Merge branch 'master' into add-confdb-handler-devicemgmt

Author: st3v3nmw

.github/workflows/ci-test.yaml

@@ -160,7 +160,6 @@ jobs:
       matrix:
         build-config:
           - { system: "ubuntu-26.04-64",     runs-on: '["ubuntu-latest"]',     os: ubuntu, os-version: '26.04' }
-          - { system: "ubuntu-25.10-64",     runs-on: '["ubuntu-latest"]',     os: ubuntu, os-version: '25.10' }
           - { system: "ubuntu-25.04-64",     runs-on: '["ubuntu-latest"]',     os: ubuntu, os-version: '25.04' }
           - { system: "ubuntu-24.04-64",     runs-on: '["ubuntu-latest"]',     os: ubuntu, os-version: '24.04' }
           - { system: "ubuntu-22.04-64",     runs-on: '["ubuntu-latest"]',     os: ubuntu, os-version: '22.04' }

.github/workflows/data-fundamental-systems.json

@@ -26,7 +26,7 @@
       },
       {
         "runs-on": "['self-hosted', 'spread-enabled']",
-        "group": "ubuntu-daily",
+        "group": "ubuntu-resolute",
         "backend": "openstack",
         "systems": "ubuntu-26.04-64",
         "tasks": "tests/...",

.github/workflows/data-non-fundamental-systems.json

@@ -116,15 +116,15 @@
         "runs-on": "['self-hosted', 'spread-enabled']",
         "group": "ubuntu-deb",
         "backend": "openstack",
-        "systems": "ubuntu-24.04-64",
+        "systems": "ubuntu-24.04-64 ubuntu-26.04-64",
         "tasks": "tests/...",
         "rules": "main"
       },
       {
         "runs-on": "['self-hosted', 'spread-enabled']",
-        "group": "ubuntu-interim",
+        "group": "ubuntu-daily",
         "backend": "openstack",
-        "systems": "ubuntu-25.10-64",
+        "systems": "ubuntu-26.10-64",
         "tasks": "tests/...",
         "rules": "main"
       },
@@ -162,9 +162,9 @@
       },
       {
         "runs-on": "['ubuntu-latest']",
-        "group": "questing (garden)",
+        "group": "stonking (garden)",
         "backend": "garden",
-        "systems": "ubuntu-25.10-64",
+        "systems": "ubuntu-26.10-64",
         "tasks": "tests/main/microk8s-smoke tests/main/download-timeout tests/main/snap-network-errors tests/main/snapd-snap:lxd tests/main/apparmor-prompting-support tests/main/proxy",
         "rules": ""
       },

NEWS.md

@@ -1,3 +1,20 @@
+# New in snapd 2.76.3
+* FDE: support keyboard configuration at install-time for first-boot
+* FDE: re-enable passphrases/PINs at install-time
+* FDE: require volumes authentication if HWROT is missing
+* FDE: bump secboot to rev 457b03a16d19
+* FDE: use new secboot API for reprovision TPM
+* Cross-distro: modify SELinux policy to use init_named_socket_activation() for allowing systemd to start snapd through socket activation
+* packaging: make sure that usr/bin/snap is built with correct build tags on debian sid
+* Ensure profiles are setup before running prepare-{slot, plug}* hooks
+
+# New in snapd 2.76.2
+* interfaces: steam-support, docker-support | fix mountinfo denial
+
+# New in snapd 2.76.1
+* LP: #2067006 CVE-2024-5300
+* CVE-2026-3888
+
 # New in snapd 2.76
 * assertions: add helper for validating integrity data
 * assertions: drop incorrect/non-standard Ed25519 support

RELEASE.md

@@ -615,3 +615,5 @@ Prerequisites:
 Request that snapd QA promotes snapd to stable. The release is done progressively. Once the progressive release has completed, update the [snapd roadmap](https://forum.snapcraft.io/t/the-snapd-roadmap/1973).
 
