Merge lp:~sergiusens/snappy/seccompError into lp:~snappy-dev/snappy/snappy-moved-to-github

[Sergio Schvezov]

Backport, Provide a more specific error than '%f is a directory' when missing a seccomp entry

Unmerged revisions

457. By Sergio Schvezov on 2015-07-06

Provide a more specific error than '%f is a directory' when missing a seccomp entry

456. By Michael Terry on 2015-07-06

Restart systemd services on failure by default

This is a backport of r492 from trunk. by mterry approved by rsalveti

455. By Michael Terry on 2015-07-06

Add an are-we-root-check/mutex-lock to the set command and make the message nicer.

This is a backport of r528 from trunk. by mterry approved by rsalveti

454. By John Lenton on 2015-07-06

Cherry picked r493 to fix oauth quoting. Fixes LP:1461262. by chipaca approved by rsalveti

453. By Ricardo Salveti on 2015-07-06

Fixing lint errors by rsalveti approved by mterry

452. By Sergio Schvezov on 2015-06-08

Backport 09_snappy to support azure kernel cmdline requirements by sergiusens approved by chipaca

451. By Michael Terry on 2015-06-04

When rolling back. output version info, especially any messages about rebooting to pick up the new version.

This is a backport of r485 from trunk. by mterry approved by sergiusens

450. By Sergio Schvezov on 2015-06-04

Don't allow installation of packages with unsupported architectures (backported from trunk with bzr merge -c 484 from trunk) by sergiusens approved by chipaca

449. By Michael Terry on 2015-06-04

Allow ".." in file paths as long as it isn't an entire element. (i.e. allow "hello..you" or "...")

We call filepath.Clean right before our ".." check. So the only instances of ".." will be in the first element. That lets us simplify the check a lot.

This is a backport of r457 from trunk. by mterry approved by chipaca

448. By Michael Terry on 2015-06-04

Fix intermittent "permission denied" errors when installing snaps by making sure that we always unpack in the same OS thread that dropped its privileges.

This is a backport of r481 from trunk. by mterry approved by chipaca

=== modified file 'clickdeb/deb.go'
=== modified file 'clickdeb/deb_test.go'
=== modified file 'cmd/snappy/cmd_internal_unpack.go'
--- cmd/snappy/cmd_internal_unpack.go	2015-07-02 16:01:11 +0000
+++ cmd/snappy/cmd_internal_unpack.go	2015-07-06 19:58:38 +0000
@@ -129,6 +129,7 @@
 
 		// first find out what user to use
 		passFile := passwdFile(rootDir, "passwd")
+<<<<<<< TREE
 		for _, dropPrivsUser = range dropPrivsUsers {
 			_, err := readUID(dropPrivsUser, passFile)
 			if err == nil {
@@ -138,6 +139,9 @@
 
 		// then get uid/gid
 		uid, err := readUID(dropPrivsUser, passFile)
+=======
+		uid, err := readUID(dropPrivsUser, passFile)
+>>>>>>> MERGE-SOURCE
 		if err != nil {
 			return err
 		}

=== modified file 'cmd/snappy/cmd_internal_unpack_test.go'
--- cmd/snappy/cmd_internal_unpack_test.go	2015-07-02 16:01:11 +0000
+++ cmd/snappy/cmd_internal_unpack_test.go	2015-07-06 19:58:38 +0000
@@ -42,7 +42,11 @@
 snappypkg:x:101:104::/nonexistent:/bin/false
 `)
 
+<<<<<<< TREE
 	uid, err := readUID("snappypkg", f.Name())
+=======
+	uid, err := readUID("clickpkg", f.Name())
+>>>>>>> MERGE-SOURCE
 	c.Assert(err, IsNil)
 	c.Assert(uid, Equals, 101)
 }
@@ -53,7 +57,11 @@
 snappypkg:x:104:
 `)
 
+<<<<<<< TREE
 	gid, err := readUID("snappypkg", f.Name())
+=======
+	gid, err := readUID("clickpkg", f.Name())
+>>>>>>> MERGE-SOURCE
 	c.Assert(err, IsNil)
 	c.Assert(gid, Equals, 104)
 }
@@ -66,7 +74,11 @@
 `)
 	defer os.Remove(f.Name())
 
+<<<<<<< TREE
 	uid, err := readUID("snappypkg", f.Name())
+=======
+	uid, err := readUID("clickpkg", f.Name())
+>>>>>>> MERGE-SOURCE
 	c.Assert(err, IsNil)
 	c.Assert(uid, Equals, 102)
 }
@@ -77,7 +89,11 @@
 snappypkg:x:
 `)
 
+<<<<<<< TREE
 	_, err := readUID("snappypkg", f.Name())
+=======
+	_, err := readUID("clickpkg", f.Name())
+>>>>>>> MERGE-SOURCE
 	c.Assert(err, NotNil)
 }
 
@@ -86,6 +102,10 @@
 daemon:
 `)
 
+<<<<<<< TREE
 	_, err := readUID("snappypkg", f.Name())
+=======
+	_, err := readUID("clickpkg", f.Name())
+>>>>>>> MERGE-SOURCE
 	c.Assert(err, NotNil)
 }

=== modified file 'cmd/snappy/cmd_rollback.go'
--- cmd/snappy/cmd_rollback.go	2015-07-02 17:16:11 +0000
+++ cmd/snappy/cmd_rollback.go	2015-07-06 19:58:38 +0000
@@ -77,5 +77,14 @@
 	parts := snappy.FindSnapsByNameAndVersion(pkg, nowVersion, installed)
 	showVerboseList(parts, os.Stdout)
 
+	m := snappy.NewMetaRepository()
+	installed, err := m.Installed()
+	if err != nil {
+		return err
+	}
+
+	parts := snappy.FindSnapsByNameAndVersion(pkg, nowVersion, installed)
+	showVerboseList(parts, os.Stdout)
+
 	return nil
 }

=== modified file 'cmd/snappy/cmd_set.go'
--- cmd/snappy/cmd_set.go	2015-06-30 12:52:52 +0000
+++ cmd/snappy/cmd_set.go	2015-07-06 19:58:38 +0000
@@ -23,8 +23,12 @@
 	"fmt"
 	"strings"
 
+<<<<<<< TREE
 	"launchpad.net/snappy/i18n"
 	"launchpad.net/snappy/logger"
+=======
+	"launchpad.net/snappy/priv"
+>>>>>>> MERGE-SOURCE
 	"launchpad.net/snappy/progress"
 	"launchpad.net/snappy/snappy"
 )
@@ -53,8 +57,18 @@
 }
 
 func (x *cmdSet) Execute(args []string) (err error) {
+<<<<<<< TREE
 	x.args = args
 	return withMutex(x.doSet)
+=======
+	privMutex := priv.New()
+	if err := privMutex.TryLock(); err != nil {
+		return err
+	}
+	defer privMutex.Unlock()
+
+	return set(args)
+>>>>>>> MERGE-SOURCE
 }
 
 func (x *cmdSet) doSet() (err error) {

=== modified file 'cmd/snappy/main.go'
--- cmd/snappy/main.go	2015-06-11 20:30:46 +0000
+++ cmd/snappy/main.go	2015-07-06 19:58:38 +0000
@@ -52,10 +52,14 @@
 			// the CLI user.
 			err = snappy.ErrNeedRoot
 		}
+<<<<<<< TREE
 		fmt.Fprintln(os.Stderr, err)
 		if _, ok := err.(*flags.Error); !ok {
 			logger.Debugf("%v failed: %v", os.Args, err)
 		}
+=======
+		fmt.Fprintln(os.Stderr, err)
+>>>>>>> MERGE-SOURCE
 		os.Exit(1)
 	}
 }

=== added directory 'etc'
=== added directory 'etc/grub.d'
=== added file 'etc/grub.d/09_snappy.OTHER'
--- etc/grub.d/09_snappy.OTHER	1970-01-01 00:00:00 +0000
+++ etc/grub.d/09_snappy.OTHER	2015-07-06 19:58:38 +0000
@@ -0,0 +1,441 @@
+#!/bin/sh
+#---------------------------------------------------------------------
+# Summary: Grub bootloader logic for Ubuntu Snappy systems.
+# Description: This is a heavily modified "10_linux" grub snippet that
+#   deals with Snappy dual-rootfs systems.
+#
+# XXX: Note that this script is called from within a chroot environment
+# on snappy systems!
+#
+#---------------------------------------------------------------------
+
+set -e
+
+prefix="/usr"
+exec_prefix="/usr"
+datarootdir="/usr/share"
+
+# Utility functions
+. "${datarootdir}/grub/grub-mkconfig_lib"
+
+# Globals
+machine=`uname -m`
+
+SNAPPY_OS="Ubuntu Core Snappy"
+SNAPPY_TYPE=simple
+
+#---------------------------------------------------------------------
+
+# Display message and exit
+die()
+{
+    msg="$*"
+    echo "ERROR: $msg" >&2
+    exit 1
+}
+
+# Create a grub menu entry by writing a menuentry to stdout.
+linux_entry_ext()
+{
+  local name="$1"
+  local os="$2"
+  local version="$3"
+  local type="$4"
+  local args="$5"
+  local device="$6"
+  local kernel="$7"
+  local initrd="$8"
+
+  local boot_device_id=
+  local prepare_root_cache=
+  local prepare_boot_cache=
+
+  if [ -z "$boot_device_id" ]; then
+      boot_device_id="$(grub_get_device_id "${device}")"
+  fi
+
+  echo "menuentry '$name' ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
+
+  if [ x$type != xrecovery ] ; then
+      save_default_entry | grub_add_tab
+  fi
+
+  # Use ELILO's generic "efifb" when it's known to be available.
+  # FIXME: We need an interface to select vesafb in case efifb can't be used.
+  if [ "x$GRUB_GFXPAYLOAD_LINUX" = x ]; then
+      echo "	load_video" | sed "s/^/$submenu_indentation/"
+  else
+      if [ "x$GRUB_GFXPAYLOAD_LINUX" != xtext ]; then
+	  echo "	load_video" | sed "s/^/$submenu_indentation/"
+      fi
+  fi
+  if ([ "$ubuntu_recovery" = 0 ] || [ x$type != xrecovery ]) && \
+     ([ "x$GRUB_GFXPAYLOAD_LINUX" != x ] || [ "$gfxpayload_dynamic" = 1 ]); then
+      echo "	gfxmode \$linux_gfx_mode" | sed "s/^/$submenu_indentation/"
+  fi
+
+  echo "	insmod gzio" | sed "s/^/$submenu_indentation/"
+  echo "	if [ x\$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi" | sed "s/^/$submenu_indentation/"
+
+  # device may be a label (LABEL=name), so convert back to full path
+  label_name=$(echo "$device"|sed 's/^LABEL=//g')
+  if [ "$device" = "$label_name" ]
+  then
+    device_path="$device"
+  else
+    # found a label
+    device_path=$(get_partition_from_label "$label_name")
+  fi
+
+  if [ x$dirname = x/ ]; then
+    if [ -z "${prepare_root_cache}" ]; then
+
+      prepare_root_cache="$(prepare_grub_to_access_device ${device_path} | grub_add_tab)"
+    fi
+    printf '%s\n' "${prepare_root_cache}" | sed "s/^/$submenu_indentation/"
+  else
+    if [ -z "${prepare_boot_cache}" ]; then
+      prepare_boot_cache="$(prepare_grub_to_access_device ${device_path} | grub_add_tab)"
+    fi
+    printf '%s\n' "${prepare_boot_cache}" | sed "s/^/$submenu_indentation/"
+  fi
+
+  if [ x"$quiet_boot" = x0 ] || [ x"$type" != xsimple ]; then
+    message="$(gettext_printf "Loading Linux %s ..." ${version})"
+    sed "s/^/$submenu_indentation/" << EOF
+	echo	'$(echo "$message" | grub_quote)'
+EOF
+  fi
+
+    sed "s/^/$submenu_indentation/" << EOF
+	linux ${kernel} root=${device} ro ${args}
+EOF
+
+  if test -n "${initrd}"; then
+    # TRANSLATORS: ramdisk isn't identifier. Should be translated.
+    if [ x"$quiet_boot" = x0 ] || [ x"$type" != xsimple ]; then
+      message="$(gettext_printf "Loading initial ramdisk ...")"
+      sed "s/^/$submenu_indentation/" << EOF
+	echo	'$(echo "$message" | grub_quote)'
+EOF
+    fi
+    sed "s/^/$submenu_indentation/" << EOF
+	initrd ${initrd}
+EOF
+  fi
+
+  sed "s/^/$submenu_indentation/" << EOF
+}
+EOF
+}
+
+# Returns a list of the currently available kernels.
+# $1: If set, look for kernel below "$1/boot/".
+get_kernels()
+{
+    local prefix_dir="$1"
+    local list
+
+    case "x$machine" in
+    xi?86 | xx86_64)
+    list=`for i in $prefix_dir/boot/vmlinuz-* \
+                         $prefix_dir/vmlinuz-* \
+                         $prefix_dir/boot/kernel-* ; do
+                  if grub_file_is_not_garbage "$i" ; then echo -n "$i " ; fi
+              done` ;;
+    *) 
+    list=`for i in $prefix_dir/boot/vmlinuz-* \
+                         $prefix_dir/boot/vmlinux-* \
+                         $prefix_dir/vmlinuz-* \
+                         $prefix_dir/vmlinux-* \
+                         $prefix_dir/boot/kernel-* ; do
+                  if grub_file_is_not_garbage "$i" ; then echo -n "$i " ; fi
+         done` ;;
+    esac
+    echo "$list"
+}
+
+# Composes and returns a kernel cmd line
+get_cmdline() {
+    channel_ini="/etc/system-image/channel.ini"
+    grep -q 'device: azure_amd64' "$channel_ini" && azure_cmdline="rootdelay=300"
+
+    echo "${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT} $azure_cmdline"
+}
+
+# Returns the path to the initrd for the kernel specified by $1.
+# $1: kernel version.
+# $2: directory to look in.
+get_initrd()
+{
+  local version="$1"
+  local dir="$2"
+
+  local alt_version=`echo $version | sed -e "s,\.old$,,g"`
+  local initrd=
+  local i=
+
+  for i in "initrd.img-${version}" "initrd-${version}.img" "initrd-${version}.gz" \
+           "initrd-${version}" "initramfs-${version}.img" \
+           "initrd.img-${alt_version}" "initrd-${alt_version}.img" \
+           "initrd-${alt_version}" "initramfs-${alt_version}.img" \
+           "initramfs-genkernel-${version}" \
+           "initramfs-genkernel-${alt_version}" \
+           "initramfs-genkernel-${GENKERNEL_ARCH}-${version}" \
+           "initramfs-genkernel-${GENKERNEL_ARCH}-${alt_version}"; do
+    if test -e "${dir}/${i}" ; then
+      initrd="${dir}/${i}"
+      break
+    fi
+  done
+  echo "$initrd"
+}
+
+# Determine full path to disk partition given a filesystem label.
+get_partition_from_label()
+{
+    local label="$1"
+    local part=
+    local path=
+
+    [ -n "$label" ] || grub_warn "need FS label"
+
+    part=$(find /dev -name "$label"|tail -1)
+    [ -z "$part" ] && return
+    path=$(readlink -f "$part")
+    [ -n "$path" ] && echo "$path"
+}
+
+# Return the partition label for the given partition device.
+# $1: full path to partition device.
+get_label_from_device()
+{
+    local root="$1"
+
+    local label=
+    local std_label=
+    local label_rootfs=
+
+    for std_label in system-a system-b; do
+        label_rootfs=$(findfs "PARTLABEL=$std_label" 2>/dev/null || :)
+        if [ "$label_rootfs" = "$root" ]; then
+            label="$std_label"
+            break
+        fi
+    done
+
+    echo "$label"
+}
+
+# Return the full path to the device corresponding to the given
+# partition label.
+#
+# $1: partition label.
+get_device_from_label()
+{
+    local label="$1"
+    local device=
+
+    device=$(findfs "PARTLABEL=$label" 2>/dev/null || :)
+    echo "$device"
+}
+
+# Given a rootfs label, return the rootfs label corresponding to the
+# "other" rootfs partition.
+get_other_rootfs_label()
+{
+    local label="$1"
+
+    if [ "$label" = "system-a" ]; then
+        echo "system-b"
+    else
+        echo "system-a"
+    fi
+}
+
+# Given a mountpoint, return the corresponding device path
+# $1: mountpoint.
+get_device_from_mountpoint()
+{
+    local mountpoint="$1"
+    local device=
+
+    # XXX: Parse mount output rather than looking in /proc/mounts to
+    # avoid seeing the mounts outside the chroot.
+    device=$(/bin/mount | grep "^/dev/.* on ${mountpoint}[[:space:]]" 2>/dev/null |\
+        awk '{print $1}' || :)
+
+    echo "$device"
+}
+
+# Convert a partition label name to a menuentry name
+make_name()
+{
+    local label="$1"
+
+    echo "$SNAPPY_OS $label rootfs" | grub_quote
+}
+
+# Arrange for a grub menuentry to be created for the given partition.
+#
+# $1: full path to rootfs partition device
+# $2: partition label associated with $1
+# $3: mountpoint of $1.
+handle_menu_entry()
+{
+    local rootfs_device="$1"
+    local label="$2"
+    local mountpoint="$3"
+
+    local name=
+    local device=
+    local mount_prefix=
+    local list=
+    local linux=
+    local basename=
+    local dirname=
+    local rel_dirname=
+    local version=
+    local initrd=
+    local cmdline=
+
+    # boot by label
+    device="LABEL=$label"
+
+    name=$(make_name "$label")
+
+    # avoid double-leading slashes and the subsequent need to call
+    # 'readlink -f'.
+    if [ "$mountpoint" = "/" ]; then
+        mount_prefix=""
+    else
+        mount_prefix="$mountpoint"
+    fi
+    list=$(get_kernels "$mount_prefix")
+
+    linux=$(version_find_latest $list)
+    basename=$(basename "$linux")
+    dirname=$(dirname "$linux")
+    rel_dirname=$(make_system_path_relative_to_its_root "$dirname")
+    version=$(echo "$basename" | sed -e "s,^[^0-9]*-,,g")
+
+    initrd=$(get_initrd "$version" "$dirname")
+
+    cmdline=$(get_cmdline)
+
+    # convert the path to the mounted "other" rootfs back to a
+    # a standard one by removing the mountpoint prefix.
+    if [ "$mountpoint" != "/" ]; then
+        linux=$(echo "$linux" | sed "s!^${mountpoint}!!g")
+        initrd=$(echo "$initrd" | sed "s!^${mountpoint}!!g")
+    fi
+
+    # Create menu entries for the 2 snappy rootfs's.
+    linux_entry_ext "$name" "$SNAPPY_OS" "$version" \
+        "$SNAPPY_TYPE" "$cmdline" "$device" \
+        "$linux" "$initrd"
+}
+
+#---------------------------------------------------------------------
+# main
+
+case "$machine" in
+    i?86) GENKERNEL_ARCH="x86" ;;
+    mips|mips64) GENKERNEL_ARCH="mips" ;;
+    mipsel|mips64el) GENKERNEL_ARCH="mipsel" ;;
+    arm*) GENKERNEL_ARCH="arm" ;;
+    *) GENKERNEL_ARCH="$machine" ;;
+esac
+
+# Determine which partition label is being used for the current root
+# directory. This is slightly convoluted but required since this code
+# runs within a chroot environment (where lsblk does not work).
+#
+# XXX: Note that since this code is run from within a chroot (where the
+# "other" rootfs is mounted), it might appear that the logic is
+# inverted. However, the code below simply 
+this_mountpoint="/"
+this_root=$(get_device_from_mountpoint "$this_mountpoint")
+[ -z "$this_root" ] && {
+    die "cannot determine rootfs for $this_mountpoint"
+}
+
+this_label=$(get_label_from_device "$this_root")
+[ -z "$this_label" ] && {
+    die "cannot determine partition label for rootfs $this_root"
+}
+
+handle_menu_entry "$this_root" "$this_label" "$this_mountpoint"
+
+other_mountpoint="/writable/cache/system"
+
+# When this script is run on a real snappy system, even if there is only
+# a single rootfs provisioned, the other rootfs partition is expected to
+# be formatted and mounted.
+#
+# However this script is also run at provisioning time where
+# $other_mountpoint will not be a mountpoint. Therefore in the provisioning
+# scenario, only a single menuentry will be generated if only a single
+# rootfs is provisioned.
+if $(mountpoint -q "$other_mountpoint"); then
+    other_label=$(get_other_rootfs_label "$this_label")
+
+    other_root=$(get_device_from_label "$other_label")
+    [ -z "$other_root" ] && {
+        die "cannot determine rootfs"
+    }
+
+    handle_menu_entry "$other_root" "$other_label" "$other_mountpoint"
+fi
+
+# Toggle rootfs if previous boot failed.
+#
+# Since grub sets snappy_trial_boot, if it is _already_ set when grub starts
+# and we're in try mode, the previous boot must have failed to unset it,
+# so toggle the rootfs.
+sed "s/^/$submenu_indentation/" << EOF
+    # set defaults
+    if [ -z "\$snappy_mode" ]; then
+        set snappy_mode=regular
+        save_env snappy_mode
+    fi
+    if [ -z "\$snappy_ab" ]; then
+        set snappy_ab=a
+        save_env snappy_ab
+    fi
+
+    if [ "\$snappy_mode" = "try" ]; then
+        if [ "\$snappy_trial_boot" = "1" ]; then
+            # Previous boot failed to unset snappy_trial_boot, so toggle
+            # rootfs.
+            if [ "\$snappy_ab" = "a" ]; then
+                set default="$(make_name system-b)"
+                set snappy_ab=b
+            else
+                set snappy_ab=a
+                set default="$(make_name system-a)"
+            fi
+            save_env snappy_ab
+        else
+            # Trial mode so set the snappy_trial_boot (which snappy is
+            # expected to unset).
+            #
+            # Note: don't use the standard recordfail variable since that forces
+            # the menu to be displayed and sets an infinite timeout if set.
+            set snappy_trial_boot=1
+            save_env snappy_trial_boot
+
+            if [ "\$snappy_ab" = "a" ]; then
+                set default="$(make_name system-a)"
+            else
+                set default="$(make_name system-b)"
+            fi
+        fi
+    else
+        if [ "\$snappy_ab" = "a" ]; then
+            set default="$(make_name system-a)"
+        else
+            set default="$(make_name system-b)"
+        fi
+    fi
+EOF

=== modified file 'helpers/helpers.go'
--- helpers/helpers.go	2015-07-01 21:09:59 +0000
+++ helpers/helpers.go	2015-07-06 19:58:38 +0000
@@ -26,6 +26,7 @@
 	"encoding/hex"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"math/rand"
 	"os"
 	"os/exec"
@@ -198,14 +199,37 @@
 	}
 }
 
-// IsSupportedArchitecture returns true if the system architecture is in the
-// list of architectures.
-func IsSupportedArchitecture(architectures []string) bool {
-	systemArch := UbuntuArchitecture()
-
-	for _, arch := range architectures {
-		if arch == "all" || arch == systemArch {
-			return true
+<<<<<<< TREE
+// IsSupportedArchitecture returns true if the system architecture is in the
+// list of architectures.
+func IsSupportedArchitecture(architectures []string) bool {
+	systemArch := UbuntuArchitecture()
+
+	for _, arch := range architectures {
+		if arch == "all" || arch == systemArch {
+			return true
+=======
+// IsSupportedArchitecture returns true if the system architecture is in the
+// list of architectures.
+func IsSupportedArchitecture(architectures []string) bool {
+	systemArch := UbuntuArchitecture()
+
+	for _, arch := range architectures {
+		if arch == "all" || arch == systemArch {
+			return true
+		}
+	}
+
+	return false
+}
+
+// EnsureDir ensures that the given directory exists and if
+// not creates it with the given permissions.
+func EnsureDir(dir string, perm os.FileMode) (err error) {
+	if _, err := os.Stat(dir); os.IsNotExist(err) {
+		if err := os.MkdirAll(dir, perm); err != nil {
+			return err
+>>>>>>> MERGE-SOURCE
 		}
 	}
 
@@ -346,6 +370,7 @@
 	return syscall.Getuid() == 0 || syscall.Getgid() == 0
 
 }
+<<<<<<< TREE
 
 // MajorMinor returns the major/minor number of the given os.FileInfo
 func MajorMinor(info os.FileInfo) (uint32, uint32, error) {
@@ -509,3 +534,140 @@
 
 	return nil
 }
+=======
+
+func makeDirMap(dirName string) (map[string]struct{}, error) {
+	dir, err := ioutil.ReadDir(dirName)
+	if err != nil {
+		return nil, err
+	}
+
+	dirMap := make(map[string]struct{})
+	for _, dent := range dir {
+		if dent.IsDir() {
+			return nil, fmt.Errorf("subdirs are not supported")
+		}
+		dirMap[dent.Name()] = struct{}{}
+	}
+
+	return dirMap, nil
+}
+
+// RSyncWithDelete syncs srcDir to destDir
+func RSyncWithDelete(srcDirName, destDirName string) error {
+
+	// first remove everything thats not in srcdir
+	err := filepath.Walk(destDirName, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		// relative to the root "destDirName"
+		relPath := path[len(destDirName):]
+		if !FileExists(filepath.Join(srcDirName, relPath)) {
+			if err := os.RemoveAll(path); err != nil {
+				return err
+			}
+			if info.IsDir() {
+				return filepath.SkipDir
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+
+	// then copy or update the data from srcdir to destdir
+	err = filepath.Walk(srcDirName, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		// relative to the root "srcDirName"
+		relPath := path[len(srcDirName):]
+		if info.IsDir() {
+			return os.MkdirAll(filepath.Join(destDirName, relPath), info.Mode())
+		}
+		src := path
+		dst := filepath.Join(destDirName, relPath)
+		if !FilesAreEqual(src, dst) {
+			// XXX: on snappy-trunk we can use CopyFile here
+			output, err := exec.Command("cp", "-va", src, dst).CombinedOutput()
+			if err != nil {
+				fmt.Errorf("Failed to copy %s to %s (%s)", src, dst, output)
+			}
+		}
+		return nil
+	})
+
+	return err
+}
+
+func fillSnapEnvVars(desc interface{}, vars []string) []string {
+	for i, v := range vars {
+		var templateOut bytes.Buffer
+		t := template.Must(template.New("wrapper").Parse(v))
+		if err := t.Execute(&templateOut, desc); err != nil {
+			// this can never happen, except we forget a variable
+			logger.LogAndPanic(err)
+		}
+		vars[i] = templateOut.String()
+	}
+	return vars
+}
+
+// GetBasicSnapEnvVars returns the app-level environment variables for a snap.
+// Despite this being a bit snap-specific, this is in helpers.go because it's
+// used by so many other modules, we run into circular dependencies if it's
+// somewhere more reasonable like the snappy module.
+func GetBasicSnapEnvVars(desc interface{}) []string {
+	return fillSnapEnvVars(desc, []string{
+		"TMPDIR=/tmp/snaps/{{.UdevAppName}}/{{.Version}}/tmp",
+		"TEMPDIR=/tmp/snaps/{{.UdevAppName}}/{{.Version}}/tmp",
+		"SNAP_APP_PATH={{.AppPath}}",
+		"SNAP_APP_DATA_PATH=/var/lib{{.AppPath}}",
+		"SNAP_APP_TMPDIR=/tmp/snaps/{{.UdevAppName}}/{{.Version}}/tmp",
+		"SNAP_NAME={{.AppName}}",
+		"SNAP_VERSION={{.Version}}",
+		"SNAP_ORIGIN={{.Namespace}}",
+		"SNAP_FULLNAME={{.UdevAppName}}",
+		"SNAP_ARCH={{.AppArch}}",
+	})
+}
+
+// GetUserSnapEnvVars returns the user-level environment variables for a snap.
+// Despite this being a bit snap-specific, this is in helpers.go because it's
+// used by so many other modules, we run into circular dependencies if it's
+// somewhere more reasonable like the snappy module.
+func GetUserSnapEnvVars(desc interface{}) []string {
+	return fillSnapEnvVars(desc, []string{
+		"SNAP_APP_USER_DATA_PATH={{.Home}}{{.AppPath}}",
+	})
+}
+
+// GetDeprecatedBasicSnapEnvVars returns the app-level deprecated environment
+// variables for a snap.
+// Despite this being a bit snap-specific, this is in helpers.go because it's
+// used by so many other modules, we run into circular dependencies if it's
+// somewhere more reasonable like the snappy module.
+func GetDeprecatedBasicSnapEnvVars(desc interface{}) []string {
+	return fillSnapEnvVars(desc, []string{
+		"SNAPP_APP_PATH={{.AppPath}}",
+		"SNAPP_APP_DATA_PATH=/var/lib{{.AppPath}}",
+		"SNAPP_APP_TMPDIR=/tmp/snaps/{{.UdevAppName}}/{{.Version}}/tmp",
+		"SNAPPY_APP_ARCH={{.AppArch}}",
+	})
+}
+
+// GetDeprecatedUserSnapEnvVars returns the user-level deprecated environment
+// variables for a snap.
+// Despite this being a bit snap-specific, this is in helpers.go because it's
+// used by so many other modules, we run into circular dependencies if it's
+// somewhere more reasonable like the snappy module.
+func GetDeprecatedUserSnapEnvVars(desc interface{}) []string {
+	return fillSnapEnvVars(desc, []string{
+		"SNAPP_APP_USER_DATA_PATH={{.Home}}{{.AppPath}}",
+	})
+}
+>>>>>>> MERGE-SOURCE

=== modified file 'helpers/helpers_test.go'
--- helpers/helpers_test.go	2015-07-01 18:27:44 +0000
+++ helpers/helpers_test.go	2015-07-06 19:58:38 +0000
@@ -271,6 +271,7 @@
 	c.Assert(err, IsNil)
 	c.Assert(home, Equals, oldHome)
 }
+<<<<<<< TREE
 
