From 4efa7ce93565c6c66f8ab466d79fe1688804ead6 Mon Sep 17 00:00:00 2001 From: Callahan Kovacs Date: Wed, 22 Jul 2026 07:19:30 -0500 Subject: [PATCH 1/7] docs: migrate "How to pack a Pro rock" Signed-off-by: Callahan Kovacs --- .../how-to-guides/pack-a-pro-artifact.rst | 71 +++++++++++++++++++ docs/conf.py | 1 + docs/how-to/index.rst | 1 + docs/how-to/pack-a-pro-artifact.rst | 1 + 4 files changed, 74 insertions(+) create mode 100644 docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst create mode 100644 docs/how-to/pack-a-pro-artifact.rst diff --git a/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst b/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst new file mode 100644 index 000000000..83f55ee18 --- /dev/null +++ b/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst @@ -0,0 +1,71 @@ +.. meta:: + :description: Pack a rock that contains extended security patches or meets regulatory compliance needs, powered by Ubuntu Pro. + +.. _how-to-pack-a-pro-rock: + +Pack a Pro-compliant rock +========================= + +Follow this guide to pack a rock that contains extended security patches or meets +regulatory compliance needs. + +Prerequisites +------------- + +- An Ubuntu Pro system (https://ubuntu.com/pro) +- LXD version 5.21 or higher installed (https://documentation.ubuntu.com/lxd/) +- Rockcraft version 1.18.0 or higher installed (https://snapcraft.io/rockcraft) + +Enable guest attachment +----------------------- + +Rockcraft makes use of Ubuntu Pro’s own support for LXD instances, but this support needs +to be explicitly enabled and configured. On a terminal, run: + +.. terminal:: + + sudo pro config set lxd_guest_attach=available + +This command lets Rockcraft attach its LXD instances to the system’s Pro subscription, +and only needs to be executed once. + +Next, restart LXD so that the new configuration takes effect: + +.. terminal:: + + sudo snap restart lxd + +Identify the required Pro services +---------------------------------- + +Next, determine which Pro services fit your needs. Rockcraft supports the following services: + +- ``esm-apps`` or ``esm-infra``: If your goal is to pack a rock for an application and include + the latest security patches for a base that is no longer under Standard Security Maintenance. +- ``fips``, ``fips-updates`` or ``fips-preview``: If you need to deploy your rock in a highly + regulated environment that processes sensitive data. + +The desired Pro services don’t need to be enabled on your system, but they do need to be +available. Run ``pro status`` and check the ``ENTITLED`` column to check whether a service is +available. The Ubuntu Pro Client documentation has +`further information `__ +on each service. + +Pack the rock +------------- + +Now you can pack the rock with the desired services. Provide them to the ``--pro`` option: + +.. terminal:: + + rockcraft pack --pro= + +To use multiple services, pass them to the option as comma-separated values. For example, +to pack a rock with the ``esm-apps`` and ``esm-infra`` services call: + +.. terminal:: + + rockcraft pack --pro=esm-apps,esm-infra + +Rockcraft will automatically attach the Pro subscription and enable the requested services on +the LXD instance while packing the rock. diff --git a/docs/conf.py b/docs/conf.py index aa2cb3646..549c59a30 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -181,6 +181,7 @@ # Common docs "common/README.md", "common/craft-application/how-to-guides/build-remotely.rst", + "common/craft-application/how-to-guides/pack-a-pro-artifact.rst", "common/craft-application/how-to-guides/reuse-packages-between-builds.rst", "common/craft-application/reference/remote-builds.rst", "common/craft-application/reference/fetch-service.rst", diff --git a/docs/how-to/index.rst b/docs/how-to/index.rst index e518206c4..f445ee8e5 100644 --- a/docs/how-to/index.rst +++ b/docs/how-to/index.rst @@ -7,6 +7,7 @@ How-to guides :maxdepth: 1 build-remotely + pack-a-pro-artifact partitions platforms add-a-linter diff --git a/docs/how-to/pack-a-pro-artifact.rst b/docs/how-to/pack-a-pro-artifact.rst new file mode 100644 index 000000000..4e0a38c7e --- /dev/null +++ b/docs/how-to/pack-a-pro-artifact.rst @@ -0,0 +1 @@ +.. include:: ../common/craft-application/how-to-guides/pack-a-pro-artifact.rst From b89d5ad27aa65e7899cb44645b524d527e91f46c Mon Sep 17 00:00:00 2001 From: Callahan Kovacs Date: Wed, 22 Jul 2026 07:19:01 -0500 Subject: [PATCH 2/7] docs: make "how to pack a Pro rock" generic Signed-off-by: Callahan Kovacs --- docs/.custom_wordlist.txt | 1 + .../how-to-guides/pack-a-pro-artifact.rst | 51 ++++++++++--------- docs/how-to/pack-a-pro-artifact.rst | 9 ++++ docs/reference/changelog.rst | 5 ++ 4 files changed, 42 insertions(+), 24 deletions(-) diff --git a/docs/.custom_wordlist.txt b/docs/.custom_wordlist.txt index 5ae759500..2c5af0a77 100644 --- a/docs/.custom_wordlist.txt +++ b/docs/.custom_wordlist.txt @@ -30,6 +30,7 @@ LaTeX latexmk Launchpadlib Makefile +monorepo Multipass MyST namespaced diff --git a/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst b/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst index 83f55ee18..cbaacc1d6 100644 --- a/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst +++ b/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst @@ -1,32 +1,32 @@ .. meta:: - :description: Pack a rock that contains extended security patches or meets regulatory compliance needs, powered by Ubuntu Pro. + :description: Pack |an-artifact| that contains extended security patches or meets regulatory compliance needs, powered by Ubuntu Pro. -.. _how-to-pack-a-pro-rock: +Pack a Pro-compliant |artifact| +=============================== -Pack a Pro-compliant rock -========================= - -Follow this guide to pack a rock that contains extended security patches or meets +Follow this guide to pack |an-artifact| that contains extended security patches or meets regulatory compliance needs. +.. Split point for downstream docs: Prerequisites onward + Prerequisites ------------- - An Ubuntu Pro system (https://ubuntu.com/pro) - LXD version 5.21 or higher installed (https://documentation.ubuntu.com/lxd/) -- Rockcraft version 1.18.0 or higher installed (https://snapcraft.io/rockcraft) +- |app| version |app-min-pro-version| or higher installed (|app-link|) Enable guest attachment ----------------------- -Rockcraft makes use of Ubuntu Pro’s own support for LXD instances, but this support needs +|app| makes use of Ubuntu Pro’s own support for LXD instances, but this support needs to be explicitly enabled and configured. On a terminal, run: .. terminal:: sudo pro config set lxd_guest_attach=available -This command lets Rockcraft attach its LXD instances to the system’s Pro subscription, +This command lets |app| attach its LXD instances to the system’s Pro subscription, and only needs to be executed once. Next, restart LXD so that the new configuration takes effect: @@ -38,12 +38,13 @@ Next, restart LXD so that the new configuration takes effect: Identify the required Pro services ---------------------------------- -Next, determine which Pro services fit your needs. Rockcraft supports the following services: +Next, determine which Pro services fit your needs. |app| supports the following services: -- ``esm-apps`` or ``esm-infra``: If your goal is to pack a rock for an application and include - the latest security patches for a base that is no longer under Standard Security Maintenance. -- ``fips``, ``fips-updates`` or ``fips-preview``: If you need to deploy your rock in a highly - regulated environment that processes sensitive data. +- ``esm-apps`` or ``esm-infra``: If your goal is to pack |an-artifact| for an application and + include the latest security patches for a base that is no longer under Standard Security + Maintenance. +- ``fips``, ``fips-updates`` or ``fips-preview``: If you need to deploy |an-artifact| in a + highly regulated environment that processes sensitive data. The desired Pro services don’t need to be enabled on your system, but they do need to be available. Run ``pro status`` and check the ``ENTITLED`` column to check whether a service is @@ -51,21 +52,23 @@ available. The Ubuntu Pro Client documentation has `further information `__ on each service. -Pack the rock -------------- +Pack the |artifact| +------------------- -Now you can pack the rock with the desired services. Provide them to the ``--pro`` option: +Now you can pack the |artifact| with the desired services. Provide them to the ``--pro`` option: -.. terminal:: +.. code-block:: bash + :substitutions: - rockcraft pack --pro= + |app-command| pack --pro= To use multiple services, pass them to the option as comma-separated values. For example, -to pack a rock with the ``esm-apps`` and ``esm-infra`` services call: +to pack |an-artifact| with the ``esm-apps`` and ``esm-infra`` services call: -.. terminal:: +.. code-block:: bash + :substitutions: - rockcraft pack --pro=esm-apps,esm-infra + |app-command| pack --pro=esm-apps,esm-infra -Rockcraft will automatically attach the Pro subscription and enable the requested services on -the LXD instance while packing the rock. +|app| will automatically attach the Pro subscription and enable the requested services on +the LXD instance while packing the |artifact|. diff --git a/docs/how-to/pack-a-pro-artifact.rst b/docs/how-to/pack-a-pro-artifact.rst index 4e0a38c7e..b93c3eafe 100644 --- a/docs/how-to/pack-a-pro-artifact.rst +++ b/docs/how-to/pack-a-pro-artifact.rst @@ -1 +1,10 @@ +.. |app| replace:: Craft Application +.. |app-command| replace:: +.. |artifact| replace:: artifact +.. |an-artifact| replace:: an artifact +.. |app-min-pro-version| replace:: 6.3.0 +.. |app-link| replace:: https://pypi.org/project/craft-application/ + +.. _how-to-pack-a-pro-artifact: + .. include:: ../common/craft-application/how-to-guides/pack-a-pro-artifact.rst diff --git a/docs/reference/changelog.rst b/docs/reference/changelog.rst index 655348291..ca2d2e60e 100644 --- a/docs/reference/changelog.rst +++ b/docs/reference/changelog.rst @@ -35,6 +35,11 @@ Bug fixes - Ignore .spread-reuse files when deciding if a source is outdated. - By default, trim documentation URLs so they display major version only. +Documentation +============= + +- Add a :ref:`how-to-pack-a-pro-artifact` how-to document. + For a complete list of commits, check out the `7.2.0`_ release on GitHub. 7.1.0 (2026-07-07) From 9e89e3a116c2772508fa16b2ef888a2a04926c4e Mon Sep 17 00:00:00 2001 From: Callahan Kovacs Date: Thu, 23 Jul 2026 11:44:53 -0500 Subject: [PATCH 3/7] docs: feedback from PR Signed-off-by: Callahan Kovacs --- .../how-to-guides/pack-a-pro-artifact.rst | 7 +++---- docs/how-to/pack-a-pro-artifact.rst | 3 +++ docs/reference/changelog.rst | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst b/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst index cbaacc1d6..8ab5dd546 100644 --- a/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst +++ b/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst @@ -1,13 +1,12 @@ -.. meta:: - :description: Pack |an-artifact| that contains extended security patches or meets regulatory compliance needs, powered by Ubuntu Pro. - Pack a Pro-compliant |artifact| =============================== +.. Begin overview + Follow this guide to pack |an-artifact| that contains extended security patches or meets regulatory compliance needs. -.. Split point for downstream docs: Prerequisites onward +.. End overview Prerequisites ------------- diff --git a/docs/how-to/pack-a-pro-artifact.rst b/docs/how-to/pack-a-pro-artifact.rst index b93c3eafe..6ae7658ab 100644 --- a/docs/how-to/pack-a-pro-artifact.rst +++ b/docs/how-to/pack-a-pro-artifact.rst @@ -1,3 +1,6 @@ +.. meta:: + :description: Pack an artifact that contains extended security patches or meets regulatory compliance needs, powered by Ubuntu Pro. + .. |app| replace:: Craft Application .. |app-command| replace:: .. |artifact| replace:: artifact diff --git a/docs/reference/changelog.rst b/docs/reference/changelog.rst index ca2d2e60e..5e1c5965b 100644 --- a/docs/reference/changelog.rst +++ b/docs/reference/changelog.rst @@ -38,7 +38,7 @@ Bug fixes Documentation ============= -- Add a :ref:`how-to-pack-a-pro-artifact` how-to document. +- Add a :ref:`how-to-pack-a-pro-artifact` how-to guide. For a complete list of commits, check out the `7.2.0`_ release on GitHub. From dea9324bfbba549056635c3994085e5e2e002a76 Mon Sep 17 00:00:00 2001 From: Callahan Kovacs Date: Tue, 11 Aug 2026 09:29:03 -0500 Subject: [PATCH 4/7] docs: feedback from PR Signed-off-by: Callahan Kovacs --- .../how-to-guides/pack-a-pro-artifact.rst | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst b/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst index 8ab5dd546..88dd8787d 100644 --- a/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst +++ b/docs/common/craft-application/how-to-guides/pack-a-pro-artifact.rst @@ -19,18 +19,18 @@ Enable guest attachment ----------------------- |app| makes use of Ubuntu Pro’s own support for LXD instances, but this support needs -to be explicitly enabled and configured. On a terminal, run: +to be explicitly enabled and configured. In a terminal, run: -.. terminal:: +.. code-block:: bash sudo pro config set lxd_guest_attach=available This command lets |app| attach its LXD instances to the system’s Pro subscription, and only needs to be executed once. -Next, restart LXD so that the new configuration takes effect: +Restart LXD so the new configuration takes effect: -.. terminal:: +.. code-block:: bash sudo snap restart lxd @@ -45,16 +45,16 @@ Next, determine which Pro services fit your needs. |app| supports the following - ``fips``, ``fips-updates`` or ``fips-preview``: If you need to deploy |an-artifact| in a highly regulated environment that processes sensitive data. -The desired Pro services don’t need to be enabled on your system, but they do need to be -available. Run ``pro status`` and check the ``ENTITLED`` column to check whether a service is -available. The Ubuntu Pro Client documentation has -`further information `__ -on each service. +The desired Pro services must be available. On a system with your Pro token +attached, run ``pro status`` and check the ``ENTITLED`` column for available +services. The Ubuntu Pro Client documentation has `detailed information on each service +`__. Pack the |artifact| ------------------- -Now you can pack the |artifact| with the desired services. Provide them to the ``--pro`` option: +Pack your Pro-compliant |artifact| with the ``pack`` command, listing the desired +services with the ``--pro`` option: .. code-block:: bash :substitutions: From 97e3da6e78ee8678cc6a35a44a295aef68cf9d57 Mon Sep 17 00:00:00 2001 From: Callahan Kovacs Date: Tue, 11 Aug 2026 09:40:04 -0500 Subject: [PATCH 5/7] ci: add zizmor workflow Signed-off-by: Callahan Kovacs --- .github/workflows/policy.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/policy.yaml b/.github/workflows/policy.yaml index 26f993bd8..2ad14fa3d 100644 --- a/.github/workflows/policy.yaml +++ b/.github/workflows/policy.yaml @@ -10,6 +10,9 @@ on: jobs: policy: uses: canonical/starflow/.github/workflows/policy.yaml@main + permissions: + contents: read + security-events: write python-scans: name: Security scan uses: canonical/starflow/.github/workflows/scan-python.yaml@main From 9e66207728ec2e2c5c70f72de9a6ff6b18055f87 Mon Sep 17 00:00:00 2001 From: Callahan Kovacs Date: Tue, 11 Aug 2026 10:11:33 -0500 Subject: [PATCH 6/7] docs: finalize changelog Signed-off-by: Callahan Kovacs --- docs/reference/changelog.rst | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/docs/reference/changelog.rst b/docs/reference/changelog.rst index 5e1c5965b..da626d272 100644 --- a/docs/reference/changelog.rst +++ b/docs/reference/changelog.rst @@ -15,7 +15,7 @@ Changelog For a complete list of commits, check out the `1.2.3`_ release on GitHub. -7.2.0 (unreleased) +7.2.0 (2028-08-11) ------------------ Application @@ -29,6 +29,11 @@ Commands - The ``init`` command now accepts the ``--base`` option to choose profile variants for specific bases. +Remote build +============ + +- Snap recipes now accept a build path. + Bug fixes ========= From 386d9225dc50dd9450e0a56cc2abbf72da917f34 Mon Sep 17 00:00:00 2001 From: Callahan Kovacs Date: Tue, 11 Aug 2026 10:15:32 -0500 Subject: [PATCH 7/7] ci: ignore .github/instructions Signed-off-by: Callahan Kovacs --- .prettierignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.prettierignore b/.prettierignore index 2f58d8a19..153594ba8 100644 --- a/.prettierignore +++ b/.prettierignore @@ -1,3 +1,4 @@ tests/**/*.yaml docs/.sphinx .github/skills +.github/instructions