Snapd installation is very slow during cloud-init

[Denis Lalaj]

[SRU] 2.72: https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/2124239

[ Impact ]

Snap icon downloads which is not required for cloud slows it down significantly.

[ Test Plan ]

1. Reproduce with snapd snap < 2.72

- Reproduce below installation scenario on CPC questing image
- Expect: slow installation due to icon downloads

2. Prove fixed with snapd snap 2.72

- Reproduce below installation scenario on CPC questing image
- Expect: similar install timing as before icons was introduced

---original---

Extremely slow installation of snaps is affecting CPC questing images. This behavior was not present in the most recently published questing image: https://cloud-images.ubuntu.com/questing/20250802/ that ships with (snapd 2.68.5+ubuntu25.10.2), but the behavior is present for images built that contain (snapd 2.71+ubuntu25.10).

It is currently affecting amd64 architectures when the image is launched in PS5 with the following cloud-init config. Our automation sets a 600 second timeout for cloud-init to complete and it is consistently timing out due to the snap installation.
```
#cloud-config
packages:
- snap:
  - lxd
```

Syslogs showing the final stage of cloud-init where the snap fails to install given the time are attached; additionally theres also a logfile for the published image with snapd 2.68.5 where the snap installation completes within reasonable time

[Denis Lalaj (dlalaj)]

Attached is the output for the install of the lxd snap specifically

[Sergio Cazzolato (sergio-j-cazzolato)]

Hi Denis, thanks for sharing this, could you please share the output of

> snap install lxd
> journalctl -u snapd

could be another snap which with fail/slow to download

Thanks

[Denis Lalaj (dlalaj)]

Hi Sergio. To clarify on how you want me to run this and update with some more context... The 600 second timeout is set by the teams automation and in such a case the instance is shut down and cleaned up after the failure.

In lauching the image with Openstack outside our automation (thus no timeout present) it appears it takes about 3-4 more minutes for the installation of lxd to complete when included in cloud-config. Ill shortly attach some relevant syslogs from two instances both launched outside our automation with no timeout set, one with the previous snapd deb (snapd 2.68.5+ubuntu25.10.2) and one with the recent snapd deb (snapd 2.71+ubuntu25.10). From the second instance (snapd 2.71+ubuntu25.10), I am also attaching the output of journalctl -u snapd (in this instance lxd did install eventually).

To clarify, because the timeout is no longer applicable since Im launching these outside our tooling, lxd snap eventually does get installed. So attempting to do `snap install lxd` will likely have no useful impact for debugging. If you would need me to try out in a fresh instance, let me know.

[Denis Lalaj (dlalaj)]

Syslog from cloud-init final stage when starting the instance with cloud-config data telling to install lxd. The instance is running the snapd 2.68.5+ubuntu25.10.2 deb

[Denis Lalaj (dlalaj)]

Syslog from cloud-init final stage when starting the instance with cloud-config data telling to install lxd. The instance is running the snapd 2.71+ubuntu25.10 deb

[Denis Lalaj (dlalaj)]

journalctl logs attached here.
The logs between these timestamps: 15:49:11 - 16:02:58 relate to booting the instance with cloud-config instructed to install lxd
The rest of the logs are from a test attempt at installing the hello-world snap

[Maciej Borzecki (maciek-borzecki)]

Denis provided images with 2.69 and 2.71 for debugging.

I created a LXD VM, one with the provided 2.71 image and the other with daily 25.10 which comes with snapd 2.69.

Attached the following snippet as cloud-init.user-data:

#cloud-config
packages:
- snap:
  - lxd

The difference in initialization time is negligible in my local environment.

With 2.69, ~29s:

[ 9.783025] cloud-init[728]: Cloud-init v. 25.2~5g009c4cfd-0ubuntu1 running 'modules:final' at Mon, 08 Sep 2025 06:09:24 +0000. Up 9.77 seconds.

Ubuntu Questing Quokka (development branch) u2-daily-2-69 ttyS0
...
[ 39.400404] sh[1175]: Completed socket interaction for boot stage final

Whereas with 2.71, ~26s:

[ 9.917240] cloud-init[738]: Cloud-init v. 25.3~2g890873f5-0ubuntu2 running 'modules:final' at Mon, 08 Sep 2025 06:07:03 +0000. Up 9.90 seconds.

Ubuntu Questing Quokka (development branch) u1-2-71 ttyS0
...
[ 36.530443] sh[1195]: Completed socket interaction for boot stage final

In both cases, I end up with the following set of snaps installed after cloud-init has finished:

root@u1-2-71:~# snap list
Name Version Rev Tracking Publisher Notes
core22 20250730 2111 latest/stable canonical✓ base
lxd 5.21.3-c5ae129 33110 5.21/stable canonical✓ -
snapd 2.71 25202 latest/stable canonical✓ snapd

On 2.71, the output of snap version is:

root@u1-2-71:~# snap version
snap 2.71+ubuntu25.10 <--- distro package
snapd 2.71+ubuntu25.10
series 16
ubuntu 25.10
kernel 6.16.0-16-generic

While on 2.69:

root@u2-daily-2-69:~# snap version
snap 2.71 <--- reexec from snapd snap
snapd 2.71
series 16
ubuntu 25.10
kernel 6.15.0-4-generic

[Maciej Borzecki (maciek-borzecki)]

Only after adding rules to drop all traffic going to dashboard.snapcraft.io and managed to trigger the problem. Was the original image tested in a firewalled environment which was actively blocking traffic such that icon download might have been stuck?

[Denis Lalaj (dlalaj)]

Further investigation has shown this is indeed related to the existing issue with icon downloads.

[Ernest Lotter (ernestl)]

https://github.com/canonical/snapd/pull/15940

[Julian Andres Klode (juliank)]

Hello Denis, or anyone else affected,

Accepted snapd into questing-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/snapd/2.72+ubuntu25.10.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-questing to verification-done-questing. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-questing. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Julian Andres Klode (juliank)]

Hello Denis, or anyone else affected,

Accepted snapd into plucky-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/snapd/2.72+ubuntu25.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-plucky to verification-done-plucky. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-plucky. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Julian Andres Klode (juliank)]

Hello Denis, or anyone else affected,

Accepted snapd into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/snapd/2.72+ubuntu24.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Julian Andres Klode (juliank)]

Hello Denis, or anyone else affected,

Accepted snapd into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/snapd/2.72+ubuntu22.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Denis Lalaj (dlalaj)]

I can do the verification for questing as I have a machine that displayed this issue around before

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted snapd (2.72+ubuntu24.04) for noble have finished running.
The following regressions have been reported in tests triggered by the package:

docker.io-app/28.2.2-0ubuntu1~24.04.1 (amd64, arm64, ppc64el, s390x)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/noble/update_excuses.html#snapd

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted snapd (2.72+ubuntu22.04) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

docker.io-app/28.2.2-0ubuntu1~22.04.1 (amd64, ppc64el, s390x)
livecd-rootfs/2.765.55 (amd64)
systemd/249.11-0ubuntu3.17 (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#snapd

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted snapd (2.72+ubuntu25.10.2) for questing have finished running.
The following regressions have been reported in tests triggered by the package:

linux-realtime/6.17.0-1002.3 (amd64)
livecd-rootfs/25.10.24 (arm64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/questing/update_excuses.html#snapd

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted snapd (2.72+ubuntu25.04) for plucky have finished running.
The following regressions have been reported in tests triggered by the package:

docker.io-app/28.2.2-0ubuntu1~25.04.1 (amd64, arm64, ppc64el, s390x)
systemd/257.4-1ubuntu3.2 (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/plucky/update_excuses.html#snapd

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Denis Lalaj (dlalaj)]

Verification complete for questing:

#######################################################################################
################# Logs from instance running snapd=2.71.1+ubuntu25.10.1 #################
#######################################################################################
ubuntu@dlalaj-snapd-271:~$ apt list --installed | grep snapd

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

snapd/questing,now 2.71.1+ubuntu25.10.1 amd64 [installed,automatic]

ubuntu@dlalaj-snapd-271:~$ time sudo snap install lxd
2025-10-20T23:36:11Z INFO Waiting for automatic snapd restart...
lxd (5.21/stable) 5.21.4-7b6bd68 from Canonical✓ installed

real 13m44.096s
user 0m0.112s
sys 0m0.213s

ubuntu@dlalaj-snapd-271:~$ snap list
Name Version Rev Tracking Publisher Notes
core22 20250822 2133 latest/stable canonical✓ base
lxd 5.21.4-7b6bd68 36153 5.21/stable canonical✓ -
snapd 2.71 25202 latest/stable canonical✓ snapd

REPORTED INSTALLATION TIME: 13m44.096s
#######################################################################################

#######################################################################################
################# Logs from instance running snapd=2.72+ubuntu25.10.2 #################
#######################################################################################

ubuntu@dlalaj-snapd-272:~$ apt list --installed | grep snapd

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

snapd/questing-proposed,now 2.72+ubuntu25.10.2 amd64 [installed,automatic]

ubuntu@dlalaj-snapd-272:~$ time sudo snap install lxd
2025-10-20T23:32:49Z INFO Waiting for automatic snapd restart...
lxd (5.21/stable) 5.21.4-7b6bd68 from Canonical✓ installed

real 0m14.079s
user 0m0.003s
sys 0m0.012s

ubuntu@dlalaj-snapd-272:~$ snap list
Name Version Rev Tracking Publisher Notes
core22 20250822 2133 latest/stable canonical✓ base
lxd 5.21.4-7b6bd68 36153 5.21/stable canonical✓ -
snapd 2.72 25577 latest/stable canonical✓ snapd

REPORTED INSTALLATION TIME: 0m14.079s
#######################################################################################

Attached is a file detailing the logs obtained from `journalctl -u snapd` when the machine has SNAPD_DEBUG=1 set in /etc/environment. The log file shows the relevant section from the logs of both machines including the icon download retry attempts in the machine running snapd=2.71.1+ubuntu25.10.1. As opposed, the machine running snapd=2.72+ubuntu25.10.2, completes the installation much faster as it is not stuck on the icon download retries. Id recommend paying close attention to the timestamps of the retries in the log file for the machine running snapd=2.71.1+ubuntu25.10.1, as that confirms the timing delay is attributed to the icon download.

[Denis Lalaj (dlalaj)]

Verification complete for noble:

#######################################################################################
################## Logs from instance running snapd=2.71+ubuntu24.04 ##################
#######################################################################################
ubuntu@noble-dlalaj-snapd-271:~$ lsb_release -c
No LSB modules are available.
Codename: noble

ubuntu@noble-dlalaj-snapd-271:~$ apt list --installed | grep snapd

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

snapd/noble-updates,now 2.71+ubuntu24.04 amd64 [installed,automatic] 100% 10.7MB/s 0.0nserror: change finished in status "Undone" with no error message

ubuntu@noble-dlalaj-snapd-271:~$ time sudo snap install lxd
2025-10-21T19:10:27Z INFO Waiting for automatic snapd restart...
lxd (5.21/stable) 5.21.4-7b6bd68 from Canonical✓ installed

real 13m48.045s
user 0m0.131s
sys 0m0.375s

ubuntu@noble-dlalaj-snapd-271:~$ snap list
Name Version Rev Tracking Publisher Notes
core22 20250923 2139 latest/stable canonical✓ base
lxd 5.21.4-7b6bd68 36153 5.21/stable canonical✓ -
snapd 2.71 25202 latest/stable canonical✓ snapd

REPORTED INSTALLATION TIME: 13m48.045s
#######################################################################################

#######################################################################################
################# Logs from instance running snapd=2.72+ubuntu24.04 ###################
#######################################################################################
ubuntu@noble-dlalaj-snapd-272:~$ lsb_release -c
No LSB modules are available.
Codename: noble

ubuntu@noble-dlalaj-snapd-272:~$ apt list --installed | grep snapd

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

snapd/noble-proposed,now 2.72+ubuntu24.04 amd64 [installed,automatic]

ubuntu@noble-dlalaj-snapd-272:~$ time sudo snap install lxd
2025-10-21T19:06:18Z INFO Waiting for automatic snapd restart...
lxd (5.21/stable) 5.21.4-7b6bd68 from Canonical✓ installed

real 1m2.148s
user 0m0.010s
sys 0m0.030s

ubuntu@noble-dlalaj-snapd-272:~$ snap list
Name Version Rev Tracking Publisher Notes
core22 20250822 2133 latest/stable canonical✓ base
lxd 5.21.4-7b6bd68 36153 5.21/stable canonical✓ -
snapd 2.71 25202 latest/stable canonical✓ snapd

REPORTED INSTALLATION TIME: 1m2.148s
#######################################################################################

See attached logile for similar reasoning as questing. Pay attention to the retry timing on the icon download as that verifies the slow installation is related to that.

[Denis Lalaj (dlalaj)]

Verification complete for jammy:

#######################################################################################
################## Logs from instance running snapd=2.71+ubuntu22.04 ##################
#######################################################################################
ubuntu@jammy-dlalaj-snapd-271:~$ snap list
No snaps are installed yet. Try 'snap install hello-world'.

ubuntu@jammy-dlalaj-snapd-271:~$ apt list --installed | grep snapd

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

snapd/jammy-updates,now 2.71+ubuntu22.04 amd64 [installed,automatic]

ubuntu@jammy-dlalaj-snapd-271:~$ time sudo snap install lxd
2025/10/22 17:59:55.366905 tool_linux.go:199: DEBUG: re-exec disabled by user
2025-10-22T18:04:24Z INFO Waiting for automatic snapd restart...
lxd (5.21/stable) 5.21.4-7b6bd68 from Canonical✓ installed

real 13m39.363s
user 0m0.091s
sys 0m0.304s

ubuntu@jammy-dlalaj-snapd-271:~$ snap list
Name Version Rev Tracking Publisher Notes
core22 20250923 2139 latest/stable canonical✓ base
lxd 5.21.4-7b6bd68 36153 5.21/stable canonical✓ -
snapd 2.72 25577 latest/stable canonical✓ snapd

REPORTED INSTALLATION TIME: 13m39.363s
#######################################################################################

#######################################################################################
################# Logs from instance running snapd=2.72+ubuntu22.04 ###################
#######################################################################################
ubuntu@jammy-dlalaj-snapd-272:~$ snap list
No snaps are installed yet. Try 'snap install hello-world'.

ubuntu@jammy-dlalaj-snapd-272:~$ apt list --installed | grep snapd

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

snapd/jammy-proposed,now 2.72+ubuntu22.04 amd64 [installed,automatic]

ubuntu@jammy-dlalaj-snapd-272:~$ time sudo snap install lxd
2025/10/22 18:00:02.529019 tool_linux.go:199: DEBUG: re-exec disabled by user
2025-10-22T18:00:07Z INFO Waiting for automatic snapd restart...
lxd (5.21/stable) 5.21.4-7b6bd68 from Canonical✓ installed

real 0m24.875s
user 0m0.002s
sys 0m0.014s

ubuntu@jammy-dlalaj-snapd-272:~$ snap list
Name Version Rev Tracking Publisher Notes
core22 20250923 2139 latest/stable canonical✓ base
lxd 5.21.4-7b6bd68 36153 5.21/stable canonical✓ -
snapd 2.72 25577 latest/stable canonical✓ snapd

REPORTED INSTALLATION TIME: 0m24.875s
#######################################################################################

See attached logile for similar reasoning as questing. Pay attention to the retry timing on the icon download as that verifies the slow installation is related to that. For more context; to ensure that the icon download issue manifested itself, the lxd, core, and snapd snaps which come pre-installed in jammy were removed before this verification was complete. Additionally to disallow the 2.72 snapd snap to reexec and run the later snap installations (for core and lxd), SNAP_REEXEC=0 was set in /etc/environment.

[Denis Lalaj (dlalaj)]

Verification complete for plucky:

#######################################################################################
################## Logs from instance running snapd=2.71+ubuntu25.04 ##################
#######################################################################################
ubuntu@plucky-dlalaj-snapd-271:~$ snap list
No snaps are installed yet. Try 'snap install hello-world'.

ubuntu@plucky-dlalaj-snapd-271:~$ apt list --installed | grep snapd

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

snapd/plucky-updates,now 2.71+ubuntu25.04 amd64 [installed,automatic]

ubuntu@plucky-dlalaj-snapd-271:~$ time sudo snap install lxd
2025/10/22 21:17:59.766042 tool_linux.go:199: DEBUG: re-exec disabled by user
2025-10-22T21:22:34Z INFO Waiting for automatic snapd restart...
lxd (5.21/stable) 5.21.4-7b6bd68 from Canonical✓ installed

real 13m55.482s
user 0m0.111s
sys 0m0.436s

ubuntu@plucky-dlalaj-snapd-271:~$ snap list
Name Version Rev Tracking Publisher Notes
core22 20250923 2139 latest/stable canonical✓ base
lxd 5.21.4-7b6bd68 36153 5.21/stable canonical✓ -
snapd 2.72 25577 latest/stable canonical✓ snapd

REPORTED INSTALLATION TIME: 13m55.482s
#######################################################################################

#######################################################################################
################# Logs from instance running snapd=2.72+ubuntu25.04 ###################
#######################################################################################
ubuntu@plucky-dlalaj-snapd-272:~$ snap list
No snaps are installed yet. Try 'snap install hello-world'.

ubuntu@plucky-dlalaj-snapd-272:~$ apt list --installed | grep snapd

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

snapd/plucky-proposed,now 2.72+ubuntu25.04 amd64 [installed,automatic]

ubuntu@plucky-dlalaj-snapd-272:~$ time sudo snap install lxd
2025/10/22 21:18:08.629642 tool_linux.go:199: DEBUG: re-exec disabled by user
2025-10-22T21:18:13Z INFO Waiting for automatic snapd restart...
lxd (5.21/stable) 5.21.4-7b6bd68 from Canonical✓ installed

real 0m26.402s
user 0m0.005s
sys 0m0.028s

ubuntu@plucky-dlalaj-snapd-272:~$ snap list
Name Version Rev Tracking Publisher Notes
core22 20250923 2139 latest/stable canonical✓ base
lxd 5.21.4-7b6bd68 36153 5.21/stable canonical✓ -
snapd 2.71 25202 latest/stable canonical✓ snapd

REPORTED INSTALLATION TIME: 0m26.402s
#######################################################################################

See attached logile for similar reasoning as questing. Pay attention to the retry timing on the icon download as that verifies the slow installation is related to that. To disallow the 2.72 snapd snap to reexec and run the later snap installations (for core and lxd), SNAP_REEXEC=0 was set in /etc/environment.

[Launchpad Janitor (janitor)]

This bug was fixed in the package snapd - 2.72+ubuntu26.04.1

---------------
snapd (2.72+ubuntu26.04.1) resolute; urgency=medium

  * New upstream release, LP: #2124239
    - FDE: support replacing TPM protected keys at runtime via the
      /v2/system-volumes endpoint
    - FDE: support secboot preinstall check fix actions for 25.10+
      hybrid installs via the /v2/system/{label} endpoint
    - FDE: tweak polkit message to remove jargon
    - FDE: ensure proper sealing with kernel command line defaults
    - FDE: provide generic reseal function
    - FDE: support using OPTEE for protecting keys, as an alternative to
      existing fde-setup hooks (Ubuntu Core only)
    - Confdb: 'snapctl get --view' supports passing default values
    - Confdb: content sub-rules in confdb-schemas inherit their parent
      rule's "access"
    - Confdb: make confdb error kinds used in API more generic
    - Confdb: fully support lists and indexed paths (including unset)
    - Prompting: add notice backend for prompting types (unused for now)
    - Prompting: include request cgroup in prompt
    - Prompting: handle unsupported xattrs
    - Prompting: add permission mapping for the camera interface
    - Notices: read notices from state without state lock
    - Notices: add methods to get notice fields and create, reoccur, and
      deepcopy notice
    - Notices: add notice manager to coordinate separate notice backends
    - Notices: support draining notices from state when notice backend
      registered as producer of a particular notice type
    - Notices: query notice manager from daemon instead of querying
      state for notices directly
    - Packaging: Ubuntu | ignore .git directory
    - Packaging: FIPS | bump deb Go FIPS to 1.23
    - Packaging: snap | bump FIPS toolchain to 1.23
    - Packaging: debian | sync most upstream changes
    - Packaging: debian-sid | depends on libcap2-bin for postint
    - Packaging: Fedora | drop fakeroot
    - Packaging: snap | modify snapd.mk to pass build tags when running
      unit tests
    - Packaging: snap | modify snapd.mk to pass nooptee build tag
    - Packaging: modify Makefile.am to fix snap-confine install profile
      with 'make hack'
    - Packaging: modify Makefile.am to fix out-of-tree use of 'make
      hack'
    - LP: #2122054 Snap installation: skip snap icon download when
      running in a cloud or using a proxy store
    - Snap installation: add timeout to http client when downloading
      snap icon
    - Snap installation: use http(s) proxy for icon downloads
    - LP: #2117558 snap-confine: fix error message with /root/snap not
      accessible
    - snap-confine: fix non-suid limitation by switching to root:root to
      operate v1 freezer
    - core-initrd: do not use writable-paths when not available
    - core-initrd: remove debian folder
    - LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev
      interface now with the more robust gpio-aggregator configfs kernel
      interface
    - Interfaces: gpio-chardev | exclusive snap connections, raise a
      conflict when both gpio-chardev and gpio are connected
    - Interfaces: gpio-chardev | fix gpio-aggregator module lo...

[Andreas Hasenack (ahasenack)]

note to self: SRU ok for release

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for snapd has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package snapd - 2.72+ubuntu25.04

---------------
snapd (2.72+ubuntu25.04) plucky; urgency=medium

  * New upstream release, LP: #2124239
    - FDE: support replacing TPM protected keys at runtime via the
      /v2/system-volumes endpoint
    - FDE: support secboot preinstall check fix actions for 25.10+
      hybrid installs via the /v2/system/{label} endpoint
    - FDE: tweak polkit message to remove jargon
    - FDE: ensure proper sealing with kernel command line defaults
    - FDE: provide generic reseal function
    - FDE: support using OPTEE for protecting keys, as an alternative to
      existing fde-setup hooks (Ubuntu Core only)
    - Confdb: 'snapctl get --view' supports passing default values
    - Confdb: content sub-rules in confdb-schemas inherit their parent
      rule's "access"
    - Confdb: make confdb error kinds used in API more generic
    - Confdb: fully support lists and indexed paths (including unset)
    - Prompting: add notice backend for prompting types (unused for now)
    - Prompting: include request cgroup in prompt
    - Prompting: handle unsupported xattrs
    - Prompting: add permission mapping for the camera interface
    - Notices: read notices from state without state lock
    - Notices: add methods to get notice fields and create, reoccur, and
      deepcopy notice
    - Notices: add notice manager to coordinate separate notice backends
    - Notices: support draining notices from state when notice backend
      registered as producer of a particular notice type
    - Notices: query notice manager from daemon instead of querying
      state for notices directly
    - Packaging: Ubuntu | ignore .git directory
    - Packaging: FIPS | bump deb Go FIPS to 1.23
    - Packaging: snap | bump FIPS toolchain to 1.23
    - Packaging: debian | sync most upstream changes
    - Packaging: debian-sid | depends on libcap2-bin for postint
    - Packaging: Fedora | drop fakeroot
    - Packaging: snap | modify snapd.mk to pass build tags when running
      unit tests
    - Packaging: snap | modify snapd.mk to pass nooptee build tag
    - Packaging: modify Makefile.am to fix snap-confine install profile
      with 'make hack'
    - Packaging: modify Makefile.am to fix out-of-tree use of 'make
      hack'
    - LP: #2122054 Snap installation: skip snap icon download when
      running in a cloud or using a proxy store
    - Snap installation: add timeout to http client when downloading
      snap icon
    - Snap installation: use http(s) proxy for icon downloads
    - LP: #2117558 snap-confine: fix error message with /root/snap not
      accessible
    - snap-confine: fix non-suid limitation by switching to root:root to
      operate v1 freezer
    - core-initrd: do not use writable-paths when not available
    - core-initrd: remove debian folder
    - LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev
      interface now with the more robust gpio-aggregator configfs kernel
      interface
    - Interfaces: gpio-chardev | exclusive snap connections, raise a
      conflict when both gpio-chardev and gpio are connected
    - Interfaces: gpio-chardev | fix gpio-aggregator module load ord...

[Launchpad Janitor (janitor)]

This bug was fixed in the package snapd - 2.72+ubuntu24.04

---------------
snapd (2.72+ubuntu24.04) noble; urgency=medium

  * New upstream release, LP: #2124239
    - FDE: support replacing TPM protected keys at runtime via the
      /v2/system-volumes endpoint
    - FDE: support secboot preinstall check fix actions for 25.10+
      hybrid installs via the /v2/system/{label} endpoint
    - FDE: tweak polkit message to remove jargon
    - FDE: ensure proper sealing with kernel command line defaults
    - FDE: provide generic reseal function
    - FDE: support using OPTEE for protecting keys, as an alternative to
      existing fde-setup hooks (Ubuntu Core only)
    - Confdb: 'snapctl get --view' supports passing default values
    - Confdb: content sub-rules in confdb-schemas inherit their parent
      rule's "access"
    - Confdb: make confdb error kinds used in API more generic
    - Confdb: fully support lists and indexed paths (including unset)
    - Prompting: add notice backend for prompting types (unused for now)
    - Prompting: include request cgroup in prompt
    - Prompting: handle unsupported xattrs
    - Prompting: add permission mapping for the camera interface
    - Notices: read notices from state without state lock
    - Notices: add methods to get notice fields and create, reoccur, and
      deepcopy notice
    - Notices: add notice manager to coordinate separate notice backends
    - Notices: support draining notices from state when notice backend
      registered as producer of a particular notice type
    - Notices: query notice manager from daemon instead of querying
      state for notices directly
    - Packaging: Ubuntu | ignore .git directory
    - Packaging: FIPS | bump deb Go FIPS to 1.23
    - Packaging: snap | bump FIPS toolchain to 1.23
    - Packaging: debian | sync most upstream changes
    - Packaging: debian-sid | depends on libcap2-bin for postint
    - Packaging: Fedora | drop fakeroot
    - Packaging: snap | modify snapd.mk to pass build tags when running
      unit tests
    - Packaging: snap | modify snapd.mk to pass nooptee build tag
    - Packaging: modify Makefile.am to fix snap-confine install profile
      with 'make hack'
    - Packaging: modify Makefile.am to fix out-of-tree use of 'make
      hack'
    - LP: #2122054 Snap installation: skip snap icon download when
      running in a cloud or using a proxy store
    - Snap installation: add timeout to http client when downloading
      snap icon
    - Snap installation: use http(s) proxy for icon downloads
    - LP: #2117558 snap-confine: fix error message with /root/snap not
      accessible
    - snap-confine: fix non-suid limitation by switching to root:root to
      operate v1 freezer
    - core-initrd: do not use writable-paths when not available
    - core-initrd: remove debian folder
    - LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev
      interface now with the more robust gpio-aggregator configfs kernel
      interface
    - Interfaces: gpio-chardev | exclusive snap connections, raise a
      conflict when both gpio-chardev and gpio are connected
    - Interfaces: gpio-chardev | fix gpio-aggregator module load orde...

[Launchpad Janitor (janitor)]

This bug was fixed in the package snapd - 2.72+ubuntu22.04

---------------
snapd (2.72+ubuntu22.04) jammy; urgency=medium

  * New upstream release, LP: #2124239
    - FDE: support replacing TPM protected keys at runtime via the
      /v2/system-volumes endpoint
    - FDE: support secboot preinstall check fix actions for 25.10+
      hybrid installs via the /v2/system/{label} endpoint
    - FDE: tweak polkit message to remove jargon
    - FDE: ensure proper sealing with kernel command line defaults
    - FDE: provide generic reseal function
    - FDE: support using OPTEE for protecting keys, as an alternative to
      existing fde-setup hooks (Ubuntu Core only)
    - Confdb: 'snapctl get --view' supports passing default values
    - Confdb: content sub-rules in confdb-schemas inherit their parent
      rule's "access"
    - Confdb: make confdb error kinds used in API more generic
    - Confdb: fully support lists and indexed paths (including unset)
    - Prompting: add notice backend for prompting types (unused for now)
    - Prompting: include request cgroup in prompt
    - Prompting: handle unsupported xattrs
    - Prompting: add permission mapping for the camera interface
    - Notices: read notices from state without state lock
    - Notices: add methods to get notice fields and create, reoccur, and
      deepcopy notice
    - Notices: add notice manager to coordinate separate notice backends
    - Notices: support draining notices from state when notice backend
      registered as producer of a particular notice type
    - Notices: query notice manager from daemon instead of querying
      state for notices directly
    - Packaging: Ubuntu | ignore .git directory
    - Packaging: FIPS | bump deb Go FIPS to 1.23
    - Packaging: snap | bump FIPS toolchain to 1.23
    - Packaging: debian | sync most upstream changes
    - Packaging: debian-sid | depends on libcap2-bin for postint
    - Packaging: Fedora | drop fakeroot
    - Packaging: snap | modify snapd.mk to pass build tags when running
      unit tests
    - Packaging: snap | modify snapd.mk to pass nooptee build tag
    - Packaging: modify Makefile.am to fix snap-confine install profile
      with 'make hack'
    - Packaging: modify Makefile.am to fix out-of-tree use of 'make
      hack'
    - LP: #2122054 Snap installation: skip snap icon download when
      running in a cloud or using a proxy store
    - Snap installation: add timeout to http client when downloading
      snap icon
    - Snap installation: use http(s) proxy for icon downloads
    - LP: #2117558 snap-confine: fix error message with /root/snap not
      accessible
    - snap-confine: fix non-suid limitation by switching to root:root to
      operate v1 freezer
    - core-initrd: do not use writable-paths when not available
    - core-initrd: remove debian folder
    - LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev
      interface now with the more robust gpio-aggregator configfs kernel
      interface
    - Interfaces: gpio-chardev | exclusive snap connections, raise a
      conflict when both gpio-chardev and gpio are connected
    - Interfaces: gpio-chardev | fix gpio-aggregator module load orde...

[Launchpad Janitor (janitor)]

This bug was fixed in the package snapd - 2.72+ubuntu25.10.2

---------------
snapd (2.72+ubuntu25.10.2) questing; urgency=medium

  * New upstream release, LP: #2124239
    - FDE: support replacing TPM protected keys at runtime via the
      /v2/system-volumes endpoint
    - FDE: support secboot preinstall check fix actions for 25.10+
      hybrid installs via the /v2/system/{label} endpoint
    - FDE: tweak polkit message to remove jargon
    - FDE: ensure proper sealing with kernel command line defaults
    - FDE: provide generic reseal function
    - FDE: support using OPTEE for protecting keys, as an alternative to
      existing fde-setup hooks (Ubuntu Core only)
    - Confdb: 'snapctl get --view' supports passing default values
    - Confdb: content sub-rules in confdb-schemas inherit their parent
      rule's "access"
    - Confdb: make confdb error kinds used in API more generic
    - Confdb: fully support lists and indexed paths (including unset)
    - Prompting: add notice backend for prompting types (unused for now)
    - Prompting: include request cgroup in prompt
    - Prompting: handle unsupported xattrs
    - Prompting: add permission mapping for the camera interface
    - Notices: read notices from state without state lock
    - Notices: add methods to get notice fields and create, reoccur, and
      deepcopy notice
    - Notices: add notice manager to coordinate separate notice backends
    - Notices: support draining notices from state when notice backend
      registered as producer of a particular notice type
    - Notices: query notice manager from daemon instead of querying
      state for notices directly
    - Packaging: Ubuntu | ignore .git directory
    - Packaging: FIPS | bump deb Go FIPS to 1.23
    - Packaging: snap | bump FIPS toolchain to 1.23
    - Packaging: debian | sync most upstream changes
    - Packaging: debian-sid | depends on libcap2-bin for postint
    - Packaging: Fedora | drop fakeroot
    - Packaging: snap | modify snapd.mk to pass build tags when running
      unit tests
    - Packaging: snap | modify snapd.mk to pass nooptee build tag
    - Packaging: modify Makefile.am to fix snap-confine install profile
      with 'make hack'
    - Packaging: modify Makefile.am to fix out-of-tree use of 'make
      hack'
    - LP: #2122054 Snap installation: skip snap icon download when
      running in a cloud or using a proxy store
    - Snap installation: add timeout to http client when downloading
      snap icon
    - Snap installation: use http(s) proxy for icon downloads
    - LP: #2117558 snap-confine: fix error message with /root/snap not
      accessible
    - snap-confine: fix non-suid limitation by switching to root:root to
      operate v1 freezer
    - core-initrd: do not use writable-paths when not available
    - core-initrd: remove debian folder
    - LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev
      interface now with the more robust gpio-aggregator configfs kernel
      interface
    - Interfaces: gpio-chardev | exclusive snap connections, raise a
      conflict when both gpio-chardev and gpio are connected
    - Interfaces: gpio-chardev | fix gpio-aggregator module lo...