Merge ~joey-mucci/ubuntu/+source/landscape-client:upstream-release-26.02 into ubuntu/+source/landscape-client:ubuntu/devel

[Joseph Mucci]

New upstream release 26.02.1

[Jan-Yaeger Dhillon (jansdhillon)]

Looks like there's a merge conflict on line 802 of the diff

[Joseph Mucci (joey-mucci)]

> Looks like there's a merge conflict on line 802 of the diff

Thanks for raising that concern, it should be resolved now.

[Joseph Mucci (joey-mucci)]

Link to a test PPA build: https://launchpad.net/~joey-mucci/+archive/ubuntu/resolute-test-2/+sourcepub/18106194/+listing-archive-extra

[Simon Poirier (simpoir)]

Could you rebase on top of ubuntu/devel to linearize the history and avoid needless merge commits?
Please keep d/changelog as separate commits. It makes reviewing large changes much easier when logical changes are their own commits.

Also see inline comments.

review: Needs Fixing

b56bc36... by Joseph Mucci on 2026-02-12

26.02.1-0ubuntu1 source changes

9d95a4e... by Joseph Mucci on 2026-02-12

d/patches: remove patches that have been applied upstream

101df48... by Joseph Mucci on 2026-02-12

d/p/fix-landscape-client-manpage.patch: refresh for 26.02.1

8a79a30... by Joseph Mucci on 2026-02-12

d/changelog: update changelog for 26.02.1

[Joseph Mucci (joey-mucci)]

> Could you rebase on top of ubuntu/devel to linearize the history and avoid
> needless merge commits?
> Please keep d/changelog as separate commits. It makes reviewing large changes
> much easier when logical changes are their own commits.
>
> Also see inline comments.

Thanks for getting to this, let me know if there are any more concerns.

Unmerged commits

8a79a30... by Joseph Mucci on 2026-02-12

d/changelog: update changelog for 26.02.1

101df48... by Joseph Mucci on 2026-02-12

d/p/fix-landscape-client-manpage.patch: refresh for 26.02.1

9d95a4e... by Joseph Mucci on 2026-02-12

d/patches: remove patches that have been applied upstream

b56bc36... by Joseph Mucci on 2026-02-12

26.02.1-0ubuntu1 source changes

diff --git a/.codecov.yml b/.codecov.yml
index 0ca0528..185cc8a 100644
--- a/.codecov.yml
+++ b/.codecov.yml
@@ -17,7 +17,7 @@ coverage:
     patch:
       default:
         target: 100%
-        threshold: 0.05
+        threshold: 1%
         only_pulls: true
     changes: off
 parsers:
diff --git a/.dev-lxc/config.yaml b/.dev-lxc/config.yaml
index 0639ded..462c876 100644
--- a/.dev-lxc/config.yaml
+++ b/.dev-lxc/config.yaml
@@ -9,3 +9,4 @@ config:
 dev-lxc-exec:
   - make depends
   - git submodule update --init
+  - curl -LsSf https://astral.sh/ruff/0.14.5/install.sh | sudo RUFF_INSTALL_DIR=/usr/local/bin sh
diff --git a/.flake8 b/.flake8
deleted file mode 100644
index c3a3cd2..0000000
--- a/.flake8
+++ /dev/null
@@ -1,5 +0,0 @@
-[flake8]
-max-line-length = 79
-max-complexity = 18
-select = B,C,E,F,W,T4,B9
-ignore = E203, W503
diff --git a/.github/workflows/build-jammy.yaml b/.github/workflows/build-jammy.yaml
new file mode 100644
index 0000000..3a64dc6
--- /dev/null
+++ b/.github/workflows/build-jammy.yaml
@@ -0,0 +1,79 @@
+name: Build Jammy
+
+on:
+
+  # Enable manual run against a specific ref
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Git ref to build from (branch name, tag, commit SHA, etc.)"
+        required: false
+        default: ''
+
+  # Enable use from other workflows
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref to build from (branch name, tag, commit SHA, etc.)"
+        required: true
+        type: string
+
+  # Run on any tag pushes
+  push:
+    tags:
+      - "**"
+
+jobs:
+  build-jammy:
+    name: Build Jammy
+    runs-on: ubuntu-22.04
+
+    steps:
+      # Get the reference to build from, if provided.
+      - name: Get reference to build from
+        id: get-reference
+        run: echo "ref=${{ github.event.inputs.ref || github.event.repository.default_branch }}" >> $GITHUB_OUTPUT
+
+      - name: Check out Git repository
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.get-reference.outputs.ref }}
+          submodules: true
+
+      - name: Install build dependencies
+        run: sudo apt update && sudo apt install -y debhelper po-debconf libdistro-info-perl dh-python python3-dev python3-distutils-extra lsb-release gawk net-tools python3-apt python3-twisted python3-configobj python3-pycurl python3-pytest locales-all devscripts
+
+      - name: Build .deb
+        run: |
+          mkdir -p ../source-build
+          mkdir -p ../deb-build
+
+          make tarball
+          rm -r sdist/
+
+          debuild --no-lintian -S -sa --no-sign
+          cp ../landscape-client_* ../source-build/
+
+          # If we use this to automatically make releases or upload to the PPA, we should enable checks.
+          DEB_BUILD_OPTIONS=nocheck debuild -b --no-sign
+          cp ../landscape-client_*.orig.tar.gz ../deb-build/
+          cp ../landscape-*.*deb ../deb-build/
+
+          # Artifact upload steps do not allow relative paths
+          mv ../source-build/ ./
+          mv ../deb-build/ ./
+
+      - name: Upload source build
+        uses: actions/upload-artifact@v4
+        with:
+          name: source-build
+          path: ./source-build/
+
+      - name: Upload deb build
+        uses: actions/upload-artifact@v4
+        with:
+          name: deb-build
+          path: ./deb-build/
+
+      - run: |
+          echo "::notice::Built from ref: ${{ steps.get-reference.outputs.ref }}"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 74030e8..6261c17 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,18 +5,22 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: ["ubuntu-22.04", "ubuntu-20.04", "ubuntu-24.04"]
+        os: ["ubuntu-22.04", "ubuntu-24.04"]
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: true
       - run: make depends-ci
       - run: make check TRIAL=/usr/bin/trial3
-  lint:
+      
+  run-ruff:
+    if: '!github.event.pull_request.draft'
     runs-on: ubuntu-latest
+  
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: true
-      - run: make depends
-      - run: make lint
+  
+      - uses: astral-sh/ruff-action@v3
+      - run: make ruff-check
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index 69e5543..f6caf3c 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -12,4 +12,6 @@ jobs:
       - run: make depends-ci
       - run: make coverage TRIAL=/usr/bin/trial3
       - name: upload
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v5
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
new file mode 100644
index 0000000..8074f29
--- /dev/null
+++ b/.github/workflows/integration-test.yml
@@ -0,0 +1,32 @@
+name: Integration Tests
+
+on:
+  schedule:
+    # Weekly on Mondays at noon UTC.
+    - cron: '0 12 * * 1'
+  workflow_dispatch:
+
+env:
+  TEST_PRO_TOKEN: ${{ secrets.TEST_PRO_TOKEN }}
+
+jobs:
+  pytest_integration_tests:
+    strategy:
+      matrix:
+        runner: ["ubuntu-24.04", "ubuntu-22.04"]
+    runs-on: ${{ matrix.runner }}
+    steps:
+      # Many of the tests require root privileges, so the tests run using sudo.
+      - uses: actions/checkout@v5
+        with:
+          submodules: true
+
+      # In 22.04, the pytest executable was called py.test-3.
+      # We attempt to symlink it to pytest, not worrying if the linking fails.
+      - name: install python dependencies
+        run: |
+          make depends-ci
+          sudo ln -s /usr/bin/py.test-3 /usr/bin/pytest || true
+
+      - name: run pytest integration tests
+        run: sudo -E pytest -m integration
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index af08167..b71fe4e 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -7,7 +7,7 @@ on:
     - cron: '0 6 * * 0'  # Run at 6:00a (arbitrary) to avoid peak activity on runners
 jobs:
   TICS:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, amd64, tiobe, noble]
     steps:
       - name: Checkout master branch
         uses: actions/checkout@v4
diff --git a/.github/workflows/update-release-branches.yml b/.github/workflows/update-release-branches.yml
new file mode 100644
index 0000000..749fe67
--- /dev/null
+++ b/.github/workflows/update-release-branches.yml
@@ -0,0 +1,44 @@
+name: Update release branches
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  update-release-branches:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - branch: core-24
+            base: core24
+          - branch: core-22
+            base: core22
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: true
+
+      - name: Install dependencies
+        run: |
+          pip install --user jinja2-cli
+
+      - name: Update ${{ matrix.branch }} branch
+        run: |
+          # necessary otherwise git will crash & despair when we attempt to commit
+          git config user.name "${{ github.actor }}"
+          git config user.email "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
+
+          git fetch origin ${{ matrix.branch }}
+          git checkout ${{ matrix.branch }}
+          git merge -X theirs main
+
+          jinja2 snap/snapcraft.yaml.j2 -D base=${{ matrix.base }} > snap/snapcraft.yaml
+
+          git add --force snap/snapcraft.yaml
+          git commit -m "chore: update snapcraft.yaml" || true
+
+          git push origin ${{ matrix.branch }}
diff --git a/.gitignore b/.gitignore
index 4d34aeb..ff4aa38 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,3 +36,6 @@ landscape_client.egg-info
 .pybuild
 venv
 .venv
+
+# templated, generate with `make snap-yaml`
+snap/snapcraft.yaml
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
deleted file mode 100644
index df96450..0000000
--- a/.pre-commit-config.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# See https://pre-commit.com for more information
-# See https://pre-commit.com/hooks.html for more hooks
-repos:
--   repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.4.0
-    hooks:
-    -   id: trailing-whitespace
-    -   id: end-of-file-fixer
-    -   id: check-yaml
-    -   id: check-added-large-files
-    -   id: debug-statements
--   repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v2.3.0
-    hooks:
-    - id: flake8
-      args:
-        - "--max-line-length=79"
-        - "--select=B,C,E,F,W,T4,B9"
-        - "--ignore=E203,W503"
--   repo: https://github.com/psf/black
-    rev: 22.12.0
-    hooks:
-    -   id: black
-        args:
-          - --line-length=79
-          - --include='\.pyi?$'
--   repo: https://github.com/asottile/reorder_python_imports
-    rev: v2.3.0
-    hooks:
-    -   id: reorder-python-imports
-        args: [--py3-plus]
--   repo: https://github.com/asottile/add-trailing-comma
-    rev: v2.0.1
-    hooks:
-    -   id: add-trailing-comma
-        args: [--py36-plus]
-exclude: >
-  (?x)(
-      \.git
-    | \.csv$
-    | \.__pycache__
-    | \.log$
-  )
diff --git a/Makefile b/Makefile
index 7ca4ff9..58e5662 100644
--- a/Makefile
+++ b/Makefile
@@ -4,12 +4,7 @@ PYTHON ?= python3
 SNAPCRAFT = SNAPCRAFT_BUILD_INFO=1 snapcraft
 TRIAL ?= -m landscape.lib.run_tests
 TRIAL_ARGS ?=
-PRE_COMMIT ?= $(HOME)/.local/bin/pre-commit
 
-# PEP8 rules ignored:
-# W503 https://www.flake8rules.com/rules/W503.html
-# E203 Whitespace before ':' (enforced by Black)
-PEP8_IGNORED = W503,E203
 
 .PHONY: help
 help:  ## Print help about available targets
@@ -17,20 +12,19 @@ help:  ## Print help about available targets
 
 .PHONY: depends
 depends:
-	sudo apt update && sudo apt-get -y install python3-configobj python3-coverage python3-distutils-extra\
-		python3-flake8 python3-mock python3-netifaces python3-pip python3-pycurl python3-twisted\
+	sudo apt update && sudo apt-get -y install python3-configobj python3-coverage \
+		python3-mock python3-netifaces python3-pip python3-pycurl python3-twisted\
 		net-tools
 
 .PHONY: depends-dev
 depends-dev: depends
-	pip install pre-commit
-	$(PRE_COMMIT) install
+	pip install jinja2-cli ruff coverage[toml]
 
 # -common seems a catch-22, but this is just a shortcut to
 # initialize user and dirs, some used through tests.
 .PHONY: depends-ci
 depends-ci: depends
-	sudo apt-get -y install landscape-common
+	sudo apt-get -y install landscape-common python3-pytest
 
 all: build
 
@@ -44,23 +38,27 @@ build:
 .PHONY: check
 check: TRIAL_ARGS=
 check: build
-	PYTHONPATH=$(PYTHONPATH):$(CURDIR) LC_ALL=C $(PYTHON) $(TRIAL) --unclean-warnings $(TRIAL_ARGS) landscape
+	@if ! echo "$$DEB_BUILD_OPTIONS" | grep -qw nocheck; then \
+		PYTHONPATH=$(PYTHONPATH):$(CURDIR) LC_ALL=C $(PYTHON) $(TRIAL) --unclean-warnings $(TRIAL_ARGS) landscape; \
+	fi
 
 .PHONY: coverage
 coverage:
 	PYTHONPATH=$(PYTHONPATH):$(CURDIR) LC_ALL=C $(PYTHON) -m coverage run $(TRIAL) --unclean-warnings landscape
 	PYTHONPATH=$(PYTHONPATH):$(CURDIR) LC_ALL=C $(PYTHON) -m coverage xml
 
-.PHONY: lint
-lint:
-	$(PYTHON) -m flake8 --ignore $(PEP8_IGNORED) `find landscape -name \*.py`
+.PHONY: ruff-fix
+ruff-fix:
+	ruff check --fix
+	ruff format
 
-.PHONY: pyflakes
-pyflakes:
-	-pyflakes `find landscape -name \*.py`
+.PHONY: ruff-check
+ruff-check:
+	ruff check
+	ruff format --check
 
-pre-commit:
-	-pre-commit run -a
+.PHONY: lint
+lint: ruff-fix
 
 .PHONY: clean
 clean:
@@ -116,36 +114,40 @@ tags:
 etags:
 	-etags --languages=python -R .
 
+.PHONY: snap-yaml
+snap-yaml:
+	jinja2 snap/snapcraft.yaml.j2 -D base=core24 > snap/snapcraft.yaml
+
+.PHONY: snap-install
 snap-install:
 	$(eval VERSION=$(shell yq ".version" snap/snapcraft.yaml))
 	sudo snap install --devmode landscape-client_$(VERSION)_amd64.snap
-.PHONY: snap-install
 
-snap-remote-build:
-	snapcraft remote-build
 .PHONY: snap-remote-build
+snap-remote-build: snap-yaml
+	snapcraft remote-build
 
+.PHONY: snap-remove
 snap-remove:
 	sudo snap remove --purge landscape-client
-.PHONY: snap-remove
 
+.PHONY: snap-shell
 snap-shell: snap-install
 	sudo snap run --shell landscape-client.landscape-client
-.PHONY: snap-shell
 
-snap-debug:
-	$(SNAPCRAFT) -v --debug
 .PHONY: snap-debug
+snap-debug: snap-yaml
+	$(SNAPCRAFT) -v --debug
 
+.PHONY: snap-clean
 snap-clean: snap-remove
 	$(eval VERSION=$(shell yq ".version" snap/snapcraft.yaml))
 	$(SNAPCRAFT) clean
 	-rm landscape-client_$(VERSION)_amd64.snap
-.PHONY: snap-clean
 
-snap:
-	$(SNAPCRAFT)
 .PHONY: snap
+snap: snap-yaml
+	$(SNAPCRAFT)
 
 # TICS expects coverage info to be in ./coverage/.coverage
 .PHONY: prepare-tics-analysis
diff --git a/Makefile.packaging b/Makefile.packaging
index d3c90ad..31ff873 100644
--- a/Makefile.packaging
+++ b/Makefile.packaging
@@ -4,20 +4,11 @@ UBUNTU_RELEASE := $(shell lsb_release -cs)
 # will be updated behind your back with the current result of that
 # command everytime it is mentioned/used.
 UPSTREAM_VERSION := $(shell python3 -c "from landscape import UPSTREAM_VERSION; print(UPSTREAM_VERSION)")
-CHANGELOG_VERSION := $(shell dpkg-parsechangelog | grep ^Version | cut -f 2 -d " " | cut -f 1 -d '-')
-GIT_HASH := $(shell git rev-parse --short HEAD)
-# We simulate a git "revno" for the sake of sortability.
-GIT_REVNO := $(shell git rev-list --count HEAD)
-ifeq (+git,$(findstring +git,$(UPSTREAM_VERSION)))
-TARBALL_VERSION := $(UPSTREAM_VERSION)
-else
-TARBALL_VERSION := $(UPSTREAM_VERSION)+git$(GIT_REVNO)
-endif
 
-.PHONY: origtarball
-origtarball: sdist
-	cp -f sdist/landscape-client-$(TARBALL_VERSION).tar.gz \
-		../landscape-client_$(TARBALL_VERSION).orig.tar.gz
+.PHONY: tarball
+tarball: sdist
+	cp -f sdist/landscape-client-$(UPSTREAM_VERSION).tar.gz \
+		../landscape-client_$(UPSTREAM_VERSION).orig.tar.gz
 
 .PHONY: prepchangelog
 prepchangelog:
@@ -30,17 +21,11 @@ prepchangelog:
 		echo "ERROR: please set \$$DEBEMAIL (NAME <EMAIL>)" 1>&2 ;\
 	    exit 1 ;\
 	fi
-# add a temporary entry for a local build if needed
-ifeq (,$(findstring +git,$(CHANGELOG_VERSION)))
-	dch -v $(TARBALL_VERSION)-0ubuntu0 "New local test build" --distribution $(UBUNTU_RELEASE)
-else
-# just update the timestamp
 	dch --distribution $(UBUNTU_RELEASE) --release $(UBUNTU_RELEASE)
-endif
 
 .PHONY: updateversion
 updateversion:
-	sed -i -e "s/^UPSTREAM_VERSION.*/UPSTREAM_VERSION = \"$(TARBALL_VERSION)\"/g" \
+	sed -i -e "s/^UPSTREAM_VERSION.*/UPSTREAM_VERSION = \"$(UPSTREAM_VERSION)\"/g" \
 		landscape/__init__.py
 
 .PHONY: package
@@ -48,23 +33,19 @@ package: clean prepchangelog updateversion  ## Generate the debian packages (use
 	debuild -b $(DEBUILD_OPTS)
 
 .PHONY: sourcepackage
-sourcepackage: origtarball prepchangelog updateversion
+sourcepackage: tarball prepchangelog updateversion
 	# need to remove sdist here because it doesn't exist in the
-	# orig tarball
+	# tarball
 	rm -rf sdist
 	debuild -S $(DEBUILD_OPTS)
 
-.PHONY: releasetarball
-releasetarball:
-	$(MAKE) sdist TARBALL_VERSION=$(UPSTREAM_VERSION)
-
 .PHONY: sdist
 sdist: clean
-	mkdir -p sdist/landscape-client-$(TARBALL_VERSION)
-	git ls-files --recurse-submodules | xargs -I {} cp -r --parents {} sdist/landscape-client-$(TARBALL_VERSION)
-	rm -rf sdist/landscape-client-$(TARBALL_VERSION)/debian
-	sed -i -e "s/^UPSTREAM_VERSION.*/UPSTREAM_VERSION = \"$(TARBALL_VERSION)\"/g" \
-		sdist/landscape-client-$(TARBALL_VERSION)/landscape/__init__.py
-	cd sdist && tar cfz landscape-client-$(TARBALL_VERSION).tar.gz landscape-client-$(TARBALL_VERSION)
-	cd sdist && md5sum landscape-client-$(TARBALL_VERSION).tar.gz > landscape-client-$(TARBALL_VERSION).tar.gz.md5
-	rm -rf sdist/landscape-client-$(TARBALL_VERSION)
+	mkdir -p sdist/landscape-client-$(UPSTREAM_VERSION)
+	git ls-files --recurse-submodules | xargs -I {} cp -r --parents {} sdist/landscape-client-$(UPSTREAM_VERSION)
+	rm -rf sdist/landscape-client-$(UPSTREAM_VERSION)/debian
+	sed -i -e "s/^UPSTREAM_VERSION.*/UPSTREAM_VERSION = \"$(UPSTREAM_VERSION)\"/g" \
+		sdist/landscape-client-$(UPSTREAM_VERSION)/landscape/__init__.py
+	cd sdist && tar cfz landscape-client-$(UPSTREAM_VERSION).tar.gz landscape-client-$(UPSTREAM_VERSION)
+	cd sdist && md5sum landscape-client-$(UPSTREAM_VERSION).tar.gz > landscape-client-$(UPSTREAM_VERSION).tar.gz.md5
+	rm -rf sdist/landscape-client-$(UPSTREAM_VERSION)
diff --git a/README b/README
index bceb5e3..c463317 100644
--- a/README
+++ b/README
@@ -6,13 +6,14 @@
 Add our beta PPA to get the latest updates to the landscape-client package
 
 #### Add repo to an Ubuntu series
-```
+
+```shell
 sudo add-apt-repository ppa:landscape/self-hosted-beta
 ```
 
 #### Add repo to a Debian based series that is not Ubuntu (experimental)
 
-```
+```shell
 # 1. Install our signing key
 gpg --keyserver keyserver.ubuntu.com --recv-keys 6e85a86e4652b4e6
 gpg --export 6e85a86e4652b4e6 | sudo tee -a /usr/share/keyrings/landscape-client-keyring.gpg > /dev/null
@@ -22,7 +23,8 @@ echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/lands
 ```
 
 #### Install the package
-```
+
+```shell
 sudo apt update && sudo apt install landscape-client
 ```
 
@@ -30,8 +32,8 @@ sudo apt update && sudo apt install landscape-client
 
 The Landscape Client generally runs as a combination of the `root` and
 `landscape` users.  It is possible to disable the administrative features of
-Landscape and run only the monitoring parts of it without using the `root`
-user at all.
+Landscape and run only the monitoring parts without using the `root` user at
+all.
 
 If you wish to use the Landscape Client in this way, it's recommended that you
 perform these steps immediately after installing the landscape-client package.
@@ -44,6 +46,7 @@ DAEMON_USER=landscape
 ```
 
 Edit `/etc/landscape/client.conf` and add the following line:
+
 ```
 monitor_only = true
 ```
@@ -66,15 +69,15 @@ git submodule update --init
 
 To run the full test suite, run the following command:
 
-```
+```shell
 make check
 ```
 
 When you want to test the landscape client manually without management
 features, you can simply run:
 
-```
-$ ./scripts/landscape-client
+```shell
+./scripts/landscape-client
 ```
 
 This defaults to the `landscape-client.conf` configuration file.
@@ -83,69 +86,83 @@ When you want to test management features manually, you'll need to run as root.
 There's a configuration file `root-client.conf` which specifies use of the
 system bus.
 
