=== JoshStrobl is now known as JoshStrobl|AFK [03:54] PR snapcraft#1642 opened: tests: move the plainbox test to the integration suite [03:57] PR snapcraft#1643 opened: [WIP] tests: run daily autopkgtest in travis [05:26] good morning [05:33] zyga-ubuntu: good morning ! [05:33] zyga-ubuntu: master is broken currently :/ https://travis-ci.org/snapcore/snapd/builds/293175118#L5810 - looks like something for pawel [05:43] PR snapcraft#1644 opened: lxd: fix the push in container builds [05:55] PR snapd#4079 closed: daemon: allow Polkit authorization to cancel changes === kira is now known as Guest63697 [06:07] PR snapd#4082 opened: cmd/snap: tell translators about arg names and descs req's (2.29) [06:08] PR snapd#4083 opened: snap-{confine,seccomp}: make @unrestricted fully unrestricted (2.29) [06:11] PR snapd#4084 opened: interfaces: clean system apparmor cache on core device (2.29) [06:12] Hello currently working on ubuntu core 16 need to build qt application which works on postgres database do [06:12] on need to create a separate snaps for it [06:12] and is any document for qt and postgres [06:15] Guest63697: hello [06:15] Guest63697: I don't know about postgres but there's something for a kiosk qt app [06:15] Guest63697: my suggestion would be to get postgress up and running [06:16] Guest63697: and then move on to qt [06:16] Guest63697: also, not sure why you want separate snaps for that but that's ok, you will just need to use content interface to share data/sockets so that they can talk to each other [06:16] PR snapd#4085 opened: debian: do not build static snap-exec on powerpc (2.29) [06:16] zyga-solus: Hi for more details i am currently working on dell edge gateway 5000 with ubntu core16 installd [06:18] Guest63697: right, you can prototype this on a typical ubuntu system (16.04 is ideal) and then just install the resulting snap on the device [06:18] mvo: o, looking [06:19] zyga-solus: I am new to the core os i just tried running hello world application so needed jus help to move my existing application to core :) [06:19] mvo: aha, I see that service management test failed [06:20] Guest63697: I suggest you start by learning about snapcraft, using snaps on your 16.04 desktop/laptop (classic system) and playing with your core system with a few snaps [06:20] Guest63697: build a hello-world.c from source, see how that looks like [06:20] Guest63697: then look at what it would take to run postgres === JanC is now known as Guest53324 === JanC_ is now known as JanC [06:20] Guest63697: or separately at kiosk-style Qt (this is documented on the forum) [06:21] Guest63697: in the end all the pieces will come together and you should get it to work fine [06:21] Guest63697: stick around, join the forum, experiment. read, and ask :) [06:21] oh, and welcome :-) [06:21] mvo: I'll ignore that master failure for now unless pawel comes around and asks for help [06:21] mvo: I need to finish apparmor changes for overlayfs [06:22] mvo: and expand the spread tests for that [06:22] zyga-solus: I have been searching on the web a multiple links can you please suggest any useful and just for curiosity should i put all the application and its dependecy under one snp [06:22] Guest63697: try forum.snapcraft.io [06:22] Guest63697: we also have a snapcraft tutorial on ... [06:22] https://docs.snapcraft.io/build-snaps/your-first-snap [06:22] zyga-ubuntu: yeah, just a heads up about the failure not a request-for-action :) [06:23] note that you can use a classic "regular" ubuntu system for all of this [06:23] that's the beauty of snaps :) [06:23] zyga-solus: sure thanks [06:23] in the end you just deploy it on core [06:23] mvo: ack, thank you :) [06:23] PR snapd#4081 closed: systemd: run all mount units before snapd.service to avoid race [06:23] mvo: I was asking my son if he would like to wake up at 3AM tomorrow to look at sunirse in the nearby fields, we could take some photos of the birds nesting there [06:23] mvo: I was talking about this the whole week [06:24] mvo: and while earlier he was "yeah dad, that would be fun" [06:24] mvo: today he said "but if we stay at home, can we sleep longer" [06:24] mvo: I think I lost that one :) [06:24] mvo: if you want I can work on mount unit refresh later today [06:25] mvo: I'd like to think how to approach that: as a fixup type thing or as a change in how we maintain them [06:28] PR snapd#4086 opened: snap-confine: increase sanity_timeout to 6s [06:28] zyga-ubuntu: it seems conceptually cleaner to do the later [06:29] mvo: I agree but then my conclusion was, if this is something that will run in ensure (that is, all the time)? [06:30] mvo: and if so, what should we do after we notice that the files were chaned [06:30] mvo: I was thinking that this is where it gets hairy [06:30] mvo: we could log "discrepancy in unit %q" [06:30] mvo: and do nothing at all (for this specific case that's fine) [06:30] mvo: but it feels like a stretch of the concept [06:30] mvo: we also don't have similar ensure for interfaces [06:30] mvo: but [06:31] mvo: if we actually do this then the system is self-healing in a nice way [06:31] zyga-ubuntu: well, if its a one-off thing we should handle it like this and not complicate things, just a "fixupMountUnits()" somewhere [06:31] mvo: ^ commented on the PR, I think you need to change a few tests too [06:31] zyga-ubuntu: 2.29 is super close this healing thing may not even make it [06:32] mvo: yes, I agree we absolutely have to have something for 2.29, so a fixup is good [06:32] zyga-ubuntu: aha, thanks. we have two autopkgtest failures where the alarm goes of [06:32] mvo: maybe 2.31 target for generic healing [06:32] zyga-ubuntu: 2.29 is super close, candiate targeted monday so it may not even make it [06:32] zyga-ubuntu: but if it does even better [06:32] zyga-ubuntu: I plan ~rc2 today [06:32] zyga-ubuntu: and hopefully that is the last one [06:32] mvo: for the tests we need "make check" to pass [06:33] mvo: what about 4008? [06:34] zyga-ubuntu: its still hanging there, I wanted to see where things are at lunchtime, if everything else is in and ready +1 [06:35] zyga-ubuntu: thanks, I adjusted the test now. I did a force push to make it easier to cherry-pick (either way) [06:36] mvo: no worries, I approve of --force ;D [06:47] PR snapd#4087 opened: cmd: downgrade log message in InternalToolPath to Debugf() [07:32] pstolowski: hey, good morning. you have two 2.29 targeted