Releate 2.58.3 to Fedora RHBZ#2173056

New upstream release 2.58.3
interfaces/screen-inhibit-control: Add support for xfce-power-
interfaces/network-manager: do not show ptrace read
interfaces: relax rules for mount-control `what` for functionfs
cmd/snap-bootstrap: add support for snapd_system_disk
interfaces/modem-manager: add net_admin capability
interfaces/network-manager: add permission for OpenVPN
httputil: fix checking x509 certification error on go 1.20
i/b/fwupd: allow reading host os-release
boot: on classic+modes `MarkBootSuccessfull` does not need a base
boot: do not include `base=` in modeenv for classic+modes installs
tests: add spread test that validates revert on boot for core does
snapstate: only take boot participants into account in
snapstate: refactor UpdateBootRevisions() to make it easier to

New upstream release 2.58.2
bootloader: fix dirty build by hardcoding copyright year

New upstream release 2.58.1
secboot: detect lockout mode in CheckTPMKeySealingSupported
cmd/snap-update-ns: prevent keeping unneeded mountpoints
o/snapstate: do not infinitely retry when an update fails during
interfaces/modem-manager: add permissions for NETLINK_ROUTE
systemd/emulation.go: use `systemctl --root` to enable/disable
snap: provide more error context in `NotSnapError`
interfaces: add read access to /run for cryptsetup
boot: avoid reboot loop if there is a bad try kernel
devicestate: retry serial acquire on time based certificate
o/devicestate: run systemctl daemon-reload after install-device
cmd/snap,daemon: add 'held' to notes in 'snap list'
o/snapshotstate: check snapshots are self-contained on import
cmd/snap: show user+gating hold info in 'snap info'
daemon: expose user and gating holds at /v2/snaps/{name}

Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

Fix for RHBZ#2152903

New upstream release 2.58
many: Use /tmp/snap-private-tmp for per-snap private tmps
data: Add systemd-tmpfiles configuration to create private tmp dir
cmd/snap: test allowed and forbidden refresh hold values
cmd/snap: be more consistent in --hold help and err messages
cmd/snap: error on refresh holds that are negative or too short
o/homedirs: make sure we do not write to /var on build time
image: make sure file customizations happen also when we have
tests/fde-on-classic: set ubuntu-seed label in seed partitions
gadget: system-seed-null should also have fs label ubuntu-seed
many: gadget.HasRole, ubuntu-seed can come also from system-seed-
o/devicestate: fix paths for retrieving recovery key on classic
cmd/snap-confine: do not discard const qualifier
interfaces: allow python3.10+ in the default template
o/restart: fix PendingForSystemRestart
interfaces: allow wayland slot snaps to access shm files created
o/assertstate: add Sequence() to val set tracking
o/assertstate: set val set 'Current' to pinned sequence
tests: tweak the libvirt interface test to work on 22.10
tests: use system-seed-null role on classic with modes tests
boot: add directory for data on install
o/devicestate: change some names from esp to seed/seed-null
gadget: add system-seed-null role
o/devicestate: really add error to new error message
restart,snapstate: implement reboot-required notifications on
many: avoid automatic system restarts on classic through new
release: Fix WSL detection in LXD
o/state: introduce WaitStatus
interfaces: Fix desktop interface rules for document portal
client: remove classic check for `snap recovery --show-
many: create snapd.mounts targets to schedule mount units
image: enable sysfs overlay for UC preseeding
i/b/network-control: add permissions for using AF_XDP
i/apparmor: move mocking of home and overlay conditions to osutil
tests/main/degraded: ignore man-db update failures in CentOS
cmd/snap: fix panic when running snap w/ flag but w/o subcommand
tests: save snaps generated during image preaparation
tests: skip building snapd based on new env var
client: remove misleading comments in ValidateApplyOptions
boot/seal: add debug traces for bootchains
bootloader/assets: fix grub.cfg when there are no labels
cmd/snap: improve refresh hold's output
packaging: enable BPF in RHEL9
packaging: do not traverse filesystems in postrm script
tests: get microk8s from another branch
bootloader: do not specify Core version in grub entry
many: refresh --hold follow-up
many: support refresh hold/unhold to API and CLI
many: expand fully handling links mapping in all components, in
snap/system_usernames,tests: Azure IoT Edge system usernames
interface: Allow access to
observe
o/devicestate,daemon: use the expiration date from the assertion
state and REST api (user-removal 4/n)
gadget: add unit tests for new install functions for FDE on
cmd/snap-seccomp: fix typo in AF_XDP value
tests/connected-after-reboot-revert: run also on UC16
kvm: allow read of AMD-SEV parameters
data: tweak apt integration config var
o/c/configcore: add faillock configuration
tests: use dbus-daemon instead of dbus-launch
packaging: remove unclean debian-sid patch
asserts: add keyword 'user-presence' keyword in system-user
removal 3/n)
interfaces: steam-support allow pivot /run/media and /etc/nvidia
aspects: initial code
overlord: process auto-import assertion at first boot
release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
tests: fix lxd-mount-units in ubuntu kinetic
tests: new variable used to configure the kernel command line in
go.mod: update to newer secboot/uc22 branch
autopkgtests: fix running autopkgtest on kinetic
tests: remove squashfs leftovers in fakeinstaller
tests: create partition table in fakeinstaller
o/ifacestate: introduce DebugAutoConnectCheck hook
tests: use test-snapd-swtpm instead of swtpm-mvo snap in nested
interfaces/polkit: do not require polkit directory if no file is
o/snapstate: be consistent not creating per-snap save dirs for
inhibit: use hintFile()
tests: use `snap prepare-image` in fde-on-classic mk-image.sh
interfaces: add microceph interface
seccomp: allow opening XDP sockets
interfaces: allow access to icon subdirectories
tests: add minimal-smoke test for UC22 and increase minimal RAM
o/devicestate: support mounting ubuntu-save also on classic with
interfaces: steam-support allow additional mounts
fakeinstaller: format SystemDetails result with %+v
cmd/libsnap-confine-private: do not panic on chmod failure
tests: ensure that fakeinstaller put the seed into the right place
many: add stub services for prompting
tests: add libfwupd and libfwupdplugin5 to openSUSE dependencies
o/snapstate: fix snaps-hold pruning/reset in the presence of
many: add support for setting up encryption from installer
many: support classic snaps in the context of classic and extended
cmd/snap,daemon: allow zero values from client to daemon for
boot,o/devicestate: extend HasFDESetupHook to consider unrelated
cmd/snap: validation set refresh-enforce CLI support + spread test
many: fix filenames written in modeenv for base/gadget plus drive-
seed: fix seed test to use a pseudo-random byte sequence
cmd/snap-confine: remove setuid calls from cgroup init code
boot,o/devicestate: introduce and use MakeRunnableStandaloneSystem
devicestate,boot,tests: make `fakeinstaller` test work
store: send Snap-Device-Location header with cloud information
overlord: fix unit tests after merging master in
o/auth: move HasUserExpired into UserState and name it HasExpired,
o/auth: rename NewUserData to NewUserParams
many: implementation of finish install step handlers
overlord: auto-resolve validation set enforcement constraints
i/backends,o/ifacestate: cleanup backends.All
cmd/snap-confine: move bind-mount setup into separate function
tests/main/mount-ns: update namespace for 18.04
o/state: Hold pseudo-error for explicit holding, concept of
many: support extended classic models that omit kernel/gadget
data/selinux: allow snapd to detect WSL
overlord: add code to remove users that has an expiration date set
wrappers,snap/quota: clear LogsDirectory= in the service unit for
daemon: move user add, remove operations to overlord device state
gadget: implement write content from gadget information
{device,snap}state: fix ineffectual assignments
daemon: support validation set refresh+enforce in API
many: reset store session when setting proxy.store
overlord/ifacestate: fix conflict detection of auto-connection
interfaces: added read/write access to /proc/self/coredump_filter
control
interfaces: add read access to /proc/cgroups and
observe
fde: run fde-reveal-key with `DefaultDependencies=no`
many: don't concatenate non-constant format strings
o/devicestate: fix non-compiling test
release, snapd-apparmor: fixed outdated WSL detection
many: add todos discussed in the review in
on-classic, snapstate cleanups
overlord: run install-device hook during factory reset
i/b/mount-control: add optional `/` to umount rules
gadget/install: split Run in several functions
o/devicestate: refactor some methods as preparation for install
tests: fix how snaps are cached in uc22
tests/main/cgroup-tracking-failure: fix rare failure in Xenial and
many: make {Install,Initramfs}{{,Host},Writable}Dir a function
tests/nested/manual/core20: fix manual test after changes to
tests: move the unit tests system to 22.04 in github actions
tests: fix nested errors uc20
boot: rewrite switch in SnapTypeParticipatesInBoot()
gadget: refactor to allow usage from the installer
overlord/devicestate: support for mounting ubuntu-save before the
device hook
many: allow to install/update kernels/gadgets on classic with
tests: fix issues related to dbus session and localtime in uc18
many: support home dirs located deeper under /home
many: refactor tests to use explicit strings instead of
boot: add factory-reset cases for boot-flags
tests: disable quota tests on arm devices using ubuntu core
tests: fix unbound SPREAD_PATH variable on nested debug session
overlord: start turning restart into a full state manager
boot: apply boot logic also for classic with modes boot snaps
tests: fix snap-env test on debug section when no var files were
overlord,daemon: allow returning errors when requesting a restart
interfaces: login-session-control: add further D-Bus interfaces
snapdenv: added wsl to userAgent
o/snapstate: support running multiple ops transactionally
store: use typed valset keys in store package
daemon: add `ensureStateSoon()` when calling systems POST api
gadget: add rules for validating classic with modes gadget.yaml
wrappers: journal namespaces did not honor journal.persistent
many: stub devicestate.Install{Finish,SetupStorageEncryption}()
sandbox/cgroup: don't check V1 cgroup if V2 is active
seed: add support to load auto import assertion
tests: fix preseed tests for arm systems
include/lk: update LK recovery environment definition to include
daemon: return `storage-encryption` in /systems/<label> reply
tests: start using remote tools from snapd-testing-tools project
tests: fix non mountable filesystem error in interfaces-udisks2
client: clarify what InstallStep{SetupStorageEncryption,Finish} do
