Base runtime freedesktop-sdk-runtime-19-08

[jdstrand]

@valentind

Will there be a new review?

Yikes, sorry for the delay on this! Since this is our first community base snap of this nature, I’m going to follow Process for reviewing base snaps rigorously so other @reviewers can more easily participate.

1. the publisher creates a snap with type: base which denotes the ABI compatibility in the name in some manner. Eg, base-1804 or base-fedora26 . The snap must also use assumes: [ snapd2.45 ]

The snap’s name is freedesktop-sdk-runtime-2008 which is compliant with the ABI naming convention we are looking for. The snap does not currently use assumes: [ snapd2.45 ].

• @valentind - can you update the snap to use assumes?

Highly preferring that the base is maintained by a community or project rather than an individual

@valentind - there is a strong preference for base snaps to be maintained by a community or project. You are currently listed as the publisher with no collaborators. Would it make sense to create a ‘Freedesktop.org’ username, adding yourself and others as collaborators? If you are amenable to this, perhaps @popey or @roadmr can assist with the process?

A base needs to contain empty directories for anything that snap-confine doesn’t create but mounts over.

The base contains all the necessary empty directories for snap-confine (this is verified by the review-tools).

Considering files in the base with ownership/permissions/etc that are not allowed by app snaps

All the files in the base are root/root with no unusual permissions (this is verified by the review-tools).

Considering files in the base that are exposed that are not allowed by the default template

I used unsquashfs -lls /path/to/snap |grep -E 'squashfs-root/(dev|etc|home|lib/modules|lib/firmware|mnt|media|run|proc|root|snap|var/snap|sys|usr/lib/firmware|usr/lib/modules|usr/lib/snapd|usr/src|var/lib/dhcp|var/lib/extrausers|var/lib/jenkins|var/lib/snapd|var/log|var/tmp)' and found the following:

• there are files in squashfs-root/etc
• there are files in squashfs-root/proc

@valentind - can you use stage in your snapcraft.yaml or otherwise remove the files in these directories (but not the directories themselves)?

I then noticed it is shipping:

• squashfs-root/app
• squashfs-root/snap

These are not going to be available to the snap at runtime because the default base template policy does not allow them.

@valentind - can you remove these?

• Base snaps shall not use tracks
• The base snap publisher must commit to not breaking other snaps (base snaps undergo additional review-tools checks from removed files and changed ABIs, but the publisher must also commit to being responsive to bugs and regressions in updates to the base snap)

@valentind - can you comment on each of these:

• Will you not request using tracks for this snap?
• Do you commit to not intentionally break consumers of this snap? (Eg, by removing files, changing ABIs, etc)
• Do you commit to be responsive to bugs and regressions caused by updates to the snap?

Assuming the that @valentind answers in the affirmative to these questions, cleans up the snap in the requested ways and ideally creates a community/project username with collaborators, I think this snap can undergo publisher vetting.