Arch Linux User Repository

Package update notes

2.36

2.36 is the first release with AppArmor enabled by default on Arch.

If you do not have AppArmor enabled at boot there should be no functional changes visible.

If you wish to use snaps with Apparmor, first make sure that Apparmor is enabled during boot, see https://wiki.archlinux.org/index.php/AppArmor for details. After upgrading the package, you need to do the following steps:

• Reload the profiles: systemctl restart apparmor.service
• Restart snapd: systemctl restart snapd.service
• Load profiles for snaps: systemctl enable --now snapd.apparmor.service

2.62

Since 2.62 snapd generated additional files describing the sandbox. The snapd service needs to be restarted after the update for snaps to continue working (unless the system is rebooted after the update, in which case no additional steps are needed). To restart, run systemctl restart snapd.service

2.70

Snapd 2.70 drops setuid permissions on /usr/lib/snapd/snap-confine in favor of explicit file capabilities. After an upgrade to 2.70, the users are prompted to restart the apparmor.service otherwise attempts to run snaps will error with cannot set capabilities message.

2.73

diff --git a/.SRCINFO b/.SRCINFO
index e1b605d..a46705b 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,6 +1,6 @@
 pkgbase = snapd
    pkgdesc = Service and tools for management of snap packages.
-   pkgver = 2.72
+   pkgver = 2.73
    pkgrel = 1
    url = https://github.com/snapcore/snapd
    install = snapd.install
@@ -30,9 +30,7 @@ pkgbase = snapd
    options = !strip
    options = emptydirs
    options = !lto
-   source = snapd-2.72.tar.xz::https://github.com/snapcore/snapd/releases/download/2.72/snapd_2.72.vendor.tar.xz
-   source = 0001-cmd-snap-confine-snap-confine-update-AppArmor-profil.patch
-   sha256sums = 53d74e663527bae667a254da8a029aa4b0b8f559ca515d214da8dbb29dc6ccc7
-   sha256sums = 3584cdfabde12d1739342bc1bd73705bb5d9d3aed4ab038a478657fd4ede7364
+   source = snapd-2.73.tar.xz::https://github.com/snapcore/snapd/releases/download/2.73/snapd_2.73.vendor.tar.xz
+   sha256sums = c47fe0c00df5e153b312b5f6dabec49158c8c872ed1eae5e342229bb229a5d85

