Merge ~chad.smith/ubuntu/+source/ubuntu-advantage-tools:upload-release-26 into ubuntu/+source/ubuntu-advantage-tools:ubuntu/devel

[Chad Smith]

New upstream release of 26.1 into Hirsute.

We would like to preserve rich git commit history by adding an pkg/upload/26.1 tag
pkg/ubuntu/devel(hirsute) if possible. But, not certain how we do that as part of this PR review process.

Known lintian warnings in this version we plan on addressing for our 27.0 release before trying to upload to Hirsute during feature freeze[1]:

 - lintian issues:
     - https://github.com/canonical/ubuntu-advantage-client/issues/1384

PPA package pushed and building at https://launchpad.net/~chad.smith/+archive/ubuntu/uaclient-uploads

local tests can be run w/ tox -e py3/mypy/flake8 and are also run on every PR against ubuntu-advantage-client

Daily integration tests are also run on our Jenkins[2] (VPN needs to be active)

references:
[1] FFe bug for releasing 27.0 into hirsute in a couple weeks https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/1915354.

[2] Jenkins UA integration tests https://jenkins.ubuntu.com/server/view/ua/

[Chad Smith (chad.smith)]

----- Autopkgtest results: ---------

csmith@downtown:/tmp/ubuntu-advantage-client (ubuntu/devel)$ autopkgtest -o autopkgtest-ua-tools -U ../out/ubuntu-advantage-tools_26.1~21.04.1.dsc -- lxd ubuntu-daily:xenial
autopkgtest [14:10:51]: starting date: 2021-02-22
autopkgtest [14:10:51]: version 5.13.1
autopkgtest [14:10:51]: host downtown; command line: /usr/bin/autopkgtest -o autopkgtest-ua-tools -U '../out/ubuntu-advantage-tools_26.1~21.04.1.dsc' -- lxd ubuntu-daily:xenial
autopkgtest [14:11:01]: @@@@@@@@@@@@@@@@@@@@ test bed setup
tee: /proc/self/fd/2: Permission denied
Hit:1 http://archive.ubuntu.com/ubuntu xenial InRelease
Hit:2 http://security.ubuntu.com/ubuntu xenial-security InRelease
Hit:3 http://archive.ubuntu.com/ubuntu xenial-updates InRelease
Hit:4 http://archive.ubuntu.com/ubuntu xenial-backports InRelease
Reading package lists...
Reading package lists...
Building dependency tree...
Reading state information...
Calculating upgrade...
The following package was automatically installed and is no longer required:
  libfreetype6
Use 'apt autoremove' to remove it.
The following packages will be upgraded:
  libldap-2.4-2
1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 159 kB of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu xenial-updates/main amd64 libldap-2.4-2 amd64 2.4.42+dfsg-2ubuntu3.13 [159 kB]
Fetched 159 kB in 0s (218 kB/s)
(Reading database ... 25810 files and directories currently installed.)
Preparing to unpack .../libldap-2.4-2_2.4.42+dfsg-2ubuntu3.13_amd64.deb ...
Unpacking libldap-2.4-2:amd64 (2.4.42+dfsg-2ubuntu3.13) over (2.4.42+dfsg-2ubuntu3.12) ...
Processing triggers for man-db (2.7.5-1) ...
Setting up libldap-2.4-2:amd64 (2.4.42+dfsg-2ubuntu3.13) ...
Processing triggers for libc-bin (2.23-0ubuntu11.2) ...
autopkgtest [14:11:28]: testbed dpkg architecture: amd64
autopkgtest [14:11:29]: testbed running kernel: Linux 5.8.0-43-generic #49-Ubuntu SMP Fri Feb 5 03:01:28 UTC 2021
autopkgtest [14:11:29]: @@@@@@@@@@@@@@@@@@@@ source ../out/ubuntu-advantage-tools_26.1~21.04.1.dsc
Reading package lists...
Building dependency tree...
Reading state information...
Correcting dependencies...Starting pkgProblemResolver with broken count: 0
Starting 2 pkgProblemResolver with broken count: 0
Done
 Done
Starting pkgProblemResolver with broken count: 0
Starting 2 pkgProblemResolver with broken count: 0
Done
The following package was automatically installed and is no longer required:
  libfreetype6
Use 'apt autoremove' to remove it.
The following additional packages will be installed:
  binutils dpkg-dev libdpkg-perl make
Suggested packages:
  binutils-doc debian-keyring gcc | c-compiler make-doc
Recommended packages:
  gcc | c-compiler build-essential fakeroot libalgorithm-merge-perl
  libfile-fcntllock-perl
The following NEW packages will be installed:
  binutils dpkg-dev libdpkg-perl make
0 upgraded, 4 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
Need to get 3,242 kB of archives.
After this operation, 17.6 MB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu xenial-updates/ma...

[Bryce Harrington (bryce)]

### Packaging Review ###

Changelog entries look great (lots and lots of changes!)

Per the RELEASES.md documentation, the version number for hirsute should rather be just '26.1'. The ~NN.04.M suffix is only used on stable series. I've updated this manually, hopefully this is ok.

Beyond that, I just spot-checked commits to ./debian/.

In running debuild -S and debuild, I notice the packaging introduces some git delta. It's all just tmp build chaff, nothing that's actually an issue, and this is not at all unusual for packages, but if you're looking to polish the packaging might be worth tidying up:

$ debuild -S
...
Changes not staged for commit:
  (use "git add/rm <file>..." to update what will be committed)
  (use "git restore <file>..." to discard changes in working directory)
 deleted: .pytest_cache/README.md
 deleted: .pytest_cache/v/cache/nodeids
 deleted: .pytest_cache/v/cache/stepwise

$ debuild
...
Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
  (use "git restore <file>..." to discard changes in working directory)
 modified: .pytest_cache/README.md
 modified: .pytest_cache/v/cache/nodeids

Untracked files:
  (use "git add <file>..." to include in what will be committed)
 apt-hook/hook
 apt-hook/ubuntu-advantage.pot
 debian/files
 debian/ubuntu-advantage-pro.substvars
 debian/ubuntu-advantage-pro/

Most likely just stuff to add to .gitignore. The .pytest_cache directory is in the .git repository, but maybe it shouldn't be?

### Autopkgtest ###

Passed without issue.

### Lintian ###

I'm ignoring the lintian errors since sounds like you plan to investigate and address in the future, but just for feedback these are the errors/warnings that showed for me:

E: ubuntu-advantage-tools: no-debconf-config
W: ubuntu-advantage-tools source: build-depends-on-obsolete-package Build-Depends: dh-systemd => use debhelper (>= 9.20160709)
W: ubuntu-advantage-tools: groff-message usr/share/man/man1/ubuntu-advantage.1.gz command exited with status 2: /usr/lib/man-db/zsoelim | /usr/lib/man-db/manconv -f UTF-8:ISO-8859-1 -t UTF-8//IGNORE | preconv -e UTF-8 | groff -mandoc -Z -rLL=117n -rLT=117n -wmac -Tutf8
W: ubuntu-advantage-tools: groff-message usr/share/man/man1/ubuntu-advantage.1.gz troff: Signal 11 (core dumped)
W: ubuntu-advantage-tools source: package-uses-deprecated-debhelper-compat-version 9
W: ubuntu-advantage-tools: postinst-uses-db-input
W: ubuntu-advantage-pro: systemd-service-file-refers-to-unusual-wantedby-target lib/systemd/system/ua-auto-attach.service cloud-config.service

The man page core dumps happen to me for pretty much every package I do; I've never bothered to investigate and am guessing it's something quirky about my lxc environment.

### SRU text ###

I know this MP isn't an SRU, so am considering the SRU bug report just a draft, but I thought I'd give some feedback on it anyway.

"Version 27.0 will introduce the ability a new `ua fix <CVE_or_USN>` subcommand which will introspect the running system for a specific CVE or USN issue"

  - I think there's a small grammar issue there. Maybe drop "ability"?

"If we block the update to ubuntu-advantage-tools versio...

review: Approve

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
 new file mode 100644
index 0000000..1fdfc76
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,33 @@
+## Proposed Commit Message
+<!-- Include a proposed commit message because all PRs can be merged in a variety of ways by the reviewer -->
+
+> summary: no more than 70 characters
+>
+> A description of what the change being made is and why it is being
+> made, if the summary line is insufficient.  The blank line above is
+> required. This should be wrapped at 72 characters, but otherwise has
+> no particular length requirements.
+>
+> If you need to write multiple paragraphs, feel free.
+>
+> LP: #NNNNNNN (replace with the appropriate Launchpad bug reference if applicable)
+> Fixes: #NNNNNNN (replace with the appropriate github issue if applicable)
+
+## Test Steps
+<!-- Please include any steps necessary to verify (and reproduce if
+this is a bug fix) this change on a live deployed system,
+including any necessary configuration files, user-data,
+setup, and teardown. Scripts used may be attached directly to this PR. -->
+
+## Desired commit type::
+<!-- put an `x` in one merge type to allow the reviewer to merge for you -->
+ - [ ] Squash and merge: Using the "Proposed Commit Message"
+ - [ ] Create a merge commit and use "Proposed Commit Message"
+ - [ ] Rebase and merge, no merge commit, rely only on existing commit messages
+
+## Checklist:
+<!-- Go over all the following points, and put an `x` in all the boxes
+that apply. -->
+ - [ ] I have updated or added any unit tests accordingly
+ - [ ] I have updated or added any integration tests accordingly
+ - [ ] I have updated or added any documentation accordingly
diff --git a/.gitignore b/.gitignore
 new file mode 100644
index 0000000..2b2da67
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,24 @@
+artifacts/*
+*debhelper*
+debian/ubuntu-advantage-tools/
+debian/ubuntu-advantage-tools.substvars
+dev/entitlement-creds.json.*
+*.pyc
+*.pyo
+__pycache__
+.tox
+.pybuild
+.coverage
+.cache
+*.egg-info/
+.mypy_cache/
+
+# Ignore artifacts generated by bddeb
+*-1~bddeb*
+ubuntu-advantage-tools_*.orig.tar.gz
+ubuntu-advantage-tools_all.deb
+ubuntu_advantage_tools.dsc
+
+# test/jenkins artifacts
+pytest_results.xml
+reports/
diff --git a/.travis.yml b/.travis.yml
 deleted file mode 100644
index 9e571fa..0000000
--- a/.travis.yml
+++ /dev/null
@@ -1,83 +0,0 @@
-language: python
-dist: bionic
-
-install:
-  # Required so `git describe` will definitely find a tag; see
-  # https://github.com/travis-ci/travis-ci/issues/7422
-  - git fetch --unshallow
-  - make testdeps
-script:
-  - make test
-
-matrix:
-  fast_finish: true
-  include:
-    - python: 3.7
-      env: TOXENV=behave
-      script:
-          # bionic has lxd from deb installed, remove it first to avoid
-          # confusion over versions
-          - sudo apt-get remove --yes --purge lxd lxd-client
-          - sudo rm -Rf /var/lib/lxd
-          - sudo snap install lxd
-          - sudo lxd init --auto
-          - sudo usermod -a -G lxd $USER
-          - sg lxd -c 'make test'
-    - env:
-        PACKAGE_BUILD_SERIES=trusty
-      install:
-        - make travis-deb-install
-      script:
-        - make travis-deb-script
-    - env:
-        PACKAGE_BUILD_SERIES=xenial
-      install:
-        - make travis-deb-install
-      script:
-        - make travis-deb-script
-    - env:
-        PACKAGE_BUILD_SERIES=bionic
-      install:
-        - make travis-deb-install
-      script:
-        - make travis-deb-script
-    - env:
-        PACKAGE_BUILD_SERIES=eoan
-      install:
-        - make travis-deb-install
-      script:
-        - make travis-deb-script
-    - env:
-        PACKAGE_BUILD_SERIES=focal
-      install:
-        - make travis-deb-install
-      script:
-        - make travis-deb-script
-    - python: 3.4
-      env: TOXENV=py3-trusty,flake8-trusty
-      dist: trusty
-    - python: 3.5
-      env: TOXENV=py3-xenial,flake8-xenial
-      dist: xenial
-    - python: 3.6
-      env: TOXENV=py3-bionic,flake8-bionic
-    - python: 3.7
-      env: TOXENV=py3-eoan,flake8-eoan
-    - python: 3.8
-      env: TOXENV=py3,flake8
-    - python: 3.7
-      env: TOXENV=mypy
-    - python: 3.7
-      env: TOXENV=black
-  allow_failures:
-    - python: 3.7
-      env: TOXENV=behave
-      script:
-          # bionic has lxd from deb installed, remove it first to avoid
-          # confusion over versions
-          - sudo apt-get remove --yes --purge lxd lxd-client
-          - sudo rm -Rf /var/lib/lxd
-          - sudo snap install lxd
-          - sudo lxd init --auto
-          - sudo usermod -a -G lxd $USER
-          - sg lxd -c 'make test'
diff --git a/Jenkinsfile b/Jenkinsfile
 new file mode 100644
index 0000000..ebee6f9
--- /dev/null
+++ b/Jenkinsfile
@@ -0,0 +1,263 @@
+pipeline {
+    agent any
+
+    environment {
+        TMPDIR = "/tmp/$BUILD_TAG/"
+        UACLIENT_BEHAVE_JENKINS_BUILD_TAG = "${BUILD_TAG}"
+        UACLIENT_BEHAVE_JENKINS_CHANGE_ID = "${CHANGE_ID}"
+        UACLIENT_BEHAVE_BUILD_PR=1
+        UACLIENT_BEHAVE_CONTRACT_TOKEN = credentials('ua-contract-token')
+        UACLIENT_BEHAVE_AWS_ACCESS_KEY_ID = credentials('ua-aws-access-key-id')
+        UACLIENT_BEHAVE_AWS_SECRET_ACCESS_KEY = credentials(
+            'ua-aws-secret-access-key'
+        )
+        UACLIENT_BEHAVE_AZ_CLIENT_ID = credentials('ua-azure-client-id')
+        UACLIENT_BEHAVE_AZ_CLIENT_SECRET = credentials(
+            'ua-azure-client-secret'
+        )
+        UACLIENT_BEHAVE_AZ_TENANT_ID = credentials('ua-azure-tenant')
+        UACLIENT_BEHAVE_AZ_SUBSCRIPTION_ID = credentials(
+            'ua-azure-subscription-id'
+        )
+        UACLIENT_BEHAVE_CONTRACT_TOKEN_STAGING = credentials(
+            'ua-contract-token-staging'
+        )
+        JOB_SUFFIX = sh(returnStdout: true, script: "basename ${JOB_NAME}| cut -d'-' -f2").trim()
+    }
+
+    stages {
+        stage ('Setup Dependencies') {
+            steps {
+                deleteDir()
+                checkout scm
+                sh '''
+                python3 -m venv $TMPDIR
+                . $TMPDIR/bin/activate
+                pip install tox  # for tox supporting --parallel--safe-build
+                '''
+            }
+        }
+        stage ('Lint and Style') {
+            parallel {
+                stage("flake8") {
+                    steps {
+                        sh '''
+                        set +x
+                        . $TMPDIR/bin/activate
+                        tox --parallel--safe-build -e flake8
+                        '''
+                    }
+                }
+                stage("style") {
+                    steps {
+                        sh '''
+                        set +x
+                        . $TMPDIR/bin/activate
+                        tox --parallel--safe-build -e black
+                        '''
+                    }
+                }
+                stage("mypy") {
+                    steps {
+                        sh '''
+                        set +x
+                        . $TMPDIR/bin/activate
+                        tox --parallel--safe-build -e mypy
+                        '''
+                    }
+                }
+            }
+        }
+        stage ('Unit Tests') {
+            steps {
+                sh '''
+                set +x
+                . $TMPDIR/bin/activate
+                tox --parallel--safe-build -e py3
+                '''
+            }
+        }
+        stage ('Package builds') {
+            parallel {
+                stage ('Package build: 14.04') {
+                    environment {
+                        BUILD_SERIES = "trusty"
+                        SERIES_VERSION = "14.04"
+                        PKG_VERSION = sh(returnStdout: true, script: "dpkg-parsechangelog --show-field Version").trim()
+                        NEW_PKG_VERSION = "${PKG_VERSION}~${SERIES_VERSION}~${JOB_SUFFIX}"
+                        ARTIFACT_DIR = "${TMPDIR}${BUILD_SERIES}"
+                    }
+                    steps {
+                        sh '''
+                        set -x
+                        mkdir ${ARTIFACT_DIR}
+                        cp debian/changelog ${WORKSPACE}/debian/changelog-${SERIES_VERSION}
+                        sed -i "s/${PKG_VERSION}/${NEW_PKG_VERSION}/" ${WORKSPACE}/debian/changelog-${SERIES_VERSION}
+                        dpkg-source -l${WORKSPACE}/debian/changelog-${SERIES_VERSION} -b .
+                        sbuild --nolog --verbose --dist=${BUILD_SERIES} --no-run-lintian --append-to-version=~${SERIES_VERSION}  ../ubuntu-advantage-tools*${NEW_PKG_VERSION}*dsc
+                        cp ./ubuntu-advantage-tools*${SERIES_VERSION}*.deb ${ARTIFACT_DIR}/ubuntu-advantage-tools-${BUILD_SERIES}.deb
+                        cp ./ubuntu-advantage-pro*${SERIES_VERSION}*.deb ${ARTIFACT_DIR}/ubuntu-advantage-pro-${BUILD_SERIES}.deb
+                        '''
+                    }
+                }
+                stage ('Package build: 16.04') {
+                    environment {
+                        BUILD_SERIES = "xenial"
+                        SERIES_VERSION = "16.04"
+                        PKG_VERSION = sh(returnStdout: true, script: "dpkg-parsechangelog --show-field Version").trim()
+                        NEW_PKG_VERSION = "${PKG_VERSION}~${SERIES_VERSION}~${JOB_SUFFIX}"
+                        ARTIFACT_DIR = "${TMPDIR}${BUILD_SERIES}"
+                    }
+                    steps {
+                        sh '''
+                        set -x
+                        mkdir ${ARTIFACT_DIR}
+                        cp debian/changelog ${WORKSPACE}/debian/changelog-${SERIES_VERSION}
+                        sed -i "s/${PKG_VERSION}/${NEW_PKG_VERSION}/" ${WORKSPACE}/debian/changelog-${SERIES_VERSION}
+                        dpkg-source -l${WORKSPACE}/debian/changelog-${SERIES_VERSION} -b .
+                        sbuild --nolog --verbose --dist=${BUILD_SERIES} --no-run-lintian --append-to-version=~${SERIES_VERSION}  ../ubuntu-advantage-tools*${NEW_PKG_VERSION}*dsc
+                        cp ./ubuntu-advantage-tools*${SERIES_VERSION}*.deb ${ARTIFACT_DIR}/ubuntu-advantage-tools-${BUILD_SERIES}.deb
+                        cp ./ubuntu-advantage-pro*${SERIES_VERSION}*.deb ${ARTIFACT_DIR}/ubuntu-advantage-pro-${BUILD_SERIES}.deb
+                        '''
+                    }
+                }
+                stage ('Package build: 18.04') {
+                    environment {
+                        BUILD_SERIES = "bionic"
+                        SERIES_VERSION = "18.04"
+                        PKG_VERSION = sh(returnStdout: true, script: "dpkg-parsechangelog --show-field Version").trim()
+                        NEW_PKG_VERSION = "${PKG_VERSION}~${SERIES_VERSION}~${JOB_SUFFIX}"
+                        ARTIFACT_DIR = "${TMPDIR}${BUILD_SERIES}"
+                    }
+                    steps {
+                        sh '''
+                        set -x
+                        mkdir ${ARTIFACT_DIR}
+                        cp debian/changelog ${WORKSPACE}/debian/changelog-${SERIES_VERSION}
+                        sed -i "s/${PKG_VERSION}/${NEW_PKG_VERSION}/" ${WORKSPACE}/debian/changelog-${SERIES_VERSION}
+                        dpkg-source -l${WORKSPACE}/debian/changelog-${SERIES_VERSION} -b .
+                        sbuild --nolog --verbose --dist=${BUILD_SERIES} --no-run-lintian --append-to-version=~${SERIES_VERSION}  ../ubuntu-advantage-tools*${NEW_PKG_VERSION}*dsc
+                        cp ./ubuntu-advantage-tools*${SERIES_VERSION}*.deb ${ARTIFACT_DIR}/ubuntu-advantage-tools-${BUILD_SERIES}.deb
+                        cp ./ubuntu-advantage-pro*${SERIES_VERSION}*.deb ${ARTIFACT_DIR}/ubuntu-advantage-pro-${BUILD_SERIES}.deb
+                        '''
+                    }
+                }
+                stage ('Package build: 20.04') {
+                    environment {
+                        BUILD_SERIES = "focal"
+                        SERIES_VERSION = "20.04"
+                        PKG_VERSION = sh(returnStdout: true, script: "dpkg-parsechangelog --show-field Version").trim()
+                        NEW_PKG_VERSION = "${PKG_VERSION}~${SERIES_VERSION}~${JOB_SUFFIX}"
+                        ARTIFACT_DIR = "${TMPDIR}${BUILD_SERIES}"
+                    }
+                    steps {
+                        sh '''
+                        set -x
+                        mkdir ${ARTIFACT_DIR}
+                        cp debian/changelog ${WORKSPACE}/debian/changelog-${SERIES_VERSION}
+                        sed -i "s/${PKG_VERSION}/${NEW_PKG_VERSION}/" ${WORKSPACE}/debian/changelog-${SERIES_VERSION}
+                        dpkg-source -l${WORKSPACE}/debian/changelog-${SERIES_VERSION} -b .
+                        sbuild --nolog --verbose --dist=${BUILD_SERIES} --no-run-lintian --append-to-version=~${SERIES_VERSION}  ../ubuntu-advantage-tools*${NEW_PKG_VERSION}*dsc
+                        cp ./ubuntu-advantage-tools*${SERIES_VERSION}*.deb ${ARTIFACT_DIR}/ubuntu-advantage-tools-${BUILD_SERIES}.deb
+                        cp ./ubuntu-advantage-pro*${SERIES_VERSION}*.deb ${ARTIFACT_DIR}/ubuntu-advantage-pro-${BUILD_SERIES}.deb
+                        '''
+                    }
+                }
+            }
+        }
+        stage ('Integration Tests') {
+            parallel {
+                stage("lxc 14.04") {
+                    environment {
+                        UACLIENT_BEHAVE_DEBS_PATH = "${TMPDIR}trusty/"
+                        UACLIENT_BEHAVE_ARTIFACT_DIR = "${TMPDIR}artifacts/behave-lxd-14.04"
+                    }
+                    steps {
+                        sh '''
+                        set +x
+                        . $TMPDIR/bin/activate
+                        tox --parallel--safe-build -e behave-lxd-14.04
+                        '''
+                    }
+                }
+                stage("lxc 16.04") {
+                    environment {
+                        UACLIENT_BEHAVE_DEBS_PATH = "${TMPDIR}xenial/"
+                        UACLIENT_BEHAVE_ARTIFACT_DIR = "${TMPDIR}artifacts/behave-lxd-16.04"
+                    }
+                    steps {
+                        sh '''
+                        set +x
+                        . $TMPDIR/bin/activate
+                        tox --parallel--safe-build -e behave-lxd-16.04
+                        '''
+                    }
+                }
+                stage("lxc 18.04") {
+                    environment {
+                        UACLIENT_BEHAVE_DEBS_PATH = "${TMPDIR}bionic/"
+                        UACLIENT_BEHAVE_ARTIFACT_DIR = "${TMPDIR}artifacts/behave-lxd-18.04"
+                    }
+                    steps {
+                        sh '''
+                        set +x
+                        . $TMPDIR/bin/activate
+                        tox --parallel--safe-build -e behave-lxd-18.04
+                        '''
+                    }
+                }
+                stage("lxc vm 20.04") {
+                    environment {
+                        UACLIENT_BEHAVE_DEBS_PATH = "${TMPDIR}focal/"
+                        UACLIENT_BEHAVE_ARTIFACT_DIR = "${TMPDIR}artifacts/behave-vm-20.04"
+                    }
+                    steps {
+                        sh '''
+                        set +x
+                        . $TMPDIR/bin/activate
+                        tox --parallel--safe-build -e behave-vm-20.04
+                        '''
+                    }
+                }
+                stage("awspro 18.04") {
+                    environment {
+                        UACLIENT_BEHAVE_DEBS_PATH = "${TMPDIR}bionic/"
+                        UACLIENT_BEHAVE_ARTIFACT_DIR = "${TMPDIR}artifacts/behave-awspro-18.04"
+                    }
+                    steps {
+                        sh '''
+                        set +x
+                        . $TMPDIR/bin/activate
+                        tox --parallel--safe-build -e behave-awspro-18.04
+                        '''
+                    }
+                }
+            }
+        }
+    }
+    post {
+        always {
+            script {
+                try {
+                    sh '''
+                    set +x
+                    DATE=`date -d 'now+1day' +%m/%d/%Y`
+                    git clone https://github.com/canonical/server-test-scripts.git
+                    python3 server-test-scripts/ubuntu-advantage-client/lxd_cleanup.py --prefix ubuntu-behave-test-$CHANGE_ID --before-date $DATE || true
+                    '''
+
+                    junit "pytest_results.xml"
+                    junit "reports/*.xml"
+                } catch (Exception e) {
+                    echo e.toString()
+                    currentBuild.result = 'UNSTABLE'
+                }
+                try {
+                    archiveArtifacts "/tmp/${BUILD_TAG}/artifacts/**/*"
+                } catch (Exception e) {
+                    echo "No integration test artifacts found. Presume success."
+                }
+            }
+        }
+    }
+}
diff --git a/Makefile b/Makefile
index d52d1e0..e8ce957 100644
--- a/Makefile
+++ b/Makefile
@@ -27,8 +27,12 @@ test:
 	@tox
 
 testdeps:
-	pip install -U six
+ifneq (,$(findstring trusty,$(TOXENV)))
+	@echo Pinning virtualenv to 20.0.31 on trusty because 32 breaks py3.4
+	pip install virtualenv==20.0.31
+endif
 	pip install tox
+	pip install tox-pip-version
 
 travis-deb-install:
 	git fetch --unshallow
@@ -48,6 +52,8 @@ travis-deb-script:
 	# Use this to get a new shell where we're in the sbuild group
 	sudo -E su ${USER} -c 'mk-sbuild ${PACKAGE_BUILD_SERIES}'
 	sudo -E su ${USER} -c 'sbuild --nolog --verbose --dist=${PACKAGE_BUILD_SERIES} ../ubuntu-advantage-tools*.dsc'
+	cp ./ubuntu-advantage-tools*.deb ubuntu-advantage-tools-${PACKAGE_BUILD_SERIES}.deb
+	cp ./ubuntu-advantage-pro*.deb ubuntu-advantage-tools-pro-${PACKAGE_BUILD_SERIES}.deb
 
 
 .PHONY: build clean test testdeps demo
diff --git a/README.md b/README.md
index 10e88d2..c45c58b 100644
--- a/README.md
+++ b/README.md
@@ -1,22 +1,122 @@
 # Ubuntu Advantage Client
 
-[![Build Status](https://travis-ci.org/CanonicalLtd/ubuntu-advantage-client.svg?branch=master)](https://travis-ci.org/CanonicalLtd/ubuntu-advantage-client)
+[![Build Status](https://travis-ci.com/canonical/ubuntu-advantage-client.svg?branch=master)](https://travis-ci.com/github/canonical/ubuntu-advantage-client)
 
 The Ubuntu Advantage client provides users with a simple mechanism to
 view, enable, and disable offerings from Canonical on their system. The
 following entitlements are supported:
 
 - [Common Criteria EAL2 certification artifacts provisioning](https://ubuntu.com/cc-eal)
-- [Canonical CIS Benchmark Audit Tool](https://ubuntu.com/cis)
+- [Canonical CIS Benchmark Audit Tool](https://ubuntu.com/cis-audit)
 - [Ubuntu Extended Security Maintenance](https://ubuntu.com/esm)
 - [FIPS 140-2 Certified Modules](https://ubuntu.com/fips)
-- [FIPS 140-2 Non-Certified Module Updates](https://ubuntu.com/fips-updates)
+- [FIPS 140-2 Non-Certified Module Updates](https://ubuntu.com/fips)
 - [Livepatch Service](https://www.ubuntu.com/livepatch)
 
 ## Obtaining the Client
 
-The client comes pre-installed on all Ubuntu systems. Users can run the
-`ua` command to learn more or view the manpage.
+The client comes pre-installed on all Ubuntu systems in the debian packages
+`ubuntu-advantage-tools` package. Ubuntu Pro images on AWS and Azure Ubuntu Pro
+images will also contain `ubuntu-advantage-pro` which automates machine attach
+on custom AWS and Azure images.
+
+Users can manually run the `ua` command to learn more or view the manpage.
+
+## Terminology
+ The following vocabulary is used to describe different aspects of the work
+Ubuntu Advantage Client performs:
+
+| Term | Meaning |
+| -------- | -------- |
+| UA Client | The python command line client represented in this ubuntu-advantage-client repository. It is installed on each Ubuntu machine and is the entry-point to enable any Ubuntu Advantage commercial service on an Ubuntu machine. |
+| Contract Server | The backend service exposing a REST API to which UA Client authenticates in order to obtain contract and commercial service information and manage which support services are active on a machine.|
+| Entitlement/Service | An Ubuntu Advantage commercial support service such as FIPS, ESM, Livepatch, CIS-Audit to which a contract may be entitled |
+| Affordance | Service-specific list of applicable architectures and Ubuntu series on which a service can run |
+| Directives | Service-specific configuration values which are applied to a service when enabling that service |
+| Obligations | Service-specific policies that must be instrumented for support of a service. Example: `enableByDefault: true` means that any attached machine **MUST** enable a service on attach |
+
+
+## Architecture
+Ubuntu Advantage client, hereafter "UA client", is python3-based command line
+utility. It provides a CLI to attach, detach, enable,
+disable and check status of support related services.
+
+The package `ubuntu-advantage-tools` also provides a C++ APT hook which helps
+advertise ESM service and available packages in MOTD and during various apt
+commands.
+
+The `ubuntu-advantage-pro` package delivers auto-attach auto-enable
+functionality via init scripts and systemd services for various cloud
+platforms.
+
+By default, Ubuntu machines are deployed in an unattached state. A machine can
+get manually or automatically attached to a specific contract by interacting
+with the Contract Server REST API. Any change in state of services or machine
+attach results in additional interactions with the Contract Server API to
+validate such operations. The contract server API is described by the
+[ua-contracts openapi spec](https://github.com/CanonicalLtd/ua-contracts/blob/develop/docs/contracts.yaml).
+
+### Attaching a machine
+Each Ubuntu SSO account holder has access to one or more contracts. To attach
+a machine to an Ubuntu Advantage contract:
+
+* An Ubuntu SSO account holder must obtain a contract token from
+https://ubuntu.com/advantage.
+* Run `sudo ua attach <contractToken>` on the machine
+  - Ubuntu Pro images for AWS and Azure perform an auto-attach without tokens
+* UA Client reads config from /etc/ubuntu-advantage/uaclient.conf to obtain
+  the contract_url (default: https://contracts.canonical.com)
+* UA Client POSTs to the Contract Server API @
+  <contract_url>/api/v1/context/machines/token providing the \<contractToken\>
+* The Contract Server responds with a JSON blob containing an unique machine
+  token, service credentials, affordances, directives and obligations to allow
+  enabling and disabling Ubuntu Advantage services
+* UA client writes the machine token API response to the root-readonly
+  /var/lib/ubuntu-advantage/machine-token.json
+* UA client auto-enables any services defined with
+  `obligations:{enableByDefault: true}`
+
+### Enabling a service
+Each service controlled by UA client will have a python module in
+uaclient/entitlements/\*.py which handles setup and teardown of services when
+enabled or disabled.
+
+If a contract entitles a machine to a service, `root` user can enable the
+service with `ua enable <service>`.  If a service can be disabled
+`ua disabled <service>` will be permitted.
+
+The goal of the UA client is to remain simple and flexible and let the
+contracts backend drive dynamic changes in contract offerings and constraints.
+In pursuit of that goal, the UA client obtains most of it's service constraints
+from a machine token that it obtains from the Contract Server API.
+
+The UA Client is simple in that it relies on the machine token on the attached
+machine to describe whether a service is applicable for an environment and what
+configuration is required to properly enable that service.
+
+Any interactions with the Contract server API are defined as UAContractClient
+class methods in [uaclient/contract.py](uaclient/contract.py).
+
+## Directory layout
+The following describes the intent of UA client related directories:
+
+
+| File/Directory | Intent |
+| -------- | -------- |
+| ./tools | Helpful scripts used to publish, release or test various aspects of UA client |
+| ./features/ | Behave BDD integration tests for UA Client
+| ./uaclient/ | collection of python modules which will be packaged into ubuntu-advantage-tools package to deliver the UA Client CLI |
+| uaclient.entitlements | Service-specific \*Entitlement class definitions which perform enable, disable, status, and entitlement operations etc. All classes derive from base.py:UAEntitlement and many derive from repo.py:RepoEntitlement |
+| ./uaclient/cli.py | The entry-point for the command-line client
+| ./uaclient/clouds/ | Cloud-platform detection logic used in Ubuntu Pro to determine if a given should be auto-attached to a contract |
+| uaclient.contract | Module for interacting with the Contract Server API |
+| ./demo | Various stale developer scripts for setting up one-off demo environments. (Not needed often)
+| ./apt-hook/ | the C++ apt-hook delivering MOTD and apt command notifications about UA support services |
+| ./apt-conf.d/ | apt config files delivered to /etc/apt/apt-conf.d to automatically allow unattended upgrades of ESM  security-related components |
+| /etc/ubuntu-advantage/uaclient.conf | Configuration file for the UA client.|
+| /var/lib/ubuntu-advantage/private | `root` read-only directory containing Contract API responses, machine-tokens and service credentials |
+| /var/log/ubuntu-advantage.log | `root` read-only log of ubuntu-advantage operations |
+
 
 ## Testing
 
@@ -42,19 +142,49 @@ directory and consist of two parts: `.feature` files that define the
 tests we want to run, and `.py` files which implement the underlying
 logic for those tests.
 
+By default, integration tests will do the folowing on a given cloud platform:
+ * Launch an instance running latest daily image of the target Ubuntu release
+ * Add the Ubuntu advantage client daily build PPA: [ppa:canonical-server/ua-client-daily](https://code.launchpad.net/~canonical-server/+archive/ubuntu/ua-client-daily)
+ * Install the appropriate ubuntu-advantage-tools and ubuntu-advantage-pro deb
+ * Stop the instance and snapshot it creating an updated bootable image for
+   test runs
+ * Launch a fresh instance based on the boot-image created and exercise tests
+
+The testing can be overridden to run using a local copy of the ubuntu-advantage-client source code instead of the daily PPA by providing the following environment variable to the behave test runner.
+```UACLIENT_BEHAVE_BUILD_PR=1```
+
 To run the tests, you can use `tox`:
 
 ```shell
-tox -e behave
+tox -e behave-20.04
 ```
 
 or, if you just want to run a specific file, or a test within a file:
 
 ```shell
-tox -e behave features/unattached_commands.feature
-tox -e behave features/unattached_commands.feature:55
+tox -e behave-20.04 features/unattached_commands.feature
+tox -e behave-20.04 features/unattached_commands.feature:55
 ```
 
+As can be seen, this will run behave tests only for release 20.04 (Focal Fossa). We are currently
+supporting 4 distinct releases:
+
+* 20.04 (Focal Fossa)
+* 18.04 (Bionic Beaver)
+* 16.04 (Xenial Xerus)
+* 14.04 (Trusty Tahr)
+
+Therefore, to change which release to run the behave tests against, just change the release version
+on the behave command.
+
+Furthermore, when developing/debugging a new scenario:
+
+ 1. Add a `@wip` tag decorator on the scenario
+ 2. To only run @wip scenarios run: `tox -e behave-20.04 -- -w`
+ 4. If you want to use a debugger:
+    a. Add ipdb to integration-requirements.txt
+    b. Add ipdb.set_trace() in the code block you wish to debug
+
 (If you're getting started with behave, we recommend at least reading
 through [the behave
 tutorial](https://behave.readthedocs.io/en/latest/tutorial.html) to get
@@ -104,25 +234,138 @@ you need to add `-D reuse_container=container_name`:
 tox -e behave -D reuse_container=container_name
 ```
 
+#### Integration testing on EC2
+The following tox environments allow for testing focal on EC2:
+
+```
+  # To test ubuntu-pro-images on EC2
+  tox -e behave-awspro-20.04
+  # To test Canonical cloud images (non-ubuntu-pro) on EC2
+  tox -e behave-awsgeneric-20.04
+```
+
+To run the test for a different release, just update the release version string. For example,
+to run AWS pro xenial tests, you can run:
+
+```
+tox -e behave-awspro-16.04
+```
+
+In order to run EC2 tests the following environment variables are required:
+  - UACLIENT_BEHAVE_AWS_ACCESS_KEY_ID
+  - UACLIENT_BEHAVE_AWS_SECRET_ACCESS_KEY
+
+
+To specifically run non-ubuntu pro tests using canonical cloud-images an
+additional token obtained from https://ubuntu.com/advantage needs to be set:
+  - UACLIENT_BEHAVE_CONTRACT_TOKEN=<your_token>
+
+By default, the public AMIs for Ubuntu Pro testing used for each Ubuntu
+release are defined in features/aws-ids.yaml. These ami-ids are determined by
+running `./tools/refresh-aws-pro-ids`.
+
+Integration tests will read features/aws-ids.yaml to determine which default
+AMI id to use for each supported Ubuntu release.
+
+To update `features/aws-ids.yaml`, run `./tools/refresh-aws-pro-ids` and put up
+a pull request against this repo to updated that content from the ua-contracts
+marketplace definitions.
+
+* To manually run EC2 integration tests using packages from `ppa:canonical-server/ua-client-daily` provide the following environment vars:
+
+```sh
+UACLIENT_BEHAVE_AWS_ACCESS_KEY_ID=<blah> UACLIENT_BEHAVE_AWS_SECRET_KEY=<blah2> tox -e behave-awspro-20.04
+```
+
+* To manually run EC2 integration tests with a specific AMI Id provide the
+following environment variable to launch your specfic  AMI instead of building
+a daily ubuntu-advantage-tools image.
+```sh
+UACLIENT_BEHAVE_REUSE_IMAGE=your-custom-ami tox -e behave-awspro-20.04
+```
+
+#### Integration testing on Azure
+The following tox environments allow for testing focal on Azure:
+
+```
+  # To test ubuntu-pro-images on EC2
+  tox -e behave-azurepro-20.04
+  # To test Canonical cloud images (non-ubuntu-pro) on EC2
+  tox -e behave-azuregeneric-20.04
+```
+
+To run the test for a different release, just update the release version string. For example,
+to run AWS pro xenial tests, you can run:
+
+```
+tox -e behave-azurepro-16.04
+```
+
+In order to run EC2 tests the following environment variables are required:
+  - UACLIENT_BEHAVE_AZ_CLIENT_ID
+  - UACLIENT_BEHAVE_AZ_CLIENT_SECRET
+  - UACLIENT_BEHAVE_AZ_SUBSCRIPTION_ID
+  - UACLIENT_BEHAVE_AZ_TENANT_ID
+
+
+To specifically run non-ubuntu pro tests using canonical cloud-images an
+additional token obtained from https://ubuntu.com/advantage needs to be set:
+  - UACLIENT_BEHAVE_CONTRACT_TOKEN=<your_token>
+
+* To manually run Azure integration tests using packages from `ppa:canonical-server/ua-client-daily` provide the following environment vars:
+
+```sh
+UACLIENT_BEHAVE_AZ_CLIENT_ID=<blah> UACLIENT_BEHAVE_AZ_CLIENT_SECRET=<blah2> UACLIENT_BEHAVE_AZ_SUBSCRIPTION_ID=<blah3> UACLIENT_BEHAVE_AZ_TENANT_ID=<blah4> tox -e behave-azurepro-20.04
+```
+
+* To manually run Azure integration tests with a specific Image Id provide the
+following environment variable to launch your specfic Image Id instead of building
+a daily ubuntu-advantage-tools image.
+```sh
+UACLIENT_BEHAVE_REUSE_IMAGE=your-custom-image-id tox -e behave-awspro-20.04
+```
+
 ## Building
 
-The packaging for the UA client package (ubuntu-advantage-tools) is
-in-tree, so you can build the package the way you would normally build
-a Debian package:
+Creating ubuntu-advantage-tools and ubuntu-advantage-pro is created from the
+debian/control file in this repository. You can build the
+package the way you would normally build a Debian package:
+
 
 ```shell
-dpkg-buildpackage
+dpkg-buildpackage -us -uc
 ```
 
-or, if you want to build for a target release other than the release
-you're on, [configure sbuild](https://wiki.ubuntu.com/SimpleSbuild) and
+**Note** It will build the package with dependencies for the Ubuntu release on
+which you are building, so it's best to build in a container of kvm for the
+release you are targeting.
+
+OR, if you want to build for a target release other than the release
+you're on:
+
+### using sbuild
+[configure sbuild](https://wiki.ubuntu.com/SimpleSbuild) and
 use that for the build:
 
+
 ```shell
 debuild -S
 sbuild --dist=<target> ../ubuntu-advantage-tools_*.dsc
 ```
 
+### Setting up an lxc development container
+```shell
+lxc launch ubuntu-daily:trusty dev-t -c user.user-data="$(cat tools/ua-dev-cloud-config.yaml)"
+lxc exec dev-t bash
+```
+
+### Setting up a kvm development environment with multipass
+**Note:** There is a sample procedure documented in tools/multipass.md as well.
+```shell
+multipass launch daily:focal -n dev-f --cloud-init tools/ua-dev-cloud-config.yaml
+multipass connect dev-f
+```
+
 ## Code Formatting
 
 The `ubuntu-advantage-client` code base is formatted using
@@ -151,15 +394,26 @@ the project, you should install them via `dev-requirements.txt`.)
 On Launchpad, there is a [daily build recipe](https://code.launchpad.net/~canonical-server/+recipe/ua-client-daily),
 which will build the client and place it in the [ua-client-daily PPA](https://code.launchpad.net/~canonical-server/+archive/ubuntu/ua-client-daily).
 
-## Demo
+## Remastering custom golden images based on Ubuntu PRO
 
-Users can demo the client with a local backend. This can be done with
-the following:
+Vendors who wish to provide custom images based on Ubuntu PRO images can
+follow the procedure below:
 
-```shell
-# Set up ua-contracts in a docker container in a bionic lxc on port 3000
-make demo
-# Set up two clients pointing at the local contract server
-./demo/run-uaclient --series disco
-./demo/run-uaclient --series xenial -b multipass
+* Launch the Ubuntu PRO golden image
+* Customize your golden image as you see fit
+* If `ua status` shows attached, remove the UA artifacts to allow clean
+  auto-attach on subsequent cloned VM launches
+```bash
+sudo ua detach
+sudo rm -rf /var/log/ubuntu-advantage.log  # to remove credentials and tokens from logs
 ```
+* Remove `cloud-init` first boot artifacts so the cloned VM boot is seen as a first boot
+```bash
+sudo cloud-init clean --logs
+sudo shutdown -h now
+```
+* Use your cloud platform to clone or snapshot this VM as a golden image
+
+
+## Releasing ubuntu-adantage-tools
+see [RELEASES.md](RELEASES.md)
diff --git a/RELEASES.md b/RELEASES.md
 new file mode 100644
index 0000000..e31dc37
--- /dev/null
+++ b/RELEASES.md
@@ -0,0 +1,63 @@
+# Ubuntu Advantage Client Releases
+
+## Release versioning schemes:
+
+Below are the versioning schemes used for publishing debs:
+
+| Build target | Version Format |
+| -------- | -------- |
+| Devel series upstream release | XX.YY |
+| Devel series bugfix release | XX.YY.Z~ubuntu1|
+| Stable series release | XX.YY~ubuntu1~18.04.1|
+| [Daily Build Recipe](https://code.launchpad.net/~canonical-server/+recipe/ua-client-daily) | XX.YY+<revtime>-g<commitish>~ubuntu1~18.04.1 |
+| Ubuntu PRO series release | binary copies of Daily PPA |
+
+## Supported upgrade use-cases based on version formats
+
+| Upgrade path | Version diffs |
+| LTS to LTS | 20.3~ubuntu1~14.04.1 -> 20.3~ubuntu1~16.04.1 |
+| LTS to Daily PPA | 20.3~ubuntu1~14.04.1 -> 20.3+202004011202~ubuntu1~14.04.1 |
+| Ubuntu PRO to latest <series>-updates | 20.3+202004011202~ubuntu1~14.04.1 -> 20.4~ubuntu1~14.04.1 |
+| Ubuntu PRO to Daily PPA | 20.3+202004011202~ubuntu1~14.04.1 -> 20.4+202004021202~ubuntu1~14.04.1 |
+
+
+## Devel Release Process
+
+Below is the procedure used to release ubuntu-advantage-client to an Ubuntu series:
+
+ 1. git-ubuntu clone ubuntu-advantage-tools; cd ubuntu-advantage-tools
+ 2. git remote add upstream [e-mail]:canonical/ubuntu-advantage-client.git
+ 3. git fetch upstream
+ 4. git checkout upstream/release-24
+ 5. git tag -a 24.3
+ 6. git rebase --onto pkg/ubuntu/devel 24.2 24.3
+ 7. git checkout -b pkg-upload-24.3
+ 8. debuild -S
+ 9. dput  ppa:chad.smith/ua-client-uploads ./ubuntu-advantage-tools_24.3_source.changes
+ 10. create a release tarfile/changes file using uss-tableflip's build-package script
+```
+ ./tools/make-release --series <SERIES> --ppa <PPA_URL_FOR_TEST_UPLOADS>
+ # follow printed procedure for dput to test PPA, and tag the released commitish
+```
+ 11. Create a merge proposal such as [24.2 PR](https://code.launchpad.net/~chad.smith/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/+merge/385073), [24.3 PR](https://code.launchpad.net/~chad.smith/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/+merge/389745)
+ 11. For SRUs: Create an "upload a new version bug" in https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bugs
+ 12. Describe the need, provide testing PPA and describe test instructions
+ 13. Ping appropriate maintainer about upload and verification
+ 14. Validate tests, accept upload and ship it
+
+Previous release bugs:
+| ------- |
+| [20.3 Focal](https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/1869980) |
+
+
+## Ubuntu PRO Release Process
+
+Manually perform a binary package copy from Daily PPA to Premium PPA and notify image creators
+
+ 1. [Open Daily PPA copy-package operation](https://code.launchpad.net/~canonical-server/+archive/ubuntu/ua-client-daily/+copy-packages)
+ 2. Check Trusty, Xenial, Bionic package
+ 3. Select Destination PPA: UA Client Premium [~canonical-server/ubuntu/ua-client-premium]
+ 4. Select Destination series: The same series
+ 5. Copy options: "Copy existing binaries
+ 6. Click Copy packages
+ 7. Notify Pro Image creatros about expected Premium PPA version (patviafore/rcj)
diff --git a/apt-hook/hook.cc b/apt-hook/hook.cc
index 56032f4..ed009de 100644
--- a/apt-hook/hook.cc
+++ b/apt-hook/hook.cc
@@ -33,8 +33,10 @@
 #include <locale.h>
 
 struct result {
-   int enabled_esms;
-   int disabled_esms;
+   int enabled_esms_i;
+   int disabled_esms_i;
+   int enabled_esms_a;
+   int disabled_esms_a;
 };
 
 // Return parent pid of specified pid, using /proc (pid might be self)
@@ -122,10 +124,22 @@ static void check_esm_upgrade(pkgCache::PkgIterator pkg, pkgPolicy *policy, resu
 	 // TODO: Just look at the origin, not pinning.
 	 if (pf.File().Archive() != 0 && pf.File().Origin() == std::string("UbuntuESM"))
 	 {
+            // Xenial and later should not be advertising unauthenticated ESM Infra apt repos
 	    if (policy->GetPriority(pf.File()) == -32768)
-	       res.disabled_esms++;
+	       res.disabled_esms_i++;
 	    else
-	       res.enabled_esms++;
+	       res.enabled_esms_i++;
+
+	    return;
+	 }
+
+	 if (pf.File().Archive() != 0 && pf.File().Origin() == std::string("UbuntuESMApps"))
+	 {
+            // Xenial and later should not be advertising unauthenticated ESM Apps apt repos
+	    if (policy->GetPriority(pf.File()) == -32768)
+	       res.disabled_esms_a++;
+	    else
+	       res.enabled_esms_a++;
 
 	    return;
 	 }
@@ -187,15 +201,16 @@ int main(int argc, char *argv[])
    //    assert(ppid == getppid_of("self"));
    // }
    assert(cmdline_eligible(make_cmdline("apt\0update\0")));
-   assert(cmdline_eligible(make_cmdline("apt-get\0update\0")));
-   assert(!cmdline_eligible(make_cmdline("apt-get\0install\0")));
-   assert(!cmdline_eligible(make_cmdline("apt\0install\0")));
    assert(!cmdline_eligible(make_cmdline("apt\0install\0")));
    assert(cmdline_eligible(make_cmdline("aptitude\0upgrade\0")));
    assert(cmdline_eligible(make_cmdline("aptitude\0update\0")));
    command_used = "";
 
-   result res = {0, 0};
+   result res = {0, 0, 0, 0};
+
+   // useful for testing
+   if (has_arg(argv, "test"))
+      command_used = "update";
 
    if (has_arg(argv, "test") || cmdline_eligible(getcmdline(getppid_of(getppid_of("self")))))
       get_update_count(res);
@@ -205,27 +220,51 @@ int main(int argc, char *argv[])
       return 1;
    }
 
-   if (res.enabled_esms > 0 && (command_used == "update"))
+   if (command_used == "update")
    {
-      ioprintf(std::cout,
-               ngettext("%d of the updates is from UA Infrastructure ESM.",
-                        "%d of the updates are from UA Infrastructure ESM.",
-                        res.enabled_esms),
-               res.enabled_esms);
-      ioprintf(std::cout, "\n");
+      if (res.enabled_esms_i > 0)
+      {
+         ioprintf(std::cout,
+                  ngettext("%d of the updates is from UA Infra: ESM.",
+                           "%d of the updates are from UA Infra: ESM.",
+                           res.enabled_esms_i),
+                  res.enabled_esms_i);
+         ioprintf(std::cout, "\n");
+      }
+      if (res.enabled_esms_a > 0)
+      {
+         ioprintf(std::cout,
+                  ngettext("%d of the updates is from UA Apps: ESM.",
+                           "%d of the updates are from UA Apps: ESM.",
+                           res.enabled_esms_a),
+                  res.enabled_esms_a);
+         ioprintf(std::cout, "\n");
+      }
    }
 
-   if (res.disabled_esms > 0)
+   if (res.disabled_esms_i > 0 || res.disabled_esms_a > 0)
    {
       if (command_used != "update")
          std::cout << std::endl;
-      ioprintf(std::cout,
-               ngettext("%d additional update is available with UA Infrastructure ESM.",
-                        "%d additional updates are available with UA Infrastructure ESM.",
-                        res.disabled_esms),
-               res.disabled_esms);
+      if (res.disabled_esms_i > 0)
+      {
+         ioprintf(std::cout,
+                  ngettext("%d additional update is available with UA Infra: ESM.",
+                           "%d additional updates are available with UA Infra: ESM.",
+                           res.disabled_esms_i),
+                  res.disabled_esms_i);
+         ioprintf(std::cout, "\n");
+      }
+      if (res.disabled_esms_a > 0)
+      {
+         ioprintf(std::cout,
+                  ngettext("%d additional update is available with UA Apps: ESM.",
+                           "%d additional updates are available with UA Apps ESM.",
+                           res.disabled_esms_a),
+                  res.disabled_esms_a);
+         ioprintf(std::cout, "\n");
+      }
 
-      ioprintf(std::cout, "\n");
       ioprintf(std::cout, gettext("To see these additional updates run: apt list --upgradable"));
       ioprintf(std::cout, "\n");
       ioprintf(std::cout, gettext("See https://ubuntu.com/advantage or run: sudo ua status"));
diff --git a/debian/changelog b/debian/changelog
index 001d980..1180c0f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,228 @@
+ubuntu-advantage-tools (26.1~21.04.1) hirsute; urgency=medium
+
+  *  New upstream release 26.1
+     - contract: block detach call to contract if machine-id change
+     - docs: add readme docs about mastering clean golden images
+     - fips: add reboot notices for fips operations (GH: #1368)
+     - livepatch: add retry when running canonical-livepatch status
+       (GH: #1360)
+     - util: use lru_cache to avoid re-reading os-release and machine-id
+       (GH: #1329)
+     - tests:
+       + add disable_auto_attach config to all test PRO vms
+       + add more log artifacts during failed integration test
+       + check cloudinit status after launching image
+       + mock leaking livepatch.application_status for fips test
+       + retry package installs on apt exit 100
+     - jenkins: parameterize build stages to avoid parallel job collision
+
+ -- Lucas Moura <[e-mail]>  Fri, 19 Feb 2021 10:30:22 -0300
+
+ubuntu-advantage-tools (26.0.1~21.04.1) hirsute; urgency=medium
+
+  * auto-attach: fix comparing numeric iid
+
+ -- Lucas Moura <[e-mail]>  Fri, 05 Feb 2021 14:10:09 -0300
+
+ubuntu-advantage-tools (26.0~21.04.1) hirsute; urgency=medium
+
+  * New upstream release 26.0:
+    - auto-attach: systemd unit to run before ua-reboot-cmds.service
+    - config: remove_notice should remove notices.json when empty
+    - fips:
+      + add notice if running a deactivated FIPS kernel (GH: #1348)
+      + block enabling FIPS on clouds using Xenial
+      + block enabling fips on GCP instances
+      + check /proc/sys/crypto/fips_enable to see if fips is enabled
+      + override fips metapackage when on bionic cloud
+      + update metapackage override logic on fips
+    - notices: clear lock file and notice when encountering any exception
+      (GH: #1326)
+    - reboot_cmds: retry on lock held errors due to pro auto-attach
+    - services: allow uaclient to disable services during enable
+    - status: include beta services in json formatted output with --all
+      (GH: #1341)
+    - tests:
+      + add FIPS tests to AWS and Azure bionic images
+      + add GCP pro test for focal machine
+      + add after_step collection of artifacts on failure
+      + remove proc file check after disabling fips
+      + pro: block auto-attach with cloud-config bootcmd
+      + add validation of systemd unit ua-reboot-cmds.service
+      + test enabling fips-updates when fips is enabled
+    - jenkins:
+      - add deb build stage to assert package builds
+      - use series-specific sbuild --build-dir avoid races
+      - use --append-to-version for each sbuild run to avoid races
+      - presume success when no integration artifacts created
+
+ -- Lucas Moura <[e-mail]>  Thu, 04 Feb 2021 16:34:56 -0300
+
+ubuntu-advantage-tools (26.0~21.04.1~beta) hirsute; urgency=medium
+
+  * d/rules:
+    - add --with systemd to allow reboot init script
+    - do not remove lib/systemd/system folder
+  * d/postinst:
+    - create marker file when reboot script need to run:
+      - enable livepatch across trusty to xenial upgrade
+      - update fips on existing fips pro machines
+  * New upstream release 26.0~beta:
+    - gcp: add Google Cloud Platform support (GH #1269)
+    - fips:
+      + remove is_beta from fips sevices
+      + fips pro: add upgrade support to require reboot to unmark held fips pkgs
+      + update origin UbuntuFIPSUpdates
+    - status:
+      + add notice to tabular output
+      + held locks emit notice about Operation in progress
+    - cli: help sort output so trusty ordering matches xenial++
+    - cis: rename service from cis-audit
+    - config: provide config notices and add_notice and remove_notice methods
+    - contract: add resource-machine-access route and datapath
+    - init: add init script to run commands on reboot
+    - keys: add ubuntu-advantage-cis keyring
+    - livepatch: make livepatch react to enableByDefault delta
+    - log: log when we install pkgs because of contract delta
+    - make: drop six testdeps target
+    - pro: do not install pro debs on non-pro instances
+    - services: Update beta info for services (GH #1220)
+    - tools: add tox-lxd-runner, that execute the test command in a shell
+    - tools: refresh-keyrings handles cis keys. drop series-specific keys
+    - tests:
+      + add GCE support for integration tests
+      + add cis integration tests for unattached and pro
+      + add pytest constraint for mypy tests
+      + add unittests for reboot_cmds script
+      + fix esm package messages for new update notifier version
+      + pin importlib-metadata for mypy tests
+      + repo tests for request_resource_machine_access
+      + unit tests for config cache clearing and machine-access data
+    - jenkins:
+      + add basic Jenkinsfile for CI runs per PR
+      + add jenkins parseable test results
+      + add lxc cleanup stage on Jenkinsfile
+
+ -- Lucas Moura <[e-mail]>  Thu, 14 Jan 2021 10:08:20 -0300
+
+ubuntu-advantage-tools (25.0~20.10.1) groovy; urgency=medium
+
+  * Release version 25.0
+
+ -- Chad Smith <[e-mail]>  Fri, 04 Dec 2020 13:32:16 -0700
+
+ubuntu-advantage-tools (25.0~20.10.1beta3) groovy; urgency=medium
+
+  * New upstream release 25.0~beta3:
+    - upgrade-lts-conract: noop during do-release-upgrade on unattached
+      (GH: #1255)
+    - ua-auto-attach: order systemd unit before cloud-config.service
+    - Update FIPSUpdates pin origin
+    - fips: unmark held fips packages for ubuntu pro fips image support
+      (GH: #1109)
+    - repo: handle changes to additionalPackages contract deltas
+    - repo: move package installation to install_packages method
+    - pro: trigger auto-attach as soon as instance-data.json is available
+      (GH: #1234)
+    - Conditionally install packages when enabling FIPS
+    - fips: allow disable (GH: #1168)
+    - cli: add trailing newline to argparse errors (GH: #1236)
+    - Install fips metapacking when enabling service
+    - integration test improvements:
+      + upgrade-test: fix upgrade path restart failures on trusty (GH: #1257)
+      + Fix integration test setup scripts (GH: #1253)
+      + strict checking for command success on behave
+      + Update tests to use new pycloudlib LXD abstraction
+      + Add upgrade scenario tests when FIPS is enabled
+      + Improve FIPS tests for checking packages
+      + Update esm-infra xenial lxd test
+      + Fix vm tests as esm-apps is beta service
+      + Fix azure generic integration testing
+      + Update esm-apps check on staging_commands tests
+      + Install pycloudlib for azure jobs only
+      + Fix shell condition in run_azure_travis_integration_tests.sh
+      + Update azure jobs on travis
+      + Update travis url in README
+      + Update travis scripts to use ppa only on master
+      + Fix cron event type check on travis yaml
+
+ -- Chad Smith <[e-mail]>  Wed, 02 Dec 2020 13:43:16 -0700
+
+ubuntu-advantage-tools (25.0~20.10.1~beta2) groovy; urgency=medium
+
+  * New upstream release 25.0~beta2:
+    - help: update esm-infra help text (GH: #1212)
+    - apt-hook: update apt cli messaging for UA Infra: ESM and UA Apps: ESM
+      product names
+    - help: update fips help docs (GH: #1213)
+    - help: revert CIS help doc URL (GH: #1211)
+    - help: add new fips help URLs to CLI help docs (GH: #1210)
+    - Show error when enabling service with invalid repo [Lucas Moura]
+      (GH: #954)
+    - Update beta info for services (#1220) [Lucas Moura] (GH: #1216)
+    - Do not enable fips when fips-updates is active [Lucas Moura] (GH: #1209)
+    - Add vm test commands in tox.ini (#1204) [Lucas Moura]
+
+ -- Chad Smith <[e-mail]>  Mon, 26 Oct 2020 20:01:21 -0600
+
+ubuntu-advantage-tools (25.0~20.10.1~beta1) groovy; urgency=medium
+
+  * Beta bug fix release
+    - status: fix missing description_override key after upgrade from
+      trusty (GH: #1201)
+    - During contract delta processing use _check_application_status_on_cache
+      instead of live service status
+
+ -- Chad Smith <[e-mail]>  Sat, 10 Oct 2020 21:47:21 -0600
+
+ubuntu-advantage-tools (25.0~20.10.1~beta) groovy; urgency=medium
+
+  * d/control:
+    - add po-debconf dependency and fix lintian not-using-po-debconf and
+      untranslatable-debconf-templates
+    - add ${misc:Depends} dep to ubuntu-advantage-pro to fix lintian
+      debhelper-but-no-misc-depends (GH: #1024)
+  * d/rules:
+    - drop --with systemd fix build-depends-on-obsolete-package
+    - set fix lintian warning extra:Depends even if empty
+  * d/postrm
+    - Add more gpg keys to be deleted in postrm for Xenial+ support
+  * d/postinst:
+    - do not unconfigure non-trusty esm. no series in apt filenames (GH: #1170)
+    - check if esm is already enabled (GH: #1095)
+  * New upstream release 25.0:
+    - Do not uninstall additionalPackages or livepatch when disabling services
+    - check for issubclass on clean_apt_files
+    - Add do-release-upgrade support for esm-infra and apps suites (GH: #1169)
+    - Apply contract deltas during do-release-upgrade operations
+    - cli: add ua help command
+    - cli: status add blocking --wait param and lock files for config change
+    - Fix livepatch behaviour on aws pro focal machine
+    - travis: drop inapplicable workspaces from specific awsgeneric release
+      jobs
+    - Add possible reboot text after enabling/disabling services
+    - apt-hook: package apt-hook and apt configuration files on all releases
+      (GH: #1150)
+    - Fix enable fail bug
+    - Add uaclient.conf override mechanism for auto-attach, beta services and
+      machine-token
+    - Support ESM Apps [Brian Murray] (GH: #930)
+    - Do not enable services if blocking services is active (GH: #1029)
+    - contract: handle 401 on invalid token, 403 on expired (GH: #1335)
+    - Hide beta services from default status output and enable/disable
+      operations (GH: #1079) (GH: #1091)
+    - fips: force apt noninteractive prompts during package installs
+      (GH: #1084)
+    - tests: add unit tests for aws-gov/aws-china cloud detection
+    - Add AWS China and GovCloud partitions [Robert Jennings]
+    - Disable beta services to be show/enabled without flag
+    - Add missing build_pr command to environment
+    - Use additionalPackages from service payload
+    - Add integration testing for Travis runs [patriciadomin] (GH: #856)
+      (GH: #857)  (GH: #853)
+
+ -- Chad Smith <[e-mail]>  Mon, 28 Sep 2020 21:11:54 -0600
+
 ubuntu-advantage-tools (24.4) groovy; urgency=medium
 
   * New bug-fix-only release 24.4:
diff --git a/debian/control b/debian/control
index 0fedb9c..9c3095e 100644
--- a/debian/control
+++ b/debian/control
@@ -5,16 +5,17 @@ Maintainer: Ubuntu Developers <[e-mail]>
 Build-Depends: bash-completion,
                debhelper (>=9),
                dh-python,
+               dh-systemd,
                gettext,
                git,
                libapt-pkg-dev,
+               po-debconf,
                python3 (>= 3.4),
                python3-flake8,
                python3-mock,
                python3-pytest,
                python3-setuptools,
-               python3-yaml,
-               dh-systemd
+               python3-yaml
 Standards-Version: 4.3.0
 Homepage: https://buy.ubuntu.com
 Vcs-Git: https://github.com/CanonicalLtd/ubuntu-advantage-script.git
@@ -37,7 +38,7 @@ Description: management tools for Ubuntu Advantage
 
 Package: ubuntu-advantage-pro
 Architecture: any
-Depends: ubuntu-advantage-tools (>=20.2)
+Depends: ${misc:Depends}, ubuntu-advantage-tools (>=20.2)
 Replaces: ubuntu-advantage-tools (<<20.2)
 Breaks: ubuntu-advantage-tools (<<20.2)
 Description: utilities and services for Ubuntu Pro images
diff --git a/debian/po/POTFILES.in b/debian/po/POTFILES.in
 new file mode 100644
index 0000000..986f7cc
--- /dev/null
+++ b/debian/po/POTFILES.in
@@ -0,0 +1 @@
+[type: gettext/rfc822deb] ubuntu-advantage-tools.templates
diff --git a/debian/po/templates.pot b/debian/po/templates.pot
 new file mode 100644
index 0000000..9dd5145
--- /dev/null
+++ b/debian/po/templates.pot
@@ -0,0 +1,36 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the ubuntu-advantage-tools package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: ubuntu-advantage-tools\n"
+"Report-Msgid-Bugs-To: [e-mail]\n"
+"POT-Creation-Date: 2020-10-02 15:07-0600\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <[e-mail]>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../ubuntu-advantage-tools.templates:1001
+msgid "Ubuntu Pro support now requires ubuntu-advantage-pro"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../ubuntu-advantage-tools.templates:1001
+msgid "To install run the following:"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../ubuntu-advantage-tools.templates:1001
+msgid "sudo apt-get install ubuntu-advantage-pro"
+msgstr ""
diff --git a/debian/postinst b/debian/postinst
index 3b39c9d..5d942f9 100644
--- a/debian/postinst
+++ b/debian/postinst
@@ -11,12 +11,15 @@ UA_KEYRING_DIR="/usr/share/keyrings/"
 ESM_INFRA_KEY_TRUSTY="ubuntu-advantage-esm-infra-trusty.gpg"
 
 APT_SRC_DIR="/etc/apt/sources.list.d"
+APT_PREFERENCES_DIR="/etc/apt/preferences.d"
 ESM_APT_SOURCE_FILE_PRECISE="$APT_SRC_DIR/ubuntu-esm-precise.list"
 ESM_APT_SOURCE_FILE_TRUSTY="$APT_SRC_DIR/ubuntu-esm-trusty.list"
-ESM_INFRA_APT_SOURCE_FILE_TRUSTY="$APT_SRC_DIR/ubuntu-esm-infra-trusty.list"
+ESM_INFRA_OLD_APT_SOURCE_FILE_TRUSTY="$APT_SRC_DIR/ubuntu-esm-infra-trusty.list"
+ESM_INFRA_APT_SOURCE_FILE_TRUSTY="$APT_SRC_DIR/ubuntu-esm-infra.list"
 
 ESM_APT_PREF_FILE_TRUSTY="/etc/apt/preferences.d/ubuntu-esm-trusty"
-ESM_INFRA_APT_PREF_FILE_TRUSTY="/etc/apt/preferences.d/ubuntu-esm-infra-trusty"
+ESM_INFRA_OLD_APT_PREF_FILE_TRUSTY="/etc/apt/preferences.d/ubuntu-esm-infra-trusty"
+ESM_INFRA_APT_PREF_FILE_TRUSTY="/etc/apt/preferences.d/ubuntu-esm-infra"
 
 MYARCH="$(dpkg --print-architecture)"
 ESM_SUPPORTED_ARCHS="i386 amd64"
@@ -25,14 +28,80 @@ SYSTEMD_WANTS_AUTO_ATTACH_LINK="/etc/systemd/system/multi-user.target.wants/ua-a
 SYSTEMD_HELPER_ENABLED_AUTO_ATTACH_DSH="/var/lib/systemd/deb-systemd-helper-enabled/ua-auto-attach.service.dsh-also"
 SYSTEMD_HELPER_ENABLED_WANTS_LINK="/var/lib/systemd/deb-systemd-helper-enabled/multi-user.target.wants/ua-auto-attach.service"
 
+REBOOT_CMD_MARKER_FILE="/var/lib/ubuntu-advantage/marker-reboot-cmds-required"
+
+# Rename apt config files for ua services removing ubuntu release names
+redact_ubuntu_release_from_ua_apt_filenames() {
+    DIR=$1
+    UA_SERVICES=$(python3 -c "
+from uaclient.entitlements import ENTITLEMENT_CLASS_BY_NAME
+print(*ENTITLEMENT_CLASS_BY_NAME.keys(), sep=' ')
+")
+
+    for file in "$DIR"/*; do
+        release_name=""
+        case "$file" in
+            *-trusty*)
+                release_name=trusty;;
+            *-xenial*)
+                release_name=xenial;;
+            *-bionic*)
+                release_name=bionic;;
+            *-focal*)
+                release_name=focal;;
+            *-groovy*)
+                release_name=groovy;;
+            *) release_name="";;
+         esac
+         if [ "$release_name" ]; then
+             # We have a ubuntu release name in the apt config.
+             # Remove $release_name from original $file.
+             new_file=${file%-${release_name}*}${file#*${release_name}}
+             for service in ${UA_SERVICES}; do
+                 if [ "${file#*$service}" != "$file" ]; then
+                      # Valid apt cfg file for an ubuntu-advantage service
+                      mv "$file" "$new_file"
+                 fi
+             done
+         fi
+    done
+}
+
+
+# Check cached service status from status.json and return 0 if enabled else 1
+check_service_is_enabled() {
+    service_name=$1
+    _RET=$(python3 -c "
+import os
+import json
+from uaclient.config import UAConfig
+cfg = UAConfig()
+status = cfg.read_cache('status-cache')
+if status:
+    for service in status['services']:
+       if service['name'] == '${service_name}':
+           print(service['status'])
+")
+   if [ "${_RET}" = "enabled" ]; then
+       return  0
+   else
+       return  1
+   fi
+}
+
 
 unconfigure_esm() {
-    rm -f $APT_TRUSTED_KEY_DIR/ubuntu-esm*gpg  # Remove previous esm keys
-    rm -f $APT_TRUSTED_KEY_DIR/$ESM_INFRA_KEY_TRUSTY
-    rm -f $ESM_INFRA_APT_SOURCE_FILE_TRUSTY
-    rm -f $ESM_APT_PREF_FILE_TRUSTY $ESM_INFRA_APT_PREF_FILE_TRUSTY
+    if ! check_service_is_enabled esm-infra; then
+        rm -f $APT_TRUSTED_KEY_DIR/ubuntu-esm*gpg  # Remove previous esm keys
+        rm -f $APT_TRUSTED_KEY_DIR/$ESM_INFRA_KEY_TRUSTY
+        rm -f $ESM_INFRA_APT_SOURCE_FILE_TRUSTY
+        rm -f $ESM_INFRA_OLD_APT_SOURCE_FILE_TRUSTY
+        rm -f $ESM_APT_PREF_FILE_TRUSTY $ESM_INFRA_OLD_APT_PREF_FILE_TRUSTY
+        rm -f $ESM_INFRA_APT_PREF_FILE_TRUSTY
+    fi
 }
 
+
 configure_esm() {
     rm -f $APT_TRUSTED_KEY_DIR/ubuntu-esm*gpg  # Remove previous esm keys
     if [ ! -f "$APT_TRUSTED_KEY_DIR/$ESM_INFRA_KEY_TRUSTY" ]; then
@@ -64,6 +133,29 @@ EOF
     fi
 }
 
+
+# If held fips packages exist, we are on a FIPS PRO machine with FIPS enabled
+mark_reboot_for_fips_pro() {
+    FIPS_HOLDS=$(apt-mark showholds | grep -E 'fips|libssl1|openssh-client|openssh-server|linux-fips|openssl|strongswan' || exit 0)
+    if [ "$FIPS_HOLDS" ]; then
+       mark_reboot_cmds_as_needed MESSAGE_FIPS_REBOOT_REQUIRED
+    fi
+}
+
+
+mark_reboot_cmds_as_needed() {
+    msg_name=$1
+    if [ ! -f "$REBOOT_CMD_MARKER_FILE" ]; then
+      touch $REBOOT_CMD_MARKER_FILE
+    fi
+    python3 -c "
+from uaclient.config import UAConfig
+from uaclient.status import ${msg_name}
+cfg = UAConfig()
+cfg.add_notice(label='', description=${msg_name})
+"
+}
+
 case "$1" in
     configure)
       PREVIOUS_PKG_VER=$2
@@ -94,10 +186,15 @@ case "$1" in
               # ubuntu-advantage-pro package that should be installed
               . /usr/share/debconf/confmodule
               db_input high ubuntu-advantage-tools/suggest_pro_pkg || true
-              db_go
+              db_go || true
           fi
       fi
 
+      # UA service PPAs support all ubuntu releases, no need to
+      # specialize apt config filenames per ubuntu release.
+      redact_ubuntu_release_from_ua_apt_filenames $APT_SRC_DIR
+      redact_ubuntu_release_from_ua_apt_filenames $APT_PREFERENCES_DIR
+
       # CACHE_DIR is no longer present or used since 19.1
       rm -rf /var/cache/ubuntu-advantage-tools
       # machine-access cache files no longer present or used since 20.1
@@ -111,10 +208,8 @@ case "$1" in
           # 14.04 and unsupported arch
           unconfigure_esm
         fi
-      else
-        # not 14.04, regardless of arch
-        unconfigure_esm
       fi
+
       if [ ! -f /var/log/ubuntu-advantage.log ]; then
           touch /var/log/ubuntu-advantage.log
       fi
@@ -124,6 +219,13 @@ case "$1" in
       if [ -d "$private_dir" ]; then
           chmod 0700 "$private_dir"
       fi
+
+      if [ "$VERSION_ID" = "16.04" ]; then
+        if echo "$PREVIOUS_PKG_VER" | grep -q "14.04"; then
+          mark_reboot_cmds_as_needed MESSAGE_LIVEPATCH_LTS_REBOOT_REQUIRED
+        fi
+      fi
+      mark_reboot_for_fips_pro
       ;;
 esac
 
diff --git a/debian/postrm b/debian/postrm
index 2112cf5..fb84664 100644
--- a/debian/postrm
+++ b/debian/postrm
@@ -16,11 +16,10 @@ remove_logs(){
     rm -f /var/log/ubuntu-advantage.log*
 }
 
-remove_esm(){
-    # config files created in postinst, need explicit handling on purge
+remove_gpg_files(){
     rm -f /etc/apt/trusted.gpg.d/ubuntu-advantage-esm-infra-trusty.gpg
-    rm -f /etc/apt/sources.list.d/ubuntu-esm-infra-trusty.list
-    rm -f /etc/apt/preferences.d/ubuntu-esm-infra-trusty
+    rm -f /etc/apt/trusted.gpg.d/ubuntu-advantage-esm-apps.gpg
+    rm -f /etc/apt/trusted.gpg.d/ubuntu-advantage-fips.gpg
 }
 
 case "$1" in
@@ -28,7 +27,7 @@ case "$1" in
         remove_apt_auth
         remove_cache_dir
         remove_logs
-        remove_esm
+        remove_gpg_files
         ;;
 esac
 
diff --git a/debian/prerm b/debian/prerm
index 4644c05..59b2b1b 100644
--- a/debian/prerm
+++ b/debian/prerm
@@ -5,9 +5,9 @@ set -e
 
 remove_apt_files() {
     python3 -c '
-from uaclient.apt import clean_apt_sources
+from uaclient.apt import clean_apt_files
 
-clean_apt_sources()
+clean_apt_files()
 '
 
 }
diff --git a/debian/rules b/debian/rules
index a535bbb..888dcde 100755
--- a/debian/rules
+++ b/debian/rules
@@ -39,26 +39,24 @@ endif
 endif
 
 override_dh_gencontrol:
-	[ -z '$(APT_PKG_DEPS)' ] || echo extra:Depends=$(APT_PKG_DEPS) >> debian/ubuntu-advantage-tools.substvars
+	echo extra:Depends=$(APT_PKG_DEPS) >> debian/ubuntu-advantage-tools.substvars
 	dh_gencontrol
 
 override_dh_auto_install:
 	dh_auto_install --destdir=debian/ubuntu-advantage-tools
 	flist=$$(find $(CURDIR)/debian/ -type f -name version.py) && sed -i 's,@@PACKAGED_VERSION@@,$(DEB_VERSION),' $${flist:-did-not-find-version-py-for-replacement}
-ifeq (${VERSION_ID},"14.04")
 	make -C apt-hook DESTDIR=$(CURDIR)/debian/ubuntu-advantage-tools install
-endif
 
 ifeq (${VERSION_ID},"14.04")
-	# Move ua-auto-attach.conf to ubuntu-advantage-pro
+	# Move ua-auto-attach.conf out to ubuntu-advantage-pro
 	mkdir -p debian/ubuntu-advantage-pro/etc/init
 	mv debian/ubuntu-advantage-tools/etc/init/ua-auto-attach.conf debian/ubuntu-advantage-pro/etc/init/
 	rmdir debian/ubuntu-advantage-tools/etc/init
 else
-	# Move ua-auto-attach.service to ubuntu-advantage-pro
+	# Move ua-auto-attach.service out to ubuntu-advantage-pro
 	mkdir -p debian/ubuntu-advantage-pro/lib/systemd/system
-	mv debian/ubuntu-advantage-tools/lib/systemd/system/ua-auto-attach.service debian/ubuntu-advantage-pro/lib/systemd/system
-	cd debian/ubuntu-advantage-tools && rmdir -p lib/systemd/system
+	mv debian/ubuntu-advantage-tools/lib/systemd/system/ua-auto-attach.* debian/ubuntu-advantage-pro/lib/systemd/system
+	cd debian/ubuntu-advantage-tools
 endif
 
 override_dh_auto_clean:
diff --git a/debian/ubuntu-advantage-tools.templates b/debian/ubuntu-advantage-tools.templates
index 255d330..1b5c6f8 100644
--- a/debian/ubuntu-advantage-tools.templates
+++ b/debian/ubuntu-advantage-tools.templates
@@ -1,6 +1,6 @@
 Template: ubuntu-advantage-tools/suggest_pro_pkg
 Type: note
-Description: Ubuntu Pro support now requires ubuntu-advantage-pro
+_Description: Ubuntu Pro support now requires ubuntu-advantage-pro
  To install run the following:
  .
  sudo apt-get install ubuntu-advantage-pro
diff --git a/features/attach_invalidtoken.feature b/features/attach_invalidtoken.feature
index 11a8ba8..4f3fc9a 100644
--- a/features/attach_invalidtoken.feature
+++ b/features/attach_invalidtoken.feature
@@ -1,15 +1,22 @@
 Feature: Command behaviour when trying to attach a machine to an Ubuntu
          Advantage subscription using an invalid token
 
-    Scenario: Attach command in a trusty lxd container
-       Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I run `ua attach INVALID_TOKEN` with sudo
-        Then I will see the following on stderr:
+    @series.all
+    Scenario Outline: Attach command in a machine
+       Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I verify that running `ua attach INVALID_TOKEN` `with sudo` exits `1`
+        Then stderr matches regexp:
             """
             Invalid token. See https://ubuntu.com/advantage
             """
-        When I run `ua attach INVALID_TOKEN` as non-root
+        When I verify that running `ua attach INVALID_TOKEN` `as non-root` exits `1`
         Then I will see the following on stderr:
              """
              This command must be run as root (try using sudo)
              """
+        Examples: ubuntu release
+           | release |
+           | trusty  |
+           | xenial  |
+           | bionic  |
+           | focal   |
diff --git a/features/attach_validtoken.feature b/features/attach_validtoken.feature
index 2a7bfc9..a25234f 100644
--- a/features/attach_validtoken.feature
+++ b/features/attach_validtoken.feature
@@ -1,10 +1,38 @@
[e-mail]_token
 Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
         subscription using a valid token
 
-    @uses.config.contract_token
-    Scenario: Attach command in a trusty lxd container
-       Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
+    @series.all
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Attach command in a ubuntu lxd container
+       Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I run `apt-get update` with sudo, retrying exit [100]
+        And I run `apt-get install -y <downrev_pkg>` with sudo, retrying exit [100]
+        When I verify that running ` --assume-yes --beta` `with sudo` exits `1`
+        And I run `/usr/lib/update-notifier/apt-check  --human-readable` as non-root
+        Then if `<release>` in `trusty` and stdout matches regexp:
+        """
+        UA Infrastructure Extended Security Maintenance \(ESM\) is not enabled.
+
+        \d+ update(s)? can be installed immediately.
+        \d+ of these updates (is a|are) security update(s)?.
+        """
+        Then if `<release>` in `trusty` and stdout matches regexp:
+        """
+        Enable UA Infrastructure ESM to receive \d+ additional security update(s)?.
+        See https://ubuntu.com/advantage or run: sudo ua status
+        """
+        Then if `<release>` in `xenial or bionic` and stdout matches regexp:
+        """
+        \d+ package(s)? can be updated.
+        \d+ of these updates (is a|are) security update(s)?.
+        """
+        Then if `<release>` in `focal` and stdout matches regexp:
+        """
+        \d+ update(s)? can be installed immediately.
+        \d+ of these updates (is a|are) security update(s)?.
+        """
+        When I attach `contract_token` with sudo
         Then stdout matches regexp:
         """
         ESM Infra enabled
@@ -16,15 +44,332 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
         And stdout matches regexp:
         """
         SERVICE       ENTITLED  STATUS    DESCRIPTION
-        cc-eal       +yes      +n/a      +Common Criteria EAL2 Provisioning Packages
-        cis-audit    +no       +—        +Center for Internet Security Audit Tools
-        esm-apps     +no       +—        +UA Apps: Extended Security Maintenance
-        esm-infra    +yes      +enabled  +UA Infra: Extended Security Maintenance
+        esm-infra    +yes      +enabled  +UA Infra: Extended Security Maintenance \(ESM\)
         fips         +yes      +n/a      +NIST-certified FIPS modules
         fips-updates +yes      +n/a      +Uncertified security updates to FIPS modules
         livepatch    +yes      +n/a      +Canonical Livepatch service
         """
-        And I will see the following on stderr:
+        And stderr matches regexp:
+        """
+        Enabling default service esm-infra
+        """
+        When I run `/usr/lib/update-notifier/apt-check  --human-readable` as non-root
+        Then if `<release>` in `trusty` and stdout matches regexp:
+        """
+        UA (Infra:|Infrastructure) Extended Security Maintenance \(ESM\) is enabled.
+
+        \d+ update(s)? can be installed immediately.
+        \d+ of these updates (is|are) (fixed|provided) through UA (Infra:|Infrastructure) ESM.
+        \d+ of these updates (is a|are) security update(s)?.
+        """
+        Then if `<release>` in `focal` and stdout matches regexp:
+        """
+        UA (Infra:|Infrastructure) Extended Security Maintenance \(ESM\) is enabled.
+
+        \d+ update(s)? can be installed immediately.
+        \d+ of these updates (is|are) (fixed|provided) through UA (Infra:|Infrastructure) ESM.
+        \d+ of these updates (is a|are) security update(s)?.
+        To see these additional updates run: apt list --upgradable
+        """
+        Then if `<release>` in `xenial or bionic` and stdout matches regexp:
+        """
+        \d+ package(s)? can be updated.
+        \d+ of these updates (is a|are) security update(s)?.
+        """
+        Examples: ubuntu release packages
+           | release | downrev_pkg                 |
+           | trusty  | libgit2-0=0.19.0-2          |
+           | xenial  | libkrad0=1.13.2+dfsg-5      |
+           | bionic  | libkrad0=1.16-2build1       |
+           | focal   | hello=2.10-2ubuntu2         |
+
+    @series.all
+    @uses.config.machine_type.aws.generic
+    Scenario Outline: Attach command in a ubuntu lxd container
+       Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then stdout matches regexp:
+        """
+        ESM Infra enabled
+        """
+        And stdout matches regexp:
+        """
+        This machine is now attached to
+        """
+        And stdout matches regexp:
+        """
+        SERVICE       ENTITLED  STATUS    DESCRIPTION
+        esm-infra    +yes      +enabled  +UA Infra: Extended Security Maintenance \(ESM\)
+        fips         +yes      +<fips_status>      +NIST-certified FIPS modules
+        fips-updates +yes      +<fips_status>      +Uncertified security updates to FIPS modules
+        livepatch    +yes      +<lp_status>  +<lp_desc>
+        """
+        And stderr matches regexp:
+        """
+        Enabling default service esm-infra
+        """
+
+        Examples: ubuntu release livepatch status
+           | release | fips_status |lp_status | lp_desc                       |
+           | trusty  | n/a         |n/a       | Available with the HWE kernel |
+           | xenial  | disabled    |enabled   | Canonical Livepatch service   |
+           | bionic  | disabled    |enabled   | Canonical Livepatch service   |
+           | focal   | n/a         |enabled   | Canonical Livepatch service   |
+
+    @series.all
+    @uses.config.machine_type.azure.generic
+    Scenario Outline: Attach command in a ubuntu lxd container
+       Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then stdout matches regexp:
+        """
+        ESM Infra enabled
+        """
+        And stdout matches regexp:
+        """
+        This machine is now attached to
+        """
+        And stdout matches regexp:
+        """
+        SERVICE       ENTITLED  STATUS    DESCRIPTION
+        esm-infra    +yes      +enabled  +UA Infra: Extended Security Maintenance \(ESM\)
+        fips         +yes      +<fips_status> +NIST-certified FIPS modules
+        fips-updates +yes      +<fips_status> +Uncertified security updates to FIPS modules
+        livepatch    +yes      +<lp_status>  +Canonical Livepatch service
+        """
+        And stderr matches regexp:
+        """
+        Enabling default service esm-infra
+        """
+
+        Examples: ubuntu release livepatch status
+           | release | lp_status | fips_status |
+           | trusty  | disabled  | n/a         |
+           | xenial  | n/a       | n/a         |
+           | bionic  | n/a       | disabled    |
+           | focal   | n/a       | n/a         |
+
+    @series.all
+    @uses.config.machine_type.gcp.generic
+    Scenario Outline: Attach command in a ubuntu lxd container
+       Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then stdout matches regexp:
+        """
+        ESM Infra enabled
+        """
+        And stdout matches regexp:
+        """
+        This machine is now attached to
+        """
+        And stdout matches regexp:
+        """
+        SERVICE       ENTITLED  STATUS    DESCRIPTION
+        esm-infra    +yes      +enabled  +UA Infra: Extended Security Maintenance \(ESM\)
+        fips         +yes      +<fips_status> +NIST-certified FIPS modules
+        fips-updates +yes      +<fips_status> +Uncertified security updates to FIPS modules
+        livepatch    +yes      +<lp_status>  +Canonical Livepatch service
+        """
+        And stderr matches regexp:
         """
         Enabling default service esm-infra
         """
+
+        Examples: ubuntu release livepatch status
+           | release | lp_status | fips_status |
+           | trusty  | disabled  | n/a         |
+           | xenial  | n/a       | n/a         |
+           | bionic  | n/a       | n/a         |
+           | focal   | n/a       | n/a         |
+
+    @series.bionic
+    @uses.config.machine_type.azure.generic
+    Scenario Outline: Attached enable of vm-based services in an ubuntu lxd vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token_staging` with sudo
+        And I run `apt-get install openssh-client openssh-server strongswan -y` with sudo
+        And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
+        And I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I run `apt-cache policy ubuntu-azure-fips` as non-root
+        Then stdout does not match regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            azure-fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+        """
+        Updating package lists
+        """
+        When I run `apt-cache policy ubuntu-azure-fips` as non-root
+        Then stdout matches regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
+        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                                        |
+           | bionic  | FIPS         | fips         |https://esm.staging.ubuntu.com/fips/ubuntu bionic/main |
+
+    @series.bionic
+    @uses.config.machine_type.aws.generic
+    Scenario Outline: Attached enable of vm-based services in an ubuntu lxd vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token_staging` with sudo
+        And I run `ua disable livepatch` with sudo
+        And I run `apt-get install openssh-client openssh-server strongswan -y` with sudo
+        And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
+        And I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I run `apt-cache policy ubuntu-aws-fips` as non-root
+        Then stdout does not match regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            aws-fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+        """
+        Updating package lists
+        """
+        When I run `apt-cache policy ubuntu-aws-fips` as non-root
+        Then stdout matches regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
+        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                                        |
+           | bionic  | FIPS         | fips         |https://esm.staging.ubuntu.com/fips/ubuntu bionic/main |
+
+    @series.xenial
+    @uses.config.machine_type.azure.generic
+    Scenario Outline: Attached enable of vm-based services in an ubuntu lxd vm
+        Given a `xenial` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token_staging` with sudo
+        Then I verify that running `ua enable <fips_service> --assume-yes` `with sudo` exits `1`
+        And stdout matches regexp:
+        """
+        Ubuntu Xenial does not provide an Azure optimized FIPS kernel
+        """
+
+        Examples: fips
+           | fips_service  |
+           | fips          |
+           | fips-updates  |
+
+    @series.bionic
+    @series.xenial
+    @uses.config.machine_type.gcp.generic
+    Scenario Outline: Attached enable of fips services in an ubuntu gcp vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token_staging` with sudo
+        Then I verify that running `ua enable <fips_service> --assume-yes` `with sudo` exits `1`
+        And stdout matches regexp:
+        """
+        Ubuntu <release_title> does not provide a GCP optimized FIPS kernel
+        """
+
+        Examples: fips
+            | release | release_title | fips_service  |
+            | xenial  | Xenial        | fips          |
+            | xenial  | Xenial        | fips-updates  |
+            | bionic  | Bionic        | fips          |
+            | bionic  | Bionic        | fips-updates  |
diff --git a/features/attached_commands.feature b/features/attached_commands.feature
index 24dfbfe..4b48f76 100644
--- a/features/attached_commands.feature
+++ b/features/attached_commands.feature
@@ -1,13 +1,14 @@
 @uses.config.contract_token
 Feature: Command behaviour when attached to an UA subscription
 
-    Scenario: Attached refresh in a trusty lxd container
-        Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
-        And I run `ua refresh` as non-root
-        Then I will see the following on stderr:
+    @series.all
+    Scenario Outline: Attached refresh in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua refresh` `as non-root` exits `1`
+        And stderr matches regexp:
             """
-            This command must be run as root (try using sudo)
+            This command must be run as root \(try using sudo\)
             """
         When I run `ua refresh` with sudo
         Then I will see the following on stdout:
@@ -15,43 +16,55 @@ Feature: Command behaviour when attached to an UA subscription
             Successfully refreshed your subscription
             """
 
-    Scenario: Attached disable of an already disabled service in a trusty lxd container
-        Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
-        And I run `ua disable livepatch` as non-root
-        Then I will see the following on stderr:
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | trusty  |
+           | xenial  |
+
+    @series.all
+    Scenario Outline: Attached disable of an already disabled service in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua disable livepatch` `as non-root` exits `1`
+        And stderr matches regexp:
             """
-            This command must be run as root (try using sudo)
+            This command must be run as root \(try using sudo\)
             """
-        When I run `ua disable livepatch` with sudo
-        Then I will see the following on stdout:
+        And I verify that running `ua disable livepatch` `with sudo` exits `1`
+        And I will see the following on stdout:
             """
             Livepatch is not currently enabled
             See: sudo ua status
             """
 
-    Scenario: Attached disable of an unknown service in a trusty lxd container
-        Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
-        And I run `ua disable foobar` as non-root
-        Then I will see the following on stderr:
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | trusty  |
+           | xenial  |
+
+    @series.all
+    Scenario Outline: Attached disable of a service in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua disable foobar` `as non-root` exits `1`
+        And stderr matches regexp:
             """
-            This command must be run as root (try using sudo)
+            This command must be run as root \(try using sudo\)
             """
-        When I run `ua disable foobar` with sudo
-        Then I will see the following on stderr:
+        And I verify that running `ua disable foobar` `with sudo` exits `1`
+        And stderr matches regexp:
             """
-            Cannot disable 'foobar'
-            For a list of services see: sudo ua status
+            Cannot disable unknown service 'foobar'.
+            Try cc-eal, cis, esm-apps, esm-infra, fips, fips-updates, livepatch
             """
-
-    Scenario: Attached disable of an already enabled service in a trusty lxd container
-        Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
-        And I run `ua disable esm-infra` as non-root
-        Then I will see the following on stderr:
+        And I verify that running `ua disable esm-infra` `as non-root` exits `1`
+        And stderr matches regexp:
             """
-            This command must be run as root (try using sudo)
+            This command must be run as root \(try using sudo\)
             """
         When I run `ua disable esm-infra` with sudo
         Then I will see the following on stdout:
@@ -61,26 +74,24 @@ Feature: Command behaviour when attached to an UA subscription
         When I run `ua status` with sudo
         Then stdout matches regexp:
             """
-            esm-infra    +yes      +disabled +UA Infra: Extended Security Maintenance
-            """
-        When I run `apt-cache policy` with sudo
-        Then stdout matches regexp:
-            """
-            -32768 https://esm.ubuntu.com/ubuntu/ trusty-infra-updates/main amd64 Packages
-            """
-        And stdout matches regexp:
-            """
-            -32768 https://esm.ubuntu.com/ubuntu/ trusty-infra-security/main amd64 Packages
+            esm-infra    +yes      +disabled +UA Infra: Extended Security Maintenance \(ESM\)
             """
+        And I verify that running `apt update` `with sudo` exits `0`
 
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | xenial  |
 
-    Scenario: Attached detach in a trusty lxd container
-        Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
-        And I run `ua detach` as non-root
-        Then I will see the following on stderr:
+    @series.all
+    Scenario Outline: Attached detach in a trusty machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua detach` `as non-root` exits `1`
+        And stderr matches regexp:
             """
-            This command must be run as root (try using sudo)
+            This command must be run as root \(try using sudo\)
             """
         When I run `ua detach --assume-yes` with sudo
         Then I will see the following on stdout:
@@ -90,18 +101,336 @@ Feature: Command behaviour when attached to an UA subscription
             Updating package lists
             This machine is now detached
             """
-       When I run `ua status` as non-root
+       When I run `ua status --all` as non-root
        Then stdout matches regexp:
            """
            SERVICE       AVAILABLE  DESCRIPTION
-           cc-eal        +no         +Common Criteria EAL2 Provisioning Packages
-           esm-apps      +no         +UA Apps: Extended Security Maintenance
-           esm-infra     +yes        +UA Infra: Extended Security Maintenance
-           fips          +no         +NIST-certified FIPS modules
-           fips-updates  +no         +Uncertified security updates to FIPS modules
+           cc-eal        +<cc-eal>   +Common Criteria EAL2 Provisioning Packages
+           cis           +<cis>      +Center for Internet Security Audit Tools
+           esm-apps      +<esm-apps> +UA Apps: Extended Security Maintenance \(ESM\)
+           esm-infra     +yes        +UA Infra: Extended Security Maintenance \(ESM\)
+           fips          +<fips>     +NIST-certified FIPS modules
+           fips-updates  +<fips>     +Uncertified security updates to FIPS modules
            livepatch     +yes        +Canonical Livepatch service
            """
        And stdout matches regexp:
           """
           This machine is not attached to a UA subscription.
           """
+       And I verify that running `apt update` `with sudo` exits `0`
+
+       Examples: ubuntu release
+           | release | esm-apps | cc-eal | cis | fips | fips-update |
+           | bionic  | yes      | no     | yes | yes  | yes         |
+           | focal   | yes      | no     | no  | no   | no          |
+           | trusty  | no       | no     | no  | no   | no          |
+           | xenial  | yes      | yes    | yes | yes  | yes         |
+
+    @series.all
+    Scenario Outline: Attached auto-attach in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua auto-attach` `as non-root` exits `1`
+        And stderr matches regexp:
+            """
+            This command must be run as root \(try using sudo\)
+            """
+        When I run `ua auto-attach` with sudo
+        Then stderr matches regexp:
+            """
+            This machine is already attached
+            """
+
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | trusty  |
+           | xenial  |
+
+    @series.all
+    Scenario Outline: Attached show version in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua version` as non-root
+        Then I will see the uaclient version on stdout
+        When I run `ua version` with sudo
+        Then I will see the uaclient version on stdout
+        When I run `ua --version` as non-root
+        Then I will see the uaclient version on stdout
+        When I run `ua --version` with sudo
+        Then I will see the uaclient version on stdout
+
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | trusty  |
+           | xenial  |
+
+    @series.all
+    Scenario Outline: Unattached status in a ubuntu machine with feature overrides
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I create the file `/tmp/machine-token-overlay.json` with the following:
+        """
+        {
+            "machineTokenInfo": {
+                "contractInfo": {
+                    "resourceEntitlements": [
+                        {
+                            "type": "cc-eal",
+                            "entitled": false
+                        }
+                    ]
+                }
+            }
+        }
+        """
+        And I append the following on uaclient config:
+        """
+        features:
+          machine_token_overlay: "/tmp/machine-token-overlay.json"
+          disable_auto_attach: true
+          other: false
+        """
+        And I attach `contract_token` with sudo
+        And I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            SERVICE       ENTITLED  STATUS    DESCRIPTION
+            cc-eal        no
+            """
+        When I run `ua --version` as non-root
+        Then I will see the uaclient version on stdout with features ` +disable_auto_attach +machine_token_overlay -other`
+        When I run `ua version` as non-root
+        Then I will see the uaclient version on stdout with features ` +disable_auto_attach +machine_token_overlay -other`
+        When I run `ua auto-attach` with sudo
+        Then stdout matches regexp:
+        """
+        Skipping auto-attach. Config disable_auto_attach is set.
+        """
+
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | trusty  |
+           | xenial  |
+
+    @series.all
+    Scenario Outline: Attached disable of different services in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua disable esm-infra livepatch foobar` `as non-root` exits `1`
+        And stderr matches regexp:
+            """
+            This command must be run as root \(try using sudo\)
+            """
+        And I verify that running `ua disable esm-infra livepatch foobar` `with sudo` exits `1`
+        And I will see the following on stdout:
+            """
+            Updating package lists
+            Livepatch is not currently enabled
+            See: sudo ua status
+            """
+        And stderr matches regexp:
+            """
+            Cannot disable unknown service 'foobar'.
+            Try cc-eal, cis, esm-apps, esm-infra, fips, fips-updates, livepatch
+            """
+        When I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            esm-infra    +yes      +disabled +UA Infra: Extended Security Maintenance \(ESM\)
+            """
+
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | trusty  |
+           | xenial  |
+
+    @series.trusty
+    Scenario: Attached disable of an already enabled service in a trusty machine
+        Given a `trusty` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua disable foobar` `as non-root` exits `1`
+        And stderr matches regexp:
+            """
+            This command must be run as root \(try using sudo\)
+            """
+        And I verify that running `ua disable foobar` `with sudo` exits `1`
+        And stderr matches regexp:
+            """
+            Cannot disable unknown service 'foobar'.
+            Try cc-eal, cis, esm-apps, esm-infra, fips, fips-updates, livepatch
+            """
+        And I verify that running `ua disable esm-infra` `as non-root` exits `1`
+        And stderr matches regexp:
+            """
+            This command must be run as root \(try using sudo\)
+            """
+        When I run `ua disable esm-infra` with sudo
+        Then I will see the following on stdout:
+            """
+            Updating package lists
+            """
+        When I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            esm-infra    +yes      +disabled +UA Infra: Extended Security Maintenance \(ESM\)
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        When I run `apt-cache policy` with sudo
+        Then apt-cache policy for the following url has permission `-32768`
+        """
+        https://esm.ubuntu.com/ubuntu/ trusty-infra-security/main amd64 Packages
+        """
+        And apt-cache policy for the following url has permission `-32768`
+        """
+        https://esm.ubuntu.com/ubuntu/ trusty-infra-updates/main amd64 Packages
+        """
+
+    @series.all
+    Scenario Outline: Help command on an attached machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua help esm-infra` with sudo
+        Then I will see the following on stdout:
+            """
+            Name:
+            esm-infra
+
+            Entitled:
+            yes
+
+            Status:
+            enabled
+
+            Help:
+            esm-infra provides access to a private ppa which includes available high
+            and critical CVE fixes for Ubuntu LTS packages in the Ubuntu Main
+            repository between the end of the standard Ubuntu LTS security
+            maintenance and its end of life. It is enabled by default with
+            Extended Security Maintenance (ESM) for UA Apps and UA Infra.
+            You can find our more about the esm service at
+            https://ubuntu.com/security/esm
+            """
+        When I run `ua help esm-infra --format json` with sudo
+        Then I will see the following on stdout:
+            """
+            {"name": "esm-infra", "entitled": "yes", "status": "enabled", "help": "esm-infra provides access to a private ppa which includes available high\nand critical CVE fixes for Ubuntu LTS packages in the Ubuntu Main\nrepository between the end of the standard Ubuntu LTS security\nmaintenance and its end of life. It is enabled by default with\nExtended Security Maintenance (ESM) for UA Apps and UA Infra.\nYou can find our more about the esm service at\nhttps://ubuntu.com/security/esm\n"}
+            """
+        And I verify that running `ua help invalid-service` `with sudo` exits `1`
+        And I will see the following on stderr:
+            """
+            No help available for 'invalid-service'
+            """
+        When I run `ua --help` as non-root
+        Then stdout matches regexp:
+        """
+        Client to manage Ubuntu Advantage services on a machine.
+         - esm-infra: UA Infra: Extended Security Maintenance \(ESM\)
+           \(https://ubuntu.com/security/esm\)
+         - fips-updates: Uncertified security updates to FIPS modules
+           \(https://ubuntu.com/security/certifications#fips\)
+         - fips: NIST-certified FIPS modules
+           \(https://ubuntu.com/security/certifications#fips\)
+         - livepatch: Canonical Livepatch service
+           \(https://ubuntu.com/security/livepatch\)
+        """
+        When I run `ua help` as non-root
+        Then stdout matches regexp:
+        """
+        Client to manage Ubuntu Advantage services on a machine.
+         - esm-infra: UA Infra: Extended Security Maintenance \(ESM\)
+           \(https://ubuntu.com/security/esm\)
+         - fips-updates: Uncertified security updates to FIPS modules
+           \(https://ubuntu.com/security/certifications#fips\)
+         - fips: NIST-certified FIPS modules
+           \(https://ubuntu.com/security/certifications#fips\)
+         - livepatch: Canonical Livepatch service
+           \(https://ubuntu.com/security/livepatch\)
+        """
+        When I run `ua help --all` as non-root
+        Then stdout matches regexp:
+        """
+        Client to manage Ubuntu Advantage services on a machine.
+         - cc-eal: Common Criteria EAL2 Provisioning Packages
+           \(https://ubuntu.com/cc-eal\)
+         - cis: Center for Internet Security Audit Tools
+           \(https://ubuntu.com/security/certifications#cis\)
+         - esm-apps: UA Apps: Extended Security Maintenance \(ESM\)
+           \(https://ubuntu.com/security/esm\)
+         - esm-infra: UA Infra: Extended Security Maintenance \(ESM\)
+           \(https://ubuntu.com/security/esm\)
+         - fips-updates: Uncertified security updates to FIPS modules
+           \(https://ubuntu.com/security/certifications#fips\)
+         - fips: NIST-certified FIPS modules
+           \(https://ubuntu.com/security/certifications#fips\)
+         - livepatch: Canonical Livepatch service
+           \(https://ubuntu.com/security/livepatch\)
+        """
+
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | trusty  |
+           | xenial  |
+
+    @series.all
+    Scenario Outline: Purge package after attaching it to a machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `touch /etc/apt/preferences.d/ubuntu-esm-infra` with sudo
+        Then I verify that files exist matching `/var/log/ubuntu-advantage.log`
+        And I verify that running `test -d /var/lib/ubuntu-advantage` `with sudo` exits `0`
+        And I verify that files exist matching `/etc/apt/auth.conf.d/90ubuntu-advantage`
+        And I verify that files exist matching `/etc/apt/trusted.gpg.d/ubuntu-advantage-esm-infra-trusty.gpg`
+        And I verify that files exist matching `/etc/apt/sources.list.d/ubuntu-esm-infra.list`
+        And I verify that files exist matching `/etc/apt/preferences.d/ubuntu-esm-infra`
+        When I run `apt-get purge ubuntu-advantage-tools -y` with sudo, retrying exit [100]
+        Then stdout matches regexp:
+        """
+        Purging configuration files for ubuntu-advantage-tools
+        """
+        And I verify that no files exist matching `/var/log/ubuntu-advantage.log`
+        And I verify that no files exist matching `/var/lib/ubuntu-advantage`
+        And I verify that no files exist matching `/etc/apt/auth.conf.d/90ubuntu-advantage`
+        And I verify that no files exist matching `/etc/apt/sources.list.d/ubuntu-*`
+        And I verify that no files exist matching `/etc/apt/trusted.gpg.d/ubuntu-advantage-*`
+        And I verify that no files exist matching `/etc/apt/preferences.d/ubuntu-*`
+
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | trusty  |
+           | xenial  |
+
+    @series.all
+    Scenario Outline: Enable command with invalid repositories in user machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua disable esm-infra` with sudo
+        And I run `add-apt-repository ppa:ua-client/staging -y` with sudo, retrying exit [1]
+        And I run `apt update` with sudo
+        And I run `sed -i 's/ubuntu/ubun/' /etc/apt/sources.list.d/<ppa_file>.list` with sudo
+        And I run `ua enable esm-infra` with sudo
+        Then stdout matches regexp:
+        """
+        One moment, checking your subscription first
+        Updating package lists
+        APT update failed.
+        APT update failed to read APT config for the following URL:
+        - http://ppa.launchpad.net/ua-client/staging/ubun
+        """
+
+        Examples: ubuntu release
+           | release | ppa_file                        |
+           | trusty  | ua-client-staging-trusty        |
+           | xenial  | ua-client-ubuntu-staging-xenial |
+           | bionic  | ua-client-ubuntu-staging-bionic |
+           | focal   | ua-client-ubuntu-staging-focal  |
diff --git a/features/attached_enable.feature b/features/attached_enable.feature
index 86f2a56..8a36fce 100644
--- a/features/attached_enable.feature
+++ b/features/attached_enable.feature
@@ -1,131 +1,437 @@
 @uses.config.contract_token
 Feature: Enable command behaviour when attached to an UA subscription
 
+    @series.all
+    Scenario Outline: Attached enable Common Criteria service in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable cc-eal` `as non-root` exits `1`
+        And I will see the following on stderr:
+            """
+            This command must be run as root (try using sudo)
+            """
+        And I verify that running `ua enable cc-eal --beta` `with sudo` exits `1`
+        And I will see the following on stdout
+            """
+            One moment, checking your subscription first
+            <msg>
+            """
+        And I verify that running `ua enable cc-eal` `with sudo` exits `1`
+        And I will see the following on stdout:
+            """
+            One moment, checking your subscription first
+            """
+        And stderr matches regexp:
+            """
+            Cannot enable unknown service 'cc-eal'.
+            Try esm-infra, fips, fips-updates, livepatch
+            """
 
-    Scenario: Attached enable Livepatch service in a trusty lxd container
-        Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
-        And I run `ua enable livepatch` as non-root
-        Then I will see the following on stderr:
+        Examples: ubuntu release
+           | release | msg                                                            |
+           | bionic  | CC EAL2 is not available for Ubuntu 18.04 LTS (Bionic Beaver). |
+           | focal   | CC EAL2 is not available for Ubuntu 20.04 LTS (Focal Fossa).   |
+           | trusty  | CC EAL2 is not available for Ubuntu 14.04 LTS (Trusty Tahr).   |
+
+    @series.all
+    Scenario Outline: Attached enable a disabled beta service and unknown service in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable cc-eal foobar` `as non-root` exits `1`
+        And I will see the following on stderr:
             """
             This command must be run as root (try using sudo)
             """
-        When I run `ua enable livepatch` with sudo
-        Then I will see the following on stdout:
+        And I verify that running `ua enable cc-eal foobar` `with sudo` exits `1`
+        And I will see the following on stdout:
             """
             One moment, checking your subscription first
-            Cannot install Livepatch on a container
+            """
+        And stderr matches regexp:
+            """
+            Cannot enable unknown service 'foobar, cc-eal'.
+            Try esm-infra, fips, fips-updates, livepatch
             """
 
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | trusty  |
+           | xenial  |
 
-    Scenario: Attached enable Common Criteria service in a trusty lxd container
-        Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
-        And I run `ua enable cc-eal` as non-root
-        Then I will see the following on stderr:
+    @series.all
+    Scenario Outline: Attached enable of an unknown service in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable foobar` `as non-root` exits `1`
+        And I will see the following on stderr:
             """
             This command must be run as root (try using sudo)
             """
-        When I run `ua enable cc-eal` with sudo
-        Then I will see the following on stdout
+        And I verify that running `ua enable foobar` `with sudo` exits `1`
+        And I will see the following on stdout:
             """
             One moment, checking your subscription first
-            CC EAL2 is not available for Ubuntu 14.04 LTS (Trusty Tahr).
+            """
+        And stderr matches regexp:
+            """
+            Cannot enable unknown service 'foobar'.
+            Try esm-infra, fips, fips-updates, livepatch
             """
 
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | trusty  |
+           | xenial  |
 
-    Scenario: Attached enable CIS Audit service in a trusty lxd container
-        Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
-        And I run `ua enable cis-audit` as non-root
-        Then I will see the following on stderr:
+    @series.all
+    Scenario Outline: Attached enable of a known service already enabled (UA Infra) in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable esm-infra` `as non-root` exits `1`
+        And I will see the following on stderr:
             """
             This command must be run as root (try using sudo)
             """
-        When I run `ua enable cis-audit` with sudo
+        And I verify that running `ua enable esm-infra` `with sudo` exits `1`
         Then I will see the following on stdout:
             """
             One moment, checking your subscription first
-            This subscription is not entitled to CIS Audit.
-            For more information see: https://ubuntu.com/advantage
+            ESM Infra is already enabled.
+            See: sudo ua status
             """
+        When I run `apt-cache policy` with sudo
+        Then apt-cache policy for the following url has permission `500`
+        """
+        <esm-infra-url> <release>-infra-updates/main amd64 Packages
+        """
+        And I verify that running `apt update` `with sudo` exits `0`
+        When I run `apt install -y <infra-pkg>` with sudo, retrying exit [100]
+        And I run `apt-cache policy <infra-pkg>` as non-root
+        Then stdout matches regexp:
+        """
+        \s*500 <esm-infra-url> <release>-infra-security/main amd64 Packages
+        \s*500 <esm-infra-url> <release>-infra-updates/main amd64 Packages
+        """
 
-    Scenario: Attached enable UA Apps service in a trusty lxd container
-        Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
-        And I run `ua enable esm-apps` as non-root
-        Then I will see the following on stderr:
+        Examples: ubuntu release
+           | release | infra-pkg | esm-infra-url                       |
+           | bionic  | libkrad0  | https://esm.ubuntu.com/infra/ubuntu |
+           | focal   | hello     | https://esm.ubuntu.com/infra/ubuntu |
+           | trusty  | libgit2-0 | https://esm.ubuntu.com/ubuntu/      |
+           | xenial  | libkrad0  | https://esm.ubuntu.com/infra/ubuntu |
+
+    @series.xenial
+    @series.bionic
+    @series.focal
+    Scenario Outline: Attached enable of a know service shows update in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable esm-infra` `with sudo` exits `1`
+        And I will see the following on stdout:
+            """
+            One moment, checking your subscription first
+            ESM Infra is already enabled.
+            See: sudo ua status
+            """
+        When I run `apt install -y <pkg-version>` with sudo, retrying exit [100]
+        And I run `apt update` with sudo
+        Then stdout matches regexp
+        """
+        \d+ of the updates (is|are) from UA Infra: ESM
+        """
+        When I run `ua disable esm-infra` with sudo
+        And I run `apt update` with sudo
+        Then stdout does not match regexp
+        """
+        \d+ of the updates (is|are) from UA Infra: ESM
+        """
+
+        Examples: ubuntu release
+           | release | pkg-version            |
+           | bionic  | libkrad0=1.16-2build1  |
+           | focal   | hello=2.10-2ubuntu2    |
+           | xenial  | libkrad0=1.13.2+dfsg-5 |
+
+    @series.all
+    @uses.config.machine_type.lxd.container
+    Scenario Outline:  Attached enable of non-container services in a ubuntu lxd container
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable <service> <flag>` `as non-root` exits `1`
+        And I will see the following on stderr:
             """
             This command must be run as root (try using sudo)
             """
-        When I run `ua enable esm-apps` with sudo
-        Then I will see the following on stdout:
+        And I verify that running `ua enable <service> <flag>` `with sudo` exits `1`
+        And I will see the following on stdout:
             """
             One moment, checking your subscription first
-            This subscription is not entitled to ESM Apps.
-            For more information see: https://ubuntu.com/advantage
+            Cannot install <title> on a container
             """
 
+        Examples: Un-supported services in containers
+           | release | service      | title        | flag         |
+           | bionic  | livepatch    | Livepatch    |              |
+           | bionic  | fips         | FIPS         | --assume-yes |
+           | bionic  | fips-updates | FIPS Updates | --assume-yes |
+           | focal   | livepatch    | Livepatch    |              |
+           | focal   | fips         | FIPS         | --assume-yes |
+           | focal   | fips-updates | FIPS Updates | --assume-yes |
+           | trusty  | livepatch    | Livepatch    |              |
+           | trusty  | fips         | FIPS         | --assume-yes |
+           | trusty  | fips-updates | FIPS Updates | --assume-yes |
+           | xenial  | livepatch    | Livepatch    |              |
+           | xenial  | fips         | FIPS         | --assume-yes |
+           | xenial  | fips-updates | FIPS Updates | --assume-yes |
 
-    Scenario: Attached enable NIST-certified FIPS service in a trusty lxd container
-        Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
-        And I run `ua enable fips` as non-root
-        Then I will see the following on stderr:
+    @series.all
+    Scenario Outline: Attached enable not entitled service in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable <service>` `as non-root` exits `1`
+        And I will see the following on stderr:
             """
             This command must be run as root (try using sudo)
             """
-        When I run `ua enable fips` with sudo
-        Then I will see the following on stdout:
+        And I verify that running `ua enable <service> --beta` `with sudo` exits `1`
+        And I will see the following on stdout:
             """
             One moment, checking your subscription first
-            Cannot install FIPS on a container
+            This subscription is not entitled to <title>.
+            For more information see: https://ubuntu.com/advantage
             """
 
+        Examples: not entitled services
+           | release | service      | title        |
+           | bionic  | cis          | CIS Audit    |
+           | bionic  | esm-apps     | ESM Apps     |
+           | focal   | cis          | CIS Audit    |
+           | focal   | esm-apps     | ESM Apps     |
+           | trusty  | cis          | CIS Audit    |
+           | trusty  | esm-apps     | ESM Apps     |
+           | xenial  | cis          | CIS Audit    |
+           | xenial  | esm-apps     | ESM Apps     |
 
-    Scenario: Attached enable Uncertified FIPS service in a trusty lxd container
-        Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
-        And I run `ua enable fips-updates` as non-root
+    @series.focal
+    @uses.config.machine_type.lxd.vm
+    Scenario: Attached enable of vm-based services in a focal lxd vm
+        Given a `focal` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable fips --assume-yes` `with sudo` exits `1`
+        And I will see the following on stdout:
+            """
+            One moment, checking your subscription first
+            FIPS is not available for Ubuntu 20.04 LTS (Focal Fossa).
+            """
+        And I verify that running `ua enable fips-updates --assume-yes` `with sudo` exits `1`
+        And I will see the following on stdout:
+            """
+            One moment, checking your subscription first
+            FIPS Updates is not available for Ubuntu 20.04 LTS (Focal Fossa).
+            """
+
+    @series.bionic
+    @series.xenial
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: Attached enable of vm-based services in a bionic lxd vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua status` with sudo
+        Then stdout matches regexp:
+        """
+        esm-infra    +yes      +enabled  +UA Infra: Extended Security Maintenance \(ESM\)
+        fips         +yes      +disabled +NIST-certified FIPS modules
+        fips-updates +yes      +disabled +Uncertified security updates to FIPS modules
+        livepatch    +yes      +enabled  +Canonical Livepatch service
+        """
+        When I run `ua disable livepatch` with sudo
+        Then I verify that running `canonical-livepatch status` `with sudo` exits `1`
+        And stdout matches regexp:
+        """
+        Machine is not enabled. Please run 'sudo canonical-livepatch enable' with the
+        token obtained from https://ubuntu.com/livepatch.
+        """
+        When I run `ua status` with sudo
+        Then stdout matches regexp:
+        """
+        esm-infra    +yes      +enabled  +UA Infra: Extended Security Maintenance \(ESM\)
+        fips         +yes      +disabled +NIST-certified FIPS modules
+        fips-updates +yes      +disabled +Uncertified security updates to FIPS modules
+        livepatch    +yes      +disabled +Canonical Livepatch service
+        """
+
+        Examples: ubuntu release
+           | release |
+           | xenial  |
+           | bionic  |
+
+    @series.bionic
+    @series.xenial
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: Attached enable livepatch on a machine with fips active
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I verify that running `canonical-livepatch status` `with sudo` exits `1`
         Then I will see the following on stderr:
             """
-            This command must be run as root (try using sudo)
+            sudo: canonical-livepatch: command not found
+            """
+        When I attach `contract_token` with sudo
+        Then stdout matches regexp:
+            """
+            Installing canonical-livepatch snap
+            Canonical livepatch enabled
             """
-        When I run `ua enable fips-updates` with sudo
+        When I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            livepatch     yes                enabled
+            """
+        When I run `canonical-livepatch status` with sudo
+        Then stdout matches regexp:
+            """
+            running: true
+            """
+
+        Examples: ubuntu release
+           | release |
+           | xenial  |
+           | bionic  |
+
+    @series.bionic
+    @uses.config.machine_type.lxd.vm
+    Scenario: Attached enable fips on a machine with livepatch active
+        Given a `bionic` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            ESM Infra enabled
+            Installing canonical-livepatch snap
+            Canonical livepatch enabled
+            """
+        When I run `ua disable livepatch` with sudo
+        And I run `ua enable fips --assume-yes` with sudo
         Then I will see the following on stdout:
             """
             One moment, checking your subscription first
-            Cannot install FIPS Updates on a container
+            Updating package lists
+            Installing FIPS packages
+            FIPS enabled
+            A reboot is required to complete install
+            """
+        When I append the following on uaclient config:
+            """
+            features:
+              block_disable_on_enable: true
+            """
+        Then I verify that running `ua enable livepatch` `with sudo` exits `1`
+        And I will see the following on stdout
+            """
+            One moment, checking your subscription first
+            Cannot enable Livepatch when FIPS is enabled
             """
 
+    @series.bionic
+    @uses.config.machine_type.lxd.vm
+    Scenario: Attached enable livepatch on a machine with fips active
+        Given a `bionic` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            ESM Infra enabled
+            Installing canonical-livepatch snap
+            Canonical livepatch enabled
+            """
+        When I append the following on uaclient config:
+        """
+        features:
+          block_disable_on_enable: true
+        """
+        Then I verify that running `ua enable fips --assume-yes` `with sudo` exits `1`
+        And I will see the following on stdout
+            """
+            One moment, checking your subscription first
+            Cannot enable FIPS when Livepatch is enabled
+            """
 
-    Scenario: Attached enable of an unknown service in a trusty lxd container
-        Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
-        And I run `ua enable foobar` as non-root
-        Then I will see the following on stderr:
+    @series.xenial
+    @series.bionic
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: Attached enable fips on a machine with livepatch active
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then stdout matches regexp:
             """
-            This command must be run as root (try using sudo)
+            Updating package lists
+            ESM Infra enabled
             """
-        When I run `ua enable foobar` with sudo
-        Then I will see the following on stderr:
+        And stdout matches regexp:
+            """
+            Installing canonical-livepatch snap
+            Canonical livepatch enabled
+            """
+        When I run `ua enable fips --assume-yes` with sudo
+        Then I will see the following on stdout
+            """
+            One moment, checking your subscription first
+            Updating package lists
+            Installing FIPS packages
+            FIPS enabled
+            A reboot is required to complete install
             """
-            Cannot enable 'foobar'
-            For a list of services see: sudo ua status
+        When I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            fips +yes +enabled
+            """
+        And stdout matches regexp:
+            """
+            livepatch +yes +n/a
             """
 
-    Scenario: Attached enable of a known service already enabled (UA Infra) in a trusty lxd container
-        Given a trusty lxd container with ubuntu-advantage-tools installed
-        When I attach contract_token with sudo
-        And I run `ua enable esm-infra` as non-root
-        Then I will see the following on stderr:
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | xenial  |
+
+    @series.xenial
+    @series.bionic
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: Attached enable fips on a machine with fips-updates active
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then stdout matches regexp:
             """
-            This command must be run as root (try using sudo)
+            ESM Infra enabled
+            """
+        And stdout matches regexp:
+            """
+            Installing canonical-livepatch snap
+            Canonical livepatch enabled
             """
-        When I run `ua enable esm-infra` with sudo
+        When I run `ua disable livepatch` with sudo
+        And I run `ua enable fips-updates --assume-yes` with sudo
         Then I will see the following on stdout:
             """
             One moment, checking your subscription first
-            ESM Infra is already enabled.
-            See: sudo ua status
+            Updating package lists
+            Installing FIPS Updates packages
+            FIPS Updates enabled
+            A reboot is required to complete install
             """
+        When I verify that running `ua enable fips --assume-yes` `with sudo` exits `1`
+        Then I will see the following on stdout
+            """
+            One moment, checking your subscription first
+            Cannot enable FIPS when FIPS Updates is enabled
+            """
+
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | xenial  |
diff --git a/features/aws-ids.yaml b/features/aws-ids.yaml
 new file mode 100644
index 0000000..e065192
--- /dev/null
+++ b/features/aws-ids.yaml
@@ -0,0 +1,4 @@
+bionic: ami-0e11aa8c6a6d58146
+focal: ami-0383ece2c0f6de239
+trusty: ami-0a64b4493bc9dc321
+xenial: ami-09e110a448d322f4a
diff --git a/features/azure-ids.yaml b/features/azure-ids.yaml
 new file mode 100644
index 0000000..0072983
--- /dev/null
+++ b/features/azure-ids.yaml
@@ -0,0 +1,4 @@
+bionic: "Canonical:0001-com-ubuntu-pro-bionic:pro-18_04-lts"
+focal: "Canonical:0001-com-ubuntu-pro-focal:pro-20_04-lts"
+trusty: "Canonical:0001-com-ubuntu-pro-trusty:pro-14_04-lts"
+xenial: "Canonical:0001-com-ubuntu-pro-xenial:pro-16_04-lts"
diff --git a/features/cloud.py b/features/cloud.py
 new file mode 100644
index 0000000..4443345
--- /dev/null
+++ b/features/cloud.py
@@ -0,0 +1,744 @@
+import json
+import os
+import logging
+import pycloudlib  # type: ignore
+import time
+import yaml
+
+try:
+    from typing import Tuple, List, Optional  # noqa
+except ImportError:
+    # typing isn't available on trusty, so ignore its absence
+    pass
+
+
+class Cloud:
+    """Base class for cloud providers that should be tested through behave.
+
+    :machine_type:
+        A string representing the type of machine to launch (pro or generic)
+    :region:
+        The region to create the cloud resources on
+    :param tag:
+        A tag to be used when creating the resources on the cloud provider
+    :timestamp_suffix:
+        Boolean set true to direct pycloudlib to append a timestamp to the end
+        of the provided tag.
+    """
+
+    name = ""
+    pro_ids_path = ""
+    env_vars: "Tuple[str, ...]" = ()
+
+    def __init__(
+        self,
+        machine_type: str,
+        region: "Optional[str]" = None,
+        tag: "Optional[str]" = None,
+        timestamp_suffix: bool = True,
+    ) -> None:
+        if tag:
+            self.tag = tag
+        else:
+            self.tag = "uaclient-ci"
+        self.machine_type = machine_type
+        self.region = region
+        self._api = None
+        self.key_name = pycloudlib.util.get_timestamped_tag(self.tag)
+        self.timestamp_suffix = timestamp_suffix
+
+        missing_env_vars = self.missing_env_vars()
+        if missing_env_vars:
+            logging.warning(
+                "".join(
+                    [
+                        "UACLIENT_BEHAVE_MACHINE_TYPE={} requires".format(
+                            self.machine_type
+                        ),
+                        " the following env vars:\n",
+                        *self.format_missing_env_vars(missing_env_vars),
+                    ]
+                )
+            )
+
+    @property
+    def api(self) -> pycloudlib.cloud.BaseCloud:
+        """Return the api used to interact with the cloud provider."""
+        raise NotImplementedError
+
+    def _create_instance(
+        self,
+        series: str,
+        instance_name: "Optional[str]" = None,
+        image_name: "Optional[str]" = None,
+        user_data: "Optional[str]" = None,
+    ) -> pycloudlib.instance:
+        """Create an instance for on the cloud provider.
+
+        :param series:
+            The ubuntu release to be used when creating an instance. We will
+            create an image based on this value if the used does not provide
+            a image_name value
+        :param instance_name:
+            The name of the instance to be created
+        :param image_name:
+            The name of the image to be used when creating the instance
+        :param user_data:
+            The user data to be passed when creating the instance
+
+        :returns:
+            A cloud provider instance
+        """
+        raise NotImplementedError
+
+    def _check_cloudinit_status(
+        self, instance: pycloudlib.instance.BaseInstance
+    ) -> None:
+        """
+        Check if cloudinit was able to finish without errors.
+
+        :param instance:
+            An instance created on the cloud provider
+        """
+        result = instance.execute(["cloud-init", "status", "--wait", "--long"])
+
+        if result.failed:
+            raise OSError(
+                "cloud-init failed to start\n: out: %s\n error: %s"
+                % (result.stdout, result.stderr)
+            )
+
+        print("--- cloud-init succeeded")
+
+    def launch(
+        self,
+        series: str,
+        instance_name: "Optional[str]" = None,
+        image_name: "Optional[str]" = None,
+        user_data: "Optional[str]" = None,
+    ) -> pycloudlib.instance.BaseInstance:
+        """Create and wait for cloud provider instance to be ready.
+
+        :param series:
+            The ubuntu release to be used when creating an instance. We will
+            create an image based on this value if the used does not provide
+            a image_name value
+        :param instance_name:
+            The name of the instance to be created
+        :param image_name:
+            The name of the image to be used when creating the instance
+        :param user_data:
+            The user data to be passed when creating the instance
+
+        :returns:
+            An cloud provider instance
+        """
+        inst = self._create_instance(
+            series=series,
+            instance_name=instance_name,
+            image_name=image_name,
+            user_data=user_data,
+        )
+        print(
+            "--- {} instance launched: {}. Waiting for ssh access".format(
+                self.name, inst.name
+            )
+        )
+        time.sleep(15)
+        for sleep in (5, 10, 15):
+            try:
+                inst.wait()
+                break
+            except Exception as e:
+                print("--- Retrying instance.wait on {}".format(str(e)))
+
+        if series != "trusty":
+            self._check_cloudinit_status(inst)
+
+        return inst
+
+    def get_instance_id(
+        self, instance: pycloudlib.instance.BaseInstance
+    ) -> str:
+        """Return the instance identifier.
+
+        :param instance:
+            An instance created on the cloud provider
+
+        :returns:
+            The string of the unique instance id
+        """
+        return instance.id
+
+    def format_missing_env_vars(self, missing_env_vars: "List") -> "List[str]":
+        """Format missing env vars to be displayed in log.
+
+        :returns:
+            A list of env string formatted to be used when logging
+        """
+        return [" - {}\n".format(env_var) for env_var in missing_env_vars]
+
+    def missing_env_vars(self) -> "List[str]":
+        """Return a list of env variables necessary for this cloud provider.
+
+        :returns:
+            A list of string representing the missing variables
+        """
+        return [
+            env_name
+            for env_name in self.env_vars
+            if not getattr(
+                self, env_name.lower().replace("uaclient_behave_", "")
+            )
+        ]
+
+    def locate_image_name(self, series: str) -> str:
+        """Locate and return the image name to use for vm provision.
+
+        :param series:
+            The ubuntu release to be used when locating the image name
+
+        :returns:
+            A image name to use when provisioning a virtual machine
+            based on the series value
+        """
+        if not series:
+            raise ValueError(
+                "Must provide either series or image_name to launch azure"
+            )
+
+        if "pro" in self.machine_type:
+            with open(self.pro_ids_path, "r") as stream:
+                pro_ids = yaml.safe_load(stream.read())
+            image_name = pro_ids[series]
+        else:
+            image_name = self.api.daily_image(release=series)
+
+        return image_name
+
+    def manage_ssh_key(self, private_key_path: "Optional[str]" = None) -> None:
+        """Create and manage ssh key pairs to be used in the cloud provider.
+
+        :param private_key_path:
+            Location of the private key path to use. If None, the location
+            will be a default location.
+        """
+        cloud_name = self.name.lower().replace("_", "-")
+        pub_key_path = "{}-pubkey".format(cloud_name)
+        priv_key_path = "{}-privkey".format(cloud_name)
+        pub_key, priv_key = self.api.create_key_pair()
+
+        with open(pub_key_path, "w") as f:
+            f.write(pub_key)
+
+        with open(priv_key_path, "w") as f:
+            f.write(priv_key)
+
+        os.chmod(pub_key_path, 0o600)
+        os.chmod(priv_key_path, 0o600)
+
+        self.api.use_key(
+            public_key_path=pub_key_path, private_key_path=priv_key_path
+        )
+
+
+class EC2(Cloud):
+    """Class that represents the EC2 cloud provider.
+
+    :param aws_access_key_id:
+        The aws access key id
+    :param aws_secret_access_key:
+        The aws secret access key
+    :region:
+        The region to be used to create the aws instances
+    :machine_type:
+        A string representing the type of machine to launch (pro or generic)
+    :tag:
+        A tag to be used when creating the resources on the cloud provider
+    :timestamp_suffix:
+        Boolean set true to direct pycloudlib to append a timestamp to the end
+        of the provided tag.
+    """
+
+    name = "aws"
+    env_vars: "Tuple[str, ...]" = (
+        "aws_access_key_id",
+        "aws_secret_access_key",
+    )
+    pro_ids_path = "features/aws-ids.yaml"
+
+    def __init__(
+        self,
+        aws_access_key_id: "Optional[str]",
+        aws_secret_access_key: "Optional[str]",
+        machine_type: str,
+        region: "Optional[str]" = "us-east-2",
+        tag: "Optional[str]" = None,
+        timestamp_suffix: bool = True,
+    ) -> None:
+        self.aws_access_key_id = aws_access_key_id
+        self.aws_secret_access_key = aws_secret_access_key
+        logging.basicConfig(
+            filename="pycloudlib-behave.log", level=logging.DEBUG
+        )
+        super().__init__(
+            region=region,
+            machine_type=machine_type,
+            tag=tag,
+            timestamp_suffix=timestamp_suffix,
+        )
+
+    @property
+    def api(self) -> pycloudlib.cloud.BaseCloud:
+        """Return the api used to interact with the cloud provider."""
+        if self._api is None:
+            self._api = pycloudlib.EC2(
+                tag=self.tag,
+                access_key_id=self.aws_access_key_id,
+                secret_access_key=self.aws_secret_access_key,
+                region=self.region,
+                timestamp_suffix=self.timestamp_suffix,
+            )
+
+        return self._api
+
+    def manage_ssh_key(
+        self,
+        private_key_path: "Optional[str]" = None,
+        key_name: "Optional[str]" = None,
+    ) -> None:
+        """Create and manage ssh key pairs to be used in the cloud provider.
+
+        :param private_key_path:
+            Location of the private key path to use. If None, the location
+            will be a default location.
+        :param key_name:
+            Optional key_name to use when uploading to the cloud. Default is
+            uaclient-ci-<timestamp>
+        """
+        if key_name:
+            self.key_name = key_name
+        if not private_key_path:
+            if self.key_name in self.api.list_keys():
+                self.api.delete_key(self.key_name)
+
+            private_key_path = "ec2-{}.pem".format(self.key_name)
+            print(
+                "--- Creating local keyfile {} for EC2".format(
+                    private_key_path
+                )
+            )
+            keypair = self.api.client.create_key_pair(KeyName=self.key_name)
+
+            with open(private_key_path, "w") as stream:
+                stream.write(keypair["KeyMaterial"])
+            os.chmod(private_key_path, 0o600)
+
+        self.api.use_key(private_key_path, private_key_path, self.key_name)
+
+    def _create_instance(
+        self,
+        series: str,
+        instance_name: "Optional[str]" = None,
+        image_name: "Optional[str]" = None,
+        user_data: "Optional[str]" = None,
+    ) -> pycloudlib.instance:
+        """Launch an instance on the cloud provider.
+
+        :param series:
+            The ubuntu release to be used when creating an instance. We will
+            create an image based on this value if the used does not provide
+            a image_name value
+        :param instance_name:
+            The name of the instance to be created
+        :param image_name:
+            The name of the image to be used when creating the instance
+        :param user_data:
+            The user data to be passed when creating the instance
+
+        :returns:
+            An AWS cloud provider instance
+        """
+        if not image_name:
+            image_name = self.locate_image_name(series)
+
+        print("--- Launching AWS image {}({})".format(image_name, series))
+        vpc = self.api.get_or_create_vpc(name="uaclient-integration")
+
+        try:
+            inst = self.api.launch(image_name, user_data=user_data, vpc=vpc)
+        except Exception as e:
+            print(str(e))
+            raise
+
+        return inst
+
+
+class Azure(Cloud):
+    """Class that represents the Azure cloud provider.
+
+    :param az_client_id:
+        The Azure client id
+    :param az_client_secret
+        The Azure client secret
+    :param az_tenant_id:
+        The Azure tenant id
+    :param az_subscription_id:
+        The Azure subscription id
+    :machine_type:
+        A string representing the type of machine to launch (pro or generic)
+    :region:
+        The region to create the resources on
+    :tag:
+        A tag to be used when creating the resources on the cloud provider
+    :timestamp_suffix:
+        Boolean set true to direct pycloudlib to append a timestamp to the end
+        of the provided tag.
+    """
+
+    name = "Azure"
+    env_vars: "Tuple[str, ...]" = (
+        "az_client_id",
+        "az_client_secret",
+        "az_tenant_id",
+        "az_subscription_id",
+    )
+    pro_ids_path = "features/azure-ids.yaml"
+
+    def __init__(
+        self,
+        machine_type: str,
+        region: "Optional[str]" = "centralus",
+        tag: "Optional[str]" = None,
+        timestamp_suffix: bool = True,
+        az_client_id: "Optional[str]" = None,
+        az_client_secret: "Optional[str]" = None,
+        az_tenant_id: "Optional[str]" = None,
+        az_subscription_id: "Optional[str]" = None,
+    ) -> None:
+        self.az_client_id = az_client_id
+        self.az_client_secret = az_client_secret
+        self.az_tenant_id = az_tenant_id
+        self.az_subscription_id = az_subscription_id
+
+        super().__init__(
+            machine_type=machine_type,
+            region=region,
+            tag=tag,
+            timestamp_suffix=timestamp_suffix,
+        )
+
+    @property
+    def api(self) -> pycloudlib.cloud.BaseCloud:
+        """Return the api used to interact with the cloud provider."""
+        if self._api is None:
+            self._api = pycloudlib.Azure(
+                tag=self.tag,
+                client_id=self.az_client_id,
+                client_secret=self.az_client_secret,
+                tenant_id=self.az_tenant_id,
+                subscription_id=self.az_subscription_id,
+                timestamp_suffix=self.timestamp_suffix,
+            )
+
+        return self._api
+
+    def get_instance_id(
+        self, instance: pycloudlib.instance.BaseInstance
+    ) -> str:
+        """Return the instance identifier.
+
+        :param instance:
+            An instance created on the cloud provider
+
+        :returns:
+            The string of the unique instance id
+        """
+        # For Azure, the API identifier uses the instance name
+        # instead of the instance id
+        return instance.name
+
+    def manage_ssh_key(self, private_key_path: "Optional[str]" = None) -> None:
+        """Create and manage ssh key pairs to be used in the cloud provider.
+
+        :param private_key_path:
+            Location of the private key path to use. If None, the location
+            will be a default location.
+        """
+        if not private_key_path:
+            private_key_path = "azure-priv-{}.pem".format(self.key_name)
+            pub_key_path = "azure-pub-{}.txt".format(self.key_name)
+            print(
+                "--- Creating local keyfile {} for Azure".format(
+                    private_key_path
+                )
+            )
+        if not os.path.exists(private_key_path):
+            pub_key, priv_key = self.api.create_key_pair(
+                key_name=self.key_name
+            )
+
+            with open(pub_key_path, "w") as stream:
+                stream.write(pub_key)
+
+            with open(private_key_path, "w") as stream:
+                stream.write(priv_key)
+
+            os.chmod(pub_key_path, 0o600)
+            os.chmod(private_key_path, 0o600)
+
+        self.api.use_key(pub_key_path, private_key_path, self.key_name)
+
+    def _create_instance(
+        self,
+        series: str,
+        instance_name: "Optional[str]" = None,
+        image_name: "Optional[str]" = None,
+        user_data: "Optional[str]" = None,
+    ) -> pycloudlib.instance:
+        """Launch an instance on the cloud provider.
+
+        :param series:
+            The ubuntu release to be used when creating an instance. We will
+            create an image based on this value if the used does not provide
+            a image_name value
+        :param instance_name:
+            The name of the instance to be created
+        :param image_name:
+            The name of the image to be used when creating the instance
+        :param user_data:
+            The user data to be passed when creating the instance
+
+        :returns:
+            An AWS cloud provider instance
+        """
+        if not image_name:
+            image_name = self.locate_image_name(series)
+
+        print("--- Launching Azure image {}({})".format(image_name, series))
+        inst = self.api.launch(image_id=image_name, user_data=user_data)
+        return inst
+
+
+class GCP(Cloud):
+    name = "gcp"
+    pro_ids_path = "features/gcp-ids.yaml"
+
+    """Class that represents the Google Cloud Platform cloud provider.
+
+    :param gcp_credentials_path
+        The GCP credentials path to use when authentiacting to GCP
+    :param gcp_project
+        The name of the GCP project to be used
+    :machine_type:
+        A string representing the type of machine to launch (pro or generic)
+    :region:
+        The region to create the resources on
+    :tag:
+        A tag to be used when creating the resources on the cloud provider
+    :timestamp_suffix:
+        Boolean set true to direct pycloudlib to append a timestamp to the end
+        of the provided tag.
+    """
+
+    env_vars: "Tuple[str, ...]" = ("gcp_credentials_path", "gcp_project")
+
+    def __init__(
+        self,
+        machine_type: str,
+        region: "Optional[str]" = "us-west2",
+        tag: "Optional[str]" = None,
+        timestamp_suffix: bool = True,
+        zone: "Optional[str]" = "a",
+        gcp_credentials_path: "Optional[str]" = None,
+        gcp_project: "Optional[str]" = None,
+    ) -> None:
+        self.gcp_credentials_path = gcp_credentials_path
+        self.gcp_project = gcp_project
+        self.zone = zone
+
+        super().__init__(
+            machine_type=machine_type,
+            region=region,
+            tag=tag,
+            timestamp_suffix=timestamp_suffix,
+        )
+
+        self._set_service_account_email()
+
+    def _set_service_account_email(self):
+        """Set service account email if credentials provided."""
+        json_credentials = {}
+
+        if self.gcp_credentials_path:
+            with open(self.gcp_credentials_path, "r") as f:
+                json_credentials = json.load(f)
+
+        self.service_account_email = json_credentials.get("client_email")
+
+    @property
+    def api(self) -> pycloudlib.cloud.BaseCloud:
+        """Return the api used to interact with the cloud provider."""
+        if self._api is None:
+            self._api = pycloudlib.GCE(
+                tag=self.tag,
+                timestamp_suffix=self.timestamp_suffix,
+                credentials_path=self.gcp_credentials_path,
+                project=self.gcp_project,
+                zone=self.zone,
+                region=self.region,
+                service_account_email=self.service_account_email,
+            )
+
+        return self._api
+
+    def _create_instance(
+        self,
+        series: str,
+        instance_name: "Optional[str]" = None,
+        image_name: "Optional[str]" = None,
+        user_data: "Optional[str]" = None,
+    ) -> pycloudlib.instance:
+        """Launch an instance on the cloud provider.
+
+        :param series:
+            The ubuntu release to be used when creating an instance. We will
+            create an image based on this value if the used does not provide
+            a image_name value
+        :param instance_name:
+            The name of the instance to be created
+        :param image_name:
+            The name of the image to be used when creating the instance
+        :param user_data:
+            The user data to be passed when creating the instance
+
+        :returns:
+            An AWS cloud provider instance
+        """
+        if not image_name:
+            image_name = self.locate_image_name(series)
+
+        print("--- Launching GCP image {}({})".format(image_name, series))
+        inst = self.api.launch(image_id=image_name, user_data=user_data)
+        return inst
+
+
+class _LXD(Cloud):
+    name = "_lxd"
+
+    @property
+    def pycloudlib_cls(self):
+        """Return the pycloudlib cls to be used as an api."""
+        raise NotImplementedError
+
+    def _create_instance(
+        self,
+        series: str,
+        instance_name: "Optional[str]" = None,
+        image_name: "Optional[str]" = None,
+        user_data: "Optional[str]" = None,
+    ) -> pycloudlib.instance:
+        """Launch an instance on the cloud provider.
+
+        :param series:
+            The ubuntu release to be used when creating an instance. We will
+            create an image based on this value if the used does not provide
+            a image_name value
+        :param instance_name:
+            The name of the instance to be created
+        :param image_name:
+            The name of the image to be used when creating the instance
+        :param user_data:
+            The user data to be passed when creating the instance
+
+        :returns:
+            An AWS cloud provider instance
+        """
+        if not image_name:
+            image_name = self.locate_image_name(series)
+
+        image_type = self.name.title().replace("-", " ")
+
+        print(
+            "--- Launching {} image {}({})".format(
+                image_type, image_name, series
+            )
+        )
+
+        inst = self.api.launch(
+            name=instance_name, image_id=image_name, user_data=user_data
+        )
+        return inst
+
+    def get_instance_id(
+        self, instance: pycloudlib.instance.BaseInstance
+    ) -> str:
+        """Return the instance identifier.
+
+        :param instance:
+            An instance created on the cloud provider
+
+        :returns:
+            The string of the unique instance id
+        """
+        # For LXD, the API identifier uses the instance name
+        # instead of the instance id
+        return instance.name
+
+    def locate_image_name(self, series: str) -> str:
+        """Locate and return the image name to use for vm provision.
+
+        :param series:
+            The ubuntu release to be used when locating the image name
+
+        :returns:
+            A image name to use when provisioning a virtual machine
+            based on the series value
+        """
+        if not series:
+            raise ValueError(
+                "Must provide either series or image_name to launch azure"
+            )
+
+        image_name = self.api.daily_image(release=series)
+        return image_name
+
+    @property
+    def api(self) -> pycloudlib.cloud.BaseCloud:
+        """Return the api used to interact with the cloud provider."""
+        if self._api is None:
+            self._api = self.pycloudlib_cls(
+                tag=self.tag, timestamp_suffix=self.timestamp_suffix
+            )
+
+        return self._api
+
+
+class LXDVirtualMachine(_LXD):
+    name = "lxd-virtual-machine"
+
+    @property
+    def pycloudlib_cls(self):
+        """Return the pycloudlib cls to be used as an api."""
+        return pycloudlib.LXDVirtualMachine
+
+
+class LXDContainer(_LXD):
+    name = "lxd-container"
+
+    @property
+    def pycloudlib_cls(self):
+        """Return the pycloudlib cls to be used as an api."""
+        return pycloudlib.LXDContainer
+
+    def manage_ssh_key(self, private_key_path: "Optional[str]" = None) -> None:
+        """Create and manage ssh key pairs to be used in the cloud provider.
+
+        On a LXD container, we do not use ssh keys to communicate with the
+        instance. Therefore, this method should not be used.
+
+        :param private_key_path:
+            Location of the private key path to use. If None, the location
+            will be a default location.
+        """
+        pass
diff --git a/features/environment.py b/features/environment.py
index 54d00eb..9a53933 100644
--- a/features/environment.py
+++ b/features/environment.py
@@ -1,13 +1,70 @@
 import datetime
+import errno
 import os
-import subprocess
-from typing import Dict, Union
+import itertools
+import tempfile
+import textwrap
+import logging
+import pycloudlib  # type: ignore
 
-from behave.model import Scenario
+try:
+    from typing import Dict, Optional, Union, List, Tuple, Any  # noqa: F401
+except ImportError:
+    # typing isn't available on trusty, so ignore its absence
+    pass
+
+from behave.model import Feature, Scenario
 
 from behave.runner import Context
 
-from features.util import launch_lxd_container, lxc_exec
+import features.cloud as cloud
+
+from features.util import emit_spinner_on_travis, lxc_get_property, build_debs
+
+ALL_SUPPORTED_SERIES = ["bionic", "focal", "trusty", "xenial"]
+
+DAILY_PPA = "http://ppa.launchpad.net/canonical-server/ua-client-daily/ubuntu"
+DAILY_PPA_KEYID = "8A295C4FB8B190B7"
+
+USERDATA_BLOCK_AUTO_ATTACH_IMG = """\
+#cloud-config
+bootcmd:
+ - cp /usr/bin/ua /usr/bin/ua.orig
+ - 'echo "#!/bin/sh\ndate >> /root/ua-calls\n" > /usr/bin/ua'
+ - chmod 755 /usr/bin/ua
+"""
+
+USERDATA_APT_SOURCE_PPA_TRUSTY = """\
+apt_sources:  # for trusty
+  - source: deb {ppa_url} $RELEASE main
+    keyid: {ppa_keyid}
+packages: [{packages}]
+"""
+
+USERDATA_APT_SOURCE_PPA = """\
+apt:
+  sources:
+    ua-tools-ppa:
+        source: deb {ppa_url} $RELEASE main
+        keyid: {ppa_keyid}
+packages: [{packages}]
+"""
+
+PROCESS_LOG_TMPL = """\
+returncode: {}
+stdout:
+{stdout}
+stderr:
+{stderr}
+"""
+
+PROCESS_LOG_TMPL = """\
+returncode: {returncode}
+stdout:
+{stdout}
+stderr:
+{stderr}
+"""
 
 
 class UAClientBehaveConfig:
@@ -19,16 +76,32 @@ class UAClientBehaveConfig:
 
     :param contract_token:
         A valid contract token to use during attach scenarios
+    :param contract_token_staging:
+        A valid staging contract token to use during attach scenarios
     :param image_clean:
         This indicates whether the image created for this test run should be
         cleaned up when all tests are complete.
+    :param machine_type:
+        The default machine_type to test: lxd.container, lxd.vm, azure.pro,
+            azure.generic, aws.pro or aws.generic
+    :param private_key_file:
+        Optional path to pre-existing private key file to use when connecting
+        launched VMs via ssh.
+    :param private_key_name:
+        Optional name of the cloud's named private key object to use when
+        connecting to launched VMs via ssh. Default: uaclient-integration.
     :param reuse_image:
         A string with an image name that should be used instead of building a
-        fresh image for this test run.  If specified, image_clean will be set
-        to False.
+        fresh image for this test run.   If specified, this image will not be
+        deleted.
     :param destroy_instances:
         This boolean indicates that test containers should be destroyed after
         the completion. Set to False to leave instances running.
+    :param debs_path:
+        Location of the debs to be used when lauching a focal integration
+        test. If that path is None, we will build those debs locally.
+    :param artifact_dir:
+        Location where test artifacts are emitted.
     """
 
     prefix = "UACLIENT_BEHAVE_"
@@ -36,48 +109,200 @@ class UAClientBehaveConfig:
     # These variables are used in .from_environ() to convert the string
     # environment variable input to the appropriate Python types for use within
     # the test framework
-    boolean_options = ["image_clean", "destroy_instances"]
-    str_options = ["contract_token", "reuse_image"]
-    redact_options = ["contract_token"]
+    boolean_options = ["build_pr", "image_clean", "destroy_instances"]
+    str_options = [
+        "aws_access_key_id",
+        "aws_secret_access_key",
+        "az_client_id",
+        "az_client_secret",
+        "az_tenant_id",
+        "az_subscription_id",
+        "gcp_credentials_path",
+        "gcp_project",
+        "contract_token",
+        "contract_token_staging",
+        "machine_type",
+        "private_key_file",
+        "private_key_name",
+        "reuse_image",
+        "debs_path",
+        "artifact_dir",
+        "ppa",
+        "ppa_keyid",
+    ]
+    redact_options = [
+        "aws_access_key_id",
+        "aws_secret_access_key",
+        "az_client_id",
+        "az_client_secret",
+        "az_tenant_id",
+        "az_subscription_id",
+        "contract_token",
+        "contract_token_staging",
+    ]
 
     # This variable is used in .from_environ() but also to emit the "Config
     # options" stanza in __init__
     all_options = boolean_options + str_options
+    cloud_api = None  # type: pycloudlib.cloud.BaseCloud
+    cloud_manager = None  # type: cloud.Cloud
 
     def __init__(
         self,
         *,
+        aws_access_key_id: str = None,
+        aws_secret_access_key: str = None,
+        az_client_id: str = None,
+        az_client_secret: str = None,
+        az_tenant_id: str = None,
+        az_subscription_id: str = None,
+        gcp_credentials_path: str = None,
+        gcp_project: str = None,
+        build_pr: bool = False,
         image_clean: bool = True,
         destroy_instances: bool = True,
+        machine_type: str = "lxd.container",
+        private_key_file: str = None,
+        private_key_name: str = "uaclient-integration",
         reuse_image: str = None,
-        contract_token: str = None
+        contract_token: str = None,
+        contract_token_staging: str = None,
+        debs_path: str = None,
+        artifact_dir: str = None,
+        ppa: str = DAILY_PPA,
+        ppa_keyid: str = DAILY_PPA_KEYID,
+        cmdline_tags: "List" = []
     ) -> None:
         # First, store the values we've detected
+        self.aws_access_key_id = aws_access_key_id
+        self.aws_secret_access_key = aws_secret_access_key
+        self.az_client_id = az_client_id
+        self.az_client_secret = az_client_secret
+        self.az_tenant_id = az_tenant_id
+        self.az_subscription_id = az_subscription_id
+        self.gcp_credentials_path = gcp_credentials_path
+        self.gcp_project = gcp_project
+        self.build_pr = build_pr
         self.contract_token = contract_token
+        self.contract_token_staging = contract_token_staging
         self.image_clean = image_clean
         self.destroy_instances = destroy_instances
+        self.machine_type = machine_type
+        self.private_key_file = private_key_file
+        self.private_key_name = private_key_name
         self.reuse_image = reuse_image
-
+        self.cmdline_tags = cmdline_tags
+        self.debs_path = debs_path
+        self.artifact_dir = artifact_dir
+        self.ppa = ppa
+        self.ppa_keyid = ppa_keyid
+        self.filter_series = set(
+            [
+                tag.split(".")[1]
+                for tag in cmdline_tags
+                if tag.startswith("series.") and "series.all" not in tag
+            ]
+        )
         # Next, perform any required validation
         if self.reuse_image is not None:
             if self.image_clean:
-                print("reuse_image specified, setting image_clean = False")
-                self.image_clean = False
+                print(" Reuse_image specified, it will not be deleted.")
+
+        ignore_vars = ()  # type: Tuple[str, ...]
+        if "aws" not in self.machine_type:
+            ignore_vars += cloud.EC2.env_vars
+        if "azure" not in self.machine_type:
+            ignore_vars += cloud.Azure.env_vars
+        if "gcp" not in self.machine_type:
+            ignore_vars += cloud.GCP.env_vars
+        if "pro" in self.machine_type:
+            ignore_vars += (
+                "UACLIENT_BEHAVE_CONTRACT_TOKEN",
+                "UACLIENT_BEHAVE_CONTRACT_TOKEN_STAGING",
+            )
+        for env_name in ignore_vars:
+            attr_name = env_name.replace("UACLIENT_BEHAVE_", "").lower()
+            if getattr(self, attr_name):
+                print(
+                    " --- Ignoring {} because machine_type is {}".format(
+                        env_name, self.machine_type
+                    )
+                )
+                setattr(self, attr_name, None)
+        timed_job_tag = datetime.datetime.utcnow().strftime(
+            "uaclient-ci-%m%d-%H%M-"
+        )
+        # Jenkinsfile provides us with UACLIENT_BEHAVE_JENKINS_BUILD_TAG
+        job_suffix = os.environ.get("UACLIENT_BEHAVE_JENKINS_BUILD_TAG")
+        print("--- job suffix: {}".format(job_suffix), flush=True)
+        if not job_suffix:
+            job_suffix = os.environ.get("CHANGE_ID", "dev")
+        else:
+            job_suffix = job_suffix.split("PR-")[-1]
+        timed_job_tag += str(job_suffix)
+        timed_job_tag = timed_job_tag.replace(".", "-")
+        if "aws" in self.machine_type:
+            self.cloud_manager = cloud.EC2(
+                aws_access_key_id,
+                aws_secret_access_key,
+                region=os.environ.get("AWS_DEFAULT_REGION", "us-east-2"),
+                machine_type=self.machine_type,
+                tag=timed_job_tag,
+                timestamp_suffix=False,
+            )
+        elif "azure" in self.machine_type:
+            self.cloud_manager = cloud.Azure(
+                az_client_id=az_client_id,
+                az_client_secret=az_client_secret,
+                az_tenant_id=az_tenant_id,
+                az_subscription_id=az_subscription_id,
+                machine_type=self.machine_type,
+                tag=timed_job_tag,
+                timestamp_suffix=False,
+            )
+        elif "gcp" in self.machine_type:
+            self.cloud_manager = cloud.GCP(
+                machine_type=self.machine_type,
+                tag=timed_job_tag,
+                timestamp_suffix=False,
+                gcp_credentials_path=self.gcp_credentials_path,
+                gcp_project=gcp_project,
+            )
+        elif "lxd.vm" in self.machine_type:
+            self.cloud_manager = cloud.LXDVirtualMachine(
+                machine_type=self.machine_type
+            )
+        else:
+            self.cloud_manager = cloud.LXDContainer(
+                machine_type=self.machine_type
+            )
+
+        self.cloud_api = self.cloud_manager.api
 
         # Finally, print the config options.  This helps users debug the use of
         # config options, and means they'll be included in test logs in CI.
         print("Config options:")
         for option in self.all_options:
-            value = getattr(self, option, "ERROR")
-            if option in self.redact_options and value not in (None, "ERROR"):
+            value = getattr(self, option, "<UNSET>")
+            if option in self.redact_options and value not in (
+                None,
+                "<UNSET>",
+            ):
                 value = "<REDACTED>"
             print("  {}".format(option), "=", value)
 
     @classmethod
-    def from_environ(cls) -> "UAClientBehaveConfig":
+    def from_environ(cls, config) -> "UAClientBehaveConfig":
         """Gather config options from os.environ and return a config object"""
         # First, gather all known options
-        kwargs: Dict[str, Union[str, bool]] = {}
+        kwargs: Dict[str, Union[str, bool, "List"]] = {}
+        # Preserve cmdline_tags for reference
+        if not config.tags.ands:
+            kwargs["cmdline_tags"] = []
+        else:
+            kwargs["cmdline_tags"] = list(
+                itertools.chain.from_iterable(config.tags.ands)
+            )
         for key, value in os.environ.items():
             if not key.startswith(cls.prefix):
                 continue
@@ -98,96 +323,440 @@ class UAClientBehaveConfig:
 
 
 def before_all(context: Context) -> None:
-    """behave will invoke this before anything else happens.
-
-    In this function, we launch a container, install ubuntu-advantage-tools and
-    then capture an image.  This image is then reused by each feature, reducing
-    test execution time.
-    """
+    """behave will invoke this before anything else happens."""
+    context.config.setup_logging()
     userdata = context.config.userdata
-    context.reuse_container = userdata.get("reuse_container")
-    context.config = UAClientBehaveConfig.from_environ()
-    if context.config.reuse_image is None:
-        create_trusty_uat_lxd_image(context)
-    else:
-        context.image_name = context.config.reuse_image
-
-
-def before_scenario(context: Context, scenario: Scenario):
-    for tag in scenario.effective_tags:
+    if userdata:
+        logging.debug("Userdata key / value pairs:")
+        print("Userdata key / value pairs:")
+        for key, value in userdata.items():
+            logging.debug("   - {} = {}".format(key, value))
+            print("   - {} = {}".format(key, value))
+    context.series_image_name = {}
+    context.series_reuse_image = ""
+    context.reuse_container = {}
+    context.config = UAClientBehaveConfig.from_environ(context.config)
+    context.config.cloud_manager.manage_ssh_key()
+
+    if context.config.reuse_image:
+        series = lxc_get_property(
+            context.config.reuse_image, property_name="series", image=True
+        )
+        machine_type = lxc_get_property(
+            context.config.reuse_image,
+            property_name="machine_type",
+            image=True,
+        )
+        if machine_type:
+            print("Found machine_type: {vm_type}".format(vm_type=machine_type))
+        if series is not None:
+            context.series_reuse_image = series
+            context.series_image_name[series] = context.config.reuse_image
+        else:
+            print(" Could not check image series. It will not be used. ")
+            context.config.reuse_image = None
+
+    if userdata.get("reuse_container"):
+        inst = context.config.cloud_api.get_instance(
+            userdata.get("reuse_container")
+        )
+        codename = inst.execute(
+            ["grep", "UBUNTU_CODENAME", "/etc/os-release"]
+        ).strip()
+        [_, series] = codename.split("=")
+
+        context.reuse_container = {series: userdata.get("reuse_container")}
+        print(
+            textwrap.dedent(
+                """
+            You are providing a {series} container. Make sure you are running
+            this series tests. For instance: --tags=series.{series}""".format(
+                    series=series
+                )
+            )
+        )
+
+
+def _should_skip_tags(context: Context, tags: "List") -> str:
+    """Return a reason if a feature or scenario should be skipped"""
+    machine_type = getattr(context.config, "machine_type", "")
+    machine_types = []
+
+    for tag in tags:
         parts = tag.split(".")
-        if parts[0] == "uses":
-            val = context
-            for attr in parts[1:]:
-                val = getattr(val, attr, None)
-                if val is None:
-                    scenario.skip(
-                        reason="Skipped because tag value was None: {}".format(
-                            tag
+        if parts[0] != "uses":
+            continue  # Only process @uses.* tags for skipping:
+        val = context
+        for idx, attr in enumerate(parts[1:], 1):
+            val = getattr(val, attr, None)
+            if attr == "machine_type":
+                curr_machine_type = ".".join(parts[idx + 1 :])
+                machine_types.append(curr_machine_type)
+                if curr_machine_type == machine_type:
+                    if machine_type.startswith("lxd"):
+                        return ""
+
+                    cloud_manager = context.config.cloud_manager
+                    if cloud_manager and cloud_manager.missing_env_vars():
+                        return "".join(
+                            (
+                                "Skipped: {} machine_type requires:\n".format(
+                                    machine_type
+                                ),
+                                *cloud_manager.format_missing_env_vars(
+                                    cloud_manager.missing_env_vars()
+                                ),
+                            )
                         )
-                    )
+                    return ""
+                break
+            if val is None:
+                return "Skipped: tag value was None: {}".format(tag)
+
+    if machine_types:
+        return "Skipped: machine type {} was not found in tags:\n {}".format(
+            machine_type, ", ".join(machine_types)
+        )
+
+    return ""
+
 
+def before_feature(context: Context, feature: Feature):
+    reason = _should_skip_tags(context, feature.tags)
+    if reason:
+        feature.skip(reason=reason)
 
-def _capture_container_as_image(container_name: str, image_name: str) -> None:
-    """Capture a lxd container as an image.
+
+def before_scenario(context: Context, scenario: Scenario):
+    """
+    In this function, we launch a container, install ubuntu-advantage-tools and
+    then capture an image. This image is then reused by each scenario, reducing
+    test execution time.
+    """
+    reason = _should_skip_tags(context, scenario.effective_tags)
+    if reason:
+        scenario.skip(reason=reason)
+
+
+FAILURE_FILES = (
+    "/etc/ubuntu-advantage/uaclient.log",
+    "/var/log/cloud-init.log",
+    "/var/log/ubuntu-advantage.log",
+    "/var/lib/cloud/instance/user-data.txt",
+    "/var/lib/cloud/instance/vendor-data.txt",
+)
+FAILURE_CMDS = {
+    "ua-version": ["ua", "version"],
+    "cloud-init-analyze": ["cloud-init", "analyze", "show"],
+    "cloud-init.status": ["cloud-init", "status", "--long"],
+    "status.json": ["ua", "status", "--all", "--format=json"],
+    "journal.log": ["journalctl", "-b", "0"],
+    "systemd-analyze-blame": ["systemd-analyze", "blame"],
+    "systemctl-status": ["systemctl", "status"],
+    "systemctl-status-ua-auto-attach": [
+        "systemctl",
+        "status",
+        "ua-auto-attach.service",
+    ],
+    "systemctl-status-ua-reboot-cmds": [
+        "systemctl",
+        "status",
+        "ua-reboot-cmds.service",
+    ],
+}
+
+
+def after_step(context, step):
+    """Collect test artifacts in the event of failure."""
+    if step.status == "failed":
+        if context.config.artifact_dir:
+            artifacts_dir = context.config.artifact_dir
+        else:
+            artifacts_dir = "artifacts"
+        artifacts_dir = os.path.join(
+            artifacts_dir,
+            "{}_{}".format(os.path.basename(step.filename), step.line),
+        )
+        if hasattr(context, "process"):
+            if not os.path.exists(artifacts_dir):
+                os.makedirs(artifacts_dir)
+            artifact_file = os.path.join(artifacts_dir, "process.log")
+            process = context.process
+            with open(artifact_file, "w") as stream:
+                stream.write(
+                    PROCESS_LOG_TMPL.format(
+                        returncode=process.returncode,
+                        stdout=process.stdout,
+                        stderr=process.stderr,
+                    )
+                )
+
+        if hasattr(context, "instance"):
+            if not os.path.exists(artifacts_dir):
+                os.makedirs(artifacts_dir)
+            for log_file in FAILURE_FILES:
+                artifact_file = os.path.join(
+                    artifacts_dir, os.path.basename(log_file)
+                )
+                print("-- pull instance:{} {}".format(log_file, artifact_file))
+                try:
+                    context.instance.pull_file(log_file, artifact_file)
+                except IOError as e:
+                    if e.errno == errno.EACCES:
+                        result = context.instance.execute(
+                            ["cat", log_file], use_sudo=True
+                        )
+                        with open(artifact_file, "w") as stream:
+                            stream.write(result.stdout)
+                except RuntimeError:
+                    # File did not exist
+                    with open(artifact_file, "w") as stream:
+                        stream.write("")
+            for artifact_file, cmd in FAILURE_CMDS.items():
+                result = context.instance.execute(cmd, use_sudo=True)
+                artifact_file = os.path.join(artifacts_dir, artifact_file)
+                with open(artifact_file, "w") as stream:
+                    stream.write(result.stdout)
+
+
+def after_all(context):
+    if context.config.image_clean:
+        for key, image in context.series_image_name.items():
+            if key == context.series_reuse_image:
+                print(
+                    " Not deleting this image: ",
+                    context.series_image_name[key],
+                )
+            else:
+                context.config.cloud_api.delete_image(image)
+
+
+def _capture_container_as_image(
+    container_name: str,
+    image_name: str,
+    cloud_api: "pycloudlib.cloud.BaseCloud",
+) -> str:
+    """Capture a container as an image.
 
     :param container_name:
         The name of the container to be captured.  Note that this container
         will be stopped.
     :param image_name:
         The name under which the image should be published.
+    :param cloud_api: Optional pycloud BaseCloud api for applicable
+        machine_types.
+    """
+    print(
+        "--- Creating  base image snapshot from vm {}".format(container_name)
+    )
+    inst = cloud_api.get_instance(container_name)
+    return cloud_api.snapshot(instance=inst)
+
+
+def build_debs_from_dev_instance(context: Context, series: str) -> "List[str]":
+    """Create a development instance, instal build dependencies and build debs
+
+
+    Will stop the development instance after deb build succeeds.
+
+    :return: A list of paths to applicable deb files published.
     """
-    subprocess.run(["lxc", "stop", container_name])
-    subprocess.run(["lxc", "publish", container_name, "--alias", image_name])
+    time_suffix = datetime.datetime.now().strftime("%s%f")
+    deb_paths = []
+
+    if context.config.debs_path:
+        print(
+            "--- Checking if debs can be reused in {}".format(
+                context.config.debs_path
+            )
+        )
+        debs_path = context.config.debs_path
+        if os.path.isdir(debs_path):
+            deb_paths = [
+                os.path.join(debs_path, deb_file)
+                for deb_file in os.listdir(debs_path)
+                if series in deb_file
+            ]
+
+    if len(deb_paths):
+        print("--- Reusing debs: {}".format(", ".join(deb_paths)))
+    else:
+        print("--- Could not find any debs to reuse. Building it locally")
+        print(
+            "--- Launching vm to build ubuntu-advantage*debs from local source"
+        )
+        build_container_name = (
+            "ubuntu-behave-image-pre-build-%s-" % series + time_suffix
+        )
+
+        cloud_manager = context.config.cloud_manager
+        if "pro" in context.config.machine_type:
+            user_data = USERDATA_BLOCK_AUTO_ATTACH_IMG
+        else:
+            user_data = ""
+        inst = cloud_manager.launch(
+            instance_name=build_container_name,
+            series=series,
+            user_data=user_data,
+        )
+
+        build_container_name = cloud_manager.get_instance_id(inst)
 
+        with emit_spinner_on_travis("Building debs from local source... "):
+            deb_paths = build_debs(
+                build_container_name,
+                output_deb_dir=os.path.join(tempfile.gettempdir(), series),
+                cloud_api=context.config.cloud_api,
+            )
 
-def create_trusty_uat_lxd_image(context: Context) -> None:
-    """Create a trusty lxd image with ubuntu-advantage-tools installed
+    if "pro" in context.config.machine_type:
+        return deb_paths
+    # Redact ubuntu-advantage-pro deb as inapplicable
+    return [deb_path for deb_path in deb_paths if "pro" not in deb_path]
+
+
+def create_uat_image(context: Context, series: str) -> None:
+    """Create a given series lxd image with ubuntu-advantage-tools installed
 
     This will launch a container, install ubuntu-advantage-tools, and publish
-    the image.  The image's name is stored in context.image_name for use within
-    step code.
+    the image. The image's name is stored in context.series_image_name for
+    use within step code.
 
     :param context:
-        A `behave.runner.Context`; this will have `image_name` set on it.
+        A `behave.runner.Context`;  this will have `series.image_name` set on
+        it.
+    :param series:
+       A string representing the series name to create
     """
 
-    def image_cleanup() -> None:
-        if context.config.image_clean:
-            subprocess.run(["lxc", "image", "delete", context.image_name])
+    if series in context.reuse_container:
+        print(
+            "\n Reusing the existing container: ",
+            context.reuse_container[series],
+        )
+        return
+    time_suffix = datetime.datetime.now().strftime("%s%f")
+    deb_paths = []
+    if context.config.build_pr:
+        deb_paths = build_debs_from_dev_instance(context, series)
+
+    print(
+        "--- Launching VM to create a base image with updated ubuntu-advantage"
+    )
+
+    is_vm = bool(context.config.machine_type == "lxd.vm")
+    build_container_name = "ubuntu-behave-image-build-%s-%s" % (
+        "-vm" if is_vm else "",
+        series + time_suffix,
+    )
+
+    user_data = ""
+    if "pro" in context.config.machine_type:
+        user_data = USERDATA_BLOCK_AUTO_ATTACH_IMG
+    if not deb_paths:
+        if not user_data:
+            user_data = "#cloud-config\n"
+        ppa = context.config.ppa
+        ppa_keyid = context.config.ppa_keyid
+        if context.config.ppa.startswith("ppa:"):
+            ppa = ppa.replace("ppa:", "http://ppa.launchpad.net/") + "/ubuntu"
+        if series == "trusty":
+            packages = ["ubuntu-advantage-tools"]
+
+            if "pro" in context.config.machine_type:
+                packages.append("ubuntu-advantage-pro")
+
+            user_data += USERDATA_APT_SOURCE_PPA_TRUSTY.format(
+                ppa_url=ppa, ppa_keyid=ppa_keyid, packages=", ".join(packages)
+            )
         else:
-            print("Image cleanup disabled, not deleting:", context.image_name)
+            packages = ["openssh-server", "ubuntu-advantage-tools"]
 
-    if context.reuse_container:
-        print(" Reusing the existent container: ", context.reuse_container)
-    else:
-        now = datetime.datetime.now()
-        context.image_name = "behave-image-" + now.strftime("%s%f")
-        build_container_name = "behave-image-build-" + now.strftime("%s%f")
-        launch_lxd_container(context, "ubuntu:trusty", build_container_name)
-        _install_uat_in_container(build_container_name)
-        _capture_container_as_image(build_container_name, context.image_name)
-        context.add_cleanup(image_cleanup)
+            if "pro" in context.config.machine_type:
+                packages.append("ubuntu-advantage-pro")
 
+            user_data += USERDATA_APT_SOURCE_PPA.format(
+                ppa_url=ppa, ppa_keyid=ppa_keyid, packages=", ".join(packages)
+            )
+    inst = context.config.cloud_manager.launch(
+        instance_name=build_container_name, series=series, user_data=user_data
+    )
+    build_container_name = context.config.cloud_manager.get_instance_id(inst)
 
-def _install_uat_in_container(container_name: str) -> None:
+    _install_uat_in_container(
+        build_container_name,
+        series=series,
+        config=context.config,
+        deb_paths=deb_paths,
+    )
+
+    image_name = _capture_container_as_image(
+        build_container_name,
+        image_name="ubuntu-behave-image-%s-" % series + time_suffix,
+        cloud_api=context.config.cloud_api,
+    )
+    context.series_image_name[series] = image_name
+    inst.delete(wait=False)
+
+
+def _install_uat_in_container(
+    container_name: str,
+    series: str,
+    config: UAClientBehaveConfig,
+    deb_paths: "Optional[List[str]]" = None,
+) -> None:
     """Install ubuntu-advantage-tools into the specified container
 
     :param container_name:
         The name of the container into which ubuntu-advantage-tools should be
         installed.
+    :param series: The name of the series that is being used
+    :param config: UAClientBehaveConfig
+    :param deb_paths: Optional paths to local deb files we need to install
     """
-    lxc_exec(
-        container_name,
-        [
-            "sudo",
-            "add-apt-repository",
-            "--yes",
-            "ppa:canonical-server/ua-client-daily",
-        ],
-    )
-    lxc_exec(container_name, ["sudo", "apt-get", "update", "-qq"])
-    lxc_exec(
-        container_name,
-        ["sudo", "apt-get", "install", "-qq", "-y", "ubuntu-advantage-tools"],
-    )
+    cmds: "List[Any]" = [["systemctl", "is-system-running", "--wait"]]
+
+    if deb_paths is None:
+        deb_paths = []
+
+    if deb_paths:
+        cmds.append(["sudo", "apt-get", "update", "-qqy"])
+
+        deb_files = []
+        inst = config.cloud_api.get_instance(container_name)
+
+        for deb_file in deb_paths:
+            if "pro" in deb_file and "pro" not in config.machine_type:
+                continue
+
+            deb_name = os.path.basename(deb_file)
+            deb_files.append("/tmp/" + deb_name)
+            inst.push_file(deb_file, "/tmp/" + deb_name)
+
+        if series == "trusty":
+            cmds.append(["sudo", "dpkg", "-i"] + deb_files)
+        else:
+            cmds.append(["sudo", "apt-get", "install", "-y"] + deb_files)
+
+    if "pro" in config.machine_type:
+        features = "features:\n  disable_auto_attach: true\n"
+        conf_path = "/etc/ubuntu-advantage/uaclient.conf"
+        cmd = "printf '{}' > /tmp/uaclient.conf".format(features)
+        cmds.append('sh -c "{}"'.format(cmd))
+        cmds.append(
+            'sudo -- sh -c "cat /tmp/uaclient.conf >> {}"'.format(conf_path)
+        )
+        cmds.append("sudo ua detach --assume-yes")
+
+    cmds.append(["ua", "version"])
+    instance = config.cloud_api.get_instance(container_name)
+    for cmd in cmds:  # type: ignore
+        result = instance.execute(cmd)
+        if result.failed:
+            print(
+                "--- Failed {}: out {} err {}".format(
+                    cmd, result.stdout, result.stderr
+                )
+            )
+        elif "version" in cmd:
+            print("--- " + result)
diff --git a/features/gcp-ids.yaml b/features/gcp-ids.yaml
 new file mode 100644
index 0000000..a3ca5bd
--- /dev/null
+++ b/features/gcp-ids.yaml
@@ -0,0 +1,3 @@
+xenial: "projects/ubuntu-os-cloud-image-proposed/global/images/testing-ubuntu-pro-1604-xenial-v20210205"
+bionic: "projects/ubuntu-os-cloud-image-proposed/global/images/testing-ubuntu-pro-1804-bionic-v20210205"
+focal: "projects/ubuntu-os-cloud-image-proposed/global/images/testing-ubuntu-pro-2004-focal-v20210205"
diff --git a/features/staging_commands.feature b/features/staging_commands.feature
 new file mode 100644
index 0000000..90c212f
--- /dev/null
+++ b/features/staging_commands.feature
@@ -0,0 +1,395 @@
[e-mail]_token_staging
+Feature: Enable command behaviour when attached to an UA staging subscription
+
+    @series.xenial
+    Scenario: Attached enable CC EAL service in a xenial lxd container
+        Given a `xenial` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token_staging` with sudo
+        Then I verify that running `ua enable cc-eal` `as non-root` exits `1`
+        And I will see the following on stderr:
+            """
+            This command must be run as root (try using sudo)
+            """
+        When I run `ua enable cc-eal --beta` with sudo
+        Then I will see the following on stdout:
+            """
+            One moment, checking your subscription first
+            GPG key '/usr/share/keyrings/ubuntu-cc-keyring.gpg' not found
+            """ 
+    @series.xenial
+    @series.bionic
+    @series.focal
+    Scenario Outline: Attached enable esm-apps on a machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token_staging` with sudo
+        And I run `ua status --all` as non-root
+        Then stdout matches regexp
+        """
+        esm-apps      yes                enabled            UA Apps: Extended Security Maintenance \(ESM\)
+        """
+        And I verify that running `apt update` `with sudo` exits `0`
+        When I run `apt-cache policy` as non-root
+        Then apt-cache policy for the following url has permission `500`
+        """
+        https://esm.staging.ubuntu.com/apps/ubuntu <release>-apps-updates/main amd64 Packages
+        """
+        And apt-cache policy for the following url has permission `500`
+        """
+        https://esm.staging.ubuntu.com/apps/ubuntu <release>-apps-security/main amd64 Packages
+        """
+        And I verify that running `apt update` `with sudo` exits `0`
+        When I run `apt install -y <apps-pkg>` with sudo, retrying exit [100]
+        And I run `apt-cache policy <apps-pkg>` as non-root
+        Then stdout matches regexp:
+        """
+        Version table:
+        \s*\*\*\* .* 500
+        \s*500 https://esm.staging.ubuntu.com/apps/ubuntu <release>-apps-security/main amd64 Packages
+        """
+
+        Examples: ubuntu release
+           | release | apps-pkg |
+           | bionic  | bundler  |
+           | focal   | ant      |
+           | trusty  | ant      |
+           | xenial  | jq       |
+
+    @series.xenial
+    @series.bionic
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: Attached enable of vm-based services in an ubuntu lxd vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token_staging` with sudo
+        And I run `ua disable livepatch` with sudo
+        And I run `apt-get install openssh-client openssh-server strongswan -y` with sudo, retrying exit [100]
+        And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
+        And I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And stdout matches regexp:
+            """
+            FIPS support requires system reboot to complete configuration
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua status --all` with sudo
+        Then stdout does not match regexp:
+            """
+            FIPS support requires system reboot to complete configuration
+            """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            A reboot is required to complete disable operation
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            Disabling FIPS requires system reboot to complete operation
+            """
+        When I run `apt-cache policy ubuntu-fips` as non-root
+        Then stdout matches regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
+        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+        Then stdout does not match regexp:
+            """
+            Disabling FIPS requires system reboot to complete operation
+            """
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                                        |
+           | xenial  | FIPS         | fips         |https://esm.staging.ubuntu.com/fips/ubuntu xenial/main |
+           | bionic  | FIPS         | fips         |https://esm.staging.ubuntu.com/fips/ubuntu bionic/main |
+
+    @series.xenial
+    @series.bionic
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: Attached enable of vm-based services in an ubuntu lxd vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token_staging` with sudo
+        And I run `ua disable livepatch` with sudo
+        And I run `apt-get install openssh-client openssh-server strongswan -y` with sudo, retrying exit [100]
+        When I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            A reboot is required to complete disable operation
+            """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
+        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                                                        |
+           | xenial  | FIPS Updates | fips-updates |https://esm.staging.ubuntu.com/fips-updates/ubuntu xenial-updates/main |
+           | bionic  | FIPS Updates | fips-updates |https://esm.staging.ubuntu.com/fips-updates/ubuntu bionic-updates/main |
+
+   @series.xenial
+   @uses.config.machine_type.lxd.vm
+   Scenario Outline: Attached FIPS upgrade across LTS releases
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token_staging` with sudo
+        And I run `apt-get install lsof` with sudo, retrying exit [100]
+        And I run `ua disable livepatch` with sudo
+        And I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+        """
+        fips
+        """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `apt-get dist-upgrade -y --allow-downgrades` with sudo
+        # A package may need a reboot after running dist-upgrade
+        And I reboot the `<release>` machine
+        And I create the file `/etc/update-manager/release-upgrades.d/ua-test.cfg` with the following
+        """
+        [Sources]
+        AllowThirdParty=yes
+        """
+        Then I verify that running `do-release-upgrade --frontend DistUpgradeViewNonInteractive` `with sudo` exits `0`
+        When I reboot the `<release>` machine
+        And I run `lsb_release -cs` as non-root
+        Then I will see the following on stdout:
+        """
+        <next_release>
+        """
+        When I verify that running `egrep "disabled" /etc/apt/sources.list.d/<source-file>.list` `as non-root` exits `1`
+        Then I will see the following on stdout:
+        """
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+        """
+        <fips-service> +yes                enabled
+        """
+        When  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+
+        Examples: ubuntu release
+        | release | next_release | fips-service  | fips-name    | source-file         |
+        | xenial  | bionic       | fips          | FIPS         | ubuntu-fips         |
+        | xenial  | bionic       | fips-updates  | FIPS Updates | ubuntu-fips-updates |
+
+    @series.xenial
+    @series.bionic
+    Scenario Outline: Attached enable of cis service in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token_staging` with sudo
+        And I verify that running `ua enable cis --beta` `with sudo` exits `0`
+        Then I will see the following on stdout:
+            """
+            One moment, checking your subscription first
+            Updating package lists
+            Installing CIS Audit packages
+            CIS Audit enabled
+            """
+        When I run `apt-cache policy usg-cisbenchmark` as non-root
+        Then stdout does not match regexp:
+        """
+        .*Installed: \(none\)
+        """
+        And stdout matches regexp:
+        """
+        \s* 500 https://esm.staging.ubuntu.com/cis/ubuntu <release>/main amd64 Packages
+        """
+        When I run `apt-cache policy usg-common` as non-root
+        Then stdout does not match regexp:
+        """
+        .*Installed: \(none\)
+        """
+        And stdout matches regexp:
+        """
+        \s* 500 https://esm.staging.ubuntu.com/cis/ubuntu <release>/main amd64 Packages
+        """
+
+        Examples: not entitled services
+           | release |
+           | bionic  |
+           | xenial  |
+
+    @series.xenial
+    @series.bionic
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: Attached enable fips-updates on fips enabled vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token_staging` with sudo
+        And I run `ua disable livepatch` with sudo
+        And I run `apt-get install openssh-client openssh-server strongswan -y` with sudo, retrying exit [100]
+        And I run `ua enable fips --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing FIPS packages
+            FIPS enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            fips +yes                enabled
+            """
+        When I reboot the `<release>` machine
+        And  I run `ua enable fips-updates --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing FIPS Updates packages
+            FIPS Updates enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """