[01:58] PR snapcraft#1044 closed: tests: use python2 to check the CLA [02:01] PR snapcraft#1032 closed: Use more secure temporary directory for parser runs === madprops_ is now known as madbot === StoneTable is now known as aisrael === mup_ is now known as mup === tedg__ is now known as tedg_ === madbot is now known as madprops === dobey_ is now known as dobey [03:26] Bug #1657633 opened: console-conf shows the previous IP address after reconfiguration === chihchun_afk is now known as chihchun [08:51] Help [08:52] i want to learn python, for ethic hacking and sockts === faenil_ is now known as faenil === faenil is now known as faenil_ [09:29] ogra_: is https://code.launchpad.net/~snappy-dev/core-snap/trunk the right place to look for the core snap? [09:30] morphis, yep [09:31] morphis, what do you need ? [09:31] ogra_: we're close to add a configure hook to the core snap, so just checking where the source for it is :-) [09:31] oh [09:32] the backend needs to go into some deb ... probably ubuntu-core-config [09:32] from the image PPA [09:34] ogra_: so what assembles the core snap then? [09:34] live-build [09:34] (with livecd-rootfs holding the config and possible hacks) [09:35] and how can we get the meta/hooks/configure script added [09:37] hmm, you want to put the whole of it there ? uncludion the binaries you need ? [09:37] *uncluding [09:37] bah [09:37] *including [09:37] ogra_: it will be a simple bash script [09:37] ah, k [09:37] yeah, that might be fine [09:37] we just need one option to enable/disable sshd [09:37] PR snapd#2660 closed: cmd: fix typo (thanks to jdstrand!) [09:38] morphis, that will need more i guess [09:39] * ogra_ tries to touch /etc/ssh/sshd_not_to_be_run on a running system [09:39] ah, no, seems fine, it is writable [09:39] :-) [09:40] ogra_: I guess that the configure hook within the core snap should have rights to do anything or is it run inside a confined environment too? [09:40] i thought we had only made individual files writable in that dir ... then you are fine just add or remove the file (and stop/start with systemctl) [09:40] morphis, how would it if the file is in the squashfs ? [09:40] it cant physically write to it then [09:41] that is true [09:41] but here we're fine, all of /etc/ssh is writable so you can just touch and remove it as you need [09:41] good [09:42] ogra_: so where is ubuntu-core-conf these days, still a single deb package sitting in the ppa or is a there a repository for it? [09:42] i dont think there is a repo [09:43] just grab the source deb from the ppa, make your changes and give it to someone who can upload [09:45] ogra_: aye [09:45] :) [09:46] morphis, you probably want to add some checks that a user exists and has a local password to not make it possible that the admin completely locks out himself [09:46] you are quite screwed if you disable ssh and have no local console access either [09:47] yeah [09:47] ogra_: what do we have to change in livecd-rootfs then? [09:48] nothing, meta/hooks/configure should be fine unless you need additional stuff from the image itself [09:48] so meta/hooks/configure inside ubuntu-core-conf, correct? [09:49] hmm [09:50] well, livecd-rootfs might work too ... i'm not sure if the build will respect an existing /meta dir inside the chroot though, might be that snapcraft ignores it [09:51] ogra_: so you're using snapcraft to build the final snap? [09:51] or that we actually delete it ... need to check the code ... there was something about old /meta [09:51] mvo, the ubuntu-core to core transition patch will be part of the next snapd release? [09:52] morphis, http://bazaar.launchpad.net/~snappy-dev/core-snap/trunk/view/head:/Makefile ... line 26 :/ [09:53] * ogra_ goes to check the bug, perhaps we can drop that nowadays [09:53] :-) [09:53] Kaleo: that is the goal, you can test the ppa that I gave to pat the other day if you want, I think the transition code is ok, I'm currently working on robustness and some warts but I think the core (no pun intended) is ok, so if you tst it I would appreciate results [09:53] ogra_: I will tell whoever will add the configure hook from our team to check with you first :-) [09:53] mvo, superb [09:53] mvo, I already manually migrated unfortunately [09:54] PR snapd#2549 closed: cmd/snap-confine: add shutdown helper [09:55] morphis, iirc the issue was that snapcraft didnt create anything in meta/ if the dir already existed ... so i'm not sure we can actually use that [09:55] ogra_: you could use a new part in snapcraft.yaml with the dump plug [09:55] we need to try what happens i fear [09:55] s/plug/plugin/ [09:55] mvo, is there any way for a single snap to be installable in either classic or devmode confinement? [09:55] then we don't have to maintain the hook inside ubuntu-core-conf at all [09:56] well, feel free to try it ... we can do tests in edge, that is what it is for ;) [09:56] good [09:56] in any case that line from the Makefile will likely need to go [09:56] PR snapd#2449 closed: overlord/patch: patch to flag in the state required snaps from model [09:56] PR snapd#2650 closed: also include system-shutdown helper in snapd.install [09:59] Kaleo: I think there is no way for a single snap to be installable in either classic or devmode confinement. but Chipaca might have ideas here [09:59] mvo, thanks [09:59] i'm not sure i understand the question [10:00] Chipaca, let's say I have an app snapped up [10:00] you can only install them in pairs ? [10:00] :P [10:00] Chipaca, and I'd like to be able to install it forcing either classic confinement or devmode confinement [10:01] Chipaca, why? because IIUC you cannot install an app with classic confinement in an all snaps image, right? [10:01] yeah [10:02] Kaleo, there isn't a way to do that today [10:03] ogra_, Chipaca, mvo: at the core of the issue, think about how you would go about snapping gnome-terminal [10:03] with the goal to make it one day work fine in an all snaps image [10:03] Chipaca, right, to do that, you can use classic confinement [10:03] Chipaca, ok [10:04] make it use a gazillion interfaces ? [10:04] Kaleo, in general however that's not something that makes sense [10:04] i mean, installing a classic snap on an all-snaps image [10:05] classic snap means it needs all the accoutrements of a classic system [10:05] ogra_, right [10:05] Chipaca, yeah, I'd like to install it confined, ie. override the classic confinement [10:05] which are not present in all-snaps [10:05] Chipaca, so let me explain [10:05] Chipaca, the main reason you want to use classic confinement for a terminal is to have / be / [10:06] Chipaca, and let the user of terminal have access to all commands available on the base system [10:06] which is probably not such a good idea in an all-snaps image anyway [10:06] (have / be / ) [10:06] ogra_, it depends if you envision say desktop users using an all snaps version of ubuntu or not [10:07] well, 96% of / will be readonly [10:07] ogra_, readonly is good [10:07] ogra_, it's not about writing on / [10:07] ogra_, it's about reading [10:07] and for the other 4% you want no user to touch the majority of it since it is managed via the system tools internally [10:08] ogra_, yep, I don't want anyone to write [10:08] so changing stuff underneath might break things badly [10:08] ogra_, no writes [10:08] ogra_, readonly / [10:08] but with classic you can write there assuming you have sudo [10:08] pedronis, yes [10:08] pedronis, and that's a side effect I don't care for [10:08] i guess for that you could special case the apparmor rules [10:09] and have manual approval for that one package [10:09] ogra_, pedronis, what I just need for a terminal is / to be / [10:09] without / being writable [10:09] indeed thats a major security issue [10:09] I really think that if the end goal is working on all-snaps, is better to start thinking what you need there [10:09] since you can see what other processes do [10:10] Kaleo, on all-snaps / is already / [10:10] Chipaca, but you cant look at all of it [10:10] i guess that is what he wants [10:11] which defeats security ... kind of [10:11] so it's a bit of ther reverse problem, on classic / is not / unless classic [10:12] Kaleo, there's nothing stopping you from installing an 'strict' snap with --classic btw [10:13] Chipaca, on an all-snaps image ? [10:13] no, on classic [10:13] oh, you mean the other way around [10:13] yeah, ignore me ... coin took a bit to drop :P [10:13] Chipaca: for installation but I guess for running apps from it there is as from what I've heard from zyga [10:15] zyga, ^? [10:16] morphis, it's possible we've got bugs there :-) [10:16] I know of at least one [10:16] Chipaca, oh my god [10:16] Chipaca, how come I did not realise that [10:16] Chipaca, / is / with all snaps [10:16] Chipaca, " there's nothing stopping you from installing an 'strict' snap with --classic btw" [10:16] Chipaca, I was testing that just now [10:16] PR snapd#2417 closed: interfaces/builtin: add uhid interface [10:17] Chipaca, http://pastebin.ubuntu.com/23827096/ [10:17] Kaleo, it's a devmode snap, devmode+classic won't work [10:17] note i said strict [10:17] Chipaca, yep [10:18] k [10:18] Chipaca, though I need it to be devmode on all snaps because? [10:18] yeah, devmode wont buy you much if you want to use the store and snap find to find it [10:18] ogra_, you mean devmode makes it non visible in the store? [10:18] devmode cant go to the stable channel ... [10:18] PR snapd#2546 closed: overlord: use a ticker for the pruning [10:18] can't go to any stable-grade channel even [10:19] yeah [10:19] ok [10:19] Kaleo, you sure you need it devmode in all-snaps? [10:19] maybe not [10:19] I need to think that through [10:19] let's imagine that I don't [10:20] Kaleo, look at the things the htop snap uses [10:20] 1) is there a way to upload a strictly confined snap and have it be installed with --classic on classic automatically? [10:20] well, that only accesses parts of proc [10:20] 2) is there a programmatic way to detect what confinement we are under? [10:20] Kaleo, (1), no [10:20] Kaleo, (2), no [10:21] (2) should be easy to implement iffen jdstrand thinks it's a good idea (i'm not too sure it is) [10:21] (1) is a bad idea [10:21] (2) I'm not sure I will need it [10:21] (1) right, but then I need some other tool [10:21] (1) cause people really need / to be / for their terminal on a classic ubuntu [10:21] 2 -> grep snap_core /proc/cmdline ... [10:22] ogra_, nice [10:22] the prob is that you might not be able to access that [10:22] (at least not before manually connecting an interface ... so you wont be able to automate) [10:22] today you can [10:23] Chipaca, from a strict snap ? [10:23] yes [10:23] oh [10:23] i thought most of /proc was blocked by default [10:23] less is blocked than we want [10:23] except for /proc/self/ [10:23] because of issues [10:23] ah [10:23] PR snapd#2661 opened: tests: skip on untrusted keys [10:23] so i wouldn't count on it without checking with people that know more than me [10:24] yeah [10:24] is this the correct channel to ask questions about snapcraft? [10:24] i'm pretty sure long term we dont want that [10:24] timp, try asking one and you will see ;) [10:24] the store tells me for my snap: desktop interfaces (unity7) specified without meta/gui/*.desktop. Please provide a desktop file via setup/gui/*.desktop if using snapcraft or meta/gui/*.desktop otherwise. It should reference one of the 'apps' from your snapcraft/snap.yaml. lint-snap-v2_meta_gui_desktop [10:24] Chipaca, I switched the snap to strict then installed it with snap install --classic --dangerous ubuntu-terminal-app_0.11_amd64.snap [10:24] Chipaca, it looks like / is not / [10:25] Chipaca, even though it installation went fine [10:25] in which step is this desktop file checked? I wonder if I need to have this desktop file available for the first step, or it can be there later. My snap is built from downloaded debs that already include desktop files [10:25] Chipaca, checking [10:25] Kaleo, in what sense is / not /? (not saying you're wrong, but wondering) [10:25] Chipaca, as in the / inside the snap environment is not the same filesystem as the / outside [10:25] Chipaca, double checking now [10:26] timp, it needs to be there in prime/ as far as i know [10:26] zyga, you here? [10:27] Chipaca, right, for example the contents of /bin are different inside of the snap and outside [10:27] Chipaca: okay, thanks [10:27] Kaleo, but confinement lets you do pretty much everything? [10:27] Chipaca, checking [10:27] Kaleo, probably just something we need to do [10:27] Chipaca, (I think so) [10:28] (that's what i checked, that confinement seemed to be as expected) [10:28] Kaleo: / is / doesn't mean we don't bind mount thing on top [10:28] pedronis, agreed [10:28] pedronis, but there is _less_ stuff [10:28] pedronis, yeah, but classic means don't do as much of that [10:28] i think? [10:28] paging dr zyga [10:29] hey [10:29] Chipaca: we do less, but I think it still defeats the goal, though there is probably some way out of that [10:29] sorry, I don't get notifications for IRC [10:29] pedronis, knowing that when the same snap was built with confinement: classic instead of confinement: strict, there was way more content accessible [10:29] pedronis, even though both were installed with --classic [10:29] * zyga still needs to make a system that takes stuff from irssi on one VM and pushes it somewhere (say a lava lamp) [10:29] so how can I help? [10:30] zyga, installing a strict snap with --classic [10:30] zyga, the mounts seem to be wrong [10:30] zyga, let's take it from the core of the issue: trying to have a terminal (say gnome-terminal) snapped and still useful on both classic ubuntu and all snaps ubuntu [10:30] ok :) [10:30] PR snapd#2662 opened: interfaces: network-manager: allow rw access to /etc/netplan [10:31] zyga, strict snap with --classic: / seems to be the core snap, not the / of the classic ubuntu [10:34] strict snap with