snapd (2.75.2+ubuntu22.04) jammy; urgency=medium

  * New upstream release, LP: #2143882
    - Interfaces: network-setup-*| allow running python binaries from
      the base on UC26+
    - Cross-distro: modify SELinux policy to allow mounting on
      /var/snap/<snap>/<rev>
    - Fix potential task deadlock by considering all tasks in a lane
      that might be waiting for a reboot when processing delayed
      security backend effects

 -- Katie May <katie.may@canonical.com>  Mon, 30 Mar 2026 17:06:36 +0200

snapd (2.75.1+ubuntu22.04) jammy; urgency=medium

    - FDE: limit number of boot check log entries
    - Allow a logged in user to refresh private snaps during a refresh
      with multiple snaps
    - Use precise prune pattern for tmpfiles (CVE-2026-3888)

 -- Katie May <katie.may@canonical.com>  Wed, 18 Mar 2026 09:59:01 +0100

snapd (2.75+ubuntu22.04) jammy; urgency=medium

    - FDE: run early boot check only once per boot
    - FDE: update secboot to revision 77bc2457cc76
    - FDE: add degraded state for status API
    - FDE: prevent resealing tasks from running together
    - FDE: enable using keyslot tokens to store protected keys for UC26+
    - FDE: early commit kcmdline config transaction in update-gadget-
      cmdline to mitigate possible race condition
    - FDE: ensure extra snapd kcmdline fragments are applied
    - FDE: remove old secboot activation API calls
    - LP: #2142130 update apparmor parser to 4.1.7
    - LP: #2137543 disable translations in formatted output for snapctl
      services
    - LP: #2142655 improve snap size reporting precision in snap info
      output
    - LP: #2139664 snap-confine: remove race condition triggered by hat
      profile
    - LP: #2139065 skip 70-snap.*.rules when building dracut initramfs
    - LP: #2002697 error early on removal without purge if home is in
      NFS mount
    - LP: #2141461 Intefaces: allow snap-update-ns to read
      /proc/pid/auxv
    - LP: #2138268 Interfaces: kerberos-tickets| new interface allow
      access to kerberos tickets stored in /tmp
    - Interfaces: block-devices| allow Xen block devices
    - Interfaces: u2f-devices| add Tokey 3 FIDO
    - Interfaces: devlxd| new interface allowing acccess to LXD devlxd
      socket and APIs
    - Interfaces: browser-support| allow reading pressure stall info
      information
    - Interfaces: network-setup-control| allow additional netplan files
      access
    - Interfaces: desktop| allow access kvantum, lxqt, and gtk4
      configuration files
    - Interfaces: system-observe| allow fdinfo access for GPU monitoring
    - Interfaces: ubuntu-pro-control| allow access to Ubuntu Advantage
      client configuration
    - Prompting: add API endpoint to ask whether application should have
      access
    - Prompting: add support for audio-record prompting via API endpoint
    - Prompting: store snap name instead of apparmor label in requests
    - Prompting: respond with 503 to API requests when prompting
      subsystem is shutting down
    - Prompting: generalize prompting subsystem to support requests from
      outside AppArmor
    - Confdb: unset data for missing paths in set request
    - Confdb: return 400 for API requests with missing filter
      constraints
    - Confdb: return 400 for API requests with unmatched filter
      constraints
    - Confdb: support typed constraints in confdb filtering
    - Confdb: fixed unmarshalling transaction with placeholder path in
      deltas
    - Confdb: refresh confdb-schema assertions during manual refresh
    - Remote device management (experimental): add skeleton device
      management manager
    - Remote device management (experimental): add message exchange loop
    - Components: add snap component command, include component summary
      in snap info output
    - Components: enforce validation sets when installing components
    - Configuration: add system.motd configuration option to customize
      message of the day (motd)
    - packaging: remove dependencies libbrotli1, libfreetype6, and
      libpng16-16 from snap
    - snap-bootstrap: use libblkid for disk information to speed up boot
    - snap-confine: improve data handling error
    - snap-confine: use ld cache from the app base for core26+
    - snap: add riscv ISA detection for snaps
    - squashfs: reduce memory footprint of single file extraction
    - Add experimental snap delta format
    - Enable early download of seed snaps during refresh
    - Enable parallel downloads of essential snaps during refresh
    - Disallow removing components required by validation sets
    - Make snap prepare-image fail on --validation=ignore if model has
      enforced validation-sets
    - Fix correctly handling interrupted snap downloads
    - Fix handling of store throttling for refresh-app-awareness
      monitored snaps
    - Stop removed "endure" services on refresh
    - Install by default from the initramfs for UC26+, removing the need
      for a reboot after installation
    - Keep minidebuginfo in snapd snap
    - Make snap-specific systemd cgroup mandatory for snaps using core26
      and later, improve messaging for failure scenarios
    - Preserve stale connections of broken snaps
    - Remove enforce-validation-sets need for network
    - Opportunistic discarding of mount namespace when updating slot
      providers
    - Support for delaying updates of snap mount namespaces when
      refreshing slot providers
    - Use application CommonID as default source for desktop ID

 -- Katie May <katie.may@canonical.com>  Mon, 09 Mar 2026 17:10:13 +0100

snapd (2.74.1+ubuntu22.04.4) jammy; urgency=medium

   * New upstream release, LP: #2138629
    - FDE: secboot fixes
    - Security: CVE-2026-3888
    - Packaging: fix deb package version number
    - Packaging: fix autopkgtest failure to install spread
    - Packaging: revert dropping transitional packages

 -- Ernest Lotter <ernest.lotter@canonical.com>  Thu, 02 Apr 2026 08:44:00 +0200

snapd (2.74.1) xenial; urgency=medium

  * New upstream release, LP: #2138629
    - FDE: measure DeployedMode and AuditMode variables if they appear
      as disabled in the event log to avoid a potential reseal-failure
      boot loop
    - LP: #2141328 FDE: reuse preinstall check context during install to
      account for user-ignored errors
    - LP: #2139611 FDE: fix db updates by allowing multiple payloads
    - LP: #2139300 snap-confine: add CAP_SYS_RESOURCE to allow raising
      memory lock limit when required
    - LP: #2139099 snap-confine: bump the max element count of the BPF
      map used to store IDs of allowed/matched devices to 1000
    - LP: #2141607 Desktop: revert change that caused user daemons
      declaring the desktop plug to implicitly depend on graphical-
      session.target
    - Interfaces: Added pidfd_open and memfd_secret to seccomp template
    - Interfaces: camera | add locking permission for /dev/video

 -- Ernest Lotter <ernest.lotter@canonical.com>  Thu, 12 Feb 2026 21:27:23 +0200

snapd (2.74) xenial; urgency=medium

  * New upstream release, LP: #2138629
    - FDE: use new activation API from secboot
    - FDE: use activation API also with non keydata keys
    - FDE: ignore internal recovery key expiration during install
    - FDE: support adding/removing PINs post-installation
    - FDE: support changing PINs post-installation
    - FDE: support adding a recovery key post-installation
    - FDE: provide activation status via new endpoint v2/system-
      info/storage-encrypted
    - FDE: support sealing and resealing using the preinstall check
      result
    - FDE: disable passphrase support during install
    - FDE: add keyboard configuration helpers
    - FDE: lazily inject keyboard layout configuration in kernel cmdline
    - FDE: enable pin tries and limits PIN entry attempts to 3
    - FDE: extend secureboot endpoint to accept DB, KEK, and PK
    - FDE: simplify /v2/system-volumes keyslots handling by allowing
      name-only entries, implicitly expanding to all system containers
    - FDE: support extra non-system key slot names to support agents
      such as Landscape to set dedicated recovery keys
    - FDE: initialize fde state after device state
    - FDE: use device node to find the storage container and keys
    - FDE: provide user visible name for disk based on ID_MODEL
    - FDE: update secboot in snapd with latest additions and fixes
    - core-initrd: add systemd service for setting plymouth keyboard
      layout and X11 keyboard layouts
    - core-initrd: set plymouth cleartext toggle option
    - core-initrd: fix plymouth missing font issue
    - core-initrd: update dependency from libteec1 to libteec2
    - core-initrd: add new dlopened libs
    - LP: #2116949 Preseeding: add support for preseeding of hybrid
      systems via the installer API$
    - Preseeding: check whether a path is a mountpoint before remounting
    - Confdb: support tagging paths as secret in storage schemas
    - Confdb: support filtering on placeholder sub-keys
    - Confdb: support filtering in API and confdbstate
    - Confdb: support field filtering on reads
    - Confdb: support "parameters" stanza and check filters against them
    - Confdb: add support for '--with' contraints
    - Confdb: parsing fixes and error handling improvements
    - Assertions: restrict serials to new format in confdb-control
    - Assertions: add verify signature function
    - Remote device management: modify request-message assertion to
      expose its time constraints for remote device management
    - Remote device management: support polling of store messages
    - Remote device management: add signing of response messages with
      device key
    - Prompting: enable notify protocol v5 and test prompt restoration
      after snapd restart
    - snap: change malformed '--channel=' warning to error
    - snap: add 'snap report-issue' command to get the available contact
      details for the specified snap
    - snap: add 'snap version --verbose' flag to include information on
      snap binaries origin
    - snap: create the XDG_RUNTIME_DIR folder
    - LP: #2068493 snap: add support for 'snap refresh --tracking'
    - snapctl: add '--tracking' flag to 'snapctl refresh'
    - Reexec: include the info filepath in the version compare debug log
    - Reexec: add support for forcing reexec into and older snapd snap
      by setting SNAP_REEXEC=force in the environment
    - snap-confine: correct error message related to snap-confine group
      policy validation
    - snap-confine: ensure we only mount existing directories
    - LP: #2134364 snap-confine: handle potential race when creating
      /tmp/snap-private-tmp when lacking systemd-tmpfiles support
    - snap-confine: filter plus characters from security tags
    - Desktop: use desktop file IDs as desktop IDs
    - Desktop: store the common ID in the desktop file
    - Desktop: allow graphical daemons to show icons in the dock
    - Desktop: change user daemons with desktop plug defined to depend
      on graphical-session.target
    - dm-verity for essential snaps: made change to prerequisite struct
    - Cross-distro: modify SELinux profile to allow connecting to squid
      proxy
    - Cross-distro: add support for migrating snap mount directory
    - Packaging: drop ubuntu-14.04 packaging
    - Packaging: drop ubuntu-{14.04,16.04} transitional binary packages
    - Packaging: remove desktop files and state lock file during snapd
      purge
    - Packaging: fix inhibition hint file being left behind on failed
      unlink-current-snap
    - Disallow timeouts < 1us in systemd units
    - Add snap-store to the user-daemons support overrides
    - Support for SuccessExitStatus= generation for systemd daemon
    - Make standby output more verbose
    - Add prepare-serial-request hook
    - Try to discard snap mount namespaces when no processes are running
      during snap updates
    - Improve handling of snap downloads cache by introducing periodic
      cleanup with more aggressive policy
    - Interfaces: mediatek-accel | create new interface
    - Interfaces: nvidia-video-driver-libs | create new interface
    - Interfaces: *-driver-libs | accept component paths
    - Interfaces: desktop-legacy, unity7 | remove workaround for slash
      filtering in ibus address
    - Interfaces: fwupd | allow writing reboot notification in /run
    - Interfaces: add 'install' coreutil to base AppArmor template
    - Interfaces: u2f-devices | add apparmor permissions to allow the
      use of the libfido2 library in snaps
    - Interfaces: u2f-devices | add support for Thetis security key
    - Interfaces: add AppArmor workaround for mmap MAP_HUGETLB
    - Interfaces: timeserver-control | manage per-link ntp settings via
      systemd-networkd

 -- Ernest Lotter <ernest.lotter@canonical.com>  Tue, 20 Jan 2026 18:54:17 +0200

snapd (2.73) xenial; urgency=medium

  * New upstream release, LP: #2132084
    - FDE: do not save incomplete FDE state when resealing was skipped
    - FDE: warn of inconsistent primary or policy counter
    - Confdb: document confdb in snapctl help messages
    - Confdb: only confdb hooks wait if snaps are disabled
    - Confdb: relax confdb change conflict checks
    - Confdb: remove empty parent when removing last leaf
    - Confdb: support parsing field filters
    - Confdb: wrap confdb write values under "values" key
    - dm-verity for essential snaps: add new naming convention for
      verity files
    - dm-verity for essential snaps: add snap integrity discovery
    - dm-verity for essential snaps: fix verity salt calculation
    - Assertions: add hardware identity assertion
    - Assertions: add integrity stanza in snap resources revisions
    - Assertions: add request message assertion required for remote
      device management
    - Assertions: add response-message assertion for secure remote
      device management
    - Assertions: expose WithStackedBackstore in RODatabase
    - Packaging: cross-distro | install upstream NEWS file into relevant
      snapd package doc directory
    - Packaging: cross-distro | tweak how the blocks injecting
      $SNAP_MOUNT_DIR/bin are generated as required for openSUSE
    - Packaging: remove deprecated snap-gdb-shim and all references now
      that snap run --gdb is unsupported and replaced by --gdbserver
    - Preseed: call systemd-tmpfiles instead handle-writable-paths on
      uc26
    - Preseed: do not remove the /snap dir but rather all its contents
      during reset
    - snap-confine: attach name derived from security tag to BPF maps
      and programs
    - snap-confine: ensure permitted capabilities match expectation
    - snap-confine: fix cached snap-confine profile cleanup to report
      the correct error instead of masking backend setup failures
    - snap-confine: Improve validation of user controlled paths
    - snap-confine: tighten snap cgroup checks to ensure a snap cannot
      start another snap in the same cgroup, preventing incorrect
      device-filter installation
    - core-initrd: add 26.04 ubuntu-core-initramfs package
    - core-initrd: add missing order dependency for setting default
      system files
    - core-initrd: avoid scanning loop and mmc boot partitions as the
      boot disk won't be any of these
    - core-initrd: make cpio a Depends and remove from Build-Depends
    - core-initrd: start plymouth sooner and reload when gadget is
      available
    - Cross-distro: modify syscheck to account for differences in
      openSUSE 16.0+
    - Validation sets: use in-flight validation sets when calling
      'snapctl install' from hook
    - Prompting: enable prompting for the camera interface
    - Prompting: remove polkit authentication when modifying/deleting
      prompting rules
    - LP: #2127189 Prompting: do not record notices for unchanged rules
      on snapd startup
    - AppArmor: add free and pidof to the template
    - AppArmor: adjust interfaces/profiles to cope with coreutils paths
    - Interfaces: add support for compatibility expressions
    - Interfaces: checkbox-support | complete overhaul
    - Interfaces: define vulkan-driver-libs, cuda-driver-libs, egl-
      driver-libs, gbm-driver-libs, opengl-driver-libs, and opengles-
      driver-libs
    - Interfaces: allow snaps on classic access to nvidia graphics
      libraries exported by *-driver-libs interfaces
    - Interfaces: fwupd | broaden access to /boot/efi/EFI
    - Interfaces: gsettings | set dconf-service as profile for
      ca.desrt.dconf.Writer
    - Interfaces: iscsi-initiator, dm-multipath, nvme-control | add new
      interfaces
    - Interfaces: opengl | grant read/write permission to /run/nvidia-
      persistenced/socket
    - interfaces: ros-snapd-support | add access to /v2/changes/
    - Interfaces: system-observe | read access to btrfs/ext4/zfs
      filesystem information
    - Interfaces: system-trace | allow /sys/kernel/tracing/** rw
    - Interfaces: usb-gadget | add support for ffs mounts in attributes
    - Add autocompletion to run command
    - Introduce option for disallowing auto-connection of a specific
      interface
    - Only log errors for user service operations performed as a part of
      snap removal
    - Patch snap names in service requests for parallel installed snaps
    - Simplify traits for eMMC special partitions
    - Strip apparmor_parser from debug symbols shrinking snapd size by
      ~3MB
    - Fix InstallPathMany skipping refresh control
    - Fix waiting for GDB helper to stop before attaching gdbserver
    - Protect the per-snap tmp directory against being reaped by age
    - Prevent disabling base snaps to ensure dependent snaps can be
      removed
    - Modify API endpoint /v2/logs to reject n <= 0 (except for special
      case -1 meaning all)
    - Avoid potential deadlock when task is injected after the change
      was aborted
    - Avoid race between store download stream and cache cleanup
      executing in parallel when invoked by snap download task
    - LP: #1851490 Use "current" instead of revision number for icons
    - LP: #2121853 Add snapctl version command
    - LP: #2127214 Ensure no more than one partition on disk can match a
      gadget partition
    - LP: #2127244 snap-confine: update AppArmor profile to allow
      read/write to journal as workaround for snap-confine fd
      inheritance prevented by newer AppArmor
    - LP: #2127766 Add new tracing mechanism with independently running
      strace and shim synchronization

 -- Ernest Lotter <ernest.lotter@canonical.com>  Fri, 21 Nov 2025 09:08:02 +0200

snapd (2.72) xenial; urgency=medium

  * New upstream release, LP: #2124239
    - FDE: support replacing TPM protected keys at runtime via the
      /v2/system-volumes endpoint
    - FDE: support secboot preinstall check fix actions for 25.10+
      hybrid installs via the /v2/system/{label} endpoint
    - FDE: tweak polkit message to remove jargon
    - FDE: ensure proper sealing with kernel command line defaults
    - FDE: provide generic reseal function
    - FDE: support using OPTEE for protecting keys, as an alternative to
      existing fde-setup hooks (Ubuntu Core only)
    - Confdb: 'snapctl get --view' supports passing default values
    - Confdb: content sub-rules in confdb-schemas inherit their parent
      rule's "access"
    - Confdb: make confdb error kinds used in API more generic
    - Confdb: fully support lists and indexed paths (including unset)
    - Prompting: add notice backend for prompting types (unused for now)
    - Prompting: include request cgroup in prompt
    - Prompting: handle unsupported xattrs
    - Prompting: add permission mapping for the camera interface
    - Notices: read notices from state without state lock
    - Notices: add methods to get notice fields and create, reoccur, and
      deepcopy notice
    - Notices: add notice manager to coordinate separate notice backends
    - Notices: support draining notices from state when notice backend
      registered as producer of a particular notice type
    - Notices: query notice manager from daemon instead of querying
      state for notices directly
    - Packaging: Ubuntu | ignore .git directory
    - Packaging: FIPS | bump deb Go FIPS to 1.23
    - Packaging: snap | bump FIPS toolchain to 1.23
    - Packaging: debian | sync most upstream changes
    - Packaging: debian-sid | depends on libcap2-bin for postint
    - Packaging: Fedora | drop fakeroot
    - Packaging: snap | modify snapd.mk to pass build tags when running
      unit tests
    - Packaging: snap | modify snapd.mk to pass nooptee build tag
    - Packaging: modify Makefile.am to fix snap-confine install profile
      with 'make hack'
    - Packaging: modify Makefile.am to fix out-of-tree use of 'make
      hack'
    - LP: #2122054 Snap installation: skip snap icon download when
      running in a cloud or using a proxy store
    - Snap installation: add timeout to http client when downloading
      snap icon
    - Snap installation: use http(s) proxy for icon downloads
    - LP: #2117558 snap-confine: fix error message with /root/snap not
      accessible
    - snap-confine: fix non-suid limitation by switching to root:root to
      operate v1 freezer
    - core-initrd: do not use writable-paths when not available
    - core-initrd: remove debian folder
    - LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev
      interface now with the more robust gpio-aggregator configfs kernel
      interface
    - Interfaces: gpio-chardev | exclusive snap connections, raise a
      conflict when both gpio-chardev and gpio are connected
    - Interfaces: gpio-chardev | fix gpio-aggregator module load order
    - Interfaces: ros-snapd-support | grant access to /v2/changes
    - Interfaces: uda-driver-libs, egl-driver-libs, gbm-driver-libs,
      opengl-driver-libs, opengles-driver-libs | new interfaces to
      support nvidia driver components
    - Interfaces: microstack-support | allow DPDK (hugepage related
      permissions)
    - Interfaces: system-observe | allow reading additional files in
      /proc, needed by node-exporter
    - Interfaces: u2f | add Cano Key, Thesis FIDO2 BioFP+ Security Key
      and Kensington VeriMark DT Fingerprint Key to device list
    - Interfaces: snap-interfaces-requests-control | allow shell API
      control
    - Interfaces: fwupd | allow access to Intel CVS sysfs
    - Interfaces: hardware-observe | allow read access to Kernel
      Samepage Merging (KSM)
    - Interfaces: xilinx-dma | support Multi Queue DMA (QDMA) IP
    - Interfaces: spi | relax sysfs permission rules to allow access to
      SPI device node attributes
    - Interfaces: content | introduce compatibility label
    - LP: #2121238 Interfaces: do not expose Kerberos tickets for
      classic snaps
    - Interfaces: ssh-public-keys | allow ro access to public host keys
      with ssh-key
    - Interfaces: Modify AppArmor template to allow listing systemd
      credentials and invoking systemd-creds
    - Interfaces: modify AppArmor template with workarounds for Go 1.35
      cgroup aware GOMAXPROCS
    - Interfaces: modify seccomp template to allow landlock_*
    - Prevent snap hooks from running while relevant snaps are unlinked
    - Make refreshes wait before unlinking snaps if running hooks can be
      affected
    - Fix systemd unit generation by moving "WantedBy=" from section
      "unit" to "install"
    - Add opt-in logging support for snap-update-ns
    - Unhide 'snap help' sign and export-key under Development category
    - LP: #2117121 Cleanly support socket activation for classic snap
    - Add architecture to 'snap version' output
    - Add 'snap debug api' option to disable authentication through
      auth.json
    - Show grade in notes for 'snap info --verbose'
    - Fix preseeding failure due to scan-disk issue on RPi
    - Support 'snap debug api' queries to user session agents
    - LP: #2112626 Improve progress reporting for snap install/refresh
    - Drop legacy BAMF_DESKTOP_FILE_HINT in desktop files
    - Fix /v2/apps error for root user when user services are present
    - LP: #2114704 Extend output to indicate when snap data snapshot was
      created during remove
    - Improve how we handle emmc volumes
    - Improve handling of system-user extra assertions

