Merge lp:~mvo/snappy/snappy-lp1460152-workaround-15.04 into lp:~snappy-dev/snappy/snappy-moved-to-github

[Michael Vogt]

This is a cherry pick of the workaround for lp #1460152 for the 15.04
branch.

Unmerged revisions

451. By Michael Vogt on 2015-06-04

cherry pick r486 from lp:~mvo/snappy/snappy-lp1460152-workaround

450. By Sergio Schvezov on 2015-06-04

Don't allow installation of packages with unsupported architectures (backported from trunk with bzr merge -c 484 from trunk) by sergiusens approved by chipaca

449. By Michael Terry on 2015-06-04

Allow ".." in file paths as long as it isn't an entire element. (i.e. allow "hello..you" or "...")

We call filepath.Clean right before our ".." check. So the only instances of ".." will be in the first element. That lets us simplify the check a lot.

This is a backport of r457 from trunk. by mterry approved by chipaca

448. By Michael Terry on 2015-06-04

Fix intermittent "permission denied" errors when installing snaps by making sure that we always unpack in the same OS thread that dropped its privileges.

This is a backport of r481 from trunk. by mterry approved by chipaca

447. By Michael Terry on 2015-06-04

Unify handling of app environment variables. Now hooks, binaries, and services all have the same variables (mostly).

This is a backport of r483 from trunk. by mterry approved by chipaca

446. By Sergio Schvezov on 2015-06-03

Backport revno 470 from trunk: Avoid writing to snappy-system.txt if not required by sergiusens approved by mvo

445. By Michael Vogt on 2015-06-03

Improve error reporting for failed hooks. by mvo approved by chipaca

444. By Michael Vogt on 2015-06-03

Only update changed files in SyncBootloader(). by mvo approved by chipaca

443. By David Callé on 2015-05-29

Sync markdown of docs/meta.md with trunk by davidc3 approved by mvo

=== modified file 'clickdeb/deb.go'
=== modified file 'clickdeb/deb_test.go'
=== modified file 'cmd/snappy/cmd_build.go'
=== modified file 'cmd/snappy/cmd_internal_unpack.go'
=== modified file 'helpers/helpers.go'
--- helpers/helpers.go	2015-06-04 12:55:54 +0000
+++ helpers/helpers.go	2015-06-04 20:51:08 +0000
@@ -26,6 +26,7 @@
 	"encoding/hex"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"math/rand"
 	"os"
 	"os/exec"
@@ -197,14 +198,37 @@
 	}
 }
 
-// IsSupportedArchitecture returns true if the system architecture is in the
-// list of architectures.
-func IsSupportedArchitecture(architectures []string) bool {
-	systemArch := UbuntuArchitecture()
-
-	for _, arch := range architectures {
-		if arch == "all" || arch == systemArch {
-			return true
+<<<<<<< TREE
+// IsSupportedArchitecture returns true if the system architecture is in the
+// list of architectures.
+func IsSupportedArchitecture(architectures []string) bool {
+	systemArch := UbuntuArchitecture()
+
+	for _, arch := range architectures {
+		if arch == "all" || arch == systemArch {
+			return true
+=======
+// IsSupportedArchitecture returns true if the system architecture is in the
+// list of architectures.
+func IsSupportedArchitecture(architectures []string) bool {
+	systemArch := UbuntuArchitecture()
+
+	for _, arch := range architectures {
+		if arch == "all" || arch == systemArch {
+			return true
+		}
+	}
+
+	return false
+}
+
+// EnsureDir ensures that the given directory exists and if
+// not creates it with the given permissions.
+func EnsureDir(dir string, perm os.FileMode) (err error) {
+	if _, err := os.Stat(dir); os.IsNotExist(err) {
+		if err := os.MkdirAll(dir, perm); err != nil {
+			return err
+>>>>>>> MERGE-SOURCE
 		}
 	}
 
@@ -345,6 +369,7 @@
 	return syscall.Getuid() == 0 || syscall.Getgid() == 0
 
 }
+<<<<<<< TREE
 
 // MajorMinor returns the major/minor number of the given os.FileInfo
 func MajorMinor(info os.FileInfo) (uint32, uint32, error) {
@@ -436,3 +461,156 @@
 		"SNAPP_APP_USER_DATA_PATH={{.Home}}{{.AppPath}}",
 	})
 }
+=======
+
+func makeDirMap(dirName string) (map[string]struct{}, error) {
+	dir, err := ioutil.ReadDir(dirName)
+	if err != nil {
+		return nil, err
+	}
+
+	dirMap := make(map[string]struct{})
+	for _, dent := range dir {
+		if dent.IsDir() {
+			return nil, fmt.Errorf("subdirs are not supported")
+		}
+		dirMap[dent.Name()] = struct{}{}
+	}
+
+	return dirMap, nil
+}
+
+// RSyncWithDelete syncs srcDir to destDir
+func RSyncWithDelete(srcDirName, destDirName string) error {
+
+	// first remove everything thats not in srcdir
+	err := filepath.Walk(destDirName, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		// relative to the root "destDirName"
+		relPath := path[len(destDirName):]
+		if !FileExists(filepath.Join(srcDirName, relPath)) {
+			if err := os.RemoveAll(path); err != nil {
+				return err
+			}
+			if info.IsDir() {
+				return filepath.SkipDir
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+
+	// then copy or update the data from srcdir to destdir
+	err = filepath.Walk(srcDirName, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		// relative to the root "srcDirName"
+		relPath := path[len(srcDirName):]
+		if info.IsDir() {
+			return os.MkdirAll(filepath.Join(destDirName, relPath), info.Mode())
+		}
+		src := path
+		dst := filepath.Join(destDirName, relPath)
+		if !FilesAreEqual(src, dst) {
+			// XXX: on snappy-trunk we can use CopyFile here
+			output, err := exec.Command("cp", "-va", src, dst).CombinedOutput()
+			if err != nil {
+				fmt.Errorf("Failed to copy %s to %s (%s)", src, dst, output)
+			}
+		}
+		return nil
+	})
+
+	return err
+}
+
+func fillSnapEnvVars(desc interface{}, vars []string) []string {
+	for i, v := range vars {
+		var templateOut bytes.Buffer
+		t := template.Must(template.New("wrapper").Parse(v))
+		if err := t.Execute(&templateOut, desc); err != nil {
+			// this can never happen, except we forget a variable
+			logger.LogAndPanic(err)
+		}
+		vars[i] = templateOut.String()
+	}
+	return vars
+}
+
+// GetBasicSnapEnvVars returns the app-level environment variables for a snap.
+// Despite this being a bit snap-specific, this is in helpers.go because it's
+// used by so many other modules, we run into circular dependencies if it's
+// somewhere more reasonable like the snappy module.
+func GetBasicSnapEnvVars(desc interface{}) []string {
+	return fillSnapEnvVars(desc, []string{
+		"TMPDIR=/tmp/snaps/{{.UdevAppName}}/{{.Version}}/tmp",
+		"TEMPDIR=/tmp/snaps/{{.UdevAppName}}/{{.Version}}/tmp",
+		"SNAP_APP_PATH={{.AppPath}}",
+		"SNAP_APP_DATA_PATH=/var/lib{{.AppPath}}",
+		"SNAP_APP_TMPDIR=/tmp/snaps/{{.UdevAppName}}/{{.Version}}/tmp",
+		"SNAP_NAME={{.AppName}}",
+		"SNAP_VERSION={{.Version}}",
+		"SNAP_ORIGIN={{.Namespace}}",
+		"SNAP_FULLNAME={{.UdevAppName}}",
+		"SNAP_ARCH={{.AppArch}}",
+	})
+}
+
+// GetUserSnapEnvVars returns the user-level environment variables for a snap.
+// Despite this being a bit snap-specific, this is in helpers.go because it's
+// used by so many other modules, we run into circular dependencies if it's
+// somewhere more reasonable like the snappy module.
+func GetUserSnapEnvVars(desc interface{}) []string {
+	return fillSnapEnvVars(desc, []string{
+		"SNAP_APP_USER_DATA_PATH={{.Home}}{{.AppPath}}",
+	})
+}
+
+// GetDeprecatedBasicSnapEnvVars returns the app-level deprecated environment
+// variables for a snap.
+// Despite this being a bit snap-specific, this is in helpers.go because it's
+// used by so many other modules, we run into circular dependencies if it's
+// somewhere more reasonable like the snappy module.
+func GetDeprecatedBasicSnapEnvVars(desc interface{}) []string {
+	return fillSnapEnvVars(desc, []string{
+		"SNAPP_APP_PATH={{.AppPath}}",
+		"SNAPP_APP_DATA_PATH=/var/lib{{.AppPath}}",
+		"SNAPP_APP_TMPDIR=/tmp/snaps/{{.UdevAppName}}/{{.Version}}/tmp",
+		"SNAPPY_APP_ARCH={{.AppArch}}",
+	})
+}
+
+// GetDeprecatedUserSnapEnvVars returns the user-level deprecated environment
+// variables for a snap.
+// Despite this being a bit snap-specific, this is in helpers.go because it's
+// used by so many other modules, we run into circular dependencies if it's
+// somewhere more reasonable like the snappy module.
+func GetDeprecatedUserSnapEnvVars(desc interface{}) []string {
+	return fillSnapEnvVars(desc, []string{
+		"SNAPP_APP_USER_DATA_PATH={{.Home}}{{.AppPath}}",
+	})
+}
+
+// CleanDir cleans all regular files in the given directory
+func CleanDir(dir string) error {
+	dents, err := ioutil.ReadDir(dir)
+	if err != nil {
+		return err
+	}
+	for _, dent := range dents {
+		if dent.Mode().IsRegular() {
+			if err := os.Remove(filepath.Join(dir, dent.Name())); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+>>>>>>> MERGE-SOURCE

=== modified file 'helpers/helpers_test.go'
--- helpers/helpers_test.go	2015-06-04 12:55:54 +0000
+++ helpers/helpers_test.go	2015-06-04 20:51:08 +0000
@@ -21,6 +21,7 @@
 
 import (
 	"compress/gzip"
+	"fmt"
 	"io/ioutil"
 	"math/rand"
 	"os"
@@ -270,6 +271,7 @@
 	c.Assert(err, IsNil)
 	c.Assert(home, Equals, oldHome)
 }
+<<<<<<< TREE
 
 func skipOnMissingDevKmsg(c *C) {
 	_, err := os.Stat("/dev/kmsg")
@@ -328,3 +330,117 @@
 	c.Assert(mknodWasCalled, Equals, true)
 
 }
+=======
+
+func makeTestFiles(c *C, srcDir, destDir string) {
+	// a new file
+	err := ioutil.WriteFile(filepath.Join(srcDir, "new"), []byte(nil), 0644)
+	c.Assert(err, IsNil)
+
+	// a existing file that needs update
+	err = ioutil.WriteFile(filepath.Join(destDir, "existing-update"), []byte("old-content"), 0644)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(srcDir, "existing-update"), []byte("some-new-content"), 0644)
+	c.Assert(err, IsNil)
+
+	// existing file that needs no update
+	err = ioutil.WriteFile(filepath.Join(srcDir, "existing-unchanged"), []byte(nil), 0644)
+	c.Assert(err, IsNil)
+	err = exec.Command("cp", "-a", filepath.Join(srcDir, "existing-unchanged"), filepath.Join(destDir, "existing-unchanged")).Run()
+	c.Assert(err, IsNil)
+
+	// a file that needs removal
+	err = ioutil.WriteFile(filepath.Join(destDir, "to-be-deleted"), []byte(nil), 0644)
+	c.Assert(err, IsNil)
+}
+
+func compareDirs(c *C, srcDir, destDir string) {
+	d1, err := exec.Command("ls", "-al", srcDir).CombinedOutput()
+	c.Assert(err, IsNil)
+	d2, err := exec.Command("ls", "-al", destDir).CombinedOutput()
+	c.Assert(err, IsNil)
+	c.Assert(string(d1), Equals, string(d2))
+	// ensure content got updated
+	c1, err := exec.Command("sh", "-c", fmt.Sprintf("find %s -type f |xargs cat", srcDir)).CombinedOutput()
+	c.Assert(err, IsNil)
+	c2, err := exec.Command("sh", "-c", fmt.Sprintf("find %s -type f |xargs cat", destDir)).CombinedOutput()
+	c.Assert(err, IsNil)
+	c.Assert(string(c1), Equals, string(c2))
+}
+
+func (ts *HTestSuite) TestSyncDirs(c *C) {
+
+	for _, l := range [][2]string{
+		[2]string{"src-short", "dst-loooooooooooong"},
+		[2]string{"src-loooooooooooong", "dst-short"},
+		[2]string{"src-eq", "dst-eq"},
+	} {
+
+		// ensure we have src, dest dirs with different length
+		srcDir := filepath.Join(c.MkDir(), l[0])
+		err := os.MkdirAll(srcDir, 0755)
+		c.Assert(err, IsNil)
+		destDir := filepath.Join(c.MkDir(), l[1])
+		err = os.MkdirAll(destDir, 0755)
+		c.Assert(err, IsNil)
+
+		// add a src subdir
+		subdir := filepath.Join(srcDir, "subdir")
+		err = os.Mkdir(subdir, 0755)
+		c.Assert(err, IsNil)
+		makeTestFiles(c, subdir, destDir)
+
+		// add a dst subdir that needs to get deleted
+		subdir2 := filepath.Join(destDir, "to-be-deleted-subdir")
+		err = os.Mkdir(subdir2, 0755)
+		subdir3 := filepath.Join(subdir2, "to-be-deleted-sub-subdir")
+		err = os.Mkdir(subdir3, 0755)
+
+		// and a toplevel
+		makeTestFiles(c, srcDir, destDir)
+
+		// do it
+		err = RSyncWithDelete(srcDir, destDir)
+		c.Assert(err, IsNil)
+
+		// ensure meta-data is identical
+		compareDirs(c, srcDir, destDir)
+		compareDirs(c, filepath.Join(srcDir, "subdir"), filepath.Join(destDir, "subdir"))
+	}
+}
+
+func (ts *HTestSuite) TestSyncDirFails(c *C) {
+	srcDir := c.MkDir()
+	err := os.MkdirAll(srcDir, 0755)
+	c.Assert(err, IsNil)
+
+	destDir := c.MkDir()
+	err = os.MkdirAll(destDir, 0755)
+	c.Assert(err, IsNil)
+
+	err = ioutil.WriteFile(filepath.Join(destDir, "meep"), []byte(nil), 0644)
+	c.Assert(err, IsNil)
+
+	// ensure remove fails
+	err = os.Chmod(destDir, 0100)
+	c.Assert(err, IsNil)
+	// make tempdir cleanup work again
+	defer os.Chmod(destDir, 0755)
+
+	// do it
+	err = RSyncWithDelete(srcDir, destDir)
+	c.Check(err, NotNil)
+	c.Check(err, ErrorMatches, ".*permission denied.*")
+}
+
+func (ts *HTestSuite) TestCleanDir(c *C) {
+	d := c.MkDir()
+	canary := filepath.Join(d, "foo")
+	err := ioutil.WriteFile(canary, []byte(nil), 0644)
+	c.Assert(err, IsNil)
+
+	err = CleanDir(d)
+	c.Assert(err, IsNil)
+	c.Assert(FileExists(canary), Equals, false)
+}
+>>>>>>> MERGE-SOURCE

=== modified file 'partition/bootloader_uboot.go'
--- partition/bootloader_uboot.go	2015-05-29 09:55:15 +0000
+++ partition/bootloader_uboot.go	2015-06-04 20:51:08 +0000
@@ -221,10 +221,7 @@
 	srcDir := u.currentBootPath
 	destDir := u.otherBootPath
 
-	// always start from scratch: all files here are owned by us.
-	os.RemoveAll(destDir)
-
-	return runCommand("/bin/cp", "-a", srcDir, destDir)
+	return helpers.RSyncWithDelete(srcDir, destDir)
 }
 
 func (u *uboot) HandleAssets() (err error) {

=== modified file 'partition/bootloader_uboot_test.go'
=== modified file 'partition/partition.go'
--- partition/partition.go	2015-05-29 09:55:15 +0000
+++ partition/partition.go	2015-06-04 20:51:08 +0000
@@ -814,6 +814,9 @@
 		return err
 	}
 
+	// XXX: first toggle roofs and then handle assets? that seems
+	//      wrong given that handleAssets may fails and we will
+	//      knowingly boot into a broken system
 	err = p.RunWithOther(RW, func(otherRoot string) (err error) {
 		return bootloader.ToggleRootFS()
 	})

=== modified file 'progress/progress.go'
--- progress/progress.go	2015-05-15 13:33:27 +0000
+++ progress/progress.go	2015-06-04 20:51:08 +0000
@@ -129,8 +129,9 @@
 // Finished stops displaying the progress
 func (t *TextProgress) Finished() {
 	if t.pbar != nil {
-		t.pbar.FinishPrint("Done")
+		t.pbar.Finish()
 	}
+	fmt.Println("Done")
 }
 
 // Write is there so that progress can implment a Writer and can be
@@ -143,7 +144,10 @@
 // that have a unknown duration
 func (t *TextProgress) Spin(msg string) {
 	states := `|/-\`
-	fmt.Printf("\r%s[%c]", msg, states[t.spinStep])
+
+	// clear until end of line
+	clearUntilEOL := "\033[K"
+	fmt.Printf("\r%s[%c]%s", msg, states[t.spinStep], clearUntilEOL)
 	t.spinStep++
 	if t.spinStep >= len(states) {
 		t.spinStep = 0

=== modified file 'progress/progress_test.go'
--- progress/progress_test.go	2015-06-02 20:53:10 +0000
+++ progress/progress_test.go	2015-06-04 20:51:08 +0000
@@ -60,7 +60,7 @@
 	f.Seek(0, 0)
 	progress, err := ioutil.ReadAll(f)
 	c.Assert(err, IsNil)
-	c.Assert(string(progress), Equals, "\rm[|]\rm[/]\rm[-]\rm[\\]\rm[|]\rm[/]")
+	c.Assert(string(progress), Equals, "\rm[|]\x1b[K\rm[/]\x1b[K\rm[-]\x1b[K\rm[\\]\x1b[K\rm[|]\x1b[K\rm[/]\x1b[K")
 }
 
 func (ts *ProgressTestSuite) testAgreed(answer string, value bool, c *C) {

=== modified file 'snappy/click.go'
--- snappy/click.go	2015-05-29 14:28:36 +0000
+++ snappy/click.go	2015-06-04 20:51:08 +0000
@@ -92,9 +92,10 @@
 func execHook(execCmd string) (err error) {
 	// the spec says this is passed to the shell
 	cmd := exec.Command("sh", "-c", execCmd)
-	if err = cmd.Run(); err != nil {
+	if output, err := cmd.CombinedOutput(); err != nil {
 		if exitCode, err := helpers.ExitCode(err); err == nil {
 			return &ErrHookFailed{cmd: execCmd,
+				output:   string(output),
 				exitCode: exitCode}
 		}
 		return err
@@ -362,9 +363,15 @@
 		AppArch     string
 		AppPath     string
 		Version     string
+<<<<<<< TREE
 		UdevAppName string
 		Origin      string
 		Home        string
+=======
+		UdevAppName string
+		Namespace   string
+		Home        string
+>>>>>>> MERGE-SOURCE
 		Target      string
 		AaProfile   string
 		OldAppVars  string
@@ -374,9 +381,15 @@
 		AppArch:     helpers.UbuntuArchitecture(),
 		AppPath:     pkgPath,
 		Version:     m.Version,
+<<<<<<< TREE
 		UdevAppName: udevPartName,
 		Origin:      origin,
 		Home:        "$HOME",
+=======
+		UdevAppName: udevPartName,
+		Namespace:   namespace,
+		Home:        "$HOME",
+>>>>>>> MERGE-SOURCE
 		Target:      actualBinPath,
 		AaProfile:   aaProfile,
 	}
@@ -761,6 +774,7 @@
 
 func installClick(snapFile string, flags InstallFlags, inter progress.Meter, origin string) (name string, err error) {
 	allowUnauthenticated := (flags & AllowUnauthenticated) != 0
+<<<<<<< TREE
 	part, err := NewSnapPartFromSnapFile(snapFile, origin, allowUnauthenticated)
 	if err != nil {
 		return "", err
@@ -768,6 +782,251 @@
 	defer part.deb.Close()
 
 	return part.Install(inter, flags)
+=======
+	if err := auditClick(snapFile, allowUnauthenticated); err != nil {
+		return "", err
+		// ?
+		//return SnapAuditError
+	}
+
+	d, err := clickdeb.Open(snapFile)
+	if err != nil {
+		return "", err
+	}
+	defer d.Close()
+
+	manifestData, err := d.ControlMember("manifest")
+	if err != nil {
+		log.Printf("Snap inspect failed: %s", snapFile)
+		return "", err
+	}
+
+	manifest, err := readClickManifest([]byte(manifestData))
+	if err != nil {
+		return "", err
+	}
+
+	yamlData, err := d.MetaMember("package.yaml")
+	if err != nil {
+		return "", err
+	}
+
+	m, err := parsePackageYamlData(yamlData)
+	if err != nil {
+		return "", err
+	}
+
+	if err := m.checkForPackageInstalled(namespace); err != nil {
+		return "", err
+	}
+
+	// verify we have a valid architecture
+	if !helpers.IsSupportedArchitecture(m.Architectures) {
+		return "", &ErrArchitectureNotSupported{m.Architectures}
+	}
+
+	if err := m.checkForNameClashes(); err != nil {
+		return "", err
+	}
+
+	if err := m.checkForFrameworks(); err != nil {
+		return "", err
+	}
+
+	targetDir := snapAppsDir
+	// the "oem" parts are special
+	if manifest.Type == SnapTypeOem {
+		targetDir = snapOemDir
+
+		// TODO do the following at a higher level once the store publishes snap types
+		// this is horrible
+		if allowOEM := (flags & AllowOEM) != 0; !allowOEM {
+			if currentOEM, err := getOem(); err == nil {
+				if currentOEM.Name != manifest.Name {
+					fmt.Println(currentOEM.Name, manifest.Name)
+					return "", ErrOEMPackageInstall
+				}
+			} else {
+				// there should always be an oem package now
+				return "", ErrOEMPackageInstall
+			}
+		}
+
+		if err := installOemHardwareUdevRules(m); err != nil {
+			return "", err
+		}
+	}
+
+	fullName := manifest.Name
+	// namespacing only applies to apps.
+	if manifest.Type != SnapTypeFramework && manifest.Type != SnapTypeOem {
+		fullName += "." + namespace
+	}
+	instDir := filepath.Join(targetDir, fullName, manifest.Version)
+	currentActiveDir, _ := filepath.EvalSymlinks(filepath.Join(instDir, "..", "current"))
+
+	if err := m.checkLicenseAgreement(inter, d, currentActiveDir); err != nil {
+		return "", err
+	}
+
+	dataDir := filepath.Join(snapDataDir, fullName, manifest.Version)
+
+	if err := helpers.EnsureDir(instDir, 0755); err != nil {
+		log.Printf("WARNING: Can not create %s", instDir)
+	}
+
+	// if anything goes wrong here we cleanup
+	defer func() {
+		if err != nil {
+			if e := os.RemoveAll(instDir); e != nil && !os.IsNotExist(e) {
+				log.Printf("Warning: failed to remove %s: %s", instDir, e)
+			}
+		}
+	}()
+
+	// we need to call the external helper so that we can reliable drop
+	// privs
+	if err := unpackWithDropPrivs(d, instDir); err != nil {
+		return "", err
+	}
+
+	// legacy, the hooks (e.g. apparmor) need this. Once we converted
+	// all hooks this can go away
+	clickMetaDir := path.Join(instDir, ".click", "info")
+	if err := os.MkdirAll(clickMetaDir, 0755); err != nil {
+		return "", err
+	}
+	if err := writeCompatManifestJSON(clickMetaDir, manifestData, namespace); err != nil {
+		return "", err
+	}
+
+	// write the hashes now
+	if err := writeHashesFile(d, instDir); err != nil {
+		return "", err
+	}
+
+	inhibitHooks := (flags & InhibitHooks) != 0
+
+	// deal with the data:
+	//
+	// if there was a previous version, stop it
+	// from being active so that it stops running and can no longer be
+	// started then copy the data
+	//
+	// otherwise just create a empty data dir
+	if currentActiveDir != "" {
+		oldManifest, err := readClickManifestFromClickDir(currentActiveDir)
+		if err != nil {
+			return "", err
+		}
+
+		// we need to stop making it active
+		err = unsetActiveClick(currentActiveDir, inhibitHooks, inter)
+		defer func() {
+			if err != nil {
+				if cerr := setActiveClick(currentActiveDir, inhibitHooks, inter); cerr != nil {
+					log.Printf("setting old version back to active failed: %v", cerr)
+				}
+			}
+		}()
+		if err != nil {
+			return "", err
+		}
+
+		err = copySnapData(fullName, oldManifest.Version, manifest.Version)
+	} else {
+		err = helpers.EnsureDir(dataDir, 0755)
+	}
+
+	defer func() {
+		if err != nil {
+			if cerr := removeSnapData(fullName, manifest.Version); cerr != nil {
+				log.Printf("when clenaning up data for %s %s: %v", manifest.Name, manifest.Version, cerr)
+			}
+		}
+	}()
+
+	if err != nil {
+		return "", err
+	}
+
+	// and finally make active
+	err = setActiveClick(instDir, inhibitHooks, inter)
+	defer func() {
+		if err != nil && currentActiveDir != "" {
+			if cerr := setActiveClick(currentActiveDir, inhibitHooks, inter); cerr != nil {
+				log.Printf("when setting old %s version back to active: %v", manifest.Name, cerr)
+			}
+		}
+	}()
+	if err != nil {
+		return "", err
+	}
+
+	// oh, one more thing: refresh the security bits
+	if !inhibitHooks {
+		part, err := NewSnapPartFromYaml(filepath.Join(instDir, "meta", "package.yaml"), namespace, m)
+		if err != nil {
+			return "", err
+		}
+
+		deps, err := part.Dependents()
+		if err != nil {
+			return "", err
+		}
+
+		sysd := systemd.New(globalRootDir, inter)
+		stopped := make(map[string]time.Duration)
+		defer func() {
+			if err != nil {
+				for serviceName := range stopped {
+					if e := sysd.Start(serviceName); e != nil {
+						inter.Notify(fmt.Sprintf("unable to restart %s with the old %s: %s", serviceName, part.Name(), e))
+					}
+				}
+			}
+		}()
+
+		for _, dep := range deps {
+			if !dep.IsActive() {
+				continue
+			}
+			for _, svc := range dep.Services() {
+				serviceName := filepath.Base(generateServiceFileName(dep.m, svc))
+				timeout := time.Duration(svc.StopTimeout)
+				if err = sysd.Stop(serviceName, timeout); err != nil {
+					inter.Notify(fmt.Sprintf("unable to stop %s; aborting install: %s", serviceName, err))
+					return "", err
+				}
+				stopped[serviceName] = timeout
+			}
+		}
+
+		if err := part.RefreshDependentsSecurity(currentActiveDir, inter); err != nil {
+			return "", err
+		}
+
+		started := make(map[string]time.Duration)
+		defer func() {
+			if err != nil {
+				for serviceName, timeout := range started {
+					if e := sysd.Stop(serviceName, timeout); e != nil {
+						inter.Notify(fmt.Sprintf("unable to stop %s with the old %s: %s", serviceName, part.Name(), e))
+					}
+				}
+			}
+		}()
+		for serviceName, timeout := range stopped {
+			if err = sysd.Start(serviceName); err != nil {
+				inter.Notify(fmt.Sprintf("unable to restart %s; aborting install: %s", serviceName, err))
+				return "", err
+			}
+			started[serviceName] = timeout
+		}
+	}
+
+	return manifest.Name, nil
+>>>>>>> MERGE-SOURCE
 }
 
 // removeSnapData removes the data for the given version of the given snap

=== modified file 'snappy/click_test.go'
=== modified file 'snappy/dirs.go'
--- snappy/dirs.go	2015-05-15 13:33:27 +0000
+++ snappy/dirs.go	2015-06-04 20:51:08 +0000
@@ -33,6 +33,8 @@
 	snapSeccompDir   string
 	snapUdevRulesDir string
 
+	systemApparmorProfileCacheDir string
+
 	snapBinariesDir  string
 	snapServicesDir  string
 	snapBusPolicyDir string
@@ -62,4 +64,6 @@
 	cloudMetaDataFile = filepath.Join(rootdir, "/var/lib/cloud/seed/nocloud-net/meta-data")
 
 	snapUdevRulesDir = filepath.Join(rootdir, "/etc/udev/rules.d")
+
+	systemApparmorProfileCacheDir = filepath.Join(rootdir, "/etc/apparmor.d/cache")
 }

=== modified file 'snappy/errors.go'
--- snappy/errors.go	2015-06-04 13:04:30 +0000
+++ snappy/errors.go	2015-06-04 20:51:08 +0000
@@ -166,11 +166,12 @@
 // ErrHookFailed is returned if a hook command fails
 type ErrHookFailed struct {
 	cmd      string
+	output   string
 	exitCode int
 }
 
 func (e *ErrHookFailed) Error() string {
-	return fmt.Sprintf("hook command %v failed with exit status %d", e.cmd, e.exitCode)
+	return fmt.Sprintf("hook command %v failed with exit status %d (output: '%s')", e.cmd, e.exitCode, e.output)
 }
 
 // ErrDataCopyFailed is returned if copying the snap data fialed

=== modified file 'snappy/snapp.go'
--- snappy/snapp.go	2015-06-04 12:55:54 +0000
+++ snappy/snapp.go	2015-06-04 20:51:08 +0000
@@ -1559,6 +1559,7 @@
 // are required when calling a meta/hook/ script and that will override
 // any already existing SNAP_* variables in os.Environment()
 func makeSnapHookEnv(part *SnapPart) (env []string) {
+<<<<<<< TREE
 	desc := struct {
 		AppName     string
 		AppArch     string
@@ -1573,6 +1574,22 @@
 		part.Version(),
 		QualifiedName(part),
 		part.Origin(),
+=======
+	desc := struct {
+		AppName     string
+		AppArch     string
+		AppPath     string
+		Version     string
+		UdevAppName string
+		Namespace   string
+	}{
+		part.Name(),
+		helpers.UbuntuArchitecture(),
+		part.basedir,
+		part.Version(),
+		Dirname(part),
+		part.Namespace(),
+>>>>>>> MERGE-SOURCE
 	}
 	snapEnv := helpers.MakeMapFromEnvList(helpers.GetBasicSnapEnvVars(desc))
 

=== modified file 'snappy/snapp_test.go'
--- snappy/snapp_test.go	2015-06-04 13:34:57 +0000
+++ snappy/snapp_test.go	2015-06-04 20:51:08 +0000
@@ -709,6 +709,7 @@
 	c.Check(p.notified[0], Matches, "Waiting for .* stop.")
 }
 
+<<<<<<< TREE
 func (s *SnapTestSuite) TestErrorOnUnsupportedArchitecture(c *C) {
 	const packageHello = `name: hello-app
 version: 1.10
@@ -728,6 +729,24 @@
 	c.Assert(err.Error(), Equals, errorMsg)
 }
 
+=======
+func (s *SnapTestSuite) TestErrorOnUnsupportedArchitecture(c *C) {
+	const packageHello = `name: hello-app
+version: 1.10
+vendor: Somebody
+icon: meta/hello.svg
+architectures:
+    - yadayada
+    - blahblah
+`
+
+	snapPkg := makeTestSnapPackage(c, packageHello)
+	_, err := installClick(snapPkg, 0, nil, testNamespace)
+	errorMsg := fmt.Sprintf("package's supported architectures (yadayada, blahblah) is incompatible with this system (%s)", helpers.UbuntuArchitecture())
+	c.Assert(err.Error(), Equals, errorMsg)
+}
+
+>>>>>>> MERGE-SOURCE
 func (s *SnapTestSuite) TestRemoteSnapErrors(c *C) {
 	snap := RemoteSnapPart{}
 

=== modified file 'snappy/systemimage.go'
--- snappy/systemimage.go	2015-05-20 17:24:29 +0000
+++ snappy/systemimage.go	2015-06-04 20:51:08 +0000
@@ -198,6 +198,9 @@
 
 	// Ensure there is always a kernel + initrd to boot with, even
 	// if the update does not provide new versions.
+	if pb != nil {
+		pb.Notify("Syncing boot files")
+	}
 	err = s.partition.SyncBootloaderFiles()
 	if err != nil {
 		return "", err
@@ -226,12 +229,32 @@
 		return "", err
 	}
 
+	// XXX: ToggleNextBoot() calls handleAssets() (but not SyncBootloader
+	//      files :/) - handleAssets() may copy kernel/initramfs to the
+	//      sync mounted /boot/uboot, so its very slow, tell the user
+	//      at least that something is going on
+	if pb != nil {
+		pb.Notify("Updating boot files")
+	}
+
+	// this needs to go once we have a clean fix for #1460152
+	if err := s.postUpgradeHacks(); err != nil {
+		return "", err
+	}
+
 	if err = s.partition.ToggleNextBoot(); err != nil {
 		return "", err
 	}
 	return systemImagePartName, nil
 }
 
+// this makes me cry
+func (s *SystemImagePart) postUpgradeHacks() error {
+	// Apply HACK to deal with bug #1460152 where the apparmor
+	// cache is confused after the upgrade
+	return helpers.CleanDir(systemApparmorProfileCacheDir)
+}
+
 // Ensure the expected version update was applied to the expected partition.
 func (s *SystemImagePart) verifyUpgradeWasApplied() error {
 	// The upgrade has now been applied, so check that the expected

=== modified file 'snappy/systemimage_native.go'
--- snappy/systemimage_native.go	2015-05-15 13:33:27 +0000
+++ snappy/systemimage_native.go	2015-06-04 20:51:08 +0000
@@ -158,6 +158,8 @@
 			pb.Set(genericData.Now)
 		}
 	}
+	// ugly: avoid Spin() artifacts
+	pb.Notify("\nApply done")
 
 	if err := scanner.Err(); err != nil {
 		return err

=== modified file 'snappy/systemimage_test.go'
--- snappy/systemimage_test.go	2015-06-02 20:53:10 +0000
+++ snappy/systemimage_test.go	2015-06-04 20:51:08 +0000
@@ -58,6 +58,13 @@
 	// setup fake /other partition
 	makeFakeSystemImageChannelConfig(c, filepath.Join(tempdir, "other", systemImageChannelConfig), "2")
 
+	// fake the apparmor.d/cache
+	systemApparmorProfileCacheDir = filepath.Join(systemImageRoot, "etc", "apparmor.d", "cache")
+	err := os.MkdirAll(systemApparmorProfileCacheDir, 0755)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(systemApparmorProfileCacheDir, "some-cache"), []byte(nil), 0644)
+	c.Assert(err, IsNil)
+
 	// run test webserver instead of talking to the real one
 	//
 	// The mock webserver versions  "1" and "2"
@@ -192,6 +199,29 @@
 	c.Assert(pb.progress, DeepEquals, []float64{20.0, 40.0, 60.0, 80.0, 100.0})
 }
 
+func (s *SITestSuite) TestSystemImagePartInstalAppliesHackLp1460152(c *C) {
+	// add a update
+	mockSystemImageIndexJSON = fmt.Sprintf(mockSystemImageIndexJSONTemplate, "2")
+	parts, err := s.systemImage.Updates()
+
+	sp := parts[0].(*SystemImagePart)
+	mockPartition := MockPartition{}
+	sp.partition = &mockPartition
+
+	dents, err := ioutil.ReadDir(systemApparmorProfileCacheDir)
+	c.Assert(err, IsNil)
+	c.Assert(dents, HasLen, 1)
+
+	pb := &MockProgressMeter{}
+	// do the install
+	_, err = sp.Install(pb, 0)
+	c.Assert(err, IsNil)
+
+	dents, err = ioutil.ReadDir(systemApparmorProfileCacheDir)
+	c.Assert(err, IsNil)
+	c.Assert(dents, HasLen, 0)
+}
+
 func (s *SITestSuite) TestSystemImagePartInstallUpdatesBroken(c *C) {
 	// fake a broken upgrade
 	scriptContent := `#!/bin/sh

=== modified file 'systemd/systemd.go'
--- systemd/systemd.go	2015-06-03 14:01:51 +0000
+++ systemd/systemd.go	2015-06-04 20:51:08 +0000
@@ -207,10 +207,17 @@
 		FullPathPostStop     string
 		AppTriple            string
 		ServiceSystemdTarget string
+<<<<<<< TREE
 		Origin               string
 		AppArch              string
 		Home                 string
 		EnvVars              string
+=======
+		Namespace            string
+		AppArch              string
+		Home                 string
+		EnvVars              string
+>>>>>>> MERGE-SOURCE
 	}{
 		*desc,
 		filepath.Join(desc.AppPath, desc.Start),
@@ -218,10 +225,17 @@
 		filepath.Join(desc.AppPath, desc.PostStop),
 		fmt.Sprintf("%s_%s_%s", desc.AppName, desc.ServiceName, desc.Version),
 		servicesSystemdTarget,
+<<<<<<< TREE
 		origin,
 		helpers.UbuntuArchitecture(),
 		"%h",
 		"",
+=======
+		namespace,
+		helpers.UbuntuArchitecture(),
+		"%h",
+		"",
+>>>>>>> MERGE-SOURCE
 	}
 	allVars := helpers.GetBasicSnapEnvVars(wrapperData)
 	allVars = append(allVars, helpers.GetUserSnapEnvVars(wrapperData)...)

=== modified file 'systemd/systemd_test.go'
--- systemd/systemd_test.go	2015-06-03 14:03:45 +0000
+++ systemd/systemd_test.go	2015-06-04 20:51:08 +0000
@@ -26,9 +26,15 @@
 	"testing"
 	"time"
 
+<<<<<<< TREE
 	. "gopkg.in/check.v1"
 
 	"launchpad.net/snappy/helpers"
+=======
+	. "launchpad.net/gocheck"
+
+	"launchpad.net/snappy/helpers"
+>>>>>>> MERGE-SOURCE
 )
 
 type testreporter struct {