PRs, could you please create a branch based on upstream/release/2.29 and cherry-pick your commits to it so that we merge to 2.29? [07:32] pstolowski: also master is failing right now [07:34] mvo, sure [07:35] mvo, what is failing? [07:43] o/ [07:58] zyga-ubuntu: I am trying run the qt4 text editor example on from snapcraft github it is giveing error as application cannot connect to x server [08:00] Guest63697: on core or on classic? [08:00] zyga-ubuntu: on core [08:01] on core there's no display stack [08:01] you need to look at qt + kiosk mir demos for that [08:15] pstolowski: sorry for the delay, I was distracted: master is broken currently :/ https://travis-ci.org/snapcore/snapd/builds/293175118#L5810 [08:15] pstolowski: maybe racy? [08:15] pstolowski: line 5810 (takes forever to load for me :/ [08:16] pstolowski: maybe https://travis-ci.org/snapcore/snapd/builds/293175118#L5758 works better? [08:17] pstolowski: the gist is http://paste.ubuntu.com/25828740/ [08:17] mvo, thank you [08:17] mvo, oh damn.. this indeed might be racy. i wonder what to do about that test :( [08:18] pstolowski: sleep 10 - what we always do (kidding of course) [08:18] i guess we need a function that tries a couple of times until a timeout passed, then it gives up [08:19] pstolowski: yeah, I think that is sensible [08:20] mvo, ok, i'll work on this, sorry about the problem [08:21] pstolowski: no worries, thank you [08:23] mvo, when cherry-picking for 2.29, is it ok to squash? [08:25] pstolowski: if it is merge in master already then please cherry-pick individually otherwise the merge of 2.29 into master will be infected with conflicts [08:26] pstolowski: if it is not merged yet the easiest is to squash merge when merging into master to get any easy cherry-pick [08:27] mvo, ack [08:40] mvo: hi, I'm trying to finish something not to lose state, let's talk about ignore-validation after lunch [08:42] pedronis: +1 [08:54] PR snapd#4082 closed: cmd/snap: tell translators about arg names and descs req's (2.29) [09:01] is there a way for a snap to know the underlying os version? (not the core snap one) [09:04] ackk: mmm, no I don't think there is === JanC_ is now known as JanC === JoshStrobl|AFK is now known as JoshStrobl [09:17] * zyga-ubuntu -> coffee [09:17] pstolowski: while you fix the test I can help with the 2.29 cherry-picks for 4070 - we need this for 2.29, right? its a bugfix aiui? [09:19] PR snapd#4088 opened: snapctl: cherry pick service commands changes [09:20] mvo, ^ [09:21] mvo, yes, it's kind of a bugfix [09:23] mvo, nb, i think 4080 is not very important for 2.29 [09:27] pstolowski: thank you [09:28] pstolowski: what branches does 4088 cover? i.e. which of the previous PRs that were tagged 2.29? [09:29] mvo, 4070 and 4065 (the latter for prerequisite for the former anyway) [09:31] oooh [09:31] man [09:31] after using vim for what, 20 years [09:31] I learned what "x" is for when in directory listing mode [09:33] pstolowski: do we need to cherry-pick b693557 in 4088 as well? its the last commit in 4070? [09:34] mvo, oh yes, that a test only, but yes. done [09:34] ta [09:35] zyga-solus, do you think that adding an interface for allowing that would be accettable? [09:35] ackk: not sure how such an interface would look like [09:35] ackk: why do you need this information? [09:35] ackk: and how would you expect to read it? [09:36] zyga-solus, for an app to expose the information. perhaps reading /etc/os-release from the host (possibly linked somewhere else) [09:38] ackk: most apps I know of don't read or expose /etc/os-release, I'm sure there must be some special cases though that's why I'd like to understand the need better [09:38] ackk: /etc/os-release says you are on ubuntu core [09:41] yeah [09:52] mvo, ok, i've a tentative fix for test race, let's see how travis likes it, i've never experieced it locally [09:53] pstolowski: great [09:53] and i hope it's a race, nothing else [09:53] pstolowski: looking forward to it, my top priority for today is to get the 2.29 branches in and release 2.29~rc2 to beta so that it can go to candidate monday. having master in good shape is vital .) [09:53] pstolowski: yeah [10:10] man, it's cold today [10:10] PR snapd#4088 closed: snapctl: cherry pick service commands changes [10:11] PR snapd#4089 opened: tests: wait for service status change & file update in the test to avoid races [10:12] mvo, ^ [10:16] pstolowski: thanks a bunch, lets see if travis is happy with this [10:27] ok [10:27] fingers crossed [10:29] mvo: so just to confirm, 4008 should be squash merged today [10:34] zyga-solus: if we want it in, yes [10:37] mvo: ok, please tell me when === JoshStrobl is now known as JoshStrobl|zzz [10:55] zyga-solus: ackk /etc/os-release is already exposed in apparmor afair [10:57] kalikiana: yes but it doesn't show you the real /etc/os-release file [10:57] kalikiana: it shows the one from the core snap [10:59] zyga-solus: Hmm classic snaps can see the real file... but I guess in that case apparmor doesn't apply anyway [11:01] kalikiana: can you show me how you determined that? [11:02] kalikiana: I just saw the file from core snap on a 16.04 test vm [11:03] zyga-solus: snapcraft can read the file. From checking interfaces/apparmor/template.go in snapd sources it's not obvious, though, if that applies or not [11:03] To me at least [11:03] kalikiana: I didn't say that it is not unreadable, it *is* readable [11:04] kalikiana: I said that it should almost always contain the /etc/os-release file from the core snap or other base snap that is used by a given app snap [11:04] kalikiana: thus when read on fedora it will not say "fedora" [11:04] kalikiana: it will consistently say "ubuntu core" or whatever the base snap says [11:05] zyga-solus: Right. I didn't mean to contest that... maybe bad wording on my part [11:05] kalikiana: no worries, I just wanted to explain what I meant earlier :) [11:08] zyga-solus: I think it technically makes sense so long as you have no access to the underlying system. Tho it would make something like a user agent that's used for statistical purposes impossible [11:11] PR snapd#4089 closed: tests: wait for service status change & file update in the test to avoid races [11:11] kalikiana: yes, I agree [11:11] technically we have the real file in /var/lib/snapd/hostfs/{etc,lib}/os-release but it is not readable in strictly confined apps === chihchun_afk is now known as chihchun [11:29] PR snapd#4087 closed: cmd: downgrade log message in InternalToolPath to Debugf() [11:57] hrm [11:57] some good and some bad news [11:57] let's make a PR [12:04] zyga-solus, kalikiana: /var/lib/snapd/hostfs/{etc,lib}/os-release is actually allowed via system-observed [12:04] system-observe* [12:05] PR snapd#4090 opened: interfaces/mount: exspose mount.{Escape,Unescape} [12:07] jdstrand: oh! [12:07] jdstrand: that's neat, I didn't know [12:07] (and didn't check apparently :) [12:08] mvo: I'm merging 4008 (squash) [12:08] mvo: speak now to stop me please [12:09] mvo: 3... [12:10] PR snapd#4086 closed: snap-confine: increase sanity_timeout to 6s [12:10] mvo: 2... [12:11] mvo: 1... [12:12] merging [12:13] PR snapd#4008 closed: cmd/snap-update-ns: create missing mount points automatically [12:16] PR snapd#4060 closed: interfaces: clean system apparmor cache on core device [12:16] PR snapd#4091 opened: cmd/snap-update-ns: allow fault injection to provide dynamic result [12:16] zyga-solus: ok, no worries [12:17] mvo: you can cherry pick for 2.29 [12:22] jdstrand: Does system-observed change which one /etc/os-release points to? Is it still the one from the core snap? [12:23] kalikiana: no, it doesn't [12:23] PR snapd#4069 closed: debian: do not build static snap-exec on powerpc [12:23] PR snapd#4092 opened: cmd/snap-update-ns: allow Change.Perform to return changes [12:24] PR snapd#4080 closed: snapctl: added long help to stop/start/restart command [12:25] PR snapd#4085 closed: debian: do not build static snap-exec on powerpc (2.29) [12:30] PR snapd#4083 closed: snap-{confine,seccomp}: make @unrestricted fully unrestricted (2.29) [12:30] PR snapd#4084 closed: interfaces: clean system apparmor cache on core device (2.29) [12:33] zyga-ubuntu: just to double check - freezeSnapProcess() is now called everytime snap-update-ns is run, right? with 4008? [12:34] yes [12:43] kenvandine, hey [12:49] mvo: I have one more for 2.29.2 [12:51] zyga-solus: which one? [12:51] mvo: https://github.com/snapcore/snapd/pull/4093 [12:51] PR #4093: cmd/snap-update-ns: initialize logger [12:51] just one liner [12:52] but it will help us in case 4008 explodes in the field [12:52] cachio, hey [12:52] zyga-ubuntu: ok [12:52] PR snapd#4093 opened: cmd/snap-update-ns: initialize logger [12:53] kenvandine, I copied the approach you use for the calculator [12:53] kenvandine, but still it can't access to the gsettings schema [12:53] I it copying the schema to the correct place [12:54] cachio, can i get a checkout of your yaml? I'll try it myself [12:54] kenvandine, https://github.com/sergiocazzolato/snapd/tree/tests-interface-gsettings/tests/lib/snaps/test-snapd-gsettings [12:54] cachio, i have a bunch of snaps all using gsettings [12:54] kenvandine, I know [12:55] kalikiana: system-observe doesn't change the system. you can either look at /etc or /usr/share/... for what the os-release is for the snap's runtime (you have access to this by default), or you can plugs system-observe and look in hostfs to see what the host system is [12:55] zyga-solus: re new> yes, it is a recent update [12:55] cachio, oh... you aren't using the desktop helpers [12:55] i bet that has something to do with it [12:55] kenvandine, how should I add it? [12:56] the desktop helpers probably tweak the schema env [12:56] after: [desktop-gtk3] [12:56] for example [12:56] and command: desktop-launch check-schema [12:56] or you can look at the launcher script and reproduce that in your own script [12:57] kenvandine, ok, I'll try that [12:57] that helpers sets lots of env needed for desktop stuff [12:57] kenvandine, thanks [12:57] np [13:00] jdstrand: Alright, that makes sense, thanks for clarifying! I guess even in that case it's best to have both available and not just change behavior. [13:29] PR snapcraft#1625 closed: tests: use the snapcraft snap for integration tests [13:34] jdstrand: hey [13:35] jdstrand: do you have 15 minutes to consider and answer a question? [13:35] jdstrand: it would require you to have spread (local or remote) and checkout my branch, run it, get a denial and see what you think about it [13:36] jdstrand: I suspect you know the answer without running it [13:36] jdstrand: but I wanted to check [13:39] kenvandine, works with the desktop-lunch [13:39] launch [13:39] popey: hey! was looking at this yaml a few days ago but couldn't find it today. Do you have a copy ? https://github.com/snapcrafters/pycharm-community/blob/master/snap/snapcraft.yaml [13:39] thanks [13:39] (need that yaml file to snap a related project) [13:39] cachio, cool [13:39] hi om26er [13:40] i deleted the repos from snapcrafters because it's owned upstream now. I have a backup though, can pastebin if you need it? [13:40] popey: yes, that would do. [13:41] http://paste.ubuntu.com/25830418/ [13:41] PR snapd#4094 opened: tests: cherry pick the fix for services test into 2.29 [13:43] mvo, ^ [13:44] pstolowski: ta! [13:45] mvo, the changes to help docs seem to already be there in 2.29, guess you merged them [13:45] pstolowski: yeah, I cherry picked [13:45] cool, thanks [13:48] popey: I would need the .desktop file as well :) [13:49] http://paste.ubuntu.com/25830453/ [13:49] sorry [13:57] * zyga-solus lunches [14:02] PR snapd#4093 closed: cmd/snap-update-ns: initialize logger [14:02] thank you :) [14:03] mvo: is Chi-paca supposed to be back Monday? [14:04] pedronis: AFAIK he is [14:04] zyga-solus: thank *you* and cherry-picked into 2.29 [14:07] PR snapd#4095 opened: debian: make packaging/ubuntu-14.04/copyright a real file again [14:11] hey folks, is it possible to have private snaps using the public store? [14:11] when will build.snapcraft respect `architectures` config ? [14:16] kenvandine: hey, fyi I noticed an issue with the gedit snap [14:16] om26er, https://forum.snapcraft.io/t/snapcraft-build-on-hint-for-builders/939 [14:16] jdstrand, oh? [14:16] mattyw: yes, but just keep in mind a private snap is just for the publisher and collaborators, e.g. for QA prior to release. Collaborators have full read-write access to the snap. [14:17] kenvandine: if you go to open a file and get the gtk3 file chooser, in the upper left the 'Documents', etc don't work as expected because they are expecting those folders to be under SNAP_USER_DATA (ie, what HOME is set to) [14:17] noise][, is it possible to define who the collaborators are - like if I have a snap that I just want people in my team to have access