 -- Ernest Lotter <ernest.lotter@canonical.com>  Thu, 18 Sep 2025 10:00:54 +0200

snapd (2.71) xenial; urgency=medium

  * New upstream release, LP: #2118396
    - FDE: auto-repair when recovery key is used
    - FDE: revoke keys on shim update
    - FDE: revoke old TPM keys when dbx has been updated
    - FDE: do not reseal FDE hook keys every time
    - FDE: store keys in the kernel keyring when installing from initrd
    - FDE: allow disabled DMA on Core
    - FDE: snap-bootstrap: do not check for partition in scan-disk on
      CVM
    - FDE: support secboot preinstall check for 25.10+ hybrid installs
      via the /v2/system/{label} endpoint
    - FDE: support generating recovery key at install time via the
      /v2/systems/{label} endpoint
    - FDE: update passphrase quality check at install time via the
      /v2/systems/{label} endpoint
    - FDE: support replacing recovery key at runtime via the new
      /v2/system-volumes endpoint
    - FDE: support checking recovery keys at runtime via the /v2/system-
      volumes endpoint
    - FDE: support enumerating keyslots at runtime via the /v2/system-
      volumes endpoint
    - FDE: support changing passphrase at runtime via the /v2/system-
      volumes endpoint
    - FDE: support passphrase quality check at runtime via the
      /v2/system-volumes endpoint
    - FDE: update secboot to revision 3e181c8edf0f
    - Confdb: support lists and indexed paths on read and write
    - Confdb: alias references must be wrapped in brackets
    - Confdb: support indexed paths in confdb-schema assertion
    - Confdb: make API errors consistent with options
    - Confdb: fetch confdb-schema assertion on access
    - Confdb: prevent --previous from being used in read-side hooks
    - Components: fix snap command with multiple components
    - Components: set revision of seed components to x1
    - Components: unmount extra kernel-modules components mounts
    - AppArmor Prompting: add lifespan "session" for prompting rules
    - AppArmor Prompting: support restoring prompts after snapd restart
    - AppArmor Prompting: limit the extra information included in probed
      AppArmor features and system key
    - Notices: refactor notice state internals
    - SELinux: look for restorecon/matchpathcon at all known locations
      rather than current PATH
    - SELinux: update policy to allow watching cgroups (for RAA), and
      talking to user session agents (service mgmt/refresh)
    - Refresh App Awareness: Fix unexpected inotify file descriptor
      cleanup
    - snap-confine: workaround for glibc fchmodat() fallback and handle
      ENOSYS
    - snap-confine: add support for host policy for limiting users able
      to run snaps
    - LP: #2114923 Reject system key mismatch advise when not yet seeded
    - Use separate lanes for essential and non-essential snaps during
      seeding and allow non-essential installs to retry
    - Fix bug preventing remodel from core18 to core18 when snapd snap
      is unchanged
    - LP: #2112551 Make removal of last active revision of a snap equal
      to snap remove
    - LP: #2114779 Allow non-gpt in fallback mode to support RPi
    - Switch from using systemd LogNamespace to manually controlled
      journal quotas
    - Change snap command trace logging to only log the command names
    - Grant desktop-launch access to /v2/snaps
    - Update code for creating the snap journal stream
    - Switch from using core to snapd snap for snap debug connectivity
    - LP: #2112544 Fix offline remodel case where we switched to a
      channel without an actual refresh
    - LP: #2112332 Exclude snap/snapd/preseeding when generating preseed
      tarball
    - LP: #1952500 Fix snap command progress reporting
    - LP: #1849346 Interfaces: kerberos-tickets |  add new interface
    - Interfaces: u2f | add support for Thetis Pro
    - Interfaces: u2f | add OneSpan device and fix older device
    - Interfaces: pipewire, audio-playback | support pipewire as system
      daemon
    - Interfaces: gpg-keys | allow access to GPG agent sockets
    - Interfaces: usb-gadget | add new interface
    - Interfaces: snap-fde-control, firmware-updater-support | add new
      interfaces to support FDE
    - Interfaces: timezone-control | extend to support timedatectl
      varlink
    - Interfaces: cpu-control | fix rules for accessing IRQ sysfs and
      procfs directories
    - Interfaces: microstack-support | allow SR-IOV attachments
    - Interfaces: modify AppArmor template to allow snaps to read their
      own systemd credentials
    - Interfaces: posix-mq | allow stat on /dev/mqueue
    - LP: #2098780 Interfaces: log-observe | add capability
      dac_read_search
    - Interfaces: block-devices | allow access to ZFS pools and datasets
    - LP: #2033883 Interfaces: block-devices | opt-in access to
      individual partitions
    - Interfaces: accel | add new interface to support accel kernel
      subsystem
    - Interfaces: shutdown | allow client to bind on its side of dbus
      socket
    - Interfaces: modify seccomp template to allow pwritev2
    - Interfaces: modify AppArmor template to allow reading
      /proc/sys/fs/nr_open
    - Packaging: drop snap.failure service for openSUSE
    - Packaging: add SELinux support for openSUSE
    - Packaging: disable optee when using nooptee build tag
    - Packaging: add support for static PIE builds in snapd.mk, drop
      pie.patch from openSUSE
    - Packaging: add libcap2-bin runtime dependency for ubuntu-16.04
    - Packaging: use snapd.mk for packaging on Fedora
    - Packaging: exclude .git directory
    - Packaging: fix DPKG_PARSECHANGELOG assignment
    - Packaging: fix building on Fedora with dpkg installed

 -- Ernest Lotter <ernest.lotter@canonical.com>  Fri, 25 Jul 2025 13:18:47 +0200

snapd (2.70) xenial; urgency=medium

  * New upstream release, LP: #2112209
    - FDE: Fix reseal with v1 hook key format
    - FDE: set role in TPM keys
    - AppArmor prompting (experimental): add handling for expired
      requests or listener in the kernel
    - AppArmor prompting: log the notification protocol version
      negotiated with the kernel
    - AppArmor prompting: implement notification protocol v5 (manually
      disabled for now)
    - AppArmor prompting: register listener ID with the kernel and
      resend notifications after snapd restart (requires protocol v5+)
    - AppArmor prompting: select interface from metadata tags and set
      request interface accordingly (requires protocol v5+)
    - AppArmor prompting: include request PID in prompt
    - AppArmor prompting: move the max prompt ID file to a subdirectory
      of the snap run directory
    - AppArmor prompting: avoid race between closing/reading socket fd
    - Confdb (experimental): make save/load hooks mandatory if affecting
      ephemeral
    - Confdb: clear tx state on failed load
    - Confdb: modify 'snap sign' formats JSON in assertion bodies (e.g.
      confdb-schema)
    - Confdb: add NestedEphemeral to confdb schemas
    - Confdb: add early concurrency checks
    - Simplify building Arch package
    - Enable snapd.apparmor on Fedora
    - Build snapd snap with libselinux
    - Emit snapd.apparmor warning only when using apparmor backend
    - When running snap, on system key mismatch e.g. due to network
      attached HOME, trigger and wait for a security profiles
      regeneration
    - Avoid requiring state lock to get user, warnings, or pending
      restarts when handling API requests
    - Start/stop ssh.socket for core24+ when enabling/disabling the ssh
      service
    - Allow providing a different base when overriding snap
    - Modify snap-bootstrap to mount snapd snap directly to /snap
    - Modify snap-bootstrap to mount /lib/{modules,firmware} from snap
      as fallback
    - Modify core-initrd to use systemctl reboot instead of /sbin/reboot
    - Copy the initramfs 'manifest-initramfs.yaml' to initramfs file
      creation directory so it can be copied to the kernel snap
    - Build the early initrd from installed ucode packages
    - Create drivers tree when remodeling from UC20/22 to UC24
    - Load gpio-aggregator module before the helper-service needs it
    - Run 'systemctl start' for mount units to ensure they are run also
      when unchanged
    - Update godbus version to 'v5 v5.1.0'
    - Add support for POST to /v2/system-info with system-key-mismatch
      indication from the client
    - Add 'snap sign --update-timestamp' flag to update timestamp before
      signing
    - Add vfs support for snap-update-ns to use to simulate and evaluate
      mount sequences
    - Add refresh app awareness debug logging
    - Add snap-bootstrap scan-disk subcommand to be called from udev
    - Add feature to inject proxy store assertions in build image
    - Add OP-TEE bindings, enable by default in ARM and ARM64 builds
    - Fix systemd dependency options target to go under 'unit' section
    - Fix snap-bootstrap reading kernel snap instead of base resulting
      in bad modeenv
    - Fix a regression during seeding when using early-config
    - LP: #2107443 reset SHELL to /bin/bash in non-classic snaps
    - Make Azure kernels reboot upon panic
    - Fix snap-confine to not drop capabilities if the original user is
      already root
    - Fix data race when stopping services
    - Fix task dependency issue by temporarily disable re-refresh on
      prerequisite updates
    - Fix compiling against op-tee on armhf
    - Fix dbx update when not using FDE
    - Fix potential validation set deadlock due to bases waiting on
      snaps
    - LP: #2104066 Only cancel notices requests on stop/shutdown
    - Interfaces: bool-file | fix gpio glob pattern as required for
      '[XXXX]*' format
    - Interfaces: system-packages-doc | allow access to
      /usr/local/share/doc
    - Interfaces: ros-snapd-support interface | added new interface
    - Interfaces: udisks2 | allow chown capability
    - Interfaces: system-observe | allow reading cpu.max
    - Interfaces: serial-port | add ttyMAXX to allowed list
    - Interfaces: modified seccomp template to disallow
      'O_NOTIFICATION_PIPE'
    - Interfaces: fwupd | add support for modem-manager plugin
    - Interfaces: gpio-chardev | make unsupported and remove
      experimental flag to hide this feature until gpio-aggregator is
      available
    - Interfaces: hardware-random | fix udev match rule
    - Interfaces: timeserver-control | extend to allow timedatectl
      timesync commands
    - Interfaces: add symlinks backend
    - Interfaces: system key mismatch handling

 -- Ernest Lotter <ernest.lotter@canonical.com>  Tue, 03 Jun 2025 11:46:44 +0200

# For older changelog entries, run 'apt-get changelog golang-github-snapcore-snapd-dev'
