/srv/irclogs.ubuntu.com/2019/11/01/#snappy.txt

mupBug #1671266 opened: rfkill should be included in the core snap <hwe> <Snappy:Confirmed for ogra> <https://launchpad.net/bugs/1671266>01:51
=== JanC_ is now known as JanC
mupPR snapd#7690 closed: cmd/snap: make completion skip hidden commands (unless overridden) <Created by pedronis> <Merged by pedronis> <https://github.com/snapcore/snapd/pull/7690>07:19
mupPR snapd#7714 opened: overlord: refactor mgrsSuite and extract kernelSuite <Created by mvo5> <https://github.com/snapcore/snapd/pull/7714>08:21
mvopedronis_: a review for 7682 would be great. then I could use the helpers there for the base->bsae undo tests08:30
mvopedronis_: actually - 7701 (smaller) is enough :)08:31
=== pedronis_ is now known as pedronis
pedronismvo: hi, yes, I wanted to ask which one of those I should review first? because the newer was merged into the older?08:32
mvopedronis: yeah, the newer one is probably the best starting point08:38
mvopedronis: so 7701 is probably the best start, its relatively small08:38
pedronismvo: I'll look now,  I was trying to give input on some older PRs that were stuck08:42
=== alan_g is now known as alan_g_
zygagood morning08:54
zygahey mvo, pedronis08:54
zygahow are you doing this frosty morning?08:54
mvohey zyga ! doing well08:54
pedronismvo: I reviewed 770108:55
mvopedronis: thank you!08:56
pedroniszyga: hi, did you see my question in #7700 ?08:56
zyganot yet08:56
mupPR snapd#7715 opened: overlord: add base->base remodel undo tests and fixe <Created by mvo5> <https://github.com/snapcore/snapd/pull/7715>08:56
mupPR #7700: many: wait while inhibition file is present <Created by zyga> <https://github.com/snapcore/snapd/pull/7700>08:56
mvopedronis: I pushed base->base remodel undo but it needs all the other ones first but at least I think we are complete in the sense that we have code written :)08:56
mvopedronis: thanks a bunch for the review!08:56
zyga@pedronis I yeah, I thought about this and I think it may need to be in /var after all08:57
zyga@pedronis I got into a longer exploration of the problem of locking08:57
pedronisok08:57
zyga@pedronis I tried to document that in the doc but I need to remove redundant parts and make the whole thing comprehensible08:57
pedronismvo: this test seems also to have that kind of name:  TestInstallCoreSnapUpdatesBootloaderAndSplitsAcrossRestart08:59
zygawow that's a long name :)09:02
mvopedronis: yeah, fixing all of the UpdatesBootloader ones now09:03
mvozyga: its a long test! needs a long name :)09:03
zygamvo: ChapterOne09:03
zyga;-)09:03
mvozyga: *if* you work today a review for 7651 would be great09:09
zygasure, let me start with that09:09
* zyga reads the spec first09:15
pstolowskimorning09:25
zygahey pawel09:26
pstolowskipedronis: i'm changing PreseedMode to func, no strong opinion either way09:35
pstolowskizyga: would you find a moment for #7675? i'd like to get it out of the way as it's a base for other PRs09:40
mupPR #7675: release: preseed mode flag <Prebaking 🍞> <Simple 😃> <Created by stolowski> <https://github.com/snapcore/snapd/pull/7675>09:40
zygapstolowski: gladly, just after the current one09:40
pedronismvo: there's a problem with the download via snapd stuff09:43
mvopedronis: oh?09:43
pedronismvo: you get polkit prompts09:43
pedroniswhich I'm not sure we want09:43
pedronisfor this09:43
zygaoh?09:44
mvopedronis: oh, meh, yes. downlaod is an auth endpoint :/09:44
zygabecause of snapd asking polkit?09:44
mvopedronis: that sounds like we need some flag to prevent interaction09:44
mvozyga: yeah09:44
Chipacapedronis: yesterday I suggested landing the current download but with the defaults flipped09:44
pedronismvo: well, we might need to change the auth rules for the /download endpoint09:45
Chipacaie having direct being the default, with a hidden --indirect flag09:45
mupIssue core18#142 opened: Stuck with blank screen on snap-core 18 Raspi 3 B+ install <Created by bernermic> <https://github.com/snapcore/core18/issue/142>09:45
pedronisChipaca: just to progress? because that's not the final goal09:46
Chipacapedronis: just to progress, yes09:47
Chipacapedronis: otherwise i see this being an open pr for quite some time, across vancouver09:48
jameshChipaca: re. https://github.com/snapcore/snapd/pull/7589, are you happy with pedronis's suggestion for "snap routine"?  I'm fine with it myself.09:48
mupPR #7589: cmd/snap: add ability to register "snap internal" commands <⛔ Blocked> <Created by jhenstridge> <https://github.com/snapcore/snapd/pull/7589>09:48
pedronisChipaca: isn't just a matter to remove this from download ?  PolkitOK: "io.snapcraft.snapd.manage",09:48
Chipacajamesh: heh, i'm terrible with names, but let me respond over there09:49
pedronisI don't think it's actually a mgmt action (in those terms) anyway09:49
pedronismvo: ^09:49
mvopedronis: hm, good point, that is probably fine09:50
mvoChipaca: beside better tests (I pushed two prs recently) and resume-partial is there anything missing from the snap download via snapd?09:50
pedronismvo: also ./snap0 known --remote account account-id=dell gives me nothing (no error either), but --direct works09:52
pedronismvo: something is off09:52
pedroniswith known too09:52
mvopedronis: uh, let me debug this09:53
pedronismvo: you pushed a 2.42.1 to edge?09:53
pedronisthat will roolback people09:53
mvopedronis: I did not, that was our stupid machinery not being updated :(09:54
mvopedronis: let me fix this, but it sounds like one of the auto-merge/auto-build bits failed09:54
pedronisso my snapd doesn't have remote on /assertions09:54
pedronisI suppose09:54
Chipacamvo: more real-life testing?09:55
mvoChipaca: good point :)09:55
Chipacamvo: i'd like to have a whole .N of us using it to help us find the bugs09:56
Chipacabut I'd also like people to stop being horrible to each other, and here we are09:57
mvoChipaca: we will have the entire 2.43 for people to test :)09:57
mvopedronis: I can reproduce the dell issue, debugging now09:58
mvoChipaca: wdyt about removing pollkitOk from /v2/download ?09:58
Chipacamvo: nah09:58
Chipacamvo: just tell it to not do interactive09:58
* Chipaca looks for how to do that09:59
Chipacamvo: client.Config{Interactive: false}09:59
Chipacamvo: turns off polkit for that request09:59
Chipacabah, for any request that client emits10:00
mvoChipaca: \o/10:00
Chipacamvo: you owe jamesh a beverage10:00
mvopedronis: snap-vendor-sync repo is 40h behind, this is controlled via spread-cron, I need to check with sergio what is going on there :(10:01
pedronismvo: ok10:01
jameshmvo: the Client instance set up by the snap command sets Interactive based on whether stdin is a tty10:02
jameshin general it is going to do the right thing for non-interactive scripts10:04
Chipacamvo: jamesh: cmd/snap/main's mkClient could take a ClientConfig to override that though10:04
pedronisyea, for download I think the regression is still annoying even interactively10:04
pedroniswe are not starting from scratch here10:05
jameshChipaca: presumably you could just do client.Interactive = false within the command10:05
jameshI don't think anything would be using the client after the command takes control of execution10:05
Chipacadegville: could / should we add a list of supported architectures to https://snapcraft.io/docs/architectures ?10:06
degvilleChipaca: yes, I think so - I've actually got a list in my edit, taken from build.snapcrraft.io.10:06
Chipacadegville: i was just looking for that list :-)10:07
Chipacathere's somebody trying to build a MIPS core image10:07
Chipacaseems like they've spent some time on it already10:07
Chipaca(not very effectively)10:07
degvilleChipaca: these are the ones I've got - s390x, ppc64el, arm64, armhf, amd64, i386.10:09
mvopedronis: I can reproduce this if I have 2.42.1 snapd and a snap client from master. snap client will sent "remote=true" to snapd but the old snapd does not know this header and returns nothing (but also no error). switching to the real edge snapd fixes this (I got reverted to 2.42.1 apparently)10:09
zygamvo: can we nuke the vendor sync repo and use github actions?10:10
zygamvo: and perhaps build the thing with github actions in a way that allows us to have the real git sha in the snap version?10:10
mvozyga: maybe, that would certainly be nice10:10
zygamvo: yeah, worth trying at least10:11
mvozyga: yes! unfortunately not today10:14
zyganope10:14
zygaI don't even know if actions are out of beta yet10:14
zygaI have access on my repos but I was given access ahead of general release a while ago10:14
pedronismvo: ok, at least this bit is understood, yes I got edge with 2.42.1 here too10:15
jameshgithub actions are so much nicer to deal with than travis10:15
jameshI've been using them on some of my personal repos too10:16
zygajamesh: that's good indicator to use them10:16
zygathanks!10:16
jameshzyga: here were my initial thoughts on the system: https://blogs.gnome.org/jamesh/2019/09/06/exploring-github-actions/10:17
pedronisjamesh: I answered to John comment in #758910:21
mupPR #7589: cmd/snap: add ability to register "snap internal" commands <⛔ Blocked> <Created by jhenstridge> <https://github.com/snapcore/snapd/pull/7589>10:21
pedronisI think we do have a path forward10:21
jameshpedronis: thanks.  For the user session systemd branch, I don't think timers and sockets need any special handling.  I put my reasoning in a comment on #723810:23
mupPR #7238: usersession: add systemd user instance service control to user session agent <Needs Samuele review> <Created by jhenstridge> <https://github.com/snapcore/snapd/pull/7238>10:23
pedronisjamesh: yea, I'll do a pass again on it today, then either way it will need a re-review by jdstrand10:23
pedronisjamesh: btw I'm off next week10:23
jameshokay.  Thanks10:24
pedronisjamesh: the fwupd one is also unblocked, it just needs a 2nd review and to get green10:24
mvopedronis, Chipaca I updated the code in 7624 to not have a polkit prompt anymore (set interactive to false)10:28
pstolowskipedronis: hey, i've added a separate firstbootPreseed16 suite to yesterday's PR. one remaining "annoyance" is the copy of two helpers (makreCoreSnaps + makeSeededChange - the latter with only minor change), maybe they should be made more general to be reused by two *16 suites - although moving them to firstBoot16Suite would probably go too far since they set up specific test data. slightly on the fence about what to11:11
pstolowskido about them11:11
pedronispstolowski: sorry, what is the problem? that they are *16 specific?11:12
pedronispstolowski: did you forget to add a file?11:13
pedronisthis diff is strange https://github.com/snapcore/snapd/pull/7705/commits/fdd697d3b89cab1101b8adbd04f082d32b3aa27e11:14
mupPR #7705: [WIP] o/devicestate: handle preseed in firstboot <Prebaking 🍞> <Created by stolowski> <https://github.com/snapcore/snapd/pull/7705>11:14
pstolowskipedronis: yes i forgot the file in that one commit. look at the next commit or complete diff11:15
pedronispstolowski: so makeSeedChanges has actual differences11:19
pstolowskipedronis: yes, but minor, different checkTasks* used11:19
pedronisyou can make a firstBoot16BaseTest with seedtest and those two? no?11:20
pedronisI mean with seedtest.TestingSeed1611:20
pedronisif you want11:21
pedronismakeCoreSnap could be a global helper that takes a *seedtest.TestingSeed1611:22
pedronismakeCoreSnaps11:22
pstolowskipedronis: yes, i can do something like this11:23
pedronispstolowski: I don't strong opinions on this, need to try a bit what is readable in the end11:25
pedronisI wouldn't do is chain them though firstBoot16BaseTest shouldn't contain firstBootBaseTest11:25
pedronisand maybe firstBoot16BaseTest is not the best name for that one11:27
pedronispstolowski: otoh all the new tests have a slightly different style that makes something like makeCoreSnaps a bit less necessary11:31
pedronisso maybe we should change to that at some point11:31
pstolowskipedronis: i can also postpone these changes for a followup maybe (when you're back)?11:31
mvoChipaca: if you feel like reviewing, 7701 would be a nice one11:33
pstolowskipedronis: will you find a moment today to take a look at #7706?11:40
mupPR #7706: overlord/snapstate: install task edges <Prebaking 🍞> <Created by stolowski> <https://github.com/snapcore/snapd/pull/7706>11:40
Chipacamvo: reviewing is all there is11:41
Chipacamvo: but first more coffee11:41
Chipacamaybe a bite to eat as well11:41
jdstrandjamesh, pedronis: re 7238, it's on my list11:42
zygahey jdstrand :)11:42
jdstrandhey zyga :)11:42
pstolowskii'm going afk for now. i'll check later if my #7675 can land and rebase the rest if needed11:42
mupPR #7675: release: preseed mode flag <Prebaking 🍞> <Simple 😃> <Created by stolowski> <https://github.com/snapcore/snapd/pull/7675>11:42
zygao/11:42
=== pstolowski is now known as pstolowski|afk
mvoChipaca: sounds like a great plan!11:47
* mvo contemplates food as well11:47
mupPR snapd#7708 closed: parts/plugins: don't xz-compress a deb we're going to discard <Simple 😃> <Created by chipaca> <Merged by chipaca> <https://github.com/snapcore/snapd/pull/7708>11:51
pedronispstolowski|afk: sorry, needed to run to have lunch12:02
zygapedronis: https://github.com/snapcore/snapd/pull/7651#pullrequestreview-31039209312:21
mupPR #7651: asserts: support and parsing for slots-per-plug/plugs-per-slot <Created by pedronis> <https://github.com/snapcore/snapd/pull/7651>12:21
zygapstolowski|afk: looking at your PR now12:26
zygapstolowski|afk: https://github.com/snapcore/snapd/pull/7675#pullrequestreview-310427961 (though not what you may have expected)12:35
mupPR #7675: release: preseed mode flag <Prebaking 🍞> <Simple 😃> <Created by stolowski> <https://github.com/snapcore/snapd/pull/7675>12:35
* zyga breaks for quick tea12:36
zygait's soooo cold at home today12:36
zygajdstrand: https://github.com/snapcore/snapd/pull/7659 should be ready now13:17
zygajdstrand: it's just the extra feature flag you asked for13:18
mupPR #7659: snap/snapenv: preserve XDG_RUNTIME_DIR for classic confinement <Created by zyga> <https://github.com/snapcore/snapd/pull/7659>13:18
zygajdstrand: I'm looking at expanding spread test to cover that, just looking where to put it13:18
jdstrandzyga: ok, thanks13:18
kenvandinejdstrand, zyga: any thoughts on marcustomlinson's findings on bug 1661626 ?13:19
mupBug #1661626: GSettings/dconf reports incorrect values on setting change under confinement <desktop> <snapd:Triaged by marcustomlinson> <https://launchpad.net/bugs/1661626>13:19
zygakenvandine: no, it seems like a mess now :/13:20
zygakenvandine: feels like gsettings really needs a portal / proxy13:20
zygakenvandine: do you think there's a simple solution for all of this?13:20
kenvandinethere is a settings proxy, not sure the state of it though13:21
kenvandines/proxy/portal13:21
kenvandinehttps://github.com/flatpak/xdg-desktop-portal/blob/master/data/org.freedesktop.portal.Settings.xml13:22
zygakenvandine: how can we use this?13:22
zygaI mean13:22
jdstrandzyga: this is what jamesh and I briefly chatted about in the plenary room as a side discussion after a meeting. there is stuff we can probably do here, but not immediately. he summarized that discussion in the forum somewhere13:22
kenvandinebut that seems to be read access to the host settings13:23
zygadoes it need gtk change to software to use that vs doing what they needed before13:23
zygaor is this some transparent proxy where we hack around and inject it and software is unmodified13:23
kenvandinei don't think it helps for an app with it's own schema13:23
jdstrandbut that was for per app settings, not global settings now that I type that13:23
kenvandinethe per app is the issue here, at least this bug13:23
kenvandineif i'm reading it right13:24
marcustomlinsonbare in mind that set and get work just fine, it's just the monitor that is broke13:24
kenvandinemarcustomlinson: right?  this is an app not getting change notificiations for it's own settings?13:24
zygamarcustomlinson: who sends the signal?13:25
kenvandineyeah, it seems to be all related to the XDG_RUNTIME_DIR13:25
marcustomlinsonzyga: shrug13:25
zygaI'm not experienced in the desktop stack13:25
zygaI cannot help without someone who knows how this works13:25
kenvandinei think the app's process13:25
zygawould it help if we had not modified xdg runtime dir?13:25
kenvandinezyga: i think so13:25
kenvandinemaybe this is a bug in the helpers?13:26
zygasounds like someone needs to deep dive into this13:26
jdstrandbut, we can probably just add another symlink for now from $XDG_RUNTIME_DIR/dconf -> ../dconf13:26
zygaI really don't know13:26
marcustomlinsonjdstrand: I did try that, didn't work13:26
zygamy meta observation is as follows:13:26
kenvandinejamesh: are you by chance still around?13:27
jdstrandmarcustomlinson: oh? did dconf remove it?13:27
zygaI think it would be healthier for the process if instead of in the helpers this was a part of snapd's preparation of /run, when some sort of interface is used13:27
marcustomlinsonjdstrand: no didn't remove it, perhaps permission issue not sure13:27
zygait would teach the snapd team more a13:27
zygaand it would help in fixing "what happens" part of the problem, because we have many layers13:27
jdstrandmarcustomlinson: a snap that plugs gsettings can acces /run/user/*/dconf, so a symlink to it should be fine13:28
marcustomlinsonjdstrand: well it wasn't :D13:28
jdstrandmarcustomlinson: ok... that isn't a lot of detail ;)13:28
marcustomlinsonjdstrand: I asked for assistance13:29
marcustomlinsonnot for ears to hear the solution13:29
jdstrandmarcustomlinson: but, /run/user/*/dconf is different than ~/.config/dconf, so maybe it doesn't have to do with XDG_RUNTIME_DIR at all?13:29
jdstrandmarcustomlinson: I'm not sure what you mean be that, but if you are implying I am not trying to assist, you are wrong13:30
zygamarcustomlinson: we can help with the confinement but we need someone to understand how the desktop side works well and design how it ought to work with isolation in place13:30
marcustomlinsonI don't have a lot of detail13:30
mupPR snapd#7651 closed: asserts: support and parsing for slots-per-plug/plugs-per-slot <Created by pedronis> <Merged by pedronis> <https://github.com/snapcore/snapd/pull/7651>13:30
kenvandinei think we probably need jamesh13:31
marcustomlinsonzyga: yes which is what I said in my comment13:31
jdstrandbut if I'm being asked to look at this to investigate the whole issue rather than provide pointers to someone who will, I'll but it in backlog13:31
kenvandinejdstrand: nah, i think we need jamesh to look at it13:31
mupPR snapd#7695 closed: o/devicestate: the basics of Core 20 firstboot support with test <Created by pedronis> <Merged by pedronis> <https://github.com/snapcore/snapd/pull/7695>13:31
marcustomlinsonkenvandine: I'm happy to press on with it if you like13:32
pedronispstolowski|afk: #7695 has landed which should help with your PR13:32
marcustomlinsonI just saw a rabbit hole approaching and thought I'd reach out first13:32
mupPR #7695: o/devicestate: the basics of Core 20 firstboot support with test <Created by pedronis> <Merged by pedronis> <https://github.com/snapcore/snapd/pull/7695>13:32
kenvandinemarcustomlinson: i'm betting james could point to the problem pretty quickly13:33
kenvandineit's in his wheelhouse13:33
marcustomlinsonagreed13:33
jdstrandmarcustomlinson (cc kenvandine, jamesh): do note that outside of snaps, there is a /run/user/1000/dconf dir and a ~/.config/dconf dir (I know you know that, but bear with me). does an unconfined non-snap get out of sync?13:34
kenvandinejdstrand: i do not think they do13:35
jdstrandmarcustomlinson (cc kenvandine, jamesh): I ask cause while we do the symlink trick from SNAP_USER_DATA to ~/.config/dconf, we apparently aren't for XDG_RUNTIME_DIR/dconf to /run/user/1000/dconf13:35
jdstrandand to me that is interesting13:35
kenvandinejdstrand: yeah, that is interesting13:36
marcustomlinsonjdstrand: no installing with --devmode doesn't fix it13:36
kenvandineit doesn't feel like confinement13:36
jdstrandiirc, and this is from *long* ago, the /run stuff was a perf optimization for fast reads. part of that optimization may be how it opens the file, or harrdoces a path, or something else13:36
kenvandinei think it has to do with monkeying with paths13:37
* jdstrand does know otoh13:37
jdstrandmarcustomlinson: no, I wasn't talking about --devmode. I was talking about a non-snap13:37
jdstrandvs a snap that has XDG_RUNTIME_DIR, $HOME, etc set13:37
marcustomlinsonjdstrand: a non-snap doesn't fall out of sync as said in the bug description13:37
jdstrandthe security policy should allow access to everything, but that doesn't mean dconf is going to the right places. that is all I'm saying13:38
kenvandinei'm going to get jamesh to take a look13:40
jdstrandjamesh: please see backscroll to see if that sparks any ideas13:40
pstolowski|afkpedronis: great, ty13:40
jdstrandkenvandine: thanks :)13:40
* zyga breaks for lunch 13:41
zygasee you at the standup13:41
jdstrands/does know/doesn't know/13:41
jdstrandkenvandine, marcustomlinson, jamesh: I gave my thoughts in the bug14:00
kenvandinejdstrand: thanks!14:00
kenvandinejdstrand: can you assign it to jamesh?  I can't seem to choose people to assign the snapd bugs to14:01
jdstrandkenvandine: sure, done14:02
zygaspread running14:20
zygajdstrand: I'm trying your suggestion on lxd14:20
kenvandinejdstrand: thanks14:20
zygajdstrand: if it works I'll file a bug with the LXD team to update their templates14:21
zygaclaudio is not on irc?14:22
zygaI wanted to correct my statement, the destkop has four microphones, not seven14:22
jdstrandpedronis: oh, 7651 got committed while I was reviewing. there are no blocking comments from me, but please consider the feedback given14:26
marcustomlinsonjdstrand: thanks, well said14:27
jdstrandmarcustomlinson: yw :)14:27
pedronisjdstrand: thanks, probably after I'm back at this point. I addressed some that were shared with zyga's here:14:29
pedronishttps://github.com/snapcore/snapd/pull/7652/commits/3e9a7ebe67bc054e7613489b0bcbd0e1eb9713a614:30
mupPR #7652: o/ifacestate,interfaces,interfaces/policy: slots-for-plug: * <Created by pedronis> <https://github.com/snapcore/snapd/pull/7652>14:30
pedroniszyga: the follow ups ^14:30
zygalooking14:30
jdstrandpedronis: sure, just wanting to make sure you saw it. not sure since it was merged by the time I finished my review if you would14:31
mupPR snapd#7716 opened: interfaces/lxd-support: Fix on core18 <Created by stgraber> <https://github.com/snapcore/snapd/pull/7716>14:32
zyga^ simple quick review14:33
zygapedronis: do you want it reviewed today?14:34
zygapedronis: or is Monday ok?14:34
pedroniszyga: the entire PR ? that's a question for mvo14:35
zygayes14:35
zygathe comments are good, thank you for them!14:35
jdstrand7716: approved14:36
zygastgraber: is that needed urgently?14:36
zygaI kind of wish that one liner could be a .2 in a day or two14:37
mvozyga: the pr 7716? monday is ok14:37
mupPR #7716: interfaces/lxd-support: Fix on core18 <Simple 😃> <Created by stgraber> <https://github.com/snapcore/snapd/pull/7716>14:38
zygamvo: no, the bigger one - 765214:38
zygamvo: I reviewed 7716 arlready14:38
mvozyga: monday is still ok, I will try to do a first pass myself today14:38
pedronisjdstrand: I don't completely understand the warn/log comments14:38
jameshkenvandine, jdstrand, marcustomlinson: the settings portal is not intended for application settings: instead it is intended to share desktop settings (e.g. theme name, font choice, etc) with the sandbox14:42
jdstrandpedronis: I might've been a bit terse, but the idea is that if someone uses '2', should we bubble that up instead of being silent14:43
stgraberzyga: we'll want that in all distros ASAP, but I'm expecting it to take months to fully roll out again :(14:43
zygamvo: ^14:43
zygatoo bad we just did a .214:43
zygastgraber: if you want we can push that to fedora and opensuse quickly14:43
pedronisjdstrand: I see, but it's the machine, and the  one setting is in the store14:44
pedronisjdstrand: it feels more confusing than helpful tbh14:44
stgraberzyga: those two would be nice, our main blocker last time around was centos714:44
jameshkenvandine: The plan upstream is to not have sandboxed apps talk to dconf at all.  If you have a new enough glib and set GTK_USE_PORTALS=1 it will store app settings to ~/.config/glib-2.0/settings/keyfile, which will be private to the snap14:44
zygastgraber: it would be good to run the lxd test on more places14:44
mvostgraber: if its really important we can do a 2.42.2 just with this14:44
zygastgraber: centos7 should be fast too nowadays14:44
stgraberzyga: looks like thye only got >= 2.40 earlier this week14:44
zygastgraber: I'll raise this with mborzecki and mvo on Monday14:44
jdstrandpedronis: that's fine14:45
zyga(mborzecki is off today)14:45
kenvandinejamesh: that's what i thought.  can you look for a solution to the current issue in that bug report?14:45
zygajamesh: I was thinking about one thing14:45
mvostgraber: we don't always get quick turnaround on SRUs unfortunately, thats true14:45
zygajamesh: could we have a service that steals part of the traffic so that gsettings is running through a new proxy which runs unconfined as the user14:46
mvovorlon: you are mentioned in the stable-release-udpates page for today, do you think you could have a look at the snapd sru maybe?14:46
stgrabermvo: our own CI now records what the snapd version was on all the distros we test, so it's pretty easy for us to block work until the version we want is available on the distros we care the most about but yeah, it can be high latency and we completely missed the broken interface until right when we were about to push to edge...14:46
jameshzyga: what would that offer over the keyfile solution?14:46
* cachio lunch14:47
zygajamesh: not sure yet, I think if we had a more-less generic middleware that could do some logic and forward the call we could handle more dbus APIs sanyl14:47
zyga*sanely14:47
kenvandineconfinement isn't the issue though14:48
zygakenvandine: it kind of is, if we had no xdg runtime dir changes we'd be okay14:48
zygabut we do for confinement14:48
zygaand get/set api is not scoped to what a given snap can and cannot do14:48
zygaif we had a way to run code on each of those14:49
jameshzyga: the design of dconf (and gconf before it) was to store every application's settings in a common data store.  It's not obvious that we want to do that when sandboxing applications14:49
zygawe could do something smart14:49
zygajamesh: I think that is fine as long as mmap is gone14:49
zygajamesh: and as long as we can limit get/set14:49
zygajamesh: (which we cannot today)14:49
zygajamesh: anyway, it's just an idea, I wanted to know what you think14:49
jameshzyga: there are only a small number of settings we want to share (themes, fonts, etc), but everything else can be private to the app14:50
zygajamesh: that's true and that's fine14:50
zygajamesh: it means it should be easy to express14:50
jameshzyga: so we store application settings in a file that ends up in $SNAP_USER_DATA, and have the portal for the shared settings14:50
jdstrandjamesh: for what it is worth, I think the keyfile idea is very good. I also think that the concept of sometime soon(ish) bind mounting /run/user/uid/snap.... onto /run/user/uid and adding in what we want to expose, leaving XDG_RUNTIME_DIR as /run/user/uid, is going to solve a lot of things14:51
jameshno need for a config access daemon with ACL support14:51
zygajamesh: sure, but again, this is just an excuse to try out an idea in our heads: we could use this for gsettings, for network-manager and perhaps for more dbus things later on14:51
jdstrandzyga: we've discussed a dbus proxy in the past, I don't think we have a compelling use case that justifies the dev resources and risk at this point14:52
kenvandinejamesh: i think we should add GTK_USE_PORTALS=1 to the  WIP gnome-3-34 snapcraft extension14:53
jdstrandwe have a lot with just apparmor without having to look at member data14:53
jdstrandbut, yes, it we really required member data mediation, we would have to come up with something14:54
zygajdstrand: odd14:55
zygaI didn't have /var/snap/lxd/common/lxd/security/apparmor/profiles/lxd-my-ubuntu14:55
zyga 14:55
zygain the test14:55
* zyga tries 16.04 14:55
zygaI was running on 18.0414:56
zygano apparmor profile created by lxd?14:56
jameshzyga: there is work upstream to add connection filtering to dbus-daemon itself.  I'm not sure of the status, but I did participate in the bug reports to make sure it wouldn't be too impossible to use with snaps14:56
zygammm, I recall some of this14:57
zygathat's good14:57
zygawell, just a thought14:57
jameshzyga: the basic idea was to ask dbus-daemon to create a new listening socket, and tag all connections made through that socket14:57
jamesha policy would be applied that would limit the bus names those connections could see, and what messages they could send and receive14:58
pedronismvo: is 7701 merged ?15:00
zygapedronis: doesn't seem to be15:01
jdstrandjamesh: thanks for keeping an eye on that btw :) it would be a bit unfortunate to have both it and apparmor in place and deciding when/how to use what, etc, etc, but yes, what you described is something we can work with15:07
zygahmm15:08
zygastgraber: where does lxd store apparmor profiles?15:08
stgraberzyga: /var/snap/lxd/common/lxd/security/apparmor15:08
zygaoh, I'm silly15:08
zygathanks, it's all there now15:08
zygaETOOMANYNAMESPACES15:08
zygathank you!15:12
pedronispstolowski|afk: gave a couple of comments in 770615:14
mvopedronis: 7701 needs a second review - I guess it could be merged with one given that its mostly test updates15:16
zygamvo: go for it15:16
mvozyga: go for the merge?15:16
zygayes15:16
pedronismvo: it would give me a chance for me to try to review the next one15:16
mvopedronis: +115:16
* zyga strongly believes in trust and asking for forgiveness more than permission15:17
mupPR snapd#7701 closed: overlord: add kernel rollback accross reboots manager test and fixes <Created by mvo5> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/7701>15:17
mvopedronis: 7682 is now ready for review as well15:18
pedronismvo: taking a break and after I'll see where I'm at on the things to finish stuff15:20
pedroniss/stuff/list/15:20
mvopedronis: sure, thank you!15:20
mvoChipaca: can 7669 be merged? has two +115:23
zygajdstrand: FYI https://github.com/snapcore/snapd/pull/7547#issuecomment-54878868515:24
Chipacamvo: 'needs samuele review' :)15:24
mupPR #7547: many: use a dedicated named cgroup hierarchy for tracking <⛔ Blocked> <Created by zyga> <https://github.com/snapcore/snapd/pull/7547>15:24
pedronismvo: actually it should be closed, I think Chipaca's prefers next one15:26
pedronisbut there is a question answered15:26
pedronisthat related whether we should pick one or the other15:26
* zyga tries another approach15:26
Chipacayes, i slightly prefer 767015:26
Chipacaoh, answered?15:27
* Chipaca looks15:27
pedronissorry, unanswered15:27
pedronisChipaca: is this one: https://github.com/snapcore/snapd/pull/7680#discussion_r33955237215:27
mupPR #7680: daemon: parse and reject invalid channels in snap ops <Channels 🏷️> <Simple 😃> <Created by chipaca> <https://github.com/snapcore/snapd/pull/7680>15:27
Chipacaah!15:28
Chipacapedronis: answered! closing 766915:28
Chipacaand adding comments to 7670 to land it15:28
Chipacathanks15:28
Chipacamissed these somehow15:29
Chipacabah, i know how -- inbox 0 it isn't15:29
pedronisit's ok, I just thought your were pausing these and get back later15:29
pedronisthey have some comments from me15:29
jdstrandzyga: :(15:30
pedronisChipaca: yea, please close 766915:30
mupPR snapd#7302 closed: cmd/snap-confine: add support for parallel instances of classic snaps, global mount ns initialization <Created by bboozzoo> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/7302>15:33
jdstrandzyga: but boy, glad we thought to test before rolling out :)15:34
zygayes15:34
zygathank you!15:34
zygamvo: this remained unaddressed https://github.com/snapcore/snapd/pull/7302#discussion_r34117820315:34
mupPR #7302: cmd/snap-confine: add support for parallel instances of classic snaps, global mount ns initialization <Created by bboozzoo> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/7302>15:34
zygamvo: but I'll work with maciek to make it better15:34
mvozyga: ok15:36
mvozyga: yeah, its fine to enable during 2.43 lifetime in edge at least15:36
mvozyga: topic for monday and a detail in some way! thanks for the suggestion though15:36
zygastgraber: question about mount in lxd15:38
zygastgraber: lxd performs syscall interception for it now?15:38
zygastgraber: is there some logic that allows systemd inside the container to mount cgroups?15:38
stgraberIt will be able to in 3.1915:39
zygastgraber: or are cgroups mounted in some other way15:39
zygastgraber: the context is this:15:39
zygastgraber: snapd needs to mount a new cgroup hierarchy15:39
zygastgraber: a name=snapd one, with no controllers15:39
mvopedronis: 7438 is probably now also unblocked, but I leave this to you, your review list is very long so its fine if it gets dropped15:39
stgraberRight now we don't intercept anything15:39
zygastgraber: I see15:39
zygastgraber: I will explore more, I'm getting EPERM now but I'll check more why15:39
stgraberIt's just normal userns+mntns and the kernel allowing you mounting safe virtual filesystems15:39
pedronismvo: yea, don't think I will get to that one15:40
zygastgraber: does that include cgroups?15:40
stgrabercgroupfs is definitely one of those15:40
zygastgraber: I'm not experienced with userns15:40
zygaok15:40
zygaI see, thanks, I'll explore more interactively15:40
stgrabersystemd in the container handles mounting it so it has to be unprivileged15:40
* zyga is making progress15:44
mupPR snapd#7669 closed: snap, cmd/snap: support (but warn) deprecated multi-slash channel <Channels 🏷️> <Needs Samuele review> <Created by chipaca> <Closed by chipaca> <https://github.com/snapcore/snapd/pull/7669>15:44
pedronismvo: Chipaca: there is no progress bar in snap download ?15:45
Chipacapedronis: there is15:45
pedronisI'm not seeing it15:45
pedronisor it's only when is not direct ?15:45
Chipacapedronis: what are you running15:45
pedronisI'm running direct15:45
pedronisI'm running mvo 762415:46
mvopedronis: try a bigger snap15:46
mvopedronis: maybe core?15:46
mvopedronis: I did not see it for small snaps like test-snapd-tools myself15:46
mvopedronis: and then I did not implment one in the first iteration because I was blissfully unware of it :/15:46
Chipacaah you might not see it if there is no progress before it's done :)15:47
ijohnsonhey folks o/15:49
zygaijohnson: hey15:49
ijohnsonlots happening this morning it seems :-) anything in particular I can help with or review, etc. ?15:49
zygaijohnson: I think reviews are in demand15:50
zygaijohnson: mvo can point you the way15:50
ijohnsonit would appear so :-)15:50
mvoijohnson: 7652, 7696 would be good and 766515:52
ijohnsonmvo ack15:52
mvoijohnson: probably more, but this should keep you busy :)15:52
mvoijohnson: and *thank you*15:52
ijohnsonhappy to help :-) (also good to take a break from staring at why the chromium snap is slow)15:53
ograzyga, ubuntu-core-meta is the metapackage generated from the seed that is defining the package list ... should be owned by foundations nowadays (sorry, only just returned from IoT worldcongress and wasnt able to check IRC)15:54
ograzyga, i think sil2100 or vorlon own it now15:54
zygaogra: ah, so it's a real thing15:57
zygathank you15:57
pedronismvo: added a couple of comments to 7624, I removed the needs my review, I think is far along enough and shouldn't be blocked, but it will need a revisit at some point15:59
mvopedronis: cool, thank you!15:59
pedronismvo: the fallback to direct without sudo or auth works16:00
pedronismvo: as John said a bit more manual testing is probably in order16:00
mvopedronis: indeed, I also want to add some more unit tests16:00
* zyga breaks16:09
mupPR snapd#7717 opened: tests/docker-smoke: add minimal docker smoke test <Simple 😃> <Created by anonymouse64> <https://github.com/snapcore/snapd/pull/7717>16:23
ograzyga, well, the seeds surely are since we are using the osfficial build system now, not sure if the metapackage is actually needed, the build of core18 might just use the task which wouldnt require a metapackage anymore16:26
ogras/core18/core18 and onwards/16:27
=== grumboo is now known as grumble
Chipacapedronis: #7696 LGTM16:52
mupPR #7696: cmd/snap,image: initial support for Core 20 in prepare-image with test <Created by pedronis> <https://github.com/snapcore/snapd/pull/7696>16:52
pedronisChipaca: thanks, it has a bug though16:53
Chipacapedronis: I saw, about classic?16:53
pedronisyes16:53
Chipacapedronis: hm16:53
pedronisbecause of the moving of setting up the directory16:53
pedronisfrom the cmd_* to the image16:53
pedronisit got lost, and the unit test didn't notice16:53
pedronisI'll try to push a fix later tonight16:54
pedronisotherwise you or mvo should fix it next week16:54
Chipacapedronis: no probs16:54
Chipacapedronis: lots of spread tests caught it instead :)16:54
pedronisChipaca: basically  for core  we create PrepareDir/image and use it as root16:54
pedronisthat's correct16:54
pedronisChipaca: for classic PrepareDir is really the root dir already16:55
pedronisso no /image should be added there16:55
* Chipaca nods16:55
pedronisand boot stuff is not relevant for classic anyway16:55
pedronisalso to be clear we don't have uc20 model/classic support yet16:56
pedronisclassic is uc 18/16 style seeds16:56
pedronisfor now16:56
diddledanhas snapd moved out of the core snap now?16:59
diddledanI installed a fresh ubuntu vm and then a snap that depends on core18 and I received snapd via the snapd snap instead of the core snap via autoinstall16:59
pedronisdiddledan: yes for fresh installs17:01
diddledanaah, only fresh installs. gotcha17:01
Chipacadiddledan: and only if the first snap you install doesn't use core :)17:12
pedronisdiddledan: we do plan to migrate old classic system (like at some point we migrated from ubuntu-core -> core), but it isn't enabled yet17:16
Chipacaijohnson: the spread tests on that pr also failed because if the image/ thing samuele mentioned, fwiw17:19
pedronis?17:19
pedronisonly my PR should be affected17:20
pedronisnow I'm confused17:20
Chipacapedronis: yep, talking about that17:20
pedronisah17:20
Chipacapedronis: ijohnson said, on your pr, “looks like the spread tests failed from some store 403s :-/”17:20
ijohnsonOh sorry I just saw that like 4 tests failed on 403s and assume the rest of them were from similar problems17:21
Chipacapedronis: so i thought before he restarts them maybe i should point out that at least some of them are genuine (enough that i didn't notice the 403 ones he mentions)17:21
ijohnsonI didn't restart them17:21
Chipacaijohnson: \o/ :)17:21
ijohnsonI assumed y'all wanted to look17:21
pedronisyea, I will fix later tonight17:21
ijohnsonCool beans17:21
pedronisChipaca: anything you need my input on?17:21
Chipacapedronis: oh, just everything17:22
Chipacapedronis: :-D17:22
Chipacapedronis: seriously, no17:22
pedronisjdstrand: thanks you for reviewing 765217:31
pedronisChipaca: ijohnson: I pushed a fix to 7696, spread should tell us if I got it right, but please double check it makes sense17:44
Chipacawill do17:44
ijohnsonAck17:44
* ijohnson lunches17:45
jdstrandpedronis: yw17:47
pedronisjdstrand: I might try to still apply the rest of your previous PR feedback and this one today17:49
* pedronis dinner17:50
Chipacapedronis: // Core 16/20,  writing for the writeable partion17:50
Chipaca16/18*17:50
Chipaca:)17:51
Chipacapedronis: buen provecho, and have a lovely holiday17:51
pedronisChipaca: oops17:51
Chipacapedronis: :)17:51
mupPR snapcraft#2787 closed: Safe grade <Created by sergiusens> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/2787>17:57
mupPR snapcraft#2788 opened: Release changelog for 3.9.1 <Created by sergiusens> <https://github.com/snapcore/snapcraft/pull/2788>18:00
* zyga returns18:26
vorlonogra, zyga: https://bugs.launchpad.net/ubuntu/+source/ubuntu-core-meta/+bug/1850538 - what is referencing ubuntu-core-meta?18:49
mupBug #1850538: Please remove ubuntu-core-meta from the archive <ubuntu-core-meta (Ubuntu):Fix Released> <https://launchpad.net/bugs/1850538>18:49
jdstrandpedronis: hey, I need to update the review-tools to understand (but not do anything with) slots-per-plug and plugs-per-slot and wanted to make sure about something.18:55
jdstrandpedronis: say the base decl has:18:55
jdstrandslots:18:55
jdstrand  foo:18:55
jdstrand    allow-connection: false18:55
jdstrandpe18:55
jdstrandpedronis: and the snap decl has:18:55
jdstrandslots:18:56
jdstrand  foo:18:56
jdstrand    allow-connection:18:56
jdstrand      slots-per-plug: 118:56
pedronisjdstrand: first of all you could warn or prohibit initially anything but18:57
pedronisallow-auto-connection:18:57
pedronis   slots-per-plugs: *18:57
pedronisbecause anything else will just end up being like the default18:57
pedronisso it's confusing/distracting18:57
pedronisbut your call18:57
jdstrandpedronis: sure18:57
pedroniswhat's the question here?18:57
pedronisthat rule in the snap decl18:57
pedronisis like  allow-connection: true18:58
jdstrandpedronis: yes, that is exactly what I thought and wanted to confirm18:58
pedronisand slot-per-plug will behind the scene be normalize away back to *18:58
pedronisin snapd18:59
pedronisfor this specific case18:59
jdstrandright. in the review-tools, I want the same evaluation rules as before. I'm only checking arity for syntax/etc18:59
jdstrandbut due to evaluation rules, in my scenario, I just wanted to double check the intent was allow-connection: true with the above19:00
pedronisyes19:00
jdstrandpedronis: ok, thanks. if you haven't started yet, enjoy your weekend :)19:00
jdstrandand week! :)19:00
pedronisthanks19:00
pedronisstill shepharding some last bits of PRs that I can19:01
* jdstrand nods19:01
pedronisjdstrand: I applied your feedback (except some bits that were more open ended)19:01
jdstrandcool, thanks :)19:03
* cachio afk19:05
ogravorlon, i think that was a core16 bug19:24
vorlonok, core+core16 still referenced ubuntu-core-meta yes19:24
ograhttps://launchpad.net/bugs/164614419:25
mupBug #1646144: ACLs to devices need to be supported in core  <Canonical System Image:Confirmed for pat-mcgowan> <Snappy:Fix Released by ogra> <ubuntu-core-meta (Ubuntu):Fix Committed by ogra> <https://launchpad.net/bugs/1646144>19:25
zygavorlon: I don't know what referenced it, I just noticed it being mentioned here19:25
ograzyga, ah, i thought you were referring to the line above your ping19:25
ogra(which was that bug it seems)19:25
cyphermoxok, so false alarm?19:26
ograalarm ?19:26
ograthere was no alarm, everything is good :)19:26
cyphermoxok; just making sure ;)19:27
=== heather is now known as hellsworth
mupPR snapcraft#2789 opened: tests: update the push and release tests for staging <Created by sergiusens> <https://github.com/snapcore/snapcraft/pull/2789>19:57
mupPR snapcraft#2790 opened: tests: skip spread tests for rust on s390x <Created by sergiusens> <https://github.com/snapcore/snapcraft/pull/2790>20:24
* zyga breaks20:39
zygano progress20:39
ads20000jdstrand My journal log is completely flooded with GNOME System Monitor snap denials on Ubuntu 19.04, what interface do I need to enable? `Nov 01 22:29:43 adam-thinkpad-t430 audit[11527]: AVC apparmor="DENIED" operation="open" profile="snap.gnome-system-monitor.gnome-system-monitor" name="/run/systemd/sessions/2"`22:31
ads20000I'm pretty sure this is System Monitor out-of-the-box (well, upgraded from previous Ubuntu versions) so perhaps a bit worrying that this has happened out-of-the-box?22:32
jdstrandads20000: yeah, that is on the list for policy updates PR queued for next week22:32
ads20000jdstrand: great, thanks! :)22:55

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!