Skip to content

Synchronize fips with master - #17686

Open
github-actions[bot] wants to merge 23 commits into
fipsfrom
sync-master-to-fips
Open

Synchronize fips with master#17686
github-actions[bot] wants to merge 23 commits into
fipsfrom
sync-master-to-fips

Conversation

@github-actions

@github-actions github-actions Bot commented Sep 21, 2026

Copy link
Copy Markdown

Synchronize fips with master, using snapcraft-fips.yaml from master as snapcraft.yaml. Merge using "Create a merge commit".

zyga and others added 2 commits September 21, 2026 14:25
@zyga
image-garden: replace opensuse {selinux,apparmor} hack
e9f0fd7 
For several releases image-garden has had support for defining instances
of well-known systems, so that they can be coupled with different
cloud-init profiles and act like independent systems with independent
images.

Replace the hand-copied build rules from .image-garden.mk with an
instance and remap the image name (garden uses @ for instance names)
with "-" for compatiblity with existing system name in spread.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
@pedronis
AGENTS.md,i/builtin/README.md: streamline AGENTS.md and move some con…
ed716e0 
…tent to i/builtin/README.md plus new intro there (#17645)

* .github: move agent instructions to AGENTS.md

drop copilot-instructions.md

see https://agents.md, only claude seem to need its own file potentially

* AGENTS.md,i/builtin/README.md: refine agent and interface guidance

* i/builtin/README.md: add introduction/context

* i/builtin/README.md: further clarifications

* AGENTS.md: incorporate feedback and slim down

Thanks to @bboozzoo and @andrewphelpsj for their feedback.
@sergiocazzolato
tests: split tests executions by scenarios in test-predictor (#17688)
f7ff377 
We need to clean the test predictor results in the nightly report by
removing other scenarios. Currently all the executions are being saved
with the same scenario.
@Mohit-Chachada
o/snapstate, store: cancel context on shutdown for catalog refresh (#…
e2b12a9 
…17626)

* Daemon.Stop -> Overlord.ShutDown -> SnapManager.ShutDown -> catalogRefresh.ShutDown which now cancels the context passed to catalogRefresh's Store requests running in catalogRefresh.Ensure
* Fix to correctly passthrough the provided context in Store.Sections 

Fixes [LP#2165972](https://bugs.launchpad.net/snapd/+bug/2165972). Thanks @Rnfudge02 and @jonathan-conder for validating the fix.

[SNAPDENG-37449](https://warthogs.atlassian.net/browse/SNAPDENG-37449)
@ZeyadYasser
systemd: read NOTIFY_SOCKET once and reuse socket connection (#17568)
1a3b0aa 
* systemd: read NOTIFY_SOCKET once and reuse socket connection

- NOTIFY_SOCKET env var should be read at the start and then
  unset, other packages should consult the systemd package
  for the value.
- Keep sdnotify socket connection open no need to open a new
  connection for each request, only retry connection on failure.

Signed-off-by: Zeyad Gouda <zeyad.gouda@canonical.com>

* systemd: address review comments

Signed-off-by: Zeyad Gouda <zeyad.gouda@canonical.com>

* system: address review comments

Signed-off-by: Zeyad Gouda <zeyad.gouda@canonical.com>

* systemd: address review comments

Signed-off-by: Zeyad Gouda <zeyad.gouda@canonical.com>

* cmd/snapd/cli: set NOTIFY_SOCKET for "snap run"

snap services of type "notify" with a connected daemon-notify
plug need the NOTIFY_SOCKET env var which is unset on init
by the systemd package. This adds it back to the running
snap enviornment variables.

Signed-off-by: Zeyad Gouda <zeyad.gouda@canonical.com>

* Revert "cmd/snapd/cli: set NOTIFY_SOCKET for "snap run""

This reverts commit e0e289e.

* many: only read/unset NOTIFY_SOCKET on daemon init

snap services of type "notify" with a connected daemon-notify
plug need the NOTIFY_SOCKET env var which was unset on init
by the systemd package. This changes init to be explicitly
called from the daemon init.

Signed-off-by: Zeyad Gouda <zeyad.gouda@canonical.com>

* many: address review comments

Signed-off-by: Zeyad Gouda <zeyad.gouda@canonical.com>

* systemd: return an error if notify socket is not initialized or unset

Signed-off-by: Zeyad Gouda <zeyad.gouda@canonical.com>

* cmd/snapd/daemon: add unit test

Signed-off-by: Zeyad Gouda <zeyad.gouda@canonical.com>

* systemd: remove unnecessary lock in tests

Signed-off-by: Zeyad Gouda <zeyad.gouda@canonical.com>

---------

Signed-off-by: Zeyad Gouda <zeyad.gouda@canonical.com>
@ernestl
many: resolve uc tracks (#17632)
f6055e2 
* asserts,snap/uctrack: resolve Ubuntu Core tracks

Restore uctrack.Resolve to remap a planned snapd channel from the
ubuntu-core-tracks map, using the model's core boot base version.

* snap/uctrack: improve comments
@ernestl
many: add system snapd standby security logging (#17628)
1b082ca 
* many: add system snapd standby security logging

Emit a SYS sys_standby_snapd event from Daemon.Stop immediately before
a completed socket-activation standby, matching the landed restart event.

* tests/main/security-logging: add simple standby test

* tests/main/security-logging: fix issue relating to 16.04 version of systemd
@andrewphelpsj
daemon: use apparmor label for pid to snap name mapping (#17649)
1f194f6 
* s/apparmor: export function to lookup label from pid

* daemon: prefer apparmor label for pid to snap name mapping

Also, attach the security tag to the context for use by other
subsystems.

* daemon: only try for apparmor label if apparmor is supported by the kernel
@sergiocazzolato
tests: new repack-kernel and core-initrd tools (#17580)
5fcaf11 
* tests: new repack-kernel and core-initrd tools

Main changes: Replace ad hoc shell helpers with
tests/lib/tools/repack-kernel and tests/lib/tools/core-initrd, and
migrate test/setup callers to the new explicit tool interface. Remove
the old sourced initramfs helper and centralize kernel repack,
corruption, metadata rewrite, and initramfs rebuild logic.

* fix shellcheck error SC2010

* remove repack-kernel tool from snapd-testing-tools

* fix muinstaller-real test

* repack-kernel updated to reduce functions complexity <= 10

Function	CCN
parse_value_arg	10
uc20_build_initramfs_kernel_snap_local	10
validate_args	8
uc24_build_initramfs_kernel_snap_local	8
run_mode	8
main	8
parse_args	6
validate_initramfs_args	5
build_corrupt_kernel_snap_local	5
validate_corrupt_args	4
run_initramfs_mode	4
validate_rewrite_metadata_args	3
uc_write_bootstrap_wrapper_local	3
uc20_inject_kernel_panic_local	3
validate_prepare_args	2
validate_nested_args	2
validate_download_args	2
run_corrupt_mode	2
run_download_mode	2
run_rewrite_metadata_mode	2
show_help	1
repack_kernel_snap_local	1
repack_local_kernel_snap_local	1
<main>	1

* Adding missing version variables for --core-version

* Fix static checks

* Fix some wrong usages of the repack-kernel tool

* fix muinstaller-real test

The automatic KERNEL_BRANCH="$CORE_VERSION" default was incorrectly
applied with --orig-snap, triggering mutual exclusion.

* Address copilot comments

* fix components for ubuntu-le 24

* Addressing comments about test failures

* simplified the split-refresh test
@bboozzoo
kernel: reject a non-empty firmware/updates entry at pack time (#17654)
0e4b224 
* kernel: reject a non-empty firmware/updates entry at pack time

Real kernel snaps ship an empty firmware/updates directory as a
harmless build-tooling placeholder (confirmed by a spread test run:
`snap pack` failed on an unmodified pc-kernel with this exact error).
It does not actually conflict with anything at runtime -
createFirmwareSymlinks/setupModsFromComp always (re)create this
directory anyway - so only flag it when it actually contains content.

A file (non-directory) named "updates" is still rejected
unconditionally, since there is no sensible "empty" case for that.

Signed-off-by: Maciej Borzecki <maciej.borzecki@canonical.com>

* fixup! kernel: reject a non-empty firmware/updates entry at pack time

* fixup! kernel: reject a non-empty firmware/updates entry at pack time

* fixup! kernel: reject a non-empty firmware/updates entry at pack time

* fixup! kernel: reject a non-empty firmware/updates entry at pack time

---------

Signed-off-by: Maciej Borzecki <maciej.borzecki@canonical.com>
@Mohit-Chachada
wrappers/internal: remap abstract sockets for parallel instances (#17630
a58f499 
)

* wrappers/internal, snap: remap abstract sockets for parallel instances

* tests: add checks for abstract socket usage in parallel instances

* wrappers/internal: return socket address max length violation error during unit generation

* wrappers/internal: explain consts

* wrappers/internal: minor test cleanup
@raimundo-henriques
docs: add generate-recovery-key response to OpenAPI spec (#17673)
7f54f8b 
Step generate-recovery-key was already included in the action install request.
However, the response in systems-label.yaml assumed the same 200 response for all POST requests to the systems endpoint.
In order to include the generate-recover-key step, I had to change this, clarifying that different actions or steps could have different responses (specifically, different result fields).
That led to the differences in multiple files.
I also took the opportunity to update check-passphrase and check-pin (deprecated) to check-passphrase-quality and check-pin-quality. I also updated the names of the files and schemas.
Quotes around status codes were removed for consistency.
The representation of null within anyOf is a workaround for v3.0.3 of OpenAPI, since type: null is only available on v3.1
@ZeyadYasser
o/devicestate: fix unit test race (#17699)
e2f75b4 
This commit fixes a race between keyboard.NewXKBConfigListener
and the cleanup of mocked GlobalRootDir because the corresponding
goroutine sometimes leak past the end of tests.

Currently the XKB config listener is mocked so that no listener
runs.

Signed-off-by: Zeyad Gouda <zeyad.gouda@canonical.com>
@maykathm
many: use naming.InstanceName/naming.SnapName in info (#17642)
1d448b1 
* many: use naming.InstanceName/naming.SnapName types instead of string

* many: fix errors from changing string to InstanceName/SnapNape

* seed: use snap instance name instead of snap name

* o/install: use instance name instead of snap name in building kernel boot info

* i/snap_app_set: use InstanceName instead of SnapName in ExpandSliceSnapVariablesWithOrder

* store/tooling: use instance name instead of snap name when downloading components

* many: change variable names and add/remove .String()

* o/servicestate: rename variable

* o/snapstate: add instance name to string conversion in mock pids of snap
@st3v3nmw
o/devicemgmtstate: document message processing (#17648)
dc1e09e 
* o/devicemgmtstate: document message processing

* o/devicemgmtstate: only LRU sequences are evicted when over capacity
@ernestl
github/workflows: add private snapd sync workflow (#17656)
963b96f 
* github/workflows: add private snapd sync workflow

* github/workflows: review improvements

* github/workflows: enable temp workaround with PAT

* .github/workflows: remove invalid --ff-only

* .github/workflows: add todo with task ref to remove PAT
sergiocazzolato and others added 2 commits September 24, 2026 17:16
@sergiocazzolato
tests: new repack-gadget and repack-base tools (#17590)
e198b08 
* tests: new repack-gadget and repack-base tools

Centralize the download, modification, and packing of base and gadget
snaps. Support the common logging, store, NTP, command-line, signing,
partition, and prepare-device changes used when creating test images.

Migrate prepare, nested, remodel, hybrid, and secure-boot tests to use
the new tools, removing duplicated unpack and repack logic.

* Update after manual rebase

* Adressing comments based on copilot review

* Fix issue preparing image

* Older unsquashfs now receives a nonexistent child directory

Fixed nested.sh. Older unsquashfs now receives a nonexistent child
directory under a safely created temporary parent.

* Addressing comments from code review

Fixed the naming of the gadget snap (missmatch with - vs _)

* revert image preservation in classic tests
@github-actions
Merge master into fips, using snapcraft-fips.yaml
6af0c3c

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.