Merge ~lamoura/ubuntu/+source/ubuntu-advantage-tools:upload-29.1-mantic into ubuntu/+source/ubuntu-advantage-tools:ubuntu/devel

[Lucas Albuquerque Medeiros de Moura]

Add feature that allows the Anbox service to be enabled on a container.
This is the only feature that is being added on top of release 29

[Lucas Albuquerque Medeiros de Moura (lamoura)]

Mantic:
  - Source ubuntu-advantage-tools/29.1~rc1: Published
    + amd64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=amd64&trigger=ubuntu-advantage-tools%2F29.1~rc1&ppa=ua-client%2Fstaging♻️
    + arm64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=arm64&trigger=ubuntu-advantage-tools%2F29.1~rc1&ppa=ua-client%2Fstaging♻️
    + armhf: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=armhf&trigger=ubuntu-advantage-tools%2F29.1~rc1&ppa=ua-client%2Fstaging♻️
    + ppcel64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=ppcel64&trigger=ubuntu-advantage-tools%2F29.1~rc1&ppa=ua-client%2Fstaging♻️
    + riscv64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=riscv64&trigger=ubuntu-advantage-tools%2F29.1~rc1&ppa=ua-client%2Fstaging♻️
    + s390x: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=s390x&trigger=ubuntu-advantage-tools%2F29.1~rc1&ppa=ua-client%2Fstaging♻️
    + amd64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=amd64&trigger=ubuntu-advantage-tools%2F29.1~rc1&ppa=ua-client%2Fstaging💍
    + arm64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=arm64&trigger=ubuntu-advantage-tools%2F29.1~rc1&ppa=ua-client%2Fstaging💍
    + armhf: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=armhf&trigger=ubuntu-advantage-tools%2F29.1~rc1&ppa=ua-client%2Fstaging💍
    + ppcel64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=ppcel64&trigger=ubuntu-advantage-tools%2F29.1~rc1&ppa=ua-client%2Fstaging💍
    + riscv64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=riscv64&trigger=ubuntu-advantage-tools%2F29.1~rc1&ppa=ua-client%2Fstaging💍
    + s390x: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=s390x&trigger=ubuntu-advantage-tools%2F29.1~rc1&ppa=ua-client%2Fstaging💍

Lunar:
  - Source ubuntu-advantage-tools/29.1~23.04~rc1: Published
    + amd64: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=amd64&trigger=ubuntu-advantage-tools%2F29.1~23.04~rc1&ppa=ua-client%2Fstaging♻️
    + arm64: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=arm64&trigger=ubuntu-advantage-tools%2F29.1~23.04~rc1&ppa=ua-client%2Fstaging♻️
    + armhf: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubunt...

[Sergio Durigan Junior (sergiodj)]

Thanks, Lucas.

dep8 results look fine.

Everything else LGTM; the changes are simple and don't affect the Debian packaging.

Uploaded:

$ dput ubuntu-advantage-tools_29.1_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/ubuntu-advantage-tools/ubuntu-advantage-tools_29.1_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/ubuntu-advantage-tools/ubuntu-advantage-tools_29.1.dsc: Valid signature from 106DA1C8C3CBBF14
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading ubuntu-advantage-tools_29.1.dsc: done.
  Uploading ubuntu-advantage-tools_29.1.tar.xz: done.
  Uploading ubuntu-advantage-tools_29.1_source.buildinfo: done.
  Uploading ubuntu-advantage-tools_29.1_source.changes: done.
Successfully uploaded packages.

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 26f78a9..6d7a651 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+ubuntu-advantage-tools (29.1) mantic; urgency=medium
+
+  * anbox: allow enabling service on container using the --access-only flag
+
+ -- Lucas Moura <[e-mail]>  Thu, 10 Aug 2023 11:08:46 -0300
+
 ubuntu-advantage-tools (29) mantic; urgency=medium
 
   * d/control:
diff --git a/features/anbox.feature b/features/anbox.feature
index 4f50faa..424b575 100644
--- a/features/anbox.feature
+++ b/features/anbox.feature
@@ -6,16 +6,46 @@ Feature: Enable anbox on Ubuntu
     Scenario Outline: Enable Anbox cloud service in a container
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo and options `--no-auto-enable`
+        When I run `pro status` as non-root
+        Then stdout matches regexp:
+        """
+        anbox-cloud +yes +disabled
+        """
         Then I verify that running `pro enable anbox-cloud` `as non-root` exits `1`
         And I will see the following on stderr:
         """
         This command must be run as root (try using sudo).
         """
-        Then I verify that running `pro enable anbox-cloud` `with sudo` exits `1`
+        When I verify that running `pro enable anbox-cloud` `with sudo` exits `1`
+        Then I will see the following on stdout:
+        """
+        One moment, checking your subscription first
+        It is only possible to enable Anbox Cloud on a container using
+        the --access-only flag.
+        """
+        When I run `pro enable anbox-cloud --access-only` with sudo
         Then I will see the following on stdout:
         """
         One moment, checking your subscription first
-        Cannot install Anbox Cloud on a container.
+        Updating package lists
+        Skipping installing packages
+        Anbox Cloud access enabled
+        """
+        When I run `pro status` as non-root
+        Then stdout matches regexp:
+        """
+        anbox-cloud +yes +enabled
+        """
+        When I run `apt-cache policy` with sudo
+        Then apt-cache policy for the following url has permission `500`
+        """
+        https://archive.anbox-cloud.io/stable <release>/main amd64 Packages
+        """
+        When I run `pro disable anbox-cloud` with sudo
+        And I run `pro status` as non-root
+        Then stdout matches regexp:
+        """
+        anbox-cloud +yes +disabled
         """
 
         Examples: ubuntu release
diff --git a/features/attached_status.feature b/features/attached_status.feature
index 682e229..b59f0bd 100644
--- a/features/attached_status.feature
+++ b/features/attached_status.feature
@@ -182,6 +182,7 @@ Feature: Attached status
         Then stdout matches regexp:
         """
         SERVICE         +ENTITLED +STATUS   +DESCRIPTION
+        anbox-cloud     +yes      +disabled +.*
         esm-apps        +yes      +enabled  +Expanded Security Maintenance for Applications
         esm-infra       +yes      +enabled  +Expanded Security Maintenance for Infrastructure
         usg             +yes      +disabled +Security compliance and audit tools
@@ -194,7 +195,7 @@ Feature: Attached status
         Then stdout matches regexp:
         """
         SERVICE         +ENTITLED +STATUS   +DESCRIPTION
-        anbox-cloud     +yes      +n/a      +.*
+        anbox-cloud     +yes      +disabled +.*
         cc-eal          +yes      +n/a      +Common Criteria EAL2 Provisioning Packages
         esm-apps        +yes      +enabled  +Expanded Security Maintenance for Applications
         esm-infra       +yes      +enabled  +Expanded Security Maintenance for Infrastructure
diff --git a/uaclient/entitlements/anbox.py b/uaclient/entitlements/anbox.py
index 33e94ab..37a2b73 100644
--- a/uaclient/entitlements/anbox.py
+++ b/uaclient/entitlements/anbox.py
@@ -1,12 +1,16 @@
 from typing import Any, Dict, Optional, Tuple
 
 from uaclient import contract, event_logger, messages, system
+from uaclient.entitlements.entitlement_status import (
+    CanEnableFailure,
+    CanEnableFailureReason,
+)
 from uaclient.entitlements.repo import RepoEntitlement
 from uaclient.files.state_files import (
     AnboxCloudData,
     anbox_cloud_credentials_file,
 )
-from uaclient.types import MessagingOperationsDict, StaticAffordance
+from uaclient.types import MessagingOperationsDict
 
 event = event_logger.get_event_logger()
 
@@ -22,24 +26,29 @@ class AnboxEntitlement(RepoEntitlement):
     supports_access_only = True
 
     @property
-    def static_affordances(self) -> Tuple[StaticAffordance, ...]:
-        return (
-            (
-                messages.SERVICE_ERROR_INSTALL_ON_CONTAINER.format(
-                    title=self.title
-                ),
-                lambda: system.is_container(),
-                False,
-            ),
-        )
-
-    @property
     def messaging(self) -> MessagingOperationsDict:
         if not self.access_only:
             return {"post_enable": [messages.ANBOX_RUN_INIT_CMD.msg]}
         else:
             return {}
 
+    def can_enable(self) -> Tuple[bool, Optional[CanEnableFailure]]:
+        ret, reason = super().can_enable()
+
+        if not ret:
+            return ret, reason
+
+        if system.is_container() and not self.access_only:
+            return (
+                False,
+                CanEnableFailure(
+                    CanEnableFailureReason.ONLY_ACCESS_ONLY_SUPPORTED,
+                    messages.ANBOX_FAIL_TO_ENABLE_ON_CONTAINER,
+                ),
+            )
+
+        return True, None
+
     def _perform_enable(self, silent: bool = False) -> bool:
         ret = super()._perform_enable(silent=silent)
 
diff --git a/uaclient/entitlements/entitlement_status.py b/uaclient/entitlements/entitlement_status.py
index baa123f..af8bb5f 100644
--- a/uaclient/entitlements/entitlement_status.py
+++ b/uaclient/entitlements/entitlement_status.py
@@ -96,6 +96,7 @@ class CanEnableFailureReason(enum.Enum):
     INCOMPATIBLE_SERVICE = object()
     INACTIVE_REQUIRED_SERVICES = object()
     ACCESS_ONLY_NOT_SUPPORTED = object()
+    ONLY_ACCESS_ONLY_SUPPORTED = object()
 
 
 class CanEnableFailure:
diff --git a/uaclient/messages.py b/uaclient/messages.py
index 976c2a9..4fd06d8 100644
--- a/uaclient/messages.py
+++ b/uaclient/messages.py
@@ -1384,6 +1384,13 @@ For more information, see https://anbox-cloud.io/docs/tut/installing-appliance
 """,
 )
 
+ANBOX_FAIL_TO_ENABLE_ON_CONTAINER = NamedMessage(
+    "anbox-fail-to-enable-on-container",
+    """\
+It is only possible to enable Anbox Cloud on a container using
+the --access-only flag.""",
+)
+
 INSTALLING_PACKAGES = "Installing {}"
 UNINSTALLING_PACKAGES = "Uninstalling {}"
 UNINSTALLING_PACKAGES_FAILED = "Failure when uninstalling {}"
diff --git a/uaclient/version.py b/uaclient/version.py
index 9fdbc8d..b8e1f94 100644
--- a/uaclient/version.py
+++ b/uaclient/version.py
@@ -15,7 +15,7 @@ from uaclient.defaults import CANDIDATE_CACHE_PATH, UAC_RUN_PATH
 from uaclient.exceptions import ProcessExecutionError
 from uaclient.system import subp
 
-__VERSION__ = "29"
+__VERSION__ = "29.1"
 PACKAGED_VERSION = "@@PACKAGED_VERSION@@"
 
 CANDIDATE_REGEX = r"Candidate: (?P<candidate>.*?)\n"