Package "snapd"

  snapd (2.76+ubuntu26.04.2) resolute; urgency=medium

  * New upstream release, LP: #2154498
    - assertions: add helper for validating integrity data
    - assertions: drop incorrect/non-standard Ed25519 support
    - confdb: allow only API admin read access to confdb secrets
    - confdb: block concurrent confdb accesses
    - confdb: block concurrent snapctl accesses to configuration
      database
    - confdb: check for ephemeral data when missing save-view hook on
      commit
    - confdb: ignore not-found errors in confdb-schema refreshes
    - confdb: support --wait-for timeouts when accessing confdb
    - core-initrd: add group referenced in udev rules
    - core-initrd: add libbpf dependency to initramfs
    - core-initrd: add missing libbpf dependency in 24.04 packaging
    - core-initrd: ensure audio is a system group
    - core-initrd: fix /boot/uboot mount with u-boot env in dedicated
      partition
    - core-initrd: increase mount burst from 5 to 128 for faster boot
    - core-initrd: sync partition udev rules with the ones in core-base
    - core-initrd: sync with latest upload to snappy-dev PPA
    - core-initrd: synchronize changelogs with latest PPA upload
    - core-initrd: update changelog with latest PPA upload
    - core-initrd: add nfnetlink module to fix nf netlink
      socket speed regression (Ubuntu Core only)
    - cross-distro: allow snapd to manipulate systemd unit files in
      SELinux policy
    - cross-distro: FIPS bootstrap and dispatch via snap-fips-dispatch
    - desktop: fix common ID selection with multiple desktop plugs
    - FDE: allow user mode on core in secboot TPM handling
    - FDE: bump go-efilib dependency
    - FDE: bump secboot to rev cdcb64992e54 for FDE fixes
    - FDE: deprecate check-pin/passphrase API endpoints
    - LP: #2147606 FDE: give inactive state on classic
    - FDE: improve tracing for OP-TEE probing
    - FDE: move auto-repair logic to overlord/fdestate and provide state
    - FDE: update secboot for TPM/FDE bug fixes including Intel HAP and
      recovery key parsing
    - FDE: use any primary key matching digest when adding a keyslot
    - FDE: use ignore action for preinstall check in VM
    - interfaces: bluez | drop explicit deny send_destination in D-Bus
      configuration
    - interfaces: conditionally deny /proc/self/mountinfo to suppress Go
      1.25+ denials
    - interfaces: custom-device | fix for-device validation panic on
      non-string value
    - interfaces: disallow auto-connect to parallel installs
    - interfaces: docker | make plug implicit on classic systems
    - interfaces: ignore errors in disconnect hooks during explicit snap
      disconnect
    - interfaces: mediatek-accel | add plug interface base declaration
    - interfaces: microceph-support | suppress noisy sudo denial audit
      logs
    - interfaces: podman | add new interface for podman socket access
    - interfaces: pulseaudio | fix security tag syntax inconsistency
    - interfaces: raw-usb | allow USB device enumeration on Fairphone 5
      with NexDock
    - interfaces: restore auto-connections on failed refresh undo
    - interfaces: bool-file | support deep SoC sysfs paths
      for LED brightness
    - LP: #2139213 packaging: make Ubuntu 16.04 packaging dep17
      compliant
    - packaging: add cross-distro build script and instructions
    - packaging: add openSUSE 16.0 spread support
    - packaging: Debian build improvements
    - packaging: default openSUSE to /var/lib/snapd/snap and sync from
      downstream
    - packaging: fix Launchpad FIPS build detection for snapd-fips job
    - packaging: refactor and clean up snapd.mk, standardize test-data
      directories
    - packaging: switch to golang-github-chai2010-gettext-go-dev
    - packaging: update bundled AppArmor 4.1.7 (snapd snap only)
    - prompting: escape paths in prompt constraints
    - prompting: improve API error handling and validation
    - prompting: improve error message when no handler service is
      present
    - prompting: re-enable the prompting notice backend
    - prompting: respond with full user-allowed permission set
    - prompting: validate permissions while unmarshalling
    - remote device management: implement dispatch-mgmt-messages task
      with sequencing support
    - LP: #2125344 snap: avoid empty channel forwarding message
    - snap: clarify snap install help text for --classic
      and --devmode
    - LP: #2152908 snap: print complex attributes in snap interface
      --attrs output
    - snap: add run-inhibit hint and inhibit info when a snap is
      disabled
    - snap: allow removing a snap and its base at the same time
    - snap: display detailed component information in snap info
    - snap: extend AlreadyInstalledError to multiple snaps and
      components
    - snap: extend set-quota command options description with accepted
      value formats
    - snap: implement snap delta command for computing snap deltas
    - snap: improve consistency for snap install when some snaps are
      already installed
    - snap: show hint in snap list that a snap has components
    - snap-confine: allow inheriting unix sockets from snaps
    - snap-confine: allow linking to libm in AppArmor profile
    - snap-confine: fix out-of-bounds read in mountinfo parser for
      partial escape sequences
    - snap-confine: harden bpffs mount with nosuid, nodev, noexec flags
    - snap-confine: remove experimental persistent per-user mount
      namespace feature
    - snap-confine: set FD_CLOEXEC on file descriptors returned by BPF
      helpers
    - snap-confine: support transparent_hugepage in AppArmor profile
    - snap-confine: use strchr after NUL-terminating in infofile parser
    - snap-update-ns: switch to a multi-pass process for constructing
      and updating mount namespaces
    - RemoveMountUnitFile now unmounts even if mount unit file is
      missing
    - Add explicit mount phase during single-reboot refresh to fix

  snapd (2.75.2+ubuntu26.04.2) resolute; urgency=medium

  * New upstream release, LP: #2143882
    - Interfaces: network-setup-*| allow running python binaries from
      the base on UC26+
    - Cross-distro: modify SELinux policy to allow mounting on
      /var/snap/<snap>/<rev>
    - Fix potential task deadlock by considering all tasks in a lane
      that might be waiting for a reboot when processing delayed
      security backend effects