-```
-$ sudo ./scripts/landscape-client -c root-client.conf
+```shell
+sudo ./scripts/landscape-client -c root-client.conf
 ```
 
 Before opening a PR, make sure to run the full test suite and lint:
-```
+
+```shell
 make check
 make lint
 ```
 
 You can run a specific test by running the following (for example):
-```
+
+```shell
 python3 -m twisted.trial landscape.client.broker.tests.test_client.BrokerClientTest.test_ping
 ```
 
 ### Building the Landscape Client snap
 
 First, you need to ensure that you have the appropriate tools installed:
-```
-$ sudo snap install snapcraft --classic
-$ lxd init --auto
+
+```shell
+sudo snap install snapcraft --classic
+lxd init --auto
 ```
 
 There are various make targets defined to assist in the lifecycle of
-building and testing the snap.  To simply build the snap with the minimum
-of debug information displayed:
+building and testing the snap. To generate the snap's `snapcraft.yaml` file:
+
+```shell
+make snap-yaml
 ```
-$ make snap
+
+To simply build the snap with the minimum of debug information displayed:
+
+```shell
+make snap
 ```
 
 If you would prefer to see more information displayed showing the progress
 of the build, and would like to get dropped into a debug shell within the
 snap container in the event of an error:
-```
-$ make snap-debug
+
+```shell
+make snap-debug
 ```
 
 To use the make targets below, make sure you have [yq](https://github.com/mikefarah/yq) installed. You can install it using [Homebrew](https://brew.sh/) or as a snap:
 
-```console
-$ brew install yq
-$ snap install yq
+```shell
+brew install yq
+snap install yq
 ```
 
 To install the resulting snap:
-```
-$ make snap-install
+
+```shell
+make snap-install
 ```
 
 To remove a previously installed snap:
-```
-$ make snap-remove
+
+```shell
+make snap-remove
 ```
 
 To clean the intermediate files as well as the snap itself from the local
 build environment:
-```
-$ make snap-clean
+
+```shell
+make snap-clean
 ```
 
 To enter into a shell environment within the snap container:
-```
-$ make snap-shell
+
+```shell
+make snap-shell
 ```
 
 If you wish to upload the snap to the store, you will first need to get
@@ -156,23 +173,27 @@ https://snapcraft.io/docs/creating-your-developer-account
 
 After obtaining and confirming your store credentials, you then need to
 log in using the snapcraft tool:
-```
-$ snapcraft login
+
+```shell
+snapcraft login
 ```
 
 Since snapcraft version 7.x and higher, the credentials are stored in the
 gnome keyring on your local workstation.  If you are building in an
 environment without a GUI (e.g. in a multipass or lxc container), you
 will need to install the gnome keyring tools:
-```
-$ sudo apt install gnome-keyring
+
+```shell
+sudo apt install gnome-keyring
 ```
 
 You will then need to initialze the default keyring as follows:
+
+```shell
+dbus-run-session -- bash
+gnome-keyring-daemon --unlock
 ```
-$ dbus-run-session -- bash
-$ gnome-keyring-daemon --unlock
-```
+
 The gnome-keyring-daemon will prompt you (without a prompt) to type in
 the initial unlock password (typically the same password for the account
 you are using - if you are using the default multipass or lxc "ubuntu"
@@ -183,16 +204,20 @@ Type the login password and hit <ENTER> followed by <CTRL>+D to end
 the input.
 
 At this point, you should be able to log into snapcraft:
+
+```shell
+snapcraft login
 ```
-$ snapcraft login
-```
+
 You will be prompted for your UbuntuOne email address, password and,
 if set up this way, your second factor for authentication.  If you
 are successful, you should be able to query your login credentials
 with:
+
+```shell
+snapcraft whoami
 ```
-$ snapcraft whoami
-```
+
 A common mistake that first-time users of this process might make
 is that after running the gnome-keyring-daemon command, they will
 exit the dbus session shell.  Do NOT do that.  Do all subsequent
@@ -208,6 +233,11 @@ logged into the store.
 
 ### Automatic Builds and Releases
 
-The latest version of landscape-client snap will be built from the most recent commit and
-published to the `latest/edge` channel via [a recipe on launchpad](https://launchpad.net/~landscape/landscape-client/+snap/core-dev).
-Other channels are promoted and released manually.
+The landscape-client snap is automatically built from the most recent commit on the release branches and published to the `<base>/edge` channel of the respective core base:
+
+| Core Base | Edge Channel | Build Recipe                                                               |
+|-----------|--------------|----------------------------------------------------------------------------|
+| 24        | `24/edge`    | [core-24](https://launchpad.net/~landscape/landscape-client/+snap/core-24) |
+| 22        | `22/edge`    | [core-22](https://launchpad.net/~landscape/landscape-client/+snap/core-22) |
+
+Other channels (`<base>/beta`, `<base>/candidate`, `<base>/stable`) are promoted and released manually.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..906ed0d
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,5 @@
+# Security policy
+
+To report a security issue, file a [Private Security Report](https://github.com/canonical/landscape-client/security/advisories/new) or send an email to [[e-mail]](mailto:[e-mail]) with a description of the issue, the steps you took to create the issue, affected versions, and, if known, mitigations for the issue.
+
+The [Ubuntu Security disclosure and embargo policy](https://ubuntu.com/security/disclosure-policy) contains more information about what you can expect when you contact us and what we expect from you.
diff --git a/debian/changelog b/debian/changelog
index 1a20b31..dd766f7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,75 @@
+landscape-client (26.02.1-0ubuntu1) resolute; urgency=medium
+
+  * New upstream release 26.02.1
+    - d/patches: refresh patches that have not been applied upstream
+      - fix-landscape-client-manpage.patch
+    - d/patches: remove patches that have been applied upstream
+      - 2087852-feat-manage-ubuntu-sources-glob.patch
+      - allow-http-proxy-in-tests.patch
+      - fix-apt-source-file-management.patch
+      - package-reporter-high-cpu.patch
+      - unittest-makeSuite-deprecation.patch
+    - fix: restore functionality and tests for python 3.14
+    - feat: add FDE recovery key manager plugin
+    - fix: package changer uses proxy when configured
+    - refactor: Revert addition of `--ssl-ca` flag
+    - fix: Move WSL config options out of unsaved_options
+    - fix: landscape-config reads deprecated ssl_public_key field
+    - refactor: clean up bpickle dumps
+    - fix: don't explicitly make root owner of the executables
+    - refactor: move uaclient integration test out of landscape directory
+    - refactor: remove last instance of ssl_public_key
+    - build: remove git suffix for packaging
+    - fix: example. conf pro management plugin
+    - Bug fix: add id for devmode snaps for server indexing
+    - feat: add weekly integration testing for uaclient/pro
+    - fix: add python3-packaging dependency to landscape-client
+    - fix: uaclient wrapper with snap and core devices
+    - fix: make improvements to landscape-config --show
+    - feat: activity to detach pro
+    - feat: activity for attaching pro
+    - feat: add --show argument to landscape-config
+    - fix: Add deprecation warning for --is-registered in landscape-client
+    - refactor: add wrapper for uaclient library calls
+    - fix: rename ssl-public-key parameter
+    - build: add python3-packaging to build dependencies and fix test cases for build
+    - Add setuptools, remove setup and fix paths in Snapcraft.yaml
+    - fix: imports for snap/core devices
+    - refactor: change ubuntu pro info to use `uaclient.status` instead of subprocess
+    - fix: bump codecov upload version and use secret token
+    - refactor: do not cast to list when not needed
+    - feat: add --script-tempdir configuration
+    - fix: use machine_id in registration message schema
+    - feat: add machine-id to registration and computer info
+    - refactor: cleanup string continuations
+    - refactor: remove obsolete user message schemas
+    - refactor: remove obsolete register-* message schemas
+    - refactor: remove obsolete hardware-inventory message schema
+    - refactor: remove obsolete computer-uptime message schema
+    - refactor: remove oboslete client-uptime message schema
+    - refactor: delete unused eucalyptus message schema
+    - feat: unknown hashes per request is configurable
+    - refactor: delete `landscape/lib/compat.py`
+    - feat: log pending message count
+    - feat: configurably exclude package sources
+    - fix: invalid plugins do not crash landscape-sysinfo (LP: #1754002)
+    - fix: .list and .sources files are restored when a repository profile is disassociated from a noble (or later) instance
+    - fix: usgmanager should accept only the profile or the tailoring file
+    - fix: ensure usgmanager plugin runs in deferred
+    - feat: add usgmanager plugin to example.conf
+    - fix: add run-id and operation-id fields to usg-audit message
+    - fix: make config tests insensitive to http(s) proxy settings
+    - fix: remove deprecated use of `unittest.makeSuite` to get tests passing on >=py312
+    - feat: add optional --authenticated-attach-code to configuration parameters
+    - feat: add authenticated attach code to registration message
+    - refactor: stop using twisted.python.compat
+    - feat: add support for .sources when applying repository profiles
+    - fix: log rotation in snap
+    - fix: removed snapd-control-managed from snapcraft.yaml apps stanza
+    - fix: lint failure E226 - missing arithmetic whitespace
+
+ -- Joey Mucci <[e-mail]>  Thu, 05 Feb 2026 17:38:31 +0000
+
 landscape-client (24.12-0ubuntu5) resolute; urgency=medium
 
   * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)
diff --git a/debian/patches/2087852-feat-manage-ubuntu-sources-glob.patch b/debian/patches/2087852-feat-manage-ubuntu-sources-glob.patch
deleted file mode 100644
index 7dd82a5..0000000
--- a/debian/patches/2087852-feat-manage-ubuntu-sources-glob.patch
+++ /dev/null
@@ -1,188 +0,0 @@
-Subject: feat: add support for .sources when applying repository profiles
-
- This is the backport of an upstream commit which added support to manage
- ubuntu sources in DEB822 format (.sources files) alongside the one-liner
- format (.list files). The bug reported is outlined in LP: #2087852.
-
-Origin: upstream, https://github.com/canonical/landscape-client/commit/556f87c2819b218029ba0a13e2b2ceddfbec3e6b
-Bug-Ubuntu: https://bugs.launchpad.net/landscape-client/+bug/2087852
-Last-Update: 2025-03-31
-
-diff --git a/landscape/client/manager/aptsources.py b/landscape/client/manager/aptsources.py
-index 179fa723..785fa215 100644
---- a/landscape/client/manager/aptsources.py
-+++ b/landscape/client/manager/aptsources.py
-@@ -27,6 +27,11 @@ class AptSources(ManagerPlugin):
-     SOURCES_LIST_D = "/etc/apt/sources.list.d"
-     TRUSTED_GPG_D = "/etc/apt/trusted.gpg.d"
-
-+    """
-+    Valid file patterns for one-line and Deb822-style sources, respectively.
-+    """
-+    SOURCES_LIST_D_FILE_PATTERNS = ["*.list", "*.sources"]
-+
-     def register(self, registry):
-         super().register(registry)
-         registry.register_message(
-@@ -140,10 +145,14 @@ def _handle_sources(self, ignored, sources):
-             "manage_sources_list_d",
-             True,
-         )
-+
-         if manage_sources_list_d not in FALSE_VALUES:
--            filenames = glob.glob(os.path.join(self.SOURCES_LIST_D, "*.list"))
--            for filename in filenames:
--                shutil.move(filename, f"{filename}.save")
-+            for pattern in self.SOURCES_LIST_D_FILE_PATTERNS:
-+                filenames = glob.glob(
-+                    os.path.join(self.SOURCES_LIST_D, pattern)
-+                )
-+                for filename in filenames:
-+                    shutil.move(filename, f"{filename}.save")
-
-         for source in sources:
-             filename = os.path.join(
-diff --git a/landscape/client/manager/tests/test_aptsources.py b/landscape/client/manager/tests/test_aptsources.py
-index aa648be6..c17aac44 100644
---- a/landscape/client/manager/tests/test_aptsources.py
-+++ b/landscape/client/manager/tests/test_aptsources.py
-@@ -260,20 +260,28 @@ def buggy_source_handler(*args):
-
-     def test_renames_sources_list_d(self):
-         """
--        The sources files in sources.list.d are renamed to .save when a message
--        is received if config says to manage them, which is the default.
-+        The sources files (.list, .sources) in sources.list.d
-+        are renamed to .save when a message is received
-+        if config says to manage them, which is the default.
-         """
-+        FILE_1_LIST = os.path.join(
-+            self.sourceslist.SOURCES_LIST_D, "file1.list"
-+        )
-+
-+        FILE_2_SOURCES = os.path.join(
-+            self.sourceslist.SOURCES_LIST_D, "file2.sources"
-+        )
-         with open(
--            os.path.join(self.sourceslist.SOURCES_LIST_D, "file1.list"),
-+            FILE_1_LIST,
-             "w",
--        ) as sources1:
--            sources1.write("ok\n")
-+        ) as source1:
-+            source1.write("ok\n")
-
-         with open(
--            os.path.join(self.sourceslist.SOURCES_LIST_D, "file2.list.save"),
-+            FILE_2_SOURCES,
-             "w",
--        ) as sources2:
--            sources2.write("ok\n")
-+        ) as source2:
-+            source2.write("ok\n")
-
-         self.manager.dispatch_message(
-             {
-@@ -285,45 +293,42 @@ def test_renames_sources_list_d(self):
-         )
-
-         self.assertFalse(
--            os.path.exists(
--                os.path.join(self.sourceslist.SOURCES_LIST_D, "file1.list"),
--            ),
-+            os.path.exists(FILE_1_LIST),
-         )
-
-+        self.assertFalse(os.path.exists(FILE_2_SOURCES))
-+
-         self.assertTrue(
--            os.path.exists(
--                os.path.join(
--                    self.sourceslist.SOURCES_LIST_D,
--                    "file1.list.save",
--                ),
--            ),
-+            os.path.exists(f"{FILE_1_LIST}.save"),
-         )
-
-         self.assertTrue(
--            os.path.exists(
--                os.path.join(
--                    self.sourceslist.SOURCES_LIST_D,
--                    "file2.list.save",
--                ),
--            ),
-+            os.path.exists(f"{FILE_2_SOURCES}.save"),
-         )
-
-     def test_does_not_rename_sources_list_d(self):
-         """
--        The sources files in sources.list.d are not renamed to .save when a
--        message is received if config says not to manage them.
-+        The sources files (.list, .sources) in sources.list.d
-+        are not renamed to .save when a message is received
-+        if config says not to manage them
-         """
-+        FILE_3_LIST = os.path.join(
-+            self.sourceslist.SOURCES_LIST_D, "file3.list"
-+        )
-+
-+        FILE_4_SOURCES = os.path.join(
-+            self.sourceslist.SOURCES_LIST_D, "file4.sources"
-+        )
-         with open(
--            os.path.join(self.sourceslist.SOURCES_LIST_D, "file1.list"),
-+            FILE_3_LIST,
-             "w",
--        ) as sources1:
--            sources1.write("ok\n")
--
-+        ) as source3:
-+            source3.write("ok\n")
-         with open(
--            os.path.join(self.sourceslist.SOURCES_LIST_D, "file2.list.save"),
-+            FILE_4_SOURCES,
-             "w",
--        ) as sources2:
--            sources2.write("ok\n")
-+        ) as source4:
-+            source4.write("ok\n")
-
-         self.manager.config.manage_sources_list_d = False
-         self.manager.dispatch_message(
-@@ -336,27 +341,19 @@ def test_does_not_rename_sources_list_d(self):
-         )
-
-         self.assertTrue(
--            os.path.exists(
--                os.path.join(self.sourceslist.SOURCES_LIST_D, "file1.list"),
--            ),
-+            os.path.exists(FILE_3_LIST),
-+        )
-+
-+        self.assertTrue(
-+            os.path.exists(FILE_4_SOURCES),
-         )
-
-         self.assertFalse(
--            os.path.exists(
--                os.path.join(
--                    self.sourceslist.SOURCES_LIST_D,
--                    "file1.list.save",
--                ),
--            ),
-+            os.path.exists(f"{FILE_3_LIST}.save"),
-         )
-
--        self.assertTrue(
--            os.path.exists(
--                os.path.join(
--                    self.sourceslist.SOURCES_LIST_D,
--                    "file2.list.save",
--                ),
--            ),
-+        self.assertFalse(
-+            os.path.exists(f"{FILE_4_SOURCES}.save"),
-         )
-
-     def test_create_landscape_sources(self):
diff --git a/debian/patches/allow-http-proxy-in-tests.patch b/debian/patches/allow-http-proxy-in-tests.patch
deleted file mode 100644
index 3fc6473..0000000
--- a/debian/patches/allow-http-proxy-in-tests.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-Description: Fix config tests; make them insensitive to http(s) proxy environment variables
-Author: Mitch Burton <[e-mail]>
-Origin: upstream
-Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/landscape-client/+bug/2106263
-Applied-Upstream: https://github.com/canonical/landscape-client/commit/e79f605e3c69fc5b9b529a9997e4e89a6728066f
-Last-Update: 2025-04-07
----
-This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
-Index: landscape-client/landscape/client/tests/test_configuration.py
-===================================================================
---- landscape-client.orig/landscape/client/tests/test_configuration.py
-+++ landscape-client/landscape/client/tests/test_configuration.py
-@@ -756,6 +756,7 @@ class ConfigurationFunctionsTest(Landsca
-         )
- 
-     @mock.patch("landscape.client.configuration.ServiceConfig")
-+    @mock.patch("os.environ", new={})
-     def test_silent_setup(self, mock_serviceconfig):
-         """
-         Only command-line options are used in silent mode.
-@@ -775,6 +776,7 @@ url = https://landscape.canonical.com/me
-         )
- 
-     @mock.patch("landscape.client.configuration.ServiceConfig")
-+    @mock.patch("os.environ", {})
-     def test_silent_setup_no_register(self, mock_serviceconfig):
-         """
-         Called with command line options to write a config file but no
-@@ -846,6 +848,7 @@ url = https://landscape.canonical.com/me
-         )
- 
-     @mock.patch("landscape.client.configuration.ServiceConfig")
-+    @mock.patch("os.environ", {})
-     def test_silent_setup_unicode_computer_title(self, mock_serviceconfig):
-         """
-         Setup accepts a non-ascii computer title and registration is
-@@ -880,6 +883,7 @@ url = https://landscape.canonical.com/me
- 
-     @mock.patch("landscape.client.configuration.input")
-     @mock.patch("landscape.client.configuration.ServiceConfig")
-+    @mock.patch("os.environ", new={})
-     def test_silent_script_users_imply_script_execution_plugin(
-         self,
-         mock_serviceconfig,
-@@ -951,6 +955,7 @@ bus = session
-         mock_serviceconfig.set_start_on_boot.assert_called_once_with(True)
- 
-     @mock.patch("landscape.client.configuration.ServiceConfig")
-+    @mock.patch("os.environ", new={})
-     def test_silent_setup_with_ping_url(self, mock_serviceconfig):
-         mock_serviceconfig.restart_landscape.return_value = True
-         filename = self.makeFile(
-@@ -1814,6 +1819,7 @@ registration_key = shared-secret
-         )
- 
-     @mock.patch("landscape.client.configuration.ServiceConfig")
-+    @mock.patch("os.environ", new={})
-     def test_import_from_file_may_reset_old_options(self, mock_serviceconfig):
-         """
-         This test ensures that setting an empty option in an imported
diff --git a/debian/patches/fix-apt-source-file-management.patch b/debian/patches/fix-apt-source-file-management.patch
deleted file mode 100644
index 1d1f07b..0000000
--- a/debian/patches/fix-apt-source-file-management.patch
+++ /dev/null
@@ -1,204 +0,0 @@
-Description: restore .list and .sources files when a repo profile is disassociated.
-Author: Mitch Burton <[e-mail]>
-Origin: backport, https://github.com/canonical/landscape-client/commit/c9900d7a31eb6d5822bd2a66d0a6bfa3e926a7a6
-Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/landscape-client/+bug/2087852
-Applied-Upstream: 25.04
-Last-Update: 2025-05-30
----
-This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
-Index: landscape-client/landscape/client/manager/aptsources.py
-===================================================================
---- landscape-client.orig/landscape/client/manager/aptsources.py	2025-05-30 15:51:00.602533338 -0700
-+++ landscape-client/landscape/client/manager/aptsources.py	2025-05-30 15:53:54.187667629 -0700
-@@ -114,6 +114,12 @@
- 
-         saved_sources = f"{self.SOURCES_LIST}.save"
- 
-+        manage_sources_list_d = getattr(
-+            self.registry.config,
-+            "manage_sources_list_d",
-+            True,
-+        )
-+
-         if sources:
-             fd, path = tempfile.mkstemp()
-             os.close(fd)
-@@ -135,24 +141,34 @@
-                 original_stat.st_uid,
-                 original_stat.st_gid,
-             )
-+
-+            if manage_sources_list_d not in FALSE_VALUES:
-+                for pattern in self.SOURCES_LIST_D_FILE_PATTERNS:
-+                    filenames = glob.glob(
-+                        os.path.join(self.SOURCES_LIST_D, pattern)
-+                    )
-+                    for filename in filenames:
-+                        shutil.move(filename, f"{filename}.save")
-         else:
-             # Re-instate original sources
-             if os.path.isfile(saved_sources):
-                 shutil.move(saved_sources, self.SOURCES_LIST)
- 
--        manage_sources_list_d = getattr(
--            self.registry.config,
--            "manage_sources_list_d",
--            True,
--        )
-+            if manage_sources_list_d not in FALSE_VALUES:
-+                for pattern in self.SOURCES_LIST_D_FILE_PATTERNS:
-+                    filenames = glob.glob(
-+                        os.path.join(self.SOURCES_LIST_D, f"{pattern}.save")
-+                    )
-+                    for filename in filenames:
-+                        restored_filename = filename.removesuffix(".save")
-+                        shutil.move(filename, restored_filename)
-+            # Delete Landscape source files prefixed with `landscape-`
-+            landscape_source_filenames = glob.glob(
-+                os.path.join(self.SOURCES_LIST_D, "landscape-*.list")
-+            )
- 
--        if manage_sources_list_d not in FALSE_VALUES:
--            for pattern in self.SOURCES_LIST_D_FILE_PATTERNS:
--                filenames = glob.glob(
--                    os.path.join(self.SOURCES_LIST_D, pattern)
--                )
--                for filename in filenames:
--                    shutil.move(filename, f"{filename}.save")
-+            for source_filename in landscape_source_filenames:
-+                os.remove(source_filename)
- 
-         for source in sources:
-             filename = os.path.join(
-Index: landscape-client/landscape/client/manager/tests/test_aptsources.py
-===================================================================
---- landscape-client.orig/landscape/client/manager/tests/test_aptsources.py	2025-05-30 15:51:00.602533338 -0700
-+++ landscape-client/landscape/client/manager/tests/test_aptsources.py	2025-05-30 15:54:55.930259108 -0700
-@@ -165,6 +165,109 @@
-         with open(self.sourceslist.SOURCES_LIST) as sources:
-             self.assertEqual("original content\n", sources.read())
- 
-+    def test_restore_sources_list_d(self):
-+        """
-+        When getting a repository message without sources, AptSources
-+        restores the previous files in sources.list.d.
-+        """
-+        FILE_1_LIST = os.path.join(
-+            self.sourceslist.SOURCES_LIST_D, "file1.list"
-+        )
-+        FILE_2_SOURCES = os.path.join(
-+            self.sourceslist.SOURCES_LIST_D, "file2.sources"
-+        )
-+        with open(
-+            FILE_1_LIST,
-+            "w",
-+        ) as source1:
-+            source1.write("ok\n")
-+        with open(
-+            FILE_2_SOURCES,
-+            "w",
-+        ) as source2:
-+            source2.write("ok\n")
-+        self.manager.dispatch_message(
-+            {
-+                "type": "apt-sources-replace",
-+                "sources": [{"name": "bla", "content": b""}],
-+                "gpg-keys": [],
-+                "operation-id": 1,
-+            },
-+        )
-+        self.assertFalse(
-+            os.path.exists(FILE_1_LIST),
-+        )
-+        self.assertFalse(os.path.exists(FILE_2_SOURCES))
-+        self.assertTrue(
-+            os.path.exists(f"{FILE_1_LIST}.save"),
-+        )
-+        self.assertTrue(
-+            os.path.exists(f"{FILE_2_SOURCES}.save"),
-+        )
-+        self.manager.dispatch_message(
-+            {
-+                "type": "apt-sources-replace",
-+                "sources": [],
-+                "gpg-keys": [],
-+                "operation-id": 2,
-+            },
-+        )
-+        self.assertTrue(
-+            os.path.exists(FILE_1_LIST),
-+        )
-+        self.assertTrue(os.path.exists(FILE_2_SOURCES))
-+        self.assertFalse(
-+            os.path.exists(f"{FILE_1_LIST}.save"),
-+        )
-+        self.assertFalse(
-+            os.path.exists(f"{FILE_2_SOURCES}.save"),
-+        )
-+    def test_restore_sources_list_d_removes_old_profile_files(self):
-+        """
-+        When getting a repository message without sources, old
-+        source files in `/etc/apt/sources.list.d` prefixed with
-+        `landscape-` will be removed.
-+        """
-+        first_source_name = "ginger"
-+        self.manager.dispatch_message(
-+            {
-+                "type": "apt-sources-replace",
-+                "sources": [{"name": first_source_name, "content": b""}],
-+                "gpg-keys": [],
-+                "operation-id": 1,
-+            },
-+        )
-+        first_sources_path = os.path.join(
-+            self.sourceslist.SOURCES_LIST_D,
-+            f"landscape-{first_source_name}.list",
-+        )
-+        self.assertTrue(os.path.exists(first_sources_path))
-+        second_source_name = "ace rothstein"
-+        self.manager.dispatch_message(
-+            {
-+                "type": "apt-sources-replace",
-+                "sources": [{"name": second_source_name, "content": b""}],
-+                "gpg-keys": [],
-+                "operation-id": 2,
-+            },
-+        )
-+        second_sources_path = os.path.join(
-+            self.sourceslist.SOURCES_LIST_D,
-+            f"landscape-{second_source_name}.list",
-+        )
-+        self.assertTrue(os.path.exists(f"{first_sources_path}.save"))
-+        self.assertTrue(os.path.exists(second_sources_path))
-+        self.manager.dispatch_message(
-+            {
-+                "type": "apt-sources-replace",
-+                "sources": [],
-+                "gpg-keys": [],
-+                "operation-id": 3,
-+            },
-+        )
-+        self.assertFalse(os.path.exists(first_sources_path))
-+        self.assertFalse(os.path.exists(second_sources_path))
-+
-     def test_sources_list_permissions(self):
-         """
-         When getting a repository message, L{AptSources} keeps sources.list
-@@ -286,12 +389,16 @@
-         self.manager.dispatch_message(
-             {
-                 "type": "apt-sources-replace",
--                "sources": [],
-+                "sources": [{"name": "bla", "content": b""}],
-                 "gpg-keys": [],
-                 "operation-id": 1,
-             },
-         )
- 
-+        self.assertTrue(
-+            os.path.exists(self.sourceslist.SOURCES_LIST),
-+        )
-+
-         self.assertFalse(
-             os.path.exists(FILE_1_LIST),
-         )
diff --git a/debian/patches/fix-landscape-client-manpage.patch b/debian/patches/fix-landscape-client-manpage.patch
index 729891a..9a34d2b 100644
--- a/debian/patches/fix-landscape-client-manpage.patch
+++ b/debian/patches/fix-landscape-client-manpage.patch
@@ -1,19 +1,19 @@
 Description: Fix indentation in landscape-client manpage
-Author: Mitch Burton <[e-mail]>
+Author: Joey Mucci <[e-mail]>
 Bug: https://bugs.launchpad.net/landscape-client/+bug/2076667
-Last-Update: 2024-08-12
+Last-Update: 2026-02-02
 ---
 This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
 --- a/man/landscape-client.1
 +++ b/man/landscape-client.1
 @@ -1,5 +1,5 @@
  .\" Text automatically generated by txt2man
--.TH landscape-client 1 "08 July 2024" "" ""
-+.TH landscape-client 1 "12 August 2024" "" ""
+-.TH landscape-client 1 "25 November 2025" "" ""
++.TH landscape-client 1 "02 February 2026" "" ""
  .SH NAME
  \fBlandscape-client \fP- Landscape system client
  \fB
-@@ -92,11 +92,14 @@
+@@ -88,11 +88,14 @@
  .SH EXAMPLES
  
  To run the client in the foreground, with all logging data printed to standard
@@ -32,7 +32,7 @@ This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
  To run the client in the background with a particular configuration file:
  .PP
  .nf
-@@ -105,7 +108,6 @@
+@@ -101,7 +104,6 @@
  
  .fam T
  .fi
@@ -42,7 +42,7 @@ This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
  .PP
 --- a/man/landscape-client.txt
 +++ b/man/landscape-client.txt
-@@ -41,7 +41,7 @@
+@@ -40,7 +40,7 @@
  EXAMPLES
  
  To run the client in the foreground, with all logging data printed to standard
diff --git a/debian/patches/package-reporter-high-cpu.patch b/debian/patches/package-reporter-high-cpu.patch
deleted file mode 100644
index 03e4866..0000000
--- a/debian/patches/package-reporter-high-cpu.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-Description: Reduce CPU usage of package-reporter (LP: #2099283)
-Author: Jan-Yaeger Dhillon <[e-mail]>
-Origin: upstream, https://github.com/canonical/landscape-client/commit/f5a6d8a924097a37e70ec25522bd748a341212bf
-Bug-Ubuntu: https://bugs.launchpad.net/landscape-client/+bug/2099283
-Reviewed-by: Kevin Nasto <[e-mail]>
-Applied Upstream: 25.04, https://github.com/canonical/landscape-client/commit/f5a6d8a924097a37e70ec25522bd748a341212bf
-Last-Update: 2025-05-12
----
-Index: landscape-client/landscape/client/package/reporter.py
-===================================================================
---- landscape-client.orig/landscape/client/package/reporter.py
-+++ landscape-client/landscape/client/package/reporter.py
-@@ -698,53 +698,53 @@ class PackageReporter(PackageTaskHandler
-         backports_archive = "{}-backports".format(os_release_info["code-name"])
-         security_archive = "{}-security".format(os_release_info["code-name"])
- 
--        for package in self._facade.get_packages():
-+        for package_version in self._facade.get_packages():
-+            # Get archives from the list of PackageFiles
-+            # for the given package version rather than using
-+            # package_version.origins from the Python apt package.
-+            # We only want to check the archives, and creating
-+            # Origins using package_version.origins is expensive.
-+            # See /usr/lib/python3/dist-packages/apt/package.py
-+            archives = [
-+                # Ex. jammy-backports
-+                package_file.archive
-+                for package_file, _ in package_version._cand.file_list
-+            ]
-+
-             # Don't include package versions from the official backports
-             # archive. The backports archive is enabled by default since
-             # xenial with a pinning policy of 100. Ideally we would
-             # support pinning, but we don't yet. In the mean time, we
-             # ignore backports, so that packages don't get automatically
-             # upgraded to the backports version.
--            backport_origins = [
--                origin
--                for origin in package.origins
--                if origin.archive == backports_archive
--            ]
--            if backport_origins and (
--                len(backport_origins) == len(package.origins)
--            ):
-+            if all(archive == backports_archive for archive in archives):
-                 # Ignore the version if it's only in the official
-                 # backports archive. If it's somewhere else as well,
-                 # e.g. a PPA, we assume it was added manually and the
-                 # user wants to get updates from it.
-                 continue
--            hash = self._facade.get_package_hash(package)
-+            hash = self._facade.get_package_hash(package_version)
-             id = self._store.get_hash_id(hash)
-             if id is not None:
--                if self._facade.is_package_installed(package):
-+                if self._facade.is_package_installed(package_version):
-                     current_installed.add(id)
--                    if self._facade.is_package_available(package):
-+                    if self._facade.is_package_available(package_version):
-                         current_available.add(id)
--                    if self._facade.is_package_autoremovable(package):
-+                    if self._facade.is_package_autoremovable(package_version):
-                         current_autoremovable.add(id)
-                 else:
-                     current_available.add(id)
- 
-                 # Are there any packages that this package is an upgrade for?
--                if self._facade.is_package_upgrade(package):
-+                if self._facade.is_package_upgrade(package_version):
-                     current_upgrades.add(id)
- 
-                 # Is this package present in the security pocket?
--                security_origins = any(
--                    origin
--                    for origin in package.origins
--                    if origin.archive == security_archive
--                )
--                if security_origins:
-+                if security_archive in archives:
-                     current_security.add(id)
- 
--        for package in self._facade.get_locked_packages():
--            hash = self._facade.get_package_hash(package)
-+        for package_version in self._facade.get_locked_packages():
-+            hash = self._facade.get_package_hash(package_version)
-             id = self._store.get_hash_id(hash)
-             if id is not None:
-                 current_locked.add(id)
-Index: landscape-client/landscape/client/package/tests/test_reporter.py
-===================================================================
---- landscape-client.orig/landscape/client/package/tests/test_reporter.py
-+++ landscape-client/landscape/client/package/tests/test_reporter.py
-@@ -1262,6 +1262,24 @@ class PackageReporterAptTest(LandscapeTe
-         result = self.reporter.detect_packages_changes()
-         return result.addCallback(got_result)
- 
-+    def test_compute_packages_changes_package_origins_not_called(self):
-+        """
-+        Archive info is extracted directly from the package versions
-+        and the apt.package.Version.origins property is not called
-+        """
-+        with mock.patch("apt.package.Version.origins") as version_origins_mock:
-+            self.successResultOf(self.reporter._compute_packages_changes())
-+        version_origins_mock.assert_not_called()
-+
-+    def test_compute_packages_changes_origins_not_created(self):
-+        """
-+        Archive info is extracted directly from the package versions
-+        and no Origins are created (expensive find_index() is not called)
-+        """
-+        with mock.patch("apt.package.Origin.__init__") as origin_mock:
-+            self.successResultOf(self.reporter._compute_packages_changes())
-+        origin_mock.assert_not_called()
-+
-     def test_detect_packages_changes_with_backports_others(self):
-         """
-         Packages coming from backport archives that aren't named like
diff --git a/debian/patches/series b/debian/patches/series
index 9c191d0..051c373 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,6 +1 @@
 fix-landscape-client-manpage.patch
-unittest-makeSuite-deprecation.patch
-2087852-feat-manage-ubuntu-sources-glob.patch
-allow-http-proxy-in-tests.patch
-package-reporter-high-cpu.patch
-fix-apt-source-file-management.patch
diff --git a/debian/patches/unittest-makeSuite-deprecation.patch b/debian/patches/unittest-makeSuite-deprecation.patch
deleted file mode 100644
index e06382e..0000000
--- a/debian/patches/unittest-makeSuite-deprecation.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-Description: Fix tests on python versions where unittest.makeSuite has been removed
-Author: Mitch Burton <[e-mail]>
-Origin: upstream
-Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/landscape-client/+bug/2106263
-Applied-Upstream: https://github.com/canonical/landscape-client/commit/e3f051ad6a33029845f9f11b17649299004598a7
-Last-Update: 2025-03-26
----
-This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
-Index: landscape-client/landscape/lib/tests/test_sequenceranges.py
-===================================================================
---- landscape-client.orig/landscape/lib/tests/test_sequenceranges.py
-+++ landscape-client/landscape/lib/tests/test_sequenceranges.py
-@@ -297,11 +297,21 @@ class RemoveFromRangesTest(unittest.Test
- def test_suite():
-     return unittest.TestSuite(
-         (
--            unittest.makeSuite(SequenceToRangesTest),
--            unittest.makeSuite(RangesToSequenceTest),
--            unittest.makeSuite(SequenceRangesTest),
--            unittest.makeSuite(FindRangesIndexTest),
--            unittest.makeSuite(AddToRangesTest),
--            unittest.makeSuite(RemoveFromRangesTest),
-+            unittest.defaultTestLoader.loadTestsFromTestCase(
-+                SequenceToRangesTest
-+            ),
-+            unittest.defaultTestLoader.loadTestsFromTestCase(
-+                RangesToSequenceTest
-+            ),
-+            unittest.defaultTestLoader.loadTestsFromTestCase(
-+                SequenceRangesTest
-+            ),
-+            unittest.defaultTestLoader.loadTestsFromTestCase(
-+                FindRangesIndexTest
-+            ),
-+            unittest.defaultTestLoader.loadTestsFromTestCase(AddToRangesTest),
-+            unittest.defaultTestLoader.loadTestsFromTestCase(
-+                RemoveFromRangesTest
-+            ),
-         ),
-     )
diff --git a/example.conf b/example.conf
index 81a5d36..c81e686 100644
--- a/example.conf
+++ b/example.conf
@@ -181,6 +181,7 @@ cloud = True
 #   UbuntuProInfo - Ubuntu Pro registration information
 #   LivePatch - Livepath status information
 #   UbuntuProRebootRequired - informs if the system needs to be rebooted
+#   ProManagement - allows for operations that manage pro
 #
 # The special value "ALL" is an alias for the entire list of plugins above and is the default.
 manager_plugins = ALL
@@ -190,6 +191,10 @@ manager_plugins = ALL
 # The ScriptExecution manager plugin is not enabled by default.
 # The following example would enable it.
 #include_manager_plugins = ScriptExecution
+#
+# The UsgManager manager plugin is not enabled by default.
+# The following example would enable it.
+#include_manager_plugins = UsgManager
 
 # A comma-separated list of usernames that scripts can run as.
 #
@@ -214,3 +219,9 @@ manager_plugins = ALL
 # should match the uid assigned to the host machine.
 # For all other computers, do not set this parameter.
 #hostagent_uid = the-uid-of-the-host-machine
+
+# This parameter determines how many unknown package hashes client
+# will send to server at one time. The default is 500 and the maximum
+# is 2000. Note that increasing the value may result in higher CPU usage
+# by the client machine during this package reporting.
+#max_unknown_hashes_per_request = 500
diff --git a/integration_tests/__init__.py b/integration_tests/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/integration_tests/__init__.py
diff --git a/integration_tests/test_uaclient_integration.py b/integration_tests/test_uaclient_integration.py
new file mode 100644
index 0000000..0b91893
--- /dev/null
+++ b/integration_tests/test_uaclient_integration.py
@@ -0,0 +1,47 @@
+"""
+Integration tests for uaclient (Ubuntu Pro) interaction.
+
+These are not run when unit tests are run. They are ignored by the unit
+testrunner, twisted.trial, because they are pytest tests.
+"""
+
+import os
+
+import pytest
+
+from landscape.lib import uaclient
+
+
[e-mail]
+def test_attach_status_detach_pro():
+    """
+    Attaches a pro token, checks the status, detaches it, then checks the
+    status again.
+    """
+    token = os.environ.get("TEST_PRO_TOKEN")
+
+    assert token is not None
+
+    uaclient.attach_pro(token)
+
+    pro_status = uaclient.get_pro_status()
+
+    assert "contract" in pro_status
+    contract = pro_status["contract"]
+
+    assert "products" in contract
+    products = contract["products"]
+
+    assert "free" in products
+
+    uaclient.detach_pro()
+
+    pro_status = uaclient.get_pro_status()
+
+    assert "contract" in pro_status
+    contract = pro_status["contract"]
+
+    assert "products" in contract
+    products = contract["products"]
+
+    assert products == []
diff --git a/landscape/__init__.py b/landscape/__init__.py
index 3faa180..e787b26 100644
--- a/landscape/__init__.py
+++ b/landscape/__init__.py
@@ -1,5 +1,6 @@
 DEBIAN_REVISION = ""
-UPSTREAM_VERSION = "24.12"
+UPSTREAM_VERSION = "26.02.1"
+PYTHON_VERSION = "26.02.1"
 VERSION = f"{UPSTREAM_VERSION}{DEBIAN_REVISION}"
 
 # The minimum server API version that all Landscape servers are known to speak
diff --git a/landscape/client/amp.py b/landscape/client/amp.py
index 5b5d448..d608e64 100644
--- a/landscape/client/amp.py
+++ b/landscape/client/amp.py
@@ -10,12 +10,15 @@ This module implements a few conveniences built around L{landscape.lib.amp} to
 let the various services connect to each other in an easy and idiomatic way,
 and have them respond to standard requests like "ping" or "exit".
 """
+
 import logging
 import os
 
-from landscape.lib.amp import MethodCallClientFactory
-from landscape.lib.amp import MethodCallServerFactory
-from landscape.lib.amp import RemoteObject
+from landscape.lib.amp import (
+    MethodCallClientFactory,
+    MethodCallServerFactory,
+    RemoteObject,
+)
 
 
 class ComponentPublisher:
diff --git a/landscape/client/attachments.py b/landscape/client/attachments.py
new file mode 100644
index 0000000..cf21f6e
--- /dev/null
+++ b/landscape/client/attachments.py
@@ -0,0 +1,65 @@
+import os
+
+from landscape import VERSION
+from landscape.client import GROUP, USER
+from landscape.lib.fetch import fetch_async
+from landscape.lib.persist import Persist
+
+
+async def save_attachments(
+    config,
+    attachments,
+    dest,
+    uid=None,
+    gid=None,
+) -> None:
+    """Downloads `attachments` from Landscape Server, writing them to `dest`.
+
+    :param config: The Landscape Client configuration.
+    :param attachments: The names and IDs of the attachments to download, an
+        iterable of pairs.
+    :param dest: The directory to write the downloaded attachments to.
+    :param uid: The user who should own the files.
+    :param gid: The group that should own the files.
+
+    :raises HTTPCodeError: If Server responds with an error HTTP code.
+    """
+    root_path = config.url.rsplit("/", 1)[0] + "/attachment/"
+    headers = {
+        "User-Agent": "landscape-client/" + VERSION,
+        "Content-Type": "application/octet-stream",
+        "X-Computer-ID": _get_secure_id(config),
+    }
+
+    for filename, attachment_id in attachments:
+        if isinstance(attachment_id, str):
+            # Backward-compatibility with inline attachments.
+            data = attachment_id.encode()
+        else:
+            data = await fetch_async(
+                root_path + str(attachment_id),
+                cainfo=config.ssl_public_key,
+                headers=headers,
+            )
+
+        full_filename = os.path.join(dest, filename)
+        with open(full_filename, "wb") as attachment:
+            attachment.write(data)
+
+        os.chmod(full_filename, 0o600)
+        if uid is not None:
+            os.chown(full_filename, uid, gid)
+
+
+def _get_secure_id(config) -> str:
+    """Retrieves the secure ID from the broker persistent storage."""
+    persist = Persist(
+        filename=os.path.join(config.data_path, "broker.bpickle"),
+        user=USER,
+        group=GROUP,
+    )
+
+    secure_id = persist.root_at("registration").get("secure-id")
+    secure_id = secure_id.decode("ascii")
+
+    return secure_id
diff --git a/landscape/client/broker/amp.py b/landscape/client/broker/amp.py
index 2278b08..5fab544 100644
--- a/landscape/client/broker/amp.py
+++ b/landscape/client/broker/amp.py
@@ -1,16 +1,11 @@
-from twisted.internet.defer import execute
-from twisted.internet.defer import maybeDeferred
-from twisted.internet.defer import succeed
-from twisted.python.compat import iteritems
+from twisted.internet.defer import execute, maybeDeferred, succeed
 
-from landscape.client.amp import ComponentConnector
-from landscape.client.amp import get_remote_methods
+from landscape.client.amp import ComponentConnector, get_remote_methods
 from landscape.client.broker.client import BrokerClient
 from landscape.client.broker.server import BrokerServer
 from landscape.client.manager.manager import Manager
 from landscape.client.monitor.monitor import Monitor
-from landscape.lib.amp import MethodCallArgument
-from landscape.lib.amp import RemoteObject
+from landscape.lib.amp import MethodCallArgument, RemoteObject
 
 
 class RemoteBroker(RemoteObject):
@@ -60,7 +55,7 @@ class FakeRemoteBroker:
             def method(*args, **kwargs):
                 for arg in args:
                     assert MethodCallArgument.check(arg)
-                for k, v in iteritems(kwargs):
+                for k, v in kwargs.items():
                     assert MethodCallArgument.check(v)
                 return execute(original, *args, **kwargs)
 
@@ -121,6 +116,4 @@ def get_component_registry():
         RemoteMonitorConnector,
         RemoteManagerConnector,
     ]
-    return {
-        connector.component.name: connector for connector in all_connectors
-    }
+    return {connector.component.name: connector for connector in all_connectors}
diff --git a/landscape/client/broker/client.py b/landscape/client/broker/client.py
index 5d3dd4a..47b9312 100644
--- a/landscape/client/broker/client.py
+++ b/landscape/client/broker/client.py
@@ -1,18 +1,18 @@
 import random
 import sys
 import traceback
-from logging import debug
-from logging import error
-from logging import exception
-from logging import info
+from logging import debug, error, exception, info
+from typing import TYPE_CHECKING
 
-from twisted.internet.defer import maybeDeferred
-from twisted.internet.defer import succeed
+from twisted.internet.defer import maybeDeferred, succeed
 
 from landscape.client.amp import remote
 from landscape.lib.format import format_object
 from landscape.lib.twisted_util import gather_results
 
+if TYPE_CHECKING:
+    from landscape.client.broker.config import BrokerConfiguration
+
 
 class HandlerNotFoundError(Exception):
     """A handler for the given message type was not found."""
@@ -44,7 +44,7 @@ class BrokerClientPlugin:
     _session_id = None
     _loop = None
 
-    def register(self, client):
+    def register(self, client: "BrokerClient"):
         self.client = client
         self.client.reactor.call_on("resynchronize", self._resynchronize)
         deferred = self.client.broker.get_session_id(scope=self.scope)
@@ -171,7 +171,7 @@ class BrokerClient:
 
     name = "client"
 
-    def __init__(self, reactor, config):
+    def __init__(self, reactor, config: "BrokerConfiguration"):
         super().__init__()
         self.reactor = reactor
         self.broker = None
@@ -235,12 +235,15 @@ class BrokerClient:
         handler = self._registered_messages.get(typ)
         if handler is None:
             raise HandlerNotFoundError(typ)
-        try:
-            return handler(message)
-        except Exception:
-            exception(
-                f"Error running message handler for type {typ!r}: {handler!r}",
-            )
+
+        d = maybeDeferred(handler, message)
+        d.addErrback(self._error_log, typ, handler)
+        return d
+
+    def _error_log(self, _, typ, handler):
+        exception(
+            f"Error running message handler for type {typ!r}: {handler!r}",
+        )
 
     @remote
     def message(self, message):
diff --git a/landscape/client/broker/config.py b/landscape/client/broker/config.py
index 2e7849f..609c45a 100644
--- a/landscape/client/broker/config.py
+++ b/landscape/client/broker/config.py
@@ -1,4 +1,5 @@
 """Configuration class for the broker."""
+
 import os
 
 from landscape.client.deployment import Configuration
@@ -91,8 +92,7 @@ class BrokerConfiguration(Configuration):
         )
         parser.add_argument(
             "--tags",
-            help="Comma separated list of tag names to be sent "
-            "to the server.",
+            help="Comma separated list of tag names to be sent to the server.",
         )
         parser.add_argument(
             "--hostagent-uid",
@@ -107,6 +107,10 @@ class BrokerConfiguration(Configuration):
             "that Landscape assigned to the installation activity for the "
             "host machine.",
         )
+        parser.add_argument(
+            "--authenticated-attach-code",
+            help="A one-time-use, Landscape server-generated code.",
+        )
 
         return parser
 
diff --git a/landscape/client/broker/exchange.py b/landscape/client/broker/exchange.py
index b223472..4f27a80 100644
--- a/landscape/client/broker/exchange.py
+++ b/landscape/client/broker/exchange.py
@@ -342,25 +342,19 @@ Diagram::
   14. Schedule exchange
 
 """
+
 import logging
 import time
 
-from twisted.internet.defer import Deferred
-from twisted.internet.defer import succeed
+from twisted.internet.defer import Deferred, succeed
 
-from landscape import CLIENT_API
-from landscape import DEFAULT_SERVER_API
-from landscape import SERVER_API
+from landscape import CLIENT_API, DEFAULT_SERVER_API, SERVER_API
 from landscape.lib.backoff import ExponentialBackoff
-from landscape.lib.compat import _PY3
-from landscape.lib.fetch import HTTPCodeError
-from landscape.lib.fetch import PyCurlError
+from landscape.lib.fetch import HTTPCodeError, PyCurlError
 from landscape.lib.format import format_delta
 from landscape.lib.hashlib import md5
-from landscape.lib.message import got_next_expected
-from landscape.lib.message import RESYNC
-from landscape.lib.versioning import is_version_higher
-from landscape.lib.versioning import sort_versions
+from landscape.lib.message import RESYNC, got_next_expected
+from landscape.lib.versioning import is_version_higher, sort_versions
 
 
 class MessageExchange:
@@ -422,6 +416,7 @@ class MessageExchange:
         self._exchange_store = exchange_store
         self._stopped = False
         self._backoff_counter = ExponentialBackoff(300, 7200)  # 5 to 120 min
+        self._exchange_state = {}
 
         self.register_message("accepted-types", self._handle_accepted_types)
         self.register_message("resynchronize", self._handle_resynchronize)
@@ -441,8 +436,7 @@ class MessageExchange:
         context = self._exchange_store.get_message_context(operation_id)
         if context is None:
             logging.warning(
-                "No message context for message with "
-                f"operation-id: {operation_id}",
+                f"No message context for message with operation-id: {operation_id}",
             )
             return False
 
@@ -551,8 +545,7 @@ class MessageExchange:
         if "exchange" in message:
             self._config.exchange_interval = message["exchange"]
             logging.info(
-                "Exchange interval set "
-                f"to {self._config.exchange_interval:d} seconds.",
+                f"Exchange interval set to {self._config.exchange_interval:d} seconds.",
             )
         if "urgent-exchange" in message:
             self._config.urgent_exchange_interval = message["urgent-exchange"]
@@ -585,8 +578,7 @@ class MessageExchange:
         start_time = time.time()
         if self._urgent_exchange:
             logging.info(
-                "Starting urgent message exchange "
-                f"with {self._transport.get_url()}.",
+                f"Starting urgent message exchange with {self._transport.get_url()}.",
             )
         else:
             logging.info(
@@ -694,10 +686,7 @@ class MessageExchange:
         # It's a bit tricky to test as it is preventing rehooking 'exchange'
         # while there's a background thread doing the exchange itself.
         if not self._exchanging and (
-            force
-            or self._exchange_id is None
-            or urgent
-            and not self._urgent_exchange
+            force or self._exchange_id is None or urgent and not self._urgent_exchange
         ):
             if urgent:
                 self._urgent_exchange = True
@@ -711,8 +700,7 @@ class MessageExchange:
             backoff_delay = self._backoff_counter.get_random_delay()
             if backoff_delay:
                 logging.warning(
-                    "Server is busy. Backing off client for {} "
-                    "seconds".format(backoff_delay),
+                    f"Server is busy. Backing off client for {backoff_delay} seconds",
                 )
                 interval += backoff_delay
 
@@ -777,6 +765,24 @@ class MessageExchange:
                 i = None
             if i is not None:
                 del messages[i:]
+
+            for message in messages:
+                if message.get("type") == "fde-recovery-key" and message["successful"]:
+                    if "recovery-key" in self._exchange_state:
+                        message["recovery-key"] = self._exchange_state["recovery-key"]
+                        logging.info(
+                            "Added the recovery key to the FDE recovery key message."
+                        )
+                    else:
+                        message["successful"] = False
+                        message["result-text"] = (
+                            "Landscape Client could not send the recovery key."
+                            "Please regenerate it."
+                        )
+                        logging.info(
+                            "Could not add the recovery key to the FDE recovery key"
+                            "message."
+                        )
         else:
             server_api = store.get_server_api()
         payload = {
@@ -859,7 +865,7 @@ class MessageExchange:
         # be 3.2, because it's the one that didn't have this field.
         server_api = result.get("server-api", b"3.2")
 
-        if _PY3 and not isinstance(server_api, bytes):
+        if not isinstance(server_api, bytes):
             # The "server-api" field in the bpickle payload sent by the server
             # is a string, however in Python 3 we need to convert it to bytes,
             # since that's what the rest of the code expects.
@@ -890,7 +896,11 @@ class MessageExchange:
             message_store.commit()
 
         if message_store.get_pending_messages(1):
-            logging.info("Pending messages remain after the last exchange.")
+            count = message_store.count_pending_messages()
+            logging.info(
+                "Pending messages remaining after the last exchange: %d",
+                count,
+            )
             # Either the server asked us for old messages, or we
             # otherwise have more messages even after transferring
             # what we could.
@@ -939,6 +949,9 @@ class MessageExchange:
     def get_client_accepted_message_types(self):
         return sorted(self._client_accepted_types)
 
+    def update_exchange_state(self, key: str, value: str):
+        self._exchange_state[key] = value
+
 
 def get_accepted_types_diff(old_types, new_types):
     old_types = set(old_types)
@@ -955,6 +968,6 @@ def get_accepted_types_diff(old_types, new_types):
 
 def maybe_bytes(thing):
     """Return a py3 ascii string from maybe py2 bytes."""
-    if _PY3 and isinstance(thing, bytes):
+    if isinstance(thing, bytes):
         return thing.decode("ascii")
     return thing
diff --git a/landscape/client/broker/exchangestore.py b/landscape/client/broker/exchangestore.py
index 4fb855a..20ac6d6 100644
--- a/landscape/client/broker/exchangestore.py
+++ b/landscape/client/broker/exchangestore.py
@@ -1,4 +1,5 @@
 """Provide access to the persistent data used by the L{MessageExchange}."""
+
 import time
 
 try:
diff --git a/landscape/client/broker/ping.py b/landscape/client/broker/ping.py
index e96ab7d..9129b05 100644
--- a/landscape/client/broker/ping.py
+++ b/landscape/client/broker/ping.py
@@ -33,15 +33,15 @@ Diagram::
 
 """
 
+from logging import info
+
 try:
     from urllib.parse import urlencode
 except ImportError:
     from urllib import urlencode
 
-from logging import info
-
-from twisted.python.failure import Failure
 from twisted.internet import defer
+from twisted.python.failure import Failure
 
 from landscape.lib import bpickle
 from landscape.lib.fetch import fetch
@@ -158,8 +158,7 @@ class Pinger:
     def _got_result(self, exchange):
         if exchange:
             info(
-                "Ping indicates message available. "
-                "Scheduling an urgent exchange.",
+                "Ping indicates message available. Scheduling an urgent exchange.",
             )
             self._exchanger.schedule_exchange(urgent=True)
 
@@ -181,8 +180,7 @@ class Pinger:
             self._config.ping_interval = message["ping"]
             self._config.write()
             info(
-                f"Ping interval set to {self._config.ping_interval:d} "
-                "seconds.",
+                f"Ping interval set to {self._config.ping_interval:d} seconds.",
             )
         if self._call_id is not None:
             self._reactor.cancel_call(self._call_id)
diff --git a/landscape/client/broker/registration.py b/landscape/client/broker/registration.py
index 3d76edc..78fe293 100644
--- a/landscape/client/broker/registration.py
+++ b/landscape/client/broker/registration.py
@@ -8,6 +8,7 @@ the machinery in this module will notice that we have no identification
 credentials yet and that the server accepts registration messages, so it
 will craft an appropriate one and send it out.
 """
+
 import json
 import logging
 
@@ -19,8 +20,7 @@ from landscape.lib.juju import get_juju_info
 from landscape.lib.network import get_fqdn
 from landscape.lib.tag import is_valid_tag_list
 from landscape.lib.versioning import is_version_higher
-from landscape.lib.vm_info import get_container_info
-from landscape.lib.vm_info import get_vm_info
+from landscape.lib.vm_info import get_container_info, get_vm_info
 
 
 class RegistrationError(Exception):
@@ -80,6 +80,7 @@ class Identity:
     access_group = config_property("access_group")
     hostagent_uid = config_property("hostagent_uid")
     installation_request_id = config_property("installation_request_id")
+    authenticated_attach_code = config_property("authenticated_attach_code")
 
     def __init__(self, config, persist):
         self._config = config
@@ -97,7 +98,7 @@ class RegistrationHandler:
     def __init__(
         self,
         config,
-        identity,
+        identity: Identity,
         reactor,
         exchange,
         pinger,
@@ -196,6 +197,7 @@ class RegistrationHandler:
         registration_key = identity.registration_key
         hostagent_uid = identity.hostagent_uid
         installation_request_id = identity.installation_request_id
+        authenticated_attach_code = identity.authenticated_attach_code
 
         self._message_store.delete_all_messages()
 
@@ -227,6 +229,8 @@ class RegistrationHandler:
             message["hostagent_uid"] = hostagent_uid
         if installation_request_id:
             message["installation_request_id"] = installation_request_id
+        if authenticated_attach_code:
+            message["authenticated_attach_code"] = authenticated_attach_code
 
         server_api = self._message_store.get_server_api()
         # If we have juju data to send and if the server is recent enough to
@@ -288,8 +292,7 @@ class RegistrationHandler:
         clone = message.get("clone-of")
         if clone is None:
             logging.info(
-                "Client has unknown secure-id for account "
-                f"{cid.account_name}.",
+                f"Client has unknown secure-id for account {cid.account_name}.",
             )
         else:  # Save the secure id as the clone, and clear it so it's renewed
             logging.info(f"Client is clone of computer {clone}")
diff --git a/landscape/client/broker/server.py b/landscape/client/broker/server.py
index db0e7f6..cb1bcb7 100644
--- a/landscape/client/broker/server.py
+++ b/landscape/client/broker/server.py
@@ -42,13 +42,13 @@ Diagram::
                                                       : exchange
 
 """
+
 import logging
 
 from twisted.internet.defer import Deferred
 
 from landscape.client.amp import remote
 from landscape.client.manager.manager import FAILED
-from landscape.lib.compat import _PY3
 from landscape.lib.twisted_util import gather_results
 
 
@@ -202,7 +202,7 @@ class BrokerServer:
             during the next regularly scheduled exchange.
         @return: The message identifier created when queuing C{message}.
         """
-        if b"type" in message and _PY3:
+        if b"type" in message:
             # XXX We are getting called by a python2 process.
             # This occurs in the the specific case of a landscape-driven
             # release upgrade to bionic, where the upgrading process is still
@@ -384,19 +384,16 @@ class BrokerServer:
             and opid is not None
             and message["type"] != "resynchronize"
         ):
-
             mtype = message["type"]
             logging.error(f"Nobody handled the {mtype} message.")
 
-            result_text = """\
-Landscape client failed to handle this request ({}) because the
+            result_text = f"""\
+Landscape client failed to handle this request ({mtype}) because the
 plugin which should handle it isn't available.  This could mean that the
 plugin has been intentionally disabled, or that the client isn't running
 properly, or you may be running an older version of the client that doesn't
 support this feature.
-""".format(
-                mtype,
-            )
+"""
             response = {
                 "type": "operation-result",
                 "status": FAILED,
@@ -421,3 +418,8 @@ support this feature.
         """
         self._exchanger.stop()
         self._pinger.stop()
+
+    @remote
+    def update_exchange_state(self, key: str, value: str):
+        """Update the exchanger state for in-memory-only data."""
+        self._exchanger.update_exchange_state(key, value)
diff --git a/landscape/client/broker/service.py b/landscape/client/broker/service.py
index 9c86267..9c6a5de 100644
--- a/landscape/client/broker/service.py
+++ b/landscape/client/broker/service.py
@@ -1,4 +1,5 @@
 """Deployment code for the monitor."""
+
 import os
 
 from landscape.client.amp import ComponentPublisher
@@ -6,13 +7,11 @@ from landscape.client.broker.config import BrokerConfiguration
 from landscape.client.broker.exchange import MessageExchange
 from landscape.client.broker.exchangestore import ExchangeStore
 from landscape.client.broker.ping import Pinger
-from landscape.client.broker.registration import Identity
-from landscape.client.broker.registration import RegistrationHandler
+from landscape.client.broker.registration import Identity, RegistrationHandler
 from landscape.client.broker.server import BrokerServer
 from landscape.client.broker.store import get_default_message_store
 from landscape.client.broker.transport import HTTPTransport
-from landscape.client.service import LandscapeService
-from landscape.client.service import run_landscape_service
+from landscape.client.service import LandscapeService, run_landscape_service
 from landscape.client.watchdog import bootstrap_list
 
 
diff --git a/landscape/client/broker/store.py b/landscape/client/broker/store.py
index ede2514..b56d2dc 100644
--- a/landscape/client/broker/store.py
+++ b/landscape/client/broker/store.py
@@ -91,6 +91,7 @@ See L{MessageStore} for details about how messages are stored on the file
 system and L{landscape.lib.message.got_next_expected} to check how the
 strategy for updating the pending offset and the sequence is implemented.
 """
+
 import itertools
 import logging
 import os
@@ -98,15 +99,10 @@ import shutil
 import traceback
 import uuid
 
-from twisted.python.compat import iteritems
-
 from landscape import DEFAULT_SERVER_API
 from landscape.lib import bpickle
-from landscape.lib.fs import create_binary_file
-from landscape.lib.fs import read_binary_file
-from landscape.lib.versioning import is_version_higher
-from landscape.lib.versioning import sort_versions
-
+from landscape.lib.fs import create_binary_file, read_binary_file
+from landscape.lib.versioning import is_version_higher, sort_versions
 
 HELD = "h"
 BROKEN = "b"
@@ -509,9 +505,7 @@ class MessageStore:
 
     def _get_sorted_filenames(self, dir=""):
         message_files = [
-            x
-            for x in os.listdir(self._message_dir(dir))
-            if not x.endswith(".tmp")
+            x for x in os.listdir(self._message_dir(dir)) if not x.endswith(".tmp")
         ]
         message_files.sort(key=lambda x: int(x.split("_")[0]))
         return message_files
@@ -578,7 +572,7 @@ class MessageStore:
             information, limited by scope.
         """
         session_ids = self._persist.get("session-ids", {})
-        for session_id, stored_scope in iteritems(session_ids):
+        for session_id, stored_scope in session_ids.items():
             # This loop should be relatively short as it's intent is to limit
             # session-ids to one per scope.  The or condition here is not
             # strictly necessary, but we *should* do "is" comparisons when we
@@ -602,7 +596,7 @@ class MessageStore:
         new_session_ids = {}
         if scopes:
             session_ids = self._persist.get("session-ids", {})
-            for session_id, session_scope in iteritems(session_ids):
+            for session_id, session_scope in session_ids.items():
                 if session_scope not in scopes:
                     new_session_ids[session_id] = session_scope
         self._persist.set("session-ids", new_session_ids)
diff --git a/landscape/client/broker/tests/helpers.py b/landscape/client/broker/tests/helpers.py
index 2ce52b0..16aee04 100644
--- a/landscape/client/broker/tests/helpers.py
+++ b/landscape/client/broker/tests/helpers.py
@@ -5,6 +5,7 @@ dependencies. The lowest-level component is a L{BrokerConfiguration} instance,
 the highest-level ones are a full L{BrokerServer} exposed over AMP and
 connected to remote test L{BrokerClient}.
 """
+
 import os
 
 from landscape.client.amp import ComponentPublisher
@@ -14,8 +15,7 @@ from landscape.client.broker.config import BrokerConfiguration
 from landscape.client.broker.exchange import MessageExchange
 from landscape.client.broker.exchangestore import ExchangeStore
 from landscape.client.broker.ping import Pinger
-from landscape.client.broker.registration import Identity
-from landscape.client.broker.registration import RegistrationHandler
+from landscape.client.broker.registration import Identity, RegistrationHandler
 from landscape.client.broker.server import BrokerServer
 from landscape.client.broker.store import get_default_message_store
 from landscape.client.broker.transport import FakeTransport
diff --git a/landscape/client/broker/tests/test_amp.py b/landscape/client/broker/tests/test_amp.py
index bc992b4..766b38d 100644
--- a/landscape/client/broker/tests/test_amp.py
+++ b/landscape/client/broker/tests/test_amp.py
@@ -1,14 +1,11 @@
 from unittest import mock
 
-from landscape.client.broker.tests.helpers import RemoteBrokerHelper
-from landscape.client.broker.tests.helpers import RemoteClientHelper
-from landscape.client.tests.helpers import DEFAULT_ACCEPTED_TYPES
-from landscape.client.tests.helpers import LandscapeTest
+from landscape.client.broker.tests.helpers import RemoteBrokerHelper, RemoteClientHelper
+from landscape.client.tests.helpers import DEFAULT_ACCEPTED_TYPES, LandscapeTest
 from landscape.lib.amp import MethodCallError
 
 
 class RemoteBrokerTest(LandscapeTest):
-
     helpers = [RemoteBrokerHelper]
 
     def test_ping(self):
@@ -216,7 +213,6 @@ class RemoteBrokerTest(LandscapeTest):
 
 
 class RemoteClientTest(LandscapeTest):
-
     helpers = [RemoteClientHelper]
 
     def test_ping(self):
diff --git a/landscape/client/broker/tests/test_client.py b/landscape/client/broker/tests/test_client.py
index 219cc0c..8ae8d14 100644
--- a/landscape/client/broker/tests/test_client.py
+++ b/landscape/client/broker/tests/test_client.py
@@ -3,16 +3,13 @@ from unittest import mock
 from twisted.internet import reactor
 from twisted.internet.defer import Deferred
 
-from landscape.client.broker.client import BrokerClientPlugin
-from landscape.client.broker.client import HandlerNotFoundError
+from landscape.client.broker.client import BrokerClientPlugin, HandlerNotFoundError
 from landscape.client.broker.tests.helpers import BrokerClientHelper
-from landscape.client.tests.helpers import DEFAULT_ACCEPTED_TYPES
-from landscape.client.tests.helpers import LandscapeTest
+from landscape.client.tests.helpers import DEFAULT_ACCEPTED_TYPES, LandscapeTest
 from landscape.lib.twisted_util import gather_results
 
 
 class BrokerClientTest(LandscapeTest):
-
     helpers = [BrokerClientHelper]
 
     def test_ping(self):
@@ -166,7 +163,7 @@ class BrokerClientTest(LandscapeTest):
 
         # At this point the plugin has already run once and has scheduled as
         # second run in plugin.run_interval seconds.
-        self.assertEquals(runs, [True])
+        self.assertEqual(runs, [True])
 
         # Mock out get_session_id so that it doesn't complete synchronously
         deferred = Deferred()
@@ -176,11 +173,11 @@ class BrokerClientTest(LandscapeTest):
         # The scheduled run has been cancelled, and even if plugin.run_interval
         # seconds elapse the plugin won't run again.
         self.client_reactor.advance(plugin.run_interval)
-        self.assertEquals(runs, [True])
+        self.assertEqual(runs, [True])
 
         # Finally get_session_id completes and the plugin runs again.
         deferred.callback(123)
-        self.assertEquals(runs, [True, True])
+        self.assertEqual(runs, [True, True])
 
     @mock.patch("random.random")
     def test_run_interval_staggered(self, mock_random):
@@ -238,7 +235,7 @@ class BrokerClientTest(LandscapeTest):
         handle_message = mock.Mock(return_value=123)
 
         def dispatch_message(result):
-            self.assertEqual(self.client.dispatch_message(message), 123)
+            self.assertEqual(self.client.dispatch_message(message).result, 123)
             handle_message.assert_called_once_with(message)
 
         result = self.client.register_message("foo", handle_message)
@@ -254,16 +251,18 @@ class BrokerClientTest(LandscapeTest):
 
         self.log_helper.ignore_errors("Error running message handler.*")
 
-        def dispatch_message(result):
-            self.assertIs(self.client.dispatch_message(message), None)
+        def check(_):
             self.assertTrue(
                 "Error running message handler for type 'foo'"
                 in self.logfile.getvalue(),
             )
             handle_message.assert_called_once_with(message)
 
-        result = self.client.register_message("foo", handle_message)
-        return result.addCallback(dispatch_message)
+        return (
+            self.client.register_message("foo", handle_message)
+            .addCallback(lambda _: self.client.dispatch_message(message))
+            .addCallback(check)
+        )
 
     def test_dispatch_message_with_no_handler(self):
         """
diff --git a/landscape/client/broker/tests/test_config.py b/landscape/client/broker/tests/test_config.py
index e4d2656..f73a58e 100644
--- a/landscape/client/broker/tests/test_config.py
+++ b/landscape/client/broker/tests/test_config.py
@@ -6,7 +6,6 @@ from landscape.lib.testing import EnvironSaverHelper
 
 
 class ConfigurationTests(LandscapeTest):
-
     helpers = [EnvironSaverHelper]
 
     def test_loading_sets_http_proxies(self):
@@ -188,3 +187,32 @@ class ConfigurationTests(LandscapeTest):
         configuration.load(["--config", filename, "--url", "whatever"])
 
         self.assertIsNone(configuration.installation_request_id)
+
+    def test_authenticated_attach_code_handling(self):
+        """
+        The 'authenticated_attach_code' value specified in the configuration
+        file is passed through.
+        """
+        filename = self.makeFile(
+            "[client]\nauthenticated_attach_code = asdfqwerty1234supersecret",
+        )
+
+        configuration = BrokerConfiguration()
+        configuration.load(["--config", filename, "--url", "whatever"])
+
+        self.assertEqual(
+            configuration.authenticated_attach_code,
+            "asdfqwerty1234supersecret",
+        )
+
+    def test_missing_authenticated_attach_code_is_none(self):
+        """
+        Test that if we don't explicitly pass a authenticated_attach_code,
+        then this value is None.
+        """
+        filename = self.makeFile("[client]\n")
+
+        configuration = BrokerConfiguration()
+        configuration.load(["--config", filename, "--url", "whatever"])
+
+        self.assertIsNone(configuration.authenticated_attach_code)
diff --git a/landscape/client/broker/tests/test_exchange.py b/landscape/client/broker/tests/test_exchange.py
index dd396c3..9b33b7b 100644
--- a/landscape/client/broker/tests/test_exchange.py
+++ b/landscape/client/broker/tests/test_exchange.py
@@ -2,26 +2,23 @@ from unittest import mock
 
 from landscape import CLIENT_API
 from landscape.client.broker.config import BrokerConfiguration
-from landscape.client.broker.exchange import get_accepted_types_diff
-from landscape.client.broker.exchange import MessageExchange
+from landscape.client.broker.exchange import MessageExchange, get_accepted_types_diff
 from landscape.client.broker.ping import Pinger
 from landscape.client.broker.registration import RegistrationHandler
 from landscape.client.broker.server import BrokerServer
 from landscape.client.broker.store import MessageStore
 from landscape.client.broker.tests.helpers import ExchangeHelper
 from landscape.client.broker.transport import FakeTransport
-from landscape.client.tests.helpers import DEFAULT_ACCEPTED_TYPES
-from landscape.client.tests.helpers import LandscapeTest
-from landscape.lib.fetch import HTTPCodeError
-from landscape.lib.fetch import PyCurlError
+from landscape.client.tests.helpers import DEFAULT_ACCEPTED_TYPES, LandscapeTest
+from landscape.lib.fetch import HTTPCodeError, PyCurlError
 from landscape.lib.hashlib import md5
 from landscape.lib.persist import Persist
 from landscape.lib.schema import Int
 from landscape.message_schemas.message import Message
+from landscape.message_schemas.server_bound import FDE_RECOVERY_KEY
 
 
 class MessageExchangeTest(LandscapeTest):
-
     helpers = [ExchangeHelper]
 
     def setUp(self):
@@ -625,6 +622,33 @@ class MessageExchangeTest(LandscapeTest):
             ],
         )
 
+    def test_count_pending_messages(self):
+        """
+        The number of pending messages is logged.
+        """
+        self.mstore.set_accepted_types(["empty", "resynchronize"])
+
+        def resynchronized(scopes=None):
+            self.mstore.add({"type": "empty"})
+
+        self.reactor.call_on("resynchronize-clients", resynchronized)
+
+        self.transport.responses.append(
+            [{"type": "resynchronize", "operation-id": 123}],
+        )
+        self.exchanger.exchange()
+        self.assertMessages(
+            self.mstore.get_pending_messages(),
+            [
+                {"type": "resynchronize", "operation-id": 123},
+                {"type": "empty"},
+            ],
+        )
+        self.assertIn(
+            "INFO: Pending messages remaining after the last exchange: 2",
+            self.logfile.getvalue(),
+        )
+
     def test_scopes_are_copied_from_incoming_resynchronize_messages(self):
         """
         If an incoming message of type 'reysnchronize' contains a 'scopes' key,
@@ -754,6 +778,93 @@ class MessageExchangeTest(LandscapeTest):
         self.assertEqual(payload.get("server-api"), b"1.1")
         self.assertEqual(self.transport.message_api, b"1.1")
 
+    def test_fde_recovery_key_payload_with_recovery_key(self):
+        """
+        When sending a recovery key message to server, the exchanger should
+        add the recovery key from the in-memory exchange state to the message.
+        """
+        self.exchanger.update_exchange_state("recovery-key", "mykey")
+        self.mstore.set_accepted_types([FDE_RECOVERY_KEY.type])
+        self.mstore.add_schema(FDE_RECOVERY_KEY)
+
+        self.mstore.add(
+            {"type": FDE_RECOVERY_KEY.type, "operation-id": 1, "successful": True}
+        )
+        self.exchanger.exchange()
+        payload = self.transport.payloads[0]
+        self.assertMessages(
+            payload["messages"],
+            [
+                {
+                    "type": "fde-recovery-key",
+                    "operation-id": 1,
+                    "successful": True,
+                    "recovery-key": "mykey",
+                    "api": b"3.2",
+                }
+            ],
+        )
+
+    def test_fde_recovery_key_payload_without_recovery_key(self):
+        """
+        When sending a recovery key message to server, if the in-memory exchange
+        state does not have the recovery key, the exchanger should update the message.
+        """
+        self.mstore.set_accepted_types([FDE_RECOVERY_KEY.type])
+        self.mstore.add_schema(FDE_RECOVERY_KEY)
+
+        self.mstore.add(
+            {"type": FDE_RECOVERY_KEY.type, "operation-id": 1, "successful": True}
+        )
+        self.exchanger.exchange()
+
+        payload = self.transport.payloads[0]
+        self.assertMessages(
+            payload["messages"],
+            [
+                {
+                    "type": "fde-recovery-key",
+                    "operation-id": 1,
+                    "successful": False,
+                    "result-text": "Landscape Client could not send the recovery key."
+                    "Please regenerate it.",
+                    "api": b"3.2",
+                }
+            ],
+        )
+
+    def test_fde_recovery_key_payload_with_failure(self):
+        """
+        When sending a recovery key message to server, if the attempt to update
+        the recovery key failed, the exchanger should not update the message.
+        """
+        self.mstore.set_accepted_types([FDE_RECOVERY_KEY.type])
+        self.mstore.add_schema(FDE_RECOVERY_KEY)
+
+        self.mstore.add(
+            {
+                "type": FDE_RECOVERY_KEY.type,
+                "operation-id": 1,
+                "successful": False,
+                "result-text": "Some Failure",
+            }
+        )
+        self.exchanger.exchange()
+
+        payload = self.transport.payloads[0]
+        self.assertMessages(
+            payload["messages"],
+            [
+                {
+                    "type": "fde-recovery-key",
+                    "operation-id": 1,
+                    "successful": False,
+                    "result-text": "Some Failure",
+                    "api": b"3.2",
+                }
+            ],
+        )
+
     def test_exchange_token(self):
         """
         When sending messages to the server, the exchanger provides the
@@ -1381,7 +1492,6 @@ class MessageExchangeTest(LandscapeTest):
 
 
 class AcceptedTypesMessageExchangeTest(LandscapeTest):
-
     helpers = [ExchangeHelper]
 
     def setUp(self):
@@ -1428,9 +1538,7 @@ class AcceptedTypesMessageExchangeTest(LandscapeTest):
         self.exchanger.register_client_accepted_message_type("type-B")
         types = sorted(["type-A", "type-B"] + DEFAULT_ACCEPTED_TYPES)
         accepted_types_digest = md5(";".join(types).encode("ascii")).digest()
-        self.transport.extra[
-            "client-accepted-types-hash"
-        ] = accepted_types_digest
+        self.transport.extra["client-accepted-types-hash"] = accepted_types_digest
         self.exchanger.exchange()
         self.exchanger.exchange()
         self.assertNotIn("client-accepted-types", self.transport.payloads[1])
diff --git a/landscape/client/broker/tests/test_exchangestore.py b/landscape/client/broker/tests/test_exchangestore.py
index 76a7d9f..8dd56b4 100644
--- a/landscape/client/broker/tests/test_exchangestore.py
+++ b/landscape/client/broker/tests/test_exchangestore.py
@@ -5,9 +5,8 @@ try:
 except ImportError:
     from pysqlite2 import dbapi2 as sqlite3
 
-from landscape.client.tests.helpers import LandscapeTest
-
 from landscape.client.broker.exchangestore import ExchangeStore
+from landscape.client.tests.helpers import LandscapeTest
 
 
 class ExchangeStoreTest(LandscapeTest):
diff --git a/landscape/client/broker/tests/test_ping.py b/landscape/client/broker/tests/test_ping.py
index fe08dee..d9ec90e 100644
--- a/landscape/client/broker/tests/test_ping.py
+++ b/landscape/client/broker/tests/test_ping.py
@@ -1,7 +1,6 @@
 from twisted.internet.defer import fail
 
-from landscape.client.broker.ping import PingClient
-from landscape.client.broker.ping import Pinger
+from landscape.client.broker.ping import PingClient, Pinger
 from landscape.client.broker.tests.helpers import ExchangeHelper
 from landscape.client.tests.helpers import LandscapeTest
 from landscape.lib import bpickle
@@ -114,7 +113,6 @@ class PingClientTest(LandscapeTest):
 
 
 class PingerTest(LandscapeTest):
-
     helpers = [ExchangeHelper]
 
     # Tell the Plugin helper to not add a MessageExchange plugin, to interfere
diff --git a/landscape/client/broker/tests/test_registration.py b/landscape/client/broker/tests/test_registration.py
index 06b312b..48b75fd 100644
--- a/landscape/client/broker/tests/test_registration.py
+++ b/landscape/client/broker/tests/test_registration.py
@@ -3,17 +3,16 @@ import logging
 import socket
 from unittest import mock
 
-from landscape.client.broker.registration import Identity
-from landscape.client.broker.registration import RegistrationError
-from landscape.client.broker.tests.helpers import BrokerConfigurationHelper
-from landscape.client.broker.tests.helpers import RegistrationHelper
+from landscape.client.broker.registration import Identity, RegistrationError
+from landscape.client.broker.tests.helpers import (
+    BrokerConfigurationHelper,
+    RegistrationHelper,
+)
 from landscape.client.tests.helpers import LandscapeTest
-from landscape.lib.compat import _PY3
 from landscape.lib.persist import Persist
 
 
 class IdentityTest(LandscapeTest):
-
     helpers = [BrokerConfigurationHelper]
 
     def setUp(self):
@@ -83,7 +82,6 @@ class IdentityTest(LandscapeTest):
 
 
 class RegistrationHandlerTestBase(LandscapeTest):
-
     helpers = [RegistrationHelper]
 
     def setUp(self):
@@ -328,14 +326,8 @@ class RegistrationHandlerTest(RegistrationHandlerTestBase):
         self.assertEqual(expected, messages[0]["tags"])
 
         logs = self.logfile.getvalue().strip()
-        # XXX This is not nice, as it has the origin in a non-consistent way of
-        # using logging. self.logfile is a cStringIO in Python 2 and
-        # io.StringIO in Python 3. This results in reading bytes in Python 2
-        # and unicode in Python 3, but a drop-in replacement of cStringIO with
-        # io.StringIO in Python 2 is not working. However, we compare bytes
-        # here, to circumvent that problem.
-        if _PY3:
-            logs = logs.encode("utf-8")
+        logs = logs.encode("utf-8")
+
         self.assertEqual(
             logs,
             b"INFO: Queueing message to register with account "
@@ -468,6 +460,47 @@ class RegistrationHandlerTest(RegistrationHandlerTestBase):
         messages = self.mstore.get_pending_messages()
         self.assertNotIn("installation_request_id", messages[0])
 
+    def test_queue_message_on_exchange_with_authenticated_attach_code(self):
+        """
+        If the admin has defined a authenticated_attach_code for this
+        computer, we send it to the server.
+        """
+        self.mstore.set_accepted_types(["register"])
+        self.mstore.set_server_api(b"3.3")
+        self.config.account_name = "account_name"
+        self.config.authenticated_attach_code = "hushhushsupersecretcode"
+        self.config.tags = "server,london"
+        self.reactor.fire("pre-exchange")
+        messages = self.mstore.get_pending_messages()
+        self.assertEqual(
+            "hushhushsupersecretcode",
+            messages[0]["authenticated_attach_code"],
+        )
+
+    def test_queue_message_on_exchange_empty_authenticated_attach_code(self):
+        """
+        If the authenticated_attach_code is "", then the outgoing message
+        does not define an "authenticated_attach_code" key.
+        """
+        self.mstore.set_accepted_types(["register"])
+        self.mstore.set_server_api(b"3.3")
+        self.config.authenticated_attach_code = ""
+        self.reactor.fire("pre-exchange")
+        messages = self.mstore.get_pending_messages()
+        self.assertNotIn("authenticated_attach_code", messages[0])
+
+    def test_queue_message_on_exchange_none_authenticated_attach_code(self):
+        """
+        If the authenticated_attach_code is None, then the outgoing message
+        does not define an "authenticated_attach_code" key.
+        """
+        self.mstore.set_accepted_types(["register"])
+        self.mstore.set_server_api(b"3.3")
+        self.config.authenticated_attach_code = None
+        self.reactor.fire("pre-exchange")
+        messages = self.mstore.get_pending_messages()
+        self.assertNotIn("authenticated_attach_code", messages[0])
+
     def test_queueing_registration_message_resets_message_store(self):
         """
         When a registration message is queued, the store is reset
@@ -736,7 +769,6 @@ class RegistrationHandlerTest(RegistrationHandlerTestBase):
 
 
 class JujuRegistrationHandlerTest(RegistrationHandlerTestBase):
-
     juju_contents = json.dumps(
         {
             "environment-uuid": "DEAD-BEEF",
diff --git a/landscape/client/broker/tests/test_server.py b/landscape/client/broker/tests/test_server.py
index 13461eb..9a962a5 100644
--- a/landscape/client/broker/tests/test_server.py
+++ b/landscape/client/broker/tests/test_server.py
@@ -2,15 +2,12 @@ import random
 from unittest.mock import Mock
 
 from configobj import ConfigObj
-from twisted.internet.defer import fail
-from twisted.internet.defer import succeed
+from twisted.internet.defer import fail, succeed
 
-from landscape.client.broker.tests.helpers import BrokerServerHelper
-from landscape.client.broker.tests.helpers import RemoteClientHelper
+from landscape.client.broker.tests.helpers import BrokerServerHelper, RemoteClientHelper
 from landscape.client.broker.tests.test_ping import FakePageGetter
 from landscape.client.manager.manager import FAILED
-from landscape.client.tests.helpers import DEFAULT_ACCEPTED_TYPES
-from landscape.client.tests.helpers import LandscapeTest
+from landscape.client.tests.helpers import DEFAULT_ACCEPTED_TYPES, LandscapeTest
 
 
 class FakeClient:
@@ -26,7 +23,6 @@ class FakeCreator:
 
 
 class BrokerServerTest(LandscapeTest):
-
     helpers = [BrokerServerHelper]
 
     def test_ping(self):
@@ -60,7 +56,6 @@ class BrokerServerTest(LandscapeTest):
         self.assertNotEqual(disk_session_id1, users_session_id)
 
     def test_send_message(self):
-
         """
         The L{BrokerServer.send_message} method forwards a message to the
         broker's exchanger.
@@ -447,9 +442,19 @@ class BrokerServerTest(LandscapeTest):
         self.reactor.advance(self.config.exchange_interval)
         self.assertEqual([], page_getter.fetches)
 
+    def test_update_exchange_state(self):
+        """
+        The L{BrokerServer.update_exchange_state} updates the exchanger's
+        in-memory data store.
+        """
+        self.assertEqual(self.exchanger._exchange_state, {})
+        self.broker.update_exchange_state("new_key", "new_value")
+
+        self.reactor.advance(self.config.exchange_interval)
+        self.assertEqual(self.exchanger._exchange_state["new_key"], "new_value")
 
-class EventTest(LandscapeTest):
 
+class EventTest(LandscapeTest):
     helpers = [RemoteClientHelper]
 
     def test_resynchronize(self):
@@ -558,7 +563,6 @@ class EventTest(LandscapeTest):
 
 
 class HandlersTest(LandscapeTest):
-
     helpers = [BrokerServerHelper]
 
     def setUp(self):
diff --git a/landscape/client/broker/tests/test_service.py b/landscape/client/broker/tests/test_service.py
index e99f9ac..04dfbc4 100644
--- a/landscape/client/broker/tests/test_service.py
+++ b/landscape/client/broker/tests/test_service.py
@@ -10,7 +10,6 @@ from landscape.lib.testing import FakeReactor
 
 
 class BrokerServiceTest(LandscapeTest):
-
     helpers = [BrokerConfigurationHelper]
 
     def setUp(self):
diff --git a/landscape/client/broker/tests/test_store.py b/landscape/client/broker/tests/test_store.py
index 5dd2fbb..c70fbca 100644
--- a/landscape/client/broker/tests/test_store.py
+++ b/landscape/client/broker/tests/test_store.py
@@ -1,19 +1,18 @@
 import os
 from unittest import mock
 
-from twisted.python.compat import intToBytes
-
 from landscape.client.broker.store import MessageStore
 from landscape.client.tests.helpers import LandscapeTest
 from landscape.lib.bpickle import dumps
 from landscape.lib.persist import Persist
-from landscape.lib.schema import Bytes
-from landscape.lib.schema import Int
-from landscape.lib.schema import InvalidError
-from landscape.lib.schema import Unicode
+from landscape.lib.schema import Bytes, Int, InvalidError, Unicode
 from landscape.message_schemas.message import Message
 
 
+def intToBytes(n):
+    return b"%d" % n
+
+
 class MessageStoreTest(LandscapeTest):
     def setUp(self):
         super().setUp()
@@ -194,7 +193,7 @@ class MessageStoreTest(LandscapeTest):
         If an exception occurs while deleting it shouldn't affect the next
         message sent
         """
-        rmtree_mock.side_effect = IOError("Error!")
+        rmtree_mock.side_effect = OSError("Error!")
         self.store._directory_size = 1
         self.store._max_dirs = 1
         self.store.add({"type": "data", "data": b"a"})
@@ -385,7 +384,7 @@ class MessageStoreTest(LandscapeTest):
         # writing a file.
         mock_open = mock.mock_open()
         with mock.patch("landscape.lib.fs.open", mock_open):
-            mock_open().write.side_effect = IOError("Sorry, pal!")
+            mock_open().write.side_effect = OSError("Sorry, pal!")
             # This kind of ensures that raising an exception is somewhat
             # similar to unplugging the power -- i.e., we're not relying
             # on special exception-handling in the file-writing code.
diff --git a/landscape/client/broker/tests/test_transport.py b/landscape/client/broker/tests/test_transport.py
index 3baf743..2451400 100644
--- a/landscape/client/broker/tests/test_transport.py
+++ b/landscape/client/broker/tests/test_transport.py
@@ -3,8 +3,7 @@ import os
 from twisted.internet import reactor
 from twisted.internet.ssl import DefaultOpenSSLContextFactory
 from twisted.internet.threads import deferToThread
-from twisted.web import resource
-from twisted.web import server
+from twisted.web import resource, server
 
 from landscape import VERSION
 from landscape.client.broker.transport import HTTPTransport
@@ -25,7 +24,6 @@ BADPUBKEY = sibpath("badpublic.ssl")
 
 
 class DataCollectingResource(resource.Resource):
-
     request = content = None
 
     def getChild(self, request, name):  # noqa: N802
@@ -38,7 +36,6 @@ class DataCollectingResource(resource.Resource):
 
 
 class HTTPTransportTest(LandscapeTest):
-
     helpers = [LogKeeperHelper]
 
     def setUp(self):
diff --git a/landscape/client/broker/transport.py b/landscape/client/broker/transport.py
index 05ad086..c0c5045 100644
--- a/landscape/client/broker/transport.py
+++ b/landscape/client/broker/transport.py
@@ -1,12 +1,10 @@
 """Low-level server communication."""
-from dataclasses import asdict
+
 import uuid
-from typing import Optional
-from typing import Union
+from dataclasses import asdict
 
 from landscape import SERVER_API
 from landscape.client.exchange import exchange_messages
-from landscape.lib.compat import unicode
 
 
 class HTTPTransport:
@@ -32,10 +30,10 @@ class HTTPTransport:
     def exchange(
         self,
         payload: dict,
-        computer_id: Optional[str] = None,
-        exchange_token: Optional[bytes] = None,
+        computer_id: str | None = None,
+        exchange_token: bytes | None = None,
         message_api: bytes = SERVER_API,
-    ) -> Union[dict, None]:
+    ) -> dict | None:
         """Exchange message data with the server.
 
         :param payload: The object to send. It must be `bpickle`-compatible.
@@ -65,9 +63,7 @@ class HTTPTransport:
         #  in landscape.client.broker.exchange.MessageExchange.
         return asdict(
             response,
-            dict_factory=lambda data: {
-                k.replace("_", "-"): v for k, v in data
-            },
+            dict_factory=lambda data: {k.replace("_", "-"): v for k, v in data},
         )
 
 
@@ -117,7 +113,7 @@ class FakeTransport:
 
         result = {
             "next-expected-sequence": self.next_expected_sequence,
-            "next-exchange-token": unicode(uuid.uuid4()),
+            "next-exchange-token": str(uuid.uuid4()),
             "messages": response,
         }
         result.update(self.extra)
diff --git a/landscape/client/configuration.py b/landscape/client/configuration.py
index 8d3a7ce..c82dd37 100644
--- a/landscape/client/configuration.py
+++ b/landscape/client/configuration.py
@@ -3,8 +3,11 @@
 This module, and specifically L{LandscapeSetupScript}, implements the support
 for the C{landscape-config} script.
 """
+
+import base64
 import getpass
 import io
+import json
 import logging
 import os
 import pwd
@@ -12,32 +15,27 @@ import re
 import shlex
 import sys
 import textwrap
+from argparse import SUPPRESS
 from urllib.parse import urlparse
 
-from landscape.client import GROUP
-from landscape.client import IS_SNAP
-from landscape.client import USER
+from landscape.client import GROUP, IS_SNAP, USER
 from landscape.client.broker.config import BrokerConfiguration
 from landscape.client.broker.registration import Identity
 from landscape.client.broker.service import BrokerService
-from landscape.client.registration import ClientRegistrationInfo
-from landscape.client.registration import register
-from landscape.client.registration import RegistrationException
-from landscape.client.serviceconfig import ServiceConfig
-from landscape.client.serviceconfig import ServiceConfigException
-from landscape.lib import base64
-from landscape.lib.bootstrap import BootstrapDirectory
-from landscape.lib.bootstrap import BootstrapList
-from landscape.lib.compat import input
-from landscape.lib.fetch import fetch
-from landscape.lib.fetch import FetchError
+from landscape.client.registration import (
+    ClientRegistrationInfo,
+    RegistrationException,
+    register,
+)
+from landscape.client.serviceconfig import ServiceConfig, ServiceConfigException
+from landscape.lib.bootstrap import BootstrapDirectory, BootstrapList
+from landscape.lib.fetch import FetchError, fetch
 from landscape.lib.fs import create_binary_file
 from landscape.lib.logging import init_app_logging
 from landscape.lib.network import get_fqdn
 from landscape.lib.persist import Persist
 from landscape.lib.tag import is_valid_tag
 
-
 EXIT_NOT_REGISTERED = 5
 
 
@@ -104,7 +102,7 @@ def get_invalid_users(users):
 
 
 class LandscapeSetupConfiguration(BrokerConfiguration):
-
+    # Whether or not config option will be written back to config file
     unsaved_options = (
         "no_start",
         "disable",
@@ -114,6 +112,34 @@ class LandscapeSetupConfiguration(BrokerConfiguration):
         "skip_registration",
         "force_registration",
         "register_if_needed",
+        "is_registered",
+        "actively_registered",
+        "registration_sent",
+        "show",
+        "show_json",
+    )
+
+    # Whether or not config option will be shown in config dumps
+    hidden_options = (
+        "no_start",
+        "disable",
+        "silent",
+        "ok_no_register",
+        "import_from",
+        "skip_registration",
+        "force_registration",
+        "register_if_needed",
+        "clones",
+        "start_clones_over",
+        "hostagent_uid",
+        "installation_request_id",
+        "authenticated_attach_code",
+        "init",
+        "is_registered",
+        "actively_registered",
+        "registration_sent",
+        "show",
+        "show_json",
     )
 
     encoding = "utf-8"
@@ -152,8 +178,7 @@ class LandscapeSetupConfiguration(BrokerConfiguration):
                         )
                     except Exception:
                         raise ImportOptionError(
-                            "Couldn't read configuration "
-                            f"from {self.import_from}.",
+                            f"Couldn't read configuration from {self.import_from}.",
                         )
             except Exception as error:
                 raise ImportOptionError(str(error))
@@ -230,8 +255,7 @@ class LandscapeSetupConfiguration(BrokerConfiguration):
         parser.add_argument(
             "--ok-no-register",
             action="store_true",
-            help="Return exit code 0 instead of 2 if the client "
-            "can't be registered.",
+            help="Return exit code 0 instead of 2 if the client can't be registered.",
         )
         parser.add_argument(
             "--silent",
@@ -255,8 +279,8 @@ class LandscapeSetupConfiguration(BrokerConfiguration):
             "--is-registered",
             action="store_true",
             help="Exit with code 0 (success) if client is "
-            "registered else returns {}. Displays "
-            "registration info.".format(EXIT_NOT_REGISTERED),
+            f"registered else returns {EXIT_NOT_REGISTERED}. Displays "
+            "registration info.",
         )
         parser.add_argument(
             "--skip-registration",
@@ -271,23 +295,31 @@ class LandscapeSetupConfiguration(BrokerConfiguration):
         parser.add_argument(
             "--register-if-needed",
             action="store_true",
-            help=(
-                "Send a new registration request only if one has not been sent"
-            ),
+            help=("Send a new registration request only if one has not been sent"),
         )
         parser.add_argument(
             "--actively-registered",
             action="store_true",
             help="Exit with code 0 (success) if client is "
-            "registered else returns {}. Displays "
-            "registration info.".format(EXIT_NOT_REGISTERED),
+            f"registered else returns {EXIT_NOT_REGISTERED}. Displays "
+            "registration info.",
         )
         parser.add_argument(
             "--registration-sent",
             action="store_true",
             help="Exit with code 0 (success) if client is "
-            "registered else returns {}. Displays "
-            "registration info.".format(EXIT_NOT_REGISTERED),
+            f"registered else returns {EXIT_NOT_REGISTERED}. Displays "
+            "registration info.",
+        )
+        parser.add_argument(
+            "--show",
+            action="store_true",
+            help="Outputs all configuration data as plain text.",
+        )
+        parser.add_argument(
+            "--show-json",
+            action="store_true",
+            help="Outputs all configuration data as JSON.",
         )
         return parser
 
@@ -468,8 +500,7 @@ class LandscapeSetupScript:
             return  # an access group is already provided, don't ask for one
 
         show_help(
-            "You may provide an access group for this computer "
-            "e.g. webservers.",
+            "You may provide an access group for this computer e.g. webservers.",
         )
         self.prompt("access_group", "Access group", False)
 
@@ -497,8 +528,7 @@ class LandscapeSetupScript:
 
     def query_landscape_edition(self):
         show_help(
-            "Manage this machine with Landscape "
-            "(https://ubuntu.com/landscape):\n",
+            "Manage this machine with Landscape (https://ubuntu.com/landscape):\n",
         )
         options = self.config.get_command_line_options()
         if "ping_url" in options and "url" in options:
@@ -525,15 +555,12 @@ class LandscapeSetupScript:
             self.config.url = f"https://{self.landscape_domain}/message-system"
         else:
             self.landscape_domain = ""
-            self.config.ping_url = self.config._command_line_defaults[
-                "ping_url"
-            ]
+            self.config.ping_url = self.config._command_line_defaults["ping_url"]
             self.config.url = self.config._command_line_defaults["url"]
             if self.config.account_name == "standalone":
                 self.config.account_name = ""
 
     def show_summary(self):
-
         tx = f"""A summary of the provided information:
             Computer's Title: {self.config.computer_title}
             Account Name: {self.config.account_name}
@@ -665,9 +692,7 @@ def setup(config) -> Identity:
     bootstrap_tree(config)
 
     if not config.no_start:
-        if config.silent:
-            ServiceConfig.set_start_on_boot(True)
-        elif not ServiceConfig.is_configured_to_run():
+        if config.silent or not ServiceConfig.is_configured_to_run():
             ServiceConfig.set_start_on_boot(True)
 
     setup_http_proxy(config)
@@ -796,7 +821,7 @@ def registration_sent(config):
     Return whether the client has sent a registration request to the server.
     For now does same thing as is_registered as to make function name more
     clear with what is performed. This is the legacy behaviour of
-    --is-registered and the name will be changed in a future release.
+    --is-registered and the name will be removed in the 26.04 release.
     """
     persist_filename = os.path.join(
         config.data_path,
@@ -829,14 +854,10 @@ def registration_info_text(config, registration_status):
     config_path = os.path.abspath(config._config_filename)
 
     text = textwrap.dedent(
-        """
-                           Registered:    {}
-                           Config Path:   {}
-                           Data Path      {}""".format(
-            registration_status,
-            config_path,
-            config.data_path,
-        ),
+        f"""
+                           Registered:    {registration_status}
+                           Config Path:   {config_path}
+                           Data Path      {config.data_path}""",
     )
     if registration_status:
         text += f"\nAccount Name:  {config.account_name}"
@@ -844,6 +865,55 @@ def registration_info_text(config, registration_status):
     return text
 
 
+def get_configuration_dump(config):
+    """
+    Return a dict mapping all configuration options to their current value
+    """
+    conf_dump = {}
+
+    # Add option for config file separately
+    conf_dump["CONFIG_FILE"] = config._config_filename
+
+    for conf_option in config._command_line_defaults:
+        conf_value = config.get(conf_option)
+        if (
+            conf_value != SUPPRESS
+            and conf_option != "config"
+            and conf_option not in LandscapeSetupConfiguration.hidden_options
+        ):
+            conf_dump[conf_option] = conf_value
+
+    # Add config file options without a command line default
+    for conf_option in config._config_file_options:
+        if conf_option not in conf_dump:
+            conf_value = config.get(conf_option)
+            conf_dump[conf_option] = conf_value
+
+    return conf_dump
+
+
+def configuration_dump_text(config):
+    """
+    Return a mapping of all available configuration options
+    and their current values organized alphabetically in plain text
+    """
+    text = ""
+    conf_dump = get_configuration_dump(config)
+    conf_sorted = sorted(conf_dump.items())
+    for key, value in conf_sorted:
+        text += f"\n{key}: {value}"
+    return text
+
+
+def configuration_dump_json(config):
+    """
+    Return a mapping of all available configuration options
+    and their current values organized alphabetically in JSON
+    """
+    conf_dump = get_configuration_dump(config)
+    return json.dumps(conf_dump)
+
+
 def set_secure_id(config, new_id, insecure_id=None):
     """Persists a secure id in the identity data file. This is used to indicate
     whether we are currently in the process of registering.
@@ -894,14 +964,22 @@ def main(args, print=print):  # noqa: C901
 
     if config.skip_registration and config.force_registration:
         sys.exit(
-            "Do not set both skip registration "
-            "and force registration together.",
+            "Do not set both skip registration and force registration together.",
         )
 
+    if config.show:
+        conf_dump = configuration_dump_text(config)
+        print(conf_dump)
+        sys.exit(0)
+
+    if config.show_json:
+        conf_dump = configuration_dump_json(config)
+        print(conf_dump)
+        sys.exit(0)
+
     already_registered = registration_sent(config)
 
     if config.is_registered or config.registration_sent:
-
         registration_status = already_registered
 
         info_text = registration_info_text(config, registration_status)
@@ -948,9 +1026,7 @@ def main(args, print=print):  # noqa: C901
 
     should_register = False
 
-    if config.force_registration:
-        should_register = True
-    elif config.silent and not config.register_if_needed:
+    if config.force_registration or config.silent and not config.register_if_needed:
         should_register = True
     elif config.register_if_needed:
         should_register = not already_registered
diff --git a/landscape/client/deployment.py b/landscape/client/deployment.py
index e46d6f2..f91e711 100644
--- a/landscape/client/deployment.py
+++ b/landscape/client/deployment.py
@@ -4,26 +4,20 @@ import subprocess
 import sys
 import time
 from argparse import SUPPRESS
-from datetime import datetime
-from datetime import timezone
-from logging import debug
-from logging import info
-from typing import Sequence
+from collections.abc import Sequence
+from datetime import datetime, timezone
+from logging import debug, info
 
 from twisted.logger import globalLogBeginner
 
 from landscape import VERSION
-from landscape.client import DEFAULT_CONFIG
-from landscape.client import GROUP
-from landscape.client import snap_http
-from landscape.client import USER
+from landscape.client import DEFAULT_CONFIG, GROUP, USER, snap_http
 from landscape.client.snap_utils import get_snap_info
 from landscape.client.upgraders import UPGRADE_MANAGERS
 from landscape.lib import logging
 from landscape.lib.config import BaseConfiguration as _BaseConfiguration
 from landscape.lib.format import expandvars
-from landscape.lib.network import get_active_device_info
-from landscape.lib.network import get_fqdn
+from landscape.lib.network import get_active_device_info, get_fqdn
 from landscape.lib.persist import Persist
 
 
@@ -50,7 +44,6 @@ def _is_script(filename=sys.argv[0], _scriptdir=os.path.abspath("scripts")):
 
 
 class BaseConfiguration(_BaseConfiguration):
-
     version = VERSION
 
     default_config_filename = DEFAULT_CONFIG
@@ -122,7 +115,7 @@ class Configuration(BaseConfiguration):
         parser.add_argument(
             "-k",
             "--ssl-public-key",
-            help="The public SSL key to verify the server. "
+            help="The ssl-public-key is a CA certificate that verifies the server."
             "Only used if the given URL is https.",
         )
         parser.add_argument(
@@ -135,14 +128,13 @@ class Configuration(BaseConfiguration):
             "--ignore-sigusr1",
             action="store_true",
             default=False,
-            help="Ignore SIGUSR1 signal to " "rotate logs.",
+            help="Ignore SIGUSR1 signal to rotate logs.",
         )
         parser.add_argument(
             "--package-monitor-interval",
             default=30 * 60,
             type=int,
-            help="The interval between package monitor runs "
-            "(default: 1800).",
+            help="The interval between package monitor runs (default: 1800).",
         )
         parser.add_argument(
             "--apt-update-interval",
@@ -155,8 +147,7 @@ class Configuration(BaseConfiguration):
             default=5 * 60,
             type=int,
             metavar="INTERVAL",
-            help="The number of seconds between flushes to disk "
-            "for persistent data.",
+            help="The number of seconds between flushes to disk for persistent data.",
         )
         parser.add_argument(
             "--stagger-launch",
@@ -173,6 +164,13 @@ class Configuration(BaseConfiguration):
             type=int,
             help="The interval between snap monitor runs (default 1800).",
         )
+        parser.add_argument(
+            "--script-tempdir",
+            default=None,
+            type=str,
+            help="The working directory to use for script executions. "
+            "Must have read, write, and exec privileges for any script users.",
+        )
 
         # Hidden options, used for load-testing to run in-process clones
         parser.add_argument("--clones", default=0, type=int, help=SUPPRESS)
diff --git a/landscape/client/exchange.py b/landscape/client/exchange.py
index 72421d8..266a31d 100644
--- a/landscape/client/exchange.py
+++ b/landscape/client/exchange.py
@@ -1,19 +1,16 @@
 """Utility functions for exchanging messages synchronously with a Landscape
 Server instance.
 """
-from dataclasses import dataclass
+
 import logging
-from pprint import pformat
 import time
+from dataclasses import dataclass
+from pprint import pformat
 from typing import Any
-from typing import Dict
-from typing import List
-from typing import Optional
 
 import pycurl
 
-from landscape import SERVER_API
-from landscape import VERSION
+from landscape import SERVER_API, VERSION
 from landscape.lib import bpickle
 from landscape.lib.fetch import fetch
 from landscape.lib.format import format_delta
@@ -25,19 +22,19 @@ class ServerResponse:
 
     server_api: str
     server_uuid: bytes
-    messages: List[Dict[str, Any]]
-    client_accepted_types_hash: Optional[bytes] = None
-    next_exchange_token: Optional[bytes] = None
-    next_expected_sequence: Optional[int] = None
+    messages: list[dict[str, Any]]
+    client_accepted_types_hash: bytes | None = None
+    next_exchange_token: bytes | None = None
+    next_expected_sequence: int | None = None
 
 
 def exchange_messages(
     payload: dict,
     server_url: str,
     *,
-    cainfo: Optional[str] = None,
-    computer_id: Optional[str] = None,
-    exchange_token: Optional[bytes] = None,
+    cainfo: str | None = None,
+    computer_id: str | None = None,
+    exchange_token: bytes | None = None,
     server_api: str = SERVER_API.decode(),
 ) -> ServerResponse:
     """Sends `payload` via HTTP(S) to `server_url`, parsing and returning the
diff --git a/landscape/client/manager/aptsources.py b/landscape/client/manager/aptsources.py
index 179fa72..e7faaf2 100644
--- a/landscape/client/manager/aptsources.py
+++ b/landscape/client/manager/aptsources.py
@@ -8,8 +8,7 @@ import uuid
 
 from twisted.internet.defer import succeed
 
-from landscape.client import GROUP
-from landscape.client import USER
+from landscape.client import GROUP, USER
 from landscape.client.manager.plugin import ManagerPlugin
 from landscape.client.package.reporter import find_reporter_command
 from landscape.constants import FALSE_VALUES
@@ -27,6 +26,11 @@ class AptSources(ManagerPlugin):
     SOURCES_LIST_D = "/etc/apt/sources.list.d"
     TRUSTED_GPG_D = "/etc/apt/trusted.gpg.d"
 
+    """
+    Valid file patterns for one-line and Deb822-style sources, respectively.
+    """
+    SOURCES_LIST_D_FILE_PATTERNS = ["*.list", "*.sources"]
+
     def register(self, registry):
         super().register(registry)
         registry.register_message(
@@ -109,6 +113,12 @@ class AptSources(ManagerPlugin):
 
         saved_sources = f"{self.SOURCES_LIST}.save"
 
+        manage_sources_list_d = getattr(
+            self.registry.config,
+            "manage_sources_list_d",
+            True,
+        )
+
         if sources:
             fd, path = tempfile.mkstemp()
             os.close(fd)
@@ -130,20 +140,33 @@ class AptSources(ManagerPlugin):
                 original_stat.st_uid,
                 original_stat.st_gid,
             )
+
+            if manage_sources_list_d not in FALSE_VALUES:
+                for pattern in self.SOURCES_LIST_D_FILE_PATTERNS:
+                    filenames = glob.glob(os.path.join(self.SOURCES_LIST_D, pattern))
+                    for filename in filenames:
+                        shutil.move(filename, f"{filename}.save")
         else:
             # Re-instate original sources
             if os.path.isfile(saved_sources):
                 shutil.move(saved_sources, self.SOURCES_LIST)
 
-        manage_sources_list_d = getattr(
-            self.registry.config,
-            "manage_sources_list_d",
-            True,
-        )
-        if manage_sources_list_d not in FALSE_VALUES:
-            filenames = glob.glob(os.path.join(self.SOURCES_LIST_D, "*.list"))
-            for filename in filenames:
-                shutil.move(filename, f"{filename}.save")
+            if manage_sources_list_d not in FALSE_VALUES:
+                for pattern in self.SOURCES_LIST_D_FILE_PATTERNS:
+                    filenames = glob.glob(
+                        os.path.join(self.SOURCES_LIST_D, f"{pattern}.save")
+                    )
+                    for filename in filenames:
+                        restored_filename = filename.removesuffix(".save")
+                        shutil.move(filename, restored_filename)
+
+            # Delete Landscape source files prefixed with `landscape-`
+            landscape_source_filenames = glob.glob(
+                os.path.join(self.SOURCES_LIST_D, "landscape-*.list")
+            )
+
+            for source_filename in landscape_source_filenames:
+                os.remove(source_filename)
 
         for source in sources:
             filename = os.path.join(
@@ -152,7 +175,7 @@ class AptSources(ManagerPlugin):
             )
             # Servers send unicode, but an upgrade from python2 can get bytes
             # from stored messages, so we need to handle both.
-            is_unicode = isinstance(source["content"], type(""))
+            is_unicode = isinstance(source["content"], str)
             with open(filename, ("w" if is_unicode else "wb")) as sources_file:
                 sources_file.write(source["content"])
             os.chmod(filename, 0o644)
diff --git a/landscape/client/manager/config.py b/landscape/client/manager/config.py
index 6b23484..249235a 100644
--- a/landscape/client/manager/config.py
+++ b/landscape/client/manager/config.py
@@ -3,7 +3,6 @@ import os
 from landscape.client.deployment import Configuration
 from landscape.client.manager.scriptexecution import ALL_USERS
 
-
 ALL_PLUGINS = [
     "ProcessKiller",
     "PackageManager",
@@ -17,6 +16,8 @@ ALL_PLUGINS = [
     "UbuntuProInfo",
     "LivePatch",
     "UbuntuProRebootRequired",
+    "ProManagement",
+    "FDERecoveryKeyManager",
 ]
 
 
diff --git a/landscape/client/manager/customgraph.py b/landscape/client/manager/customgraph.py
index 5e35310..ddea186 100644
--- a/landscape/client/manager/customgraph.py
+++ b/landscape/client/manager/customgraph.py
@@ -2,21 +2,17 @@ import logging
 import os
 import time
 
-from twisted.internet.defer import DeferredList
-from twisted.internet.defer import fail
-from twisted.internet.defer import succeed
-from twisted.python.compat import iteritems
+from twisted.internet.defer import DeferredList, fail, succeed
 
 from landscape.client.accumulate import Accumulator
 from landscape.client.manager.plugin import ManagerPlugin
-from landscape.client.manager.scriptexecution import ProcessFailedError
 from landscape.client.manager.scriptexecution import (
+    ProcessFailedError,
     ProcessTimeLimitReachedError,
+    ScriptRunnerMixin,
 )
-from landscape.client.manager.scriptexecution import ScriptRunnerMixin
 from landscape.lib.scriptcontent import generate_script_hash
-from landscape.lib.user import get_user_info
-from landscape.lib.user import UnknownUserError
+from landscape.lib.user import UnknownUserError, get_user_info
 
 
 class StoreProxy:
@@ -152,7 +148,7 @@ class CustomGraphPlugin(ManagerPlugin, ScriptRunnerMixin):
         self.registry.store.add_graph(graph_id, filename, user)
 
     def _format_exception(self, e):
-        return "{}: {}".format(e.__class__.__name__, e.args[0])
+        return f"{e.__class__.__name__}: {e.args[0]}"
 
     def exchange(self, urgent=False):
         self.registry.broker.call_if_accepted(
@@ -165,7 +161,7 @@ class CustomGraphPlugin(ManagerPlugin, ScriptRunnerMixin):
         if not self.do_send:
             return
         self.do_send = False
-        graphs = list(self.registry.store.get_graphs())
+        graphs = self.registry.store.get_graphs()
         for graph_id, filename, user in graphs:
             if graph_id not in self._data:
                 if os.path.isfile(filename):
@@ -179,7 +175,7 @@ class CustomGraphPlugin(ManagerPlugin, ScriptRunnerMixin):
         message = {"type": self.message_type, "data": self._data}
 
         new_data = {}
-        for graph_id, item in iteritems(self._data):
+        for graph_id, item in self._data.items():
             script_hash = item["script-hash"]
             new_data[graph_id] = {
                 "values": [],
@@ -221,9 +217,9 @@ class CustomGraphPlugin(ManagerPlugin, ScriptRunnerMixin):
                 )
             self._data[graph_id]["error"] = failure_value
         elif failure.check(ProcessTimeLimitReachedError):
-            self._data[graph_id][
-                "error"
-            ] = f"Process exceeded the {self.time_limit:d} seconds limit"
+            self._data[graph_id]["error"] = (
+                f"Process exceeded the {self.time_limit:d} seconds limit"
+            )
         else:
             self._data[graph_id]["error"] = self._format_exception(
                 failure.value,
@@ -240,7 +236,7 @@ class CustomGraphPlugin(ManagerPlugin, ScriptRunnerMixin):
         handle the output.
         """
         self.do_send = True
-        graphs = list(self.registry.store.get_graphs())
+        graphs = self.registry.store.get_graphs()
 
         if not graphs:
             # Shortcut to prevent useless call to call_if_accepted
diff --git a/landscape/client/manager/fakepackagemanager.py b/landscape/client/manager/fakepackagemanager.py
index c27f2cc..2d1feef 100644
--- a/landscape/client/manager/fakepackagemanager.py
+++ b/landscape/client/manager/fakepackagemanager.py
@@ -5,7 +5,6 @@ from landscape.client.manager.plugin import ManagerPlugin
 
 
 class FakePackageManager(ManagerPlugin):
-
     run_interval = 1800
     randint = random.randint
 
diff --git a/landscape/client/manager/fderecoverykeymanager.py b/landscape/client/manager/fderecoverykeymanager.py
new file mode 100644
index 0000000..365a5a0
--- /dev/null
+++ b/landscape/client/manager/fderecoverykeymanager.py
@@ -0,0 +1,170 @@
+import logging
+from typing import Any, Tuple
+
+from twisted.internet import task
+from twisted.internet.defer import Deferred, ensureDeferred
+
+from landscape.client import snap_http
+from landscape.client.manager.plugin import (
+    ManagerPlugin,
+)
+from landscape.client.snap_http.http import SnapdHttpException
+from landscape.client.snap_http.types import INCOMPLETE_STATUSES
+
+KEYSLOT_NAME = "landscape-recovery-key"
+
+
+class FDEKeyError(Exception):
+    """Raised when the FDE key generation fails."""
+
+    def __init__(self, message):
+        self.message = message
+
+
+class FDERecoveryKeyManager(ManagerPlugin):
+    """Plugin that generates FDE recovery keys."""
+
+    def register(self, client):
+        super().register(client)
+        client.register_message(
+            "fde-recovery-key",
+            self._handle_recovery_key_message,
+        )
+
+    def _handle_recovery_key_message(self, message):
+        return ensureDeferred(self.handle_recovery_key_message(message))
+
+    async def handle_recovery_key_message(self, message: dict[str, Any]) -> None:
+        """Generates an FDE recovery key, then responds to `message`.
+
+        If the recovery key is successfully generated, we will store it in the
+        exchanger in-memory data store and attempt to add the recovery key to
+        the message just before sending it to server.
+
+        :message: A message of type "fde-recovery-key".
+        """
+        opid = message["operation-id"]
+
+        try:
+            recovery_key_exists = self._recovery_key_exists()
+            recovery_key, key_id = self._generate_recovery_key()
+            await self._update_recovery_key(key_id, recovery_key_exists)
+
+            self.registry.broker.update_exchange_state("recovery-key", recovery_key)
+
+            await self._send_fde_recovery_key(
+                opid, True, "Generated new FDE recovery key."
+            )
+        except FDEKeyError as e:
+            await self._send_fde_recovery_key(opid, False, str(e))
+        except Exception as e:
+            await self._send_fde_recovery_key(opid, False, str(e))
+
+    async def _send_fde_recovery_key(
+        self,
+        opid: int,
+        successful: bool,
+        result_text: str,
+    ) -> None:
+        """Queues a `fde-recovery-key` message to Landscape Server."""
+
+        message = {
+            "type": "fde-recovery-key",
+            "operation-id": opid,
+            "successful": successful,
+            "result-text": result_text,
+        }
+
+        return await self.registry.broker.send_message(
+            message,
+            self._session_id,
+            True,
+        )
+
+    def _recovery_key_exists(
+        self,
+    ) -> bool:
+        """Checks if the Landscape recovery key keyslot already exists.
+
+        :raises FDEKeyError: If the snapd API returns an error.
+        """
+
+        try:
+            result = snap_http.get_keyslots()
+        except SnapdHttpException as e:
+            raise FDEKeyError(f"Unable to list recovery keys: {e}")
+
+        slots = result.result["by-container-role"]["system-data"]["keyslots"]
+
+        return KEYSLOT_NAME in slots
+
+    def _generate_recovery_key(
+        self,
+    ) -> Tuple[str, str]:
+        """Generates the recovery key and a key-id used to update the
+        Landscape recovery key keyslot.
+
+        :raises FDEKeyError: If the snapd API returns an error.
+        """
+
+        try:
+            result = snap_http.generate_recovery_key()
+        except SnapdHttpException as e:
+            raise FDEKeyError(f"Unable to generate recovery key: {e}")
+
+        recovery_key = result.result["recovery-key"]
+        key_id = result.result["key-id"]
+
+        return recovery_key, key_id
+
+    async def _update_recovery_key(
+        self, key_id: str, recovery_key_exists: bool
+    ) -> None:
+        """Uses the key-id to add or replace the Landscape recovery key keyslot.
+
+        :key_id: The identifier for the generated recovery key.
+        :recovery_key_exists: If True, replaces the recovery key instead of adding it.
+
+        :raises FDEKeyError: If the snapd API returns an error.
+        """
+
+        try:
+            result = snap_http.update_recovery_key(
+                key_id, KEYSLOT_NAME, recovery_key_exists
+            )
+        except SnapdHttpException as e:
+            raise FDEKeyError(f"Unable to update recovery key: {e}")
+
+        await self._poll_for_completion(result.change)
+
+    def _poll_for_completion(self, change_id: str) -> Deferred:
+        """Waits for an async operation to be complete.
+
+        :change_id: The change id for the async operation.
+
+        :raises FDEKeyError: If the snapd API returns an error.
+        """
+        interval = getattr(self.registry.config, "snapd_poll_interval", 15)
+
+        def get_status():
+            logging.info("Polling snapd for status of pending recovery key update.")
+
+            try:
+                status = snap_http.check_change(change_id).result["status"]
+            except SnapdHttpException as e:
+                logging.error(f"Error checking status of snap changes: {e}")
+                loop.stop()
+                raise FDEKeyError(str(e))
+
+            if status in INCOMPLETE_STATUSES:
+                logging.debug(
+                    "Incomplete status for recovery key update, waiting...",
+                )
+            else:
+                logging.debug("Complete status for recovery key update")
+                loop.stop()
+
+        loop = task.LoopingCall(get_status)
+        loopDeferred = loop.start(interval)
+
+        return loopDeferred
diff --git a/landscape/client/manager/keystonetoken.py b/landscape/client/manager/keystonetoken.py
index 14fab79..e9c941c 100644
--- a/landscape/client/manager/keystonetoken.py
+++ b/landscape/client/manager/keystonetoken.py
@@ -1,16 +1,12 @@
 import logging
 import os
+from configparser import ConfigParser, NoOptionError
 
-from landscape.client import GROUP
-from landscape.client import USER
+from landscape.client import GROUP, USER
 from landscape.client.monitor.plugin import DataWatcher
-from landscape.lib.compat import _PY3
-from landscape.lib.compat import ConfigParser
-from landscape.lib.compat import NoOptionError
 from landscape.lib.fs import read_binary_file
 from landscape.lib.persist import Persist
 
-
 KEYSTONE_CONFIG_FILE = "/etc/keystone/keystone.conf"
 
 
@@ -61,28 +57,21 @@ class KeystoneToken(DataWatcher):
             return None
 
         config = ConfigParser()
-        if _PY3:
-            # We need to use the surrogateescape error handler as the
-            # admin_token my contain arbitrary bytes. The ConfigParser in
-            # Python 2 on the other hand does not support read_string.
-            config_str = read_binary_file(self._keystone_config_file).decode(
-                "utf-8",
-                "surrogateescape",
-            )
-            config.read_string(config_str)
-        else:
-            config.read(self._keystone_config_file)
+        # We need to use the surrogateescape error handler as the
+        # admin_token my contain arbitrary bytes.
+        config_str = read_binary_file(self._keystone_config_file).decode(
+            "utf-8",
+            "surrogateescape",
+        )
+        config.read_string(config_str)
         try:
             admin_token = config.get("DEFAULT", "admin_token")
         except NoOptionError:
             logging.error(
-                "KeystoneToken: No admin_token found in "
-                f"{self._keystone_config_file}",
+                f"KeystoneToken: No admin_token found in {self._keystone_config_file}",
             )
             return None
-        # There is no support for surrogateescape in Python 2, but we actually
-        # have bytes in this case anyway.
-        if _PY3:
-            admin_token = admin_token.encode("utf-8", "surrogateescape")
+
+        admin_token = admin_token.encode("utf-8", "surrogateescape")
 
         return admin_token
diff --git a/landscape/client/manager/livepatch.py b/landscape/client/manager/livepatch.py
index 666bb42..362f5f4 100644
--- a/landscape/client/manager/livepatch.py
+++ b/landscape/client/manager/livepatch.py
@@ -2,6 +2,7 @@ import json
 import logging
 import subprocess
 import traceback
+
 import yaml
 
 from landscape.client.manager.plugin import DataWatcherManager
@@ -42,9 +43,7 @@ def _parse_humane(output):
             value = value.strip().strip('"').strip("'")
             data[key] = value
         else:
-            raise yaml.YAMLError(
-                "Input is not a list of key/value pairs: " + output
-            )
+            raise yaml.YAMLError("Input is not a list of key/value pairs: " + output)
 
     return data
 
diff --git a/landscape/client/manager/packagemanager.py b/landscape/client/manager/packagemanager.py
index 36692a9..7a8cb64 100644
--- a/landscape/client/manager/packagemanager.py
+++ b/landscape/client/manager/packagemanager.py
@@ -12,7 +12,6 @@ from landscape.lib.encoding import encode_values
 
 
 class PackageManager(ManagerPlugin):
-
     run_interval = 1800
     _package_store = None
 
diff --git a/landscape/client/manager/plugin.py b/landscape/client/manager/plugin.py
index 2a1e9b9..44b5e87 100644
--- a/landscape/client/manager/plugin.py
+++ b/landscape/client/manager/plugin.py
@@ -1,11 +1,9 @@
 import logging
 from pathlib import Path
-from typing import Optional
 
 from twisted.internet.defer import maybeDeferred
 
-from landscape.client import GROUP
-from landscape.client import USER
+from landscape.client import GROUP, USER
 from landscape.client.broker.client import BrokerClientPlugin
 from landscape.lib.format import format_object
 from landscape.lib.log import log_failure
@@ -45,7 +43,7 @@ class ManagerPlugin(BrokerClientPlugin):
         def failure(failure):
             text = f"{failure.type.__name__}: {failure.value}"
             msg = (
-                "Error occured running message handler %s with " "args %r %r.",
+                "Error occurred running message handler %s with args %r %r.",
                 format_object(callable),
                 args,
                 kwargs,
@@ -85,7 +83,7 @@ class DataWatcherManager(ManagerPlugin):
     a get_data method
     """
 
-    message_type: Optional[str] = None
+    message_type: str | None = None
 
     def __init__(self):
         super().__init__()
@@ -95,12 +93,12 @@ class DataWatcherManager(ManagerPlugin):
         super().register(registry)
         self._persist_filename = Path(
             self.registry.config.data_path,
-            self.message_type + '.manager.bpkl',
+            self.message_type + ".manager.bpkl",
         )
         self._persist = Persist(
             filename=self._persist_filename,
             user=USER,
-            group=GROUP
+            group=GROUP,
         )
         self.call_on_accepted(self.message_type, self.send_message)
 
@@ -115,10 +113,11 @@ class DataWatcherManager(ManagerPlugin):
         call"""
         result = self.get_new_data()
         if not result:
-            logging.debug("{} unchanged so not sending".format(
-                          self.message_type))
+            logging.debug(
+                f"{self.message_type} unchanged so not sending",
+            )
             return
-        logging.debug("Sending new {} data!".format(self.message_type))
+        logging.debug(f"Sending new {self.message_type} data!")
         message = {"type": self.message_type, self.message_type: result}
         return self.registry.broker.send_message(message, self._session_id)
 
diff --git a/landscape/client/manager/promanagement.py b/landscape/client/manager/promanagement.py
new file mode 100644
index 0000000..1659731
--- /dev/null
+++ b/landscape/client/manager/promanagement.py
@@ -0,0 +1,83 @@
+import json
+
+from twisted.internet.threads import deferToThread
+
+from landscape.client.manager.plugin import (
+    FAILED,
+    SUCCEEDED,
+    ManagerPlugin,
+)
+from landscape.client.manager.ubuntuproinfo import get_ubuntu_pro_info
+from landscape.lib.uaclient import (
+    ProManagementError,
+    attach_pro,
+    detach_pro,
+)
+
+
+class ProManagement(ManagerPlugin):
+    """A plugin which allows for users to attach pro tokens."""
+
+    def register(self, registry):
+        super().register(registry)
+        registry.register_message(
+            "attach-pro",
+            self._handle_attach_pro,
+        )
+        registry.register_message(
+            "detach-pro",
+            self._handle_detach_pro,
+        )
+
+    def _handle_attach_pro(self, message: dict):
+        """
+        Extract data from message and create deferred for
+        attaching a pro token.
+        """
+        opid = message["operation-id"]
+        token = message["token"]
+        d = deferToThread(attach_pro, token)
+        d.addCallback(self._respond_success_attach, opid)
+        d.addErrback(self._respond_failure, opid)
+        return d
+
+    def _handle_detach_pro(self, message: dict):
+        """
+        Extract data from message and create deferred for
+        detaching a pro token.
+        """
+        opid = message["operation-id"]
+        d = deferToThread(detach_pro)
+        d.addCallback(self._respond_success_detach, opid)
+        d.addErrback(self._respond_failure, opid)
+        return d
+
+    def _respond_success_attach(self, data, opid):
+        return self._respond(SUCCEEDED, json.dumps(get_ubuntu_pro_info()), opid)
+
+    def _respond_success_detach(self, data, opid):
+        return self._respond(SUCCEEDED, "Succeeded in detaching pro token.", opid)
+
+    def _respond_failure(self, failure, opid):
+        try:
+            failure.raiseException()
+        except ProManagementError as e:
+            return self._respond(FAILED, str(e), opid)
+        except Exception:
+            return self._respond(FAILED, str(failure), opid)
+
+    def _respond(self, status, data, opid, result_code=None):
+        message = {
+            "type": "operation-result",
+            "status": status,
+            "result-text": data,
+            "operation-id": opid,
+        }
+        if result_code:
+            message["result-code"] = result_code
+
+        return self.registry.broker.send_message(
+            message,
+            self._session_id,
+            True,
+        )
diff --git a/landscape/client/manager/scriptexecution.py b/landscape/client/manager/scriptexecution.py
index fe39d39..a1c61f4 100644
--- a/landscape/client/manager/scriptexecution.py
+++ b/landscape/client/manager/scriptexecution.py
@@ -3,34 +3,28 @@ Functionality for running arbitrary shell scripts.
 
 @var ALL_USERS: A token indicating all users should be allowed.
 """
+
 import os.path
 import shutil
 import sys
 import tempfile
+from typing import TYPE_CHECKING
 
-from twisted.internet.defer import Deferred
-from twisted.internet.defer import fail
-from twisted.internet.defer import inlineCallbacks
-from twisted.internet.defer import returnValue
-from twisted.internet.defer import succeed
+from twisted.internet.defer import Deferred, ensureDeferred, fail, succeed
 from twisted.internet.error import ProcessDone
 from twisted.internet.protocol import ProcessProtocol
-from twisted.python.compat import unicode
 
-from landscape import VERSION
-from landscape.client import GROUP
 from landscape.client import IS_SNAP
-from landscape.client import USER
-from landscape.client.manager.plugin import FAILED
-from landscape.client.manager.plugin import ManagerPlugin
-from landscape.client.manager.plugin import SUCCEEDED
+from landscape.client.attachments import save_attachments
+from landscape.client.manager.plugin import FAILED, SUCCEEDED, ManagerPlugin
 from landscape.constants import UBUNTU_PATH
-from landscape.lib.fetch import fetch_async
 from landscape.lib.fetch import HTTPCodeError
-from landscape.lib.persist import Persist
 from landscape.lib.scriptcontent import build_script
 from landscape.lib.user import get_user_info
 
+if TYPE_CHECKING:
+    from landscape.client.broker.client import BrokerClient
+
 
 ALL_USERS = object()
 TIMEOUT_RESULT = 102
@@ -110,20 +104,27 @@ class ScriptRunnerMixin:
         script_file.write(script)
         script_file.close()
 
-    def _run_script(self, filename, uid, gid, path, env, time_limit):
-        if uid == os.getuid():
-            uid = None
-        if gid == os.getgid():
-            gid = None
-        env = {
+    def _sanitize_env(self, env: dict) -> dict:
+        """
+        Guard against unrecognized characters in the environment.
+        """
+        return {
             key: (
                 value.encode(sys.getfilesystemencoding(), errors="replace")
-                if isinstance(value, unicode)
+                if isinstance(value, str)
                 else value
             )
             for key, value in env.items()
         }
 
+    def _run_script(self, filename, uid, gid, path, env, time_limit):
+        if uid == os.getuid():
+            uid = None
+        if gid == os.getgid():
+            gid = None
+
+        env = self._sanitize_env(env)
+
         pp = ProcessAccumulationProtocol(
             self.registry.reactor,
             self.registry.config.script_output_limit,
@@ -147,6 +148,15 @@ class ScriptRunnerMixin:
 class ScriptExecutionPlugin(ManagerPlugin, ScriptRunnerMixin):
     """A plugin which allows execution of arbitrary shell scripts."""
 
+    def __init__(
+        self,
+        process_factory=None,
+        script_tempdir: str | None = None,
+    ):
+        ScriptRunnerMixin.__init__(self, process_factory=process_factory)
+        ManagerPlugin.__init__(self)
+        self.script_tempdir = script_tempdir
+
     def register(self, registry):
         super().register(registry)
         registry.register_message(
@@ -155,7 +165,7 @@ class ScriptExecutionPlugin(ManagerPlugin, ScriptRunnerMixin):
         )
 
     def _respond(self, status, data, opid, result_code=None):
-        if not isinstance(data, unicode):
+        if not isinstance(data, str):
             # Let's decode result-text, replacing non-printable
             # characters
             data = data.decode("utf-8", "replace")
@@ -199,10 +209,9 @@ class ScriptExecutionPlugin(ManagerPlugin, ScriptRunnerMixin):
             return d
         except Exception as e:
             self._respond(FAILED, self._format_exception(e), opid)
-            raise
 
     def _format_exception(self, e):
-        return "{}: {}".format(e.__class__.__name__, e.args[0])
+        return f"{e.__class__.__name__}: {e.args[0]}"
 
     def _respond_success(self, data, opid):
         return self._respond(SUCCEEDED, data, opid)
@@ -227,36 +236,23 @@ class ScriptExecutionPlugin(ManagerPlugin, ScriptRunnerMixin):
         else:
             return self._respond(FAILED, str(failure), opid)
 
-    @inlineCallbacks
-    def _save_attachments(self, attachments, uid, gid, computer_id, env):
-        root_path = self.registry.config.url.rsplit("/", 1)[0] + "/attachment/"
-        env["LANDSCAPE_ATTACHMENTS"] = attachment_dir = tempfile.mkdtemp()
-        headers = {
-            "User-Agent": f"landscape-client/{VERSION}",
-            "Content-Type": "application/octet-stream",
-            "X-Computer-ID": computer_id,
-        }
-        for filename, attachment_id in attachments.items():
-            if isinstance(attachment_id, str):
-                # Backward compatible behavior
-                data = attachment_id.encode("utf-8")
-                yield succeed(None)
-            else:
-                data = yield fetch_async(
-                    f"{root_path}{attachment_id:d}",
-                    cainfo=self.registry.config.ssl_public_key,
-                    headers=headers,
-                )
-            full_filename = os.path.join(attachment_dir, filename)
-            with open(full_filename, "wb") as attachment:
-                os.chmod(full_filename, 0o600)
-                if not self.IS_SNAP and uid is not None:
-                    os.chown(full_filename, uid, gid)
-                attachment.write(data)
+    async def _save_attachments(self, attachments, uid, gid, env):
+        attachment_dir = tempfile.mkdtemp(dir=self.script_tempdir)
+        env["LANDSCAPE_ATTACHMENTS"] = attachment_dir
         os.chmod(attachment_dir, 0o700)
+
+        await save_attachments(
+            self.registry.config,
+            attachments.items(),
+            attachment_dir,
+            uid,
+            gid,
+        )
+
         if not self.IS_SNAP and uid is not None:
             os.chown(attachment_dir, uid, gid)
-        returnValue(attachment_dir)
+
+        return attachment_dir
 
     def run_script(
         self,
@@ -292,7 +288,7 @@ class ScriptExecutionPlugin(ManagerPlugin, ScriptRunnerMixin):
 
         uid, gid, path = get_user_info(user)
 
-        fd, filename = tempfile.mkstemp()
+        fd, filename = tempfile.mkstemp(dir=self.script_tempdir)
         script_file = os.fdopen(fd, "wb")
         self.write_script_file(script_file, filename, shell, code, uid, gid)
 
@@ -315,26 +311,18 @@ class ScriptExecutionPlugin(ManagerPlugin, ScriptRunnerMixin):
         old_umask = os.umask(0o022)
 
         if attachments:
-            persist = Persist(
-                filename=os.path.join(
-                    self.registry.config.data_path,
-                    "broker.bpickle",
+            d = ensureDeferred(
+                self._save_attachments(
+                    attachments,
+                    uid,
+                    gid,
+                    env,
                 ),
-                user=USER,
-                group=GROUP,
             )
-            persist = persist.root_at("registration")
-            computer_id = persist.get("secure-id")
-            try:
-                computer_id = computer_id.decode("ascii")
-            except AttributeError:
-                pass
-            d = self._save_attachments(attachments, uid, gid, computer_id, env)
         else:
             d = succeed(None)
 
         def prepare_script(attachment_dir):
-
             return self._run_script(filename, uid, gid, path, env, time_limit)
 
         d.addCallback(prepare_script)
@@ -443,16 +431,17 @@ class ScriptExecution(ManagerPlugin):
     Meta-plugin wrapping ScriptExecutionPlugin and CustomGraphPlugin.
     """
 
-    def __init__(self):
+    def register(self, client: "BrokerClient"):
         from landscape.client.manager.customgraph import CustomGraphPlugin
 
-        self._script_execution = ScriptExecutionPlugin()
+        super().register(client)
+        self._script_execution = ScriptExecutionPlugin(
+            script_tempdir=self.manager.config.script_tempdir,
+        )
         self._custom_graph = CustomGraphPlugin()
 
-    def register(self, registry):
-        super().register(registry)
-        self._script_execution.register(registry)
-        self._custom_graph.register(registry)
+        self._script_execution.register(client)
+        self._custom_graph.register(client)
 
     def exchange(self, urgent=False):
         self._custom_graph.exchange(urgent)
diff --git a/landscape/client/manager/service.py b/landscape/client/manager/service.py
index c289685..5b1a366 100644
--- a/landscape/client/manager/service.py
+++ b/landscape/client/manager/service.py
@@ -6,8 +6,7 @@ from landscape.client.amp import ComponentPublisher
 from landscape.client.broker.amp import RemoteBrokerConnector
 from landscape.client.manager.config import ManagerConfiguration
 from landscape.client.manager.manager import Manager
-from landscape.client.service import LandscapeService
-from landscape.client.service import run_landscape_service
+from landscape.client.service import LandscapeService, run_landscape_service
 
 
 class ManagerService(LandscapeService):
@@ -35,8 +34,7 @@ class ManagerService(LandscapeService):
         for plugin_name in self.config.plugin_factories:
             try:
                 plugin = namedClass(
-                    "landscape.client.manager."
-                    f"{plugin_name.lower()}.{plugin_name}",
+                    f"landscape.client.manager.{plugin_name.lower()}.{plugin_name}",
                 )
                 plugins.append(plugin())
             except ModuleNotFoundError:
diff --git a/landscape/client/manager/shutdownmanager.py b/landscape/client/manager/shutdownmanager.py
index bd38533..d80836c 100644
--- a/landscape/client/manager/shutdownmanager.py
+++ b/landscape/client/manager/shutdownmanager.py
@@ -1,12 +1,9 @@
 import logging
 
 import dbus
-from twisted.internet import reactor
-from twisted.internet import task
+from twisted.internet import reactor, task
 
-from landscape.client.manager.plugin import FAILED
-from landscape.client.manager.plugin import ManagerPlugin
-from landscape.client.manager.plugin import SUCCEEDED
+from landscape.client.manager.plugin import FAILED, SUCCEEDED, ManagerPlugin
 
 
 class ShutdownManager(ManagerPlugin):
diff --git a/landscape/client/manager/snapmanager.py b/landscape/client/manager/snapmanager.py
index ce6c2d4..9eb9a87 100644
--- a/landscape/client/manager/snapmanager.py
+++ b/landscape/client/manager/snapmanager.py
@@ -5,15 +5,13 @@ from pathlib import Path
 
 from twisted.internet import task
 
-from landscape.client import GROUP
-from landscape.client import snap_http
-from landscape.client import USER
-from landscape.client.manager.plugin import FAILED
-from landscape.client.manager.plugin import ManagerPlugin
-from landscape.client.manager.plugin import SUCCEEDED
-from landscape.client.snap_http import INCOMPLETE_STATUSES
-from landscape.client.snap_http import SnapdHttpException
-from landscape.client.snap_http import SUCCESS_STATUSES
+from landscape.client import GROUP, USER, snap_http
+from landscape.client.manager.plugin import FAILED, SUCCEEDED, ManagerPlugin
+from landscape.client.snap_http import (
+    INCOMPLETE_STATUSES,
+    SUCCESS_STATUSES,
+    SnapdHttpException,
+)
 from landscape.lib.persist import Persist
 from landscape.message_schemas.server_bound import SNAPS
 
@@ -292,6 +290,28 @@ class SnapManager(BaseSnapManager):
             self._send_snap_update,
         )
 
+    def _get_serial(self):
+        """
+        Returns device's serial number by parsing the serial assertion.
+
+        If the serial assertion cannot be retrieved, returns "no-serial".
+        """
+        serial = "no-serial"
+
+        try:
+            serial_bytes = snap_http.get_assertions("serial").result
+            serial_assert = serial_bytes.decode("utf-8")
+        except SnapdHttpException as e:
+            logging.error(f"Unable to get serial assertion: {e}")
+            return serial
+
+        for line in serial_assert.splitlines():
+            if line.startswith("serial:"):
+                serial = line.split("serial:", 1)[1].strip()
+                break
+
+        return serial or "no-serial"
+
     def get_data(self):
         try:
             snaps = snap_http.list().result
@@ -301,6 +321,10 @@ class SnapManager(BaseSnapManager):
 
         for i in range(len(snaps)):
             snap_name = snaps[i]["name"]
+            # devmode snaps have no ID so we need to add one for server
+            # indexing.
+            if snaps[i]["id"] == "":
+                snaps[i]["id"] = self._get_serial() + "-" + snap_name
             try:
                 config = snap_http.get_conf(snap_name).result
             except SnapdHttpException as e:
diff --git a/landscape/client/manager/store.py b/landscape/client/manager/store.py
index 1971b5e..57484d5 100644
--- a/landscape/client/manager/store.py
+++ b/landscape/client/manager/store.py
@@ -37,8 +37,7 @@ class ManagerStore:
             )
         else:
             cursor.execute(
-                "INSERT INTO graph (graph_id, filename, user) "
-                "VALUES (?, ?, ?)",
+                "INSERT INTO graph (graph_id, filename, user) VALUES (?, ?, ?)",
                 (graph_id, filename, user),
             )
 
diff --git a/landscape/client/manager/tests/test_aptsources.py b/landscape/client/manager/tests/test_aptsources.py
index aa648be..0a87032 100644
--- a/landscape/client/manager/tests/test_aptsources.py
+++ b/landscape/client/manager/tests/test_aptsources.py
@@ -1,15 +1,12 @@
 import os
 from unittest import mock
 
-from twisted.internet.defer import Deferred
-from twisted.internet.defer import succeed
+from twisted.internet.defer import Deferred, succeed
 
 from landscape.client.manager.aptsources import AptSources
-from landscape.client.manager.plugin import FAILED
-from landscape.client.manager.plugin import SUCCEEDED
+from landscape.client.manager.plugin import FAILED, SUCCEEDED
 from landscape.client.package.reporter import find_reporter_command
-from landscape.client.tests.helpers import LandscapeTest
-from landscape.client.tests.helpers import ManagerHelper
+from landscape.client.tests.helpers import LandscapeTest, ManagerHelper
 
 
 class FakeStatResult:
@@ -165,6 +162,129 @@ class AptSourcesTests(LandscapeTest):
         with open(self.sourceslist.SOURCES_LIST) as sources:
             self.assertEqual("original content\n", sources.read())
 
+    def test_restore_sources_list_d(self):
+        """
+        When getting a repository message without sources, AptSources
+        restores the previous files in sources.list.d.
+        """
+        FILE_1_LIST = os.path.join(self.sourceslist.SOURCES_LIST_D, "file1.list")
+
+        FILE_2_SOURCES = os.path.join(self.sourceslist.SOURCES_LIST_D, "file2.sources")
+        with open(
+            FILE_1_LIST,
+            "w",
+        ) as source1:
+            source1.write("ok\n")
+
+        with open(
+            FILE_2_SOURCES,
+            "w",
+        ) as source2:
+            source2.write("ok\n")
+
+        self.manager.dispatch_message(
+            {
+                "type": "apt-sources-replace",
+                "sources": [{"name": "bla", "content": b""}],
+                "gpg-keys": [],
+                "operation-id": 1,
+            },
+        )
+
+        self.assertFalse(
+            os.path.exists(FILE_1_LIST),
+        )
+
+        self.assertFalse(os.path.exists(FILE_2_SOURCES))
+
+        self.assertTrue(
+            os.path.exists(f"{FILE_1_LIST}.save"),
+        )
+
+        self.assertTrue(
+            os.path.exists(f"{FILE_2_SOURCES}.save"),
+        )
+
+        self.manager.dispatch_message(
+            {
+                "type": "apt-sources-replace",
+                "sources": [],
+                "gpg-keys": [],
+                "operation-id": 2,
+            },
+        )
+
+        self.assertTrue(
+            os.path.exists(FILE_1_LIST),
+        )
+
+        self.assertTrue(os.path.exists(FILE_2_SOURCES))
+
+        self.assertFalse(
+            os.path.exists(f"{FILE_1_LIST}.save"),
+        )
+
+        self.assertFalse(
+            os.path.exists(f"{FILE_2_SOURCES}.save"),
+        )
+
+    def test_restore_sources_list_d_removes_old_profile_files(self):
+        """
+        When getting a repository message without sources, old
+        source files in `/etc/apt/sources.list.d` prefixed with
+        `landscape-` will be removed.
+        """
+        first_source_name = "ginger"
+
+        self.manager.dispatch_message(
+            {
+                "type": "apt-sources-replace",
+                "sources": [{"name": first_source_name, "content": b""}],
+                "gpg-keys": [],
+                "operation-id": 1,
+            },
+        )
+
+        first_sources_path = os.path.join(
+            self.sourceslist.SOURCES_LIST_D,
+            f"landscape-{first_source_name}.list",
+        )
+
+        self.assertTrue(os.path.exists(first_sources_path))
+
+        second_source_name = "ace rothstein"
+
+        self.manager.dispatch_message(
+            {
+                "type": "apt-sources-replace",
+                "sources": [{"name": second_source_name, "content": b""}],
+                "gpg-keys": [],
+                "operation-id": 2,
+            },
+        )
+
+        second_sources_path = os.path.join(
+            self.sourceslist.SOURCES_LIST_D,
+            f"landscape-{second_source_name}.list",
+        )
+
+        self.assertTrue(os.path.exists(f"{first_sources_path}.save"))
+
+        self.assertTrue(os.path.exists(second_sources_path))
+
+        self.manager.dispatch_message(
+            {
+                "type": "apt-sources-replace",
+                "sources": [],
+                "gpg-keys": [],
+                "operation-id": 3,
+            },
+        )
+
+        self.assertFalse(os.path.exists(first_sources_path))
+
+        self.assertFalse(os.path.exists(second_sources_path))
+
     def test_sources_list_permissions(self):
         """
         When getting a repository message, L{AptSources} keeps sources.list
@@ -260,70 +380,71 @@ class AptSourcesTests(LandscapeTest):
 
     def test_renames_sources_list_d(self):
         """
-        The sources files in sources.list.d are renamed to .save when a message
-        is received if config says to manage them, which is the default.
+        The sources files (.list, .sources) in sources.list.d
+        are renamed to .save when a message is received
+        if config says to manage them, which is the default.
         """
+        FILE_1_LIST = os.path.join(self.sourceslist.SOURCES_LIST_D, "file1.list")
+
+        FILE_2_SOURCES = os.path.join(self.sourceslist.SOURCES_LIST_D, "file2.sources")
         with open(
-            os.path.join(self.sourceslist.SOURCES_LIST_D, "file1.list"),
+            FILE_1_LIST,
             "w",
-        ) as sources1:
-            sources1.write("ok\n")
+        ) as source1:
+            source1.write("ok\n")
 
         with open(
-            os.path.join(self.sourceslist.SOURCES_LIST_D, "file2.list.save"),
+            FILE_2_SOURCES,
             "w",
-        ) as sources2:
-            sources2.write("ok\n")
+        ) as source2:
+            source2.write("ok\n")
 
         self.manager.dispatch_message(
             {
                 "type": "apt-sources-replace",
-                "sources": [],
+                "sources": [{"name": "bla", "content": b""}],
                 "gpg-keys": [],
                 "operation-id": 1,
             },
         )
 
+        self.assertTrue(
+            os.path.exists(self.sourceslist.SOURCES_LIST),
+        )
+
         self.assertFalse(
-            os.path.exists(
-                os.path.join(self.sourceslist.SOURCES_LIST_D, "file1.list"),
-            ),
+            os.path.exists(FILE_1_LIST),
         )
 
+        self.assertFalse(os.path.exists(FILE_2_SOURCES))
+
         self.assertTrue(
-            os.path.exists(
-                os.path.join(
-                    self.sourceslist.SOURCES_LIST_D,
-                    "file1.list.save",
-                ),
-            ),
+            os.path.exists(f"{FILE_1_LIST}.save"),
         )
 
         self.assertTrue(
-            os.path.exists(
-                os.path.join(
-                    self.sourceslist.SOURCES_LIST_D,
-                    "file2.list.save",
-                ),
-            ),
+            os.path.exists(f"{FILE_2_SOURCES}.save"),
         )
 
     def test_does_not_rename_sources_list_d(self):
         """
-        The sources files in sources.list.d are not renamed to .save when a
-        message is received if config says not to manage them.
+        The sources files (.list, .sources) in sources.list.d
+        are not renamed to .save when a message is received
+        if config says not to manage them
         """
+        FILE_3_LIST = os.path.join(self.sourceslist.SOURCES_LIST_D, "file3.list")
+
+        FILE_4_SOURCES = os.path.join(self.sourceslist.SOURCES_LIST_D, "file4.sources")
         with open(
-            os.path.join(self.sourceslist.SOURCES_LIST_D, "file1.list"),
+            FILE_3_LIST,
             "w",
-        ) as sources1:
-            sources1.write("ok\n")
-
+        ) as source3:
+            source3.write("ok\n")
         with open(
-            os.path.join(self.sourceslist.SOURCES_LIST_D, "file2.list.save"),
+            FILE_4_SOURCES,
             "w",
-        ) as sources2:
-            sources2.write("ok\n")
+        ) as source4:
+            source4.write("ok\n")
 
         self.manager.config.manage_sources_list_d = False
         self.manager.dispatch_message(
@@ -336,27 +457,19 @@ class AptSourcesTests(LandscapeTest):
         )
 
         self.assertTrue(
-            os.path.exists(
-                os.path.join(self.sourceslist.SOURCES_LIST_D, "file1.list"),
-            ),
+            os.path.exists(FILE_3_LIST),
+        )
+
+        self.assertTrue(
+            os.path.exists(FILE_4_SOURCES),
         )
 
         self.assertFalse(
-            os.path.exists(
-                os.path.join(
-                    self.sourceslist.SOURCES_LIST_D,
-                    "file1.list.save",
-                ),
-            ),
+            os.path.exists(f"{FILE_3_LIST}.save"),
         )
 
-        self.assertTrue(
-            os.path.exists(
-                os.path.join(
-                    self.sourceslist.SOURCES_LIST_D,
-                    "file2.list.save",
-                ),
-            ),
+        self.assertFalse(
+            os.path.exists(f"{FILE_4_SOURCES}.save"),
         )
 
     def test_create_landscape_sources(self):
@@ -417,7 +530,7 @@ class AptSourcesTests(LandscapeTest):
         gpg_dirpath = self.sourceslist.TRUSTED_GPG_D
         for filename in os.listdir(gpg_dirpath):
             filepath = os.path.join(gpg_dirpath, filename)
-            with open(filepath, "r") as fh:
+            with open(filepath) as fh:
                 keys.append(fh.read())
 
         self.assertCountEqual(keys, gpg_keys)
@@ -482,20 +595,22 @@ class AptSourcesTests(LandscapeTest):
 
         self.sourceslist._run_process = _run_process
 
-        with mock.patch.multiple(
-            "landscape.client.manager.aptsources",
-            USER="root",
-            GROUP="root",
+        with (
+            mock.patch.multiple(
+                "landscape.client.manager.aptsources",
+                USER="root",
+                GROUP="root",
+            ),
+            mock.patch("os.getuid") as getuid,
         ):
-            with mock.patch("os.getuid") as getuid:
-                getuid.return_value = 0
-                self.manager.dispatch_message(
-                    {
-                        "type": "apt-sources-replace",
-                        "sources": [],
-                        "gpg-keys": [],
-                        "operation-id": 1,
-                    },
-                )
+            getuid.return_value = 0
+            self.manager.dispatch_message(
+                {
+                    "type": "apt-sources-replace",
+                    "sources": [],
+                    "gpg-keys": [],
+                    "operation-id": 1,
+                },
+            )
 
         return deferred
diff --git a/landscape/client/manager/tests/test_config.py b/landscape/client/manager/tests/test_config.py
index 1fdd57a..cd90e27 100644
--- a/landscape/client/manager/tests/test_config.py
+++ b/landscape/client/manager/tests/test_config.py
@@ -1,5 +1,4 @@
-from landscape.client.manager.config import ALL_PLUGINS
-from landscape.client.manager.config import ManagerConfiguration
+from landscape.client.manager.config import ALL_PLUGINS, ManagerConfiguration
 from landscape.client.manager.scriptexecution import ALL_USERS
 from landscape.client.tests.helpers import LandscapeTest
 
@@ -25,6 +24,8 @@ class ManagerConfigurationTest(LandscapeTest):
                 "UbuntuProInfo",
                 "LivePatch",
                 "UbuntuProRebootRequired",
+                "ProManagement",
+                "FDERecoveryKeyManager",
             ],
             ALL_PLUGINS,
         )
diff --git a/landscape/client/manager/tests/test_customgraph.py b/landscape/client/manager/tests/test_customgraph.py
index b712a75..5f6e3fb 100644
--- a/landscape/client/manager/tests/test_customgraph.py
+++ b/landscape/client/manager/tests/test_customgraph.py
@@ -1,22 +1,18 @@
 import logging
 import os
 import pwd
-from unittest import mock
-from unittest import skipIf
+from unittest import mock, skipIf
 
 from twisted.internet.error import ProcessDone
 from twisted.python.failure import Failure
 
 from landscape.client.manager.customgraph import CustomGraphPlugin
 from landscape.client.manager.store import ManagerStore
-from landscape.client.tests.helpers import LandscapeTest
-from landscape.client.tests.helpers import ManagerHelper
-from landscape.lib.testing import DummyProcess
-from landscape.lib.testing import StubProcessFactory
+from landscape.client.tests.helpers import LandscapeTest, ManagerHelper
+from landscape.lib.testing import DummyProcess, StubProcessFactory
 
 
 class CustomGraphManagerTests(LandscapeTest):
-
     helpers = [ManagerHelper]
 
     def setUp(self):
@@ -192,16 +188,12 @@ class CustomGraphManagerTests(LandscapeTest):
                             123: {
                                 "error": "",
                                 "values": [(300, 1.0)],
-                                "script-hash": (
-                                    b"483f2304b49063680c75e3c9e09cf6d0"
-                                ),
+                                "script-hash": (b"483f2304b49063680c75e3c9e09cf6d0"),
                             },
                             124: {
                                 "error": "",
                                 "values": [(300, 2.0)],
-                                "script-hash": (
-                                    b"73a74b1530b2256db7edacb9b9cc385e"
-                                ),
+                                "script-hash": (b"73a74b1530b2256db7edacb9b9cc385e"),
                             },
                         },
                         "type": "custom-graph",
@@ -226,9 +218,7 @@ class CustomGraphManagerTests(LandscapeTest):
                             123: {
                                 "error": " (process exited with code 1)",
                                 "values": [],
-                                "script-hash": (
-                                    b"eaca3ba1a3bf1948876eba320148c5e9"
-                                ),
+                                "script-hash": (b"eaca3ba1a3bf1948876eba320148c5e9"),
                             },
                         },
                         "type": "custom-graph",
@@ -264,9 +254,7 @@ class CustomGraphManagerTests(LandscapeTest):
                                     "number: 'foobar'"
                                 ),
                                 "values": [],
-                                "script-hash": (
-                                    b"baab6c16d9143523b7865d46896e4596"
-                                ),
+                                "script-hash": (b"baab6c16d9143523b7865d46896e4596"),
                             },
                         },
                         "type": "custom-graph",
@@ -298,13 +286,10 @@ class CustomGraphManagerTests(LandscapeTest):
                         "data": {
                             123: {
                                 "error": (
-                                    "NoOutputError: Script did not output "
-                                    "any value"
+                                    "NoOutputError: Script did not output any value"
                                 ),
                                 "values": [],
-                                "script-hash": (
-                                    b"baab6c16d9143523b7865d46896e4596"
-                                ),
+                                "script-hash": (b"baab6c16d9143523b7865d46896e4596"),
                             },
                         },
                         "type": "custom-graph",
@@ -338,19 +323,14 @@ class CustomGraphManagerTests(LandscapeTest):
                         "data": {
                             123: {
                                 "error": (
-                                    "NoOutputError: Script did not output "
-                                    "any value"
-                                ),
-                                "script-hash": (
-                                    b"baab6c16d9143523b7865d46896e4596"
+                                    "NoOutputError: Script did not output any value"
                                 ),
+                                "script-hash": (b"baab6c16d9143523b7865d46896e4596"),
                                 "values": [],
                             },
                             124: {
                                 "error": "",
-                                "script-hash": (
-                                    b"baab6c16d9143523b7865d46896e4596"
-                                ),
+                                "script-hash": (b"baab6c16d9143523b7865d46896e4596"),
                                 "values": [(300, 0.5)],
                             },
                         },
@@ -388,19 +368,14 @@ class CustomGraphManagerTests(LandscapeTest):
                                     "InvalidFormatError: Failed to convert "
                                     "to number: 'foo'"