Request for classic confinement: oras and oras-test

store-requests
1

ORAS project provides a way to push and pull OCI Artifacts to and from OCI Registries. We have onboarded oras CLI v1.0.0 to Snapcraft so our Ubuntu users can easily install it. But to authenticate with OCI registries, oras CLI need to access below resources which are not in the snap sandbox:

  1. an external system-wide configuration file shared with docker and other container tools to store credentials.
  2. external helper tool binaries to save and load credentials securely.

Due to the above two use cases, oras CLI need to be installed in a classic way so both the configuration and external binaries installed on the Ubuntu host can be correctly found.

oras belongs to account(orasproject@gmail.com) and oras-test belongs to account(qweeah@gmail.com). We use oras to build and publish public snaps and oras-test to do PoC and validate our automated workflows.

2

Hello BillyZha,

Thanks for submitting this request. According to the process for reviewing classic snaps, we require that the request fit into one of the supported categories. Could you please identify if ORAS fits within any of those categories?

Have you considered if personal-files or system-files might be able to be used to satisfy this?

Would you be able to package those binaries into the snap using stage-packages?

1 Like
3

Hey @BillyZha - ping, can you please provide the requested information that @dclane asked for? Thanks.

1 Like
4

Could you please identify if ORAS fits within any of those categories?

Our use case fits into this one: kubernetes tools requiring arbitrary authentication agents . ORAS can be used to upload and download container images. Other K8S tools are expected to share the auth config and agents with ORAS.

Have you considered if personal-files or system-files might be able to be used to satisfy this?

Since the file path is user-specified, we need to enable ORAS snap to access(read and write) files in every folder of $HOME, as well as every system files. I am not sure if it’s doable and it’s seems better not to sandbox those config files.

Would you be able to package those binaries into the snap using stage-packages ?

No we can’t. ORAS is expected to support any binaries compliant to the authentication mechanism and it’s not possible to enumerate all the applications during build(snapcraft) time.

All in all, ORAS has the exact issue discussed in Personal-files request for kontena-lens - store-requests - snapcraft.io and Classic confinement for kontena-lens - store-requests - snapcraft.io. To me ORAS should not be sandboxed.

5

Thanks for your patience @BillyZha.

The requirements for classic are understood. @advocacy, can you please perform the vetting?

6

Looping @Igor in case the previous msg was missed

7

@BillyZha can you please point me to the official homepage for oras and oras test?

8

@Igor Official homepage for oras: https://oras.land/

oras-test is used to do PoC and validate our automated workflows and can be non-classic if it’s not applicable to be.

9

@BillyZha can you also please share (via DM if you like) the official email for oras?

10

@Igor You may use orasproject@gmail.com.

11

Hey @BillyZha I picking up the publisher vetting from here. could you please get back to my DM that I just sent you. Thanks

1 Like
12

The publisher vetting for the oras snap is not complete. Thanks.

13

Classic confinement override granted to oras snap, this is now live.

1 Like
14

@sahnaseredini Hi I tried to release a classic snap but got below error:

Publishing snap "oras_v1.2.0-rc.1_arm64.snap"...
/snap/bin/snapcraft upload oras_v1.2.0-rc.1_arm64.snap --release candidate
Uploading... (--->)
Uploading... (<---)
Status: processing
Status: processing
Status: processing
Status: error while processing
Issues while processing snap:
- confinement 'classic' not allowed with plugs/slots
15

Is there any way to check if the classic confinement is enforced?

16

Hi, could you please make sure you’ve removed the list of current plugs (home and network) from your snap as you’re having classic confinement and try it again?

17

Oh I missed that. Got it, will try in next release, thanks.

1 Like
18

Tried and it works, thanks

1 Like