v1.1.1: require admin access for file pull API

This locks down the files "pull" API to require admin. Even though it's a read (GET), this meant any user could potentially read sensitive files.

Note that this version number is prior to any other tagged release of Pebble (the first tagged release was v1.2.0).

This addresses CVE-2024-3250.

Changes from 5842ea68c9c7 (the version currently used by Juju 2.9).

v1.10.1: add missing client.ChangeUpdateNotice constant

This is a patch release that just adds the missing client.ChangeUpdateNotice constant.

v1.10.0: change-update

What's Changed

This release has one new feature (addition of the change-update notice type), as well as a host of bug fixes, minor doc improvements, and a significant refactoring of plan management.

Features

• feat(state): record change-update notices on change status updates by @ZeyadYasser in #379

Bug fixes

• fix: start process subreaper at top level to avoid shutdown hangs by @benhoyt in #380
• fix: allow for the JSON overhead when reading log lines by @tonyandrewmeyer in #384
• fix(client): make retry loop stop immediately when context is cancelled by @benhoyt in #386
• enter: start default services before executing subcommand by @rebornplusplus in #257
• fix(run): don't overwrite err on reaper.Stop() by @thp-canonical in #390
• fix(cli): PEBBLE_COPY_ONCE on missing dir. by @hpidcock in #392
• fix(client): use host from BaseURL for websockets by @thp-canonical in #393
• fix(daemon): deduplicate user-provided notice types by @olivercalder in #399
• fix(cli): pass PebbleDir and SocketPath through RunOptions/ParserOptions/CmdOptions by @thp-canonical in #388
• fix(help): DefaultDir to personality, allow overriding header and footer by @thp-canonical in #397
• fix(taskrunner): consistent, nicer formatting for task failed log by @benhoyt in #391
• fix(daemon): improve health state lock test, remove LockCount by @benhoyt in #373

Refactoring

• chore: remove deprecated functions now that we're on Go 1.16+ by @benhoyt in #375
• refactor: remove maybeShellcheck from FakeCommand by @benhoyt in #381
• feat(planstate): create a dedicated plan manager by @flotter in #387
• feat(cli): add RunOptions to cli.Run, remove global variable by @thp-canonical in #383

Docs

• docs: add comments to clarify that WaitNotices releases the state lock by @benhoyt in #378
• docs: explicitly note that on-failure is not considered when starting or stopping a service by @tonyandrewmeyer in #382
• feat(cli): new Info category for help, version by @thp-canonical in #400

New Contributors

• @ZeyadYasser made their first contribution in #379

Full Changelog: v1.9.0...v1.10.0

v1.9.1: make PEBBLE_COPY_ONCE not fail on missing dir

Adds #392, which makes the PEBBLE_COPY_ONCE feature not fail if the source directory is missing.

v1.7.3: fix: validate whole plan, rather than topmost two layers

This is a patch release pulling in the following fix to validate the whole plan, rather than just the topmost two layers.

Full Changelog: v1.7.2...v1.7.3

v1.9.0: notices "select" to "users", health check state lock fix, validation fixes, and more

What's Changed

• chore(daemon): remove untrusted socket by @thp-canonical in #361
• fix(daemon): Export error responders from daemon.response by @thp-canonical in #360
• feat(wait): export cli.Wait function by @paul-rodriguez in #362
• doc(state): say why we're not implementing warnings as notices yet by @benhoyt in #365
• chore(daemon): port AccessChecker interface from snapd by @thp-canonical in #358
• fix: validate whole plan, rather than topmost two layers by @tonyandrewmeyer in #363
• feat(daemon): Add support for PEBBLE_COPY_ONCE. by @hpidcock in #352
• fix(notices): replace "select=all" with "users=all" by @olivercalder in #368
• fix(daemon): avoid acquiring state lock in health check endpoint by @benhoyt in #369
• Update version to v1.9.0 for release; flesh out release instructions by @benhoyt in #370

New Contributors

• @tonyandrewmeyer made their first contribution in #363

Full Changelog: v1.8.0...v1.9.0

v1.7.2: rename notices "select" to "users", avoid acquiring state lock in /v1/health

This patch release adds the following changes since v1.7.1:

• #368: replace "select=all" with "users=all". Strictly speaking this is a breaking change, however, it was a design mistake and we want to fix it as soon as possible. It's almost certainly that no one is using this feature yet.
• #369: avoid acquiring state lock in health check endpoint. This fixes (or is one aspect of the fix for) the issue described in https://bugs.launchpad.net/juju/+bug/2052517, so that the GET /v1/health endpoint returns much quicker even when under load.

v1.7.1: deadlock fix

This patch release includes a fix for the "Pebble is unresponsive" deadlock issue described in #314.

Commits compared to v1.7.0: v1.7.0...v1.7.1

v1.4.1: deadlock fix

This patch release includes a fix for the "Pebble is unresponsive" deadlock issue described in #314.

Commits compared to v1.4.0: v1.4.0...v1.4.1

v1.8.0: deadlock fix, port various items from snapd

This release includes a fix for the "Pebble is unresponsive" deadlock issue described in #314, in addition to cross-porting various features from snapd, most notably the overlord/state changes in #344. Full list of changes below:

What's Changed

• ci(snap): cope with concurrent builds by @cjdcordeiro in #341
• tests(daemon): improve test coverage of notices API by @olivercalder in #346
• chore(state): cross-port latest changes from snapd's overlord/state by @dmitry-lyfar in #344
• fix(cmdstate): use imperative language and uppercase for task summary by @medvied in #348
• chore(deps): Bump critical dependencies. by @hpidcock in #353
• daemon: make ucrednetGet() return *ucrednet by @thp-canonical in #357
• fix(servstate): reduce scope of holding ServiceManager.planLock by @benhoyt in #355
• fix(servstate): don't hold both servicesLock and state lock at once by @benhoyt in #359

New Contributors

• @medvied made their first contribution in #348

Full list of commits: v1.7.0...v1.8.0