classic is meaningless [10:34] it will never work [10:34] as strict snaps are not built in a way that allows them to run in classic [10:34] zyga, ok [10:34] zyga, that's clear then [10:34] Kaleo: FYI, you cannot reuse binary packages easily for classic confinement snaps [10:34] zyga, we should block it then :-) [10:34] Kaleo: IMHO everything should be rebuilt [10:34] zyga, so back to the core of the matter: trying to have a terminal (say gnome-terminal) snapped and still useful on both classic ubuntu and all snaps ubuntu [10:35] zyga, Chipaca, or maybe we could publish 2 versions of a snap? [10:35] zyga, Chipaca, one classic and one strict [10:35] this is an all-snaps ubuntu that presumably has X somehow? [10:35] zyga, Chipaca, would the store allow that? [10:35] Chipaca, yeah [10:35] Chipaca, or MIR [10:35] MIR I buy :-) [10:36] Kaleo, with different names, sure [10:36] Chipaca, or whatever, just a display and a keyboard :;) [10:36] Chipaca, ideally with the same name :) [10:36] Chipaca, different name, I guess it's just a matter of having 2 entirely separate "snaps" [10:36] niemeyer, you here? [10:36] Chipaca, it's unpractical from a source code perspective: having 2 snapcraft.yaml [10:37] Chipaca, and not as nice for the user [10:39] Kaleo: the core version would need to snap the whole display stack (or use interfaces) [10:39] Kaleo: how do you expect to use it? [10:40] Kaleo: FYI, on core I think there's no good way to ship a terminal emulator that would be useful for developers [10:40] Kaleo, i've pinged niemeyer so we can think about how we *want* this to be [10:40] zyga, I would rather imagine it would uses interfaces (such as unity8) [10:40] Kaleo: interfaces give you permissions [10:40] Kaleo: what about all the runtime libraries, gtk, mir [10:40] Kaleo, as to how things are, today, i'm afraid it's two separate snaps (and i'm not sure you'll get what you expect/want even then) [10:40] zyga, right [10:40] Kaleo: content interface is not supported for snaps using classic confinement [10:40] Kaleo: I think the issue at hand is this: [10:41] Kaleo: you can make a perfect strictly-confined terminal emulator [10:41] zyga, that's indeed another issue I bumped into (I have a big snap atm) [10:41] Kaleo: but to be useful it must be allowed to run an unconfined shell [10:41] Kaleo: otherwise this is somewhat pointless [10:41] zyga, yeah [10:41] Kaleo: AFAIK gnome-terminal has a daemon process and is tied to the session bus [10:41] Kaleo: all this makes it a lot more complicated [10:41] zyga, you need to be able to do something as far as launching gnome-calculator from said terminal [10:42] o/ [10:42] zyga, yeah, let's take a simpler terminal to think about it [10:42] zyga, ubuntu-terminal :) [10:42] Kaleo: launching one snap from another is forbidden and there's no interface for that yet [10:42] running one snap's apps from another snap's app was not supported last time i checked [10:42] (and there's a kernel bug that prevents this right now) [10:42] zyga, have we done the legwork to support swapping profiles like that? [10:43] Chipaca: swapping apparmor profile is easy [10:43] Yeah, it's not [10:43] supported, that is [10:43] Chipaca: there are other things at play and they are broken (the reassociate-fix branch as all the details) [10:43] terminal emulators are like desktop environments [10:43] they run various apps [10:43] zyga, crazy to the head? [10:43] they feel like having super-powers [10:43] ah, that also [10:43] There are reasonable paths for us to support that, but not there yet [10:43] yeah [10:44] zyga, Chipaca, so right now, we can do the following: have 2 separate snaps, one classic, one confined; the classic one can be useful on classic and the confined one will be somewhat of limited usefulness [10:44] any ideas why for the ubuntu-ui-toolkit-examples snap, I only have the options to release it to beta and edge? No candidate or stable [10:44] timp, it's devmode? [10:44] - but better than no terminal in an all snaps image [10:45] Chipaca: right.... thanks :) [10:45] Kaleo: where do you expect to run the confined snap today? [10:45] Kaleo: on classic desktop or on something like raspberry pi? [10:45] zyga, the confined snap, on a desktop type device for which we might have an all snaps image; which I don't know we have [10:45] Kaleo: the classic snap would be an interesting thing to try anyway [10:46] zyga, the classic snap already works [10:46] Kaleo: just to see how hard it would be to take a complex real-world codebase and build it for classic [10:46] Kaleo: please do that regardless and work with sergio and kyrofa to make them aware of feedback [10:46] zyga, I switched ubuntu-terminal to classic (from devmode) and it works [10:46] Kaleo: how did you build the classic snap? did you try it on 14.04? (I suspect it doesn't work there) [10:46] zyga, tried on 16.04 [10:47] Kaleo: building and testing on 16.04 is somewhat tricky as you may build a broken snap that will only work on 16.04 [10:47] zyga, I kept all the stage-packages as they were when confined [10:47] zyga, so I would expect that the right libs are there in the snap and linked [10:47] Kaleo: building classic snaps with stage packages is wrong [10:47] Kaleo: sadly the only sane way is to build from source [10:48] (this is why it is hard) [10:48] zyga, even to prevent breakages? [10:48] zyga, I don't understand whyh [10:48] -h [10:48] Kaleo: do you want to? [10:48] :-) [10:48] to understand? :) [10:48] sure [10:48] Kaleo: because that snap transparently relies on your ubuntu system, for a correct snap it should only rely on /snap/core/current and /snap/$SNAP_NAME/current [10:49] zyga, yeah so you might forget snap-packages or might forget to change some paths [10:49] Kaleo: at almost every detail, from the dynamic linker, dynamic libraries, helper executables and data files [10:49] Kaleo: if you ever move away from 16.04 it will stop working [10:49] Kaleo: no, it's not "some paths" [10:49] zyga, but since I made the snap work in devmode [10:49] Kaleo: prebuilt packages will not work [10:49] Kaleo: you *must* built it from source and snapcraft must support classic confinement in each plugin you use [10:50] zyga, then I don't understand the point of classic snaps [10:50] Kaleo: that's the unfortunate reality; I would encourate you to check this on kde or on 14.04 kde for a "good test" [10:50] Kaleo: the point is as you thought it to be a moment ago [10:50] Kaleo: but the technical reality is that they cannot be built from binary packages [10:50] zyga, which you said is not reality [10:51] zyga, so no point :)$ [10:51] Kaleo: no, the point is to have no confinement in the way [10:51] zyga, I see [10:51] Kaleo: you can bring in gcc as a classic snap [10:51] Kaleo: git, vim [10:51] zyga, ok [10:51] Kaleo: gedit as well, but you must build from source [10:51] Kaleo: and all the build bits must do what is required (magic in snapcraft or hand-holding) [10:51] Kaleo: e.g. I've built a python0 snap as a classic confinement snap [10:51] Kaleo: look at the build system: [10:51] https://github.com/snapcore/snapd/pull/2581/files [10:51] PR snapd#2581: debian: remove trusty specific bits [10:52] I bet you this will work on any system under the sun [10:52] zyga, so, for right now, I can test the snap on more systems, and publish it only if it works ok; and even then work on a way to make terminals useful when fully confined? [10:52] Kaleo: but I had to do stuff manually as snapcraft doesn't support everything yet: https://github.com/zyga/python0/blob/master/python0.Makefile#L10 [10:52] Kaleo: not sure which snap you mean, you said you have a few [10:53] zyga, ubuntu-terminal [10:53] Kaleo: (one problem at a time please, I'm somewhat distracted doing a few things already) [10:53] zyga, ubuntu-terminal-app [10:53] zyga, it's only the one thing we are talking about [10:53] zyga, making snapped terminals useful [10:53] zyga, starting with ubuntu-terminal-app [10:54] Kaleo: do you want a confined or classic snap [10:54] zyga, since you said classic snaps are basically unreliable, it cannot be classic in the long ruin [10:54] -i [10:54] zyga, so confined [10:54] Kaleo: no, I didn't say that: I said that you must build classic snaps from source and do it correctly, they are 100% reliable then [10:55] zyga, lol [10:55] Kaleo: ok, confined [10:55] zyga, I mean unreliable for actual end users [10:55] zyga, (actual end users don't compile their software) [10:55] Kaleo: again, I didn't say that [10:55] Kaleo: actual users don't build snaps either [10:55] zyga, so I don't understand [10:55] Kaleo: as long as the snap is built correctly it will be reliable [10:55] Kaleo: ok [10:56] PR snapd#2663 opened: run "go test -i" before go test itself [10:56] Kaleo: fact of life: building classic snaps from binary packages is incorrect [10:56] zyga, "build classic snaps from source" means what? [10:56] Kaleo: fact of life: snacpraft doesn't support building everything magically yet [10:56] Kaleo: well, you build the .c files and the .cpp files [10:56] Kaleo: you cannot download debs and copy them over [10:56] zyga, of the software? or of the software and all its dependencies? [10:56] Kaleo: that's what I mean by "build it from source" [10:56] Kaleo: all of it [10:56] zyga, of all the deps, I see [10:56]