snap: Turn into strict snap

Signed-off-by: Daniel Schaefer <dhs@frame.work>

Author: JohnAZoidberg

.gitignore

@@ -27,3 +27,6 @@ dump.bmp
 OVMF.fd
 OVMF_CODE.fd
 OVMF_VARS.fd
+
+# Snap
+*.snap

README.md

@@ -32,9 +32,46 @@ You can find lots of examples in [EXAMPLES.md](./EXAMPLES.md).
   - Build from source
 - Homebrew
   - Add [this homebrew tap](https://github.com/ublue-os/homebrew-tap), then `brew install --cask framework-tool`
+- Snap (Not yet in the snap store!)
+  - `sudo snap install framework-tool`
+  - Then connect the required interfaces (see [Snap Interfaces](#snap-interfaces) below)
 - Cargo (Any distro)
   - `cargo install --locked framework_tool`
 
+#### Snap Interfaces
+
+The snap uses strict confinement. After installing, connect the required interfaces
+to allow access to the hardware:
+
+```sh
+# Required for most functionality (EC communication)
+sudo snap connect framework-tool:cros-ec
+sudo snap connect framework-tool:hardware-observe
+
+# Required for HID devices (touchpad, touchscreen, PD controller firmware)
+sudo snap connect framework-tool:hidraw
+
+# Required for USB devices (expansion cards, input modules, camera)
+sudo snap connect framework-tool:raw-usb
+
+# Required for NVMe firmware version detection
+sudo snap connect framework-tool:block-devices
+
+# Required for EC port I/O fallback (when cros_ec driver is unavailable)
+sudo snap connect framework-tool:io-ports-control
+
+# Required for SMBIOS table fallback via /dev/mem
+sudo snap connect framework-tool:physical-memory-observe
+```
+
+You can connect all interfaces at once:
+
+```sh
+for plug in cros-ec hardware-observe hidraw raw-usb block-devices io-ports-control physical-memory-observe; do
+  sudo snap connect framework-tool:$plug
+done
+```
+
 ### Windows
 
 ```

contrib/snap.md

@@ -0,0 +1,82 @@
+# Snap Package
+
+## Building
+
+Make sure `snapcraft` is installed:
+
+```sh
+sudo snap install snapcraft --classic
+```
+
+Build the snap:
+
+```sh
+snapcraft
+```
+
+This produces a file like `framework-tool_v0.6.1-20-gabda498ca6_amd64.snap`.
+
+To clean up build artifacts and start fresh:
+
+```sh
+snapcraft clean
+```
+
+## Installing Locally
+
+Install the locally built snap (bypasses store signature check):
+
+```sh
+sudo snap install --dangerous framework-tool_*.snap
+```
+
+## Connecting Interfaces
+
+The snap uses strict confinement, so hardware interfaces must be connected
+manually after install:
+
+```sh
+for plug in cros-ec hardware-observe hidraw raw-usb block-devices io-ports-control physical-memory-observe; do
+  sudo snap connect framework-tool:$plug
+done
+```
+
+Verify the connections:
+
+```sh
+snap connections framework-tool
+```
+
+## Testing
+
+```sh
+# Basic functionality
+sudo framework-tool --help
+sudo framework-tool --versions
+sudo framework-tool --esrt
+
+# EC communication (needs cros-ec + hardware-observe)
+sudo framework-tool --power
+sudo framework-tool --pdports
+
+# HID devices (needs hidraw)
+sudo framework-tool --touchpad-info
+
+# USB devices (needs raw-usb)
+sudo framework-tool --dp-hdmi-info
+sudo framework-tool --audio-card-info
+
+# NVMe (needs block-devices)
+sudo framework-tool --nvme-info
+```
+
+If a command fails with a permission error, check which interface it needs
+and make sure it is connected.
+
+## Publishing
+
+See: https://snapcraft.io/docs/releasing-your-app
+
+Note: Several interfaces (`block-devices`, `physical-memory-observe`,
+`io-ports-control`, `system-files`) are privileged and require a manual
+review by the snap store team before they can be used in a published snap.

snap/snapcraft.yaml

@@ -1,6 +1,12 @@
 name: framework-tool
+title: Framework Tool
 base: core24
 adopt-info: framework-tool
+license: BSD-2-Clause
+contact: https://github.com/FrameworkComputer/framework-system/issues
+issues: https://github.com/FrameworkComputer/framework-system/issues
+source-code: https://github.com/FrameworkComputer/framework-system
+website: https://frame.work
 summary: CLI tool to inspect and control Framework Computer systems
 description: |
   framework_tool is a CLI utility to interact with Framework Computer laptop
@@ -16,9 +22,18 @@ description: |
   Note: Most features require root privileges (sudo framework-tool ...).
 
 grade: stable
-confinement: classic
+confinement: strict
 compression: lzo
 
+# /dev/cros_ec needs ioctl access, which requires custom-device interface.
+# This needs a store assertion for the slot. For local testing use --devmode.
+plugs:
+  cros-ec:
+    interface: custom-device
+    custom-device: cros-ec
+    devices:
+      - /dev/cros_ec
+
 parts:
   framework-tool:
     plugin: rust
@@ -35,14 +50,14 @@ parts:
     override-pull: |
       craftctl default
       VERSION=$(craftctl get version)
-      if [ -z $VERSION ]; then
+      if [ -z "$VERSION" ] && git rev-parse --git-dir > /dev/null 2>&1; then
         VERSION=$(git describe --tags --abbrev=10)
-        craftctl set version=$VERSION
+        craftctl set version="$VERSION"
       fi
     override-build: |
       cd "${CRAFT_PART_SRC}"
       cargo build --release -p framework_tool --features nvidia
-      install -Dm755 target/release/framework_tool "${CRAFT_PART_INSTALL}/bin/framework_tool"
+      install -Dm755 "${CRAFT_PART_SRC}/target/release/framework_tool" "${CRAFT_PART_INSTALL}/bin/framework_tool"
       install -Dm644 "${CRAFT_PART_SRC}/completions/bash/framework_tool" \
         "${CRAFT_PART_INSTALL}/share/bash-completion/completions/framework_tool"
       install -Dm644 "${CRAFT_PART_SRC}/completions/zsh/_framework_tool" \
@@ -53,3 +68,17 @@ parts:
 apps:
   framework-tool:
     command: bin/framework_tool
+    plugs:
+      # EC communication via /dev/cros_ec ioctl
+      - cros-ec
+      # HID devices: touchpad, touchscreen, PD controller firmware
+      - hidraw
+      # USB devices: audio card, camera, USB hub, input modules
+      - raw-usb
+      # NVMe device access for firmware version detection
+      - block-devices
+      # /dev/mem for SMBIOS table fallback, /dev/port for EC port I/O
+      - physical-memory-observe
+      - io-ports-control
+      # /sys/firmware (SMBIOS/DMI, EFI ESRT), /sys/class/mei, hardware enumeration
+      - hardware-observe