# changelog

author: Pavel Raiskup <praiskup@redhat.com> 1.1-1
changelog:
  - more powerful parsing for ssh clone urls
  - nicer error output for not-matched origin.url hostnames
  - apply Fedora Review fixes


author: Thomas Moschny <thomas.moschny@gmx.de> - 1.18.21-1
changelog:
  - Update to 1.18.21.
  - Add patch for rhbz#2203408 from pr#7.
  - Depend on python3-dnf, not dnf (pr#6).


author: Thomas Moschny <thomas.moschny@gmx.de> - 1.18.22-1
changelog:
  - Update to 1.18.22.
  - Remove all EL7-related conditionals and parts.
  - Update for current Python packaging guidelines (rhbz#2377253).
  - Add support for DNF5 (rhbz#2326283).


author: Maxwell G <maxwell@gtmx.me> - 3.3.0-1
changelog:
  - Update to new source git source
  - Remove go_mod_vendor.prov from this package. It's already upstream.
  - Add -L flag to %gometa and %gorpmname
  - Add direct dependency on go-rpm-macros-golist-symlink


author: Sérgio M. Basto <sergio@serjux.com> - 0.5.93-4
changelog:
  - Force replacement of packages of
    copr:copr.fedorainfracloud.org:sergiomb:libayatana-appindicator repo


author: Łukasz Wojniłowicz <lukasz.wojnilowicz@gmail.com> - 1.7.4-14
changelog:
  - Set dmenu-wayland and dmenu to Recommends instead of Requires to have
    a choice to install one or the other or both. Helpful when using Wayland
    and having xorg-x11-server-Xorg for XWayland purpose only.
    Resolves: rhbz#2335143


author: Peter Georg <peter.georg@physik.uni-regensburg.de> - 1.7.4-15
changelog:
  - Only recommend wl-clipboard if libwayland-client is installed
  - Only recommend xclip if xorg-x11-server-Xorg is installed


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.36.00-1
changelog:
  - Update to 6.36.00
  - Enable the R interface for EPEL 10.1
  - Removed subpackages: root-gui-qt5webdisplay, -hist-draw, -histv7 and -html
  - New subpackage: root-roofit-codegen


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.36.00-2
changelog:
  - Add root-tree-ntuple and root-tree-ntuple-utils dependensies to root-core
    (listed in root-config --libs)
  - Rename root-fonts package to root-font-files
  - Add optional test dependency python3-pandas now available in EPEL 10
  - Add dependency jupyter-notebook to root-jupyroot for EPEL 10.1 and later
  - Fix Python 3.14 refcount issues in tests


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 1:5.8.2-1
changelog:
  - Update to version 5.8.2
  - Use reserved uid and gid 194 for the xrootd user
    - https://pagure.io/packaging-committee/issue/1444
    - https://src.fedoraproject.org/rpms/setup/pull-request/27


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.5.0-1
changelog:
  - Initial package (close RHBZ#2328487)
  - Re-generate with rust2rpm 27 for a slightly nicer spec file


author: Benjamin A. Beasley <code@musicinmybrain.net> - 2.22.0-2
changelog:
  - Update the rust-image-0.25 patch to match what was merged upstream
  - Fewer image formats are now supported.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.7.5-4
changelog:
  - Re-generate using rust2rpm 27
  - Since it is now easier to re-use a Cargo.toml patch, we use one to remove
    the postcard dev-dependency instead of depending on tomcli.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.10.4-2
changelog:
  - On i686, skip a test that is designed for 64-bit
  - Send a PR upstream to conditionalize the test by architecture.


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.67.1
   - Fix apparmor permissions to allow snaps access to kernel modules
     and firmware on UC24, which also fixes the kernel-modules-control
     interface on UC24
   - AppArmor prompting (experimental): disallow /./ and /../ in path
     patterns
   - Fix 'snap run' getent based user lookup in case of bad PATH
   - Fix snapd using the incorrect AppArmor version during undo of an
     refresh for regenerating snap profiles
   - Add new syscalls to base templates
   - hardware-observe interface: allow riscv_hwprobe syscall
   - mount-observe interface: allow listmount and statmount syscalls