 pkgname = snapd
diff --git a/0001-cmd-snap-confine-snap-confine-update-AppArmor-profil.patch b/0001-cmd-snap-confine-snap-confine-update-AppArmor-profil.patch
deleted file mode 100644
index 6a35127..0000000
--- a/0001-cmd-snap-confine-snap-confine-update-AppArmor-profil.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 079605bdacc82243efdd44ec6d81bc4a93d2859f Mon Sep 17 00:00:00 2001
-Message-ID: <079605bdacc82243efdd44ec6d81bc4a93d2859f.1760438845.git.maciej.borzecki@canonical.com>
-From: Maciej Borzecki <maciej.borzecki@canonical.com>
-Date: Mon, 13 Oct 2025 19:15:54 +0200
-Subject: [PATCH] cmd/snap-confine/snap-confine: update AppArmor profile to
- allow read/write to journal (#16131)
-
-Update the AppArmor profile of snap-confine to allow read-write access
-to the journal provided stdout. This scenario occurs when snap-confine
-is invoked to set up a sandbox for snap services.
-
-Fixes: LP#2127244 LP#2121169
-Related: SNAPDENG-35767
-
-Signed-off-by: Maciej Borzecki <maciej.borzecki@canonical.com>
----
- cmd/snap-confine/snap-confine.apparmor.in | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/cmd/snap-confine/snap-confine.apparmor.in b/cmd/snap-confine/snap-confine.apparmor.in
-index a653f1f70f7a7abfadc6414fb78a6c8ae3273e67..51964ad7ec2bdc714292310cee507de34498eacf 100644
---- a/cmd/snap-confine/snap-confine.apparmor.in
-+++ b/cmd/snap-confine/snap-confine.apparmor.in
-@@ -66,6 +66,9 @@
-     /dev/pts/[0-9]* rw,
-     /dev/tty rw,
- 
-+    # Stdout may be inherited from systemd. This is normally provided by <abstractions/base>
-+    /{,var/}run/systemd/journal/stdout rw,
-+
-     # SNAP_MOUNT_DIR probe logic
-     /proc/1/root/snap r,
- 
-@@ -546,6 +549,9 @@
-         /dev/random r,
-         /dev/urandom r,
- 
-+        # Stdout may be inherited from systemd. This is normally provided by <abstractions/base>
-+        /{,var/}run/systemd/journal/stdout rw,
-+
-         capability dac_override,
-         capability sys_ptrace,
-         capability sys_admin,
--- 
-2.51.0
-
diff --git a/PKGBUILD b/PKGBUILD
index 352ad87..324f96e 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -8,7 +8,7 @@ pkgdesc="Service and tools for management of snap packages."
 depends=('squashfs-tools' 'libseccomp' 'libsystemd' 'libcap' 'apparmor')
 optdepends=('bash-completion: bash completion support'
             'xdg-desktop-portal: desktop integration')
-pkgver=2.72
+pkgver=2.73
 pkgrel=1
 arch=('x86_64' 'i686' 'armv7h' 'aarch64')
 url="https://github.com/snapcore/snapd"
@@ -19,12 +19,9 @@ options=('!strip' 'emptydirs' '!lto')
 install=snapd.install
 source=(
   "$pkgname-$pkgver.tar.xz::https://github.com/snapcore/${pkgname}/releases/download/${pkgver}/${pkgname}_${pkgver}.vendor.tar.xz"
-  "0001-cmd-snap-confine-snap-confine-update-AppArmor-profil.patch"
 )

-sha256sums=('53d74e663527bae667a254da8a029aa4b0b8f559ca515d214da8dbb29dc6ccc7'
-           '3584cdfabde12d1739342bc1bd73705bb5d9d3aed4ab038a478657fd4ede7364')
-
+sha256sums=('c47fe0c00df5e153b312b5f6dabec49158c8c872ed1eae5e342229bb229a5d85')

 prepare() {
   cd "$pkgname-$pkgver"

@bboozzoo Well, it seems it was an issue with paru. I ran this with makepkg -sriL in terminal, in order to generate the log and it seemed to work properly. So I'm not really sure what the issue, but I'll make sure to run things like this through makepkg explicitly first next time. Sorry for the false positive!

@ixvari can you share the actual log? it builds for me locally, in a clean chroot and in CI on github, so I'm a loss why it fails to build for you.

Package was working fine, but is randomly failing to build / update on latest 2.72-1. The last version (2.71-1) worked fine without issue. Most of the build llooks fine, but it exits with "make: *** [Makefile:1427: all] Error 2"

@bboozzoo You can rename the file that is downloaded with the sth::https:://... syntax in the url variable, like in the firefoy-nightly and other packages where the upstream filename stays the same. See warning box here for more info: https://wiki.archlinux.org/title/PKGBUILD#source But one could also argue makepkg or the AUR helper should just delete and retry ideally if the checksum doesn't match.

@MissRin my guess is you managed to update snapd before the upstream replaced the tarball. Since the file name is identical, makepkg won't download the file again, so it takes the file you have in the source directory, attempts to verify the checksum and fails. Eh, what a mess. Let me see if I can provide a reasonable upgrade path.

snapd-2.70.tar.xz is failing the validity check still attempting to upgrade from 2.70-1 to 2.70-2

Thanks for support ^^

I've updated 2.70 to -2 with changed sha256sum of the upstream tarball. Upstream release was re-generated with new changelogs, overwriting old tarballs.

Please fix sha256sums=('208c4356e17e96f25f8e5d4cc9c5494157099d15c091a530bb4f260aae9cf88b') to sha256sums=('4092c7e02d9d03c4c3c0546a0cddcff288ffffe484cd872f7df7565ab1428dbf')