client: prepare InstallSystemOptions for real use
usersession: Remove duplicated struct
o/snapstate: support specific revisions in UpdateMany/InstallMany
i/b/system_packages_doc: restore access to Libreoffice
snap/quota,wrappers: allow using 0 values for the journal rate
tests: add kinetic images to the gce bucket for preseed test
multiple: clear up naming convention for thread quota
daemon: implement stub `"action": "install"`
tests/main/snap-quota-{install/journal}: fix unstable spread tests
tests: remove code for old systems not supported anymore
tests: third part of the nested helper cleanup
image: clean snapd mount after preseeding
tests: use the new ubuntu kinetic image
i/b/system_observe: honour root dir when checking for
tests: restore microk8s test on 16.04
tests: run spread tests on arm64 instances in google cloud
tests: skip interfaces-udisks2 in fedora
asserts,boot,secboot: switch to a secboot version measuring
client: add API for GET /systems/<label>
overlord: frontend for --quota-group support (2/2)
daemon: add GET support for `/systems/<seed-label>`
i/b/system-observe: allow reading processes security label
many: support '--purge' when removing multiple snaps
snap-confine: remove obsolete code
interfaces: rework logic of unclashMountEntries
data/systemd/Makefile: add comment warning about "snapd." prefix
interfaces: grant access to speech-dispatcher socket (bug 1787245)
overlord/servicestate: disallow removal of quota group with any
data: include snapd/mounts in preseeded blob
many: Set SNAPD_APPARMOR_REEXEC=1
store/tooling,tests: support UBUNTU_STORE_URL override env var
multiple: clear up naming convention for cpu-set quota
tests: improve and standardize debug section on tests
device: add new DeviceManager.encryptionSupportInfo()
tests: check snap download with snapcraft v7+ export-login auth
cmd/snap-bootstrap: changes to be able to boot classic rootfs
tests: fix debug section for test uc20-create-partitions
overlord: --quota-group support (1/2)
asserts,cmd/snap-repair: drop not pursued
id
interfaces: make polkit implicit on core if /usr/libexec/polkitd
multiple: move arguments for auth.NewUser into a struct (auto-
overlord: track security profiles for non-active snaps
tests: remove NESTED_IMAGE_ID from nested manual tests
tests: add extra space to ubuntu bionic
store/tooling: support using snapcraft v7+ base64-encoded auth
overlord: allow seeding in the case of classic with modes system
tests: rework snap-logs-journal test and add missing cleanup
tests: add spread test for journal quotas
tests: run spread tests in ubuntu kinetic
o/snapstate: extend support for holding refreshes
devicestate: return an error in checkEncryption() if KernelInfo
tests: fix sbuild test on debian sid
o/devicestate: do not run tests in this folder twice
sandbox/apparmor: remove duplicate hook into testing package
many: refactor store code to be able to use simpler form of auth
snap,store: drop support/consideration for anonymous download urls
data/selinux: allow snaps to read certificates
many: add Is{Core,Classic}Boot() to DeviceContext
o/assertstate: don't refresh enforced validation sets during check
go.mod: replace maze.io/x/crypto with local repo
many: fix unnecessary use of fmt.Sprintf
bootloader,systemd: fix `don't use Yoda conditions (ST1017)`
HACKING.md: extend guidelines with common review comments
many: progress bars should use the overridable stdouts
tests: remove ubuntu 21.10 from sru validation
tests: import remote tools
daemon,usersession: switch from HeaderMap to Header in tests
asserts: add some missing `c.Check()` in the asserts test
strutil: fix VersionCompare() to allow multiple `-` in the version
testutil: remove unneeded `fmt.Sprintf`
boot: remove some unneeded `fmt.Sprintf()` calls
tests: implement prepare_gadget and prepare_base and unify all the
o/snapstate: refactor managed refresh schedule logic
o/assertstate, snapasserts: implementation of
interfaces: add kconfig paths to system-observe
dbusutil: move debian patch into dbustest
many: change name and input of CheckProvenance to clarify usage
tests: Fix a missing parameter in command to wait for device
tests: Work-around non-functional --wait on systemctl
tests: unify the way the snapd/core and kernel are repacked in
tests: skip interfaces-ufisks2 on centos-9
i/b/mount-control: allow custom filesystem types
interfaces,metautil: make error handling in getPaths() more
cmd/snap-update-ns: handle mountpoint removal failures with EBUSY
tests: fix pc-kernel repacking
systemd: add `WantedBy=default.target` to snap mount units
tests: disable microk8s test on 16.04

Release 2.57.6 to Fedora

New upstream release 2.57.6
SECURITY UPDATE: Local privilege escalation
snap-confine: Fix race condition in snap-confine when preparing a
CVE-2022-3328

New upstream release 2.57.5
image: clean snapd mount after preseeding
wrappers,snap/quota: clear LogsDirectory= in the service unit
cmd/snap,daemon: allow zero values from client to daemon for
limit
interfaces: steam-support allow pivot /run/media and /etc/nvidia
o/ifacestate: introduce DebugAutoConnectCheck hook
release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
autopkgtests: fix running autopkgtest on kinetic
interfaces: add microceph interface
interfaces: steam-support allow additional mounts
many: add stub services
interfaces: add kconfig paths to system-observe
i/b/system_observe: honour root dir when checking for
interfaces: grant access to speech-dispatcher socket
interfaces: rework logic of unclashMountEntries

New upstream release 2.57.4
release, snapd-apparmor: fixed outdated WSL detection
overlord/ifacestate: fix conflict detection of auto-connection
overlord: run install-device hook during factory reset
image/preseed/preseed_linux: add missing new line
boot: add factory-reset cases for boot-flags.
interfaces: added read/write access to /proc/self/coredump_filter
control
interfaces: add read access to /proc/cgroups and
observe
fde: run fde-reveal-key with `DefaultDependencies=no`
snapdenv: added wsl to userAgent
tests: fix restore section for persistent-journal-namespace
i/b/mount-control: add optional `/` to umount rules
cmd/snap-bootstrap: changes to be able to boot classic rootfs
cmd/snap-bootstrap: add CVM mode

New upstream release 2.57.3
wrappers: journal namespaces did not honor journal.persistent
snap/quota,wrappers: allow using 0 values for the journal rate to
multiple: clear up naming convention for cpu-set quota
i/b/mount-control: allow custom filesystem types
i/b/system-observe: allow reading processes security label
sandbox/cgroup: don't check V1 cgroup if V2 is active
asserts,boot,secboot: switch to a secboot version measuring

New upstream release 2.57.2
store/tooling,tests: support UBUNTU_STORE_URL override env var
tests: check snap download with snapcraft v7+ export-login auth
store/tooling: support using snapcraft v7+ base64-encoded auth
many: progress bars should use the overridable stdouts
many: refactor store code to be able to use simpler form of auth
snap,store: drop support/consideration for anonymous download urls
data: include snapd/mounts in preseeded blob
many: Set SNAPD_APPARMOR_REEXEC=1
overlord: track security profiles for non-active snaps

New upstream release 2.57.1
cmd/snap-update-ns: handle mountpoint removal failures with EBUSY
cmd/snap-update-ns: print current mount entries
cmd/snap-update-ns: check the unused mounts with a cleaned path
snap-confine: disable -Werror=array-bounds in __overflow tests to
systemd: add `WantedBy=default.target` to snap mount units

New upstream release 2.57
tests: Fix calls to systemctl is-system-running
osutil/disks: handle GPT for 4k disk and too small tables
packaging: import change from the 2.54.3-1.1 upload
many: revert "features: disable refresh-app-awarness by default
tests: improve robustness of preparation for regression/lp-1803542
tests: get the ubuntu-image binary built with test keys
tests: remove commented code from lxd test
interfaces/builtin: add more permissions for steam-support
tests: skip interfaces-network-control on i386
tests: tweak the "tests/nested/manual/connections" test
interfaces: posix-mq: allow specifying message queue paths as an
bootloader/assets: add ttyS0,115200n8 to grub.cfg
i/b/desktop,unity7: remove name= specification on D-Bus signals
tests: ensure that microk8s does not produce DENIED messages
many: support non-default provenance snap-revisions in
tests: fix `core20-new-snapd-does-not-break-old-initrd` test
many: device and provenance revision authority cross checks
tests: fix nested save-data test on 22.04
sandbox/cgroup: ignore container slices when tracking snaps
tests: improve 'ignore-running' spread test
tests: add `debug:` section to `tests/nested/manual/connections`
tests: remove leaking `pc-kernel.snap` in `repack_kernel_snap`
many: preparations for revision authority cross checks including
daemon,overlord/servicestate: followup changes from PR #11960 to
cmd/snap: fix visual representation of 'AxB%' cpu quota modifier.
many: expose and support provenance from snap.yaml metadata
overlord,snap: add support for per-snap storage on ubuntu-save
nested: fix core-early-config nested test
tests: revert lxd change to support nested lxd launch
tests: add invariant check for leftover cgroup scopes
daemon,systemd: introduce support for namespaces in 'snap logs'
cmd/snap: do not track apps that wish to stay outside of the life-
asserts: allow classic + snaps models and add distribution to
cmd/snap: add snap debug connections/connection commands
data: start snapd after time-set.target
tests: remove ubuntu 21.10 from spread tests due to end of life
tests: Update the whitebox word to avoid inclusive naming issues
many: mount gadget in run folder
interfaces/hardware-observe: clean up reading access to sysfs
tests: use overlayfs for interfaces-opengl-nvidia test
tests: update fake-netplan-apply test for 22.04
tests: add executions for ubuntu 22.04
tests: enable centos-9
tests: make more robust the files check in preseed-core20 test
bootloader/assets: add fallback entry to grub.cfg
interfaces/apparmor: add permissions for per-snap directory on
save partition
devicestate: add more path to `fixupWritableDefaultDirs()`
boot,secboot: reset DA lockout counter after successful boot
many: Revert "overlord,snap: add support for per-snap storage on
save"
overlord,snap: add support for per-snap storage on ubuntu-save
tests: exclude centos-7 from kernel-module-load test
dirs: remove unused SnapAppArmorAdditionalDir
boot,device: extract SealedKey helpers from boot to device
boot,gadget: add new `device.TpmLockoutAuthUnder()` and use it
interfaces/display-control: allow changing brightness value
asserts: add more context to key expiry error
many: introduce IsUndo flag in LinkContext
i/apparmor: allow calling which.debianutils
tests: new profile id for apparmor in test preseed-core20
tests: detect 403 in apt-hooks and skip test in this case
overlord/servicestate: restart the relevant journald service when
client,cmd/snap: add journal quota frontend (5/n)
gadget/device: introduce package which provides helpers for
features: disable refresh-app-awarness by default again
many: install bash completion files in writable directory
image: fix handling of var/lib/extrausers when preseeding
tests: force version 2.48.3 on xenial ESM
tests: fix snap-network-erros on uc16
cmd/snap-confine: be compatible with a snap rootfs built as a
o/snapstate: allow install of unasserted gadget/kernel on
interfaces: dynamic loading of kernel modules
many: add optional primary key provenance to snap-revision, allow
declaration revision-authority
tests: fix boringcripto errors in centos7
tests: fix snap-validate-enforce in opensuse-tumbleweed
test: print User-Agent on failed checks
interfaces: add memory stats to system_observe
interfaces/pwm: Remove implicitOnCore/implicitOnClassic
spread: add openSUSE Leap 15.4
tests: disable core20-to-core22 nested test
tests: fix nested/manual/connections test
tests: add spread test for migrate-home command
overlord/servicestate: refresh security profiles when services are
interfaces/apparmor: add missing apparmor rules for journal
tests: add nested test variant that adds 4k sector size
cmd/snap: fix test failing due to timezone differences
build-aux/snap: build against the snappy-dev/image PPA
daemon: implement api handler for refresh with enforced validation
preseed: suggest to install "qemu-user-static"
many: add migrate-home debug command
o/snapstate: support passing validation sets to storehelpers via
cmd/snapd-apparmor: fix unit tests on distros which do not support
o/devicestate: post factory reset ensure, spread test update
tests/core/basic20: Enable on uc22
packaging/arch: install snapd-apparmor
o/snapstate: support migrating snap home as change
tests: enable snapd.apparmor service in all the opensuse systems
snapd-apparmor: add more integration-ish tests
asserts: store required revisions for missing snaps in
overlord/ifacestate: fix path for journal redirect
o/devicestate: factory reset with encryption
cmd/snapd-apparmor: reimplement snapd-apparmor in Go
squashfs: improve error reporting when `unsquashfs` fails
o/assertstate: support multiple extra validation sets in
tests: enable mount-order-regression test for arm devices
tests: fix interfaces network control
interfaces: update AppArmor template to allow read the memory …
cmd/snap-update-ns: add /run/systemd to unrestricted paths
wrappers: fix LogNamespace being written to the wrong file
boot: release the new PCR handles when sealing for factory reset
tests: add support fof uc22 in test uboot-unpacked-assets
boot: post factory reset cleanup
tests: add support for uc22 in listing test
spread.yaml: add ubuntu-22.04-06 to qemu-nested
gadget: check also mbr type when testing for implicit data
interfaces/system-packages-doc: allow read-only access to
root/ and /usr/share/gimp/2.0/help/
tests/nested/manual/core20-early-config: revert changes that
o/ifacestate: warn if the snapd.apparmor service is disabled
tests: add spread execution for fedora 36
overlord/hookstate/ctlcmd: fix timestamp coming out of sync in
gadget/install: do not assume dm device has same block size as
interfaces: update network-control interface with permissions
secboot: stage and transition encryption keys
secboot, boot: support and use alternative PCR handles during
overlord/ifacestate: add journal bind-mount snap layout when snap
secboot/keymgr, cmd/snap-fde-keymgr: two step encryption key
cmd/snap: cleanup and make the code a bit easier to read/maintain
overlord/hookstate/ctlcmd: add 'snapctl model' command (3/3)
cmd/snap-repair: fix snap-repair tests silently failing
spread: drop openSUSE Leap 15.2
interfaces/builtin: remove the name=org.freedesktop.DBus
control AppArmor rules
wrappers: write journald config files for quota groups with
o/assertstate: auto aliases for apps that exist
o/state: use more detailed NoStateError in state
tests/main/interfaces-browser-support: verify jupyter notebooks
o/snapstate: exclude services from refresh app awareness hard
tests/main/nfs-support: be robust against umount failures
tests: update centos images and add new centos 9 image
many: print valid/invalid status on snap validate --monitor
secboot, boot: TPM provisioning mode enum, introduce
tests: allow to re-execute aborted tests
cmd/snapd-apparmor: add explicit WSL detection to
tests: avoid launching lxd inside lxd on cloud images
interfaces: extra htop apparmor rules
gadget/install: encrypted system factory reset support
secboot: helpers for dealing with PCR handles and TPM resources
systemd: improve error handling for systemd-sysctl command
boot, secboot: separate the TPM provisioning and key sealing
o/snapstate: fix validation sets restoring and snap revert on
interfaces/builtin/system-observe: extend access for htop
cmd/snap: support custom apparmor features dir with snap prepare-
interfaces/mount-observe: Allow read access to /run/mount/utab
cmd/snap: add help strings for set-quota options
interfaces/builtin: add README file
cmd/snap-confine: mount support cleanups
overlord: execute snapshot cleanup in task
i/b/accounts_service: fix path of introspectable objects
interfaces/opengl: update allowed PCI accesses for RPi
configcore: add core.system.ctrl-alt-del-action config option
many: structured startup timings
spread: switch back to building ubuntu-image from source
many: optional recovery keys
tests/lib/nested: fix unbound variable
run-checks: fail on equality checks w/ ErrNoState
snap-bootstrap: Mount as private
tests: Test for gadget connections
tests: set `br54.dhcp4=false` in the netplan-cfg test
tests: core20 preseed/nested spread test
systemd: remove the systemctl stop timeout handling
interfaces/shared-memory: Update AppArmor permissions for
many: replace ErrNoState equality checks w/ errors.Is()
cmd/snap: exit w/ non-zero code on missing snap
systemd: fix snapd systemd-unit stop progress notifications
.github: Trigger daily riscv64 snapd edge builds
interfaces/serial-port: add ttyGS to serial port allow list
interfaces/modem-manager: Don't generate DBus plug policy
tests: add spread test to test upgrade from release snapd to
wrappers: refactor EnsureSnapServices
testutil: add ErrorIs test checker
tests: import spread shellcheck changes
cmd/snap-fde-keymgr: best effort idempotency of add-recovery-key
interfaces/udev: refactor handling of udevadm triggers for input
secboot: support for changing encryption keys via keymgr

Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild