1#@!#!123s

: / proc / self / root / snap / snapd / 25202 / snap /
Filename : manifest.yaml
back
snapcraft-version: 8.10.2
snapcraft-started-at: '2025-07-27T14:30:41.433648Z'
snapcraft-os-release-id: ubuntu
snapcraft-os-release-version-id: '22.04'
name: snapd
version: '2.71'
summary: Daemon and tooling that enable snap packages
description: |
  Install, configure, refresh and remove snap packages. Snaps are
  'universal' packages that work across many different Linux systems,
  enabling secure distribution of the latest apps and utilities for
  cloud, servers, desktops and the internet of things.

  Start with 'snap list' to see installed snaps.
base: null
grade: stable
confinement: strict
apps: null
parts:
  dynamic-linker:
    build-environment:
    - DYNAMIC_LINKER: ld-linux-x86-64.so.2
    plugin: nil
    build-packages:
    - gawk
    - bison
    - quilt
    - python3-pyelftools
    source: https://git.launchpad.net/ubuntu/+source/glibc
    source-branch: ubuntu/jammy-updates
    source-type: git
    override-pull: |
      craftctl default
      QUILT_PATCHES=debian/patches quilt push -a
      patch -p1 <"/build/snapd/build-aux/snap/local/rename-dynamic-loader-variables.patch"
    override-build: |
      rm -rf build
      mkdir -p build
      cd build
      unset LDFLAGS
      unset CPPFLAGS
      export CFLAGS="-pipe -O2 -g"
      cat <<EOF >configparms
      libdir=/snap/snapd/current/usr/lib/x86_64-linux-gnu
      slibdir=/snap/snapd/current/usr/lib/x86_64-linux-gnu
      rtldir=/snap/snapd/current/usr/lib/x86_64-linux-gnu
      EOF
      "${CRAFT_PART_SRC_WORK}/configure" --prefix=/snap/snapd/current/usr
      make -j"4" -C .. objdir="${PWD}" "${PWD}/linkobj/libc_pic.a"
      make elf/ldso_install DESTDIR="${CRAFT_PART_INSTALL}"
      strip "${CRAFT_PART_INSTALL}/snap/snapd/current/usr/lib/x86_64-linux-gnu/${DYNAMIC_LINKER}"
      install -Dm755 -t "${CRAFT_PART_INSTALL}/usr/lib/x86_64-linux-gnu" "${CRAFT_PART_INSTALL}/snap/snapd/current/usr/lib/x86_64-linux-gnu/${DYNAMIC_LINKER}"
    stage:
    - usr/lib/x86_64-linux-gnu/ld*.so*
    stage-packages: []
    prime: []
  runtime:
    build-environment:
    - DYNAMIC_LINKER: ld-linux-x86-64.so.2
    plugin: nil
    stage-packages:
    - libblkid1=2.37.2-4ubuntu3.4
    - libbrotli1=1.0.9-2build6
    - libc6=2.35-0ubuntu3.10
    - libcap2=1:2.44-1ubuntu0.22.04.2
    - libexpat1=2.4.7-1ubuntu0.6
    - libfreetype6=2.11.1+dfsg-1ubuntu0.3
    - libgcc-s1=12.3.0-1ubuntu1~22.04
    - liblz4-1=1.9.3-2build2
    - liblzma5=5.2.5-2ubuntu1
    - liblzo2-2=2.10-2build3
    - libpng16-16=1.6.37-3build5
    - libseccomp2=2.5.3-2ubuntu3~22.04.1
    - libudev1=249.11-0ubuntu3.16
    - libzstd1=1.4.8+dfsg-3build1
    - squashfs-tools=1:4.5-3build1
    - xdelta3=3.0.11-dfsg-1.2
    - zlib1g=1:1.2.11.dfsg-2ubuntu9.2
    stage:
    - -usr/lib/x86_64-linux-gnu/ld*.so*
    - -lib32
    - -lib64
    - -usr/lib32
    - -usr/lib64
    - -etc/ld.so.conf.d
    - -usr/share/man
    - -usr/share/lintian
    - -usr/share/lintian/**
    - -usr/lib/x86_64-linux-gnu/libnss_*.so.2
    override-build: |
      craftctl default
      cp -avT "${CRAFT_PART_INSTALL}/lib/x86_64-linux-gnu" "${CRAFT_PART_INSTALL}/usr/lib/x86_64-linux-gnu"
      rm -rf "${CRAFT_PART_INSTALL}/lib/x86_64-linux-gnu"
      rm -f "${CRAFT_PART_INSTALL}/lib/${DYNAMIC_LINKER}"
      find "${CRAFT_PART_INSTALL}/usr/share/doc" \( -not -type d -not -name "copyright" -delete \) -o \( -type d -empty -delete \)
    prime: []
    build-packages: []
  prime-runtime:
    build-environment:
    - DYNAMIC_LINKER: ld-linux-x86-64.so.2
    plugin: nil
    after:
    - runtime
    override-prime: |
      craftctl default
      CRAFT_PART_INSTALL="${CRAFT_PART_INSTALL}/../../runtime/install" \
        python3 "/build/snapd/build-aux/snap/local/patch-dl.py" "/snap/snapd/current/usr/lib/x86_64-linux-gnu/${DYNAMIC_LINKER}"
    stage-packages: []
    stage: []
    prime: []
    build-packages: []
  apparmor:
    build-environment:
    - DYNAMIC_LINKER: ld-linux-x86-64.so.2
    plugin: autotools
    build-packages:
    - autoconf-archive
    - bison
    - flex
    - gettext
    - g++
    - pkg-config
    - wget
    source: https://gitlab.com/apparmor/apparmor/-/archive/v4.0.2/apparmor-v4.0.2.tar.gz
    source-checksum: sha256/0b847751b8c0e2344169ec2065cad6251063c5c5ff311953e194bbf25686d981
    override-build: |
      # For some reason, some snapcraft version remove the "build-aux" folder
      # and move the contents up when the data is uploaded; this conditional
      # manages it.
      LOCAL_APPARMOR_DIR="/build/snapd"/build-aux/snap/local/apparmor/
      if [ ! -d $LOCAL_APPARMOR_DIR ]; then
        LOCAL_APPARMOR_DIR="/build/snapd"/snap/local/apparmor/
      fi
      # apply prompting patch from the build-aux folder - this is the same as
      # what is used in the Ubuntu 24.10 (oracular) version
      patch -p1 < "${LOCAL_APPARMOR_DIR}"/parser-add-support-for-prompting.patch
      # apply compatibility fix for older kernels
      patch -p1 < "${LOCAL_APPARMOR_DIR}"/apparmor-parser-fix-protocol-error-on-older-kernels-caused-by.patch

      cd "${CRAFT_PART_BUILD}"/libraries/libapparmor
      ./autogen.sh
      ./configure --prefix=/usr --libdir="/usr/lib/x86_64-linux-gnu" --disable-man-pages --disable-perl --disable-python --disable-ruby
      make -j"4"
      make -C src install DESTDIR="${CRAFT_PART_INSTALL}"
      make -C include install DESTDIR="${CRAFT_PART_INSTALL}"
      cd ${CRAFT_PART_BUILD}/parser
      # copy in a pregenerated list of network address families so that the
      # parser gets built to support as many as possible even if glibc in
      # the current build environment does not support them
      cp -a "${LOCAL_APPARMOR_DIR}"/af_names.h .
      make -j"4"
      install -Dm755 -t "${CRAFT_PART_INSTALL}/usr/lib/snapd" apparmor_parser
      install -Dm644 -t "${CRAFT_PART_INSTALL}/usr/lib/snapd/apparmor" parser.conf
      cd "${CRAFT_PART_BUILD}/profiles"
      make -j"4"
      mkdir -p "${CRAFT_PART_INSTALL}/usr/lib/snapd/apparmor.d"
      cp -a apparmor.d/abi "${CRAFT_PART_INSTALL}/usr/lib/snapd/apparmor.d"
      cp -a apparmor.d/abstractions "${CRAFT_PART_INSTALL}/usr/lib/snapd/apparmor.d"
      cp -a apparmor.d/tunables "${CRAFT_PART_INSTALL}/usr/lib/snapd/apparmor.d"
    prime:
    - -usr/lib/x86_64-linux-gnu/**
    - -usr/include
    override-prime: |
      craftctl default
      python3 "/build/snapd/build-aux/snap/local/patch-dl.py" "/snap/snapd/current/usr/lib/x86_64-linux-gnu/${DYNAMIC_LINKER}"
    stage-packages: []
    stage: []
  patchelf:
    plugin: autotools
    build-packages:
    - autoconf-archive
    source: http://archive.ubuntu.com/ubuntu/pool/universe/p/patchelf/patchelf_0.18.0.orig.tar.gz
    source-checksum: sha256/1451d01ee3a21100340aed867d0b799f46f0b1749680028d38c3f5d0128fb8a7
    prime:
    - -*
    stage-packages: []
    stage: []
  snapd:
    build-environment:
    - DYNAMIC_LINKER: ld-linux-x86-64.so.2
    plugin: nil
    source: .
    build-snaps:
    - go/1.23/stable
    after:
    - apparmor
    - patchelf
    build-packages:
    - git
    - dpkg-dev
    - autoconf
    - autoconf-archive
    - automake
    - xfslibs-dev
    - libblkid-dev
    - libudev-dev
    - libcap-dev
    - libseccomp-dev
    - libselinux1-dev
    - pkg-config
    - libcap2-bin
    override-pull: |
      craftctl default
      # set version, this needs dpkg-parsechangelog (from dpkg-dev) and git
      VERSION="$(./mkversion.sh --output-only)"

      if [ -f fips-build ]; then
          # CI can set a build stamp for enabling the FIPS build mode
          echo "-- detected FIPS build from CI build stamp"
      fi

      if [ "${VERSION/+fips/}" != "$VERSION" ] ; then
          # we have a '+fips' element in the version, which may be coming from
          # debian/changelog or git tag
          echo "-- detected FIPS build from version $VERSION"
          touch fips-build
      fi

      # check for triggers that indicate a build on LP of the snapd-fips snap
      # recipe https://launchpad.net/~fips-cc-stig/fips-cc-stig/+snap/snapd-fips
      is_lp_fips_build="$(./release-tools/is-lp-fips-build.sh)"
      if [ "$is_lp_fips_build" = "true" ]; then
          echo "-- detected FIPS build from LP location"
          touch fips-build
          touch fips-build-lp
      fi

      if [ -f fips-build ]; then
          if [ "${VERSION/+fips/}" = "$VERSION" ] ; then
              # we have a fips-build marker, but fips tag isn't yet part of the
              # snap version, let's add it
              echo "-- appending FIPS tag to version $VERSION"
              VERSION="$VERSION+fips"
          fi
      fi

      if [ -f test-build ]; then
          VERSION="1337.${VERSION}"
      fi
      craftctl set version="$VERSION"

      ./get-deps.sh --skip-unused-check
    override-build: |
      # this should be passed through build environment, but we're already
      # anchoring dynamic linker env variables
      GO_TOOLCHAIN_FIPS_CHANNEL="1.21-fips/stable"

      VERSION="$(craftctl get version)"
      if [ -f fips-build ] ; then
          # use the fips channel of Go
          snap refresh --channel "$GO_TOOLCHAIN_FIPS_CHANNEL" go
          # make sure it is really the Go FIPS toolchain
          if ! test -f /snap/go/current/src/crypto/internal/backend/openssl_linux.go; then
              echo "Go FIPS toolschain verification failed: cannot find /snap/go/current/src/crypto/internal/backend/openssl_linux.go"
              exit 1
          fi
      fi
      # make sure to set the version we declared in pull
      ./mkversion.sh "$VERSION"

      # double check the toolchain
      echo "--- go version $(go version)"
      echo "--- go is at $(which go)"

      cd "${CRAFT_PART_BUILD}/cmd"

      autoreconf -fvi
      ./configure \
        --prefix=/usr \
        --libexec=/usr/lib/snapd \
        --sysconfdir=/etc \
        --localstatedir=/var \
        --without-unit-tests \
        --enable-apparmor \
        --enable-static-libapparmor \
        --enable-selinux \
        --enable-static-libselinux \
        --disable-host-binaries \
        --enable-nvidia-multiarch \
        --with-host-arch-triplet=$(dpkg-architecture -qDEB_HOST_MULTIARCH) \
        $(test "$(uname -m)" = x86_64 && echo --with-host-arch-32bit-triplet=$(dpkg-architecture -ai386 -qDEB_HOST_MULTIARCH))

      make -j"4"
      make DESTDIR="${CRAFT_PART_INSTALL}" install

      cd "${CRAFT_PART_BUILD}"

      # Disable buildvcs:
      #  * We do not use it
      #  * When building in a git worktree, snapcraft does not share
      #    the main directory, and it fails.
      EXTRA_GO_FLAGS="-buildvcs=false"

      CMDS=(bin/snap
            lib/snapd/snapd
            # core-initrd for UC20 still depends on snap-bootstrap
            # being started from snap because of broken re-execution
            # and fixes that were not yet backported
            lib/snapd/snap-bootstrap
            lib/snapd/snap-exec
            lib/snapd/snap-failure
            lib/snapd/snap-fde-keymgr
            lib/snapd/snap-preseed
            lib/snapd/snap-recovery-chooser
            lib/snapd/snap-repair
            lib/snapd/snap-seccomp
            lib/snapd/snap-update-ns
            lib/snapd/snapctl
            lib/snapd/snapd-apparmor
            lib/snapd/snap-gpio-helper)
      for cmd in "${CMDS[@]}"; do
        case "${cmd}" in
           # FIXME: some binaries need to be run confined in apps. But
           # instead we should allow apps to access dynamic linkers
           # and libraries from snapd.
           lib/snapd/snap-exec|lib/snapd/snapctl)
             export CGO_ENABLED=0
             GO_LD_FLAGS=()
             CHECK_STATIC=1
             ;;
           lib/snapd/snap-update-ns)
             export CGO_ENABLED=1
             GO_LD_FLAGS=(-ldflags '-extldflags "-static"')
             CHECK_STATIC=1
             ;;
           *)
             export CGO_ENABLED=1
             GO_LD_FLAGS=()

             case "amd64" in
               arm64|armhf)
                 GO_LD_FLAGS+=(-ldflags "-extldflags \"-L/usr/lib/x86_64-linux-gnu"\")
                 ;;
             esac

             case "amd64" in
               armhf)
                 # https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1822738
                 ;;
               *)
                 GO_LD_FLAGS+=(-buildmode=pie)
                 ;;
             esac
             unset CHECK_STATIC
             ;;
        esac

        TAGS=(snapdusergo osusergo)

        # general build tags, note that version 1337 is used only in CI and
        # triggers testing specific build tags which produce binaries that are
        # insecure for use in production systems
        case "${cmd}" in
          bin/snap)
            TAGS+=(nomanagers)
            ;;
          lib/snapd/snap-bootstrap)
            TAGS+=(nomanagers)
            case "amd64" in
              arm64|armhf)
                TAGS+=(withoptee)
                ;;
            esac
            ;;
          lib/snapd/snapd)
            case "amd64" in
              arm64|armhf)
                TAGS+=(withoptee)
                ;;
            esac
            ;;
        esac

        case "${VERSION}" in
          1337.*)
            case "${cmd}" in
              bin/snap)
                TAGS+=(withtestkeys faultinject statelocktrace structuredlogging)
                ;;
              *)
                TAGS+=(withtestkeys withbootassetstesting faultinject statelocktrace structuredlogging)
                ;;
            esac
            ;;
        esac

        # FIPS specific build tags
        if [ -f fips-build ]; then
          case "${cmd}" in
            # per snapd FIPS spec, FIPS build tags are only relevant for snapd,
            # snap, snap-repair and snap-bootstrap, tags:
            # - goexperiment.opensslcrypto - enable openssl crypto backend
            # - snapdfips - enable additional FIPS support (enforce FIPS compliant TLS)
            bin/snap|lib/snapd/snapd|lib/snapd/snap-repair|lib/snapd/snap-bootstrap)
              TAGS+=(goexperiment.opensslcrypto snapdfips)
              ;;
          esac
        fi

        output="${CRAFT_PART_INSTALL}/usr/${cmd}"
        go build -mod=vendor -tags "${TAGS[*]}" "${GO_LD_FLAGS[@]}" ${EXTRA_GO_FLAGS-} -o "${output}" "github.com/snapcore/snapd/cmd/$(basename ${cmd})"
        if [ "${CHECK_STATIC-}" = 1 ]; then
          if objdump -p "${output}" | grep INTERP; then
            echo "${output} is not static!" 1>&2
            exit 1
          fi
        fi
        unset CGO_ENABLED
      done

      make -C data -j"4" all
      # wrappers/core18.go expects units in fixed paths so even when
      # systemd package will those, they have to continue to match our
      # paths. We force the value here in case we change the default.
      make -C data install DESTDIR="${CRAFT_PART_INSTALL}" SYSTEMDUSERUNITDIR=/usr/lib/systemd/user SYSTEMDSYSTEMUNITDIR=/lib/systemd/system
      # UC depends on this name (symlink)
      mv "${CRAFT_PART_INSTALL}/etc/profile.d/snapd.sh" "${CRAFT_PART_INSTALL}/etc/profile.d/apps-bin-path.sh"

      install -Dm644 data/info "${CRAFT_PART_INSTALL}/usr/lib/snapd/info"
      install -Dm644 data/preseed.json "${CRAFT_PART_INSTALL}/usr/lib/snapd/preseed.json"

      install -Dm644 -t "${CRAFT_PART_INSTALL}/usr/lib/snapd" data/completion/bash/complete.sh data/completion/bash/etelpmoc.sh
      install -Dm644 -t "${CRAFT_PART_INSTALL}/usr/share/bash-completion/completions" ./data/completion/bash/snap

      # TODO: For now snapd expects a renamed apparmor profile to
      # work-around LP#1673247. We should fix that since the snapd
      # should not need that work-around.
      mv "${CRAFT_PART_INSTALL}/etc/apparmor.d/usr.lib.snapd.snap-confine" "${CRAFT_PART_INSTALL}/etc/apparmor.d/usr.lib.snapd.snap-confine.real"

      # copy helper for collecting debug output
      cp -av debug-tools/snap-debug-info.sh ${CRAFT_PART_INSTALL}/usr/lib/snapd/

      if sh -x ./mkversion.sh --output-only | grep "dirty"; then
        mkdir -p "${CRAFT_PART_INSTALL}/usr/lib/snapd"
        (
          echo "dirty git tree during build detected:"
          git status
          git diff
        ) > "${CRAFT_PART_INSTALL}/usr/lib/snapd/dirty-git-tree-info.txt"
      fi

      find "${CRAFT_PART_INSTALL}/usr/lib/snapd" "${CRAFT_PART_INSTALL}/usr/bin" -type f -exec strip {} ";"

      if [ -f fips-build ]; then
        touch "${CRAFT_PART_INSTALL}/fips-build"
      fi
      if [ -f fips-build-lp ]; then
        touch "${CRAFT_PART_INSTALL}/fips-build-lp"
      fi

      # ensure capabilities are set
      setcap -q - "${CRAFT_PART_INSTALL}/usr/lib/snapd/snap-confine" \
           < "${CRAFT_PART_INSTALL}/usr/lib/snapd/snap-confine.caps"
      getcap "${CRAFT_PART_INSTALL}/usr/lib/snapd/snap-confine"
    prime:
    - -fips-build
    - -fips-build-lp
    override-prime: |
      craftctl default
      # use patchelf built in earlier step
      PATH="/build/snapd/stage"/usr/local/bin:$PATH \
          "/build/snapd/build-aux/snap/local/patch-dl.py" \
              "/snap/snapd/current/usr/lib/x86_64-linux-gnu/${DYNAMIC_LINKER}"

      # verify file capabilities
      caps="$(getcap "${CRAFT_PART_INSTALL}/usr/lib/snapd/snap-confine" | awk '{print $2}')"
      expected_caps="$(cat "${CRAFT_PART_INSTALL}/usr/lib/snapd/snap-confine.caps")"
      echo "-- expecting caps: $expected_caps"
      echo "-- actual caps:    $caps"
      test "$caps" = "$expected_caps"
    stage-packages: []
    stage: []
  libcrypto-fips:
    plugin: nil
    after:
    - snapd
    override-build: |
      # XXX this should be done in pull, but apparently ordering is not honored
      # for 'pull' step of parts

      # FIPS stamp files were created in the 'snap' part build
      if [ -f "/build/snapd/stage/fips-build-lp" ]; then
        mkdir -p etc/apt/preferences.d/
        # need to up the priority of the repository
        # TODO what if we need to choose between FIPS and FIPS preview?
        cat <<-'EOF' > /etc/apt/preferences.d/fips.pref
      Package: *
      Pin: release o=LP-PPA-ubuntu-advantage-pro-fips-updates
      Pin-Priority: 1010
      EOF
        apt update
        # FIPS libraries required by snapd
        mkdir fips-debs
        (
          cd fips-debs
          apt download openssl libssl3 openssl-fips-module-3
        )
      elif [ -f "/build/snapd/stage/fips-build" ]; then
        # grab the core22 from fips-updates channel
        snap download --channel fips-updates/stable --basename core22-fips core22
      fi

      # TODO this is really a hack as we should likely be using on LP; The snapd
      # snap should include the information about a particular openssl version
      # which was included in the build but the core22 FIPS variant snap has
      # been stripped off of the manifest.
      if [ -f "/build/snapd/stage/fips-build-lp" ]; then
        mkdir fips-libs-from-debs
        mkdir fips-libs-from-debs-stage

        # extract
        for f in fips-debs/*.deb; do
          dpkg -x "$f" fips-libs-from-debs
        done

        # and cherry pick the files we want
        (
          cd fips-libs-from-debs

          # XXX note with -print0 only the last match is printed
          find . \
            \( \
              -wholename './usr/lib/*-linux-gnu*/engines-3' \
              -o -wholename  './usr/lib/*-linux-gnu*/ossl-modules-3' \
              -o -wholename './usr/lib/*-linux-gnu*/libssl.so.3' \
              -o -wholename './usr/lib/*-linux-gnu*/libcrypto.so.3' \
            \) -print0 | \
              xargs -0 -- cp -av --parents --target ../fips-libs-from-debs-stage/
        )
        cp -av fips-libs-from-debs-stage/* "${CRAFT_PART_INSTALL}"
      elif [ -f "/build/snapd/stage/fips-build" ]; then
        unsquashfs -d core22-fips-squashfs-root core22-fips.snap \
          'usr/lib/*-linux-gnu*/engines-3' \
          'usr/lib/*-linux-gnu*/ossl-modules-3' \
          'usr/lib/*-linux-gnu*/libssl.so.3' \
          'usr/lib/*-linux-gnu*/libcrypto.so.3'
        cp -av core22-fips-squashfs-root/* "${CRAFT_PART_INSTALL}"
      fi
      find "${CRAFT_PART_INSTALL}/" -ls
    stage-packages: []
    stage: []
    prime: []
    build-packages: []
  check-linker:
    build-environment:
    - DYNAMIC_LINKER: ld-linux-x86-64.so.2
    plugin: nil
    build-packages:
    - patchelf
    after:
    - snapd
    - runtime
    - prime-runtime
    - apparmor
    - dynamic-linker
    override-prime: |
      craftctl default
      "/build/snapd/build-aux/snap/local/verify-dl.py" \
          "/snap/snapd/current/usr/lib/x86_64-linux-gnu/${DYNAMIC_LINKER}"
    stage-packages: []
    stage: []
    prime: []
architectures:
- amd64
image-info:
  build-request-id: lp-100253431
  build-request-timestamp: '2025-07-27T14:00:17Z'
  build_url: https://launchpad.net/~snappy-dev/+snap/snapd/+build/2860853
build-packages: []
build-snaps: []
primed-stage-packages:
- libblkid1=2.37.2-4ubuntu3.4
- libbrotli1=1.0.9-2build6
- libc6=2.35-0ubuntu3.10
- libcap2=1:2.44-1ubuntu0.22.04.2
- libexpat1=2.4.7-1ubuntu0.6
- libfreetype6=2.11.1+dfsg-1ubuntu0.3
- libgcc-s1=12.3.0-1ubuntu1~22.04
- liblz4-1=1.9.3-2build2
- liblzma5=5.2.5-2ubuntu1
- liblzo2-2=2.10-2build3
- libpng16-16=1.6.37-3build5
- libseccomp2=2.5.3-2ubuntu3~22.04.1
- libudev1=249.11-0ubuntu3.16
- libzstd1=1.4.8+dfsg-3build1
- squashfs-tools=1:4.5-3build1
- xdelta3=3.0.11-dfsg-1.2
- zlib1g=1:1.2.11.dfsg-2ubuntu9.2