Package "snapd"

  snapd (2.72+ubuntu25.04) plucky; urgency=medium

  * New upstream release, LP: #2124239
    - FDE: support replacing TPM protected keys at runtime via the
      /v2/system-volumes endpoint
    - FDE: support secboot preinstall check fix actions for 25.10+
      hybrid installs via the /v2/system/{label} endpoint
    - FDE: tweak polkit message to remove jargon
    - FDE: ensure proper sealing with kernel command line defaults
    - FDE: provide generic reseal function
    - FDE: support using OPTEE for protecting keys, as an alternative to
      existing fde-setup hooks (Ubuntu Core only)
    - Confdb: 'snapctl get --view' supports passing default values
    - Confdb: content sub-rules in confdb-schemas inherit their parent
      rule's "access"
    - Confdb: make confdb error kinds used in API more generic
    - Confdb: fully support lists and indexed paths (including unset)
    - Prompting: add notice backend for prompting types (unused for now)
    - Prompting: include request cgroup in prompt
    - Prompting: handle unsupported xattrs
    - Prompting: add permission mapping for the camera interface
    - Notices: read notices from state without state lock
    - Notices: add methods to get notice fields and create, reoccur, and
      deepcopy notice
    - Notices: add notice manager to coordinate separate notice backends
    - Notices: support draining notices from state when notice backend
      registered as producer of a particular notice type
    - Notices: query notice manager from daemon instead of querying
      state for notices directly
    - Packaging: Ubuntu | ignore .git directory
    - Packaging: FIPS | bump deb Go FIPS to 1.23
    - Packaging: snap | bump FIPS toolchain to 1.23
    - Packaging: debian | sync most upstream changes
    - Packaging: debian-sid | depends on libcap2-bin for postint
    - Packaging: Fedora | drop fakeroot
    - Packaging: snap | modify snapd.mk to pass build tags when running
      unit tests
    - Packaging: snap | modify snapd.mk to pass nooptee build tag
    - Packaging: modify Makefile.am to fix snap-confine install profile
      with 'make hack'
    - Packaging: modify Makefile.am to fix out-of-tree use of 'make
      hack'
    - LP: #2122054 Snap installation: skip snap icon download when
      running in a cloud or using a proxy store
    - Snap installation: add timeout to http client when downloading
      snap icon
    - Snap installation: use http(s) proxy for icon downloads
    - LP: #2117558 snap-confine: fix error message with /root/snap not
      accessible
    - snap-confine: fix non-suid limitation by switching to root:root to
      operate v1 freezer
    - core-initrd: do not use writable-paths when not available
    - core-initrd: remove debian folder
    - LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev
      interface now with the more robust gpio-aggregator configfs kernel
      interface
    - Interfaces: gpio-chardev | exclusive snap connections, raise a
      conflict when both gpio-chardev and gpio are connected
    - Interfaces: gpio-chardev | fix gpio-aggregator module load order
    - Interfaces: ros-snapd-support | grant access to /v2/changes
    - Interfaces: uda-driver-libs, egl-driver-libs, gbm-driver-libs,
      opengl-driver-libs, opengles-driver-libs | new interfaces to
      support nvidia driver components
    - Interfaces: microstack-support | allow DPDK (hugepage related
      permissions)
    - Interfaces: system-observe | allow reading additional files in
      /proc, needed by node-exporter
    - Interfaces: u2f | add Cano Key, Thesis FIDO2 BioFP+ Security Key
      and Kensington VeriMark DT Fingerprint Key to device list
    - Interfaces: snap-interfaces-requests-control | allow shell API
      control
    - Interfaces: fwupd | allow access to Intel CVS sysfs
    - Interfaces: hardware-observe | allow read access to Kernel
      Samepage Merging (KSM)
    - Interfaces: xilinx-dma | support Multi Queue DMA (QDMA) IP
    - Interfaces: spi | relax sysfs permission rules to allow access to
      SPI device node attributes
    - Interfaces: content | introduce compatibility label
    - LP: #2121238 Interfaces: do not expose Kerberos tickets for
      classic snaps
    - Interfaces: ssh-public-keys | allow ro access to public host keys
      with ssh-key
    - Interfaces: Modify AppArmor template to allow listing systemd
      credentials and invoking systemd-creds
    - Interfaces: modify AppArmor template with workarounds for Go 1.35
      cgroup aware GOMAXPROCS
    - Interfaces: modify seccomp template to allow landlock_*
    - Prevent snap hooks from running while relevant snaps are unlinked
    - Make refreshes wait before unlinking snaps if running hooks can be
      affected
    - Fix systemd unit generation by moving "WantedBy=" from section
      "unit" to "install"
    - Add opt-in logging support for snap-update-ns
    - Unhide 'snap help' sign and export-key under Development category
    - LP: #2117121 Cleanly support socket activation for classic snap
    - Add architecture to 'snap version' output
    - Add 'snap debug api' option to disable authentication through
      auth.json
    - Show grade in notes for 'snap info --verbose'
    - Fix preseeding failure due to scan-disk issue on RPi
    - Support 'snap debug api' queries to user session agents
    - LP: #2112626 Improve progress reporting for snap install/refresh
    - Drop legacy BAMF_DESKTOP_FILE_HINT in desktop files
    - Fix /v2/apps error for root user when user services are present
    - LP: #2114704 Extend output to indicate when snap data snapshot was
      created during remove
    - Improve how we handle emmc volumes
    - Improve handling of system-user extra assertions

 -- Ernest Lotter <email address hidden> Thu, 18 Sep 2025 10:00:54 +0200

  snapd (2.71+ubuntu25.04) plucky; urgency=medium

  * New upstream release, LP: #2118396
    - FDE: auto-repair when recovery key is used
    - FDE: revoke keys on shim update
    - FDE: revoke old TPM keys when dbx has been updated
    - FDE: do not reseal FDE hook keys every time
    - FDE: store keys in the kernel keyring when installing from initrd
    - FDE: allow disabled DMA on Core
    - FDE: snap-bootstrap: do not check for partition in scan-disk on
      CVM
    - FDE: support secboot preinstall check for 25.10+ hybrid installs
      via the /v2/system/{label} endpoint
    - FDE: support generating recovery key at install time via the
      /v2/systems/{label} endpoint
    - FDE: update passphrase quality check at install time via the
      /v2/systems/{label} endpoint
    - FDE: support replacing recovery key at runtime via the new
      /v2/system-volumes endpoint
    - FDE: support checking recovery keys at runtime via the /v2/system-
      volumes endpoint
    - FDE: support enumerating keyslots at runtime via the /v2/system-
      volumes endpoint
    - FDE: support changing passphrase at runtime via the /v2/system-
      volumes endpoint
    - FDE: support passphrase quality check at runtime via the
      /v2/system-volumes endpoint
    - FDE: update secboot to revision 3e181c8edf0f
    - Confdb: support lists and indexed paths on read and write
    - Confdb: alias references must be wrapped in brackets
    - Confdb: support indexed paths in confdb-schema assertion
    - Confdb: make API errors consistent with options
    - Confdb: fetch confdb-schema assertion on access
    - Confdb: prevent --previous from being used in read-side hooks
    - Components: fix snap command with multiple components
    - Components: set revision of seed components to x1
    - Components: unmount extra kernel-modules components mounts
    - AppArmor Prompting: add lifespan "session" for prompting rules
    - AppArmor Prompting: support restoring prompts after snapd restart
    - AppArmor Prompting: limit the extra information included in probed
      AppArmor features and system key
    - Notices: refactor notice state internals
    - SELinux: look for restorecon/matchpathcon at all known locations
      rather than current PATH
    - SELinux: update policy to allow watching cgroups (for RAA), and
      talking to user session agents (service mgmt/refresh)
    - Refresh App Awareness: Fix unexpected inotify file descriptor
      cleanup
    - snap-confine: workaround for glibc fchmodat() fallback and handle
      ENOSYS
    - snap-confine: add support for host policy for limiting users able
      to run snaps
    - LP: #2114923 Reject system key mismatch advise when not yet seeded
    - Use separate lanes for essential and non-essential snaps during
      seeding and allow non-essential installs to retry
    - Fix bug preventing remodel from core18 to core18 when snapd snap
      is unchanged
    - LP: #2112551 Make removal of last active revision of a snap equal
      to snap remove
    - LP: #2114779 Allow non-gpt in fallback mode to support RPi
    - Switch from using systemd LogNamespace to manually controlled
      journal quotas
    - Change snap command trace logging to only log the command names
    - Grant desktop-launch access to /v2/snaps
    - Update code for creating the snap journal stream
    - Switch from using core to snapd snap for snap debug connectivity
    - LP: #2112544 Fix offline remodel case where we switched to a
      channel without an actual refresh
    - LP: #2112332 Exclude snap/snapd/preseeding when generating preseed
      tarball
    - LP: #1952500 Fix snap command progress reporting
    - LP: #1849346 Interfaces: kerberos-tickets | add new interface
    - Interfaces: u2f | add support for Thetis Pro
    - Interfaces: u2f | add OneSpan device and fix older device
    - Interfaces: pipewire, audio-playback | support pipewire as system
      daemon
    - Interfaces: gpg-keys | allow access to GPG agent sockets
    - Interfaces: usb-gadget | add new interface
    - Interfaces: snap-fde-control, firmware-updater-support | add new
      interfaces to support FDE
    - Interfaces: timezone-control | extend to support timedatectl
      varlink
    - Interfaces: cpu-control | fix rules for accessing IRQ sysfs and
      procfs directories
    - Interfaces: microstack-support | allow SR-IOV attachments
    - Interfaces: modify AppArmor template to allow snaps to read their
      own systemd credentials
    - Interfaces: posix-mq | allow stat on /dev/mqueue
    - LP: #2098780 Interfaces: log-observe | add capability
      dac_read_search
    - Interfaces: block-devices | allow access to ZFS pools and datasets
    - LP: #2033883 Interfaces: block-devices | opt-in access to
      individual partitions
    - Interfaces: accel | add new interface to support accel kernel
      subsystem
    - Interfaces: shutdown | allow client to bind on its side of dbus
      socket
    - Interfaces: modify seccomp template to allow pwritev2
    - Interfaces: modify AppArmor template to allow reading
      /proc/sys/fs/nr_open
    - Packaging: drop snap.failure service for openSUSE
    - Packaging: add SELinux support for openSUSE
    - Packaging: disable optee when using nooptee build tag
    - Packaging: add support for static PIE builds in snapd.mk, drop
      pie.patch from openSUSE
    - Packaging: add libcap2-bin runtime dependency for ubuntu-16.04
    - Packaging: use snapd.mk for packaging on Fedora
    - Packaging: exclude .git directory
    - Packaging: fix DPKG_PARSECHANGELOG assignment
    - Packaging: fix building on Fedora with dpkg installed

  snapd (2.68.5+ubuntu25.04.2) plucky; urgency=medium

  * New upstream release, LP: #2098137
    -LP: #2109843 fix missing preseed files when running in a container