Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Staged package dedup #223

Closed

Conversation

simondeziel
Copy link
Member

Stop priming binaries that are already available in the base/core snap. See https://snapcraft.io/docs/build-and-staging-dependencies#heading--filtering for the explanation.

In the case of vim and for the 5.0/stable channel, this would have saved us from using a known vulnerable vim version:

$ grep vim-tiny /snap/core20/current/usr/share/snappy/dpkg.list 
ii  vim-tiny                       2:8.1.2269-1ubuntu5.15       amd64        Vi IMproved - enhanced vi editor - compact version

$ grep '^- vim-tiny' /snap/lxd/current/snap/manifest.yaml 
- vim-tiny=2:8.1.2269-1ubuntu5.11

In the above, core20 ships ... .15 while the 5.0/stable one has ... .11.

The situation with differs for latest/stable as our snap's vim is ahead of what core22 provides:

$ grep vim-tiny /snap/core22/current/usr/share/snappy/dpkg.list 
ii  vim-tiny                       2:8.2.3995-1ubuntu2.9                   amd64        Vi IMproved - enhanced vi editor - compact version

$ grep '^- vim-tiny' /snap/lxd/current/snap/manifest.yaml 
- vim-tiny=2:8.2.3995-1ubuntu2.13

Even then, I think we should rely on what's provided by the base/core snap so that another team is responsible for that "shared infrastructure bit".

@simondeziel
Copy link
Member Author

Superseded by #237

@simondeziel simondeziel closed this Dec 6, 2023
@simondeziel simondeziel deleted the staged-package-dedup branch December 6, 2023 18:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant