Change log for snapd package in Ubuntu

snapd (2.62+20.04) focal; urgency=medium

  * New upstream release, LP: #2058277
    - Aspects based configuration schema support (experimental)
    - Refresh app awareness support for UI (experimental)
    - Support for user daemons by introducing new control switches
      --user/--system/--users for service start/stop/restart
      (experimental)
    - Add AppArmor prompting experimental flag (feature currently
      unsupported)
    - Installation of local snap components of type test
    - Packaging of components with snap pack
    - Expose experimental features supported/enabled in snapd REST API
      endpoint /v2/system-info
    - Support creating and removing recovery systems for use by factory
      reset
    - Enable API route for creating and removing recovery systems using
      /v2/systems with action create and /v2/systems/{label} with action
      remove
    - Lift requirements for fde-setup hook for single boot install
    - Enable single reboot gadget update for UC20+
    - Allow core to be removed on classic systems
    - Support for remodeling on hybrid systems
    - Install desktop files on Ubuntu Core and update after snapd
      upgrade
    - Upgrade sandbox features to account for cgroup v2 device filtering
    - Support snaps to manage their own cgroups
    - Add support for AppArmor 4.0 unconfined profile mode
    - Add AppArmor based read access to /etc/default/keyboard
    - Upgrade to squashfuse 0.5.0
    - Support useradd utility to enable removing Perl dependency for
      UC24+
    - Support for recovery-chooser to use console-conf snap
    - Add support for --uid/--gid using strace-static
    - Add support for notices (from pebble) and expose via the snapd
      REST API endpoints /v2/notices and /v2/notice
    - Add polkit authentication for snapd REST API endpoints
      /v2/snaps/{snap}/conf and /v2/apps
    - Add refresh-inhibit field to snapd REST API endpoint /v2/snaps
    - Add refresh-inhibited select query to REST API endpoint /v2/snaps
    - Take into account validation sets during remodeling
    - Improve offline remodeling to use installed revisions of snaps to
      fulfill the remodel revision requirement
    - Add rpi configuration option sdtv_mode
    - When snapd snap is not installed, pin policy ABI to 4.0 or 3.0 if
      present on host
    - Fix gadget zero-sized disk mapping caused by not ignoring zero
      sized storage traits
    - Fix gadget install case where size of existing partition was not
      correctly taken into account
    - Fix trying to unmount early kernel mount if it does not exist
    - Fix restarting mount units on snapd start
    - Fix call to udev in preseed mode
    - Fix to ensure always setting up the device cgroup for base bare
      and core24+
    - Fix not copying data from newly set homedirs on revision change
    - Fix leaving behind empty snap home directories after snap is
      removed (resulting in broken symlink)
    - Fix to avoid using libzstd from host by adding to snapd snap
    - Fix autorefresh to correctly handle forever refresh hold
    - Fix username regex allowed for system-user assertion to not allow
      '+'
    - Fix incorrect application icon for notification after autorefresh
      completion
    - Fix to restart mount units when changed
    - Fix to support AppArmor running under incus
    - Fix case of snap-update-ns dropping synthetic mounts due to
      failure to match  desired mount dependencies
    - Fix parsing of base snap version to enable pre-seeding of Ubuntu
      Core Desktop
    - Fix packaging and tests for various distributions
    - Add remoteproc interface to allow developers to interact with
      Remote Processor Framework which enables snaps to load firmware to
      ARM Cortex microcontrollers
    - Add kernel-control interface to enable controlling the kernel
      firmware search path
    - Add nfs-mount interface to allow mounting of NFS shares
    - Add ros-opt-data interface to allow snaps to access the host
      /opt/ros/ paths
    - Add snap-refresh-observe interface that provides refresh-app-
      awareness clients access to relevant snapd API endpoints
    - steam-support interface: generalize Pressure Vessel root paths and
      allow access to driver information, features and container
      versions
    - steam-support interface: make implicit on Ubuntu Core Desktop
    - desktop interface: improved support for Ubuntu Core Desktop and
      limit autoconnection to implicit slots
    - cups-control interface: make autoconnect depend on presence of
      cupsd on host to ensure it works on classic systems
    - opengl interface: allow read access to /usr/share/nvidia
    - personal-files interface: extend to support automatic creation of
      missing parent directories in write paths
    - network-control interface: allow creating /run/resolveconf
    - network-setup-control and network-setup-observe interfaces: allow
      busctl bind as required for systemd 254+
    - libvirt interface: allow r/w access to /run/libvirt/libvirt-sock-
      ro and read access to /var/lib/libvirt/dnsmasq/**
    - fwupd interface: allow access to IMPI devices (including locking
      of device nodes), sysfs attributes needed by amdgpu and the COD
      capsule update directory
    - uio interface: allow configuring UIO drivers from userspace
      libraries
    - serial-port interface: add support for NXP Layerscape SoC
    - lxd-support interface: add attribute enable-unconfined-mode to
      require LXD to opt-in to run unconfined
    - block-devices interface: add support for ZFS volumes
    - system-packages-doc interface: add support for reading jquery and
      sphinx documentation
    - system-packages-doc interface: workaround to prevent autoconnect
      failure for snaps using base bare
    - microceph-support interface: allow more types of block devices to
      be added as an OSD
    - mount-observe interface: allow read access to
      /proc/{pid}/task/{tid}/mounts and proc/{pid}/task/{tid}/mountinfo
    - polkit interface: changed to not be implicit on core because
      installing policy files is not possible
    - upower-observe interface: allow stats refresh
    - gpg-public-keys interface: allow creating lock file for certain
      gpg operations
    - shutdown interface: allow access to SetRebootParameter method
    - media-control interface: allow device file locking
    - u2f-devices interface: support for Trustkey G310H, JaCarta U2F,
      Kensington VeriMark Guard, RSA DS100, Google Titan v2

 -- Ernest Lotter <email address hidden>  Thu, 21 Mar 2024 22:06:09 +0200

Available diffs

• diff from 2.61.3+20.04 to 2.62+20.04 (1.3 MiB)

snapd (2.62+22.04) jammy; urgency=medium

  * New upstream release, LP: #2058277
    - Aspects based configuration schema support (experimental)
    - Refresh app awareness support for UI (experimental)
    - Support for user daemons by introducing new control switches
      --user/--system/--users for service start/stop/restart
      (experimental)
    - Add AppArmor prompting experimental flag (feature currently
      unsupported)
    - Installation of local snap components of type test
    - Packaging of components with snap pack
    - Expose experimental features supported/enabled in snapd REST API
      endpoint /v2/system-info
    - Support creating and removing recovery systems for use by factory
      reset
    - Enable API route for creating and removing recovery systems using
      /v2/systems with action create and /v2/systems/{label} with action
      remove
    - Lift requirements for fde-setup hook for single boot install
    - Enable single reboot gadget update for UC20+
    - Allow core to be removed on classic systems
    - Support for remodeling on hybrid systems
    - Install desktop files on Ubuntu Core and update after snapd
      upgrade
    - Upgrade sandbox features to account for cgroup v2 device filtering
    - Support snaps to manage their own cgroups
    - Add support for AppArmor 4.0 unconfined profile mode
    - Add AppArmor based read access to /etc/default/keyboard
    - Upgrade to squashfuse 0.5.0
    - Support useradd utility to enable removing Perl dependency for
      UC24+
    - Support for recovery-chooser to use console-conf snap
    - Add support for --uid/--gid using strace-static
    - Add support for notices (from pebble) and expose via the snapd
      REST API endpoints /v2/notices and /v2/notice
    - Add polkit authentication for snapd REST API endpoints
      /v2/snaps/{snap}/conf and /v2/apps
    - Add refresh-inhibit field to snapd REST API endpoint /v2/snaps
    - Add refresh-inhibited select query to REST API endpoint /v2/snaps
    - Take into account validation sets during remodeling
    - Improve offline remodeling to use installed revisions of snaps to
      fulfill the remodel revision requirement
    - Add rpi configuration option sdtv_mode
    - When snapd snap is not installed, pin policy ABI to 4.0 or 3.0 if
      present on host
    - Fix gadget zero-sized disk mapping caused by not ignoring zero
      sized storage traits
    - Fix gadget install case where size of existing partition was not
      correctly taken into account
    - Fix trying to unmount early kernel mount if it does not exist
    - Fix restarting mount units on snapd start
    - Fix call to udev in preseed mode
    - Fix to ensure always setting up the device cgroup for base bare
      and core24+
    - Fix not copying data from newly set homedirs on revision change
    - Fix leaving behind empty snap home directories after snap is
      removed (resulting in broken symlink)
    - Fix to avoid using libzstd from host by adding to snapd snap
    - Fix autorefresh to correctly handle forever refresh hold
    - Fix username regex allowed for system-user assertion to not allow
      '+'
    - Fix incorrect application icon for notification after autorefresh
      completion
    - Fix to restart mount units when changed
    - Fix to support AppArmor running under incus
    - Fix case of snap-update-ns dropping synthetic mounts due to
      failure to match  desired mount dependencies
    - Fix parsing of base snap version to enable pre-seeding of Ubuntu
      Core Desktop
    - Fix packaging and tests for various distributions
    - Add remoteproc interface to allow developers to interact with
      Remote Processor Framework which enables snaps to load firmware to
      ARM Cortex microcontrollers
    - Add kernel-control interface to enable controlling the kernel
      firmware search path
    - Add nfs-mount interface to allow mounting of NFS shares
    - Add ros-opt-data interface to allow snaps to access the host
      /opt/ros/ paths
    - Add snap-refresh-observe interface that provides refresh-app-
      awareness clients access to relevant snapd API endpoints
    - steam-support interface: generalize Pressure Vessel root paths and
      allow access to driver information, features and container
      versions
    - steam-support interface: make implicit on Ubuntu Core Desktop
    - desktop interface: improved support for Ubuntu Core Desktop and
      limit autoconnection to implicit slots
    - cups-control interface: make autoconnect depend on presence of
      cupsd on host to ensure it works on classic systems
    - opengl interface: allow read access to /usr/share/nvidia
    - personal-files interface: extend to support automatic creation of
      missing parent directories in write paths
    - network-control interface: allow creating /run/resolveconf
    - network-setup-control and network-setup-observe interfaces: allow
      busctl bind as required for systemd 254+
    - libvirt interface: allow r/w access to /run/libvirt/libvirt-sock-
      ro and read access to /var/lib/libvirt/dnsmasq/**
    - fwupd interface: allow access to IMPI devices (including locking
      of device nodes), sysfs attributes needed by amdgpu and the COD
      capsule update directory
    - uio interface: allow configuring UIO drivers from userspace
      libraries
    - serial-port interface: add support for NXP Layerscape SoC
    - lxd-support interface: add attribute enable-unconfined-mode to
      require LXD to opt-in to run unconfined
    - block-devices interface: add support for ZFS volumes
    - system-packages-doc interface: add support for reading jquery and
      sphinx documentation
    - system-packages-doc interface: workaround to prevent autoconnect
      failure for snaps using base bare
    - microceph-support interface: allow more types of block devices to
      be added as an OSD
    - mount-observe interface: allow read access to
      /proc/{pid}/task/{tid}/mounts and proc/{pid}/task/{tid}/mountinfo
    - polkit interface: changed to not be implicit on core because
      installing policy files is not possible
    - upower-observe interface: allow stats refresh
    - gpg-public-keys interface: allow creating lock file for certain
      gpg operations
    - shutdown interface: allow access to SetRebootParameter method
    - media-control interface: allow device file locking
    - u2f-devices interface: support for Trustkey G310H, JaCarta U2F,
      Kensington VeriMark Guard, RSA DS100, Google Titan v2

 -- Ernest Lotter <email address hidden>  Thu, 21 Mar 2024 22:06:09 +0200

Available diffs

• diff from 2.61.3+22.04 to 2.62+22.04 (1.3 MiB)

snapd (2.62+23.10) mantic; urgency=medium

  * New upstream release, LP: #2058277
    - Aspects based configuration schema support (experimental)
    - Refresh app awareness support for UI (experimental)
    - Support for user daemons by introducing new control switches
      --user/--system/--users for service start/stop/restart
      (experimental)
    - Add AppArmor prompting experimental flag (feature currently
      unsupported)
    - Installation of local snap components of type test
    - Packaging of components with snap pack
    - Expose experimental features supported/enabled in snapd REST API
      endpoint /v2/system-info
    - Support creating and removing recovery systems for use by factory
      reset
    - Enable API route for creating and removing recovery systems using
      /v2/systems with action create and /v2/systems/{label} with action
      remove
    - Lift requirements for fde-setup hook for single boot install
    - Enable single reboot gadget update for UC20+
    - Allow core to be removed on classic systems
    - Support for remodeling on hybrid systems
    - Install desktop files on Ubuntu Core and update after snapd
      upgrade
    - Upgrade sandbox features to account for cgroup v2 device filtering
    - Support snaps to manage their own cgroups
    - Add support for AppArmor 4.0 unconfined profile mode
    - Add AppArmor based read access to /etc/default/keyboard
    - Upgrade to squashfuse 0.5.0
    - Support useradd utility to enable removing Perl dependency for
      UC24+
    - Support for recovery-chooser to use console-conf snap
    - Add support for --uid/--gid using strace-static
    - Add support for notices (from pebble) and expose via the snapd
      REST API endpoints /v2/notices and /v2/notice
    - Add polkit authentication for snapd REST API endpoints
      /v2/snaps/{snap}/conf and /v2/apps
    - Add refresh-inhibit field to snapd REST API endpoint /v2/snaps
    - Add refresh-inhibited select query to REST API endpoint /v2/snaps
    - Take into account validation sets during remodeling
    - Improve offline remodeling to use installed revisions of snaps to
      fulfill the remodel revision requirement
    - Add rpi configuration option sdtv_mode
    - When snapd snap is not installed, pin policy ABI to 4.0 or 3.0 if
      present on host
    - Fix gadget zero-sized disk mapping caused by not ignoring zero
      sized storage traits
    - Fix gadget install case where size of existing partition was not
      correctly taken into account
    - Fix trying to unmount early kernel mount if it does not exist
    - Fix restarting mount units on snapd start
    - Fix call to udev in preseed mode
    - Fix to ensure always setting up the device cgroup for base bare
      and core24+
    - Fix not copying data from newly set homedirs on revision change
    - Fix leaving behind empty snap home directories after snap is
      removed (resulting in broken symlink)
    - Fix to avoid using libzstd from host by adding to snapd snap
    - Fix autorefresh to correctly handle forever refresh hold
    - Fix username regex allowed for system-user assertion to not allow
      '+'
    - Fix incorrect application icon for notification after autorefresh
      completion
    - Fix to restart mount units when changed
    - Fix to support AppArmor running under incus
    - Fix case of snap-update-ns dropping synthetic mounts due to
      failure to match  desired mount dependencies
    - Fix parsing of base snap version to enable pre-seeding of Ubuntu
      Core Desktop
    - Fix packaging and tests for various distributions
    - Add remoteproc interface to allow developers to interact with
      Remote Processor Framework which enables snaps to load firmware to
      ARM Cortex microcontrollers
    - Add kernel-control interface to enable controlling the kernel
      firmware search path
    - Add nfs-mount interface to allow mounting of NFS shares
    - Add ros-opt-data interface to allow snaps to access the host
      /opt/ros/ paths
    - Add snap-refresh-observe interface that provides refresh-app-
      awareness clients access to relevant snapd API endpoints
    - steam-support interface: generalize Pressure Vessel root paths and
      allow access to driver information, features and container
      versions
    - steam-support interface: make implicit on Ubuntu Core Desktop
    - desktop interface: improved support for Ubuntu Core Desktop and
      limit autoconnection to implicit slots
    - cups-control interface: make autoconnect depend on presence of
      cupsd on host to ensure it works on classic systems
    - opengl interface: allow read access to /usr/share/nvidia
    - personal-files interface: extend to support automatic creation of
      missing parent directories in write paths
    - network-control interface: allow creating /run/resolveconf
    - network-setup-control and network-setup-observe interfaces: allow
      busctl bind as required for systemd 254+
    - libvirt interface: allow r/w access to /run/libvirt/libvirt-sock-
      ro and read access to /var/lib/libvirt/dnsmasq/**
    - fwupd interface: allow access to IMPI devices (including locking
      of device nodes), sysfs attributes needed by amdgpu and the COD
      capsule update directory
    - uio interface: allow configuring UIO drivers from userspace
      libraries
    - serial-port interface: add support for NXP Layerscape SoC
    - lxd-support interface: add attribute enable-unconfined-mode to
      require LXD to opt-in to run unconfined
    - block-devices interface: add support for ZFS volumes
    - system-packages-doc interface: add support for reading jquery and
      sphinx documentation
    - system-packages-doc interface: workaround to prevent autoconnect
      failure for snaps using base bare
    - microceph-support interface: allow more types of block devices to
      be added as an OSD
    - mount-observe interface: allow read access to
      /proc/{pid}/task/{tid}/mounts and proc/{pid}/task/{tid}/mountinfo
    - polkit interface: changed to not be implicit on core because
      installing policy files is not possible
    - upower-observe interface: allow stats refresh
    - gpg-public-keys interface: allow creating lock file for certain
      gpg operations
    - shutdown interface: allow access to SetRebootParameter method
    - media-control interface: allow device file locking
    - u2f-devices interface: support for Trustkey G310H, JaCarta U2F,
      Kensington VeriMark Guard, RSA DS100, Google Titan v2

 -- Ernest Lotter <email address hidden>  Thu, 21 Mar 2024 22:06:09 +0200

Available diffs

• diff from 2.61.3+23.10 to 2.62+23.10 (1.3 MiB)

snapd (2.62+24.04build1) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <email address hidden>  Sun, 31 Mar 2024 17:14:08 +0000

Available diffs

• diff from 2.61.3+24.04 to 2.62+24.04build1 (1.3 MiB)
• diff from 2.62+24.04 to 2.62+24.04build1 (361 bytes)

snapd (2.62+24.04) noble; urgency=medium

  * New upstream release, LP: #2058277
    - Aspects based configuration schema support (experimental)
    - Refresh app awareness support for UI (experimental)
    - Support for user daemons by introducing new control switches
      --user/--system/--users for service start/stop/restart
      (experimental)
    - Add AppArmor prompting experimental flag (feature currently
      unsupported)
    - Installation of local snap components of type test
    - Packaging of components with snap pack
    - Expose experimental features supported/enabled in snapd REST API
      endpoint /v2/system-info
    - Support creating and removing recovery systems for use by factory
      reset
    - Enable API route for creating and removing recovery systems using
      /v2/systems with action create and /v2/systems/{label} with action
      remove
    - Lift requirements for fde-setup hook for single boot install
    - Enable single reboot gadget update for UC20+
    - Allow core to be removed on classic systems
    - Support for remodeling on hybrid systems
    - Install desktop files on Ubuntu Core and update after snapd
      upgrade
    - Upgrade sandbox features to account for cgroup v2 device filtering
    - Support snaps to manage their own cgroups
    - Add support for AppArmor 4.0 unconfined profile mode
    - Add AppArmor based read access to /etc/default/keyboard
    - Upgrade to squashfuse 0.5.0
    - Support useradd utility to enable removing Perl dependency for
      UC24+
    - Support for recovery-chooser to use console-conf snap
    - Add support for --uid/--gid using strace-static
    - Add support for notices (from pebble) and expose via the snapd
      REST API endpoints /v2/notices and /v2/notice
    - Add polkit authentication for snapd REST API endpoints
      /v2/snaps/{snap}/conf and /v2/apps
    - Add refresh-inhibit field to snapd REST API endpoint /v2/snaps
    - Add refresh-inhibited select query to REST API endpoint /v2/snaps
    - Take into account validation sets during remodeling
    - Improve offline remodeling to use installed revisions of snaps to
      fulfill the remodel revision requirement
    - Add rpi configuration option sdtv_mode
    - When snapd snap is not installed, pin policy ABI to 4.0 or 3.0 if
      present on host
    - Fix gadget zero-sized disk mapping caused by not ignoring zero
      sized storage traits
    - Fix gadget install case where size of existing partition was not
      correctly taken into account
    - Fix trying to unmount early kernel mount if it does not exist
    - Fix restarting mount units on snapd start
    - Fix call to udev in preseed mode
    - Fix to ensure always setting up the device cgroup for base bare
      and core24+
    - Fix not copying data from newly set homedirs on revision change
    - Fix leaving behind empty snap home directories after snap is
      removed (resulting in broken symlink)
    - Fix to avoid using libzstd from host by adding to snapd snap
    - Fix autorefresh to correctly handle forever refresh hold
    - Fix username regex allowed for system-user assertion to not allow
      '+'
    - Fix incorrect application icon for notification after autorefresh
      completion
    - Fix to restart mount units when changed
    - Fix to support AppArmor running under incus
    - Fix case of snap-update-ns dropping synthetic mounts due to
      failure to match  desired mount dependencies
    - Fix parsing of base snap version to enable pre-seeding of Ubuntu
      Core Desktop
    - Fix packaging and tests for various distributions
    - Add remoteproc interface to allow developers to interact with
      Remote Processor Framework which enables snaps to load firmware to
      ARM Cortex microcontrollers
    - Add kernel-control interface to enable controlling the kernel
      firmware search path
    - Add nfs-mount interface to allow mounting of NFS shares
    - Add ros-opt-data interface to allow snaps to access the host
      /opt/ros/ paths
    - Add snap-refresh-observe interface that provides refresh-app-
      awareness clients access to relevant snapd API endpoints
    - steam-support interface: generalize Pressure Vessel root paths and
      allow access to driver information, features and container
      versions
    - steam-support interface: make implicit on Ubuntu Core Desktop
    - desktop interface: improved support for Ubuntu Core Desktop and
      limit autoconnection to implicit slots
    - cups-control interface: make autoconnect depend on presence of
      cupsd on host to ensure it works on classic systems
    - opengl interface: allow read access to /usr/share/nvidia
    - personal-files interface: extend to support automatic creation of
      missing parent directories in write paths
    - network-control interface: allow creating /run/resolveconf
    - network-setup-control and network-setup-observe interfaces: allow
      busctl bind as required for systemd 254+
    - libvirt interface: allow r/w access to /run/libvirt/libvirt-sock-
      ro and read access to /var/lib/libvirt/dnsmasq/**
    - fwupd interface: allow access to IMPI devices (including locking
      of device nodes), sysfs attributes needed by amdgpu and the COD
      capsule update directory
    - uio interface: allow configuring UIO drivers from userspace
      libraries
    - serial-port interface: add support for NXP Layerscape SoC
    - lxd-support interface: add attribute enable-unconfined-mode to
      require LXD to opt-in to run unconfined
    - block-devices interface: add support for ZFS volumes
    - system-packages-doc interface: add support for reading jquery and
      sphinx documentation
    - system-packages-doc interface: workaround to prevent autoconnect
      failure for snaps using base bare
    - microceph-support interface: allow more types of block devices to
      be added as an OSD
    - mount-observe interface: allow read access to
      /proc/{pid}/task/{tid}/mounts and proc/{pid}/task/{tid}/mountinfo
    - polkit interface: changed to not be implicit on core because
      installing policy files is not possible
    - upower-observe interface: allow stats refresh
    - gpg-public-keys interface: allow creating lock file for certain
      gpg operations
    - shutdown interface: allow access to SetRebootParameter method
    - media-control interface: allow device file locking
    - u2f-devices interface: support for Trustkey G310H, JaCarta U2F,
      Kensington VeriMark Guard, RSA DS100, Google Titan v2

 -- Ernest Lotter <email address hidden>  Thu, 21 Mar 2024 22:06:09 +0200

Available diffs

• diff from 2.61.3+24.04 to 2.62+24.04 (1.3 MiB)

snapd (2.61.3+20.04) focal; urgency=medium

  * New upstream release, LP: #2039017
    - Install systemd files in correct location for 24.04

 -- Ernest Lotter <email address hidden>  Wed, 06 Mar 2024 23:18:11 +0200

Available diffs

• diff from 2.58+20.04.1 (in ~ubuntu-security-proposed/ubuntu/ppa) to 2.61.3+20.04 (2.3 MiB)
• diff from 2.58+20.04 to 2.61.3+20.04 (2.3 MiB)

snapd (2.61.3+22.04) jammy; urgency=medium

  * New upstream release, LP: #2039017
    - Install systemd files in correct location for 24.04

 -- Ernest Lotter <email address hidden>  Wed, 06 Mar 2024 23:18:11 +0200

Available diffs

• diff from 2.58+22.04.1 (in ~ubuntu-security-proposed/ubuntu/ppa) to 2.61.3+22.04 (2.3 MiB)
• diff from 2.58+22.04 to 2.61.3+22.04 (2.3 MiB)

snapd (2.61.3+23.10) mantic; urgency=medium

  * New upstream release, LP: #2039017
    - Install systemd files in correct location for 24.04

 -- Ernest Lotter <email address hidden>  Wed, 06 Mar 2024 23:18:11 +0200

Available diffs

• diff from 2.60.4+23.10.1 to 2.61.3+23.10 (1.0 MiB)

snapd (2.61.3+24.04) noble; urgency=medium

  * New upstream release, LP: #2039017
    - Install systemd files in correct location for 24.04

Available diffs

• diff from 2.60.4+23.10 to 2.61.3+24.04 (1.0 MiB)

snapd (2.59.1+23.04ubuntu1.2) lunar; urgency=medium

  [ Valentin David ]
  * cmd/snapd-generator: read mountinfo for pid 1 (LP: #2039268)

 -- Steve Langasek <email address hidden>  Thu, 26 Oct 2023 13:03:02 -0700

Available diffs

• diff from 2.59.1+23.04ubuntu1.1 (in ~ubuntu-security-proposed/ubuntu/ppa) to 2.59.1+23.04ubuntu1.2 (732 bytes)
• diff from 2.60.2+23.04 to 2.59.1+23.04ubuntu1.2 (559.2 KiB)

snapd (2.60.4+23.10.1) mantic; urgency=medium

  [ Valentin David ]
  * cmd/snapd-generator: read mountinfo for pid 1 (LP: #2039268)

 -- Steve Langasek <email address hidden>  Thu, 26 Oct 2023 13:25:44 -0700

Available diffs

• diff from 2.60.4+23.10 to 2.60.4+23.10.1 (662 bytes)

snapd (2.60.4+23.10) mantic; urgency=medium

  * New upstream release, LP: #2024007
    - i/b/qualcomm_ipc_router.go: switch to plug/slot and add socket
      permission
    - interfaces/builtin: fix custom-device udev KERNEL values
    - overlord: allow the firmware-updater snap to install user daemons
    - interfaces: allow loopback as a block-device

 -- Michael Vogt <email address hidden>  Fri, 15 Sep 2023 20:46:59 +0200

Available diffs

• diff from 2.60.3+23.10.1 to 2.60.4+23.10 (23.1 KiB)

snapd (2.60.3+23.10.1) mantic; urgency=medium

  [ Sebastien Bacher ]
  * debian/patches/firmware-updater.patch:
    - cherry pick an upstream change to allow us to install firmware-updater
      despite its use of the experimental dbus user daemon feature

 -- Michael Vogt <email address hidden>  Mon, 11 Sep 2023 12:51:35 +0200

Available diffs

• diff from 2.60.2+23.10.1 to 2.60.3+23.10.1 (18.4 KiB)

snapd (2.60.2+23.10.1) mantic; urgency=medium

  * debian/patches/firmware-updater.patch:
    - cherry pick an upstream change to allow us to install firmware-updater
      despite its use of the experimental dbus user daemon feature

 -- Sebastien Bacher <email address hidden>  Wed, 30 Aug 2023 16:10:23 +0200

Available diffs

• diff from 2.60.2+23.10 to 2.60.2+23.10.1 (1.5 KiB)

snapd (2.60.2+23.04) lunar; urgency=medium

  * New upstream release, LP: #2024007
    - i/builtin: allow directories in private /dev/shm
    - i/builtin: add read access to /proc/task/schedstat in system-
      observe
    - snap-bootstrap: print version information at startup
    - go.mod: update gopkg.in/yaml.v3 to v3.0.1 to fix CVE-2022-28948
    - snap, store: filter out invalid snap edited links from store info
      and persisted state
    - o/configcore: write netplan defaults to 00-snapd-config on seeding
    - snapcraft.yaml: pull in apparmor_parser optimization patches from
      https://gitlab.com/apparmor/apparmor/-/merge_requests/711
    - snap-confine: fix missing \0 after readlink
    - cmd/snap: hide append-integrity-data
    - interfaces/opengl: add support for ARM Mali

 -- Michael Vogt <email address hidden>  Fri, 04 Aug 2023 12:14:04 +0200

Available diffs

• diff from 2.59.1+23.04ubuntu1 to 2.60.2+23.04 (562.6 KiB)

snapd (2.60.2+23.10) mantic; urgency=medium

  * New upstream release, LP: #2024007
    - i/builtin: allow directories in private /dev/shm
    - i/builtin: add read access to /proc/task/schedstat in system-
      observe
    - snap-bootstrap: print version information at startup
    - go.mod: update gopkg.in/yaml.v3 to v3.0.1 to fix CVE-2022-28948
    - snap, store: filter out invalid snap edited links from store info
      and persisted state
    - o/configcore: write netplan defaults to 00-snapd-config on seeding
    - snapcraft.yaml: pull in apparmor_parser optimization patches from
      https://gitlab.com/apparmor/apparmor/-/merge_requests/711
    - snap-confine: fix missing \0 after readlink
    - cmd/snap: hide append-integrity-data
    - interfaces/opengl: add support for ARM Mali

 -- Michael Vogt <email address hidden>  Fri, 04 Aug 2023 12:14:04 +0200

Available diffs

• diff from 2.60.1+23.10 to 2.60.2+23.10 (17.3 KiB)

snapd (2.60.1+23.10) mantic; urgency=medium

  * New upstream release, LP: #2024007
    - install: fallback to lazy unmount() in writeFilesystemContent
    - data: include "modprobe.d" and "modules-load.d" in preseeded blob
    - gadget: fix install test on armhf
    - interfaces: fix typo in network_manager_observe
    - sandbox/apparmor: don't let vendored apparmor conflict with system
    - gadget/update: set parts in laid out data from the ones matched
    - many: move SnapConfineAppArmorDir from dirs to sandbox/apparmor
    - many: stop using `-O no-expr-simplify` in apparmor_parser
    - go.mod: update secboot to latest uc22 branch

 -- Michael Vogt <email address hidden>  Tue, 04 Jul 2023 21:21:48 +0200

Available diffs

• diff from 2.60+23.10 to 2.60.1+23.10 (17.6 KiB)

snapd (2.60+23.10) mantic; urgency=medium

  * New upstream release, LP: #2024007
    - Support for dynamic snapshot data exclusions
    - Apparmor userspace is vendored inside the snapd snap
    - Added a default-configure hook that exposes gadget default
      configuration options to snaps during first install before
      services are started
    - Allow install from initrd to speed up the initial installation
      for systems that do not have a install-device hook
    - New `snap sign --chain` flag that appends the account and
      account-key assertions
    - Support validation-sets in the model assertion
    - Support new "min-size" field in gadget.yaml
    - New interface: "userns"

 -- Michael Vogt <email address hidden>  Thu, 15 Jun 2023 17:14:31 +0200

Available diffs

• diff from 2.59.1+23.04ubuntu2 to 2.60+23.10 (534.4 KiB)

snapd (2.58+18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: possible sandbox escape via TIOCLINUX ioctl
    - interfaces/seccomp/template.go: block ioctl with TIOCLINUX. Patch
      from upstream. Graphical terminal emulators like xterm, gnome-terminal
      and others are not affected - this can only be exploited when snaps
      are run on a virtual console.
    - https://github.com/snapcore/snapd/pull/12849
    - CVE-2023-1523

 -- Alex Murray <email address hidden>  Mon, 29 May 2023 21:40:12 +0930

Available diffs

• diff from 2.58+18.04 (in Ubuntu) to 2.58+18.04.1 (5.2 KiB)
• diff from 2.57.5+18.04ubuntu0.1 (in ~ubuntu-security/ubuntu/ppa) to 2.58+18.04.1 (468.9 KiB)
• diff from 2.54.3+18.04.2ubuntu0.2 to 2.58+18.04.1 (2.5 MiB)

snapd (2.58+20.04.1) focal-security; urgency=medium

  * SECURITY UPDATE: possible sandbox escape via TIOCLINUX ioctl
    - interfaces/seccomp/template.go: block ioctl with TIOCLINUX. Patch
      from upstream. Graphical terminal emulators like xterm, gnome-terminal
      and others are not affected - this can only be exploited when snaps
      are run on a virtual console.
    - https://github.com/snapcore/snapd/pull/12849
    - CVE-2023-1523

 -- Alex Murray <email address hidden>  Mon, 29 May 2023 21:39:27 +0930

Available diffs

• diff from 2.58+20.04 (in Ubuntu) to 2.58+20.04.1 (5.2 KiB)
• diff from 2.57.5+20.04ubuntu0.1 (in ~ubuntu-security/ubuntu/ppa) to 2.58+20.04.1 (468.9 KiB)
• diff from 2.54.3+20.04.1ubuntu0.2 to 2.58+20.04.1 (2.5 MiB)

snapd (2.58+22.04.1) jammy-security; urgency=medium

  * SECURITY UPDATE: possible sandbox escape via TIOCLINUX ioctl
    - interfaces/seccomp/template.go: block ioctl with TIOCLINUX. Patch
      from upstream. Graphical terminal emulators like xterm, gnome-terminal
      and others are not affected - this can only be exploited when snaps
      are run on a virtual console.
    - https://github.com/snapcore/snapd/pull/12849
    - CVE-2023-1523

 -- Alex Murray <email address hidden>  Mon, 29 May 2023 21:38:22 +0930

Available diffs

• diff from 2.58+22.04 (in Ubuntu) to 2.58+22.04.1 (5.2 KiB)
• diff from 2.57.5+22.04ubuntu0.1 (in ~ubuntu-security/ubuntu/ppa) to 2.58+22.04.1 (468.9 KiB)
• diff from 2.55.3+22.04 (in Ubuntu) to 2.58+22.04.1 (2.1 MiB)

snapd (2.58+22.10.1) kinetic-security; urgency=medium

  * SECURITY UPDATE: possible sandbox escape via TIOCLINUX ioctl
    - interfaces/seccomp/template.go: block ioctl with TIOCLINUX. Patch
      from upstream. Graphical terminal emulators like xterm, gnome-terminal
      and others are not affected - this can only be exploited when snaps
      are run on a virtual console.
    - https://github.com/snapcore/snapd/pull/12849
    - CVE-2023-1523

 -- Alex Murray <email address hidden>  Mon, 29 May 2023 21:35:05 +0930

Available diffs

• diff from 2.58+22.10 (in Ubuntu) to 2.58+22.10.1 (5.2 KiB)
• diff from 2.57.5+22.10ubuntu0.1 (in ~ubuntu-security/ubuntu/ppa) to 2.58+22.10.1 (468.9 KiB)
• diff from 2.57.4+22.10ubuntu1 (in Ubuntu) to 2.58+22.10.1 (510.1 KiB)

snapd (2.59.1+23.04ubuntu1.1) lunar-security; urgency=medium

  * SECURITY UPDATE: possible sandbox escape via TIOCLINUX ioctl
    - interfaces/seccomp/template.go: block ioctl with TIOCLINUX. Patch
      from upstream. Graphical terminal emulators like xterm, gnome-terminal
      and others are not affected - this can only be exploited when snaps
      are run on a virtual console.
    - https://github.com/snapcore/snapd/pull/12849
    - CVE-2023-1523

 -- Alex Murray <email address hidden>  Mon, 29 May 2023 15:15:18 +0930

Available diffs

• diff from 2.59.1+23.04ubuntu1 (in Ubuntu) to 2.59.1+23.04ubuntu1.1 (5.2 KiB)

snapd (2.59.1+23.04ubuntu2) mantic; urgency=medium

  * SECURITY UPDATE: possible sandbox escape via TIOCLINUX ioctl
    - interfaces/seccomp/template.go: block ioctl with TIOCLINUX. Patch
      from upstream. Graphical terminal emulators like xterm, gnome-terminal
      and others are not affected - this can only be exploited when snaps
      are run on a virtual console.
    - https://github.com/snapcore/snapd/pull/12849
    - CVE-2023-1523

 -- Alex Murray <email address hidden>  Mon, 29 May 2023 13:53:02 +0930

Available diffs

• diff from 2.59.1+23.04ubuntu1 to 2.59.1+23.04ubuntu2 (5.2 KiB)

snapd (2.59.1+23.04ubuntu1) lunar; urgency=medium

  * Cherry pick commit 0a66c2f9fa to fix missing startup of a
    user service (LP: #2015468)

 -- Michael Vogt <email address hidden>  Thu, 06 Apr 2023 13:35:46 +0200

Available diffs

• diff from 2.59.1+23.04 to 2.59.1+23.04ubuntu1 (1.0 KiB)

snapd (2.59.1+23.04) lunar; urgency=medium

  * New upstream release, LP: #2009946
    - Add udev rules from steam-devices to steam-support interface
    - Bugfixes for layout path checking, dm_crypt permissions,
      mount-control interface parameter checking, kernel commandline
      parsing, docker-support, refresh-app-awareness

 -- Michael Vogt <email address hidden>  Tue, 28 Mar 2023 20:58:44 +0200

Available diffs

• diff from 2.58.3+23.04ubuntu1 to 2.59.1+23.04 (934.5 KiB)

snapd (2.58.3+23.04ubuntu1) lunar; urgency=medium

  * Cherry pick a fix from James Henstridge to grant access to new ibus
    socket location in desktop-legacy,fixes text input isn't working anymore
    in the firefox snap with glib 2.75 (lp: #2008279)

 -- Sebastien Bacher <email address hidden>  Wed, 08 Mar 2023 13:50:10 +0100

Available diffs

• diff from 2.58.2+23.04 to 2.58.3+23.04ubuntu1 (11.5 KiB)
• diff from 2.58.3+23.04 to 2.58.3+23.04ubuntu1 (672 bytes)

snapd (2.58.3+23.04) lunar; urgency=medium

  * New upstream release, LP: #1998462
    - interfaces/screen-inhibit-control: Add support for xfce-power-
      manager
    - interfaces/network-manager: do not show ptrace read
      denials
    - interfaces: relax rules for mount-control `what` for functionfs
    - cmd/snap-bootstrap: add support for snapd_system_disk
    - interfaces/modem-manager: add net_admin capability
    - interfaces/network-manager: add permission for OpenVPN
    - httputil: fix checking x509 certification error on go 1.20
    - i/b/fwupd: allow reading host os-release
    - boot: on classic+modes `MarkBootSuccessfull` does not need a base
    - boot: do not include `base=` in modeenv for classic+modes installs
    - tests: add spread test that validates revert on boot for core does
      not happen on classic+modes
    - snapstate: only take boot participants into account in
      UpdateBootRevisions
    - snapstate: refactor UpdateBootRevisions() to make it easier to
      check for boot.SnapTypeParticipatesInBoot()

 -- Michael Vogt <email address hidden>  Tue, 21 Feb 2023 17:14:50 +0100

Available diffs

• diff from 2.58.2+23.04 to 2.58.3+23.04 (11.0 KiB)

snapd (2.58.2+23.04) lunar; urgency=medium

  * New upstream release, LP: #1998462
    - bootloader: fix dirty build by hardcoding copyright year

 -- Michael Vogt <email address hidden>  Wed, 25 Jan 2023 20:02:08 +0100

Available diffs

• diff from 2.57.5+23.04ubuntu0.1 to 2.58.2+23.04 (498.2 KiB)
• diff from 2.58.1+23.04 to 2.58.2+23.04 (2.4 KiB)

snapd (2.58.1+23.04) lunar; urgency=medium

  * New upstream release, LP: #1998462
    - secboot: detect lockout mode in CheckTPMKeySealingSupported
    - cmd/snap-update-ns: prevent keeping unneeded mountpoints
    - o/snapstate: do not infinitely retry when an update fails during
      seeding
    - interfaces/modem-manager: add permissions for NETLINK_ROUTE
    - systemd/emulation.go: use `systemctl --root` to enable/disable
    - snap: provide more error context in `NotSnapError`
    - interfaces: add read access to /run for cryptsetup
    - boot: avoid reboot loop if there is a bad try kernel
    - devicestate: retry serial acquire on time based certificate
      errors
    - o/devicestate: run systemctl daemon-reload after install-device
      hook
    - cmd/snap,daemon: add 'held' to notes in 'snap list'
    - o/snapshotstate: check snapshots are self-contained on import
    - cmd/snap: show user+gating hold info in 'snap info'
    - daemon: expose user and gating holds at /v2/snaps/{name}

 -- Michael Vogt <email address hidden>  Mon, 23 Jan 2023 18:03:40 +0100

Available diffs

• diff from 2.58+23.04 to 2.58.1+23.04 (31.4 KiB)

snapd (2.58+22.10) kinetic; urgency=medium

  * New upstream release, LP: #1998462
    - many: Use /tmp/snap-private-tmp for per-snap private tmps
    - data: Add systemd-tmpfiles configuration to create private tmp dir
    - cmd/snap: test allowed and forbidden refresh hold values
    - cmd/snap: be more consistent in --hold help and err messages
    - cmd/snap: error on refresh holds that are negative or too short
    - o/homedirs: make sure we do not write to /var on build time
    - image: make sure file customizations happen also when we have
      defaultscause
    - tests/fde-on-classic: set ubuntu-seed label in seed partitions
    - gadget: system-seed-null should also have fs label ubuntu-seed
    - many: gadget.HasRole, ubuntu-seed can come also from system-seed-
      null
    - o/devicestate: fix paths for retrieving recovery key on classic
    - cmd/snap-confine: do not discard const qualifier
    - interfaces: allow python3.10+ in the default template
    - o/restart: fix PendingForSystemRestart
    - interfaces: allow wayland slot snaps to access shm files created
      by Firefox
    - o/assertstate: add Sequence() to val set tracking
    - o/assertstate: set val set 'Current' to pinned sequence
    - tests: tweak the libvirt interface test to work on 22.10
    - tests: use system-seed-null role on classic with modes tests
    - boot: add directory for data on install
    - o/devicestate: change some names from esp to seed/seed-null
    - gadget: add system-seed-null role
    - o/devicestate: really add error to new error message
    - restart,snapstate: implement reboot-required notifications on
      classic
    - many: avoid automatic system restarts on classic through new
      overlord/restart logic
    - release: Fix WSL detection in LXD
    - o/state: introduce WaitStatus
    - interfaces: Fix desktop interface rules for document portal
    - client: remove classic check for `snap recovery --show-
      keys`
    - many: create snapd.mounts targets to schedule mount units
    - image: enable sysfs overlay for UC preseeding
    - i/b/network-control: add permissions for using AF_XDP
    - i/apparmor: move mocking of home and overlay conditions to osutil
    - tests/main/degraded: ignore man-db update failures in CentOS
    - cmd/snap: fix panic when running snap w/ flag but w/o subcommand
    - tests: save snaps generated during image preaparation
    - tests: skip building snapd based on new env var
    - client: remove misleading comments in ValidateApplyOptions
    - boot/seal: add debug traces for bootchains
    - bootloader/assets: fix grub.cfg when there are no labels
    - cmd/snap: improve refresh hold's output
    - packaging: enable BPF in RHEL9
    - packaging: do not traverse filesystems in postrm script
    - tests: get microk8s from another branch
    - bootloader: do not specify Core version in grub entry
    - many: refresh --hold follow-up
    - many: support refresh hold/unhold to API and CLI
    - many: expand fully handling links mapping in all components, in
      the API and in snap info
    - snap/system_usernames,tests: Azure IoT Edge system usernames
    - interface: Allow access to
      org.freedesktop.DBus.ListActivatableNames via system-observe
      interface
    - o/devicestate,daemon: use the expiration date from the assertion
      in user-state and REST api (user-removal 4/n)
    - gadget: add unit tests for new install functions for FDE on
      classic
    - cmd/snap-seccomp: fix typo in AF_XDP value
    - tests/connected-after-reboot-revert: run also on UC16
    - kvm: allow read of AMD-SEV parameters
    - data: tweak apt integration config var
    - o/c/configcore: add faillock configuration
    - tests: use dbus-daemon instead of dbus-launch
    - packaging: remove unclean debian-sid patch
    - asserts: add keyword 'user-presence' keyword in system-user
      assertion (auto-removal 3/n)
    - interfaces: steam-support allow pivot /run/media and /etc/nvidia
      mount
    - aspects: initial code
    - overlord: process auto-import assertion at first boot
    - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
    - tests: fix lxd-mount-units in ubuntu kinetic
    - tests: new variable used to configure the kernel command line in
      nested tests
    - go.mod: update to newer secboot/uc22 branch
    - autopkgtests: fix running autopkgtest on kinetic
    - tests: remove squashfs leftovers in fakeinstaller
    - tests: create partition table in fakeinstaller
    - o/ifacestate: introduce DebugAutoConnectCheck hook
    - tests: use test-snapd-swtpm instead of swtpm-mvo snap in nested
      helper
    - interfaces/polkit: do not require polkit directory if no file is
      needed
    - o/snapstate: be consistent not creating per-snap save dirs for
      classic models
    - inhibit: use hintFile()
    - tests: use `snap prepare-image` in fde-on-classic mk-image.sh
    - interfaces: add microceph interface
    - seccomp: allow opening XDP sockets
    - interfaces: allow access to icon subdirectories
    - tests: add minimal-smoke test for UC22 and increase minimal RAM
    - overlord: introduce hold levels in the snapstate.Hold* API
    - o/devicestate: support mounting ubuntu-save also on classic with
      modes
    - interfaces: steam-support allow additional mounts
    - fakeinstaller: format SystemDetails result with %+v
    - cmd/libsnap-confine-private: do not panic on chmod failure
    - tests: ensure that fakeinstaller put the seed into the right place
    - many: add stub services for prompting
    - tests: add libfwupd and libfwupdplugin5 to openSUSE dependencies
    - o/snapstate: fix snaps-hold pruning/reset in the presence of
      system holding
    - many: add support for setting up encryption from installer
    - many: support classic snaps in the context of classic and extended
      models
    - cmd/snap,daemon: allow zero values from client to daemon for
      journal rate limit
    - boot,o/devicestate: extend HasFDESetupHook to consider unrelated
      kernels
    - cmd/snap: validation set refresh-enforce CLI support + spread test
    - many: fix filenames written in modeenv for base/gadget plus drive-
      by TODO
    - seed: fix seed test to use a pseudo-random byte sequence
    - cmd/snap-confine: remove setuid calls from cgroup init code
    - boot,o/devicestate: introduce and use MakeRunnableStandaloneSystem
    - devicestate,boot,tests: make `fakeinstaller` test work
    - store: send Snap-Device-Location header with cloud information
    - overlord: fix unit tests after merging master in
    - o/auth: move HasUserExpired into UserState and name it HasExpired,
      and add unit tests for this
    - o/auth: rename NewUserData to NewUserParams
    - many: implementation of finish install step handlers
    - overlord: auto-resolve validation set enforcement constraints
    - i/backends,o/ifacestate: cleanup backends.All
    - cmd/snap-confine: move bind-mount setup into separate function
    - tests/main/mount-ns: update namespace for 18.04
    - o/state: Hold pseudo-error for explicit holding, concept of
      pending changes in prune logic
    - many: support extended classic models that omit kernel/gadget
    - data/selinux: allow snapd to detect WSL
    - overlord: add code to remove users that has an expiration date set
    - wrappers,snap/quota: clear LogsDirectory= in the service unit for
      journal namespaces
    - daemon: move user add, remove operations to overlord device state
    - gadget: implement write content from gadget information
    - {device,snap}state: fix ineffectual assignments
    - daemon: support validation set refresh+enforce in API
    - many: rename AddAffected* to RegisterAffected*, add
      Change|State.Has, fix a comment
    - many: reset store session when setting proxy.store
    - overlord/ifacestate: fix conflict detection of auto-connection
    - interfaces: added read/write access to /proc/self/coredump_filter
      for process-control
    - interfaces: add read access to /proc/cgroups and
      /proc/sys/vm/swappiness to system-observe
    - fde: run fde-reveal-key with `DefaultDependencies=no`
    - many: don't concatenate non-constant format strings
    - o/devicestate: fix non-compiling test
    - release, snapd-apparmor: fixed outdated WSL detection
    - many: add todos discussed in the review in
      tests/nested/manual/fde-on-classic, snapstate cleanups
    - overlord: run install-device hook during factory reset
    - i/b/mount-control: add optional `/` to umount rules
    - gadget/install: split Run in several functions
    - o/devicestate: refactor some methods as preparation for install
      steps implementation
    - tests: fix how snaps are cached in uc22
    - tests/main/cgroup-tracking-failure: fix rare failure in Xenial and
      Bionic
    - many: make {Install,Initramfs}{{,Host},Writable}Dir a  function
    - tests/nested/manual/core20: fix manual test after changes to
      'tests.nested exec'
    - tests: move the unit tests system to 22.04 in github actions
      workflow
    - tests: fix nested errors uc20
    - boot: rewrite switch in SnapTypeParticipatesInBoot()
    - gadget: refactor to allow usage from the installer
    - overlord/devicestate: support for mounting ubuntu-save before the
      install-device hook
    - many: allow to install/update kernels/gadgets on classic with
      modes
    - tests: fix issues related to dbus session and localtime in uc18
    - many: support home dirs located deeper under /home
    - many: refactor tests to use explicit strings instead of
      boot.Install{Initramfs,Host}{Writable,FDEData}Dir
    - boot: add factory-reset cases for boot-flags
    - tests: disable quota tests on arm devices using ubuntu core
    - tests: fix unbound SPREAD_PATH variable on nested debug session
    - overlord: start turning restart into a full state manager
    - boot: apply boot logic also for classic with modes boot snaps
    - tests: fix snap-env test on debug section when no var files were
      created
    - overlord,daemon: allow returning errors when requesting a restart
    - interfaces: login-session-control: add further D-Bus interfaces
    - snapdenv: added wsl to userAgent
    - o/snapstate: support running multiple ops transactionally
    - store: use typed valset keys in store package
    - daemon: add `ensureStateSoon()` when calling systems POST api
    - gadget: add rules for validating classic with modes gadget.yaml
      files
    - wrappers: journal namespaces did not honor journal.persistent
    - many: stub devicestate.Install{Finish,SetupStorageEncryption}()
    - sandbox/cgroup: don't check V1 cgroup if V2 is active
    - seed: add support to load auto import assertion
    - tests: fix preseed tests for arm systems
    - include/lk: update LK recovery environment definition to include
      device lock state used by bootloader
    - daemon: return `storage-encryption` in /systems/<label> reply
    - tests: start using remote tools from snapd-testing-tools project
      in nested tests
    - tests: fix non mountable filesystem error in interfaces-udisks2
    - client: clarify what InstallStep{SetupStorageEncryption,Finish} do
    - client: prepare InstallSystemOptions for real use
    - usersession: Remove duplicated struct
    - o/snapstate: support specific revisions in UpdateMany/InstallMany
    - i/b/system_packages_doc: restore access to Libreoffice
      documentation
    - snap/quota,wrappers: allow using 0 values for the journal rate
      limit
    - tests: add kinetic images to the gce bucket for preseed test
    - multiple: clear up naming convention for thread quota
    - daemon: implement stub `"action": "install"`
    - tests/main/snap-quota-{install/journal}: fix unstable spread tests
    - tests: remove code for old systems not supported anymore
    - tests: third part of the nested helper cleanup
    - image: clean snapd mount after preseeding
    - tests: use the new ubuntu kinetic image
    - i/b/system_observe: honour root dir when checking for
      /boot/config-*
    - tests: restore microk8s test on 16.04
    - tests: run spread tests on arm64 instances in google cloud
    - tests: skip interfaces-udisks2 in fedora
    - asserts,boot,secboot: switch to a secboot version measuring
      classic
    - client: add API for GET /systems/<label>
    - overlord: frontend for --quota-group support (2/2)
    - daemon: add GET support for `/systems/<seed-label>`
    - i/b/system-observe: allow reading processes security label
    - many: support '--purge' when removing multiple snaps
    - snap-confine: remove obsolete code
    - interfaces: rework logic of unclashMountEntries
    - data/systemd/Makefile: add comment warning about "snapd." prefix
    - interfaces: grant access to speech-dispatcher socket (bug 1787245)
    - overlord/servicestate: disallow removal of quota group with any
      limits set
    - data: include snapd/mounts in preseeded blob
    - many: Set SNAPD_APPARMOR_REEXEC=1
    - store/tooling,tests: support UBUNTU_STORE_URL override env var
    - multiple: clear up naming convention for cpu-set quota
    - tests: improve and standardize debug section on tests
    - device: add new DeviceManager.encryptionSupportInfo()
    - tests: check snap download with snapcraft v7+ export-login auth
      data
    - cmd/snap-bootstrap: changes to be able to boot classic rootfs
    - tests: fix debug section for test uc20-create-partitions
    - overlord: --quota-group support (1/2)
    - asserts,cmd/snap-repair: drop not pursued
      AuthorityDelegation/signatory-id
    - snap-bootstrap: add CVM mode* snap-bootstrap: add classic runmode
    - interfaces: make polkit implicit on core if /usr/libexec/polkitd
      exists
    - multiple: move arguments for auth.NewUser into a struct (auto-
      removal 1/n)
    - overlord: track security profiles for non-active snaps
    - tests: remove NESTED_IMAGE_ID from nested manual tests
    - tests: add extra space to ubuntu bionic
    - store/tooling: support using snapcraft v7+ base64-encoded auth
      data
    - overlord: allow seeding in the case of classic with modes system
    - packaging/*/tests/integrationtests: reload ssh.service, not
      sshd.service
    - tests: rework snap-logs-journal test and add missing cleanup
    - tests: add spread test for journal quotas
    - tests: run spread tests in ubuntu kinetic
    - o/snapstate: extend support for holding refreshes
    - devicestate: return an error in checkEncryption() if KernelInfo
      fails
    - tests: fix sbuild test on debian sid
    - o/devicestate: do not run tests in this folder twice
    - sandbox/apparmor: remove duplicate hook into testing package
    - many: refactor store code to be able to use simpler form of auth
      creds
    - snap,store: drop support/consideration for anonymous download urls
    - data/selinux: allow snaps to read certificates
    - many: add Is{Core,Classic}Boot() to DeviceContext
    - o/assertstate: don't refresh enforced validation sets during check
    - go.mod: replace maze.io/x/crypto with local repo
    - many: fix unnecessary use of fmt.Sprintf
    - bootloader,systemd: fix `don't use Yoda conditions (ST1017)`
    - HACKING.md: extend guidelines with common review comments
    - many: progress bars should use the overridable stdouts
    - tests: remove ubuntu 21.10 from sru validation
    - tests: import remote tools
    - daemon,usersession: switch from HeaderMap to Header in tests
    - asserts: add some missing `c.Check()` in the asserts test
    - strutil: fix VersionCompare() to allow multiple `-` in the version
    - testutil: remove unneeded `fmt.Sprintf`
    - boot: remove some unneeded `fmt.Sprintf()` calls
    - tests: implement prepare_gadget and prepare_base and unify all the
      version
    - o/snapstate: refactor managed refresh schedule logic
    - o/assertstate, snapasserts: implementation of
      assertstate.TryEnforceValidationSets function
    - interfaces: add kconfig paths to system-observe
    - dbusutil: move debian patch into dbustest
    - many: change name and input of CheckProvenance to clarify usage
    - tests: Fix a missing parameter in command to wait for device
    - tests: Work-around non-functional --wait on systemctl
    - tests: unify the way the snapd/core and kernel are repacked in
      nested helper
    - tests: skip interfaces-ufisks2 on centos-9
    - i/b/mount-control: allow custom filesystem types
    - interfaces,metautil: make error handling in getPaths() more
      targeted
    - cmd/snap-update-ns: handle mountpoint removal failures with EBUSY
    - tests: fix pc-kernel repacking
    - systemd: add `WantedBy=default.target` to snap mount units
    - tests: disable microk8s test on 16.04

 -- Michael Vogt <email address hidden>  Thu, 01 Dec 2022 09:52:23 +0100

Available diffs

• diff from 2.57.5+22.10ubuntu0.1 (in ~ubuntu-security/ubuntu/ppa) to 2.58+22.10 (464.1 KiB)
• diff from 2.57.5+22.10 to 2.58+22.10 (471.6 KiB)

snapd (2.58+18.04) bionic; urgency=medium

  * New upstream release, LP: #1998462
    - many: Use /tmp/snap-private-tmp for per-snap private tmps
    - data: Add systemd-tmpfiles configuration to create private tmp dir
    - cmd/snap: test allowed and forbidden refresh hold values
    - cmd/snap: be more consistent in --hold help and err messages
    - cmd/snap: error on refresh holds that are negative or too short
    - o/homedirs: make sure we do not write to /var on build time
    - image: make sure file customizations happen also when we have
      defaultscause
    - tests/fde-on-classic: set ubuntu-seed label in seed partitions
    - gadget: system-seed-null should also have fs label ubuntu-seed
    - many: gadget.HasRole, ubuntu-seed can come also from system-seed-
      null
    - o/devicestate: fix paths for retrieving recovery key on classic
    - cmd/snap-confine: do not discard const qualifier
    - interfaces: allow python3.10+ in the default template
    - o/restart: fix PendingForSystemRestart
    - interfaces: allow wayland slot snaps to access shm files created
      by Firefox
    - o/assertstate: add Sequence() to val set tracking
    - o/assertstate: set val set 'Current' to pinned sequence
    - tests: tweak the libvirt interface test to work on 22.10
    - tests: use system-seed-null role on classic with modes tests
    - boot: add directory for data on install
    - o/devicestate: change some names from esp to seed/seed-null
    - gadget: add system-seed-null role
    - o/devicestate: really add error to new error message
    - restart,snapstate: implement reboot-required notifications on
      classic
    - many: avoid automatic system restarts on classic through new
      overlord/restart logic
    - release: Fix WSL detection in LXD
    - o/state: introduce WaitStatus
    - interfaces: Fix desktop interface rules for document portal
    - client: remove classic check for `snap recovery --show-
      keys`
    - many: create snapd.mounts targets to schedule mount units
    - image: enable sysfs overlay for UC preseeding
    - i/b/network-control: add permissions for using AF_XDP
    - i/apparmor: move mocking of home and overlay conditions to osutil
    - tests/main/degraded: ignore man-db update failures in CentOS
    - cmd/snap: fix panic when running snap w/ flag but w/o subcommand
    - tests: save snaps generated during image preaparation
    - tests: skip building snapd based on new env var
    - client: remove misleading comments in ValidateApplyOptions
    - boot/seal: add debug traces for bootchains
    - bootloader/assets: fix grub.cfg when there are no labels
    - cmd/snap: improve refresh hold's output
    - packaging: enable BPF in RHEL9
    - packaging: do not traverse filesystems in postrm script
    - tests: get microk8s from another branch
    - bootloader: do not specify Core version in grub entry
    - many: refresh --hold follow-up
    - many: support refresh hold/unhold to API and CLI
    - many: expand fully handling links mapping in all components, in
      the API and in snap info
    - snap/system_usernames,tests: Azure IoT Edge system usernames
    - interface: Allow access to
      org.freedesktop.DBus.ListActivatableNames via system-observe
      interface
    - o/devicestate,daemon: use the expiration date from the assertion
      in user-state and REST api (user-removal 4/n)
    - gadget: add unit tests for new install functions for FDE on
      classic
    - cmd/snap-seccomp: fix typo in AF_XDP value
    - tests/connected-after-reboot-revert: run also on UC16
    - kvm: allow read of AMD-SEV parameters
    - data: tweak apt integration config var
    - o/c/configcore: add faillock configuration
    - tests: use dbus-daemon instead of dbus-launch
    - packaging: remove unclean debian-sid patch
    - asserts: add keyword 'user-presence' keyword in system-user
      assertion (auto-removal 3/n)
    - interfaces: steam-support allow pivot /run/media and /etc/nvidia
      mount
    - aspects: initial code
    - overlord: process auto-import assertion at first boot
    - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
    - tests: fix lxd-mount-units in ubuntu kinetic
    - tests: new variable used to configure the kernel command line in
      nested tests
    - go.mod: update to newer secboot/uc22 branch
    - autopkgtests: fix running autopkgtest on kinetic
    - tests: remove squashfs leftovers in fakeinstaller
    - tests: create partition table in fakeinstaller
    - o/ifacestate: introduce DebugAutoConnectCheck hook
    - tests: use test-snapd-swtpm instead of swtpm-mvo snap in nested
      helper
    - interfaces/polkit: do not require polkit directory if no file is
      needed
    - o/snapstate: be consistent not creating per-snap save dirs for
      classic models
    - inhibit: use hintFile()
    - tests: use `snap prepare-image` in fde-on-classic mk-image.sh
    - interfaces: add microceph interface
    - seccomp: allow opening XDP sockets
    - interfaces: allow access to icon subdirectories
    - tests: add minimal-smoke test for UC22 and increase minimal RAM
    - overlord: introduce hold levels in the snapstate.Hold* API
    - o/devicestate: support mounting ubuntu-save also on classic with
      modes
    - interfaces: steam-support allow additional mounts
    - fakeinstaller: format SystemDetails result with %+v
    - cmd/libsnap-confine-private: do not panic on chmod failure
    - tests: ensure that fakeinstaller put the seed into the right place
    - many: add stub services for prompting
    - tests: add libfwupd and libfwupdplugin5 to openSUSE dependencies
    - o/snapstate: fix snaps-hold pruning/reset in the presence of
      system holding
    - many: add support for setting up encryption from installer
    - many: support classic snaps in the context of classic and extended
      models
    - cmd/snap,daemon: allow zero values from client to daemon for
      journal rate limit
    - boot,o/devicestate: extend HasFDESetupHook to consider unrelated
      kernels
    - cmd/snap: validation set refresh-enforce CLI support + spread test
    - many: fix filenames written in modeenv for base/gadget plus drive-
      by TODO
    - seed: fix seed test to use a pseudo-random byte sequence
    - cmd/snap-confine: remove setuid calls from cgroup init code
    - boot,o/devicestate: introduce and use MakeRunnableStandaloneSystem
    - devicestate,boot,tests: make `fakeinstaller` test work
    - store: send Snap-Device-Location header with cloud information
    - overlord: fix unit tests after merging master in
    - o/auth: move HasUserExpired into UserState and name it HasExpired,
      and add unit tests for this
    - o/auth: rename NewUserData to NewUserParams
    - many: implementation of finish install step handlers
    - overlord: auto-resolve validation set enforcement constraints
    - i/backends,o/ifacestate: cleanup backends.All
    - cmd/snap-confine: move bind-mount setup into separate function
    - tests/main/mount-ns: update namespace for 18.04
    - o/state: Hold pseudo-error for explicit holding, concept of
      pending changes in prune logic
    - many: support extended classic models that omit kernel/gadget
    - data/selinux: allow snapd to detect WSL
    - overlord: add code to remove users that has an expiration date set
    - wrappers,snap/quota: clear LogsDirectory= in the service unit for
      journal namespaces
    - daemon: move user add, remove operations to overlord device state
    - gadget: implement write content from gadget information
    - {device,snap}state: fix ineffectual assignments
    - daemon: support validation set refresh+enforce in API
    - many: rename AddAffected* to RegisterAffected*, add
      Change|State.Has, fix a comment
    - many: reset store session when setting proxy.store
    - overlord/ifacestate: fix conflict detection of auto-connection
    - interfaces: added read/write access to /proc/self/coredump_filter
      for process-control
    - interfaces: add read access to /proc/cgroups and
      /proc/sys/vm/swappiness to system-observe
    - fde: run fde-reveal-key with `DefaultDependencies=no`
    - many: don't concatenate non-constant format strings
    - o/devicestate: fix non-compiling test
    - release, snapd-apparmor: fixed outdated WSL detection
    - many: add todos discussed in the review in
      tests/nested/manual/fde-on-classic, snapstate cleanups
    - overlord: run install-device hook during factory reset
    - i/b/mount-control: add optional `/` to umount rules
    - gadget/install: split Run in several functions
    - o/devicestate: refactor some methods as preparation for install
      steps implementation
    - tests: fix how snaps are cached in uc22
    - tests/main/cgroup-tracking-failure: fix rare failure in Xenial and
      Bionic
    - many: make {Install,Initramfs}{{,Host},Writable}Dir a  function
    - tests/nested/manual/core20: fix manual test after changes to
      'tests.nested exec'
    - tests: move the unit tests system to 22.04 in github actions
      workflow
    - tests: fix nested errors uc20
    - boot: rewrite switch in SnapTypeParticipatesInBoot()
    - gadget: refactor to allow usage from the installer
    - overlord/devicestate: support for mounting ubuntu-save before the
      install-device hook
    - many: allow to install/update kernels/gadgets on classic with
      modes
    - tests: fix issues related to dbus session and localtime in uc18
    - many: support home dirs located deeper under /home
    - many: refactor tests to use explicit strings instead of
      boot.Install{Initramfs,Host}{Writable,FDEData}Dir
    - boot: add factory-reset cases for boot-flags
    - tests: disable quota tests on arm devices using ubuntu core
    - tests: fix unbound SPREAD_PATH variable on nested debug session
    - overlord: start turning restart into a full state manager
    - boot: apply boot logic also for classic with modes boot snaps
    - tests: fix snap-env test on debug section when no var files were
      created
    - overlord,daemon: allow returning errors when requesting a restart
    - interfaces: login-session-control: add further D-Bus interfaces
    - snapdenv: added wsl to userAgent
    - o/snapstate: support running multiple ops transactionally
    - store: use typed valset keys in store package
    - daemon: add `ensureStateSoon()` when calling systems POST api
    - gadget: add rules for validating classic with modes gadget.yaml
      files
    - wrappers: journal namespaces did not honor journal.persistent
    - many: stub devicestate.Install{Finish,SetupStorageEncryption}()
    - sandbox/cgroup: don't check V1 cgroup if V2 is active
    - seed: add support to load auto import assertion
    - tests: fix preseed tests for arm systems
    - include/lk: update LK recovery environment definition to include
      device lock state used by bootloader
    - daemon: return `storage-encryption` in /systems/<label> reply
    - tests: start using remote tools from snapd-testing-tools project
      in nested tests
    - tests: fix non mountable filesystem error in interfaces-udisks2
    - client: clarify what InstallStep{SetupStorageEncryption,Finish} do
    - client: prepare InstallSystemOptions for real use
    - usersession: Remove duplicated struct
    - o/snapstate: support specific revisions in UpdateMany/InstallMany
    - i/b/system_packages_doc: restore access to Libreoffice
      documentation
    - snap/quota,wrappers: allow using 0 values for the journal rate
      limit
    - tests: add kinetic images to the gce bucket for preseed test
    - multiple: clear up naming convention for thread quota
    - daemon: implement stub `"action": "install"`
    - tests/main/snap-quota-{install/journal}: fix unstable spread tests
    - tests: remove code for old systems not supported anymore
    - tests: third part of the nested helper cleanup
    - image: clean snapd mount after preseeding
    - tests: use the new ubuntu kinetic image
    - i/b/system_observe: honour root dir when checking for
      /boot/config-*
    - tests: restore microk8s test on 16.04
    - tests: run spread tests on arm64 instances in google cloud
    - tests: skip interfaces-udisks2 in fedora
    - asserts,boot,secboot: switch to a secboot version measuring
      classic
    - client: add API for GET /systems/<label>
    - overlord: frontend for --quota-group support (2/2)
    - daemon: add GET support for `/systems/<seed-label>`
    - i/b/system-observe: allow reading processes security label
    - many: support '--purge' when removing multiple snaps
    - snap-confine: remove obsolete code
    - interfaces: rework logic of unclashMountEntries
    - data/systemd/Makefile: add comment warning about "snapd." prefix
    - interfaces: grant access to speech-dispatcher socket (bug 1787245)
    - overlord/servicestate: disallow removal of quota group with any
      limits set
    - data: include snapd/mounts in preseeded blob
    - many: Set SNAPD_APPARMOR_REEXEC=1
    - store/tooling,tests: support UBUNTU_STORE_URL override env var
    - multiple: clear up naming convention for cpu-set quota
    - tests: improve and standardize debug section on tests
    - device: add new DeviceManager.encryptionSupportInfo()
    - tests: check snap download with snapcraft v7+ export-login auth
      data
    - cmd/snap-bootstrap: changes to be able to boot classic rootfs
    - tests: fix debug section for test uc20-create-partitions
    - overlord: --quota-group support (1/2)
    - asserts,cmd/snap-repair: drop not pursued
      AuthorityDelegation/signatory-id
    - snap-bootstrap: add CVM mode* snap-bootstrap: add classic runmode
    - interfaces: make polkit implicit on core if /usr/libexec/polkitd
      exists
    - multiple: move arguments for auth.NewUser into a struct (auto-
      removal 1/n)
    - overlord: track security profiles for non-active snaps
    - tests: remove NESTED_IMAGE_ID from nested manual tests
    - tests: add extra space to ubuntu bionic
    - store/tooling: support using snapcraft v7+ base64-encoded auth
      data
    - overlord: allow seeding in the case of classic with modes system
    - packaging/*/tests/integrationtests: reload ssh.service, not
      sshd.service
    - tests: rework snap-logs-journal test and add missing cleanup
    - tests: add spread test for journal quotas
    - tests: run spread tests in ubuntu kinetic
    - o/snapstate: extend support for holding refreshes
    - devicestate: return an error in checkEncryption() if KernelInfo
      fails
    - tests: fix sbuild test on debian sid
    - o/devicestate: do not run tests in this folder twice
    - sandbox/apparmor: remove duplicate hook into testing package
    - many: refactor store code to be able to use simpler form of auth
      creds
    - snap,store: drop support/consideration for anonymous download urls
    - data/selinux: allow snaps to read certificates
    - many: add Is{Core,Classic}Boot() to DeviceContext
    - o/assertstate: don't refresh enforced validation sets during check
    - go.mod: replace maze.io/x/crypto with local repo
    - many: fix unnecessary use of fmt.Sprintf
    - bootloader,systemd: fix `don't use Yoda conditions (ST1017)`
    - HACKING.md: extend guidelines with common review comments
    - many: progress bars should use the overridable stdouts
    - tests: remove ubuntu 21.10 from sru validation
    - tests: import remote tools
    - daemon,usersession: switch from HeaderMap to Header in tests
    - asserts: add some missing `c.Check()` in the asserts test
    - strutil: fix VersionCompare() to allow multiple `-` in the version
    - testutil: remove unneeded `fmt.Sprintf`
    - boot: remove some unneeded `fmt.Sprintf()` calls
    - tests: implement prepare_gadget and prepare_base and unify all the
      version
    - o/snapstate: refactor managed refresh schedule logic
    - o/assertstate, snapasserts: implementation of
      assertstate.TryEnforceValidationSets function
    - interfaces: add kconfig paths to system-observe
    - dbusutil: move debian patch into dbustest
    - many: change name and input of CheckProvenance to clarify usage
    - tests: Fix a missing parameter in command to wait for device
    - tests: Work-around non-functional --wait on systemctl
    - tests: unify the way the snapd/core and kernel are repacked in
      nested helper
    - tests: skip interfaces-ufisks2 on centos-9
    - i/b/mount-control: allow custom filesystem types
    - interfaces,metautil: make error handling in getPaths() more
      targeted
    - cmd/snap-update-ns: handle mountpoint removal failures with EBUSY
    - tests: fix pc-kernel repacking
    - systemd: add `WantedBy=default.target` to snap mount units
    - tests: disable microk8s test on 16.04

 -- Michael Vogt <email address hidden>  Thu, 01 Dec 2022 09:52:23 +0100

Available diffs

• diff from 2.57.5+18.04ubuntu0.1 (in ~ubuntu-security/ubuntu/ppa) to 2.58+18.04 (464.1 KiB)
• diff from 2.57.5+18.04 to 2.58+18.04 (471.5 KiB)

snapd (2.58+22.04) jammy; urgency=medium

  * New upstream release, LP: #1998462
    - many: Use /tmp/snap-private-tmp for per-snap private tmps
    - data: Add systemd-tmpfiles configuration to create private tmp dir
    - cmd/snap: test allowed and forbidden refresh hold values
    - cmd/snap: be more consistent in --hold help and err messages
    - cmd/snap: error on refresh holds that are negative or too short
    - o/homedirs: make sure we do not write to /var on build time
    - image: make sure file customizations happen also when we have
      defaultscause
    - tests/fde-on-classic: set ubuntu-seed label in seed partitions
    - gadget: system-seed-null should also have fs label ubuntu-seed
    - many: gadget.HasRole, ubuntu-seed can come also from system-seed-
      null
    - o/devicestate: fix paths for retrieving recovery key on classic
    - cmd/snap-confine: do not discard const qualifier
    - interfaces: allow python3.10+ in the default template
    - o/restart: fix PendingForSystemRestart
    - interfaces: allow wayland slot snaps to access shm files created
      by Firefox
    - o/assertstate: add Sequence() to val set tracking
    - o/assertstate: set val set 'Current' to pinned sequence
    - tests: tweak the libvirt interface test to work on 22.10
    - tests: use system-seed-null role on classic with modes tests
    - boot: add directory for data on install
    - o/devicestate: change some names from esp to seed/seed-null
    - gadget: add system-seed-null role
    - o/devicestate: really add error to new error message
    - restart,snapstate: implement reboot-required notifications on
      classic
    - many: avoid automatic system restarts on classic through new
      overlord/restart logic
    - release: Fix WSL detection in LXD
    - o/state: introduce WaitStatus
    - interfaces: Fix desktop interface rules for document portal
    - client: remove classic check for `snap recovery --show-
      keys`
    - many: create snapd.mounts targets to schedule mount units
    - image: enable sysfs overlay for UC preseeding
    - i/b/network-control: add permissions for using AF_XDP
    - i/apparmor: move mocking of home and overlay conditions to osutil
    - tests/main/degraded: ignore man-db update failures in CentOS
    - cmd/snap: fix panic when running snap w/ flag but w/o subcommand
    - tests: save snaps generated during image preaparation
    - tests: skip building snapd based on new env var
    - client: remove misleading comments in ValidateApplyOptions
    - boot/seal: add debug traces for bootchains
    - bootloader/assets: fix grub.cfg when there are no labels
    - cmd/snap: improve refresh hold's output
    - packaging: enable BPF in RHEL9
    - packaging: do not traverse filesystems in postrm script
    - tests: get microk8s from another branch
    - bootloader: do not specify Core version in grub entry
    - many: refresh --hold follow-up
    - many: support refresh hold/unhold to API and CLI
    - many: expand fully handling links mapping in all components, in
      the API and in snap info
    - snap/system_usernames,tests: Azure IoT Edge system usernames
    - interface: Allow access to
      org.freedesktop.DBus.ListActivatableNames via system-observe
      interface
    - o/devicestate,daemon: use the expiration date from the assertion
      in user-state and REST api (user-removal 4/n)
    - gadget: add unit tests for new install functions for FDE on
      classic
    - cmd/snap-seccomp: fix typo in AF_XDP value
    - tests/connected-after-reboot-revert: run also on UC16
    - kvm: allow read of AMD-SEV parameters
    - data: tweak apt integration config var
    - o/c/configcore: add faillock configuration
    - tests: use dbus-daemon instead of dbus-launch
    - packaging: remove unclean debian-sid patch
    - asserts: add keyword 'user-presence' keyword in system-user
      assertion (auto-removal 3/n)
    - interfaces: steam-support allow pivot /run/media and /etc/nvidia
      mount
    - aspects: initial code
    - overlord: process auto-import assertion at first boot
    - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
    - tests: fix lxd-mount-units in ubuntu kinetic
    - tests: new variable used to configure the kernel command line in
      nested tests
    - go.mod: update to newer secboot/uc22 branch
    - autopkgtests: fix running autopkgtest on kinetic
    - tests: remove squashfs leftovers in fakeinstaller
    - tests: create partition table in fakeinstaller
    - o/ifacestate: introduce DebugAutoConnectCheck hook
    - tests: use test-snapd-swtpm instead of swtpm-mvo snap in nested
      helper
    - interfaces/polkit: do not require polkit directory if no file is
      needed
    - o/snapstate: be consistent not creating per-snap save dirs for
      classic models
    - inhibit: use hintFile()
    - tests: use `snap prepare-image` in fde-on-classic mk-image.sh
    - interfaces: add microceph interface
    - seccomp: allow opening XDP sockets
    - interfaces: allow access to icon subdirectories
    - tests: add minimal-smoke test for UC22 and increase minimal RAM
    - overlord: introduce hold levels in the snapstate.Hold* API
    - o/devicestate: support mounting ubuntu-save also on classic with
      modes
    - interfaces: steam-support allow additional mounts
    - fakeinstaller: format SystemDetails result with %+v
    - cmd/libsnap-confine-private: do not panic on chmod failure
    - tests: ensure that fakeinstaller put the seed into the right place
    - many: add stub services for prompting
    - tests: add libfwupd and libfwupdplugin5 to openSUSE dependencies
    - o/snapstate: fix snaps-hold pruning/reset in the presence of
      system holding
    - many: add support for setting up encryption from installer
    - many: support classic snaps in the context of classic and extended
      models
    - cmd/snap,daemon: allow zero values from client to daemon for
      journal rate limit
    - boot,o/devicestate: extend HasFDESetupHook to consider unrelated
      kernels
    - cmd/snap: validation set refresh-enforce CLI support + spread test
    - many: fix filenames written in modeenv for base/gadget plus drive-
      by TODO
    - seed: fix seed test to use a pseudo-random byte sequence
    - cmd/snap-confine: remove setuid calls from cgroup init code
    - boot,o/devicestate: introduce and use MakeRunnableStandaloneSystem
    - devicestate,boot,tests: make `fakeinstaller` test work
    - store: send Snap-Device-Location header with cloud information
    - overlord: fix unit tests after merging master in
    - o/auth: move HasUserExpired into UserState and name it HasExpired,
      and add unit tests for this
    - o/auth: rename NewUserData to NewUserParams
    - many: implementation of finish install step handlers
    - overlord: auto-resolve validation set enforcement constraints
    - i/backends,o/ifacestate: cleanup backends.All
    - cmd/snap-confine: move bind-mount setup into separate function
    - tests/main/mount-ns: update namespace for 18.04
    - o/state: Hold pseudo-error for explicit holding, concept of
      pending changes in prune logic
    - many: support extended classic models that omit kernel/gadget
    - data/selinux: allow snapd to detect WSL
    - overlord: add code to remove users that has an expiration date set
    - wrappers,snap/quota: clear LogsDirectory= in the service unit for
      journal namespaces
    - daemon: move user add, remove operations to overlord device state
    - gadget: implement write content from gadget information
    - {device,snap}state: fix ineffectual assignments
    - daemon: support validation set refresh+enforce in API
    - many: rename AddAffected* to RegisterAffected*, add
      Change|State.Has, fix a comment
    - many: reset store session when setting proxy.store
    - overlord/ifacestate: fix conflict detection of auto-connection
    - interfaces: added read/write access to /proc/self/coredump_filter
      for process-control
    - interfaces: add read access to /proc/cgroups and
      /proc/sys/vm/swappiness to system-observe
    - fde: run fde-reveal-key with `DefaultDependencies=no`
    - many: don't concatenate non-constant format strings
    - o/devicestate: fix non-compiling test
    - release, snapd-apparmor: fixed outdated WSL detection
    - many: add todos discussed in the review in
      tests/nested/manual/fde-on-classic, snapstate cleanups
    - overlord: run install-device hook during factory reset
    - i/b/mount-control: add optional `/` to umount rules
    - gadget/install: split Run in several functions
    - o/devicestate: refactor some methods as preparation for install
      steps implementation
    - tests: fix how snaps are cached in uc22
    - tests/main/cgroup-tracking-failure: fix rare failure in Xenial and
      Bionic
    - many: make {Install,Initramfs}{{,Host},Writable}Dir a  function
    - tests/nested/manual/core20: fix manual test after changes to
      'tests.nested exec'
    - tests: move the unit tests system to 22.04 in github actions
      workflow
    - tests: fix nested errors uc20
    - boot: rewrite switch in SnapTypeParticipatesInBoot()
    - gadget: refactor to allow usage from the installer
    - overlord/devicestate: support for mounting ubuntu-save before the
      install-device hook
    - many: allow to install/update kernels/gadgets on classic with
      modes
    - tests: fix issues related to dbus session and localtime in uc18
    - many: support home dirs located deeper under /home
    - many: refactor tests to use explicit strings instead of
      boot.Install{Initramfs,Host}{Writable,FDEData}Dir
    - boot: add factory-reset cases for boot-flags
    - tests: disable quota tests on arm devices using ubuntu core
    - tests: fix unbound SPREAD_PATH variable on nested debug session
    - overlord: start turning restart into a full state manager
    - boot: apply boot logic also for classic with modes boot snaps
    - tests: fix snap-env test on debug section when no var files were
      created
    - overlord,daemon: allow returning errors when requesting a restart
    - interfaces: login-session-control: add further D-Bus interfaces
    - snapdenv: added wsl to userAgent
    - o/snapstate: support running multiple ops transactionally
    - store: use typed valset keys in store package
    - daemon: add `ensureStateSoon()` when calling systems POST api
    - gadget: add rules for validating classic with modes gadget.yaml
      files
    - wrappers: journal namespaces did not honor journal.persistent
    - many: stub devicestate.Install{Finish,SetupStorageEncryption}()
    - sandbox/cgroup: don't check V1 cgroup if V2 is active
    - seed: add support to load auto import assertion
    - tests: fix preseed tests for arm systems
    - include/lk: update LK recovery environment definition to include
      device lock state used by bootloader
    - daemon: return `storage-encryption` in /systems/<label> reply
    - tests: start using remote tools from snapd-testing-tools project
      in nested tests
    - tests: fix non mountable filesystem error in interfaces-udisks2
    - client: clarify what InstallStep{SetupStorageEncryption,Finish} do
    - client: prepare InstallSystemOptions for real use
    - usersession: Remove duplicated struct
    - o/snapstate: support specific revisions in UpdateMany/InstallMany
    - i/b/system_packages_doc: restore access to Libreoffice
      documentation
    - snap/quota,wrappers: allow using 0 values for the journal rate
      limit
    - tests: add kinetic images to the gce bucket for preseed test
    - multiple: clear up naming convention for thread quota
    - daemon: implement stub `"action": "install"`
    - tests/main/snap-quota-{install/journal}: fix unstable spread tests
    - tests: remove code for old systems not supported anymore
    - tests: third part of the nested helper cleanup
    - image: clean snapd mount after preseeding
    - tests: use the new ubuntu kinetic image
    - i/b/system_observe: honour root dir when checking for
      /boot/config-*
    - tests: restore microk8s test on 16.04
    - tests: run spread tests on arm64 instances in google cloud
    - tests: skip interfaces-udisks2 in fedora
    - asserts,boot,secboot: switch to a secboot version measuring
      classic
    - client: add API for GET /systems/<label>
    - overlord: frontend for --quota-group support (2/2)
    - daemon: add GET support for `/systems/<seed-label>`
    - i/b/system-observe: allow reading processes security label
    - many: support '--purge' when removing multiple snaps
    - snap-confine: remove obsolete code
    - interfaces: rework logic of unclashMountEntries
    - data/systemd/Makefile: add comment warning about "snapd." prefix
    - interfaces: grant access to speech-dispatcher socket (bug 1787245)
    - overlord/servicestate: disallow removal of quota group with any
      limits set
    - data: include snapd/mounts in preseeded blob
    - many: Set SNAPD_APPARMOR_REEXEC=1
    - store/tooling,tests: support UBUNTU_STORE_URL override env var
    - multiple: clear up naming convention for cpu-set quota
    - tests: improve and standardize debug section on tests
    - device: add new DeviceManager.encryptionSupportInfo()
    - tests: check snap download with snapcraft v7+ export-login auth
      data
    - cmd/snap-bootstrap: changes to be able to boot classic rootfs
    - tests: fix debug section for test uc20-create-partitions
    - overlord: --quota-group support (1/2)
    - asserts,cmd/snap-repair: drop not pursued
      AuthorityDelegation/signatory-id
    - snap-bootstrap: add CVM mode* snap-bootstrap: add classic runmode
    - interfaces: make polkit implicit on core if /usr/libexec/polkitd
      exists
    - multiple: move arguments for auth.NewUser into a struct (auto-
      removal 1/n)
    - overlord: track security profiles for non-active snaps
    - tests: remove NESTED_IMAGE_ID from nested manual tests
    - tests: add extra space to ubuntu bionic
    - store/tooling: support using snapcraft v7+ base64-encoded auth
      data
    - overlord: allow seeding in the case of classic with modes system
    - packaging/*/tests/integrationtests: reload ssh.service, not
      sshd.service
    - tests: rework snap-logs-journal test and add missing cleanup
    - tests: add spread test for journal quotas
    - tests: run spread tests in ubuntu kinetic
    - o/snapstate: extend support for holding refreshes
    - devicestate: return an error in checkEncryption() if KernelInfo
      fails
    - tests: fix sbuild test on debian sid
    - o/devicestate: do not run tests in this folder twice
    - sandbox/apparmor: remove duplicate hook into testing package
    - many: refactor store code to be able to use simpler form of auth
      creds
    - snap,store: drop support/consideration for anonymous download urls
    - data/selinux: allow snaps to read certificates
    - many: add Is{Core,Classic}Boot() to DeviceContext
    - o/assertstate: don't refresh enforced validation sets during check
    - go.mod: replace maze.io/x/crypto with local repo
    - many: fix unnecessary use of fmt.Sprintf
    - bootloader,systemd: fix `don't use Yoda conditions (ST1017)`
    - HACKING.md: extend guidelines with common review comments
    - many: progress bars should use the overridable stdouts
    - tests: remove ubuntu 21.10 from sru validation
    - tests: import remote tools
    - daemon,usersession: switch from HeaderMap to Header in tests
    - asserts: add some missing `c.Check()` in the asserts test
    - strutil: fix VersionCompare() to allow multiple `-` in the version
    - testutil: remove unneeded `fmt.Sprintf`
    - boot: remove some unneeded `fmt.Sprintf()` calls
    - tests: implement prepare_gadget and prepare_base and unify all the
      version
    - o/snapstate: refactor managed refresh schedule logic
    - o/assertstate, snapasserts: implementation of
      assertstate.TryEnforceValidationSets function
    - interfaces: add kconfig paths to system-observe
    - dbusutil: move debian patch into dbustest
    - many: change name and input of CheckProvenance to clarify usage
    - tests: Fix a missing parameter in command to wait for device
    - tests: Work-around non-functional --wait on systemctl
    - tests: unify the way the snapd/core and kernel are repacked in
      nested helper
    - tests: skip interfaces-ufisks2 on centos-9
    - i/b/mount-control: allow custom filesystem types
    - interfaces,metautil: make error handling in getPaths() more
      targeted
    - cmd/snap-update-ns: handle mountpoint removal failures with EBUSY
    - tests: fix pc-kernel repacking
    - systemd: add `WantedBy=default.target` to snap mount units
    - tests: disable microk8s test on 16.04

 -- Michael Vogt <email address hidden>  Thu, 01 Dec 2022 09:52:23 +0100

Available diffs

• diff from 2.57.5+22.04ubuntu0.1 (in ~ubuntu-security/ubuntu/ppa) to 2.58+22.04 (464.1 KiB)
• diff from 2.57.5+22.04 to 2.58+22.04 (471.6 KiB)

snapd (2.58+20.04) focal; urgency=medium

  * New upstream release, LP: #1998462
    - many: Use /tmp/snap-private-tmp for per-snap private tmps
    - data: Add systemd-tmpfiles configuration to create private tmp dir
    - cmd/snap: test allowed and forbidden refresh hold values
    - cmd/snap: be more consistent in --hold help and err messages
    - cmd/snap: error on refresh holds that are negative or too short
    - o/homedirs: make sure we do not write to /var on build time
    - image: make sure file customizations happen also when we have
      defaultscause
    - tests/fde-on-classic: set ubuntu-seed label in seed partitions
    - gadget: system-seed-null should also have fs label ubuntu-seed
    - many: gadget.HasRole, ubuntu-seed can come also from system-seed-
      null
    - o/devicestate: fix paths for retrieving recovery key on classic
    - cmd/snap-confine: do not discard const qualifier
    - interfaces: allow python3.10+ in the default template
    - o/restart: fix PendingForSystemRestart
    - interfaces: allow wayland slot snaps to access shm files created
      by Firefox
    - o/assertstate: add Sequence() to val set tracking
    - o/assertstate: set val set 'Current' to pinned sequence
    - tests: tweak the libvirt interface test to work on 22.10
    - tests: use system-seed-null role on classic with modes tests
    - boot: add directory for data on install
    - o/devicestate: change some names from esp to seed/seed-null
    - gadget: add system-seed-null role
    - o/devicestate: really add error to new error message
    - restart,snapstate: implement reboot-required notifications on
      classic
    - many: avoid automatic system restarts on classic through new
      overlord/restart logic
    - release: Fix WSL detection in LXD
    - o/state: introduce WaitStatus
    - interfaces: Fix desktop interface rules for document portal
    - client: remove classic check for `snap recovery --show-
      keys`
    - many: create snapd.mounts targets to schedule mount units
    - image: enable sysfs overlay for UC preseeding
    - i/b/network-control: add permissions for using AF_XDP
    - i/apparmor: move mocking of home and overlay conditions to osutil
    - tests/main/degraded: ignore man-db update failures in CentOS
    - cmd/snap: fix panic when running snap w/ flag but w/o subcommand
    - tests: save snaps generated during image preaparation
    - tests: skip building snapd based on new env var
    - client: remove misleading comments in ValidateApplyOptions
    - boot/seal: add debug traces for bootchains
    - bootloader/assets: fix grub.cfg when there are no labels
    - cmd/snap: improve refresh hold's output
    - packaging: enable BPF in RHEL9
    - packaging: do not traverse filesystems in postrm script
    - tests: get microk8s from another branch
    - bootloader: do not specify Core version in grub entry
    - many: refresh --hold follow-up
    - many: support refresh hold/unhold to API and CLI
    - many: expand fully handling links mapping in all components, in
      the API and in snap info
    - snap/system_usernames,tests: Azure IoT Edge system usernames
    - interface: Allow access to
      org.freedesktop.DBus.ListActivatableNames via system-observe
      interface
    - o/devicestate,daemon: use the expiration date from the assertion
      in user-state and REST api (user-removal 4/n)
    - gadget: add unit tests for new install functions for FDE on
      classic
    - cmd/snap-seccomp: fix typo in AF_XDP value
    - tests/connected-after-reboot-revert: run also on UC16
    - kvm: allow read of AMD-SEV parameters
    - data: tweak apt integration config var
    - o/c/configcore: add faillock configuration
    - tests: use dbus-daemon instead of dbus-launch
    - packaging: remove unclean debian-sid patch
    - asserts: add keyword 'user-presence' keyword in system-user
      assertion (auto-removal 3/n)
    - interfaces: steam-support allow pivot /run/media and /etc/nvidia
      mount
    - aspects: initial code
    - overlord: process auto-import assertion at first boot
    - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
    - tests: fix lxd-mount-units in ubuntu kinetic
    - tests: new variable used to configure the kernel command line in
      nested tests
    - go.mod: update to newer secboot/uc22 branch
    - autopkgtests: fix running autopkgtest on kinetic
    - tests: remove squashfs leftovers in fakeinstaller
    - tests: create partition table in fakeinstaller
    - o/ifacestate: introduce DebugAutoConnectCheck hook
    - tests: use test-snapd-swtpm instead of swtpm-mvo snap in nested
      helper
    - interfaces/polkit: do not require polkit directory if no file is
      needed
    - o/snapstate: be consistent not creating per-snap save dirs for
      classic models
    - inhibit: use hintFile()
    - tests: use `snap prepare-image` in fde-on-classic mk-image.sh
    - interfaces: add microceph interface
    - seccomp: allow opening XDP sockets
    - interfaces: allow access to icon subdirectories
    - tests: add minimal-smoke test for UC22 and increase minimal RAM
    - overlord: introduce hold levels in the snapstate.Hold* API
    - o/devicestate: support mounting ubuntu-save also on classic with
      modes
    - interfaces: steam-support allow additional mounts
    - fakeinstaller: format SystemDetails result with %+v
    - cmd/libsnap-confine-private: do not panic on chmod failure
    - tests: ensure that fakeinstaller put the seed into the right place
    - many: add stub services for prompting
    - tests: add libfwupd and libfwupdplugin5 to openSUSE dependencies
    - o/snapstate: fix snaps-hold pruning/reset in the presence of
      system holding
    - many: add support for setting up encryption from installer
    - many: support classic snaps in the context of classic and extended
      models
    - cmd/snap,daemon: allow zero values from client to daemon for
      journal rate limit
    - boot,o/devicestate: extend HasFDESetupHook to consider unrelated
      kernels
    - cmd/snap: validation set refresh-enforce CLI support + spread test
    - many: fix filenames written in modeenv for base/gadget plus drive-
      by TODO
    - seed: fix seed test to use a pseudo-random byte sequence
    - cmd/snap-confine: remove setuid calls from cgroup init code
    - boot,o/devicestate: introduce and use MakeRunnableStandaloneSystem
    - devicestate,boot,tests: make `fakeinstaller` test work
    - store: send Snap-Device-Location header with cloud information
    - overlord: fix unit tests after merging master in
    - o/auth: move HasUserExpired into UserState and name it HasExpired,
      and add unit tests for this
    - o/auth: rename NewUserData to NewUserParams
    - many: implementation of finish install step handlers
    - overlord: auto-resolve validation set enforcement constraints
    - i/backends,o/ifacestate: cleanup backends.All
    - cmd/snap-confine: move bind-mount setup into separate function
    - tests/main/mount-ns: update namespace for 18.04
    - o/state: Hold pseudo-error for explicit holding, concept of
      pending changes in prune logic
    - many: support extended classic models that omit kernel/gadget
    - data/selinux: allow snapd to detect WSL
    - overlord: add code to remove users that has an expiration date set
    - wrappers,snap/quota: clear LogsDirectory= in the service unit for
      journal namespaces
    - daemon: move user add, remove operations to overlord device state
    - gadget: implement write content from gadget information
    - {device,snap}state: fix ineffectual assignments
    - daemon: support validation set refresh+enforce in API
    - many: rename AddAffected* to RegisterAffected*, add
      Change|State.Has, fix a comment
    - many: reset store session when setting proxy.store
    - overlord/ifacestate: fix conflict detection of auto-connection
    - interfaces: added read/write access to /proc/self/coredump_filter
      for process-control
    - interfaces: add read access to /proc/cgroups and
      /proc/sys/vm/swappiness to system-observe
    - fde: run fde-reveal-key with `DefaultDependencies=no`
    - many: don't concatenate non-constant format strings
    - o/devicestate: fix non-compiling test
    - release, snapd-apparmor: fixed outdated WSL detection
    - many: add todos discussed in the review in
      tests/nested/manual/fde-on-classic, snapstate cleanups
    - overlord: run install-device hook during factory reset
    - i/b/mount-control: add optional `/` to umount rules
    - gadget/install: split Run in several functions
    - o/devicestate: refactor some methods as preparation for install
      steps implementation
    - tests: fix how snaps are cached in uc22
    - tests/main/cgroup-tracking-failure: fix rare failure in Xenial and
      Bionic
    - many: make {Install,Initramfs}{{,Host},Writable}Dir a  function
    - tests/nested/manual/core20: fix manual test after changes to
      'tests.nested exec'
    - tests: move the unit tests system to 22.04 in github actions
      workflow
    - tests: fix nested errors uc20
    - boot: rewrite switch in SnapTypeParticipatesInBoot()
    - gadget: refactor to allow usage from the installer
    - overlord/devicestate: support for mounting ubuntu-save before the
      install-device hook
    - many: allow to install/update kernels/gadgets on classic with
      modes
    - tests: fix issues related to dbus session and localtime in uc18
    - many: support home dirs located deeper under /home
    - many: refactor tests to use explicit strings instead of
      boot.Install{Initramfs,Host}{Writable,FDEData}Dir
    - boot: add factory-reset cases for boot-flags
    - tests: disable quota tests on arm devices using ubuntu core
    - tests: fix unbound SPREAD_PATH variable on nested debug session
    - overlord: start turning restart into a full state manager
    - boot: apply boot logic also for classic with modes boot snaps
    - tests: fix snap-env test on debug section when no var files were
      created
    - overlord,daemon: allow returning errors when requesting a restart
    - interfaces: login-session-control: add further D-Bus interfaces
    - snapdenv: added wsl to userAgent
    - o/snapstate: support running multiple ops transactionally
    - store: use typed valset keys in store package
    - daemon: add `ensureStateSoon()` when calling systems POST api
    - gadget: add rules for validating classic with modes gadget.yaml
      files
    - wrappers: journal namespaces did not honor journal.persistent
    - many: stub devicestate.Install{Finish,SetupStorageEncryption}()
    - sandbox/cgroup: don't check V1 cgroup if V2 is active
    - seed: add support to load auto import assertion
    - tests: fix preseed tests for arm systems
    - include/lk: update LK recovery environment definition to include
      device lock state used by bootloader
    - daemon: return `storage-encryption` in /systems/<label> reply
    - tests: start using remote tools from snapd-testing-tools project
      in nested tests
    - tests: fix non mountable filesystem error in interfaces-udisks2
    - client: clarify what InstallStep{SetupStorageEncryption,Finish} do
    - client: prepare InstallSystemOptions for real use
    - usersession: Remove duplicated struct
    - o/snapstate: support specific revisions in UpdateMany/InstallMany
    - i/b/system_packages_doc: restore access to Libreoffice
      documentation
    - snap/quota,wrappers: allow using 0 values for the journal rate
      limit
    - tests: add kinetic images to the gce bucket for preseed test
    - multiple: clear up naming convention for thread quota
    - daemon: implement stub `"action": "install"`
    - tests/main/snap-quota-{install/journal}: fix unstable spread tests
    - tests: remove code for old systems not supported anymore
    - tests: third part of the nested helper cleanup
    - image: clean snapd mount after preseeding
    - tests: use the new ubuntu kinetic image
    - i/b/system_observe: honour root dir when checking for
      /boot/config-*
    - tests: restore microk8s test on 16.04
    - tests: run spread tests on arm64 instances in google cloud
    - tests: skip interfaces-udisks2 in fedora
    - asserts,boot,secboot: switch to a secboot version measuring
      classic
    - client: add API for GET /systems/<label>
    - overlord: frontend for --quota-group support (2/2)
    - daemon: add GET support for `/systems/<seed-label>`
    - i/b/system-observe: allow reading processes security label
    - many: support '--purge' when removing multiple snaps
    - snap-confine: remove obsolete code
    - interfaces: rework logic of unclashMountEntries
    - data/systemd/Makefile: add comment warning about "snapd." prefix
    - interfaces: grant access to speech-dispatcher socket (bug 1787245)
    - overlord/servicestate: disallow removal of quota group with any
      limits set
    - data: include snapd/mounts in preseeded blob
    - many: Set SNAPD_APPARMOR_REEXEC=1
    - store/tooling,tests: support UBUNTU_STORE_URL override env var
    - multiple: clear up naming convention for cpu-set quota
    - tests: improve and standardize debug section on tests
    - device: add new DeviceManager.encryptionSupportInfo()
    - tests: check snap download with snapcraft v7+ export-login auth
      data
    - cmd/snap-bootstrap: changes to be able to boot classic rootfs
    - tests: fix debug section for test uc20-create-partitions
    - overlord: --quota-group support (1/2)
    - asserts,cmd/snap-repair: drop not pursued
      AuthorityDelegation/signatory-id
    - snap-bootstrap: add CVM mode* snap-bootstrap: add classic runmode
    - interfaces: make polkit implicit on core if /usr/libexec/polkitd
      exists
    - multiple: move arguments for auth.NewUser into a struct (auto-
      removal 1/n)
    - overlord: track security profiles for non-active snaps
    - tests: remove NESTED_IMAGE_ID from nested manual tests
    - tests: add extra space to ubuntu bionic
    - store/tooling: support using snapcraft v7+ base64-encoded auth
      data
    - overlord: allow seeding in the case of classic with modes system
    - packaging/*/tests/integrationtests: reload ssh.service, not
      sshd.service
    - tests: rework snap-logs-journal test and add missing cleanup
    - tests: add spread test for journal quotas
    - tests: run spread tests in ubuntu kinetic
    - o/snapstate: extend support for holding refreshes
    - devicestate: return an error in checkEncryption() if KernelInfo
      fails
    - tests: fix sbuild test on debian sid
    - o/devicestate: do not run tests in this folder twice
    - sandbox/apparmor: remove duplicate hook into testing package
    - many: refactor store code to be able to use simpler form of auth
      creds
    - snap,store: drop support/consideration for anonymous download urls
    - data/selinux: allow snaps to read certificates
    - many: add Is{Core,Classic}Boot() to DeviceContext
    - o/assertstate: don't refresh enforced validation sets during check
    - go.mod: replace maze.io/x/crypto with local repo
    - many: fix unnecessary use of fmt.Sprintf
    - bootloader,systemd: fix `don't use Yoda conditions (ST1017)`
    - HACKING.md: extend guidelines with common review comments
    - many: progress bars should use the overridable stdouts
    - tests: remove ubuntu 21.10 from sru validation
    - tests: import remote tools
    - daemon,usersession: switch from HeaderMap to Header in tests
    - asserts: add some missing `c.Check()` in the asserts test
    - strutil: fix VersionCompare() to allow multiple `-` in the version
    - testutil: remove unneeded `fmt.Sprintf`
    - boot: remove some unneeded `fmt.Sprintf()` calls
    - tests: implement prepare_gadget and prepare_base and unify all the
      version
    - o/snapstate: refactor managed refresh schedule logic
    - o/assertstate, snapasserts: implementation of
      assertstate.TryEnforceValidationSets function
    - interfaces: add kconfig paths to system-observe
    - dbusutil: move debian patch into dbustest
    - many: change name and input of CheckProvenance to clarify usage
    - tests: Fix a missing parameter in command to wait for device
    - tests: Work-around non-functional --wait on systemctl
    - tests: unify the way the snapd/core and kernel are repacked in
      nested helper
    - tests: skip interfaces-ufisks2 on centos-9
    - i/b/mount-control: allow custom filesystem types
    - interfaces,metautil: make error handling in getPaths() more
      targeted
    - cmd/snap-update-ns: handle mountpoint removal failures with EBUSY
    - tests: fix pc-kernel repacking
    - systemd: add `WantedBy=default.target` to snap mount units
    - tests: disable microk8s test on 16.04

 -- Michael Vogt <email address hidden>  Thu, 01 Dec 2022 09:52:23 +0100

Available diffs

• diff from 2.57.5+20.04ubuntu0.1 (in ~ubuntu-security/ubuntu/ppa) to 2.58+20.04 (464.1 KiB)
• diff from 2.57.5+20.04 to 2.58+20.04 (471.6 KiB)

snapd (2.58+23.04) lunar; urgency=medium

  * New upstream release, LP: #1998462
    - many: Use /tmp/snap-private-tmp for per-snap private tmps
    - data: Add systemd-tmpfiles configuration to create private tmp dir
    - cmd/snap: test allowed and forbidden refresh hold values
    - cmd/snap: be more consistent in --hold help and err messages
    - cmd/snap: error on refresh holds that are negative or too short
    - o/homedirs: make sure we do not write to /var on build time
    - image: make sure file customizations happen also when we have
      defaultscause
    - tests/fde-on-classic: set ubuntu-seed label in seed partitions
    - gadget: system-seed-null should also have fs label ubuntu-seed
    - many: gadget.HasRole, ubuntu-seed can come also from system-seed-
      null
    - o/devicestate: fix paths for retrieving recovery key on classic
    - cmd/snap-confine: do not discard const qualifier
    - interfaces: allow python3.10+ in the default template
    - o/restart: fix PendingForSystemRestart
    - interfaces: allow wayland slot snaps to access shm files created
      by Firefox
    - o/assertstate: add Sequence() to val set tracking
    - o/assertstate: set val set 'Current' to pinned sequence
    - tests: tweak the libvirt interface test to work on 22.10
    - tests: use system-seed-null role on classic with modes tests
    - boot: add directory for data on install
    - o/devicestate: change some names from esp to seed/seed-null
    - gadget: add system-seed-null role
    - o/devicestate: really add error to new error message
    - restart,snapstate: implement reboot-required notifications on
      classic
    - many: avoid automatic system restarts on classic through new
      overlord/restart logic
    - release: Fix WSL detection in LXD
    - o/state: introduce WaitStatus
    - interfaces: Fix desktop interface rules for document portal
    - client: remove classic check for `snap recovery --show-
      keys`
    - many: create snapd.mounts targets to schedule mount units
    - image: enable sysfs overlay for UC preseeding
    - i/b/network-control: add permissions for using AF_XDP
    - i/apparmor: move mocking of home and overlay conditions to osutil
    - tests/main/degraded: ignore man-db update failures in CentOS
    - cmd/snap: fix panic when running snap w/ flag but w/o subcommand
    - tests: save snaps generated during image preaparation
    - tests: skip building snapd based on new env var
    - client: remove misleading comments in ValidateApplyOptions
    - boot/seal: add debug traces for bootchains
    - bootloader/assets: fix grub.cfg when there are no labels
    - cmd/snap: improve refresh hold's output
    - packaging: enable BPF in RHEL9
    - packaging: do not traverse filesystems in postrm script
    - tests: get microk8s from another branch
    - bootloader: do not specify Core version in grub entry
    - many: refresh --hold follow-up
    - many: support refresh hold/unhold to API and CLI
    - many: expand fully handling links mapping in all components, in
      the API and in snap info
    - snap/system_usernames,tests: Azure IoT Edge system usernames
    - interface: Allow access to
      org.freedesktop.DBus.ListActivatableNames via system-observe
      interface
    - o/devicestate,daemon: use the expiration date from the assertion
      in user-state and REST api (user-removal 4/n)
    - gadget: add unit tests for new install functions for FDE on
      classic
    - cmd/snap-seccomp: fix typo in AF_XDP value
    - tests/connected-after-reboot-revert: run also on UC16
    - kvm: allow read of AMD-SEV parameters
    - data: tweak apt integration config var
    - o/c/configcore: add faillock configuration
    - tests: use dbus-daemon instead of dbus-launch
    - packaging: remove unclean debian-sid patch
    - asserts: add keyword 'user-presence' keyword in system-user
      assertion (auto-removal 3/n)
    - interfaces: steam-support allow pivot /run/media and /etc/nvidia
      mount
    - aspects: initial code
    - overlord: process auto-import assertion at first boot
    - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
    - tests: fix lxd-mount-units in ubuntu kinetic
    - tests: new variable used to configure the kernel command line in
      nested tests
    - go.mod: update to newer secboot/uc22 branch
    - autopkgtests: fix running autopkgtest on kinetic
    - tests: remove squashfs leftovers in fakeinstaller
    - tests: create partition table in fakeinstaller
    - o/ifacestate: introduce DebugAutoConnectCheck hook
    - tests: use test-snapd-swtpm instead of swtpm-mvo snap in nested
      helper
    - interfaces/polkit: do not require polkit directory if no file is
      needed
    - o/snapstate: be consistent not creating per-snap save dirs for
      classic models
    - inhibit: use hintFile()
    - tests: use `snap prepare-image` in fde-on-classic mk-image.sh
    - interfaces: add microceph interface
    - seccomp: allow opening XDP sockets
    - interfaces: allow access to icon subdirectories
    - tests: add minimal-smoke test for UC22 and increase minimal RAM
    - overlord: introduce hold levels in the snapstate.Hold* API
    - o/devicestate: support mounting ubuntu-save also on classic with
      modes
    - interfaces: steam-support allow additional mounts
    - fakeinstaller: format SystemDetails result with %+v
    - cmd/libsnap-confine-private: do not panic on chmod failure
    - tests: ensure that fakeinstaller put the seed into the right place
    - many: add stub services for prompting
    - tests: add libfwupd and libfwupdplugin5 to openSUSE dependencies
    - o/snapstate: fix snaps-hold pruning/reset in the presence of
      system holding
    - many: add support for setting up encryption from installer
    - many: support classic snaps in the context of classic and extended
      models
    - cmd/snap,daemon: allow zero values from client to daemon for
      journal rate limit
    - boot,o/devicestate: extend HasFDESetupHook to consider unrelated
      kernels
    - cmd/snap: validation set refresh-enforce CLI support + spread test
    - many: fix filenames written in modeenv for base/gadget plus drive-
      by TODO
    - seed: fix seed test to use a pseudo-random byte sequence
    - cmd/snap-confine: remove setuid calls from cgroup init code
    - boot,o/devicestate: introduce and use MakeRunnableStandaloneSystem
    - devicestate,boot,tests: make `fakeinstaller` test work
    - store: send Snap-Device-Location header with cloud information
    - overlord: fix unit tests after merging master in
    - o/auth: move HasUserExpired into UserState and name it HasExpired,
      and add unit tests for this
    - o/auth: rename NewUserData to NewUserParams
    - many: implementation of finish install step handlers
    - overlord: auto-resolve validation set enforcement constraints
    - i/backends,o/ifacestate: cleanup backends.All
    - cmd/snap-confine: move bind-mount setup into separate function
    - tests/main/mount-ns: update namespace for 18.04
    - o/state: Hold pseudo-error for explicit holding, concept of
      pending changes in prune logic
    - many: support extended classic models that omit kernel/gadget
    - data/selinux: allow snapd to detect WSL
    - overlord: add code to remove users that has an expiration date set
    - wrappers,snap/quota: clear LogsDirectory= in the service unit for
      journal namespaces
    - daemon: move user add, remove operations to overlord device state
    - gadget: implement write content from gadget information
    - {device,snap}state: fix ineffectual assignments
    - daemon: support validation set refresh+enforce in API
    - many: rename AddAffected* to RegisterAffected*, add
      Change|State.Has, fix a comment
    - many: reset store session when setting proxy.store
    - overlord/ifacestate: fix conflict detection of auto-connection
    - interfaces: added read/write access to /proc/self/coredump_filter
      for process-control
    - interfaces: add read access to /proc/cgroups and
      /proc/sys/vm/swappiness to system-observe
    - fde: run fde-reveal-key with `DefaultDependencies=no`
    - many: don't concatenate non-constant format strings
    - o/devicestate: fix non-compiling test
    - release, snapd-apparmor: fixed outdated WSL detection
    - many: add todos discussed in the review in
      tests/nested/manual/fde-on-classic, snapstate cleanups
    - overlord: run install-device hook during factory reset
    - i/b/mount-control: add optional `/` to umount rules
    - gadget/install: split Run in several functions
    - o/devicestate: refactor some methods as preparation for install
      steps implementation
    - tests: fix how snaps are cached in uc22
    - tests/main/cgroup-tracking-failure: fix rare failure in Xenial and
      Bionic
    - many: make {Install,Initramfs}{{,Host},Writable}Dir a  function
    - tests/nested/manual/core20: fix manual test after changes to
      'tests.nested exec'
    - tests: move the unit tests system to 22.04 in github actions
      workflow
    - tests: fix nested errors uc20
    - boot: rewrite switch in SnapTypeParticipatesInBoot()
    - gadget: refactor to allow usage from the installer
    - overlord/devicestate: support for mounting ubuntu-save before the
      install-device hook
    - many: allow to install/update kernels/gadgets on classic with
      modes
    - tests: fix issues related to dbus session and localtime in uc18
    - many: support home dirs located deeper under /home
    - many: refactor tests to use explicit strings instead of
      boot.Install{Initramfs,Host}{Writable,FDEData}Dir
    - boot: add factory-reset cases for boot-flags
    - tests: disable quota tests on arm devices using ubuntu core
    - tests: fix unbound SPREAD_PATH variable on nested debug session
    - overlord: start turning restart into a full state manager
    - boot: apply boot logic also for classic with modes boot snaps
    - tests: fix snap-env test on debug section when no var files were
      created
    - overlord,daemon: allow returning errors when requesting a restart
    - interfaces: login-session-control: add further D-Bus interfaces
    - snapdenv: added wsl to userAgent
    - o/snapstate: support running multiple ops transactionally
    - store: use typed valset keys in store package
    - daemon: add `ensureStateSoon()` when calling systems POST api
    - gadget: add rules for validating classic with modes gadget.yaml
      files
    - wrappers: journal namespaces did not honor journal.persistent
    - many: stub devicestate.Install{Finish,SetupStorageEncryption}()
    - sandbox/cgroup: don't check V1 cgroup if V2 is active
    - seed: add support to load auto import assertion
    - tests: fix preseed tests for arm systems
    - include/lk: update LK recovery environment definition to include
      device lock state used by bootloader
    - daemon: return `storage-encryption` in /systems/<label> reply
    - tests: start using remote tools from snapd-testing-tools project
      in nested tests
    - tests: fix non mountable filesystem error in interfaces-udisks2
    - client: clarify what InstallStep{SetupStorageEncryption,Finish} do
    - client: prepare InstallSystemOptions for real use
    - usersession: Remove duplicated struct
    - o/snapstate: support specific revisions in UpdateMany/InstallMany
    - i/b/system_packages_doc: restore access to Libreoffice
      documentation
    - snap/quota,wrappers: allow using 0 values for the journal rate
      limit
    - tests: add kinetic images to the gce bucket for preseed test
    - multiple: clear up naming convention for thread quota
    - daemon: implement stub `"action": "install"`
    - tests/main/snap-quota-{install/journal}: fix unstable spread tests
    - tests: remove code for old systems not supported anymore
    - tests: third part of the nested helper cleanup
    - image: clean snapd mount after preseeding
    - tests: use the new ubuntu kinetic image
    - i/b/system_observe: honour root dir when checking for
      /boot/config-*
    - tests: restore microk8s test on 16.04
    - tests: run spread tests on arm64 instances in google cloud
    - tests: skip interfaces-udisks2 in fedora
    - asserts,boot,secboot: switch to a secboot version measuring
      classic
    - client: add API for GET /systems/<label>
    - overlord: frontend for --quota-group support (2/2)
    - daemon: add GET support for `/systems/<seed-label>`
    - i/b/system-observe: allow reading processes security label
    - many: support '--purge' when removing multiple snaps
    - snap-confine: remove obsolete code
    - interfaces: rework logic of unclashMountEntries
    - data/systemd/Makefile: add comment warning about "snapd." prefix
    - interfaces: grant access to speech-dispatcher socket (bug 1787245)
    - overlord/servicestate: disallow removal of quota group with any
      limits set
    - data: include snapd/mounts in preseeded blob
    - many: Set SNAPD_APPARMOR_REEXEC=1
    - store/tooling,tests: support UBUNTU_STORE_URL override env var
    - multiple: clear up naming convention for cpu-set quota
    - tests: improve and standardize debug section on tests
    - device: add new DeviceManager.encryptionSupportInfo()
    - tests: check snap download with snapcraft v7+ export-login auth
      data
    - cmd/snap-bootstrap: changes to be able to boot classic rootfs
    - tests: fix debug section for test uc20-create-partitions
    - overlord: --quota-group support (1/2)
    - asserts,cmd/snap-repair: drop not pursued
      AuthorityDelegation/signatory-id
    - snap-bootstrap: add CVM mode* snap-bootstrap: add classic runmode
    - interfaces: make polkit implicit on core if /usr/libexec/polkitd
      exists
    - multiple: move arguments for auth.NewUser into a struct (auto-
      removal 1/n)
    - overlord: track security profiles for non-active snaps
    - tests: remove NESTED_IMAGE_ID from nested manual tests
    - tests: add extra space to ubuntu bionic
    - store/tooling: support using snapcraft v7+ base64-encoded auth
      data
    - overlord: allow seeding in the case of classic with modes system
    - packaging/*/tests/integrationtests: reload ssh.service, not
      sshd.service
    - tests: rework snap-logs-journal test and add missing cleanup
    - tests: add spread test for journal quotas
    - tests: run spread tests in ubuntu kinetic
    - o/snapstate: extend support for holding refreshes
    - devicestate: return an error in checkEncryption() if KernelInfo
      fails
    - tests: fix sbuild test on debian sid
    - o/devicestate: do not run tests in this folder twice
    - sandbox/apparmor: remove duplicate hook into testing package
    - many: refactor store code to be able to use simpler form of auth
      creds
    - snap,store: drop support/consideration for anonymous download urls
    - data/selinux: allow snaps to read certificates
    - many: add Is{Core,Classic}Boot() to DeviceContext
    - o/assertstate: don't refresh enforced validation sets during check
    - go.mod: replace maze.io/x/crypto with local repo
    - many: fix unnecessary use of fmt.Sprintf
    - bootloader,systemd: fix `don't use Yoda conditions (ST1017)`
    - HACKING.md: extend guidelines with common review comments
    - many: progress bars should use the overridable stdouts
    - tests: remove ubuntu 21.10 from sru validation
    - tests: import remote tools
    - daemon,usersession: switch from HeaderMap to Header in tests
    - asserts: add some missing `c.Check()` in the asserts test
    - strutil: fix VersionCompare() to allow multiple `-` in the version
    - testutil: remove unneeded `fmt.Sprintf`
    - boot: remove some unneeded `fmt.Sprintf()` calls
    - tests: implement prepare_gadget and prepare_base and unify all the
      version
    - o/snapstate: refactor managed refresh schedule logic
    - o/assertstate, snapasserts: implementation of
      assertstate.TryEnforceValidationSets function
    - interfaces: add kconfig paths to system-observe
    - dbusutil: move debian patch into dbustest
    - many: change name and input of CheckProvenance to clarify usage
    - tests: Fix a missing parameter in command to wait for device
    - tests: Work-around non-functional --wait on systemctl
    - tests: unify the way the snapd/core and kernel are repacked in
      nested helper
    - tests: skip interfaces-ufisks2 on centos-9
    - i/b/mount-control: allow custom filesystem types
    - interfaces,metautil: make error handling in getPaths() more
      targeted
    - cmd/snap-update-ns: handle mountpoint removal failures with EBUSY
    - tests: fix pc-kernel repacking
    - systemd: add `WantedBy=default.target` to snap mount units
    - tests: disable microk8s test on 16.04

 -- Michael Vogt <email address hidden>  Thu, 01 Dec 2022 09:52:23 +0100

Available diffs

• diff from 2.57.5+23.04ubuntu0.1 to 2.58+23.04 (475.3 KiB)

snapd (2.57.5+23.04ubuntu0.1) lunar; urgency=medium

    - snap-confine: Fix race condition in snap-confine when preparing a
      private tmp mount namespace for a snap
    - CVE-2022-3328

 -- Michael Vogt <email address hidden>  Thu, 01 Dec 2022 11:21:49 +0100

Available diffs

• diff from 2.57.5+22.10 to 2.57.5+23.04ubuntu0.1 (23.8 KiB)

snapd (2.57.5+22.04ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Local privilege escalation
    - snap-confine: Fix race condition in snap-confine when preparing a
      private tmp mount namespace for a snap
    - CVE-2022-3328

 -- Alex Murray <email address hidden>  Mon, 28 Nov 2022 15:23:24 +1030

Available diffs

• diff from 2.57.5+22.04 (in Ubuntu) to 2.57.5+22.04ubuntu0.1 (10.0 KiB)
• diff from 2.54.3+22.04.1 to 2.57.5+22.04ubuntu0.1 (2.1 MiB)

snapd (2.57.5+22.10ubuntu0.1) kinetic-security; urgency=medium

  * SECURITY UPDATE: Local privilege escalation
    - snap-confine: Fix race condition in snap-confine when preparing a
      private tmp mount namespace for a snap
    - CVE-2022-3328

 -- Alex Murray <email address hidden>  Mon, 28 Nov 2022 13:20:27 +1030

Available diffs

• diff from 2.57.5+22.10 (in Ubuntu) to 2.57.5+22.10ubuntu0.1 (10.0 KiB)
• diff from 2.57.4+22.10ubuntu1 (in Ubuntu) to 2.57.5+22.10ubuntu0.1 (43.8 KiB)

snapd (2.57.5+20.04ubuntu0.1) focal-security; urgency=medium

  * SECURITY UPDATE: Local privilege escalation
    - snap-confine: Fix race condition in snap-confine when preparing a
      private tmp mount namespace for a snap
    - CVE-2022-3328

 -- Alex Murray <email address hidden>  Mon, 28 Nov 2022 15:25:10 +1030

Available diffs

• diff from 2.57.5+20.04 (in Ubuntu) to 2.57.5+20.04ubuntu0.1 (10.0 KiB)
• diff from 2.54.3+20.04.1ubuntu0.2 (in ~ubuntu-security-proposed/ubuntu/ppa) to 2.57.5+20.04ubuntu0.1 (2.2 MiB)
• diff from 2.54.3+20.04.1 to 2.57.5+20.04ubuntu0.1 (2.1 MiB)

snapd (2.57.5+18.04ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Local privilege escalation
    - snap-confine: Fix race condition in snap-confine when preparing a
      private tmp mount namespace for a snap
    - CVE-2022-3328

 -- Alex Murray <email address hidden>  Mon, 28 Nov 2022 15:26:53 +1030

Available diffs

• diff from 2.57.5+18.04 (in Ubuntu) to 2.57.5+18.04ubuntu0.1 (10.0 KiB)
• diff from 2.54.3+18.04.2ubuntu0.2 (in ~ubuntu-security-proposed/ubuntu/ppa) to 2.57.5+18.04ubuntu0.1 (2.2 MiB)
• diff from 2.54.3+18.04 to 2.57.5+18.04ubuntu0.1 (2.1 MiB)

snapd (2.57.5+18.04) bionic; urgency=medium

  * New upstream release, LP: #1983035
    - image: clean snapd mount after preseeding
    - wrappers,snap/quota: clear LogsDirectory= in the service unit
      for journal namespaces
    - cmd/snap,daemon: allow zero values from client to daemon for
      journal rate-limit
    - interfaces: steam-support allow pivot /run/media and /etc/nvidia
      mount
    - o/ifacestate: introduce DebugAutoConnectCheck hook
    - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
    - autopkgtests: fix running autopkgtest on kinetic
    - interfaces: add microceph interface
    - interfaces: steam-support allow additional mounts
    - many: add stub services
    - interfaces: add kconfig paths to system-observe
    - i/b/system_observe: honour root dir when checking for
      /boot/config-*
    - interfaces: grant access to speech-dispatcher socket
    - interfaces: rework logic of unclashMountEntries

 -- Michael Vogt <email address hidden>  Mon, 17 Oct 2022 18:25:18 +0200

Available diffs

• diff from 2.55.5+18.04 to 2.57.5+18.04 (1.6 MiB)

snapd (2.57.5+20.04) focal; urgency=medium

  * New upstream release, LP: #1983035
    - image: clean snapd mount after preseeding
    - wrappers,snap/quota: clear LogsDirectory= in the service unit
      for journal namespaces
    - cmd/snap,daemon: allow zero values from client to daemon for
      journal rate-limit
    - interfaces: steam-support allow pivot /run/media and /etc/nvidia
      mount
    - o/ifacestate: introduce DebugAutoConnectCheck hook
    - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
    - autopkgtests: fix running autopkgtest on kinetic
    - interfaces: add microceph interface
    - interfaces: steam-support allow additional mounts
    - many: add stub services
    - interfaces: add kconfig paths to system-observe
    - i/b/system_observe: honour root dir when checking for
      /boot/config-*
    - interfaces: grant access to speech-dispatcher socket
    - interfaces: rework logic of unclashMountEntries

 -- Michael Vogt <email address hidden>  Mon, 17 Oct 2022 18:25:18 +0200

Available diffs

• diff from 2.55.5+20.04 to 2.57.5+20.04 (1.6 MiB)

snapd (2.57.5+22.04) jammy; urgency=medium

  * New upstream release, LP: #1983035
    - image: clean snapd mount after preseeding
    - wrappers,snap/quota: clear LogsDirectory= in the service unit
      for journal namespaces
    - cmd/snap,daemon: allow zero values from client to daemon for
      journal rate-limit
    - interfaces: steam-support allow pivot /run/media and /etc/nvidia
      mount
    - o/ifacestate: introduce DebugAutoConnectCheck hook
    - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
    - autopkgtests: fix running autopkgtest on kinetic
    - interfaces: add microceph interface
    - interfaces: steam-support allow additional mounts
    - many: add stub services
    - interfaces: add kconfig paths to system-observe
    - i/b/system_observe: honour root dir when checking for
      /boot/config-*
    - interfaces: grant access to speech-dispatcher socket
    - interfaces: rework logic of unclashMountEntries

 -- Michael Vogt <email address hidden>  Mon, 17 Oct 2022 18:25:18 +0200

Available diffs

• diff from 2.57.4+22.04 to 2.57.5+22.04 (22.6 KiB)

snapd (2.57.5+22.10) kinetic; urgency=medium

  * New upstream release, LP: #1983035
    - image: clean snapd mount after preseeding
    - wrappers,snap/quota: clear LogsDirectory= in the service unit
      for journal namespaces
    - cmd/snap,daemon: allow zero values from client to daemon for
      journal rate-limit
    - interfaces: steam-support allow pivot /run/media and /etc/nvidia
      mount
    - o/ifacestate: introduce DebugAutoConnectCheck hook
    - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
    - autopkgtests: fix running autopkgtest on kinetic
    - interfaces: add microceph interface
    - interfaces: steam-support allow additional mounts
    - many: add stub services
    - interfaces: add kconfig paths to system-observe
    - i/b/system_observe: honour root dir when checking for
      /boot/config-*
    - interfaces: grant access to speech-dispatcher socket
    - interfaces: rework logic of unclashMountEntries

 -- Michael Vogt <email address hidden>  Mon, 17 Oct 2022 18:25:18 +0200

Available diffs

• diff from 2.57.4+22.10ubuntu1 to 2.57.5+22.10 (34.9 KiB)

snapd (2.57.4+22.04) jammy; urgency=medium

  * New upstream release, LP: #1983035
    - release, snapd-apparmor: fixed outdated WSL detection
    - overlord/ifacestate: fix conflict detection of auto-connection
    - overlord: run install-device hook during factory reset
    - image/preseed/preseed_linux: add missing new line
    - boot: add factory-reset cases for boot-flags.
    - interfaces: added read/write access to /proc/self/coredump_filter
      for process-control
    - interfaces: add read access to /proc/cgroups and
      /proc/sys/vm/swappiness to system-observe
    - fde: run fde-reveal-key with `DefaultDependencies=no`
    - snapdenv: added wsl to userAgent
    - tests: fix restore section for persistent-journal-namespace
    - i/b/mount-control: add optional `/` to umount rules
    - cmd/snap-bootstrap: changes to be able to boot classic rootfs
    - cmd/snap-bootstrap: add CVM mode

 -- Michael Vogt <email address hidden>  Thu, 29 Sep 2022 09:54:21 +0200

Available diffs

• diff from 2.56.2+22.04ubuntu1 to 2.57.4+22.04 (1.2 MiB)

snapd (2.57.4+22.10ubuntu1) kinetic; urgency=medium

  * Fix kinetic autopkgtest failure
    - cherry-pick https://github.com/snapcore/snapd/pull/12257:

 -- Michael Vogt <email address hidden>  Thu, 13 Oct 2022 12:14:13 +0200

Available diffs

• diff from 2.57.1+22.10.1 to 2.57.4+22.10ubuntu1 (406.2 KiB)

snapd (2.57.1+22.10.1) kinetic; urgency=medium

  * Adjust test suite to reload ssh.service, not sshd.service alias.

 -- Steve Langasek <email address hidden>  Sat, 20 Aug 2022 05:36:28 +0000

Available diffs

• diff from 2.57.1+22.10 to 2.57.1+22.10.1 (696 bytes)

snapd (2.57.1+22.10) kinetic; urgency=medium

  * New upstream release, LP: #1983035
    - cmd/snap-update-ns: handle mountpoint removal failures with EBUSY
    - cmd/snap-update-ns: print current mount entries
    - cmd/snap-update-ns: check the unused mounts with a cleaned path
    - snap-confine: disable -Werror=array-bounds in __overflow tests to
      fix build error on Ubuntu 22.10
    - systemd: add `WantedBy=default.target` to snap mount units
      (LP: #1983528)

 -- <email address hidden> (Samuele Pedroni (Canonical Services Ltd.))  Wed, 10 Aug 2022 09:30:50 +0300

Available diffs

• diff from 2.56+22.10 to 2.57.1+22.10 (864.4 KiB)
• diff from 2.57+22.10 to 2.57.1+22.10 (16.4 KiB)

snapd (2.56.2+22.04ubuntu1) jammy; urgency=medium

  * Cherry pick https://github.com/snapcore/snapd/pull/12011
    to fix launching snaps OEM install (LP: #1983528)

Available diffs

• diff from 2.55.5+22.04 to 2.56.2+22.04ubuntu1 (387.4 KiB)

snapd (2.57+22.10) kinetic; urgency=medium

  * New upstream release, LP: #1983035
    - tests: Fix calls to systemctl is-system-running
    - osutil/disks: handle GPT for 4k disk and too small tables
    - packaging: import change from the 2.54.3-1.1 upload
    - many: revert "features: disable refresh-app-awarness by default
      again"
    - tests: improve robustness of preparation for regression/lp-1803542
    - tests: get the ubuntu-image binary built with test keys
    - tests: remove commented code from lxd test
    - interfaces/builtin: add more permissions for steam-support
    - tests: skip interfaces-network-control on i386
    - tests: tweak the "tests/nested/manual/connections" test
    - interfaces: posix-mq: allow specifying message queue paths as an
      array
    - bootloader/assets: add ttyS0,115200n8 to grub.cfg
    - i/b/desktop,unity7: remove name= specification on D-Bus signals
    - tests: ensure that microk8s does not produce DENIED messages
    - many: support non-default provenance snap-revisions in
      DeriveSideInfo
    - tests: fix `core20-new-snapd-does-not-break-old-initrd` test
    - many: device and provenance revision authority cross checks
    - tests: fix nested save-data test on 22.04
    - sandbox/cgroup: ignore container slices when tracking snaps
    - tests: improve 'ignore-running' spread test
    - tests: add `debug:` section to `tests/nested/manual/connections`
    - tests: remove leaking `pc-kernel.snap` in `repack_kernel_snap`
    - many: preparations for revision authority cross checks including
      device scope
    - daemon,overlord/servicestate: followup changes from PR #11960 to
      snap logs
    - cmd/snap: fix visual representation of 'AxB%' cpu quota modifier.
    - many: expose and support provenance from snap.yaml metadata
    - overlord,snap: add support for per-snap storage on ubuntu-save
    - nested: fix core-early-config nested test
    - tests: revert lxd change to support nested lxd launch
    - tests: add invariant check for leftover cgroup scopes
    - daemon,systemd: introduce support for namespaces in 'snap logs'
    - cmd/snap: do not track apps that wish to stay outside of the life-
      cycle system
    - asserts: allow classic + snaps models and add distribution to
      model
    - cmd/snap: add snap debug connections/connection commands
    - data: start snapd after time-set.target
    - tests: remove ubuntu 21.10 from spread tests due to end of life
    - tests: Update the whitebox word to avoid inclusive naming issues
    - many: mount gadget in run folder
    - interfaces/hardware-observe: clean up reading access to sysfs
    - tests: use overlayfs for interfaces-opengl-nvidia test
    - tests: update fake-netplan-apply test for 22.04
    - tests: add executions for ubuntu 22.04
    - tests: enable centos-9
    - tests: make more robust the files check in preseed-core20 test
    - bootloader/assets: add fallback entry to grub.cfg
    - interfaces/apparmor: add permissions for per-snap directory on
      ubuntu-save partition
    - devicestate: add more path to `fixupWritableDefaultDirs()`
    - boot,secboot: reset DA lockout counter after successful boot
    - many: Revert "overlord,snap: add support for per-snap storage on
      ubuntu-save"
    - overlord,snap: add support for per-snap storage on ubuntu-save
    - tests: exclude centos-7 from kernel-module-load test
    - dirs: remove unused SnapAppArmorAdditionalDir
    - boot,device: extract SealedKey helpers from boot to device
    - boot,gadget: add new `device.TpmLockoutAuthUnder()` and use it
    - interfaces/display-control: allow changing brightness value
    - asserts: add more context to key expiry error
    - many: introduce IsUndo flag in LinkContext
    - i/apparmor: allow calling which.debianutils
    - tests: new profile id for apparmor in test preseed-core20
    - tests: detect 403 in apt-hooks and skip test in this case
    - overlord/servicestate: restart the relevant journald service when
      a journal quota group is modified
    - client,cmd/snap: add journal quota frontend (5/n)
    - gadget/device: introduce package which provides helpers for
      locations of things
    - features: disable refresh-app-awarness by default again
    - many: install bash completion files in writable directory
    - image: fix handling of var/lib/extrausers when preseeding
      uc20
    - tests: force version 2.48.3 on xenial ESM
    - tests: fix snap-network-erros on uc16
    - cmd/snap-confine: be compatible with a snap rootfs built as a
      tmpfs
    - o/snapstate: allow install of unasserted gadget/kernel on
      dangerous models
    - interfaces: dynamic loading of kernel modules
    - many: add optional primary key provenance to snap-revision, allow
      delegating via snap-declaration revision-authority
    - tests: fix boringcripto errors in centos7
    - tests: fix snap-validate-enforce in opensuse-tumbleweed
    - test: print User-Agent on failed checks
    - interfaces: add memory stats to system_observe
    - interfaces/pwm: Remove implicitOnCore/implicitOnClassic
    - spread: add openSUSE Leap 15.4
    - tests: disable core20-to-core22 nested test
    - tests: fix nested/manual/connections test
    - tests: add spread test for migrate-home command
    - overlord/servicestate: refresh security profiles when services are
      affected by quotas
    - interfaces/apparmor: add missing apparmor rules for journal
      namespaces
    - tests: add nested test variant that adds 4k sector size
    - cmd/snap: fix test failing due to timezone differences
    - build-aux/snap: build against the snappy-dev/image PPA
    - daemon: implement api handler for refresh with enforced validation
      sets
    - preseed: suggest to install "qemu-user-static"
    - many: add migrate-home debug command
    - o/snapstate: support passing validation sets to storehelpers via
      RevisionOptions
    - cmd/snapd-apparmor: fix unit tests on distros which do not support
      reexec
    - o/devicestate: post factory reset ensure, spread test update
    - tests/core/basic20: Enable on uc22
    - packaging/arch: install snapd-apparmor
    - o/snapstate: support migrating snap home as change
    - tests: enable snapd.apparmor service in all the opensuse systems
    - snapd-apparmor: add more integration-ish tests
    - asserts: store required revisions for missing snaps in
      CheckInstalledSnaps
    - overlord/ifacestate: fix path for journal redirect
    - o/devicestate: factory reset with encryption
    - cmd/snapd-apparmor: reimplement snapd-apparmor in Go
    - squashfs: improve error reporting when `unsquashfs` fails
    - o/assertstate: support multiple extra validation sets in
      EnforcedValidationSets
    - tests: enable mount-order-regression test for arm devices
    - tests: fix interfaces network control
    - interfaces: update AppArmor template to allow read the memory …
    - cmd/snap-update-ns: add /run/systemd to unrestricted paths
    - wrappers: fix LogNamespace being written to the wrong file
    - boot: release the new PCR handles when sealing for factory reset
    - tests: add support fof uc22 in test uboot-unpacked-assets
    - boot: post factory reset cleanup
    - tests: add support for uc22 in listing test
    - spread.yaml: add ubuntu-22.04-06 to qemu-nested
    - gadget: check also mbr type when testing for implicit data
      partition
    - interfaces/system-packages-doc: allow read-only access to
      /usr/share/cups/doc-root/ and /usr/share/gimp/2.0/help/
    - tests/nested/manual/core20-early-config: revert changes that
      disable netplan checks
    - o/ifacestate: warn if the snapd.apparmor service is disabled
    - tests: add spread execution for fedora 36
    - overlord/hookstate/ctlcmd: fix timestamp coming out of sync in
      unit tests
    - gadget/install: do not assume dm device has same block size as
      disk
    - interfaces: update network-control interface with permissions
      required by resolvectl
    - secboot: stage and transition encryption keys
    - secboot, boot: support and use alternative PCR handles during
      factory reset
    - overlord/ifacestate: add journal bind-mount snap layout when snap
      is in a journal quota group (4/n)
    - secboot/keymgr, cmd/snap-fde-keymgr: two step encryption key
      change
    - cmd/snap: cleanup and make the code a bit easier to read/maintain
      for quota options
    - overlord/hookstate/ctlcmd: add 'snapctl model' command (3/3)
    - cmd/snap-repair: fix snap-repair tests silently failing
    - spread: drop openSUSE Leap 15.2
    - interfaces/builtin: remove the name=org.freedesktop.DBus
      restriction in cups-control AppArmor rules
    - wrappers: write journald config files for quota groups with
      journal quotas (3/n)
    - o/assertstate: auto aliases for apps that exist
    - o/state: use more detailed NoStateError in state
    - tests/main/interfaces-browser-support: verify jupyter notebooks
      access
    - o/snapstate: exclude services from refresh app awareness hard
      running check
    - tests/main/nfs-support: be robust against umount failures
    - tests: update centos images and add new centos 9 image
    - many: print valid/invalid status on snap validate --monitor
    - secboot, boot: TPM provisioning mode enum, introduce
      reprovisioning
    - tests: allow to re-execute aborted tests
    - cmd/snapd-apparmor: add explicit WSL detection to
      is_container_with_internal_policy
    - tests: avoid launching lxd inside lxd on cloud images
    - interfaces: extra htop apparmor rules
    - gadget/install: encrypted system factory reset support
    - secboot: helpers for dealing with PCR handles and TPM resources
    - systemd: improve error handling for systemd-sysctl command
    - boot, secboot: separate the TPM provisioning and key sealing
    - o/snapstate: fix validation sets restoring and snap revert on
      failed refresh
    - interfaces/builtin/system-observe: extend access for htop
    - cmd/snap: support custom apparmor features dir with snap prepare-
      image
    - interfaces/mount-observe: Allow read access to /run/mount/utab
    - cmd/snap: add help strings for set-quota options
    - interfaces/builtin: add README file
    - cmd/snap-confine: mount support cleanups
    - overlord: execute snapshot cleanup in task
    - i/b/accounts_service: fix path of introspectable objects
    - interfaces/opengl: update allowed PCI accesses for RPi
    - configcore: add core.system.ctrl-alt-del-action config option
    - many: structured startup timings
    - spread: switch back to building ubuntu-image from source
    - many: optional recovery keys
    - tests/lib/nested: fix unbound variable
    - run-checks: fail on equality checks w/ ErrNoState
    - snap-bootstrap: Mount as private
    - tests: Test for gadget connections
    - tests: set `br54.dhcp4=false` in the netplan-cfg test
    - tests: core20 preseed/nested spread test
    - systemd: remove the systemctl stop timeout handling
    - interfaces/shared-memory: Update AppArmor permissions for
      mmap+link
    - many: replace ErrNoState equality checks w/ errors.Is()
    - cmd/snap: exit w/ non-zero code on missing snap
    - systemd: fix snapd systemd-unit stop progress notifications
    - .github: Trigger daily riscv64 snapd edge builds
    - interfaces/serial-port: add ttyGS to serial port allow list
    - interfaces/modem-manager: Don't generate DBus plug policy
    - tests: add spread test to test upgrade from release snapd to
      current
    - wrappers: refactor EnsureSnapServices
    - testutil: add ErrorIs test checker
    - tests: import spread shellcheck changes
    - cmd/snap-fde-keymgr: best effort idempotency of add-recovery-key
    - interfaces/udev: refactor handling of udevadm triggers for input
    - secboot: support for changing encryption keys via keymgr

 -- Michael Vogt <email address hidden>  Thu, 28 Jul 2022 16:59:39 +0200

Available diffs

• diff from 2.56+22.10 to 2.57+22.10 (873.4 KiB)

snapd (2.56+22.10) kinetic; urgency=medium

  * New upstream release, LP: #1974147
    - portal-info: Add CommonID Field
    - asserts/info,mkversion.sh: capture max assertion formats in
      snapd/info
    - tests: improve the unit testing workflow to run in parallel
    - interfaces: allow map and execute permissions for files on
      removable media
    - tests: add spread test to verify that connections are preserved if
      snap refresh fails
    - tests: Apparmor sandbox profile mocking
    - cmd/snap-fde-keymgr: support for multiple devices and
      authorizations for add/remove recovery key
    - cmd/snap-bootstrap: Listen to keyboard added after start and
      handle switch root
    - interfaces,overlord: add support for adding extra mount layouts
    - cmd/snap: replace existing code for 'snap model' to use shared
      code in clientutil (2/3)
    - interfaces: fix opengl interface on RISC-V
    - interfaces: allow access to the file locking for cryptosetup in
      the dm-crypt interface
    - interfaces: network-manager: add AppArmor rule for configuring
      bridges
    - i/b/hardware-observe.go: add access to the thermal sysfs
    - interfaces: opengl: add rules for NXP i.MX GPU drivers
    - i/b/mount_control: add an optional "/" to the mount target rule
    - snap/quota: add values for journal quotas (journal quota 2/n)
    - tests: spread test for uc20 preseeding covering snap prepare-image
    - o/snapstate: remove deadcode breaking static checks
    - secboot/keymgr: extend unit tests, add helper for identify keyslot
      used error
    - tests: use new snaps.name and snaps.cleanup tools
    - interfaces: tweak getPath() slightly and add some more tests
    - tests: update snapd testing tools
    - client/clientutil: add shared code for printing model assertions
      as yaml or json (1/3)
    - debug-tools: list all snaps
    - cmd/snap: join search terms passed in the command line
    - osutil/disks: partition UUID lookup
    - o/snapshotstate: refactor snapshot read/write logic
    - interfaces: Allow locking in block-devices
    - daemon: /v2/system-recovery-keys remove API
    - snapstate: do not auto-migrate to ~/Snap for core22 just yet
    - tests: run failed tests by default
    - o/snapshotstate: check installed snaps before running 'save' tasks
    - secboot/keymgr: remove recovery key, authorize with existing key
    - deps: bump libseccomp to include build fixes, run unit tests using
      CC=clang
    - cmd/snap-seccomp: only compare the bottom 32-bits of the flags arg
      of copy_file_range
    - osutil/disks: helper for obtaining the UUID of a partition which
      is a mount point source
    - image/preseed: umount the base snap last after writable paths
    - tests: new set of nested tests for uc22
    - tests: run failed tests on nested suite
    - interfaces: posix-mq: add new interface
    - tests/main/user-session-env: remove openSUSE-specific tweaks
    - tests: skip external backend in mem-cgroup-disabled test
    - snap/quota: change the journal quota period to be a time.Duration
    - interfaces/apparmor: allow executing /usr/bin/numfmt in the base
      template
    - tests: add lz4 dependency for jammy to avoid issues repacking
      kernel
    - snap-bootstrap, o/devicestate: use seed parallelism
    - cmd/snap-update-ns: correctly set sticky bit on created
      directories where applicable
    - tests: install snapd while restoring in snap-mgmt
    - .github: skip misspell and ineffassign on go 1.13
    - many: use UC20+/pre-UC20 in user messages as needed
    - o/devicestate: use snap handler for copying and checksuming
      preseeded snaps
    - image, cmd/snap-preseed: allow passing custom apparmor features
      path
    - o/assertstate: fix handling of validation set tracking update in
      enforcing mode
    - packaging: restart our units only after the upgrade
    - interfaces: add a steam-support interface
    - gadget/install, o/devicestate: do not create recovery and
      reinstall keys during installation
    - many: move recovery key responsibility to devicestate/secboot,
      prepare for a future with just optional recovery key
    - tests: do not run mem-cgroup-disabled on external backends
    - snap: implement "star" developers
    - o/devicestate: fix install tests on systems with
      /var/lib/snapd/snap
    - cmd/snap-fde-keymgr, secboot: followup cleanups
    - seed: let SnapHandler provided a different final path for snaps
    - o/devicestate: implement maybeApplyPreseededData function to apply
      preseed artifact
    - tests/lib/tools: add piboot to boot_path()
    - interfaces/builtin: shared-memory drop plugs allow-installation:
      true
    - tests/main/user-session-env: for for opensuse
    - cmd/snap-fde-keymgr, secboot: add a tiny FDE key manager
    - tests: re-execute the failed tests when "Run failed" label is set
      in the PR
    - interfaces/builtin/custom-device: fix unit tests on hosts with
      different libexecdir
    - sandbox: move profile load/unload to sandbox/apparmor
    - cmd/snap: handler call verifications for cmd_quota_tests
    - secboot/keys: introduce a package for secboot key types, use the
      package throughout the code base
    - snap/quota: add journal quotas to resources.go
    - many: let provide a SnapHandler to Seed.Load*Meta*
    - osutil: allow setting desired mtime on the AtomicFile, preserve
      mtime on copy
    - systemd: add systemd.Run() wrapper for systemd-run
    - tests: test fresh install of core22-based snap (#11696)
    - tests: initial set of tests to uc22 nested execution
    - o/snapstate: migration overwrites existing snap dir
    - tests: fix interfaces-location-control tests leaking provider.py
      process
    - tests/nested: fix custom-device test
    - tests: test migration w/ revert, refresh and XDG dir creation
    - asserts,store: complete support for optional primary key headers
      for assertions
    - seed: support parallelism when loading/verifying snap metadata
    - image/preseed, cmd/snap-preseed: create and sign preseed assertion
    - tests: Initial changes to run nested tests on uc22
    - o/snapstate: fix TestSnapdRefreshTasks test after two r-a-a PRs
    - interfaces: add ACRN hypervisor support
    - o/snapstate: exclude TypeSnapd and TypeOS snaps from refresh-app-
      awareness
    - features: enable refresh-app-awareness by default
    - libsnap-confine-private: show proper error when aa_change_onexec()
      fails
    - i/apparmor: remove leftover comment
    - gadget: drop unused code in unit tests
    - image, store: move ToolingStore to store/tooling package
    - HACKING: update info for snapcraft remote build
    - seed: return all essential snaps found if no types are given to
      LoadEssentialMeta
    - i/b/custom_device: fix generation of udev rules
    - tests/nested/manual/core20-early-config: disable netplan checks
    - bootloader/assets, tests: add factory-reset mode, test non-
      encrypted factory-reset
    - interfaces/modem-manager: add support for Cinterion modules
    - gadget: fully support multi-volume gadget asset updates in
      Update() on UC20+
    - i/b/content: use slot.Lookup() as suggested by TODO comment
    - tests: install linux-tools-gcp on jammy to avoid bpftool
      dependency error
    - tests/main: add spread tests for new cpu and thread quotas
    - snap-debug-info: print validation sets and validation set
      assertions
    - many: renaming related to inclusive language part 2
    - c/snap-seccomp: update syscalls to match libseccomp 2657109
    - github: cancel workflows when pushing to pull request branches
    - .github: use reviewdog action from woke tool
    - interfaces/system-packages-doc: allow read-only access to
      /usr/share/gtk-doc
    - interfaces: add max_map_count to system-observe
    - o/snapstate: print pids of running processes on BusySnapError
    - .github: run woke tool on PR's
    - snapshots: follow-up on exclusions PR
    - cmd/snap: add check switch for snap debug state
    - tests: do not run mount-order-regression test on i386
    - interfaces/system-packages-doc: allow read-only access to
      /usr/share/xubuntu-docs
    - interfaces/hardware_observe: add read access for various devices
    - packaging: use latest go to build spread
    - tests: Enable more tests for UC22
    - interfaces/builtin/network-control: also allow for mstp and bchat
      devices too
    - interfaces/builtin: update apparmor profile to allow creating
      mimic over /usr/share*
    - data/selinux: allow snap-update-ns to mount on top of /var/snap
      inside the mount ns
    - interfaces/cpu-control: fix apparmor rules of paths with CPU ID
    - tests: remove the file that configures nm as default
    - tests: fix the change done for netplan-cfg test
    - tests: disable netplan-cfg test
    - cmd/snap-update-ns: apply content mounts before layouts
    - overlord/state: add a helper to detect cyclic dependencies between
      tasks in change
    - packaging/ubuntu-16.04/control: recommend `fuse3 | fuse`
    - many: change "transactional" flag to a "transaction" option
    - b/piboot.go: check EEPROM version for RPi4
    - snap/quota,spread: raise lower memory quota limit to 640kb
    - boot,bootloader: add missing grub.cfg assets mocks in some tests
    - many: support --ignore-running with refresh many
    - tests: skip the test interfaces-many-snap-provided in
      trusty
    - o/snapstate: rename XDG dirs during HOME migration
    - cmd/snap,wrappers: fix wrong implementation of zero count cpu
      quota
    - i/b/kernel_module_load: expand $SNAP_COMMON in module options
    - interfaces/u2f-devices: add Solo V2
    - overlord: add missing grub.cfg assets mocks in manager_tests.go
    - asserts: extend optional primary keys support to the in-memory
      backend
    - tests: update the lxd-no-fuse test
    - many: fix failing golangci checks
    - seed,many: allow to limit LoadMeta to snaps of a precise mode
    - tests: allow ubuntu-image to be built with a compatible snapd tree
    - o/snapstate: account for repeat migration in ~/Snap undo
    - asserts: start supporting optional primary keys in fs backend,
      assemble and signing
    - b/a: do not set console in kernel command line for arm64
    - tests/main/snap-quota-groups: fix spread test
    - sandbox,quota: ensure cgroup is available when creating mem
      quotas
    - tests: add debug output what keeps `/home` busy
    - sanity: rename "sanity.Check" to "syscheck.CheckSystem"
    - interfaces: add pkcs11 interface
    - o/snapstate: undo migration on 'snap revert'
    - overlord: snapshot exclusions
    - interfaces: add private /dev/shm support to shared-memory
      interface
    - gadget/install: implement factory reset for unencrypted system
    - packaging: install Go snap from 1.17 channel in the integration
      tests
    - snap-exec: fix detection if `cups` interface is connected
    - tests: extend gadget-config-defaults test with refresh.retain
    - cmd/snap,strutil: move lineWrap to WordWrapPadded
    - bootloader/piboot: add support for armhf
    - snap,wrappers: add `sigint{,-all}` to supported stop-modes
    - packaging/ubuntu-16.04/control: depend on fuse3 | fuse
    - interfaces/system-packages-doc: allow read-only access to
      /usr/share/libreoffice/help
    - daemon: add a /v2/accessories/changes/{ID} endpoint
    - interfaces/appstream-metadata: Re-create app-info links to
      swcatalog
    - debug-tools: add script to help debugging GCE instances which fail
      to boot
    - gadget/install, kernel: more ICE helpers/support
    - asserts: exclude empty snap id from duplicates lookup with preseed
      assert
    - cmd/snap, signtool: move key-manager related helpers to signtool
      package
    - tests/main/snap-quota-groups: add 219 as possible exit code
    - store: set validation-sets on actions when refreshing
    - github/workflows: update golangci-lint version
    - run-check: use go install instead of go get
    - tests: set as manual the interfaces-cups-control test
    - interfaces/appstream-metadata: Support new swcatalog directory
      names
    - image/preseed: migrate tests from cmd/snap-preseed
    - tests/main/uc20-create-partitions: update the test for new Go
      versions
    - strutil: move wrapGeneric function to strutil as WordWrap
    - many: small inconsequential tweaks
    - quota: detect/error if cpu-set is used with cgroup v1
    - tests: moving ubuntu-image to candidate to fix uc16 tests
    - image: integrate UC20 preseeding with image.Prepare
    - cmd/snap,client: frontend for cpu/thread quotas
    - quota: add test for `Resource.clone()`
    - many: replace use of "sanity" with more inclusive naming (part 2)
    - tests: switch to "test-snapd-swtpm"
    - i/b/network-manager: split rule with more than one peers
    - tests: fix restore of the BUILD_DIR in failover test on uc18
    - cmd/snap/debug: sort changes by their spawn times
    - asserts,interfaces/policy: slot-snap-id allow-installation
      constraints
    - o/devicestate: factory reset mode, no encryption
    - debug-tools/snap-debug-info.sh: print message if no gadget snap
      found
    - overlord/devicestate: install system cleanups
    - cmd/snap-bootstrap: support booting into factory-reset mode
    - o/snapstate, ifacestate: pass preseeding flag to
      AddSnapdSnapServices
    - o/devicestate: restore device key and serial when assertion is
      found
    - data: add static preseed.json file
    - sandbox: improve error message from `ProbeCgroupVersion()`
    - tests: fix the nested remodel tests
    - quota: add some more unit tests around Resource.Change()
    - debug-tools/snap-debug-info.sh: add debug script
    - tests: workaround lxd issue lp:10079 (function not implemented) on
      prep-snapd-in-lxd
    - osutil/disks: blockdev need not be available in the PATH
    - cmd/snap-preseed: address deadcode linter
    - tests/lib/fakestore/store: return snap base in details
    - tests/lib/nested.sh: rm core18 snap after download
    - systemd: do not reload system when enabling/disabling services
    - i/b/kubernetes_support: add access to Java certificates

 -- Michael Vogt <email address hidden>  Thu, 19 May 2022 09:57:33 +0200

Available diffs

• diff from 2.55.3+22.04ubuntu1 to 2.56+22.10 (396.9 KiB)

snapd (2.55.5+18.04) bionic; urgency=medium

  * New upstream release, LP: #1965808
    - snapstate: do not auto-migrate to ~/Snap for core22 just yet
    - cmd/snap-seccomp: add copy_file_range to
      syscallsWithNegArgsMaskHi32
    - cmd/snap-update-ns: correctly set sticky bit on created
      directories where applicable
    - .github: Skip misspell and ineffassign on go 1.13
    - tests: add lz4 dependency for jammy to avoid issues repacking
      kernel
    - interfaces: posix-mq: add new interface

 -- Michael Vogt <email address hidden>  Wed, 11 May 2022 06:38:24 +0200

Available diffs

• diff from 2.54.3+18.04.2ubuntu0.2 (in ~ubuntu-security-proposed/ubuntu/ppa) to 2.55.5+18.04 (591.5 KiB)
• diff from 2.54.2+18.04ubuntu1 to 2.55.5+18.04 (620.3 KiB)

snapd (2.55.5+21.10) impish; urgency=medium

  * New upstream release, LP: #1965808
    - snapstate: do not auto-migrate to ~/Snap for core22 just yet
    - cmd/snap-seccomp: add copy_file_range to
      syscallsWithNegArgsMaskHi32
    - cmd/snap-update-ns: correctly set sticky bit on created
      directories where applicable
    - .github: Skip misspell and ineffassign on go 1.13
    - tests: add lz4 dependency for jammy to avoid issues repacking
      kernel
    - interfaces: posix-mq: add new interface

 -- Michael Vogt <email address hidden>  Wed, 11 May 2022 06:38:24 +0200

Available diffs

• diff from 2.54.3+21.10.1ubuntu0.3 to 2.55.5+21.10 (591.5 KiB)

snapd (2.55.5+20.04) focal; urgency=medium

  * New upstream release, LP: #1965808
    - snapstate: do not auto-migrate to ~/Snap for core22 just yet
    - cmd/snap-seccomp: add copy_file_range to
      syscallsWithNegArgsMaskHi32
    - cmd/snap-update-ns: correctly set sticky bit on created
      directories where applicable
    - .github: Skip misspell and ineffassign on go 1.13
    - tests: add lz4 dependency for jammy to avoid issues repacking
      kernel
    - interfaces: posix-mq: add new interface

 -- Michael Vogt <email address hidden>  Wed, 11 May 2022 06:38:24 +0200

Available diffs

• diff from 2.54.3+20.04.1ubuntu0.3 to 2.55.5+20.04 (591.6 KiB)

snapd (2.55.5+22.04) jammy; urgency=medium

  * New upstream release, LP: #1965808
    - snapstate: do not auto-migrate to ~/Snap for core22 just yet
    - cmd/snap-seccomp: add copy_file_range to
      syscallsWithNegArgsMaskHi32
    - cmd/snap-update-ns: correctly set sticky bit on created
      directories where applicable
    - .github: Skip misspell and ineffassign on go 1.13
    - tests: add lz4 dependency for jammy to avoid issues repacking
      kernel
    - interfaces: posix-mq: add new interface

 -- Michael Vogt <email address hidden>  Wed, 11 May 2022 06:38:24 +0200

Available diffs

• diff from 2.55.3+22.04ubuntu1 to 2.55.5+22.04 (33.0 KiB)

snapd (2.54.3+20.04.1ubuntu0.3) focal; urgency=medium

  * Cherry-pick https://github.com/snapcore/snapd/pull/11680 and
    https://github.com/snapcore/snapd/pull/11287:
    - This fixes a bad interaction between snapd and update-notifier
      during a release upgrade (LP: #1969162)

 -- Michael Vogt <email address hidden>  Wed, 27 Apr 2022 18:12:51 +0200

Available diffs

• diff from 2.54.3+20.04.1ubuntu0.2 (in ~ubuntu-security-proposed/ubuntu/ppa) to 2.54.3+20.04.1ubuntu0.3 (962 bytes)
• diff from 2.54.2+20.04ubuntu2 to 2.54.3+20.04.1ubuntu0.3 (37.0 KiB)

snapd (2.55.3+22.04ubuntu1) jammy; urgency=medium

  * Cherry-pick https://github.com/snapcore/snapd/pull/11680
    - This fixes a bad interaction between snapd and update-notifier
      during a release upgrade (LP: #1969162)

 -- Michael Vogt <email address hidden>  Thu, 21 Apr 2022 10:50:55 +0200

Available diffs

• diff from 2.55.3+22.04 to 2.55.3+22.04ubuntu1 (694 bytes)

snapd (2.54.3+21.10.1ubuntu0.3) impish; urgency=medium

  * Cherry-pick https://github.com/snapcore/snapd/pull/11680 and
    https://github.com/snapcore/snapd/pull/11287:
    - This fixes a bad interaction between snapd and update-notifier
      during a release upgrade (LP: #1969162)

 -- Michael Vogt <email address hidden>  Thu, 21 Apr 2022 12:11:17 +0200

Available diffs

• diff from 2.54.3+21.10.1ubuntu0.2 (in ~ubuntu-security-proposed/ubuntu/ppa) to 2.54.3+21.10.1ubuntu0.3 (958 bytes)
• diff from 2.54.2+21.10ubuntu1 to 2.54.3+21.10.1ubuntu0.3 (36.5 KiB)

snapd (2.55.3+22.04) jammy; urgency=medium

  * New upstream release, LP: #1965808
    - cmd/snap-update-ns: apply content mounts before layouts
    - many: change "transactional" flag to a "transaction" option
    - b/piboot.go: check EEPROM version for RPi4
    - snap/quota,spread: raise lower memory quota limit to 640kb
    - boot,bootloader: add missing grub.cfg assets mocks in some
      tests
    - many: support --ignore-running with refresh many
    - cmd/snap,wrappers: fix wrong implementation of zero count cpu
      quota
    - quota: add some more unit tests around Resource.Change()
    - quota: detect/error if cpu-set is used with cgroup v1
    - quota: add test for `Resource.clone()
    - cmd/snap,client: frontend for cpu/thread quotas
    - tests: update spread test to check right XDG dirs
    - snap: set XDG env vars to new dirs
    - o/snapstate: initialize XDG dirs in HOME migration
    - i/b/kernel_module_load: expand $SNAP_COMMON in module options
    - overlord: add missing grub.cfg assets mocks in manager_tests.go
    - o/snapstate: account for repeat migration in ~/Snap undo
    - b/a: do not set console in kernel command line for arm64
    - sandbox: improve error message from `ProbeCgroupVersion()`
    - tests/main/snap-quota-groups: fix spread test
    - interfaces: add pkcs11 interface
    - o/snapstate: undo migration on 'snap revert'
    - overlord: snapshot exclusions
    - interfaces: add private /dev/shm support to shared-memory
      interface
    - packaging: install Go snap from 1.17 channel in the integration
      tests
    - snap-exec: fix detection if `cups` interface is connected
    - bootloader/piboot: add support for armhf
    - interfaces/system-packages-doc: allow read-only access to
      /usr/share/libreoffice/help
    - daemon: add a /v2/accessories/changes/{ID} endpoint
    - interfaces/appstream-metadata: Re-create app-info links to
      swcatalog
    - tests/main/snap-quota-groups: add 219 as possible exit code
    - store: set validation-sets on actions when refreshing
    - interfaces/appstream-metadata: Support new swcatalog directory
      names
    - asserts,interfaces/policy: slot-snap-id allow-installation
      constraints
    - i/b/network-manager: change rule for ResolveAddress to check only
      label
    - cmd/snap-bootstrap: support booting into factory-reset mode
    - systemd: do not reload system when enabling/disabling services

 -- Michael Vogt <email address hidden>  Fri, 08 Apr 2022 16:48:35 +0200

Available diffs

• diff from 2.55.2+22.04.1 to 2.55.3+22.04 (112.9 KiB)

snapd (2.55.2+22.04.1) jammy; urgency=medium

  * packaging/16.04/tests/integrationtests: Install the Go snap from the 1.17
    channel, as the behaviour of "go get" changes in 1.18 meaning spread does
    not get installed to the expected location.

 -- Michael Hudson-Doyle <email address hidden>  Mon, 04 Apr 2022 10:46:33 +1200

Available diffs

• diff from 2.55.2+22.04 to 2.55.2+22.04.1 (628 bytes)

snapd (2.55.2+22.04) jammy; urgency=medium

  * New upstream release, LP: #1965808
    - cmd/snap-update-ns: actually use entirely non-existent dirs

 -- Ian Johnson <email address hidden>  Mon, 21 Mar 2022 22:16:54 -0500

Available diffs

• diff from 2.54.3+git26.g360067e+22.04 to 2.55.2+22.04 (497.4 KiB)

snapd (2.54.3+git26.g360067e+22.04) jammy; urgency=medium

  * New git snapshot that cherry picks PR#11276

 -- Michael Vogt <email address hidden>  Sun, 27 Feb 2022 20:10:37 +0100

Available diffs

• diff from 2.54.3+git19.g868fc21+22.04 to 2.54.3+git26.g360067e+22.04 (14.3 KiB)

snapd (2.54.3+18.04.2ubuntu0.2) bionic-security; urgency=medium

  * SECURITY REGRESSION: Fix fish shell compatibility
    - data/env/snapd.fish.in: more workarounds for even older fish shells,
      provide reasonable defaults.
    - LP: #1961791

 -- Paulo Flabiano Smorigo <email address hidden>  Wed, 23 Feb 2022 18:29:05 +0000

Available diffs

• diff from 2.54.3+18.04.2ubuntu0.1 to 2.54.3+18.04.2ubuntu0.2 (877 bytes)

snapd (2.54.3+21.10.1ubuntu0.2) impish-security; urgency=medium

  * SECURITY REGRESSION: Fix fish shell compatibility
    - data/env/snapd.fish.in: more workarounds for even older fish shells,
      provide reasonable defaults.
    - LP: #1961791

 -- Paulo Flabiano Smorigo <email address hidden>  Wed, 23 Feb 2022 14:48:54 +0000

Available diffs

• diff from 2.54.3+21.10.1ubuntu0.1 to 2.54.3+21.10.1ubuntu0.2 (880 bytes)

snapd (2.54.3+20.04.1ubuntu0.2) focal-security; urgency=medium

  * SECURITY REGRESSION: Fix fish shell compatibility
    - data/env/snapd.fish.in: more workarounds for even older fish shells,
      provide reasonable defaults.
    - LP: #1961791

 -- Paulo Flabiano Smorigo <email address hidden>  Wed, 23 Feb 2022 18:25:31 +0000

Available diffs

• diff from 2.54.3+20.04.1ubuntu0.1 to 2.54.3+20.04.1ubuntu0.2 (878 bytes)

snapd (2.54.3+18.04.2ubuntu0.1) bionic-security; urgency=medium

  * SECURITY REGRESSION: Fix fish shell compatibility
    - data/env/snapd.fish.in: fix fish env for all versions of fish, unexport
      local vars, export XDG_DATA_DIRS.
    - LP: #1961365

 -- Paulo Flabiano Smorigo <email address hidden>  Fri, 18 Feb 2022 14:06:51 +0000

Available diffs

• diff from 2.54.3+18.04 (in ~ubuntu-security/ubuntu/ppa) to 2.54.3+18.04.2ubuntu0.1 (816 bytes)
• diff from 2.54.3+18.04.2 to 2.54.3+18.04.2ubuntu0.1 (362 bytes)

snapd (2.54.3+20.04.1ubuntu0.1) focal-security; urgency=medium

  * SECURITY REGRESSION: Fix fish shell compatibility
    - data/env/snapd.fish.in: fix fish env for all versions of fish, unexport
      local vars, export XDG_DATA_DIRS.
    - LP: #1961365

 -- Paulo Flabiano Smorigo <email address hidden>  Fri, 18 Feb 2022 21:31:48 +0000

Available diffs

• diff from 2.54.3+20.04.1 (in ~ubuntu-security/ubuntu/ppa) to 2.54.3+20.04.1ubuntu0.1 (835 bytes)
• diff from 2.48.3+20.04 (in ~ubuntu-security/ubuntu/ppa) to 2.54.3+20.04.1ubuntu0.1 (4.2 MiB)

snapd (2.54.3+21.10.1ubuntu0.1) impish-security; urgency=medium

  * SECURITY REGRESSION: Fix fish shell compatibility
    - data/env/snapd.fish.in: fix fish env for all versions of fish, unexport
      local vars, export XDG_DATA_DIRS.
    - LP: #1961365

 -- Paulo Flabiano Smorigo <email address hidden>  Fri, 18 Feb 2022 21:21:29 +0000

Available diffs

• diff from 2.54.3+21.10.1 (in ~ubuntu-security/ubuntu/ppa) to 2.54.3+21.10.1ubuntu0.1 (830 bytes)
• diff from 2.53+21.10ubuntu1 (in Ubuntu) to 2.54.3+21.10.1ubuntu0.1 (685.9 KiB)

snapd (2.54.3+20.04.1) focal-security; urgency=medium

  * debian/rules: disabling unit tests on riscv64

 -- Emilia Torino <email address hidden>  Thu, 17 Feb 2022 15:37:53 -0300

Available diffs

• diff from 2.54.3+20.04 to 2.54.3+20.04.1 (834 bytes)

snapd (2.54.3+git19.g868fc21+22.04) jammy; urgency=medium

  * New git snapshot with fixes for CVE-2021-44730, CVE-2021-44731,
    CVE-2021-4120

 -- Michael Vogt <email address hidden>  Thu, 17 Feb 2022 18:51:49 +0100

Available diffs

• diff from 2.54.2+22.04ubuntu3 to 2.54.3+git19.g868fc21+22.04 (42.5 KiB)
• diff from 2.54.3+22.04.1 (in ~ubuntu-security/ubuntu/ppa) to 2.54.3+git19.g868fc21+22.04 (9.7 KiB)

snapd (2.54.3+22.04.1) jammy; urgency=medium

  * SECURITY UPDATE: Sensitive information exposure
    - usersession/autostart: change ~/snap perms to 0700 on startup.
    - cmd: create ~/snap dir with 0700 perms.
    - CVE-2021-3155
    - LP: #1910298
  * SECURITY UPDATE: Local privilege escalation
    - snap-confine: Add validations of the location of the snap-confine
      binary within snapd.
    - snap-confine: Fix race condition in snap-confine when preparing a
      private mount namespace for a snap.
    - CVE-2021-44730
    - CVE-2021-44731
  * SECURITY UPDATE: Data injection from malicious snaps
    - interfaces: Add validations of snap content interface and layout
      paths in snapd.
    - CVE-2021-4120
    - LP: #1949368

 -- Michael Vogt <email address hidden>  Tue, 15 Feb 2022 17:45:13 +0100

Available diffs

• diff from 2.54.2+22.04ubuntu3 (in Ubuntu) to 2.54.3+22.04.1 (35.9 KiB)
• diff from 2.54.3+22.04 to 2.54.3+22.04.1 (456 bytes)

snapd (2.54.3+21.10.1) impish-security; urgency=medium

  * SECURITY UPDATE: Sensitive information exposure
    - usersession/autostart: change ~/snap perms to 0700 on startup.
    - cmd: create ~/snap dir with 0700 perms.
    - CVE-2021-3155
    - LP: #1910298
  * SECURITY UPDATE: Local privilege escalation
    - snap-confine: Add validations of the location of the snap-confine
      binary within snapd.
    - snap-confine: Fix race condition in snap-confine when preparing a
      private mount namespace for a snap.
    - CVE-2021-44730
    - CVE-2021-44731
  * SECURITY UPDATE: Data injection from malicious snaps
    - interfaces: Add validations of snap content interface and layout
      paths in snapd.
    - CVE-2021-4120
    - LP: #1949368

 -- Michael Vogt <email address hidden>  Tue, 15 Feb 2022 17:45:13 +0100

Available diffs

• diff from 2.54.2+21.10ubuntu1 (in Ubuntu) to 2.54.3+21.10.1 (34.8 KiB)
• diff from 2.54.3+21.10 to 2.54.3+21.10.1 (464 bytes)

snapd (2.54.3+18.04) bionic-security; urgency=medium

  * SECURITY UPDATE: Sensitive information exposure
    - usersession/autostart: change ~/snap perms to 0700 on startup.
    - cmd: create ~/snap dir with 0700 perms.
    - CVE-2021-3155
    - LP: #1910298
  * SECURITY UPDATE: Local privilege escalation
    - snap-confine: Add validations of the location of the snap-confine
      binary within snapd.
    - snap-confine: Fix race condition in snap-confine when preparing a
      private mount namespace for a snap.
    - CVE-2021-44730
    - CVE-2021-44731
  * SECURITY UPDATE: Data injection from malicious snaps
    - interfaces: Add validations of snap content interface and layout
      paths in snapd.
    - CVE-2021-4120
    - LP: #1949368

 -- Michael Vogt <email address hidden>  Tue, 15 Feb 2022 17:45:13 +0100

Available diffs

• diff from 2.54.2+18.04ubuntu1 (in Ubuntu) to 2.54.3+18.04 (34.7 KiB)
• diff from 2.48.3+18.04 to 2.54.3+18.04 (4.2 MiB)

snapd (2.54.3+20.04) focal-security; urgency=medium

  * SECURITY UPDATE: Sensitive information exposure
    - usersession/autostart: change ~/snap perms to 0700 on startup.
    - cmd: create ~/snap dir with 0700 perms.
    - CVE-2021-3155
    - LP: #1910298
  * SECURITY UPDATE: Local privilege escalation
    - snap-confine: Add validations of the location of the snap-confine
      binary within snapd.
    - snap-confine: Fix race condition in snap-confine when preparing a
      private mount namespace for a snap.
    - CVE-2021-44730
    - CVE-2021-44731
  * SECURITY UPDATE: Data injection from malicious snaps
    - interfaces: Add validations of snap content interface and layout
      paths in snapd.
    - CVE-2021-4120
    - LP: #1949368

 -- Michael Vogt <email address hidden>  Tue, 15 Feb 2022 17:45:13 +0100

Available diffs

• diff from 2.54.2+20.04ubuntu2 (in Ubuntu) to 2.54.3+20.04 (34.5 KiB)
• diff from 2.48.3+20.04 to 2.54.3+20.04 (4.2 MiB)

snapd (2.54.2+20.04ubuntu2) focal; urgency=medium

  * New upstream release, LP: #1955137
    - cherry-pick https://github.com/snapcore/snapd/pull/11325
      to fix timeout during the riscv64 builds on focal

 -- Michael Vogt <email address hidden>  Tue, 01 Feb 2022 17:59:58 +0100

Available diffs

• diff from 2.51.1+20.04ubuntu2 to 2.54.2+20.04ubuntu2 (3.0 MiB)
• diff from 2.54.2+20.04ubuntu1 to 2.54.2+20.04ubuntu2 (953 bytes)