Request for classic confinement for snap Blueprint Compiler

store-requests
1

Blueprint Compiler is a compiler for the blueprint files. Blueprint is a markup language for GTK user interface files. This is the website for blueprint-compiler

https://gitlab.gnome.org/jwestman/blueprint-compiler

As this snap will be mostly used during snap compilations as a build snap, it needs to access all the files of the OS, which is not possible with confinement. Though, I never tried with a snap compilation to compile with blueprint-compiler and home plug, but I don’t think it’d work properly. A snap is necessary for the fact that the repo version is very old now, and modern GTK apps often use 0.8+ version. I would like to make it work within confinement, so, some suggestions regarding this will also be helpful. Thanks

2

I never tried with a snap compilation to compile with blueprint-compiler and home plug

Can you please try this? You state that this snap requires classic confinement but then say you have not tried it with strict confinement - I suspect that perhaps blueprint may not require access to files from the host file system - so it would be good to confirm whether this is actually the case or not.

If it does not work under strict confinement, please include the resulting errors / DENIAL messages from syslog here so we can see if it might be possible to get it working correctly under strict confinement.

3

@alexmurray in my post, I made a wrong comment, that I never tried to compile an app with strict confinement. But, I tried it but forgot what error I got. This is the error I get now,

error: Could not find GTK 4 introspection files. Is gobject-introspection installed?
  at ./Blueprints/account_settings_dialog.blp line 1 column 11:
     1 |using Gtk 4.0;
       |          ^
  hint: search path: /snap/blueprint-compiler/x2/usr/lib/x86_64-linux-gnu/girepository-1.0:/usr/lib/x86_64-linux-gnu/girepository-1.0:/usr/lib/girepository-1.0
  
/home/soumyaxubuntu/Downloads/Project/Denaro/NickvisionMoney.GNOME/NickvisionMoney.GNOME.csproj(22,5): error MSB3073: The command "blueprint-compiler batch-compile ./Blueprints ./Blueprints ./Blueprints/*.blp" exited with code 1.
An error occurred when executing task 'Publish'.

Here, to fix I will need to install the typelib files of GTK-4 into the blueprint-compiler snap, which is not a proper approach. Cause different snaps will compile GTK-4 with different version of Gtk.

For example, someone using this with gnome-3-38-2004 extension and using the gtk4 files from the repo, will need older gtk4 files, which will be provided by the repo package libgtk-4-1. But, blueprint-compiler will not be able to access files.

I hope I’m able to make you understand this. If I have done any mistake in understanding then kindly explain me this. I will again try then.

4

@alexmurray any update on this? Should I share any more details?

5

From my understanding, it would work similar to other development tools where it needs access to arbitrary development libraries. In this case the appropriate typelib, which may not be provided as part of the platform. However, it would be the packagers responsibility to ensure the correct typelib is bundled in their snap.

6

Hey @soumyaDghosh , did you have a chance to have a look at @kenvandine’s suggestions regarding the libraries?

7

Here by the word packager @kenvandine meant that the snapcrafter who will be using blueprint-compiler in their snap, it’s his responsibility. As the package can be any arbitrary package. That’s why this classic grade is needed.

8

hi @soumyaDghosh,

Thanks for the patience on this while the review team considered the request. I spent some time today mocking up an example that would be similar to the Blueprint compiler use-case and I concur that classic is indeed appropriate and required.

In order for blueprint to access all of the files in all of the packages that supply any include-like files or helper executables that publishers will use to generate their applications, blueprint will need to be classic. In accordance with the Process for reviewing classic confinement, blueprint-compiler fits into the Compilers category.

I know you have many published snaps but I am unsure if you have been vetted for classic before. @advocacy, can you please perform vetting, or confirm if it has been done previously.

9

@dclane I never needed to publish snaps with classic confinement or system-files plugs. So, I guess I’m not. But, there are two more snaps which will need classic confinement. So, I guess it’ll be better to do it asap.

10

@dclane Hello! Any Update on this?

11

hey @soumyaDghosh,

We are waiting on publisher vetting, so @Igor can you please perform this?

Thanks!

12

@soumyaDghosh are you affiliated with the project, or perhaps a core contributor?

13

No I’m actually none of those. I just snap gnome apps, and many of them needs it. So, I made this package.

14

Have you had any chance to talk to the upstream, see what they think about the effort?

15

I have made an issue there.

https://gitlab.gnome.org/jwestman/blueprint-compiler/-/issues/130

16

@Igor It’s been 2 weeks, since I made the issue, but there is still no comment. How much would you like to wait?

17

Well, I guess we need to figure out if they are interested, and if not, what you’d like to do. Proceed without their intent?

19

Since this application requires classic confinement, and it’s someone else’s code, it would be good if you could get some sort of info from upstream. This also makes validation more complicated.

21

(continuing from your new thread bump)

@soumyaDghosh, @igor has asked questions about what you’d like to do if upstream aren’t interested, which seems to be the case here.

For applications that don’t require classic confinement or super-privileged snapd interfaces this is not typically a problem, but given the access that classic confinement allows for, we prefer that the snap publisher and upstream are aware of each other’s activities. This provides users with some confidence that the snap will be maintained, and reviewers some confidence that the (highly privileged) snap is somewhat official.

Might I suggest that given you’re republishing their work, you re-engage with upstream?

Edit/update:

I see now that the snap was recently transferred to jwestman (upstream). This should make things easier, thank you.

22

Thanks a lot, hope this thread will not make any clashes anymore. I am marking your reply a solution of this thread and closing this discussion. Thanks.

1 Like