Merge ~chad.smith/ubuntu/+source/update-notifier:ubuntu/devel into ubuntu/+source/update-notifier:ubuntu/devel

[Chad Smith]

Currently, the apt-check script is configured to only handle package count for ESM Infra. We are now updating the logic to also handle ESM Apps packages as well.

Furthermore, we are also updating the messaging that is created in apt-check. We are advertising ESM Apps if the service is disabled and only messaging about ESM Infra if the distro is already on ESM mode.

Finally, this PR also fixes LP #1883315, since we now check to see if the system has esm-infra or esm-apps before performing a package count for package with esm origins

[Chad Smith (chad.smith)]

Should be quickly testable on an installed system with /usr/lib/update-notifier/apt_check.py --human-readable

[Bryce Harrington (bryce)]

Make sure to include the code docs that lamoura added for the other MPs, so those changes are preserved going forward:

https://code.launchpad.net/~lamoura/ubuntu/+source/update-notifier/+git/update-notifier/+merge/401657

review: Needs Fixing

[Bryce Harrington (bryce)]

As mentioned on the hirsute MP, I went ahead and uploaded as-is for expedience and since the code docs aren't user visible, but please ensure they get included for future updates.

triage-hirsute+21.04:~/pkg/UpdateNotifier/review-mp401826$ dput ubuntu update-notifier_3.192.41_source.changes
D: Setting host argument.
Checking signature on .changes
gpg: /home/bryce/pkg/UpdateNotifier/review-mp401826/update-notifier_3.192.41_source.changes: Valid signature from E603B2578FB8F0FB
Checking signature on .dsc
gpg: /home/bryce/pkg/UpdateNotifier/review-mp401826/update-notifier_3.192.41.dsc: Valid signature from E603B2578FB8F0FB
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading update-notifier_3.192.41.dsc: done.
  Uploading update-notifier_3.192.41.tar.xz: done.
  Uploading update-notifier_3.192.41_source.buildinfo: done.
  Uploading update-notifier_3.192.41_source.changes: done.
Successfully uploaded packages.
triage-hirsute+21.04:~/pkg/UpdateNotifier/review-mp401826/update-notifier-gu$ git ubuntu tag -f --upload
Updated tag 'upload/3.192.41' (was fff7497)
triage-hirsute+21.04:~/pkg/UpdateNotifier/review-mp401826/update-notifier-gu$ git push pkg upload/3.192.41
Enumerating objects: 33, done.
Counting objects: 100% (33/33), done.
Delta compression using up to 12 threads
Compressing objects: 100% (20/20), done.
Writing objects: 100% (25/25), 7.80 KiB | 798.00 KiB/s, done.
Total 25 (delta 19), reused 8 (delta 5), pack-reused 0
To ssh://git.launchpad.net/ubuntu/+source/update-notifier
 * [new tag] upload/3.192.41 -> upload/3.192.41

review: Approve

diff --git a/data/apt_check.py b/data/apt_check.py
index 2c18ef6..60d2ecd 100755
--- a/data/apt_check.py
+++ b/data/apt_check.py
@@ -10,13 +10,16 @@ import sys
 from optparse import OptionParser
 import gettext
 import subprocess
+import distro_info
 
 SYNAPTIC_PINFILE = "/var/lib/synaptic/preferences"
 DISTRO = subprocess.check_output(
     ["lsb_release", "-c", "-s"],
     universal_newlines=True).strip()
 
-ESM_ORIGINS = ("UbuntuESM", "UbuntuESMApps")
+ESM_INFRA_ORIGIN = "UbuntuESM"
+ESM_APPS_ORIGIN = "UbuntuESMApps"
+ESM_ORIGINS = (ESM_INFRA_ORIGIN, ESM_APPS_ORIGIN)
 
 
 def _(msg):
@@ -47,8 +50,8 @@ def saveDistUpgrade(cache, depcache):
 def isSecurityUpgrade(ver):
     " check if the given version is a security update (or masks one) "
     security_pockets = [("Ubuntu", "%s-security" % DISTRO),
-                        ("UbuntuESM", "%s-infra-security" % DISTRO),
-                        ("UbuntuESMApps", "%s-apps-security" % DISTRO),
+                        (ESM_INFRA_ORIGIN, "%s-infra-security" % DISTRO),
+                        (ESM_APPS_ORIGIN, "%s-apps-security" % DISTRO),
                         ("gNewSense", "%s-security" % DISTRO),
                         ("Debian", "%s-updates" % DISTRO)]
     for (file, index) in ver.file_list:
@@ -58,14 +61,22 @@ def isSecurityUpgrade(ver):
     return False
 
 
-def isESMUpgrade(ver):
+def _isESMUpgrade(ver, esm_origin):
     " check if the given version is a security update (or masks one) "
     for (file, index) in ver.file_list:
-        if file.origin in ESM_ORIGINS and file.archive.startswith(DISTRO):
+        if file.origin == esm_origin and file.archive.startswith(DISTRO):
             return True
     return False
 
 
+def isESMAppsUpgrade(ver):
+    return _isESMUpgrade(ver, esm_origin=ESM_APPS_ORIGIN)
+
+
+def isESMInfraUpgrade(ver):
+    return _isESMUpgrade(ver, esm_origin=ESM_INFRA_ORIGIN)
+
+
 def write_package_names(outstream, cache, depcache):
     " write out package names that change to outstream "
     pkgs = [pkg for pkg in cache.packages if depcache.marked_install(pkg)
@@ -73,11 +84,86 @@ def write_package_names(outstream, cache, depcache):
     outstream.write("\n".join([p.name for p in pkgs]))
 
 
+def is_esm_distro():
+    ubuntu_distro = distro_info.UbuntuDistroInfo()
+
+    is_esm_supported = bool(
+        DISTRO in ubuntu_distro.supported_esm()
+    )
+
+    is_not_currently_supported = bool(
+        DISTRO in ubuntu_distro.unsupported()
+    )
+
+    return is_esm_supported and is_not_currently_supported
+
+
+def is_lts_distro():
+    return distro_info.UbuntuDistroInfo().is_lts(DISTRO)
+
+
+def _output_esm_package_count(outstream, service_type, esm_pkg_count):
+    if esm_pkg_count > 0:
+        outstream.write("\n")
+        outstream.write(gettext.dngettext("update-notifier",
+                                          "%d of these updates "
+                                          "is an UA %s: ESM "
+                                          "security update.",
+                                          "%d of these updates "
+                                          "are UA %s: ESM "
+                                          "security updates.",
+                                          esm_pkg_count) %
+                        (esm_pkg_count, service_type))
+
+
+def _output_esm_package_alert(
+    outstream, service_type, disabled_pkg_count
+):
+    outstream.write("\n")
+    if disabled_pkg_count > 0:
+        outstream.write("\n")
+        outstream.write(gettext.dngettext("update-notifier",
+                                          "%i additional security "
+                                          "update can be applied "
+                                          "with UA %s: ESM\nLearn "
+                                          "more about enabling UA "
+                                          "%s: ESM service at "
+                                          "https://ubuntu.com/esm",
+                                          "%i additional security "
+                                          "updates can be applied "
+                                          "with UA %s: ESM\nLearn "
+                                          "more about enabling UA "
+                                          "%s: ESM service at "
+                                          "https://ubuntu.com/esm",
+                                          disabled_pkg_count) %
+                        (disabled_pkg_count, service_type, service_type))
+    else:
+        outstream.write("\n")
+        outstream.write(gettext.dgettext("update-notifier",
+                                         "Enable UA %s: ESM to "
+                                         "receive additional future "
+                                         "security updates.") %
+                        service_type)
+
+        outstream.write("\n")
+        outstream.write(
+            gettext.dgettext("update-notifier",
+                             "See https://ubuntu.com/security/esm "
+                             "or run: sudo ua status")
+        )
+
+
 def write_human_readable_summary(outstream, upgrades, security_updates,
-                                 esm_updates, have_esm, disabled_esm_updates):
+                                 esm_infra_updates, esm_apps_updates,
+                                 have_esm_infra, have_esm_apps,
+                                 disabled_esm_infra_updates,
+                                 disabled_esm_apps_updates):
+
+    esm_distro = is_esm_distro()
+    lts_distro = is_lts_distro()
     " write out human summary summary to outstream "
-    if have_esm is not None:
-        if have_esm:
+    if have_esm_infra is not None and esm_distro:
+        if have_esm_infra:
             outstream.write(gettext.dgettext("update-notifier",
                                              "UA Infra: Extended "
                                              "Security Maintenance (ESM) is "
@@ -87,64 +173,51 @@ def write_human_readable_summary(outstream, upgrades, security_updates,
                                              "UA Infra: Extended "
                                              "Security Maintenance (ESM) is "
                                              "not enabled."))
-        outstream.write("\n\n")
-
-    outstream.write(gettext.dngettext("update-notifier",
-                                      "%i update can be installed "
-                                      "immediately.",
-                                      "%i updates can be installed "
-                                      "immediately.",
-                                      upgrades) % upgrades)
-    outstream.write("\n")
-    if esm_updates > 0:
+        if upgrades > 0:
+            outstream.write("\n\n")
+    if upgrades > 0:
+        outstream.write(
+            gettext.dngettext("update-notifier",
+                              "%i update can be applied immediately.",
+                              "%i updates can be applied immediately.",
+                              upgrades) % upgrades
+        )
+
+    _output_esm_package_count(
+        outstream, service_type="Infra", esm_pkg_count=esm_infra_updates)
+    _output_esm_package_count(
+        outstream, service_type="Apps", esm_pkg_count=esm_apps_updates)
+
+    if security_updates > 0:
+        outstream.write("\n")
         outstream.write(gettext.dngettext("update-notifier",
-                                          "%i of these updates is fixed "
-                                          "through UA Infra: ESM.",
+                                          "%i of these updates is a "
+                                          "standard security update.",
                                           "%i of these updates are "
-                                          "fixed through UA "
-                                          "Infra: ESM.",
-                                          esm_updates) %
-                        esm_updates)
-        outstream.write("\n")
-    outstream.write(gettext.dngettext("update-notifier",
-                                      "%i of these updates is a "
-                                      "security update.",
-                                      "%i of these updates are "
-                                      "security updates.",
-                                      security_updates) %
-                    security_updates)
-    if upgrades > 0 or security_updates > 0 or esm_updates > 0:
+                                          "standard security updates.",
+                                          security_updates) %
+                        security_updates)
+
+    if any([upgrades, security_updates, esm_infra_updates, esm_apps_updates]):
         outstream.write("\n")
         outstream.write(gettext.dgettext("update-notifier",
                                          "To see these additional updates "
                                          "run: apt list --upgradable"))
-    if have_esm is not None and not have_esm:
-        outstream.write("\n")
-        if disabled_esm_updates > 0:
-            outstream.write("\n")
-            outstream.write(gettext.dngettext("update-notifier",
-                                              "Enable UA Infra: ESM "
-                                              "to receive %i additional "
-                                              "security update.",
-                                              "Enable UA Infra: ESM "
-                                              "to receive %i additional "
-                                              "security updates.",
-                                              disabled_esm_updates) %
-                            disabled_esm_updates)
-        else:
-            outstream.write("\n")
-            outstream.write(gettext.dgettext("update-notifier",
-                                             "Enable UA Infra: ESM to "
-                                             "receive additional future "
-                                             "security updates."))
-        outstream.write("\n")
-        outstream.write(gettext.dgettext("update-notifier",
-                                         "See https://ubuntu.com/security/esm "
-                                         "or run: sudo ua status"))
+
+    if have_esm_apps is not None and not have_esm_apps and lts_distro:
+        _output_esm_package_alert(
+            outstream, service_type="Apps",
+            disabled_pkg_count=disabled_esm_apps_updates)
+
+    if have_esm_infra is not None and not have_esm_infra and esm_distro:
+        _output_esm_package_alert(
+            outstream, service_type="Infra",
+            disabled_pkg_count=disabled_esm_infra_updates)
+
     outstream.write("\n")
 
 
-def has_disabled_esm_security_update(depcache, pkg):
+def has_disabled_esm_security_update(depcache, pkg, esm_origin):
     " check if we have a disabled ESM security update "
     inst_ver = pkg.current_ver
     if not inst_ver:
@@ -155,12 +228,39 @@ def has_disabled_esm_security_update(depcache, pkg):
             break
 
         for (file, index) in ver.file_list:
-            if (file.origin in ESM_ORIGINS and file.archive.startswith(DISTRO)
+            if (file.origin == esm_origin and file.archive.startswith(DISTRO)
                     and depcache.policy.get_priority(file) == -32768):
                 return True
     return False
 
 
+def has_disabled_esm_apps_security_update(depcache, pkg):
+    return has_disabled_esm_security_update(depcache, pkg, ESM_APPS_ORIGIN)
+
+
+def has_disabled_esm_infra_security_update(depcache, pkg):
+    return has_disabled_esm_security_update(depcache, pkg, ESM_INFRA_ORIGIN)
+
+
+def has_esm_service(cache, depcache, esm_origin):
+    have_esm = None
+    for file in cache.file_list:
+        origin = file.origin
+        if origin == esm_origin and file.archive.startswith(DISTRO):
+            # In case of multiple ESM repos, one enabled is sufficient.
+            if depcache.policy.get_priority(file) == -32768:
+                # We found a disabled ESM repository, but we'll only count
+                # ESM as disabled here if we have not found any other ESM
+                # repo, so one ESM repo being enabled means ESM is enabled.
+                if have_esm is None:
+                    have_esm = False
+            else:
+                have_esm = True
+                break
+
+    return have_esm
+
+
 def init():
     " init the system, be nice "
     # FIXME: do a ionice here too?
@@ -203,31 +303,26 @@ def run(options=None):
 
     # Check if we have ESM enabled or disabled; and if it exists in the
     # first place.
-    have_esm = None        # None == does not exist
-    for file in cache.file_list:
-        if file.origin in ESM_ORIGINS and file.archive.startswith(DISTRO):
-            # In case of multiple ESM repos, one enabled is sufficient.
-            if depcache.policy.get_priority(file) == -32768:
-                # We found a disabled ESM repository, but we'll only count
-                # ESM as disabled here if we have not found any other ESM
-                # repo, so one ESM repo being enabled means ESM is enabled.
-                if have_esm is None:
-                    have_esm = False
-            else:
-                have_esm = True
-                break
+    have_esm_infra = has_esm_service(
+        cache, depcache, esm_origin=ESM_INFRA_ORIGIN)
+    have_esm_apps = has_esm_service(
+        cache, depcache, esm_origin=ESM_APPS_ORIGIN)
 
     # analyze the ugprade
     upgrades = 0
     security_updates = 0
-    esm_updates = 0
-    disabled_esm_updates = 0
+    esm_apps_updates = 0
+    esm_infra_updates = 0
+    disabled_esm_apps_updates = 0
+    disabled_esm_infra_updates = 0
 
     # we need another cache that has more pkg details
     with apt.Cache() as aptcache:
         for pkg in cache.packages:
-            if has_disabled_esm_security_update(depcache, pkg):
-                disabled_esm_updates += 1
+            if has_disabled_esm_apps_security_update(depcache, pkg):
+                disabled_esm_apps_updates += 1
+            if has_disabled_esm_infra_security_update(depcache, pkg):
+                disabled_esm_infra_updates += 1
 
             # skip packages that are not marked upgraded/installed
             if not (depcache.marked_install(pkg)
@@ -241,10 +336,14 @@ def run(options=None):
                 continue
             # check for security upgrades
             if isSecurityUpgrade(cand_ver):
-                if isESMUpgrade(cand_ver):
-                    esm_updates += 1
+                if have_esm_apps and isESMAppsUpgrade(cand_ver):
+                    esm_apps_updates += 1
+                elif have_esm_infra and isESMInfraUpgrade(cand_ver):
+                    esm_infra_updates += 1
+                else:
+                    security_updates += 1
+
                 upgrades += 1
-                security_updates += 1
                 continue
 
             # check to see if the update is a phased one
@@ -268,9 +367,11 @@ def run(options=None):
                         and apt_pkg.version_compare(ver.ver_str,
                                                     inst_ver.ver_str) <= 0):
                     continue
-                if isESMUpgrade(ver):
-                    esm_updates += 1
-                if isSecurityUpgrade(ver):
+                if have_esm_apps and isESMAppsUpgrade(cand_ver):
+                    esm_apps_updates += 1
+                elif have_esm_infra and isESMInfraUpgrade(cand_ver):
+                    esm_infra_updates += 1
+                elif isSecurityUpgrade(ver):
                     security_updates += 1
                     break
 
@@ -279,8 +380,10 @@ def run(options=None):
         write_package_names(sys.stderr, cache, depcache)
     elif options and options.readable_output:
         write_human_readable_summary(sys.stdout, upgrades, security_updates,
-                                     esm_updates, have_esm,
-                                     disabled_esm_updates)
+                                     esm_infra_updates, esm_apps_updates,
+                                     have_esm_infra, have_esm_apps,
+                                     disabled_esm_infra_updates,
+                                     disabled_esm_apps_updates)
     else:
         # print the number of regular upgrades and the number of
         # security upgrades
diff --git a/debian/changelog b/debian/changelog
index d603649..0a659fc 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,20 @@
+update-notifier (3.192.41) impish; urgency=medium
+
+  [ Lucas Moura ]
+
+  * data/apt_check.py:
+    - Add support to handle packages from ESM Apps in addition to ESM Infra
+      and only display alerts if the distro is ESM. (LP: #1924766)
+    - Do not display a count of ESM packages if the system does not have ESM
+      enabled. (LP: #1883315)
+    - Make distinction between standard security updates and ESM updates
+      when performing package counts. (LP: #1926208)
+    - use 'applied' instead of 'installed', redact 0 of these updates are
+      security updates, and correct singular messages
+  * debian/control: Add a dependency on python3-distro-info.
+
+ -- Chad Smith <[e-mail]>  Thu, 22 Apr 2021 17:47:19 -0600
+
 update-notifier (3.192.40) hirsute; urgency=medium
 
   * Skip notify for an update if the command we need to run doesn't exist
diff --git a/debian/control b/debian/control
index 79975d0..c6c9012 100644
--- a/debian/control
+++ b/debian/control
@@ -18,6 +18,7 @@ Build-Depends: debhelper (>= 11~),
                python3-apt,
                python3-debconf,
                python3-debian,
+               python3-distro-info,
                python3-mock
 Standards-Version: 4.5.0
 Vcs-Git: https://git.launchpad.net/update-notifier -b master
@@ -51,6 +52,7 @@ Depends: ${shlibs:Depends},
          python3:any,
          python3-apt, python3-dbus, python3-debian,
          python3-debconf | debconf (<< 1.5.64~),
+         python3-distro-info,
          patch, update-manager-core (>= 1:17.04.2)
 Recommends: libpam-modules (>= 1.0.1-9ubuntu3)
 Suggests: policykit-1
diff --git a/tests/test_motd.py b/tests/test_motd.py
index ec1a09f..3efe2e8 100755
--- a/tests/test_motd.py
+++ b/tests/test_motd.py
@@ -6,6 +6,8 @@ import io
 import unittest
 import textwrap
 
+from unittest import mock
+
 
 def get_message(*args, **kwds):
     with io.StringIO() as stream:
@@ -16,132 +18,386 @@ def get_message(*args, **kwds):
 class TestMotd(unittest.TestCase):
     """ Validate /etc/motd text """
 
-    def test_esm_disabled_upto_date_esm_avail(self):
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=True)
+    def test_esm_infra_disabled_upto_date_esm_avail(
+        self, _m_esm_distro, _m_is_lts
+    ):
         self.assertEqual(
             get_message(upgrades=0, security_updates=0,
-                        esm_updates=0, have_esm=False,
-                        disabled_esm_updates=23),
+                        esm_infra_updates=0, esm_apps_updates=0,
+                        have_esm_infra=False, have_esm_apps=False,
+                        disabled_esm_infra_updates=1,
+                        disabled_esm_apps_updates=0),
             textwrap.dedent(
-                """
+                """\
                 UA Infra: Extended Security Maintenance (ESM) is not enabled.
 
-                0 updates can be installed immediately.
-                0 of these updates are security updates.
-
-                Enable UA Infra: ESM to receive 23 additional security updates.
+                Enable UA Apps: ESM to receive additional future security updates.
                 See https://ubuntu.com/security/esm or run: sudo ua status
-                """).lstrip())
 
-    def test_esm_disabled_security_esm_avail(self):
+                1 additional security update can be applied with UA Infra: ESM
+                Learn more about enabling UA Infra: ESM service at https://ubuntu.com/esm
+                """))
+
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=True)
+    def test_esm_infra_disabled_security_esm_avail(
+        self, _m_esm_distro, _m_is_lts
+    ):
         self.assertEqual(
-            get_message(upgrades=15, security_updates=7,
-                        esm_updates=0, have_esm=False,
-                        disabled_esm_updates=23),
+            get_message(upgrades=15, security_updates=1,
+                        esm_infra_updates=0, esm_apps_updates=0,
+                        have_esm_infra=False, have_esm_apps=False,
+                        disabled_esm_infra_updates=23,
+                        disabled_esm_apps_updates=0),
             textwrap.dedent(
-                """
+                """\
                 UA Infra: Extended Security Maintenance (ESM) is not enabled.
 
-                15 updates can be installed immediately.
-                7 of these updates are security updates.
+                15 updates can be applied immediately.
+                1 of these updates is a standard security update.
                 To see these additional updates run: apt list --upgradable
 
-                Enable UA Infra: ESM to receive 23 additional security updates.
+                Enable UA Apps: ESM to receive additional future security updates.
                 See https://ubuntu.com/security/esm or run: sudo ua status
-                """).lstrip())
 
-    def test_esm_disabled_security_no_esm_avail(self):
+                23 additional security updates can be applied with UA Infra: ESM
+                Learn more about enabling UA Infra: ESM service at https://ubuntu.com/esm
+                """))
+
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=True)
+    def test_esm_infra_disabled_security_no_esm_avail(
+        self, _m_esm_distro, _m_is_lts
+    ):
         self.assertEqual(
             get_message(upgrades=15, security_updates=7,
-                        esm_updates=0, have_esm=False,
-                        disabled_esm_updates=0),
+                        esm_infra_updates=0, esm_apps_updates=0,
+                        have_esm_infra=False, have_esm_apps=False,
+                        disabled_esm_infra_updates=0,
+                        disabled_esm_apps_updates=0),
             textwrap.dedent(
-                """
+                """\
                 UA Infra: Extended Security Maintenance (ESM) is not enabled.
 
-                15 updates can be installed immediately.
-                7 of these updates are security updates.
+                15 updates can be applied immediately.
+                7 of these updates are standard security updates.
                 To see these additional updates run: apt list --upgradable
 
+                Enable UA Apps: ESM to receive additional future security updates.
+                See https://ubuntu.com/security/esm or run: sudo ua status
+
                 Enable UA Infra: ESM to receive additional future security updates.
                 See https://ubuntu.com/security/esm or run: sudo ua status
-                """).lstrip())
+                """))
 
-    def test_esm_disabled_nosecurity(self):
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=True)
+    def test_esm_infra_disabled_nosecurity(
+        self, _m_esm_distro, _m_is_lts
+    ):
         self.assertEqual(
             get_message(upgrades=15, security_updates=0,
-                        esm_updates=0, have_esm=False,
-                        disabled_esm_updates=0),
+                        esm_infra_updates=0, esm_apps_updates=0,
+                        have_esm_infra=False, have_esm_apps=False,
+                        disabled_esm_infra_updates=0,
+                        disabled_esm_apps_updates=0),
             textwrap.dedent(
-                """
+                """\
                 UA Infra: Extended Security Maintenance (ESM) is not enabled.
 
-                15 updates can be installed immediately.
-                0 of these updates are security updates.
+                15 updates can be applied immediately.
                 To see these additional updates run: apt list --upgradable
 
+                Enable UA Apps: ESM to receive additional future security updates.
+                See https://ubuntu.com/security/esm or run: sudo ua status
+
                 Enable UA Infra: ESM to receive additional future security updates.
                 See https://ubuntu.com/security/esm or run: sudo ua status
-                """).lstrip())
+                """))
 
-    def test_esm_disabled_noupdates(self):
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=True)
+    def test_esm_infra_disabled_noupdates(
+        self, _m_esm_distro, _m_is_lts
+    ):
         self.assertEqual(
             get_message(upgrades=0, security_updates=0,
-                        esm_updates=0, have_esm=False,
-                        disabled_esm_updates=0),
+                        esm_infra_updates=0, esm_apps_updates=0,
+                        have_esm_infra=False, have_esm_apps=False,
+                        disabled_esm_infra_updates=0,
+                        disabled_esm_apps_updates=0),
             textwrap.dedent(
-                """
+                """\
                 UA Infra: Extended Security Maintenance (ESM) is not enabled.
 
-                0 updates can be installed immediately.
-                0 of these updates are security updates.
+                Enable UA Apps: ESM to receive additional future security updates.
+                See https://ubuntu.com/security/esm or run: sudo ua status
 
                 Enable UA Infra: ESM to receive additional future security updates.
                 See https://ubuntu.com/security/esm or run: sudo ua status
-                """).lstrip())
+                """))
 
-    def test_esm_enabled_nosecurity(self):
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=True)
+    def test_esm_infra_enabled_nosecurity(
+        self, _m_esm_distro, _m_is_lts
+    ):
         self.assertEqual(
             get_message(upgrades=35, security_updates=0,
-                        esm_updates=13, have_esm=True,
-                        disabled_esm_updates=0),
+                        esm_infra_updates=13, esm_apps_updates=0,
+                        have_esm_infra=True, have_esm_apps=False,
+                        disabled_esm_infra_updates=0,
+                        disabled_esm_apps_updates=0),
             textwrap.dedent(
-                """
+                """\
                 UA Infra: Extended Security Maintenance (ESM) is enabled.
 
-                35 updates can be installed immediately.
-                13 of these updates are fixed through UA Infra: ESM.
-                0 of these updates are security updates.
+                35 updates can be applied immediately.
+                13 of these updates are UA Infra: ESM security updates.
                 To see these additional updates run: apt list --upgradable
-                """).lstrip())
 
-    def test_esm_enabled_somesecurity(self):
+                Enable UA Apps: ESM to receive additional future security updates.
+                See https://ubuntu.com/security/esm or run: sudo ua status
+                """))
+
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=True)
+    def test_esm_infra_enabled_somesecurity(
+        self, _m_esm_distro, _m_is_lts
+    ):
         self.assertEqual(
             get_message(upgrades=47, security_updates=7,
-                        esm_updates=13, have_esm=True,
-                        disabled_esm_updates=0),
+                        esm_infra_updates=13, esm_apps_updates=0,
+                        have_esm_infra=True, have_esm_apps=False,
+                        disabled_esm_infra_updates=0,
+                        disabled_esm_apps_updates=0),
             textwrap.dedent(
-                """
+                """\
                 UA Infra: Extended Security Maintenance (ESM) is enabled.
 
-                47 updates can be installed immediately.
-                13 of these updates are fixed through UA Infra: ESM.
-                7 of these updates are security updates.
+                47 updates can be applied immediately.
+                13 of these updates are UA Infra: ESM security updates.
+                7 of these updates are standard security updates.
                 To see these additional updates run: apt list --upgradable
-                """).lstrip())
 
-    def test_esm_enabled_noupdates(self):
+                Enable UA Apps: ESM to receive additional future security updates.
+                See https://ubuntu.com/security/esm or run: sudo ua status
+                """))
+
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=True)
+    def test_esm_infra_enabled_noupdates(
+        self, _m_esm_distro, _m_is_lts
+    ):
         self.assertEqual(
             get_message(upgrades=0, security_updates=0,
-                        esm_updates=0, have_esm=True,
-                        disabled_esm_updates=0),
+                        esm_infra_updates=0, esm_apps_updates=0,
+                        have_esm_infra=True, have_esm_apps=False,
+                        disabled_esm_infra_updates=0,
+                        disabled_esm_apps_updates=10),
+            textwrap.dedent(
+                """\
+                UA Infra: Extended Security Maintenance (ESM) is enabled.
+
+                10 additional security updates can be applied with UA Apps: ESM
+                Learn more about enabling UA Apps: ESM service at https://ubuntu.com/esm
+                """))
+
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=True)
+    def test_esm_infra_and_esm_apps_enabled(
+        self, _m_esm_distro, _m_is_lts
+    ):
+        self.assertEqual(
+            get_message(upgrades=30, security_updates=0,
+                        esm_infra_updates=15, esm_apps_updates=15,
+                        have_esm_infra=True, have_esm_apps=True,
+                        disabled_esm_infra_updates=0,
+                        disabled_esm_apps_updates=0),
             textwrap.dedent(
                 """
                 UA Infra: Extended Security Maintenance (ESM) is enabled.
 
-                0 updates can be installed immediately.
-                0 of these updates are security updates.
+                30 updates can be applied immediately.
+                15 of these updates are UA Infra: ESM security updates.
+                15 of these updates are UA Apps: ESM security updates.
+                To see these additional updates run: apt list --upgradable
+                """).lstrip())
+
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=True)
+    def test_esm_infra_disable_and_esm_apps_enabled(
+        self, _m_esm_distro, _m_is_lts
+    ):
+        self.assertEqual(
+            get_message(upgrades=30, security_updates=12,
+                        esm_infra_updates=0, esm_apps_updates=15,
+                        have_esm_infra=False, have_esm_apps=True,
+                        disabled_esm_infra_updates=0,
+                        disabled_esm_apps_updates=0),
+            textwrap.dedent(
+                """
+                UA Infra: Extended Security Maintenance (ESM) is not enabled.
+
+                30 updates can be applied immediately.
+                15 of these updates are UA Apps: ESM security updates.
+                12 of these updates are standard security updates.
+                To see these additional updates run: apt list --upgradable
+
+                Enable UA Infra: ESM to receive additional future security updates.
+                See https://ubuntu.com/security/esm or run: sudo ua status
+                """).lstrip())
+
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=True)
+    def test_esm_infra_disabled_wih_pkgs_and_esm_apps_enabled(
+        self, _m_esm_distro, _m_is_lts
+    ):
+        self.assertEqual(
+            get_message(upgrades=30, security_updates=15,
+                        esm_infra_updates=0, esm_apps_updates=1,
+                        have_esm_infra=False, have_esm_apps=True,
+                        disabled_esm_infra_updates=40,
+                        disabled_esm_apps_updates=0),
+            textwrap.dedent(
+                """
+                UA Infra: Extended Security Maintenance (ESM) is not enabled.
+
+                30 updates can be applied immediately.
+                1 of these updates is an UA Apps: ESM security update.
+                15 of these updates are standard security updates.
+                To see these additional updates run: apt list --upgradable
+
+                40 additional security updates can be applied with UA Infra: ESM
+                Learn more about enabling UA Infra: ESM service at https://ubuntu.com/esm
                 """).lstrip())
 
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=True)
+    def test_esm_infra_disabled_and_esm_apps_disabled_with_pkgs(
+        self, _m_esm_distro, _m_is_lts
+    ):
+        self.assertEqual(
+            get_message(upgrades=30, security_updates=18,
+                        esm_infra_updates=0, esm_apps_updates=0,
+                        have_esm_infra=False, have_esm_apps=False,
+                        disabled_esm_infra_updates=0,
+                        disabled_esm_apps_updates=40),
+            textwrap.dedent(
+                """\
+                UA Infra: Extended Security Maintenance (ESM) is not enabled.
+
+                30 updates can be applied immediately.
+                18 of these updates are standard security updates.
+                To see these additional updates run: apt list --upgradable
+
+                40 additional security updates can be applied with UA Apps: ESM
+                Learn more about enabling UA Apps: ESM service at https://ubuntu.com/esm
+
+                Enable UA Infra: ESM to receive additional future security updates.
+                See https://ubuntu.com/security/esm or run: sudo ua status
+                """))
+
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=True)
+    def test_no_esm_infra_and_apps_index_in_esm_distro(
+        self, _m_esm_distro, _m_is_lts
+    ):
+        self.assertEqual(
+            get_message(upgrades=30, security_updates=18,
+                        esm_infra_updates=0, esm_apps_updates=0,
+                        have_esm_infra=None, have_esm_apps=None,
+                        disabled_esm_infra_updates=0,
+                        disabled_esm_apps_updates=0),
+            textwrap.dedent(
+                """\
+                30 updates can be applied immediately.
+                18 of these updates are standard security updates.
+                To see these additional updates run: apt list --upgradable
+                """))
+
+    @mock.patch("apt_check.is_lts_distro", return_value=False)
+    @mock.patch("apt_check.is_esm_distro", return_value=False)
+    def test_no_esm_infra_and_apps_index_in_non_lts_distro(
+        self, _m_esm_distro, _m_is_lts
+    ):
+        self.assertEqual(
+            get_message(upgrades=30, security_updates=18,
+                        esm_infra_updates=0, esm_apps_updates=0,
+                        have_esm_infra=None, have_esm_apps=None,
+                        disabled_esm_infra_updates=0,
+                        disabled_esm_apps_updates=0),
+            textwrap.dedent(
+                """\
+                30 updates can be applied immediately.
+                18 of these updates are standard security updates.
+                To see these additional updates run: apt list --upgradable
+                """))
+
+    @mock.patch("apt_check.is_lts_distro", return_value=False)
+    @mock.patch("apt_check.is_esm_distro", return_value=False)
+    def test_esm_infra_disabled_and_esm_apps_disabled_with_no_esm_distro(
+        self, _m_esm_distro, _m_is_lts,
+    ):
+        self.assertEqual(
+            get_message(upgrades=30, security_updates=18,
+                        esm_infra_updates=0, esm_apps_updates=0,
+                        have_esm_infra=False, have_esm_apps=False,
+                        disabled_esm_infra_updates=0,
+                        disabled_esm_apps_updates=40),
+            textwrap.dedent(
+                """\
+                30 updates can be applied immediately.
+                18 of these updates are standard security updates.
+                To see these additional updates run: apt list --upgradable
+                """))
+
+    @mock.patch("apt_check.is_lts_distro", return_value=False)
+    @mock.patch("subprocess.Popen")
+    def test_message_for_distro_that_will_not_go_into_esm_mode(
+        self, m_popen, _m_is_lts
+    ):
+        comm_mock = mock.MagicMock()
+        comm_mock.communicate.return_value = (
+            "(unknown)".encode("utf-8"), "")
+        m_popen.return_value = comm_mock
+
+        self.assertEqual(
+            get_message(upgrades=30, security_updates=18,
+                        esm_infra_updates=0, esm_apps_updates=0,
+                        have_esm_infra=False, have_esm_apps=False,
+                        disabled_esm_infra_updates=0,
+                        disabled_esm_apps_updates=40),
+            textwrap.dedent(
+                """\
+                30 updates can be applied immediately.
+                18 of these updates are standard security updates.
+                To see these additional updates run: apt list --upgradable
+                """))
+
+    @mock.patch("apt_check.is_lts_distro", return_value=True)
+    @mock.patch("apt_check.is_esm_distro", return_value=False)
+    def test_message_for_lts_distro_not_in_esm_mode_yet(
+        self, _m_is_esm, _m_is_lts
+    ):
+        self.assertEqual(
+            get_message(upgrades=30, security_updates=18,
+                        esm_infra_updates=0, esm_apps_updates=0,
+                        have_esm_infra=False, have_esm_apps=False,
+                        disabled_esm_infra_updates=10,
+                        disabled_esm_apps_updates=40),
+            textwrap.dedent(
+                """\
+                30 updates can be applied immediately.
+                18 of these updates are standard security updates.
+                To see these additional updates run: apt list --upgradable
+
+                40 additional security updates can be applied with UA Apps: ESM
+                Learn more about enabling UA Apps: ESM service at https://ubuntu.com/esm
+                """))
+
 
 if __name__ == "__main__":
     import logging