=== KindTwo is now known as KindOne === KindTwo is now known as KindOne === KindTwo is now known as KindOne [05:12] morning [06:03] mvo: hi, there's a typo in https://github.com/snapcore/snapd/pull/8822 that static checks choke on [06:03] PR #8822: release: 2.45.1 [06:05] mborzecki: meh, ok [06:05] mborzecki: thank you, will fix [06:12] hey guys [06:29] zyga: hey [06:29] hey [06:29] zyga: how is your back? [06:29] thinking about how to say it [06:29] f*** uP? [06:30] not good for sure [06:31] zyga: sad to hear that [06:39] hey zyga - good morning [06:39] hey mvo [07:03] morning [07:09] hey pstolowski - good morning [07:23] PR snapd#8804 closed: tests: port xdg-settings test to tests.session [07:23] PR snapd#8815 closed: tests: port snap-handle-link test to tests.session [07:32] thanks mvo! [07:32] zyga: thank *you* [07:40] mvo: MRI on Wednesday at 15:00 [07:40] so before then I'm working from bed [07:41] zyga: ok [07:43] PR snapd#8825 opened: tests: move a few more tests to snapstate_install_test [07:44] https://github.com/snapcore/snapd/pull/8826 [07:44] PR #8826: tests: assorted small patches [07:47] pstolowski: +1 [07:48] heh [07:48] PR snapd#8826 opened: tests: assorted small patches [07:48] I've seen so many tasks that never get a ping back from travis [07:48] mvo: perhaps it is time to drop travis from the "required" list? [07:49] the only thing left is the CLA check [07:50] zyga: ty! [07:50] zyga: I guess we could remove it totally, yes? [07:51] mvo: I would keep it for a while because IIRC mborzecki wanted to do some changes to the CLA checker [07:51] anyone remember whether time-control only works if you use timedatectl? [07:51] and having a 2nd guess would be better [07:51] mborzecki: as in the interface? [07:51] mborzecki: let me look [07:52] mborzecki: it's literally defined as such but perhaps that's a bit too tight [07:53] mborzecki: what kind of extra permissions do you think it should grant? [07:54] zyga: there's https://forum.snapcraft.io/t/access-to-bin-date-in-strict-confinement/18041 but the reporter gets EPERM (so likely not caused by AA) [07:55] mmm [07:55] how does date set time [07:55] clock_settime or something like that? [07:55] zyga: strace tells met it's clock_settime [07:56] so a seccomp filter is probably what needs changing [07:56] IMO it's sensible [07:56] yup [07:57] ok, let me open a PR and mark it for security review [07:58] thanks [07:58] maybe tweak the spread test in the PR as well [07:58] I think we have one [08:20] mvo: there was a question about https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1881350 and release to groovy [08:20] Bug #1881350: snap seeding fails with libc6-lse [08:20] do you think it's better to do 2.45.1 or just a distro patch? [08:23] pstolowski: mborzecki: hi, when you have time, could you re-review #8702 (it follows my suggestions, I think, now) [08:23] PR #8702: overlord/configstate: add system.kernel.printk.console-loglevel option [08:23] pedronis: sure, will do [08:23] pedronis: sure [08:23] thx [08:23] zyga: I uploaded to groovy already [08:24] ah, fantastic [08:24] zyga: and it's there already (i.e. autopkgtest passed) [09:10] mvo: my daughter doesn't recognize me :) [09:10] mvo: she's scared when she sees me now [09:11] zyga: haha - oh boy [09:11] zyga: but you *do look different' [09:12] zyga: shaved your beard? [09:12] yep [09:19] so we no longer poke jamie, but rather set 'needs security review' tag? [09:20] zyga: https://github.com/snapcore/snapd/pull/8827 [09:20] PR #8827: interfaces/builtin/time-control: allow POSIX clock API [09:20] mborzecki: yes [09:21] done [09:21] mborzecki: any weird things happen when you change the time? [09:21] perhaps that test should be invoked via a time namespace? [09:22] just to make sure it affects the system less [09:24] PR snapd#8827 opened: interfaces/builtin/time-control: allow POSIX clock API [09:24] zyga: it gets restored in the test, the ntp should slowly update the clock [09:24] zyga: btw. do any of the systems have a kernel that supports time ns already? [09:24] mborzecki: yeah, I think 20.04+ should be fine [09:24] iirc it's in 5.6 [09:24] it was a added a while ago [09:24] or maybe I read the patch a while ago :D [09:25] it's automatically a part of new uts ns right? [09:26] mborzecki: mmh, that PR is not using the file I thought it should use [09:27] mborzecki: no, I don’t think it is [09:27] pedronis: 99-snapd.conf? [09:27] Uts is a separate ns [09:27] mborzecki: yes, actually the code is confusing [09:27] why is it mentioning 10-console-messages.conf [09:27] I see it has both [09:28] I asked a question there now [09:28] zyga: https://kernelnewbies.org/Linux_5.6#Time_Namespaces hmm my version if unshare is unaware of CLONE_NEWTIME [09:29] mborzecki: I'm not sure why it bothers with 10-console-messages.conf at al [09:29] it should just write an empty 99-snapd.conf, no? [09:29] or remove it [09:29] pedronis: aiui it reloads the old/default setting [09:29] so it's applied now, rather than on the next reboot [09:32] I see, feels fragile [09:32] maybe we should just sysctl --system all the time [09:33] if there's a change [09:34] mborzecki: I commented about that [09:34] pedronis: hm yes, that's an option, i think one could argue if you tweak something at runtime, it could get overwritten [09:36] mvo: what's the state of this: https://bugs.launchpad.net/snapd/+bug/1867415 ? [09:36] Bug #1867415: Hardlinking snaps wastes 400 MB tmpfs RAM in live CDs [09:39] pedronis: this is fixed, let me update the bug [09:40] pedronis: oh, let me see, someone claims it's not [09:40] mvo: yes, exactly, that's why I'm asking [09:40] pedronis: I will try to reproduce now [09:41] * mvo is downloading [09:54] PR snapd#8828 opened: tests: clean up up the use of configcoreSuite in the configcore tests [09:56] tianon, hey, are all interfaces used by the docker snap actually needed? I was looking into a way to restrict what the snap can do [09:56] is the store under load? [09:56] error: cannot get snap sections: cannot sections: got unexpected HTTP status code 403 via GET to "https://api.snapcraft.io/api/v1/snaps/sections" [09:57] pedronis, mborzecki: tracking broken out as a separate PR https://github.com/snapcore/snapd/pull/8829 [09:57] PR #8829: sandbox/cgroup: add tracking helpers [09:58] I chose to bundle ConfirmSystemdServiceTracking in the same PR as that function itself is tiny and completes the picture as to how this is meant to be used [09:58] this is half of the large PR now and contains really just the logic to create a transient scope, along with unit tests [09:58] I didn't add the spread tests as those would pull in virtually everything from the original [09:59] PR snapd#8829 opened: sandbox/cgroup: add tracking helpers [10:01] the design was reviewed by jamie and he gave a +1 on the original PR [10:03] zyga: mvo: this has a lot of back and forth by you but no priority or status != new: https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1873004 [10:03] Bug #1873004: lxd interaction blocked until snapd was restarted [10:04] pedronis: yes, I think this is a duplicate of an existing issue that was investigated but not fixed earlier [10:04] pedronis: I will look at launchpad to find the other report [10:04] pedronis: it _looks_ like snapd starts before we mount snaps, and if core is mounted after snapd, this will happen [10:04] (no interfaces) [10:05] ah wait [10:05] wrong bug [10:05] oh, is that a dupe of the one andy had on friday ? [10:05] I looked at the other tap [10:05] *tab [10:05] no no, sorry let me read the correct link [10:06] hmm [10:10] hmm [10:11] mvo: I don't have any more ideas for that bug [10:12] the frequency seems to suggest it is related to core reloading [10:12] er, refreshing [10:18] mborzecki: bit confused by the rename to UpdateBootScript, not sure how it helps with confusion with InstallBootConfig [10:29] * zyga prepares the next segment [10:38] * zyga takes a break from writing and reads https://github.com/snapcore/snapd/pull/8675/files [10:38] PR #8675: osutil: add disks pkg for associating mountpoints with disks/partitions [10:44] pedronis: i'm thinking about https://github.com/snapcore/snapd/pull/8775#discussion_r434505499 bot end up named grub.cfg, so maybe grub.cfg and recovery/grub.cfg? [10:44] PR #8775: [RFC] bootloader, boot: boot scripts, edition <⛔ Blocked> [10:45] mborzecki: should we have a chat before the standup about the grub scripts? [10:45] pedronis: now or later? [10:46] mborzecki: can do in 5 min? [10:46] pedronis: sounds fine [10:53] mborzecki: going to the standup [10:54] * mvo hugs pstolowski for 8828 [11:14] mvo: thanks for the review & suggestions! [11:21] * zyga needs a break [11:21] man, you have kids and they are at home [11:21] but when *everyone* just comes to the same room [11:21] and the dog too [11:21] and then everyone starts moving [11:21] it's a bit too much [11:34] zyga: I commented/asked some question in #8573 [11:34] PR #8573: overlord/snapstate: inhibit startup while unlinked [11:39] PR snapd#8830 opened: bootloader: introduce bootloarder assets, import grub.cfg with an edition marker [11:43] Thank you! [11:44] PR snapd#8831 opened: tests: use configcoreSuite in journalSuite and remove some duplicated code [11:53] pstolowski: I did a pass on #8812 [11:53] PR #8812: o/snapstate: service-control task handler (4/N) [11:53] pedronis: great, thank you! [11:53] some high-level questions/comments [11:54] PR snapd#8722 closed: tests: check that host settings like hostname are settable on core [11:57] zyga: does #8829 need a security review? [11:57] PR #8829: sandbox/cgroup: add tracking helpers [11:57] pedronis: I think jamie could indicate if he needs to review it again but my understanding it he gave this a +1 already [11:57] if he has the time for a quick look to decide if a deeper look is necessary [11:57] that would be okay [11:57] jdstrand: ^ [11:59] PR snapd#8832 opened: travis.yml: removed, all our checks run in GH actions now [12:11] is it possible to try core20 out without updating kernel or its a no go [12:12] i set the gadget to use 20 and left the kernel snap 4.4.x (core16 kernel) i guess its normal that i cant use to build an image this way [12:22] clmsy: core20 needs a new model assertion syntax and new initramfs, because of the latter an old kernel will not work as is === mbriza2 is now known as mbriza [12:27] thx pedronis! [12:34] popey, gitea just exploded in my face ... seems it sets a versioned SNAP_USER_DATA everywhere in its app.ini instead of using the /current link so after an update it cant access its data anymore ... [12:37] (fixing app.ini manually to use the symlink everywhere foxes the app and it starts again) [12:37] *fixes [12:43] uh [12:53] zyga: dbusutil/dbustest/stug.bo needs a blankline before package atm the copyright is the doc comment of the package [12:53] ah, thanks [12:53] I didn't check that [12:54] I have a check, but it's a bit hacky, maybe we should add to run-checks anyway [12:54] mborzecki: I did a pass on #8830, mostly naming [12:54] PR #8830: bootloader: introduce bootloarder assets, import grub.cfg with an edition marker [12:54] pedronis: thanks! [13:22] ogra i am on vacation, do feel free to provide feedback upstream (which publishes the snap) [13:25] PR snapd#8833 opened: sandbox/cgroup: remove redundant pathOfProcPidCgroup [13:27] popey, will do, thanks ... enjoy your vac. [13:30] PR snapd#8834 opened: dbusutil/dbustest: add separate license from package [13:40] mvo, I created a PR for skip [13:40] #8835 [13:40] PR #8835: POC: skip binary to stip tests in an easy way <⛔ Blocked> [13:41] cachio: thank you! looking now [13:41] mvo, this is to address this https://github.com/snapcore/spread/pull/72 [13:41] PR spread#72: Run condition [13:43] pedronis: cmatsuoka: i can take a look at making some of the exported gadget code private tomorrow morning [13:44] the updaters, device lookup, filesystem image cuold all be private [13:45] PR snapd#8835 opened: POC: skip binary to stip tests in an easy way <⛔ Blocked> [13:45] we did not agree on what to do with the code what was introduced for the tool that could build images, or did we? [13:45] mborzecki: ack, thanks! [13:46] PR snapcraft#3164 closed: cli: remove enable-ci command [14:00] PR snapd#8836 opened: sandbox/cgroup: add tests for ParsePids [14:19] hmmm [14:19] not that many spread tests are in flight [14:19] mvo: I wonder if it would help if we also ran unit tests in self-hosted runners [14:20] after all, the worker is really mostly idle apart from waiting for network IO from spread [14:20] zyga: works for me [14:20] mvo: I somewhat worry about RAM usage though, not sure how much our test suite takes [14:20] * zyga checks [14:20] mvo: I'll experiment with some PRs later [14:21] mvo: I think now we're waiting for unit tests to pass to run spread and have more spread capacity than unit test capacity [14:21] zyga: yeah, makes sense [14:22] hmm, actually, my view was stale 32 spread jobs in flight [14:22] so perhaps that would not win much [14:22] exactly at capacity [14:41] * zyga breaks for lunch [14:44] mborzecki: I commented on the name of the assets get function again [14:49] nice, i like assets.Internal [14:50] PR snapd#8398 closed: usersession/userd: add "slack" to the white list of URL schemes handled by xdg-open [14:50] PR snapd#8800 closed: usersession/userd: add "slack" to the white list of URL schemes handled by xdg-open - 2.45 [14:56] mborzecki: what is the word "edition" used for, is it like "version"? [14:57] zyga: yeah, in the same feel as edition in gadget.yaml [14:57] ah [14:57] I forgot we have that [15:07] zyga: what versions of opensuse would you say are supported by snapd? [15:07] 15.1 and tumbleweed [15:07] but .45 is not out there yet as I had issues with auth [15:08] (the package is ready for a while, I just need to return to it) [15:09] zyga: with PR 8829, is that broken out from PR 7825 unmodified? if so and you didn't change anything (significant, ie, algorithm or implementation-wise) in this part of the code, then I don't need to re-review [15:09] PR #8829: sandbox/cgroup: add tracking helpers [15:09] PR #7825: many: use transient scope for tracking apps and hooks

[15:09] jdstrand: there are way more tests [15:09] tests are great :) [15:09] others can review those [15:10] variable renames, equivalent/simple refactoring, also not needed in this go code [15:10] jdstrand: and there's a new helper that checks for the cgroup of a service (using an existing helper but technically the function is new) - it is on line https://github.com/snapcore/snapd/pull/8829/files#diff-4706d268ffa8aa3999d09cac05b3ced2R110 [15:10] PR #8829: sandbox/cgroup: add tracking helpers [15:10] s/not needed/don't need a security review/ [15:11] you may want to eye that if you want, I included it here because in all cases we call either the new CreateTransientScope or the new ConfirmSystemdServiceTracking [15:11] that function is fine and using a reviewed-already api [15:11] zyga: well, if you feel that my cursory glance missed something and you want me to review, please add the needs security review tag [15:12] jdstrand: I think this is okay, I really don't think there's anything security related here [15:12] and there's no new design [15:12] just broken out code [15:12] tests [15:12] and some moving around to different packages to fit the structure better [15:12] yeah, that is what it looked like [15:13] I mean, yes, we need to have the design and code for this feature reviewed, but we did that extensively in PR 7825 [15:13] PR #7825: many: use transient scope for tracking apps and hooks

[15:13] yes, this is my understanding as well [15:35] mborzecki: https://github.com/snapcore/snapd/pull/8830#pullrequestreview-426362895 [15:35] PR #8830: bootloader: introduce bootloarder assets, import grub.cfg with an edition marker [15:40] man I was up for like 30 seconds [15:40] and it hurts for a few minutes now [15:41] ouch zyga :( [15:41] yeah, this is not a good time [15:41] PR snapcraft#3162 closed: tests: remove scenario usage from lifecycle order [15:41] PR snapcraft#3163 closed: cli: remove the hidden inspect command [15:45] * cachio lunch === KindTwo is now known as KindOne [16:05] zyga: I wrote a quick mail about /usr/lib/snapd [16:05] pedronis: checking [16:08] pedronis: I like this a lot [16:08] let me think a little about it and draft something for tomorrow [16:21] * zyga goes to rest for a while, putting the laptop away [16:30] PR snapd#8827 closed: interfaces/builtin/time-control: allow POSIX clock API [16:35] anyone else seeing snaps unstable on travis today? I'm getting a lot of failed lxd snap installs… [16:42] abeato: I guess that depends on what you want to "lock down" -- "privileged", "home", and "removable-media" are definitely optional, but the others are all related to core functionality of Docker you'd have to go out of your way to not use IIRC [16:43] Saviq: we actually moved away from travis *today* [16:43] tianon, I actually tried removing "privileged", but get into some problems when starting dockerd [16:44] it was some permission for sysfs [16:44]