[SRU] Add AssumedAppArmorLabel to fwupd service

[Ken VanDine]

In order for strictly confined snaps to work with the host's fwupd we need to add the AssumedAppArmorLabel=unconfined to the DBus service file.

[Impact]

 * Without this label, strictly confined snaps can not work with the host's fwupd service

[Test Case]

 * snap install --edge gnome-firmware
 * snap connect gnome-firmware:fwupd
 * snap run gnome-firmware
 * Expected results: Display devices with upgradable firmware

[Regression Potential]

 * There should be no potential for regression, this is adding an optional label that will not effect other services communicating with the fwupd service.

[Mario Limonciello (superm1)]

Focal has the fix coming in during Debian unstable sync. Setting this task to fix committed.

[Mario Limonciello (superm1)]

1.3.3-3 promoted to focal release pocket today fixes this, marking focal task as fix released.

[Timo Aaltonen (tjaalton)]

Hello Ken, or anyone else affected,

Accepted fwupd into eoan-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/fwupd/1.2.10-1ubuntu3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-eoan to verification-done-eoan. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-eoan. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello Ken, or anyone else affected,

Accepted fwupd-signed into eoan-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/fwupd-signed/1.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-eoan to verification-done-eoan. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-eoan. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Mario Limonciello (superm1)]

I think for eoan this is missing a task for snapd to be successful. The current snapd doesn't know anything about the fwupd interface corresponding to a classic host system.

[Ken VanDine (ken-vandine)]

I've verified the fix on eoan.

[Chris Halse Rogers (raof)]

Hm. I also don't see the fwupd interface on Eoan, so I'm not sure haw this could currently work. Ken, were you testing with a different snapd or something?

[Łukasz Zemczak (sil2100)]

Ken, could you address Chris's and Mario's concerns? We can't release the update with this situation unclear.

[Ken VanDine (ken-vandine)]

This needs snapd 2.43, which is in edge currently.

[Łukasz Zemczak (sil2100)]

I think it seems safe to release fwupd* as it is now. The required snapd version is in the stable channel right now (we might have to wait for the deb version a bit, but that's ok).

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for fwupd-signed has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package fwupd-signed - 1.10.1

---------------
fwupd-signed (1.10.1) eoan; urgency=medium

  * Build depends on fwupd 1.2.10-1ubuntu3 (LP: #1852485)

 -- Ken VanDine <email address hidden> Mon, 02 Dec 2019 11:44:09 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package fwupd - 1.2.10-1ubuntu3

---------------
fwupd (1.2.10-1ubuntu3) eoan; urgency=medium

  * d/p/0001-Allows-confined-snaps-to-activate-fwupd-via-D-Bus.patch
    - This allows confined snaps to activate fwupd via D-Bus (LP: #1852485)

 -- Ken VanDine <email address hidden> Wed, 13 Nov 2019 11:46:47 -0800

[Mario Limonciello (superm1)]

bionic tasks were fixed when 1.2.10 backported into bionic.