to? [14:17] kenvandine: the Documents, etc in the lower left all work fine [14:17] jdstrand, yeah, i haven't figured out what to do with that [14:17] portals will help [14:18] mattyw: yes - on your snap details page on dashboard.snapcraft.io, there's a "Collaboration" link in the side nav [14:18] kenvandine: it should. another idea is to symlink from SNAP_USER_DATA/Documents to /home/user/Documents [14:18] jdstrand, oh... we could do that in the helpers [14:18] kyrofa: when you're up, perhaps we can chat about snapcraft#1641 briefly? [14:18] PR snapcraft#1641: lxd: catch CalledProcessError in _container_run [14:18] right [14:19] zyga-solus: can you just show me the denial, the spread test and the branch of the code? [14:21] kalikiana, let me take a look here... [14:22] jdstrand, i'll take a swing at that [14:22] kalikiana, alright, want to HO real quick? [14:22] jdstrand: ha, no denial, this is overlayfs [14:22] kyrofa: Yeah, gimme 1 minute to fetch my headset [14:22] Sure thing [14:23] jdstrand: I can show you the branch if you want to try [14:23] one sec [14:24] jdstrand, actually the helpers run from within the snap and don't have access to $HOME [14:25] jdstrand: fetch my remote please, go to feature/transparent-overlayfs and pop one patch off, that is go to bc687e812a693afe532f51803645cc41d027de00 - then run SPREAD_DEBUG_EACH=0 spread -debug -v -reuse qemu:ubuntu-16.04-64:tests/main/interfaces-content-mkdir-writable:snap [14:25] kalikiana, haha you're ringing my phone, hold on, I need to learn how to use hangouts [14:25] kyrofa: https://hangouts.google.com/hangouts/_/ygq3wu36wzebfjotr7gdj7ofhye [14:25] we'd have to do some mangling of the paths like in $SNAP_USER_DATA [14:25] kyrofa: Oh, heh. Wasn't my intention. Just created a hangout ( I think...) [14:25] Ah excellent [14:26] jdstrand: I'm running it here [14:27] kenvandine: gedit plugs the home interface [14:28] yes [14:28] but we don't have proper $HOME i meant [14:28] so we would need to strip out part of the path [14:28] doable though [14:28] use getent. there is already stuff in there [14:28] oh cool [14:29] * zyga-ubuntu is a bit preoccupied and worried about Spain vs Catalonia just now; Catalonia has just declared independence [14:29] kenvandine: getent passwd $UID | cut -d ':' -f 6 [14:29] jdstrand, yeah, thanks! [14:29] * kenvandine always forgets about getent :) [14:29] zyga-ubuntu: you asked me to look at something with overlayfs. what is it you want me to look at? [14:29] jdstrand: yes [14:30] jdstrand: that's exactly that branch and that is exactly what I'm running as well [14:30] note, this is not going to take only 15 minutes if you are asking me to verify that it is going to dtrt with apparmor [14:30] jdstrand: to ensure we're seeing the same thing [14:31] 2017/10/27 14:31:17.262504 main.go:154: cannot apply mount change mount (/snap/test-snapd-content-advanced-slot/x1/source /snap/test-snapd-content-advanced-plug/x1/target none bind 0 0): cannot open path segment "x1" (got up to "/snap/test-snapd-content-advanced-plug"): permission denied [14:31] jdstrand: this is the error I'm seeing [14:31] jdstrand: and there are no denials [14:32] istr something with overlayfs and private mounts [14:33] jdstrand: now in that same branch there's one more patch that lets this test pass [14:33] jdstrand: it makes snap-update-ns unconfined [14:34] jdstrand: note: when s-u-n is unconfined it can complete the work and then let regularly confined apps work [14:34] jdstrand: I'm trying to understand if the failure I'm seeing is a result of missing apparmor support for overlayfs [14:34] zyga-ubuntu: I'll try the spread test, but note, I'm not keen on spending a lot of time on overlayfs until niemeyer or mvo say that the change in direction is what we want in the PR. I laid out many questions about this and didn't get a response that pertains to them. morphis then followed up but no response [14:34] jdstrand: I suspect the answer is "yes" [14:35] jdstrand: gustavo strongly wants me to pursue this, I'll review your questions and ensure they are all answered [14:35] s/in the PR/in the forum/ [14:35] jdstrand: ack [14:36] zyga-ubuntu: that is a complete 180 in terms of direction wrt overlayfs. it has always been "no, because it can't be backported" [14:36] tyhicks: fyi ^ [14:36] ratliff: ^ [14:37] zyga-ubuntu: you mentioned something about a fallback to !overlayfs. if that is supposed to work as well as (from the pov of the user) overlayfs, why not just focus on that instead? you can answer that in the forum (it was one of my questions) [14:41] fg [14:41] Oops [14:42] zyga-ubuntu: this means we will always have two different implementations inside snapd for the layouts feature? [14:43] seb128, the user-dirs.defaults directories, are the actual directory names translated? Or just the presentation of them? [14:43] s/are the/are they [14:43] kenvandine, the actual dirs [14:43] bummer [14:43] ok [14:43] is there an easy way to get those names? Or do i need to parse them out of user-dirs.defaults? [14:44] morphis: I don't know yet [14:44] * kenvandine thought there was an easy way [14:44] kenvandine, g_get_user_special_dir () [14:44] yeah, but nothing available in a shell script [14:45] you can use the binding from python [14:45] i guess i can look at the g_get_user_special_dir implementation [14:45] ah [14:46] seb128, although i doubt starting a python interpretor in the desktop helpers would be a good idea speed wise [14:46] zyga-ubuntu: please let me know once you guys are closer to a decision on this as this will have quite some impact on system enablement etc. [14:46] kenvandine, $ python -c "from gi.repository import GLib; print(GLib.get_user_special_dir(GLib.USER_DIRECTORY_DOCUMENTS))" [14:47] morphis: right, I think this will happen one gustavo is back [14:47] zyga-ubuntu: I'm sure you are aware of this but there will be a considerable lead time before apparmor and overlayfs can be fully working together and the one or two people that can work on that are committed to other work [14:47] kenvandine, it wouldn't be the slowest thing in there... [14:47] morphis: in the meantime I'll work on options [14:47] kenvandine, but yeah, probably easier to just shell parse the .config [14:47] tyhicks: noted, [14:48] seb128, thx! [14:48] kenvandine, yw [14:48] zyga-ubuntu: aye [14:48] tyhicks: ultimately it is not my decision, I'll just collect facts and help make the