Merge ~lamoura/ubuntu/+source/ubuntu-advantage-tools:upload-27.7-jammy into ubuntu/+source/ubuntu-advantage-tools:ubuntu/devel

[Lucas Albuquerque Medeiros de Moura]

This MR represents release 27.7 of ubuntu-advantage-tools. We are creating this new MR because we have identified an issue in the release that needed a fix.

Originally, the MR was made through this branch:
https://code.launchpad.net/~orndorffgrant/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/+merge/416678

We have a FFE ready for this release on Jammy:
https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/1964134

And the SRU bug here: https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/1964028

[Paride Legovini (paride)]

The bugfix commit (afc280d) LGTM. I verified the correspondence between the message strings names as called by postinst and the actual definitions.

I checked the commit hashes to make sure that the new commits are applied cleanly on the previously-reviewed branch, without rebasing. As this is the case, the new change can be considered alone, and given that it's a bugfix-only change I believe this doesn't require another FFe approval (virtually we could have uploaded the FFe approved version, followed by a bugfix-only upload, not requiring approval).

My review comment to https://code.launchpad.net/~orndorffgrant/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/+merge/416678 still applies, I'm reporting it here.

---

Looking at this as packaging for a normal new upstream release: this is fine. Packaging changes are small, the only delicate bit is the handling of the log file permissions, which is now partially handled by logrotate. If logrotate isn't installed the logs will stay non-user-readable, which is a good compromise. Lintian complains hard about E: missing-build-dependency-for-dh-addon, but the dh-systemd B-D is present as an "OR" dependency, which lintian doesn't resolve, so this is a false positive. We may want to override this, but it's not a blocker for uploading. The other Lintian warning are due to deliberate choices.

Looking at this upload from the FFe/SRU perspective: this also looks good to me. More specifically the changes are

 - Bug fixes;
 - New functionality, extending existing functionality
   in a non-breaking way;
 - Documentation changes.

A binary debdiff shows that ubuntu-advantage-tools_27.7~22.04.1_amd64.deb ships the following new files wrt 27.6~22.04.1:

Files in second .deb but not in first
-------------------------------------
-rw-r--r-- root/root /usr/lib/python3/dist-packages/uaclient/data_types.py
-rw-r--r-- root/root /usr/lib/python3/dist-packages/uaclient/event_logger.py
-rw-r--r-- root/root /usr/lib/python3/dist-packages/uaclient/messages.py

These are expected and part of the aforementioned new functionality.

I think this is ready for the "second pass" review from a SRU team member.

review: Approve

[Chris Halse Rogers (raof)]

SRU pass: there are a lot of changes here, but the changes to the packaging are OK and the others look like they're sensible. SRU pre-ack.

Unmerged commits

05f6b3a... by Lucas Albuquerque Medeiros de Moura on 2022-03-22

changelog: add line for postinst messages change

afc280d... by Lucas Albuquerque Medeiros de Moura on 2022-03-22

postinst: Adapt script for new messages module

bc721e4... by Renan Rodrigo on 2022-03-14

gcp: add pro license for Jammy

Signed-off-by: Renan Rodrigo <email address hidden>

9433db4... by Grant Orndorff on 2022-03-09

changelog: fix trailer line for 27.4.1

cd08064... by Lucas Albuquerque Medeiros de Moura on 2022-03-08

fix ubuntu upgrade tests for jammy

5b135d4... by Lucas Albuquerque Medeiros de Moura on 2022-03-07

fix integration test failures

feff165... by Grant Orndorff on 2022-03-07

release 27.7 changelog entry

68ca8e6... by Grant Orndorff on 2022-03-07

chore: bump version to 27.7

cf59d1d... by Renan Rodrigo on 2022-03-02

chore: bump security-status schema version to 0.1

Signed-off-by: Renan Rodrigo <email address hidden>

7db6f2d... by Renan Rodrigo on 2022-03-02

cli: include the origin site for security-status updates

Signed-off-by: Renan Rodrigo <email address hidden>

diff --git a/Jenkinsfile b/Jenkinsfile
index f9ca868..9c71624 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -141,6 +141,27 @@ pipeline {
                         '''
                     }
                 }
+                stage ('Package build: 22.04') {
+                    environment {
+                        BUILD_SERIES = "jammy"
+                        SERIES_VERSION = "22.04"
+                        PKG_VERSION = sh(returnStdout: true, script: "dpkg-parsechangelog --show-field Version").trim()
+                        NEW_PKG_VERSION = "${PKG_VERSION}~${SERIES_VERSION}~${JOB_SUFFIX}"
+                        ARTIFACT_DIR = "${TMPDIR}${BUILD_SERIES}"
+                    }
+                    steps {
+                        sh '''
+                        set -x
+                        mkdir ${ARTIFACT_DIR}
+                        cp debian/changelog ${WORKSPACE}/debian/changelog-${SERIES_VERSION}
+                        sed -i "s/${PKG_VERSION}/${NEW_PKG_VERSION}/" ${WORKSPACE}/debian/changelog-${SERIES_VERSION}
+                        dpkg-source -l${WORKSPACE}/debian/changelog-${SERIES_VERSION} -b .
+                        sbuild --resolve-alternatives --nolog --verbose --dist=${BUILD_SERIES} --no-run-lintian --append-to-version=~${SERIES_VERSION}  ../ubuntu-advantage-tools*${NEW_PKG_VERSION}*dsc
+                        cp ./ubuntu-advantage-tools*${SERIES_VERSION}*.deb ${ARTIFACT_DIR}/ubuntu-advantage-tools-${BUILD_SERIES}.deb
+                        cp ./ubuntu-advantage-pro*${SERIES_VERSION}*.deb ${ARTIFACT_DIR}/ubuntu-advantage-pro-${BUILD_SERIES}.deb
+                        '''
+                    }
+                }
             }
         }
         stage ('Integration Tests') {
@@ -190,6 +211,21 @@ pipeline {
                         '''
                     }
                 }
+                stage("lxc 22.04") {
+                    environment {
+                        UACLIENT_BEHAVE_DEBS_PATH = "${TMPDIR}jammy/"
+                        UACLIENT_BEHAVE_ARTIFACT_DIR = "artifacts/behave-lxd-22.04"
+                        UACLIENT_BEHAVE_EPHEMERAL_INSTANCE = 1
+                        UACLIENT_BEHAVE_SNAPSHOT_STRATEGY = 1
+                    }
+                    steps {
+                        sh '''
+                        set +x
+                        . $TMPDIR/bin/activate
+                        tox --parallel--safe-build -e behave-lxd-22.04 -- --tags="~slow"
+                        '''
+                    }
+                }
                 stage("lxc vm 20.04") {
                     environment {
                         UACLIENT_BEHAVE_DEBS_PATH = "${TMPDIR}focal/"
diff --git a/Makefile b/Makefile
index e8ce957..87932a8 100644
--- a/Makefile
+++ b/Makefile
@@ -33,6 +33,7 @@ ifneq (,$(findstring trusty,$(TOXENV)))
 endif
 	pip install tox
 	pip install tox-pip-version
+	pip install tox-setuptools-version
 
 travis-deb-install:
 	git fetch --unshallow
diff --git a/README.md b/README.md
index a9040e2..8d413c5 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,7 @@ Below is a list of platforms and releases ubuntu-advantage-tools supports
 | Bionic | amd64, arm64, armhf, i386, ppc64el, s390x | Active SRU of all features |
 | Focal | amd64, arm64, armhf, ppc64el, riscv64, s390x | Active SRU of all features |
 | Groovy | amd64, arm64, armhf, ppc64el, riscv64, s390x | Last release 27.1 |
-| Hirsute | amd64, arm64, armhf, ppc64el, riscv64, s390x | Active SRU of all features |
+| Hirsute | amd64, arm64, armhf, ppc64el, riscv64, s390x | Last release 27.5 |
 | Impish | amd64, arm64, armhf, ppc64el, riscv64, s390x | Active SRU of all features |
 
 Note: ppc64el will not have support for APT JSON hook messaging due to insufficient golang packages
@@ -107,6 +107,27 @@ https://ubuntu.com/advantage.
 * UA client auto-enables any services defined with
   `obligations:{enableByDefault: true}`
 
+#### Attaching with --attach-config
+Running `ua attach` with the `--attach-config` may be better suited to certain scenarios.
+
+When using `--attach-config` the token must be passed in the file rather than on the command line. This is useful in situations where it is preffered to keep the secret token in a file.
+
+Optionally, the attach config file can be used to override the services that are automatically enabled as a part of the attach process.
+
+An attach config file looks like this:
+```yaml
+token: YOUR_TOKEN_HERE  # required
+enable_services:        # optional list of service names to auto-enable
+  - esm-infra
+  - esm-apps
+  - cis
+```
+
+And can be passed on the cli like this:
+```shell
+sudo ua attach --attach-config /path/to/file.yaml
+```
+
 ### Enabling a service
 Each service controlled by UA client will have a python module in
 uaclient/entitlements/\*.py which handles setup and teardown of services when
@@ -367,9 +388,9 @@ when you should set UACLIENT_BEHAVE_SNAPSHOT_STRATEGY=1
 The following tox environments allow for testing focal on EC2:
 
 ```
-  # To test ubuntu-pro-images on EC2
+  # To test ubuntu-pro-images
   tox -e behave-awspro-20.04
-  # To test Canonical cloud images (non-ubuntu-pro) on EC2
+  # To test Canonical cloud images (non-ubuntu-pro)
   tox -e behave-awsgeneric-20.04
 ```
 
@@ -417,9 +438,9 @@ UACLIENT_BEHAVE_REUSE_IMAGE=your-custom-ami tox -e behave-awspro-20.04
 The following tox environments allow for testing focal on Azure:
 
 ```
-  # To test ubuntu-pro-images on EC2
+  # To test ubuntu-pro-images
   tox -e behave-azurepro-20.04
-  # To test Canonical cloud images (non-ubuntu-pro) on EC2
+  # To test Canonical cloud images (non-ubuntu-pro)
   tox -e behave-azuregeneric-20.04
 ```
 
@@ -563,7 +584,7 @@ the project, you should install them via `dev-requirements.txt`.)
 ## Daily Builds
 
 On Launchpad, there is a [daily build recipe](https://code.launchpad.net/~canonical-server/+recipe/ua-client-daily),
-which will build the client and place it in the [ua-client-daily PPA](https://code.launchpad.net/~canonical-server/+archive/ubuntu/ua-client-daily).
+which will build the client and place it in the [ua-client-daily PPA](https://code.launchpad.net/~ua-client/+archive/ubuntu/daily).
 
 ## Remastering custom golden images based on Ubuntu PRO
 
diff --git a/RELEASES.md b/RELEASES.md
index 20096a2..3ea848a 100644
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -226,9 +226,11 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
     lxc exec dev-i -- bash /setup_proposed.sh
     ```
 
-    e. Once [ubuntu-advantage-tools shows up in the pending_sru page](https://people.canonical.com/~ubuntu-archive/pending-sru.html), perform the [Ubuntu-advantage-client SRU verification steps](https://wiki.ubuntu.com/UbuntuAdvantageToolsUpdates). This typically involves running all behave targets with `UACLIENT_BEHAVE_ENABLE_PROPOSED=1 UACLIENT_BEHAVE_CHECK_VERSION=<this-version>` and saving the output.
+    e. With the package in proposed, perform the steps from `I.3` above but use a `~stableppaX` suffix instead of `~rcX` in the version name, and upload to `ppa:ua-client/stable` instead of staging.
 
-    f. After all tests have passed, tarball all of the output files and upload them to the SRU bug with a message that looks like this:
+    f. Once [ubuntu-advantage-tools shows up in the pending_sru page](https://people.canonical.com/~ubuntu-archive/pending-sru.html), perform the [Ubuntu-advantage-client SRU verification steps](https://wiki.ubuntu.com/UbuntuAdvantageToolsUpdates). This typically involves running all behave targets with `UACLIENT_BEHAVE_ENABLE_PROPOSED=1 UACLIENT_BEHAVE_CHECK_VERSION=<this-version>` and saving the output.
+
+    g. After all tests have passed, tarball all of the output files and upload them to the SRU bug with a message that looks like this:
     ```
     We have run the full ubuntu-advantage-tools integration test suite against the version in -proposed. The results are attached. All tests passed (or call out specific explained failures).
     
@@ -238,33 +240,23 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
     ```
     Change the tags on the bug from `verification-needed` to `verification-done` (including the verification tags for each release).
 
-    g. For any other related Launchpad bugs that are fixed in this release. Perform the verification steps necessary for those bugs and mark them `verification-done` as needed. This will likely involve following the test steps, but instead of adding the staging PPA, enabling -proposed.
+    h. For any other related Launchpad bugs that are fixed in this release. Perform the verification steps necessary for those bugs and mark them `verification-done` as needed. This will likely involve following the test steps, but instead of adding the staging PPA, enabling -proposed.
 
-    h. Once all SRU bugs are tagged as `verification*-done`, all SRU-bugs should be listed as green in [the pending_sru page](https://people.canonical.com/~ubuntu-archive/pending-sru.html).
+    i. Once all SRU bugs are tagged as `verification*-done`, all SRU-bugs should be listed as green in [the pending_sru page](https://people.canonical.com/~ubuntu-archive/pending-sru.html).
     
-    i. After the pending sru page says that ubuntu-advantage-tools has been in proposed for 7 days, it is now time to ping the [current SRU vanguard](https://wiki.ubuntu.com/StableReleaseUpdates#Publishing) for acceptance of ubuntu-advantage-tools into -updates.
+    j. After the pending sru page says that ubuntu-advantage-tools has been in proposed for 7 days, it is now time to ping the [current SRU vanguard](https://wiki.ubuntu.com/StableReleaseUpdates#Publishing) for acceptance of ubuntu-advantage-tools into -updates.
 
-    j. Ping the Ubuntu Server team member who approved the version in step `II.4` to now upload to the devel release.
+    k. Ping the Ubuntu Server team member who approved the version in step `II.4` to now upload to the devel release.
 
-    k. Check `rmadison ubuntu-advantage-tools` for updated version in devel release
+    l. Check `rmadison ubuntu-advantage-tools` for updated version in devel release
 
-    l. Confirm availability in <devel-series>-updates pocket via `lxc launch ubuntu-daily:<devel-series> dev-i; lxc exec dev-i -- apt update; lxc exec dev-i -- apt-cache policy ubuntu-advantage-tools`
+    m. Confirm availability in <devel-series>-updates pocket via `lxc launch ubuntu-daily:<devel-series> dev-i; lxc exec dev-i -- apt update; lxc exec dev-i -- apt-cache policy ubuntu-advantage-tools`
 
-### III. Final release to team infrastructure
+### III. Github Repository Post-release Update
 
 1. Ensure the version tag is correct on github. The `version` git tag should point to the commit that was released as that version to ubuntu -updates. If changes were made in response to feedback during the release process, the tag may have to be moved.
-2. Perform the steps from `I.3` above but use a `~stableppaX` suffix instead of `~rcX` in the version name, and upload to `ppa:ua-client/stable` instead of staging.
-3. Bring in any changes that were made to the release branch into `main` via PR (e.g. Changelog edits).
-
-## Ubuntu PRO Release Process
+2. Bring in any changes that were made to the release branch into `main` via PR (e.g. Changelog edits).
 
-Below is the procedure used to release ubuntu-advantage-tools to Ubuntu PRO images:
+## Cloud Images Update
 
- 1. [Open Daily PPA copy-package operation](https://code.launchpad.net/~ua-client/+archive/ubuntu/daily/+copy-packages)
- 2. Check Xenial, Bionic, Focal, Hirsute, Impish packages
- 3. Select Destination PPA: UA Client Premium [~ua-client/ubuntu/staging]
- 4. Select Destination series: The same series
- 5. Copy options: "Copy existing binaries"
- 6. Click Copy packages
- 7. Notify Pro Image creators about expected Premium PPA version (patviafore/powersj)
- 8. Once new PRO AMIs are publicly available run `./tools/refresh-aws-pro-ids` to update AMIs we test during CI runs
+After the release process is finished, CPC must be informed. They will be responsible to update the cloud images using the package from the pockets it was released to (whether it is the `stable` PPA or the`-updates` pocket).
diff --git a/apt-hook/json-hook-src/json-hook_test.go b/apt-hook/json-hook-src/json-hook_test.go
index 0a2a2eb..695f323 100644
--- a/apt-hook/json-hook-src/json-hook_test.go
+++ b/apt-hook/json-hook-src/json-hook_test.go
@@ -114,9 +114,9 @@ const mockJson = `
                         "pin": 500,
                         "origins": [
                             {
-                                "archive": "hirsute-apps-security",
-                                "codename": "hirsute",
-                                "version": "21.04",
+                                "archive": "focal-apps-security",
+                                "codename": "focal",
+                                "version": "20.04",
                                 "origin": "UbuntuESMApps",
                                 "label": "Ubuntu",
                                 "site": ""
@@ -130,9 +130,9 @@ const mockJson = `
                         "pin": 500,
                         "origins": [
                             {
-                                "archive": "hirsute-apps-security",
-                                "codename": "hirsute",
-                                "version": "21.04",
+                                "archive": "focal-apps-security",
+                                "codename": "focal",
+                                "version": "20.04",
                                 "origin": "UbuntuESMApps",
                                 "label": "Ubuntu",
                                 "site": ""
@@ -162,9 +162,9 @@ const mockJson = `
                         "pin": 500,
                         "origins": [
                             {
-                                "archive": "hirsute-apps-security",
-                                "codename": "hirsute",
-                                "version": "21.04",
+                                "archive": "focal-apps-security",
+                                "codename": "focal",
+                                "version": "20.04",
                                 "origin": "UbuntuESMApps",
                                 "label": "Ubuntu",
                                 "site": ""
@@ -178,9 +178,9 @@ const mockJson = `
                         "pin": 500,
                         "origins": [
                             {
-                                "archive": "hirsute-apps-security",
-                                "codename": "hirsute",
-                                "version": "21.04",
+                                "archive": "focal-apps-security",
+                                "codename": "focal",
+                                "version": "20.04",
                                 "origin": "UbuntuESMApps",
                                 "label": "Ubuntu",
                                 "site": ""
@@ -210,17 +210,17 @@ const mockJson = `
                         "pin": 500,
                         "origins": [
                             {
-                                "archive": "hirsute-infra-security",
-                                "codename": "hirsute",
-                                "version": "21.04",
+                                "archive": "focal-infra-security",
+                                "codename": "focal",
+                                "version": "20.04",
                                 "origin": "UbuntuESM",
                                 "label": "Ubuntu",
                                 "site": ""
                             },
                             {
-                                "archive": "hirsute",
-                                "codename": "hirsute",
-                                "version": "21.04",
+                                "archive": "focal",
+                                "codename": "focal",
+                                "version": "20.04",
                                 "origin": "Ubuntu",
                                 "label": "Ubuntu",
                                 "site": ""
@@ -234,17 +234,17 @@ const mockJson = `
                         "pin": 500,
                         "origins": [
                             {
-                                "archive": "hirsute-infra-security",
-                                "codename": "hirsute",
-                                "version": "21.04",
+                                "archive": "focal-infra-security",
+                                "codename": "focal",
+                                "version": "20.04",
                                 "origin": "UbuntuESM",
                                 "label": "Ubuntu",
                                 "site": ""
                             },
                             {
-                                "archive": "hirsute",
-                                "codename": "hirsute",
-                                "version": "21.04",
+                                "archive": "focal",
+                                "codename": "focal",
+                                "version": "20.04",
                                 "origin": "Ubuntu",
                                 "label": "Ubuntu",
                                 "site": ""
@@ -274,9 +274,9 @@ const mockJson = `
                         "pin": 500,
                         "origins": [
                             {
-                                "archive": "hirsute-infra-security",
-                                "codename": "hirsute",
-                                "version": "21.04",
+                                "archive": "focal-infra-security",
+                                "codename": "focal",
+                                "version": "20.04",
                                 "origin": "UbuntuESM",
                                 "label": "Ubuntu",
                                 "site": ""
@@ -290,9 +290,9 @@ const mockJson = `
                         "pin": 500,
                         "origins": [
                             {
-                                "archive": "hirsute-infra-security",
-                                "codename": "hirsute",
-                                "version": "21.04",
+                                "archive": "focal-infra-security",
+                                "codename": "focal",
+                                "version": "20.04",
                                 "origin": "UbuntuESM",
                                 "label": "Ubuntu",
                                 "site": ""
@@ -322,8 +322,8 @@ const mockJson = `
                         "pin": 500,
                         "origins": [
                             {
-                                "archive": "hirsute-apps-security",
-                                "codename": "hirsute",
+                                "archive": "focal-apps-security",
+                                "codename": "focal",
                                 "version": "1.0",
                                 "origin": "UbuntuESMApps",
                                 "label": "Google",
@@ -338,8 +338,8 @@ const mockJson = `
                         "pin": 500,
                         "origins": [
                             {
-                                "archive": "hirsute-apps-security",
-                                "codename": "hirsute",
+                                "archive": "focal-apps-security",
+                                "codename": "focal",
                                 "version": "1.0",
                                 "origin": "UbuntuESMApps",
                                 "label": "Google",
@@ -370,9 +370,9 @@ const mockJson = `
                         "pin": 500,
                         "origins": [
                             {
-                                "archive": "hirsute-security",
-                                "codename": "hirsute",
-                                "version": "21.04",
+                                "archive": "focal-security",
+                                "codename": "focal",
+                                "version": "20.04",
                                 "origin": "Ubuntu",
                                 "label": "Ubuntu",
                                 "site": ""
@@ -386,9 +386,9 @@ const mockJson = `
                         "pin": 500,
                         "origins": [
                             {
-                                "archive": "hirsute-security",
-                                "codename": "hirsute",
-                                "version": "21.04",
+                                "archive": "focal-security",
+                                "codename": "focal",
+                                "version": "20.04",
                                 "origin": "Ubuntu",
                                 "label": "Ubuntu",
                                 "site": ""
diff --git a/debian/changelog b/debian/changelog
index 6feeb98..b44d4d9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,41 @@
+ubuntu-advantage-tools (27.7~22.04.1) jammy; urgency=medium
+
+  * d/changelog:
+    - fix changelog trailer line for 27.4.1
+  * d/logrotate:
+    - make new logs world readable
+  * d/tools.postinst:
+    - refactor to catch exception from entitlement_factory
+    - no longer always set log file to only root readable
+    - when creating log file for the first time, make world readable
+    - adapt postinst for new messages module
+  * New upstream release 27.7 (LP: #1964028)
+    - attach: --attach-config option for customizing auto-enabled services
+      and supplying token via a file
+    - auto-attach: fix bug where auto-attach caused a manually attached
+      machine to detach
+    - cli:
+      + support --format=json for attach
+      + support --format=json for detach
+      + support --format=json for enable
+      + support --format=json for disable
+    - contract: include activity info when updating contract
+    - detach: no longer contacts contract server on detach
+    - fips: allow fips on containers
+    - fix: support USNs that don't have related CVEs
+    - logs: make all newly created logs world-readable
+    - security-status:
+      + show already installed esm package counts
+      + include APT origin for each potential update
+      + bump schema version to "0.1"
+      + remove previously required --beta flag
+    - status:
+      + include blocked_by information in service status when format=json
+      + --simulate-with-token now reports expired tokens as errors
+      + --simulate-with-token now returns errors in the specified format
+
+ -- Grant Orndorff <[e-mail]>  Mon, 07 Mar 2022 13:14:57 -0500
+
 ubuntu-advantage-tools (27.6~22.04.1) jammy; urgency=medium
 
   * New upstream release 27.6 (LP: #1958556)
diff --git a/debian/ubuntu-advantage-tools.logrotate b/debian/ubuntu-advantage-tools.logrotate
index 76e6b47..7c64857 100644
--- a/debian/ubuntu-advantage-tools.logrotate
+++ b/debian/ubuntu-advantage-tools.logrotate
@@ -2,6 +2,7 @@
 # of /var/log/ubuntu-advantage*.log files.
 /var/log/ubuntu-advantage*.log {
     su root root
+    create 0644 root root
     rotate 6
     monthly
     compress
diff --git a/debian/ubuntu-advantage-tools.postinst b/debian/ubuntu-advantage-tools.postinst
index 191f0db..c7e1d02 100644
--- a/debian/ubuntu-advantage-tools.postinst
+++ b/debian/ubuntu-advantage-tools.postinst
@@ -119,12 +119,12 @@ check_service_is_beta() {
     _IS_BETA_SVC=$(/usr/bin/python3 -c "
 from uaclient.config import UAConfig
 from uaclient.entitlements import entitlement_factory
-ent_cls = entitlement_factory('${service_name}')
-if ent_cls:
+try:
+    ent_cls = entitlement_factory('${service_name}')
     cfg = UAConfig()
     allow_beta = cfg.features.get('allow_beta', False)
     print(all([ent_cls.is_beta, not allow_beta]))
-else:
+except Exception:
     print(True)
 ")
 if [ "${_IS_BETA_SVC}" = "True" ]; then
@@ -248,16 +248,17 @@ configure_esm() {
 mark_reboot_for_fips_pro() {
     FIPS_HOLDS=$(apt-mark showholds | grep -E 'fips|libssl1|openssh-client|openssh-server|linux-fips|openssl|strongswan' || exit 0)
     if [ "$FIPS_HOLDS" ]; then
-       mark_reboot_cmds_as_needed MESSAGE_FIPS_REBOOT_REQUIRED
+       mark_reboot_cmds_as_needed FIPS_REBOOT_REQUIRED_MSG
     fi
 }
 
 
 add_notice() {
-    msg_name=$1
+    module=$1
+    msg_name=$2
     /usr/bin/python3 -c "
 from uaclient.config import UAConfig
-from uaclient.status import ${msg_name}
+from uaclient.${module} import ${msg_name}
 cfg = UAConfig()
 cfg.add_notice(label='', description=${msg_name})
 "
@@ -268,7 +269,7 @@ mark_reboot_cmds_as_needed() {
     if [ ! -f "$REBOOT_CMD_MARKER_FILE" ]; then
       touch $REBOOT_CMD_MARKER_FILE
     fi
-    add_notice "$msg_name"
+    add_notice messages "$msg_name"
 }
 
 patch_status_json_0_1_for_non_root() {
@@ -303,7 +304,7 @@ notify_wrong_fips_metapackage_on_cloud() {
 
     if echo "$cloud_id" | grep -E -q "^(azure|aws)"; then
       if echo "$fips_installed" | grep -E -q "installed"; then
-        add_notice NOTICE_WRONG_FIPS_METAPACKAGE_ON_CLOUD
+        add_notice status NOTICE_WRONG_FIPS_METAPACKAGE_ON_CLOUD
       fi
     fi
 }
@@ -399,7 +400,7 @@ case "$1" in
       # Repo for FIPS packages changed from old client
       if [ -f $FIPS_APT_SOURCE_FILE ]; then
         if grep -q $OLD_CLIENT_FIPS_PPA $FIPS_APT_SOURCE_FILE; then
-            add_notice MESSAGE_FIPS_INSTALL_OUT_OF_DATE
+            add_notice messages FIPS_INSTALL_OUT_OF_DATE
         fi
       fi
 
@@ -419,15 +420,14 @@ case "$1" in
         fi
       fi
 
-      # We modify permissions for ubuntu-advantage.log because
-      # in a past version of UA, this log file was world readable.
-      # This isn't necessary for the timer/license-check log files,
-      # because they have always been only root-readable.
+      # log files need to be world-readable
       if [ ! -f /var/log/ubuntu-advantage.log ]; then
           touch /var/log/ubuntu-advantage.log
+          # We are only making new log files world readable
+          chmod 0644 /var/log/ubuntu-advantage.log
       fi
-      chmod 0600 /var/log/ubuntu-advantage.log
       chown root:root /var/log/ubuntu-advantage.log
+
       private_dir="/var/lib/ubuntu-advantage/private"
       if [ -d "$private_dir" ]; then
           chmod 0700 "$private_dir"
@@ -435,7 +435,7 @@ case "$1" in
 
       if [ "$VERSION_ID" = "16.04" ]; then
         if echo "$PREVIOUS_PKG_VER" | grep -q "14.04"; then
-          mark_reboot_cmds_as_needed MESSAGE_LIVEPATCH_LTS_REBOOT_REQUIRED
+          mark_reboot_cmds_as_needed LIVEPATCH_LTS_REBOOT_REQUIRED
         fi
       fi
       mark_reboot_for_fips_pro
diff --git a/features/_version.feature b/features/_version.feature
index e265769..b972500 100644
--- a/features/_version.feature
+++ b/features/_version.feature
@@ -6,8 +6,10 @@ Feature: UA is expected version
     @uses.config.machine_type.lxd.vm
     @uses.config.machine_type.aws.generic
     @uses.config.machine_type.aws.pro
+    @uses.config.machine_type.aws.pro.fips
     @uses.config.machine_type.azure.generic
     @uses.config.machine_type.azure.pro
+    @uses.config.machine_type.azure.pro.fips
     @uses.config.machine_type.gcp.generic
     @uses.config.machine_type.gcp.pro
     Scenario Outline: Check ua version
@@ -30,7 +32,6 @@ Feature: UA is expected version
             | xenial  |
             | bionic  |
             | focal   |
-            | hirsute |
             | impish  |
             | jammy   |
 
@@ -58,5 +59,4 @@ Feature: UA is expected version
             | xenial  |
             | bionic  |
             | focal   |
-            | hirsute |
             | impish  |
diff --git a/features/attach_invalidtoken.feature b/features/attach_invalidtoken.feature
index 6ad2d93..59435c2 100644
--- a/features/attach_invalidtoken.feature
+++ b/features/attach_invalidtoken.feature
@@ -15,12 +15,17 @@ Feature: Command behaviour when trying to attach a machine to an Ubuntu
              """
              This command must be run as root (try using sudo).
              """
+        When I verify that running `ua attach invalid-token --format json` `with sudo` exits `1`
+        Then I will see the following on stdout:
+            """
+            {"_schema_version": "0.1", "errors": [{"message": "Invalid token. See https://ubuntu.com/advantage", "message_code": "attach-invalid-token", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+            """
+
         Examples: ubuntu release
            | release |
            | xenial  |
            | bionic  |
            | focal   |
-           | hirsute |
            | impish  |
            | jammy   |
 
@@ -41,6 +46,5 @@ Feature: Command behaviour when trying to attach a machine to an Ubuntu
            | xenial  |
            | bionic  |
            | focal   |
-           | hirsute |
            | impish  |
            | jammy   |
diff --git a/features/attach_validtoken.feature b/features/attach_validtoken.feature
index 8045591..25f763b 100644
--- a/features/attach_validtoken.feature
+++ b/features/attach_validtoken.feature
@@ -3,7 +3,6 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
         subscription using a valid token
 
     @series.jammy
-    @series.hirsute
     @series.impish
     @uses.config.machine_type.lxd.container
     Scenario Outline: Attached command in a non-lts ubuntu machine
@@ -24,7 +23,6 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
 
         Examples: ubuntu release
             | release |
-            | hirsute |
             | impish  |
             | jammy   |
 
@@ -67,8 +65,8 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
         """
         esm-apps     +yes      +enabled  +UA Apps: Extended Security Maintenance \(ESM\)
         esm-infra    +yes      +enabled  +UA Infra: Extended Security Maintenance \(ESM\)
-        fips         +yes      +n/a      +NIST-certified core packages
-        fips-updates +yes      +n/a      +NIST-certified core packages with priority security updates
+        fips         +yes      +disabled +NIST-certified core packages
+        fips-updates +yes      +disabled +NIST-certified core packages with priority security updates
         livepatch    +yes      +n/a      +Canonical Livepatch service
         """
         And stdout matches regexp:
@@ -173,6 +171,115 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
            | bionic  | libkrad0=1.16-2build1       | disabled  | cis        |
            | focal   | hello=2.10-2ubuntu2         | n/a       | usg        |
 
+    @series.lts
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Attach command with attach config
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        # simplest happy path
+        When I create the file `/tmp/attach.yaml` with the following
+        """
+        token: <contract_token>
+        """
+        When I replace `<contract_token>` in `/tmp/attach.yaml` with token `contract_token`
+        When I run `ua attach --attach-config /tmp/attach.yaml` with sudo
+        Then stdout matches regexp:
+        """
+        esm-apps +yes +enabled
+        """
+        And stdout matches regexp:
+        """
+        esm-infra +yes +enabled
+        """
+        And stdout matches regexp:
+        """
+        <cis_or_usg> +yes +disabled
+        """
+        When I run `ua detach --assume-yes` with sudo
+        # don't allow both token on cli and config
+        Then I verify that running `ua attach TOKEN --attach-config /tmp/attach.yaml` `with sudo` exits `1`
+        Then stderr matches regexp:
+        """
+        Do not pass the TOKEN arg if you are using --attach-config.
+        Include the token in the attach-config file instead.
+        """
+        # happy path with service overrides
+        When I create the file `/tmp/attach.yaml` with the following
+        """
+        token: <contract_token>
+        enable_services:
+          - esm-apps
+          - <cis_or_usg>
+        """
+        When I replace `<contract_token>` in `/tmp/attach.yaml` with token `contract_token`
+        When I run `ua attach --attach-config /tmp/attach.yaml` with sudo
+        Then stdout matches regexp:
+        """
+        esm-apps +yes +enabled
+        """
+        And stdout matches regexp:
+        """
+        esm-infra +yes +disabled
+        """
+        And stdout matches regexp:
+        """
+        <cis_or_usg> +yes +enabled
+        """
+        When I run `ua detach --assume-yes` with sudo
+        # missing token
+        When I create the file `/tmp/attach.yaml` with the following
+        """
+        enable_services:
+          - esm-apps
+          - <cis_or_usg>
+        """
+        Then I verify that running `ua attach --attach-config /tmp/attach.yaml` `with sudo` exits `1`
+        Then stderr matches regexp:
+        """
+        Error while reading /tmp/attach.yaml: Got value with incorrect type for field
+        "token": Expected value with type StringDataValue but got value: None
+        """
+        # other schema error
+        When I create the file `/tmp/attach.yaml` with the following
+        """
+        token: <contract_token>
+        enable_services: {cis: true}
+        """
+        When I replace `<contract_token>` in `/tmp/attach.yaml` with token `contract_token`
+        Then I verify that running `ua attach --attach-config /tmp/attach.yaml` `with sudo` exits `1`
+        Then stderr matches regexp:
+        """
+        Error while reading /tmp/attach.yaml: Got value with incorrect type for field
+        "enable_services": Expected value with type list but got value: {\'cis\': True}
+        """
+        # invalid service name
+        When I create the file `/tmp/attach.yaml` with the following
+        """
+        token: <contract_token>
+        enable_services:
+          - esm-apps
+          - nonexistent
+          - nonexistent2
+        """
+        When I replace `<contract_token>` in `/tmp/attach.yaml` with token `contract_token`
+        Then I verify that running `ua attach --attach-config /tmp/attach.yaml` `with sudo` exits `1`
+        Then stdout matches regexp:
+        """
+        esm-apps +yes +enabled
+        """
+        And stdout matches regexp:
+        """
+        esm-infra +yes +disabled
+        """
+        Then stderr matches regexp:
+        """
+        Cannot enable unknown service 'nonexistent, nonexistent2'.
+        """
+        Examples: ubuntu
+           | release | cis_or_usg |
+           | xenial  | cis        |
+           | bionic  | cis        |
+           | focal   | usg        |
+
     @series.all
     @uses.config.machine_type.aws.generic
     Scenario Outline: Attach command in an generic AWS Ubuntu VM
@@ -231,7 +338,7 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
            | release | fips_status |lp_status | lp_desc                       | cc_status | cis_or_usg |
            | xenial  | disabled    |enabled   | Canonical Livepatch service   | disabled  | cis        |
            | bionic  | disabled    |enabled   | Canonical Livepatch service   | disabled  | cis        |
-           | focal   | n/a         |enabled   | Canonical Livepatch service   | n/a       | usg        |
+           | focal   | disabled    |enabled   | Canonical Livepatch service   | n/a       | usg        |
 
     @series.all
     @uses.config.machine_type.azure.generic
@@ -290,8 +397,8 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
         Examples: ubuntu release livepatch status
            | release | lp_status | fips_status | cc_status | cis_or_usg |
            | xenial  | enabled   | n/a         | disabled  | cis        |
-           | bionic  | n/a       | disabled    | disabled  | cis        |
-           | focal   | enabled   | n/a         | n/a       | usg        |
+           | bionic  | enabled   | disabled    | disabled  | cis        |
+           | focal   | enabled   | disabled    | n/a       | usg        |
 
     @series.all
     @uses.config.machine_type.gcp.generic
@@ -351,4 +458,39 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
            | release | lp_status | fips_status | cc_status | cis_or_usg |
            | xenial  | n/a       | n/a         | disabled  | cis        |
            | bionic  | n/a       | disabled    | disabled  | cis        |
-           | focal   | enabled   | n/a         | n/a       | usg        |
+           | focal   | enabled   | disabled    | n/a       | usg        |
+
+    @series.all
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Attach command with json output
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I verify that running attach `as non-root` with json response exits `1`
+        Then I will see the following on stdout:
+            """
+            {"_schema_version": "0.1", "errors": [{"message": "This command must be run as root (try using sudo).", "message_code": "nonroot-user", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+            """
+        When I verify that running attach `with sudo` with json response exits `0`
+        Then I will see the following on stdout:
+            """
+            {"_schema_version": "0.1", "errors": [], "failed_services": [], "needs_reboot": false, "processed_services": ["esm-apps", "esm-infra"], "result": "success", "warnings": []}
+            """
+        When I run `ua status` with sudo
+        Then stdout matches regexp:
+        """
+        SERVICE       ENTITLED  STATUS    DESCRIPTION
+        cc-eal        +yes +<cc-eal>  +Common Criteria EAL2 Provisioning Packages
+        """
+        And stdout matches regexp:
+        """
+        esm-apps      +yes +enabled +UA Apps: Extended Security Maintenance \(ESM\)
+        esm-infra     +yes +enabled +UA Infra: Extended Security Maintenance \(ESM\)
+        fips          +yes +disabled +NIST-certified core packages
+        fips-updates  +yes +disabled +NIST-certified core packages with priority security updates
+        livepatch     +yes +n/a  +Canonical Livepatch service
+        """
+
+        Examples: ubuntu release
+          | release | cc-eal   |
+          | xenial  | disabled |
+          | bionic  | disabled |
+          | focal   | n/a      |
diff --git a/features/attached_commands.feature b/features/attached_commands.feature
index ca536dd..dd6cf1a 100644
--- a/features/attached_commands.feature
+++ b/features/attached_commands.feature
@@ -38,7 +38,9 @@ Feature: Command behaviour when attached to an UA subscription
         And I run `sh -c "ls /var/log/ubuntu-advantage* | sort -d"` as non-root
         Then stdout matches regexp:
         """
+        /var/log/ubuntu-advantage.log
         /var/log/ubuntu-advantage.log.1
+        /var/log/ubuntu-advantage-timer.log
         /var/log/ubuntu-advantage-timer.log.1
         """
 
@@ -47,79 +49,89 @@ Feature: Command behaviour when attached to an UA subscription
            | bionic  |
            | focal   |
            | xenial  |
-           | hirsute |
            | impish  |
            | jammy   |
 
-    @series.all
-    @uses.config.machine_type.lxd.container
-    Scenario Outline: Attached and detach correctly reach contract endpoint
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token` with sudo
-        And I run `ua detach --assume-yes` with sudo
-        Then I verify that running `grep "Found new machine-id. Do not call detach on contract backend" /var/log/ubuntu-advantage.log` `with sudo` exits `1`
-
-        Examples: ubuntu release
-           | release |
-           | bionic  |
-           | focal   |
-           | xenial  |
-           | hirsute |
-           | impish  |
-           | jammy   |
 
     @series.all
     @uses.config.machine_type.lxd.container
-    Scenario Outline: Attached and detach don't reach contract endpoint if machine-id changes
+    Scenario Outline: Attached disable of an already disabled service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
-        And I update contract to use `machineId` as `new-machine-id`
-        And I run `ua detach --assume-yes` with sudo
-        Then stdout matches regexp:
+        Then I verify that running `ua disable livepatch` `as non-root` exits `1`
+        And stderr matches regexp:
             """
-            This machine is now detached.
+            This command must be run as root \(try using sudo\).
+            """
+        And I verify that running `ua disable livepatch` `with sudo` exits `1`
+        And I will see the following on stdout:
+            """
+            Livepatch is not currently enabled
+            See: sudo ua status
             """
-        And I verify that running `grep "Found new machine-id. Do not call detach on contract backend" /var/log/ubuntu-advantage.log` `with sudo` exits `0`
-        When I run `ua status` with sudo
-        Then stdout matches regexp:
-          """
-          This machine is not attached to a UA subscription.
-          """
 
         Examples: ubuntu release
            | release |
            | bionic  |
            | focal   |
            | xenial  |
-           | hirsute |
            | impish  |
            | jammy   |
 
-    @series.all
+    @series.lts
     @uses.config.machine_type.lxd.container
-    Scenario Outline: Attached disable of an already disabled service in a ubuntu machine
+    Scenario Outline: Attached disable with json format
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
-        Then I verify that running `ua disable livepatch` `as non-root` exits `1`
-        And stderr matches regexp:
+        Then I verify that running `ua disable foobar --format json` `as non-root` exits `1`
+        And stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
             """
-            This command must be run as root \(try using sudo\).
+            {"_schema_version": "0.1", "errors": [{"message": "json formatted response requires --assume-yes flag.", "message_code": "json-format-require-assume-yes", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
             """
-        And I verify that running `ua disable livepatch` `with sudo` exits `1`
+        Then I verify that running `ua disable foobar --format json` `with sudo` exits `1`
+        And stdout is a json matching the `ua_operation` schema
         And I will see the following on stdout:
             """
-            Livepatch is not currently enabled
-            See: sudo ua status
+            {"_schema_version": "0.1", "errors": [{"message": "json formatted response requires --assume-yes flag.", "message_code": "json-format-require-assume-yes", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+            """
+        Then I verify that running `ua disable foobar --format json --assume-yes` `as non-root` exits `1`
+        And stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+            """
+            {"_schema_version": "0.1", "errors": [{"message": "This command must be run as root (try using sudo).", "message_code": "nonroot-user", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+            """
+        And I verify that running `ua disable foobar --format json --assume-yes` `with sudo` exits `1`
+        And stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+            """
+            {"_schema_version": "0.1", "errors": [{"message": "Cannot disable unknown service 'foobar'.\nTry <valid_services>", "message_code": "invalid-service-or-failure", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
             """
+        And I verify that running `ua disable livepatch --format json --assume-yes` `with sudo` exits `1`
+        And stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+        """
+        {"_schema_version": "0.1", "errors": [{"message": "Livepatch is not currently enabled\nSee: sudo ua status", "message_code": "service-already-disabled", "service": "livepatch", "type": "service"}], "failed_services": ["livepatch"], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+        """
+        And I verify that running `ua disable esm-infra esm-apps --format json --assume-yes` `with sudo` exits `0`
+        And stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+        """
+        {"_schema_version": "0.1", "errors": [], "failed_services": [], "needs_reboot": false, "processed_services": ["esm-apps", "esm-infra"], "result": "success", "warnings": []}
+        """
+        When I run `ua enable esm-infra` with sudo
+        Then I verify that running `ua disable esm-infra foobar --format json --assume-yes` `with sudo` exits `1`
+        And stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+        """
+        {"_schema_version": "0.1", "errors": [{"message": "Cannot disable unknown service 'foobar'.\nTry <valid_services>", "message_code": "invalid-service-or-failure", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": ["esm-infra"], "result": "failure", "warnings": []}
+        """
 
         Examples: ubuntu release
-           | release |
-           | bionic  |
-           | focal   |
-           | xenial  |
-           | hirsute |
-           | impish  |
-           | jammy   |
+           | release | valid_services                                                                      |
+           | xenial  | cc-eal, cis, esm-apps, esm-infra, fips, fips-updates, livepatch, ros,\nros-updates. |
+           | bionic  | cc-eal, cis, esm-apps, esm-infra, fips, fips-updates, livepatch, ros,\nros-updates. |
+           | focal   | cc-eal, esm-apps, esm-infra, fips, fips-updates, livepatch, ros,\nros-updates, usg. |
 
     @series.xenial
     @series.bionic
@@ -241,6 +253,31 @@ Feature: Command behaviour when attached to an UA subscription
           This machine is not attached to a UA subscription.
           """
        And I verify that running `apt update` `with sudo` exits `0`
+       When I attach `contract_token` with sudo
+       Then I verify that running `ua enable foobar --format json` `as non-root` exits `1`
+       And stdout is a json matching the `ua_operation` schema
+       And I will see the following on stdout:
+           """
+           {"_schema_version": "0.1", "errors": [{"message": "json formatted response requires --assume-yes flag.", "message_code": "json-format-require-assume-yes", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+            """
+       Then I verify that running `ua enable foobar --format json` `with sudo` exits `1`
+       And stdout is a json matching the `ua_operation` schema
+       And I will see the following on stdout:
+           """
+           {"_schema_version": "0.1", "errors": [{"message": "json formatted response requires --assume-yes flag.", "message_code": "json-format-require-assume-yes", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+           """
+       Then I verify that running `ua detach --format json --assume-yes` `as non-root` exits `1`
+       And stdout is a json matching the `ua_operation` schema
+       And I will see the following on stdout:
+           """
+           {"_schema_version": "0.1", "errors": [{"message": "This command must be run as root (try using sudo).", "message_code": "nonroot-user", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+           """
+       When I run `ua detach --format json --assume-yes` with sudo
+       Then stdout is a json matching the `ua_operation` schema
+       And I will see the following on stdout:
+           """
+           {"_schema_version": "0.1", "errors": [], "failed_services": [], "needs_reboot": false, "processed_services": ["esm-apps", "esm-infra"], "result": "success", "warnings": []}
+           """
 
        Examples: ubuntu release
            | release | esm-apps | cc-eal | cis | fips | fips-update | ros | cis_or_usg |
@@ -269,7 +306,6 @@ Feature: Command behaviour when attached to an UA subscription
            | bionic  |
            | focal   |
            | xenial  |
-           | hirsute |
            | impish  |
            | jammy   |
 
@@ -292,7 +328,6 @@ Feature: Command behaviour when attached to an UA subscription
            | bionic  |
            | focal   |
            | xenial  |
-           | hirsute |
            | impish  |
            | jammy   |
 
@@ -344,7 +379,6 @@ Feature: Command behaviour when attached to an UA subscription
            | bionic  |
            | focal   |
            | xenial  |
-           | hirsute |
            | impish  |
            | jammy   |
 
@@ -534,7 +568,6 @@ Feature: Command behaviour when attached to an UA subscription
            | release | infra-status |
            | bionic  | enabled      |
            | xenial  | enabled      |
-           | hirsute | n/a          |
            | impish  | n/a          |
            | jammy   | n/a          |
 
@@ -751,7 +784,6 @@ Feature: Command behaviour when attached to an UA subscription
            | xenial  |
            | bionic  |
            | focal   |
-           | hirsute |
            | impish  |
            | jammy   |
 
@@ -884,14 +916,11 @@ Feature: Command behaviour when attached to an UA subscription
             """
         And I run `dpkg-reconfigure ubuntu-advantage-tools` with sudo
         And I run `apt-get update` with sudo
-        When I run `ua security-status --format json --beta` as non-root
-        Then stdout is formatted as `json` and has keys:
-        """
-        _schema_version summary packages
-        """
+        When I run `ua security-status --format json` as non-root
+        Then stdout is a json matching the `ua_security_status` schema
         And stdout matches regexp:
         """
-        "_schema_version": "0"
+        "_schema_version": "0.1"
         """
         And stdout matches regexp:
         """
@@ -915,13 +944,17 @@ Feature: Command behaviour when attached to an UA subscription
         """
         And stdout matches regexp:
         """
+        "origin": "esm.ubuntu.com"
+        """
+        And stdout matches regexp:
+        """
         "status": "pending_attach"
         """
         When I attach `contract_token` with sudo
-        And I run `ua security-status --format json --beta` as non-root
+        And I run `ua security-status --format json` as non-root
         Then stdout matches regexp:
         """
-        "_schema_version": "0"
+        "_schema_version": "0.1"
         """
         And stdout matches regexp:
         """
@@ -939,32 +972,23 @@ Feature: Command behaviour when attached to an UA subscription
         """
         "status": "upgrade_available"
         """
-        When I run `ua security-status --format yaml --beta` as non-root
-        Then stdout is formatted as `yaml` and has keys:
-        """
-        _schema_version summary packages
-        """
+        When I run `ua security-status --format yaml` as non-root
+        Then stdout is a yaml matching the `ua_security_status` schema
         And stdout matches regexp:
         """
-        _schema_version: '0'
-        """
-        When I verify that running `ua security-status --format json` `as non-root` exits `2`
-        Then I will see the following on stderr:
-        """
-        usage: security-status [-h] --format {json,yaml} --beta
-        the following arguments are required: --beta
+        _schema_version: '0.1'
         """
-        When I verify that running `ua security-status --format unsupported --beta` `as non-root` exits `2`
+        When I verify that running `ua security-status --format unsupported` `as non-root` exits `2`
         Then I will see the following on stderr:
         """
-        usage: security-status [-h] --format {json,yaml} --beta
+        usage: security-status [-h] --format {json,yaml}
         argument --format: invalid choice: 'unsupported' (choose from 'json', 'yaml')
         """
         When I verify that running `ua security-status` `as non-root` exits `2`
         Then I will see the following on stderr:
         """
-        usage: security-status [-h] --format {json,yaml} --beta
-        the following arguments are required: --format, --beta
+        usage: security-status [-h] --format {json,yaml}
+        the following arguments are required: --format
         """
         Examples: ubuntu release
            | release | package   | service   |
diff --git a/features/attached_enable.feature b/features/attached_enable.feature
index 2fda0de..90a62cb 100644
--- a/features/attached_enable.feature
+++ b/features/attached_enable.feature
@@ -29,7 +29,6 @@ Feature: Enable command behaviour when attached to an UA subscription
             | bionic  |
 
     @series.focal
-    @series.hirsute
     @series.impish
     @uses.config.machine_type.lxd.container
     Scenario Outline: Attached enable Common Criteria service in an ubuntu lxd container
@@ -49,11 +48,80 @@ Feature: Enable command behaviour when attached to an UA subscription
         Examples: ubuntu release
             | release | version    | full_name     |
             | focal   | 20.04 LTS  | Focal Fossa   |
-            | hirsute | 21.04      | Hirsute Hippo |
             | impish  | 21.10      | Impish Indri  |
 
     @series.xenial
     @series.bionic
+    @series.focal
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Attached enable of different services using json format
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable foobar --format json` `as non-root` exits `1`
+        And stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+            """
+            {"_schema_version": "0.1", "errors": [{"message": "json formatted response requires --assume-yes flag.", "message_code": "json-format-require-assume-yes", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+            """
+        Then I verify that running `ua enable foobar --format json` `with sudo` exits `1`
+        And stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+            """
+            {"_schema_version": "0.1", "errors": [{"message": "json formatted response requires --assume-yes flag.", "message_code": "json-format-require-assume-yes", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+            """
+        Then I verify that running `ua enable foobar --format json --assume-yes` `as non-root` exits `1`
+        And stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+            """
+            {"_schema_version": "0.1", "errors": [{"message": "This command must be run as root (try using sudo).", "message_code": "nonroot-user", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+            """
+        And I verify that running `ua enable foobar --format json --assume-yes` `with sudo` exits `1`
+        And stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+            """
+            {"_schema_version": "0.1", "errors": [{"message": "Cannot enable unknown service 'foobar'.\nTry <valid_services>", "message_code": "invalid-service-or-failure", "service": null, "type": "system"}], "failed_services": ["foobar"], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+            """
+        And I verify that running `ua enable ros foobar --format json --assume-yes` `with sudo` exits `1`
+        And stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+        """
+        {"_schema_version": "0.1", "errors": [{"message": "Cannot enable unknown service 'foobar, ros'.\nTry <valid_services>", "message_code": "invalid-service-or-failure", "service": null, "type": "system"}], "failed_services": ["foobar", "ros"], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+        """
+        And I verify that running `ua enable esm-infra --format json --assume-yes` `with sudo` exits `1`
+        And stdout is a json matching the `ua_operation` schema
+        Then I will see the following on stdout:
+            """
+            {"_schema_version": "0.1", "errors": [{"message": "UA Infra: ESM is already enabled.\nSee: sudo ua status", "message_code": "service-already-enabled", "service": "esm-infra", "type": "service"}], "failed_services": ["esm-infra"], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+            """
+        When I run `ua disable esm-infra` with sudo
+        And I run `ua enable esm-infra --format json --assume-yes` with sudo
+        Then stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+        """
+        {"_schema_version": "0.1", "errors": [], "failed_services": [], "needs_reboot": false, "processed_services": ["esm-infra"], "result": "success", "warnings": []}
+        """
+        When I run `ua disable esm-infra` with sudo
+        And I verify that running `ua enable esm-infra foobar --format json --assume-yes` `with sudo` exits `1`
+        Then stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+        """
+        {"_schema_version": "0.1", "errors": [{"message": "Cannot enable unknown service 'foobar'.\nTry <valid_services>", "message_code": "invalid-service-or-failure", "service": null, "type": "system"}], "failed_services": ["foobar"], "needs_reboot": false, "processed_services": ["esm-infra"], "result": "failure", "warnings": []}
+        """
+        When I run `ua disable esm-infra esm-apps` with sudo
+        And I run `ua enable esm-infra esm-apps --beta --format json --assume-yes` with sudo
+        Then stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+        """
+        {"_schema_version": "0.1", "errors": [], "failed_services": [], "needs_reboot": false, "processed_services": ["esm-apps", "esm-infra"], "result": "success", "warnings": []}
+        """
+
+        Examples: ubuntu release
+           | release | valid_services                                         |
+           | xenial  | cc-eal, cis, esm-infra, fips, fips-updates, livepatch. |
+           | bionic  | cc-eal, cis, esm-infra, fips, fips-updates, livepatch. |
+           | focal   | cc-eal, esm-infra, fips, fips-updates, livepatch, usg. |
+
+    @series.lts
     @uses.config.machine_type.lxd.container
     Scenario Outline: Attached enable of a service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
@@ -84,7 +152,7 @@ Feature: Enable command behaviour when attached to an UA subscription
             Try cc-eal, cis, esm-infra, fips, fips-updates, livepatch.
             """
         And I verify that running `ua enable esm-infra` `with sudo` exits `1`
-        Then I will see the following on stdout:
+        And I will see the following on stdout:
             """
             One moment, checking your subscription first
             UA Infra: ESM is already enabled.
@@ -176,25 +244,12 @@ Feature: Enable command behaviour when attached to an UA subscription
             One moment, checking your subscription first
             Cannot install Livepatch on a container.
             """
-        And I verify that running `ua enable fips --assume-yes` `with sudo` exits `1`
-        And I will see the following on stdout:
-            """
-            One moment, checking your subscription first
-            Cannot install FIPS on a container.
-            """
-        And I verify that running `ua enable fips-updates --assume-yes` `with sudo` exits `1`
-        And I will see the following on stdout:
-            """
-            One moment, checking your subscription first
-            Cannot install FIPS Updates on a container.
-            """
 
         Examples: Un-supported services in containers
            | release |
            | bionic  |
            | focal   |
            | xenial  |
-           | hirsute |
            | impish  |
            | jammy   |
 
@@ -495,7 +550,7 @@ Feature: Enable command behaviour when attached to an UA subscription
         """
         When I run `ua disable livepatch` with sudo
         Then I verify that running `canonical-livepatch status` `with sudo` exits `1`
-        And stdout matches regexp:
+        And stderr matches regexp:
         """
         Machine is not enabled. Please run 'sudo canonical-livepatch enable' with the
         token obtained from https://ubuntu.com/livepatch.
@@ -581,6 +636,11 @@ Feature: Enable command behaviour when attached to an UA subscription
             One moment, checking your subscription first
             Cannot enable Livepatch when FIPS is enabled.
             """
+        Then I verify that running `ua enable livepatch --format json --assume-yes` `with sudo` exits `1`
+        And I will see the following on stdout
+            """
+            {"_schema_version": "0.1", "errors": [{"message": "Cannot enable Livepatch when FIPS is enabled.", "message_code": "livepatch-error-when-fips-enabled", "service": "livepatch", "type": "service"}], "failed_services": ["livepatch"], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+            """
 
     @series.bionic
     @uses.config.machine_type.lxd.vm
@@ -603,11 +663,14 @@ Feature: Enable command behaviour when attached to an UA subscription
         And I will see the following on stdout
             """
             One moment, checking your subscription first
-            """
-        And I will see the following on stderr
-            """
             Cannot enable FIPS when Livepatch is enabled.
             """
+        Then I verify that running `ua enable fips --assume-yes --format json` `with sudo` exits `1`
+        And stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+        """
+        {"_schema_version": "0.1", "errors": [{"message": "Cannot enable FIPS when Livepatch is enabled.", "service": "fips", "type": "service"}], "failed_services": ["fips"], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+        """
 
     @slow
     @series.xenial
@@ -688,7 +751,8 @@ Feature: Enable command behaviour when attached to an UA subscription
            | bionic  |
            | xenial  |
 
-    @series.lts
+    @series.xenial
+    @series.bionic
     @uses.config.contract_token
     @uses.config.machine_type.lxd.container
     Scenario Outline: Attached enable ros on a machine
@@ -741,7 +805,6 @@ Feature: Enable command behaviour when attached to an UA subscription
         ROS ESM Security Updates cannot be enabled with UA Apps: ESM disabled.
         Enable UA Apps: ESM and proceed to enable ROS ESM Security Updates\? \(y\/N\) Cannot enable ROS ESM Security Updates when UA Apps: ESM is disabled.
         """
-
         When I run `ua enable ros --beta` `with sudo` and stdin `y`
         Then stdout matches regexp
         """
diff --git a/features/attached_status.feature b/features/attached_status.feature
index 78483ed..59406e7 100644
--- a/features/attached_status.feature
+++ b/features/attached_status.feature
@@ -7,25 +7,14 @@ Feature: Attached status
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
         And I run `ua status --format json` as non-root
-        Then stdout is formatted as `json` and has keys:
-            """
-            _doc _schema_version account attached config config_path contract effective
-            environment_vars execution_details execution_status expires machine_id notices
-            services version simulated
-            """
+        Then stdout is a json matching the `ua_status` schema
         When I run `ua status --format yaml` as non-root
-        Then stdout is formatted as `yaml` and has keys:
-            """
-            _doc _schema_version account attached config config_path contract effective
-            environment_vars execution_details execution_status expires machine_id notices
-            services version simulated
-            """
+        Then stdout is a yaml matching the `ua_status` schema
 
         Examples: ubuntu release
            | release |
            | bionic  |
            | focal   |
            | xenial  |
-           | hirsute |
            | impish  |
            | jammy   |
diff --git a/features/aws-ids.yaml b/features/aws-ids.yaml
index e0198a7..f2376ad 100644
--- a/features/aws-ids.yaml
+++ b/features/aws-ids.yaml
@@ -1,3 +1,5 @@
-bionic: ami-094e9c95623db463c
-focal: ami-0193aa0a9df84a08b
-xenial: ami-06e94647aeaed1e5c
+bionic: ami-0419d66039473da9d
+bionic-fips: ami-03b75f613f80bcff1
+focal: ami-0489b8bdbbf3a3b32
+xenial: ami-011bcfe2bea365b6a
+xenial-fips: ami-077e4c339a098fc9f
diff --git a/features/azure-ids.yaml b/features/azure-ids.yaml
index 4d43f80..735223f 100644
--- a/features/azure-ids.yaml
+++ b/features/azure-ids.yaml
@@ -1,3 +1,5 @@
 bionic: "Canonical:0001-com-ubuntu-pro-bionic:pro-18_04-lts"
 focal: "Canonical:0001-com-ubuntu-pro-focal:pro-20_04-lts"
 xenial: "Canonical:0001-com-ubuntu-pro-xenial:pro-16_04-lts"
+bionic-fips: "Canonical:0001-com-ubuntu-pro-bionic-fips:pro-fips-18_04"
+xenial-fips: "Canonical:0001-com-ubuntu-pro-xenial-fips:pro-fips-16_04-private"
diff --git a/features/cloud.py b/features/cloud.py
index 4938374..b0df204 100644
--- a/features/cloud.py
+++ b/features/cloud.py
@@ -218,7 +218,10 @@ class Cloud:
         if "pro" in self.machine_type:
             with open(self.pro_ids_path, "r") as stream:
                 pro_ids = yaml.safe_load(stream.read())
-            image_name = pro_ids[series]
+            if "fips" in self.machine_type:
+                image_name = pro_ids[series + "-fips"]
+            else:
+                image_name = pro_ids[series]
         else:
             image_name = self.api.daily_image(release=series)
 
@@ -539,7 +542,7 @@ class Azure(Cloud):
             List of ports to open for network ingress to the instance
 
         :returns:
-            An AWS cloud provider instance
+            An Azure cloud provider instance
         """
         if not image_name:
             image_name = self.locate_image_name(series)
@@ -654,7 +657,7 @@ class GCP(Cloud):
             List of ports to open for network ingress to the instance
 
         :returns:
-            An AWS cloud provider instance
+            An GCP cloud provider instance
         """
         if not image_name:
             image_name = self.locate_image_name(series)
diff --git a/features/detached_auto_attach.feature b/features/detached_auto_attach.feature
 new file mode 100644
index 0000000..463400a
--- /dev/null
+++ b/features/detached_auto_attach.feature
@@ -0,0 +1,32 @@
[e-mail]_token
+Feature: Attached cloud does not detach when auto-attaching after manually attaching
+
+    @series.all
+    @uses.config.machine_type.aws.generic
+    @uses.config.machine_type.azure.generic
+    @uses.config.machine_type.gcp.generic
+    Scenario Outline: No detaching on manually attached machine on all clouds
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua refresh` with sudo
+        Then I will see the following on stdout:
+            """
+            Successfully processed your ua configuration.
+            Successfully refreshed your subscription.
+            """
+        When I run `ua auto-attach` with sudo
+        Then stderr matches regexp:
+        """
+        Skipping attach: Instance '[0-9a-z\-]+' is already attached.
+        """
+        When I run `ua status` with sudo
+        Then stdout matches regexp:
+        """
+        esm-infra    +yes      +<esm-service> +UA Infra: Extended Security Maintenance \(ESM\)
+        """
+
+        Examples: ubuntu release
+           | release | esm-service |
+           | bionic  | enabled     |
+           | focal   | enabled     |
+           | xenial  | enabled     |
diff --git a/features/enable_fips_container.feature b/features/enable_fips_container.feature
 new file mode 100644
index 0000000..8519480
--- /dev/null
+++ b/features/enable_fips_container.feature
@@ -0,0 +1,144 @@
+
[e-mail]_token
+Feature: FIPS enablement in lxd containers
+
+    @series.xenial
+    @series.bionic
+    @series.focal
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Attached enable of FIPS in an ubuntu lxd container
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan openssl <libssl> libgcrypt20` with sudo, retrying exit [100]
+        And I run `ua enable fips<updates>` `with sudo` and stdin `y`
+        Then stdout matches regexp:
+            """
+            Warning: Enabling <fips-name> in a container.
+                     This will install the FIPS packages but not the kernel.
+                     This container must run on a host with <fips-name> enabled to be
+                     compliant.
+            Warning: This action can take some time and cannot be undone.
+            """
+        And stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install.
+            Please run `apt upgrade` to ensure all FIPS packages are updated to the correct
+            version.
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            fips<updates> +yes                enabled
+            """
+        And stdout matches regexp:
+            """
+            FIPS support requires system reboot to complete configuration
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that `openssh-server` is installed from apt source `https://esm.ubuntu.com/fips<updates>/ubuntu <release><updates>/main`
+        And I verify that `openssh-client` is installed from apt source `https://esm.ubuntu.com/fips<updates>/ubuntu <release><updates>/main`
+        And I verify that `strongswan` is installed from apt source `https://esm.ubuntu.com/fips<updates>/ubuntu <release><updates>/main`
+        And I verify that `strongswan-hmac` is installed from apt source `https://esm.ubuntu.com/fips<updates>/ubuntu <release><updates>/main`
+        And I verify that `openssl` is installed from apt source `https://esm.ubuntu.com/fips<updates>/ubuntu <release><updates>/main`
+        And I verify that `<libssl>` is installed from apt source `https://esm.ubuntu.com/fips<updates>/ubuntu <release><updates>/main`
+        And I verify that `<libssl>-hmac` is installed from apt source `https://esm.ubuntu.com/fips<updates>/ubuntu <release><updates>/main`
+        And I verify that `<additional-fips-packages>` are installed from apt source `https://esm.ubuntu.com/fips<updates>/ubuntu <release><updates>/main`
+        When I reboot the `<release>` machine
+        When I run `ua status --all` with sudo
+        Then stdout does not match regexp:
+            """
+            FIPS support requires system reboot to complete configuration
+            """
+        When I run `ua disable fips<updates>` `with sudo` and stdin `y`
+        Then stdout matches regexp:
+            """
+            This will disable the FIPS entitlement but the FIPS packages will remain installed.
+            """
+        And stdout matches regexp:
+            """
+            Updating package lists
+            """
+        And stdout does not match regexp:
+            """
+            A reboot is required to complete disable operation
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            fips<updates> +yes                disabled
+            """
+        Then stdout does not match regexp:
+            """
+            Disabling FIPS requires system reboot to complete operation
+            """
+        When I run `apt-cache policy ubuntu-fips` as non-root
+        Then stdout does not match regexp:
+            """
+            .*Installed: \(none\)
+            """
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
+        And I verify that `openssl` installed version matches regexp `fips`
+        And I verify that `<libssl>` installed version matches regexp `fips`
+        And I verify that `<libssl>-hmac` installed version matches regexp `fips`
+        And I verify that packages `<additional-fips-packages>` installed versions match regexp `fips`
+
+        Examples: ubuntu release
+           | release | fips-name    | updates  | libssl      | additional-fips-packages                                             |
+           | xenial  | FIPS         |          | libssl1.0.0 | openssh-server-hmac openssh-client-hmac                              |
+           | xenial  | FIPS Updates | -updates | libssl1.0.0 | openssh-server-hmac openssh-client-hmac                              |
+           | bionic  | FIPS         |          | libssl1.1   | openssh-server-hmac openssh-client-hmac libgcrypt20 libgcrypt20-hmac |
+           | bionic  | FIPS Updates | -updates | libssl1.1   | openssh-server-hmac openssh-client-hmac libgcrypt20 libgcrypt20-hmac |
+           | focal   | FIPS         |          | libssl1.1   | libgcrypt20 libgcrypt20-hmac                                         |
+           | focal   | FIPS Updates | -updates | libssl1.1   | libgcrypt20 libgcrypt20-hmac                                         |
+
+    @series.xenial
+    @series.bionic
+    @series.focal
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Try to enable FIPS after FIPS Updates in a lxd container
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            fips-updates +yes +disabled
+            """
+        And stdout matches regexp:
+            """
+            fips +yes +disabled
+            """
+        When I run `ua enable fips-updates --assume-yes` with sudo
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            fips-updates +yes +enabled
+            """
+        And stdout matches regexp:
+            """
+            fips +yes +n/a
+            """
+        When I verify that running `ua enable fips --assume-yes` `with sudo` exits `1`
+        Then stdout matches regexp:
+            """
+            Cannot enable FIPS when FIPS Updates is enabled.
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            fips-updates +yes +enabled
+            """
+        And stdout matches regexp:
+            """
+            fips +yes +n/a
+            """
+        Examples: ubuntu release
+           | release |
+           | xenial  |
+           | bionic  |
+           | focal   |
diff --git a/features/enable_fips_vm.feature b/features/enable_fips_vm.feature
index b401bf2..a055354 100644
--- a/features/enable_fips_vm.feature
+++ b/features/enable_fips_vm.feature
@@ -8,7 +8,12 @@ Feature: FIPS enablement in lxd VMs
     Scenario Outline: Attached enable of FIPS in an ubuntu lxd vm
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
-        And I run `ua disable livepatch` with sudo
+        When I run `ua status --format json` with sudo
+        Then stdout contains substring
+        """
+        {"available": "yes", "blocked_by": [{"name": "livepatch", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "disabled", "status_details": "FIPS is not configured"}
+        """
+        When I run `ua disable livepatch` with sudo
         And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo, retrying exit [100]
         And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
         And I run `ua enable <fips-service>` `with sudo` and stdin `y`
@@ -40,6 +45,12 @@ Feature: FIPS enablement in lxd VMs
         And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
         And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
         And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I run `ua status --format json` with sudo
+        Then stdout contains substring:
+        """
+        {"available": "yes", "blocked_by": [{"name": "fips", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}], "description": "Canonical Livepatch service", "description_override": null, "entitled": "yes", "name": "livepatch", "status": "n/a", "status_details": "Cannot enable Livepatch when FIPS is enabled."}
+        """
+
         When I reboot the `<release>` machine
         And  I run `uname -r` as non-root
         Then stdout matches regexp:
@@ -99,6 +110,24 @@ Feature: FIPS enablement in lxd VMs
             """
             Disabling FIPS requires system reboot to complete operation
             """
+        When I run `ua enable <fips-service> --assume-yes --format json --assume-yes` with sudo
+        Then stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+        """
+        {"_schema_version": "0.1", "errors": [], "failed_services": [], "needs_reboot": true, "processed_services": ["<fips-service>"], "result": "success", "warnings": []}
+        """
+        When I reboot the `<release>` machine
+        And I run `ua disable <fips-service> --assume-yes --format json` with sudo
+        Then stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+        """
+        {"_schema_version": "0.1", "errors": [], "failed_services": [], "needs_reboot": true, "processed_services": ["<fips-service>"], "result": "success", "warnings": []}
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
 
         Examples: ubuntu release
            | release | fips-name    | fips-service |fips-apt-source                                |
@@ -139,6 +168,12 @@ Feature: FIPS enablement in lxd VMs
         And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
         And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
         And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I run `ua status --format json` with sudo
+        Then stdout contains substring:
+        """
+        {"available": "yes", "blocked_by": [{"name": "fips-updates", "reason": "FIPS cannot be enabled if FIPS Updates has ever been enabled because FIPS Updates installs security patches that aren't officially certified.", "reason_code": "fips-updates-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "n/a", "status_details": "Cannot enable FIPS when FIPS Updates is enabled."}
+        """
+
         When I reboot the `<release>` machine
         And  I run `uname -r` as non-root
         Then stdout matches regexp:
@@ -207,6 +242,30 @@ Feature: FIPS enablement in lxd VMs
             """
             livepatch +yes +enabled
             """
+        When I run `ua status --format json` with sudo
+        Then stdout contains substring:
+        """
+        {"available": "yes", "blocked_by": [{"name": "livepatch", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}, {"name": "fips-updates", "reason": "FIPS cannot be enabled if FIPS Updates has ever been enabled because FIPS Updates installs security patches that aren't officially certified.", "reason_code": "fips-updates-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "n/a", "status_details": "Cannot enable FIPS when FIPS Updates is enabled."}
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        And I run `ua enable <fips-service> --assume-yes --format json --assume-yes` with sudo
+        Then stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+        """
+        {"_schema_version": "0.1", "errors": [], "failed_services": [], "needs_reboot": true, "processed_services": ["<fips-service>"], "result": "success", "warnings": []}
+        """
+        When I reboot the `<release>` machine
+        And I run `ua disable <fips-service> --assume-yes --format json` with sudo
+        Then stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+        """
+        {"_schema_version": "0.1", "errors": [], "failed_services": [], "needs_reboot": true, "processed_services": ["<fips-service>"], "result": "success", "warnings": []}
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
 
         Examples: ubuntu release
            | release | fips-name    | fips-service |fips-apt-source                                                |
diff --git a/features/install_uninstall.feature b/features/install_uninstall.feature
index 66426c8..078b1b5 100644
--- a/features/install_uninstall.feature
+++ b/features/install_uninstall.feature
@@ -12,7 +12,6 @@ Feature: UA Install and Uninstall related tests
            | xenial  |
            | bionic  |
            | focal   |
-           | hirsute |
            | impish  |
            | jammy   |
 
diff --git a/features/license_check.feature b/features/license_check.feature
index 01d4425..b368360 100644
--- a/features/license_check.feature
+++ b/features/license_check.feature
@@ -38,8 +38,9 @@ Feature: License check timer only runs in environments where necessary
             | xenial  |
             | bionic  |
             | focal   |
+            | jammy   |
 
-    @series.hirsute
+    @series.impish
     @uses.config.contract_token
     @uses.config.machine_type.gcp.generic
     Scenario Outline: license_check is disabled gcp generic non lts
@@ -59,7 +60,7 @@ Feature: License check timer only runs in environments where necessary
         Then I verify the `ua-license-check` systemd timer is disabled
         Examples: version
             | release |
-            | hirsute |
+            | impish  |
 
     @series.all
     @uses.config.contract_token
@@ -91,7 +92,6 @@ Feature: License check timer only runs in environments where necessary
             | xenial  |
             | bionic  |
             | focal   |
-            | hirsute |
             | impish  |
             | jammy   |
 
diff --git a/features/proxy_config.feature b/features/proxy_config.feature
index 7ee5c5a..30f03cf 100644
--- a/features/proxy_config.feature
+++ b/features/proxy_config.feature
@@ -24,12 +24,23 @@ Feature: Proxy configuration
           https_proxy: http://<ci-proxy-ip>:3128
         """
         And I verify `/var/log/squid/access.log` is empty on `proxy` machine
-        And I attach `contract_token` with sudo
+        # We need this for the route command
+        And I run `apt-get install net-tools` with sudo
+        # We will guarantee that the machine will only use the proxy when
+        # running the ua commands
+        And I run `route del default` with sudo
+        And I attach `contract_token` with sudo and options `--no-auto-enable`
         And I run `cat /var/log/squid/access.log` `with sudo` on the `proxy` machine
         Then stdout matches regexp:
         """
         .*CONNECT contracts.canonical.com.*
         """
+        When I run `ua status` with sudo
+        # Just to verify that the machine is attached
+        Then stdout matches regexp:
+        """
+        esm-infra     +yes      +disabled      +UA Infra: Extended Security Maintenance \(ESM\)
+        """
         When I run `truncate -s 0 /var/log/squid/access.log` `with sudo` on the `proxy` machine
         When I create the file `/etc/ubuntu-advantage/uaclient.conf` with the following:
         """
@@ -139,8 +150,12 @@ Feature: Proxy configuration
         And I run `systemctl restart squid.service` `with sudo` on the `proxy` machine
         And I run `ua config set http_proxy=http://<ci-proxy-ip>:3128` with sudo
         And I run `ua config set https_proxy=http://<ci-proxy-ip>:3128` with sudo
-        And I verify `/var/log/squid/access.log` is empty on `proxy` machine
-        And I attach `contract_token` with sudo
+        And I run `cat /var/log/squid/access.log` `with sudo` on the `proxy` machine
+        Then stdout matches regexp:
+        """
+        .*CONNECT api.snapcraft.io.*
+        """
+        When I attach `contract_token` with sudo
         Then stdout matches regexp:
         """
         Setting snap proxy
@@ -296,8 +311,12 @@ Feature: Proxy configuration
         And I run `systemctl restart squid.service` `with sudo` on the `proxy` machine
         And I run `ua config set http_proxy=http://someuser:somepassword@<ci-proxy-ip>:3128` with sudo
         And I run `ua config set https_proxy=http://someuser:somepassword@<ci-proxy-ip>:3128` with sudo
-        And I verify `/var/log/squid/access.log` is empty on `proxy` machine
-        And I attach `contract_token` with sudo
+        And I run `cat /var/log/squid/access.log` `with sudo` on the `proxy` machine
+        Then stdout matches regexp:
+        """
+        .*CONNECT api.snapcraft.io:443.*
+        """
+        When I attach `contract_token` with sudo
         Then stdout matches regexp:
         """
         Setting snap proxy
diff --git a/features/schemas/ua_operation.json b/features/schemas/ua_operation.json
 new file mode 100644
index 0000000..2afb7c8
--- /dev/null
+++ b/features/schemas/ua_operation.json
@@ -0,0 +1,76 @@
+{
+  "type": "object",
+  "properties": {
+    "_schema_version": {
+       "type": "string",
+       "const": "0.1"
+    },
+    "result": {
+       "type": "string",
+       "enum": ["success", "failure"]
+    },
+    "errors": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [ "message", "service", "type" ],
+        "properties": {
+          "message": {
+            "type": "string"
+           },
+           "message_code": {
+               "type": ["null", "string"]
+           },
+           "service": {
+             "type": ["null", "string"]
+           }
+        },
+        "patternProperties": {
+           "^type$": {
+             "type": "string",
+             "enum": ["service", "system"]
+          }
+        }
+      }
+    },
+    "warnings": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [ "message", "service", "type" ],
+        "properties": {
+          "message": {
+            "type": "string"
+           },
+           "message_code": {
+               "type": ["null", "string"]
+           },
+           "service": {
+             "type": ["null", "string"]
+           }
+        },
+        "patternProperties": {
+           "^type$": {
+             "type": "string",
+             "enum": ["service", "system"]
+          }
+        }
+      }
+    },
+    "failed_services": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "processed_services": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "needs_reboot": {
+      "type": "boolean"
+    }
+  }
+}
diff --git a/features/schemas/ua_security_status.json b/features/schemas/ua_security_status.json
 new file mode 100644
index 0000000..e099976
--- /dev/null
+++ b/features/schemas/ua_security_status.json
@@ -0,0 +1,81 @@
+{
+  "type": "object",
+  "properties": {
+    "_schema_version": {
+      "type": "string",
+      "const": "0.1"
+    },
+    "summary": {
+      "type": "object",
+      "properties": {
+        "ua": {
+          "type": "object",
+          "properties": {
+            "attached": {
+              "type": "boolean"
+            },
+            "enabled_services": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            "entitled_services": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "num_installed_packages": {
+          "type": "integer"
+        },
+        "num_esm_infra_packages": {
+          "type": "integer"
+        },
+        "num_esm_apps_packages": {
+          "type": "integer"
+        },
+        "num_esm_infra_updates": {
+          "type": "integer"
+        },
+        "num_esm_apps_updates": {
+          "type": "integer"
+        },
+        "num_standard_security_updates": {
+          "type": "integer"
+        }
+      }
+    },
+    "packages": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "package": {
+            "type": "string"
+          },
+          "version": {
+            "type": "string"
+          },
+          "service_name": {
+            "type": "string"
+          },
+          "origin": {
+            "type": "string"
+          },
+          "status": {
+            "type": "string",
+            "enum": [
+              "upgrade_available",
+              "pending_attach",
+              "pending_enable",
+              "upgrade_unavailable"
+            ]
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/features/schemas/ua_status.json b/features/schemas/ua_status.json
 new file mode 100644
index 0000000..ae9fd69
--- /dev/null
+++ b/features/schemas/ua_status.json
@@ -0,0 +1,247 @@
+{
+  "type": "object",
+  "properties": {
+    "_doc": {
+      "type": "string"
+    },
+    "_schema_version": {
+      "type": "string",
+      "const": "0.1"
+    },
+    "version": {
+      "type": "string"
+    },
+    "result": {
+       "type": "string",
+       "enum": ["success", "failure"]
+    },
+    "errors": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [ "message", "service", "type" ],
+        "properties": {
+          "message": {
+            "type": "string"
+           },
+           "service": {
+             "type": ["null", "string"]
+           }
+        },
+        "patternProperties": {
+           "^type$": {
+             "type": "string",
+             "enum": ["service", "system"]
+          }
+        }
+      }
+    },
+    "warnings": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [ "message", "service", "type" ],
+        "properties": {
+          "message": {
+            "type": "string"
+           },
+           "service": {
+             "type": ["null", "string"]
+           }
+        },
+        "patternProperties": {
+           "^type$": {
+             "type": "string",
+             "enum": ["service", "system"]
+          }
+        }
+      }
+    },
+    "attached": {
+      "type": "boolean"
+    },
+    "machine_id": {
+      "type": ["null", "string"]
+    },
+    "effective": {
+      "type": ["null", "string"]
+    },
+    "expires": {
+      "type": ["null", "string"]
+    },
+    "execution_status": {
+      "type": "string",
+      "enum": ["active", "inactive", "reboot-required"]
+    },
+    "execution_details": {
+      "type": "string"
+    },
+    "simulated": {
+      "type": "boolean"
+    },
+    "services": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "description": {
+            "type": "string"
+          },
+          "available": {
+            "type": "string",
+            "enum": ["yes", "no"]
+          },
+          "entitled": {
+            "type": "string",
+            "enum": ["yes", "no"]
+          },
+          "status": {
+            "type": "string",
+            "enum": ["enabled", "disabled", "n/a"]
+          },
+          "status_details": {
+            "type": "string"
+          },
+          "description_override": {
+            "type": ["null", "string"]
+          },
+          "blocked_by": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string"
+                },
+                "reason": {
+                  "type": "string"
+                },
+                "reason_code": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "notices": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "config_path": {
+      "type": "string"
+    },
+    "environment_vars": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "contract": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        },
+        "created_at": {
+          "type": "string"
+        },
+        "products": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "tech_support_level": {
+          "type": "string"
+        }
+      }
+    },
+    "account": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        },
+        "created_at": {
+          "type": "string"
+        },
+        "external_account_ids": {
+          "type": "array"
+        }
+      }
+    },
+    "config": {
+      "type": "object",
+      "properties": {
+        "contract_url": {
+          "type": "string"
+        },
+        "security_url": {
+          "type": "string"
+        },
+        "data_dir": {
+          "type": "string"
+        },
+        "log_level": {
+          "type": "string"
+        },
+        "log_file": {
+          "type": "string"
+        },
+        "timer_log_file": {
+          "type": "string"
+        },
+        "license_check_log_file": {
+          "type": "string"
+        },
+        "ua_config": {
+          "type": "object",
+          "properties": {
+            "apt_http_proxy": {
+              "type": ["null", "string"]
+            },
+            "apt_https_proxy": {
+              "type": ["null", "string"]
+            },
+            "http_proxy": {
+              "type": ["null", "string"]
+            },
+            "https_proxy": {
+              "type": ["null", "string"]
+            },
+            "update_messaging_timer": {
+              "type": "integer"
+            },
+            "update_status_timer": {
+              "type": "integer"
+            },
+            "metering_timer": {
+              "type": "integer"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/features/steps/steps.py b/features/steps/steps.py
index 2c0d5bf..e63f625 100644
--- a/features/steps/steps.py
+++ b/features/steps/steps.py
@@ -6,6 +6,7 @@ import shlex
 import subprocess
 import time
 
+import jsonschema  # type: ignore
 import yaml
 from behave import given, then, when
 from hamcrest import (
@@ -20,7 +21,12 @@ from features.environment import (
     capture_container_as_image,
     create_instance_with_uat_installed,
 )
-from features.util import SLOW_CMDS, emit_spinner_on_travis, nullcontext
+from features.util import (
+    SLOW_CMDS,
+    SafeLoaderWithoutDatetime,
+    emit_spinner_on_travis,
+    nullcontext,
+)
 from uaclient.defaults import DEFAULT_CONFIG_FILE, DEFAULT_MACHINE_TOKEN_PATH
 from uaclient.util import DatetimeAwareJSONDecoder
 
@@ -191,7 +197,7 @@ def when_i_run_command_on_machine(context, command, user_spec, instance_name):
 
 @when("I verify `{file_name}` is empty on `{instance_name}` machine")
 def when_i_verify_file_is_empty_on_machine(context, file_name, instance_name):
-    command = 'sh -c "cat {} | wc -l"'
+    command = 'sh -c "cat {} | wc -l"'.format(file_name)
     when_i_run_command(
         context, command, user_spec="with sudo", instance_name=instance_name
     )
@@ -230,8 +236,8 @@ def when_i_run_command_with_stdin(
 
 
 @when("I do a preflight check for `{contract_token}` {user_spec}")
-def when_i_preflight(context, contract_token, user_spec):
-    token = getattr(context.config, contract_token)
+def when_i_preflight(context, contract_token, user_spec, verify_return=True):
+    token = getattr(context.config, contract_token, "invalid_token")
     command = "ua status --simulate-with-token {}".format(token)
     if user_spec == "with the all flag":
         command += " --all"
@@ -239,10 +245,23 @@ def when_i_preflight(context, contract_token, user_spec):
         output_format = user_spec.split()[2]
         command += " --format {}".format(output_format)
     when_i_run_command(
-        context=context, command=command, user_spec="as non-root"
+        context=context,
+        command=command,
+        user_spec="as non-root",
+        verify_return=verify_return,
     )
 
 
+@when(
+    "I verify that a preflight check for `{contract_token}` {user_spec} exits {exit_codes}"  # noqa
+)
+def when_i_attempt_preflight(context, contract_token, user_spec, exit_codes):
+    when_i_preflight(context, contract_token, user_spec, verify_return=False)
+
+    expected_codes = exit_codes.split(",")
+    assert str(context.process.returncode) in expected_codes
+
+
 @when("I run `{command}` {user_spec}")
 def when_i_run_command(
     context,
@@ -280,6 +299,9 @@ def when_i_run_command(
         logging.error("Error executing command: {}".format(command))
         logging.error("stdout: {}".format(result.stdout))
         logging.error("stderr: {}".format(result.stderr))
+    else:
+        logging.debug("stdout: {}".format(result.stdout))
+        logging.debug("stderr: {}".format(result.stderr))
 
     if verify_return:
         assert_that(process.returncode, equal_to(0))
@@ -290,11 +312,21 @@ def when_i_run_command(
 @when("I fix `{issue}` by attaching to a subscription with `{token_type}`")
 def when_i_fix_a_issue_by_attaching(context, issue, token_type):
     token = getattr(context.config, token_type)
+
+    if (
+        token_type == "contract_token_staging"
+        or token_type == "contract_token_staging_expired"
+    ):
+        change_contract_endpoint_to_staging(context, user_spec="with sudo")
+    else:
+        change_contract_endpoint_to_production(context, user_spec="with sudo")
+
     when_i_run_command(
         context=context,
         command="ua fix {}".format(issue),
         user_spec="with sudo",
         stdin="a\n{}\n".format(token),
+        verify_return=False,
     )
 
 
@@ -340,23 +372,46 @@ def when_i_update_contract_field_to_new_value(
     )
 
 
+def change_contract_endpoint_to_staging(context, user_spec):
+    when_i_run_command(
+        context,
+        "sed -i 's/contracts.can/contracts.staging.can/' {}".format(
+            DEFAULT_CONFIG_FILE
+        ),
+        user_spec,
+    )
+
+
+def change_contract_endpoint_to_production(context, user_spec):
+    when_i_run_command(
+        context,
+        "sed -i 's/contracts.staging.can/contracts.can/' {}".format(
+            DEFAULT_CONFIG_FILE
+        ),
+        user_spec,
+    )
+
+
+@when("I attach `{token_type}` {user_spec} and options `{options}`")
+def when_i_attach_staging_token_with_options(
+    context, token_type, user_spec, options
+):
+    when_i_attach_staging_token(
+        context, token_type, user_spec, options=options
+    )
+
+
 @when("I attach `{token_type}` {user_spec}")
 def when_i_attach_staging_token(
-    context, token_type, user_spec, verify_return=True
+    context, token_type, user_spec, verify_return=True, options=""
 ):
     token = getattr(context.config, token_type)
     if (
         token_type == "contract_token_staging"
         or token_type == "contract_token_staging_expired"
     ):
-        when_i_run_command(
-            context,
-            "sed -i 's/contracts.can/contracts.staging.can/' {}".format(
-                DEFAULT_CONFIG_FILE
-            ),
-            user_spec,
-        )
-    cmd = "ua attach {}".format(token)
+        change_contract_endpoint_to_staging(context, user_spec)
+    cmd = "ua attach {} {}".format(token, options).strip()
     when_i_run_command(context, cmd, user_spec, verify_return=False)
 
     if verify_return:
@@ -420,6 +475,25 @@ def when_i_wait(context, seconds):
     time.sleep(int(seconds))
 
 
+@when("I replace `{original}` in `{filename}` with `{new}`")
+def when_i_replace_string_in_file(context, original, filename, new):
+    when_i_run_command(
+        context,
+        "sed -i 's/{original}/{new}/' {filename}".format(
+            original=original, new=new, filename=filename
+        ),
+        "with sudo",
+    )
+
+
+@when("I replace `{original}` in `{filename}` with token `{token_name}`")
+def when_i_replace_string_in_file_with_token(
+    context, original, filename, token_name
+):
+    token = getattr(context.config, token_name)
+    when_i_replace_string_in_file(context, original, filename, token)
+
+
 @then("I will see the following on stdout")
 def then_i_will_see_on_stdout(context):
     assert_that(context.process.stdout.strip(), equal_to(context.text))
@@ -439,27 +513,6 @@ def then_conditional_stdout_does_not_match_regexp(context, value1, value2):
         then_stream_does_not_match_regexp(context, "stdout")
 
 
-@then("stdout is formatted as `{output_format}` and has keys")
-def then_stdout_is_formatted_and_has_keys(context, output_format):
-    output = context.process.stdout.strip()
-    if output_format == "json":
-        data = json.loads(output)
-    elif output_format == "yaml":
-        data = yaml.safe_load(output)
-
-    keys = set(context.text.split())
-    output_keys = set(data.keys())
-
-    if keys != output_keys:
-        message = """
-        Missing keys in output: {}
-        Extra keys in output: {}
-        """.format(
-            keys - output_keys or "", output_keys - keys or ""
-        )
-        raise AssertionError(message)
-
-
 @then("{stream} does not match regexp")
 def then_stream_does_not_match_regexp(context, stream):
     content = getattr(context.process, stream).strip()
@@ -472,6 +525,12 @@ def then_stream_matches_regexp(context, stream):
     assert_that(content, matches_regexp(context.text))
 
 
+@then("{stream} contains substring")
+def then_stream_contains_substring(context, stream):
+    content = getattr(context.process, stream).strip()
+    assert_that(content, contains_string(context.text))
+
+
 @then("I will see the following on stderr")
 def then_i_will_see_on_stderr(context):
     assert_that(context.process.stderr.strip(), equal_to(context.text))
@@ -521,6 +580,16 @@ def then_i_verify_that_running_cmd_with_spec_exits_with_codes(
 
 
 @when(
+    "I verify that running attach `{spec}` with json response exits `{exit_codes}`"  # noqa
+)
+def when_i_verify_attach_with_json_response(context, spec, exit_codes):
+    cmd = "ua attach {} --format json".format(context.config.contract_token)
+    then_i_verify_that_running_cmd_with_spec_exits_with_codes(
+        context=context, cmd_name=cmd, spec=spec, exit_codes=exit_codes
+    )
+
+
+@when(
     "I verify that running `{cmd_name}` `{spec}` and stdin `{stdin}` exits `{exit_codes}`"  # noqa
 )
 def then_i_verify_that_running_cmd_with_spec_and_stdin_exits_with_codes(
@@ -581,6 +650,16 @@ def verify_installed_package_matches_version_regexp(context, package, regex):
     assert_that(context.process.stdout.strip(), matches_regexp(regex))
 
 
+@then(
+    "I verify that packages `{packages}` installed versions match regexp `{regex}`"  # noqa: E501
+)
+def verify_installed_packages_match_version_regexp(context, packages, regex):
+    for package in packages.split(" "):
+        verify_installed_package_matches_version_regexp(
+            context, package, regex
+        )
+
+
 @then("I verify that `{package}` is installed from apt source `{apt_source}`")
 def verify_package_is_installed_from_apt_source(context, package, apt_source):
     when_i_run_command(
@@ -609,6 +688,18 @@ def verify_package_is_installed_from_apt_source(context, package, apt_source):
     )
 
 
+@then(
+    "I verify that `{packages}` are installed from apt source `{apt_source}`"
+)
+def verify_packages_are_installed_from_apt_source(
+    context, packages, apt_source
+):
+    for package in packages.split(" "):
+        verify_package_is_installed_from_apt_source(
+            context, package, apt_source
+        )
+
+
 @then("I verify that the timer interval for `{job}` is `{interval}`")
 def verify_timer_interval_for_job(context, job, interval):
     when_i_run_command(
@@ -779,6 +870,18 @@ def i_restore_the_saved_key_value_on_contract(context, key):
     )
 
 
+@then("stdout is a {output_format} matching the `{schema}` schema")
+def stdout_matches_the_json_schema(context, output_format, schema):
+    if output_format == "json":
+        instance = json.loads(context.process.stdout.strip())
+    elif output_format == "yaml":
+        instance = yaml.load(
+            context.process.stdout.strip(), SafeLoaderWithoutDatetime
+        )
+    with open("features/schemas/{}.json".format(schema), "r") as schema_file:
+        jsonschema.validate(instance=instance, schema=json.load(schema_file))
+
+
 def get_command_prefix_for_user_spec(user_spec):
     prefix = []
     if user_spec == "with sudo":
diff --git a/features/ubuntu_pro.feature b/features/ubuntu_pro.feature
index 95d54e1..04ef4fc 100644
--- a/features/ubuntu_pro.feature
+++ b/features/ubuntu_pro.feature
@@ -40,6 +40,22 @@ Feature: Command behaviour when auto-attached in an ubuntu PRO image
             """
             <cis_or_usg>           +yes  +<cis-s>  +Security compliance and audit tools
             """
+        When I run `ua enable <cis_or_usg>` with sudo
+        And I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            <cis_or_usg>         +yes    +enabled   +Security compliance and audit tools
+            """
+        When I run `ua disable <cis_or_usg>` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            """
+        When I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            <cis_or_usg>         +yes    +disabled   +Security compliance and audit tools
+            """
         When I run `cat /var/log/squid/access.log` `with sudo` on the `proxy` machine
         Then stdout matches regexp:
         """
@@ -53,7 +69,7 @@ Feature: Command behaviour when auto-attached in an ubuntu PRO image
            | release | fips-s   | cc-eal-s | cis-s    | cis_or_usg |
            | xenial  | disabled | disabled | disabled | cis        |
            | bionic  | disabled | disabled | disabled | cis        |
-           | focal   | n/a      | n/a      | disabled | usg        |
+           | focal   | disabled | n/a      | disabled | usg        |
 
     @series.lts
     @uses.config.machine_type.azure.pro
@@ -95,6 +111,22 @@ Feature: Command behaviour when auto-attached in an ubuntu PRO image
             """
             <cis_or_usg>           +yes  +<cis-s>  +Security compliance and audit tools
             """
+        When I run `ua enable <cis_or_usg>` with sudo
+        And I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            <cis_or_usg>         +yes    +enabled   +Security compliance and audit tools
+            """
+        When I run `ua disable <cis_or_usg>` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            """
+        When I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            <cis_or_usg>         +yes    +disabled   +Security compliance and audit tools
+            """
         When I run `cat /var/log/squid/access.log` `with sudo` on the `proxy` machine
         Then stdout matches regexp:
         """
@@ -107,8 +139,8 @@ Feature: Command behaviour when auto-attached in an ubuntu PRO image
         Examples: ubuntu release
            | release | fips-s   | cc-eal-s | cis-s    | livepatch-s | cis_or_usg |
            | xenial  | n/a      | disabled | disabled | enabled     | cis        |
-           | bionic  | disabled | disabled | disabled | n/a         | cis        |
-           | focal   | n/a      | n/a      | disabled | enabled     | usg        |
+           | bionic  | disabled | disabled | disabled | enabled     | cis        |
+           | focal   | disabled | n/a      | disabled | enabled     | usg        |
 
     @series.lts
     @uses.config.machine_type.gcp.pro
@@ -150,6 +182,22 @@ Feature: Command behaviour when auto-attached in an ubuntu PRO image
             """
             <cis_or_usg>           +yes  +<cis-s>  +Security compliance and audit tools
             """
+        When I run `ua enable <cis_or_usg>` with sudo
+        And I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            <cis_or_usg>         +yes    +enabled   +Security compliance and audit tools
+            """
+        When I run `ua disable <cis_or_usg>` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            """
+        When I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            <cis_or_usg>         +yes    +disabled   +Security compliance and audit tools
+            """
         When I run `cat /var/log/squid/access.log` `with sudo` on the `proxy` machine
         Then stdout matches regexp:
         """
@@ -163,7 +211,7 @@ Feature: Command behaviour when auto-attached in an ubuntu PRO image
            | release | fips-s   | cc-eal-s | cis-s    | livepatch-s | cis_or_usg |
            | xenial  | n/a      | disabled | disabled | n/a         | cis        |
            | bionic  | disabled | disabled | disabled | n/a         | cis        |
-           | focal   | n/a      | n/a      | disabled | enabled     | usg        |
+           | focal   | disabled | n/a      | disabled | enabled     | usg        |
 
     @series.lts
     @uses.config.machine_type.aws.pro
@@ -178,7 +226,6 @@ Feature: Command behaviour when auto-attached in an ubuntu PRO image
         """
         And I run `ua auto-attach` with sudo
         And I run `ua status --wait` as non-root
-        And I run `ua status` as non-root
         Then stdout matches regexp:
             """
             SERVICE       ENTITLED  STATUS    DESCRIPTION
@@ -214,6 +261,22 @@ Feature: Command behaviour when auto-attached in an ubuntu PRO image
             """
             <cis_or_usg>           +yes  +<cis-s>  +Security compliance and audit tools
             """
+        When I run `ua enable <cis_or_usg>` with sudo
+        And I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            <cis_or_usg>         +yes    +enabled   +Security compliance and audit tools
+            """
+        When I run `ua disable <cis_or_usg>` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            """
+        When I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            <cis_or_usg>         +yes    +disabled   +Security compliance and audit tools
+            """
         When I run `systemctl start ua-auto-attach.service` with sudo
         And I verify that running `systemctl status ua-auto-attach.service` `as non-root` exits `0,3`
         Then stdout matches regexp:
@@ -281,7 +344,7 @@ Feature: Command behaviour when auto-attached in an ubuntu PRO image
            | release | fips-s   | cc-eal-s | cis-s    | infra-pkg | apps-pkg | cis_or_usg |
            | xenial  | disabled | disabled | disabled | libkrad0  | jq       | cis        |
            | bionic  | disabled | disabled | disabled | libkrad0  | bundler  | cis        |
-           | focal   | n/a      | n/a      | disabled | hello     | ant      | usg        |
+           | focal   | disabled | n/a      | disabled | hello     | ant      | usg        |
 
     @series.lts
     @uses.config.machine_type.azure.pro
@@ -332,6 +395,22 @@ Feature: Command behaviour when auto-attached in an ubuntu PRO image
             """
             <cis_or_usg>           +yes  +<cis-s>  +Security compliance and audit tools
             """
+        When I run `ua enable <cis_or_usg>` with sudo
+        And I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            <cis_or_usg>         +yes    +enabled   +Security compliance and audit tools
+            """
+        When I run `ua disable <cis_or_usg>` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            """
+        When I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            <cis_or_usg>         +yes    +disabled   +Security compliance and audit tools
+            """
         When I run `systemctl start ua-auto-attach.service` with sudo
         And I verify that running `systemctl status ua-auto-attach.service` `as non-root` exits `0,3`
         Then stdout matches regexp:
@@ -398,8 +477,8 @@ Feature: Command behaviour when auto-attached in an ubuntu PRO image
         Examples: ubuntu release
            | release | fips-s   | cc-eal-s | cis-s    | infra-pkg | apps-pkg | livepatch | cis_or_usg |
            | xenial  | n/a      | disabled | disabled | libkrad0  | jq       | enabled   | cis        |
-           | bionic  | disabled | disabled | disabled | libkrad0  | bundler  | n/a       | cis        |
-           | focal   | n/a      | n/a      | disabled | hello     | ant      | enabled   | usg        |
+           | bionic  | disabled | disabled | disabled | libkrad0  | bundler  | enabled   | cis        |
+           | focal   | disabled | n/a      | disabled | hello     | ant      | enabled   | usg        |
 
     @series.lts
     @uses.config.machine_type.gcp.pro
@@ -450,6 +529,22 @@ Feature: Command behaviour when auto-attached in an ubuntu PRO image
             """
             <cis_or_usg>           +yes  +<cis-s>  +Security compliance and audit tools
             """
+        When I run `ua enable <cis_or_usg>` with sudo
+        And I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            <cis_or_usg>         +yes    +enabled   +Security compliance and audit tools
+            """
+        When I run `ua disable <cis_or_usg>` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            """
+        When I run `ua status` with sudo
+        Then stdout matches regexp:
+            """
+            <cis_or_usg>         +yes    +disabled   +Security compliance and audit tools
+            """
         When I run `systemctl start ua-auto-attach.service` with sudo
         And I verify that running `systemctl status ua-auto-attach.service` `as non-root` exits `0,3`
         Then stdout matches regexp:
@@ -517,4 +612,4 @@ Feature: Command behaviour when auto-attached in an ubuntu PRO image
            | release | fips-s   | cc-eal-s | cis-s    | infra-pkg | apps-pkg | livepatch | cis_or_usg |
            | xenial  | n/a      | disabled | disabled | libkrad0  | jq       | n/a       | cis        |
            | bionic  | disabled | disabled | disabled | libkrad0  | bundler  | n/a       | cis        |
-           | focal   | n/a      | n/a      | disabled | hello     | ant      | enabled   | usg        |
+           | focal   | disabled | n/a      | disabled | hello     | ant      | enabled   | usg        |
diff --git a/features/ubuntu_pro_fips.feature b/features/ubuntu_pro_fips.feature
 new file mode 100644
index 0000000..7a18b03
--- /dev/null
+++ b/features/ubuntu_pro_fips.feature
@@ -0,0 +1,210 @@
+Feature: Command behaviour when auto-attached in an ubuntu PRO fips image
+
+    @series.lts
+    @uses.config.machine_type.azure.pro.fips
+    Scenario Outline: Check fips is enabled correctly on Ubuntu pro fips Azure machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I create the file `/etc/ubuntu-advantage/uaclient.conf` with the following:
+        """
+        contract_url: 'https://contracts.canonical.com'
+        data_dir: /var/lib/ubuntu-advantage
+        log_level: debug
+        log_file: /var/log/ubuntu-advantage.log
+        features:
+          allow_xenial_fips_on_cloud: true
+        """
+        And I run `ua auto-attach` with sudo
+        And I run `ua status --wait` as non-root
+        And I run `ua status` as non-root
+        Then stdout matches regexp:
+            """
+            esm-apps      +yes +enabled +UA Apps: Extended Security Maintenance \(ESM\)
+            esm-infra     +yes +enabled +UA Infra: Extended Security Maintenance \(ESM\)
+            fips          +yes +enabled +NIST-certified core packages
+            fips-updates  +yes +disabled +NIST-certified core packages with priority security updates
+            livepatch     +yes +n/a  +Canonical Livepatch service
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            <fips-kernel-version>
+            """
+        When I run `apt-cache policy ubuntu-azure-fips` as non-root
+        Then stdout does not match regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `systemctl start ua-auto-attach.service` with sudo
+        And I verify that running `systemctl status ua-auto-attach.service` `as non-root` exits `0,3`
+        Then stdout matches regexp:
+        """
+        .*status=0\/SUCCESS.*
+        """
+        And stdout matches regexp:
+        """
+        Skipping attach: Instance '[0-9a-z\-]+' is already attached.
+        """
+        When I run `ua auto-attach` with sudo
+        Then stderr matches regexp:
+        """
+        Skipping attach: Instance '[0-9a-z\-]+' is already attached.
+        """
+        When I run `apt-cache policy` with sudo
+        Then apt-cache policy for the following url has permission `500`
+        """
+        https://esm.ubuntu.com/infra/ubuntu <release>-infra-updates/main amd64 Packages
+        """
+        And apt-cache policy for the following url has permission `500`
+        """
+        https://esm.ubuntu.com/infra/ubuntu <release>-infra-security/main amd64 Packages
+        """
+        And apt-cache policy for the following url has permission `500`
+        """
+        https://esm.ubuntu.com/apps/ubuntu <release>-apps-updates/main amd64 Packages
+        """
+        And apt-cache policy for the following url has permission `500`
+        """
+        https://esm.ubuntu.com/apps/ubuntu <release>-apps-security/main amd64 Packages
+        """
+        And I verify that running `apt update` `with sudo` exits `0`
+        When I run `apt install -y <infra-pkg>/<release>-infra-security` with sudo, retrying exit [100]
+        And I run `apt-cache policy <infra-pkg>` as non-root
+        Then stdout matches regexp:
+        """
+        \s*500 https://esm.ubuntu.com/infra/ubuntu <release>-infra-security/main amd64 Packages
+        \s*500 https://esm.ubuntu.com/infra/ubuntu <release>-infra-updates/main amd64 Packages
+        """
+        And stdout matches regexp:
+        """
+        Installed: .*[~+]esm
+        """
+        When I run `apt install -y <apps-pkg>/<release>-apps-security` with sudo, retrying exit [100]
+        And I run `apt-cache policy <apps-pkg>` as non-root
+        Then stdout matches regexp:
+        """
+        Version table:
+        \s*\*\*\* .* 500
+        \s*500 https://esm.ubuntu.com/apps/ubuntu <release>-apps-security/main amd64 Packages
+        """
+
+        Examples: ubuntu release
+           | release | infra-pkg | apps-pkg | fips-apt-source                                | fips-kernel-version |
+           | xenial  | libkrad0  | jq       | https://esm.ubuntu.com/fips/ubuntu xenial/main | fips                |
+           | bionic  | libkrad0  | bundler  | https://esm.ubuntu.com/fips/ubuntu bionic/main | azure-fips          |
+
+    @series.lts
+    @uses.config.machine_type.aws.pro.fips
+    Scenario Outline: Check fips is enabled correctly on Ubuntu pro fips AWS machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I create the file `/etc/ubuntu-advantage/uaclient.conf` with the following:
+        """
+        contract_url: 'https://contracts.canonical.com'
+        data_dir: /var/lib/ubuntu-advantage
+        log_level: debug
+        log_file: /var/log/ubuntu-advantage.log
+        """
+        And I run `ua auto-attach` with sudo
+        And I run `ua status --wait` as non-root
+        And I run `ua status` as non-root
+        Then stdout matches regexp:
+            """
+            esm-apps      +yes +enabled +UA Apps: Extended Security Maintenance \(ESM\)
+            esm-infra     +yes +enabled +UA Infra: Extended Security Maintenance \(ESM\)
+            fips          +yes +enabled +NIST-certified core packages
+            fips-updates  +yes +disabled +NIST-certified core packages with priority security updates
+            livepatch     +yes +n/a  +Canonical Livepatch service
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            <fips-kernel-version>
+            """
+        When I run `apt-cache policy ubuntu-aws-fips` as non-root
+        Then stdout does not match regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `systemctl start ua-auto-attach.service` with sudo
+        And I verify that running `systemctl status ua-auto-attach.service` `as non-root` exits `0,3`
+        Then stdout matches regexp:
+        """
+        .*status=0\/SUCCESS.*
+        """
+        And stdout matches regexp:
+        """
+        Skipping attach: Instance '[0-9a-z\-]+' is already attached.
+        """
+        When I run `ua auto-attach` with sudo
+        Then stderr matches regexp:
+        """
+        Skipping attach: Instance '[0-9a-z\-]+' is already attached.
+        """
+        When I run `apt-cache policy` with sudo
+        Then apt-cache policy for the following url has permission `500`
+        """
+        https://esm.ubuntu.com/infra/ubuntu <release>-infra-updates/main amd64 Packages
+        """
+        And apt-cache policy for the following url has permission `500`
+        """
+        https://esm.ubuntu.com/infra/ubuntu <release>-infra-security/main amd64 Packages
+        """
+        And apt-cache policy for the following url has permission `500`
+        """
+        https://esm.ubuntu.com/apps/ubuntu <release>-apps-updates/main amd64 Packages
+        """
+        And apt-cache policy for the following url has permission `500`
+        """
+        https://esm.ubuntu.com/apps/ubuntu <release>-apps-security/main amd64 Packages
+        """
+        And I verify that running `apt update` `with sudo` exits `0`
+        When I run `apt install -y <infra-pkg>/<release>-infra-security` with sudo, retrying exit [100]
+        And I run `apt-cache policy <infra-pkg>` as non-root
+        Then stdout matches regexp:
+        """
+        \s*500 https://esm.ubuntu.com/infra/ubuntu <release>-infra-security/main amd64 Packages
+        \s*500 https://esm.ubuntu.com/infra/ubuntu <release>-infra-updates/main amd64 Packages
+        """
+        And stdout matches regexp:
+        """
+        Installed: .*[~+]esm
+        """
+        When I run `apt install -y <apps-pkg>/<release>-apps-security` with sudo, retrying exit [100]
+        And I run `apt-cache policy <apps-pkg>` as non-root
+        Then stdout matches regexp:
+        """
+        Version table:
+        \s*\*\*\* .* 500
+        \s*500 https://esm.ubuntu.com/apps/ubuntu <release>-apps-security/main amd64 Packages
+        """
+
+        Examples: ubuntu release
+           | release | infra-pkg | apps-pkg | fips-apt-source                                | fips-kernel-version |
+           | xenial  | libkrad0  | jq       | https://esm.ubuntu.com/fips/ubuntu xenial/main | fips                |
+           | bionic  | libkrad0  | bundler  | https://esm.ubuntu.com/fips/ubuntu bionic/main | aws-fips            |
+
diff --git a/features/ubuntu_upgrade.feature b/features/ubuntu_upgrade.feature
index fb506b9..4cf3407 100644
--- a/features/ubuntu_upgrade.feature
+++ b/features/ubuntu_upgrade.feature
@@ -3,7 +3,6 @@ Feature: Upgrade between releases when uaclient is attached
 
     @slow
     @series.focal
-    @series.hirsute
     @series.impish
     @uses.config.machine_type.lxd.container
     @upgrade
@@ -11,6 +10,8 @@ Feature: Upgrade between releases when uaclient is attached
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
         And I run `apt-get dist-upgrade --assume-yes` with sudo
+        # Some packages upgrade may require a reboot
+        And I reboot the `<release>` machine
         And I create the file `/etc/update-manager/release-upgrades.d/ua-test.cfg` with the following
         """
         [Sources]
@@ -41,8 +42,7 @@ Feature: Upgrade between releases when uaclient is attached
 
         Examples: ubuntu release
         | release | next_release | devel_release   |
-        | focal   | hirsute      |                 |
-        | hirsute | impish       |                 |
+        | focal   | impish       |                 |
         | impish  | jammy        | --devel-release |
 
     @slow
diff --git a/features/ubuntu_upgrade_unattached.feature b/features/ubuntu_upgrade_unattached.feature
index 3944dba..0856c92 100644
--- a/features/ubuntu_upgrade_unattached.feature
+++ b/features/ubuntu_upgrade_unattached.feature
@@ -3,13 +3,14 @@ Feature: Upgrade between releases when uaclient is unattached
 
     @slow
     @series.focal
-    @series.hirsute
     @series.impish
     @uses.config.machine_type.lxd.container
     @upgrade
     Scenario Outline: Unattached upgrade across releases
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I run `apt-get dist-upgrade --assume-yes` with sudo
+        # Some packages upgrade may require a reboot
+        And I reboot the `<release>` machine
         And I create the file `/etc/update-manager/release-upgrades.d/ua-test.cfg` with the following
         """
         [Sources]
@@ -40,8 +41,7 @@ Feature: Upgrade between releases when uaclient is unattached
 
         Examples: ubuntu release
         | release  | next_release | devel_release   |
-        | focal    | hirsute      |                 |
-        | hirsute  | impish       |                 |
+        | focal    | impish      |                 |
         | impish   | jammy        | --devel-release |
 
    @slow
diff --git a/features/unattached_commands.feature b/features/unattached_commands.feature
index bda7597..7c95ab9 100644
--- a/features/unattached_commands.feature
+++ b/features/unattached_commands.feature
@@ -27,7 +27,6 @@ Feature: Command behaviour when unattached
            | bionic  |
            | focal   |
            | xenial  |
-           | hirsute |
            | impish  |
            | jammy   |
 
@@ -131,8 +130,6 @@ Feature: Command behaviour when unattached
            | focal   | refresh |
            | xenial  | detach  |
            | xenial  | refresh |
-           | hirsute | detach  |
-           | hirsute | refresh |
            | impish  | detach  |
            | impish  | refresh |
            | jammy   | detach  |
@@ -169,10 +166,6 @@ Feature: Command behaviour when unattached
            | xenial  | disable  | livepatch |
            | xenial  | enable   | unknown   |
            | xenial  | disable  | unknown   |
-           | hirsute | enable   | livepatch |
-           | hirsute | disable  | livepatch |
-           | hirsute | enable   | unknown   |
-           | hirsute | disable  | unknown   |
            | impish  | enable   | livepatch |
            | impish  | disable  | livepatch |
            | impish  | enable   | unknown   |
@@ -220,7 +213,6 @@ Feature: Command behaviour when unattached
            | bionic   | yes          |
            | focal    | yes          |
            | xenial   | yes          |
-           | hirsute  | no           |
            | impish   | no           |
            | jammy    | no           |
 
@@ -251,7 +243,6 @@ Feature: Command behaviour when unattached
            | xenial  |
            | bionic  |
            | focal   |
-           | hirsute |
            | impish  |
            | jammy   |
 
@@ -288,7 +279,7 @@ Feature: Command behaviour when unattached
             USN-4539-1: AWL vulnerability
             Found CVEs:
             https://ubuntu.com/security/CVE-2020-11728
-            1 affected package is installed: awl
+            1 affected source package is installed: awl
             \(1/1\) awl:
             A fix is available in Ubuntu standard updates.
             .*\{ apt update && apt install --only-upgrade -y libawl-php \}.*
@@ -299,7 +290,7 @@ Feature: Command behaviour when unattached
             """
             CVE-2020-28196: Kerberos vulnerability
             https://ubuntu.com/security/CVE-2020-28196
-            1 affected package is installed: krb5
+            1 affected source package is installed: krb5
             \(1/1\) krb5:
             A fix is available in Ubuntu standard updates.
             The update is already installed.
@@ -323,7 +314,7 @@ Feature: Command behaviour when unattached
             USN-4539-1: AWL vulnerability
             Found CVEs:
             https://ubuntu.com/security/CVE-2020-11728
-            1 affected package is installed: awl
+            1 affected source package is installed: awl
             \(1/1\) awl:
             Sorry, no fix is available.
             1 package is still affected: awl
@@ -334,7 +325,7 @@ Feature: Command behaviour when unattached
             """
             CVE-2020-15180: MariaDB vulnerabilities
             https://ubuntu.com/security/CVE-2020-15180
-            No affected packages are installed.
+            No affected source packages are installed.
             .*✔.* CVE-2020-15180 does not affect your system.
             """
         When I run `ua fix CVE-2020-28196` as non-root
@@ -342,7 +333,7 @@ Feature: Command behaviour when unattached
             """
             CVE-2020-28196: Kerberos vulnerability
             https://ubuntu.com/security/CVE-2020-28196
-            1 affected package is installed: krb5
+            1 affected source package is installed: krb5
             \(1/1\) krb5:
             A fix is available in Ubuntu standard updates.
             The update is already installed.
@@ -354,7 +345,7 @@ Feature: Command behaviour when unattached
             """
             CVE-2017-9233: Expat vulnerability
             https://ubuntu.com/security/CVE-2017-9233
-            3 affected packages are installed: expat, matanza, swish-e
+            3 affected source packages are installed: expat, matanza, swish-e
             \(1/3, 2/3\) matanza, swish-e:
             Sorry, no fix is available.
             \(3/3\) expat:
@@ -363,6 +354,28 @@ Feature: Command behaviour when unattached
             2 packages are still affected: matanza, swish-e
             .*✘.* CVE-2017-9233 is not resolved.
             """
+        When I fix `USN-5079-2` by attaching to a subscription with `contract_token_staging_expired`
+        Then stdout matches regexp
+            """
+            USN-5079-2: curl vulnerabilities
+            Found CVEs:
+            https://ubuntu.com/security/CVE-2021-22946
+            https://ubuntu.com/security/CVE-2021-22947
+            1 affected source package is installed: curl
+            \(1/1\) curl:
+            A fix is available in UA Infra.
+            The update is not installed because this system is not attached to a
+            subscription.
+
+            Choose: \[S\]ubscribe at ubuntu.com \[A\]ttach existing token \[C\]ancel
+            > Enter your token \(from https://ubuntu.com/advantage\) to attach this system:
+            > .*\{ ua attach .*\}.*
+            Attach denied:
+            Contract ".*" expired on .*
+            Visit https://ubuntu.com/advantage to manage contract tokens.
+            1 package is still affected: curl
+            .*✘.* USN-5079-2 is not resolved.
+            """
         When I fix `USN-5079-2` by attaching to a subscription with `contract_token`
         Then stdout matches regexp:
             """
@@ -370,7 +383,7 @@ Feature: Command behaviour when unattached
             Found CVEs:
             https://ubuntu.com/security/CVE-2021-22946
             https://ubuntu.com/security/CVE-2021-22947
-            1 affected package is installed: curl
+            1 affected source package is installed: curl
             \(1/1\) curl:
             A fix is available in UA Infra.
             The update is not installed because this system is not attached to a
@@ -395,7 +408,7 @@ Feature: Command behaviour when unattached
             USN-5051-2: OpenSSL vulnerability
             Found CVEs:
             https://ubuntu.com/security/CVE-2021-3712
-            1 affected package is installed: openssl
+            1 affected source package is installed: openssl
             \(1/1\) openssl:
             A fix is available in UA Infra.
             .*\{ apt update && apt install --only-upgrade -y libssl1.0.0 openssl \}.*
@@ -440,7 +453,7 @@ Feature: Command behaviour when unattached
             USN-4539-1: AWL vulnerability
             Found CVEs:
             https://ubuntu.com/security/CVE-2020-11728
-            1 affected package is installed: awl
+            1 affected source package is installed: awl
             \(1/1\) awl:
             Ubuntu security engineers are investigating this issue.
             1 package is still affected: awl
@@ -451,7 +464,7 @@ Feature: Command behaviour when unattached
             """
             CVE-2020-28196: Kerberos vulnerability
             https://ubuntu.com/security/CVE-2020-28196
-            1 affected package is installed: krb5
+            1 affected source package is installed: krb5
             \(1/1\) krb5:
             A fix is available in Ubuntu standard updates.
             The update is already installed.
@@ -463,7 +476,7 @@ Feature: Command behaviour when unattached
         """
         CVE-2021-27135: xterm vulnerability
         https://ubuntu.com/security/CVE-2021-27135
-        1 affected package is installed: xterm
+        1 affected source package is installed: xterm
         \(1/1\) xterm:
         A fix is available in Ubuntu standard updates.
         Package fixes cannot be installed.
@@ -476,7 +489,7 @@ Feature: Command behaviour when unattached
         """
         CVE-2021-27135: xterm vulnerability
         https://ubuntu.com/security/CVE-2021-27135
-        1 affected package is installed: xterm
+        1 affected source package is installed: xterm
         \(1/1\) xterm:
         A fix is available in Ubuntu standard updates.
         .*\{ apt update && apt install --only-upgrade -y xterm \}.*
@@ -487,12 +500,26 @@ Feature: Command behaviour when unattached
         """
         CVE-2021-27135: xterm vulnerability
         https://ubuntu.com/security/CVE-2021-27135
-        1 affected package is installed: xterm
+        1 affected source package is installed: xterm
         \(1/1\) xterm:
         A fix is available in Ubuntu standard updates.
         The update is already installed.
         .*✔.* CVE-2021-27135 is resolved.
         """
+        When I run `apt-get install libbz2-1.0=1.0.6-8.1 -y --allow-downgrades` with sudo
+        And I run `apt-get install bzip2=1.0.6-8.1 -y` with sudo
+        And I run `ua fix USN-4038-3` with sudo
+        Then stdout matches regexp:
+        """
+        USN-4038-3: bzip2 regression
+        Found Launchpad bugs:
+        https://launchpad.net/bugs/1834494
+        1 affected source package is installed: bzip2
+        \(1/1\) bzip2:
+        A fix is available in Ubuntu standard updates.
+        .*\{ apt update && apt install --only-upgrade -y bzip2 libbz2-1.0 \}.*
+        .*✔.* USN-4038-3 is resolved.
+        """
 
 
     @series.all
@@ -535,6 +562,31 @@ Feature: Command behaviour when unattached
           | release |
           | bionic  |
           | focal   |
-          | hirsute |
+          | impish  |
+          | jammy   |
+
+    @series.all
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Unattached enable fails in a ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I verify that running `ua enable esm-infra` `with sudo` exits `1`
+        Then I will see the following on stderr:
+          """
+          To use 'esm-infra' you need an Ubuntu Advantage subscription
+          Personal and community subscriptions are available at no charge
+          See https://ubuntu.com/advantage
+          """
+        When I verify that running `ua enable esm-infra --format json --assume-yes` `with sudo` exits `1`
+        Then stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+          """
+          {"_schema_version": "0.1", "errors": [{"message": "To use 'esm-infra' you need an Ubuntu Advantage subscription\nPersonal and community subscriptions are available at no charge\nSee https://ubuntu.com/advantage", "message_code": "enable-failure-unattached", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+          """
+
+        Examples: ubuntu release
+          | release |
+          | xenial  |
+          | bionic  |
+          | focal   |
           | impish  |
           | jammy   |
diff --git a/features/unattached_status.feature b/features/unattached_status.feature
index 7b91df3..08538a2 100644
--- a/features/unattached_status.feature
+++ b/features/unattached_status.feature
@@ -5,18 +5,31 @@ Feature: Unattached status
     Scenario Outline: Unattached status in a ubuntu machine - formatted
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I run `ua status --format json` as non-root
-        Then stdout is formatted as `json` and has keys:
+        Then stdout is a json matching the `ua_status` schema
+        When I run `ua status --format yaml` as non-root
+        Then stdout is a yaml matching the `ua_status` schema
+        When I run `sed -i 's/contracts.can/invalidurl.notcan/' /etc/ubuntu-advantage/uaclient.conf` with sudo
+        And I verify that running `ua status --format json` `as non-root` exits `1`
+        Then stdout is a json matching the `ua_status` schema
+        And I will see the following on stdout:
             """
-            _doc _schema_version account attached config config_path contract effective
-            environment_vars execution_details execution_status expires machine_id notices
-            services version simulated
+            {"environment_vars": [], "errors": [{"message": "Failed to connect to authentication server\nCheck your Internet connection and try again.", "message_code": "connectivity-error", "service": null, "type": "system"}], "result": "failure", "services": [], "warnings": []}
             """
-        When I run `ua status --format yaml` as non-root
-        Then stdout is formatted as `yaml` and has keys:
+        And I verify that running `ua status --format yaml` `as non-root` exits `1`
+        Then stdout is a yaml matching the `ua_status` schema
+        And I will see the following on stdout:
             """
-            _doc _schema_version account attached config config_path contract effective
-            environment_vars execution_details execution_status expires machine_id notices
-            services version simulated
+            environment_vars: []
+            errors:
+            - message: 'Failed to connect to authentication server
+
+                Check your Internet connection and try again.'
+              message_code: connectivity-error
+              service: null
+              type: system
+            result: failure
+            services: []
+            warnings: []
             """
 
         Examples: ubuntu release
@@ -24,7 +37,6 @@ Feature: Unattached status
            | bionic  |
            | focal   |
            | xenial  |
-           | hirsute |
            | impish  |
            | jammy   |
 
@@ -32,7 +44,6 @@ Feature: Unattached status
     @uses.config.machine_type.lxd.container
     Scenario Outline: Unattached status in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I run `sed -i 's/contracts.can/contracts.staging.can/' /etc/ubuntu-advantage/uaclient.conf` with sudo
         When I run `ua status` as non-root
         Then stdout matches regexp:
             """
@@ -128,63 +139,104 @@ Feature: Unattached status
            | xenial  | yes      | yes    | cis | yes           | yes  | yes       | yes | yes       |     |
            | bionic  | yes      | yes    | cis | yes           | yes  | yes       | yes | yes       |     |
            | focal   | yes      | no     |     | yes           | yes  | yes       | no  | yes       | usg |
-           | hirsute | no       | no     | cis | no            | no   | no        | no  | no        |     |
            | impish  | no       | no     | cis | no            | no   | no        | no  | no        |     |
            | jammy   | no       | no     | cis | no            | no   | no        | no  | no        |     |
 
     @series.all
     @uses.config.machine_type.lxd.container
     @uses.config.contract_token
+    @uses.config.contract_token_staging_expired
     Scenario Outline: Simulate status in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I do a preflight check for `contract_token` without the all flag
         Then stdout matches regexp:
-        """
-        SERVICE       AVAILABLE  ENTITLED   AUTO_ENABLED  DESCRIPTION
-        cc-eal        <cc-eal>    +yes  +no   +Common Criteria EAL2 Provisioning Packages
-        ?<cis>( +<cis-available> +yes +no +Security compliance and audit tools)?
-        ?esm-infra     <esm-infra> +yes  +yes  +UA Infra: Extended Security Maintenance \(ESM\)
-        fips          <fips>      +yes  +no   +NIST-certified core packages
-        fips-updates  <fips>      +yes  +no   +NIST-certified core packages with priority security updates
-        livepatch     <livepatch> +yes  +yes  +Canonical Livepatch service
-        ?<usg>( +<cis-available> +yes +no +Security compliance and audit tools)?
-        """
+            """
+            SERVICE       AVAILABLE  ENTITLED   AUTO_ENABLED  DESCRIPTION
+            cc-eal        <cc-eal>    +yes  +no   +Common Criteria EAL2 Provisioning Packages
+            ?<cis>( +<cis-available> +yes +no +Security compliance and audit tools)?
+            ?esm-infra     <esm-infra> +yes  +yes  +UA Infra: Extended Security Maintenance \(ESM\)
+            fips          <fips>      +yes  +no   +NIST-certified core packages
+            fips-updates  <fips>      +yes  +no   +NIST-certified core packages with priority security updates
+            livepatch     <livepatch> +yes  +yes  +Canonical Livepatch service
+            ?<usg>( +<cis-available> +yes +no +Security compliance and audit tools)?
+            """
         When I do a preflight check for `contract_token` with the all flag
         Then stdout matches regexp:
-        """
-        SERVICE       AVAILABLE  ENTITLED   AUTO_ENABLED  DESCRIPTION
-        cc-eal        <cc-eal>    +yes  +no   +Common Criteria EAL2 Provisioning Packages
-        ?<cis>( +<cis-available> +yes +no +Security compliance and audit tools)?
-        ?esm-apps      <esm-apps>  +yes  +yes  +UA Apps: Extended Security Maintenance \(ESM\)
-        esm-infra     <esm-infra> +yes  +yes  +UA Infra: Extended Security Maintenance \(ESM\)
-        fips          <fips>      +yes  +no   +NIST-certified core packages
-        fips-updates  <fips>      +yes  +no   +NIST-certified core packages with priority security updates
-        livepatch     <livepatch> +yes  +yes  +Canonical Livepatch service
-        ros           <ros>       +yes  +no   +Security Updates for the Robot Operating System
-        ros-updates   <ros>       +yes  +no   +All Updates for the Robot Operating System
-        ?<usg>( +<cis-available> +yes +no +Security compliance and audit tools)?
-        """
+            """
+            SERVICE       AVAILABLE  ENTITLED   AUTO_ENABLED  DESCRIPTION
+            cc-eal        <cc-eal>    +yes  +no   +Common Criteria EAL2 Provisioning Packages
+            ?<cis>( +<cis-available> +yes +no +Security compliance and audit tools)?
+            ?esm-apps      <esm-apps>  +yes  +yes  +UA Apps: Extended Security Maintenance \(ESM\)
+            esm-infra     <esm-infra> +yes  +yes  +UA Infra: Extended Security Maintenance \(ESM\)
+            fips          <fips>      +yes  +no   +NIST-certified core packages
+            fips-updates  <fips>      +yes  +no   +NIST-certified core packages with priority security updates
+            livepatch     <livepatch> +yes  +yes  +Canonical Livepatch service
+            ros           <ros>       +yes  +no   +Security Updates for the Robot Operating System
+            ros-updates   <ros>       +yes  +no   +All Updates for the Robot Operating System
+            ?<usg>( +<cis-available> +yes +no +Security compliance and audit tools)?
+            """
         When I do a preflight check for `contract_token` formatted as json
-        Then stdout is formatted as `json` and has keys:
-        """
-        _doc _schema_version account attached config config_path contract effective
-        environment_vars execution_details execution_status expires machine_id notices
-        services version simulated
-        """
+        Then stdout is a json matching the `ua_status` schema
         When I do a preflight check for `contract_token` formatted as yaml
-        Then stdout is formatted as `yaml` and has keys:
-        """
-        _doc _schema_version account attached config config_path contract effective
-        environment_vars execution_details execution_status expires machine_id notices
-        services version simulated
-        """
+        Then stdout is a yaml matching the `ua_status` schema
+        When I verify that a preflight check for `invalid_token` formatted as json exits 1
+        Then stdout is a json matching the `ua_status` schema
+        And I will see the following on stdout:
+            """
+            {"environment_vars": [], "errors": [{"message": "Invalid token. See https://ubuntu.com/advantage", "message_code": "attach-invalid-token", "service": null, "type": "system"}], "result": "failure", "services": [], "warnings": []}
+            """
+        When I verify that a preflight check for `invalid_token` formatted as yaml exits 1
+        Then stdout is a yaml matching the `ua_status` schema
+        And I will see the following on stdout:
+            """
+            environment_vars: []
+            errors:
+            - message: Invalid token. See https://ubuntu.com/advantage
+              message_code: attach-invalid-token
+              service: null
+              type: system
+            result: failure
+            services: []
+            warnings: []
+            """
+        When I run `sed -i 's/contracts.can/contracts.staging.can/' /etc/ubuntu-advantage/uaclient.conf` with sudo
+        And I verify that a preflight check for `contract_token_staging_expired` formatted as json exits 1
+        Then stdout is a json matching the `ua_status` schema
+        And stdout matches regexp:
+            """
+            \"result\": \"failure\"
+            """
+        And stdout matches regexp:
+            """
+            \"message\": \"Contract .* expired on .*\"
+            """
+        When I verify that a preflight check for `contract_token_staging_expired` formatted as yaml exits 1
+        Then stdout is a yaml matching the `ua_status` schema
+        Then stdout matches regexp:
+            """
+            errors:
+            - message: Contract .* expired on .*
+            """
+        When I verify that a preflight check for `contract_token_staging_expired` without the all flag exits 1
+        Then stdout matches regexp:
+            """
+            This token is not valid.
+            Contract \".*\" expired on .*
 
+            SERVICE       AVAILABLE  ENTITLED   AUTO_ENABLED  DESCRIPTION
+            cc-eal        <cc-eal>    +yes  +no   +Common Criteria EAL2 Provisioning Packages
+            ?<cis>( +<cis-available> +yes +no +Security compliance and audit tools)?
+            ?esm-infra     <esm-infra> +yes  +yes  +UA Infra: Extended Security Maintenance \(ESM\)
+            fips          <fips>      +yes  +no   +NIST-certified core packages
+            fips-updates  <fips>      +yes  +no   +NIST-certified core packages with priority security updates
+            livepatch     <livepatch> +yes  +yes  +Canonical Livepatch service
+            ?<usg>( +<cis-available> +yes +no +Security compliance and audit tools)?
+            """
 
         Examples: ubuntu release
            | release | esm-apps | cc-eal | cis | cis-available | fips | esm-infra | ros | livepatch | usg |
            | xenial  | yes      | yes    | cis | yes           | yes  | yes       | yes | yes       |     |
            | bionic  | yes      | yes    | cis | yes           | yes  | yes       | yes | yes       |     |
            | focal   | yes      | no     |     | yes           | yes  | yes       | no  | yes       | usg |
-           | hirsute | no       | no     | cis | no            | no   | no        | no  | no        |     |
            | impish  | no       | no     | cis | no            | no   | no        | no  | no        |     |
            | jammy   | no       | no     | cis | no            | no   | no        | no  | no        |     |
diff --git a/features/util.py b/features/util.py
index 8bb7dfe..7e00746 100644
--- a/features/util.py
+++ b/features/util.py
@@ -325,3 +325,10 @@ def emit_spinner_on_travis(msg: str = " "):
     finally:
         print()
         dot_process.terminate()
+
+
+class SafeLoaderWithoutDatetime(yaml.SafeLoader):
+    yaml_implicit_resolvers = {
+        k: [r for r in v if r[0] != "tag:yaml.org,2002:timestamp"]
+        for k, v in yaml.SafeLoader.yaml_implicit_resolvers.items()
+    }
diff --git a/integration-requirements.txt b/integration-requirements.txt
index 69471fa..effd7bd 100644
--- a/integration-requirements.txt
+++ b/integration-requirements.txt
@@ -1,5 +1,6 @@
 # Integration testing
 behave
+jsonschema
 PyHamcrest
 pycloudlib @ git+https://github.com/canonical/pycloudlib.git@756a2c2de044ca60eaa7cdc76653d23a1339dc0a
 
diff --git a/lib/reboot_cmds.py b/lib/reboot_cmds.py
index 569b46a..c819dba 100644
--- a/lib/reboot_cmds.py
+++ b/lib/reboot_cmds.py
@@ -18,11 +18,10 @@ import logging
 import os
 import sys
 
-from uaclient import config, contract, lock, status
+from uaclient import config, contract, exceptions, lock, messages
 from uaclient.cli import setup_logging
 from uaclient.entitlements.fips import FIPSEntitlement
-from uaclient.exceptions import LockHeldError, UserFacingError
-from uaclient.util import ProcessExecutionError, UrlError, subp
+from uaclient.util import subp
 
 # Retry sleep backoff algorithm if lock is held.
 # Lock may be held by auto-attach on systems with ubuntu-advantage-pro.
@@ -34,7 +33,7 @@ def run_command(cmd, cfg):
     try:
         out, _ = subp(cmd.split(), capture=True)
         logging.debug("Successfully executed cmd: {}".format(cmd))
-    except ProcessExecutionError as exec_error:
+    except exceptions.ProcessExecutionError as exec_error:
         msg = (
             "Failed running cmd: {}\n"
             "Return code: {}\n"
@@ -75,7 +74,7 @@ def fix_pro_pkg_holds(cfg):
                     )
                 try:
                     entitlement.install_packages(cleanup_on_failure=False)
-                except UserFacingError as e:
+                except exceptions.UserFacingError as e:
                     logging.error(e.msg)
                     logging.warning(
                         "Failed to install packages at boot: {}".format(
@@ -83,22 +82,22 @@ def fix_pro_pkg_holds(cfg):
                         )
                     )
                     sys.exit(1)
-                cfg.remove_notice("", status.MESSAGE_FIPS_REBOOT_REQUIRED)
+                cfg.remove_notice("", messages.FIPS_SYSTEM_REBOOT_REQUIRED.msg)
 
 
 def refresh_contract(cfg):
     try:
         contract.request_updated_contract(cfg)
-    except UrlError as exc:
+    except exceptions.UrlError as exc:
         logging.exception(exc)
-        logging.warning(status.MESSAGE_REFRESH_CONTRACT_FAILURE)
+        logging.warning(messages.REFRESH_CONTRACT_FAILURE)
         sys.exit(1)
 
 
 def process_remaining_deltas(cfg):
     cmd = "/usr/bin/python3 /usr/lib/ubuntu-advantage/upgrade_lts_contract.py"
     run_command(cmd=cmd, cfg=cfg)
-    cfg.remove_notice("", status.MESSAGE_LIVEPATCH_LTS_REBOOT_REQUIRED)
+    cfg.remove_notice("", messages.LIVEPATCH_LTS_REBOOT_REQUIRED)
 
 
 def process_reboot_operations(cfg):
@@ -122,13 +121,13 @@ def process_reboot_operations(cfg):
             process_remaining_deltas(cfg)
 
             cfg.delete_cache_key("marker-reboot-cmds")
-            cfg.remove_notice("", status.MESSAGE_REBOOT_SCRIPT_FAILED)
+            cfg.remove_notice("", messages.REBOOT_SCRIPT_FAILED)
             logging.debug("Successfully ran all commands on reboot.")
         except Exception as e:
             msg = "Failed running commands on reboot."
             msg += str(e)
             logging.error(msg)
-            cfg.add_notice("", status.MESSAGE_REBOOT_SCRIPT_FAILED)
+            cfg.add_notice("", messages.REBOOT_SCRIPT_FAILED)
 
 
 def main(cfg):
@@ -145,7 +144,7 @@ def main(cfg):
             max_retries=MAX_RETRIES_ON_LOCK_HELD,
         ):
             process_reboot_operations(cfg=cfg)
-    except LockHeldError as e:
+    except exceptions.LockHeldError as e:
         logging.warning("Lock not released. %s", str(e.msg))
         sys.exit(1)
 
diff --git a/setup.py b/setup.py
index 4c92683..bcce7c5 100644
--- a/setup.py
+++ b/setup.py
@@ -5,7 +5,7 @@ import glob
 
 import setuptools
 
-from uaclient import defaults, util, version
+from uaclient import defaults, version
 
 NAME = "ubuntu-advantage-tools"
 
@@ -39,7 +39,7 @@ def _get_version():
 
 
 def _get_data_files():
-    data_files = [
+    return [
         ("/etc/ubuntu-advantage", ["uaclient.conf", "help_data.yaml"]),
         ("/etc/update-motd.d", glob.glob("update-motd.d/*")),
         ("/usr/lib/ubuntu-advantage", glob.glob("lib/[!_]*")),
@@ -49,16 +49,8 @@ def _get_data_files():
             ["release-upgrades.d/ubuntu-advantage-upgrades.cfg"],
         ),
         (defaults.CONFIG_DEFAULTS["data_dir"], []),
+        ("/lib/systemd/system", glob.glob("systemd/*")),
     ]
-    rel_major, _rel_minor = util.get_platform_info()["release"].split(".", 1)
-    if rel_major == "14":
-        data_files.append(
-            ("/etc/apt/apt.conf.d", ["apt.conf.d/51ubuntu-advantage-esm"])
-        )
-        data_files.append(("/etc/init", glob.glob("upstart/*")))
-    else:
-        data_files.append(("/lib/systemd/system", glob.glob("systemd/*")))
-    return data_files
 
 
 setuptools.setup(
diff --git a/sru/release-27.7/test_world_readable_logs.sh b/sru/release-27.7/test_world_readable_logs.sh
 new file mode 100644
index 0000000..ed687a7
--- /dev/null
+++ b/sru/release-27.7/test_world_readable_logs.sh
@@ -0,0 +1,66 @@
+series=$1
+deb=$2
+
+set -eE
+
+GREEN="\e[32m"
+RED="\e[31m"
+BLUE="\e[36m"
+END_COLOR="\e[0m"
+
+function cleanup {
+  lxc delete test --force
+}
+
+function on_err {
+  echo -e "${RED}Test Failed${END_COLOR}"
+  cleanup
+  exit 1
+}
+
+trap on_err ERR
+
+function print_and_run_cmd {
+  echo -e "${BLUE}Running:${END_COLOR}" "$@"
+  echo -e "${BLUE}Output:${END_COLOR}"
+  lxc exec test -- sh -c "$@"
+  echo
+}
+
+function explanatory_message {
+  echo -e "${BLUE}$@${END_COLOR}"
+}
+
+explanatory_message "Starting $series container and updating ubuntu-advantage-tools"
+lxc launch ubuntu-daily:$series test >/dev/null 2>&1
+sleep 10
+
+explanatory_message "Check that log is not world readable"
+print_and_run_cmd "ua version"
+print_and_run_cmd "head /var/log/ubuntu-advantage.log"
+print_and_run_cmd "find /var/log/ -name ubuntu-advantage.log -perm 0600 | grep -qz ."
+
+lxc exec test -- apt-get update >/dev/null
+explanatory_message "installing new version of ubuntu-advantage-tools from local copy"
+lxc file push $deb test/tmp/ua.deb > /dev/null
+print_and_run_cmd "dpkg -i /tmp/ua.deb"
+print_and_run_cmd "ua version"
+
+explanatory_message "Check that log files permissions are still the same"
+print_and_run_cmd "find /var/log/ -name ubuntu-advantage.log -perm 0600 | grep -qz ."
+
+explanatory_message "Check that logrotate command will create world readable files"
+print_and_run_cmd "logrotate --force /etc/logrotate.d/ubuntu-advantage-tools"
+print_and_run_cmd "find /var/log/ -name ubuntu-advantage.log -perm 0644 | grep -qz ."
+print_and_run_cmd "find /var/log/ -name ubuntu-advantage.log.1 -perm 0600 | grep -qz ."
+
+explanatory_message "Check that running logrotate again will stil make world readable files"
+# Just to add new entry to the log
+print_and_run_cmd "ua version"
+print_and_run_cmd "logrotate --force /etc/logrotate.d/ubuntu-advantage-tools"
+print_and_run_cmd "find /var/log/ -name ubuntu-advantage.log -perm 0644 | grep -qz ."
+print_and_run_cmd "find /var/log/ -name ubuntu-advantage.log.1 -perm 0644 | grep -qz ."
+print_and_run_cmd "find /var/log/ -name ubuntu-advantage.log.2.gz -perm 0600 | grep -qz ."
+
+echo -e "${GREEN}Test Passed${END_COLOR}"
+cleanup
diff --git a/tools/create-lp-release-branches.sh b/tools/create-lp-release-branches.sh
index 604df74..454af96 100755
--- a/tools/create-lp-release-branches.sh
+++ b/tools/create-lp-release-branches.sh
@@ -32,7 +32,7 @@ else
   set -e
 fi
 
-for release in xenial bionic focal hirsute impish
+for release in xenial bionic focal impish
 do
   echo
   echo $release
@@ -48,7 +48,6 @@ do
       xenial) version=${UA_VERSION}~16.04.1;;
       bionic) version=${UA_VERSION}~18.04.1;;
       focal) version=${UA_VERSION}~20.04.1;;
-      hirsute) version=${UA_VERSION}~21.04.1;;
       impish) version=${UA_VERSION}~21.10.1;;
   esac
   dch_cmd=(dch -v ${version} -D ${release} -b  "Backport new upstream release: (LP: #${SRU_BUG}) to $release")
diff --git a/tools/refresh-aws-pro-ids b/tools/refresh-aws-pro-ids
index 5256a6c..7a89f5a 100755
--- a/tools/refresh-aws-pro-ids
+++ b/tools/refresh-aws-pro-ids
@@ -3,6 +3,7 @@
 import glob
 import os
 import re
+
 import yaml
 
 from uaclient import util
@@ -19,7 +20,7 @@ git push upstream your-branch
 Create a new pull request @ https://github.com/canonical/ubuntu-advantage-client/pulls
 """
 
-EOL_RELEASES = ("trusty", )  # Releases we no longer test
+EOL_RELEASES = ("trusty",)  # Releases we no longer test
 
 
 def main():
@@ -33,35 +34,45 @@ def main():
     aws_ids = {}
     for aws_listing in glob.glob("listing-aws-pro-*"):
         m = re.match(
-            r"^listing-aws-pro-(?P<release>\w+).yaml$", aws_listing
+            r"^listing-aws-pro-(fips-)?(?P<release>\w+).yaml$", aws_listing
         )
         if not m:
             print("Skipping unexpected listing file name: ", aws_listing)
             continue
         elif m.group("release") in EOL_RELEASES:
             print(
-                "Skipping release %s. No longer CI on EOL releases" %
-                    m.group("release")
+                "Skipping release %s. No longer CI on EOL releases"
+                % m.group("release")
             )
             continue
         listing = yaml.safe_load(open(aws_listing, "r"))
-        for md in listing['metadata']:
+        for md in listing["metadata"]:
             if md["key"] == "series":
                 release = md["value"]
+                if "fips" in listing["productID"]:
+                    release = release + "-fips"
                 break
-        for externalID in listing['externalIDs']:
-            if externalID['origin'] == 'AWS':
+        for externalID in listing["externalIDs"]:
+            if externalID["origin"] == "AWS":
                 # TODO(handle multiple IDs)
-                [marketplace_id] = externalID['IDs']
+                [marketplace_id] = externalID["IDs"]
                 break
         marketplace_id = marketplace_id.replace(MARKETPLACE_PREFIX, "")
         out, _err = util.subp(
-            ["aws", "ec2", "describe-images", "--owners", "aws-marketplace",
-             "--filters", "Name=product-code,Values={}".format(marketplace_id),
-             "--query", "sort_by(Images, &CreationDate)[-1].ImageId"]
+            [
+                "aws",
+                "ec2",
+                "describe-images",
+                "--owners",
+                "aws-marketplace",
+                "--filters",
+                "Name=product-code,Values={}".format(marketplace_id),
+                "--query",
+                "sort_by(Images, &CreationDate)[-1].ImageId",
+            ]
         )
         ami_id = out.strip()
-        aws_ids[release] = ami_id.replace("\"", "")
+        aws_ids[release] = ami_id.replace('"', "")
 
     os.chdir("../..")
     with open("features/aws-ids.yaml", "w") as stream:
diff --git a/tools/run-integration-tests.py b/tools/run-integration-tests.py
index 10b4a55..da55b1c 100644
--- a/tools/run-integration-tests.py
+++ b/tools/run-integration-tests.py
@@ -12,7 +12,6 @@ SERIES_TO_VERSION = {
     "xenial": "16.04",
     "bionic": "18.04",
     "focal": "20.04",
-    "hirsute": "21.04",
     "impish": "21.10",
     "jammy": "22.04",
 }
@@ -28,11 +27,11 @@ PLATFORM_SERIES_TESTS = {
     "azurepro": ["xenial", "bionic", "focal"],
     "awsgeneric": ["xenial", "bionic", "focal"],
     "awspro": ["xenial", "bionic", "focal"],
-    "gcpgeneric": ["xenial", "bionic", "focal", "hirsute"],
+    "gcpgeneric": ["xenial", "bionic", "focal", "impish", "jammy"],
     "gcppro": ["xenial", "bionic", "focal"],
     "vm": ["xenial", "bionic", "focal"],
-    "lxd": ["xenial", "bionic", "focal", "hirsute", "impish", "jammy"],
-    "upgrade": ["xenial", "bionic", "focal", "hirsute", "impish"],
+    "lxd": ["xenial", "bionic", "focal", "impish", "jammy"],
+    "upgrade": ["xenial", "bionic", "focal", "impish"],
 }
 
 
diff --git a/tox.ini b/tox.ini
index 9c98f03..45962e0 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,20 +1,21 @@
 [tox]
-envlist = py3, flake8, py3-{xenial,bionic}, flake8-{trusty,xenial,bionic}, mypy, black, isort
-
-[testenv:flake8-trusty]
-pip_version = 9.0.2
+envlist = py3, flake8, py3-{xenial,bionic}, flake8-{xenial,bionic}, mypy, black, isort
 
 [testenv:flake8-bionic]
 pip_version = 9.0.2
+setuptools_version = 59.8.0
 
 [testenv:flake8-xenial]
 pip_version = 9.0.2
+setuptools_version = 59.8.0
 
 [testenv:py3-xenial]
 pip_version = 9.0.2
+setuptools_version = 59.8.0
 
 [testenv:py3-bionic]
 pip_version = 9.0.2
+setuptools_version = 59.8.0
 
 [testenv]
 deps =
@@ -35,8 +36,10 @@ passenv =
 setenv =
     awsgeneric: UACLIENT_BEHAVE_MACHINE_TYPE = aws.generic
     awspro: UACLIENT_BEHAVE_MACHINE_TYPE = aws.pro
+    awspro-fips: UACLIENT_BEHAVE_MACHINE_TYPE = aws.pro.fips
     azuregeneric: UACLIENT_BEHAVE_MACHINE_TYPE = azure.generic
     azurepro: UACLIENT_BEHAVE_MACHINE_TYPE = azure.pro
+    azurepro-fips: UACLIENT_BEHAVE_MACHINE_TYPE = azure.pro.fips
     gcpgeneric: UACLIENT_BEHAVE_MACHINE_TYPE = gcp.generic
     gcppro: UACLIENT_BEHAVE_MACHINE_TYPE = gcp.pro
     vm: UACLIENT_BEHAVE_MACHINE_TYPE = lxd.vm
@@ -52,16 +55,14 @@ commands =
     behave-lxd-16.04: behave -v {posargs} --tags="uses.config.machine_type.lxd.container" --tags="series.xenial,series.lts,series.all" --tags="~upgrade"
     behave-lxd-18.04: behave -v {posargs} --tags="uses.config.machine_type.lxd.container" --tags="series.bionic,series.lts,series.all" --tags="~upgrade"
     behave-lxd-20.04: behave -v {posargs} --tags="uses.config.machine_type.lxd.container" --tags="series.focal,series.lts,series.all" --tags="~upgrade"
-    behave-lxd-21.04: behave -v {posargs} --tags="uses.config.machine_type.lxd.container" --tags="series.hirsute,series.all" --tags="~upgrade"
     behave-lxd-21.10: behave -v {posargs} --tags="uses.config.machine_type.lxd.container" --tags="series.impish,series.all" --tags="~upgrade"
-    behave-lxd-22.04: behave -v {posargs} --tags="uses.config.machine_type.lxd.container" --tags="series.jammy,series.all" --tags="~upgrade"
+    behave-lxd-22.04: behave -v {posargs} --tags="uses.config.machine_type.lxd.container" --tags="series.jammy,series.lts,series.all" --tags="~upgrade"
     behave-vm-16.04: behave -v {posargs} --tags="uses.config.machine_type.lxd.vm" --tags="series.xenial,series.all,series.lts" --tags="~upgrade"
     behave-vm-18.04: behave -v {posargs} --tags="uses.config.machine_type.lxd.vm" --tags="series.bionic,series.all,series.lts" --tags="~upgrade"
     behave-vm-20.04: behave -v {posargs} --tags="uses.config.machine_type.lxd.vm" --tags="series.focal,series.all,series.lts" --tags="~upgrade"
     behave-upgrade-16.04: behave -v {posargs} --tags="upgrade" --tags="series.xenial,series.all"
     behave-upgrade-18.04: behave -v {posargs} --tags="upgrade" --tags="series.bionic,series.all"
     behave-upgrade-20.04: behave -v {posargs} --tags="upgrade" --tags="series.focal,series.all"
-    behave-upgrade-21.04: behave -v {posargs} --tags="upgrade" --tags="series.hirsute,series.all"
     behave-upgrade-21.10: behave -v {posargs} --tags="upgrade" --tags="series.impish,series.all"
     behave-awsgeneric-16.04: behave -v {posargs} --tags="uses.config.machine_type.aws.generic" --tags="series.xenial,series.lts,series.all" --tags="~upgrade"
     behave-awsgeneric-18.04: behave -v {posargs} --tags="uses.config.machine_type.aws.generic" --tags="series.bionic,series.lts,series.all" --tags="~upgrade"
@@ -69,16 +70,21 @@ commands =
     behave-awspro-16.04: behave -v {posargs} --tags="uses.config.machine_type.aws.pro" --tags="series.xenial,series.lts,series.all"
     behave-awspro-18.04: behave -v {posargs} --tags="uses.config.machine_type.aws.pro" --tags="series.bionic,series.lts,series.all"
     behave-awspro-20.04: behave -v {posargs} --tags="uses.config.machine_type.aws.pro" --tags="series.focal,series.lts,series.all"
+    behave-awspro-fips-16.04: behave -v {posargs} --tags="uses.config.machine_type.aws.pro.fips" --tags="series.xenial,series.lts,series.all"
+    behave-awspro-fips-18.04: behave -v {posargs} --tags="uses.config.machine_type.aws.pro.fips" --tags="series.bionic,series.lts,series.all"
     behave-azuregeneric-16.04: behave -v {posargs} --tags="uses.config.machine_type.azure.generic" --tags="series.xenial,series.lts,series.all" --tags="~upgrade"
     behave-azuregeneric-18.04: behave -v {posargs} --tags="uses.config.machine_type.azure.generic" --tags="series.bionic,series.lts,series.all" --tags="~upgrade"
     behave-azuregeneric-20.04: behave -v {posargs} --tags="uses.config.machine_type.azure.generic" --tags="series.focal,series.lts,series.all" --tags="~upgrade"
     behave-azurepro-16.04: behave -v {posargs} --tags="uses.config.machine_type.azure.pro" --tags="series.xenial,series.lts,series.all"
     behave-azurepro-18.04: behave -v {posargs} --tags="uses.config.machine_type.azure.pro" --tags="series.bionic,series.lts,series.all"
     behave-azurepro-20.04: behave -v {posargs} --tags="uses.config.machine_type.azure.pro" --tags="series.focal,series.lts,series.all"
+    behave-azurepro-fips-16.04: behave -v {posargs} --tags="uses.config.machine_type.azure.pro.fips" --tags="series.xenial,series.lts,series.all"
+    behave-azurepro-fips-18.04: behave -v {posargs} --tags="uses.config.machine_type.azure.pro.fips" --tags="series.bionic,series.lts,series.all"
     behave-gcpgeneric-16.04: behave -v {posargs} --tags="uses.config.machine_type.gcp.generic" --tags="series.xenial,series.lts,series.all" --tags="~upgrade"
     behave-gcpgeneric-18.04: behave -v {posargs} --tags="uses.config.machine_type.gcp.generic" --tags="series.bionic,series.lts,series.all" --tags="~upgrade"
     behave-gcpgeneric-20.04: behave -v {posargs} --tags="uses.config.machine_type.gcp.generic" --tags="series.focal,series.lts,series.all" --tags="~upgrade"
-    behave-gcpgeneric-21.04: behave -v {posargs} --tags="uses.config.machine_type.gcp.generic" --tags="series.hirsute,series.all" --tags="~upgrade"
+    behave-gcpgeneric-21.10: behave -v {posargs} --tags="uses.config.machine_type.gcp.generic" --tags="series.impish,series.all" --tags="~upgrade"
+    behave-gcpgeneric-22.04: behave -v {posargs} --tags="uses.config.machine_type.gcp.generic" --tags="series.jammy,series.lts,series.all" --tags="~upgrade"
     behave-gcppro-16.04: behave -v {posargs} --tags="uses.config.machine_type.gcp.pro" --tags="series.xenial,series.lts,series.all" --tags="~upgrade"
     behave-gcppro-18.04: behave -v {posargs} --tags="uses.config.machine_type.gcp.pro" --tags="series.bionic,series.lts,series.all" --tags="~upgrade"
     behave-gcppro-20.04: behave -v {posargs} --tags="uses.config.machine_type.gcp.pro" --tags="series.focal,series.lts,series.all" --tags="~upgrade"
diff --git a/uaclient/actions.py b/uaclient/actions.py
index ec8706f..792c5a7 100644
--- a/uaclient/actions.py
+++ b/uaclient/actions.py
@@ -1,9 +1,20 @@
 import logging
+import sys
+from typing import Optional  # noqa: F401
 
-from uaclient import clouds, config, contract, exceptions, status, util
+from uaclient import (
+    clouds,
+    config,
+    contract,
+    entitlements,
+    event_logger,
+    exceptions,
+    messages,
+)
 from uaclient.clouds import identity
 
 LOG = logging.getLogger("ua.actions")
+event = event_logger.get_event_logger()
 
 
 def attach_with_token(
@@ -22,18 +33,20 @@ def attach_with_token(
         contract.request_updated_contract(
             cfg, token, allow_enable=allow_enable
         )
-    except util.UrlError as exc:
-        with util.disable_log_to_console():
-            LOG.exception(exc)
+    except exceptions.UrlError as exc:
         cfg.status()  # Persist updated status in the event of partial attach
         update_apt_and_motd_messages(cfg)
         raise exc
     except exceptions.UserFacingError as exc:
-        LOG.warning(exc.msg)
+        event.info(exc.msg, file_type=sys.stderr)
         cfg.status()  # Persist updated status in the event of partial attach
         update_apt_and_motd_messages(cfg)
         raise exc
 
+    current_iid = identity.get_instance_id()
+    if current_iid:
+        cfg.write_cache("instance-id", current_iid)
+
     update_apt_and_motd_messages(cfg)
 
 
@@ -53,16 +66,53 @@ def auto_attach(
         tokenResponse = contract_client.request_auto_attach_contract_token(
             instance=cloud
         )
-    except contract.ContractAPIError as e:
+    except exceptions.ContractAPIError as e:
         if e.code and 400 <= e.code < 500:
             raise exceptions.NonAutoAttachImageError(
-                status.MESSAGE_UNSUPPORTED_AUTO_ATTACH
+                messages.UNSUPPORTED_AUTO_ATTACH
             )
         raise e
-    current_iid = identity.get_instance_id()
-    if current_iid:
-        cfg.write_cache("instance-id", current_iid)
 
     token = tokenResponse["contractToken"]
 
     attach_with_token(cfg, token=token, allow_enable=True)
+
+
+def enable_entitlement_by_name(
+    cfg: config.UAConfig,
+    name: str,
+    *,
+    assume_yes: bool = False,
+    allow_beta: bool = False
+):
+    """
+    Constructs an entitlement based on the name provided. Passes kwargs onto
+    the entitlement constructor.
+    :raise EntitlementNotFoundError: If no entitlement with the given name is
+        found, then raises this error.
+    """
+    ent_cls = entitlements.entitlement_factory(name)
+    entitlement = ent_cls(
+        cfg, assume_yes=assume_yes, allow_beta=allow_beta, called_name=name
+    )
+    return entitlement.enable()
+
+
+def status(
+    cfg: config.UAConfig,
+    *,
+    simulate_with_token: Optional[str] = None,
+    show_beta: bool = False
+):
+    """
+    Construct the current UA status dictionary.
+    """
+    if simulate_with_token:
+        status, ret = cfg.simulate_status(
+            token=simulate_with_token, show_beta=show_beta
+        )
+    else:
+        status = cfg.status(show_beta=show_beta)
+        ret = 0
+
+    return status, ret
diff --git a/uaclient/apt.py b/uaclient/apt.py
index f6e86a7..e84d3cf 100644
--- a/uaclient/apt.py
+++ b/uaclient/apt.py
@@ -6,7 +6,7 @@ import subprocess
 import tempfile
 from typing import Dict, List, Optional
 
-from uaclient import exceptions, gpg, status, util
+from uaclient import event_logger, exceptions, gpg, messages, util
 
 APT_HELPER_TIMEOUT = 60.0  # 60 second timeout used for apt-helper call
 APT_AUTH_COMMENT = "  # ubuntu-advantage-tools"
@@ -27,6 +27,8 @@ APT_PROXY_CONF_FILE = "/etc/apt/apt.conf.d/90ubuntu-advantage-aptproxy"
 # Hope for an optimal first try.
 APT_RETRIES = [1.0, 5.0, 10.0]
 
+event = event_logger.get_event_logger()
+
 
 def assert_valid_apt_credentials(repo_url, username, password):
     """Validate apt credentials for a PPA.
@@ -55,7 +57,7 @@ def assert_valid_apt_credentials(repo_url, username, password):
                 timeout=APT_HELPER_TIMEOUT,
                 retry_sleeps=APT_RETRIES,
             )
-    except util.ProcessExecutionError as e:
+    except exceptions.ProcessExecutionError as e:
         if e.exit_code == 100:
             stderr = str(e.stderr).lower()
             if re.search(r"401\s+unauthorized|httperror401", stderr):
@@ -80,7 +82,9 @@ def assert_valid_apt_credentials(repo_url, username, password):
         )
 
 
-def _parse_apt_update_for_invalid_apt_config(apt_error: str) -> str:
+def _parse_apt_update_for_invalid_apt_config(
+    apt_error: str
+) -> Optional[messages.NamedMessage]:
     """Parse apt update errors for invalid apt config in user machine.
 
     This functions parses apt update errors regarding the presence of
@@ -96,9 +100,9 @@ def _parse_apt_update_for_invalid_apt_config(apt_error: str) -> str:
     message.
 
     :param apt_error: The apt error string
-    :return: a string containing the parsed error message.
+    :return: a NamedMessage containing the error message
     """
-    error_msg = ""
+    error_msg = None
     failed_repos = set()
 
     for line in apt_error.strip().split("\n"):
@@ -115,17 +119,18 @@ def _parse_apt_update_for_invalid_apt_config(apt_error: str) -> str:
                 failed_repos.add(repo_url_match)
 
     if failed_repos:
-        error_msg += "\n"
-        error_msg += status.MESSAGE_APT_UPDATE_INVALID_URL_CONFIG.format(
-            "s" if len(failed_repos) > 1 else "",
-            "\n".join(sorted(failed_repos)),
+        error_msg = messages.APT_UPDATE_INVALID_URL_CONFIG.format(
+            plural="s" if len(failed_repos) > 1 else "",
+            failed_repos="\n".join(sorted(failed_repos)),
         )
 
     return error_msg
 
 
 def run_apt_command(
-    cmd: List[str], error_msg: str, env: Optional[Dict[str, str]] = {}
+    cmd: List[str],
+    error_msg: Optional[str] = None,
+    env: Optional[Dict[str, str]] = {},
 ) -> str:
     """Run an apt command, retrying upon failure APT_RETRIES times.
 
@@ -141,18 +146,66 @@ def run_apt_command(
         out, _err = util.subp(
             cmd, capture=True, retry_sleeps=APT_RETRIES, env=env
         )
-    except util.ProcessExecutionError as e:
+    except exceptions.ProcessExecutionError as e:
         if "Could not get lock /var/lib/dpkg/lock" in str(e.stderr):
-            error_msg += " Another process is running APT."
+            raise exceptions.APTProcessConflictError()
         else:
             """
             Treat errors where one of the APT repositories
             is invalid or unreachable. In that situation, we alert
             which repository is causing the error
             """
-            error_msg += _parse_apt_update_for_invalid_apt_config(e.stderr)
+            repo_error_msg = _parse_apt_update_for_invalid_apt_config(e.stderr)
+            if repo_error_msg:
+                raise exceptions.APTInvalidRepoError(
+                    error_msg=repo_error_msg.msg
+                )
+
+        msg = error_msg if error_msg else str(e)
+        raise exceptions.UserFacingError(msg)
+    return out
+
+
+def run_apt_update_command(env: Optional[Dict[str, str]] = {}) -> str:
+    try:
+        out = run_apt_command(cmd=["apt-get", "update"], env=env)
+    except exceptions.APTProcessConflictError:
+        raise exceptions.APTUpdateProcessConflictError()
+    except exceptions.APTInvalidRepoError as e:
+        raise exceptions.APTUpdateInvalidRepoError(repo_msg=e.msg)
+    except exceptions.UserFacingError as e:
+        raise exceptions.UserFacingError(
+            msg=messages.APT_UPDATE_FAILED.msg + "\n" + e.msg,
+            msg_code=messages.APT_UPDATE_FAILED.name,
+        )
+
+    return out
+
+
+def run_apt_install_command(
+    packages: List[str],
+    apt_options: Optional[List[str]] = None,
+    error_msg: Optional[str] = None,
+    env: Optional[Dict[str, str]] = {},
+) -> str:
+    if apt_options is None:
+        apt_options = []
+
+    try:
+        out = run_apt_command(
+            cmd=["apt-get", "install", "--assume-yes"]
+            + apt_options
+            + packages,
+            error_msg=error_msg,
+            env=env,
+        )
+    except exceptions.APTProcessConflictError:
+        raise exceptions.APTInstallProcessConflictError(header_msg=error_msg)
+    except exceptions.APTInvalidRepoError as e:
+        raise exceptions.APTInstallInvalidRepoError(
+            repo_msg=e.msg, header_msg=error_msg
+        )
 
-        raise exceptions.UserFacingError(error_msg)
     return out
 
 
@@ -181,7 +234,7 @@ def add_auth_apt_repo(
     # Does this system have updates suite enabled?
     updates_enabled = False
     policy = run_apt_command(
-        ["apt-cache", "policy"], status.MESSAGE_APT_POLICY_FAILED
+        ["apt-cache", "policy"], messages.APT_POLICY_FAILED.msg
     )
     for line in policy.splitlines():
         # We only care about $suite-updates lines
@@ -403,7 +456,7 @@ def setup_apt_proxy(
     :return: None
     """
     if http_proxy or https_proxy:
-        print(status.MESSAGE_SETTING_SERVICE_PROXY.format(service="APT"))
+        event.info(messages.SETTING_SERVICE_PROXY.format(service="APT"))
 
     apt_proxy_config = ""
     if http_proxy:
@@ -413,9 +466,7 @@ def setup_apt_proxy(
             proxy_url=https_proxy
         )
     if apt_proxy_config != "":
-        apt_proxy_config = (
-            status.MESSAGE_APT_PROXY_CONFIG_HEADER + apt_proxy_config
-        )
+        apt_proxy_config = messages.APT_PROXY_CONFIG_HEADER + apt_proxy_config
 
     if apt_proxy_config == "":
         util.remove_file(APT_PROXY_CONF_FILE)
diff --git a/uaclient/cli.py b/uaclient/cli.py
index 340516c..6af7e74 100644
--- a/uaclient/cli.py
+++ b/uaclient/cli.py
@@ -15,8 +15,7 @@ import tempfile
 import textwrap
 import time
 from functools import wraps
-from typing import Optional  # noqa: F401
-from typing import List, Tuple
+from typing import List, Optional, Tuple  # noqa
 
 import yaml
 
@@ -25,9 +24,11 @@ from uaclient import (
     config,
     contract,
     entitlements,
+    event_logger,
     exceptions,
     jobs,
     lock,
+    messages,
     security,
     security_status,
 )
@@ -35,6 +36,7 @@ from uaclient import status as ua_status
 from uaclient import util, version
 from uaclient.clouds import AutoAttachCloudInstance  # noqa: F401
 from uaclient.clouds import identity
+from uaclient.data_types import AttachActionsConfigFile, IncorrectTypeError
 from uaclient.defaults import (
     CLOUD_BUILD_INFO,
     CONFIG_FIELD_ENVVAR_ALLOWLIST,
@@ -82,6 +84,8 @@ UA_SERVICES = (
     "ua-license-check.timer",
 )
 
+event = event_logger.get_event_logger()
+
 
 class UAArgumentParser(argparse.ArgumentParser):
     def __init__(
@@ -128,31 +132,31 @@ class UAArgumentParser(argparse.ArgumentParser):
 
         resources = contract.get_available_resources(config.UAConfig())
         for resource in resources:
-            ent_cls = entitlements.entitlement_factory(resource["name"])
-            if ent_cls:
-                # Because we don't know the presentation name if unattached
-                presentation_name = resource.get(
-                    "presentedAs", resource["name"]
-                )
-                if ent_cls.help_doc_url:
-                    url = " ({})".format(ent_cls.help_doc_url)
-                else:
-                    url = ""
-                service_info = textwrap.fill(
-                    service_info_tmpl.format(
-                        name=presentation_name,
-                        description=ent_cls.description,
-                        url=url,
-                    ),
-                    width=PRINT_WRAP_WIDTH,
-                    subsequent_indent="   ",
-                    break_long_words=False,
-                    break_on_hyphens=False,
-                )
-                if ent_cls.is_beta:
-                    beta_services_desc.append(service_info)
-                else:
-                    non_beta_services_desc.append(service_info)
+            try:
+                ent_cls = entitlements.entitlement_factory(resource["name"])
+            except exceptions.EntitlementNotFoundError:
+                continue
+            # Because we don't know the presentation name if unattached
+            presentation_name = resource.get("presentedAs", resource["name"])
+            if ent_cls.help_doc_url:
+                url = " ({})".format(ent_cls.help_doc_url)
+            else:
+                url = ""
+            service_info = textwrap.fill(
+                service_info_tmpl.format(
+                    name=presentation_name,
+                    description=ent_cls.description,
+                    url=url,
+                ),
+                width=PRINT_WRAP_WIDTH,
+                subsequent_indent="   ",
+                break_long_words=False,
+                break_on_hyphens=False,
+            )
+            if ent_cls.is_beta:
+                beta_services_desc.append(service_info)
+            else:
+                non_beta_services_desc.append(service_info)
 
         return (non_beta_services_desc, beta_services_desc)
 
@@ -179,7 +183,25 @@ def assert_root(f):
     def new_f(*args, **kwargs):
         if os.getuid() != 0:
             raise exceptions.NonRootUserError()
-        return f(*args, **kwargs)
+        else:
+            return f(*args, **kwargs)
+
+    return new_f
+
+
+def verify_json_format_args(f):
+    """Decorator to verify if correct params are used for json format"""
+
+    @wraps(f)
+    def new_f(cmd_args, *args, **kwargs):
+        if not cmd_args:
+            return f(cmd_args, *args, **kwargs)
+
+        if cmd_args.format == "json" and not cmd_args.assume_yes:
+            msg = messages.JSON_FORMAT_REQUIRE_ASSUME_YES
+            raise exceptions.UserFacingError(msg=msg.msg, msg_code=msg.name)
+        else:
+            return f(cmd_args, *args, **kwargs)
 
     return new_f
 
@@ -352,6 +374,21 @@ def attach_parser(parser):
         dest="auto_enable",
         help="do not enable any recommended services automatically",
     )
+    parser.add_argument(
+        "--attach-config",
+        type=argparse.FileType("r"),
+        help=(
+            "use the provided attach config file instead of passing the token"
+            " on the cli"
+        ),
+    )
+    parser.add_argument(
+        "--format",
+        action="store",
+        choices=["cli", "json"],
+        default="cli",
+        help=("output enable in the specified format (default: cli)"),
+    )
     return parser
 
 
@@ -389,15 +426,6 @@ def security_status_parser(parser):
         choices=("json", "yaml"),
         required=True,
     )
-    parser.add_argument(
-        "--beta",
-        help=(
-            "Acknowledge that this output is not final and may change in the"
-            " next version"
-        ),
-        action="store_true",
-        required=True,
-    )
     return parser
 
 
@@ -465,6 +493,13 @@ def detach_parser(parser):
         action="store_true",
         help="do not prompt for confirmation before performing the detach",
     )
+    parser.add_argument(
+        "--format",
+        action="store",
+        choices=["cli", "json"],
+        default="cli",
+        help=("output enable in the specified format (default: cli)"),
+    )
     return parser
 
 
@@ -534,6 +569,13 @@ def enable_parser(parser):
     parser.add_argument(
         "--beta", action="store_true", help="allow beta service to be enabled"
     )
+    parser.add_argument(
+        "--format",
+        action="store",
+        choices=["cli", "json"],
+        default="cli",
+        help=("output enable in the specified format (default: cli)"),
+    )
     return parser
 
 
@@ -561,6 +603,13 @@ def disable_parser(parser):
         action="store_true",
         help="do not prompt for confirmation before performing the disable",
     )
+    parser.add_argument(
+        "--format",
+        action="store",
+        choices=["cli", "json"],
+        default="cli",
+        help=("output disable in the specified format (default: cli)"),
+    )
     return parser
 
 
@@ -643,7 +692,7 @@ def status_parser(parser):
     return parser
 
 
-def _perform_disable(entitlement_name, cfg, *, assume_yes):
+def _perform_disable(entitlement, cfg, *, assume_yes, update_status=True):
     """Perform the disable action on a named entitlement.
 
     :param entitlement_name: the name of the entitlement to enable
@@ -653,10 +702,27 @@ def _perform_disable(entitlement_name, cfg, *, assume_yes):
 
     @return: True on success, False otherwise
     """
-    ent_cls = entitlements.entitlement_factory(entitlement_name)
-    entitlement = ent_cls(cfg, assume_yes=assume_yes)
-    ret = entitlement.disable()
-    cfg.status()  # Update the status cache
+    ret, reason = entitlement.disable()
+
+    if not ret:
+        event.service_failed(entitlement.name)
+
+        if reason is not None and isinstance(
+            reason, ua_status.CanDisableFailure
+        ):
+            if reason.message is not None:
+                event.info(reason.message.msg)
+                event.error(
+                    error_msg=reason.message.msg,
+                    error_code=reason.message.name,
+                    service=entitlement.name,
+                )
+    else:
+        event.service_processed(entitlement.name)
+
+    if update_status:
+        cfg.status()  # Update the status cache
+
     return ret
 
 
@@ -709,7 +775,7 @@ def action_config_show(args, *, cfg, **kwargs):
             raise exceptions.UserFacingError(
                 textwrap.fill(
                     msg,
-                    width=ua_status.PRINT_WRAP_WIDTH,
+                    width=PRINT_WRAP_WIDTH,
                     subsequent_indent=" " * indent_position,
                 )
             )
@@ -844,8 +910,9 @@ def action_config_unset(args, *, cfg, **kwargs):
     return 0
 
 
+@verify_json_format_args
 @assert_root
-@assert_attached(ua_status.MESSAGE_ENABLE_FAILURE_UNATTACHED_TMPL)
+@assert_attached(messages.ENABLE_FAILURE_UNATTACHED)
 @assert_lock_file("ua disable")
 def action_disable(args, *, cfg, **kwargs):
     """Perform the disable action on a list of entitlements.
@@ -856,11 +923,13 @@ def action_disable(args, *, cfg, **kwargs):
     entitlements_found, entitlements_not_found = get_valid_entitlement_names(
         names
     )
-    tmpl = ua_status.MESSAGE_INVALID_SERVICE_OP_FAILURE_TMPL
     ret = True
 
-    for entitlement in entitlements_found:
-        ret &= _perform_disable(entitlement, cfg, assume_yes=args.assume_yes)
+    for ent_name in entitlements_found:
+        ent_cls = entitlements.entitlement_factory(ent_name)
+        ent = ent_cls(cfg, assume_yes=args.assume_yes)
+
+        ret &= _perform_disable(ent, cfg, assume_yes=args.assume_yes)
 
     if entitlements_not_found:
         valid_names = (
@@ -876,50 +945,68 @@ def action_disable(args, *, cfg, **kwargs):
                 break_on_hyphens=False,
             )
         )
-        raise exceptions.UserFacingError(
-            tmpl.format(
-                operation="disable",
-                name=", ".join(entitlements_not_found),
-                service_msg=service_msg,
-            )
+        raise exceptions.InvalidServiceToDisableError(
+            operation="disable",
+            name=", ".join(entitlements_not_found),
+            service_msg=service_msg,
         )
 
+    event.process_events()
     return 0 if ret else 1
 
 
+def _create_enable_entitlements_not_found_message(
+    entitlements_not_found, *, allow_beta: bool
+) -> messages.NamedMessage:
+    """
+    Constructs the MESSAGE_INVALID_SERVICE_OP_FAILURE message
+    based on the attempted services and valid services.
+    """
+    valid_services_names = entitlements.valid_services(allow_beta=allow_beta)
+    valid_names = ", ".join(valid_services_names)
+    service_msg = "\n".join(
+        textwrap.wrap(
+            "Try " + valid_names + ".",
+            width=80,
+            break_long_words=False,
+            break_on_hyphens=False,
+        )
+    )
+
+    return messages.INVALID_SERVICE_OP_FAILURE.format(
+        operation="enable",
+        name=", ".join(entitlements_not_found),
+        service_msg=service_msg,
+    )
+
+
+@verify_json_format_args
 @assert_root
-@assert_attached(ua_status.MESSAGE_ENABLE_FAILURE_UNATTACHED_TMPL)
+@assert_attached(messages.ENABLE_FAILURE_UNATTACHED)
 @assert_lock_file("ua enable")
 def action_enable(args, *, cfg, **kwargs):
     """Perform the enable action on a named entitlement.
 
     @return: 0 on success, 1 otherwise
     """
-    print(ua_status.MESSAGE_REFRESH_CONTRACT_ENABLE)
+    event.info(messages.REFRESH_CONTRACT_ENABLE)
     try:
         contract.request_updated_contract(cfg)
-    except (util.UrlError, exceptions.UserFacingError):
+    except (exceptions.UrlError, exceptions.UserFacingError):
         # Inability to refresh is not a critical issue during enable
-        logging.debug(
-            ua_status.MESSAGE_REFRESH_CONTRACT_FAILURE, exc_info=True
-        )
+        logging.debug(messages.REFRESH_CONTRACT_FAILURE, exc_info=True)
+        event.warning(warning_msg=messages.REFRESH_CONTRACT_FAILURE)
 
     names = getattr(args, "service", [])
     entitlements_found, entitlements_not_found = get_valid_entitlement_names(
         names
     )
-    valid_services_names = entitlements.valid_services(allow_beta=args.beta)
     ret = True
     for ent_name in entitlements_found:
         try:
-            ent_cls = entitlements.entitlement_factory(ent_name)
-            entitlement = ent_cls(
-                cfg,
-                assume_yes=args.assume_yes,
-                allow_beta=args.beta,
-                called_name=ent_name,
+            ent_ret, reason = actions.enable_entitlement_by_name(
+                cfg, ent_name, assume_yes=args.assume_yes, allow_beta=args.beta
             )
-            ent_ret, reason = entitlement.enable()
             cfg.status()  # Update the status cache
 
             if (
@@ -928,39 +1015,41 @@ def action_enable(args, *, cfg, **kwargs):
                 and isinstance(reason, ua_status.CanEnableFailure)
             ):
                 if reason.message is not None:
-                    print(reason.message)
+                    event.info(reason.message.msg)
+                    event.error(
+                        error_msg=reason.message.msg,
+                        error_code=reason.message.name,
+                        service=ent_name,
+                    )
                 if reason.reason == ua_status.CanEnableFailureReason.IS_BETA:
                     # if we failed because ent is in beta and there was no
                     # allow_beta flag/config, pretend it doesn't exist
                     entitlements_not_found.append(ent_name)
+            elif ent_ret:
+                event.service_processed(service=ent_name)
+            elif not ent_ret and reason is None:
+                event.service_failed(service=ent_name)
 
             ret &= ent_ret
         except exceptions.UserFacingError as e:
-            print(e)
+            event.info(e.msg)
+            event.error(
+                error_msg=e.msg, error_code=e.msg_code, service=ent_name
+            )
             ret = False
 
     if entitlements_not_found:
-        valid_names = ", ".join(valid_services_names)
-        service_msg = "\n".join(
-            textwrap.wrap(
-                "Try " + valid_names + ".",
-                width=80,
-                break_long_words=False,
-                break_on_hyphens=False,
-            )
-        )
-        tmpl = ua_status.MESSAGE_INVALID_SERVICE_OP_FAILURE_TMPL
-        raise exceptions.UserFacingError(
-            tmpl.format(
-                operation="enable",
-                name=", ".join(entitlements_not_found),
-                service_msg=service_msg,
-            )
+        msg = _create_enable_entitlements_not_found_message(
+            entitlements_not_found, allow_beta=args.beta
         )
+        event.services_failed(entitlements_not_found)
+        raise exceptions.UserFacingError(msg=msg.msg, msg_code=msg.name)
 
+    event.process_events()
     return 0 if ret else 1
 
 
+@verify_json_format_args
 @assert_root
 @assert_attached()
 @assert_lock_file("ua detach")
@@ -985,11 +1074,15 @@ def _detach(cfg: config.UAConfig, assume_yes: bool) -> int:
     to_disable = []
     for ent_cls in entitlements.ENTITLEMENT_CLASSES:
         ent = ent_cls(cfg=cfg, assume_yes=assume_yes)
-        if ent.can_disable(silent=True):
+        # For detach, we should not consider that a service
+        # cannot be disabled because of dependent services,
+        # since we are going to disable all of them anyway
+        ret, _ = ent.can_disable(ignore_dependent_services=True)
+        if ret:
             to_disable.append(ent)
 
     """
-    We will nake sure that services without dependencies are disabled first
+    We will make sure that services without dependencies are disabled first
     PS: This will only work because we have only three services with reverse
     dependencies:
     * ros: ros-updates
@@ -1007,40 +1100,47 @@ def _detach(cfg: config.UAConfig, assume_yes: bool) -> int:
 
     if to_disable:
         suffix = "s" if len(to_disable) > 1 else ""
-        print("Detach will disable the following service{}:".format(suffix))
+        event.info(
+            "Detach will disable the following service{}:".format(suffix)
+        )
         for ent in to_disable:
-            print("    {}".format(ent.name))
+            event.info("    {}".format(ent.name))
     if not util.prompt_for_confirmation(assume_yes=assume_yes):
         return 1
     for ent in to_disable:
-        ent.disable(silent=False)
-    contract_client = contract.UAContractClient(cfg)
-    machine_token = cfg.machine_token["machineToken"]
-    contract_id = cfg.machine_token["machineTokenInfo"]["contractInfo"]["id"]
-    contract_client.detach_machine_from_contract(machine_token, contract_id)
+        _perform_disable(ent, cfg, assume_yes=assume_yes, update_status=False)
+
     cfg.delete_cache()
     jobs.enable_license_check_if_applicable(cfg)
     update_apt_and_motd_messages(cfg)
-    print(ua_status.MESSAGE_DETACH_SUCCESS)
+    event.info(messages.DETACH_SUCCESS)
+    event.process_events()
     return 0
 
 
 def _post_cli_attach(cfg: config.UAConfig) -> None:
-    contract_name = cfg.machine_token["machineTokenInfo"]["contractInfo"][
-        "name"
-    ]
+    contract_name = None
+
+    if cfg.machine_token:
+        contract_name = (
+            cfg.machine_token.get("machineTokenInfo", {})
+            .get("contractInfo", {})
+            .get("name")
+        )
 
     if contract_name:
-        print(
-            ua_status.MESSAGE_ATTACH_SUCCESS_TMPL.format(
-                contract_name=contract_name
-            )
+        event.info(
+            messages.ATTACH_SUCCESS_TMPL.format(contract_name=contract_name)
         )
     else:
-        print(ua_status.MESSAGE_ATTACH_SUCCESS_NO_CONTRACT_NAME)
+        event.info(messages.ATTACH_SUCCESS_NO_CONTRACT_NAME)
 
     jobs.disable_license_check_if_applicable(cfg)
-    action_status(args=None, cfg=cfg)
+
+    status, _ret = actions.status(cfg)
+    output = ua_status.format_tabular(status)
+    event.info(util.handle_unicode_characters(output))
+    event.process_events()
 
 
 @assert_root
@@ -1064,27 +1164,25 @@ def action_auto_attach(args, *, cfg):
             raise exceptions.AlreadyAttachedError(cfg)
         if isinstance(e, exceptions.CloudFactoryNoCloudError):
             raise exceptions.UserFacingError(
-                ua_status.MESSAGE_UNABLE_TO_DETERMINE_CLOUD_TYPE
+                messages.UNABLE_TO_DETERMINE_CLOUD_TYPE
             )
         if isinstance(e, exceptions.CloudFactoryNonViableCloudError):
-            raise exceptions.UserFacingError(
-                ua_status.MESSAGE_UNSUPPORTED_AUTO_ATTACH
-            )
+            raise exceptions.UserFacingError(messages.UNSUPPORTED_AUTO_ATTACH)
         if isinstance(e, exceptions.CloudFactoryUnsupportedCloudError):
             raise exceptions.NonAutoAttachImageError(
-                ua_status.MESSAGE_UNSUPPORTED_AUTO_ATTACH_CLOUD_TYPE.format(
+                messages.UNSUPPORTED_AUTO_ATTACH_CLOUD_TYPE.format(
                     cloud_type=e.cloud_type
                 )
             )
         # we shouldn't get here, but this is a reasonable default just in case
         raise exceptions.UserFacingError(
-            ua_status.MESSAGE_UNABLE_TO_DETERMINE_CLOUD_TYPE
+            messages.UNABLE_TO_DETERMINE_CLOUD_TYPE
         )
 
     if not instance:
         # we shouldn't get here, but this is a reasonable default just in case
         raise exceptions.UserFacingError(
-            ua_status.MESSAGE_UNABLE_TO_DETERMINE_CLOUD_TYPE
+            messages.UNABLE_TO_DETERMINE_CLOUD_TYPE
         )
 
     current_iid = identity.get_instance_id()
@@ -1095,13 +1193,13 @@ def action_auto_attach(args, *, cfg):
         print("Re-attaching Ubuntu Advantage subscription on new instance")
         if _detach(cfg, assume_yes=True) != 0:
             raise exceptions.UserFacingError(
-                ua_status.MESSAGE_DETACH_AUTOMATION_FAILURE
+                messages.DETACH_AUTOMATION_FAILURE
             )
 
     try:
         actions.auto_attach(cfg, instance)
-    except util.UrlError:
-        print(ua_status.MESSAGE_ATTACH_FAILURE)
+    except exceptions.UrlError:
+        event.info(messages.ATTACH_FAILURE)
         return 1
     except exceptions.UserFacingError:
         return 1
@@ -1114,22 +1212,83 @@ def action_auto_attach(args, *, cfg):
 @assert_root
 @assert_lock_file("ua attach")
 def action_attach(args, *, cfg):
-    if not args.token:
+    if not args.token and not args.attach_config:
         raise exceptions.UserFacingError(
-            ua_status.MESSAGE_ATTACH_REQUIRES_TOKEN
+            msg=messages.ATTACH_REQUIRES_TOKEN.msg,
+            msg_code=messages.ATTACH_REQUIRES_TOKEN.name,
         )
-    try:
-        actions.attach_with_token(
-            cfg, token=args.token, allow_enable=args.auto_enable
+    if args.token and args.attach_config:
+        raise exceptions.UserFacingError(
+            msg=messages.ATTACH_TOKEN_ARG_XOR_CONFIG.msg,
+            msg_code=messages.ATTACH_TOKEN_ARG_XOR_CONFIG.name,
         )
-    except util.UrlError:
-        print(ua_status.MESSAGE_ATTACH_FAILURE)
+
+    if args.token:
+        token = args.token
+        enable_services_override = None
+    else:
+        try:
+            attach_config = AttachActionsConfigFile.from_dict(
+                yaml.safe_load(args.attach_config)
+            )
+        except IncorrectTypeError as e:
+            raise exceptions.AttachInvalidConfigFileError(
+                config_name=args.attach_config.name, error=e.msg
+            )
+
+        token = attach_config.token
+        enable_services_override = attach_config.enable_services
+
+    allow_enable = args.auto_enable and enable_services_override is None
+
+    try:
+        actions.attach_with_token(cfg, token=token, allow_enable=allow_enable)
+    except exceptions.UrlError:
+        msg = messages.ATTACH_FAILURE
+        event.info(msg.msg)
+        event.error(error_msg=msg.msg, error_code=msg.name)
+        event.process_events()
         return 1
-    except exceptions.UserFacingError:
+    except exceptions.UserFacingError as exc:
+        event.info(exc.msg)
+        event.error(error_msg=exc.msg, error_code=exc.msg_code)
+        event.process_events()
         return 1
     else:
+        ret = 0
+        if enable_services_override is not None and args.auto_enable:
+            found, not_found = get_valid_entitlement_names(
+                enable_services_override
+            )
+            for name in found:
+                ent_ret, reason = actions.enable_entitlement_by_name(
+                    cfg, name, assume_yes=True, allow_beta=True
+                )
+                if not ent_ret:
+                    ret = 1
+                    if (
+                        reason is not None
+                        and isinstance(reason, ua_status.CanEnableFailure)
+                        and reason.message is not None
+                    ):
+                        event.info(reason.message.msg)
+                        event.error(
+                            error_msg=reason.message.msg,
+                            error_code=reason.message.name,
+                            service=name,
+                        )
+                else:
+                    event.service_processed(name)
+
+            if not_found:
+                msg = _create_enable_entitlements_not_found_message(
+                    not_found, allow_beta=True
+                )
+                event.info(msg.msg, file_type=sys.stderr)
+                event.error(error_msg=msg.msg, error_code=msg.name)
+                ret = 1
         _post_cli_attach(cfg)
-        return 0
+        return ret
 
 
 def _write_command_output_to_file(
@@ -1138,7 +1297,7 @@ def _write_command_output_to_file(
     """Helper which runs a command and writes output or error to filename."""
     try:
         out, _ = util.subp(cmd.split(), rcs=return_codes)
-    except util.ProcessExecutionError as e:
+    except exceptions.ProcessExecutionError as e:
         util.write_file("{}-error".format(filename), str(e))
     else:
         util.write_file(filename, out)
@@ -1326,26 +1485,27 @@ def action_status(args, *, cfg):
         cfg = config.UAConfig()
     show_beta = args.all if args else False
     token = args.simulate_with_token if args else None
-    if token:
-        status = cfg.simulate_status(token=token, show_beta=show_beta)
-    else:
-        status = cfg.status(show_beta=show_beta)
     active_value = ua_status.UserFacingConfigStatus.ACTIVE.value
+
+    status, ret = actions.status(
+        cfg, simulate_with_token=token, show_beta=show_beta
+    )
     config_active = bool(status["execution_status"] == active_value)
+
     if args and args.wait and config_active:
         while status["execution_status"] == active_value:
-            print(".", end="")
+            event.info(".", end="")
             time.sleep(1)
-            status = cfg.status(show_beta=show_beta)
-        print("")
-    if args and args.format == "json":
-        print(ua_status.format_json_status(status))
-    elif args and args.format == "yaml":
-        print(ua_status.format_yaml_status(status))
-    else:
-        output = ua_status.format_tabular(status)
-        print(util.handle_unicode_characters(output))
-    return 0
+            status, ret = actions.status(
+                cfg, simulate_with_token=token, show_beta=show_beta
+            )
+        event.info("")
+
+    event.set_output_content(status)
+    output = ua_status.format_tabular(status)
+    event.info(util.handle_unicode_characters(output))
+    event.process_events()
+    return ret
 
 
 def get_version(_args=None, _cfg=None):
@@ -1365,23 +1525,19 @@ def _action_refresh_config(args, cfg: config.UAConfig):
     except RuntimeError as exc:
         with util.disable_log_to_console():
             logging.exception(exc)
-        raise exceptions.UserFacingError(
-            ua_status.MESSAGE_REFRESH_CONFIG_FAILURE
-        )
-    print(ua_status.MESSAGE_REFRESH_CONFIG_SUCCESS)
+        raise exceptions.UserFacingError(messages.REFRESH_CONFIG_FAILURE)
+    print(messages.REFRESH_CONFIG_SUCCESS)
 
 
 @assert_attached()
 def _action_refresh_contract(_args, cfg: config.UAConfig):
     try:
         contract.request_updated_contract(cfg)
-    except util.UrlError as exc:
+    except exceptions.UrlError as exc:
         with util.disable_log_to_console():
             logging.exception(exc)
-        raise exceptions.UserFacingError(
-            ua_status.MESSAGE_REFRESH_CONTRACT_FAILURE
-        )
-    print(ua_status.MESSAGE_REFRESH_CONTRACT_SUCCESS)
+        raise exceptions.UserFacingError(messages.REFRESH_CONTRACT_FAILURE)
+    print(messages.REFRESH_CONTRACT_SUCCESS)
 
 
 @assert_root
@@ -1444,8 +1600,10 @@ def setup_logging(console_level, log_level, log_file=None, logger=None):
     if os.getuid() == 0:
         # Setup readable-by-root-only debug file logging if running as root
         log_file_path = pathlib.Path(log_file)
-        log_file_path.touch()
-        log_file_path.chmod(0o600)
+
+        if not log_file_path.exists():
+            log_file_path.touch()
+            log_file_path.chmod(0o644)
 
         file_handler = logging.FileHandler(log_file)
         file_handler.setLevel(log_level)
@@ -1454,6 +1612,17 @@ def setup_logging(console_level, log_level, log_file=None, logger=None):
         logger.addHandler(file_handler)
 
 
+def set_event_mode(cmd_args):
+    """Set the right event mode based on the args provided"""
+    if cmd_args.command in ("attach", "detach", "enable", "disable", "status"):
+        event.set_command(cmd_args.command)
+        if hasattr(cmd_args, "format"):
+            if cmd_args.format == "json":
+                event.set_event_mode(event_logger.EventLoggerMode.JSON)
+            if cmd_args.format == "yaml":
+                event.set_event_mode(event_logger.EventLoggerMode.YAML)
+
+
 def main_error_handler(func):
     def wrapper(*args, **kwargs):
         try:
@@ -1464,40 +1633,53 @@ def main_error_handler(func):
             print("Interrupt received; exiting.", file=sys.stderr)
             lock.clear_lock_file_if_present()
             sys.exit(1)
-        except util.UrlError as exc:
+        except exceptions.UrlError as exc:
             if "CERTIFICATE_VERIFY_FAILED" in str(exc):
-                tmpl = ua_status.MESSAGE_SSL_VERIFICATION_ERROR_CA_CERTIFICATES
+                tmpl = messages.SSL_VERIFICATION_ERROR_CA_CERTIFICATES
                 if util.is_installed("ca-certificates"):
-                    tmpl = (
-                        ua_status.MESSAGE_SSL_VERIFICATION_ERROR_OPENSSL_CONFIG
-                    )
-                print(tmpl.format(url=exc.url), file=sys.stderr)
+                    tmpl = messages.SSL_VERIFICATION_ERROR_OPENSSL_CONFIG
+                msg = tmpl.format(url=exc.url)
+                event.error(error_msg=msg.msg, error_code=msg.name)
+                event.info(info_msg=msg.msg, file_type=sys.stderr)
             else:
                 with util.disable_log_to_console():
                     msg_args = {"url": exc.url, "error": exc}
                     if exc.url:
                         msg_tmpl = (
-                            ua_status.LOG_CONNECTIVITY_ERROR_WITH_URL_TMPL
+                            messages.LOG_CONNECTIVITY_ERROR_WITH_URL_TMPL
                         )
                     else:
-                        msg_tmpl = ua_status.LOG_CONNECTIVITY_ERROR_TMPL
+                        msg_tmpl = messages.LOG_CONNECTIVITY_ERROR_TMPL
                     logging.exception(msg_tmpl.format(**msg_args))
-                print(ua_status.MESSAGE_CONNECTIVITY_ERROR, file=sys.stderr)
+
+                msg = messages.CONNECTIVITY_ERROR
+                event.error(error_msg=msg.msg, error_code=msg.name)
+                event.info(info_msg=msg.msg, file_type=sys.stderr)
+
             lock.clear_lock_file_if_present()
+            event.process_events()
             sys.exit(1)
         except exceptions.UserFacingError as exc:
             with util.disable_log_to_console():
                 logging.error(exc.msg)
-            print("{}".format(exc.msg), file=sys.stderr)
+            event.error(error_msg=exc.msg, error_code=exc.msg_code)
+            event.info(info_msg="{}".format(exc.msg), file_type=sys.stderr)
             if not isinstance(exc, exceptions.LockHeldError):
                 # Only clear the lock if it is ours.
                 lock.clear_lock_file_if_present()
+            event.process_events()
             sys.exit(exc.exit_code)
-        except Exception:
+        except Exception as e:
             with util.disable_log_to_console():
                 logging.exception("Unhandled exception, please file a bug")
             lock.clear_lock_file_if_present()
-            print(ua_status.MESSAGE_UNEXPECTED_ERROR, file=sys.stderr)
+            event.info(
+                info_msg=messages.UNEXPECTED_ERROR.msg, file_type=sys.stderr
+            )
+            event.error(
+                error_msg=getattr(e, "msg", str(e)), error_type="exception"
+            )
+            event.process_events()
             sys.exit(1)
 
     return wrapper
@@ -1514,6 +1696,7 @@ def main(sys_argv=None):
         print("Try 'ua --help' for more information.")
         sys.exit(1)
     args = parser.parse_args(args=cli_arguments)
+    set_event_mode(args)
     cfg = config.UAConfig()
 
     http_proxy = cfg.http_proxy
diff --git a/uaclient/clouds/gcp.py b/uaclient/clouds/gcp.py
index 55f518c..c520d47 100644
--- a/uaclient/clouds/gcp.py
+++ b/uaclient/clouds/gcp.py
@@ -20,6 +20,7 @@ GCP_LICENSES = {
     "xenial": "8045211386737108299",
     "bionic": "6022427724719891830",
     "focal": "599959289349842382",
+    "jammy": "2592866803419978320",
 }
 
 
diff --git a/uaclient/clouds/identity.py b/uaclient/clouds/identity.py
index cd8f7b4..7542d35 100644
--- a/uaclient/clouds/identity.py