snap-store-proxy: can't add override for snap in brand store

[Kyle Nitzsche]

I cannot add an snap/rev override for snaps in the brand store used by my devices.

For example, the ce-team-test store has test-revision rev 8 on stable (armhf). And I can install it on the device through the snap-store-proxy (SSP). But I cannot add an override for this snap.

On the SSP host
---------------

root@snap-store-proxy:~# sudo snap-proxy override test-revision stable=8
Failed to set override:
No snap named 'test-revision' found in series '16'.

root@snap-store-proxy:~# sudo snap-proxy check-connections
http: https://dashboard.snapcraft.io: OK
http: https://login.ubuntu.com: OK
http: https://api.snapcraft.io: OK
postgres: localhost: OK
All connections appear to be accessible

On the device
-------------

knitzsche@ubuntu:/snap/pi-kernel/current/meta$ snap info test-revision
name: test-revision
summary: Boilerplate2
publisher: Kyle Nitzsche (knitzsche)
store-url: https://snapcraft.io/test-revision
license: unset
description: |
  This is my-snap's description. You have a paragraph or two to tell the
  most important story about your snap. Keep it under 100 words though,
  we live in tweetspace and your description wants to look good in the snap
  store.
snap-id: Hd1B6bexX487FYwOzk8ChZyja7A10QxS
tracking: latest/stable
refresh-date: today at 16:31 UTC
channels:
  latest/stable: 0.3 2021-03-09 (8) 8kB -
  latest/candidate: ↑
  latest/beta: ↑
  latest/edge: 0.1 2021-02-08 (1) 8kB -
installed: 0.3 (8) 8kB -

Same thing for another snap in the ce-team-test store
-----------------------------------------------------

root@snap-store-proxy:~# sudo snap-proxy override demo-game-0 stable=1
Failed to set override:
No snap named 'demo-game-0' found in series '16'.

But, I can add overrides for snaps in the global store
------------------------------------------------------

root@snap-store-proxy:~# snap info learnit
name: learnit
summary: Learn through flash card tests
publisher: Kyle Nitzsche (knitzsche)
store-url: https://snapcraft.io/learnit
contact: <email address hidden>
license: LGPL-3.0+
description: |
  Learn through flashcards from external card files
snap-id: OHILDGdP7v0yZmkQnvGyXnGD5t2mZZ1g
channels:
  latest/stable: 1 2021-07-22 (23) 1MB -
  latest/candidate: 0.2 2017-05-17 (2) 696kB -
  latest/beta: 0.2 2017-05-17 (2) 696kB -
  latest/edge: 1 2021-07-23 (25) 1MB -

root@snap-store-proxy:~# sudo snap-proxy override learnit stable=23
learnit stable amd64 23 (upstream 23)

[Przemysław Suliga (suligap)]

Thanks. That's correct. If I understand correctly, currently snap-store-proxy overrides is a mechanism that gives clients the ability to control revisions for snaps they do not have control over, like snaps from the Global store.

[Kyle Nitzsche (knitzsche)]

That's not mentioned, I think, in the docs: https://docs.ubuntu.com/snap-store-proxy/en/overrides

As a method for limiting the revisions of snaps that flow to devices that use your SSP, it is inconsistent with the design of Refresh Control, which allows validating any snap's revision. But, it is true that most folks use Refresh Control to validate only snaps whose release they do NOT control.

Cheers

[Kyle Nitzsche (knitzsche)]

I just found that in air gap mode, with the brand store meta information added, I can set an override for a snap in the brand store, however, the list-overrides command then indicates there are no overrides available in air gap mode, and the override does not apply. I think it is probably a bug that you can set an override on an SSP in air gap mode. I have filed a separate bug for this: https://bugs.launchpad.net/snapstore-server/+bug/1953512

[Bret Barker (noise)]

I think there has been some miscommunication around this topic so let me try to clarify. There are 2 issues:

1) Overrides don't work for snaps in brand stores. This is a bug, the proxy admin should have control over snap updates for all of their devices, global or brand store. Note that brands themselves should utilize the normal channel release mechanisms and refresh-control, this functionality is more for a third-party enterprise that is managing a heterogenous set of devices within their network.

2) Overrides don't work in air-gap mode. This is correct as the admin is explicitly loading certain revisions. I recommend we simply have those commands fail with a more descriptive error in that scenario.