snap: add initial snap packaging

[LucasAPayne]

This PR provides an initial snap build for vaultlocker. The snap uses strict confinement and needs the network, dm-crypt, and block-devices connections. This is just an initial build to allow making a snap recipe and getting this on the snap store, and there will be a follow-up PR to address any issues or anything missing.

Most notably, vaultlocker currently creates a systemd service for each registered encrypted device to allow automatic unlocking on boot. The snap cannot create a systemd service, and it will instead need a snap service to manage these devices. The device is still able to be controlled over the CLI; it's only the automatic unlocking that is currently affected. Because systemd appears in so many tests and has no effect on the snap other than printing an error, I have left it enabled. So while manually testing the snap, it will complain about the systemd service, but this does not prevent anything else from working. A follow-up PR will ensure the systemd service is used for a non-snap installation and the snap service is used for a snap installation.

Note that until the snap service is implemented, automatic unlock on boot will not work for the snap.

The udev adm calls that previously occurred during encryption have also been disabled. The snap cannot issue these commands. These commands were added as a workaround for an issue in older Ubuntu versions, and at least on Noble, the issue no longer occurs. A determination should be made whether these commands can be removed entirely.

Also, the snap will not use the default configuration path of /etc/vaultlocker/vaultlocker.conf. For now, the snap requires explicitly passing a config file with the --config option. This will also be addressed in a follow-up PR.

How to Test

Setup:

Install the snap based on this branch

snapcraft pack
snapcraft install --dangerous vaultlocker_0.1_amd64.snap

Add the required snap connections

sudo snap connect vaultlocker:network
sudo snap connect vaultlocker:dm-crypt
sudo snap connect vaultlocker:block-devices

• Prepare a disposable, unformatted disk.
• Prepare a test Vault deployment (directly or with a charm).
• Enable the AppRole auth method in Vault, and get the RoleID and a SecretID (example).
• Create a config file, making sure to populate the approle and secret_id fields with the values from the previous step.

Encrypt the device:

sudo vaultlocker --config <config_path> encrypt <device_path>

Verify that the device is now LUKS-formatted.

Links

Jira card: OPEN-4713

[Raven-182]

Thanks @LucasAPayne. I dont have permissions to start a review but this looks good to me as an initial template.

Could you add a note to the PR description making it clear that automatic unlock on boot will not work with the snap as part of this change?

[LucasAPayne]

Thank you for calling that out @Raven-182; I have updated the description.

[freyes]

Please add a new workflow to exercise this functionality

The new workflow should have (at least) the following steps:

• build the snap - https://github.com/marketplace/actions/snapcraft-action
• install it
• connect the interfaces, if needed
• run the --help command, and any other commands that can help to validate the snap is functional

[hmlanigan]

question: do you have a jira ticket or a note to enable this test assert and the code in shell.py?

[LucasAPayne]

The acceptance criteria in my next ticket for this snap includes re-enabling or entirely removing the udev calls. This was originally added as a workaround to ensure device UUIDs could be picked up in old Ubuntu/cryptsetup versions, and it's likely no longer needed.