Is curl in the category that allows to apply classic confinement?

[aoyama]

Hi team,

I’m the maintainer of the curl snap currently.

Here is the context.

Since curl is commonly used as a download tool for installation scripts of various open source software.

Recently, many users have reported to me that strict snap cannot access hidden files in the HOME directory, which makes them very distressed.

And this problem is probably very common, perhaps only classic confinement can solve it. So I would like to ask whether curl is in the category that allows to request a classic confinement.

Or is there any other better way?

Thank you.

[store-requests-bot]

This request has been added to the queue for review by the @reviewers team.

[konstin]

I’d like to add some context to aoyama’s request. I’m one of the maintainers of uv, where problems with the curl snap were reported multiple times by users (sorry, discourse did not allow me to post them as links):

• https://github.com/astral-sh/uv/issues/11849
• https://github.com/astral-sh/uv/issues/12728
• https://github.com/astral-sh/uv/issues/13178

With the curl snap’s current permission restrictions, it’s not possible to install use curl for installers that use XDG directories such as ~/.local/bin/. Critically, users only see a generic error message with no indication why the installer failed, and the only solution is currently to remove the curl snap and install it with apt.

curl: (23) client returned ERROR on write of 1369 bytes

curl is the widely pre-installed tool that can download file, making it the foundation of most CLI-based installers. It affects a lot of big projects: From a GitHub search, it has been reported in rust, deno, uv, atuin, volta, nvm, julia, ollama, and many more.

Here are some typical screenshots from their issue trackers (sorry for the collage, discourse didn’t allow me to post more than one picture):

[ogra]

See

Process for reviewing classic confinement snaps

Classic confinement review process Background As of snapd 2.20, snappy supports confinement: classic which allows the snap to run without restrictions. Future releases of snapd will also support a classic interface (name TBD) that operates similarly. Snaps specifying classic confinement may target the stable channel, but are only supported on classic distro systems (ie, not on Ubuntu Core). Because classic confinement snaps run without restrictions, use of classic confinement effectively gran…

Snaps that are granted classic must fit into the “supported” category, this is a hard requirement (I doubt curl fits into any of that list but you can indeed try to convince the reviewers otherwise)…

[jslarraz]

I also think that curl is probably not a good fir for classic, considering that accessing arbitrary files is explicitly listed as unsupported reason. Also, classic confinement requires of publisher vetting, so it can only be requested by members of the upstream project.

That said, looking a the reported issues:

• In the case of Hashkell, the installer just needs to be updated to download the file ~/.ghcup/cache/ghcup-0.0.9.yaml to and intermediate location accessible by curl snap and then mv it to final location
• Similarly for uv the installer just needs to be updated to download uv-x86_64-unknown-linux-gnu.tar.gz to a location accessible by curl snap (such as ~/Downloads instead of /tmp) and then should work fine.

Thanks