 func skipOnMissingDevKmsg(c *C) {
 	_, err := os.Stat("/dev/kmsg")
@@ -483,3 +484,106 @@
 	err := CopyIfDifferent(src, dst)
 	c.Assert(err, NotNil)
 }
+=======
+
+func makeTestFiles(c *C, srcDir, destDir string) {
+	// a new file
+	err := ioutil.WriteFile(filepath.Join(srcDir, "new"), []byte(nil), 0644)
+	c.Assert(err, IsNil)
+
+	// a existing file that needs update
+	err = ioutil.WriteFile(filepath.Join(destDir, "existing-update"), []byte("old-content"), 0644)
+	c.Assert(err, IsNil)
+	err = ioutil.WriteFile(filepath.Join(srcDir, "existing-update"), []byte("some-new-content"), 0644)
+	c.Assert(err, IsNil)
+
+	// existing file that needs no update
+	err = ioutil.WriteFile(filepath.Join(srcDir, "existing-unchanged"), []byte(nil), 0644)
+	c.Assert(err, IsNil)
+	err = exec.Command("cp", "-a", filepath.Join(srcDir, "existing-unchanged"), filepath.Join(destDir, "existing-unchanged")).Run()
+	c.Assert(err, IsNil)
+
+	// a file that needs removal
+	err = ioutil.WriteFile(filepath.Join(destDir, "to-be-deleted"), []byte(nil), 0644)
+	c.Assert(err, IsNil)
+}
+
+func compareDirs(c *C, srcDir, destDir string) {
+	d1, err := exec.Command("ls", "-al", srcDir).CombinedOutput()
+	c.Assert(err, IsNil)
+	d2, err := exec.Command("ls", "-al", destDir).CombinedOutput()
+	c.Assert(err, IsNil)
+	c.Assert(string(d1), Equals, string(d2))
+	// ensure content got updated
+	c1, err := exec.Command("sh", "-c", fmt.Sprintf("find %s -type f |xargs cat", srcDir)).CombinedOutput()
+	c.Assert(err, IsNil)
+	c2, err := exec.Command("sh", "-c", fmt.Sprintf("find %s -type f |xargs cat", destDir)).CombinedOutput()
+	c.Assert(err, IsNil)
+	c.Assert(string(c1), Equals, string(c2))
+}
+
+func (ts *HTestSuite) TestSyncDirs(c *C) {
+
+	for _, l := range [][2]string{
+		[2]string{"src-short", "dst-loooooooooooong"},
+		[2]string{"src-loooooooooooong", "dst-short"},
+		[2]string{"src-eq", "dst-eq"},
+	} {
+
+		// ensure we have src, dest dirs with different length
+		srcDir := filepath.Join(c.MkDir(), l[0])
+		err := os.MkdirAll(srcDir, 0755)
+		c.Assert(err, IsNil)
+		destDir := filepath.Join(c.MkDir(), l[1])
+		err = os.MkdirAll(destDir, 0755)
+		c.Assert(err, IsNil)
+
+		// add a src subdir
+		subdir := filepath.Join(srcDir, "subdir")
+		err = os.Mkdir(subdir, 0755)
+		c.Assert(err, IsNil)
+		makeTestFiles(c, subdir, destDir)
+
+		// add a dst subdir that needs to get deleted
+		subdir2 := filepath.Join(destDir, "to-be-deleted-subdir")
+		err = os.Mkdir(subdir2, 0755)
+		subdir3 := filepath.Join(subdir2, "to-be-deleted-sub-subdir")
+		err = os.Mkdir(subdir3, 0755)
+
+		// and a toplevel
+		makeTestFiles(c, srcDir, destDir)
+
+		// do it
+		err = RSyncWithDelete(srcDir, destDir)
+		c.Assert(err, IsNil)
+
+		// ensure meta-data is identical
+		compareDirs(c, srcDir, destDir)
+		compareDirs(c, filepath.Join(srcDir, "subdir"), filepath.Join(destDir, "subdir"))
+	}
+}
+
+func (ts *HTestSuite) TestSyncDirFails(c *C) {
+	srcDir := c.MkDir()
+	err := os.MkdirAll(srcDir, 0755)
+	c.Assert(err, IsNil)
+
+	destDir := c.MkDir()
+	err = os.MkdirAll(destDir, 0755)
+	c.Assert(err, IsNil)
+
+	err = ioutil.WriteFile(filepath.Join(destDir, "meep"), []byte(nil), 0644)
+	c.Assert(err, IsNil)
+
+	// ensure remove fails
+	err = os.Chmod(destDir, 0100)
+	c.Assert(err, IsNil)
+	// make tempdir cleanup work again
+	defer os.Chmod(destDir, 0755)
+
+	// do it
+	err = RSyncWithDelete(srcDir, destDir)
+	c.Check(err, NotNil)
+	c.Check(err, ErrorMatches, ".*permission denied.*")
+}
+>>>>>>> MERGE-SOURCE

=== modified file 'helpers/touch.go'
=== modified file 'oauth/oauth_test.go'
--- oauth/oauth_test.go	2015-06-09 13:02:35 +0000
+++ oauth/oauth_test.go	2015-07-06 19:58:38 +0000
@@ -1,3 +1,4 @@
+<<<<<<< TREE
 // -*- Mode: Go; indent-tabs-mode: t -*-
 
 /*
@@ -67,3 +68,74 @@
 		c.Check(needsEscape(no), Equals, false)
 	}
 }
+=======
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2014-2015 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package oauth
+
+import (
+	"testing"
+
+	. "launchpad.net/gocheck"
+)
+
+func Test(t *testing.T) { TestingT(t) }
+
+type OAuthTestSuite struct{}
+
+var _ = Suite(&OAuthTestSuite{})
+
+func (s *OAuthTestSuite) TestMakePlaintextSignature(c *C) {
+	mockToken := Token{
+		ConsumerKey:    "consumer-key+",
+		ConsumerSecret: "consumer-secret+",
+		TokenKey:       "token-key+",
+		TokenSecret:    "token-secret+",
+	}
+	sig := MakePlaintextSignature(&mockToken)
+	c.Assert(sig, Matches, `OAuth oauth_nonce="[a-zA-Z]+", oauth_timestamp="[0-9]+", oauth_version="1.0", oauth_signature_method="PLAINTEXT", oauth_consumer_key="consumer-key%2B", oauth_token="token-key%2B", oauth_signature="consumer-secret%2B&token-secret%2B"`)
+}
+
+func (s *OAuthTestSuite) TestQuote(c *C) {
+	// see http://wiki.oauth.net/w/page/12238556/TestCases
+	c.Check(quote("abcABC123"), Equals, "abcABC123")
+	c.Check(quote("-._~"), Equals, "-._~")
+	c.Check(quote("%"), Equals, "%25")
+	c.Check(quote("+"), Equals, "%2B")
+	c.Check(quote("&=*"), Equals, "%26%3D%2A")
+	c.Check(quote("\u000A"), Equals, "%0A")
+	c.Check(quote("\u0020"), Equals, "%20")
+	c.Check(quote("\u007F"), Equals, "%7F")
+	c.Check(quote("\u0080"), Equals, "%C2%80")
+	c.Check(quote("\u3001"), Equals, "%E3%80%81")
+}
+
+func (s *OAuthTestSuite) TestNeedsEscape(c *C) {
+	for _, needed := range []byte{'?', '/', ':'} {
+		c.Check(needsEscape(needed), Equals, true)
+	}
+}
+
+func (s *OAuthTestSuite) TestNeedsNoEscape(c *C) {
+	for _, no := range []byte{'a', 'z', 'A', 'Z', '-', '.', '_', '~'} {
+		c.Check(needsEscape(no), Equals, false)
+	}
+}
+>>>>>>> MERGE-SOURCE

=== modified file 'partition/bootloader_uboot.go'
--- partition/bootloader_uboot.go	2015-07-01 06:27:50 +0000
+++ partition/bootloader_uboot.go	2015-07-06 19:58:38 +0000
@@ -203,6 +203,110 @@
 	return os.RemoveAll(bootloaderUbootStampFile)
 }
 
+<<<<<<< TREE
+=======
+func (u *uboot) SyncBootFiles() (err error) {
+	srcDir := u.currentBootPath
+	destDir := u.otherBootPath
+
+	return helpers.RSyncWithDelete(srcDir, destDir)
+}
+
+func (u *uboot) HandleAssets() (err error) {
+	// check if we have anything, if there is no hardware yaml, there is nothing
+	// to process.
+	hardware, err := u.partition.hardwareSpec()
+	if err == ErrNoHardwareYaml {
+		return nil
+	} else if err != nil {
+		return err
+	}
+	// ensure to remove the file once we are done
+	defer os.Remove(u.partition.hardwareSpecFile)
+
+	// validate bootloader
+	if hardware.Bootloader != u.Name() {
+		return fmt.Errorf(
+			"bootloader is of type %s but hardware spec requires %s",
+			u.Name(),
+			hardware.Bootloader)
+	}
+
+	// validate partition layout
+	if u.partition.dualRootPartitions() && hardware.PartitionLayout != bootloaderSystemAB {
+		return fmt.Errorf("hardware spec requires dual root partitions")
+	}
+
+	// ensure we have the destdir
+	destDir := u.otherBootPath
+	if err := os.MkdirAll(destDir, dirMode); err != nil {
+		return err
+	}
+
+	// install kernel+initrd
+	for _, file := range []string{hardware.Kernel, hardware.Initrd} {
+
+		if file == "" {
+			continue
+		}
+
+		// expand path
+		path := path.Join(u.partition.cacheDir(), file)
+
+		if !helpers.FileExists(path) {
+			return fmt.Errorf("can not find file %s", path)
+		}
+
+		// ensure we remove the dir later
+		defer os.RemoveAll(filepath.Dir(path))
+
+		if err := runCommand("/bin/cp", path, destDir); err != nil {
+			return err
+		}
+	}
+
+	// TODO: look at the OEM package for dtb changes too once that is
+	//       fully speced
+
+	// install .dtb files
+	dtbSrcDir := filepath.Join(u.partition.cacheDir(), hardware.DtbDir)
+	if helpers.FileExists(dtbSrcDir) {
+		// ensure we cleanup the source dir
+		defer os.RemoveAll(dtbSrcDir)
+
+		dtbDestDir := path.Join(destDir, "dtbs")
+		if err := os.MkdirAll(dtbDestDir, dirMode); err != nil {
+			return err
+		}
+
+		files, err := filepath.Glob(path.Join(dtbSrcDir, "*"))
+		if err != nil {
+			return err
+		}
+
+		for _, file := range files {
+			if err := runCommand("/bin/cp", file, dtbDestDir); err != nil {
+				return err
+			}
+		}
+	}
+
+	flashAssetsDir := u.partition.flashAssetsDir()
+
+	if helpers.FileExists(flashAssetsDir) {
+		// FIXME: we don't currently do anything with the
+		// MLO + uImage files since they are not specified in
+		// the hardware spec. So for now, just remove them.
+
+		if err := os.RemoveAll(flashAssetsDir); err != nil {
+			return err
+		}
+	}
+
+	return err
+}
+
+>>>>>>> MERGE-SOURCE
 // Write lines to file atomically. File does not have to preexist.
 // FIXME: put into utils package
 func atomicFileUpdateImpl(file string, lines []string) (err error) {

=== modified file 'partition/bootloader_uboot_test.go'
--- partition/bootloader_uboot_test.go	2015-06-29 23:15:00 +0000
+++ partition/bootloader_uboot_test.go	2015-07-06 19:58:38 +0000
@@ -318,3 +318,40 @@
 	c.Check(strings.Contains(string(bytes), "snappy_mode=regular"), Equals, true)
 	c.Check(strings.Contains(string(bytes), "snappy_ab=a"), Equals, true)
 }
+
+func (s *PartitionTestSuite) TestNoWriteNotNeeded(c *C) {
+	s.makeFakeUbootEnv(c)
+
+	atomiCall := false
+	atomicFileUpdate = func(a string, b []string) error { atomiCall = true; return atomicFileUpdateImpl(a, b) }
+
+	partition := New()
+	u := newUboot(partition)
+	c.Assert(u, NotNil)
+
+	c.Check(u.MarkCurrentBootSuccessful(), IsNil)
+	c.Assert(atomiCall, Equals, false)
+}
+
+func (s *PartitionTestSuite) TestWriteDueToMissingValues(c *C) {
+	s.makeFakeUbootEnv(c)
+
+	// this file needs specific data
+	c.Assert(ioutil.WriteFile(bootloaderUbootEnvFile, []byte(""), 0644), IsNil)
+
+	atomiCall := false
+	atomicFileUpdate = func(a string, b []string) error { atomiCall = true; return atomicFileUpdateImpl(a, b) }
+
+	partition := New()
+	u := newUboot(partition)
+	c.Assert(u, NotNil)
+
+	c.Check(u.MarkCurrentBootSuccessful(), IsNil)
+	c.Assert(atomiCall, Equals, true)
+
+	bytes, err := ioutil.ReadFile(bootloaderUbootEnvFile)
+	c.Assert(err, IsNil)
+	c.Check(strings.Contains(string(bytes), "snappy_mode=try"), Equals, false)
+	c.Check(strings.Contains(string(bytes), "snappy_mode=regular"), Equals, true)
+	c.Check(strings.Contains(string(bytes), "snappy_ab=a"), Equals, true)
+}

=== modified file 'partition/partition.go'
--- partition/partition.go	2015-07-01 14:48:33 +0000
+++ partition/partition.go	2015-07-06 19:58:38 +0000
@@ -583,6 +583,7 @@
 		return errors.New("System is not dual root")
 	}
 
+<<<<<<< TREE
 	bootloader, err := bootloader(p)
 	if err != nil {
 		return err
@@ -606,4 +607,23 @@
 	}
 
 	return bootloader.BootDir()
+=======
+	bootloader, err := getBootloader(p)
+	if err != nil {
+		return err
+	}
+
+	// XXX: first toggle roofs and then handle assets? that seems
+	//      wrong given that handleAssets may fails and we will
+	//      knowingly boot into a broken system
+	err = p.RunWithOther(RW, func(otherRoot string) (err error) {
+		return bootloader.ToggleRootFS()
+	})
+
+	if err != nil {
+		return err
+	}
+
+	return bootloader.HandleAssets()
+>>>>>>> MERGE-SOURCE
 }

=== modified file 'progress/progress.go'
=== modified file 'progress/progress_test.go'
=== modified file 'snappy/auth.go'
=== modified file 'snappy/auth_test.go'
=== modified file 'snappy/click.go'
--- snappy/click.go	2015-06-17 12:02:24 +0000
+++ snappy/click.go	2015-07-06 19:58:38 +0000
@@ -332,9 +332,15 @@
 		AppArch     string
 		AppPath     string
 		Version     string
+<<<<<<< TREE
 		UdevAppName string
 		Origin      string
 		Home        string
+=======
+		UdevAppName string
+		Namespace   string
+		Home        string
+>>>>>>> MERGE-SOURCE
 		Target      string
 		AaProfile   string
 		OldAppVars  string
@@ -344,9 +350,15 @@
 		AppArch:     helpers.UbuntuArchitecture(),
 		AppPath:     pkgPath,
 		Version:     m.Version,
+<<<<<<< TREE
 		UdevAppName: udevPartName,
 		Origin:      origin,
 		Home:        "$HOME",
+=======
+		UdevAppName: udevPartName,
+		Namespace:   namespace,
+		Home:        "$HOME",
+>>>>>>> MERGE-SOURCE
 		Target:      actualBinPath,
 		AaProfile:   aaProfile,
 	}
@@ -736,6 +748,7 @@
 
 func installClick(snapFile string, flags InstallFlags, inter progress.Meter, origin string) (name string, err error) {
 	allowUnauthenticated := (flags & AllowUnauthenticated) != 0
+<<<<<<< TREE
 	part, err := NewSnapPartFromSnapFile(snapFile, origin, allowUnauthenticated)
 	if err != nil {
 		return "", err
@@ -743,6 +756,251 @@
 	defer part.deb.Close()
 
 	return part.Install(inter, flags)
+=======
+	if err := auditClick(snapFile, allowUnauthenticated); err != nil {
+		return "", err
+		// ?
+		//return SnapAuditError
+	}
+
+	d, err := clickdeb.Open(snapFile)
+	if err != nil {
+		return "", err
+	}
+	defer d.Close()
+
+	manifestData, err := d.ControlMember("manifest")
+	if err != nil {
+		log.Printf("Snap inspect failed: %s", snapFile)
+		return "", err
+	}
+
+	manifest, err := readClickManifest([]byte(manifestData))
+	if err != nil {
+		return "", err
+	}
+
+	yamlData, err := d.MetaMember("package.yaml")
+	if err != nil {
+		return "", err
+	}
+
+	m, err := parsePackageYamlData(yamlData)
+	if err != nil {
+		return "", err
+	}
+
+	if err := m.checkForPackageInstalled(namespace); err != nil {
+		return "", err
+	}
+
+	// verify we have a valid architecture
+	if !helpers.IsSupportedArchitecture(m.Architectures) {
+		return "", &ErrArchitectureNotSupported{m.Architectures}
+	}
+
+	if err := m.checkForNameClashes(); err != nil {
+		return "", err
+	}
+
+	if err := m.checkForFrameworks(); err != nil {
+		return "", err
+	}
+
+	targetDir := snapAppsDir
+	// the "oem" parts are special
+	if manifest.Type == SnapTypeOem {
+		targetDir = snapOemDir
+
+		// TODO do the following at a higher level once the store publishes snap types
+		// this is horrible
+		if allowOEM := (flags & AllowOEM) != 0; !allowOEM {
+			if currentOEM, err := getOem(); err == nil {
+				if currentOEM.Name != manifest.Name {
+					fmt.Println(currentOEM.Name, manifest.Name)
+					return "", ErrOEMPackageInstall
+				}
+			} else {
+				// there should always be an oem package now
+				return "", ErrOEMPackageInstall
+			}
+		}
+
+		if err := installOemHardwareUdevRules(m); err != nil {
+			return "", err
+		}
+	}
+
+	fullName := manifest.Name
+	// namespacing only applies to apps.
+	if manifest.Type != SnapTypeFramework && manifest.Type != SnapTypeOem {
+		fullName += "." + namespace
+	}
+	instDir := filepath.Join(targetDir, fullName, manifest.Version)
+	currentActiveDir, _ := filepath.EvalSymlinks(filepath.Join(instDir, "..", "current"))
+
+	if err := m.checkLicenseAgreement(inter, d, currentActiveDir); err != nil {
+		return "", err
+	}
+
+	dataDir := filepath.Join(snapDataDir, fullName, manifest.Version)
+
+	if err := helpers.EnsureDir(instDir, 0755); err != nil {
+		log.Printf("WARNING: Can not create %s", instDir)
+	}
+
+	// if anything goes wrong here we cleanup
+	defer func() {
+		if err != nil {
+			if e := os.RemoveAll(instDir); e != nil && !os.IsNotExist(e) {
+				log.Printf("Warning: failed to remove %s: %s", instDir, e)
+			}
+		}
+	}()
+
+	// we need to call the external helper so that we can reliable drop
+	// privs
+	if err := unpackWithDropPrivs(d, instDir); err != nil {
+		return "", err
+	}
+
+	// legacy, the hooks (e.g. apparmor) need this. Once we converted
+	// all hooks this can go away
+	clickMetaDir := path.Join(instDir, ".click", "info")
+	if err := os.MkdirAll(clickMetaDir, 0755); err != nil {
+		return "", err
+	}
+	if err := writeCompatManifestJSON(clickMetaDir, manifestData, namespace); err != nil {
+		return "", err
+	}
+
+	// write the hashes now
+	if err := writeHashesFile(d, instDir); err != nil {
+		return "", err
+	}
+
+	inhibitHooks := (flags & InhibitHooks) != 0
+
+	// deal with the data:
+	//
+	// if there was a previous version, stop it
+	// from being active so that it stops running and can no longer be
+	// started then copy the data
+	//
+	// otherwise just create a empty data dir
+	if currentActiveDir != "" {
+		oldManifest, err := readClickManifestFromClickDir(currentActiveDir)
+		if err != nil {
+			return "", err
+		}
+
+		// we need to stop making it active
+		err = unsetActiveClick(currentActiveDir, inhibitHooks, inter)
+		defer func() {
+			if err != nil {
+				if cerr := setActiveClick(currentActiveDir, inhibitHooks, inter); cerr != nil {
+					log.Printf("setting old version back to active failed: %v", cerr)
+				}
+			}
+		}()
+		if err != nil {
+			return "", err
+		}
+
+		err = copySnapData(fullName, oldManifest.Version, manifest.Version)
+	} else {
+		err = helpers.EnsureDir(dataDir, 0755)
+	}
+
+	defer func() {
+		if err != nil {
+			if cerr := removeSnapData(fullName, manifest.Version); cerr != nil {
+				log.Printf("when clenaning up data for %s %s: %v", manifest.Name, manifest.Version, cerr)
+			}
+		}
+	}()
+
+	if err != nil {
+		return "", err
+	}
+
+	// and finally make active
+	err = setActiveClick(instDir, inhibitHooks, inter)
+	defer func() {
+		if err != nil && currentActiveDir != "" {
+			if cerr := setActiveClick(currentActiveDir, inhibitHooks, inter); cerr != nil {
+				log.Printf("when setting old %s version back to active: %v", manifest.Name, cerr)
+			}
+		}
+	}()
+	if err != nil {
+		return "", err
+	}
+
+	// oh, one more thing: refresh the security bits
+	if !inhibitHooks {
+		part, err := NewSnapPartFromYaml(filepath.Join(instDir, "meta", "package.yaml"), namespace, m)
+		if err != nil {
+			return "", err
+		}
+
+		deps, err := part.Dependents()
+		if err != nil {
+			return "", err
+		}
+
+		sysd := systemd.New(globalRootDir, inter)
+		stopped := make(map[string]time.Duration)
+		defer func() {
+			if err != nil {
+				for serviceName := range stopped {
+					if e := sysd.Start(serviceName); e != nil {
+						inter.Notify(fmt.Sprintf("unable to restart %s with the old %s: %s", serviceName, part.Name(), e))
+					}
+				}
+			}
+		}()
+
+		for _, dep := range deps {
+			if !dep.IsActive() {
+				continue
+			}
+			for _, svc := range dep.Services() {
+				serviceName := filepath.Base(generateServiceFileName(dep.m, svc))
+				timeout := time.Duration(svc.StopTimeout)
+				if err = sysd.Stop(serviceName, timeout); err != nil {
+					inter.Notify(fmt.Sprintf("unable to stop %s; aborting install: %s", serviceName, err))
+					return "", err
+				}
+				stopped[serviceName] = timeout
+			}
+		}
+
+		if err := part.RefreshDependentsSecurity(currentActiveDir, inter); err != nil {
+			return "", err
+		}
+
+		started := make(map[string]time.Duration)
+		defer func() {
+			if err != nil {
+				for serviceName, timeout := range started {
+					if e := sysd.Stop(serviceName, timeout); e != nil {
+						inter.Notify(fmt.Sprintf("unable to stop %s with the old %s: %s", serviceName, part.Name(), e))
+					}
+				}
+			}
+		}()
+		for serviceName, timeout := range stopped {
+			if err = sysd.Start(serviceName); err != nil {
+				inter.Notify(fmt.Sprintf("unable to restart %s; aborting install: %s", serviceName, err))
+				return "", err
+			}
+			started[serviceName] = timeout
+		}
+	}
+
+	return manifest.Name, nil
+>>>>>>> MERGE-SOURCE
 }
 
 // removeSnapData removes the data for the given version of the given snap

=== modified file 'snappy/click_test.go'
=== modified file 'snappy/errors.go'
--- snappy/errors.go	2015-06-30 12:30:02 +0000
+++ snappy/errors.go	2015-07-06 19:58:38 +0000
@@ -138,13 +138,20 @@
 
 	// ErrInvalidPart is returned when something on the filesystem does not make sense
 	ErrInvalidPart = errors.New("invalid package on system")
+<<<<<<< TREE
 
 	// ErrInvalidSeccompPolicy is returned when policy-version and policy-vender are not set together
 	ErrInvalidSeccompPolicy = errors.New("policy-version and policy-vendor must be specified together")
 	// ErrNoSeccompPolicy is returned when an expected seccomp policy is not provided.
 	ErrNoSeccompPolicy = errors.New("no seccomp policy provided")
+=======
+
+	// ErrNoSeccompPolicy is returned when an expected seccomp policy is not provided.
+	ErrNoSeccompPolicy = errors.New("no seccomp policy provided")
+>>>>>>> MERGE-SOURCE
 )
 
+<<<<<<< TREE
 // ErrDownload represents a download error
 type ErrDownload struct {
 	code int
@@ -165,6 +172,18 @@
 	return fmt.Sprintf("package's supported architectures (%s) is incompatible with this system (%s)", strings.Join(e.architectures, ", "), helpers.UbuntuArchitecture())
 }
 
+=======
+// ErrArchitectureNotSupported is returned when trying to install a snappy package that
+// is not supported on the system
+type ErrArchitectureNotSupported struct {
+	architectures []string
+}
+
+func (e *ErrArchitectureNotSupported) Error() string {
+	return fmt.Sprintf("package's supported architectures (%s) is incompatible with this system (%s)", strings.Join(e.architectures, ", "), helpers.UbuntuArchitecture())
+}
+
+>>>>>>> MERGE-SOURCE
 // ErrInstallFailed is an error type for installation errors for snaps
 type ErrInstallFailed struct {
 	snap    string
@@ -184,7 +203,11 @@
 }
 
 func (e *ErrHookFailed) Error() string {
+<<<<<<< TREE
 	return fmt.Sprintf("hook command %v failed with exit status %d (output: %q)", e.cmd, e.exitCode, e.output)
+=======
+	return fmt.Sprintf("hook command %v failed with exit status %d (output: '%s')", e.cmd, e.exitCode, e.output)
+>>>>>>> MERGE-SOURCE
 }
 
 // ErrDataCopyFailed is returned if copying the snap data fialed

=== modified file 'snappy/security.go'
--- snappy/security.go	2015-06-24 17:05:21 +0000
+++ snappy/security.go	2015-07-06 19:58:38 +0000
@@ -151,11 +151,18 @@
 	syscalls := []string{}
 
 	if sd.SecurityOverride != nil {
+<<<<<<< TREE
 		if sd.SecurityOverride.Seccomp == "" {
 			logger.Noticef("No seccomp policy found")
 			return nil, ErrNoSeccompPolicy
 		}
 
+=======
+		if sd.SecurityOverride.Seccomp == "" {
+			return nil, ErrNoSeccompPolicy
+		}
+
+>>>>>>> MERGE-SOURCE
 		fn := filepath.Join(baseDir, sd.SecurityOverride.Seccomp)
 		var s securitySeccompOverride
 		err := readSeccompOverride(fn, &s)

=== modified file 'snappy/security_test.go'
=== modified file 'snappy/snapp.go'
--- snappy/snapp.go	2015-07-06 17:12:53 +0000
+++ snappy/snapp.go	2015-07-06 19:58:38 +0000
@@ -40,9 +40,13 @@
 
 	"launchpad.net/snappy/clickdeb"
 	"launchpad.net/snappy/helpers"
+<<<<<<< TREE
 	"launchpad.net/snappy/logger"
 	"launchpad.net/snappy/oauth"
 	"launchpad.net/snappy/pkg"
+=======
+	"launchpad.net/snappy/oauth"
+>>>>>>> MERGE-SOURCE
 	"launchpad.net/snappy/policy"
 	"launchpad.net/snappy/progress"
 	"launchpad.net/snappy/release"
@@ -1866,6 +1870,7 @@
 // are required when calling a meta/hook/ script and that will override
 // any already existing SNAP_* variables in os.Environment()
 func makeSnapHookEnv(part *SnapPart) (env []string) {
+<<<<<<< TREE
 	desc := struct {
 		AppName     string
 		AppArch     string
@@ -1880,6 +1885,22 @@
 		part.Version(),
 		QualifiedName(part),
 		part.Origin(),
+=======
+	desc := struct {
+		AppName     string
+		AppArch     string
+		AppPath     string
+		Version     string
+		UdevAppName string
+		Namespace   string
+	}{
+		part.Name(),
+		helpers.UbuntuArchitecture(),
+		part.basedir,
+		part.Version(),
+		Dirname(part),
+		part.Namespace(),
+>>>>>>> MERGE-SOURCE
 	}
 	snapEnv := helpers.MakeMapFromEnvList(helpers.GetBasicSnapEnvVars(desc))
 

=== modified file 'snappy/snapp_test.go'
--- snappy/snapp_test.go	2015-06-30 02:32:37 +0000
+++ snappy/snapp_test.go	2015-07-06 19:58:38 +0000
@@ -747,6 +747,7 @@
 	c.Check(p.notified[0], Matches, "Waiting for .* stop.")
 }
 
+<<<<<<< TREE
 func (s *SnapTestSuite) TestErrorOnUnsupportedArchitecture(c *C) {
 	const packageHello = `name: hello-app
 version: 1.10
@@ -766,6 +767,24 @@
 	c.Assert(err.Error(), Equals, errorMsg)
 }
 
+=======
+func (s *SnapTestSuite) TestErrorOnUnsupportedArchitecture(c *C) {
+	const packageHello = `name: hello-app
+version: 1.10
+vendor: Somebody
+icon: meta/hello.svg
+architectures:
+    - yadayada
+    - blahblah
+`
+
+	snapPkg := makeTestSnapPackage(c, packageHello)
+	_, err := installClick(snapPkg, 0, nil, testNamespace)
+	errorMsg := fmt.Sprintf("package's supported architectures (yadayada, blahblah) is incompatible with this system (%s)", helpers.UbuntuArchitecture())
+	c.Assert(err.Error(), Equals, errorMsg)
+}
+
+>>>>>>> MERGE-SOURCE
 func (s *SnapTestSuite) TestRemoteSnapErrors(c *C) {
 	snap := RemoteSnapPart{}
 

=== modified file 'snappy/systemimage.go'
--- snappy/systemimage.go	2015-07-01 14:48:33 +0000
+++ snappy/systemimage.go	2015-07-06 19:58:38 +0000
@@ -191,10 +191,17 @@
 
 	// Ensure there is always a kernel + initrd to boot with, even
 	// if the update does not provide new versions.
+<<<<<<< TREE
 	if pb != nil {
 		pb.Notify("Syncing boot files")
 	}
 	err = s.partition.SyncBootloaderFiles(bootAssetFilePaths())
+=======
+	if pb != nil {
+		pb.Notify("Syncing boot files")
+	}
+	err = s.partition.SyncBootloaderFiles()
+>>>>>>> MERGE-SOURCE
 	if err != nil {
 		return "", err
 	}

=== modified file 'snappy/systemimage_native.go'
=== modified file 'systemd/systemd.go'
--- systemd/systemd.go	2015-06-05 18:29:52 +0000
+++ systemd/systemd.go	2015-07-06 19:58:38 +0000
@@ -208,10 +208,17 @@
 		FullPathPostStop     string
 		AppTriple            string
 		ServiceSystemdTarget string
+<<<<<<< TREE
 		Origin               string
 		AppArch              string
 		Home                 string
 		EnvVars              string
+=======
+		Namespace            string
+		AppArch              string
+		Home                 string
+		EnvVars              string
+>>>>>>> MERGE-SOURCE
 	}{
 		*desc,
 		filepath.Join(desc.AppPath, desc.Start),
@@ -219,10 +226,17 @@
 		filepath.Join(desc.AppPath, desc.PostStop),
 		fmt.Sprintf("%s_%s_%s", desc.AppName, desc.ServiceName, desc.Version),
 		servicesSystemdTarget,
+<<<<<<< TREE
 		origin,
 		helpers.UbuntuArchitecture(),
 		"%h",
 		"",
+=======
+		namespace,
+		helpers.UbuntuArchitecture(),
+		"%h",
+		"",
+>>>>>>> MERGE-SOURCE
 	}
 	allVars := helpers.GetBasicSnapEnvVars(wrapperData)
 	allVars = append(allVars, helpers.GetUserSnapEnvVars(wrapperData)...)

=== modified file 'systemd/systemd_test.go'
--- systemd/systemd_test.go	2015-06-05 18:29:52 +0000
+++ systemd/systemd_test.go	2015-07-06 19:58:38 +0000
@@ -26,9 +26,15 @@
 	"testing"
 	"time"
 
+<<<<<<< TREE
 	. "gopkg.in/check.v1"
 
 	"launchpad.net/snappy/helpers"
+=======
+	. "launchpad.net/gocheck"
+
+	"launchpad.net/snappy/helpers"
+>>>>>>> MERGE-SOURCE
 )
 
 type testreporter struct {