/srv/irclogs.ubuntu.com/2018/06/27/#snappy.txt

mborzeckimorning05:08
mborzeckii ran #5397 job 7-8 times now, only one econnreset error, but unrelated to the fix we made, the test got 503 when trying to download the snap what looked like some store side hiccup06:27
mupPR #5397: tests/main/econnreset: limit ingress traffic to 512kB/s <Created by bboozzoo> <https://github.com/snapcore/snapd/pull/5397>06:27
mborzeckii have seen the mounting squashfs error reproduce a couple of times, and at least one other error which i do not recall seeing before in tests/main/validate-container-failures06:29
mborzeckii'll be merging the PR when the travis job becomes green again06:29
mupPR snapd#5408 opened:  i18n: use xgettext-go --files-from to avoid running into cmdline size limits <Created by mvo5> <https://github.com/snapcore/snapd/pull/5408>06:49
mupPR snapd#5407 closed: tests: add fedora to distro_clean_package_cache function <Created by sergiocazzolato> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/5407>06:51
mborzeckiand opensuse downloads flaky too :(07:04
zygaGood morning07:05
mborzeckizyga: hey07:06
zygaI am heading to school for some errands. I will be back in an hour07:06
=== pstolowski|afk is now known as pstolowski
pstolowskimornings07:15
mborzeckipstolowski: heya07:18
pedronismvo: hi,   #5403 uses #5386 :)07:20
mupPR #5403: many: use extra "releases" information on store "revision-not-found" errors to produce better errors <Created by pedronis> <https://github.com/snapcore/snapd/pull/5403>07:20
mupPR #5386: snap: introduce a struct Channel to represent store channels, and helpers to work with it <Created by pedronis> <https://github.com/snapcore/snapd/pull/5386>07:20
mvopedronis: *cough* sorry and thank you07:23
mborzeckipedronis: hi, could you take a look at https://github.com/snapcore/snapd/pull/5387 ? :)07:28
mupPR #5387: snap{/snaptest}: set instance key based on snap name <Created by bboozzoo> <https://github.com/snapcore/snapd/pull/5387>07:28
mborzeckithis unblocks some unit tests for snapstate07:29
pedronismborzecki: will look in a little bit07:31
mborzeckipedronis: thank you07:31
pedronismvo: are you looking at 5403 atm ?   wondering if I should merge or squash merge 538607:40
mvopedronis: not looking at it right now07:42
mupPR snapd#5386 closed: snap: introduce a struct Channel to represent store channels, and helpers to work with it <Created by pedronis> <Merged by pedronis> <https://github.com/snapcore/snapd/pull/5386>07:42
mupPR snapd#5409 opened: tests: run "arp" tests only if arp is available <Core18> <Created by mvo5> <https://github.com/snapcore/snapd/pull/5409>07:43
pedronismvo: I squashed it, and rebased 540307:45
zygaI signed up my son to a new school07:47
zygaHeading home soon07:47
mvopedronis: ta07:47
mupPR snapd#5397 closed: tests/main/econnreset: limit ingress traffic to 512kB/s <Created by bboozzoo> <Merged by bboozzoo> <https://github.com/snapcore/snapd/pull/5397>07:58
mupPR core18#42 opened: hooks: port 008-etc-writable.chroot from core16 <Created by mvo5> <https://github.com/snapcore/core18/pull/42>08:05
mvozyga: http://paste.ubuntu.com/p/q87HDCzFqp/ <- this is a failure I see right now on core18 with the interfaces on core PR. I guess this is what you meant yesterday when you said we also need to translate the API calls?08:07
pedronismborzecki: looks good, left a comment08:10
mborzeckipedronis: thanks, looking08:11
mborzeck1heh and gnome died again, it's probably somethign with nvidia08:13
mborzeck1the host is not responding over the network08:13
mborzeck1but the cursor overlay works, pff08:13
=== mborzeck1 is now known as mborzecki
ondramcphail install just openhab-ondra, gadget was only in case you need to use some specific usb dongle08:22
ondramcphail if you are not planning to use any usb, then no need for gadget08:22
ondramcphail if you want to use some usb device, share with me pid and. vid of that device I will add it. It exposes serial interface slot so you can connect plug from openhab to it08:23
mupPR snapd#5410 opened: tests: update tests to work on core18 <Core18> <Created by mvo5> <https://github.com/snapcore/snapd/pull/5410>08:28
Chipacamoin moin08:31
pedronisChipaca: hi08:31
Chipacapedronis: 'sup08:31
zygamvo: looking08:32
pedronisChipaca: mainly #5403  and reviewing stuff08:32
mupPR #5403: many: use extra "releases" information on store "revision-not-found" errors to produce better errors <Created by pedronis> <https://github.com/snapcore/snapd/pull/5403>08:32
zygamvo: yes, exactly that08:33
pedronisChipaca: and I pinged you here:  https://github.com/snapcore/snapd/pull/5386#discussion_r19839297408:33
mupPR #5386: snap: introduce a struct Channel to represent store channels, and helpers to work with it <Created by pedronis> <Merged by pedronis> <https://github.com/snapcore/snapd/pull/5386>08:33
zygamvo: I think it's a bit of a weirdness but we should do it08:33
zygamvo: not just because of our tests08:33
zygamvo: but perhaps of scripted interactions in the wild08:33
zygamvo: muscle memory or bash history08:33
zygamvo: I was thinking where to translate that08:34
zygamvo: the repository itself is nice but perhaps too naive08:34
zygamvo: the disconnect will work but I'm not sure about the connection state, as there are other translation points in the interface manager08:35
zygamvo: nothing hard, just something I need to look at08:35
mvozyga: yeah, I agree it should work08:38
mborzeckipedronis: regarding https://github.com/snapcore/snapd/pull/5387#discussion_r198401006 i can do the instanceName == info.InstanceName() in MockSnapInstance/mockSnap but i need to set instance key in mocnSnap for mount/file locations to be correct, unless i pull the common part to say mockSnapFiles and duplicate the info parsing bits in MockSnap & MockSnapInstance (which I'd like to avoid)08:38
mupPR #5387: snap{/snaptest}: set instance key based on snap name <Created by bboozzoo> <https://github.com/snapcore/snapd/pull/5387>08:38
mvozyga: I guess the question is at what layer to translate08:38
Chipacapedronis: answered your ping there08:38
zygasorry for being late btw, we had to do some paperwork to move our son to a new school08:38
Chipacapedronis: did you answer mvo wrt when architecture would be used, or should i?08:38
zygamvo: I think we should translate in the interface manager08:38
* Chipaca hugs zyga 08:38
zygamvo: because that captures both connection state and repository connection08:38
Chipacazyga: PAPERWORK IS AWESOME08:39
zygahey Chipaca08:39
zygahahaha08:39
zygaChipaca, the recovering paperwork addict08:39
mvoChipaca: he pointed me to the PR that actually uses this08:39
Chipacamvo: fair08:39
mvoChipaca: so I think its fine08:39
mvozyga: ok08:39
pedronisit is used quite a bit08:39
zygamvo: if you want I can look in a sec08:39
zygalet me just commit something quickly08:39
pedronisChipaca: anyway your review of #5403 when you can would be appreciated08:40
mupPR #5403: many: use extra "releases" information on store "revision-not-found" errors to produce better errors <Created by pedronis> <https://github.com/snapcore/snapd/pull/5403>08:40
zygaChipaca: did you reach the origami phase where instead of filling in the forms you just fold them08:40
Chipacapedronis: yep, on it08:40
zygaand daydream08:40
Chipacazyga: so, one change in the hostilization of this process that bit me and delayed me was that they changed from 'list any absences longer than 60 days' to 'list any absences' (ie trips out of the country)08:40
Chipacazyga: the table had three rows08:41
Chipacazyga: so you had to continue it on a separate sheet08:41
zygaoooh08:41
zygaI would go to jail if they asked me to fill in all the places I've been to correctly08:41
Chipacaso I filled one side of the separate sheet with all the info, turned it around to carry on … and there was a hand-drawn comic on it08:41
Chipacaso i guess they're getting an original piece of art together with this sumission08:42
zygahaha :)08:42
zygafridge magnets help08:42
Chipaca(it's all got to be handwritten of course, because this is the nineteenth century)08:42
Chipacaanyhoo. I'll put that away for now and review stuff :)08:42
* Son_Goku groans to life08:47
zygagood morning08:48
* Chipaca passes Son_Goku the mate08:48
* Son_Goku wobbles08:48
zygaSon_Goku: maybe some quick shot of vodka to wake you up ;-)08:48
* zyga hides08:49
* Son_Goku runs away08:49
Son_Goku...08:49
* Son_Goku ambles back08:49
Son_Gokuzyga, have you made any progress on implementing the base snap creation to Oz?08:49
zygano, I need to schedule that and really work on it soon08:50
zygaSon_Goku: I have fedora on w510 now so I can work natively on this08:50
Son_Goku:D08:50
zyga(and quake, that doesn't help)08:50
Son_Gokuhah08:50
zygathat game really is fun, it plays surprisingly well on the trackpoint08:50
Son_Gokuwell, they _were_ a lot more common when Quake 1 was a fresh game08:51
zygaI would like to sync about flock and plan when we should deliver stuff08:51
Son_Gokuyeah08:51
zygaalso flock is where, I suspect, we can get most of this ready08:51
Son_Gokuwell, Mohan Boddu is interested in syncing with us on this at Flock08:51
Son_Gokumost of the releng team will be there at Flock08:51
Son_GokuMohan hit me up this week and was curious about our progress08:52
* Son_Goku waves to sabdfl_ 08:54
zygathat's cool, I think we should not come to flock empty handed08:54
Son_Gokuit'd be nice to come to Flock with _something_, yeah08:54
Son_Gokuwe already mechanically understand what's needed for a base snap08:55
Son_Gokuso I don't see a reason why oz cannot make one08:55
zygayeah, I agree08:55
zygaI think it's mostly figuring out the architecture of oz and friends to do this08:56
zygado you think we will be able to reuse any of the shell scripts?08:56
zygaor will this all involve writing new code08:56
* Son_Goku wishes GitHub wasn't being unresponsive right now08:56
Son_Gokuwhat shell scripts?08:57
Son_Gokuwe don't have any for making fedora base snap08:57
Son_Gokuthere is _a_ python script I wrote to make one09:00
Son_Gokubut I think the answer is generally going to be no09:01
zygaI mean, those scripts09:02
zygaI also have some09:02
zygaok09:02
Son_Gokuwe probably are going to need to adapt this to Fedora tooling, which means a kickstart definition for the base snap, and an imagefactory target for it09:02
pedroniszyga: I looked a bit at #5369,  it's nice it is short,  it's not super obvious it's correct/maintainable tough, it seems somewhat disperse09:03
mupPR #5369: overlord,interfaces,cmd: WIP early support for interfaces on core18 <Core18> <Created by zyga> <https://github.com/snapcore/snapd/pull/5369>09:03
Son_Gokuzyga: https://pagure.io/fedora-kickstarts/tree/master09:03
Son_Gokuthe fedora-docker-* ks files are probably a good starting point09:04
zygapedronis: thank you, do you have any ideas on how to improve it?09:04
pedroniszyga: well, tbh, I don't understand even if   snap connect for core interaces works there and how :)09:05
pedronisI have a question about that there09:06
mborzeckipedronis: pushed a fix09:06
zygapedronis: I think mvo and me discussed that operations against explicitly named core snap don't work yet09:07
zygaimplicit operations work fine09:07
pedronisbecause of the guessing?09:07
mupPR snapd#5411 opened: many: remove core-support interface <Created by zyga> <https://github.com/snapcore/snapd/pull/5411>09:08
zygayes, the guessing knows about snapd now09:08
zygait has priority if it exists (the snapd snap)09:08
zygafor explicit we need to add one more translation point in doConnect and doDisconnect09:08
pedroniszyga: anyway it sounds we would need some helpers around manipulating conns09:08
zygamvo: I opened an RFC to drop core-support09:08
pedronisso it's clear  snapd cannot get in there09:08
zygapedronis: that's a good idea09:08
zygapedronis: I can propose some and then the translations can happen in a single spot09:09
zygamvo: I don't know if it will pass spread, let's wait and see09:10
pedronismvo: you have quite a few PRs open, anything in particular that I should review or re-review?09:14
mborzeckiChipaca: when you're done with the paperwork, can you take another look at #5366 ?09:22
mupPR #5366: snap: helper for validating snap instance names <Created by bboozzoo> <https://github.com/snapcore/snapd/pull/5366>09:22
Chipacamborzecki: i'm reviewing 5403 right now, i'll get to that later09:22
mborzeckiChipaca: thanks09:22
mborzeckihmm got xdg-desktop-portals installed and it's showing popoup when runing unit tests09:28
mborzeckihaha 'Allow snap "some-snap" to open file "/tmp/check-935424627432528910/7"?'09:29
Chipacapedronis: pausing review of that for a bit, will come back to it later09:30
Chipacapedronis: (commented a bunch meanwhile)09:30
mborzeckiuhh it's the launcher09:31
Chipacamborzecki: I still think that just dropping "invalid instance key" is not nice09:32
Chipacamborzecki: in that it's gobbledegook09:32
mborzeckiChipaca: invalid snap instance name?09:32
Chipacamborzecki: do we call it 'instance' anywhere in user-facing stuff other than this error09:32
Chipacalike, does 'snap install --help' explain instances09:33
mborzeckiChipaca: well the feature refers to them as instances, snap install uses (or will use) --instance when installing from file, other than that there's no explicit instance09:34
mborzeckiChipaca: i can go with 'invalid snap name' or sth along these lines09:34
Chipacamborzecki: concretely: I suggest «invalid instance key %q (see 'snap install --help')», and adding a small paragraph to the install help that explains  them09:34
Chipacamborzecki: the feature description is not a user-visible document :)09:34
jackHi guys,09:34
pedronisChipaca: but we cannot really add a paragrah yet for something that is an incomplete experimental feature09:35
pedronisI suppose mborzecki can add a todo there09:36
Chipacayes :)09:36
mborzeckiworks for me09:36
Chipacaa TODO is ok09:36
ChipacaI can then hit him over the head with it at a later time09:36
* Chipaca orders a gross of TODO bludgeons off of amazon09:37
mborzeckihaha09:37
mvopedronis: thanks, most should be easy(ish), let me look for some harder ones09:37
Chipacamborzecki: when the help is written, we need to line up instance key vs name between error and help to avoid confusion also09:38
mvopedronis: 5392 would be nice09:38
mvozyga: thank you09:39
pstolowskizyga: hey, #5326 when you have a moment, please09:39
mupPR #5326: api/snapctl: allow -h and --help for regular users <Created by stolowski> <https://github.com/snapcore/snapd/pull/5326>09:39
sam__Hi guys, I have a java web application as war file it using tomcat server. Now i want to snap it. please someone guide me.09:40
zygaI read it last night but I was too tired09:40
zygaI will do it now09:40
mborzeckiChipaca: pushed a patch with TODO note09:40
tomreynhi! i recently read https://github.com/canonical-websites/snapcraft.io/issues/651 and https://blog.ubuntu.com/2018/05/15/trust-and-security-in-the-snap-store and am wondinerg whether embedding (privacy impacting) trackers is currently (1) considered acceptable (b) tested for and (c) how it's being handled, if at all. from my POV this is a major issue on android's primary app ecosystem, and mostly unhandled / unsolved (or rather accepted) there.09:45
tomreynso i'm wondering whether what the situation with snaps is.09:45
zygahey tomreyn09:47
tomreynhello zyga09:47
zygaI don't think we have any official policy about trackers in applications yet09:47
tomreynthat's... a shame,09:48
zygawe don't run applications as a part of the acceptance process, it is fully automated09:48
zygalet me look at the policy that we have to be sure09:48
pedronisChipaca: I answered two of your questions, will wait for more feedback09:48
zygatomreyn: I don't think the store has any written policy so far, or at least I cannot find any09:52
mupPR snapd#5412 opened: userd: fix running unit tests on KDE <Simple> <Created by bboozzoo> <https://github.com/snapcore/snapd/pull/5412>09:52
mborzeckitrivial PR ^^09:52
zygatomreyn: I would recommend that you discuss this on the forum as it seems like a goal worth pursuing09:52
zygamborzecki: +1 but use Also09:53
zygaso one restore less09:53
zygalook at what MockCommand return value MockCmd can do09:53
mborzeckiinteresting, will do09:54
zygatomreyn: discussions on IRC are immediate but actually miss quite a lot of the people that participate in snaps09:55
zygatomreyn: a thread on forum.snapcraft.io, in the store category, is the best way to ensure the key people read tihs09:55
tomreynzyga: thanks for checking. personally i don't think snaps a a goal worth pursuing so i'm not interested in investing time on improving the policies around it. hope you don't mind.09:55
mborzeckizyga: pushed09:56
zygatomreyn: not at all, have a nice day :)09:56
tomreynthanks for your time, though.09:56
tomreynzyga: another question, if you have the time: is there a policy which defines which snaps get security support by canonical (in that canonical takes measures to ensure that known security vulnerabilities are overcome in a short amount of time, similar to how the ubuntu security team does it for the supported apt repositories)?10:01
zygayes, there is that10:01
zygamay I ask why are you interested having said that snaps are not worth pursuing?10:01
tomreynoh, that's good. ubuntu 18.04 installs gnome-calculator as a snap by default, so i was hoping so.10:02
zygaall snaps owned (as snap names) by canonical10:02
zygahave secutity support guarantees10:02
Chipacazyga: all snaps with a for-stable-ubuntu branch also10:02
zygaChipaca: thanks, I didn't know that10:02
Chipacasnaps installed by default are tracking an ad-hoc branch, not latest/stable, for this purpose10:03
Chipacaat least that's my understanding :-) i haven't checked, not having an 18.04 to hand10:03
Chipacabut, as I say, curious why tomreyn is simultaneously curious and incurious10:04
tomreynI can be curious about things I don't favor.10:04
Chipacatomreyn: yes :)10:04
Chipacatomreyn: but you said something like it 'not being worth your time', which is rather less than not favouring it10:04
zygatomreyn: snaps and similar efforst are an important part of application distribution, if you look at docker it's been very influential and has changed how many people work, deploy and use software.10:05
zygawhile you may dislike snaps or anything else, having sane, safe behavior for something used by many people is important to us10:05
ChipacaI don't favour systemd, myself, but here we are :)10:05
zyga*efforts10:05
tomreynzyga: sure, i'm happy to discuss my discontent with snaps. i like decentralized architectures, the snap store is centralized. i'm an open source enthusiast, snaps opens the door too widely to proprietary software. i also think that at this time, using snaps and debugging issues from a user perspective is badly documented, so it is difficult to know how to recover from issues.10:06
mcphailondra: that's great. thanks! (and thanks for the snap, too)10:07
zygatomreyn: ironically distributing open source software is really hard today10:07
zygamuch harder than proprietary software10:08
ogra_tomreyn, it opens the door the same way for opensource SW10:08
tomreynthe way it was introduced in ubuntu was quite intrasparant. the average user does not even know there ar enow two different mechanism to install packages and they would not know where to look for problems.10:08
zygaI, as someone working on FOSS for about a decade now, really appreciate that software distribution is breaking away from the initial taxonomy-driven library model10:08
ogra_and why would the user need to know that ? she just wants to use some software10:09
zygatomreyn: as with all new software, no matter how many times new things are announced, some poeple will be taken by surprise10:09
zygatomreyn: this is not unique to snaps, it's just how people deal witch change10:09
tomreynogra_: that's correct, just, traditionally, debian, and also ubuntu, wasn't as embracing to proprietary software.10:09
ogra_thats not true ... ubuntus focus was always "the best user experience" ... i.e. "linux for human beings ..."10:10
zygatomreyn: I think ubuntu was always driven by being nice to people and that includes being able to use the software that said people want to use, proprietary or not10:10
* zyga hugs ogra10:10
ogra_we have shipped proprietary nvidia drivers from day one10:10
zyga(we are not in the same room btw, :D10:10
ogra_heh10:10
zygaI'm in a park with my dog, working on a bench10:10
cjwatsonthat's a new value of "one"10:10
zygaand ogra is probably 1000km away10:10
ogra_not even in the same country :)10:10
zygatomreyn: note that gnome-software has a mode now (not sure if released yet as we tend to see "git master" more often than not) where you can see just FOSS software10:11
zygatomreyn: that includes snaps10:11
tomreynzyga: i agree about the effects of introducing new technology. but don't you think more efforts should have been spent on educating users as to what these changes mean for them, and for how they need to manage their systems?10:11
zygatomreyn: I think that it is impossible to make everyone happe, I can bring some people here who will compain that I'm not addressing the issue they have, add the feature they want instead of documenting something10:12
zygatomreyn: the best way to ensure it is really the best software experience across linux is to help10:12
ogra_but do you think someone using gnome-software actually *wants* to "manage their system" ? they just want an easy way to get their software10:12
zygabecome an advocate10:12
zygadocument, explain, educate10:12
zygapoint out issues, help address them10:12
zygahelp with the design and with bug fixing10:13
zygawhatever you feel like doing or feel you are good at10:13
zygawe are only a handful of people10:13
ogra_if you really needs to be an admin and i.e. "manage your system" you probably dive deeper into the system anyway and will learn abouut snap as you will learn about debs10:13
zygawe are not a mega-corp with 100M monthly budget on advertising10:13
tomreynsure, there is only so much time when you have limited resources available. i did not mean to blame you or anyone for not documenting things enough. things could probably have been smoother if there had been more people available to work on it.10:13
zygawe cannot do everything ourselves10:13
zygaexatly10:14
zygaplease feel welcome here10:14
zygajoin us10:14
zygathe forum is a fantastic place to contribute10:14
ogra_my mother, or sister definitely do not care about the mechanism how their SW is delivered to them as long as the apps start and run flawlessly10:14
zygano coding is needed10:14
zygayou can document how snaps work, how they are different, you can make people see this10:14
zygathe forum is being used to drive documentation pages10:14
zyga(literally, certain posts just show up as documentation on other pages)10:14
zygaso anything you contribute has immediate real vlaue10:14
zyga*value10:15
zygaand it is very good to be sceptical about it10:15
zygayou are not the only one10:15
zygaseeing how snaps operate, how the policy is made is the best way to keep people working on it as a day job honest10:15
zygaso please, stay around, look around and see how you can help - this is how FOSS works10:15
tomreynthanks for the invitation. ;) i'll decline for now (since i'm still thinking that snaps will drive ubuntu in a direction i do not want to support), but maybe my mind will change in the future, you never know. and you placed a good seed there.10:15
zygain the meantime, I need to review a patch from a colleague10:16
tomreynthanks for your time.10:16
ogra_cjwatson, did warty not have the drivers on disk (iirc they were shipped but a manual install was needed) ?10:16
mupPR snapd#5413 opened: tests: purge packages installed by accounts, calendar, and contacts interface tests <Created by jhenstridge> <https://github.com/snapcore/snapd/pull/5413>10:17
zygatomreyn: one last question10:18
cjwatsonICBW but I don't think they worked properly until hoary.  In any case it was a massive controversy when we started considering doing more stuff with them by way of compiz and the like10:19
zygatomreyn: do you have any software you made yourself that you share with others?10:19
cjwatsonso it's pretty ahistorical to say that Ubuntu has always been all the way over to one end of the spectrum; we've gone back and forth a lot10:19
ogra_yeah, i do remember that ... but i thougth we always had restricted on the CD from the start10:19
ogra_but i probably mis-remember and t was hoary ...10:19
ogra_*it10:20
tomreynzyga: i contribute to an open source game, megaglest. but i didnt write it myself. it's a fork which i help manage / develop.10:20
cjwatsonogra_: I *think* that was only since hoary10:20
ogra_k10:20
zygatomreyn: are you involved in publishing aspect of that game?10:20
ogra_so day "two" :)10:20
tomreynzyga: i have a voice in it. what's your point?10:20
cjwatsonoh look, I have warty images lying around10:21
zygatomreyn: did you try to ensure that the latest version of your game is available in debian, ubuntu, fedora and opensuse for example10:21
zygaor that the bug you fixed is released there10:21
ogra_i even have my original warty laptop ... but it is in some box in the basement :)10:21
cjwatsonthey had restricted on the image, but no nvidia10:21
ogra_ah10:21
cjwatsonlinux-amd64-generic was in restricted for some reason10:22
zygapeople see snaps as some uneeded evil often don't have the first hand experience in delivering software across releases of one distribution, let alone across many10:22
ogra_heh10:22
cjwatsonoh, no, nvidia-kernel-common was on the i386 install image10:22
zygaI wanted to know if you have experience or stories about that10:22
cjwatsonbut not amd64, presumably for reasons ...10:22
ogra_amd64 was still young in 2004 ...10:22
zygapstolowski: so snapctl get as a regular user can read configuration of any snap?10:23
ogra_i guess nvidia didnt provide 64bit binaries back then10:23
cjwatsonyeah, could well be10:23
cjwatsonthe baseline architecture worked well but it was still considered slightly exotic10:24
ogra_yep10:24
pstolowskizyga: only *own* snap (needs a valid context, so needs to be run by an app itself)10:25
tomreynzyga: yes, it's a hassle if you want to be compatible to all or most linux distros and make installing and upgrading easy. if the software was more widely used i would probably spend time on packaging it using flatpack.10:25
zygatomreyn: maybe it is not widely used becaue it's not widely available due to packaging complexity?10:25
tomreyni don't think that's the case, no.10:26
tomreynMegaglest is in all major distros, and we don't get to see a lot of players. it's an old game with an old graphics engine.10:26
zygapstolowski: how do you define "own" snaps?10:27
zygapstolowski: I mean running "snapctl" outside of snap world10:28
pstolowskizyga: by presence of context10:28
zygaah, isee10:28
pstolowskizyga: (cookie)10:28
zygaand without that?10:28
zygapstolowski: (review sent)10:28
pstolowskizyga: without context snapctl get errors out (only -h flag will work)10:29
zygathanks!10:29
mborzeckiDownload (curl) error for 'http://download.opensuse.org/distribution/leap/42.3/repo/oss/suse/x86_64/libcap-devel-2.22-18.16.x86_64.rpm':10:30
mborzeckiError code: Curl error 5210:30
mborzeckiError message: Empty reply from server10:30
mborzeckiehh10:30
pstolowskizyga: thanks for the review; okay, i see where your question comes from, i'll add a comment in the code, "as is" it may look scary at first10:31
zygaI was thinking if we could grep for something and retry common apt/dnf/zypper/pacman/git operations10:31
mborzecki#5412 super simple review, anyone?10:31
mupPR #5412: userd: fix running unit tests on KDE <Simple> <Created by bboozzoo> <https://github.com/snapcore/snapd/pull/5412>10:31
zygamerge it10:32
mupPR snapd#5412 closed: userd: fix running unit tests on KDE <Simple> <Created by bboozzoo> <Merged by bboozzoo> <https://github.com/snapcore/snapd/pull/5412>10:33
tomreynzyga: so, i just reflected a bit more about my disappreciation, and to at least contribute *someething* to your efforts, i tried to condense the aspects i'm most hesitant about when it comes to snaps: privacy concerns: witht he classic apt repos i can tell pretty well that this software has received *some* level of review, and can mostly rely on this to prevent, for example, i install software which analyzes and tracks me / my use of it / the10:36
tomreyncomputer etc. with snaps, i don't have an easy way to tell where i can rely on things to be 'clean' of such issues and where not. the other aspect is security: there are two sub aspects here: for once, very much as for the privacy concerns i have, i also might install one snap but receive some bundled software i don't want, and i have no easy way to tell whether that's so or not. the other aspect is that while it's great that security updates10:36
tomreyncan be shipped so easily - unless i can know what gets regular security updates and what doesn't, i can easily end up with software in a known vulnerable version, but no9t realize it.10:36
zygatomreyn: I am afk for a bit. I will reply when I’m back10:41
tomreynsure10:42
ondramcphail feel free to ping me if I forget updating it, are you tracking stable or other channel?10:50
popeyondra: automate the builds!10:50
ondrapopey I do consume product of one jenkins, which I do not have control over, so it's hard to automate fully10:51
ondrapopey I need some job periodically checking if there is new thing on jenkins10:52
mupPR snapd#5414 opened: corecfg: added experimental.hotplug feature flag <Created by stolowski> <https://github.com/snapcore/snapd/pull/5414>10:52
ondrapopey we will eventually get jenkins intergation there, but for that we need hotplug so openhab foundation is happy to adopt snaps, long storey :)10:53
ondramcphail BTW if you are in homekit camp, you might be also interested in homebridge snap10:53
mupPR snapd#5415 opened: interfaces: moved normalize method to interfaces/utils and made it public <Created by stolowski> <https://github.com/snapcore/snapd/pull/5415>10:59
pedronismvo:  I did a pass over 539211:05
zygahttps://www.irccloud.com/pastebin/BJ7ooq1z/11:19
zygatomreyn: ^11:19
ogra_now ... that remonds me that i have to rebuild 4 of my snaps for the libssl CVE ... the store spammed me tonight i should do that :)11:28
ogra_*reminds11:28
mvopedronis: thank you!11:29
mupPR snapd#5416 opened: interfaces/hotplug: add hotplug Specification and HotplugDeviceInfo <Created by stolowski> <https://github.com/snapcore/snapd/pull/5416>11:37
=== pstolowski is now known as pstolowski|lunch
mcphailondra: cheers. i've just installed the stable channel. i haven't poked it yet. i'm hoping i can replace my openhabianpi installation11:42
tomreynzyga: my response https://paste.ubuntu.com/p/gVWpdPFxrY/11:44
ogra_tomreyn, your assumption is wrong, the centralized store does exactly that ... it auto-reviews every upload (and even monitors it during its lifetime)11:46
ogra_and thats only possible with such a centalized model11:47
ogra_the security model around snaps removes most needs for manual reviews (yet they happen for some special cases like gadget snaps or kernel snaps)11:47
tomreynogra_: then how did the miner make it in there, and what about user tracking? maybe the automated review process is just not as good as a manual one?11:49
zygatomreyn: in reality, there is no manual review (anywhere) that is detailed, there is only trust and reaction in case of mistakes11:49
ogra_it definitely isnt ... but do you think manual reviews in distros are any better ?11:49
zyganobody reads code in detail11:49
tomreynyou probably want them both manual and automated, though11:49
zygaand really nasty code can be obfuscated11:50
zygatomreyn: snaps make you trust the publisher (a specific entity) rather than the middle man11:50
ogra_tomreyn, note that 90% of uploads to distro archives are not regularly reviewed either11:50
zygain both cases (distro and app store) there are ways to catch up with nasty software11:50
zygato block it, patch it out11:50
ogra_a deb usually gets an initial review and then the developer uploads on hs own afterwards11:51
zygain reality there is not much difference there11:51
tomreynright, snaps make the user have trust relations to *many* publishers, which is overwhelming11:51
ogra_well11:51
zygaif you trust mozilla with firefox, use firefox as a snap, or as the tarball from their website, or as the deb in ubuntu11:51
ogra_snaps rather make the user trust into the security model11:51
zygatomreyn: yes but that is _reality_11:51
zygatomreyn: in the past nobody really read code11:51
zygait's a myth11:51
zygait was just nicely packed into one big label ($Distro)11:51
zygaI think that's not going to change much really11:52
zygawhat is different is now this is explicit (you know who gives you software)11:52
zygaand you can get software from more authors than before (non-free software)11:52
zygaand you can have some guarantees about how that software operates (sandbox)11:53
zygain reality there is no better model yet11:53
ogra_tomreyn, btw ... thanks to the snap store otifying me i just invested 2x 2min to update 4 snaps (2 server packages, one VPN tool and a desktop app) to get the latest libssl fixes in ... that would have eaten hours of my day if the packages were not snaps11:53
ogra_*notifying11:53
tomreynyes, there are clearly benefits in centralization.11:54
ogra_also ... the miner is a totally valid thing ...11:54
ogra_the fact that the developer did not mention it in the description was not valid though11:55
tomreynso a miner package which would say it is a miner and would just mine for a one hardcoded account would be fine?11:56
ogra_i dont see a reason why the package format should deny maintainers to get money for the work they do ... a miner is a possible way to do that ... just not without telling your users about it in advance11:56
zygatomreyn: policy is not decided on IRC11:56
zygait's a process and it is done on the forum11:56
ogra_tomreyn, sure, why wouldnt it ...11:57
zygatomreyn: in the end one thing is clear, there's no place for deception in software11:57
ogra_tomreyn, its a very valid use-case to have an UbuntuCore image with a preinstalled miner snap to maintain your 10000 node miner farm with one-click11:57
tomreynthen you'll need to discuss whether tracking users, probably unknowingly and against their will, is deception.11:57
ogra_and in my personal opinion a miner is also a valid thing for a maintainer of opensource software to generate some income ... as long as the user knows in advance what she is getting herself into11:58
tomreynanyways, i do not want to distract you off your work any loinger. thanks for the fruitful (i hope) discussion.11:58
zygatomreyn: would you mind summarizing this conversation on the forum11:59
zygairc is not preserved as much11:59
ogra_(beyond that fact that you can deny network access ofr a snap with one click or cmdline command)11:59
zygaI'm sure many people will find that useful11:59
ogra_yeah, that would be super nice11:59
tomreynzyga: that'd be me contributing to improving snaps, but, at leats so far, i'm not yet convinced that i want to do so. sorry for disappointing...12:00
zygatoo bad, maybe next time12:01
tomreyn(you did bring up a couple things which will make me reconsider a few of my POVs though)12:01
tomreynthanks for that12:01
zygamy point about the forum is that then this conversation is not specifically about you getting some answers but the whole community getting information12:02
zygaabout making sutff better for more than oneself12:02
mupPR snapd#5366 closed: snap: helper for validating snap instance names <Created by bboozzoo> <Merged by bboozzoo> <https://github.com/snapcore/snapd/pull/5366>12:03
mupPR snapd#5387 closed: snap{/snaptest}: set instance key based on snap name <Created by bboozzoo> <Merged by bboozzoo> <https://github.com/snapcore/snapd/pull/5387>12:03
tomreyni will be happy to contribute to projects whose goals i share. ;-) you are welcome to reuse what i posted here and on the pastebin, both by paraphrasing or by quoting me.12:03
mupPR core18#42 closed: hooks: port 008-etc-writable.chroot from core16 <Created by mvo5> <Merged by mvo5> <https://github.com/snapcore/core18/pull/42>12:03
mupPR snapd#5417 opened: image: block installation of parallel snap instances <Created by bboozzoo> <https://github.com/snapcore/snapd/pull/5417>12:09
mupPR snapd#5402 closed: i18n: handle write errors in xgettext-go <Created by mvo5> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/5402>12:16
mupPR snapd#5418 opened: overlord/ifacestate: get/set connection state only via helpers <Core18> <Simple> <Created by zyga> <https://github.com/snapcore/snapd/pull/5418>12:16
mvoa second review for 5361 would be great12:17
zygaboo12:18
zygamvo: I already did that one12:18
mupPR snapd#5390 closed: data: add systemd environment configuration <Created by mvo5> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/5390>12:18
Chipacamborzecki: "реасе" is a favourite of mine to check for invalid names12:19
Chipacamborzecki: :-)12:19
pedronismmh, 50 PRs12:19
Chipacapedronis: working on it12:20
* Chipaca seems nitpicky and slow today, but still12:20
mborzeckiwow, 49, it was ~45 in the morning12:20
zygamvo: 5411 is green12:20
mvopedronis: my fault - but I have a lot of simple ones12:20
zygait's -377 and some comment changes that made it to +1012:20
pedronisovelord tests have become 30s long mmh12:23
pstolowski|lunchpedronis: managers_test is responsible for that12:23
pedronisneed to dig a bit, seems a bit bad12:23
pstolowski|lunchpedronis: (and i might have added to that with the retry-conflicts tests)12:24
cachiozyga, hey, when you have a time, could you please take a look to #534312:25
mupPR #5343: tests: adding extra check to validate journalctl is showing current test data <Created by sergiocazzolato> <https://github.com/snapcore/snapd/pull/5343>12:25
zygasure12:27
zygacachio: merged12:32
cachiothanks12:32
zygaI left one comment though12:32
zygamaybe you can squeeze that into some other PR12:32
mupPR snapd#5343 closed: tests: adding extra check to validate journalctl is showing current test data <Created by sergiocazzolato> <Merged by zyga> <https://github.com/snapcore/snapd/pull/5343>12:32
zygamborzecki: review on 541512:35
zygaer12:38
zygathat was pstolowski|lunch sorry :)12:38
zygaI'm reading your 5417 so I thought about you12:38
zygamvo: funny, same review points :)12:43
zygaon 541512:43
mvozyga: haha12:43
zygaer12:43
zyga1712:43
mvopstolowski|lunch: 5415 looks like an easy one, just one suggeston from zyga missing afaict12:44
mupPR snapd#5419 opened: [WIP] many: switch to account validation: unproven|verified <Created by pedronis> <https://github.com/snapcore/snapd/pull/5419>12:49
zygamborzecki: can you look at my comment on 541312:50
=== pstolowski|lunch is now known as pstolowski
mborzeckizyga: hmm that's a bit unexpected12:52
mvozyga: I have a conflicting meeting today12:59
zygaack12:59
niemeyermvo, zyga, mborzecki: I won't attend the standup today.. have a conflict over it13:00
niemeyer(in principle)13:00
zygaack13:01
* zyga tries to join13:02
pstolowskipedronis: standup or other meeting?13:03
pedronisconflict13:03
zygathank you13:10
=== alan_g is now known as alan_g_
pstolowskizyga, mborzecki arch-linux-64:tests/main/interfaces-content failure https://api.travis-ci.org/v3/job/397340654/log.txt ; is this the same issue you mentioned earlier this week?13:50
mvozyga: did you see my earlier (last night?) paste of the test failure of the layout test on core18?13:57
mvozyga: it is reproducible, it happend on my latest test run as well13:58
abeatoniemeyer, hi, https://github.com/snapcore/snapd/pull/5309 needs another (hopefully final) round14:13
mupPR #5309: overlord/configstate: add watchdog options <Created by alfonsosanchezbeato> <https://github.com/snapcore/snapd/pull/5309>14:13
niemeyerabeato: Heya, looking14:14
abeatogreat, thx14:15
zygamvo: I did, thank you14:17
zygamvo: how can I reproduce that, which branch to start with?14:17
mvozyga: please get https://github.com/mvo5/snappy/tree/core18-all-fixes-all-tests and then run "spread -v -debug ubuntu-core-18-64:tests/main/layout14:19
zygapstolowski: hmm, what's the failure there?14:20
zygathanks!14:20
zygapstolowski: I only see the snapd-notify error14:20
zygamvo: running now14:26
mupPR snapd#5420 opened: snap-mgmt: fix for non-existent dbus system policy dir, shellchecks <Created by bboozzoo> <https://github.com/snapcore/snapd/pull/5420>14:29
zygapstolowski: those sysfs rules are interesting14:29
zygaI was not aware about some of them14:29
pstolowskizyga: i restarted the job shortly after; here is the error https://pastebin.ubuntu.com/p/RMyqtdzVzq/14:34
pstolowskizyga: what sysfs rules?14:35
mborzeckizyga: #5420 addresses snap-mgmt thing14:35
mupPR #5420: snap-mgmt: fix for non-existent dbus system policy dir, shellchecks <Created by bboozzoo> <https://github.com/snapcore/snapd/pull/5420>14:35
mborzeckialso pushed some fixes for blocking parallel instances when preparing an image PR14:36
zygamvo: reproduced (with my extra branch, investigating)14:38
kyrofasergiusens, slack isn't connecting today, it seems. Are you able to?14:38
kyrofaUntil it starts working, I'm here if needed14:38
zygamvo: so14:39
zygamvo: I got this error14:39
zygahttps://www.irccloud.com/pastebin/taNSqyBH/14:39
zygathis may not be the same error you got yourself14:39
zygait is also a bug in the test14:39
zygathe test encodes assumptions about the base snap14:40
zygamvo: my suggestion is to change the test14:40
* cachio afk14:41
zygamvo: I will send you a patch shortly14:42
mvozyga: cool14:43
* zyga has flaky network with 27K photos being backed up today /o\14:44
mvozyga: not sure about the error14:44
zygamvo: the error I got may be different because I merged one of my layout fixes here14:44
zygamvo: this uncovered the assumption about base snap that just don't hold14:45
kyrofaOh, looks like slack is just down in general14:52
mvozyga: aha, ok14:53
mvozyga: I was looking at a different failure14:53
=== Caelum_ is now known as Caelum
zygamvo: the failure you got is fixed by my PR14:53
zygamvo: so that's expected14:53
zygaI just wanted to see if this is correct after14:53
zygavanilla master trips over the bug that this one fixes14:54
pedronispstolowski: we get  5+5 s just from the retries indeed14:54
pstolowskipedronis: that's bad.. perhaps instead of settle we could wait the exact number of ensures15:01
zygamvo: hmm, interesting, this is slightly deeper than that15:01
zygamvo: the test is expected to run against the core snap15:02
zygamvo: but because this is a core system it dones't run against the core snap, it runs again core18 because on all-snap systems we don't pivot15:02
zygamvo: which I think is a deeper bug15:02
zygamvo: this means that on core18 sytems _all_ snaps run against core18, not core!15:03
zygawhich is a critical bug15:03
zygamvo: I switched networks, are you reading this, not sure if irc works now15:04
pedronispstolowski: not sure, anyway it's an area to touch again, at least I see where the time comes from now15:04
mvoxnox: hey, I filed bug 1778936 about the need to get a patch from xenial systemd back. I also added a debdiff, anything else I should do to ensure this is part of the next sru?15:04
mvozyga: uh, that sounds nasty15:04
mupBug #1778936: please re-add Support-system-image-read-only-etc.patch <systemd (Ubuntu):New> <systemd (Ubuntu Bionic):New> <https://launchpad.net/bugs/1778936>15:04
zygamvo: let me look at that now15:05
mvozyga: I think you are right, I just did "snap run --shell test-snapd-tools.echo" and a cat /etc/os-release and its core1815:05
mupPR snapd#5418 closed: overlord/ifacestate: get/set connection state only via helpers <Core18> <Simple> <Created by zyga> <Merged by zyga> <https://github.com/snapcore/snapd/pull/5418>15:06
xnoxmvo, there is a systemd in-flight in the unapproved.15:08
xnoxmvo, is this a regression since xenial?15:08
xnoxmvo, =/ i hope i didn't drop anything else on the floor15:08
mvoxnox: its a regression, to be fair we had hoped to get to a clean /etc by core18 but it did not work out ./15:09
xnoxmvo, horum15:09
mvoxnox: I have not noticed any other regression15:09
xnoxi shall dig into the history of that then quickly15:09
mvoxnox: fortunately the patch still applies almost cleanly15:09
mvoxnox: it looks like it got dropped when yakkety opened15:09
mvoxnox: there is no changelog entry, but with 230-1 it was dropped15:09
xnoxmvo, ah, which is before i started systemd maintainance. i guess pitti thought it will be all fixed and dropped it post-xenial.15:10
xnoxmvo, at one point systemd was in-sync in debian and ubuntu15:10
mvoxnox: https://launchpad.net/ubuntu/+source/systemd/230-1 is what I was looking at  (diffhttp://launchpadlibrarian.net/261334051/systemd_229-6ubuntu1_230-1.diff.gz )15:11
xnoxnice15:11
mvoxnox: I think he just hated it ;) but thats ok, its really not great that we haven't gotten to the clean etc15:11
xnoxmvo, do we need to talk about that in brussels?15:11
mvoxnox: we need this before brussels15:12
mvoxnox: oh, clean etc15:12
xnoxmvo, cause i think we never got around to finalising what needs to be in-distro / on-core to get this done.15:12
mvoxnox: yes please15:12
xnoxmvo, yeah clean etc.15:12
mvoxnox: +10015:12
mvoxnox: I think it must be a combined effort of foundations,core,debian but I think the important thing is to start :)15:12
mvoxnox: anyway, it won't happen for core18 so we have a bit of time but I will be really sad if we don't have it for core2015:13
xnoxack15:17
mvoxnox: ta15:17
mvozyga: https://github.com/snapcore/snapd/compare/master...mvo5:core18-use-core?expand=1 <- an integration test for the bug you just found15:18
kyrofasergiusens, snapcraft#2172 is all green15:18
mupPR snapcraft#2172: many: add shellcheck to static tests <Created by kyrofa> <https://github.com/snapcore/snapcraft/pull/2172>15:18
mvozyga: iirc we do something special on core, did you start looking into it?15:18
zygamvo: yes, I did15:18
zygathanks for the test, it's really simple15:19
zygaI mean15:19
zygathe bug15:19
zygawe just need to talk about it15:19
mvozyga: tell me more :)15:19
zygawe have two options15:19
zygaoption number one is this: detect core18 and treat it as classic (pivot root, etc)15:19
zygaa bit hairy but keeps the core status quo15:19
zygaoption number two: drop all special casing, always pivot15:20
zygaI prefer two but it may affect core in some way15:20
zygaright now on core we don't do pretty much anything15:20
zygawe unshare the mount namespace15:20
zygabind mount tmp and private /dev/pts15:20
zygaand that's that15:20
zygaso all production hacks are visible at runtime15:20
zygaand all the real / is there15:21
zygawe talked about this sometime in the past15:21
zygawhen you first added bases to snap-confine15:21
mvozyga: yeah, I think option (2) is better but more risky15:21
zygaI said then that we should unify core and classic to behave like classic (for the purpose of mount ns)15:21
zygabut chose not to do this then because we wanted to avoid the risk :)15:21
zygaand impact on core itself15:21
zygaI think we should do that again15:22
zygabut try to fix it at the same time15:22
zygamy memory is rusty but I think there's a real issue there15:22
zygathat unification doesn't work for a real reason15:22
zygabut I forgot that reason15:22
zygaI will do a patch that detects booted base != "core" and uses classic semantics15:22
zygabecause this is a new slate15:22
zygaso new issues rather than regressions15:22
mvozyga: +115:23
zygaand because this eventually puts us on a path where core is deprecated and core16 can be the special case (if we end up needing it)15:23
zygaok, I'll get to it now15:23
mvozyga: \o/15:23
sergiusenskyrofa: no, slack no work, me fitter, happier, more productive, comfortable15:43
zygamvo: core16 and core will use the same os-releaes file, right?15:47
mvozyga: yes15:49
mvozyga: well, we could decide but that was the plan15:49
zygaI think it must15:50
zygaI was just checking and thinking aloud :)15:50
kyrofaHahaha15:50
kyrofasergiusens, amen15:50
pedronisthey need to be ideally identical in bits that snaps can see, or through snap-confine bind mounting stuff (from snapd for example)15:52
mvozyga: yeah, I think pedronis is right, we may need some other way to distinguish15:55
zygapedronis: I agree, it is just that now on core we don't pivot so today on core (bare "core" as boot snap) you see _everything_ that exists on the system, in general, not just what is in the core snap itself.15:55
zygaso on a system that moved to core16 we can attempt to keep that15:56
zygabut on a core18 system that runs a snap using core16 or core as base we cannot just get that for free, we need to hack things to behave this way15:56
zygasome things about product hacks may leak but I don't know if that matters15:56
zyga(as in on a real core system you may see stuff that you won't see on core18 with apps running against core16)15:57
mvozyga: lets start with the simple case and just remove the special handling on core18, i.e. on core18 it always behaves like on classic, we always construct the mount namespaces from the snaps15:57
mvozyga: i.e. on anything not old-core15:57
zygamvo: yes, I agree15:57
zygathat's what I'm doing now15:58
mvozyga: \o/15:58
pstolowskiyay, my go-udev patch merged upstream16:10
=== pstolowski is now known as pstolowski|afk
zyganice :)16:20
mvopstolowski|afk: yay16:34
mupPR snapcraft#2171 closed: {catkin,python} plugin: support cleaning <Created by kyrofa> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/2171>16:50
mupPR snapd#5421 opened: tests: replace MATCH by grep to check users created for ubuntu core <Created by sergiocazzolato> <https://github.com/snapcore/snapd/pull/5421>17:07
sergiusenskyrofa: 2167 is a little larget than I thought it would be :-P17:14
kyrofasergiusens, ignoring the tests?17:28
kyrofasergiusens, snapcraft#2172 should be all good now17:55
mupPR snapcraft#2172: many: add shellcheck to static tests <Created by kyrofa> <https://github.com/snapcore/snapcraft/pull/2172>17:55
mupPR snapd#5422 opened: devicestate: fix race when refreshing a snap with snapd-control <Created by mvo5> <https://github.com/snapcore/snapd/pull/5422>18:00
kyrofaHey zyga, I'm having trouble running snaps in lxc on my desktop: cannot remount /tmp/snap.rootfs_nMP7A9/var/lib/snapd/lib/vulkan as read-only: Permission denied18:55
kyrofazyga, any ideas?18:55
zygaoh, feels like a bug18:55
zygadmesg | grep DENIED18:56
kyrofaRun that on the host or the guest?18:56
zygaeither, it is lxc18:56
kyrofazyga, [61955.378584] audit: type=1400 audit(1530126985.909:482): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxd-brave-drum_</var/snap/lxd/common/lxd>" name="/tmp/snap.rootfs_o6dcBz/var/lib/snapd/lib/vulkan/" pid=12945 comm="snap-confine" flags="ro, remount"19:17
kyrofazyga, this is a vanilla, confined container19:22
zygaone sec19:22
zygahum19:23
zygais this a privileged container?19:23
zygathis looks like a bug in lxd to me, why is it running snap-confine under its own profile?19:24
zygahmm19:24
zygastgraber: ^19:25
kyrofaNo, it's unprivileged. Just `lxc launch ubuntu:xenial -e`19:25
stgraberkyrofa: what snap?19:27
kyrofastgraber, any, but that particular test was cla-check19:27
kyrofastgraber, happens when running any app19:27
kyrofastgraber, running on bionic, lxd 3.1 via snap19:28
stgraberhmm, can't reproduce this here19:29
stgraberrunning a xenial container on current lxd on bionic, then install hello-world or cla-check inside the container, both work fine19:29
kyrofaCould it have something to do with my nvidia card?19:30
stgrabergetting a clean 18.04 install on a maas node now to see if that behaves differently19:30
stgraberkyrofa: could be, yeah19:30
zyganvidia? how?19:31
stgraberroot@c2:~# hello-world19:31
stgrabercannot remount /tmp/snap.rootfs_uuibb2/var/lib/snapd/lib/vulkan as read-only: Permission denied19:31
stgraberon a system with an nvidia gpu19:31
kyrofaAh!19:31
kyrofazyga, just saw the word "vulkan" and took a leap19:32
zygayes, that part is related19:32
kyrofaThat's all I got :P19:33
zygabut the question is, why did snap-confine not get an apparmor profile19:33
zygacan you do this from inside the container19:33
zygasudo aa-status19:33
stgraberkyrofa: anyway, a workaround you can probably use for now is "lxc config set NAME security.nesting true" which will unrestrict some mount operations19:33
zygastgraber: what does that do?19:34
kyrofazyga, sure thing: https://paste.ubuntu.com/p/55BMdHBfxy/19:34
stgraberzyga: pretty much allows all mounts everywhere in the container which likely includes remounts.19:35
zygathis looks fine19:35
kyrofastgraber, indeed, that seems to let the mount through and the app works19:35
stgraberzyga: I suspect the denial is correct in that it's the underlying LXD apparmor profile which refuses the mount, not the snap-confine profile that's loaded on top19:35
zygastgraber: I see19:35
zygaso the outer profile needs to allow this as well19:35
zygare19:40
zygaI just had a silly incident with one of the random dev boards I had around started serving everyone new IP addresses faster than my router :P19:40
chiluksomething broke snappy gnome-calculator http://paste.ubuntu.com/p/dFJjCxpXpT/19:42
chilukhow is this even possible?19:42
kyrofazyga, stgraber, so how does having an nvidia card result in a mount that is denied, while none of the other mount magic is denied?19:42
stgraberkyrofa: probably because only that triggers some snapd hook for vulkan/gl stuff which apparently bind-mounts stuff and then does a remount,ro19:42
zygakyrofa: when you have nvidia we do more things19:42
stgraberthe remount,ro part is what apparmor denies19:42
kyrofaAh, so the bind mount is okay, it's the remount that's problematic19:43
stgraberyep19:43
zygachiluk: are the two snaps connected?19:43
chiluknope ...19:43
chilukbut I haven't screwed with any of the snaps.19:44
stgraberit's safe for us to allow bind-mounts in general, remounts are more risky19:44
kyrofaSo what is the fix for this? Does snapd need to be doing something different?19:44
chilukand breaking the calculator is kind of a shit show..19:44
chilukzyga ... I could connect the two.19:44
zygachiluk: can you share "snap changes"19:44
zygakyrofa: the fix must happen in lxd19:44
chilukhttp://paste.ubuntu.com/p/rJX6bPYjBV/19:45
chilukzyga... I ran snap refresh today in hopes that there was an updated snap..19:45
kyrofazyga, what is the fix? Just allowing remounts. even though they're risky? Or something more specific?19:45
zygachiluk: and snap interfaces | grep gnome-calculator19:45
zygakyrofa: well, to allow this specific operation19:46
chilukzyga http://paste.ubuntu.com/p/gNWj9FDH5g/19:46
zygachiluk: it seems to be connected here19:46
zygagnome-3-26-1604:gnome-3-26-1604            gnome-calculator,gnome-characters,gnome-logs,gnome-system-monitor19:46
kyrofastgraber, can lxd allow snap-confine specifically to remount?19:46
stgraberkyrofa: nope19:47
chilukzyga.. I believe you... and it's connected on my desktop as well, but the question still remains how did they get unconnected?19:47
stgraberkyrofa: apparmor doesn't let you do per-process and even if it did, there'd be nothing preventing root in the container from calling a random binary snap-confine19:47
zygastgraber: what I don't undertand is how the host of other mounts/remounts we do is ok19:47
chilukI haven't explicitly been doing any snappy things..19:47
zygaand this is not?19:47
zygachiluk: can you run: sudo nsenter -m/run/snapd/ns/gnome-calculator.mnt19:47
zygachiluk: and then: cat /proc/self/mountinfo19:47
stgraberzyga: I suspect the rest of the things you're doing is just bind-mounts or standard mounts19:48
zygapastebin the result and exit that shell to go back19:48
zygastgraber: interesting, let me check19:48
stgraberzyga: I don't see any case where our profile would allow for remounts19:48
zygayes, that's the only place that we remount19:49
stgraberI have a change here which allows specifically remount,ro and nothing else, but I'm not sure that this is actually safe, at least I very much doubt that it is for privileged containers19:49
chilukzyga http://paste.ubuntu.com/p/NjGJMYwkTx/19:49
zygastgraber: is this done at apparmor level, why is remounting something read-only not allowed19:49
stgraberzyga: because remount is a fs operation, not a mount operation, so if you pass a bind-mount from the host and do remount,ro, now the path on the host is read-only too19:50
stgraberzyga: which was a pretty simple DoS attack for privileged containers against their host19:50
zygastgraber: you can pass MS_BIND| MS_REMOUNT to specifically make the bind mount read only, no?19:50
zygaand we don't do that!19:50
stgraberright, you don't do that :)19:51
zygachiluk: can you finally paste /run/snapd/ns/snap.gnome-calculator.fstab19:51
zygachiluk: this should be enough19:51
zygastgraber: thanks, I will correct this shortly19:51
zygakyrofa: thank you!19:51
kyrofazyga, stgraber, thank you both!19:51
chilukzyga http://paste.ubuntu.com/p/JwbbwbFfcV/19:52
zygakyrofa: can you please drop a topic on the forum with basic info "lxd + nvidia = sad snappy"19:52
zygaI will do the rest19:52
kyrofazyga, of course19:52
stgraberkyrofa: make sure to mention the security.nesting workaround, that's not great but it works19:52
zygachiluk: can you do "snap list" and share the revision of gnome-calculator and the gnome platform snap19:53
chilukzyga see first pastebin19:53
zygaok, sorry, looking19:53
zygahmm19:55
chilukzyga... It still could be something I did, but that seems unlikely... I feel like other users will probably eventually hit this.19:55
zygalet me read the mount table19:55
zygathis is what snapd claims it did: /snap/gnome-3-26-1604/64 /snap/gnome-calculator/178/gnome-platform none bind,ro 0 019:56
zygaI'm checking if that's true19:56
zygacuriously it doesn't seem to be true19:56
zygadid this happen just now?19:57
chilukit's been happening for a few days.. I'm pretty sure it persists over restart.19:57
chilukI guess I could check...19:57
zygacan you disconnect and re-connect that interface to see if this fixes it19:57
zygasadly we don't log much when that part fails19:58
chilukyou mean run snap connect?19:58
zygayes, please disconnect and re-connect gnome-calculator:gnome-3-26-160419:58
chiluksnap connect gnome-calculator:gnome-3-26-160420:00
chilukerror: snap "core" has no "content" interface slots20:00
zygaI think you need to spell both sides of the connection this time20:00
zygasorry20:00
zygait should tab-complete though20:00
chiluksnap connect gnome-calculator:gnome-3-26-1604 gnome-3-26-160420:00
chiluk^^ made it work.20:01
chilukas I expected.20:01
chilukbut I don't care about fixing this for me.20:01
chilukI'm a little confused as to why it broke in the first place.20:01
chilukbecause I can't be the only one.20:01
zygacan you jump into the mount ns20:01
zygaand collect mountinfo again please20:02
zygasame as last time (same commands)20:02
zygaI would like to diff the two20:02
chilukhttp://paste.ubuntu.com/p/3yZmBfBB5C/20:02
zygathank you20:02
stgraberzyga, kyrofa: https://github.com/lxc/lxd/pull/470420:03
mupPR lxc/lxd#4704: lxd/apparmor: Allow ro bind-mounts and remounts <Created by stgraber> <https://github.com/lxc/lxd/pull/4704>20:03
kyrofazyga, chiluk, just throwing this out there, but gnome-software has the ability to twiddle those as well, no?20:03
zygasure enough :/20:03
zygahttps://www.irccloud.com/pastebin/TevxFMh7/20:03
stgraberthis allows the read-only bind-mounts which you should be using for both priv and unpriv + allows ro remounts for unpriv20:04
zygakyrofa: yes but we _claim_ this is connected, we _claim_ it is mounted (snapd) and it's not20:04
zygaso clearly something was broken20:04
chilukright...20:04
kyrofaAh interesting20:04
chilukhow'd it get that way though?20:04
zygastgraber: I will fix this in snap-confine, I think it's clearly our mistake because lack of MS_BIND is confusing from an API POV20:05
zygachiluk: that's the question20:05
zygachiluk: if you can reproduce this please tell me, I'd love to know what happened20:05
zygachiluk: do you have any denials in recent history20:05
chilukyeah that's unlikely.20:05
zygasadly, as I said, snapd doesn't log this20:05
chilukzyga.. are you talking app armor?20:06
kyrofastgraber, wait, I thought ro remounts were unsafe since they set the host dir ro as well?20:06
zygachiluk: yes20:06
zygakyrofa: it's subtle20:06
zygakyrofa: we don't want to remount the filesystem20:06
zygakyrofa: we want to remount the bind mounted view20:06
=== pbek_ is now known as pbek
chilukzyga syslog:Jun 27 15:00:44 groovy kernel: [233210.052692] audit: type=1400 audit(1530129644.316:573): apparmor="DENIED" operation="open" profile="snap.gnome-calculator.gnome-calculator" name="/home/dchiluk/Templates/" pid=20481 comm="head" requested_mask="r" denied_mask="r" fsuid=1000 ouid=100020:07
zygaguys it's 22:06 and I have snap-confine patches all over my screen, I need to take the dog out, take a shower and not hack much more20:07
zygachiluk: that's not related, so if that is the only denial you had I have no other ideas :/20:07
kyrofazyga, I think I understand what you need to change on the snapd side, I just don't understand that lxd PR, since it covers filesystem remounts, no?20:07
chilukzyga looking20:07
zygakyrofa: I think the lxd PR is a separate topic now, I'm not sure it is strictly speaking mandatory or safe (as stgraber explained earlier)20:08
zygaif fixing snap-confine is sufficient to address this we should know soon (it will be in edge in about a day)20:08
zygabut first20:08
zygadog/shower/sleep20:08
stgraberkyrofa: note that I only allow those for unpriv containers where the kernel will not let them propagate to the host20:09
zygaah20:09
zygathat's nice, I didn't know the kernel does that20:09
zygahow does it decide?20:09
stgraberby looking at the kuid tied to the original mount20:11
stgraberif that doesn't match your kuid then you get EPERM20:11
stgraberobviously that doesn't work for privileged containers as those run as real root and so you totally do have the right to go and mess with the host mount table20:12
chilukzyga nothing more about calculator or snap that seems relevant in the logs.20:13
kyrofastgraber, ah, interesting, okay20:15
chilukzyga nothing more about calculator or snap that seems relevant in the logs.20:15
kyrofastgraber, thank you for putting that together!20:15
chilukzyga if it's any consolation it looks like this machine was installed with 18.04 pre-release *(probably around beta stage)... maybe that's it.20:17
zygaNo chiluk, this happened since your last reboot20:24
zygaThis is purely volatile state20:24
sergiusenskyrofa: we need to stop moving back and forth with our comm platform :-P But yeah, the code sans tests is quite large; I am not doing a light review and my state of mind right now also complicates things20:29
kyrofasergiusens, haha, I sent that ages ago! Slack is back up, we can talk there if you like20:34
kyrofaTake your time on the review20:34
sergiusenswell, I would rather discuss here, until I have the urge to paste something :-P20:36
sergiusenskyrofa: I setup matrix during the weekend and added elopio as I knew he was on, he told me you are his only other friend there :-P20:36
kyrofaWorks for me!20:36
kyrofaHahahahahaha20:36
sergiusenskyrofa: if you dismiss my review I lose the ability to approve from the same pane :-P20:40
kyrofaOh I didn't actually realize that was a possibility in the first place. How fancy!20:41
kyrofaLooking forward to that one landing. Not sure how some of this has been working20:45
mupPR snapcraft#2172 closed: many: add shellcheck to static tests <Created by kyrofa> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/2172>21:32
sergiusenskyrofa: ok, so first pass on #2167 is done21:34
mupPR #2167: snapstate, devicestate: do not remove seed <Created by chipaca> <Merged by chipaca> <https://github.com/snapcore/snapd/pull/2167>21:34
sergiusenskyrofa: what do you think of making the <topic>: in the merge more functional instead of locational? Else you get "many:" for most things and it loses importance.21:37
kyrofasergiusens, yeah I think most of the time they're the same, sans many :P22:05
kyrofaI'm good with that, I'll avoid many22:05
kyrofasergiusens, updated snapcraft#216723:15
mupPR snapcraft#2167: many: detect local source changes <Created by kyrofa> <https://github.com/snapcore/snapcraft/pull/2167>23:15

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!