Exploits of the Snapcraft Ninja

Exploits of the
Snapcraft Ninja
Dani Llewellyn (diddledani) she/her

08/11/2022 Dani Llewellyn 2
My Background
●
Linux user since ~1997-8
●
Web, Desktop, and Server dev/admin experience
●
Windows, macOS, and Linux
●
Single System Image Beowulf-style clustering ~2001-5 (OpenMosix)
●
Ran Gentoo for a decade learning a LOT
●
Learned high-availability techniques via tools like CoroSync and Pacemaker
●
Have since forgotten it all 😛
●
Used Docker and containerisation since Docker first appeared
●
Primary contributions to Snaps/Snapcraft, WSL2, and Ubuntu Mate
●
Featured multiple times on the Ubuntu.com Blog
●
Ubuntu Member February 2018
●
Ubuntu Membership Board September 2018-present
●
Microsoft MVP primarily for WSL-related community work

Snap Packages
●
Avidly followed Ubuntu Touch efforts
●
Loved the advocacy streams by Alan Pope et al
●
Excited by the Click Packaging system
●
Backed the Ubuntu Edge campaign on Indiegogo
●
Snaps arose like a phoenix from the ashes of UT
●
Just as exciting as Click Packages, and for more than just
phones
●
Cue my jumping in to start experimenting...

First steps with Snap Packaging
●
Started out simple with a package for HexChat IRC Client
●
Handed-off to upstream developers
●
Began learning how desktop stack fits together
●
Spread my wings further to look at other desktop apps
●
My understanding of the desktop stack continually improving…
●
Packaged several games, including
●
OpenRA (Open-source Command & Conquer engine reimplementation)
●
OpenTTD (Open-source Transport Tycoon Deluxe engine reimplementation)
●
SuperTuxKart (Similar to Super Mario Kart)
●
Micropolis (Open-source release of Sim City by the copyright holder for the One Laptop per Child
project)
●
And others...

Fully committed?

Yup, fully committed!
●
After cutting my teeth on more simple desktop apps I wanted more of a
challenge
●
So I bit off a huge chunk with the GNU Image Manipulation Program
●
This app is a monster package!
●
Many dependencies that need to mesh just right
●
At the time, and for the stable branch still, GTK2-based
●
GTK2 was already legacy and no examples existed within the Snap community
●
Yup, I learnt a LOT more about the desktop stack here, too
●
Still principle maintainer via the Snapcrafters project

How many Snaps?
●
Lots! 125 repositories related to Snapcrafting – not all of these are
package but more are.

Snapstats
●
I’ve been running snapstats.org for some time now
cataloguing the Snap Store
●
Unfortunately the scraping is now unpredictable – The Store
is returning inconsistent numbers on repeated runs
●
The site was an attempt at maintaining a third-party list of
available Snap Packages in the Store along with some basic
statistics like number of packages over time and which how
many packages per architecture over time

Screenshots – The graphs went wonky in
February 2022 🤦‍♀️

Snapcraft Summits
●
My GNU Image Manipulation Program snap, along with my other snaps and wider activities
in the ecosystem, brought attention from the Snap Advocacy team (Alan Pope and Martin
Wimpress)
●
They invited me to the Snapcraft Summit in Seattle in February 2018
●
The summits are organised hackathons where Canonical engineers work with developers from other
organisations and open source projects to get their respective apps working inside Snap Packages
●
Previous wins include the launch of Spotify as a Snap Package during a summit
●
I mentioned I was working on a package for PowerShell Core so they organised for Travis Plunk
from Microsoft to join us where we worked in partnership to bring a first-party snap of PowerShell
Core to the store
●
I contributed fixes to PowerShell Core to ensure that features of PowerShell that assumed non-
immutable filesystem were functional
●
One such example being the telemetry opt-out mechanism that relied on a file being created alongside the
pwsh executable, which isn’t possible in a Snap Package due to the immutable filesystem

So I’m a trusted expert now?
●
Canonical employees regularly request my
expertise
●
Several blog posts featuring my insights on
Ubuntu.com
●
Star Developer on the Snap Store
●
Core member of the Snapcrafters project
●
Well known and trusted within the
community

What else have I contributed?

Background: About Snapcraft Extensions
●
In the past there were “cloud parts”
●
Magic “parts” that you could declare your dependence upon
●
When depending on a “cloud part” in your snapcraft.yaml the cloud would be pulled
and built first
●
Authorable by anybody
●
Not scalable due to implementation
●
Now there are Snapcraft Extensions
●
Similar to cloud parts in that they are natively supported by Snapcraft
●
Shipped as part of Snapcraft so requires a PR and approval and may be rejected
●
Scalability not really proven yet
●
So far only desktop-related and flutter extensions exist

Why I want to replace Snapcraft Extensions
●
Snapcraft Extensions “just work”, so why invent something
new?
●
They ship within Snapcraft itself
●
Lead time till available is too long
●
PR approval is arbitrary and may not be granted
●
Must sign the Canonical Contributor License Agreement

My idea and implementation
●
At their heart, Snapcraft Extensions merely augment the snapcraft.yaml before
using it to build your Snap Package
●
Let’s do the augmentation instead of Snapcraft
●
Enter sc-jsonnet: https://snapcraft.io/sc-jsonnet
●
Write your snapcraft.yaml in jsonnet instead of YAML
●
Use sc-jsonnet’s import capability to import remote jsonnet libraries
●
When you have a snapcraft.jsonnet file, generate the snapcraft.yaml before building
with Snapcraft:
$ sc-jsonnet -o snap/snapcraft.yaml
$ snapcraft

Example snapcraft.jsonnet
local snapcraft = import 'snapcraft.libsonnet';
snapcraft {
name: "my-jsonnet-snap-name",
version: "0.1",
summary: "Single-line elevator pitch for your amazing snap",
description: "This is my-snap's description. You have a paragraph or two to tell the most important story about your
snap. Keep it under 100 words though, we live in tweetspace and your description wants to look good in the snap store.",
grade: "devel",
confinement: "devmode",
parts: {
"my-part": {
plugin: "nil",
},
},
}

Adding a third-party extension to
snapcraft.jsonnet
# import my ALSA extension
local alsa = import 'https://raw.githubusercontent.com/diddlesnaps/snapcraft-alsa/master/alsa.libsonnet';
snapcraft {
# removed for brevity – it’s identical to the example
# on the previous slide
} + alsa() # this is all you need to add beyond the import above

Even better, extensions can take arguments
# import my ALSA extension
local alsa = import 'https://raw.githubusercontent.com/diddlesnaps/snapcraft-alsa/master/alsa.libsonnet';
snapcraft {
# removed for brevity – it’s identical to the example
# on the previous slide
} + alsa("1.1.9")
# this builds ALSA version 1.1.9 from source instead of using the version
# from the Ubuntu package archive (via APT)

Documentation and available extensions
●
Documentation for sc-jsonnet is available at
https://sc-jsonnet.readthedocs.io/en/latest/
●
I’ve written two libraries of extensions:
●
Snapcraft ALSA – A single extension to pipe ALSA output through
PulseAudio for more a less privileged Snap Package:
https://snapcraft-alsa.readthedocs.io/en/latest/
●
Snapcraft Utils Library – several extensions that perform common
tasks usually handled via Copy+Paste:
https://snapcraft-utils-library.readthedocs.io/en/latest/

Any more?

Snapcraft CI/CD pipelines
●
Don’t want to use the Snapcraft Build Service on snapcraft.io?
●
I’ve developed a build pipeline for both GitHub Actions and
GitLab CI
●
Uses my own OCI container image that can be used in any CI
system that allowed privileged mode execution of containers
●
i.e. launched via Docker CLI’s --privileged flag
●
See my other talk “Automated Snap Package build processes
without the Build Service” for full details

Wrapping up… but first...

Snapcraft skills for sale
●
I provide contracting services to anyone creating
Snap Packages of their apps
●
Multiple organisations have now benefited from my
expertise
●
Contact me via https://snapcraft.ninja/ to introduce
your project

Acknowledgements
●
Martin Wimpress (@m_wimpress), Alan Pope (@popey), both alumni, and Igor (of the
Snap Advocacy team)
●
For recognising my capability and enthusiasm for the Snap Packaging world
●
For inviting me to Snapcraft Summits to share my knowledge and expertise
●
For encouraging me to get deeper into the Ubuntu Community, such as applying for Ubuntu Membership
●
Ubuntu Desktop Team, Snapcraft Team, and Snapd Team all at Canonical
●
For being receptive to my contributions and constantly encouraging my continued involvement
●
Sarah Dickinson (@dickinsonsarah7) formally head of Canonical PR
●
For featuring my thoughts about Snaps and other Canonical projects in multiple blog posts on Ubuntu.com
●
Heather Ellsworth (Ubuntu Desktop team; @linux_flower) and Monica Madon (former Ubuntu
Community Respresentative; @communiteatime)
●
For being excellent friends and providing constant encouragement and moral support, especially while I'm
trying to find work that is suitable for my talents

Where to find me
●
https://snapcraft.ninja/
●
Ubuntu Discourse (diddledani)
●
Snapcraft Forum (diddledani)
●
https://github.com/diddlesnaps
●
https://github.com/diddledani
●
https://github.com/UbuntuAccomplishments
●
Twitter (@diddledani)
●
Mastodon (@diddledani@mastodon.lol)
●
Also: I’m currently looking for (more permanent) work 😉

Exploits of the Snapcraft Ninja

More Related Content

Similar to Exploits of the Snapcraft Ninja (20)

Recently uploaded (20)

Exploits of the Snapcraft Ninja