 #### 2. Request move to `-updates`
+
+Once the move is complete, change all milestone bugs to "Fix released."

asserts/asserts.go

@@ -222,7 +222,8 @@ func init() {
 	// 4: support for plug-names/slot-names constraints
 	// 5: alt attr matcher usage (was unused before, has new behavior now)
 	// 6: support for $PLUG_PUBLISHER_ID/$SLOT_PUBLISHER_ID in attr constraints
-	maxSupportedFormat[SnapDeclarationType.Name] = 6
+	// 7: support for on-classic distro/variant constraints
+	maxSupportedFormat[SnapDeclarationType.Name] = 7
 
 	// 1: support to limit to device serials
 	// 2: support for user-presence constraint

asserts/export_test.go

@@ -47,6 +47,9 @@ var DecodePrivateKeyInTest = decodePrivateKey
 // readOpenPGPRSAPublicKey exposed for tests
 var ReadOpenPGPRSAPublicKeyInTest = readOpenPGPRSAPublicKey
 
+// CompileOnClassicSystemConstraintForTest exposes the on-classic system parser for focused tests.
+var CompileOnClassicSystemConstraintForTest = compileOnClassicSystemConstraint
+
 // NewDecoderStressed makes a Decoder with a stressed setup with the given buffer and maximum sizes.
 func NewDecoderStressed(r io.Reader, bufSize, maxHeadersSize, maxBodySize, maxSigSize int) *Decoder {
 	return (&Decoder{

asserts/ifacedecls.go

@@ -44,6 +44,8 @@ const (
 	deviceScopeConstraintsFeature = "device-scope-constraints"
 	// feature label for plug-names/slot-names constraints
 	nameConstraintsFeature = "name-constraints"
+	// feature label for on-classic distro/variant constraints
+	onClassicVariantConstraintsFeature = "on-classic-variant-constraints"
 )
 
 // AttributeConstraints implements a set of constraints on the attributes of a slot or plug.
@@ -184,7 +186,97 @@ var (
 // OnClassicConstraint specifies a constraint based whether the system is classic and optional specific distros' sets.
 type OnClassicConstraint struct {
 	Classic   bool
-	SystemIDs []string
+	SystemIDs []OnClassicSystemConstraint
+}
+
+// OnClassicSystemConstraint specifies an operating system distro/variant matcher.
+//
+// VariantAny is true for constraints that accept any VARIANT_ID, including the
+// legacy distro-only form (for example "ubuntu") and the explicit wildcard form
+// (for example "ubuntu/*"). VariantID preserves the explicit wildcard so format
+// detection can distinguish old and new syntax.
+type OnClassicSystemConstraint struct {
+	DistroID   string
+	VariantID  string
+	VariantAny bool
+}
+
+func (c *OnClassicConstraint) feature(flabel string) bool {
+	if flabel != onClassicVariantConstraintsFeature {
+		return false
+	}
+	for _, systemID := range c.SystemIDs {
+		// Explicit variant syntax requires format 7, even when it still matches any
+		// variant (for example "ubuntu/*"). The legacy distro-only form keeps the
+		// zero VariantID while still setting VariantAny.
+		if !systemID.VariantAny || systemID.VariantID == "*" {
+			return true
+		}
+	}
+	return false
+}
+
+func compileOnClassicConstraint(context *subruleContext, onClassic any) (*OnClassicConstraint, error) {
+	what := fmt.Sprintf("on-classic in %s", context)
+	syntaxError := fmt.Errorf("%s must be 'true', 'false' or a list of operating system IDs with optional /variant IDs", what)
+
+	switch x := onClassic.(type) {
+	case string:
+		switch x {
+		case "true":
+			return &OnClassicConstraint{Classic: true}, nil
+		case "false":
+			return &OnClassicConstraint{Classic: false}, nil
+		default:
+			return nil, syntaxError
+		}
+	case []any:
+		systems := make([]OnClassicSystemConstraint, len(x))
+		for i, v := range x {
+			s, ok := v.(string)
+			if !ok {
+				return nil, fmt.Errorf("%s must be a list of strings", what)
+			}
+			systemID, err := compileOnClassicSystemConstraint(s)
+			if err != nil {
+				return nil, fmt.Errorf("%s contains an invalid element: %q: %v", what, s, err)
+			}
+			systems[i] = systemID
+		}
+		return &OnClassicConstraint{Classic: true, SystemIDs: systems}, nil
+	default:
+		return nil, syntaxError
+	}
+}
+
+func compileOnClassicSystemConstraint(s string) (OnClassicSystemConstraint, error) {
+	if strings.Count(s, "/") > 1 {
+		return OnClassicSystemConstraint{}, fmt.Errorf("invalid operating system constraint: too many '/' separators")
+	}
+	if distroID, variantID, hasVariant := strings.Cut(s, "/"); hasVariant {
+		if !validDistro.MatchString(distroID) {
+			return OnClassicSystemConstraint{}, fmt.Errorf("invalid operating system constraint: invalid distro ID")
+		}
+		constraint := OnClassicSystemConstraint{
+			DistroID: distroID,
+		}
+		switch {
+		case variantID == "*":
+			constraint.VariantAny = true
+			constraint.VariantID = "*"
+		case variantID == "":
+			// Match only when VARIANT_ID is unset.
+		case validDistro.MatchString(variantID):
+			constraint.VariantID = variantID
+		default:
+			return OnClassicSystemConstraint{}, fmt.Errorf("invalid operating system constraint: invalid variant ID")
+		}
+		return constraint, nil
+	}
+	if !validDistro.MatchString(s) {
+		return OnClassicSystemConstraint{}, fmt.Errorf("invalid operating system constraint: invalid distro ID")
+	}
+	return OnClassicSystemConstraint{DistroID: s, VariantAny: true}, nil
 }
 
 // OnCoreDesktopConstraint specifies a constraint based whether the system is core desktop.
@@ -387,24 +479,9 @@ func baseCompileConstraints(context *subruleContext, cDef constraintsDef, target
 	if onClassic == nil {
 		defaultUsed++
 	} else {
-		var c *OnClassicConstraint
-		switch x := onClassic.(type) {
-		case string:
-			switch x {
-			case "true":
-				c = &OnClassicConstraint{Classic: true}
-			case "false":
-				c = &OnClassicConstraint{Classic: false}
-			}
-		case []any:
-			lst, err := checkStringListInMap(cMap, "on-classic", fmt.Sprintf("on-classic in %s", context), validDistro)
-			if err != nil {
-				return err
-			}
-			c = &OnClassicConstraint{Classic: true, SystemIDs: lst}
-		}
-		if c == nil {
-			return fmt.Errorf("on-classic in %s must be 'true', 'false' or a list of operating system IDs", context)
+		c, err := compileOnClassicConstraint(context, onClassic)
+		if err != nil {
+			return err
 		}
 		target.setOnClassicConstraint(c)
 	}
@@ -667,6 +744,9 @@ func (c *PlugInstallationConstraints) feature(flabel string) bool {
 	if flabel == deviceScopeConstraintsFeature {
 		return c.DeviceScope != nil
 	}
+	if flabel == onClassicVariantConstraintsFeature {
+		return c.OnClassic != nil && c.OnClassic.feature(flabel)
+	}
 	if flabel == nameConstraintsFeature {
 		return c.PlugNames != nil
 	}
@@ -754,6 +834,9 @@ func (c *PlugConnectionConstraints) feature(flabel string) bool {
 	if flabel == deviceScopeConstraintsFeature {
 		return c.DeviceScope != nil
 	}
+	if flabel == onClassicVariantConstraintsFeature {
+		return c.OnClassic != nil && c.OnClassic.feature(flabel)
+	}
 	if flabel == nameConstraintsFeature {
 		return c.PlugNames != nil || c.SlotNames != nil
 	}
@@ -986,6 +1069,9 @@ func (c *SlotInstallationConstraints) feature(flabel string) bool {
 	if flabel == deviceScopeConstraintsFeature {
 		return c.DeviceScope != nil
 	}
+	if flabel == onClassicVariantConstraintsFeature {
+		return c.OnClassic != nil && c.OnClassic.feature(flabel)
+	}
 	if flabel == nameConstraintsFeature {
 		return c.SlotNames != nil
 	}
@@ -1087,6 +1173,9 @@ func (c *SlotConnectionConstraints) feature(flabel string) bool {
 	if flabel == deviceScopeConstraintsFeature {
 		return c.DeviceScope != nil
 	}
+	if flabel == onClassicVariantConstraintsFeature {
+		return c.OnClassic != nil && c.OnClassic.feature(flabel)
+	}
 	if flabel == nameConstraintsFeature {
 		return c.PlugNames != nil || c.SlotNames != nil
 	}

asserts/ifacedecls_test.go

@@ -872,7 +872,48 @@ func (s *plugSlotRulesSuite) TestCompilePlugRuleInstallationConstraintsOnClassic
 	rule, err = asserts.CompilePlugRule("iface", m["iface"].(map[string]any))
 	c.Assert(err, IsNil)
 
-	c.Check(rule.AllowInstallation[0].OnClassic, DeepEquals, &asserts.OnClassicConstraint{Classic: true, SystemIDs: []string{"ubuntu", "debian"}})
+	c.Check(rule.AllowInstallation[0].OnClassic, DeepEquals, &asserts.OnClassicConstraint{Classic: true, SystemIDs: []asserts.OnClassicSystemConstraint{{DistroID: "ubuntu", VariantAny: true}, {DistroID: "debian", VariantAny: true}}})
+
+	m, err = asserts.ParseHeaders([]byte("iface:\n  allow-installation:\n    on-classic:\n      - ubuntu/touch\n      - ubuntu/*\n      - ubuntu/"))
+	c.Assert(err, IsNil)
+
+	rule, err = asserts.CompilePlugRule("iface", m["iface"].(map[string]any))
+	c.Assert(err, IsNil)
+
+	c.Check(rule.AllowInstallation[0].OnClassic, DeepEquals, &asserts.OnClassicConstraint{Classic: true, SystemIDs: []asserts.OnClassicSystemConstraint{{DistroID: "ubuntu", VariantID: "touch"}, {DistroID: "ubuntu", VariantID: "*", VariantAny: true}, {DistroID: "ubuntu"}}})
+}
+
+func (s *plugSlotRulesSuite) TestCompileOnClassicSystemConstraint(c *C) {
+	validTests := []struct {
+		input    string
+		expected asserts.OnClassicSystemConstraint
+	}{
+		{input: "ubuntu", expected: asserts.OnClassicSystemConstraint{DistroID: "ubuntu", VariantAny: true}},
+		{input: "ubuntu/touch", expected: asserts.OnClassicSystemConstraint{DistroID: "ubuntu", VariantID: "touch"}},
+		{input: "ubuntu/*", expected: asserts.OnClassicSystemConstraint{DistroID: "ubuntu", VariantID: "*", VariantAny: true}},
+		{input: "ubuntu/", expected: asserts.OnClassicSystemConstraint{DistroID: "ubuntu"}},
+	}
+
+	for _, test := range validTests {
+		constraint, err := asserts.CompileOnClassicSystemConstraintForTest(test.input)
+		c.Assert(err, IsNil)
+		c.Check(constraint, DeepEquals, test.expected)
+	}
+
+	invalidTests := []struct {
+		input string
+		err   string
+	}{
+		{input: "ubuntu/touch/stable", err: "invalid operating system constraint: too many '/' separators"},
+		{input: "ubuntu/!desktop", err: "invalid operating system constraint: invalid variant ID"},
+		{input: "ubuntu//", err: "invalid operating system constraint: too many '/' separators"},
+		{input: "/touch", err: "invalid operating system constraint: invalid distro ID"},
+		{input: "*", err: "invalid operating system constraint: invalid distro ID"},
+	}
+	for _, test := range invalidTests {
+		_, err := asserts.CompileOnClassicSystemConstraintForTest(test.input)
+		c.Check(err, ErrorMatches, test.err)
+	}
 }
 
 func (s *plugSlotRulesSuite) TestCompilePlugRuleInstallationConstraintsDeviceScope(c *C) {
@@ -1038,7 +1079,15 @@ func (s *plugSlotRulesSuite) TestCompilePlugRuleConnectionConstraintsOnClassic(c
 	rule, err = asserts.CompilePlugRule("iface", m["iface"].(map[string]any))
 	c.Assert(err, IsNil)
 
-	c.Check(rule.AllowConnection[0].OnClassic, DeepEquals, &asserts.OnClassicConstraint{Classic: true, SystemIDs: []string{"ubuntu", "debian"}})
+	c.Check(rule.AllowConnection[0].OnClassic, DeepEquals, &asserts.OnClassicConstraint{Classic: true, SystemIDs: []asserts.OnClassicSystemConstraint{{DistroID: "ubuntu", VariantAny: true}, {DistroID: "debian", VariantAny: true}}})
+
+	m, err = asserts.ParseHeaders([]byte("iface:\n  allow-connection:\n    on-classic:\n      - ubuntu/touch\n      - ubuntu/*\n      - ubuntu/"))
+	c.Assert(err, IsNil)
+
+	rule, err = asserts.CompilePlugRule("iface", m["iface"].(map[string]any))
+	c.Assert(err, IsNil)
+
+	c.Check(rule.AllowConnection[0].OnClassic, DeepEquals, &asserts.OnClassicConstraint{Classic: true, SystemIDs: []asserts.OnClassicSystemConstraint{{DistroID: "ubuntu", VariantID: "touch"}, {DistroID: "ubuntu", VariantID: "*", VariantAny: true}, {DistroID: "ubuntu"}}})
 }
 
 func (s *plugSlotRulesSuite) TestCompilePlugRuleConnectionConstraintsDeviceScope(c *C) {
@@ -1718,7 +1767,15 @@ func (s *plugSlotRulesSuite) TestCompileSlotRuleInstallationConstraintsOnClassic
 	rule, err = asserts.CompileSlotRule("iface", m["iface"].(map[string]any))
 	c.Assert(err, IsNil)
 
-	c.Check(rule.AllowInstallation[0].OnClassic, DeepEquals, &asserts.OnClassicConstraint{Classic: true, SystemIDs: []string{"ubuntu", "debian"}})
+	c.Check(rule.AllowInstallation[0].OnClassic, DeepEquals, &asserts.OnClassicConstraint{Classic: true, SystemIDs: []asserts.OnClassicSystemConstraint{{DistroID: "ubuntu", VariantAny: true}, {DistroID: "debian", VariantAny: true}}})
+
+	m, err = asserts.ParseHeaders([]byte("iface:\n  allow-installation:\n    on-classic:\n      - ubuntu/touch\n      - ubuntu/*\n      - ubuntu/"))
+	c.Assert(err, IsNil)
+
+	rule, err = asserts.CompileSlotRule("iface", m["iface"].(map[string]any))
+	c.Assert(err, IsNil)
+
+	c.Check(rule.AllowInstallation[0].OnClassic, DeepEquals, &asserts.OnClassicConstraint{Classic: true, SystemIDs: []asserts.OnClassicSystemConstraint{{DistroID: "ubuntu", VariantID: "touch"}, {DistroID: "ubuntu", VariantID: "*", VariantAny: true}, {DistroID: "ubuntu"}}})
 }
 
 func (s *plugSlotRulesSuite) TestCompileSlotRuleInstallationConstraintsDeviceScope(c *C) {
@@ -1885,7 +1942,15 @@ func (s *plugSlotRulesSuite) TestCompileSlotRuleConnectionConstraintsOnClassic(c
 	rule, err = asserts.CompileSlotRule("iface", m["iface"].(map[string]any))
 	c.Assert(err, IsNil)
 
-	c.Check(rule.AllowConnection[0].OnClassic, DeepEquals, &asserts.OnClassicConstraint{Classic: true, SystemIDs: []string{"ubuntu", "debian"}})
+	c.Check(rule.AllowConnection[0].OnClassic, DeepEquals, &asserts.OnClassicConstraint{Classic: true, SystemIDs: []asserts.OnClassicSystemConstraint{{DistroID: "ubuntu", VariantAny: true}, {DistroID: "debian", VariantAny: true}}})
+
+	m, err = asserts.ParseHeaders([]byte("iface:\n  allow-connection:\n    on-classic:\n      - ubuntu/touch\n      - ubuntu/*\n      - ubuntu/"))
+	c.Assert(err, IsNil)
+
+	rule, err = asserts.CompileSlotRule("iface", m["iface"].(map[string]any))
+	c.Assert(err, IsNil)
+
+	c.Check(rule.AllowConnection[0].OnClassic, DeepEquals, &asserts.OnClassicConstraint{Classic: true, SystemIDs: []asserts.OnClassicSystemConstraint{{DistroID: "ubuntu", VariantID: "touch"}, {DistroID: "ubuntu", VariantID: "*", VariantAny: true}, {DistroID: "ubuntu"}}})
 }
 
 func (s *plugSlotRulesSuite) TestCompileSlotRuleConnectionConstraintsDeviceScope(c *C) {
@@ -2134,14 +2199,11 @@ func (s *plugSlotRulesSuite) TestCompileSlotRuleErrors(c *C) {
   allow-connection:
     plug-snap-type:
       - xapp`, `plug-snap-type in allow-connection in slot rule for interface "iface" contains an invalid element: "xapp"`},
-		{`iface:
-  allow-connection:
-    on-classic:
-      x: 1`, `on-classic in allow-connection in slot rule for interface \"iface\" must be 'true', 'false' or a list of operating system IDs`},
-		{`iface:
-  allow-connection:
-    on-classic:
-      - zoom!`, `on-classic in allow-connection in slot rule for interface \"iface\" contains an invalid element: \"zoom!\"`},
+		{"iface:\n  allow-connection:\n    on-classic:\n      x: 1", `on-classic in allow-connection in slot rule for interface \"iface\" must be 'true', 'false' or a list of operating system IDs with optional /variant IDs`},
+		{"iface:\n  allow-connection:\n    on-classic:\n      -\n        distro: ubuntu", `on-classic in allow-connection in slot rule for interface "iface" must be a list of strings`},
+		{"iface:\n  allow-connection:\n    on-classic:\n      - zoom!", `on-classic in allow-connection in slot rule for interface "iface" contains an invalid element: "zoom!": invalid operating system constraint: invalid distro ID`},
+		{"iface:\n  allow-connection:\n    on-classic:\n      - ubuntu/touch/stable", `on-classic in allow-connection in slot rule for interface "iface" contains an invalid element: "ubuntu/touch/stable": invalid operating system constraint: too many '/' separators`},
+		{"iface:\n  allow-connection:\n    on-classic:\n      - ubuntu/!desktop", `on-classic in allow-connection in slot rule for interface "iface" contains an invalid element: "ubuntu/!desktop": invalid operating system constraint: invalid variant ID`},
 		{`iface:
   allow-connection:
     plug-snap-ids: