Merge ~orndorffgrant/ubuntu/+source/ubuntu-advantage-tools:upload-27.15-mantic into ubuntu/+source/ubuntu-advantage-tools:ubuntu/devel

[Grant Orndorff]

This is release 27.15 of ubuntu-advantage-tools.
This is the final 27.x release before we move to scheduled releases, which will each bump the main version.

SRU Bug: https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2017949

[Grant Orndorff (orndorffgrant)]

* Staging PPA Test Triggers:
  - Source ubuntu-advantage-tools/27.15~rc1: Published
    + amd64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=amd64&trigger=ubuntu-advantage-tools%2F27.15~rc1&ppa=ua-client%2Fstaging♻
    + arm64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=arm64&trigger=ubuntu-advantage-tools%2F27.15~rc1&ppa=ua-client%2Fstaging♻
    + armhf: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=armhf&trigger=ubuntu-advantage-tools%2F27.15~rc1&ppa=ua-client%2Fstaging♻
    + ppc64el: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=ppc64el&trigger=ubuntu-advantage-tools%2F27.15~rc1&ppa=ua-client%2Fstaging♻
    + s390x: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=s390x&trigger=ubuntu-advantage-tools%2F27.15~rc1&ppa=ua-client%2Fstaging♻
    + riscv64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=riscv64&trigger=ubuntu-advantage-tools%2F27.15~rc1&ppa=ua-client%2Fstaging♻
  - Source ubuntu-advantage-tools/27.15~23.04~rc1: Published
    + amd64: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=amd64&trigger=ubuntu-advantage-tools%2F27.15~23.04~rc1&ppa=ua-client%2Fstaging♻
    + arm64: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=arm64&trigger=ubuntu-advantage-tools%2F27.15~23.04~rc1&ppa=ua-client%2Fstaging♻
    + armhf: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=armhf&trigger=ubuntu-advantage-tools%2F27.15~23.04~rc1&ppa=ua-client%2Fstaging♻
    + ppc64el: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=ppc64el&trigger=ubuntu-advantage-tools%2F27.15~23.04~rc1&ppa=ua-client%2Fstaging♻
    + s390x: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=s390x&trigger=ubuntu-advantage-tools%2F27.15~23.04~rc1&ppa=ua-client%2Fstaging♻
    + riscv64: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=riscv64&trigger=ubuntu-advantage-tools%2F27.15~23.04~rc1&ppa=ua-client%2Fstaging♻
  - Source ubuntu-advantage-tools/27.15~22.10~rc1: Published
    + amd64: https://autopkgtest.ubuntu.com/request.cgi?release=kinetic&package=ubuntu-advantage-tools&arch=amd64&trigger=ubuntu-advantage-tools%2F27.15~22.10~rc1&ppa=ua-client%2Fstaging♻
    + arm64: https://autopkgtest.ubuntu.com/request.cgi?release=kinetic&package=ubuntu-advantage-tools&arch=arm64&trigger=ubuntu-advantage-tools%2F27.15~22.10~rc1&ppa=ua-client%2Fstaging♻
    + armhf: https://autopkgtest.ubuntu.com/request.cgi?release=kinetic&package=ubuntu-advantage-tools&arch=armhf&trigger=ubuntu-advantage-tools%2F27.15~22.10~rc1&ppa=ua-client%2Fstaging♻
    + ppc64el: https://autopkgtest.ubuntu.com/request.cgi?release=kinetic&package=ubuntu-advantage-tools&arch=ppc64el&trigger=ubuntu-advantage-tools%2F27.15~22.10~rc1&ppa=ua-client%2Fstaging♻
    ...

[Grant Orndorff (orndorffgrant)]

Closing in favor of https://code.launchpad.net/~orndorffgrant/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/+merge/443833

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index abf1338..7faa407 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,5 +1,13 @@
-## Proposed Commit Message
-<!-- Include a proposed commit message because all PRs can be merged in a variety of ways by the reviewer -->
+## Why is this needed?
+<!-- This information should be captured in your commit messages, so any description here can be very brief -->
+This PR solves all of our problems because...
+
+<!--
+By default, we rebase PRs and will ask for a clean well-organized commit history in the PR before rebasing.
+If your PR is small enough and you prefer, uncomment the following section and fill it out to request a squashed PR.
+-->
+<!--
+## Please Squash this PR with this commit message
 
 ```
 summary: no more than 70 characters
@@ -14,6 +22,7 @@ If you need to write multiple paragraphs, feel free.
 LP: #NNNNNNN (replace with the appropriate Launchpad bug reference if applicable)
 Fixes: #NNNNNNN (replace with the appropriate github issue if applicable)
 ```
+-->
 
 ## Test Steps
 <!-- Please include any steps necessary to verify (and reproduce if
@@ -21,6 +30,16 @@ this is a bug fix) this change on a live deployed system,
 including any necessary configuration files, user-data,
 setup, and teardown. Scripts used may be attached directly to this PR. -->
 
+<!-- Example:
+```
+env SHELL_BEFORE=1 ./tools/test-in-lxd.sh xenial
+# Set up test scenario before upgrade
+exit # new version gets installed after exit and lxc shell is re-started
+sudo pro new-sub-command --new-flag
+# Assert something
+```
+-->
+
 ## Checklist
 <!-- Go over all the following points, and put an `x` in all the boxes
 that apply. -->
diff --git a/.github/actions/bug-refs/action.yml b/.github/actions/bug-refs/action.yml
new file mode 100644
index 0000000..458d152
--- /dev/null
+++ b/.github/actions/bug-refs/action.yml
@@ -0,0 +1,9 @@
+name: 'Require Bug References'
+description: 'Block PRs on missing bug references'
+inputs:
+  repo-token:
+    description: 'Token for the repository. Can be passed in using {{ secrets.GITHUB_TOKEN }}'
+    required: true
+runs:
+  using: 'node16'
+  main: 'index.js'
diff --git a/.github/actions/bug-refs/index.js b/.github/actions/bug-refs/index.js
new file mode 100644
index 0000000..7804e06
--- /dev/null
+++ b/.github/actions/bug-refs/index.js
@@ -0,0 +1,61 @@
+const core = require('@actions/core');
+const github = require('@actions/github');
+
+async function run() {
+    const context = github.context;
+    if (context.eventName !== "pull_request") {
+      console.log(
+        'The event that triggered this action was not a pull request, skipping.'
+      );
+      return;
+    }
+
+    const body = context.payload.pull_request.body.toLocaleUpperCase();
+    const ignoreJira = body.includes("NO-JIRA");
+    const ignoreLaunchpad = body.includes("NO-LP");
+    const ignoreGithub = body.includes("NO-GH");
+
+    const errorMessages = [];
+
+    const title = context.payload.pull_request.title;
+    if (!ignoreJira && !title.toLocaleUpperCase().includes("SC-")) {
+        errorMessages.push("The PR title does not include a Jira SC-#### reference.\nEither add one or add 'no-jira' to the PR description.");
+    }
+
+    const client = github.getOctokit(
+        core.getInput('repo-token', {required: true})
+    );
+    const commits = await client.rest.pulls.listCommits({
+        owner: context.issue.owner,
+        repo: context.issue.repo,
+        pull_number: context.issue.number,
+    });
+
+    let launchpadPresent = false;
+    let githubPresent = false;
+    commits.data.forEach(commit => {
+        const message = commit.commit.message.toLocaleUpperCase();
+        if (message.includes("LP: #")) {
+            launchpadPresent = true;
+        }
+        if (message.includes("FIXES: #") || message.includes("CLOSES: #")) {
+            githubPresent = true;
+        }
+    });
+
+    if (!ignoreLaunchpad && !launchpadPresent) {
+        errorMessages.push("None of the commits include a Launchpad bug reference.\nEither add one or add 'no-lp' to the PR description.");
+    }
+    if (!ignoreGithub && !githubPresent) {
+        errorMessages.push("None of the commits include a Github bug reference.\nEither add one or add 'no-gh' to the PR description.");
+    }
+
+    if (errorMessages.length > 0) {
+        core.setFailed(errorMessages.join("\n\n"));
+    }
+}
+
+run().catch(error => {
+    console.error(error);
+    core.setFailed(error.message);
+})
diff --git a/.github/actions/bug-refs/package-lock.json b/.github/actions/bug-refs/package-lock.json
new file mode 100644
index 0000000..f9ad26b
--- /dev/null
+++ b/.github/actions/bug-refs/package-lock.json
@@ -0,0 +1,430 @@
+{
+  "name": "bug-refs",
+  "version": "1.0.0",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "bug-refs",
+      "version": "1.0.0",
+      "dependencies": {
+        "@actions/core": "^1.10.0",
+        "@actions/github": "^5.1.1"
+      }
+    },
+    "node_modules/@actions/core": {
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.0.tgz",
+      "integrity": "sha512-2aZDDa3zrrZbP5ZYg159sNoLRb61nQ7awl5pSvIq5Qpj81vwDzdMRKzkWJGJuwVvWpvZKx7vspJALyvaaIQyug==",
+      "dependencies": {
+        "@actions/http-client": "^2.0.1",
+        "uuid": "^8.3.2"
+      }
+    },
+    "node_modules/@actions/github": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-5.1.1.tgz",
+      "integrity": "sha512-Nk59rMDoJaV+mHCOJPXuvB1zIbomlKS0dmSIqPGxd0enAXBnOfn4VWF+CGtRCwXZG9Epa54tZA7VIRlJDS8A6g==",
+      "dependencies": {
+        "@actions/http-client": "^2.0.1",
+        "@octokit/core": "^3.6.0",
+        "@octokit/plugin-paginate-rest": "^2.17.0",
+        "@octokit/plugin-rest-endpoint-methods": "^5.13.0"
+      }
+    },
+    "node_modules/@actions/http-client": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.1.0.tgz",
+      "integrity": "sha512-BonhODnXr3amchh4qkmjPMUO8mFi/zLaaCeCAJZqch8iQqyDnVIkySjB38VHAC8IJ+bnlgfOqlhpyCUZHlQsqw==",
+      "dependencies": {
+        "tunnel": "^0.0.6"
+      }
+    },
+    "node_modules/@octokit/auth-token": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-2.5.0.tgz",
+      "integrity": "sha512-r5FVUJCOLl19AxiuZD2VRZ/ORjp/4IN98Of6YJoJOkY75CIBuYfmiNHGrDwXr+aLGG55igl9QrxX3hbiXlLb+g==",
+      "dependencies": {
+        "@octokit/types": "^6.0.3"
+      }
+    },
+    "node_modules/@octokit/core": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-3.6.0.tgz",
+      "integrity": "sha512-7RKRKuA4xTjMhY+eG3jthb3hlZCsOwg3rztWh75Xc+ShDWOfDDATWbeZpAHBNRpm4Tv9WgBMOy1zEJYXG6NJ7Q==",
+      "dependencies": {
+        "@octokit/auth-token": "^2.4.4",
+        "@octokit/graphql": "^4.5.8",
+        "@octokit/request": "^5.6.3",
+        "@octokit/request-error": "^2.0.5",
+        "@octokit/types": "^6.0.3",
+        "before-after-hook": "^2.2.0",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/endpoint": {
+      "version": "6.0.12",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-6.0.12.tgz",
+      "integrity": "sha512-lF3puPwkQWGfkMClXb4k/eUT/nZKQfxinRWJrdZaJO85Dqwo/G0yOC434Jr2ojwafWJMYqFGFa5ms4jJUgujdA==",
+      "dependencies": {
+        "@octokit/types": "^6.0.3",
+        "is-plain-object": "^5.0.0",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/graphql": {
+      "version": "4.8.0",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-4.8.0.tgz",
+      "integrity": "sha512-0gv+qLSBLKF0z8TKaSKTsS39scVKF9dbMxJpj3U0vC7wjNWFuIpL/z76Qe2fiuCbDRcJSavkXsVtMS6/dtQQsg==",
+      "dependencies": {
+        "@octokit/request": "^5.6.0",
+        "@octokit/types": "^6.0.3",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/openapi-types": {
+      "version": "12.11.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-12.11.0.tgz",
+      "integrity": "sha512-VsXyi8peyRq9PqIz/tpqiL2w3w80OgVMwBHltTml3LmVvXiphgeqmY9mvBw9Wu7e0QWk/fqD37ux8yP5uVekyQ=="
+    },
+    "node_modules/@octokit/plugin-paginate-rest": {
+      "version": "2.21.3",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-2.21.3.tgz",
+      "integrity": "sha512-aCZTEf0y2h3OLbrgKkrfFdjRL6eSOo8komneVQJnYecAxIej7Bafor2xhuDJOIFau4pk0i/P28/XgtbyPF0ZHw==",
+      "dependencies": {
+        "@octokit/types": "^6.40.0"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=2"
+      }
+    },
+    "node_modules/@octokit/plugin-rest-endpoint-methods": {
+      "version": "5.16.2",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-5.16.2.tgz",
+      "integrity": "sha512-8QFz29Fg5jDuTPXVtey05BLm7OB+M8fnvE64RNegzX7U+5NUXcOcnpTIK0YfSHBg8gYd0oxIq3IZTe9SfPZiRw==",
+      "dependencies": {
+        "@octokit/types": "^6.39.0",
+        "deprecation": "^2.3.1"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=3"
+      }
+    },
+    "node_modules/@octokit/request": {
+      "version": "5.6.3",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-5.6.3.tgz",
+      "integrity": "sha512-bFJl0I1KVc9jYTe9tdGGpAMPy32dLBXXo1dS/YwSCTL/2nd9XeHsY616RE3HPXDVk+a+dBuzyz5YdlXwcDTr2A==",
+      "dependencies": {
+        "@octokit/endpoint": "^6.0.1",
+        "@octokit/request-error": "^2.1.0",
+        "@octokit/types": "^6.16.1",
+        "is-plain-object": "^5.0.0",
+        "node-fetch": "^2.6.7",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/request-error": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-2.1.0.tgz",
+      "integrity": "sha512-1VIvgXxs9WHSjicsRwq8PlR2LR2x6DwsJAaFgzdi0JfJoGSO8mYI/cHJQ+9FbN21aa+DrgNLnwObmyeSC8Rmpg==",
+      "dependencies": {
+        "@octokit/types": "^6.0.3",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      }
+    },
+    "node_modules/@octokit/types": {
+      "version": "6.41.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-6.41.0.tgz",
+      "integrity": "sha512-eJ2jbzjdijiL3B4PrSQaSjuF2sPEQPVCPzBvTHJD9Nz+9dw2SGH4K4xeQJ77YfTq5bRQ+bD8wT11JbeDPmxmGg==",
+      "dependencies": {
+        "@octokit/openapi-types": "^12.11.0"
+      }
+    },
+    "node_modules/before-after-hook": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
+      "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ=="
+    },
+    "node_modules/deprecation": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
+      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ=="
+    },
+    "node_modules/is-plain-object": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
+      "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/node-fetch": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.9.tgz",
+      "integrity": "sha512-DJm/CJkZkRjKKj4Zi4BsKVZh3ValV5IR5s7LVZnW+6YMh0W1BfNA8XSs6DLMGYlId5F3KnA70uu2qepcR08Qqg==",
+      "dependencies": {
+        "whatwg-url": "^5.0.0"
+      },
+      "engines": {
+        "node": "4.x || >=6.0.0"
+      },
+      "peerDependencies": {
+        "encoding": "^0.1.0"
+      },
+      "peerDependenciesMeta": {
+        "encoding": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="
+    },
+    "node_modules/tunnel": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
+      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==",
+      "engines": {
+        "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
+      }
+    },
+    "node_modules/universal-user-agent": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.0.tgz",
+      "integrity": "sha512-isyNax3wXoKaulPDZWHQqbmIx1k2tb9fb3GGDBRxCscfYV2Ch7WxPArBsFEG8s/safwXTT7H4QGhaIkTp9447w=="
+    },
+    "node_modules/uuid": {
+      "version": "8.3.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
+    },
+    "node_modules/webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ=="
+    },
+    "node_modules/whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
+      "dependencies": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  },
+  "dependencies": {
+    "@actions/core": {
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.0.tgz",
+      "integrity": "sha512-2aZDDa3zrrZbP5ZYg159sNoLRb61nQ7awl5pSvIq5Qpj81vwDzdMRKzkWJGJuwVvWpvZKx7vspJALyvaaIQyug==",
+      "requires": {
+        "@actions/http-client": "^2.0.1",
+        "uuid": "^8.3.2"
+      }
+    },
+    "@actions/github": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-5.1.1.tgz",
+      "integrity": "sha512-Nk59rMDoJaV+mHCOJPXuvB1zIbomlKS0dmSIqPGxd0enAXBnOfn4VWF+CGtRCwXZG9Epa54tZA7VIRlJDS8A6g==",
+      "requires": {
+        "@actions/http-client": "^2.0.1",
+        "@octokit/core": "^3.6.0",
+        "@octokit/plugin-paginate-rest": "^2.17.0",
+        "@octokit/plugin-rest-endpoint-methods": "^5.13.0"
+      }
+    },
+    "@actions/http-client": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.1.0.tgz",
+      "integrity": "sha512-BonhODnXr3amchh4qkmjPMUO8mFi/zLaaCeCAJZqch8iQqyDnVIkySjB38VHAC8IJ+bnlgfOqlhpyCUZHlQsqw==",
+      "requires": {
+        "tunnel": "^0.0.6"
+      }
+    },
+    "@octokit/auth-token": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-2.5.0.tgz",
+      "integrity": "sha512-r5FVUJCOLl19AxiuZD2VRZ/ORjp/4IN98Of6YJoJOkY75CIBuYfmiNHGrDwXr+aLGG55igl9QrxX3hbiXlLb+g==",
+      "requires": {
+        "@octokit/types": "^6.0.3"
+      }
+    },
+    "@octokit/core": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-3.6.0.tgz",
+      "integrity": "sha512-7RKRKuA4xTjMhY+eG3jthb3hlZCsOwg3rztWh75Xc+ShDWOfDDATWbeZpAHBNRpm4Tv9WgBMOy1zEJYXG6NJ7Q==",
+      "requires": {
+        "@octokit/auth-token": "^2.4.4",
+        "@octokit/graphql": "^4.5.8",
+        "@octokit/request": "^5.6.3",
+        "@octokit/request-error": "^2.0.5",
+        "@octokit/types": "^6.0.3",
+        "before-after-hook": "^2.2.0",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "@octokit/endpoint": {
+      "version": "6.0.12",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-6.0.12.tgz",
+      "integrity": "sha512-lF3puPwkQWGfkMClXb4k/eUT/nZKQfxinRWJrdZaJO85Dqwo/G0yOC434Jr2ojwafWJMYqFGFa5ms4jJUgujdA==",
+      "requires": {
+        "@octokit/types": "^6.0.3",
+        "is-plain-object": "^5.0.0",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "@octokit/graphql": {
+      "version": "4.8.0",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-4.8.0.tgz",
+      "integrity": "sha512-0gv+qLSBLKF0z8TKaSKTsS39scVKF9dbMxJpj3U0vC7wjNWFuIpL/z76Qe2fiuCbDRcJSavkXsVtMS6/dtQQsg==",
+      "requires": {
+        "@octokit/request": "^5.6.0",
+        "@octokit/types": "^6.0.3",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "@octokit/openapi-types": {
+      "version": "12.11.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-12.11.0.tgz",
+      "integrity": "sha512-VsXyi8peyRq9PqIz/tpqiL2w3w80OgVMwBHltTml3LmVvXiphgeqmY9mvBw9Wu7e0QWk/fqD37ux8yP5uVekyQ=="
+    },
+    "@octokit/plugin-paginate-rest": {
+      "version": "2.21.3",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-2.21.3.tgz",
+      "integrity": "sha512-aCZTEf0y2h3OLbrgKkrfFdjRL6eSOo8komneVQJnYecAxIej7Bafor2xhuDJOIFau4pk0i/P28/XgtbyPF0ZHw==",
+      "requires": {
+        "@octokit/types": "^6.40.0"
+      }
+    },
+    "@octokit/plugin-rest-endpoint-methods": {
+      "version": "5.16.2",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-5.16.2.tgz",
+      "integrity": "sha512-8QFz29Fg5jDuTPXVtey05BLm7OB+M8fnvE64RNegzX7U+5NUXcOcnpTIK0YfSHBg8gYd0oxIq3IZTe9SfPZiRw==",
+      "requires": {
+        "@octokit/types": "^6.39.0",
+        "deprecation": "^2.3.1"
+      }
+    },
+    "@octokit/request": {
+      "version": "5.6.3",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-5.6.3.tgz",
+      "integrity": "sha512-bFJl0I1KVc9jYTe9tdGGpAMPy32dLBXXo1dS/YwSCTL/2nd9XeHsY616RE3HPXDVk+a+dBuzyz5YdlXwcDTr2A==",
+      "requires": {
+        "@octokit/endpoint": "^6.0.1",
+        "@octokit/request-error": "^2.1.0",
+        "@octokit/types": "^6.16.1",
+        "is-plain-object": "^5.0.0",
+        "node-fetch": "^2.6.7",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "@octokit/request-error": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-2.1.0.tgz",
+      "integrity": "sha512-1VIvgXxs9WHSjicsRwq8PlR2LR2x6DwsJAaFgzdi0JfJoGSO8mYI/cHJQ+9FbN21aa+DrgNLnwObmyeSC8Rmpg==",
+      "requires": {
+        "@octokit/types": "^6.0.3",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      }
+    },
+    "@octokit/types": {
+      "version": "6.41.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-6.41.0.tgz",
+      "integrity": "sha512-eJ2jbzjdijiL3B4PrSQaSjuF2sPEQPVCPzBvTHJD9Nz+9dw2SGH4K4xeQJ77YfTq5bRQ+bD8wT11JbeDPmxmGg==",
+      "requires": {
+        "@octokit/openapi-types": "^12.11.0"
+      }
+    },
+    "before-after-hook": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
+      "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ=="
+    },
+    "deprecation": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
+      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ=="
+    },
+    "is-plain-object": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
+      "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q=="
+    },
+    "node-fetch": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.9.tgz",
+      "integrity": "sha512-DJm/CJkZkRjKKj4Zi4BsKVZh3ValV5IR5s7LVZnW+6YMh0W1BfNA8XSs6DLMGYlId5F3KnA70uu2qepcR08Qqg==",
+      "requires": {
+        "whatwg-url": "^5.0.0"
+      }
+    },
+    "once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "requires": {
+        "wrappy": "1"
+      }
+    },
+    "tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="
+    },
+    "tunnel": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
+      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="
+    },
+    "universal-user-agent": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.0.tgz",
+      "integrity": "sha512-isyNax3wXoKaulPDZWHQqbmIx1k2tb9fb3GGDBRxCscfYV2Ch7WxPArBsFEG8s/safwXTT7H4QGhaIkTp9447w=="
+    },
+    "uuid": {
+      "version": "8.3.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="
+    },
+    "webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ=="
+    },
+    "whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
+      "requires": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    },
+    "wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  }
+}
diff --git a/.github/actions/bug-refs/package.json b/.github/actions/bug-refs/package.json
new file mode 100644
index 0000000..14ceb07
--- /dev/null
+++ b/.github/actions/bug-refs/package.json
@@ -0,0 +1,10 @@
+{
+  "name": "bug-refs",
+  "version": "1.0.0",
+  "description": "Block PRs on missing bug references",
+  "main": "index.js",
+  "dependencies": {
+    "@actions/core": "^1.10.0",
+    "@actions/github": "^5.1.1"
+  }
+}
diff --git a/.github/workflows/ci-base.yaml b/.github/workflows/ci-base.yaml
index 59174bf..dab17d3 100644
--- a/.github/workflows/ci-base.yaml
+++ b/.github/workflows/ci-base.yaml
@@ -29,6 +29,8 @@ jobs:
         run: tox -e mypy
       - name: Version Consistency
         run: python3 ./tools/check-versions-are-consistent.py
+      - name: Docs
+        run: tox -e docs
   unit-tests:
     name: Unit Tests
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/ci-integration.yaml b/.github/workflows/ci-integration.yaml
index 62df9e3..937de39 100644
--- a/.github/workflows/ci-integration.yaml
+++ b/.github/workflows/ci-integration.yaml
@@ -92,6 +92,9 @@ jobs:
           # in a way that is incompatible with lxd.
           # https://linuxcontainers.org/lxd/docs/master/howto/network_bridge_firewalld/#prevent-issues-with-lxd-and-docker
           sudo iptables -I DOCKER-USER -j ACCEPT
+      - name: Refresh LXD
+        if: matrix.platform == 'lxd' || matrix.platform == 'vm'
+        run: sudo snap refresh --channel latest/stable lxd
       - name: Initialize LXD
         if: matrix.platform == 'lxd' || matrix.platform == 'vm'
         run: sudo lxd init --auto
diff --git a/.github/workflows/custom_pr_checks.yaml b/.github/workflows/custom_pr_checks.yaml
new file mode 100644
index 0000000..b3be667
--- /dev/null
+++ b/.github/workflows/custom_pr_checks.yaml
@@ -0,0 +1,27 @@
+---
+
+name: Custom PR Checks
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+    branches:
+      - main
+
+jobs:
+  bug-refs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Git checkout
+        uses: actions/checkout@v3
+      - name: Install dependencies
+        run: cd ./.github/actions/bug-refs && npm install
+      - name: Check for bug references
+        uses: ./.github/actions/bug-refs
+        id: bug-refs
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/apport/source_ubuntu-advantage-tools.py b/apport/source_ubuntu-advantage-tools.py
index 193d557..f2c4f1a 100644
--- a/apport/source_ubuntu-advantage-tools.py
+++ b/apport/source_ubuntu-advantage-tools.py
@@ -2,6 +2,7 @@ import os
 import tempfile
 
 from apport.hookutils import attach_file_if_exists
+from uaclient import defaults
 from uaclient.actions import collect_logs
 from uaclient.config import UAConfig
 
@@ -12,7 +13,7 @@ def add_info(report, ui=None):
     cfg = UAConfig()
     with tempfile.TemporaryDirectory() as output_dir:
         collect_logs(cfg, output_dir)
-        auto_include_log_files = [
+        auto_include_log_files = {
             "cloud-id.txt",
             "cloud-id.txt-error",
             "ua-status.json",
@@ -24,6 +25,9 @@ def add_info(report, ui=None):
             os.path.basename(cfg.timer_log_file),
             os.path.basename(cfg.daemon_log_file),
             os.path.basename(cfg.data_path("jobs-status")),
-        ]
+            os.path.basename(defaults.CONFIG_DEFAULTS["log_file"]),
+            os.path.basename(defaults.CONFIG_DEFAULTS["timer_log_file"]),
+            os.path.basename(defaults.CONFIG_DEFAULTS["daemon_log_file"]),
+        }
         for f in auto_include_log_files:
             attach_file_if_exists(report, os.path.join(output_dir, f), key=f)
diff --git a/apt-hook/json-hook.cc b/apt-hook/json-hook.cc
index 1d36bd2..61548b7 100644
--- a/apt-hook/json-hook.cc
+++ b/apt-hook/json-hook.cc
@@ -218,13 +218,17 @@ CloudID get_cloud_id() {
     return ret;
 }
 
-bool is_xenial() {
+enum ESMInfraSeries {NOT_ESM_INFRA, XENIAL, BIONIC};
+
+ESMInfraSeries get_esm_infra_series() {
     std::ifstream os_release_file("/etc/os-release");
-    bool ret = false;
+    ESMInfraSeries ret = NOT_ESM_INFRA;
     if (os_release_file.is_open()) {
         std::string os_release_str((std::istreambuf_iterator<char>(os_release_file)), (std::istreambuf_iterator<char>()));
         if (os_release_str.find("xenial") != os_release_str.npos) {
-            ret = true;
+            ret = XENIAL;
+        } else if (os_release_str.find("bionic") != os_release_str.npos) {
+            ret = BIONIC;
         }
         os_release_file.close();
     }
@@ -238,27 +242,39 @@ struct ESMContext {
 
 ESMContext get_esm_context() {
     CloudID cloud_id = get_cloud_id();
-    bool is_x = is_xenial();
+    ESMInfraSeries esm_infra_series = get_esm_infra_series();
 
     ESMContext ret;
     ret.context = "";
     ret.url = "https://ubuntu.com/pro";
 
-    if (cloud_id != AZURE && is_x) {
-        ret.context = " for 16.04";
-        ret.url = "https://ubuntu.com/16-04";
-    } else if (cloud_id == AZURE && !is_x) {
-        ret.context = " on Azure";
-        ret.url = "https://ubuntu.com/azure/pro";
-    } else if (cloud_id == AZURE && is_x) {
-        ret.context = " for 16.04 on Azure";
-        ret.url = "https://ubuntu.com/16-04/azure";
-    } else if (cloud_id == AWS && !is_x) {
-        ret.context = " on AWS";
-        ret.url = "https://ubuntu.com/aws/pro";
-    } else if (cloud_id == GCE && !is_x) {
-        ret.context = " on GCP";
-        ret.url = "https://ubuntu.com/gcp/pro";
+    if (esm_infra_series == XENIAL) {
+        if (cloud_id == AZURE) {
+            ret.context = " for 16.04 on Azure";
+            ret.url = "https://ubuntu.com/16-04/azure";
+        } else {
+            ret.context = " for 16.04";
+            ret.url = "https://ubuntu.com/16-04";
+        }
+    } else if (esm_infra_series == BIONIC) {
+        if (cloud_id == AZURE) {
+            ret.context = " for 18.04 on Azure";
+            ret.url = "https://ubuntu.com/18-04/azure";
+        } else {
+            ret.context = " for 18.04";
+            ret.url = "https://ubuntu.com/18-04";
+        }
+    } else {
+        if (cloud_id == AZURE) {
+            ret.context = " on Azure";
+            ret.url = "https://ubuntu.com/azure/pro";
+        } else if (cloud_id == AWS) {
+            ret.context = " on AWS";
+            ret.url = "https://ubuntu.com/aws/pro";
+        } else if (cloud_id == GCE) {
+            ret.context = " on GCP";
+            ret.url = "https://ubuntu.com/gcp/pro";
+        }
     }
 
     return ret;
diff --git a/apt.conf.d/51ubuntu-advantage-esm b/apt.conf.d/51ubuntu-advantage-esm
deleted file mode 100644
index e9b1c3a..0000000
--- a/apt.conf.d/51ubuntu-advantage-esm
+++ /dev/null
@@ -1,6 +0,0 @@
-Unattended-Upgrade::Allowed-Origins {
-  "${distro_id}ESM:${distro_codename}-infra-security";
-};
-Unattended-Upgrade::Allowed-Origins {
-  "${distro_id}ESMApps:${distro_codename}-apps-security";
-};
diff --git a/debian/changelog b/debian/changelog
index 69290bb..e9979e2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,41 @@
+ubuntu-advantage-tools (27.15) mantic; urgency=medium
+
+  * d/ubuntu-advantage-tools.postinst:
+    - more specific regex for ua_config warning
+  * New upstream release 27.15 (LP: #2017949)
+    - apport: collect default log files if present for bug reports
+    - apt messaging: add bionic-specific urls
+    - config: no longer load uaclient.conf from current working directory
+    - fix:
+      + add support for --no-related flag
+      + separate target USN from related USNs
+    - general:
+      + logs to user cache directory when run as non-root
+      + fix bug where non-root commands failed with file permission error
+        accessing /tmp/ubuntu-advantage (GH: #2567)
+      + use system environment vars by default in sub processes (GH: #2527)
+      + fall back to /usr/lib/os-release for release info
+      + start logging to default log file until config is loaded
+      + remove small timeout from contract checking request
+    - livepatch: use uname.machine for kernel arch when checking support
+      (GH: #2517)
+    - realtime-kernel: add support for intel-iotg variant
+    - reboot-required: new criteria for "yes-kernel-livepatches-applied"
+      livepatch status must be either "applied" or "nothing-to-apply" and
+      livepatch support status must say "supported"
+    - security-status:
+      + always show available/installed counts for esm packages
+      + include hint to run apt-get update for up-to-date info (GH: #2443)
+      + improve visibility of installed and available updates (GH: #2442)
+      + change package info message hint to recommend apt-cache show
+    - systemd: update service unit for reboot_cmds to not run if not attached
+    - status:
+      + add hint for pro status --all
+      + better message if no services are available (LP: #1994923)
+    - timer: only run timer when attached
+
+ -- Grant Orndorff <[e-mail]>  Thu, 27 Apr 2023 16:34:55 -0400
+
 ubuntu-advantage-tools (27.14.4) lunar; urgency=medium
 
   * timer: disable update_contract_info job (LP: #2015302)
diff --git a/debian/ubuntu-advantage-tools.postinst b/debian/ubuntu-advantage-tools.postinst
index 7d9d03e..31d93ae 100644
--- a/debian/ubuntu-advantage-tools.postinst
+++ b/debian/ubuntu-advantage-tools.postinst
@@ -452,7 +452,7 @@ case "$1" in
           migrate_user_config_post
       fi
 
-      if grep -q "ua_config:" /etc/ubuntu-advantage/uaclient.conf; then
+      if grep -q "^ua_config:" /etc/ubuntu-advantage/uaclient.conf; then
           echo "Warning: uaclient.conf contains old ua_config field." >&2
           echo "         Please do the following:" >&2
           echo "         1. Run 'pro config set field=value' for each field/value pair" >&2
diff --git a/docs/README.md b/dev-docs/howtoguides/build-docs.md
similarity index 100%
rename from docs/README.md
rename to dev-docs/howtoguides/build-docs.md
diff --git a/dev-docs/howtoguides/building.md b/dev-docs/howtoguides/building.md
index 17be892..40b4d70 100644
--- a/dev-docs/howtoguides/building.md
+++ b/dev-docs/howtoguides/building.md
@@ -41,16 +41,3 @@ sbuild-launchpad-chroot create --architecture="riscv64" "--name=focal-riscv64" "
 > # this script can be used to update all chroots
 > sudo PATTERN=\* sh /usr/share/doc/sbuild/examples/sbuild-debian-developer-setup-update-all
 > ```
-
-## Setting up an lxc development container
-```shell
-lxc launch ubuntu-daily:xenial dev-x -c user.user-data="$(cat tools/ua-dev-cloud-config.yaml)"
-lxc exec dev-x bash
-```
-
-## Setting up a kvm development environment with multipass
-**Note:** There is a sample procedure documented in tools/multipass.md as well.
-```shell
-multipass launch daily:focal -n dev-f --cloud-init tools/ua-dev-cloud-config.yaml
-multipass connect dev-f
-```
diff --git a/dev-docs/howtoguides/how_to_release_a_new_version_of_ua.md b/dev-docs/howtoguides/release_a_new_version.md
similarity index 75%
rename from dev-docs/howtoguides/how_to_release_a_new_version_of_ua.md
rename to dev-docs/howtoguides/release_a_new_version.md
index 7a067dc..9d9109c 100644
--- a/dev-docs/howtoguides/how_to_release_a_new_version_of_ua.md
+++ b/dev-docs/howtoguides/release_a_new_version.md
@@ -31,6 +31,14 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
   ```
 * You must have Launchpad already properly configured in your system in order to upload packages to the PPAs. Follow [this guide](https://help.launchpad.net/Packaging/PPA/Uploading) to get set up.
 
+* In order to run the `ppa` command, install `ppa-dev-tools` from `bryce`'s PPA:
+  ```bash
+  sudo add-apt-repository ppa:bryce/ppa-dev-tools
+  sudo apt update
+  sudo apt install ppa-dev-tools
+  ```
+  When running `ppa` for the first time, there will be another round of launchpad authorization to be performed.
+
 ## I. Preliminary/staging release to team infrastructure
 1. Create a release PR:
 
@@ -41,7 +49,7 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
     b Create a new entry in the `debian/changelog` file:
 
       * You can do that by running `dch --newversion <version-name>`.
-      * Remember to update the release from `UNRELEASED` to the ubuntu/devel release. Edit the version to look like: `27.2~21.10.1`, with the appropriate pro-client and ubuntu/devel version numbers.
+      * Remember to update the release from `UNRELEASED` to the ubuntu/devel release. Edit the version to look like: `27.2`, with the appropriate pro-client version number.
       * Populate `debian/changelog` with the commits you have cherry-picked.
       * You can do that by running `git log <first-cherry-pick-commit>..<last-cherry-pick-commit> | log2dch`
         * This will generate a list of commits that could be included in the changelog.
@@ -84,7 +92,7 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
 
     b. Edit the changelog
       * List yourself as the author of this release.
-      * Edit the version number to look like: `27.2~20.04.1~rc1` (`<version>~<ubuntu-release-number>.<revno>~rc<release-candidate-number>`)
+      * Edit the version number to look like: `27.2~rc1` (`<version>~rc<release-candidate-number>`)
       * Edit the Ubuntu release name. Start with the ubuntu/devel release.
       * `git add debian/changelog && git commit -m "throwaway"` - Do **not** push this commit!
 
@@ -95,9 +103,10 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
       * If this succeeds move on. If this fails, debug and fix before continuing.
 
     e. Repeat 3.b through 3.d for all supported Ubuntu Releases
-      * PS: remember to also change the version number on the changelog. For example, suppose
-        the new version is `1.1~20.04.1~rc1`. If you want to test Bionic now, change it to
-        `1.1~18.04.1~rc1`.
+      * The version for series other than devel should be in the form `<version>~<ubuntu-release-number>~rc<release-candidate-number>`
+        This means you must add the release number in the changelog. For example, suppose
+        the devel version is `1.1~rc1`. If you want to build for jammy now, change it to
+        `1.1~22.04~rc1`.
 
     f. For each release, dput to the staging PPA:
       * `dput ppa:ua-client/staging ../out/<package_name>_source.changes`
@@ -136,14 +145,17 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
     e. `git checkout -B upload-<this-version>-kinetic`
       * This creates a new local branch name based on your detached branch.
 
-    f. Make sure the changelog version contains the release version in the name (e.g., `27.1~22.10.1`)
+    f. `git push <your_launchpad_user> upload-<this-version>-kinetic`
 
-    g. `git push <your_launchpad_user> upload-<this-version>-kinetic`
-
-    h. On Launchpad, create a merge proposal for this version which targets `ubuntu/devel`
-      * For an example, see the [27.9 merge proposal](https://code.launchpad.net/~orndorffgrant/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/+merge/422906).
+    g. On Launchpad, create a merge proposal for this version which targets `ubuntu/devel`
+      * For an example, see the [27.14.1 merge proposal](https://code.launchpad.net/~renanrodrigo/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/+merge/439507).
       * Add 2 review slots for `canonical-server-reporter` and `canonical-server-core-reviewers`.
 
+    h. With the packages published to `ppa:ua-client/staging`, add links to the autopkgtest triggers to the Merge Proposal. The reviewer will have permission to trigger those tests. The links can be obtained by running `ppa tests -r <release> -a <arch1,arch2> ua-client/staging -L`
+      * Make sure to post links to all the architectures built for a given release.
+      * The riscv64 autopkgtests are not avaialble and don't need to be included.
+      * The `ppa test` command will have two variations of tests: the regular one, and one with `all-proposed=1`; only the regular test need to be there.
+
 4. Server Team Review and Pre-SRU Review
 
     a. Ask the assigned ubuntu-advantage-tools reviewer/sponsor from Server team for a review of your MPs. If you don't know who that is, ask in ~Server. Include a link to the ubuntu/devel MP and to the SRU bug.
@@ -160,7 +172,12 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
       * Follow instructions in `II.4.b` if they request any changes.
 
     e. Once the SRU team member gives a pre-SRU approval, create the branches for each stable release. They should be named `upload-<this-version>-<codename>`.
+      * The versions for the stable releases must include `~<release-number>`
       * If you've followed the instructions precisely so far, you can just run `bash tools/create-lp-release-branches.sh`.
+        - When using the `create-lp-release-branches.sh` script, an important parameter is `SRU_BUG`:
+        - In the vast majority of cases, this should be set to the overall SRU bug written in step II.1.b.
+        - In the case where an existing SRU never got released, and a new patch version was uploaded on top of it to fix a new bug discovered during review, then the bug should still be the overall SRU bug.
+        - If the release is exclusively a bugfix release and the previous version has already been successfully released all the way through the SRU process, then the bug should instead be the specific bugfix number.
 
     f. Ask Server team member sponsor to upload to devel, and then the SRU proposed queue using the stable release branches you just created.
       * Ask them to tag the PR with the appropriate `upload/<version>` tag so git-ubuntu will import rich commit history.
diff --git a/dev-docs/howtoguides/testing.md b/dev-docs/howtoguides/testing.md
index fb0519a..37d6cb2 100644
--- a/dev-docs/howtoguides/testing.md
+++ b/dev-docs/howtoguides/testing.md
@@ -175,17 +175,6 @@ To specifically run non-ubuntu pro tests using canonical cloud-images an
 additional token obtained from https://ubuntu.com/pro needs to be set:
   - UACLIENT_BEHAVE_CONTRACT_TOKEN=<your_token>
 
-By default, the public AMIs for Ubuntu Pro testing used for each Ubuntu
-release are defined in features/aws-ids.yaml. These ami-ids are determined by
-running `./tools/refresh-aws-pro-ids`.
-
-Integration tests will read features/aws-ids.yaml to determine which default
-AMI id to use for each supported Ubuntu release.
-
-To update `features/aws-ids.yaml`, run `./tools/refresh-aws-pro-ids` and put up
-a pull request against this repo to updated that content from the ua-contracts
-marketplace definitions.
-
 * To manually run EC2 integration tests with a specific AMI Id provide the
 following environment variable to launch your specific  AMI instead of building
 a daily ubuntu-advantage-tools image.
diff --git a/dev-docs/references/directory_layout.md b/dev-docs/references/directory_layout.md
index 241fa36..ccee76b 100644
--- a/dev-docs/references/directory_layout.md
+++ b/dev-docs/references/directory_layout.md
@@ -14,7 +14,6 @@ The following describes the intent of Ubuntu Pro Client related directories:
 | uaclient.messages | Module that contains the messages delivered by `pro` to the user |
 | uaclient.security | Module that hold the logic used to run `pro fix` commands |
 | ./apt-hook/ | the C++ apt-hook delivering MOTD and apt command notifications about Ubuntu Pro support services |
-| ./apt-conf.d/ | apt config files delivered to /etc/apt/apt-conf.d to automatically allow unattended upgrades of ESM security-related components. If apt proxy settings are configured, an additional apt config file will be placed here to configure the apt proxy. |
 | /etc/ubuntu-advantage/uaclient.conf | Configuration file for the Ubuntu Pro Client.|
 | /var/lib/ubuntu-advantage/private | `root` read-only directory containing Contract API responses, machine-tokens and service credentials |
 | /var/lib/ubuntu-advantage/machine-token.json | `world` readable file containing redacted Contract API responses, machine-tokens and service credentials |
diff --git a/dev-docs/references/version_string_formatting.md b/dev-docs/references/version_string_formatting.md
index 98c150e..59f163c 100644
--- a/dev-docs/references/version_string_formatting.md
+++ b/dev-docs/references/version_string_formatting.md
@@ -5,10 +5,10 @@ Below are the versioning schemes used for publishing debs:
 | Build target                                                                      | Version Format                             |
 | --------------------------------------------------------------------------------- | ------------------------------------------ |
 | [Daily PPA](https://code.launchpad.net/~canonical-server/+recipe/ua-client-daily) | `XX.YY-<revno>~g<commitish>~ubuntu22.04.1` |
-| Staging PPA                                                                       | `XX.YY~22.04.1~rc1`                        |
-| Stable PPA                                                                        | `XX.YY~22.04.1~stableppa1`                 |
-| Archive release                                                                   | `XX.YY~22.04.1`                            |
-| Archive bugfix release                                                            | `XX.YY.Z~22.04.1`                          |
+| Staging PPA                                                                       | `XX.YY~22.04~rc1`                        |
+| Stable PPA                                                                        | `XX.YY~22.04~stableppa1`                 |
+| Archive release                                                                   | `XX.YY~22.04`                            |
+| Archive bugfix release                                                            | `XX.YY.Z~22.04`                          |
 
 ## Supported upgrade paths on same upstream version
 
@@ -18,10 +18,10 @@ This table demonstrates upgrade paths between sources for one particular upstrea
 
 | Upgrade path                    | Version diff example                                                    |
 | ------------------------------- | ----------------------------------------------------------------------- |
-| Staging to Next Staging rev     | `31.4~22.04.1~rc1` ➜ `31.4~22.04.1~rc2`                                 |
-| Staging to Stable               | `31.4~22.04.1~rc2` ➜ `31.4~22.04.1~stableppa1`                          |
-| Stable to Next Stable rev       | `31.4~22.04.1~stableppa1` ➜ `31.4~22.04.1~stableppa2`                   |
-| Stable to Archive               | `31.4~22.04.1~stableppa2` ➜ `31.4~22.04.1`                              |
-| LTS Archive to Next LTS Archive | `31.4~22.04.1` ➜ `31.4~24.04.1`                                         |
-| Archive to Daily                | `31.4~24.04.1` ➜ `31.4-1500~g75fa134~ubuntu24.04.1`                     |
+| Staging to Next Staging rev     | `31.4~22.04~rc1` ➜ `31.4~22.04~rc2`                                 |
+| Staging to Stable               | `31.4~22.04~rc2` ➜ `31.4~22.04~stableppa1`                          |
+| Stable to Next Stable rev       | `31.4~22.04~stableppa1` ➜ `31.4~22.04~stableppa2`                   |
+| Stable to Archive               | `31.4~22.04~stableppa2` ➜ `31.4~22.04`                              |
+| LTS Archive to Next LTS Archive | `31.4~22.04` ➜ `31.4~24.04`                                         |
+| Archive to Daily                | `31.4~24.04` ➜ `31.4-1500~g75fa134~ubuntu24.04.1`                     |
 | Daily to Next Daily             | `31.4-1500~g75fa134~ubuntu24.04.1` ➜ `31.4-1501~g3836375~ubuntu24.04.1` |
diff --git a/docs/_static/js/github_issue_links.js b/docs/_static/js/github_issue_links.js
index e449b4e..d339060 100644
--- a/docs/_static/js/github_issue_links.js
+++ b/docs/_static/js/github_issue_links.js
@@ -2,7 +2,7 @@ window.onload = function() {
     const link = document.createElement("a");
     link.classList.add("muted-link");
     link.classList.add("github-issue-link");
-    link.text = "Have a question?";
+    link.text = "Give feedback";
     link.href = (
         "https://github.com/canonical/ubuntu-pro-client/issues/new?"
         + "title=docs%3A+TYPE+YOUR+QUESTION+HERE"
diff --git a/docs/conf.py b/docs/conf.py
index 8dd4d59..f1f82b0 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -38,6 +38,11 @@ extensions = [
 
 templates_path = ["_templates"]
 
+html_extra_path = [
+    "googleaf254801a5285c31.html",
+    "sitemap-index.xml"
+]
+
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
 # This pattern also affects html_static_path and html_extra_path.
@@ -100,7 +105,7 @@ html_static_path = ["_static"]
 html_css_files = [
     "css/logo.css",
     "css/github_issue_links.css",
-    "css/custom.css"
+    "css/custom.css",
 ]
 html_js_files = [
     "js/github_issue_links.js",
diff --git a/docs/explanations.rst b/docs/explanations.rst
index a424451..78adb85 100644
--- a/docs/explanations.rst
+++ b/docs/explanations.rst
@@ -27,6 +27,7 @@ selection of some of the commands -- what they do, and how they work.
     :maxdepth: 1
 
     explanations/how_to_interpret_the_security_status_command.md
+    explanations/how_to_interpret_output_of_unattended_upgrades.md
     explanations/status_columns.md
     explanations/what_refresh_does.md
 
@@ -48,6 +49,7 @@ Other Pro features explained
 ..  toctree::
     :maxdepth: 1
     
+    explanations/cves_and_usns_explained.md
     explanations/what_are_the_timer_jobs.md
     explanations/what_is_the_daemon.md
     explanations/why_trusty_is_no_longer_supported.md
diff --git a/docs/explanations/apt_messages.md b/docs/explanations/apt_messages.md
index d4e62ef..edd50d2 100644
--- a/docs/explanations/apt_messages.md
+++ b/docs/explanations/apt_messages.md
@@ -25,7 +25,7 @@ Learn more about Ubuntu Pro for 16.04 at https://ubuntu.com/16-04
 
 ## LTS series with esm-apps service disabled
 
-When you are running `apt upgraded` on a LTS release, like Focal, we advertise
+When you are running `apt upgrade` on a LTS release, like Focal, we advertise
 the `esm-apps` service if packages could be upgraded by enabling the service:
 
 ```
diff --git a/docs/explanations/cves_and_usns_explained.md b/docs/explanations/cves_and_usns_explained.md
new file mode 100644
index 0000000..272c1d8
--- /dev/null
+++ b/docs/explanations/cves_and_usns_explained.md
@@ -0,0 +1,44 @@
+# CVEs and USNs explained
+
+## What is a CVE
+
+Common Vulnerabilities and Exposures (CVEs) are a way to catalogue and track public security
+vulnerabilities for a given software. Every CVE is identified through a unique identifier,
+for example [CVE-2023-0465](https://www.cve.org/CVERecord?id=CVE-2023-0465).
+
+CVEs are maintained by the [MITRE Corporation](https://cve.mitre.org/) and the goal of the project
+is to provide naming conventions for the public known security issues while also maintaining a
+centralised repository for all of the security issues. This makes it easier for an organization to
+submit a new security flaw though the CVE convention while also analysing any other existing CVEs
+in the database.
+
+You can search for any existing CVE related to Ubuntu using
+[the Ubuntu CVE page](https://ubuntu.com/security/cves).
+
+## What is a USN?
+
+An Ubuntu Security Notice (USN) is the way that Canonical publicly catalogues and displays security
+vulneratibilities for Ubuntu packages. Usually, a USN is composed of one or more
+[CVEs](#what-is-a-cve) and it also contains update instructions to fix the issue, if a fix is
+already available.
+
+USNs follow a naming convention of the format: [USN-5963-1](https://ubuntu.com/security/notices/USN-5963-1)
+
+You can search for any existing USN using
+[the Ubuntu Security Notices page](https://ubuntu.com/security/notices).
+
+## What are related USNs?
+
+A USN is composed of different CVEs. If the same CVE appears on multiple USNs, we say that those USNs are related.
+In the following image, we can see a visual representation of that concept, where USN-789 and USN-321
+are related USNs because both are affected by CVE-2:
+
+![Related USN example](../images/usn-related.png)
+
+
+A real example can be seen in [USN-5573-1](https://ubuntu.com/security/notices/USN-5573-1).
+In the section **Related notices**, it shows that both **USN-5570-1**
+and **USN-5570-2** are related to **USN-5573-1**.
+
+This information is useful for users that want to tackle
+all related USNs at once, making sure that a CVE is fully fixed on their Ubuntu machine.
diff --git a/docs/explanations/how_to_interpret_output_of_unattended_upgrades.md b/docs/explanations/how_to_interpret_output_of_unattended_upgrades.md
new file mode 100644
index 0000000..714c14a
--- /dev/null
+++ b/docs/explanations/how_to_interpret_output_of_unattended_upgrades.md
@@ -0,0 +1,82 @@
+# How to interpret the output of unattended-upgrades
+
+On Pro Client version 27.14~, we introduced the `u.pro.unattended_upgrades.status.v1` endpoint.
+This endpoint is designed to provide users with an overview of the configuration and setup for
+unattended-upgrades on the machine. The expected output follows this JSON example:
+
+```json
+{
+  "_schema_version": "v1",
+  "data": {
+    "attributes": {
+      "apt_periodic_job_enabled": true,
+      "package_lists_refresh_frequency_days": 1,
+      "systemd_apt_timer_enabled": true,
+      "unattended_upgrades_allowed_origins": [
+        "${distro_id}:${distro_codename}",
+        "${distro_id}:${distro_codename}-security",
+        "${distro_id}ESMApps:${distro_codename}-apps-security",
+        "${distro_id}ESM:${distro_codename}-infra-security"
+      ],
+      "unattended_upgrades_disabled_reason": null,
+      "unattended_upgrades_frequency_days": 1,
+      "unattended_upgrades_last_run": null,
+      "unattended_upgrades_running": true
+    },
+    "meta": {
+      "environment_vars": [],
+      "raw_config": {
+        "APT::Periodic::Enable": "1",
+        "APT::Periodic::Unattended-Upgrade": "1",
+        "APT::Periodic::Update-Package-Lists": "1",
+        "Unattended-Upgrade::Allowed-Origins": [
+          "${distro_id}:${distro_codename}",
+          "${distro_id}:${distro_codename}-security",
+          "${distro_id}ESMApps:${distro_codename}-apps-security",
+          "${distro_id}ESM:${distro_codename}-infra-security"
+        ]
+      }
+    },
+    "type": "UnattendedUpgradesStatus"
+  },
+  "errors": [],
+  "result": "success",
+  "version": "27.14~16.04.1",
+  "warnings": []
+}
+```
+
+As we can see from this output, we have a variable named `unattended_upgrades_running`. That variable
+indicates if unattended-upgrades is properly configured and running on the machine.
+The value of this field will only be `true` if *ALL*  of the following prerequisites are also true:
+
+* *`apt_periodic_job_enable` is true*: That variable indicates if the APT::Periodic::Enable configuration variable
+  is turned on. If it is turned off, unattended-upgrades will not automatically run on the machine.
+* *`package_lists_refresh_frequency_days` is non-zero*: That variable shows the value of APT::Periodic::Package-List-Frequency.
+  This configuration defines the daily frequency for updating package sources in the background. If it has a zero value, this step will never
+  happen and unattended-upgrades might not be able to install new versions of the packages.
+* *`systemd_apt_timer_enabled` is true*: This variable is true if both `apt-daily.timer` and `apt-daily-upgrade.timer` are running
+  on the machine. These timers are the ones that control when unattended-upgrades run. The first job, `apt-daily.timer` is responsible
+  for triggering the code that downloads the lastest package information on the system. The second job, `apt-daily-upgrade.timer` is
+  responsible for running unattended-upgrades to download the latest version of the packages. If one of these jobs is disabled,
+  unattended-upgrades might not work as expected.
+* *`unattended_upgrades_allowed_origins` is not empty*: This variable defines the origins that
+  unattended-upgrades can use to install a package. If that list is empty, no packages can be
+  installed and unattended-upgrades will not work as expected.
+* *`unattended_upgrades_frequency_days` is non-zero*: That variable shows the value of
+  APT::Periodic::Unattended-Upgrade. This configuration defines the daily frequency for running
+  unattended-upgrades in the background. Therefore, if it has a zero value, the command will never
+  run.
+
+
+If any of those conditions are not met, the variable
+*unattended_upgrades_disabled_reason* will contain an object explaining why unattended-upgrades is
+not running. For example, if `package_lists_refresh_frequency_days` has a zero value, we will see
+the following value for *unattended_upgrades_disabled_reason*:
+
+```json
+{
+    "msg": "APT::Periodic::Update-Package-Lists is turned off",
+    "code": "unattended-upgrades-cfg-value-turned-off"
+}
+```
diff --git a/docs/explanations/motd_messages.md b/docs/explanations/motd_messages.md
index 337a4bd..6a8f22b 100644
--- a/docs/explanations/motd_messages.md
+++ b/docs/explanations/motd_messages.md
@@ -2,21 +2,51 @@
 
 When the Ubuntu Pro Client (`pro`) is installed on the system, it delivers
 custom messages on ["Message of the Day" (MOTD)](https://wiki.debian.org/motd).
-Those messages are generated directly by two different sources.
+Those messages are generated directly by three different sources.
 
-## Python-scripted MOTD
+* MOTD about available updates
+* MOTD about important subscription conditions
+* MOTD about ESM being available
+
+## MOTD about available updates
 
 The [update-notifier](https://wiki.ubuntu.com/UpdateNotifier) delivers a script
-called `apt_check.py`. With regards to Ubuntu Pro, this script is responsible
-for:
-  
+via the `update-notifier-common` package called
+`/usr/lib/update-notifier/apt_check.py.
+With regards to Ubuntu Pro, this script is responsible for:
+
 * Informing the user about the status of one of the ESM services; `esm-apps` if
   the machine is an LTS series, or `esm-infra` if the series is in ESM mode.
 * Showing the number of `esm-infra` or `esm-apps` packages that can be upgraded
   on the machine.
 
-For example, here is the output of the `apt_check.py` script on a LTS machine
-when both of those services are enabled:
+`update-notifier` has always added information about potential updates to
+MOTD to raise user awareness. With the advent of Ubuntu Pro they are
+just more differentiated.
+
+Note that if you run `apt_check.py` directly it might give you rather
+unreadable output as it is meant for program use. You can add `--human-readable`
+to see the information as it would be presented in MOTD.
+
+### Machine is unattached
+
+On a machine that runs an Ubuntu release for which the `esm-apps` service
+is available, but not yet attached to an Ubuntu Pro subscription, there will
+be a message notifying the user that there may be more security updates
+available through ESM Apps.
+
+```
+Expanded Security Maintenance for Applications is not enabled.
+
+0 updates can be applied immediately.
+
+Enable ESM Apps to receive additional future security updates.
+See https://ubuntu.com/esm or run: sudo pro status
+```
+
+### Machine is fully attached
+
+In the opposite situation, if an LTS machine has the `esm-infra` and `esm-apps` services enabled then users will see the following output in MOTD:
 
 ```
 Expanded Security Maintenance for Applications is enabled.
@@ -28,8 +58,16 @@ Expanded Security Maintenance for Applications is enabled.
 To see these additional updates run: apt list --upgradable
 ```
 
-However, if we were running this on an ESM series, we would instead see
-`esm-infra` being advertised:
+### Machine is fully attached, on an older release
+
+Above you have seen examples of recent (as in "still in their first 5
+years of support") Ubuntu releases, where the hint is about ESM Apps
+extending the coverage to the universe repositories.
+
+However, if running on an Ubuntu release that has is already past the initial
+5 years of support and has thereby entered Expanded Security Maintenance
+(["ESM"](https://ubuntu.com/security/esm)), we would instead see
+`esm-infra` (which provides coverage for another 5 years) being shown:
 
 ```
 Expanded Security Maintenance Infrastructure is enabled.
@@ -41,17 +79,19 @@ Expanded Security Maintenance Infrastructure is enabled.
 To see these additional updates run: apt list --upgradable
 ```
 
+### Partial service enablement
+
 Now let's consider a scenario where one of these services is not enabled. For
 example, if `esm-apps` was disabled, the output will be:
 
 ```
 Expanded Security Maintenance for Applications is not enabled.
-  
+
 6 updates can be applied immediately.
 1 of these updates is a ESM Infra security update.
 5 of these updates are standard security updates.
 To see these additional updates run: apt list --upgradable
-  
+
 5 additional security updates can be applied with ESM Apps
 Learn more about enabling ESM Apps for Ubuntu 16.04 at
 https://ubuntu.com/16-04
@@ -62,13 +102,13 @@ upgraded if that service was enabled. Note that we would deliver the same
 information for `esm-infra` if the service was disabled and the series running
 on the machine is in ESM state.
 
-## MOTD through Ubuntu Pro timer jobs
+## MOTD about important subscription conditions
 
-One of the timer jobs Ubuntu Pro uses can insert additional messages into MOTD.
-These messages will be always delivered before or after the content created by
-the Python script delivered by `update-notifier`. These additional messages are
-generated when `pro` detects that certain conditions on the machine have been
-met. They are:
+One of the [timer jobs](https://canonical-ubuntu-pro-client.readthedocs-hosted.com/en/latest/explanations/what_are_the_timer_jobs.html)
+Ubuntu Pro uses can insert additional messages into MOTD.
+These messages will be always delivered next to the content created by
+`update-notifier`. These additional messages are generated when `pro`
+detects that certain conditions on the machine have been met. They are:
 
 ### Subscription expired
 
@@ -104,8 +144,69 @@ coverage for your applications.
 Your grace period will expire in 9 days.
 ```
 
-### How are these messages updated and inserted into MOTD?
+## MOTD about ESM being available
+
+When Ubuntu Pro became generally available, a temporary announcement was made
+through MOTD. This was intended to raise awareness of Pro now being available
+and free for personal use, and was shown on systems that could be covered
+by `esm-apps`.
+It looked like:
+
+```
+ * Introducing Expanded Security Maintenance for Applications.
+   Receive updates to over 25,000 software packages with your
+   Ubuntu Pro subscription. Free for personal use.
+
+     https://ubuntu.com/pro
+```
+
+Since this message was intended as a limited-time announcement to coincide
+with the release of Ubuntu Pro into general availability, it was removed in
+27.14.
+
+## How are these messages inserted into MOTD and how can I disable them?
+
+Just as there are different purposes to the messages outlined above,
+there are different sources producing these MOTD elements that one
+sees at login.
+
+Those messages are considered important to ensure user awareness about
+the free additional security coverage provided by Ubuntu Pro and about
+not-yet-applied potential updates in general. Therefore it is generally not
+recommended to disable them. But still, you can selectively disable them
+by removing the config files that add them, as outlined below.
+
+Removing those files is considered a conffile change to customize a program
+and they will stay removed even on future upgrades or re-installations of the
+related packages.
+
+If you realize that you actually need them back you need
+to reinstall the related packages and tell apt/dpkg to offer you to restore
+those files via:
+
+```
+sudo apt install --reinstall -o Dpkg::Options::="--force-confask" ubuntu-advantage-tools update-notifier-common
+```
+
+## Source: MOTD about available updates
+
+1. `update-notifier-common` has a hook `/etc/apt/apt.conf.d/99update-notifier` that runs after `apt update`.
+2. That hook will update the information in `/var/lib/update-notifier/updates-available` matching the new package information that was just fetched by using `/usr/lib/update-notifier/apt-check --human-readable`.
+3. At MOTD generation time, the script located at `/etc/update-motd.d/90-updates-available` checks if `/var/lib/update-notifier/updates-available` exists and if it does, inserts the message into the full MOTD.
+
+If you want to disable any message of update-notifier (not just related to Ubuntu Pro and ESM) about potentially available updates remove `/etc/update-motd.d/90-updates-available`.
 
-1. The contract status is checked periodically in the background when the machine is attached to an Ubuntu Pro contract.
-2. If one of the above messages applies to the contract that the machine is attached to, then the message is stored in `/var/lib/ubuntu-advantage/messages/motd-contract-status`.
+## Source: MOTD about important subscription conditions
+
+1. The subscription status is checked periodically in the background when the machine is attached to an Ubuntu Pro subscription.
+2. If one of the above conditions applies to the subscription that the machine is attached to (there are no messages generated by this for unattached machines), then the message is stored in `/var/lib/ubuntu-advantage/messages/motd-contract-status`.
 3. At MOTD generation time, the script located at `/etc/update-motd.d/91-contract-ua-esm-status` checks if `/var/lib/ubuntu-advantage/messages/motd-contract-status` exists and if it does, inserts the message into the full MOTD.
+
+If you want to disable any message about important conditions of your attached subscription remove `/etc/update-motd.d/91-contract-ua-esm-status`.
+
+## Source: MOTD about ESM being available
+
+1. `pro` checks regularly if a system would have `esm-apps` available to it and if so places a message in `/var/lib/ubuntu-advantage/messages/motd-esm-announce`.
+2. At MOTD generation time, the script located at `/etc/update-motd.d/88-esm-announce` checks if `/var/lib/ubuntu-advantage/messages/motd-esm-announce` exists and if it does, inserts the message into the full MOTD.
+
+If you want to disable the ESM announcement remove `/etc/update-motd.d/88-esm-announce` (or upgrade to 27.14 or later which will remove it for you).
diff --git a/docs/explanations/status_columns.md b/docs/explanations/status_columns.md
index 1447b44..6e79449 100644
--- a/docs/explanations/status_columns.md
+++ b/docs/explanations/status_columns.md
@@ -101,3 +101,105 @@ allow_beta: True
 It's important to keep in mind that any feature defined like this will be
 listed, even if it is invalid or typed the wrong way. Those appear in `status`
 output for informational and debugging purposes.
+
+## Machine-readable output
+
+The `pro status` command supports a `--format` flag with options including `json` and `yaml`. These result in a machine-readable form of the information presented by the `pro status` command.
+
+```{note}
+`pro status` should return the same results whether using `sudo` or not, but earlier versions did not always do this. We recommend using `sudo` whenever possible.
+```
+
+For example, running `sudo pro status --format=json` on an attached machine may give you something like this:
+```javascript
+{
+  "_doc": "Content provided in json response is currently considered Experimental and may change",
+  "_schema_version": "0.1",
+  "account": {
+    "created_at": "2000-01-02T03:04:05+06:00",
+    "id": "account_id",
+    "name": "Test"
+  },
+  "attached": true,
+  "config": { ...effectiveConfiguration },
+  "config_path": "/etc/ubuntu-advantage/uaclient.conf",
+  "contract": {
+    "created_at": "2000-01-02T03:04:05+06:00",
+    "id": "contract_id",
+    "name": "contract_name",
+    "products": [ "uaa-essential" ],
+    "tech_support_level": "essential"
+  },
+  "effective": null,
+  "environment_vars": [...proClientEnvironmentVariables],
+  "errors": [],
+  "execution_details": "No Ubuntu Pro operations are running",
+  "execution_status": "inactive",
+  "expires": "9999-12-31T00:00:00+00:00",
+  "features": {},
+  "machine_id": "machine_id",
+  "notices": [],
+  "result": "success",
+  "services": [
+    {
+      "available": "yes",
+      "blocked_by": [],
+      "description": "Expanded Security Maintenance for Applications",
+      "description_override": null,
+      "entitled": "yes",
+      "name": "esm-apps",
+      "status": "enabled",
+      "status_details": "Ubuntu Pro: ESM Apps is active",
+      "warning": null
+    },
+    {
+      "available": "yes",
+      "blocked_by": [],
+      "description": "Expanded Security Maintenance for Infrastructure",
+      "description_override": null,
+      "entitled": "yes",
+      "name": "esm-infra",
+      "status": "enabled",
+      "status_details": "Ubuntu Pro: ESM Infra is active",
+      "warning": null
+    },
+    {
+      "available": "yes",
+      "blocked_by": [],
+      "description": "Canonical Livepatch service",
+      "description_override": null,
+      "entitled": "yes",
+      "name": "livepatch",
+      "status": "enabled",
+      "status_details": "",
+      "warning": null
+    },
+    ...otherServiceStatusObjects
+  ],
+  "simulated": false,
+  "version": "27.13.6~18.04.1",
+  "warnings": []
+}
+```
+
+Some particularly important attributes in the output include:
+* `attached`: This boolean value indicates whether this machine is attached to an Ubuntu Pro account. This does not tell you if any particular service (e.g. `esm-infra`) is enabled. You must check the individual service item in the `services` list for that status (described below).
+* `expires`: This is the date that the Ubuntu Pro subscription is valid until (in RFC3339 format). After this date has passed the machine should be treated as if not attached and no services are enabled. `attached` may still say `true` and services may still say they are `entitled` and `enabled`, but if the `expires` date has passed, you should assume the services are not functioning.
+* `services`: This is a list of Ubuntu Pro services. Each item has its own attributes. Widely applicable services include those with `name` equal to `esm-infra`, `esm-apps`, and `livepatch`. Some important fields in each service object are:
+  * `name`: The name of the service.
+  * `entitled`: A boolean indicating whether the attached Ubuntu Pro account is allowed to enable this service.
+  * `status`: A string indicating the service's current status on the machine. Any value other than `enabled` should be treated as if the service is not enabled and not working properly on the machine. Possible values are:
+    * `enabled`: The service is enabled and working.
+    * `disabled`: The service can be enabled but is not currently.
+    * `n/a`: The service cannot be enabled on this machine.
+    * `warning`: The service is supposed to be enabled but something is wrong. Check the `warning` field in the service item for additional information.
+
+For example, if you want to programatically find the status of esm-infra on a particular machine, you can use the following command:
+```shell
+sudo pro status --format=json | jq '.services[] | select(.name == "esm-infra").status'
+```
+That command will print one of the `status` values defined above.
+
+```{attention}
+In an future version of Ubuntu Pro Client, there will be an [API](../references/api.md) function to access this information. For now, though, `pro status --format=json` is the recommended machine-readable interface to this data.
+```
diff --git a/docs/googleaf254801a5285c31.html b/docs/googleaf254801a5285c31.html
new file mode 100644
index 0000000..b603071
--- /dev/null
+++ b/docs/googleaf254801a5285c31.html
@@ -0,0 +1 @@
+google-site-verification: googleaf254801a5285c31.html
\ No newline at end of file
diff --git a/docs/howtoguides.rst b/docs/howtoguides.rst
index 7127394..5b93de6 100644
--- a/docs/howtoguides.rst
+++ b/docs/howtoguides.rst
@@ -59,6 +59,7 @@ How to use ``pro`` commands
     :maxdepth: 1
 
     Run `fix` in "dry run" mode <howtoguides/how_to_run_fix_in_dry_run_mode.md>
+    Skip fixing related USNs <howtoguides/how_to_not_fix_related_usns.md>
 
 ``refresh``
 -----------
diff --git a/docs/howtoguides/enable_fips.md b/docs/howtoguides/enable_fips.md
index 8f614fb..4fe8b8a 100644
--- a/docs/howtoguides/enable_fips.md
+++ b/docs/howtoguides/enable_fips.md
@@ -36,5 +36,5 @@ been installed:
 ```
 Installing FIPS packages
 FIPS enabled
-A reboot is required to complete installl
+A reboot is required to complete install.
 ```
diff --git a/docs/howtoguides/get_rid_of_corrupt_lock.md b/docs/howtoguides/get_rid_of_corrupt_lock.md
index 03da4a3..17e8e37 100644
--- a/docs/howtoguides/get_rid_of_corrupt_lock.md
+++ b/docs/howtoguides/get_rid_of_corrupt_lock.md
@@ -2,7 +2,7 @@
 
 Some pro commands (`attach`, `enable`, `detach` and `disable`) will potentially change the
 internal state of your system. Since those commands can run in parallel, we have a lock file
-mechanism to guarantee that only one of these commands can run at the same time. The lock follow
+mechanism to guarantee that only one of these commands can run at the same time. The lock follows
 this pattern:
 
 ```
diff --git a/docs/howtoguides/get_token_and_attach.md b/docs/howtoguides/get_token_and_attach.md
index 41726ef..ff15c15 100644
--- a/docs/howtoguides/get_token_and_attach.md
+++ b/docs/howtoguides/get_token_and_attach.md
@@ -1,10 +1,21 @@
 # How to get an Ubuntu Pro token and attach to a subscription
 
+## Get an Ubuntu Pro token
+
 Retrieve your Ubuntu Pro token from the
-[Ubuntu Pro portal](https://ubuntu.com/pro/). You will log in with your "Single 
+[Ubuntu Pro portal](https://ubuntu.com/pro/). Log in with your "Single
 Sign On" credentials, the same credentials you use for https://login.ubuntu.com.
-Note that you can obtain a free personal token, which provides you with access
-to several of the Ubuntu Pro services.
+
+Being logged in you can then go to the
+[Ubuntu Pro Dashboard](https://ubuntu.com/pro/dashboard) that is associated to
+your user. It will show you all subscriptions currently available to you and
+for each the associated token.
+
+Note that even without buying anything you can always obtain a free personal
+token that way, which provides you with access to several of the Ubuntu Pro
+services.
+
+## Attach to a subscription
 
 Once that token is obtained, to attach your machine to a subscription, just run:
 
@@ -35,3 +46,26 @@ Enable services with: pro enable <service>
 Once the Ubuntu Pro Client is attached to your Ubuntu Pro account, you can use
 it to activate various services, including: access to ESM packages, Livepatch,
 FIPS, and CIS. Some features are specific to certain LTS releases.
+
+## Control of auto-enabled services
+
+Your subscription controls which services are available to you and which ones
+you can manage via the [Ubuntu Pro Dashboard](https://ubuntu.com/pro/dashboard).
+
+Recommended services are auto-enabled by default when attaching a system.
+You can choose which of the available services will be automatically
+enabled or disabled when you attach by toggling them in the
+[Ubuntu Pro Dashboard](https://ubuntu.com/pro/dashboard). 
+Available services can always be enabled or disabled on the command line
+with `pro enable` and `pro disable` after attaching.
+
+![Toggling recommended services in the Pro Dashboard](pro-dashboard-service-toggles.png)
+
+If your subscription does not permit you to change the default
+enabled services via the Dashboard, or if you want to keep the
+defaults but do not want to auto-enable any services while attaching a particular
+machine, you can pass the `--no-auto-enable` flag to `attach` using the following command:
+
+```
+$ sudo pro attach YOUR_TOKEN --no-auto-enable
+```
diff --git a/docs/howtoguides/how_to_not_fix_related_usns.md b/docs/howtoguides/how_to_not_fix_related_usns.md
new file mode 100644
index 0000000..c9fabf0
--- /dev/null
+++ b/docs/howtoguides/how_to_not_fix_related_usns.md
@@ -0,0 +1,65 @@
+# How to not fix related USNs
+
+When running the `pro fix` command for a USN, by default we also try to fix
+any related USNs as well. To better understand the concept of related USNs,
+you can refer to our [related USNs guide](../explanations/cves_and_usns_explained.md).
+To make this clear, let's take a look into the following example:
+
+```
+USN-5573-1: rsync vulnerability
+Found CVEs:
+  - https://ubuntu.com/security/CVE-2022-37434
+
+Fixing requested USN-5573-1
+1 affected source package is installed: rsync
+(1/1) rsync:
+A fix is available in Ubuntu standard updates.
+{ apt update && apt install --only-upgrade -y rsync }
+
+✔ USN-5573-1 is resolved.
+
+Found related USNs:
+- USN-5570-1
+- USN-5570-2
+
+Fixing related USNs:
+- USN-5570-1
+No affected source packages are installed.
+
+✔ USN-5570-1 does not affect your system.
+
+- USN-5570-2
+1 affected source package is installed: zlib
+(1/1) zlib:
+A fix is available in Ubuntu standard updates.
+{ apt update && apt install --only-upgrade -y zlib1g }
+
+✔ USN-5570-2 is resolved.
+
+Summary:
+✔ USN-5573-1 [requested] is resolved.
+✔ USN-5570-1 [related] does not affect your system.
+✔ USN-5570-2 [related] is resolved.
+```
+
+We can see here that the `pro fix` command fixed the requested **USN-5573-1** while also
+handling both **USN-5570-1** and **USN-5570-2**, which are related to the requested USN.
+If you don't want to fix any related USNs during the `fix` operation, just use the
+`--no-related` flag. By running the command `pro fix USN-5573-1 --no-related` we would get
+the following output instead:
+
+```
+USN-5573-1: rsync vulnerability
+Found CVEs:
+  - https://ubuntu.com/security/CVE-2022-37434
+
+Fixing requested USN-5573-1
+1 affected source package is installed: rsync
+(1/1) rsync:
+A fix is available in Ubuntu standard updates.
+{ apt update && apt install --only-upgrade -y rsync }
+
+✔ USN-5573-1 is resolved.
+```
+
+Note that we have not analysed or tried to fix any related USNs
diff --git a/docs/howtoguides/pro-dashboard-service-toggles.png b/docs/howtoguides/pro-dashboard-service-toggles.png
new file mode 100644
index 0000000..90095f5
Binary files /dev/null and b/docs/howtoguides/pro-dashboard-service-toggles.png differ
diff --git a/docs/images/usn-related.png b/docs/images/usn-related.png
new file mode 100644
index 0000000..9db73c0
Binary files /dev/null and b/docs/images/usn-related.png differ
diff --git a/docs/index.rst b/docs/index.rst
index b63cce0..d07dd4d 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -63,9 +63,10 @@ using it!
   
 - **Having trouble?**
   We would like to help! To get help on a specific page in this documentation,
-  simply click on the "Have a question?" link at the top of that page. This
+  simply click on the "Give feedback" link at the top of that page. This
   will open up an issue in GitHub where you can tell us more about the problem
-  you're having and we will do our best to resolve it for you.
+  you're having or suggestion you'd like to make, and we will do our best to
+  resolve it for you.
 
 - **Found a bug?**
   You can `Report bugs on Launchpad`_!
diff --git a/docs/references/api.md b/docs/references/api.md
index 4708d9b..9c40f60 100644
--- a/docs/references/api.md
+++ b/docs/references/api.md
@@ -75,6 +75,28 @@ except ImportError:
 
 You could do something similar by catching certain errors when using the `pro api` subcommand, but there are more cases that could indicate an old version, and it generally isn't recommended.
 
+
+### Errors and Warnings fields
+
+When using the API through the CLI, we use two distinct fields to list issues to the users; *errors*
+and *warnings*. Both of those fields will contain a list of JSON objects explaining unexpected
+behavior during the execution of a command. For example, the *errors* field will be populated like
+this if we have a connectivity issue when running a `pro api` command:
+
+```json
+[
+    {
+        "msg": "Failed to connect to authentication server",
+        "code": "connectivity-error",
+        "meta": {}
+    }
+]
+```
+
+Finally, *warnings* follow the exact same structure as *errors*. The only difference is that
+*warnings* means that the command was able to complete although unexpected scenarios happened
+when executing the command.
+
 ## Available endpoints
 The currently available endpoints are:
 - [u.pro.version.v1](#uproversionv1)
@@ -89,6 +111,7 @@ The currently available endpoints are:
 - [u.pro.packages.summary.v1](#upropackagessummaryv1)
 - [u.pro.packages.updates.v1](#upropackagesupdatesv1)
 - [u.security.package_manifest.v1](#usecuritypackage_manifestv1)
+- [u.unattended_upgrades.status.v1](#uunattended_upgradesstatusv1)
 
 ## u.pro.version.v1
 
@@ -801,3 +824,105 @@ pro api u.security.package_manifest.v1
     "package_manifest":"package1\t1.0\npackage2\t2.3\n"
 }
 ```
+
+## u.unattended_upgrades.status.v1
+
+Introduced in Ubuntu Pro Client Version: `27.14~`
+
+Returns the status around unattended-upgrades. The focus of the endpoint
+is to verify if the application is running and how it is configured on
+the machine.
+
+```{important}
+For this endpoint, we deliver a unique key under `meta` called `raw_config`. This field contains
+all related unattended-upgrades configurations unparsed. This means that this field will maintain
+both original name and values for those configurations.
+``` 
+
+### Args
+
+This endpoint takes no arguments.
+
+### Python API interaction
+
+#### Calling from Python code
+
+```python
+from uaclient.api.u.unattended_upgrades.status.v1 import status
+
+result = status()
+```
+
+#### Expected return object:
+`uaclient.api.u.unattended_upgrades.status.v1.UnattendedUpgradesStatusResult
+
+|Field Name|Type|Description|
+|-|-|-|
+|`systemd_apt_timer_enabled`|*bool*|Indicate if the apt-daily.timer jobs are enabled|
+|`apt_periodic_job_enabled`|*bool*|Indicate if the APT::Periodic::Enabled configuration is turned off|
+|`package_lists_refresh_frequency_days`|*int*|The value of the APT::Periodic::Update-Package-Lists configuration|
+|`unattended_upgrades_frequency_days`|*int*|The value of the APT::Periodic::Unattended-Upgrade configuration|
+|`unattended_upgrades_allowed_origins`|*List[str]*|The value of the Unattended-Upgrade::Allowed-Origins configuration|
+|`unattended_upgrades_running`|*bool*|Indicate if the unattended-upgrade service is correctly configured and running|
+|`unattended_upgrades_disabled_reason`|*object*|Object that explains why unattended-upgrades is not running. In case the application is running, the object will be null|
+|`unatteded_upgrades_last_run`|`datetime.datetime`|The last time unattended-upgrades has run|
+
+`uaclient.api.u.unattended_upgrades.status.v1.UnattendedUpgradesStatusDisabledReason`
+
+|Field Name|Type|Description|
+|-|-|-|
+|`msg`|*str*|The reason why unattended-upgrades is not running in the system|
+|`code`|*str*|The message code associated with the message|
+
+### Raised exceptions
+
+- `UnattendedUpgradesError`: Raised in case we cannot run a necessary command to show the status
+  of unattended-upgrades
+
+### CLI interaction
+
+#### Calling from the CLI:
+
+```bash
+pro api u.unattended_upgrades.status.v1
+```
+
+#### Expected attributes in JSON structure
+
+```json
+{
+    "apt_periodic_job_enabled": true,
+    "package_lists_refresh_frequency_days": 1,
+    "systemd_apt_timer_enabled": true,
+    "unattended_upgrades_allowed_origins": [
+      "${distro_id}:${distro_codename}",
+      "${distro_id}:${distro_codename}-security",
+      "${distro_id}ESMApps:${distro_codename}-apps-security",
+      "${distro_id}ESM:${distro_codename}-infra-security"
+    ],
+    "unattended_upgrades_disabled_reason": null,
+    "unattended_upgrades_frequency_days": 1,
+    "unattended_upgrades_last_run": null,
+    "unattended_upgrades_running": true
+}
+```
+
+#### Possible attributes in JSON meta field
+```json
+{
+    "meta": {
+      "environment_vars": [],
+      "raw_config": {
+        "APT::Periodic::Enable": "1",
+        "APT::Periodic::Unattended-Upgrade": "1",
+        "APT::Periodic::Update-Package-Lists": "1",
+        "Unattended-Upgrade::Allowed-Origins": [
+          "${distro_id}:${distro_codename}",
+          "${distro_id}:${distro_codename}-security",
+          "${distro_id}ESMApps:${distro_codename}-apps-security",
+          "${distro_id}ESM:${distro_codename}-infra-security"
+        ]
+      }
+    }
+}
+```
diff --git a/docs/references/network_requirements.md b/docs/references/network_requirements.md
index cb25256..ffbeffd 100644
--- a/docs/references/network_requirements.md
+++ b/docs/references/network_requirements.md
@@ -10,7 +10,7 @@ access to:
 
 ```{seealso}
 
-You can also refer to our [Proxy Configuration guide](/../howtoguides/configure_proxies.md)
+You can also refer to our [Proxy Configuration guide](../howtoguides/configure_proxies.md)
 to learn how to inform Ubuntu Pro Client of HTTP(S)/APT proxies.
 ```
 
diff --git a/docs/sitemap-index.xml b/docs/sitemap-index.xml
new file mode 100644
index 0000000..efce50f
--- /dev/null
+++ b/docs/sitemap-index.xml
@@ -0,0 +1,8 @@
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+    <url>
+        <loc>https://canonical-ubuntu-pro-client.readthedocs-hosted.com/en/latest/</loc>
+        <changefreq>weekly</changefreq>
+        <priority>1.0</priority>
+    </url>
+</urlset>
+
diff --git a/docs/tutorials/create_a_fips_updates_pro_cloud_image.md b/docs/tutorials/create_a_fips_updates_pro_cloud_image.md
index e4427bc..10b87b3 100644
--- a/docs/tutorials/create_a_fips_updates_pro_cloud_image.md
+++ b/docs/tutorials/create_a_fips_updates_pro_cloud_image.md
@@ -1,8 +1,8 @@
-# Customised Cloud Ubuntu Pro images with FIPS updates
+# How to customise a cloud Ubuntu Pro image with FIPS updates
 
 ## Launch an Ubuntu Pro instance on your cloud
 
-See the following links for up to date information for each supported Cloud:
+See the following links for up to date information for each supported cloud:
 
 * https://ubuntu.com/aws/pro
 * https://ubuntu.com/azure/pro
@@ -10,20 +10,20 @@ See the following links for up to date information for each supported Cloud:
 
 ## Enable FIPS updates
 
-First, we need to wait for the standard Ubuntu Pro services to be set up:
+Wait for the standard Ubuntu Pro services to be set up:
 
 ```bash
 sudo pro status --wait
 ```
 
-We can then use [the `enable` command](../howtoguides/enable_fips.md) to set up
+Use [the `enable` command](../howtoguides/enable_fips.md) to set up
 FIPS updates.
 
 ```bash
 sudo pro enable fips-updates --assume-yes
 ```
 
-Now, we need to reboot the instance:
+Now, reboot the instance:
 
 ```bash
 sudo reboot
@@ -49,12 +49,12 @@ Cloud-specific instructions are here:
 * [Azure](https://docs.microsoft.com/en-us/azure/virtual-machines/windows/capture-image-resource)
 * [GCP](https://cloud.google.com/compute/docs/machine-images/create-machine-images)
 
-## Launch your custom image!
+## Launch your custom image
 
-Use your specific Cloud to launch a new instance from your custom image.
+Use your specific cloud to launch a new instance from the custom image.
 
 ````{note}
-For versions prior to 27.11, you will need to re-enable `fips-updates` on each
+For versions of the Ubuntu Pro Client prior to 27.11, you will need to re-enable `fips-updates` on each
 instance launched from the custom image.
 
 This won't require a reboot and is only necessary to ensure the instance gets
@@ -64,7 +64,7 @@ updates to FIPS packages when they become available.
 sudo pro enable fips-updates --assume-yes
 ```
 
-You can easily script this using [cloud-init user data](https://cloudinit.readthedocs.io/en/latest/topics/modules.html#runcmd) at launch time:
+This can be scripted using [cloud-init user data](https://cloudinit.readthedocs.io/en/latest/topics/modules.html#runcmd) at launch time:
 ```yaml
 #cloud-config
 # Enable fips-updates after pro auto-attach and reboot after cloud-init completes
diff --git a/docs/tutorials/fix_scenarios.md b/docs/tutorials/fix_scenarios.md
index fe6f8e2..1c96800 100644
--- a/docs/tutorials/fix_scenarios.md
+++ b/docs/tutorials/fix_scenarios.md
@@ -81,7 +81,9 @@ You should see an output like this:
 ```
 CVE-2020-15180: MariaDB vulnerabilities
 https://ubuntu.com/security/CVE-2020-15180
+
 No affected source packages are installed.
+
 ✔ CVE-2020-15180 does not affect your system.
 ```
 
@@ -110,10 +112,12 @@ You will then see the following output:
 ```
 CVE-2020-25686: Dnsmasq vulnerabilities
 https://ubuntu.com/security/CVE-2020-25686
+
 1 affected package is installed: dnsmasq
 (1/1) dnsmasq:
 A fix is available in Ubuntu standard updates.
 { apt update && apt install --only-upgrade -y dnsmasq }
+
 ✔ CVE-2020-25686 is resolved.
 ```
 
@@ -137,10 +141,12 @@ run the `pro fix` command again, and we should now see the following:
 ```
 CVE-2020-25686: Dnsmasq vulnerabilities
 https://ubuntu.com/security/CVE-2020-25686
+
 1 affected package is installed: dnsmasq
 (1/1) dnsmasq:
 A fix is available in Ubuntu standard updates.
 The update is already installed.
+
 ✔ CVE-2020-25686 is resolved.
 ```
 
@@ -151,30 +157,34 @@ let you know! Before we reproduce this scenario, let us first install a package
 that we know has no fix available by running:
 
 ```console
-$ sudo apt install -y libawl-php
+$ sudo apt-get install -y expat=2.1.0-7 swish-e matanza ghostscript
 ```
 
 Now, we can confirm that there is no fix by running the following command:
 
 ```console
-$ pro fix USN-4539-1
+$ pro fix CVE-2017-9233
 ```
 
 You will see the following output:
 
 ```
-USN-4539-1: AWL vulnerability
-Found CVEs:
-https://ubuntu.com/security/CVE-2020-11728
-1 affected source package is installed: awl
-(1/1) awl:
-Sorry, no fix is available.
-1 package is still affected: awl
-✘ USN-4539-1 is not resolved.
+CVE-2017-9233: Coin3D vulnerability
+  - https://ubuntu.com/security/CVE-2017-9233
+
+3 affected source packages are installed: expat, matanza, swish-e
+(1/3, 2/3) matanza, swish-e:
+Ubuntu security engineers are investigating this issue.
+(3/3) expat:
+A fix is available in Ubuntu standard updates.
+{ apt update && apt install --only-upgrade -y expat }
+
+2 packages are still affected: matanza, swish-e
+✘ CVE-2017-9233 is not resolved.
 ```
 
-As you can see, we are informed by `pro fix` that there is no fix available. In
-the last line, we can also see that the USN is not resolved.
+As you can see, we are informed by `pro fix` that some packages do not have a fix available. In
+the last line, we can also see that the CVE is not resolved.
 
 ## CVE/USN that require an Ubuntu Pro subscription
 
@@ -193,6 +203,8 @@ USN-5079-2: curl vulnerabilities
 Found CVEs:
 https://ubuntu.com/security/CVE-2021-22946
 https://ubuntu.com/security/CVE-2021-22947
+
+Fixing requested USN-5079-2
 1 affected package is installed: curl
 (1/1) curl:
 A fix is available in Ubuntu Pro: ESM Infra.
@@ -222,6 +234,7 @@ USN-5079-2: curl vulnerabilities
 Found CVEs:
 https://ubuntu.com/security/CVE-2021-22946
 https://ubuntu.com/security/CVE-2021-22947
+
 1 affected package is installed: curl
 (1/1) curl:
 A fix is available in Ubuntu Pro: ESM Infra.
@@ -258,22 +271,40 @@ Enable services with: pro enable <service>
 Technical support level: essential
 { apt update && apt install --only-upgrade -y curl libcurl3-gnutls }
 ✔ USN-5079-2 is resolved.
+
+Found related USNs:
+- USN-5079-1
+
+Fixing related USNs:
+- USN-5079-1
+No affected source packages are installed.
+
+✔ USN-5079-1 does not affect your system.
+
+Summary:
+✔ USN-5079-2 [requested] is resolved.
+✔ USN-5079-1 [related] does not affect your system.
 ```
 
-We can see that that the attach command was successful, which can be verified
+We can see that this command also fixed related USN **USN-5079-1**.
+If you want to learn more about related USNs, refer to [our explanation guide](../explanations/cves_and_usns_explained.md#what-are-related-usns)
+
+Finally, we can see that that the attach command was successful, which can be verified
 by the status output we see when executing the command. Additionally, we can
 observe that the USN is indeed fixed, which you can confirm by running the
 `pro fix` command again:
 
 ```
-N-5079-2: curl vulnerabilities
+USN-5079-2: curl vulnerabilities
 Found CVEs:
 https://ubuntu.com/security/CVE-2021-22946
 https://ubuntu.com/security/CVE-2021-22947
+
 1 affected package is installed: curl
 (1/1) curl:
 A fix is available in Ubuntu Pro: ESM Infra.
 The update is already installed.
+
 ✔ USN-5079-2 is resolved.
 ```
 
@@ -308,6 +339,7 @@ prompted):
 ```
 CVE-2021-44731: snapd vulnerabilities
 https://ubuntu.com/security/CVE-2021-44731
+
 1 affected package is installed: snapd
 (1/1) snapd:
 A fix is available in Ubuntu Pro: ESM Infra.
@@ -321,6 +353,7 @@ One moment, checking your subscription first
 Updating package lists
 Ubuntu Pro: ESM Infra enabled
 { apt update && apt install --only-upgrade -y ubuntu-core-launcher snapd }
+
 ✔ CVE-2021-44731 is resolved.
 ```
 
@@ -342,13 +375,15 @@ $ sudo pro fix CVE-2022-0778
 Then you will see the following output:
 
 ```
-VE-2022-0778: OpenSSL vulnerability
+CVE-2022-0778: OpenSSL vulnerability
 https://ubuntu.com/security/CVE-2022-0778
+
 1 affected package is installed: openssl
 (1/1) openssl:
 A fix is available in Ubuntu Pro: ESM Infra.
 { apt update && apt install --only-upgrade -y libssl1.0.0 openssl }
 A reboot is required to complete fix operation.
+
 ✘ CVE-2022-0778 is not resolved.
 ```
 
@@ -358,10 +393,12 @@ indeed fixed:
 ```
 CVE-2022-0778: OpenSSL vulnerability
 https://ubuntu.com/security/CVE-2022-0778
+
 1 affected package is installed: openssl
 (1/1) openssl:
 A fix is available in Ubuntu Pro: ESM Infra.
 The update is already installed.
+
 ✔ CVE-2022-0778 is resolved.
 ```
 
@@ -390,6 +427,7 @@ And you will see the following output:
 ```
 CVE-2017-9233: Expat vulnerability
 https://ubuntu.com/security/CVE-2017-9233
+
 3 affected packages are installed: expat, matanza, swish-e
 (1/3, 2/3) matanza, swish-e:
 Sorry, no fix is available.
@@ -397,6 +435,7 @@ Sorry, no fix is available.
 A fix is available in Ubuntu standard updates.
 { apt update && apt install --only-upgrade -y expat }
 2 packages are still affected: matanza, swish-e
+
 ✘ CVE-2017-9233 is not resolved.
 ```
 
diff --git a/features/api_full_auto_attach.feature b/features/api_full_auto_attach.feature
index c65fca5..9df2f69 100644
--- a/features/api_full_auto_attach.feature
+++ b/features/api_full_auto_attach.feature
@@ -27,7 +27,7 @@ Feature: Full Auto-Attach Endpoint
         """
         Then stdout matches regexp:
         """
-        livepatch     +yes +(disabled|n/a)  +Canonical Livepatch service
+        livepatch     +yes +(disabled|n/a)  +(Canonical Livepatch service|Current kernel is not supported)
         """
         Examples:
            | release |
diff --git a/features/apt_messages.feature b/features/apt_messages.feature
index 401360d..693ebee 100644
--- a/features/apt_messages.feature
+++ b/features/apt_messages.feature
@@ -175,7 +175,7 @@ Feature: APT Messages
         Calculating upgrade...
         Get more security updates through Ubuntu Pro with 'esm-apps' enabled:
           <package>
-        Learn more about Ubuntu Pro at https://ubuntu.com/pro
+        <learn_more_msg>
         0 upgraded, 0 newly installed, 0 to remove and \d+ not upgraded.
         """
         When I run `apt-get upgrade` with sudo
@@ -211,10 +211,10 @@ Feature: APT Messages
         0 upgraded, 0 newly installed, 0 to remove and \d+ not upgraded\.
         """
         Examples: ubuntu release
-          | release | package |
-          | bionic  | ansible |
-          | focal   | hello   |
-          | jammy   | hello   |
+          | release | package | learn_more_msg                                                    |
+          | bionic  | ansible | Learn more about Ubuntu Pro for 18.04 at https://ubuntu.com/18-04 |
+          | focal   | hello   | Learn more about Ubuntu Pro at https://ubuntu.com/pro             |
+          | jammy   | hello   | Learn more about Ubuntu Pro at https://ubuntu.com/pro             |
 
     @series.all
     @uses.config.machine_type.lxd.container
@@ -613,6 +613,7 @@ Feature: APT Messages
 
     @series.xenial
     @series.bionic
+    @series.focal
     @uses.config.machine_type.aws.generic
     Scenario Outline: AWS URLs
         Given a `<release>` machine with ubuntu-advantage-tools installed
@@ -620,17 +621,19 @@ Feature: APT Messages
         When I run `apt-get install ansible -y` with sudo
         When I run `apt-get update` with sudo
         When I run `apt upgrade --dry-run` with sudo
-        Then stdout matches regexp:
+        Then stdout contains substring:
         """
         <msg>
         """
         Examples: ubuntu release
-          | release | msg                                                                    |
-          | xenial  | Learn more about Ubuntu Pro for 16\.04 at https:\/\/ubuntu\.com\/16-04 |
-          | bionic  | Learn more about Ubuntu Pro on AWS at https:\/\/ubuntu\.com\/aws\/pro  |
+          | release | msg                                                               |
+          | xenial  | Learn more about Ubuntu Pro for 16.04 at https://ubuntu.com/16-04 |
+          | bionic  | Learn more about Ubuntu Pro for 18.04 at https://ubuntu.com/18-04 |
+          | focal   | Learn more about Ubuntu Pro on AWS at https://ubuntu.com/aws/pro  |
 
     @series.xenial
     @series.bionic
+    @series.focal
     @uses.config.machine_type.azure.generic
     Scenario Outline: Azure URLs
         Given a `<release>` machine with ubuntu-advantage-tools installed
@@ -638,17 +641,19 @@ Feature: APT Messages
         When I run `apt-get install ansible -y` with sudo
         When I run `apt-get update` with sudo
         When I run `apt upgrade --dry-run` with sudo
-        Then stdout matches regexp:
+        Then stdout contains substring:
         """
         <msg>
         """
         Examples: ubuntu release
-          | release | msg                                                                                    |
-          | xenial  | Learn more about Ubuntu Pro for 16\.04 on Azure at https:\/\/ubuntu\.com\/16-04\/azure |
-          | bionic  | Learn more about Ubuntu Pro on Azure at https:\/\/ubuntu\.com\/azure\/pro              |
+          | release | msg                                                                              |
+          | xenial  | Learn more about Ubuntu Pro for 16.04 on Azure at https://ubuntu.com/16-04/azure |
+          | bionic  | Learn more about Ubuntu Pro for 18.04 on Azure at https://ubuntu.com/18-04/azure |
+          | focal   | Learn more about Ubuntu Pro on Azure at https://ubuntu.com/azure/pro             |
 
     @series.xenial
     @series.bionic
+    @series.focal
     @uses.config.machine_type.gcp.generic
     Scenario Outline: GCP URLs
         Given a `<release>` machine with ubuntu-advantage-tools installed
@@ -656,14 +661,15 @@ Feature: APT Messages
         When I run `apt-get install ansible -y` with sudo
         When I run `apt-get update` with sudo
         When I run `apt upgrade --dry-run` with sudo
-        Then stdout matches regexp:
+        Then stdout contains substring:
         """
         <msg>
         """
         Examples: ubuntu release
           | release | msg                                                                    |
-          | xenial  | Learn more about Ubuntu Pro for 16\.04 at https:\/\/ubuntu\.com\/16-04 |
-          | bionic  | Learn more about Ubuntu Pro on GCP at https:\/\/ubuntu\.com\/gcp\/pro  |
+          | xenial  | Learn more about Ubuntu Pro for 16.04 at https://ubuntu.com/16-04 |
+          | bionic  | Learn more about Ubuntu Pro for 18.04 at https://ubuntu.com/18-04 |
+          | focal   | Learn more about Ubuntu Pro on GCP at https://ubuntu.com/gcp/pro  |
 
     @series.kinetic
     @uses.config.machine_type.lxd.container
diff --git a/features/attach_validtoken.feature b/features/attach_validtoken.feature
index da04c06..3ff70d5 100644
--- a/features/attach_validtoken.feature
+++ b/features/attach_validtoken.feature
@@ -8,18 +8,31 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Pro
     Scenario Outline: Attached command in a non-lts ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
-        And I run `pro status --all` as non-root
+        And I run `pro status` as non-root
         Then stdout matches regexp:
-            """
-            SERVICE       +ENTITLED  STATUS    DESCRIPTION
-            cc-eal        +yes      +n/a      +Common Criteria EAL2 Provisioning Packages
-            cis           +yes      +n/a      +Security compliance and audit tools
-            esm-apps      +yes      +n/a      +Expanded Security Maintenance for Applications
-            esm-infra     +yes      +n/a      +Expanded Security Maintenance for Infrastructure
-            fips          +yes      +n/a      +NIST-certified core packages
-            fips-updates  +yes      +n/a      +NIST-certified core packages with priority security updates
-            livepatch     +yes      +n/a      +Canonical Livepatch service
-            """
+        """
+        No Ubuntu Pro services are available to this system.
+        """
+        And stdout matches regexp:
+        """
+        For a list of all Ubuntu Pro services, run 'pro status --all'
+        """
+        When I run `pro status --all` as non-root
+        Then stdout matches regexp:
+        """
+        SERVICE       +ENTITLED  STATUS    DESCRIPTION
+        cc-eal        +yes      +n/a      +Common Criteria EAL2 Provisioning Packages
+        cis           +yes      +n/a      +Security compliance and audit tools
+        esm-apps      +yes      +n/a      +Expanded Security Maintenance for Applications
+        esm-infra     +yes      +n/a      +Expanded Security Maintenance for Infrastructure
+        fips          +yes      +n/a      +NIST-certified core packages
+        fips-updates  +yes      +n/a      +NIST-certified core packages with priority security updates
+        livepatch     +yes      +n/a      +Canonical Livepatch service
+        """
+        And stdout does not match regexp:
+        """
+        For a list of all Ubuntu Pro services, run 'pro status --all'
+        """
 
         Examples: ubuntu release
             | release |
@@ -83,7 +96,7 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Pro
            | xenial  | libkrad0=1.13.2+dfsg-5      | disabled  | cis        | disabled | disabled | Canonical Livepatch service   |
            | bionic  | libkrad0=1.16-2build1       | disabled  | cis        | disabled | disabled | Canonical Livepatch service   |
            | focal   | hello=2.10-2ubuntu2         | n/a       | usg        | disabled | disabled | Canonical Livepatch service   |
-           | jammy   | hello=2.10-2ubuntu4         | n/a       | usg        | n/a      | n/a      | Available with the HWE kernel |
+           | jammy   | hello=2.10-2ubuntu4         | n/a       | usg        | n/a      | n/a      | Canonical Livepatch service   |
 
     @series.lts
     @uses.config.machine_type.lxd.container
@@ -380,6 +393,7 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Pro
 
         Examples: ubuntu release livepatch status
            | release |
-           | xenial  |
-           | bionic  |
-           | focal   |
+           # removing until we add this feature back in a way that doesn't hammer the server
+           #| xenial  |
+           #| bionic  |
+           #| focal   |
diff --git a/features/attached_commands.feature b/features/attached_commands.feature
index 524e4e0..ffedcbe 100644
--- a/features/attached_commands.feature
+++ b/features/attached_commands.feature
@@ -294,7 +294,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
            | xenial  | yes      | yes    | yes | yes  | yes         | yes | cis        | no              |
            | bionic  | yes      | yes    | yes | yes  | yes         | yes | cis        | no              |
            | focal   | yes      | no     | yes | yes  | yes         | no  | usg        | no              |
-           | jammy   | yes      | no     | no  | no   | no          | no  | usg        | yes             |
+           | jammy   | yes      | no     | yes | no   | no          | no  | usg        | yes             |
 
     @series.all
     @uses.config.machine_type.lxd.container
diff --git a/features/attached_status.feature b/features/attached_status.feature
index b01386e..571bba4 100644
--- a/features/attached_status.feature
+++ b/features/attached_status.feature
@@ -101,6 +101,7 @@ Feature: Attached status
         ros             +yes      +disabled +Security Updates for the Robot Operating System
         ros-updates     +yes      +disabled +All Updates for the Robot Operating System
 
+        For a list of all Ubuntu Pro services, run 'pro status --all'
         Enable services with: pro enable <service>
         """
         When I verify root and non-root `pro status --all` calls have the same output
@@ -143,6 +144,7 @@ Feature: Attached status
         fips-updates    +yes      +disabled +NIST-certified core packages with priority security updates
         usg             +yes      +disabled +Security compliance and audit tools
 
+        For a list of all Ubuntu Pro services, run 'pro status --all'
         Enable services with: pro enable <service>
         """
         When I verify root and non-root `pro status --all` calls have the same output
@@ -180,7 +182,9 @@ Feature: Attached status
         SERVICE         +ENTITLED +STATUS   +DESCRIPTION
         esm-apps        +yes      +enabled  +Expanded Security Maintenance for Applications
         esm-infra       +yes      +enabled  +Expanded Security Maintenance for Infrastructure
+        usg             +yes      +disabled +Security compliance and audit tools
 
+        For a list of all Ubuntu Pro services, run 'pro status --all'
         Enable services with: pro enable <service>
         """
         When I verify root and non-root `pro status --all` calls have the same output
@@ -197,7 +201,7 @@ Feature: Attached status
         realtime-kernel +yes      +n/a      +Ubuntu kernel with PREEMPT_RT patches integrated
         ros             +yes      +n/a      +Security Updates for the Robot Operating System
         ros-updates     +yes      +n/a      +All Updates for the Robot Operating System
-        usg             +yes      +n/a      +Security compliance and audit tools
+        usg             +yes      +disabled +Security compliance and audit tools
 
         Enable services with: pro enable <service>
         """
diff --git a/features/cloud.py b/features/cloud.py
index 1a5d11b..d222f84 100644
--- a/features/cloud.py
+++ b/features/cloud.py
@@ -168,7 +168,7 @@ class Cloud:
         """
         return instance.id
 
-    def locate_image_name(self, series: str) -> str:
+    def locate_image_name(self, series: str, daily: bool = True) -> str:
         """Locate and return the image name to use for vm provision.
 
         :param series:
@@ -189,7 +189,14 @@ class Cloud:
         elif "pro" in self.machine_type:
             image_type = ImageType.PRO
 
-        return self.api.daily_image(release=series, image_type=image_type)
+        if daily:
+            logging.debug("looking up daily image for {}".format(series))
+            return self.api.daily_image(release=series, image_type=image_type)
+        else:
+            logging.debug("looking up released image for {}".format(series))
+            return self.api.released_image(
+                release=series, image_type=image_type
+            )
 
     def manage_ssh_key(
         self,
@@ -297,7 +304,14 @@ class EC2(Cloud):
             An AWS cloud provider instance
         """
         if not image_name:
-            image_name = self.locate_image_name(series)
+            if series == "xenial" and "pro" not in self.machine_type:
+                logging.debug(
+                    "defaulting to non-daily image for awsgeneric-16.04"
+                )
+                daily = False
+            else:
+                daily = True
+            image_name = self.locate_image_name(series, daily=daily)
 
         logging.info(
             "--- Launching AWS image {}({})".format(image_name, series)
@@ -603,7 +617,7 @@ class _LXD(Cloud):
         # instead of the instance id
         return instance.name
 
-    def locate_image_name(self, series: str) -> str:
+    def locate_image_name(self, series: str, daily: bool = True) -> str:
         """Locate and return the image name to use for vm provision.
 
         :param series:
@@ -618,7 +632,13 @@ class _LXD(Cloud):
                 "Must provide either series or image_name to launch azure"
             )
 
-        image_name = self.api.daily_image(release=series)
+        if daily:
+            logging.debug("looking up daily image for {}".format(series))
+            image_name = self.api.daily_image(release=series)
+        else:
+            logging.debug("looking up released image for {}".format(series))
+            image_name = self.api.released_image(release=series)
+
         return image_name
 
 
diff --git a/features/daemon.feature b/features/daemon.feature
index ed74ec5..88fbbf7 100644
--- a/features/daemon.feature
+++ b/features/daemon.feature
@@ -105,10 +105,10 @@ Feature: Pro Upgrade Daemon only runs in environments where necessary
         Active: active \(running\)
         """
         # TODO find out what caused memory to go up, try to lower it again
-        Then on `xenial`, systemd status output says memory usage is less than `16` MB
-        Then on `bionic`, systemd status output says memory usage is less than `14` MB
-        Then on `focal`, systemd status output says memory usage is less than `12` MB
-        Then on `jammy`, systemd status output says memory usage is less than `13` MB
+        Then on `xenial`, systemd status output says memory usage is less than `17` MB
+        Then on `bionic`, systemd status output says memory usage is less than `15` MB
+        Then on `focal`, systemd status output says memory usage is less than `13` MB
+        Then on `jammy`, systemd status output says memory usage is less than `14` MB
 
         When I run `cat /var/log/ubuntu-advantage-daemon.log` with sudo
         Then stdout matches regexp:
diff --git a/features/docker.feature b/features/docker.feature
index 2e82266..bf204d9 100644
--- a/features/docker.feature
+++ b/features/docker.feature
@@ -77,4 +77,3 @@ Feature: Build docker images with pro services
            | focal   | xenial            | [ esm-infra ]  | curl              | esm                  |
            | focal   | bionic            | [ fips ]       | openssl           | fips                 |
            | focal   | focal             | [ esm-apps ]   | hello             | esm                  |
-
diff --git a/features/enable_fips_cloud.feature b/features/enable_fips_cloud.feature
index c14b39b..41edbb0 100644
--- a/features/enable_fips_cloud.feature
+++ b/features/enable_fips_cloud.feature
@@ -217,7 +217,7 @@ Feature: FIPS enablement in cloud based machines
         And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
         When I run `apt-cache policy ubuntu-fips` as non-root
         Then stdout does not match regexp:
-        ""
+        """
         .*Installed: \(none\)
         """
         When I reboot the machine
diff --git a/features/enable_fips_vm.feature b/features/enable_fips_vm.feature
index ea6c38e..88a5db8 100644
--- a/features/enable_fips_vm.feature
+++ b/features/enable_fips_vm.feature
@@ -11,7 +11,7 @@ Feature: FIPS enablement in lxd VMs
         When I run `pro status --format json` with sudo
         Then stdout contains substring
         """
-        {"available": "yes", "blocked_by": [{"name": "livepatch", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "disabled", "status_details": "FIPS is not configured"}
+        {"available": "yes", "blocked_by": [{"name": "livepatch", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "disabled", "status_details": "FIPS is not configured", "warning": null}
         """
         When I run `pro disable livepatch` with sudo
         And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo, retrying exit [100]
@@ -48,15 +48,14 @@ Feature: FIPS enablement in lxd VMs
         When I run `pro status --format json --all` with sudo
         Then stdout contains substring:
         """
-        {"available": "no", "blocked_by": [{"name": "fips", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}], "description": "Canonical Livepatch service", "description_override": null, "entitled": "yes", "name": "livepatch", "status": "n/a", "status_details": "Cannot enable Livepatch when FIPS is enabled."}
+        {"available": "no", "blocked_by": [{"name": "fips", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}], "description": "Canonical Livepatch service", "description_override": null, "entitled": "yes", "name": "livepatch", "status": "n/a", "status_details": "Cannot enable Livepatch when FIPS is enabled.", "warning": null}
         """
-
         When I reboot the machine
         And  I run `uname -r` as non-root
         Then stdout matches regexp:
-            """
-            fips
-            """
+        """
+        fips
+        """
         When I run `cat /proc/sys/crypto/fips_enabled` with sudo
         Then I will see the following on stdout:
         """
@@ -64,24 +63,24 @@ Feature: FIPS enablement in lxd VMs
         """
         When I run `pro status --all` with sudo
         Then stdout does not match regexp:
-            """
-            FIPS support requires system reboot to complete configuration
-            """
+        """
+        FIPS support requires system reboot to complete configuration
+        """
         When I run `pro disable <fips-service>` `with sudo` and stdin `y`
         Then stdout matches regexp:
-            """
-            This will disable the FIPS entitlement but the FIPS packages will remain installed.
-            """
+        """
+        This will disable the FIPS entitlement but the FIPS packages will remain installed.
+        """
         And stdout matches regexp:
-            """
-            Updating package lists
-            A reboot is required to complete disable operation
-            """
+        """
+        Updating package lists
+        A reboot is required to complete disable operation
+        """
         When I run `pro status --all` with sudo
         Then stdout matches regexp:
-            """
-            Disabling FIPS requires system reboot to complete operation
-            """
+        """
+        Disabling FIPS requires system reboot to complete operation
+        """
         When I run `apt-cache policy ubuntu-fips` as non-root
         Then stdout matches regexp:
         """
@@ -103,13 +102,13 @@ Feature: FIPS enablement in lxd VMs
         """
         When I run `pro status --all` with sudo
         Then stdout matches regexp:
-            """
-            <fips-service> +yes                disabled
-            """
+        """
+        <fips-service> +yes                disabled
+        """
         Then stdout does not match regexp:
-            """
-            Disabling FIPS requires system reboot to complete operation
-            """
+        """
+        Disabling FIPS requires system reboot to complete operation
+        """
         When I run `pro enable <fips-service> --assume-yes --format json --assume-yes` with sudo
         Then stdout is a json matching the `ua_operation` schema
         And I will see the following on stdout:
@@ -125,9 +124,9 @@ Feature: FIPS enablement in lxd VMs
         """
         When I run `pro status --all` with sudo
         Then stdout matches regexp:
-            """
-            <fips-service> +yes                disabled
-            """
+        """
+        <fips-service> +yes                disabled
+        """
 
         Examples: ubuntu release
            | release | fips-name    | fips-service |fips-apt-source                                |
@@ -171,7 +170,7 @@ Feature: FIPS enablement in lxd VMs
         When I run `pro status --all --format json` with sudo
         Then stdout contains substring:
         """
-        {"available": "no", "blocked_by": [{"name": "fips-updates", "reason": "FIPS cannot be enabled if FIPS Updates has ever been enabled because FIPS Updates installs security patches that aren't officially certified.", "reason_code": "fips-updates-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "n/a", "status_details": "Cannot enable FIPS when FIPS Updates is enabled."}
+        {"available": "no", "blocked_by": [{"name": "fips-updates", "reason": "FIPS cannot be enabled if FIPS Updates has ever been enabled because FIPS Updates installs security patches that aren't officially certified.", "reason_code": "fips-updates-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "n/a", "status_details": "Cannot enable FIPS when FIPS Updates is enabled.", "warning": null}
         """
 
         When I reboot the machine
@@ -245,7 +244,7 @@ Feature: FIPS enablement in lxd VMs
         When I run `pro status --all --format json` with sudo
         Then stdout contains substring:
         """
-        {"available": "no", "blocked_by": [{"name": "livepatch", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}, {"name": "fips-updates", "reason": "FIPS cannot be enabled if FIPS Updates has ever been enabled because FIPS Updates installs security patches that aren't officially certified.", "reason_code": "fips-updates-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "n/a", "status_details": "Cannot enable FIPS when FIPS Updates is enabled."}
+        {"available": "no", "blocked_by": [{"name": "livepatch", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}, {"name": "fips-updates", "reason": "FIPS cannot be enabled if FIPS Updates has ever been enabled because FIPS Updates installs security patches that aren't officially certified.", "reason_code": "fips-updates-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "n/a", "status_details": "Cannot enable FIPS when FIPS Updates is enabled.", "warning": null}
         """
         When I run `pro disable <fips-service> --assume-yes` with sudo
         And I run `pro enable <fips-service> --assume-yes --format json --assume-yes` with sudo
@@ -342,7 +341,6 @@ Feature: FIPS enablement in lxd VMs
             """
             Updating package lists
             Installing <fips-name> packages
-            FIPS strongswan-hmac package could not be installed
             <fips-name> enabled
             A reboot is required to complete install
             """
@@ -376,6 +374,8 @@ Feature: FIPS enablement in lxd VMs
         When I reboot the machine
         Then I verify that `openssh-server` installed version matches regexp `fips`
         And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
         When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
         Then I will see the following on stdout:
         """
@@ -520,7 +520,7 @@ Feature: FIPS enablement in lxd VMs
                 """
             And stdout matches regexp:
                 """
-                livepatch +yes                enabled
+                livepatch +yes                (enabled|warning)
                 """
             When  I run `uname -r` as non-root
             Then stdout matches regexp:
diff --git a/features/environment.py b/features/environment.py
index 8c3f685..522a02f 100644
--- a/features/environment.py
+++ b/features/environment.py
@@ -6,6 +6,7 @@ import random
 import re
 import string
 import sys
+import tarfile
 from typing import Dict, List, Optional, Tuple, Union  # noqa: F401
 
 import pycloudlib  # type: ignore  # noqa: F401
@@ -123,8 +124,8 @@ class UAClientBehaveConfig:
         contract_token: Optional[str] = None,
         contract_token_staging: Optional[str] = None,
         contract_token_staging_expired: Optional[str] = None,
-        artifact_dir: Optional[str] = None,
-        install_from: InstallationSource = InstallationSource.DAILY,
+        artifact_dir: str = "artifacts",
+        install_from: InstallationSource = InstallationSource.LOCAL,
         custom_ppa: Optional[str] = None,
         debs_path: Optional[str] = None,
         userdata_file: Optional[str] = None,
@@ -299,6 +300,9 @@ class UAClientBehaveConfig:
                     bool_value = False
                 kwargs[key] = bool_value
 
+        # userdata should override environment variables
+        kwargs.update(config.userdata)
+
         if "install_from" in kwargs:
             kwargs["install_from"] = InstallationSource(kwargs["install_from"])
 
@@ -329,17 +333,17 @@ def before_all(context: Context) -> None:
             print("   - {} = {}".format(key, value))
     context.series_image_name = {}
     context.series_reuse_image = ""
-    context.config = UAClientBehaveConfig.from_environ(context.config)
-    context.config.cloud_manager.manage_ssh_key()
+    context.pro_config = UAClientBehaveConfig.from_environ(context.config)
+    context.pro_config.cloud_manager.manage_ssh_key()
     context.snapshots = {}
     context.machines = {}
 
-    if context.config.reuse_image:
+    if context.pro_config.reuse_image:
         series = lxc_get_property(
-            context.config.reuse_image, property_name="series", image=True
+            context.pro_config.reuse_image, property_name="series", image=True
         )
         machine_type = lxc_get_property(
-            context.config.reuse_image,
+            context.pro_config.reuse_image,
             property_name="machine_type",
             image=True,
         )
@@ -347,26 +351,26 @@ def before_all(context: Context) -> None:
             print("Found machine_type: {vm_type}".format(vm_type=machine_type))
         if series is not None:
             context.series_reuse_image = series
-            context.series_image_name[series] = context.config.reuse_image
+            context.series_image_name[series] = context.pro_config.reuse_image
         else:
             print(" Could not check image series. It will not be used. ")
-            context.config.reuse_image = None
+            context.pro_config.reuse_image = None
 
 
 def _should_skip_tags(context: Context, tags: List) -> str:
     """Return a reason if a feature or scenario should be skipped"""
-    machine_type = getattr(context.config, "machine_type", "")
+    machine_type = getattr(context.pro_config, "machine_type", "")
     machine_types = []
 
     for tag in tags:
         parts = tag.split(".")
-        if parts[0] != "uses":
-            continue  # Only process @uses.* tags for skipping:
-        val = context
-        for idx, attr in enumerate(parts[1:], 1):
+        if parts[0] != "uses" or parts[1] != "config":
+            continue  # Only process @uses.config.* tags for skipping:
+        val = context.pro_config
+        for idx, attr in enumerate(parts[2:], 1):
             val = getattr(val, attr, None)
             if attr == "machine_type":
-                curr_machine_type = ".".join(parts[idx + 1 :])
+                curr_machine_type = ".".join(parts[idx + 2 :])
                 machine_types.append(curr_machine_type)
                 if curr_machine_type == machine_type:
                     return ""
@@ -397,7 +401,7 @@ def before_scenario(context: Context, scenario: Scenario):
         scenario.skip(reason=reason)
         return
 
-    filter_series = context.config.filter_series
+    filter_series = context.pro_config.filter_series
     given_a_series_match = re.match(
         "a `(.*)` machine with ubuntu-advantage-tools installed",
         scenario.steps[0].name,
@@ -431,61 +435,30 @@ def before_scenario(context: Context, scenario: Scenario):
             )
 
 
-FAILURE_FILES = (
-    "/etc/ubuntu-advantage/uaclient.log",
-    "/var/log/cloud-init.log",
-    "/var/log/ubuntu-advantage.log",
-    "/var/log/ubuntu-advantage-daemon.log",
-    "/var/log/ubuntu-advantage-timer.log",
-    "/var/lib/cloud/instance/user-data.txt",
-    "/var/lib/cloud/instance/vendor-data.txt",
-)
-FAILURE_CMDS = {
-    "ua-version": ["pro", "version"],
-    "cloud-init-analyze": ["cloud-init", "analyze", "show"],
-    "cloud-init.status": ["cloud-init", "status", "--long"],
-    "status.yaml": ["pro", "status", "--all", "--format=yaml"],
-    "journal.log": ["journalctl", "-b", "0"],
-    "systemd-analyze-blame": ["systemd-analyze", "blame"],
-    "systemctl-status": ["systemctl", "status"],
-    "systemctl-status-ua-auto-attach": [
-        "systemctl",
-        "status",
-        "ua-auto-attach.service",
-    ],
-    "systemctl-status-ua-reboot-cmds": [
-        "systemctl",
-        "status",
-        "ua-reboot-cmds.service",
-    ],
-    "systemctl-status-ubuntu-advantage": [
-        "systemctl",
-        "status",
-        "ubuntu-advantage.service",
-    ],
-    "systemctl-status-apt-news": [
-        "systemctl",
-        "status",
-        "apt-news.service",
-    ],
-}
-
-
 def after_step(context, step):
     """Collect test artifacts in the event of failure."""
     if step.status == "failed":
-        if context.config.artifact_dir:
-            artifacts_dir = context.config.artifact_dir
-        else:
-            artifacts_dir = "artifacts"
-        artifacts_dir = os.path.join(
-            artifacts_dir,
+        logging.warning("STEP FAILED. Collecting logs.")
+        inner_dir = os.path.join(
+            datetime.datetime.now().strftime("%Y-%m-%dT%H-%M-%S"),
             "{}_{}".format(os.path.basename(step.filename), step.line),
         )
+        new_artifacts_dir = os.path.join(
+            context.pro_config.artifact_dir,
+            inner_dir,
+        )
+        if not os.path.exists(new_artifacts_dir):
+            os.makedirs(new_artifacts_dir)
+
+        latest_link_dir = os.path.join(
+            context.pro_config.artifact_dir, "latest"
+        )
+        if os.path.exists(latest_link_dir):
+            os.unlink(latest_link_dir)
+        os.symlink(inner_dir, latest_link_dir)
+
         if hasattr(context, "process"):
-            if not os.path.exists(artifacts_dir):
-                os.makedirs(artifacts_dir)
-            artifact_file = os.path.join(artifacts_dir, "process.log")
+            artifact_file = os.path.join(new_artifacts_dir, "process.log")
             process = context.process
             with open(artifact_file, "w") as stream:
                 stream.write(
@@ -497,35 +470,28 @@ def after_step(context, step):
                 )
 
         if hasattr(context, "machines") and SUT in context.machines:
-            if not os.path.exists(artifacts_dir):
-                os.makedirs(artifacts_dir)
-            for log_file in FAILURE_FILES:
-                artifact_file = os.path.join(
-                    artifacts_dir, os.path.basename(log_file)
+            try:
+                context.machines[SUT].instance.execute(
+                    ["pro", "collect-logs", "-o", "/tmp/logs.tar.gz"],
+                    use_sudo=True,
                 )
-                logging.info(
-                    "-- pull instance:{} {}".format(log_file, artifact_file)
+                context.machines[SUT].instance.execute(
+                    ["chmod", "666", "/tmp/logs.tar.gz"], use_sudo=True
                 )
-                try:
-                    result = context.machines[SUT].instance.execute(
-                        ["cat", log_file], use_sudo=True
-                    )
-                    content = result.stdout if result.ok else ""
-                except RuntimeError:
-                    content = ""
-                with open(artifact_file, "w") as stream:
-                    stream.write(content)
-            for artifact_file, cmd in FAILURE_CMDS.items():
-                result = context.machines[SUT].instance.execute(
-                    cmd, use_sudo=True
+                dest = os.path.join(new_artifacts_dir, "logs.tar.gz")
+                context.machines[SUT].instance.pull_file(
+                    "/tmp/logs.tar.gz", dest
                 )
-                artifact_file = os.path.join(artifacts_dir, artifact_file)
-                with open(artifact_file, "w") as stream:
-                    stream.write(result.stdout)
+                with tarfile.open(dest) as logs_tarfile:
+                    logs_tarfile.extractall(new_artifacts_dir)
+                logging.warning("Done collecting logs.")
+            except Exception as e:
+                logging.error(str(e))
+                logging.warning("Failed to collect logs")
 
 
 def after_all(context):
-    if context.config.image_clean:
+    if context.pro_config.image_clean:
         for key, image in context.series_image_name.items():
             if key == context.series_reuse_image:
                 logging.info(
@@ -533,11 +499,11 @@ def after_all(context):
                     context.series_image_name[key],
                 )
             else:
-                context.config.cloud_api.delete_image(image)
+                context.pro_config.cloud_api.delete_image(image)
 
-    if context.config.destroy_instances:
+    if context.pro_config.destroy_instances:
         try:
-            key_pair = context.config.cloud_manager.api.key_pair
+            key_pair = context.pro_config.cloud_manager.api.key_pair
             os.remove(key_pair.private_key_path)
             os.remove(key_pair.public_key_path)
         except Exception as e:
@@ -547,7 +513,7 @@ def after_all(context):
 
     if "builder" in context.snapshots:
         try:
-            context.config.cloud_manager.api.delete_image(
+            context.pro_config.cloud_manager.api.delete_image(
                 context.snapshots["builder"]
             )
         except RuntimeError as e:
diff --git a/features/fix.feature b/features/fix.feature
index f62946f..cc10066 100644
--- a/features/fix.feature
+++ b/features/fix.feature
@@ -39,64 +39,158 @@ Feature: Ua fix command behaviour
         When I run `apt-get update` with sudo
         When I verify that running `pro fix CVE-1800-123456` `as non-root` exits `1`
         Then I will see the following on stderr:
-            """
-            Error: CVE-1800-123456 not found.
-            """
+        """
+        Error: CVE-1800-123456 not found.
+        """
         When I verify that running `pro fix USN-12345-12` `as non-root` exits `1`
         Then I will see the following on stderr:
-            """
-            Error: USN-12345-12 not found.
-            """
+        """
+        Error: USN-12345-12 not found.
+        """
         When I verify that running `pro fix CVE-12345678-12` `as non-root` exits `1`
         Then I will see the following on stderr:
-            """
-            Error: issue "CVE-12345678-12" is not recognized.
-            Usage: "pro fix CVE-yyyy-nnnn" or "pro fix USN-nnnn"
-            """
+        """
+        Error: issue "CVE-12345678-12" is not recognized.
+        Usage: "pro fix CVE-yyyy-nnnn" or "pro fix USN-nnnn"
+        """
         When I verify that running `pro fix USN-12345678-12` `as non-root` exits `1`
         Then I will see the following on stderr:
-            """
-            Error: issue "USN-12345678-12" is not recognized.
-            Usage: "pro fix CVE-yyyy-nnnn" or "pro fix USN-nnnn"
-            """
+        """
+        Error: issue "USN-12345678-12" is not recognized.
+        Usage: "pro fix CVE-yyyy-nnnn" or "pro fix USN-nnnn"
+        """
         When I run `apt install -y libawl-php=0.60-1 --allow-downgrades` with sudo
         And I run `pro fix USN-4539-1` with sudo
         Then stdout matches regexp:
-            """
-            USN-4539-1: AWL vulnerability
-            Found CVEs:
-             - https://ubuntu.com/security/CVE-2020-11728
+        """
+        USN-4539-1: AWL vulnerability
+        Found CVEs:
+         - https://ubuntu.com/security/CVE-2020-11728
 
-            1 affected source package is installed: awl
-            \(1/1\) awl:
-            A fix is available in Ubuntu standard updates.
-            .*\{ apt update && apt install --only-upgrade -y libawl-php \}.*
+        Fixing requested USN-4539-1
+        1 affected source package is installed: awl
+        \(1/1\) awl:
+        A fix is available in Ubuntu standard updates.
+        .*\{ apt update && apt install --only-upgrade -y libawl-php \}.*
 
-            .*✔.* USN-4539-1 is resolved.
-            """
+        .*✔.* USN-4539-1 is resolved.
+        """
         When I run `pro fix CVE-2020-28196` as non-root
         Then stdout matches regexp:
-            """
-            CVE-2020-28196: Kerberos vulnerability
-             - https://ubuntu.com/security/CVE-2020-28196
+        """
+        CVE-2020-28196: Kerberos vulnerability
+         - https://ubuntu.com/security/CVE-2020-28196
 
-            1 affected source package is installed: krb5
-            \(1/1\) krb5:
-            A fix is available in Ubuntu standard updates.
-            The update is already installed.
+        1 affected source package is installed: krb5
+        \(1/1\) krb5:
+        A fix is available in Ubuntu standard updates.
+        The update is already installed.
 
-            .*✔.* CVE-2020-28196 is resolved.
-            """
+        .*✔.* CVE-2020-28196 is resolved.
+        """
         When I run `pro fix CVE-2022-24959` as non-root
         Then stdout matches regexp:
-            """
-            CVE-2022-24959: Linux kernel vulnerabilities
-             - https://ubuntu.com/security/CVE-2022-24959
+        """
+        CVE-2022-24959: Linux kernel vulnerabilities
+         - https://ubuntu.com/security/CVE-2022-24959
 
-            No affected source packages are installed.
+        No affected source packages are installed.
 
-            .*✔.* CVE-2022-24959 does not affect your system.
-            """
+        .*✔.* CVE-2022-24959 does not affect your system.
+        """
+        When I run `apt install -y rsync=3.1.3-8 --allow-downgrades` with sudo
+        And I run `apt install -y zlib1g=1:1.2.11.dfsg-2ubuntu1 --allow-downgrades` with sudo
+        And I run `pro fix USN-5573-1` with sudo
+        Then stdout matches regexp:
+        """
+        USN-5573-1: rsync vulnerability
+        Found CVEs:
+         - https://ubuntu.com/security/CVE-2022-37434
+
+        Fixing requested USN-5573-1
+        1 affected source package is installed: rsync
+        \(1/1\) rsync:
+        A fix is available in Ubuntu standard updates.
+        .*\{ apt update && apt install --only-upgrade -y rsync \}.*
+
+        .*✔.* USN-5573-1 is resolved.
+
+        Found related USNs:
+        - USN-5570-1
+        - USN-5570-2
+
+        Fixing related USNs:
+        - USN-5570-1
+        No affected source packages are installed.
+
+        .*✔.* USN-5570-1 does not affect your system.
+
+        - USN-5570-2
+        1 affected source package is installed: zlib
+        \(1/1\) zlib:
+        A fix is available in Ubuntu standard updates.
+        .*\{ apt update && apt install --only-upgrade -y zlib1g \}.*
+
+        .*✔.* USN-5570-2 is resolved.
+
+        Summary:
+        .*✔.* USN-5573-1 \[requested\] is resolved.
+        .*✔.* USN-5570-1 \[related\] does not affect your system.
+        .*✔.* USN-5570-2 \[related\] is resolved.
+        """
+        When I run `pro fix USN-5573-1` with sudo
+        Then stdout matches regexp:
+        """
+        USN-5573-1: rsync vulnerability
+        Found CVEs:
+         - https://ubuntu.com/security/CVE-2022-37434
+
+        Fixing requested USN-5573-1
+        1 affected source package is installed: rsync
+        \(1/1\) rsync:
+        A fix is available in Ubuntu standard updates.
+        The update is already installed.
+
+        .*✔.* USN-5573-1 is resolved.
+
+        Found related USNs:
+        - USN-5570-1
+        - USN-5570-2
+
+        Fixing related USNs:
+        - USN-5570-1
+        No affected source packages are installed.
+
+        .*✔.* USN-5570-1 does not affect your system.
+
+        - USN-5570-2
+        1 affected source package is installed: zlib
+        \(1/1\) zlib:
+        A fix is available in Ubuntu standard updates.
+        The update is already installed.
+
+        .*✔.* USN-5570-2 is resolved.
+
+        Summary:
+        .*✔.* USN-5573-1 \[requested\] is resolved.
+        .*✔.* USN-5570-1 \[related\] does not affect your system.
+        .*✔.* USN-5570-2 \[related\] is resolved.
+        """
+        When I run `pro fix USN-5573-1 --no-related` with sudo
+        Then stdout matches regexp:
+        """
+        USN-5573-1: rsync vulnerability
+        Found CVEs:
+         - https://ubuntu.com/security/CVE-2022-37434
+
+        Fixing requested USN-5573-1
+        1 affected source package is installed: rsync
+        \(1/1\) rsync:
+        A fix is available in Ubuntu standard updates.
+        The update is already installed.
+
+        .*✔.* USN-5573-1 is resolved.
+        """
 
         Examples: ubuntu release details
            | release |
@@ -107,22 +201,30 @@ Feature: Ua fix command behaviour
     @uses.config.machine_type.lxd.container
     Scenario Outline: Fix command on an unattached machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I verify that running `pro fix CVE-1800-123456` `as non-root` exits `1`
+        Then I will see the following on stderr:
+        """
+        Error: CVE-1800-123456 not found.
+        """
+        When I verify that running `pro fix USN-12345-12` `as non-root` exits `1`
+        Then I will see the following on stderr:
+        """
+        Error: USN-12345-12 not found.
+        """
         When I run `apt-get update` with sudo
         When I run `apt install -y libawl-php` with sudo
         And I reboot the machine
-        And I verify that running `pro fix USN-4539-1` `as non-root` exits `1`
+        And I run `pro fix USN-4539-1` as non-root
         Then stdout matches regexp:
         """
         USN-4539-1: AWL vulnerability
         Found CVEs:
          - https://ubuntu.com/security/CVE-2020-11728
 
-        1 affected source package is installed: awl
-        \(1/1\) awl:
-        Ubuntu security engineers are investigating this issue.
+        Fixing requested USN-4539-1
+        No affected source packages are installed.
 
-        1 package is still affected: awl
-        .*✘.* USN-4539-1 is not resolved.
+        .*✔.* USN-4539-1 does not affect your system.
         """
         When I run `pro fix CVE-2020-15180` as non-root
         Then stdout matches regexp:
@@ -192,6 +294,7 @@ Feature: Ua fix command behaviour
          - https://ubuntu.com/security/CVE-2021-22946
          - https://ubuntu.com/security/CVE-2021-22947
 
+        Fixing requested USN-5079-2
         1 affected source package is installed: curl
         \(1/1\) curl:
         A fix is available in Ubuntu Pro: ESM Infra.
@@ -207,6 +310,19 @@ Feature: Ua fix command behaviour
         .*\{ apt update && apt install --only-upgrade -y curl libcurl3-gnutls \}.*
 
         .*✔.* USN-5079-2 is resolved.
+
+        Found related USNs:
+        - USN-5079-1
+
+        Fixing related USNs:
+        - USN-5079-1
+        No affected source packages are installed.
+
+        .*✔.* USN-5079-1 does not affect your system.
+
+        Summary:
+        .*✔.* USN-5079-2 \[requested\] is resolved.
+        .*✔.* USN-5079-1 \[related\] does not affect your system.
         """
         When I fix `USN-5079-2` by attaching to a subscription with `contract_token_staging_expired`
         Then stdout matches regexp
@@ -216,6 +332,7 @@ Feature: Ua fix command behaviour
          - https://ubuntu.com/security/CVE-2021-22946
          - https://ubuntu.com/security/CVE-2021-22947
 
+        Fixing requested USN-5079-2
         1 affected source package is installed: curl
         \(1/1\) curl:
         A fix is available in Ubuntu Pro: ESM Infra.
@@ -240,6 +357,7 @@ Feature: Ua fix command behaviour
          - https://ubuntu.com/security/CVE-2021-22946
          - https://ubuntu.com/security/CVE-2021-22947
 
+        Fixing requested USN-5079-2
         1 affected source package is installed: curl
         \(1/1\) curl:
         A fix is available in Ubuntu Pro: ESM Infra.
@@ -259,6 +377,19 @@ Feature: Ua fix command behaviour
         .*\{ apt update && apt install --only-upgrade -y curl libcurl3-gnutls \}.*
 
         .*✔.* USN-5079-2 is resolved.
+
+        Found related USNs:
+        - USN-5079-1
+
+        Fixing related USNs:
+        - USN-5079-1
+        No affected source packages are installed.
+
+        .*✔.* USN-5079-1 does not affect your system.
+
+        Summary:
+        .*✔.* USN-5079-2 \[requested\] is resolved.
+        .*✔.* USN-5079-1 \[related\] does not affect your system.
         """
         When I verify that running `pro fix USN-5051-2` `with sudo` exits `2`
         Then stdout matches regexp:
@@ -267,6 +398,7 @@ Feature: Ua fix command behaviour
         Found CVEs:
          - https://ubuntu.com/security/CVE-2021-3712
 
+        Fixing requested USN-5051-2
         1 affected source package is installed: openssl
         \(1/1\) openssl:
         A fix is available in Ubuntu Pro: ESM Infra.
@@ -276,6 +408,8 @@ Feature: Ua fix command behaviour
         .*✘.* USN-5051-2 is not resolved.
         """
         When I run `pro disable esm-infra` with sudo
+        # Allow esm-cache to be populated
+        And I run `sleep 5` as non-root
         And I run `apt-get install gzip -y` with sudo
         And I run `pro fix USN-5378-4 --dry-run` as non-root
         Then stdout matches regexp:
@@ -286,17 +420,53 @@ Feature: Ua fix command behaviour
         Found CVEs:
          - https://ubuntu.com/security/CVE-2022-1271
 
-        2 affected source packages are installed: gzip, xz-utils
-        \(1/2, 2/2\) gzip, xz-utils:
+        Fixing requested USN-5378-4
+        1 affected source package is installed: gzip
+        \(1/1\) gzip:
         A fix is available in Ubuntu Pro: ESM Infra.
 
         .*Ubuntu Pro service: esm-infra is not enabled.
         To proceed with the fix, a prompt would ask permission to automatically enable
         this service.
         \{ pro enable esm-infra \}.*
-        .*\{ apt update && apt install --only-upgrade -y gzip liblzma5 xz-utils \}.*
+        .*\{ apt update && apt install --only-upgrade -y gzip \}.*
 
         .*✔.* USN-5378-4 is resolved.
+
+        Found related USNs:
+        - USN-5378-1
+        - USN-5378-2
+        - USN-5378-3
+
+        Fixing related USNs:
+        - USN-5378-1
+        No affected source packages are installed.
+
+        .*✔.* USN-5378-1 does not affect your system.
+
+        - USN-5378-2
+        No affected source packages are installed.
+
+        .*✔.* USN-5378-2 does not affect your system.
+
+        - USN-5378-3
+        1 affected source package is installed: xz-utils
+        \(1/1\) xz-utils:
+        A fix is available in Ubuntu Pro: ESM Infra.
+
+        .*Ubuntu Pro service: esm-infra is not enabled.
+        To proceed with the fix, a prompt would ask permission to automatically enable
+        this service.
+        \{ pro enable esm-infra \}.*
+        .*\{ apt update && apt install --only-upgrade -y liblzma5 xz-utils \}.*
+
+        .*✔.* USN-5378-3 is resolved.
+
+        Summary:
+        .*✔.* USN-5378-4 \[requested\] is resolved.
+        .*✔.* USN-5378-1 \[related\] does not affect your system.
+        .*✔.* USN-5378-2 \[related\] does not affect your system.
+        .*✔.* USN-5378-3 \[related\] is resolved.
         """
         When I run `pro fix USN-5378-4` `with sudo` and stdin `E`
         Then stdout matches regexp:
@@ -305,8 +475,9 @@ Feature: Ua fix command behaviour
         Found CVEs:
          - https://ubuntu.com/security/CVE-2022-1271
 
-        2 affected source packages are installed: gzip, xz-utils
-        \(1/2, 2/2\) gzip, xz-utils:
+        Fixing requested USN-5378-4
+        1 affected source package is installed: gzip
+        \(1/1\) gzip:
         A fix is available in Ubuntu Pro: ESM Infra.
         The update is not installed because this system does not have
         esm-infra enabled.
@@ -316,9 +487,59 @@ Feature: Ua fix command behaviour
         One moment, checking your subscription first
         Updating package lists
         Ubuntu Pro: ESM Infra enabled
-        .*\{ apt update && apt install --only-upgrade -y gzip liblzma5 xz-utils \}.*
+        .*\{ apt update && apt install --only-upgrade -y gzip \}.*
 
         .*✔.* USN-5378-4 is resolved.
+
+        Found related USNs:
+        - USN-5378-1
+        - USN-5378-2
+        - USN-5378-3
+
+        Fixing related USNs:
+        - USN-5378-1
+        No affected source packages are installed.
+
+        .*✔.* USN-5378-1 does not affect your system.
+
+        - USN-5378-2
+        No affected source packages are installed.
+
+        .*✔.* USN-5378-2 does not affect your system.
+
+        - USN-5378-3
+        1 affected source package is installed: xz-utils
+        \(1/1\) xz-utils:
+        A fix is available in Ubuntu Pro: ESM Infra.
+        .*\{ apt update && apt install --only-upgrade -y liblzma5 xz-utils \}.*
+
+        .*✔.* USN-5378-3 is resolved.
+
+        Summary:
+        .*✔.* USN-5378-4 \[requested\] is resolved.
+        .*✔.* USN-5378-1 \[related\] does not affect your system.
+        .*✔.* USN-5378-2 \[related\] does not affect your system.
+        .*✔.* USN-5378-3 \[related\] is resolved.
+        """
+        When I run `pro detach --assume-yes` with sudo
+        And I run `sed -i "/xenial-updates/d" /etc/apt/sources.list` with sudo
+        And I run `sed -i "/xenial-security/d" /etc/apt/sources.list` with sudo
+        And I run `apt-get update` with sudo
+        And I run `apt-get install squid -y` with sudo
+        And I verify that running `pro fix CVE-2020-25097` `as non-root` exits `1`
+        Then stdout matches regexp:
+        """
+        CVE-2020-25097: Squid vulnerabilities
+         - https://ubuntu.com/security/CVE-2020-25097
+
+        1 affected source package is installed: squid3
+        \(1/1\) squid3:
+        A fix is available in Ubuntu standard updates.
+        - Cannot install package squid version 3.5.12-1ubuntu7.16
+        - Cannot install package squid-common version 3.5.12-1ubuntu7.16
+
+        1 package is still affected: squid3
+        .*✘.* CVE-2020-25097 is not resolved
         """
 
         Examples: ubuntu release details
@@ -353,7 +574,7 @@ Feature: Ua fix command behaviour
         Usage: "pro fix CVE-yyyy-nnnn" or "pro fix USN-nnnn"
         """
         When I run `apt install -y libawl-php` with sudo
-        And I verify that running `pro fix USN-4539-1 --dry-run` `as non-root` exits `1`
+        And I run `pro fix USN-4539-1 --dry-run` as non-root
         Then stdout matches regexp:
         """
         .*WARNING: The option --dry-run is being used.
@@ -362,26 +583,22 @@ Feature: Ua fix command behaviour
         Found CVEs:
          - https://ubuntu.com/security/CVE-2020-11728
 
-        1 affected source package is installed: awl
-        \(1/1\) awl:
-        Ubuntu security engineers are investigating this issue.
+        Fixing requested USN-4539-1
+        No affected source packages are installed.
 
-        1 package is still affected: awl
-        .*✘.* USN-4539-1 is not resolved.
+        .*✔.* USN-4539-1 does not affect your system.
         """
-        When I verify that running `pro fix USN-4539-1` `as non-root` exits `1`
+        When I run `pro fix USN-4539-1` as non-root
         Then stdout matches regexp:
         """
         USN-4539-1: AWL vulnerability
         Found CVEs:
          - https://ubuntu.com/security/CVE-2020-11728
 
-        1 affected source package is installed: awl
-        \(1/1\) awl:
-        Ubuntu security engineers are investigating this issue.
+        Fixing requested USN-4539-1
+        No affected source packages are installed.
 
-        1 package is still affected: awl
-        .*✘.* USN-4539-1 is not resolved.
+        .*✔.* USN-4539-1 does not affect your system.
         """
         When I run `pro fix CVE-2020-28196` as non-root
         Then stdout matches regexp:
@@ -462,6 +679,7 @@ Feature: Ua fix command behaviour
         Found Launchpad bugs:
          - https://launchpad.net/bugs/1834494
 
+        Fixing requested USN-4038-3
         1 affected source package is installed: bzip2
         \(1/1\) bzip2:
         A fix is available in Ubuntu standard updates.
diff --git a/features/i8n.feature b/features/i8n.feature
new file mode 100644
index 0000000..f87f994
--- /dev/null
+++ b/features/i8n.feature
@@ -0,0 +1,128 @@
+Feature: Pro supports multiple languages
+
+    @series.all
+    @uses.config.machine_type.lxd.container
+    @uses.config.contract_token
+    Scenario Outline: Pro client's commands run successfully
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        ## Change the locale
+        When I run `apt install language-pack-fr -y` with sudo
+        And I run `update-locale LANG=fr_FR.UTF-8` with sudo
+        And I reboot the machine
+        And I run `cat /etc/default/locale` as non-root
+        Then stdout matches regexp:
+        """
+        LANG=fr_FR.UTF-8
+        """
+        #Attach invalid token
+        When I verify that running `pro attach INVALID_TOKEN` `with sudo` exits `1`
+        Then stderr matches regexp:
+        """
+        Invalid token. See https://ubuntu.com/pro
+        """
+        When I run `lscpu` as non-root
+        Then stdout does not match regexp:
+        """
+        Architecture:
+        """
+        When I run `apt update` with sudo
+        Then stdout does not match regexp:
+        """
+        Hit
+        """
+        When I verify that running `pro attach INVALID_TOKEN` `as non-root` exits `1`
+        Then I will see the following on stderr:
+         """
+         This command must be run as root (try using sudo).
+         """
+        When I verify that running `pro attach invalid-token --format json` `with sudo` exits `1`
+        Then stdout is a json matching the `ua_operation` schema
+        And I will see the following on stdout:
+        """
+        {"_schema_version": "0.1", "errors": [{"message": "Invalid token. See https://ubuntu.com/pro", "message_code": "attach-invalid-token", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+        """
+        When I attach `contract_token` with sudo
+        # Refresh command
+        When I run `pro refresh` with sudo
+        Then I will see the following on stdout:
+        """
+        Successfully processed your pro configuration.
+        Successfully refreshed your subscription.
+        Successfully updated Ubuntu Pro related APT and MOTD messages.
+        """
+    # auto-attach command
+        When I verify that running `pro auto-attach` `with sudo` exits `2`
+        Then stderr matches regexp:
+        """
+        This machine is already attached to 'UA Client Test'
+        To use a different subscription first run: sudo pro detach.
+            """
+        # status command
+        When I run `pro status --format json` as non-root
+        Then stdout is a json matching the `ua_status` schema
+        When I run `pro status --format yaml` as non-root
+        Then stdout is a yaml matching the `ua_status` schema
+        When I create the file `/tmp/machine-token-overlay.json` with the following:
+        """
+        {
+            "machineTokenInfo": {
+                "contractInfo": {
+                    "effectiveTo": null
+                }
+            }
+        }
+        """
+        And I append the following on uaclient config:
+        """
+        features:
+          machine_token_overlay: "/tmp/machine-token-overlay.json"
+        """
+        And I run `pro status` with sudo
+        Then stdout contains substring:
+        """
+        Valid until: Unknown/Expired
+        """
+        # api command invalid endpoint
+        When I verify that running `pro api invalid.endpoint` `with sudo` exits `1`
+        Then stdout matches regexp:
+        """
+        {\"_schema_version\": \"v1\", \"data\": {\"meta\": {\"environment_vars\": \[]}}, \"errors\": \[{\"code\": \"api\-invalid\-endpoint", \"meta\": {}, \"title\": \"'invalid\.endpoint' is not a valid endpoint\"}], \"result\": \"failure\", \"version\": \".*\", \"warnings\": \[]}
+        """
+        When I verify that running `pro api u.pro.version.v1 --args extra=arg` `with sudo` exits `1`
+        Then stdout matches regexp:
+        """
+        {\"_schema_version\": \"v1\", \"data\": {\"meta\": {\"environment_vars\": \[]}}, \"errors\": \[{\"code\": \"api\-no\-argument\-for\-endpoint\", \"meta\": {}, \"title\": \"u\.pro\.version\.v1 accepts no arguments\"}], \"result\": \"failure\", \"version\": \".*\", \"warnings\": \[]}
+        """
+        # api command valid endpoint
+        When I run `pro api u.pro.version.v1` with sudo
+        Then stdout matches regexp:
+        """
+        {\"_schema_version\": \"v1\", \"data\": {\"attributes\": {\"installed_version\": \".*\"}, \"meta\": {\"environment_vars\": \[]}, \"type\": \"Version\"}, \"errors\": \[], \"result\": \"success\", \"version\": \".*\", \"warnings\": \[]}
+        """
+        When I run `UA_LOG_FILE=/tmp/some_file OTHER_ENVVAR=not_there pro api u.pro.version.v1` with sudo
+        Then stdout matches regexp:
+        """
+        {\"_schema_version\": \"v1\", \"data\": {\"attributes\": {\"installed_version\": \".*\"}, \"meta\": {\"environment_vars\": \[{\"name\": \"UA_LOG_FILE\", \"value\": \"\/tmp\/some_file\"}]}, \"type\": \"Version\"}, \"errors\": \[], \"result\": \"success\", \"version\": \".*\", \"warnings\": \[]}
+        """
+        When I run `ua api u.pro.attach.auto.should_auto_attach.v1` with sudo
+        Then stdout matches regexp:
+        """
+        {"_schema_version": "v1", "data": {"attributes": {"should_auto_attach": false}, "meta": {"environment_vars": \[\]}, "type": "ShouldAutoAttach"}, "errors": \[\], "result": "success", "version": ".*", "warnings": \[\]}
+        """
+        # version
+        When I run `pro version` as non-root
+        Then I will see the uaclient version on stdout
+        When I run `pro version` with sudo
+        Then I will see the uaclient version on stdout
+        When I run `pro --version` as non-root
+        Then I will see the uaclient version on stdout
+        When I run `pro --version` with sudo
+        Then I will see the uaclient version on stdout
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | xenial  |
+           | jammy   |
+           | kinetic |
+           | lunar   |
diff --git a/features/livepatch.feature b/features/livepatch.feature
index 31641b7..724fa1a 100644
--- a/features/livepatch.feature
+++ b/features/livepatch.feature
@@ -5,6 +5,10 @@ Feature: Livepatch
     @uses.config.machine_type.lxd.vm
     Scenario Outline: Attached livepatch status shows warning when on unsupported kernel
         Given a `<release>` machine with ubuntu-advantage-tools installed
+        Then I verify that no files exist matching `/home/ubuntu/.cache/ubuntu-pro/livepatch-kernel-support-cache.json`
+        When I run `pro status` as non-root
+        Then I verify that files exist matching `/home/ubuntu/.cache/ubuntu-pro/livepatch-kernel-support-cache.json`
+        Then I verify that no files exist matching `/run/ubuntu-advantage/livepatch-kernel-support-cache.json`
         When I run `pro status` with sudo
         Then stdout matches regexp:
         """
@@ -14,6 +18,7 @@ Feature: Livepatch
         """
         Supported livepatch kernels are listed here: https://ubuntu.com/security/livepatch/docs/kernels
         """
+        Then I verify that files exist matching `/run/ubuntu-advantage/livepatch-kernel-support-cache.json`
         When I attach `contract_token` with sudo
         When I run `pro status` with sudo
         Then stdout matches regexp:
@@ -23,7 +28,7 @@ Feature: Livepatch
         Then stdout matches regexp:
         """
         NOTICES
-        The current kernel \(5.4.0-(\d+)-kvm, amd64\) is not supported by livepatch.
+        The current kernel \(5.4.0-(\d+)-kvm, x86_64\) is not supported by livepatch.
         Supported kernels are listed here: https://ubuntu.com/security/livepatch/docs/kernels
         Either switch to a supported kernel or `pro disable livepatch` to dismiss this warning.
 
@@ -37,7 +42,7 @@ Feature: Livepatch
         Then stdout does not match regexp:
         """
         NOTICES
-        The current kernel \(5.4.0-(\d+)-kvm, amd64\) is not supported by livepatch.
+        The current kernel \(5.4.0-(\d+)-kvm, x86_64\) is not supported by livepatch.
         Supported kernels are listed here: https://ubuntu.com/security/livepatch/docs/kernels
         Either switch to a supported kernel or `pro disable livepatch` to dismiss this warning.
 
diff --git a/features/logs.feature b/features/logs.feature
index 80924af..b64facd 100644
--- a/features/logs.feature
+++ b/features/logs.feature
@@ -28,3 +28,62 @@ Feature: Logs in Json Array Formatter
           | kinetic |
           | jammy   |
           | lunar   |
+
+    @series.all
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Non-root user and root user log files are different
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        # Confirm user log file does not exist 
+        When I verify `/var/log/ubuntu-advantage.log` is empty
+        Then I verify that no files exist matching `/home/ubuntu/.cache/ubuntu-pro/ubuntu-pro.log`
+        When I verify that running `pro status` `as non-root` exits `0`
+        Then I verify that files exist matching `/home/ubuntu/.cache/ubuntu-pro/ubuntu-pro.log`
+        When I verify `/var/log/ubuntu-advantage.log` is empty
+        And I run `cat /home/ubuntu/.cache/ubuntu-pro/ubuntu-pro.log` as non-root
+        Then stdout contains substring
+        """
+        Executed with sys.argv: ['/usr/bin/pro', 'status']
+        """
+        When I run `truncate -s 0 /home/ubuntu/.cache/ubuntu-pro/ubuntu-pro.log` with sudo
+        And I attach `contract_token` with sudo
+        And I verify `/home/ubuntu/.cache/ubuntu-pro/ubuntu-pro.log` is empty
+        And I run `cat /var/log/ubuntu-advantage.log` as non-root
+        Then stdout contains substring
+        """
+        Executed with sys.argv: ['/usr/bin/pro', 'attach'
+        """
+        Examples: ubuntu release
+          | release |
+          | xenial  |
+          | bionic  |
+          | focal   |
+          | kinetic |
+          | jammy   |
+          | lunar   |
+
+    @series.all
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Non-root user log files included in collect logs
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When i verify that running `pro status` `with sudo` exits `0`
+        And I verify that running `pro collect-logs` `with sudo` exits `0`
+        And I run `tar -tf ua_logs.tar.gz` as non-root
+        Then stdout does not contain substring 
+        """
+        user0.log
+        """
+        When i verify that running `pro status` `as non-root` exits `0`
+        And I verify that running `pro collect-logs` `with sudo` exits `0`
+        And I run `tar -tf ua_logs.tar.gz` as non-root
+        Then stdout contains substring 
+        """
+        user0.log
+        """
+        Examples: ubuntu release
+          | release |
+          | xenial  |
+          | bionic  |
+          | focal   |
+          | kinetic |
+          | jammy   |
+          | lunar   |
diff --git a/features/proxy_config.feature b/features/proxy_config.feature
index 733c4ce..dd9d6df 100644
--- a/features/proxy_config.feature
+++ b/features/proxy_config.feature
@@ -582,7 +582,7 @@ Feature: Proxy configuration
         When I create the file `/var/lib/ubuntu-advantage/user-config.json` with the following:
         """
         {
-          "ua_apt_http_proxy": "http://someuser:somepassword@$behave_var{machine-ip proxy}:3128"
+          "ua_apt_http_proxy": "http://someuser:somepassword@$behave_var{machine-ip proxy}:3128",
           "ua_apt_https_proxy": "http://someuser:somepassword@$behave_var{machine-ip proxy}:3128"
         }
         """
@@ -1133,7 +1133,7 @@ Feature: Proxy configuration
         When I create the file `/var/lib/ubuntu-advantage/user-config.json` with the following:
         """
         {
-          "apt_http_proxy": "http://$behave_var{machine-ip proxy}:3128"
+          "apt_http_proxy": "http://$behave_var{machine-ip proxy}:3128",
           "apt_https_proxy": "http://$behave_var{machine-ip proxy}:3128"
         }
         """
@@ -1206,7 +1206,8 @@ Feature: Proxy configuration
         esm-apps     +yes      +enabled      +Expanded Security Maintenance for Applications
         esm-infra     +yes      +enabled      +Expanded Security Maintenance for Infrastructure
         """
-        When I run `pro enable realtime-kernel --beta` `with sudo` and stdin `y`
+        When I run `pro disable livepatch --assume-yes` with sudo
+        When I run `pro enable realtime-kernel` `with sudo` and stdin `y`
         Then stdout matches regexp:
         """
         Installing Real-time kernel packages
diff --git a/features/realtime_kernel.feature b/features/realtime_kernel.feature
index ef0cfc0..78972a2 100644
--- a/features/realtime_kernel.feature
+++ b/features/realtime_kernel.feature
@@ -50,65 +50,298 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
         When I attach `contract_token` with sudo and options `--no-auto-enable`
         Then I verify that running `pro enable realtime-kernel` `as non-root` exits `1`
         And I will see the following on stderr:
-            """
-            This command must be run as root (try using sudo).
-            """
+        """
+        This command must be run as root (try using sudo).
+        """
         When I run `pro enable realtime-kernel` `with sudo` and stdin `y`
         Then stdout matches regexp:
-            """
-            One moment, checking your subscription first
-            The Real-time kernel is an Ubuntu kernel with PREEMPT_RT patches integrated.
+        """
+        One moment, checking your subscription first
+        The Real-time kernel is an Ubuntu kernel with PREEMPT_RT patches integrated.
 
-            .*This will change your kernel. To revert to your original kernel, you will need
-            to make the change manually..*
+        .*This will change your kernel. To revert to your original kernel, you will need
+        to make the change manually..*
 
-            Do you want to continue\? \[ default = Yes \]: \(Y/n\) Updating package lists
-            Installing Real-time kernel packages
-            Real-time kernel enabled
-            A reboot is required to complete install.
-            """
+        Do you want to continue\? \[ default = Yes \]: \(Y/n\) Updating package lists
+        Installing Real-time kernel packages
+        Real-time kernel enabled
+        A reboot is required to complete install.
+        """
         When I run `apt-cache policy ubuntu-realtime` as non-root
         Then stdout does not match regexp:
-            """
-            .*Installed: \(none\)
-            """
+        """
+        .*Installed: \(none\)
+        """
         And stdout matches regexp:
-            """
-            \s* 500 https://esm.ubuntu.com/realtime/ubuntu <release>/main amd64 Packages
-            """
+        """
+        \s* 500 https://esm.ubuntu.com/realtime/ubuntu <release>/main amd64 Packages
+        """
         When I verify that running `pro enable realtime-kernel` `with sudo` exits `1`
         Then stdout matches regexp
-            """
-            One moment, checking your subscription first
-            Real-time kernel is already enabled.
-            See: sudo pro status
-            """
+        """
+        One moment, checking your subscription first
+        Real-time kernel is already enabled.
+        See: sudo pro status
+        """
         When I reboot the machine
         When I run `uname -r` as non-root
         Then stdout matches regexp:
-            """
-            realtime
-            """
+        """
+        realtime
+        """
         When I run `pro disable realtime-kernel` `with sudo` and stdin `y`
         Then stdout matches regexp:
-            """
-            This will remove the boot order preference for the Real-time kernel and
-            disable updates to the Real-time kernel.
+        """
+        This will remove the boot order preference for the Real-time kernel and
+        disable updates to the Real-time kernel.
 
-            This will NOT fully remove the kernel from your system.
+        This will NOT fully remove the kernel from your system.
 
-            After this operation is complete you must:
-              - Ensure a different kernel is installed and configured to boot
-              - Reboot into that kernel
-              - Fully remove the realtime kernel packages from your system
-                  - This might look something like `apt remove linux\*realtime`,
-                    but you must ensure this is correct before running it.
-            """
+        After this operation is complete you must:
+          - Ensure a different kernel is installed and configured to boot
+          - Reboot into that kernel
+          - Fully remove the realtime kernel packages from your system
+              - This might look something like `apt remove linux\*realtime`,
+                but you must ensure this is correct before running it.
+        """
         When I run `apt-cache policy ubuntu-realtime` as non-root
         Then stdout contains substring
-            """
-            Installed: (none)
-            """
+        """
+        Installed: (none)
+        """
+        When I verify that running `pro enable realtime-kernel --access-only --variant nvidia-tegra` `with sudo` exits `1`
+        Then I will see the following on stderr:
+        """
+        Error: Cannot use --access-only together with --variant.
+        """
+        When I run `pro status` as non-root
+        Then stdout does not match regexp:
+        """
+         \* Service has variants
+        """
+        When I run `pro status --all` as non-root
+        Then stdout does not match regexp:
+        """
+        realtime-kernel  yes +disabled   +Ubuntu kernel with PREEMPT_RT patches integrated
+        ├ generic        yes +disabled  +Generic version of the RT kernel \(default\)
+        ├ intel-iotg     yes +disabled  +RT kernel optimized for Intel IOTG platform
+        └ nvidia-tegra   yes +disabled   +RT kernel optimized for NVIDIA Tegra platform
+        """
+        And stdout matches regexp:
+        """
+        realtime-kernel  yes +disabled   +Ubuntu kernel with PREEMPT_RT patches integrated
+        """
+
+        # Test one variant
+        # We need to disable this job before adding the overlay, because we might
+        # write the machine token to disk with the override content
+        When I run `pro config set update_messaging_timer=0` with sudo
+        And I set the machine token overlay to the following yaml
+        """
+        machineTokenInfo:
+          contractInfo:
+            resourceEntitlements:
+              - type: realtime-kernel
+                overrides:
+                  - directives:
+                      additionalPackages:
+                        - ubuntu-intel-iot-realtime
+                    selector:
+                      variant: intel-iotg
+                    affordances:
+                      platformChecks: {"cpu_vendor_ids": ["intel"]}
+        """
+        When I run `pro enable realtime-kernel --assume-yes` with sudo
+        When I run `pro status --all` as non-root
+        Then stdout matches regexp:
+        """
+        realtime-kernel  yes +enabled   +Ubuntu kernel with PREEMPT_RT patches integrated
+        ├ generic        yes +enabled   +Generic version of the RT kernel \(default\)
+        └ intel-iotg     yes +disabled  +RT kernel optimized for Intel IOTG platform
+        """
+        When I run `pro enable realtime-kernel --variant intel-iotg` `with sudo` and stdin `y\ny\n`
+        Then stdout contains substring:
+        """
+        Real-time Intel IOTG Kernel cannot be enabled with Real-time kernel.
+        Disable Real-time kernel and proceed to enable Real-time Intel IOTG Kernel? (y/N)
+        """
+        When I run `pro status --all` as non-root
+        Then stdout matches regexp:
+        """
+        realtime-kernel  yes +enabled   +Ubuntu kernel with PREEMPT_RT patches integrated
+        ├ generic        yes +disabled   +Generic version of the RT kernel \(default\)
+        └ intel-iotg     yes +enabled  +RT kernel optimized for Intel IOTG platform
+        """
+        When I run `pro enable realtime-kernel --variant generic` `with sudo` and stdin `y\ny\n`
+        When I run `pro status --all` as non-root
+        Then stdout matches regexp:
+        """
+        realtime-kernel  yes +enabled   +Ubuntu kernel with PREEMPT_RT patches integrated
+        ├ generic        yes +enabled   +Generic version of the RT kernel \(default\)
+        └ intel-iotg     yes +disabled  +RT kernel optimized for Intel IOTG platform
+        """
+        When I run `pro enable realtime-kernel --variant intel-iotg` `with sudo` and stdin `y\ny\n`
+        When I run `pro status --all` as non-root
+        Then stdout matches regexp:
+        """
+        realtime-kernel  yes +enabled   +Ubuntu kernel with PREEMPT_RT patches integrated
+        ├ generic        yes +disabled   +Generic version of the RT kernel \(default\)
+        └ intel-iotg     yes +enabled  +RT kernel optimized for Intel IOTG platform
+        """
+        When I verify that running `pro enable realtime-kernel` `with sudo` exits `1`
+        Then stdout contains substring:
+        """
+        Real-time kernel is already enabled.
+        """
+        When I run `pro disable realtime-kernel --assume-yes` with sudo
+        When I run `apt-cache policy hello` as non-root
+        Then stdout contains substring:
+        """
+        Installed: (none)
+        """
+
+        # Test multiple variants
+        When I set the machine token overlay to the following yaml
+        """
+        machineTokenInfo:
+          contractInfo:
+            resourceEntitlements:
+              - type: realtime-kernel
+                overrides:
+                  - directives:
+                      additionalPackages:
+                        - nvidia-prime
+                    selector:
+                      variant: nvidia-tegra
+                  - directives:
+                      additionalPackages:
+                        - ubuntu-intel-iot-realtime
+                    selector:
+                      variant: intel-iotg
+                    affordances:
+                      platformChecks: {"cpu_vendor_ids": ["intel"]}
+        """
+        When I run `pro enable realtime-kernel --variant nvidia-tegra` `with sudo` and stdin `y`
+        Then stdout matches regexp:
+        """
+        One moment, checking your subscription first
+        The Real-time kernel is an Ubuntu kernel with PREEMPT_RT patches integrated.
+
+        .*This will change your kernel. To revert to your original kernel, you will need
+        to make the change manually..*
+
+        Do you want to continue\? \[ default = Yes \]: \(Y/n\) Updating package lists
+        Installing Real-time NVIDIA Tegra Kernel packages
+        Real-time NVIDIA Tegra Kernel enabled
+        """
+        When I run `pro status` as non-root
+        Then stdout matches regexp:
+        """
+        realtime-kernel\* yes +enabled +Ubuntu kernel with PREEMPT_RT patches integrated
+        usg +yes +disabled +Security compliance and audit tools
+
+         \* Service has variants
+        """
+        Then stdout contains substring:
+        """
+        For a list of all Ubuntu Pro services and variants, run 'pro status --all'
+        """
+        When I run `pro status --all` as non-root
+        Then stdout matches regexp:
+        """
+        realtime-kernel  yes +enabled   +Ubuntu kernel with PREEMPT_RT patches integrated
+        ├ generic        yes +disabled  +Generic version of the RT kernel \(default\)
+        ├ intel-iotg     yes +disabled  +RT kernel optimized for Intel IOTG platform
+        └ nvidia-tegra   yes +enabled   +RT kernel optimized for NVIDIA Tegra platform
+        """
+        When I verify that running `pro enable realtime-kernel --variant intel-iotg` `with sudo` and stdin `N` exits `1`
+        Then stdout matches regexp:
+        """
+        Real-time Intel IOTG Kernel cannot be enabled with Real-time NVIDIA Tegra Kernel.
+        Disable Real-time NVIDIA Tegra Kernel and proceed to enable Real-time Intel IOTG Kernel\? \(y/N\)
+        """
+        And stdout matches regexp:
+        """
+        Cannot enable Real-time Intel IOTG Kernel when Real-time NVIDIA Tegra Kernel is enabled.
+        """
+        When I run `pro help realtime-kernel` as non-root
+        Then I will see the following on stdout:
+        """
+        Name:
+        realtime-kernel
+
+        Entitled:
+        yes
+
+        Status:
+        enabled
+
+        Help:
+        The Real-time kernel is an Ubuntu kernel with PREEMPT_RT patches integrated.
+        It services latency-dependent use cases by providing deterministic response times.
+        The Real-time kernel meets stringent preemption specifications and is suitable for
+        telco applications and dedicated devices in industrial automation and robotics.
+        The Real-time kernel is currently incompatible with FIPS and Livepatch. 
+
+        Variants:
+
+          * generic: Generic version of the RT kernel (default)
+          * intel-iotg: RT kernel optimized for Intel IOTG platform
+          * nvidia-tegra: RT kernel optimized for NVIDIA Tegra platform
+        """
+        When I run `pro disable realtime-kernel` `with sudo` and stdin `y`
+        Then stdout matches regexp:
+        """
+        This will remove the boot order preference for the Real-time kernel and
+        disable updates to the Real-time kernel.
+
+        This will NOT fully remove the kernel from your system.
+
+        After this operation is complete you must:
+          - Ensure a different kernel is installed and configured to boot
+          - Reboot into that kernel
+          - Fully remove the realtime kernel packages from your system
+              - This might look something like `apt remove linux\*realtime`,
+                but you must ensure this is correct before running it.
+        """
+        When I run `pro status` as non-root
+        Then stdout matches regexp:
+        """
+        realtime-kernel\* +yes +disabled   +Ubuntu kernel with PREEMPT_RT patches integrated
+        """
+        When I run `pro status --all` as non-root
+        Then stdout matches regexp:
+        """
+        realtime-kernel  yes +disabled   +Ubuntu kernel with PREEMPT_RT patches integrated
+        ├ generic        yes +disabled  +Generic version of the RT kernel \(default\)
+        ├ intel-iotg     yes +disabled  +RT kernel optimized for Intel IOTG platform
+        └ nvidia-tegra   yes +disabled   +RT kernel optimized for NVIDIA Tegra platform
+        """
+        When I verify that running `pro enable realtime-kernel --variant nonexistent` `with sudo` exits `1`
+        Then I will see the following on stdout:
+        """
+        One moment, checking your subscription first
+        could not find entitlement named "nonexistent"
+        """
+        When I run `pro detach --assume-yes` with sudo
+        And I run `pro status` as non-root
+        Then stdout matches regexp:
+        """
+        realtime-kernel +yes +Ubuntu kernel with PREEMPT_RT patches integrated
+        """
+        When I run `pro status --all` as non-root
+        Then stdout matches regexp:
+        """
+        realtime-kernel +yes +Ubuntu kernel with PREEMPT_RT patches integrated
+        """
+        And stdout does not match regexp:
+        """
+        nvidia-tegra
+        """
+        And stdout does not match regexp:
+        """
+        intel-iotg
+        """
 
         Examples: ubuntu release
             | release |
diff --git a/features/reboot_cmds.feature b/features/reboot_cmds.feature
new file mode 100644
index 0000000..13548b8
--- /dev/null
+++ b/features/reboot_cmds.feature
@@ -0,0 +1,48 @@
[e-mail]_token
+Feature: Reboot Commands
+
+    @series.focal
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: reboot-cmds removes fips package holds and updates packages
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        When I run `apt install -y strongswan` with sudo
+        When I run `pro enable fips --assume-yes` with sudo
+        When I reboot the machine
+        When I run `pro status` with sudo
+        Then stdout matches regexp:
+        """
+        fips +yes +enabled
+        """
+        When I run `apt install -y --allow-downgrades strongswan=<old_version>` with sudo
+        When I run `apt-mark hold strongswan` with sudo
+        When I run `dpkg-reconfigure ubuntu-advantage-tools` with sudo
+        When I run `pro status` with sudo
+        Then stdout matches regexp:
+        """
+        NOTICES
+        Reboot to FIPS kernel required
+        """
+        When I reboot the machine
+        And  I verify that running `systemctl status ua-reboot-cmds.service` `as non-root` exits `0,3`
+        Then stdout matches regexp:
+        """
+        .*status=0\/SUCCESS.*
+        """
+        When I run `pro status` with sudo
+        Then stdout does not match regexp:
+        """
+        NOTICES
+        """
+        When I run `apt-mark showholds` with sudo
+        Then I will see the following on stdout:
+        """
+        """
+        When I run `apt policy strongswan` with sudo
+        Then stdout contains substring:
+        """
+        *** <new_version> 1001
+        """
+        Examples: ubuntu release
+            | release | old_version      | new_version               |
+            | focal   | 5.8.2-1ubuntu3.5 | 5.8.2-1ubuntu3.fips.3.1.2 |
diff --git a/features/retry_auto_attach.feature b/features/retry_auto_attach.feature
index 84540ef..68db599 100644
--- a/features/retry_auto_attach.feature
+++ b/features/retry_auto_attach.feature
@@ -190,7 +190,8 @@ Feature: auto-attach retries periodically on failures
         """
         Active: inactive (dead)
         """
-        When I run `run-parts /etc/update-motd.d/` with sudo
+        # Workaround for livepatch issue LP #2015585
+        Then I verify that running `run-parts /etc/update-motd.d/` `with sudo` exits `0,1`
         Then stdout does not match regexp:
         """
         Failed to automatically attach to Ubuntu Pro services
@@ -345,7 +346,8 @@ Feature: auto-attach retries periodically on failures
         """
         Active: inactive (dead)
         """
-        When I run `run-parts /etc/update-motd.d/` with sudo
+        # Workaround for livepatch issue LP #2015585
+        Then I verify that running `run-parts /etc/update-motd.d/` `with sudo` exits `0,1`
         Then stdout does not match regexp:
         """
         Failed to automatically attach to Ubuntu Pro services
diff --git a/features/security_status.feature b/features/security_status.feature
index 1ee472c..a27fe5b 100644
--- a/features/security_status.feature
+++ b/features/security_status.feature
@@ -136,10 +136,10 @@ Feature: Security status command behavior
         This machine is NOT attached to an Ubuntu Pro subscription.
 
         Ubuntu Pro with 'esm-infra' enabled provides security updates for
-        Main/Restricted packages until 2026 and has \d+ pending security update[s]?\.
+        Main/Restricted packages until 2026\. There (is|are) \d+ pending security update[s]?\.
 
         Ubuntu Pro with 'esm-apps' enabled provides security updates for
-        Universe/Multiverse packages until 2026 and has \d+ pending security update[s]?\.
+        Universe/Multiverse packages until 2026\. There (is|are) \d+ pending security update[s]?\.
 
         Try Ubuntu Pro with a free personal subscription on up to 5 machines.
         Learn more at https://ubuntu.com/pro
@@ -155,17 +155,18 @@ Feature: Security status command behavior
         and esm-infra is not enabled.
 
         Ubuntu Pro with 'esm-infra' enabled provides security updates for
-        Main/Restricted packages until 2026 and has \d+ pending security update[s]?\.
+        Main/Restricted packages until 2026\. There (is|are) \d+ pending security update[s]?\.
 
         Run 'pro help esm-infra' to learn more
 
-        Package names in .*bold.* currently have an available update
-        with 'esm-infra' enabled
-        Packages:
+        Installed packages with an available esm-infra update:
+        (.|\n)+
+
+        Further installed packages covered by esm-infra:
         (.|\n)+
 
         For example, run:
-            apt-cache policy .+
+            apt-cache show .+
         to learn more about that package\.
         """
         When I verify root and non-root `pro security-status --esm-apps` calls have the same output
@@ -176,17 +177,18 @@ Feature: Security status command behavior
          +\d+ package[s]? from Ubuntu Universe/Multiverse repository
 
         Ubuntu Pro with 'esm-apps' enabled provides security updates for
-        Universe/Multiverse packages until 2026 and has \d+ pending security update[s]?\.
+        Universe/Multiverse packages until 2026\. There (is|are) \d+ pending security update[s]?\.
 
         Run 'pro help esm-apps' to learn more
 
-        Package names in .*bold.* currently have an available update
-        with 'esm-apps' enabled
-        Packages:
+        Installed packages with an available esm-apps update:
+        (.|\n)+
+
+        Further installed packages covered by esm-apps:
         (.|\n)+
 
         For example, run:
-            apt-cache policy .+
+            apt-cache show .+
         to learn more about that package\.
         """
         When I attach `contract_token` with sudo
@@ -207,10 +209,10 @@ Feature: Security status command behavior
         This machine is attached to an Ubuntu Pro subscription.
 
         Main/Restricted packages are receiving security updates from
-        Ubuntu Pro with 'esm-infra' enabled until 2026\.
+        Ubuntu Pro with 'esm-infra' enabled until 2026\. There (is|are) \d+ pending security update[s]?\.
 
         Universe/Multiverse packages are receiving security updates from
-        Ubuntu Pro with 'esm-apps' enabled until 2026\.
+        Ubuntu Pro with 'esm-apps' enabled until 2026\. There (is|are) \d+ pending security update[s]?\.
         """
         When I verify root and non-root `pro security-status --esm-infra` calls have the same output
         And I run `pro security-status --esm-infra` as non-root
@@ -220,17 +222,18 @@ Feature: Security status command behavior
          +\d+ packages from Ubuntu Main/Restricted repository
 
         Main/Restricted packages are receiving security updates from
-        Ubuntu Pro with 'esm-infra' enabled until 2026\.
+        Ubuntu Pro with 'esm-infra' enabled until 2026\. There (is|are) \d+ pending security update[s]?\.
 
         Run 'pro help esm-infra' to learn more
 
-        Package names in .*bold.* currently have an available update
-        with 'esm-infra' enabled
-        Packages:
+        Installed packages with an available esm-infra update:
+        (.|\n)+
+
+        Further installed packages covered by esm-infra:
         (.|\n)+
 
         For example, run:
-            apt-cache policy .+
+            apt-cache show .+
         to learn more about that package\.
         """
         When I verify root and non-root `pro security-status --esm-apps` calls have the same output
@@ -241,17 +244,18 @@ Feature: Security status command behavior
          +\d+ package[s]? from Ubuntu Universe/Multiverse repository
 
         Universe/Multiverse packages are receiving security updates from
-        Ubuntu Pro with 'esm-apps' enabled until 2026\.
+        Ubuntu Pro with 'esm-apps' enabled until 2026\. There (is|are) \d+ pending security update[s]?\.
 
         Run 'pro help esm-apps' to learn more
 
-        Package names in .*bold.* currently have an available update
-        with 'esm-apps' enabled
-        Packages:
+        Installed packages with an available esm-apps update:
+        (.|\n)+
+
+        Further installed packages covered by esm-apps:
         (.|\n)+
 
         For example, run:
-            apt-cache policy .+
+            apt-cache show .+
         to learn more about that package\.
         """
         When I run `apt upgrade -y` with sudo
@@ -300,10 +304,12 @@ Feature: Security status command behavior
 
         Ubuntu Pro with 'esm-infra' enabled provides security updates for
         Main/Restricted packages until 2026.
+
         Enable esm-infra with: pro enable esm-infra
 
         Ubuntu Pro with 'esm-apps' enabled provides security updates for
         Universe/Multiverse packages until 2026.
+
         Enable esm-apps with: pro enable esm-apps
         """
         When I verify root and non-root `pro security-status --thirdparty` calls have the same output
@@ -320,7 +326,7 @@ Feature: Security status command behavior
         (.|\n)+
 
         For example, run:
-            apt-cache policy .+
+            apt-cache show .+
         to learn more about that package\.
         """
         When I verify root and non-root `pro security-status --unavailable` calls have the same output
@@ -338,7 +344,7 @@ Feature: Security status command behavior
         (.|\n)+
 
         For example, run:
-            apt-cache policy .+
+            apt-cache show .+
         to learn more about that package\.
         """
         When I verify root and non-root `pro security-status --esm-infra` calls have the same output
@@ -356,14 +362,8 @@ Feature: Security status command behavior
 
         Run 'pro help esm-infra' to learn more
 
-        Package names in .*bold.* currently have an available update
-        with 'esm-infra' enabled
-        Packages:
+        Installed packages covered by esm-infra:
         (.|\n)+
-
-        For example, run:
-            apt-cache policy .+
-        to learn more about that package\.
         """
         When I verify root and non-root `pro security-status --esm-apps` calls have the same output
         And I run `pro security-status --esm-apps` as non-root
@@ -377,14 +377,8 @@ Feature: Security status command behavior
 
         Run 'pro help esm-apps' to learn more
 
-        Package names in .*bold.* currently have an available update
-        with 'esm-apps' enabled
-        Packages:
+        Installed packages covered by esm-apps:
         (.|\n)+
-
-        For example, run:
-            apt-cache policy .+
-        to learn more about that package\.
         """
         When I verify that running `pro security-status --thirdparty --unavailable` `as non-root` exits `2`
         Then I will see the following on stderr
@@ -393,6 +387,70 @@ Feature: Security status command behavior
                                [--thirdparty | --unavailable | --esm-infra | --esm-apps]
         argument --unavailable: not allowed with argument --thirdparty
         """
+        When I run `rm /var/lib/apt/periodic/update-success-stamp` with sudo
+        And I run `pro security-status` as non-root
+        Then stdout matches regexp:
+        """
+        \d+ packages installed:
+         +\d+ package[s]? from Ubuntu Main/Restricted repository
+         +\d+ package[s]? from Ubuntu Universe/Multiverse repository
+         +\d+ package[s]? from a third party
+         +\d+ package[s]? no longer available for download
+
+        To get more information about the packages, run
+            pro security-status --help
+        for a list of available options\.
+
+        The system apt cache may be outdated\. Make sure to run
+            sudo apt-get update
+        to get the latest package information from apt\.
+
+        This machine is NOT receiving security patches because the LTS period has ended
+        and esm-infra is not enabled.
+        This machine is attached to an Ubuntu Pro subscription.
+
+        Ubuntu Pro with 'esm-infra' enabled provides security updates for
+        Main/Restricted packages until 2026.
+
+        Enable esm-infra with: pro enable esm-infra
+
+        Ubuntu Pro with 'esm-apps' enabled provides security updates for
+        Universe/Multiverse packages until 2026.
+
+        Enable esm-apps with: pro enable esm-apps
+        """
+        When I run `touch -d '-2 days' /var/lib/apt/periodic/update-success-stamp` with sudo
+        And I run `pro security-status` as non-root
+        Then stdout matches regexp:
+        """
+        \d+ packages installed:
+         +\d+ package[s]? from Ubuntu Main/Restricted repository
+         +\d+ package[s]? from Ubuntu Universe/Multiverse repository
+         +\d+ package[s]? from a third party
+         +\d+ package[s]? no longer available for download
+
+        To get more information about the packages, run
+            pro security-status --help
+        for a list of available options\.
+
+        The system apt information was updated 2 day\(s\) ago\. Make sure to run
+            sudo apt-get update
+        to get the latest package information from apt\.
+
+        This machine is NOT receiving security patches because the LTS period has ended
+        and esm-infra is not enabled.
+        This machine is attached to an Ubuntu Pro subscription.
+
+        Ubuntu Pro with 'esm-infra' enabled provides security updates for
+        Main/Restricted packages until 2026.
+
+        Enable esm-infra with: pro enable esm-infra
+
+        Ubuntu Pro with 'esm-apps' enabled provides security updates for
+        Universe/Multiverse packages until 2026.
+
+        Enable esm-apps with: pro enable esm-apps
+        """
 
     @series.focal
     @uses.config.machine_type.lxd.container
@@ -423,7 +481,7 @@ Feature: Security status command behavior
         Main/Restricted packages until 2030.
 
         Ubuntu Pro with 'esm-apps' enabled provides security updates for
-        Universe/Multiverse packages until 2030 and has \d+ pending security update[s]?\.
+        Universe/Multiverse packages until 2030\. There (is|are) \d+ pending security update[s]?\.
 
         Try Ubuntu Pro with a free personal subscription on up to 5 machines.
         Learn more at https://ubuntu.com/pro
@@ -451,17 +509,18 @@ Feature: Security status command behavior
          +\d+ package[s]? from Ubuntu Universe/Multiverse repository
 
         Ubuntu Pro with 'esm-apps' enabled provides security updates for
-        Universe/Multiverse packages until 2030 and has \d+ pending security update[s]?\.
+        Universe/Multiverse packages until 2030\. There (is|are) \d+ pending security update[s]?\.
 
         Run 'pro help esm-apps' to learn more
 
-        Package names in .*bold.* currently have an available update
-        with 'esm-apps' enabled
-        Packages:
+        Installed packages with an available esm-apps update:
+        (.|\n)+
+
+        Further installed packages covered by esm-apps:
         (.|\n)+
 
         For example, run:
-            apt-cache policy .+
+            apt-cache show .+
         to learn more about that package\.
         """
         When I attach `contract_token` with sudo
@@ -485,7 +544,7 @@ Feature: Security status command behavior
         Ubuntu Pro with 'esm-infra' enabled until 2030.
 
         Universe/Multiverse packages are receiving security updates from
-        Ubuntu Pro with 'esm-apps' enabled until 2030\.
+        Ubuntu Pro with 'esm-apps' enabled until 2030\. There (is|are) \d+ pending security update[s]?\.
         """
         When I verify root and non-root `pro security-status --esm-infra` calls have the same output
         And I run `pro security-status --esm-infra` as non-root
@@ -507,17 +566,18 @@ Feature: Security status command behavior
          +\d+ package[s]? from Ubuntu Universe/Multiverse repository
 
         Universe/Multiverse packages are receiving security updates from
-        Ubuntu Pro with 'esm-apps' enabled until 2030\.
+        Ubuntu Pro with 'esm-apps' enabled until 2030\. There (is|are) \d+ pending security update[s]?\.
 
         Run 'pro help esm-apps' to learn more
 
-        Package names in .*bold.* currently have an available update
-        with 'esm-apps' enabled
-        Packages:
+        Installed packages with an available esm-apps update:
+        (.|\n)+
+
+        Further installed packages covered by esm-apps:
         (.|\n)+
 
         For example, run:
-            apt-cache policy .+
+            apt-cache show .+
         to learn more about that package\.
         """
         When I run `apt upgrade -y` with sudo
@@ -565,10 +625,12 @@ Feature: Security status command behavior
 
         Ubuntu Pro with 'esm-infra' enabled provides security updates for
         Main/Restricted packages until 2030.
+
         Enable esm-infra with: pro enable esm-infra
 
         Ubuntu Pro with 'esm-apps' enabled provides security updates for
         Universe/Multiverse packages until 2030.
+
         Enable esm-apps with: pro enable esm-apps
         """
         When I verify root and non-root `pro security-status --thirdparty` calls have the same output
@@ -585,7 +647,7 @@ Feature: Security status command behavior
         (.|\n)+
 
         For example, run:
-            apt-cache policy .+
+            apt-cache show .+
         to learn more about that package\.
         """
         When I verify root and non-root `pro security-status --unavailable` calls have the same output
@@ -603,7 +665,7 @@ Feature: Security status command behavior
         (.|\n)+
 
         For example, run:
-            apt-cache policy .+
+            apt-cache show .+
         to learn more about that package\.
         """
         When I verify root and non-root `pro security-status --esm-infra` calls have the same output
@@ -633,14 +695,8 @@ Feature: Security status command behavior
 
         Run 'pro help esm-apps' to learn more
 
-        Package names in .*bold.* currently have an available update
-        with 'esm-apps' enabled
-        Packages:
+        Installed packages covered by esm-apps:
         (.|\n)+
-
-        For example, run:
-            apt-cache policy .+
-        to learn more about that package\.
         """
         When I verify that running `pro security-status --thirdparty --unavailable` `as non-root` exits `2`
         Then I will see the following on stderr
@@ -649,6 +705,70 @@ Feature: Security status command behavior
                                [--thirdparty | --unavailable | --esm-infra | --esm-apps]
         argument --unavailable: not allowed with argument --thirdparty
         """
+        When I run `rm /var/lib/apt/periodic/update-success-stamp` with sudo
+        And I run `pro security-status` as non-root
+        Then stdout matches regexp:
+        """
+        \d+ packages installed:
+         +\d+ package[s]? from Ubuntu Main/Restricted repository
+         +\d+ package[s]? from Ubuntu Universe/Multiverse repository
+         +\d+ package[s]? from a third party
+         +\d+ package[s]? no longer available for download
+
+        To get more information about the packages, run
+            pro security-status --help
+        for a list of available options\.
+
+        The system apt cache may be outdated\. Make sure to run
+            sudo apt-get update
+        to get the latest package information from apt\.
+
+        This machine is receiving security patching for Ubuntu Main/Restricted
+        repository until 2025.
+        This machine is attached to an Ubuntu Pro subscription.
+
+        Ubuntu Pro with 'esm-infra' enabled provides security updates for
+        Main/Restricted packages until 2030.
+
+        Enable esm-infra with: pro enable esm-infra
+
+        Ubuntu Pro with 'esm-apps' enabled provides security updates for
+        Universe/Multiverse packages until 2030.
+
+        Enable esm-apps with: pro enable esm-apps
+        """
+        When I run `touch -d '-2 days' /var/lib/apt/periodic/update-success-stamp` with sudo
+        And I run `pro security-status` as non-root
+        Then stdout matches regexp:
+        """
+        \d+ packages installed:
+         +\d+ package[s]? from Ubuntu Main/Restricted repository
+         +\d+ package[s]? from Ubuntu Universe/Multiverse repository
+         +\d+ package[s]? from a third party
+         +\d+ package[s]? no longer available for download
+
+        To get more information about the packages, run
+            pro security-status --help
+        for a list of available options\.
+
+        The system apt information was updated 2 day\(s\) ago\. Make sure to run
+            sudo apt-get update
+        to get the latest package information from apt\.
+
+        This machine is receiving security patching for Ubuntu Main/Restricted
+        repository until 2025.
+        This machine is attached to an Ubuntu Pro subscription.
+
+        Ubuntu Pro with 'esm-infra' enabled provides security updates for
+        Main/Restricted packages until 2030.
+
+        Enable esm-infra with: pro enable esm-infra
+
+        Ubuntu Pro with 'esm-apps' enabled provides security updates for
+        Universe/Multiverse packages until 2030.
+
+        Enable esm-apps with: pro enable esm-apps
+        """
 
     @series.kinetic
     @uses.config.machine_type.lxd.container
@@ -695,3 +815,47 @@ Feature: Security status command behavior
 
         Ubuntu Pro is not available for non-LTS releases\.
         """
+        When I run `rm /var/lib/apt/periodic/update-success-stamp` with sudo
+        And I run `pro security-status` as non-root
+        Then stdout matches regexp:
+        """
+        \d+ packages installed:
+         +\d+ packages from Ubuntu Main/Restricted repository
+         +\d+ package[s]? from Ubuntu Universe/Multiverse repository
+         +\d+ package[s]? from a third party
+         +\d+ package[s]? no longer available for download
+
+        To get more information about the packages, run
+            pro security-status --help
+        for a list of available options\.
+
+        The system apt cache may be outdated\. Make sure to run
+            sudo apt-get update
+        to get the latest package information from apt\.
+
+        Main/Restricted packages receive updates until 7/2023\.
+
+        Ubuntu Pro is not available for non-LTS releases\.
+        """
+        When I run `touch -d '-2 days' /var/lib/apt/periodic/update-success-stamp` with sudo
+        And I run `pro security-status` as non-root
+        Then stdout matches regexp:
+        """
+        \d+ packages installed:
+         +\d+ packages from Ubuntu Main/Restricted repository
+         +\d+ package[s]? from Ubuntu Universe/Multiverse repository
+         +\d+ package[s]? from a third party
+         +\d+ package[s]? no longer available for download
+
+        To get more information about the packages, run
+            pro security-status --help
+        for a list of available options\.
+
+        The system apt information was updated 2 day\(s\) ago\. Make sure to run
+            sudo apt-get update
+        to get the latest package information from apt\.
+
+        Main/Restricted packages receive updates until 7/2023\.
+
+        Ubuntu Pro is not available for non-LTS releases\.
+        """
diff --git a/features/steps/airgap.py b/features/steps/airgap.py
index 004f875..85f2ddf 100644
--- a/features/steps/airgap.py
+++ b/features/steps/airgap.py
@@ -10,7 +10,7 @@ from features.steps.shell import when_i_run_command
 
 @when("I download the service credentials on the `{machine_name}` machine")
 def download_service_credentials(context, machine_name):
-    token = context.config.contract_token
+    token = context.pro_config.contract_token
     when_i_run_command(
         context,
         "get-resource-tokens {}".format(token),
@@ -112,7 +112,7 @@ def serve_apt_mirror(context, service, port, machine_name):
     "I create the contract config overrides file for `{service_list}` on the `{machine_name}` machine"  # noqa
 )
 def create_contract_overrides(context, service_list, machine_name):
-    token = context.config.contract_token
+    token = context.pro_config.contract_token
     config_override = {token: {}}  # type: Dict[str, Any]
 
     for service in service_list.split(","):
diff --git a/features/steps/attach.py b/features/steps/attach.py
index ad6d7de..921bbc4 100644
--- a/features/steps/attach.py
+++ b/features/steps/attach.py
@@ -23,7 +23,7 @@ def when_i_attach_staging_token_with_options(
 def when_i_attach_staging_token(
     context, token_type, user_spec, verify_return=True, options=""
 ):
-    token = getattr(context.config, token_type)
+    token = getattr(context.pro_config, token_type)
     if (
         token_type == "contract_token_staging"
         or token_type == "contract_token_staging_expired"
@@ -47,7 +47,9 @@ def when_i_attempt_to_attach_staging_token(context, token_type, user_spec):
     "I verify that running attach `{spec}` with json response exits `{exit_codes}`"  # noqa
 )
 def when_i_verify_attach_with_json_response(context, spec, exit_codes):
-    cmd = "pro attach {} --format json".format(context.config.contract_token)
+    cmd = "pro attach {} --format json".format(
+        context.pro_config.contract_token
+    )
     then_i_verify_that_running_cmd_with_spec_exits_with_codes(
         context=context, cmd_name=cmd, spec=spec, exit_codes=exit_codes
     )
@@ -59,7 +61,7 @@ def when_i_verify_attach_with_json_response(context, spec, exit_codes):
 def when_i_verify_attach_expired_token_with_json_response(context, spec):
     change_contract_endpoint_to_staging(context, user_spec="with sudo")
     cmd = "pro attach {} --format json".format(
-        context.config.contract_token_staging_expired
+        context.pro_config.contract_token_staging_expired
     )
     then_i_verify_that_running_cmd_with_spec_exits_with_codes(
         context=context, cmd_name=cmd, spec=spec, exit_codes=ERROR_CODE
diff --git a/features/steps/files.py b/features/steps/files.py
index 8b34375..f4e8545 100644
--- a/features/steps/files.py
+++ b/features/steps/files.py
@@ -36,8 +36,11 @@ def when_i_add_this_text_on_file_above_line(
     )
 
 
+@when("I verify `{file_name}` is empty")
 @when("I verify `{file_name}` is empty on `{machine_name}` machine")
-def when_i_verify_file_is_empty_on_machine(context, file_name, machine_name):
+def when_i_verify_file_is_empty_on_machine(
+    context, file_name, machine_name=SUT
+):
     command = 'sh -c "cat {} | wc -l"'.format(file_name)
     when_i_run_command(
         context, command, user_spec="with sudo", machine_name=machine_name
@@ -97,7 +100,7 @@ def when_i_replace_string_in_file(context, original, filename, new):
 def when_i_replace_string_in_file_with_token(
     context, original, filename, token_name
 ):
-    token = getattr(context.config, token_name)
+    token = getattr(context.pro_config, token_name)
     when_i_replace_string_in_file(context, original, filename, token)
 
 
diff --git a/features/steps/fix.py b/features/steps/fix.py
index a799d79..a9a77fe 100644
--- a/features/steps/fix.py
+++ b/features/steps/fix.py
@@ -9,7 +9,7 @@ from features.steps.shell import when_i_run_command
 
 @when("I fix `{issue}` by attaching to a subscription with `{token_type}`")
 def when_i_fix_a_issue_by_attaching(context, issue, token_type):
-    token = getattr(context.config, token_type)
+    token = getattr(context.pro_config, token_type)
 
     if (
         token_type == "contract_token_staging"
@@ -40,7 +40,7 @@ def when_i_fix_a_issue_by_enabling_service(context, issue):
 
 @when("I fix `{issue}` by updating expired token")
 def when_i_fix_a_issue_by_updating_expired_token(context, issue):
-    token = getattr(context.config, "contract_token")
+    token = getattr(context.pro_config, "contract_token")
     when_i_run_command(
         context=context,
         command="pro fix {}".format(issue),
diff --git a/features/steps/machines.py b/features/steps/machines.py
index c06555d..4101649 100644
--- a/features/steps/machines.py
+++ b/features/steps/machines.py
@@ -40,7 +40,7 @@ def given_a_machine(
 
     inbound_ports = ports.split(",") if ports is not None else None
 
-    is_pro = "pro" in context.config.machine_type
+    is_pro = "pro" in context.pro_config.machine_type
     pro_user_data = (
         "bootcmd:\n"
         """  - "cloud-init-per once disable-auto-attach printf '\\nfeatures: {disable_auto_attach: true}\\n' >> /etc/ubuntu-advantage/uaclient.conf"\n"""  # noqa: E501
@@ -53,10 +53,10 @@ def given_a_machine(
         if user_data is not None:
             user_data_to_use += user_data
 
-    instance = context.config.cloud_manager.launch(
+    instance = context.pro_config.cloud_manager.launch(
         series=series,
         instance_name=instance_name,
-        ephemeral=context.config.ephemeral_instance,
+        ephemeral=context.pro_config.ephemeral_instance,
         image_name=context.snapshots.get(snapshot_name, None),
         inbound_ports=inbound_ports,
         user_data=user_data_to_use,
@@ -69,7 +69,7 @@ def given_a_machine(
     if cleanup:
 
         def cleanup_instance():
-            if not context.config.destroy_instances:
+            if not context.pro_config.destroy_instances:
                 logging.info(
                     "--- Leaving instance running: {}".format(
                         context.machines[machine_name].instance.name
@@ -92,7 +92,7 @@ def given_a_machine(
 @when("I take a snapshot of the machine")
 def when_i_take_a_snapshot(context, machine_name=SUT, cleanup=True):
     inst = context.machines[machine_name].instance
-    snapshot = context.config.cloud_manager.api.snapshot(inst)
+    snapshot = context.pro_config.cloud_manager.api.snapshot(inst)
 
     context.snapshots[machine_name] = snapshot
 
@@ -100,7 +100,7 @@ def when_i_take_a_snapshot(context, machine_name=SUT, cleanup=True):
 
         def cleanup_snapshot() -> None:
             try:
-                context.config.cloud_manager.api.delete_image(
+                context.pro_config.cloud_manager.api.delete_image(
                     context.snapshots[machine_name]
                 )
             except RuntimeError as e:
@@ -115,13 +115,13 @@ def when_i_take_a_snapshot(context, machine_name=SUT, cleanup=True):
 
 @given("a `{series}` machine with ubuntu-advantage-tools installed")
 def given_a_sut_machine(context, series):
-    if context.config.install_from == InstallationSource.LOCAL:
+    if context.pro_config.install_from == InstallationSource.LOCAL:
         # build right away, this will cache the built debs for later use
         # building early means we catch build errors before investing in
         # launching instances
         build_debs(series)
 
-    if context.config.snapshot_strategy:
+    if context.pro_config.snapshot_strategy:
         if "builder" not in context.snapshots:
             given_a_machine(
                 context, series, machine_name="builder", cleanup=False
diff --git a/features/steps/output.py b/features/steps/output.py
index abb1f7f..788e939 100644
--- a/features/steps/output.py
+++ b/features/steps/output.py
@@ -65,6 +65,13 @@ def then_stream_contains_substring(context, stream):
     assert_that(content, contains_string(text))
 
 
+@then("{stream} does not contain substring")
+def then_stream_not_contains_substring(context, stream):
+    content = getattr(context.process, stream).strip()
+    text = process_template_vars(context, context.text)
+    assert_that(content, not_(contains_string(text)))
+
+
 @then("I will see the following on stderr")
 def then_i_will_see_on_stderr(context):
     text = process_template_vars(context, context.text)
diff --git a/features/steps/packages.py b/features/steps/packages.py
index a523706..2239e51 100644
--- a/features/steps/packages.py
+++ b/features/steps/packages.py
@@ -3,16 +3,9 @@ import re
 from behave import then, when
 from hamcrest import assert_that, contains_string, matches_regexp
 
-from features.steps.files import when_i_create_file_with_content
 from features.steps.shell import when_i_run_command
 from features.util import SUT
 
-APT_REPO_ENTRY = (
-    "deb [trusted=yes] "
-    "http://proclientdummyrepo.s3-website.us-east-2.amazonaws.com/"
-    "actual_ppa/ unstable main"
-)
-
 
 @when("I apt install `{package_name}`")
 @when("I apt install `{package_name}` on the `{machine_name}` machine")
@@ -108,27 +101,33 @@ def verify_packages_are_installed_from_apt_source(
 @when("I install third-party / unknown packages in the machine")
 def when_i_install_packages(context):
     # Dummy packages are installed to serve as third-party and unknown
-    # packages for the tests. They live happy and joyful lives in a s3 bucket.
+    # packages for the tests. Those packages are in Launchpad PPAs
+    # owned by the uaclient team.
     # Many APT updates just to make sure we are up to date
 
-    # Unknown package - installed directly, no external reference
+    # Unknown package - we remove the PPA afterwards so there is no
+    # external references for the deb.
     when_i_run_command(
         context,
-        (
-            "curl -L "
-            "http://proclientdummyrepo.s3-website.us-east-2.amazonaws.com/"
-            "unknown_deb/pro-dummy-unknown_1.2.3_all.deb "
-            "-o /tmp/unknown.deb"
-        ),
+        "add-apt-repository -y ppa:ua-client/pro-client-ci-test-unknown",
         "with sudo",
     )
+    when_i_run_command(context, "apt-get update", "with sudo")
     when_i_run_command(
-        context, "apt-get install -y /tmp/unknown.deb", "with sudo"
+        context, "apt-get install -y pro-dummy-unknown", "with sudo"
+    )
+    # Why no remove-apt-repository?
+    when_i_run_command(
+        context,
+        "add-apt-repository -y -r ppa:ua-client/pro-client-ci-test-unknown",
+        "with sudo",
     )
 
     # PPA to install the third-party package
-    when_i_create_file_with_content(
-        context, "/etc/apt/sources.list.d/prodummy.list", text=APT_REPO_ENTRY
+    when_i_run_command(
+        context,
+        "add-apt-repository -y ppa:ua-client/pro-client-ci-test-thirdparty",
+        "with sudo",
     )
     when_i_run_command(context, "apt-get update", "with sudo")
     when_i_run_command(
diff --git a/features/steps/shell.py b/features/steps/shell.py
index aad147b..6e04988 100644
--- a/features/steps/shell.py
+++ b/features/steps/shell.py
@@ -43,10 +43,12 @@ def when_i_run_command(
     machine_name=SUT,
 ):
     command = process_template_vars(context, command)
-
     prefix = get_command_prefix_for_user_spec(user_spec)
-
     full_cmd = prefix + shlex.split(command)
+
+    if stdin is not None:
+        stdin = stdin.replace("\\n", "\n")
+
     result = context.machines[machine_name].instance.execute(
         full_cmd, stdin=stdin
     )
diff --git a/features/steps/status.py b/features/steps/status.py
index 3fada5e..4c606da 100644
--- a/features/steps/status.py
+++ b/features/steps/status.py
@@ -5,7 +5,7 @@ from features.steps.shell import when_i_run_command
 
 @when("I do a preflight check for `{contract_token}` {user_spec}")
 def when_i_preflight(context, contract_token, user_spec, verify_return=True):
-    token = getattr(context.config, contract_token, "invalid_token")
+    token = getattr(context.pro_config, contract_token, "invalid_token")
     command = "pro status --simulate-with-token {}".format(token)
     if user_spec == "with the all flag":
         command += " --all"
diff --git a/features/steps/ubuntu_advantage_tools.py b/features/steps/ubuntu_advantage_tools.py
index 2b6bf16..827e89b 100644
--- a/features/steps/ubuntu_advantage_tools.py
+++ b/features/steps/ubuntu_advantage_tools.py
@@ -14,8 +14,8 @@ from features.util import SUT, InstallationSource, build_debs
 def when_i_install_uat(context, machine_name=SUT):
     instance = context.machines[machine_name].instance
     series = context.machines[machine_name].series
-    is_pro = "pro" in context.config.machine_type
-    if context.config.install_from is InstallationSource.ARCHIVE:
+    is_pro = "pro" in context.pro_config.machine_type
+    if context.pro_config.install_from is InstallationSource.ARCHIVE:
         instance.execute("sudo apt update")
         when_i_apt_install(
             context, "ubuntu-advantage-tools", machine_name=machine_name
@@ -24,8 +24,8 @@ def when_i_install_uat(context, machine_name=SUT):
             when_i_apt_install(
                 context, "ubuntu-advantage-pro", machine_name=machine_name
             )
-    elif context.config.install_from is InstallationSource.PREBUILT:
-        debs_path = context.config.debs_path
+    elif context.pro_config.install_from is InstallationSource.PREBUILT:
+        debs_path = context.pro_config.debs_path
         deb_paths = [
             os.path.join(debs_path, deb_file)
             for deb_file in os.listdir(debs_path)
@@ -39,7 +39,7 @@ def when_i_install_uat(context, machine_name=SUT):
                     context, "/tmp/behave_ua.deb", machine_name=machine_name
                 )
                 instance.execute("sudo rm /tmp/behave_ua.deb")
-    elif context.config.install_from is InstallationSource.LOCAL:
+    elif context.pro_config.install_from is InstallationSource.LOCAL:
         ua_deb_path, pro_deb_path = build_debs(series)
         instance.push_file(ua_deb_path, "/tmp/behave_ua.deb")
         when_i_apt_install(
@@ -52,7 +52,7 @@ def when_i_install_uat(context, machine_name=SUT):
                 context, "/tmp/behave_ua.deb", machine_name=machine_name
             )
             instance.execute("sudo rm /tmp/behave_ua.deb")
-    elif context.config.install_from is InstallationSource.DAILY:
+    elif context.pro_config.install_from is InstallationSource.DAILY:
         instance.execute("sudo add-apt-repository ppa:ua-client/daily")
         instance.execute("sudo apt update")
         when_i_apt_install(
@@ -62,7 +62,7 @@ def when_i_install_uat(context, machine_name=SUT):
             when_i_apt_install(
                 context, "ubuntu-advantage-pro", machine_name=machine_name
             )
-    elif context.config.install_from is InstallationSource.STAGING:
+    elif context.pro_config.install_from is InstallationSource.STAGING:
         instance.execute("sudo add-apt-repository ppa:ua-client/staging")
         instance.execute("sudo apt update")
         when_i_apt_install(
@@ -72,7 +72,7 @@ def when_i_install_uat(context, machine_name=SUT):
             when_i_apt_install(
                 context, "ubuntu-advantage-pro", machine_name=machine_name
             )
-    elif context.config.install_from is InstallationSource.STABLE:
+    elif context.pro_config.install_from is InstallationSource.STABLE:
         instance.execute("sudo add-apt-repository ppa:ua-client/stable")
         instance.execute("sudo apt update")
         when_i_apt_install(
@@ -82,7 +82,7 @@ def when_i_install_uat(context, machine_name=SUT):
             when_i_apt_install(
                 context, "ubuntu-advantage-pro", machine_name=machine_name
             )
-    elif context.config.install_from is InstallationSource.PROPOSED:
+    elif context.pro_config.install_from is InstallationSource.PROPOSED:
         context.text = "deb http://archive.ubuntu.com/ubuntu/ {series}-proposed main\n".format(  # noqa: E501
             series=series
         )
@@ -127,9 +127,9 @@ def when_i_install_uat(context, machine_name=SUT):
             when_i_apt_install(
                 context, "ubuntu-advantage-pro", machine_name=machine_name
             )
-    elif context.config.install_from is InstallationSource.CUSTOM:
+    elif context.pro_config.install_from is InstallationSource.CUSTOM:
         instance.execute(
-            "sudo add-apt-repository {}".format(context.config.custom_ppa)
+            "sudo add-apt-repository {}".format(context.pro_config.custom_ppa)
         )
         instance.execute("sudo apt update")
         when_i_apt_install(
@@ -143,7 +143,7 @@ def when_i_install_uat(context, machine_name=SUT):
 
 @when("I have the `{series}` debs under test in `{dest}`")
 def when_i_have_the_debs_under_test(context, series, dest):
-    if context.config.install_from is InstallationSource.LOCAL:
+    if context.pro_config.install_from is InstallationSource.LOCAL:
         deb_paths = build_debs(series)
 
         for deb_path in deb_paths:
@@ -151,17 +151,17 @@ def when_i_have_the_debs_under_test(context, series, dest):
             dest_path = "{}/ubuntu-advantage-{}.deb".format(dest, tools_or_pro)
             context.machines[SUT].instance.push_file(deb_path, dest_path)
     else:
-        if context.config.install_from is InstallationSource.PROPOSED:
+        if context.pro_config.install_from is InstallationSource.PROPOSED:
             ppa_opts = ""
         else:
-            if context.config.install_from is InstallationSource.DAILY:
+            if context.pro_config.install_from is InstallationSource.DAILY:
                 ppa = "ppa:ua-client/daily"
-            elif context.config.install_from is InstallationSource.STAGING:
+            elif context.pro_config.install_from is InstallationSource.STAGING:
                 ppa = "ppa:ua-client/staging"
-            elif context.config.install_from is InstallationSource.STABLE: