[Impact]
This release brings changes to match the Contract Server new affordance, presentedAs, to present a resource via CLI with the appropriate name based on the contract definition. The main use for this functionality is to show CIS as USG on series where the latter is available, enabling user access to this new service.
Furthermore, these are the additional functionalities/bug fixes contained:
* Improvement on redaction of sensitive information in log files
* Support for getting AWS metadata through IPv6
* Ability to do a preflight query for contract/entitlements for a token without attaching
* Fix the return codes when attaching an already attached machine - (GH: #1867)
* Change the calls to livepatch to use the full path - (LP: #1951954)
See the changelog entry below for a full list of changes and bugs.
[Test Case]
The following development and SRU process was followed:
https://wiki.ubuntu.com/UbuntuAdvantageToolsUpdates
<DONE> The ubuntu-advantage-tools team will be in charge of attaching the artifacts and
console output of the appropriate run to the bug. ubuntu-advantage-tools team
members will not mark ‘verification-done’ until this has happened.
Integration test artifacts are attached to the bug.
[Regression Potential]
Most of the changes are adding new things and the integration tests make sure that the existing functionality is preserved.
Redacting the logs is still a work in progress, and to avoid problems we will only make the logs world readable in the future, when all cases where sensitive information can be logged are verified.
In postinst, we changed a dictionary iteration to the equivalent function implementation. Tests show that the return value is exactly the same, but we may be inadvertently adding a bug there.
In postrm, we are using a wildcard to remove gpg keys that matches the naming schema we have for files. There is a risk if someone names an unrelated apt gpg key with the ua prefix - it will end up being removed as well.
[Discussion]
This is the first version of the CIS/USG migration, and we do expect the security team to come with more requests/fixes on this in the future. However, we did agree to do that iteratively over SRUs.
The Xenial and Bionic series should see only UI text changes, preserving exactly the same functionality as before.
From Focal on, it is expected that USG will replace CIS. Being a superset of CIS, USG enables people interested in CIS to use the functionality without problems, and security will have documentation up to guide on that.
For the migration path, users on Focal which have already enabled CIS will see USG instead, while still keeping the functionality they enabled before.
`ua enable cis` will still work from Focal onwards with the same functionality as before, but informing the user that USG should be used instead, and pointing to relevant documentation.
[Changelog]
* d/control:
- Update homepage URL
* d/tools.postinst:
- Refactor to use valid_services
* New upstream release 27.5:
- aws: add support for the IPv6 metadata endpoint
- cis: update URL for the documentation
- cli:
+ add endpoint to simulate the status using a specific contract token
+ fix return code when attaching an already attached machine (GH: #1867)
+ fix security-status to consider all possible origins to show updates
+ include cloud build.info in the collect-logs tarball
+ only show services which exist in the contracts server in ua status
- docs: fix typos and wrong/outdated information
- livepatch: always use the full path in livepatch calls (LP: #1951954)
- logs:
+ improve rules to redact sensitive information from all log files
+ redact sensitive information from older unredacted log files
+ log errors from external software execution, for debugging purposes
- usg:
+ support the presentedAs affordance from the contract server, showing
services in the CLI with the appropriate names
+ replace the CIS entitlement by USG on Focal and onwards
Hello Renan, or anyone else affected,
Accepted ubuntu-
Please help us by testing this new package. See https:/
If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-
Further information regarding the verification process can be found at https:/
N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.