App Center (snap-store): No app icons and gallery pictures shown; about page broken

[Boris Erdmann]

Bug Description:

After upgrading from 23.04 to 23.10 and a fresh install of the snap-store App Center version 0+git.e118b05 (as a consequence of bug https://bugs.launchpad.net/ubuntu/mantic/+source/snapd/+bug/2036765 )
no app preview or gallery pictures are being shown. Also, the about page in App Center shows:

TlsException: Failure trusting builtin roots. (OS Error: Permission denied(file.c:98) SYS_LIB(file.c:104) system library(by_file.c:253), errno = 33554445)

At the same time /var/log/syslog is full of

kernel: [ 1453.698787] audit: type=1400 audit(1697962011.860:373): apparmor="DENIED" operation="open" class="file" profile="snap.snap-store.snap-store" name="/etc/pki/tls/certs/ca-bundle.crt" pid=9922 comm="io.flutter.ui" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

The cert file is in place and perfectly accessible from user space though.

Expected Behavior:

- app icons being shown
- gallery picture being shown
- snap-store about page with info and without the error described above

Additional Info:

snap list snap-store
Name Version Revision Tracking Herausgeber Hinweise
snap-store 0+git.e118b05 1046 latest/stable/… canonical✓ -

snap info snap-store
name: snap-store
summary: Snap Store is a graphical desktop application for discovering, installing and managing
  snaps on Linux.
publisher: Canonical✓
store-url: https://snapcraft.io/snap-store
contact: https://bugs.launchpad.net/snap-store/
license: unset
description: |
  Snap Store showcases featured and popular applications with useful descriptions, ratings, reviews
  and screenshots.

  Applications can be found either through browsing categories
  or by searching.

  Snap Store can also be used to switch channels, view and alter snap permissions and view and
  submit reviews and ratings.

  Snap Store is based on GNOME Software, optimized for the Snap experience.
commands:
  - snap-store
snap-id: gjf3IPXoRiipCu9K0kVu52f0H56fIksg
tracking: latest/stable/ubuntu-23.10
refresh-date: gestern um 10:17 CEST
channels:
  latest/stable: 41.3-71-g709398e 2023-04-28 (959) 12MB -
  latest/candidate: 41.3-76-g2e8f3b0 2023-10-12 (1058) 12MB -
  latest/beta: ↑
  latest/edge: 0+git.211a029 2023-10-09 (1055) 11MB -
  preview/stable: –
  preview/candidate: 0.2.7-alpha 2023-02-02 (864) 10MB -
  preview/beta: ↑
  preview/edge: 0.3.0-alpha 2023-08-14 (1017) 11MB -
installed: 0+git.e118b05 (1046) 11MB -

[Ubuntu Foundations Team Bug Bot (crichton)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. It seems that your bug report is not filed about a specific source package though, rather it is just filed against Ubuntu in general. It is important that bug reports be filed about source packages so that people interested in the package can find the bugs about it. You can find some hints about determining what package your bug might be about at https://wiki.ubuntu.com/Bugs/FindRightPackage. You might also ask for help in the #ubuntu-bugs irc channel on Libera.chat.

To change the source package that this bug is filed about visit https://bugs.launchpad.net/ubuntu/+bug/2040094/+editstatus and add the package name in the text box next to the word Package.

[This is an automated message. I apologize if it reached you inappropriately; please just reply to this message indicating so.]

[Boris Erdmann (boris-erdmann)]

As requested by the bot: Since the package explicitly states:
contact: https://bugs.launchpad.net/snap-store/
but no snap-store nor snap-store-desktop package exists, I set this to "snap"

[Boris Erdmann (boris-erdmann)]

The bug might actually be that snap-store tries to read the certificates from

/etc/pki/tls/certs/ca-bundle.crt (redhat)

instead of

/etc/ssl/certs/ca-certificates.crt (ubuntu)

If /etc/pki/tls/certs/ca-bundle.crt was generally accepted to be looked into by programs this path should be added to apparmor's abstractions:

dpkg -S /etc/apparmor.d/abstractions/ssl_certs
apparmor: /etc/apparmor.d/abstractions/ssl_certs

Otherwise the path should be fixed in snap-store or included in snap-store's apparmor profile.

Anyways, I added the path to /etc/apparmor.d/abstractions/ssl_certs.d/etc.pki.tls.certs.ca-bundle.crt as a work-around.