author: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
changelog:
  - The changelog date and author have been modified to maintain linearity.
  - Drop 0001-data-selinux-remove-timedatex.patch - applied upstream.
  - New upstream release 2.67
   - AppArmor prompting (experimental): allow overlapping rules
   - Registry view (experimental): Changes to registry data (from both
     users and snaps) can be validated and saved by custodian snaps
   - Registry view (experimental): Support 'snapctl get --pristine' to
     read the registry data excluding staged transaction changes
   - Registry view (experimental): Put registry commands behind
     experimental feature flag
   - Components: Make modules shipped/created by kernel-modules
     components available right after reboot
   - Components: Add tab completion for local component files
   - Components: Allow installing snaps and components from local files
     jointly on the CLI
   - Components: Allow 'snapctl model' command for gadget and kernel
     snaps
   - Components: Add 'snap components' command
   - Components: Bug fixes
   - eMMC gadget updates (WIP): add syntax support in gadget.yaml for
     eMMC schema
   - Support for ephemeral recovery mode on hybrid systems
   - Support for dm-verity options in snap-bootstrap
   - Support for overlayfs options and allow empty what argument for
     tmpfs
   - Enable ubuntu-image to determine the size of the disk image to
     create
   - Expose 'snap debug' commands 'validate-seed' and 'seeding'
   - Add debug API option to use dedicated snap socket /run/snapd-
     snap.socket
   - Hide experimental features that are no longer required
     (accepted/rejected)
   - Mount ubuntu-save partition with no{exec,dev,suid} at install, run
     and factory-reset
   - Improve memory controller support with cgroup v2
   - Support ssh socket activation configurations (used by ubuntu
     22.10+)
   - Fix generation of AppArmor profile with incorrect revision during
     multi snap refresh
   - Fix refresh app awareness related deadlock edge case
   - Fix not caching delta updated snap download
   - Fix passing non root uid, guid to initial tmpfs mount
   - Fix ignoring snaps in try mode when amending
   - Fix reloading of service activation units to avoid systemd errors
   - Fix snapd snap FIPS build on Launchpad to use Advantage Pro FIPS
     updates PPA
   - Make killing of snap apps best effort to avoid possibility of
     malicious failure loop
   - Alleviate impact of auto-refresh failure loop with progressive
     delay
   - Dropped timedatex in selinux-policy to avoid runtime issue
   - Fix missing syscalls in seccomp profile
   - Modify AppArmor template to allow using SNAP_REEXEC on arch
     systems
   - Modify AppArmor template to allow using vim.tiny (available in
     base snaps)
   - Modify AppArmor template to add read-access to debian_version
   - Modify AppArmor template to allow owner to read
     @{PROC}/@{pid}/sessionid
   - {common,personal,system}-files interface: prohibit trailing @ in
     filepaths
   - {desktop,shutdown,system-observe,upower-observe} interface:
     improve for Ubuntu Core Desktop
   - custom-device interface: allow @ in custom-device filepaths
   - desktop interface: improve launch entry and systray integration
     with session
   - desktop-legacy interface: allow DBus access to
     com.canonical.dbusmenu
   - fwupd interface: allow access to nvmem for thunderbolt plugin
   - mpris interface: add plasmashell as label
   - mount-control interface: add support for nfs mounts
   - network-{control,manager} interface: add missing dbus link rules
   - network-manager-observe interface: add getDevices methods
   - opengl interface: add Kernel Fusion Driver access to opengl
   - screen-inhibit-control interface: improve screen inhibit control
     for use on core
   - udisks2 interface: allow ping of the UDisks2 service
   - u2f-devices interface: add Nitrokey Passkey


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.68
   - FDE: add support for new and more extensible key format that is
     unified between TPM and FDE hook
   - FDE: add support for adding passphrases during installation
   - FDE: update secboot to 30317622bbbc
   - Snap components: make kernel components available on firstboot
     after either initramfs or ephemeral rootfs style install
   - Snap components: mount drivers tree from initramfs so kernel
     modules are available in early boot stages
   - Snap components: support remodeling to models that contain
     components
   - Snap components: support offline remodeling to models that contain
     components
   - Snap components: support creating new recovery systems with
     components
   - Snap components: support downloading components with 'snap
     download' command
   - Snap components: support sideloading asserted components
   - AppArmor Prompting(experimental): improve version checks and
     handling of listener notification protocol for communication with
     kernel AppArmor
   - AppArmor Prompting(experimental): make prompt replies idempotent,
     and have at most one rule for any given path pattern, with
     potentially mixed outcomes and lifespans
   - AppArmor Prompting(experimental): timeout unresolved prompts after
     a period of client inactivity
   - AppArmor Prompting(experimental): return an error if a patch
     request to the API would result in a rule without any permissions
   - AppArmor Prompting(experimental): warn if there is no prompting
     client present but prompting is enabled, or if a prompting-related
     error occurs during snapd startup
   - AppArmor Prompting(experimental): do not log error when converting
     empty permissions to AppArmor permissions
   - Confdb(experimental): rename registries to confdbs (including API
     /v2/registries => /v2/confdb)
   - Confdb(experimental): support marking confdb schemas as ephemeral
   - Confdb(experimental): add confdb-control assertion and feature
     flag
   - Refresh App Awareness(experimental): LP: #2089195 prevent
     possibility of incorrect notification that snap will quit and
     update
   - Confidential VMs: snap-bootstrap support for loading partition
     information from a manifest file for cloudimg-rootfs mode
   - Confidential VMs: snap-bootstrap support for setting up cloudimg-
     rootfs as an overlayfs with integrity protection
   - dm-verity for essential snaps: add support for snap-integrity
     assertion
   - Interfaces: modify AppArmor template to allow owner read on
     @{PROC}/@{pid}/fdinfo/*
   - Interfaces: LP: #2072987 modify AppArmor template to allow using
     setpriv to run daemon as non-root user
   - Interfaces: add configfiles backend that ensures the state of
     configuration files in the filesystem
   - Interfaces: add ldconfig backend that exposes libraries coming
     from snaps to either the rootfs or to other snaps
   - Interfaces: LP: #1712808 LP: 1865503 disable udev backend when
     inside a container
   - Interfaces: add auditd-support interface that grants audit_control
     capability and required paths for auditd to function
   - Interfaces: add checkbox-support interface that allows
     unrestricted access to all devices
   - Interfaces: fwupd | allow access to dell bios recovery
   - Interfaces: fwupd | allow access to shim and fallback shim
   - Interfaces: mount-control | add mount option validator to detect
     mount option conflicts early
   - Interfaces: cpu-control | add read access to /sys/kernel/irq/
   - Interfaces: locale-control | changed to be implicit on Ubuntu Core
     Desktop
   - Interfaces: microstack-support | support for utilizing of AMD SEV
     capabilities
   - Interfaces: u2f | added missing OneSpan device product IDs
   - Interfaces: auditd-support | grant seccomp setpriority
   - Interfaces: opengl interface | enable parsing of nvidia driver
     information files
   - Allow mksquashfs 'xattrs' when packing snap types os, core, base
     and snapd as part of work to support non-root snap-confine
   - Upstream/downstream packaging changes and build updates
   - Improve error logs for malformed desktop files to also show which
     desktop file is at fault
   - Provide more precise error message when overriding channels with
     grade during seed creation
   - Expose 'snap prepare-image' validation parameter
   - Add snap-seccomp 'dump' command that dumps the filter rules from a
     compiled profile
   - Add fallback release info location /etc/initrd-release
   - Added core-initrd to snapd repo and fixed issues with ubuntu-core-
     initramfs deb builds
   - Remove stale robust-mount-namespace-updates experimental feature
     flag
   - Remove snapd-snap experimental feature (rejected) and it's feature
     flag
   - Changed snap-bootstrap to mount base directly on /sysroot
   - Mount ubuntu-seed mounted as no-{suid,exec,dev}
   - Mapping volumes to disks: add support for volume-assignments in
     gadget
   - Fix silently broken binaries produced by distro patchelf 0.14.3 by
     using locally build patchelf 0.18
   - Fix mismatch between listed refresh candidates and actual refresh
     due to outdated validation sets
   - Fix 'snap get' to produce compact listing for tty
   - Fix missing store-url by keeping it as part of auxiliary store
     info
   - Fix snap-confine attempting to retrieve device cgroup setup inside
     container where it is not available
   - Fix 'snap set' and 'snap get' panic on empty strings with early
     error checking
   - Fix logger debug entries to show correct caller and file
     information
   - Fix issue preventing hybrid systems from being seeded on first
     boot
   - LP: #1966203 remove auto-import udev rules not required by deb
     package to avoid unwanted syslog errors
   - LP: #1886414 fix progress reporting when stdout is on a tty, but
     stdin is not


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.68.2
   - FDE: use boot mode for FDE hooks
   - FDE: add snap-bootstrap compatibility check to prevent image
     creation with incompatible snapd and kernel snap
   - FDE: add argon2 out-of-process KDF support
   - FDE: have separate mutex for the sections writing a fresh modeenv
   - FDE: LP: #2099709 update secboot to e07f4ae48e98
   - Confdb: support pruning ephemeral data and process alternative
     types in order
   - core-initrd: look at env to mount directly to /sysroot
   - core-initrd: prepare for Plucky build and split out 24.10
     (Oracular)
   - Fix missing primed packages in snapd snap manifest
   - Interfaces: posix-mq | fix incorrect clobbering of global variable
     and make interface more precise
   - Interfaces: opengl | add more kernel fusion driver files


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.68.3
   - FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to
     old keyring path
   - Fix Plucky snapd deb build issue related to /var/lib/snapd/void
     permissions
   - Fix snapd deb build complaint about ifneq with extra bracket


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.68.4
   - Snap components: LP: #2104933 workaround for classic 24.04/24.10
     models that incorrectly specify core22 instead of core24
   - Update build dependencies


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.69
   - FDE: re-factor listing of the disks based on run mode model and
     model to correctly resolve paths
   - FDE: run snapd from snap-failure with the correct keyring mode
   - Snap components: allow remodeling back to an old snap revision
     that includes components
   - Snap components: fix remodel to a kernel snap that is already
     installed on the system, but not the current kernel due to a
     previous remodel.
   - Snap components: fix for snapctl inputs that can crash snapd
   - Confdb (experimental): load ephemeral data when reading data via
     snapctl get
   - Confdb (experimental): load ephemeral data when reading data via
     snap get
   - Confdb (experimental): rename {plug}-view-changed hook to observe-
     view-{plug}
   - Confdb (experimental): rename confdb assertion to confdb-schema
   - Confdb (experimental): change operator grouping in confdb-control
     assertion
   - Confdb (experimental): add confdb-control API
   - AppArmor: extend the probed features to include the presence of
     files, as well as directories
   - AppArmor prompting (experimental): simplify the listener
   - AppArmor metadata tagging (disabled): probe parser support for
     tags
   - AppArmor metadata tagging (disabled): implement notification
     protocol v5
   - Confidential VMs: sysroot.mount is now dynamically created by
     snap-bootstrap instead of being a static file in the initramfs
   - Confidential VMs: Add new implementation of snap integrity API
   - Non-suid snap-confine: first phase to replace snap-confine suid
     with capabilities to achieve the required permissions
   - Initial changes for dynamic security profiles updates
   - Provide snap icon fallback for /v2/icons without requiring network
     access at runtime
   - Add eMMC gadget update support
   - Support reexec when using /usr/libexec/snapd on the host (Arch
     Linux, openSUSE)
   - Auto detect snap mount dir location on unknown distributions
   - Modify snap-confine AppArmor template to allow all glibc HWCAPS
     subdirectories to prevent launch errors
   - LP: #2102456 update secboot to bf2f40ea35c4 and modify snap-
     bootstrap to remove usage of go templates to reduce size by 4MB
   - Fix snap-bootstrap to mount kernel snap from
     /sysroot/writable/system-data
   - LP: #2106121 fix snap-bootstrap busy loop
   - Fix encoding of time.Time by using omitzero instead of omitempty
     (on go 1.24+)
   - Fix setting snapd permissions through permctl for openSUSE
   - Fix snap struct json tags typo
   - Fix snap pack configure hook permissions check incorrect file mode
   - Fix gadget snap reinstall to honor existing sizes of partitions
   - Fix to update command line when re-executing a snapd tool
   - Fix 'snap validate' of specific missing newline and add error on
     missed case of 'snap validate --refresh' without another action
   - Workaround for snapd-confine time_t size differences between
     architectures
   - Disallow pack and install of snapd, base and os with specific
     configure hooks
   - Drop udev build dependency that is no longer required and add
     missing systemd-dev dependency
   - Build snap-bootstrap with nomanagers tag to decrease size by 1MB
   - Interfaces: polkit | support custom polkit rules
   - Interfaces: opengl | LP: #2088456 fix GLX on nvidia when xorg is
     confined by AppArmor
   - Interfaces: log-observe | add missing udev rule
   - Interfaces: hostname-control | fix call to hostnamectl in core24
   - Interfaces: network-control | allow removing created network
     namespaces
   - Interfaces: scsi-generic | re-enable base declaration for scsi-
     generic plug
   - Interfaces: u2f | add support for Arculus AuthentiKey


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.70
   - FDE: Fix reseal with v1 hook key format
   - FDE: set role in TPM keys
   - AppArmor prompting (experimental): add handling for expired
     requests or listener in the kernel
   - AppArmor prompting: log the notification protocol version
     negotiated with the kernel
   - AppArmor prompting: implement notification protocol v5 (manually
     disabled for now)
   - AppArmor prompting: register listener ID with the kernel and
     resend notifications after snapd restart (requires protocol v5+)
   - AppArmor prompting: select interface from metadata tags and set
     request interface accordingly (requires protocol v5+)
   - AppArmor prompting: include request PID in prompt
   - AppArmor prompting: move the max prompt ID file to a subdirectory
     of the snap run directory
   - AppArmor prompting: avoid race between closing/reading socket fd
   - Confdb (experimental): make save/load hooks mandatory if affecting
     ephemeral
   - Confdb: clear tx state on failed load
   - Confdb: modify 'snap sign' formats JSON in assertion bodies (e.g.
     confdb-schema)
   - Confdb: add NestedEphemeral to confdb schemas
   - Confdb: add early concurrency checks
   - Simplify building Arch package
   - Enable snapd.apparmor on Fedora
   - Build snapd snap with libselinux
   - Emit snapd.apparmor warning only when using apparmor backend
   - When running snap, on system key mismatch e.g. due to network
     attached HOME, trigger and wait for a security profiles
     regeneration
   - Avoid requiring state lock to get user, warnings, or pending
     restarts when handling API requests
   - Start/stop ssh.socket for core24+ when enabling/disabling the ssh
     service
   - Allow providing a different base when overriding snap
   - Modify snap-bootstrap to mount snapd snap directly to /snap
   - Modify snap-bootstrap to mount /lib/{modules,firmware} from snap
     as fallback
   - Modify core-initrd to use systemctl reboot instead of /sbin/reboot
   - Copy the initramfs 'manifest-initramfs.yaml' to initramfs file
     creation directory so it can be copied to the kernel snap
   - Build the early initrd from installed ucode packages
   - Create drivers tree when remodeling from UC20/22 to UC24
   - Load gpio-aggregator module before the helper-service needs it
   - Run 'systemctl start' for mount units to ensure they are run also
     when unchanged
   - Update godbus version to 'v5 v5.1.0'
   - Add support for POST to /v2/system-info with system-key-mismatch
     indication from the client
   - Add 'snap sign --update-timestamp' flag to update timestamp before
     signing
   - Add vfs support for snap-update-ns to use to simulate and evaluate
     mount sequences
   - Add refresh app awareness debug logging
   - Add snap-bootstrap scan-disk subcommand to be called from udev
   - Add feature to inject proxy store assertions in build image
   - Add OP-TEE bindings, enable by default in ARM and ARM64 builds
   - Fix systemd dependency options target to go under 'unit' section
   - Fix snap-bootstrap reading kernel snap instead of base resulting
     in bad modeenv
   - Fix a regression during seeding when using early-config
   - LP: #2107443 reset SHELL to /bin/bash in non-classic snaps
   - Make Azure kernels reboot upon panic
   - Fix snap-confine to not drop capabilities if the original user is
     already root
   - Fix data race when stopping services
   - Fix task dependency issue by temporarily disable re-refresh on
     prerequisite updates
   - Fix compiling against op-tee on armhf
   - Fix dbx update when not using FDE
   - Fix potential validation set deadlock due to bases waiting on
     snaps
   - LP: #2104066 Only cancel notices requests on stop/shutdown
   - Interfaces: bool-file | fix gpio glob pattern as required for
     '[XXXX]*' format
   - Interfaces: system-packages-doc | allow access to
     /usr/local/share/doc
   - Interfaces: ros-snapd-support interface | added new interface
   - Interfaces: udisks2 | allow chown capability
   - Interfaces: system-observe | allow reading cpu.max
   - Interfaces: serial-port | add ttyMAXX to allowed list
   - Interfaces: modified seccomp template to disallow
     'O_NOTIFICATION_PIPE'
   - Interfaces: fwupd | add support for modem-manager plugin
   - Interfaces: gpio-chardev | make unsupported and remove
     experimental flag to hide this feature until gpio-aggregator is
     available
   - Interfaces: hardware-random | fix udev match rule
   - Interfaces: timeserver-control | extend to allow timedatectl
     timesync commands
   - Interfaces: add symlinks backend
   - Interfaces: system key mismatch handling


