/srv/irclogs.ubuntu.com/2016/12/06/#snappy.txt

=== chihchun is now known as chihchun_afk
=== wolflarson_ is now known as wolflarson
=== chihchun_afk is now known as chihchun
mupPR snapcraft#948 opened: Use testtools as the base of all unit tests <Created by elopio> <https://github.com/snapcore/snapcraft/pull/948>04:32
=== pbek_ is now known as pbek
=== stub` is now known as stub
=== Guest32050 is now known as macnibblet
=== macnibblet is now known as mac_nibblet
mac_nibbletCan someone please explain the workflow when developing stuff with snapcraft ?06:06
mac_nibbletI find it rather tedious to run a clean, download everything again and then install just to test changes to our application06:06
=== JanC_ is now known as JanC
mac_nibbletAnybody up for some paid support06:21
mac_nibblet?06:21
Omou?07:10
Omouis here somebody07:10
=== Guest64506 is now known as ahasenack
=== ahasenack is now known as Guest79511
=== rgogunskiy_ is now known as rgogunskiy
mupPR snapd#2401 closed: snap: abort install with ctrl+c <Created by stolowski> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/2401>08:29
ogra_mvo, hmm, there was just a new set of kernels released09:44
zygaogra_: hey :)09:45
ogra_yo09:45
mvoogra_: cool, did the new lp script tell you? or some other way?09:45
ogra_mvo, my mail client did :P09:45
mvoogra_: new -update? if so, I think we want that in beta and then candidate09:45
mvoogra_: heh09:45
ogra_ok, i'll take care09:46
mvota09:49
mupPR snapd#2412 opened: snap: add description to `snap info` <Created by mvo5> <https://github.com/snapcore/snapd/pull/2412>09:51
mupPR snapd#2413 opened: interfaces/apparmor: allow access to core snap <Critical> <Created by zyga> <https://github.com/snapcore/snapd/pull/2413>10:03
=== chihchun is now known as chihchun_afk
ogra_mvo, all kernels in beta, do we have any specific criteria before releasing to candidate atm ?10:59
ogra_(the store is so sloooow)10:59
mvoogra_: a smoke test for now, I think we want something better long term but for now booting all supported boards with the new kernel is the sufficient11:00
ogra_ok11:00
mupPR snapd#2414 opened: store: switch default delta format from xdelta to xdelta3 <Created by wgrant> <https://github.com/snapcore/snapd/pull/2414>11:08
zygajdstrand: https://github.com/snapcore/snapd/pull/241311:25
mupPR snapd#2413: interfaces/apparmor: allow access to core snap <Critical> <Created by zyga> <https://github.com/snapcore/snapd/pull/2413>11:25
mupPR snapd#2415 opened: overlord/ifacestate: no interface checks if no snap id <Created by chipaca> <https://github.com/snapcore/snapd/pull/2415>11:32
zygajdstrand: ^^11:34
mupPR snapd#2406 closed: many: add support for classic confinement <Critical> <Created by zyga> <Merged by zyga> <https://github.com/snapcore/snapd/pull/2406>11:37
mupPR snapd#2416 opened: cmd/snap-confine: add snap-confine command line parser module <Created by zyga> <https://github.com/snapcore/snapd/pull/2416>11:52
liuxgogra_, ping12:14
ogra_yo12:14
liuxgogra_, I just followed your suggestion to extract the arm64 file at http://cdimage.ubuntu.com/ubuntu-base/xenial/daily/current/, I unziped the file, and now when I use "sudo chroot rootfsarm64". it gives me an error like http://paste.ubuntu.com/23588275/12:15
liuxgogra_, what could be the problem for it? thanks12:15
ogra_liuxg, did you copy the qemu-$arch-static binary in place ?12:16
liuxgogra_, yeah, I just realized that. thanks for your reminding :)12:16
ogra_this isnt different from using debootstrap ;)12:16
ogra_(just that you save all the deb unpacking and configuring time)12:16
liuxgogra_, yes, it works now. thanks. I will try to explore it and see how it works :)12:17
ogra_:)12:17
mupPR snapd#2417 opened: Add uhid interface <Created by bergotorino> <https://github.com/snapcore/snapd/pull/2417>12:17
liuxgogra_, after I enter the chroot, some things are not there. for example, vi is not in the package. I need to install more things12:33
mupPR snapcraft#931 closed: parser: add support for origin-{branch,commit,tag} <Created by 3v1n0> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/931>12:35
mupPR snapcraft#946 closed: meta: support classic confinment <Created by sergiusens> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/946>12:35
ogra_liuxg, hmm, vi should definitely be in there, thats weird12:37
ogra_oh, no, it shouldnt, since thats a buildd tarball12:38
liuxgogra_, http://paste.ubuntu.com/23588349/, this is what looks like here.12:38
ogra_yeah12:38
ogra_it is what you would get using debootstrap --minbase12:38
ogra_a typical build chroot12:38
Chipacadidrocks, could you strace the 'plain' schmurl?12:39
Chipacadidrocks, (hello! etc :-/)12:39
liuxgogra_, also I got some installation issues like http://paste.ubuntu.com/23588353/. it looks not so predicable :)12:39
didrocksChipaca: hey! sure, do we have a snap ready with it? I think I will just copy the armhf binary there if not12:40
Chipacadidrocks, i've always just copied the binary12:40
didrocksok!12:40
didrocksyou want a full strace, no option?12:40
ogra_liuxg, did you "apt update" first (thats not different to how you should do debootstrap)12:40
liuxgogra_, yes, I did that in the first place12:41
Chipacadidrocks, -f -s 4096, i think12:41
ogra_weird12:41
mupPR snapd#2418 opened: snapstate/backend: add backend methods to manage aliases <Created by pedronis> <https://github.com/snapcore/snapd/pull/2418>12:41
didrocksChipaca: will give it to you in a few minutes12:42
ogra_(given that all our build machines use these tarballs ...)12:42
Chipacadidrocks, perfect12:42
liuxgogra_, yeah, it looks like it is not so doable in this method. :)12:42
ogra_well, looks like not all components are switched on in sources.list (perhaps only main ?)12:43
ogra_it is definitely the cleaner way ... but if it starts getting to complex to explain in the howto better go with debootstrap12:43
liuxgogra_, if I try to use apt-get -f install, I get http://paste.ubuntu.com/23588370/. yeah, I think you have a point. A lot of things are commented out there.12:44
liuxgogra_, in fact, the installation is very straightforward, just extract it, and that's it. could it be that it is not daily build?12:45
ogra_oh, you need to mount /sys and /proc (and if you feel like also devpts), but thats not different with the debootstrap chroot12:45
ogra_without these dirs mounted any chroot will have issues12:46
ogra_(regarding package installs at least)12:46
ogra_the "current" tarballs are definitely from tonight12:46
didrocksChipaca: here we go: http://paste.ubuntu.com/23588377/12:46
Chipacaah12:47
popeysergiusens: bug 1612818 - Is there any plan to up the priority of this from wishlist?12:47
mupBug #1612818: Ruby breaks when snapped <isv> <new-plugin> <Snapcraft:Triaged> <https://launchpad.net/bugs/1612818>12:47
Chipacadidrocks, could you do it again, but this time redirecting stdout?12:47
didrocksChipaca: sure12:48
Chipacadidrocks, so i don't need to wade through the pretty progress bar thing :-)12:48
popeysergiusens: we have software we've rejected snapping because of the lack of ruby plugin)12:48
* Chipaca lazy12:48
liuxgogra_,  yeah, I think it is better go with the debootstrap solution :)12:48
=== chihchun_afk is now known as chihchun
ogra_liuxg, wqell, 80% of the above needs to be solved there too ... you always need to mount /proc and /sys if you enter a chroot (and unmount it when you leave) etc ... but yeah, missing bits in sources.list is indeed bad12:49
didrocksChipaca: wait, I didn't take it in the first place to the logs so that you are not bothered with it12:49
didrocksChipaca: so, you meant, you want me to redirect stdout to /dev/null so that you don't have the write()/ioctl?12:49
Chipacadidrocks, the progress bar addds ioctl()s and weird prints to the log12:49
Chipacaexactly12:49
didrocksyeah, you detect the output type and disable it12:50
didrocksgot it :)12:50
Chipacaas all progress bars should :-D12:50
didrocksChipaca: don't force me to give some examples of python modules I know of :)12:50
Chipacadidrocks, there's a reason i wrote this progress bar myself :-)12:51
didrocksChipaca: btw, what's the name of the go progressbar project you are using? I'm interesting for some personal projects :)12:51
didrocksah, it's yours ;)12:51
Chipacadidrocks, i think next weekend i'll be publishing it12:51
Chipacait's not "there" yet12:51
didrocksgreat! keep me posted12:52
didrocksChipaca: http://paste.ubuntu.com/23588390/12:52
didrocks(file is a little bit bigger as the download went further down)12:52
liuxgogra_, anyway, thanks for your tips :)12:54
Chipacadidrocks, and i have a bug in progress where it's still doing ioctls :-) darnit12:54
ogra_np, sad it doesnt work out for you12:54
Chipacadidrocks, anyway, thank you; this is what i needed12:54
liuxgogra_, anyway, I still learn a lot out of it :)12:55
didrocksChipaca: yeah, I noticed it ;) at least, you don't have the write()12:55
* Chipaca nods12:56
ogra_:)12:56
Chipacadidrocks, it's just checking whether the fd suddenly became a terminal, by magic12:56
Chipacadidrocks, it should do that check once at the start methinks -- unless file descriptors can suddenly become terminals :-)12:56
didrocks"suddenly" :-)12:56
didrocksyeah, only once will make sense :)12:57
ogra_everything is a file !12:57
Chipacadidrocks, could you also strace curl?12:59
didrocksyep, doing12:59
didrocksChipaca: hum, logs are 50M13:03
Chipacahehe13:03
Chipacadidrocks, gzip it and put it on p.c.c?13:04
didrocksChipaca: yep, ofc, you have the 30M snap in it :)13:04
didrockswith the write() ops13:04
sergiusenspopey well we need someone who knows ruby, lately all the plugins have been externally contributed except for the python a go ones which I've catered for; also wishlist is the status only because it is not a bug, it is a feature request13:05
Chipacadidrocks, ah, you can drop the -s option there if you want13:06
Chipacadidrocks, :-/13:06
popeysergiusens: so we basically need someone who knows python + ruby?13:06
didrocksChipaca: ok, doing, will be easier for you to read13:06
sergiusenspopey if we can get someone that knows ruby I can work on the plugin code itself13:06
popeyok13:07
didrocksChipaca: less than 2 Megs: http://paste.ubuntu.com/23588441/13:08
mupPR snapcraft#949 opened: project: support building classic snaps <Created by sergiusens> <https://github.com/snapcore/snapcraft/pull/949>13:14
=== hikiko is now known as hikiko|ln
renato__mvo, hey, could you review the pending reviews for package: 645313:18
kalikiana_snapd master seems to be aborting instantly on startup for me - could there be a regression? Or something changed that'd require updating something else?13:20
zygakalikiana_: can you share any error messages or logs please?13:23
kalikiana_zyga: None, except for "Terminated" as far as I can see13:23
zygakalikiana_: anything in journalctl -u snapd13:23
kalikiana_-- No entries --13:24
kalikiana_Non-snapd entries are there for failing to connect to snapd13:25
kalikiana_(Because it's not running, obviously)13:25
kalikiana_zyga: ^^13:26
zygainteresting and odd13:26
kalikiana_I tried going back some revisions but even a half month makes no difference13:27
kalikiana_So I suspect something in the system other than snapd changed13:27
kalikiana_zyga: There was a dependency change that required "go get" at one point, any idea if that might be related?13:29
kalikiana_It's the only change I'm aware of13:29
kalikiana_Other than whatever might've changed in an update of the base system13:30
=== chihchun is now known as chihchun_afk
Chipacadidrocks, in the curl strace with the big -s, could you grep for HTTP/ (including the /) please?13:40
=== hikiko|ln is now known as hikiko
didrocksChipaca: no result13:41
jdstrandzyga: I don't really understand the motivation for 241313:41
Chipacadidrocks, are you sure that's in the big trace?13:41
Chipacadidrocks, ah, case-insensitively please13:41
jdstrandzyga: basically, we have the default template that allows certain reads, and this rule that allows reading everything13:42
didrocksChipaca: ah, case-insensitivity returns 2 results:13:42
didrockssend(4,13:42
didrocks"\26\3\1\1\21\1\0\1\r\3\3XF\277\341\302\237M\257\205\355\207\344\36\372i\307\21\250\350d\246\257\357\307\17oxUl\303\324m\0\0l\300+\300,\300\206\300\207\300\t\300#\300\n\300$\300r\300s\300\254\300\255\300\10\300/\3000\300\212\300\213\300\23\300'\300\24\300(\300v\300w\300\22\0\234\0\235\300z\300{\0/\0<\0005\0=\0A\0\272\0\204\0\300\300\234\300\235\0\n\0\236\0\237\300|\300}\0003\0g\0009\0k\0E\0\276\0\210\0\304\3013:42
didrocks0\236\300\237\0\26\1\0\0x\0\27\0\0\0\26\0\0\0\5\0\5\1\0\0\0\0\0\0\0\33\0\31\0\0\26public.apps.ubuntu.com\377\1\0\1\0\0#\0\0\0\n\0\f\0\n\0\27\0\30\0\31\0\25\0\23\0\v\0\2\1\0\0\r\0\26\0\24\4\1\4\3\5\1\5\3\6\1\6\3\3\1\3\3\2\1\2\3\0\20\0\v\0\t\10http/1.1", 278, MSG_NOSIGNAL) = 27813:42
didrockssend(5, "\26\3\1\1\32\1\0\1\26\3\3XF\277\260\330B\204g\307@\n(\271\22\31\257I\n\312\335\21\713:42
didrocks\n\256\341L\264\f\347\17\222\0\0l\300+\300,\300\206\300\207\300\t\300#\300\n\300$\300r\300s\300\254\300\255\300\10\300/\3000\300\212\300\213\300\23\300'\300\24\300(\300v\300w\300\22\0\234\0\235\300z\300{\0/\0<\0005\0=\0A\0\272\0\204\0\300\300\234\300\235\0\n\0\236\0\237\300|\300}\0003\0g\0009\0k\0E\0\276\0\210\0\304\300\236\300\237\0\26\1\0\0\201\0\27\0\0\0\26\0\0\0\5\0\5\1\0\0\0\0\0\0\0$\0\"\0\0\037068ed04f213:42
didrocks3.site.internapcdn.net\377\1\0\1\0\0#\0\0\0\n\0\f\0\n\0\27\0\30\0\31\0\25\0\23\0\v\0\2\1\0\0\r\0\26\0\24\4\1\4\3\5\1\5\3\6\1\6\3\3\1\3\3\2\1\2\3\0\20\0\v\0\t\10http/1.1", 287, MSG_NOSIGNAL) = 28713:42
Chipacathx13:42
didrocksI guess it's the first request + redirect?13:42
jdstrandzyga: and why do classic snaps care about about this? if they do care, can't we add this rule conditionally on jailmode (plus, I thought that we didn't support jailmode with --classic)13:43
Chipacadidrocks, yep13:43
mupPR snapd#2419 opened: store: retry downloads on io.Copy errors <Created by stolowski> <https://github.com/snapcore/snapd/pull/2419>13:44
Chipacadidrocks, are you in a position to wireshark the pi's connection?13:45
Chipacadidrocks, forget it, https. Let me think some more.13:47
ahasenackis there a way to prevent snaps from auto-upgrading?13:50
zygajdstrand: because gustavo argued to have --jailmode that turns classic snaps into regular confined snaps13:51
Chipacadidrocks, could you run it again, the very first schmurl, pointing at http://lenticularis.chipaca.com/YZ7LshLxDQQIrhAL6DMLub2yTVUA2DIK_15.snap please?13:52
alex-abreuChipaca, quick question, ... the List & Find snapd client results dont contains the list of plugs & slots requested & defined by the snap, I was thinking about creating a PR to add them to the snapinfo as strings, wdyt?13:54
mupPR snapd#2268 closed: many: merge snap-confine into snapd <Critical> <Created by zyga> <Merged by zyga> <https://github.com/snapcore/snapd/pull/2268>13:55
Chipacaalex-abreu, what for?13:55
didrocksChipaca: 3 downloads in a row, they all completed with success. So clearly a store <-> client interaction13:55
Chipacadidrocks, not so quick, little one :-p13:55
alex-abreuChipaca, they are required in snapweb, as snap met ainfo13:56
didrocks;)13:56
Chipacadidrocks, and now https://people.canonical.com/~john/YZ7LshLxDQQIrhAL6DMLub2yTVUA2DIK_15.snap13:59
didrocksChipaca: success as well14:02
Chipacaalex-abreu, how would you get the ones from the store?14:02
Chipacadidrocks, and https://068ed04f23.site.internapcdn.net/download-snap/YZ7LshLxDQQIrhAL6DMLub2yTVUA2DIK_15.snap?t=2016-12-07T13:58:28Z&h=35c698e528ac75d574ed395ecc3144ebff6a238b ? (don't forget to quote it)14:03
alex-abreuChipaca, the store lists the plugs & slots14:03
Chipacaalex-abreu, but you don't talk to the store14:04
alex-abreuChipaca, maybe I am missing your point, but snapd/client/packages.go Find does in the backend ...14:05
didrocksChipaca: dropping after few Kb or Mb downloaded14:05
didrockswith the same reset by peer14:05
Chipacadidrocks, and https://public.apps.ubuntu.com/anon/download-snap/YZ7LshLxDQQIrhAL6DMLub2yTVUA2DIK_15.snap?cdn=local14:06
zygajdstrand: snap-confine is in snapd now :)14:08
zyga:)14:08
didrocksChipaca: works with the local cdn parameter (so internapcdn.net is behaving in some unexpected fashion?)14:09
didrockslet me try to curl that one (in case curl is redirected to another one)14:09
zygajdstrand: https://github.com/snapcore/snapd/pull/241614:09
mupPR snapd#2416: cmd/snap-confine: add snap-confine command line parser module <Created by zyga> <https://github.com/snapcore/snapd/pull/2416>14:09
didrocks(curl worked)14:10
Chipacaalex-abreu, sorry, my point is that it's going to be a big branch, because not only client doesn't know it, neither does daemon, nor store, nor state14:11
Chipacaalex-abreu, and I don't understand the design that would benefit from including this information, but I'm not inherently opposed to the idea14:12
alex-abreuChipaca, yes I had a quick look at it and yes, ... the overlord needs to be updated etc.14:12
Chipacanoise][1, ping14:14
alex-abreuChipaca, it is not a super high prio, but having it seems like a strong requirement for them14:14
noise][1Chipaca: so we have curl->internap OK, snapd->internap not, snapd->elsewhere OK ?14:14
Chipacanoise][1, go http client, not snapd, but yes14:15
Chipacai took snapd out of the equation to make it simpler14:15
Chipacajust a regular `http.Get(...)`14:15
noise][1yeah, have you tweaked any tcp options yet?14:15
Chipacanoise][1, not usefully, why?14:16
noise][1mostly thinking timeouts, keepalives14:16
Chipacanoise][1, keepalives are to keep the connection alive, aren't they?14:17
Chipacaanyway gustavo had me set keep alives to a very small time and nothing changed14:18
noise][1in that strace - is getting a read timeout?14:18
Chipacano, a ECONNRESET14:18
noise][1ah, missed that, yeah14:20
ChipacaI'll write something to dump the whole request we make14:20
Chipacalet's see what gives14:20
renato__mvo, could you upload the first version of this package to store? https://code.launchpad.net/~phablet-team/+snap/mediaplayer-app14:25
noise][1Chipaca: trying to think what curl might be doing differently than go here14:26
noise][1any consistency on the timing from start to conn reset?14:26
noise][1didrocks: ^^14:26
didrocksnoise][1: no, can be 1s or up to 4s of download14:26
didrocks(mostly between 1 & 2s though)14:27
noise][1didrocks: and this is mainly happening on your pi2? routed/nat'd through your desktop?14:28
didrocksnoise][1: indeed, I never have any issue on my desktop14:28
kgunnmorphis hey wanted to catch you before your eod, i cloned the master of pulseaudio snap, built local, installed on a series16 Core running as a kvm/qemu vm....and i'm having trouble getting it to work, when i call14:30
kgunnpulseaudio.paplay somfile.ogg14:31
kgunnit acts like there's no server up to connect to so14:31
kgunni didn't know if i need to start a server ?14:31
ogra_ps ax ?14:31
mvorenato__: sure14:31
mvorenato__: btw, nice to see that the snaps are quite small now14:32
renato__mvo, yes, thanks to ubuntu-app-platform14:32
mvoindeed14:32
* zyga solicits code reviews for https://github.com/snapcore/snapd/pull/241614:32
mupPR snapd#2416: cmd/snap-confine: add snap-confine command line parser module <Critical> <Created by zyga> <https://github.com/snapcore/snapd/pull/2416>14:32
zygatvoss, lool: ^^ maybe interested14:33
zygathis is for the release tomorrow14:33
jdstrandzyga: it sounds like jailmode for classic is strict plus read of all of the core snap. is that accurate?14:33
renato__mvo, please review the notes app too if possible14:33
zygajdstrand: yes14:33
Chipacadidrocks, can you get https://people.canonical.com/~john/schmurl_arm_verbose and try again?14:33
zygajdstrand: that's exactly right14:33
Chipacadidrocks, (no strace, just the regular output)14:33
=== chihchun_afk is now known as chihchun
didrocksChipaca: http://paste.ubuntu.com/23588841/14:37
Chipacadidrocks, and you had the verbose curl output with all headers somewhere, yes?14:38
didrocksI can redo one anyway14:40
didrocksChipaca: http://paste.ubuntu.com/23588854/14:40
kgunnmorphis sorry, browser crashed bad...had to get it back up...here's the pastebin14:41
kgunnhttp://pastebin.ubuntu.com/23588855/14:41
kgunnof the issue i'm experiencing14:41
Chipacadidrocks, and if you add -H "Accept-Encoding: gzip" -H "Accept;" ?14:42
didrocksChipaca: download still succeeded14:44
Chipacadidrocks, I suddenly understand people that drink during work hours14:52
ChipacaI think a cup of tea would work14:52
* Chipaca goes14:52
didrocksChipaca: ahah, sounds sane! ;)14:53
kalikiana_zyga: FYI it seems using "kill" is a bad idea. After using "sudo systemctl stop snapd.service snapd.socket" I got a go stacktrace - turns out there was an extra space in basedeclarations.go14:54
mupPR snapcraft#950 opened: tests: Use a more stable ftp source <Created by elopio> <https://github.com/snapcore/snapcraft/pull/950>15:02
Chipacajdstrand, ping15:08
jdstrandChipaca: hey15:11
Chipacajdstrand, i'm told you're the person to talk with about http being non-installable15:14
jdstrandChipaca: I need more context, but maybe?15:15
Chipacajdstrand, - Mount snap "http" (19) (installation not allowed by "snapd-control" plug rule of interface "snapd-control")15:15
jdstrandChipaca: what is 'http'?15:16
Chipacajdstrand, httpie, in a snap15:16
jdstrandChipaca: it sounds like a webserver. why does it need snapd-control?15:16
Chipacajdstrand, so you can do http snapd:///v2/etc15:16
jdstrandChipaca: ok I think you may be missing some context of my questions15:17
Chipacajdstrand, sorry :-)15:17
Chipacait's a web client, not a server15:17
jdstrandChipaca: currently, http would need a snap declaration to be able to use the privileged snapd socket15:17
Chipacalike curl but written in python15:17
Chipacapretty-prints and colorizes json and other neat things15:18
jdstrandChipaca: I'm trying to understand if that access is legitimate15:18
jdstrandChipaca: is this a Canonical snap? is it used by snappy developers for debugging, etc?15:18
Chipacajdstrand, it's a chipaca snap, not a canonical snap15:18
Chipacait is used by me to talk to snapd directly, yes15:19
Chipacabut it's also just regular httpie, so you can http google.com and such15:19
jdstrandit seems reasonable that a snappy developer would be able to use a snappy tool to talk to the snapd socket, so I'll say as much in a comment in the snap and grant the snap declaration15:19
Chipacahmm. I'll take it. I'd like to think somebody not working on snappy could still do this if they cared about it enough, though.15:21
jdstrandjeez, why is the store taking so long15:21
Chipacajdstrand, that's noise][1's middle name these days, i hear15:21
jdstrandhmm, searching for 'http' in the store doesn't yield great results...15:22
ogra_try google then :P15:22
jdstrandlol15:22
jdstrandChipaca: this https://myapps.developer.ubuntu.com/dev/click-apps/3675/ ?15:22
Chipacajdstrand, sorry for the delay (2fa...)15:23
Chipacajdstrand, yes15:23
jdstrandChipaca: ok done15:23
Chipacawoo, it works again :-D15:24
lutostagI can't seem to get lxd to work on core-16, due to https://bugs.launchpad.net/snappy/+bug/1606510, is that truly the case or am I missing something?15:34
mupBug #1606510: Mechanism to create system groups <lxd> <Snappy:New> <https://launchpad.net/bugs/1606510>15:34
lutostagany help would be appreciated15:35
ogra_lutostag, seen my last comment on that bug ?15:35
lutostagogra_: sweet, I did not, I will see if that works, thanks!15:36
ogra_sadlyx there is still manual work required, but we'll fix that15:36
mupPR snapd#2420 opened: overlord/snapstate: setup/remove aliases as we link/unlink snaps <Created by pedronis> <https://github.com/snapcore/snapd/pull/2420>15:50
lutostagogra_: ok, I no longer see that error in syslog (but after a reboot the error reappears). And I can never seem to get the lxd daemon to start properly15:53
ogra_hmm15:54
lutostag(started with clean kvm image & rpi2)15:55
ogra_stgraber, any idea why using extrausers might confuse lxd ? even thjough it works before reboot ?15:55
ogra_do we need any extra pam or nss magic here ?15:55
stgraberogra_: lxd just calls getgrnam which should go through the usual NSS stack15:57
ogra_hmm15:57
stgraberdoes "getent group lxd" succeed on such a system?15:58
lutostagerrorcode 215:58
lutostag(no output)15:58
ogra_ogra@pi3:~$ sudo grep lxd /var/lib/extrausers/*16:01
ogra_ogra@pi3:~$ getent group lxd; echo $?16:01
ogra_216:01
ogra_ogra@pi3:~$16:01
ogra_grr16:01
stgrabergood, so not my fault :)16:01
ogra_ogra@pi3:~$ sudo grep lxd /var/lib/extrausers/*16:01
ogra_/var/lib/extrausers/group:lxd:x:112:16:01
ogra_/var/lib/extrausers/group-:lxd:x:112:16:01
ogra_/var/lib/extrausers/gshadow:lxd:!::16:01
ogra_/var/lib/extrausers/gshadow-:lxd:!::16:01
ogra_ogra@pi3:~$ getent group lxd; echo $?16:01
ogra_216:01
ogra_ogra@pi3:~$16:01
ogra_so the getent lies ...16:02
stgrabersomething must be busted with your nss setup somehow16:04
stgraberwhat do you have in nsswitch.conf?16:04
ogra_passwd:         compat extrausers16:04
ogra_group:          compat extrausers16:04
ogra_shadow:         compat extrausers16:04
ogra_gshadow:        files16:04
ogra_hmm16:04
ogra_gshadow doesnt look right16:04
stgraberyeah, not sure that it'd cause that problem, but maybe16:04
stgrabershould be easy enough to try, just bind-mount a fixed file onto it and try again :)16:04
ogra_ogra@pi3:~$ sudo getent group lxd; echo $?16:06
ogra_216:06
ogra_nope, no change16:06
mupPR snapd#2421 opened: tests: add basic test for docker <Created by mvo5> <https://github.com/snapcore/snapd/pull/2421>16:30
qamarhi all16:30
=== topi` is now known as topi
=== topi is now known as topi`
zygajdstrand: hey18:02
zygajdstrand: will you have the time to review https://github.com/snapcore/snapd/pull/2416 today?18:02
mupPR snapd#2416: cmd/snap-confine: add snap-confine command line parser module <Critical> <Created by zyga> <https://github.com/snapcore/snapd/pull/2416>18:02
kyrofaHey ogra_, do you know where our kernel snapcraft.yaml is maintained?18:08
zygakyrofa: hehe18:08
zygakyrofa: I do18:08
zygakyrofa: I asked the kernel team if we can move it18:09
zygahttps://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux-snap/+git/xenial/tree/snapcraft.yaml?h=pc18:09
zyga(in a galaxy far far away)18:09
kyrofazyga, ah, thanks!18:09
zygakyrofa: reviews welcome ^ (for snapd)18:13
ogra_kyrofa, note that the actual building happens with the Makefile that is in the tree under source: ... it has nothing at all in common with a snapcraft kernel plugin created kernel snap18:14
kyrofaogra_, indeed, I noticed that18:14
kyrofaogra_, is that overcoming a shortcoming, or just using something that was already there?18:15
ogra_(it is a chroot that grabs a bunch of binaries from the archive and pulls the binaries out of there)18:15
ogra_it is a necessity18:15
ogra_we need a bunch of userspace bits and these bits need to come from stable packages18:15
kyrofaogra_, ah, it's not "just" the kernel, huh?18:15
ogra_and we need the kernel binaries signed with the ubuntu archive key for secure boot18:15
ogra_no, rthe official kernel snap has not much in common with a plain kernel snap from a snapcraft plugin build18:16
ogra_we do not build anything from source18:16
ogra_due to the key requirement that wouldnt work outside of the archive18:16
ogra_we need to use the same secure-boot key for UEFI secure boot as the desktop kernel18:17
ogra_kyrofa, also, ppisati owns all this now18:17
kyrofaogra_, ah, very interesting, okay18:18
kyrofaogra_, yeah I just curious what it looked like, no problems with it or anything18:18
kyrofaThanks for the info!18:18
ogra_np18:20
jdstrandzyga: I wasn't planning on it. this looks like the code churn stuff I thought we were not going to make a high prioirty (with tyhicks)18:21
zygaogra_: AFAIK all kernel snaps are owned wholly by the kernel team18:21
zygajdstrand: we have today and part of tomorrow still18:22
zygajdstrand: I can still prepare alt branches but I wrote this super carefully and I'd love to land if it we can review it on time18:22
jdstrandzyga: why is this important? it is code churn? snap-confine works fine without it18:23
jdstrandtyhicks: do you want me to continue to put off my work for this ^18:23
zygajdstrand: churn in some way, it's making something that was kind of ad-hoc more reliable18:23
zygajdstrand: if you don't have the time to review this it's fine but at some point we may need to just land stuff without being reviwed by security18:24
zygajdstrand: if you collectively agree that's okay18:24
jdstrandzyga: that sounds like a threat :)18:24
zygajdstrand: no no, I didn't mean it to sound like that18:24
zygajdstrand: I mean we may need to reorg stuff as we have conflicting requirements18:24
zygajdstrand: and not enough time to do everything18:25
zygajdstrand: e.g. I'll likely work on the live namespace changes code soon and that will involve lots of new stuff18:26
jdstrandI don't know what you are referring to with reorg, but I'm still on snappy full time. anyway, resourcing is something for ratliff, et al. let's see what tyhicks says18:26
zygajdstrand: with reorg I meant that perhaps we could land some pull requests without a security review18:26
zygajdstrand: and really put your time where it matters most18:27
jdstrandzyga: sure, and I'd like to finish dbus-app, network-namespace, get seccomp arg policy in place, and like 20 other snappy cards :)18:27
zygajdstrand: I don't think the parser code is particilarly security sensitive18:27
zygajdstrand: and I write stuff as defensively as I can now18:27
zygajdstrand: right, I undertand, and from my perspective you have to ack almost everything I write :)18:27
jdstrandzyga: it is sensitive. it is running before privileges are dropped. if something bad happens there, priv escalation18:27
zygajdstrand: yep, you are right18:28
tyhicksyes, it is sensitive18:28
jdstrandzyga: this is nothing against your coding btw18:28
zygajdstrand: (and thus I prefer my super defensive and tested code to the stuff that's in main now :)18:28
jdstrandthere is very little in main that is setuid root18:28
jdstrandthis launcher is ridiculously complex for a setuid executable. I understand it has to be so, but...18:29
zygajdstrand: I think parsing was18:29
zygajdstrand: I agree but I think we made it as simple as it can18:29
zygajdstrand: (be)18:29
jdstrandsure, hence the 'but'18:29
jdstranderr18:30
jdstrandhence the 'understand'18:30
* zyga nods18:30
zygajdstrand: could emily review some of my branches?18:30
jdstrandthat would be for ratliff and tyhicks to decide18:31
tyhickszyga: why is this PR critical?18:31
jdstrandhonestly, I'd love to get to a point where the launcher is constantly changing18:31
jdstrandisn't*18:31
tyhicksme too18:31
tyhicksclosely reviewing PRs to a setuid-root executable takes considerable time18:32
jdstrandTyler gave the +1 on the error handling one (which is fine), but I'm starting to feel like I'm losing context with each review18:32
tyhicksI'd like us to not make changes just for the sake of rewriting existing code18:33
zygatyhicks: it's on the critical path for classic confinement, there's just two branches after that (short ones)18:33
tyhicksthat PR only adds new code so I can't see what it is simplifying/hardening/improving18:33
jdstrandagain, changing arg parsing isn't critical to that18:34
jdstrandI gave an easy path for classic18:34
zygatyhicks: the code that changes main is in a separate branch18:34
jdstrandjust modify the current parsing18:34
jdstrandI'm not saying this should not ever be merged. I'm just saying it isn't critical to classic18:34
jdstrandand therefore maybe we can land small changes fast as opposed to big changes fast18:35
zygaok, I'll adjust after feedback from gutavo and propose a small branch that just adds another strcmp for --classic18:35
* jdstrand notes that tyhicks did not weigh in on if one of us should move away from what we are doing to this18:36
tyhicksmy preference is to not preempt all of our current work with this PR18:36
tyhickszyga seems to have agreed with a way forward that doesn't need us to do that18:36
zygajdstrand, tyhicks: I think at the root of the problem is the fact that I implicitly assume I can get a review from one of you at any time18:37
zygaand that's not the case18:37
jdstrandok. unless told otherwise, I will postpone reviewing this PR18:37
zygatyhicks: well, still but to a smaller degree :)18:37
tyhickszyga: yeah, that's probably a bad assumption18:38
zygatyhicks: so what do you think we should do?18:38
tyhickszyga: I thought you said that you'd go the strcmp() route for --classic?18:38
zygatyhicks: yes, I mean in general18:39
zygatyhicks: what do we do the next time?18:39
tyhickszyga: we have to prioritize all of the work that we have on our plates - critical snappy PRs rank extremely high18:39
jdstrandzyga: I think that the stakeholder process is not being observed18:40
tyhickszyga: we'll make time for those18:40
zygajdstrand: what process wasthat?18:40
tyhickszyga: PRs that move code around fall below ubuntu security updates, some feature development, etc., and that's the situation that we're facing now18:40
jdstrandit's assumed that I can do anything asked of me for snappy at any time. this results in the security team's snappy lane not getting enough attention18:40
jdstrandcause everything gets preempted all the time18:41
zygatyhicks: should I be allowed to land such PRs with regular reviews?18:41
zygajdstrand: right, I see the bad side effects, I'm looking at what to do in general18:42
tyhickszyga: I would hope not. Like we discussed, this code will end up being used in the most critical sections.18:42
jdstrandzyga: I think what tyhicks is saying is that critical PRs will always be treated with critical priority. a PR that just moves stuff around as part of a critical feature isn't really the same thing. We can get to that PR too, but it needs to be prioritized alongside other items18:42
tyhicksyes, that's what I'm saynig18:42
* zyga nods18:43
tyhicksplease have a good reason to make a code reorgnization PR as a prereq of a critical feature18:43
jdstrandfor example, people are being driven crazy because setpriority isn't using arg filtering18:43
zygaone thing I'd like to figure out is how we can do refactorings like this one over time, perhaps we should not do it at random time but I would argue that we should have time and space for refactoring code in s-c18:43
jdstrandand having that and 20 other seccomp arg filtering bugs should be higher priority than an arg parsing pr18:43
zygaI see18:44
jdstrandzyga: we can, it just needs to be prioritized alongside the other stuff18:44
zygaack18:44
jdstrandto date, the other stuff is constantly deprioritized18:44
zygaI'll just keep proposing them and when you have time just review them18:44
zygaand I'll try minimalistic branches for everything ele18:44
* jdstrand nods18:44
zygaelse18:44
tyhicksI think that would work out well18:45
jdstrandzyga: if something is blocking you, it is totally fine to raise that with tyhicks and ratliff18:45
jdstrandthat is the stakeholder process18:45
zygaack18:45
tyhicksthanks zyga18:45
zygatyhicks, jdstrand: FYI, after the merge into snapd I'll spend time on adjusting spread tess to work with and feel more like the snapd tests18:46
zygaand I'll do some small reorg to have a static library shared by snap-confine, snap-discard-ns, snap-system-shutdown and the upcoming snap-modify-ns (working name)18:46
jdstrandzyga: for you arg parsing pr... since the code will be more involved, perhaps temporarily drop privs before and raise after like we do a little later18:46
zygahopefully just autotools changes though18:47
zygajdstrand: sure, I can do that easily18:47
tyhicksheh, I was going to suggest the same thing that jdstrand just suggested18:47
jdstrandzyga: it isn't bulletproof to be sure, but adds a hurdle18:47
zygayes18:47
tyhicksI'd like to see a temporary drop of privs18:47
zygaI can even switch hats18:47
jdstrandswitching hats is an interesting concept18:47
zygaso I'm all up to do all of that in a nice and tested fashion :) (you know I love to code)18:48
jdstrandyes! :)18:48
jdstrandI'd say start with priv dropping for that-- it is super easy18:48
zyga+118:49
tyhicksif you change hats, I wouldn't suggest doing it the way that aa_change_hat() is already used18:49
zygatyhicks: what would you suggest?18:49
jdstrandchanging hats, using privilege separation in another process, using a crazy restrictive seccomp sandbox for that process are all things that could possibly be done, but would need to be designed to make sure the benefit outweighs the complexity18:49
tyhickszyga: well we currently fork and then change hats and never return back18:49
mupPR snapd#2422 opened: tests: re-enable snap-confine unit tests via spread <Created by zyga> <https://github.com/snapcore/snapd/pull/2422>18:49
zygatyhicks: ah18:50
zygatyhicks: I thought you meant that we should use something other than aa_change_hat18:50
tyhickszyga: you wouldn't want to fork - you'd just change to a hat and then change back18:50
tyhickscool, sounds like we're on the same page18:50
zygayes, I think so18:50
tyhicksok, I'm off to hack on seccomp some more18:51
* jdstrand goes off to reviews and dbus18:51
zygathanks guys!18:53
zygaand if I can review something for you, ask any time!18:53
* jdstrand hugs zyga :)18:53
zygaI'd like to help :)18:53
jdstrandthanks!18:53
* zyga hugs jdstrand and tyhicks :)18:53
* tyhicks hugs zyga and jdstrand :)18:54
mupPR snapd#2423 opened: overlord,overlord/snapstate: implement snapstate.Alias <Created by pedronis> <https://github.com/snapcore/snapd/pull/2423>19:16
mupPR snapcraft#948 closed: Use testtools as the base of all unit tests <Created by elopio> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/948>19:27
mupPR snapcraft#950 closed: tests: Use a more stable ftp source <Created by elopio> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/950>19:27
mupPR # opened: snapd#1613, snapd#2083, snapd#2128, snapd#2129, snapd#2209, snapd#2226, snapd#2230, snapd#2236, snapd#2251, snapd#2256, snapd#2274, snapd#2277, snapd#2302, snapd#2328, snapd#2345, snapd#2347, snapd#2359, snapd#2360, snapd#2365, snapd#2368, snapd#2370, snapd#2374, snapd#2377,20:09
mupsnapd#2378, snapd#2380, snapd#2391, snapd#2392, snapd#2394, snapd#2395, snapd#2397, snapd#2407, snapd#2410, snapd#2411, snapd#2412, snapd#2413, snapd#2414, snapd#2415, snapd#2416, snapd#2417, snapd#2418, snapd#2419, snapd#2420, snapd#2421, snapd#2422, snapd#242320:09
qenghodang.20:10
kyrofajdstrand, the apparmor needed by snappy isn't available upstream, correct?20:43
tyhickskyrofa: the userspace bits are all available upstream20:44
tyhickskyrofa: not all of the kernel bits are available upstream20:44
kyrofatyhicks, right sorry, should have specified the kernel20:45
kyrofatyhicks, alright just wanted to double check. Thanks!20:45
tyhickskyrofa: upstreaming those bits is something that we'll have someone working on very soon20:45
kyrofatyhicks, makes sense for the long haul, but I'm sure there are higher priorities at the moment20:46
tyhicksyes :/20:47
kyrofazyga, do we still have a classic dimension in the new Ubuntu Core images?20:52
kyrofaogra_, I seem to remember you demoing the classic stuff, but don't remember how to do it20:55
mupPR snapcraft#908 closed: Let Rust plugin fetch dependencies in pull <Created by ChrisMacNaughton> <Merged by kyrofa> <https://github.com/snapcore/snapcraft/pull/908>21:12
ogra_kyrofa, sudo snap install classic --devmode --edge; sudo classic21:13
kyrofaogra_, thank you :)21:14
mupBug #1647849 opened: Ubuntu Snappy Core on Raspberry Pi 3 Wi-Fi fails on first boot <Snappy:New> <https://launchpad.net/bugs/1647849>21:18
zygakyrofa: yes, but it's called clasisc snap21:21
zygaclassic*21:21
kyrofazyga, difficult to discover. Do we plan on documenting that further, or integrate further with snapd itself?21:22
zygakyrofa: maybe via motd?21:22
zygakyrofa: I think we should document it on the snapd wiki21:22
zygakyrofa: in "first steps" perhaps, (a find-your-way-around tutorial)21:22
kyrofaIndeed21:30
kyrofamotd is also a good idea21:30
mupBug #1609322 changed: snap firstboot can run before /sys/class/net/ is populated <Snappy:Fix Released> <https://launchpad.net/bugs/1609322>22:16
mupPR snapd#2424 opened: interfaces/builtin: add physical-memory-* and io-ports-control <Created by tonyespy> <https://github.com/snapcore/snapd/pull/2424>23:10
mupBug #1647849 changed: Ubuntu Snappy Core on Raspberry Pi 3 Wi-Fi fails on first boot <Snappy:New> <https://launchpad.net/bugs/1647849>23:16

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!