en.osm.town is one of the many independent Mastodon servers you can use to participate in the fediverse.
An independent, community of OpenStreetMap people on the Fediverse/Mastodon. Funding graciously provided by the OpenStreetMap Foundation.

Server stats:

251
active users

#snapcraft

0 posts0 participants0 posts today

I was working on a snap package for a small C test program and I ended up re-discovering how to cross compile in #snapcraft

The key thing to understand is that snapcraft allows it but doesn't hand-hold you through the process or make everything work by magic. It's better to say that Debian's cross-compile tools make cross compilation of snap packages that rely on C easy. Cross compilation of other languages depends on them. For example, for a Go program this would be equally easy.

Continued thread

Snapcraft was supposed to solve this problem of how to package up large and complex software into basically a Docker overlay image that installs directly onto your system, except that Snapcraft's Ruby support has been broken for a while and seems to only been designed for Ruby web apps that are installed via git or tar archive, and not Ruby CLIs that are already packaged as gems that are meant to be installed globally.
snapcraft.io/docs/ruby-plugin

SnapcraftThe ruby plugin | Snapcraft documentationSnaps are containerised software packages that are simple to create and install. They auto-update and are safe to run. And because they bundle their dependencies, they work on all major Linux systems without modification.

I found the #snap snapcraft.io/ghidra and the link to github to the snapcraft.yaml looks legit.
The snap is provided by an unverified developer. How can I verify that the snap binary hosted on #snapcraft is indeed the thing built from that snapcraft.yaml?
#Linux #security #ubuntu #canonical
Can developers just push any binary squashfs as a snap to snapcraft?

SnapcraftInstall ghidra on Linux | Snap StoreGet the latest version of ghidra for Linux - Software reverse engineering (SRE) tools developed by NSA in support of the Cyber Security mission (unofficial snap)

So I just discovered that proprietary media (H.264, AAC, etc.) was not working with the Snap version of @Vivaldi on Linux—I mean .snap packages, not Snapshots.

I found this out as I attempted to use the Snap version to play a video and it failed. I am on vacation at the moment and not really monitoring our forums or bug tracker right now. I addition I do not usually use the Snap at home personally, so this was just by chance. 😱

On investigating, it seems that on 2024-12-17T13:39:10.926512+00:00 (last Tuesday) the "chromium-ffmpeg" snap package that we use to provide support for proprietary media was updated by Canonical and version 115541 (which we were still using) was removed entirely.

Since I can update things myself and most of my colleagues are likely asleep I have now switched the Vivaldi 7.0 Snap to use "chromium-ffmpeg-118887" (which Canonical offer now) and released this live as of 2024-12-23T00:03:01.156148+00:00. That seems to have resolved it for me. If anyone is using the Snap version of Vivaldi, could you also confirm (after a Snap refresh and a restart of the browser) that it works for you also.

There is a test video (with sound) here for you to check against:

help.vivaldi.com/desktop/media

Vivaldi Browser Help · HTML5 Proprietary Media | Linux | Vivaldi Browser HelpHTML5 “proprietary” audio and video includes all media types that are patented, such H.264 (video) and AAC (audio). Find out how to install & test a suitable package on Linux.

@fosstastic

> Funnily enough #Snapcraft, the centralised competitor, doesn't use such a convoluted naming scheme and manages fine without it.

Why funnily? It can be like that exactly because it is centralized.

> Just because it has been inherited from AppStream doesn't make it good.

That's not the point. The point is: cross-distros/decentralized implies (reverse) DNS notation or equivalent. It is a well established thing in software distribution.

✅ Achievement unlocked - Got a minor credit in a CVE.

mcphail wrote:

"I recently found a bug in Snap, a package manager for Ubuntu and other Linux distributions, which allows the snap to escape the sandbox and run arbitrary code (as the user) if the home permission is set. This exploit could be run on a vanilla install of Ubuntu and was patched in commit aa191f9 on 13th March 2024."

gld.mcphail.uk/posts/explainin

cve.mitre.org/cgi-bin/cvename.

gld.mcphail.ukExplaining CVE-2024-1724 | Grey Lumpy DinosaurI found a vulnerability in Canonical’s Snap package manager which can be exploited to escape the sandbox and run arbitrary code as the user.

🎉 Exciting news! My program, Image Meta Cleaner, now has a snap package available! You can now easily install it from the Snapcraft store. Get ready to efficiently clean up those image meta data with just a few clicks! Check it out here:
snapcraft.io/image-meta-cleane 🚀 #ImageMetaCleaner
#snapcraft
#linux
#images
#code

SnapcraftInstall Image Meta Cleaner on Linux | Snap StoreGet the latest version of Image Meta Cleaner for Linux - A cross-platform image metadata removal tool

Wait, there's no built-in UI to install .deb files on Ubuntu? Really??? :neocat_shocked:

I know Canonical really wants to push their stupid walled garden with Snaps, but c'mon. That's just insane. :blobfoxlaughsweat: Snaps are the reason I'll generally not recommend Ubuntu anymore. It's too much to explain to a Linux newbie why Firefox boots slowly and Steam crashes.

GitHubSupport installing local deb packages · Issue #1407 · ubuntu/app-centerBy d-loose
#Ubuntu#Linux#Snaps