/srv/irclogs.ubuntu.com/2016/03/09/#snappy.txt

=== chihchun_afk is now known as chihchun
sergiusensogra_, any ideas about http://paste.ubuntu.com/15333155/ ?06:21
sergiusensah missing firmware06:28
dholbachgood morning07:26
zyga-phoneGood morning07:52
didrockshey zyga-phone07:54
zyga-phone:-)07:59
ogra_sergiusens, https://launchpad.net/~p-pisati/+archive/ubuntu/embedded you want dragon410c-firmware08:13
sergiusensogra_, yeah, thanks, I figured it out 6 minutes after pinging you (like in the message)08:18
ogra_:)08:18
sergiusensogra_, I grabbed from upstream though08:18
sergiusenshttps://developer.qualcomm.com/hardware/dragonboard-410c/tools08:18
ogra_well, the package has the filesystem structure, which is why i prefer it08:19
ogra_just a dpkg -x *deb /target/dir is enough ... i dont need to bother where the files go08:19
sergiusensogra_, right, the upstream stuff just needs to get dumped in lib/firmware08:20
ogra_yep08:20
sergiusensogra_, I'll be sending out an email later today08:21
sergiusensonce the demo stuff is done I can focus on releasing a snapcraft with that interfaces swap08:21
ogra_:)08:21
didrocksdholbach, davidcalle: any time to HO and try the new template + content import? :)09:05
dholbachdidrocks, maybe some time after lunch?09:06
=== chihchun is now known as chihchun_afk
davidcalledidrocks: dholbach: anytime wfm09:07
didrocksdholbach: davidcalle: 2:30PM?09:07
dholbachsure09:07
davidcalle+109:08
didrocksinvitations sent!09:09
noizerGoodmorning09:10
* zyga-phone throws more branches out09:24
zyga-phonehttps://github.com/ubuntu-core/snappy/pull/62109:24
zyga-phonehttps://github.com/ubuntu-core/snappy/pull/61809:24
zyga-phonehttps://github.com/ubuntu-core/snappy/pull/62009:24
zyga-phoneand a biggie: https://github.com/ubuntu-core/snappy/pull/61709:25
=== chihchun_afk is now known as chihchun
ogra_mvo, hey, so looking at kernel snaps from livecd-rootfs i'm wondering what we do with azure10:06
ogra_(today thats just a cp of the amd64 tarball iirc, for snaps we cant really do that since it will need different meta data .... should azure use the normal amd64 one or should i produce a *.azure.kernel.snap separately ?)10:08
dpmmvo, quick question on your e-mail to snappy-devel: "3. The icon location has changed - It is now in meta/gui/icon.png instead of meta/icon.png". So far I've specified the icon location in snapcraft.yaml, so I'm not sure what effect that has for snaps that specify a particular path to the icon. Or is this just the default location icons will be searched for if they're not specified in snapcraft.yaml?10:36
mvodpm: if you use snapcraft it will take care of everything for you10:39
mvodpm: at least that is my understanding unless sergiusens_ corrects me :)10:40
dpmmvo, I'm not sure I understand it at all. My icon lives in the upstream code under app/icon.png, and that's what I specify on snapcraft.yaml. So do I need to do any changes to snapcraft.yaml or the icon location in the tree after the latest snappy changes?10:41
dpme.g. http://bazaar.launchpad.net/~dpm/ubuntu-calculator-app/snap-all-things/view/head:/snapcraft.yaml10:41
noizerhow does security-overide works?10:43
sergiusens_dpm, mvo that's not landed yet10:44
sergiusens_won't happen this week at least10:44
sergiusens_this week it is all about the kernel10:44
dpmsergiusens_, thanks. So when it lands, are there any changes that need to be done to that snapcraft.yaml file? ^^10:47
sergiusens_dpm, none10:48
dpmok, cool, thanks10:48
dpmsergiusens_, mvo, another question related to the announced change of the snap startup directory is now $SNAP_DATA instead of $SNAP: I'm using the copy plugin to install a config file with a relative path: http://bazaar.launchpad.net/~dpm/ubuntu-calculator-app/snap-all-things/view/head:/snapcraft.yaml#L3010:51
dpmThe file itself is http://bazaar.launchpad.net/~dpm/ubuntu-calculator-app/snap-all-things/view/head:/snappy-qt5.conf10:51
dpmso I guess I'll now have to change the ./ path to $SNAP explicitly on the config file10:52
dpmis there any plugin to do variable replacements in files specified in snapcraft.yaml? Or a simpler way to do it?10:52
sergiusens_dpm, instead of bin/calculator do 'calculator' or '$SNAP/bin/calculator'10:55
* zyga-phone triest to implement the first manager in the overlord10:55
dpmsergiusens_, thanks. So just that change and the .conf file can stay as it is with its ./relative path?10:56
ogra_mvo, did you see my ping abov ?11:12
ogra_*above11:12
mvoogra_: sorry, I did not11:15
ogra_<ogra_> mvo, hey, so looking at kernel snaps from livecd-rootfs i'm wondering what we do with azure11:15
ogra_<ogra_> (today thats just a cp of the amd64 tarball iirc, for snaps we cant really do that since it will need different meta data .... should azure use the normal amd64 one or should i produce a *.azure.kernel.snap separately ?)11:15
mvoogra_: hm, I think azure need no special handling anymore but ben howard will know for sure11:17
ogra_ok, i'll leave that out for now11:17
ogra_mvo, btw http://paste.ubuntu.com/15333996/ ... is what i have so far11:18
* ogra_ will do a test build soon11:18
ogra_oops ... just noticed an error11:19
mvoogra_: nice11:20
=== chihchun is now known as chihchun_afk
noizerogra_: Do you know more about the apparmor?12:27
=== chihchun_afk is now known as chihchun
=== devil is now known as Guest30973
ogra_noizer, not really12:29
noizerogra_: Do you know somebody that have more experience?12:29
ogra_jdstrand for example12:30
noizerogra_: Do you have any clue when he will be available?12:30
ogra_nope12:30
=== Guest30973 is now known as devil_
ogra_(if you just dump your question in the channle probably someone else can answer ... dont be so tied to specific persons ;) )12:32
ogra_channel12:32
noizerok xD12:33
noizerI'm making a snap that doesn't need to be available in the store. This snaps needs to be able to start (execute an other snaps wrapper) an other snap. So I thought to change the AppArmor a little. But i got some issue about this. Can anyone help me out with it?12:34
* ogra_ wonders why the arm64 builders seem to work at half speed today 12:42
zyga-phonenoizer: not today, I'm deep in integrating skills with the system13:13
beunoogra_, maybe someone needs to press the Turbo button?13:14
ogra_haha13:14
ogra_beuno, well, seems the build is jumping between bare metal and scaling stack ... seems a build on the latter takes abotu 1h while on the former it taks between 20-30min13:15
noizerzyga-phone: No problem i will try further13:31
ogra_zyga-phone, skills ?13:36
zyga-phoneogra_: you caught me :)13:36
* ogra_ prepares mail announcing the new name change :P13:36
zyga-phoneogra_: no it's not renamed13:36
zyga-phoneogra_: interfaces13:36
zyga-phoneogra_: just stale cache in my head13:36
ogra_week is over ... new name imminent13:36
ogra_snappy security ... best before: next week13:37
ogra_:P13:37
ogra_utlemming, yo14:23
ogra_utlemming, do the cloud images already use all-snaps (asking because we currently treat azure images special on the image builders and i'd like to know what to do ... specifically for the former device tarball (now kernel.snap) )14:26
utlemmingogra_: the cloud images do not use all-snaps14:28
ogra_utlemming, oh ? how will they work in xenial then (system-image isnt supported anymore)14:28
ogra_do we drop snappy in the cloud for xenial ?14:29
utlemmingogra_: the work to do that has not been scheduled14:29
ogra_heh, well, 5 weeks to release ... :)14:30
utlemmingogra_: ack, understood14:30
ogra_(and PPAs arent allowed anymore ... changes would have to be SRUed ... i assume you know what pain that can be)14:30
ogra_WHEEE !14:35
ogra_livecd.ubuntu-core.raspi2.kernel.snap livecd.ubuntu-core.os.snap livecd.ubuntu-core.kernel.snap14:36
ogra_https://launchpad.net/~ubuntu-cdimage/+livefs/ubuntu/xenial/ubuntu-core-system-image/+build/5463614:36
ogra_:D14:36
ogra_now to teach cdimage to publish that to cdimage.ubuntu.com14:39
ogra_hmm, and perhaps i shoul dbuild a test image from these snaps :)14:40
noizeris it possible that the security-override doesn't works?15:44
dpmmvo, so I updated http://bazaar.launchpad.net/~dpm/ubuntu-clock-app/snap-all-things/view/head:/snapcraft.yaml and built it with snapcraft trunk, which succeeded. But upon installation, there seems to be some issues finding the qmlscene binary. I'm not sure there is any path changes that might have happened behind the scenes15:45
dpm$ ubuntu-clock-app.clock15:45
dpmqmlscene: could not exec './usr/lib/x86_64-linux-gnu/qt5/bin/qmlscene': No such file or directory15:45
dpmThat's the output of the newly built and sideloaded app now ^15:45
=== chihchun is now known as chihchun_afk
ogra_dholbach, anything on the agenda ?15:51
jdstrandnoizer: things are always possible, especially lately with all the code and yaml updates. do you have a specific question?15:53
dholbachogra_, I'll move the call to another time for next week - it clashes with our community team meeting15:53
dholbachso better let's chat next week15:53
jdstranddpm: use $SNAP/... instead of ./15:53
ogra_dholbach, ok, sounds good15:53
jdstrandthey changed the working directory recently15:54
jdstranddpm: or, 'cd $SNAP'15:54
jdstrandbefore hand15:54
noizerjdstrand: Yes ok I will make a snapp thats not be available in the store. So I want to that the app can execute the binaries from /snaps/bin/. So then can he acces other snaps.15:55
jdstrandnoizer: that isn't possible15:55
noizerjdstrand: So i tought i will do some changes on the apparmor so a can execute these snaps.15:55
dpmjdstrand, but the "./" appears on a .conf file. I'm not sure how to do variable substitution there15:56
jdstrandthe reason why is /snaps/bin are shell scripts that call the launcher, which needs priviliges to set up the sandbox. those privs can't be granted to apps15:56
jdstranddpm: then do a cd $SNAP15:56
jdstranddpm: I can't really advise how to implement the fix, I'm just saying that people decided to change the working directory and your snap need to do something about that15:57
dpmI'm a bit lost to what I need to do here, just cd $SNAP in the wrapper script? (I appreciate the help, thanks jdstrand!)15:58
jdstranddpm: yes15:58
jdstranddpm: right at the top of your script15:58
jdstranddpm: fyi, 'Subject: Internal format updates' on snappy-devel. in addition to the working directory it talks about icon and desktop16:02
noizerjdstrand: how can i make it possible then?16:03
dpmjdstrand, yeah, that's why I started doing the changes16:03
ogra_mvo, http://paste.ubuntu.com/15335324/ whats that "Removing unneded" message about ? (do i need to worry ? )16:05
ogra_the resulting image boots fine16:05
jdstrandnoizer: it is only going to be possible if you do security-policy and have a very lenient profile, but this is going against how snappy works. typically, you bundle what you want in one snap. it is possible to do stuff with frameworks on 15.04, but frameworks are going away in favor of interfaces. the interfaces work is very much still being worked out, but at some point there will be a way for you to approach Canonical for new interfaces and then C16:06
mvoogra_: hm, that looks a bit scary. image boots and has all the snaps you expect it to have?16:08
ogra_mvo, yeah16:08
ogra_mvo, the snaps are from https://launchpad.net/~ubuntu-cdimage/+livefs/ubuntu/xenial/ubuntu-core-system-image/+build/5463416:08
mvoogra_: aha, I do remember now, its fine16:08
ogra_cool !16:08
mvoogra_: sorry, its a misleading message16:08
ogra_then the livecd-rootfs built snaps all work :)16:09
mvoogra_: \o/16:09
ogra_cdimage publishing pending :)16:09
noizerjdstrand: so it will be possible in the future? but can I have now the solution because then i can test further with my code.16:11
noizerjdstrand: I know its not how snappy works but it would be awesome for me that i would make 1 snap with some other priviliges.16:14
ogra_you can surely make a completely unconfined snap and sideload it16:15
noizerogra_: how can i do that?16:18
elopioping ogra_: what triggers this? https://launchpad.net/~ubuntu-cdimage/+livefs/ubuntu/xenial/ubuntu-core-system-image16:19
elopioan update in the PPA?16:19
ogra_noizer, not sure how you do it in this weeks seciroty model ... two weeks ago i could do http://bazaar.launchpad.net/~ogra/+junk/htop-unconfined/view/head:/snapcraft.yaml16:20
ogra_elopio, a cron job on "nusakan" (which is what outsoders know as cdimage)16:20
ogra_*outsiders16:21
elopioogra_: awesome. That is solving half of the unknowns I had :D16:21
ogra_elopio, well, or a manual call from a member of the cdimage team (like i did a few yesterday and today tomake the new snap bild code work)16:21
jdstrandogra and nozier: with ogra_'s example, do 's/uses/plugs/' and 's/type: migration-skill/interface: old-security/'16:22
ogra_jdstrand, thanks ! (saves me from looking it up)16:22
elopioogra_: cron is alright. A url we can trigger would be even better, but nothing to worry about now. We hope to have solved the dput into the ppa by friday. I'll get back to you after.16:23
ogra_elopio, if you clock on one of the last "Successfuly built" links you now find os and kernel snaps there16:23
noizerjdstrand: ogra_ huh i don't understand it very good16:23
ogra_*click16:23
ogra_(note "last" means at the top)16:24
elopioogra_: yes, that's what I saw and that's why I'm happy.16:24
elopiothank you.16:24
jdstrandnoizer: every place you see 'uses' in ogra_'s example, use 'plugs' instead16:24
ogra_elopio, i currently work on making them show up on http://cdimage.ubuntu.com/ubuntu-core/daily-preinstalled/current/ ... and then hope the store can pull them into the edge channel from there16:25
jdstrandnoizer: and every place you see 'type: migration-skill', use 'interface: old-security' instead16:25
elopioogra_: we can pull them from jenkins, and push them from there too. I'm not sure what's best yet.16:25
jdstrandmvo: is this cause for concern: http://paste.ubuntu.com/15335485/16:28
ogra_elopio, well, i like the idea that you could manually pull them from cdimage and test them ... its our canonical place for all official image fragments16:28
noizerjdstrand: just a stupid question whats de difference between slots and plugs16:29
* jdstrand wonders why we are so emphatic with the developer ("canonical!")16:29
jdstrandnoizer: one is the providing side and one is the consuming side16:29
jdstrandyou provide a slot for a plug16:29
elopioogra_: I think I like that too. The only detail I'm thinking about is beta. I think that if we put the better tested beta in that daily folder, the testers would get a better experience than with edge.16:29
ogra_elopio, i dont really care how they get into the store after this :) but we need them in the store to test upgraeability (snappy refuses to upgrade sideloaded packages)16:30
elopiobut we can adjust everything.16:30
jdstrandths os provides the old-security interface as a slot that apps may plug into16:30
elopiowe have all this blocks, it's easy to move them around.16:30
ogra_yeah16:30
jdstrandnoizer: see the snappy-devel mailing list for more info16:30
jdstrandnoizer: but my summary is hopefully good enough16:31
noizerjdstrand: an unconfined app i cant execute then the snaps/bin executables :s16:31
jdstrandusing the 'unconfined' template won't give you enough cause you need to be able to change profiles, etc16:32
elopioogra_: we are testing upgradeability with a fake store and a fake snap. That was really cool by mvo.16:32
elopioWe do need to test real updates and we have all the jobs ready, so yes, we need to upload to the store. But that's my least concern, we are already uploading snaps in the snapcraft suite (also a cool thing by pindonga).16:32
jdstrandyou need security-policy with unrestricted seccomp and lenient policy. you would need to look at /etc/apparmor.d/usr.bin.ubuntu-core-launcher for some of the perms16:33
jdstrandfyi, this isn't the proper way to do things-- you're going to be quite on your own here16:33
ogra_elopio, hmm, i thought we'd now work by store channels only ...16:33
noizerjdstrand:   then i can change some profiles from seccomp and apparmor?16:36
jdstrandnoizer: you do something like this16:37
jdstrandplugs:16:37
jdstrand  "my-confinement":16:37
jdstrand    interface: old-security16:37
elopio ogra_: well, not only. We can't upload the snap from pull requests to the store because they will be generally broken and conflicting and confusing. At that stage, we fake.16:37
jdstrand    apparmor: path/to/apparmor/profile16:37
elopioonce we land into master/edge, we test the real thing.16:37
jdstrand    seccomp: path/to/seccomp/profile16:37
beunoelopio, ogra_, so, apps that are uploaded but not published to any channel are accessible by specified users16:38
beunoyou can CI it in every real sense without putting it in a channel16:38
elopiobeuno: that's interesting.16:38
jdstrandnoizer: put @unrestricted in path/to/seccomp/profile, and then adjust path/to/apparmor/profile to be what you want. you might start with what is in /usr/share/apparmor/easyprof/templates/ubuntu-core/16.04/unconfined16:39
elopiobeuno: are we going to be able to select a channel or not channel from snapcraft upload?16:39
beunoelopio, getting a snap into the store involves 2 steps: upload & publish16:39
beunowhen you upload, you get back a revision which makes it accessible if you have upload rights to the snap16:40
jdstrandnoizer: if you ignore the package.yaml stuff in this page, there are things that might help: https://wiki.ubuntu.com/SecurityTeam/Specifications/SnappyConfinement/DevelopingFrameworkPolicy16:40
beunopublishing is what actually makes it distributable via a channel16:40
jdstrandnoizer: at this point, you are far outside the snappy system and I've got to focus on the snappy system atm. good luck!16:40
noizerjdstrand: hahah ok thx. but why can people start services and stop services from any snap they want with a REST api?16:41
jdstrandnoizer: because that breaks application isolation. apps aren't supposed to be able to mess with other snap's apps16:42
elopiobeuno: ok, I'll check again. So, no snapcraft publish command? We'll have to go to the URL.16:42
beunoelopio, snapcraft still needs to grow the publish command, yes16:43
jdstrandnoizer: this isn't a reimplementation of the traditional linux distro, this is a new way of doing things16:43
elopiogreat, that's even better :)16:43
jdstrandnoizer: you are free to stop and start your own services of course. the snap rest api may provide things for stopping and starting services. you might talk to Chipaca on if it does16:43
elopiosudo snappy service ...16:44
jdstrandnoizer: if the snappy rest api allows for that, you can use:16:44
jdstrandinterface: old-security16:44
jdstrandcaps: [snapd]16:44
* jdstrand notes that old-security/caps is going away soon in favor of native interfaces16:45
noizerjdstrand: but is it possible then to say to the service that he don't start while booting16:45
jdstrandnoizer: I don't think so, no16:45
jdstrandmaybe16:45
noizerjdstrand: when this is possible i can start an application over services16:45
* jdstrand didn't design or implement the snappy rest api16:45
ogra_beuno, elopio, well, we are talking about image testing ... so i guess ubuntu-device-flash will be involved ... i'm not sure it can currently deal with unpublished snaps apart from treating them as sideloaded16:46
ogra_i know it can download from edge if i pass /edge to the snap name though16:47
elopioogra_: I'm sorry, I'm talking about everything at once.16:47
ogra_but then the snap has already been published to the edge channel16:47
elopioin particular, this unpublished thing is great to test the snapcraft examples. But I might find it useful in the snappy suite to.16:47
elopiotoo16:47
ogra_elopio, right, my focus is more on images currently :)16:47
elopioogra_: I know. That's why I'm not yet with you. Figuring out the earlier steps first.16:48
ogra_well, snapcraft wont be involved in our image builds16:48
ogra_(the builder doesnt really have access to the outside world beyonf the ubuntu archive)16:49
ogra_(on purpose)16:50
elopioogra_: that's the part we need to figure out where to put. I want that a new OS snap is published to beta only if all the snapcraft examples pass on it.16:50
elopiowe don't need to generate an image for this tests16:50
ogra_how else would you use the os snap if not in an image ?16:50
elopiowe will generate it only if the tests pass and the snap is promoted to a higher channel.16:51
ogra_mount the squashfs and chroot ?16:51
ogra_you kind of need to test the os snap in context (if the initrd doesnt set up your bind-mount farm to get you writable bis you cant boot etc etc)16:52
elopioogra_: hah, three possible tricks. The one we are using now is just calling a different snappy binary, not installed. The second option is to build the snap and get it installed through the fake store, or something. The third would be to generate our own image with udf and upload it to scalingstack, but I'm trying to avoid this one.16:52
ogra_i cant imagine how to test that without at least generating an imge and boot it in a VM or some such16:52
ogra_elopio, i think the last one is the only valid one ... else you will never test in real context16:53
ogra_you need to knwo the boot process works, the env is correct after booting and ... well, then test the binaries etc16:54
elopioogra_: remember that I'm this week on the early stages. The focus is to test the snappy commands they are adding to the master branch, not the bootloader or the kernel.16:54
=== chihchun_afk is now known as chihchun
ogra_ah, so only the snappy binary itself ... ok16:54
elopiowe have jobs in place to test the whole image in later stages. We need to add more coverage there, but we have a basic verification in place.16:54
ogra_i thought you meant the os snap16:54
elopioyes, I excused myself because I'm throwing all the topics at once.16:55
elopiofor this week, the least context and most isolation we can get, the better.16:56
ogra_heh, i'm just slow in understanding today :)16:56
ogra_to much cdimage code in my brain for the last two days ... that does weird things to you16:56
noizerChipaca is it possible to disable starting on boot a service?16:57
Chipacanoizer, deactivate the snap?16:58
elopioweird is the new cool.16:58
elopioI'm happy not looking at cdimage though.16:58
noizerChipaca no no the app needs to be active but services (background-app) start automatically16:58
Chipacanoizer, disable the service then16:59
noizercan i start it later?16:59
Chipacanoizer, or stop shipping it, if you don't want it to run :-)16:59
Chipacanoizer, 15.04, or 16?16:59
noizerChipaca no i want to start it later with the REST api16:59
noizerChipaca it is 1616:59
Chipacanoizer, enable/disable using the rest api17:00
Chipacanoizer, e.g., http.POST snapd:///2.0/snaps/snap.mine/services/a-service action=disabe17:01
Chipacanoizer, using http.chipaca17:01
Chipacadisable*17:01
Chipacanoizer, that'll probably change before 16 GA, moving to not need the .mine there17:02
Chipacanoizer, enabling is with action=enable, obvs17:03
noizerChipaca hmmm can i init that so thats disabled by default?17:04
Chipacanoizer, no17:04
noizerChipaca ok17:04
noizerChipaca Thx for the help17:04
Chipacanoizer, if you need that feature, file a bug? but we're all full of things to do for 16 so i doubt we'd be able to do it any time soon17:05
noizerChipaca ok or maybe make it myself?17:06
=== jkridner|work is now known as jkridner_
=== jkridner_ is now known as jkridner__
=== jkridner__ is now known as jkridner_
Chipacanoizer, what do you mean?17:07
noizerChipaca the disable function of services?17:07
ogra_write a patch ?17:07
beunoogra_, I'm sure u-d-f could be taught to access snaps by revision17:11
beunoand then you just make sure it has the right credentials17:11
ogra_beuno, indeed it could, i was just talking about the status quo17:11
ogra_it needs code :) and that needs someones time17:12
beunoluckily, I'm ignorant about a lot of quo's17:12
ogra_haha17:12
=== chihchun is now known as chihchun_afk
dpmjdstrand, it worked! :)17:21
dpmcd $SNAPPY, that is17:21
dpmthanks a lot for the pointer17:21
jdstranddpm: woo!18:33
loolkyrofa: hey! around?19:18
loolAll, when using multiple python2 parts in snapcraft, each part pulls a python2 runtime and then the parts clash when installing; what's the most elegant way of dealing with this?19:19
ssweenyI'm working on building location-service for snappy and running into an interesting issue. When linking against apparmor it's picking the static lib in /lib/<triplet> which fails because everything else is built shared with -fPIC. I can work around by removing /lib/<triplet>/libapparmor.a or adding an unversioned .so symlink to the .so there but I'd like to solve the problem a bit more elegantly if possible :)20:39
ssweenythis is snapcraft on xenial20:39
ssweenyI notice that there is a .so symlink in /lib/<triplet> when the apparmor-dev package is installed but not in the staged version in my snap20:40

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!