[rpms/snapd] f43: Update snapd to 2.77.1

[rpms/snapd] f43: Update snapd to 2.77.1

[Zygmunt Krynicki]

            A new commit has been pushed.

            Repo   : rpms/snapd
            Branch : f43
            Commit : 792b6e0a8467915c829e897096ee59d68d1ad9cb
            Author : Zygmunt Krynicki <me@zygoon.pl>
            Date   : 2026-09-16T13:32:46+02:00
            Stats  : +232/-52 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/snapd/c/792b6e0a8467915c829e897096ee59d68d1ad9cb?branch=f43

            Log:
            Update snapd to 2.77.1

Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>

---
diff --git a/.gitignore b/.gitignore
index 811a781..8a321c4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,5 @@
 /snapd_2.75.2.only-vendor.tar.xz
 /snapd_2.76.no-vendor.tar.xz
 /snapd_2.76.only-vendor.tar.xz
+/snapd_2.77.1.no-vendor.tar.xz
+/snapd_2.77.1.only-vendor.tar.xz

diff --git a/snapd.spec b/snapd.spec
index f4e9113..6b41c2a 100644
--- a/snapd.spec
+++ b/snapd.spec
@@ -77,7 +77,7 @@
 %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d}
 
 Name:           snapd
-Version:        2.76
+Version:        2.77.1
 Release:        0%{?dist}
 Summary:        A transactional software package manager
 License:        GPL-3.0-only
@@ -129,7 +129,7 @@ Provides:       %{name}-login-service%{?_isa} = 1.33
 %if ! 0%{?with_bundled}
 BuildRequires: golang(github.com/bmatcuk/doublestar/v4)
 BuildRequires: golang(github.com/chai2010/gettext-go)
-BuildRequires: golang(github.com/coreos/go-systemd/activation)
+BuildRequires: golang(github.com/cilium/ebpf)
 BuildRequires: golang(github.com/godbus/dbus/v5)
 BuildRequires: golang(github.com/godbus/dbus/v5/introspect)
 BuildRequires: golang(github.com/gorilla/mux)
@@ -144,8 +144,6 @@ BuildRequires: golang(golang.org/x/crypto/openpgp/armor)
 BuildRequires: golang(golang.org/x/crypto/openpgp/packet)
 BuildRequires: golang(golang.org/x/crypto/sha3)
 BuildRequires: golang(golang.org/x/crypto/ssh/terminal)
-BuildRequires: golang(golang.org/x/xerrors)
-BuildRequires: golang(golang.org/x/xerrors/internal)
 BuildRequires: golang(gopkg.in/check.v1)
 BuildRequires: golang(gopkg.in/macaroon.v1)
 BuildRequires: golang(gopkg.in/mgo.v2/bson)
@@ -225,7 +223,6 @@ BuildArch:     noarch
 %if ! 0%{?with_bundled}
 Requires:      golang(github.com/bmatcuk/doublestar/v4)
 Requires:      golang(github.com/chai2010/gettext-go)
-Requires:      golang(github.com/coreos/go-systemd/activation)
 Requires:      golang(github.com/godbus/dbus/v5)
 Requires:      golang(github.com/godbus/dbus/v5/introspect)
 Requires:      golang(github.com/gorilla/mux)
@@ -242,8 +239,6 @@ Requires:      golang(golang.org/x/crypto/openpgp/armor)
 Requires:      golang(golang.org/x/crypto/openpgp/packet)
 Requires:      golang(golang.org/x/crypto/sha3)
 Requires:      golang(golang.org/x/crypto/ssh/terminal)
-Requires:      golang(golang.org/x/xerrors)
-Requires:      golang(golang.org/x/xerrors/internal)
 Requires:      golang(gopkg.in/check.v1)
 Requires:      golang(gopkg.in/macaroon.v1)
 Requires:      golang(gopkg.in/mgo.v2/bson)
@@ -256,7 +251,6 @@ Requires:      golang(gopkg.in/yaml.v3)
 # the bundled tarball are unversioned (they go by git commit)
 Provides:      bundled(golang(github.com/bmatcuk/doublestar/v4))
 Provides:      bundled(golang(github.com/chai2010/gettext-go))
-Provides:      bundled(golang(github.com/coreos/go-systemd/activation))
 Provides:      bundled(golang(github.com/godbus/dbus/v5))
 Provides:      bundled(golang(github.com/godbus/dbus/v5/introspect))
 Provides:      bundled(golang(github.com/gorilla/mux))
@@ -273,8 +267,6 @@ Provides:      bundled(golang(golang.org/x/crypto/openpgp/armor))
 Provides:      bundled(golang(golang.org/x/crypto/openpgp/packet))
 Provides:      bundled(golang(golang.org/x/crypto/sha3))
 Provides:      bundled(golang(golang.org/x/crypto/ssh/terminal))
-Provides:      bundled(golang(golang.org/x/xerrors))
-Provides:      bundled(golang(golang.org/x/xerrors/internal))
 Provides:      bundled(golang(gopkg.in/check.v1))
 Provides:      bundled(golang(gopkg.in/macaroon.v1))
 Provides:      bundled(golang(gopkg.in/mgo.v2/bson))
@@ -307,7 +299,6 @@ Provides:      golang(%{import_path}/bootloader/lkenv) = %{version}-%{release}
 Provides:      golang(%{import_path}/bootloader/ubootenv) = %{version}-%{release}
 Provides:      golang(%{import_path}/client) = %{version}-%{release}
 Provides:      golang(%{import_path}/client/clientutil) = %{version}-%{release}
-Provides:      golang(%{import_path}/cmd/snap) = %{version}-%{release}
 Provides:      golang(%{import_path}/cmd/snap-bootstrap) = %{version}-%{release}
 Provides:      golang(%{import_path}/cmd/snap-bootstrap/triggerwatch) = %{version}-%{release}
 Provides:      golang(%{import_path}/cmd/snap-exec) = %{version}-%{release}
@@ -319,7 +310,14 @@ Provides:      golang(%{import_path}/cmd/snap-seccomp) = %{version}-%{release}
 Provides:      golang(%{import_path}/cmd/snap-seccomp/syscalls) = %{version}-%{release}
 Provides:      golang(%{import_path}/cmd/snap-update-ns) = %{version}-%{release}
 Provides:      golang(%{import_path}/cmd/snapctl) = %{version}-%{release}
+Provides:      golang(%{import_path}/cmd/snapctl/tool/snapctl) = %{version}-%{release}
+Provides:      golang(%{import_path}/cmd/snapctl/tool/snap-exec) = %{version}-%{release}
 Provides:      golang(%{import_path}/cmd/snapd) = %{version}-%{release}
+Provides:      golang(%{import_path}/cmd/snapd/cli) = %{version}-%{release}
+Provides:      golang(%{import_path}/cmd/snapd/daemon) = %{version}-%{release}
+Provides:      golang(%{import_path}/cmd/snapd/tool/snap-preseed) = %{version}-%{release}
+Provides:      golang(%{import_path}/cmd/snapd/tool/snap-gpio-helper) = %{version}-%{release}
+Provides:      golang(%{import_path}/cmd/snapd/tool/snapd-apparmor) = %{version}-%{release}
 Provides:      golang(%{import_path}/cmd/snaplock) = %{version}-%{release}
 Provides:      golang(%{import_path}/cmd/snaplock/runinhibit) = %{version}-%{release}
 Provides:      golang(%{import_path}/daemon) = %{version}-%{release}
@@ -492,37 +490,6 @@ sed -i -e '/^RestartMode=/d' data/systemd/snapd.service.in
 
 %build
 
-# Build snapd
-mkdir -p src/github.com/snapcore
-ln -s ../../../ src/github.com/snapcore/snapd
-
-export GOPATH=$(pwd):%{gopath}
-# FIXME: move spec file really to a go.mod world instead of this hack
-rm -f go.mod
-export GO111MODULE=off
-# Ensure we do not pass -mod=foo argument to go, as we disable modules and go
-# does not allow us to do both.
-sed -e 's/-mod=readonly//g' -e 's/-mod=vendor//g' <packaging/snapd.mk >packaging/snapd2.mk
-
-# Generate version files
-cat <<EOF >snapdtool/version_generated.go
-package snapdtool
-
-func init() {
-	Version = "%{version}-%{release}"
-}
-EOF
-
-cat <<EOF >cmd/VERSION
-%{version}-%{release}
-EOF
-
-cat <<EOF >data/info
-VERSION=%{version}-%{release}
-SNAPD_APPARMOR_REEXEC=0
-SNAPD_ASSERTS_FORMATS='{"account-key":1,"snap-declaration":6,"system-user":2}'
-EOF
-
 %if ! 0%{?with_bundled}
 # We don't need the snapcore fork for bolt - it is just a fix on ppc
 sed -e "s:github.com/snapcore/bolt:github.com/boltdb/bolt:g" -i advisor/*.go
@@ -568,6 +535,7 @@ EXTRA_GO_BUILD_TAGS = rpm_crashtraceback $EXTRA_TAGS
 __DEFINES__
 
 # Generate version files
+DPKG_PARSECHANGELOG="" ./mkversion.sh "%{version}-%{release}"
 
 (
 %if 0%{?rhel} == 7
@@ -604,7 +572,7 @@ autoreconf --force --install --verbose
 popd
 
 # Build snap, snapd and other tools
-%make_build -f packaging/snapd2.mk \
+%make_build -f packaging/snapd.mk \
             SNAPD_DEFINES_DIR=$PWD \
             all
 
@@ -692,10 +660,17 @@ popd
 
 # Install snap, snapd and tools
 # auto-remove unnecessary files and service units
-%make_install -f packaging/snapd2.mk \
+%make_install -f packaging/snapd.mk \
             SNAPD_DEFINES_DIR=$PWD \
             install
 
+# Install the CLI wrapper as /usr/bin/snap, replacing the symlink installed by
+# snapd.mk. The wrapper is a real binary carrying snappy_cli_exec_t so that the
+# SELinux domain transition to snappy_cli_t fires correctly on exec. This works
+# even if not using SElinux.
+rm -f %{buildroot}%{_bindir}/snap
+install -m 0755 cmd/snap-cli-wrap/snap-cli-wrap %{buildroot}%{_bindir}/snap
+
 %if 0%{?rhel} == 7
 # Install kernel tweaks
 # See: https://access.redhat.com/articles/3128691
@@ -744,10 +719,10 @@ for file in $(find . -iname "*_test.go"); do
     cp -pav $file %{buildroot}/%{gopath}/src/%{import_path}/$file
     echo "%%{gopath}/src/%%{import_path}/$file" >> unit-test-devel.file-list
 done
-if [ -d cmd/snap/testdata ]; then
-    echo "%%dir %%{gopath}/src/%%{import_path}/cmd/snap/testdata" >> devel.file-list
-    install -d -p %{buildroot}/%{gopath}/src/%{import_path}/cmd/snap/testdata
-    for file in cmd/snap/testdata/*; do
+if [ -d cmd/snapd/cli/testdata ]; then
+    echo "%%dir %%{gopath}/src/%%{import_path}/cmd/snapd/cli/testdata" >> devel.file-list
+    install -d -p %{buildroot}/%{gopath}/src/%{import_path}/cmd/snapd/cli/testdata
+    for file in cmd/snapd/cli/testdata/*; do
         cp -pav $file %{buildroot}/%{gopath}/src/%{import_path}/$file
         echo "%%{gopath}/src/%%{import_path}/$file" >> unit-test-devel.file-list
     done
@@ -765,7 +740,7 @@ done
 
 # snapd tests
 %if 0%{?with_check} && 0%{?with_unit_test} && 0%{?with_devel}
-%make_build -f packaging/snapd2.mk \
+%make_build -f packaging/snapd.mk \
             SNAPD_DEFINES_DIR=$PWD \
             check
 %endif
@@ -848,9 +823,9 @@ make -C data -k check
 %ghost %{_sharedstatedir}/snapd/seccomp/bpf/global.bin
 %dir %{_sharedstatedir}/snapd/snaps
 %dir %{_sharedstatedir}/snapd/snap
-%ghost %dir %{_sharedstatedir}/snapd/snap/bin
 %ghost %{_sharedstatedir}/snapd/state.json
 %ghost %{_sharedstatedir}/snapd/system-key
+%ghost %{_sharedstatedir}/snapd/snap/bin
 %ghost %{_sharedstatedir}/snapd/snap/README
 %dir %{_localstatedir}/cache/snapd
 %ghost %{_localstatedir}/cache/snapd/commands
@@ -905,6 +880,9 @@ make -C data -k check
 %endif
 
 %post
+# Create the private tmp directory for snap-confine
+install -d -m 0700 /tmp/snap-private-tmp
+
 %if 0%{?rhel} == 7
 %sysctl_apply 99-snap.conf
 %endif
@@ -961,6 +939,10 @@ fi
 %post selinux
 %selinux_modules_install %{_datadir}/selinux/packages/snappy.pp.bz2
 %selinux_relabel_post
+# Ensure the private tmp directory for snap-confine exists and has the correct
+# SELinux label now that the policy module is loaded
+install -d -m 0700 /tmp/snap-private-tmp
+restorecon /tmp/snap-private-tmp || :
 
 %posttrans selinux
 %selinux_relabel_post
@@ -972,6 +954,202 @@ if [ $1 -eq 0 ]; then
 fi
 
 %changelog
+* Wed Sep 02 2026 Ernest Lotter <ernest.lotter@canonical.com>
+- New upstream release 2.77.1
+ - Fix undo of unlink-component after its snap revision was discarded
+ - interfaces: power-control | allow reading all battery state files
+
+* Fri Jul 24 2026 Sergio Cazzolato <sergio.cazzolato@canonical.com>
+- New upstream release 2.77
+ - Account for differences in names of the binaries in the snapd FIPS
+   build
+ - Add code to calculate canonical subject name hash
+ - Add commands for debugging or accessing snap mount namespaces
+ - Add helpers for listing and iterating device mediation groups
+ - Add package ebpf with helpers wrapping eBPF exposed objects with
+   dependency on github.com/cilium/ebpf
+ - Add secondary prerequisites task that acts as the synchronization
+   point, which ensures that a snap's prerequisites are available
+   before it's installed
+ - Add support for shell conditional syntax in envs
+ - Added /usr/share/{man,help,info} to system-packages-doc
+ - asserts: add validation-sets confdb-schema builtin
+ - asserts: ensure that compatibility labels are strings
+ - asserts: extend on-classic constraints to accept "distro/variant",
+   "distro/*", and "distro/" under a new snap-declaration format 7
+ - asserts: validate serial in newDeviceIDFromString
+ - Bump github.com/canonical/go-efilib to v1.8.0 to include fixes for
+   efivars probe
+ - confdb: add validation-sets handler and fix data loss when writing
+   to new schemas or accounts
+ - confdb: fix bug on reading uneven lists
+ - confdb: literal subkeys are sorted after placeholders
+ - confdb: run observe-view-* hooks after commit
+ - confdb: support Encode/Decode for builtins
+ - confdb: support sign-only external keypair backends
+ - core-initrd: add missing libbpf and systemd dlopen dependencies,
+   and increase mount burst
+ - Drop task logs for delayed effects
+ - During snap removal, clear-snap task errors early if there are
+   user mounts in snap data dirs
+ - Enable reverts to trigger a seed refresh
+ - Ensure profiles are setup before running prepare-{slot, plug}*
+   hooks
+ - Ensure that prereqs created by initial refresh run before create-
+   recovery-system
+ - Exclude Georgian from translation linting
+ - experimental features: graduate layouts, classic-preserves-xdg-
+   runtime-dir, refresh-app-awareness, and dbus-activation features
+ - experimental features: warn when setting graduated or default-
+   enabled experimental features and do not store settings for
+   graduated features
+ - Expose individual certs as well as c_rehash emulation
+ - Extend autogen with explicit --sysconfdir
+ - External keypair manager: add shared external key manager
+   implementation
+ - External keypair manager: refactor GPG and external keypair
+   managers to use extKeypairMgrImpl
+ - External keypair manager: support external OPENPGP signing in
+   ExternalKeypairManager
+ - FDE: add post install actions API
+ - FDE: add reprovision API
+ - FDE: add reprovision recovery key generation API
+ - FDE: add reseal check after snapd refresh
+ - FDE: allow reprovision without factory reset
+ - FDE: change makebootable part of the boot package to not take
+   install observers as parameters
+ - FDE: extend storage-encrypted system information
+ - FDE: make reprovision only seal
+ - FDE: remove all tmp keyslots on error
+ - FDE: remove check for unchanged authentication options
+ - FDE: run post install checks during auto repair
+ - Filter seed-refresh based on model and seed presence
+ - Fix failing snap remove when there are snapctl created mounts
+   under snap global data dirs
+ - Fix postNotices to validate before locking state
+ - Guard the ensure check from running on classic
+ - Implement remodeling fully in terms of updates
+ - Implement ShutDown for HookManager
+ - Include variables SNAP_APP_NAME, and when applicable
+   SNAP_APP_COMMON_ID, SNAP_APP_DESKTOP_FILE and SNAP_APP_BUS_NAME in
+   snap application environments
+ - interfaces: add xdg-portal-permission-store interface
+ - interfaces: allow gtk css in subdirectories
+ - interfaces: allow systemd networkd link property changes via D-Bus
+ - interfaces: allow the systemd networkctl command
+ - interfaces: allow Wine to execute files accessed via the Document
+   Portal
+ - interfaces: apparmor-observe | add interface
+ - interfaces: attempt to fix content with parallel installs
+ - interfaces: devlxd | fix access for LXD containers
+ - interfaces: docker | allow connecting to system-wide docker on
+   classic
+ - interfaces: grant default access to memory.high in a snap's cgroup
+ - interfaces: iscsi-initiator | allow access to /var/lib/iscsi/nodes
+ - interfaces: kernel-sched-ext-control | add the kernel sched-ext
+   control interface implementation
+ - interfaces: make polkit and upower implicit on Core systems only
+ - interfaces: open-iscsi | add missing state paths
+ - interfaces: opengl | expose wsl libraries
+ - interfaces: u2f-devices | add atkey PID and relative VID support
+ - List dir contents on failure to remove snap base data dir
+ - List non-snapctl mounts in snap data dirs
+ - LP: #2072331 Validate map keys in JSON config values
+ - LP: #2110510 Interfaces: allow reading of /proc/self/smaps_rollup
+ - LP: #2143934 Interfaces: network-control, network-manager | allow
+   missing resolve1 link setters
+ - LP: #2160691 Security logging: strip trailing whitespace from
+   audit netlink message payload
+ - LP: #2161982 Interfaces: vsock | add interface for VM guest
+   services
+ - Make arguments of debug mount-namespace consistent with other
+   debug commands
+ - Make bootloader logging less verbose
+ - Make cert manager garbage check run after symlink migration
+ - Make secondary prerequisite synchronization task handle same-
+   change retries
+ - mkversion.sh: do describe in worktrees too
+ - multi-entry snapd: merge snap and snapd binaries
+ - multi-entry snapd: move debug device-cgroup implementation file
+   under cmd/snapd/cli
+ - multi-entry snapd: move snap-gpio-helper sources around before
+   transitioning to multi-entry dispatch
+ - multi-entry snapd: move snapd-apparmor sources to a dedicated tool
+   location
+ - multi-entry snapd: move source files around in preparation for
+   snapd/snap merge
+ - multi-entry snapd: move the snap-preseed sources around in
+   preparation
+ - multi-entry snapd: move the sources of snapctl and snap-exec in
+   preparation for the multi-entry dispatch
+ - Never create seed refresh tasks during a remodel
+ - packaging: assign a default label for /tmp/snap-private-tmp and
+   set it during installation
+ - packaging: build deb with Go 1.23 for noble and jammy, Go 1.22 for
+   focal
+ - packaging: drop SNAP_TAGS
+ - packaging: drop symlinks for opensuse 15.5/15.6 packaging
+ - packaging: fix service startup during install and session-agent
+   socket handling on Ubuntu 26.04+
+ - packaging: fix stderr redirection
+ - packaging: restore gbp.conf output directory for Ubuntu 26.04
+   builds
+ - packaging: switch to apparmor 5.x with 5 ABI
+ - packaging: update bundled AppArmor to 5.0.2 and accept the 5.0 ABI
+   when running as deb
+ - packaging: use a relative symlink for snapctl and update steam-
+   support udev rules
+ - Preserve component in hook security tags
+ - Prevent removal of seed-refresh snaps when seed-refresh is enabled
+ - Refactor base-declaration into 1st class builtin assertion
+ - Refactor how the is-originating-from-snap-command advisory check
+   works
+ - Refactor prerequisites task handler to enable proper seed-refresh
+   integration
+ - Reintroduce fdstore helpers
+ - remote device management: add task to validate request messages
+ - remote device management: apply management messages, queue
+   response messages, and improve sequencing and redelivery handling
+ - Remove osutil unused AtomicWriteFollow flag
+ - Remove xerrors dependency
+ - Reuse existing seed-refresh implementation for free during single-
+   path installation
+ - Rework how SnapSetup.SnapPath is used
+ - seccomp: allow rseq_slice_yield
+ - security logging: add seclog API for administrative actions and
+   token create/remove events
+ - security logging: add security logging for adding, updating and
+   removing a snapd user
+ - Set target hostname from install-mode
+ - snap-confine: improve loading of BPF programs, retry on failures
+   to collect verifier logs
+ - snap-confine: use profile and flags= in snap-confine and snap-
+   update-ns' AppArmor profiles
+ - snap-confine: work around kernel mnt_ns_loop() ordering bug on
+   6.18.x
+ - snap: add debug command for listing currently mediated devices for
+   a given snap
+ - snap: fix self-managed cgroup support checks
+ - snap: report hidden file access for paths allowed by home when
+   prompting is active
+ - snap: report read-only file access for paths allowed by system-
+   package-doc
+ - snapctl async support: add --format json to snap tasks to be
+   consistent with snapctl
+ - snapctl async support: add snapctl tasks command
+ - snapctl async support: async feature negotiation between snap
+   client and daemon
+ - snapctl async support: fix snapctl is-ready exit codes
+ - snapctl async support: re-enable snapctl async functionality
+ - snapshots: restore preserves snapctl created mounts
+ - snapshots: save excludes all mount points
+ - Support ca-certificate.crt only systems like core26
+ - Turn on quota-groups by default
+ - Use 0755 for certificate generation directories
+ - Use CreateTemp for NewAtomicFile tmp file creation
+ - Verify cached downloads in the do path and detect obvious
+   corruption
+
 * Thu May 28 2026 Ernest Lotter <ernest.lotter@canonical.com>
 - New upstream release 2.76
  - assertions: add helper for validating integrity data

diff --git a/sources b/sources
index 87b3e3c..ac3edf4 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (snapd_2.76.no-vendor.tar.xz) = 628a16d8487a1c85fb62f89682469e4b49a966412fa96f0d03d2e18f98a7dc435b34e8dd0d0a730843a80a7920c9807118dd38328f4bae44198e180b6ed8379b
-SHA512 (snapd_2.76.only-vendor.tar.xz) = d109f3fbec5c4df73f9d42425b63bfbac3397ac3c407a37603743ca5970c6d945a96c3ec51f0a1ebd6d135275a3b86e8b232bbdb163d94190faad0fd5c96f300
+SHA512 (snapd_2.77.1.no-vendor.tar.xz) = 7a282a650fb21553ef245899a9e5ae11d377540e48746a89c4a63e2f1febcd9bb9bba70d4f851d2d687dae17fb1d4dcf6cdccfbc95e03539b22756b4e04aee15
+SHA512 (snapd_2.77.1.only-vendor.tar.xz) = 3ace60d707d9aff9510bae1817e46bb52916863534ee2061534bc45282eb3f183fbe8880b485136e53b6873de555efa09f168157288af3845d6c2589aa8c515c