descision clear [14:49] zyga-ubuntu: that makes sense - just be sure to point that out if you're in a conversation where the decision is being made [14:49] popey: for you: https://forum.snapcraft.io/t/please-allow-my-android-studio-snap/2634 :-) [14:49] tyhicks: you will be in the call I'm sure [14:50] sometimes it works out like that, sometimes not :) [14:50] (in all projects - not just snappy) === cachio is now known as cachio_lunch [15:11] * zyga-ubuntu breaks for some follow-the-news time [15:18] kenvandine, seb128: in the past we have said that we won't support translatable directories in the filesystem (how they are presented to the user is entirely different of course). that hasn't changed, has it? [15:24] Huh. elopio what might be causing this? https://travis-ci.org/snapcore/snapcraft/jobs/292341577 [15:24] Any chance it's from the "use the snap for integration tests" PR? [15:32] Bug #1728076 opened: Initialize Device transaction incorrect "Done" status [15:33] jdstrand, i remember some discussions on that, but i don't recall the details [15:33] jdstrand, i've found an easy way to get those from xdg-user-dirs [15:34] in practice what it gives me might not be translated though [15:37] jdstrand, seb128: http://paste.ubuntu.com/25830955/ [15:37] that seems to work [15:37] but i need to try that with a different LANG now [15:38] kenvandine: this came up a long time ago wrt click. basically, upstream and Ubuntu felt that translating those at the filesystem level was a mistake. ie, it should always be /home/foo/Documents, not /home/foo/SomeTranslatedThing [15:39] kenvandine: so we don't support translated dirs officially. as it happens, with the home interface and because all of $SNAP_USER_DATA is usable by the snap, this hasn't been an issue on snappy [15:40] kenvandine: that said, I don't think user-dirs.dirs is readable today [15:41] kenvandine: no it isn't. I'm getting lose to writing a PR that will make it readable [15:41] close* === chihchun is now known as chihchun_afk [15:45] jdstrand, who is "we"? translated directories are a xdg reality for 10 years... [15:46] s/reality/annoyance/ :P [15:46] kalikiana, commented on snapcraft#1641 [15:46] PR snapcraft#1641: lxd: catch CalledProcessError in _container_run [15:46] ogra_, says a german speaker... [15:47] who has to type "Arbeitsfläche" instead of Desktop on one machine ... i hate that [15:47] seb128: you were in the conversation. I remember discussing it in person with you and Allison. we all agreed it was a mistake even if they've been there for 10 years. and we agreed click wouldn't support them. I can pull up bugs to remind you if needed :P [15:47] kyrofa: Thanks! [15:47] jdstrand, you might be right, I vaguely remember discussing it but not in the snap context, maybe it was clicks [15:47] jdstrand, issue is that for snaps you have to deal with existing apps [15:47] seb128: no, it wasn't the snap context. only clicks [15:47] (i dont mind Bilder vs Pictures and the like ... but translating the Desktop dir always puts me off) [15:48] seb128: I was saying with snaps we inherited non-support initially, but now with home and SNAP_USER_DATA, it mostly doesn't matter [15:49] only if we decide to carve up the home interface would it be an issue [15:49] seb128, i guess this is the first time i've run a snap using a different lang... so snaps aren't showing as translated? [15:49] on the phone we could do the translation on the UI level because we had the content-hub and friends [15:50] * jdstrand notes that the gtk3 file chooser or nautilus or whatever could present anything they want (that was what we concluded unity8 might end up doing) [15:50] kenvandine, they do if built properly [15:50] that is why it wasnt a problem there ... there was a way bigger separation [15:50] seb128, so i guess mine aren't :) [15:50] seb128, what's the magic? [15:50] kenvandine, do you use the --prefix build hack? [15:50] kalikiana, did you approve snapcraft#1644 ? [15:50] PR snapcraft#1644: lxd: fix the push in container builds [15:50] seb128, yes [15:51] Rather, I know you didn't, but DO you approve [15:51] kenvandine, then translations should work... [15:51] ogra_: right [15:51] but again, it isn't actually a problem here [15:51] yeah [15:51] cause we don't separate ~/Videos from ~/Documents [15:52] jdstrand, ${XDG_CONFIG_HOME:-~/.config}/user-dirs.dirs is readable because it's under $SNAP_USER_DATA [15:52] and we run xdg-user-dirs-update after setting that [15:52] so it should do the right thing [15:53] if we did, and if translated xdg dirs are still a thing (and it sounds like they are; I guess upstream didn't pursue something better), then there would be work to do make them work in the policy (which is possible) [15:53] kenvandine: yeah, but, where are you getting that? [15:54] kenvandine: https://forum.snapcraft.io/t/xdg-user-dirs-and-dconf-apparmor-denials/2390/3 [15:54] kenvandine: in addition to that, I also need to add ~/.config/user-dirs.conf [15:54] the desktop helper runs xdg-user-dirs-update after setting $XDG_CONFIG_HOME properly [15:54] kenvandine: in addition to that, I also need to add ~/.config/user-dirs.dirs? [15:55] jdstrand, that would be good [15:55] ok [15:55] I was talkingn about .conf [15:55] but we should also allow /etc/xdg/user-dirs.defaults [15:55] yeah [15:56] kyrofa: ugh, you broke it :( it worked less than a day. [15:56] elopio, hahahahaha [15:56] Let me check the logs to see if I can understand something there. But more likely I'll have to debug. [15:56] zyga-ubuntu: I gave spread the wrong args and it is running all the tests. I can't seem to kill it [15:57] jdstrand: qemu or linode? [15:57] zyga-ubuntu: I bg'd it and tried -discard, but it held the lock [15:57] jdstrand: if qemu just kill qemu process [15:57] zyga-ubuntu: linode [15:57] jdstrand: ah [15:57] (hence the wrong argument [15:57] jdstrand: kill spread and -discard then [15:57] seb128, confirmed gedit is using the prefix hack but not showing up as translated for me [15:57] (run the same thing bug pass -discard) [15:57] seb128, can you please confirm? [15:57] ok, wasn't sure that would work [15:58] yes, all you need is in that local .spread.* file [15:58] it just kills the node from the lindoe API [16:01] kyrofa can you look at my comment on snapcraft#1641, the objective is to not print an error, not to capture and print the same error again [16:01] PR snapcraft#1641: lxd: catch CalledProcessError in _container_run [16:01] zyga-solus: did you disable rate limiting? I think we are doing that by default now in spread, but worth asking [16:01] kenvandine, indeed, (gedit:8296): Gtk-WARNING **: Locale not supported by C library. [16:01] Using the fallback 'C' locale. [16:01] sergiusens, right, capturing it would cause it to _not_ be printed [16:01] jdstrand: no, I didn't! that's a good think to check [16:01] sergiusens, and give us the ability to print it [16:02] sergiusens, rather than traceback, we can simply use the stderr [16:02] kyrofa: Yes. I was reluctant to give my v here since I changed the unit tests. But the fix is good to my mind [16:03] kenvandine, I had my ghex snap working with that wrapper http://bazaar.launchpad.net/~ubuntu-desktop/+junk/ghexudt/view/head:/ghex.wrapper [16:03] zyga-solus: note that if it is a capability denial, apparmor itself might be rate limiting it (it actually rate limits quite a few things. see: https://bugs.launchpad.net/apparmor/+bug/1707743). capability is the only one that really seems to be a problem [16:03] Bug #1707743: denied capability logged only after profile load [16:04] zyga-solus: perhaps you could add a base capability rule and see if it passes? 'capability,' [16:04] s/base/bare/ [16:05] kenvandine, the desktop launcher has https://github.com/ubuntu/snapcraft-desktop-helpers/blob/master/common/desktop-exports#L127 ... did you try to stage locales-all? [16:05] jdstrand: trying === cachio_lunch is now known as cachio [16:06] kenvandine, that might take space though, the hack in ghex was only needing libc-bin/locales iirc which is smaller [16:08] kyrofa kalikiana why is it not possible to NOT traceback and NOT print? [16:08] kyrofa on a cli, you will run something, it will be seen as a double error being printed [16:09] sergiusens, we're saying the same thing, perhaps we should jump on a HO? [16:10] to say the same thing aloud ? [16:11] ogra_, in harmony [16:11] yeah, thats what i imagined [16:12] zyga-solus: I see the same thing. no denial [16:12] seb128, i'll play around with it [16:12] seb128, thx [16:13] capability didn't change it [16:15] seb128, i can probably add locales-all to the platform [16:15] zyga-solus: try removing this: deny capability fsetid, [16:15] k [16:15] zyga-solus: or turn it into an allow by removing 'deny' [16:16] jdstrand: running, though it is on the parent profile so probably not a factor [16:16] removing the rule would still have it deny of course [16:16] sure [16:16] kyrofa I think you want to handle the printing the exception handler which requires all of what you mentioned is needed. I am just saying, from whatever calls lxc exec, raise a specific exception that will be caught and handled differently [16:17] zyga-solus: that should be unrelated anyway, but, like I said, there are some weird bugs [16:17] (with overlayfs and apparmor) [16:17] sergiusens, handled differently i.e. just exit non-zero and don't say anything extra? [16:19] I think we can do that just by raising a SnapcraftError(), but I'll check [16:20] We'll need a SnapcraftError with a __str__ that is empty [16:21] kyrofa yes, exactly; given that the run was owned by the instance of snapcraft run inside the container; if we go a different path this will be exceedingly complex to handle; that said, in a future PR we could just use the piping mechanism to create a .log of the build when using containers (should be straightforward) [16:22] sergiusens, yeah that seems to be the direction we're heading overall anyway [16:22] sergiusens, when it comes to the nested snapcraft I totally agree [16:22] sergiusens, but doing the same for the setup stuff isn't quite as clear. How do you feel about hiding that behind a progress bar? [16:23] jdstrand: no change [16:24] It'll take two PRs to do that, this one using essentially a dumb exception, and another one splitting the setup tasks out [16:25] zyga-solus: I've dropped to the shell in spread. I should just be able to edit the profile and run stuff, right? I tried to run test-snapd-content-advanced-slot.sh' but things went terribly wrong [16:25] /bin/sh: 0: Bad substitution [16:25] repeated forever. I couldn't recover and had to kill the vm [16:28] yes [16:29] yes, that breaks, paste the same line you saw in the test and it will work [16:29] so [16:29] test-snapd-content-advanced-plug.sh -c 'test -d $SNAP/target' [16:29] this will re-try [16:29] /usr/lib/snapd/snap-discard-ns test-snapd-content-advanced-plug; test-snapd-content-advanced-plug.sh -c 'test -d $SNAP/target'; echo $? [16:29] this is even better [16:30] kyrofa what setup stuff? [16:30] zyga-solus: unfortunately I was winging it cause I did 'reset' :) [16:30] sergiusens, installing squashfuse, injecting snaps, the stuff that failed for popey that spawned that PR [16:31] kyrofa oh, that should be handled the way we usually handle exceptions in our code base [16:31] sergiusens, right, which is what kalikiana did. Problem is, the codepath is the same [16:32] sergiusens, so my suggestion is: if we're splitting them out, might as well put that stuff behind a progress bar [16:33] PR snapd#4094 closed: tests: cherry pick the fix for services test into 2.29 [16:33] kyrofa code path the same being, the sequence of steps comes one after the other? [16:34] they just need to be handled differently then, a progressbar could do, but I would hold off on that until we have a better separation of cli/logic [16:35] sergiusens, no, they all go through `_container_run`, which is where the exception-handling logic has been added. They just need to be, yeah, treated differently [16:35] sergiusens, okay, I'll summarize on the PR [16:36] thanks [16:36] kyrofa: treat differently how? I'm a bit lost now [16:36] kalikiana, don't worry, I will try to make all things clear in my summary [16:36] Okay thanks === JoshStrobl|zzz is now known as JoshStrobl [16:37] PR snapd#4096 opened: spread: welcome bionic beaver [16:38] btw wrapping up for today now - I'll be off most of next week (you can see it in the team view) but will be checking in here and there for comments etc [16:45] cachio: finally! 2.29~rc2 for i386,amd64 - arm is still pending, no idea what is going on with the arm autobuilders currently, super slow [16:48] i guess you are fighting with doko ;) [16:48] initial import of bionic etc === chihchun_afk is now known as chihchun [16:57] zyga-solus: I've spent way more than 15 minutes on this. unfortunately, my desktop crashed and I lost all state (/me shakes fist at wayland/mutter not being able to restart) [16:58] zyga-solus: I don't think there is enough information to definitively say it is apparmor. however, you could try different bare rules to see what is the issue [16:58] jdstrand: thank you for the effort [16:58] jdstrand: I think this is enough for now [16:58] zyga-solus: eg, add 'file,' [16:58] then mount, [16:58] then ptrace, [16:58] etc [16:58] I'll try [16:59] maybe one of them will work and that will provide a clue [16:59] could be a logging bug [16:59] could be a poor interaction between attach_disconnected and overlayfs [17:00] it would not surprise me at all if attach_disconnected is mapping something to the wrong place [17:00] zyga-solus: ^ [17:00] aha [17:01] I'll try all and we'll know more next time [17:01] thank you for investigating this [17:01] remember, attach_disconnected is a hack. overlayfs would ideally be giving us the proper locations. attach_disconnected just says connect anything that is disconnected to '/' [17:01] zyga-solus: ^ [17:01] ok, yw [17:02] I see, I didn't know it's a hack [17:03] mvo, could you please upload the snap https://github.com/sergiocazzolato/snapd/tree/tests-interface-gsettings/tests/lib/snaps/test-snapd-gsettings [17:03] sergiusens, snapcraft#1636 is ready, but you put 2.36 on there. Does that mean you don't want it in just yet? [17:03] PR snapcraft#1636: internal: more gracefully determine host OS [17:04] It's not approved yet either, to be clear [17:05] I'm also good with snapcraft#1593 if you want to take a look [17:05] PR snapcraft#1593: catkin tools plugin: add catkin tools support [17:05] mvo, I am running beta validation now [17:08] elopio, also, what do you think about the plainbox tests? Do you agree that we should remove the years? [17:23] why do classic snaps need manual approval ? [17:24] because they have full system access [17:24] when does ogra_ actually go offline ? [17:25] heh [17:25] anyways, I have a android-studio snap waiting manual review because its a classic snap. Hopefully that'll get figured out soon. [17:30] kyrofa: yes, I'll update my branch. Sorry the day.got complicated and I'm in a bus. [17:30] elopio, quite alright, I'm happy to update it if you like, I just wanted to make sure you agreed [17:31] kyrofa and your PR has the snap stage after.that integration test. That way it will never work. I'm not sure what's going on, I'll keep digging. [17:31] elopio, huh... [17:31] kyrofa yes please, go for it [17:33] kyrofa if you provide a list of all the systems you've checked then maybe yes; but I put 2.36 on most so the focus would stay on things for 2.35 and potentially the pip/python stuff (which is the only thing we could think about backing into 2.35) [17:33] sergiusens, alright I figured, just wanted to make sure we were on the same page [17:33] the "just one more thing" is what is causing all these release delays ;-) [17:34] Haha, amen [17:35] If you want to just lock down the release now that's fine too. Focus on autopkgtests [17:35] sergiusens, remember we can always make a release branch for stabilizing if we don't want to hold up landings [17:36] jdstrand, are you actively working on adding access to user-dirs related paths? [17:36] kyrofa I don't mind as we all have things to work on for 2.35; this is not a big team :-) [17:36] kenvandine: yes. I'm preparing a branch with various updates that includes that as we speak [17:36] I really want our small team to focus on 2.35 [17:36] jdstrand, excellent [17:37] sergiusens, alright will do. I'll focus on autopkgtests [17:42] cachio: thanks! core build still tells me in 1h/2h for armhf/arm64 :( [17:42] cachio: I keep an eye one it [17:43] ok, np [17:44] mvo, ce you updaload the snap I'll create the PR === cachio is now known as cachio_afk [17:54] kyrofa feel free to make the ocd change in snapcraft#1644 [17:54] PR snapcraft#1644: lxd: fix the push in container builds [17:54] sergiusens, haha, okay === ahasenack is now known as andreas [18:21] alright, back on my machine [18:24] noise][: can you give cory johns @canonical.com access to charmtools snap? [18:25] kyrofa: I will start the hangout in a few minutes. Let me know if you want to join to test. Also sergiusens where in the world are you? You are welcome to join us, of course. [18:26] PR snapd#4097 opened: interfaces/many: miscellaneous updates based on feedback from the field [18:26] elopio, awesome [18:26] elopio I am finally home, since yesterday! [18:26] noise][: sorry the snap is "charm" [18:26] noise][: or maybe give ownership to the same group you did with conjure-up [18:26] mvo: hey, still there? [18:27] mvo: hey, I know its late, but there is the PR I was talking about. no need to review now, but I add the 2.29 milestone-- is that what you wanted me to do? [18:27] mvo: sorry for going AWOL, tracking unfolding events in spain now [18:27] nessita: or if you're available to give access to charm for the canonical group (same group set for conjure-up) [18:28] sergiusens: seen https://pastebin.ubuntu.com/25830958/ before? [18:28] stokachu, hey there. I can't add collaborators, you need mvo for that, sorry [18:28] nessita: ok ty! [18:29] mvo: if you got a minute from the spain madness :) [18:30] stokachu: mvo or me? [18:30] zyga-ubuntu: can you give store access to people? [18:30] stokachu: I don't think I can [18:31] ok [18:33] stokachu seems like request's raise_for_code did not get triggered and status was not returned in the json results. Mind logging a bug? Is this a one time thing? [18:33] Facu any idea about that scenario ^ in stokachu's pastebin? [18:34] sergiusens: cory_fu is the one that hit this issue [18:34] kenvandine: fyi, https://github.com/snapcore/snapd/pull/4097 [18:34] PR #4097: interfaces/many: miscellaneous updates based on feedback from the field [18:34] elopio, give me the link when you have it [18:34] one second [18:35] sergiusens: Pretty sure it's because I don't have access to the snap yet (there's an invite pending, but I never got the email nor can I find it via the Dashboard) [18:35] sergiusens, nop [18:36] cory_fu, but you can repeat it, right? [18:36] cory_fu ah, no snap access, that should return some sort of 5xx I believe, but let me try and release a snap I don't have listed here and see what happens; if you don't mind a bug might help this from falling into the cracks [18:36] sergiusens: Yep, filing one to LP now [18:37] Facu: Yes, I can reproduce it [18:38] https://bugs.launchpad.net/snapcraft/+bug/1728121 [18:38] Bug #1728121: Traceback from snapcraft release [18:41] kyrofa, sergiusens and anybody else who would like to join the ubuntu hour: https://hangouts.google.com/hangouts/_/jdpkqoaaz5fw7f6b2jlmhy5auie [18:41] PR snapd#4098 opened: snap-confine: allow reading uevents from any where in /sys [18:41] mvo: same question for ^ [18:42] cory_fu, sergiusens, will track this server side, thanks === JoshStrobl is now known as JoshStrobl|Store [18:44] jdstrand, cool, i'll watch that [18:44] jdstrand, also i have a WIP branch for the helpers https://github.com/kenvandine/snapcraft-desktop-helpers/commit/9be256f76362a4f109890e033d9fc5467144f715 [18:45] Facu stokachu cory_fu I can totally reproduce this https://pastebin.ubuntu.com/25831852/ [18:46] kenvandine: come to think of it, `id -u` will be more robust than $UID. istr not always having $UID [18:46] sergiusens, also trying to release something you don't have permissions? [18:46] kenvandine: and cool! :) [18:46] I will look at the responses a bit closer (we could add one more call before release to get the account info and verify you can release to that snap if it comes to it). [18:46] Facu yes, I have no access to conjure-up :-) [18:47] sergiusens, I would have thought that the server is not 200ing in this case, will check [18:48] Facu ah, it is the exception that is at fault [18:48] we have if not response.ok and pass the response to our own exception implementation [18:49] Facu I'll take it from here :-) [18:50] sergiusens, so, server is returning that you can not access it, right? [19:05] Facu at least returning something saying it is not ok [19:21] jdstrand: what was the question? [19:21] jdstrand: I think thats reasonable [19:22] mvo: you said to 'tag' the PR with 2.29. I don't see 'tag's in the github interface, so I milestoned it [19:22] mvo: I just wanted to make sure I was doing what you asked :) [19:22] jdstrand: yeah, sorry, milestoned is the right thing [19:22] ok, cool [19:22] jdstrand: thanks! this is fine for 2.29 [19:22] thank you :) [19:23] mvo: note it is 4097 and 4098 (both only add access so not risky) === JoshStrobl|Store is now known as JoshStrobl [19:26] jdstrand: aha, thank you === cachio_afk is now known as cachio [19:29] cachio: armhf/arm64 is now ready as well [19:30] mvo, great [19:30] I'll run that now [19:30] cachio: thanks a lot! [19:30] cachio: keep me updated please :) [19:31] mvo, so far everything passed [19:33] mvo, l run the devices now [19:56] PR snapd#4054 closed: snap-{confine,seccomp}: make @unrestricted fully unrestricted === JoshStrobl is now known as JoshStrobl|Food [20:00] PR snapd#4099 opened: merge 2.29~rc2 release back into master [20:19] does the dump plugin support dynamic `source` parameter ? [20:19] maybe a script that resolves to a url ? === JanC_ is now known as JanC [20:27] om26er, no, can you explain your use-case? [20:28] kyrofa: There is no direct link for the source zip that I want to download from. The url is resolved after a script is executed. [20:29] om26er, can you execute it locally and then copy/paste that URL? [20:29] I am setting version using version-script but was looking for a way to set the `source` as well. [20:29] om26er, you always do it in a local plugin [20:29] om26er, inherit from the dump plugin but make the source dynamic [20:30] you CAN always, rather [20:30] kyrofa: that could work but I was thinking to full automate it. i.e. whenever I know there is a new release available, just do a dummy commit to my snap package and push so that auto build kick in [20:31] om26er, yeah this doesn't preclude that [20:31] I do the same thing for daily builds, although in my case the URL is just a symlink [20:31] I just change the version and push [20:32] kyrofa: can you share examples of a local plugin ? [20:33] om26er, sure thing, one sec [20:33] om26er, here's an example: https://github.com/nextcloud/nextcloud-snap/blob/master/snap/plugins/x-php.py [20:34] You just need to put them in snap/plugins and snapcraft will find them [20:35] (like they are there) [20:35] kyrofa: so when I refer them in my yaml I prepend `x-` ? [20:35] om26er, no actually-- refer to the YAML in that same project [20:36] kyrofa: you got an example to override dump plugin somewhere ? [20:37] The naming pattern is confusing, so just trust me: name your plugin x-.py and then refer to it in the YAML as [20:37] om26er, I don't, but simply import snapcraft.plugins.dump and inherit from snapcraft.plugins.dump.DumpPlugin [20:38] om26er, then overwrite the `pull` method, but not the `build` [20:41] looking into this. [20:48] PR snapcraft#1546 closed: cli: update parts cache in the container === JoshStrobl|Food is now known as JoshStrobl === JoshStrobl is now known as JoshStrobl|Away [21:29] elopio what is that close/open attempt all about on snapcraft#1607 ? [21:29] PR snapcraft#1607: python plugin: use extracted pip [21:31] sergiusens: kyle broke the order of the stages. I turned it on and off again to fix it. [21:34] elopio, wait... what? [21:34] How did that fix things? :P [21:35] (shrug) [21:37] PR snapd#4100 opened: add ssh-keys, ssh-public-keys, gpg-keys and gpg-public keys interfaces [21:38] kyrofa I saw only yours was failing that way, and restarting didn't help [21:39] I was just touching buttons. It might be necessary to do this for the ones that have been open before the change. [21:43] I'm going to propose the transfer nicety now. [22:08] elopio, quick plug for the `transfer` snap [22:12] kyrofa why transfer when you can wormhole it ;-) [22:12] sergiusens, one to many versus one to one [22:12] sergiusens, elopio is talking about making the snapcraft snap available for each PR by uploading it to transfer.sh [22:17] kyrofa ah, it would be much nicer to have a webhook sent to some infra we control that would end up pushing and releasing to a branch :-) [22:17] but one step at a time [22:17] Quick cheat until build.snapcraft.io makes it nicer for us [22:17] kyrofa is transfer.sh the one from mozilla? [22:18] sergiusens: the bot can't release to a branch yet [22:18] ah, no, it was send (the one from mozilla) [22:18] elopio btw, how is the bot protected? [22:19] sergiusens ssh-only on Google cloud. [22:20] ACLs for the commands, but the commands can't expose the password.