Release 29 #2677

If we detect we have a corrupted lock in the system, we are now alerting the user about that with steps to solve that scenario LP: #1996931

If we have not set the ssh keys when running integration tests, we might accidentally delete the ssh keys stored in the user .ssh folder. We are checking to see if the keys are stored in that folder before deleting it

Signed-off-by: Renan Rodrigo <[email protected]>

lunar is now tested where kinetic is tested, except on some cases where it is not possible yet - those will be done in 3 months lunar is now part of the GH CI Signed-off-by: Renan Rodrigo <[email protected]>

When we are gathering related USNs, we must ensure that they are indeed USNs. To do that, we are ignoring any security id that doesn't start with USN

The previous interface to readurl had different return types depending on the request, and it propogated exceptions that were raised from the urllib library. Those urllib exceptions were then caught and used in various places throughout the codebase. The upcoming tls-in-tls implementation will require swapping out the urllib request function for a pycurl-based one, which will not have any of the same return types or exceptions as urllib, so we need to stop using urllib-specific things everywhere. To achieve this, I've defined a simple HTTPResponse tuple that will always be returned by the readurl function - this should be easily implemented by any underlying http implementation. Notice that the function always returns this tuple, even if there is a http code above 300. Previously we expected/excepted errors on 4xx/5xx responses, so I've changed a lot of the calling code to check the return code rather than except errors. The only error that is raised is now our exceptions.UrlError and I've redefined it to only be raised if something about the connection fails.

Same keys, just different names to standardize them all as pro. Fixes: #1539 Signed-off-by: Renan Rodrigo <[email protected]>

Signed-off-by: Renan Rodrigo <[email protected]>

Fixes: #2463 Signed-off-by: Renan Rodrigo <[email protected]>

Always require a contract token in the environment if the test has an attachment step. If the whole feature requires attachment, require it on feature level. If the feature does not imply attachment, require it on scenario level. Signed-off-by: Renan Rodrigo <[email protected]>

This avoids a possible inconsistent state between checking if a file exists and trying to remove it. LP: #2025731 Signed-off-by: Renan Rodrigo <[email protected]>

Signed-off-by: Renan Rodrigo <[email protected]>

If there is no argument, default to the system dpkg architecture. Signed-off-by: Renan Rodrigo <[email protected]>

Add support to read and process the additionalSnaps directive. Right now, we are only trying to install the snaps included in that directive. In the future, we can perform more snap related checks before installing the snap

When creating the tarball to be used when building the package, we should not check for changes on the keyrings folder

Add support for enabling the anbox-cloud service. This service will not only configure apt sources but should also install required snaps

Add anbox-cloud service to integration tests that lists the services supported by the Pro client

The anbox product has the enableByDefault obligation turned on because the old setup of Anbox require the resource tokens to be already present in the machine-token file once the service is enabled. However, we don't need to enable this service during attach. Finally, we should remove this code once the Contract server provides another mechanism to deliver resource tokens by default to some services

Signed-off-by: Renan Rodrigo <[email protected]>

We are changing classic_confinment_support to the cammel case representation. That is because cammel case is the standard support on the Contract server

Create a function on the system module to fetch the reboot required packages from /var/run/reboot-required.pkgs

We are adding extra data to the reboot required endpoint to allow user to better understand the decision making regarding if a reboot is required or not

We are now concentrating every reboot_required logic into the API. The security_status module will now consume the reboot information directly from the API module

The links in CONTRIBUTING should be updated again to point to readthedocs when the development documentation is published there. Signed-off-by: Renan Rodrigo <[email protected]>

Signed-off-by: Renan Rodrigo <[email protected]>

Update message we show at the end of enabling Anbox while also listing to the user the required snaps we will install

Allow a channel to be specified when installing a snap. This will allow a channel to be specified when installing a required snap

Update help text for the Anbox service

Some lunar/mantic entries inserted to match current support. Some example-only appearance in tests are kept. Signed-off-by: Renan Rodrigo <[email protected]>

Signed-off-by: Renan Rodrigo <[email protected]>

When trying to assess if snapd is installed, well, we now verify it is installed. We always expect /usr/bin/snap to be there when snapd is present. Signed-off-by: Renan Rodrigo <[email protected]>

LP: #1999909

The shown argument should be True when the result will be displayed in the test output. When shown is True, secret config values are not replaced.

I didn't notice we already had an implementation for this and wrote a new one. Then I realized we already had one and decided to combine the new and old implementation in a small refactor.

Move the function to a module better allow other module to reuse it

This module adds all the necessary functionality for the plan and execute API endpoints. This will eventually replace the security module once all API endpoints are ready and the CLI function can be use them instead

Add support for user to provide a JSON data on the CLI command for the api. This is achieved now by using the --data parameter.

Add endpoint for the CVE fix plan scenario. If used through the CLI, users need to provide the cves through a JSON object using the --data flag

Add endpoint for the USN fix plan scenario. If used through the CLI, users need to provide the usns through a JSON object using the --data flag

Add test where we modify the system to not allow a package to be installed and certify that the fix plan endpoint will correctly capture that

Add JSON schema checks for both USN and CVE endpoints of the fix plan API

This way users who enabled esm will not risk getting automatic updates for packages if those don't come from the esm repositories, guaranteeing security patches will not be accidentally removed. Fixes: #2580 Signed-off-by: Renan Rodrigo <[email protected]>

…y to parse empty string

The API reference document showed both Python and CLI code to the user at the same time. Now through the use of tabs, the user can choose whether to view Python or the CLI version. Tabs are synced so their choice is applied to all entries. The API page is now made cleaner and more functional. This also converts the source doc from md to rst

* Docs front page overhaul - Revamp docs front page giving context for Pro services - Add tabs to separate services by user pathways - Add links to some relevant pages in our own docs - Add new explanation page on ESM services (from FAQ) - Change LHS nav menu to collapse some how-tos - Expand "how to enable esm-infra" to include esm-apps - Also added content on how to disable these

Fixes: #2559

Define an incompatibility matrix for the services and reference it on each how-to-guide that shows how to enable a service that is incompatible with another service. Fixes: #2595

Signed-off-by: Renan Rodrigo <[email protected]>

Helps maintain the user's system sbuild config

We used to have 28 as the devel version, but now 28 is being released, and will be followed by 29, 30, etc - bumping an epoch makes the devel version greater than any released version. Making 'devel' part of the version makes it explicit that this is not a supported version. Signed-off-by: Renan Rodrigo <[email protected]>

Signed-off-by: Renan Rodrigo <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release 29 #2677

Release 29 #2677

Commits on Aug 1, 2023