Package "snap-confine"

  snapd (2.62+22.04) jammy; urgency=medium

  * New upstream release, LP: #2058277
    - Aspects based configuration schema support (experimental)
    - Refresh app awareness support for UI (experimental)
    - Support for user daemons by introducing new control switches
      --user/--system/--users for service start/stop/restart
      (experimental)
    - Add AppArmor prompting experimental flag (feature currently
      unsupported)
    - Installation of local snap components of type test
    - Packaging of components with snap pack
    - Expose experimental features supported/enabled in snapd REST API
      endpoint /v2/system-info
    - Support creating and removing recovery systems for use by factory
      reset
    - Enable API route for creating and removing recovery systems using
      /v2/systems with action create and /v2/systems/{label} with action
      remove
    - Lift requirements for fde-setup hook for single boot install
    - Enable single reboot gadget update for UC20+
    - Allow core to be removed on classic systems
    - Support for remodeling on hybrid systems
    - Install desktop files on Ubuntu Core and update after snapd
      upgrade
    - Upgrade sandbox features to account for cgroup v2 device filtering
    - Support snaps to manage their own cgroups
    - Add support for AppArmor 4.0 unconfined profile mode
    - Add AppArmor based read access to /etc/default/keyboard
    - Upgrade to squashfuse 0.5.0
    - Support useradd utility to enable removing Perl dependency for
      UC24+
    - Support for recovery-chooser to use console-conf snap
    - Add support for --uid/--gid using strace-static
    - Add support for notices (from pebble) and expose via the snapd
      REST API endpoints /v2/notices and /v2/notice
    - Add polkit authentication for snapd REST API endpoints
      /v2/snaps/{snap}/conf and /v2/apps
    - Add refresh-inhibit field to snapd REST API endpoint /v2/snaps
    - Add refresh-inhibited select query to REST API endpoint /v2/snaps
    - Take into account validation sets during remodeling
    - Improve offline remodeling to use installed revisions of snaps to
      fulfill the remodel revision requirement
    - Add rpi configuration option sdtv_mode
    - When snapd snap is not installed, pin policy ABI to 4.0 or 3.0 if
      present on host
    - Fix gadget zero-sized disk mapping caused by not ignoring zero
      sized storage traits
    - Fix gadget install case where size of existing partition was not
      correctly taken into account
    - Fix trying to unmount early kernel mount if it does not exist
    - Fix restarting mount units on snapd start
    - Fix call to udev in preseed mode
    - Fix to ensure always setting up the device cgroup for base bare
      and core24+
    - Fix not copying data from newly set homedirs on revision change
    - Fix leaving behind empty snap home directories after snap is
      removed (resulting in broken symlink)
    - Fix to avoid using libzstd from host by adding to snapd snap
    - Fix autorefresh to correctly handle forever refresh hold
    - Fix username regex allowed for system-user assertion to not allow
      '+'
    - Fix incorrect application icon for notification after autorefresh
      completion
    - Fix to restart mount units when changed
    - Fix to support AppArmor running under incus
    - Fix case of snap-update-ns dropping synthetic mounts due to
      failure to match desired mount dependencies
    - Fix parsing of base snap version to enable pre-seeding of Ubuntu
      Core Desktop
    - Fix packaging and tests for various distributions
    - Add remoteproc interface to allow developers to interact with
      Remote Processor Framework which enables snaps to load firmware to
      ARM Cortex microcontrollers
    - Add kernel-control interface to enable controlling the kernel
      firmware search path
    - Add nfs-mount interface to allow mounting of NFS shares
    - Add ros-opt-data interface to allow snaps to access the host
      /opt/ros/ paths
    - Add snap-refresh-observe interface that provides refresh-app-
      awareness clients access to relevant snapd API endpoints
    - steam-support interface: generalize Pressure Vessel root paths and
      allow access to driver information, features and container
      versions
    - steam-support interface: make implicit on Ubuntu Core Desktop
    - desktop interface: improved support for Ubuntu Core Desktop and
      limit autoconnection to implicit slots
    - cups-control interface: make autoconnect depend on presence of
      cupsd on host to ensure it works on classic systems
    - opengl interface: allow read access to /usr/share/nvidia
    - personal-files interface: extend to support automatic creation of
      missing parent directories in write paths
    - network-control interface: allow creating /run/resolveconf
    - network-setup-control and network-setup-observe interfaces: allow
      busctl bind as required for systemd 254+
    - libvirt interface: allow r/w access to /run/libvirt/libvirt-sock-
      ro and read access to /var/lib/libvirt/dnsmasq/**
    - fwupd interface: allow access to IMPI devices (including locking
      of device nodes), sysfs attributes needed by amdgpu and the COD
      capsule update directory
    - uio interface: allow configuring UIO drivers from userspace
      libraries
    - serial-port interface: add support for NXP Layerscape SoC
    - lxd-support interface: add attribute enable-unconfined-mode to
      require LXD to opt-in to run unconfined
    - block-devices interface: add support for ZFS volumes
    - system-packages-doc interface: add support for reading jquery and
      sphinx documentation
    - system-packages-doc interface: workaround to prevent autoconnect
      failure for snaps using base bare
    - microceph-support interface: allow more types of block devices to
      be added as an OSD
    - mount-observe interface: allow read access to
      /proc/{pid}/task

  snapd (2.61.3+22.04) jammy; urgency=medium

  * New upstream release, LP: #2039017
    - Install systemd files in correct location for 24.04

 -- Ernest Lotter <email address hidden> Wed, 06 Mar 2024 23:18:11 +0200

  snapd (2.58+22.04) jammy; urgency=medium

  * New upstream release, LP: #1998462
    - many: Use /tmp/snap-private-tmp for per-snap private tmps
    - data: Add systemd-tmpfiles configuration to create private tmp dir
    - cmd/snap: test allowed and forbidden refresh hold values
    - cmd/snap: be more consistent in --hold help and err messages
    - cmd/snap: error on refresh holds that are negative or too short
    - o/homedirs: make sure we do not write to /var on build time
    - image: make sure file customizations happen also when we have
      defaultscause
    - tests/fde-on-classic: set ubuntu-seed label in seed partitions
    - gadget: system-seed-null should also have fs label ubuntu-seed
    - many: gadget.HasRole, ubuntu-seed can come also from system-seed-
      null
    - o/devicestate: fix paths for retrieving recovery key on classic
    - cmd/snap-confine: do not discard const qualifier
    - interfaces: allow python3.10+ in the default template
    - o/restart: fix PendingForSystemRestart
    - interfaces: allow wayland slot snaps to access shm files created
      by Firefox
    - o/assertstate: add Sequence() to val set tracking
    - o/assertstate: set val set 'Current' to pinned sequence
    - tests: tweak the libvirt interface test to work on 22.10
    - tests: use system-seed-null role on classic with modes tests
    - boot: add directory for data on install
    - o/devicestate: change some names from esp to seed/seed-null
    - gadget: add system-seed-null role
    - o/devicestate: really add error to new error message
    - restart,snapstate: implement reboot-required notifications on
      classic
    - many: avoid automatic system restarts on classic through new
      overlord/restart logic
    - release: Fix WSL detection in LXD
    - o/state: introduce WaitStatus
    - interfaces: Fix desktop interface rules for document portal
    - client: remove classic check for `snap recovery --show-
      keys`
    - many: create snapd.mounts targets to schedule mount units
    - image: enable sysfs overlay for UC preseeding
    - i/b/network-control: add permissions for using AF_XDP
    - i/apparmor: move mocking of home and overlay conditions to osutil
    - tests/main/degraded: ignore man-db update failures in CentOS
    - cmd/snap: fix panic when running snap w/ flag but w/o subcommand
    - tests: save snaps generated during image preaparation
    - tests: skip building snapd based on new env var
    - client: remove misleading comments in ValidateApplyOptions
    - boot/seal: add debug traces for bootchains
    - bootloader/assets: fix grub.cfg when there are no labels
    - cmd/snap: improve refresh hold's output
    - packaging: enable BPF in RHEL9
    - packaging: do not traverse filesystems in postrm script
    - tests: get microk8s from another branch
    - bootloader: do not specify Core version in grub entry
    - many: refresh --hold follow-up
    - many: support refresh hold/unhold to API and CLI
    - many: expand fully handling links mapping in all components, in
      the API and in snap info
    - snap/system_usernames,tests: Azure IoT Edge system usernames
    - interface: Allow access to
      org.freedesktop.DBus.ListActivatableNames via system-observe
      interface
    - o/devicestate,daemon: use the expiration date from the assertion
      in user-state and REST api (user-removal 4/n)
    - gadget: add unit tests for new install functions for FDE on
      classic
    - cmd/snap-seccomp: fix typo in AF_XDP value
    - tests/connected-after-reboot-revert: run also on UC16
    - kvm: allow read of AMD-SEV parameters
    - data: tweak apt integration config var
    - o/c/configcore: add faillock configuration
    - tests: use dbus-daemon instead of dbus-launch
    - packaging: remove unclean debian-sid patch
    - asserts: add keyword 'user-presence' keyword in system-user
      assertion (auto-removal 3/n)
    - interfaces: steam-support allow pivot /run/media and /etc/nvidia
      mount
    - aspects: initial code
    - overlord: process auto-import assertion at first boot
    - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
    - tests: fix lxd-mount-units in ubuntu kinetic
    - tests: new variable used to configure the kernel command line in
      nested tests
    - go.mod: update to newer secboot/uc22 branch
    - autopkgtests: fix running autopkgtest on kinetic
    - tests: remove squashfs leftovers in fakeinstaller
    - tests: create partition table in fakeinstaller
    - o/ifacestate: introduce DebugAutoConnectCheck hook
    - tests: use test-snapd-swtpm instead of swtpm-mvo snap in nested
      helper
    - interfaces/polkit: do not require polkit directory if no file is
      needed
    - o/snapstate: be consistent not creating per-snap save dirs for
      classic models
    - inhibit: use hintFile()
    - tests: use `snap prepare-image` in fde-on-classic mk-image.sh
    - interfaces: add microceph interface
    - seccomp: allow opening XDP sockets
    - interfaces: allow access to icon subdirectories
    - tests: add minimal-smoke test for UC22 and increase minimal RAM
    - overlord: introduce hold levels in the snapstate.Hold* API
    - o/devicestate: support mounting ubuntu-save also on classic with
      modes
    - interfaces: steam-support allow additional mounts
    - fakeinstaller: format SystemDetails result with %+v
    - cmd/libsnap-confine-private: do not panic on chmod failure
    - tests: ensure that fakeinstaller put the seed into the right place
    - many: add stub services for prompting
    - tests: add libfwupd and libfwupdplugin5 to openSUSE dependencies
    - o/snapstate: fix snaps-hold pruning/reset in the presence of
      system holding
    - many: add support for setting up encryption from installer
    - many: support classic snaps in the context of classic and extended
      models
    - cmd/snap,daemon: allow zero values from client to daemon for
      journal rate limit
    - boot,o/devices