[06:10] morning [06:27] good morning [06:36] zyga: hey [06:38] zyga: miserable weather, grey, dull, raining a bit :/ [06:51] mborzecki finally! :D [06:51] mborzecki it was sunny for too long [07:00] morning [07:00] pstolowski: hi [07:01] good morning pawel [07:01] pstolowski could you look at the fruit of your recent reviews please? [07:02] pstolowski https://github.com/snapcore/snapd/pull/9446 ! :) [07:02] zyga: hey, nice! i saw your tweet about it :) [07:02] hey pstolowski and zyga [07:02] will look at it for sure [07:02] hey mvo :) [07:02] mvo I will focus on the feedback I got from samuele today [07:02] mvo I would love if you could look at https://github.com/snapcore/snapd/pull/9446 [07:03] mvo it can still be in edge before the sprint :) [07:03] zyga: ok, let me look [07:06] mvo it's mostly questions and some code [07:06] but it could be in edge by Friday ;-) [07:06] just saying [07:07] mvo: docker-smoke is failing on 20.10, failure seems real [07:08] mvo: https://github.com/snapcore/snapd/pull/9155/checks?check_run_id=1189677047 [07:08] pedronis: uh, thanks, I have not seen this, will also look [07:08] might be aa3 related [07:09] strconv.Atoi: parsing "file": invalid syntax. [07:09] weird [07:09] we try to parse "file" as int [07:09] whatever that is [07:09] degville: mvo: different note, could you double check https://github.com/snapcore/snapd/pull/9424 looks [07:10] zyga: not sure it's us, it seems docker is trying to do that [07:10] ah, I see [07:10] ... 9424 looks good [07:11] pstolowski: could you look at my last commit in #9155 , I changed something ? [07:13] pedronis: sure [07:15] pedronis: sure [07:16] pedronis: looks good! good catch on the blank line. [07:17] pedronis: looks good (9424) - do you mind if I squash merge? then I will cherry pick into 2.47 [07:18] mvo: yea, it's fine, thanks [07:21] pedronis: thanks, merged and cherry picked [07:21] pedronis: docker failure looks real indeed, running a spread -debug now to see what is going on [07:22] zyga: 9446 is just 200 LOC ? woah [07:22] mvo: it's an early draft, but yeah [07:26] mvo: can you take a look at https://github.com/snapcore/snapd/pull/9439 ? it's super simple [07:28] zyga: first read - very very nice [07:28] mvo \o/ [07:28] mborzecki: sure [07:28] man those reviews make all the difference in world [07:28] lately all my code was "after core20" :-) [07:29] mvo: thanks! [07:31] zyga: but we are past this now - you are IMPORTANT again ;) [07:32] mborzecki: hm, I saw two failures of "snap sign" on arch, wonder if something changed there [07:32] * zyga installs macos update, afk for coffee [07:32] mborzecki: merged it anyway, I don't think your code broke this ;) [07:32] mvo: thanks, let me check the log [07:33] mvo: hmm, looks like another gpg problem [07:41] we need to spend some time understanding those problems, they are more frequent, and we never spent time understanding them [07:41] nothing immediate though [07:42] mborzecki: I reviewed #9440, it looks good, but I'm confused by how it keeps things working alone [07:42] (probably my confusion) [07:45] mborzecki: interesting that no unit test broke? [07:45] pedronis: you're right about that snippet, need to fix that [07:45] pstolowski: thanks for the review [07:46] pedronis: also, the observer does not respond with ChangeIgnore atm yet, so we're still keeping the behavior where managed assets are asked upfront when creating the updater [07:47] mborzecki: yea [07:48] pedronis: new behavior is in #9427 [07:48] hm mup didn't pick that up [07:48] mup: poke poke [07:49] pedronis: re docker> I suspect this happens because 20.10 has the new apparmor3 but the core snap has apparmor_parser2. i.e. the apparmor_parser(v2) from the core snap tries to read new apparmor.conf and does not understand it :/ [07:49] looks like it needs a poke from niemeyer [07:56] mvo oooh [08:02] mvo very problematic actually [08:02] zyga: yeah, makes my head hurt :( [08:02] zyga: I think we need to talk to security jamie about this [08:02] mvo: all sounded too easy [08:02] yes [08:02] it may seem we need apparmor 3 in core then? [08:02] * zyga reboots [08:02] core18 would have the same issue [08:03] ? [08:09] pedronis: updated #9442 [08:40] pstolowski: \o/ [08:46] jamesh reviewed [08:46] jamesh my main question there is the way we ask the store [08:46] is this agreed with pedronis? [08:48] zyga: the code in the PR is a translation of some stuff I was doing client side. There was some discussion on the forum about how to convert theme names to package names with some community feedback, but I don't think there was anything from the snapd side. [08:49] zyga: part of the idea was to keep the API relatively high level so it could be adapted to newer store query APIs if they become available [08:50] (e.g. a search query based on slot definitions) [08:50] I understand that API may be still far away, I'm mostly concerned about suitability of the implementation in the meanwhile, will the store load be acceptable? [08:50] if that's a yes, then I have no objections [08:51] zyga: I expect that for the majority of users it will result in zero load on the store [08:51] pedronis: updated https://github.com/snapcore/snapd/pull/9440 now [08:51] zyga: most users' themes are provided by gtk-common-themes, so a store lookup would be avoided [08:52] mmm, [08:52] jamesh what will trigger the search? I understand this is a new API that's not used yet [08:52] jamesh should we add provisions for avoiding searching on failures, e.g. to cap them at once a day or something [08:53] zyga: a daemon running in the user session. It will do one check on login, and any time the theme settings are altered [08:53] jamesh ok [08:53] I think we can introduce any kind of caching and rate-limiting there [08:54] anyway, have a look at the rest of the review, I think this was my main concern [08:54] the rest is trivial [08:54] thank you for going over it [09:01] my pleasure, all I need is a ping when my manager is looking at me ;-) [09:25] jamesh: is it using info or find logic ? [09:28] pedronis IIRC info [09:28] pedronis: it does full name based queries rather than pattern matching [09:37] it should be ok (at least for a first pass), but yes we could add caching/rate limit, or discuss with the store [09:37] otoh we should look into using the functionality that let us ask only for fields we really need [09:41] mwhudson: hey, is stripping go binaries safe these days? I saw some old discussions about this in 2016 and was wondering if there is anything new happening since? would be nice for snapd :) [09:41] mvo: should be fine yes [09:41] mwhudson: can we strip the line table? [09:41] pstolowski: in a follow we can teach Iter to take an optional SetID and use that it list, so we stop reading bits of snapshots to find the files of one [09:42] or anything else that is somewhat optional and inflates the binary size [09:42] mwhudson: nice, thank you [09:42] zyga: not sure, do you care about go tracebacks? [09:42] mwhudson not so much in that context [09:43] mwhudson: to be clear, size above all nice extras [09:43] zyga: can't actually remember what's in .gopclntab, it's been a while :) [09:43] pedronis: yes, indeed [09:43] some of the mapping tables are important [09:46] zyga: heh, I would say more measure and decide, we do care about fixing bugs and traceback might be useful [09:47] pedronis: we did measure, we are larger than the rest of the OS, we should figure out what we _can_ strip if possible [09:47] I agree in priciple but it's just "can we make go smaller" kind of thing [09:59] #9234 btw needs 2nd reviews [09:59] https://github.com/snapcore/snapd/pull/9234 [10:01] pstolowski: what's the status of #8395 ? [10:02] pedronis: hmm a bit forgotten tbh, let me merge master and see [10:03] pstolowski: mvo said some tests were failing, anyway not urgent but it would be good to land it before 2.49 [10:03] pedronis: yeah i'm going to check what's failing [10:04] ah just gomt i think [10:04] *gofmt [10:09] pstolowski: I merged my validation sets PR btw [10:11] ack, ty [10:36] * zyga would love a front-end for strace logs that can offer either time-correlated or independent view of various processes [10:36] one day, I will learn GUI programming and write that [10:36] pstolowski: #9442 can land I think? pstolowski, mvo: can we update #9036 with master then to use the changes pstolowski did? [10:38] ok merging, was waiting for tests [10:40] pedronis: sure thing! [10:46] pstolowski: should I take care of 9036 (merge master, deconflict?) [10:48] mvo: i can do it [10:49] pstolowski: either way is fine with me [10:49] pstolowski: so please go ahead, I will review once it's there. I added some review points last evening too that I failed to get to so far :/ [10:49] mvo: ok [11:04] anyone familiar with aliases in snap declarations? [11:05] is this correct? https://paste.ubuntu.com/p/9ZrpDYKGf9/ shouldn't the target be dotnet-sdk.dotnet? [11:05] pedronis: maybe you know ^^ this is from https://bugs.launchpad.net/snapd/+bug/1897984 [11:07] hm looking at the code the auto alias should be should be dotnet:dotnet i think [11:08] mborzecki perhaps the snap name is implicit [11:08] mvo: i've pushed just deconflict + trivial fix, will simplify now [11:09] zyga-mbp: hm the code looks for info.Apps[], maybe they had dotnet-sdk at some point, but there's no dotnet app [11:09] pstolowski: nice [11:09] zyga-mbp: i mean there's no dotnet-sdk app at this point, maybe it was there before [11:32] mborzecki: there shouldn't be a dot there [11:33] pedronis: so name: dotnet, target: dotnet (as the app name is `dotnet`) [11:34] yes [11:34] ack, left a note in the bug [11:34] maybe we should add some validation code [11:34] for this [11:35] pedronis: or a log at least, that the the auto alias does not reference a known app [11:35] no, I mean in the assertion parsing [11:39] mborzecki: sorry, there not dot problem, but they are pointing dotnet -> donet-sdk [11:40] instead of dotnet -> dotnet [11:40] pedronis: so this basically right? https://bugs.launchpad.net/snapd/+bug/1897984/comments/1 [11:41] yes [11:41] cool, thanks for double checking [11:42] this is a bit messy though, if they really had a dotnet-sdk before and not now [11:42] we can't make it work both ways [11:45] cmatsuoka: hi, can you take a look at https://github.com/snapcore/snapd/pull/9440 ? [11:45] mborzecki: sure, checking it [11:45] cmatsuoka: thanks! [11:59] mvo: re aa3> can you discuss with amurray? we have on our roadmap to vendor aa3 next cycle. also note, I've been running aa3 with snaps for weeks and weeks (but I don't use the docker snap). if it is an apparmor2 vs apparmor3 config file issue, the easiest thing would be to ship apparmor.conf from aa2 and use --config-file [11:59] mvo: jjohansen would also be able to help triage [12:01] mvo: that said, I don't see where snapd is shipping apparmor_parser so it should just use whatever is on the system and the system should have everything it needs? [12:01] oh, or is it the docker snap that is shipping it... [12:01] well, or using it from the base snap [12:01] the base snap does have it (for core) [12:02] but it would need interface support for that [12:02] jdstrand: so we have to meditate on this: [12:02] docker_support.go:/sbin/apparmor_parser ixr, [12:03] multipass_support.go:/sbin/apparmor_parser ixr, [12:03] multipass-support and docker-support... yes [12:04] it's also probably related to etc comes straight from host [12:04] yes [12:05] * jdstrand notices that core20 has apparmor_parser in /usr/sbin and those interfaces are broken [12:07] ok [12:07] this appears non-fatal [12:08] well, it depends on the core [12:09] jdstrand: would the user land v2 parser even work if not choking on the config with the rest of the system using aa3 ? [12:10] 'yes', if it can understand the policy [12:10] gimme a sec [12:10] mborzecki: I fixed the dotnet alias, can you try and comment in the places? afaict all the recent release revisons have dotnet as app, not dotnet-sdk [12:11] pedronis: sure [12:12] pedronis: thanks, it work snow, the alias was created [12:13] mborzecki: if they had current versions around with app dotnet-sdk and some with dotnet, atm we could have made only one of the two work [12:13] but if people are updated to what is on the channels it should work [12:14] /on the/in the/ [12:14] while this is not a solution, I really really think we need to plan a way out of shared /etc [12:14] it was a huge mistake, we should only share specific files, perhaps with a filter even === zyga_ is now known as zyga [12:15] zyga: yes, I would like to do that, but at this point is a 22 goal [12:15] (and maybe even that is optimistic) [12:15] as long as it's on the roadmap somewhere, I'm happy [12:15] well [12:16] I think we may have our hand forced at some point [12:21] pedronis and zyga (cc mvo and amurray): https://paste.ubuntu.com/p/d82JTRMdxz/ [12:22] I'm going to file a bug [12:27] pedronis and zyga (cc mvo and amurray): https://bugs.launchpad.net/snapd/+bug/1898038. I've assigned amurray for the moment, but if someone else is going to jump on it, please let him know [12:27] * jdstrand adds a 20.10 Ubuntu task too [12:29] thanks [12:29] stgraber: you might be interested in that bug too ^ (that said, I've been using lxd with apparmor3 for weeks and weeks and you seem ok) [12:32] amurray: we should update our test plan to include docker, lxd and multipass snaps [12:33] zyga: I commented on #7700 [12:34] mborzecki: done [12:34] cmatsuoka: thanks, let me land that and update the main branch [12:35] pstolowski: mvo: should I look myself at #9036 (snapshot import) or is it premature? [12:36] pedronis: 1 minute, i'm just finishing actual changes [12:36] so far only pushed deconflicting changes [12:38] amurray: note, snap-confine has facilities for this sort of thing, but the core snaps don't ship /etc/apparmor and /etc/apparmor.d currently, so they'll need to be adjust to not strip those out [12:38] * jdstrand steps away for a bit [12:39] pedronis: i pushed simplifications after changes in master. but this PR still needs more work to address all comments [12:40] * zyga lunch [12:42] pedronis thank you [12:47] pstolowski: made some small comments [12:49] pedronis: thanks! how do you feel about it overall? [12:50] mvo: I don't know, I mostly looked at backend [12:52] ok [13:56] * pstolowski lunch [14:16] mborzecki: I did a pass on #9443 [14:18] pedronis: thanks! [14:22] pstolowski: how annoying would be to split the import PR into two ? (overlord/snapshotstate and the rest) it's not very big but it touches a lot files [14:26] pedronis, pstolowski I can do that if it helps you, I can do the api bits maybe first? those look ok [14:26] (to me9 [14:30] it would help a little bit my reviewing [14:34] pedronis: sure, let me do this now, we may lose a bit of history unless I cherry pick stuff which will be super messy [14:49] Saviq: fyi, you are likely affected by https://bugs.launchpad.net/snapd/+bug/1898038. see backscroll starting ~2.5 hours ago [14:50] mvo, pedronis sorry, had a late lunch. sounds good. i'll focus on addressing the comments to backend part [14:51] pstolowski: thank you! [14:51] zyga: do you need anything from me? [14:51] pedronis: I pushed 9450 [14:51] mvo: a review on the notification thing would be great [14:51] mvo: nothing else from the top of my head [14:52] zyga: the one that actually sents the notifications (i.e. the latest one?) [14:52] yes [14:58] cachio I did a pass through most or all of your PRs [14:58] zyga, thanks!! [14:58] I'll take a look now [14:59] hey folks [14:59] * ijohnson is back finally [15:01] mvo: jdstrand: sounds like docker on groovy stuff got sorted out and triaged at least ? [15:01] ijohnson: I think we have a life jacket at least [15:01] that's nice [15:02] btw do layouts to put things from $SNAP onto /etc/... work ? [15:02] ijohnson we should plan something more oomhpy over time and there are some proposals (bundle aa with snapd, stop using host's /etc, fix immediately with mount profiles when aa-capable interfaces are connected) [15:02] last time I tried that it didn't work because snap-update-ns died saying that trying to do the specified layout would modify the host [15:02] but maybe I was doing something else wrong [15:02] ijohnson: we can do better, each interface that can use apparmor_parser could result in hiding real /etc/apparmor* [15:02] zyga: yes that makes sense [15:03] * zyga stops coding now, stops reviewing, need to take a break and work with the kids a little [15:03] I'll be back late to iterate on my own PRs a little [15:03] ijohnson: layouts were designed to handle /etc... the idea is that the snap could ship its own /etc/apparmor and /etc/apparmor.d and then have a layout for it [15:04] ijohnson: that is the escape hatch to unbreak things without snapd changes. snapd can do better though. and yes, it is triaged [15:04] (and assigned) [15:04] ijohnson: hello btw :) [15:05] * jdstrand wouldn't mind jumping on this himself... [15:05] hi :-) [15:05] [15:05] jdstrand what do you think about the idea I mentioned? [15:05] yeah I udnerstand that layouts are supposed to work on /etc, I just seem to remember some problem with them on /etc but perhaps I am mistaken [15:05] ijohnson it IS a problem because etc is unpredictable [15:05] if a distribution provides /etc/apparmor -> /etc/apparmor-2.0 symlink [15:05] we are broken [15:06] it's not a nice solution to force this on snap authors IMO [15:06] no [15:06] that isn't the solution [15:06] zyga: ah right I think that was what I hit, is that something on my host /etc/ was interfering with setting up the mimic [15:06] that is just if the publisher insists on unbreaking themselves before the solution is in place [15:06] ah, I misunderstood then [15:07] yes, the publisher has an escape hatch as well [15:08] zyga: doing it in the interface could be nice since only two interfaces need this behavior. the interface code also understands what base is in use and can mount the correct one [15:08] yeah [15:08] zyga: perhaps add a comment to the bug how you think this might work for amurray? [15:08] and it's more open than a layout (which is by design more constrained) [15:08] jdstrand I did :) [15:09] ah [15:09] * jdstrand reads [15:09] well, terse but so :) [15:15] * zyga EPDs [15:17] EODs even [15:17] * cachio lunch [15:27] zyga: ok, commented in the bug. enjoy your evening [15:45] mvo: I reviewed #9450 [15:49] pedronis: thanks! working through it right now [15:49] pstolowski: please push any WIP for the import pr before you EOD, I can pick up from that then :) [15:52] mvo: ok, i addressed the couple of minor points, but the big one is comparing hashes, pondering about that now [15:52] s/the/a/ [15:54] pstolowski: to be clear, that probanly can be/should be its own PR [15:55] but I didn't want us to forget about it [15:55] pedronis: ah, ok, thanks [15:55] at least you can put a TODO in that fuction? is it even the place where we would do this? [16:00] pstolowski, pedronis thanks, +1 for followup [16:01] pedronis: looking at /v2/snapshots right now, I think that's what I will do [16:01] mvo: pedronis do we want to verify hashes at // XXX: check the snapshot hashes or in a followupt oo [16:01] *too [16:02] pstolowski: that sounds like something we should to be sure the thing wasn't corrupted? [16:03] pedronis: indeed, mostly asking if we want it in this PR or followup [16:03] pstolowski: we have code for check-snapshot, maybe some part of it can be reused [16:03] not sure [16:03] yes [16:03] checkOne [16:03] actually, Check [16:05] pedronis: do you have a recommendation for the content-type? application/snapd-snapshot-v1 ? or too outlandish? versioning seems to be uncommon :/ [16:08] it would helped if Iter() wasn't assuming dirs.SnapshotsDir but again it probably should be a prerequisite (down a rabbit hole ;)) [16:11] hmm, maybe not neccessary [16:13] pedronis: thanks, just saw your updated review! I will address after I made dinner for the kids [16:13] pedronis: I pushed a stawman for the content-type too now please comment in the PR :) [16:13] mvo: yea, I looked at what save does [16:13] * mvo needs to vanish for ~45min or so [16:18] done [17:11] mvo: pushed a few more changes [17:13] mvo: added Check() and a very rudimentary test for it.. would love to have a good test, but it's tricky. i may take a look at it tomorrow with clear head [17:17] mvo: I changed my thinking slightly: https://github.com/snapcore/snapd/pull/9450#discussion_r498399310 to be consistent with the design as it was discussed [17:51] pedronis: yeah, noticed and update [18:04] mvo: I made another comment (but maybe I'm confused), anyway I don't think #9450 needs my +1 at this point, my main concern were addressed, but I don't think I'm up to do a final close review right now [18:08] if I'm making sense [18:25] pedronis: sure, that's fine [18:25] pedronis: I will ask the others tomorrow to review the details, thanks a bunch! [18:32] pedronis: got a second for quick question on how to set a client.Client config option for cmd/snap ? I want to specify a Timeout to the http.Client we use for our snapd client.Client, because currently there is not one, but I only need it for the console-conf routine command, not for every command in snap [18:32] pedronis: I was thinking about just tearing out the existing client from my Execute() and recreating a client, but that seems fragile and wrong [18:34] or maybe it's okay to have a reasonable Timeout for all snap commands [19:12] ijohnson: there is kind of a timeout for all client requests, no? [19:13] pedronis I don't see an http.Client Timeout set for the client that we use from clientMixIn [19:13] Maybe I'm reading the wrong code [19:14] ijohnson: no, but client itself sets up a timeout via context, for everything except things that use client.raw directly [19:14] Ah right I forgot about contexts timeout [19:15] * ijohnson goes to go look at that [19:15] do uses doTimeout which goes into rawWithTimeout [19:15] I mean client.do [19:15] Client.do [19:15] in client/client.go [19:16] pedronis yes I see that now [19:16] I was just looking at client.Config [19:17] it's fixed [19:17] except some things mostly dealing with downloading blobs from snapd don't use it [19:17] downloading or uploading [19:18] Okay I think I just need to modify my call to Do() to use a different shorter timeout then [19:19] Probably I could just call rawWithTimeout [19:22] yes, most of the code in do seems only relevant for GET, plus the decoding but that is an helper as well, so you could call it yourself [19:23] but doSync does a bit more [19:24] this code honestly seems to need a cleanup, I think it was meant to be very standardized [19:24] but now we have grown different variant, and there's a bit of mix between params vs variants [19:24] to ask for different behavior [19:29] yes there's a few different ways to do subtly different versions of the same thing it seems [19:30] yes [19:32] like NoTimeout is weird [19:33] I'm beginning to wonder if there's any part of our codebase that hasn't grown organically like this [19:34] it's natural, but is also necessary to clean up once in a while [19:34] this one seems particularly bad though [19:34] I don't think it has deep reasons to be like [19:34] except to avoid changing call points [19:34] but all call points are inside client anyway [19:36] Right [19:41] it's even worse, some places do raw but set their own timeout [19:41] :/ [19:46] :-( [19:54] I thing they preexist rawWithTimeout but anyway :/ [20:35] ijohnson: I cleaned it up a bit [20:37] pedronis thanks for that [20:38] ijohnson: you were doing doSync right? [20:39] pedronis yes I was using doSync originally [20:39] yea, now there's a doSync variant that can be passed a specific timeout [20:40] Great thanks [20:40] mup seems to be mia [20:44] ijohnson: here: https://github.com/snapcore/snapd/pull/9454 if you could look at it and maybe pick it up tomorrow, it could use some tests, it's mostly a refactor but there are some changes to do, tbh lots of the new stuff didn't seem tested yet [20:44] pedronis: sure I am going to work a bit extra tonight to make up for starting late today so I can try to clean that up [20:45] also hoping to get my first pr for the maintenance.json stuff up that is related to here [20:59] maybe that was confusing: it's mostly a refactor but there are some changes to the "do" method