Merge ~orndorffgrant/ubuntu/+source/ubuntu-advantage-tools:upload-28-mantic into ubuntu/+source/ubuntu-advantage-tools:ubuntu/devel

[Grant Orndorff]

This is release 28 of ubuntu-advantage-tools.
This replaces the 27.15 MP, which I will close shortly.

SRU Bug: https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2017949

[Grant Orndorff (orndorffgrant)]

* Staging PPA Test Triggers:
  - Source ubuntu-advantage-tools/28~rc1: Pending
    + amd64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=amd64&trigger=ubuntu-advantage-tools%2F28~rc1&ppa=ua-client%2Fstaging♻
    + arm64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=arm64&trigger=ubuntu-advantage-tools%2F28~rc1&ppa=ua-client%2Fstaging♻
    + armhf: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=armhf&trigger=ubuntu-advantage-tools%2F28~rc1&ppa=ua-client%2Fstaging♻
    + ppc64el: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=ppc64el&trigger=ubuntu-advantage-tools%2F28~rc1&ppa=ua-client%2Fstaging♻
    + s390x: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=s390x&trigger=ubuntu-advantage-tools%2F28~rc1&ppa=ua-client%2Fstaging♻
    + riscv64: https://autopkgtest.ubuntu.com/request.cgi?release=mantic&package=ubuntu-advantage-tools&arch=riscv64&trigger=ubuntu-advantage-tools%2F28~rc1&ppa=ua-client%2Fstaging♻
  - Source ubuntu-advantage-tools/28~23.04~rc1: Pending
    + amd64: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=amd64&trigger=ubuntu-advantage-tools%2F28~23.04~rc1&ppa=ua-client%2Fstaging♻
    + arm64: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=arm64&trigger=ubuntu-advantage-tools%2F28~23.04~rc1&ppa=ua-client%2Fstaging♻
    + armhf: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=armhf&trigger=ubuntu-advantage-tools%2F28~23.04~rc1&ppa=ua-client%2Fstaging♻
    + ppc64el: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=ppc64el&trigger=ubuntu-advantage-tools%2F28~23.04~rc1&ppa=ua-client%2Fstaging♻
    + s390x: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=s390x&trigger=ubuntu-advantage-tools%2F28~23.04~rc1&ppa=ua-client%2Fstaging♻
    + riscv64: https://autopkgtest.ubuntu.com/request.cgi?release=lunar&package=ubuntu-advantage-tools&arch=riscv64&trigger=ubuntu-advantage-tools%2F28~23.04~rc1&ppa=ua-client%2Fstaging♻
  - Source ubuntu-advantage-tools/28~22.10~rc1: Pending
    + amd64: https://autopkgtest.ubuntu.com/request.cgi?release=kinetic&package=ubuntu-advantage-tools&arch=amd64&trigger=ubuntu-advantage-tools%2F28~22.10~rc1&ppa=ua-client%2Fstaging♻
    + arm64: https://autopkgtest.ubuntu.com/request.cgi?release=kinetic&package=ubuntu-advantage-tools&arch=arm64&trigger=ubuntu-advantage-tools%2F28~22.10~rc1&ppa=ua-client%2Fstaging♻
    + armhf: https://autopkgtest.ubuntu.com/request.cgi?release=kinetic&package=ubuntu-advantage-tools&arch=armhf&trigger=ubuntu-advantage-tools%2F28~22.10~rc1&ppa=ua-client%2Fstaging♻
    + ppc64el: https://autopkgtest.ubuntu.com/request.cgi?release=kinetic&package=ubuntu-advantage-tools&arch=ppc64el&trigger=ubuntu-advantage-tools%2F28~22.10~rc1&ppa=ua-client%2Fstaging♻
    + s390x: https://autopkgtest.ubuntu.com/request.cgi?release=kin...

[Lucas Kanashiro (lucaskanashiro)]

All tests were triggered.

[Lucas Kanashiro (lucaskanashiro)]

Review:

As I am not familiar to the code base and my review here is more related to the
interaction with the system, I kind of skipped most changes related to tests
(the ones not executed during build time), CI and docs and tried to focus on the
code. Bear in mind this is my first pro-client review, so if there is something
you believe I should change in my approach please let me know.

I started reviewing the difference between the content in the archive (git tag
pkg/import/27.14.4) and the proposed branch for 27.15 (branch
upload-27.15-mantic). This branch contains just a partial set of changes of the
proposed upload (upload-28-mantic branch) but it was a good way to review it in
smaller chunks.

# Diff between 27.14.4 and 27.15 (never released)

- The initial commits are related to the diff between the packaging branch and
  upstream tag for that release that Robie raised to the Pro team on MM. Grant
  added those missing changes to the package now with splitted commits. Thanks
  Grant! There is still a delta in d/changelog which is fixed in version 28,
  and the .gitignore changes which still remains in version 28.

- A bunch of refactoring was done.

- A bunch of logging related changes, plus a apport script update to include
  those logs when reporting a bug. Now non-root user logging is supported.

- postinst change to better catch when the "ua_config" option is used. The
  regex was updated to check if the line starts with "ua_config", which makes
  sure that the option is not commented out. This change seems safe enough to
  me.

- The code which tries to load uaclient.conf from CWD was removed, considered
  unintuitive and unexpected behavior by the Pro team. I believe this has no
  impact in the package itself, since the config is loaded from somewhere else.

- Livepatch related changes. Nothing that I believe it will impact the package.
  The kernel architecture is now treated differently than the other packages,
  they use uname.machine to track it. So instead of amd64 we have x86_64 for
  kernels, which seems to be what the livepatch service supports.

- When getting OS info via os-release, now Pro tries to checkout /etc/os-release
  and then fallback to /usr/lib/os-release, as the doc suggests.

- Update the ua-reboot-cmds.service and ua-timer.timer to start only if
  /var/lib/ubuntu-advantage/private/machine-token.json exists, which means that
  it is already attached. I do not foresee any issue with that change.

- Pro security status now shows available/installed counts for ESM packages
  even if it is not enabled/attached. The output of the command was also
  updated to facilitate users searching for packages via grep, and some other
  small changes. The pro status message was also improved.

- Bionic specific urls where added to apt messaging.

- The apt config file adding infra-security and apps-security to
  Unattended-Upgrade:Allowed-Origins was removed from the Pro code base, it is
  now shipped by the unattended-upgrades package. I confirmed that it is true to
  supported releases.

- Pro now supports variants for services, such as variants for kernel vendors
  like Intel and NVIDIA.

# Diff between 27.15 (never re...

review: Needs Fixing

[Grant Orndorff (orndorffgrant)]

Thank you for the review Lucas!

I've addressed your requests: The changelog references version 28 only now (since 27.15 never happened - I'll be deleting the 27.15 tag on GitHub as well). And the commit about the new return code now accurately says the new code is 4.

I'll also post the autopkgtest results so far in a separate comment. They're all passing so far, but some are still in the queue.

[Grant Orndorff (orndorffgrant)]

* Staging PPA Test Results:
  - ubuntu-advantage-tools/28~16.04~rc1
    + ✅ ubuntu-advantage-tools on xenial for amd64 @ 31.05.23 15:23:13 Log 🗒
    + ✅ ubuntu-advantage-tools on xenial for arm64 @ 31.05.23 15:27:09 Log 🗒
    + ✅ ubuntu-advantage-tools on xenial for armhf @ 31.05.23 15:22:36 Log 🗒
    + ✅ ubuntu-advantage-tools on xenial for i386 @ 31.05.23 15:38:47 Log 🗒
    + ✅ ubuntu-advantage-tools on xenial for ppc64el @ 31.05.23 15:22:47 Log 🗒
    + ✅ ubuntu-advantage-tools on xenial for s390x @ 31.05.23 15:40:53 Log 🗒
  - ubuntu-advantage-tools/28~18.04~rc1
    + ✅ ubuntu-advantage-tools on bionic for amd64 @ 01.06.23 02:12:58 Log 🗒
    + ✅ ubuntu-advantage-tools on bionic for arm64 @ 31.05.23 15:30:36 Log 🗒
    + ✅ ubuntu-advantage-tools on bionic for armhf @ 31.05.23 15:22:43 Log 🗒
    + ✅ ubuntu-advantage-tools on bionic for i386 @ 01.06.23 03:17:17 Log 🗒
    + ✅ ubuntu-advantage-tools on bionic for ppc64el @ 31.05.23 15:23:53 Log 🗒
  - ubuntu-advantage-tools/28~20.04~rc1
    + ✅ ubuntu-advantage-tools on focal for arm64 @ 31.05.23 22:38:53 Log 🗒
    + ✅ ubuntu-advantage-tools on focal for armhf @ 31.05.23 15:23:20 Log 🗒
    + ✅ ubuntu-advantage-tools on focal for ppc64el @ 31.05.23 15:24:49 Log 🗒
  - ubuntu-advantage-tools/28~22.04~rc1
    + ✅ ubuntu-advantage-tools on jammy for arm64 @ 01.06.23 00:58:01 Log 🗒
    + ✅ ubuntu-advantage-tools on jammy for armhf @ 31.05.23 15:30:03 Log 🗒
    + ✅ ubuntu-advantage-tools on jammy for ppc64el @ 31.05.23 15:23:18 Log 🗒
  - ubuntu-advantage-tools/28~22.10~rc1
    + ✅ ubuntu-advantage-tools on kinetic for amd64 @ 01.06.23 12:38:43 Log 🗒
    + ✅ ubuntu-advantage-tools on kinetic for armhf @ 31.05.23 15:21:52 Log 🗒
    + ✅ ubuntu-advantage-tools on kinetic for ppc64el @ 31.05.23 15:22:56 Log 🗒
  - ubuntu-advantage-tools/28~23.04~rc1
    + ✅ ubuntu-advantage-tools on lunar for armhf @ 31.05.23 15:21:03 Log 🗒
    + ✅ ubuntu-advantage-tools on lunar for ppc64el @ 31.05.23 15:23:05 Log 🗒
  - ubuntu-advantage-tools/28~rc1
    + ✅ ubuntu-advantage-tools on mantic for amd64 @ 31.05.23 15:25:13 Log 🗒
    + ✅ ubuntu-advantage-tools on mantic for arm64 @ 31.05.23 15:48:51 Log 🗒
    + ✅ ubuntu-advantage-tools on mantic for armhf @ 31.05.23 15:21:18 Log 🗒
    + ✅ ubuntu-advantage-tools on mantic for ppc64el @ 31.05.23 15:20:24 Log 🗒
    + ✅ ubuntu-advantage-tools on mantic for s390x @ 31.05.23 16:18:27 Log 🗒
* Waiting:
  # Q-num pkg release arch ppa trigger
  - 716 ubuntu-advantage-tools bionic s390x ua-client/staging ubuntu-advantage-tools/28~18.04~rc1
  - 60 ubuntu-advantage-tools focal amd64 ua-client/staging ubuntu-advantage-tools/28~20.04~rc1
  - 1340 ubuntu-advantage-tools focal s390x ua-client/staging ubuntu-advantage-tools/28~20.04~rc1
  - 1748 ubuntu-advantage-tools jammy s390x ua-client/staging ubuntu-advantage-tools/2...

[Lucas Kanashiro (lucaskanashiro)]

Thanks for addressing my comments Grant!

I built the package locally and then ran lintian against it, and I noticed that the lintian overrides that you have in place seems to not be working. I got the following lintian error:

E: ubuntu-advantage-tools source: missing-build-dependency-for-dh-addon systemd (does not satisfy debhelper:any (>= 9.20160709~) | debhelper-compat:any | dh-sequence-systemd:any | dh-systemd:any) [debian/rules]

I see you have it in d/source/lintian-overrides:

$ cat debian/source/lintian-overrides | grep dh-addon
ubuntu-advantage-tools: missing-build-dependency-for-dh-addon systemd => dh-systemd

Could we try to fix it? I saw the comment in d/control regarding this change.

There are also some lintian warnings that are not mandatory to fix TBH, but they are kind of annoying and some of them have a good reason to be ignored, so maybe documenting it via a lintian override is a good way. I am going to list all the warnings below and based on your judgement override them or not.

W: ubuntu-advantage-tools: command-with-path-in-maintainer-script /usr/bin/python3 (plain script) [postinst:113]
W: ubuntu-advantage-tools: command-with-path-in-maintainer-script /usr/bin/python3 (plain script) [postinst:281]
W: ubuntu-advantage-tools: command-with-path-in-maintainer-script /usr/bin/python3 (plain script) [postinst:347]
W: ubuntu-advantage-tools: command-with-path-in-maintainer-script /usr/bin/python3 (plain script) [prerm:6]

I believe you know what you are doing, hard-coding python3 interpreter there :)

W: ubuntu-advantage-tools: maintainer-script-calls-systemctl [postinst:255]
W: ubuntu-advantage-tools: maintainer-script-calls-systemctl [postinst:258]

Since in Ubuntu we support just systemd there I think it is fine to call it directly. Ideally, we should use deb-systemd-invoke.

W: ubuntu-advantage-tools source: mismatched-override missing-build-dependency-for-dh-addon systemd => dh-systemd [debian/source/lintian-overrides:3]

This warning should be fixed when we fix the lintian error mentioned above.

W: ubuntu-advantage-tools source: package-uses-deprecated-debhelper-compat-version 9

We can override this one, I understand you use debhelper compat level 9 because you backport this package to old releases.

W: ubuntu-advantage-tools: possible-bashism-in-maintainer-script 'machine_token_file.read()' [postinst:284]

This one is a false positive, this line is called in a python code snippet.

W: ubuntu-advantage-tools: possibly-insecure-handling-of-tmp-files-in-maintainer-script /tmp [postinst:58]

I also believe you know what you are doing :)

W: ubuntu-advantage-tools: uses-dpkg-database-directly [usr/lib/ubuntu-advantage/apt-esm-json-hook]

And I think this is needed.

In short, the lintian error I'd like to get it fixed before uploading it, but the warnings is up to you, feel free to override or ignore them :)

review: Needs Fixing

[Lucas Kanashiro (lucaskanashiro)]

While taking a look and executing the DEP-8 test, I noticed that it is really trivial. You should add 'superficial' to Restrictions to signalize that the successful pass of this test does not mean that your package is fully functional, since you are simply calling "ua --help" and "ua version". This may not be something you want to do now but I think you should do it at some point.

[Grant Orndorff (orndorffgrant)]

Thank you Lucas!

I think you've assessed the state of our lintian errors and warnings very well.

I've addressed the lintian error with an adjusted lintian-override in the latest commit I just pushed.

I've created issues on our GitHub repository to represent:
- overriding/resolving all of the lintian warnings: https://github.com/canonical/ubuntu-pro-client/issues/2608
- marking our current dep-8 tests as superficial: https://github.com/canonical/ubuntu-pro-client/issues/2609
- updating our dep-8 tests to be non-superficial: https://github.com/canonical/ubuntu-pro-client/issues/2610

Let me know if there is anything else!

[Lucas Kanashiro (lucaskanashiro)]

Thank you Grant! LGTM now, +1.

review: Approve

[Grant Orndorff (orndorffgrant)]

The final autopkgtests have finished

  - ubuntu-advantage-tools/28~18.04~rc1
    + ✅ ubuntu-advantage-tools on bionic for s390x @ 02.06.23 17:18:56 Log 🗒
  - ubuntu-advantage-tools/28~20.04~rc1
    + ✅ ubuntu-advantage-tools on focal for amd64 @ 01.06.23 19:02:55 Log 🗒
    + ✅ ubuntu-advantage-tools on focal for s390x @ 03.06.23 12:32:58 Log 🗒
  - ubuntu-advantage-tools/28~22.04~rc1
    + ✅ ubuntu-advantage-tools on jammy for amd64 @ 01.06.23 18:12:44 Log 🗒
    + ✅ ubuntu-advantage-tools on jammy for s390x @ 03.06.23 19:33:52 Log 🗒
  - ubuntu-advantage-tools/28~22.10~rc1
    + ✅ ubuntu-advantage-tools on kinetic for arm64 @ 01.06.23 20:39:32 Log 🗒
  - ubuntu-advantage-tools/28~23.04~rc1
    + ✅ ubuntu-advantage-tools on lunar for amd64 @ 02.06.23 15:01:23 Log 🗒
    + ✅ ubuntu-advantage-tools on lunar for arm64 @ 01.06.23 16:03:26 Log 🗒
    + ✅ ubuntu-advantage-tools on lunar for s390x @ 02.06.23 11:32:14 Log 🗒

[Robie Basak (racb)]

Thank you Lucas for the excellent summary and review! Generally this looks good to me with no specific issues from an SRU perspective. However I did notice an issue that I thought is severe enough to need attention. There's also one other minor request that doesn't need to block this.

---

[Must be fixed or needs further discussion]

> 1c9bc854 subp: use system environment vars by default

This is dangerous for a number of reasons:

1) env.update(os.environ) will update the *caller's* copy. This is made even
worse by run_apt_command defining env={} as a default, so this will not only
change the caller's copy, it will mutate that default.

2) If a caller were relying on overriding an option in the environment by
specifying it here, that will no longer work as the entry in os.environ will
override it. Have you checked all callers?

3) Doesn't this make for a really surprising API? I'd expect the API to be
identical to the Python subprocess module use of env. Failing that, one would
expect env=None to mean "use the current process environment, and if env is not
None, for this to mean that either the entries present should either override
the current process environment or that the entries present should be used
ignoring the current process environment (I think Python does the latter). The
behaviour should be clearly stated in the docstring. For it to instead be the
behaviour in the previous point is surprising.

Suggestions:

1. Stick to the Python library's meaning of env. This is what developers
expect, and then the docstring can just refer to the subprocess module's
behaviour.

2. Never use the "foo={}" default value pattern unless you're actually trying
to create globally mutable state. Always use foo=None, and if required, "if foo
is None: foo = {}" to make sure you get an empty one every time.

3. Fix issue 2527 without changing the subp API's definition of env. For
example you could add an additional_env parameter to subp to make it explicit,
instead of overloading the meaning of env. This could be implemented like this:

if additional_env:
    final_env = dict(env) if env else {}
    final_env.update(additional_env)

As I've done here, it's generally a good idea to use a different name for every
variable with different semantics instead of mutating an existing one - this is
why I did not do "env = dict(env)...".

I see lots of use of env={} and haven't inspected the entire call graph to
understand the use of env throughout. This probably needs doing to make sure
the design accommodates everything.

---

[Optional/feature]

Some files in systemd/* contain some excellent comments explaining to
interested users what the services do, the circumstances under which they
(won't) activate and how to turn them off. Other files are less well commented.
For example, "attach" is a term that we understand, but users disinterested in
Pro do not.

Commits 697bbac1 and 9cd7fe26 touch these files. Maybe this is an opportunity
to improve the comments?

review: Needs Fixing

[Grant Orndorff (orndorffgrant)]

Thank you Robie!

Yes that is an excellent point about our overall usage of "env" and we should fix it. After taking a look at all of our uses of that argument, I've discovered that it is exclusively there to support setting DEBIAN_FRONTEND=noninteractive for some apt subprocesses. With that in mind, I've created an upstream PR that changes the name and the semantics of the argument to be more in line with what we're using it for. That includes changing it so that the arg overrides os.environ instead of the other way around. I've also tried to address your points about mutating caller args and mutable default args in the refactor.

Please take a look here when you have time: https://github.com/canonical/ubuntu-pro-client/pull/2623

I also went ahead and included more explanatory comments in our systemd unit files in that same PR - separate commit. Let me know if you think they make sense to include now or if not then we can workshop them and add them later.

[Robie Basak (racb)]

> I also went ahead and included more explanatory comments in our systemd unit files in that same PR - separate commit. Let me know if you think they make sense to include now or if not then we can workshop them and add them later.

I think it makes sense to include now, assuming that's easiest for you. Fine if not.

[Grant Orndorff (orndorffgrant)]

Thank you for the upstream review Robie!

We merged the fix upstream, and I just included it here in this branch. Please double check the last two commits I just pushed and let me know if you find anything else that needs fixing.

[Lucas Kanashiro (lucaskanashiro)]

Thanks for the fixes Grant! I talked to Robie and he asked me just to make sure that what you proposed here matches the changes he approved in the upstream PR. I checked and the changes are the same. I'll be uploading those changes to Mantic.

review: Approve

[Lucas Kanashiro (lucaskanashiro)]

Package uploaded:

Uploading ubuntu-advantage-tools_28.dsc
Uploading ubuntu-advantage-tools_28.tar.xz
Uploading ubuntu-advantage-tools_28_source.changes

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index abf1338..7faa407 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,5 +1,13 @@
-## Proposed Commit Message
-<!-- Include a proposed commit message because all PRs can be merged in a variety of ways by the reviewer -->
+## Why is this needed?
+<!-- This information should be captured in your commit messages, so any description here can be very brief -->
+This PR solves all of our problems because...
+
+<!--
+By default, we rebase PRs and will ask for a clean well-organized commit history in the PR before rebasing.
+If your PR is small enough and you prefer, uncomment the following section and fill it out to request a squashed PR.
+-->
+<!--
+## Please Squash this PR with this commit message
 
 ```
 summary: no more than 70 characters
@@ -14,6 +22,7 @@ If you need to write multiple paragraphs, feel free.
 LP: #NNNNNNN (replace with the appropriate Launchpad bug reference if applicable)
 Fixes: #NNNNNNN (replace with the appropriate github issue if applicable)
 ```
+-->
 
 ## Test Steps
 <!-- Please include any steps necessary to verify (and reproduce if
@@ -21,6 +30,16 @@ this is a bug fix) this change on a live deployed system,
 including any necessary configuration files, user-data,
 setup, and teardown. Scripts used may be attached directly to this PR. -->
 
+<!-- Example:
+```
+env SHELL_BEFORE=1 ./tools/test-in-lxd.sh xenial
+# Set up test scenario before upgrade
+exit # new version gets installed after exit and lxc shell is re-started
+sudo pro new-sub-command --new-flag
+# Assert something
+```
+-->
+
 ## Checklist
 <!-- Go over all the following points, and put an `x` in all the boxes
 that apply. -->
diff --git a/.github/actions/bug-refs/action.yml b/.github/actions/bug-refs/action.yml
new file mode 100644
index 0000000..458d152
--- /dev/null
+++ b/.github/actions/bug-refs/action.yml
@@ -0,0 +1,9 @@
+name: 'Require Bug References'
+description: 'Block PRs on missing bug references'
+inputs:
+  repo-token:
+    description: 'Token for the repository. Can be passed in using {{ secrets.GITHUB_TOKEN }}'
+    required: true
+runs:
+  using: 'node16'
+  main: 'index.js'
diff --git a/.github/actions/bug-refs/index.js b/.github/actions/bug-refs/index.js
new file mode 100644
index 0000000..b603793
--- /dev/null
+++ b/.github/actions/bug-refs/index.js
@@ -0,0 +1,107 @@
+const core = require('@actions/core');
+const github = require('@actions/github');
+
+const commentHeader = "<!-- ubuntu-pro-client-bug-refs -->";
+
+function createCommentBody(commits, title) {
+    let newComment = "";
+    newComment += commentHeader;
+    newComment += "\n";
+
+    newComment += "Jira: ";
+    const jiraMatches = title.toLocaleUpperCase().match(/SC-\d+/g);
+    if (jiraMatches === null || jiraMatches.length === 0) {
+        newComment += "This PR is not related to a Jira item. (The PR title does not include a SC-#### reference)\n";
+    } else {
+        const jiraID = jiraMatches[0];
+        newComment += `[${jiraID}](https://warthogs.atlassian.net/browse/${jiraID})\n`;
+    }
+    newComment += "\n";
+
+    let lpBugs = [];
+    let ghIssues = [];
+    commits.forEach(commit => {
+        const message = commit.commit.message.toLocaleUpperCase();
+        lpBugs = lpBugs.concat(Array.from(message.matchAll(/LP: #(\d+)/g)).map(m => m[1]));
+        ghIssues = ghIssues.concat(Array.from(message.matchAll(/FIXES: #(\d+)/g)).map(m => m[1]));
+        ghIssues = ghIssues.concat(Array.from(message.matchAll(/CLOSES: #(\d+)/g)).map(m => m[1]));
+    });
+
+    newComment += "GitHub Issues:";
+    if (ghIssues.length === 0) {
+        newComment += " No GitHub issues are fixed by this PR. (No commits have Fixes: #### references)\n";
+    } else {
+        newComment += "\n";
+        ghIssues.forEach(issue => {
+            newComment += `- Fixes: #${issue}\n`;
+        });
+    }
+    newComment += "\n";
+
+    newComment += "Launchpad Bugs:";
+    if (lpBugs.length === 0) {
+        newComment += " No Launchpad bugs are fixed by this PR. (No commits have LP: #### references)\n";
+    } else {
+        newComment += "\n";
+        lpBugs.forEach(bug => {
+            newComment += `- LP: [#${bug}](https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/${bug})\n`;
+        });
+    }
+    newComment += "\n";
+
+    newComment += "👍 this comment to confirm that this is correct.";
+
+    return newComment;
+}
+
+async function run() {
+    const context = github.context;
+    if (context.eventName !== "pull_request") {
+      console.log(
+        'The event that triggered this action was not a pull request, skipping.'
+      );
+      return;
+    }
+
+    const client = github.getOctokit(
+        core.getInput('repo-token', {required: true})
+    );
+    const commits = await client.rest.pulls.listCommits({
+        owner: context.issue.owner,
+        repo: context.issue.repo,
+        pull_number: context.issue.number,
+    });
+    const comments = await client.rest.issues.listComments({
+        owner: context.issue.owner,
+        repo: context.issue.repo,
+        issue_number: context.issue.number,
+    });
+    const theComment = comments.data.find(c => c.body.includes(commentHeader));
+    if (theComment) {
+        // comment already exists, update it appropriately
+        const existingBody = theComment.body;
+        const newBody = createCommentBody(commits.data, context.payload.pull_request.title);
+        if (existingBody !== newBody) {
+            client.rest.issues.updateComment({
+                owner: context.issue.owner,
+                repo: context.issue.repo,
+                comment_id: theComment.id,
+                body: newBody,
+            });
+        }
+    } else {
+        // first run, comment doesn't exist yet
+        const newBody = createCommentBody(commits.data, context.payload.pull_request.title);
+        client.rest.issues.createComment({
+            owner: context.issue.owner,
+            repo: context.issue.repo,
+            issue_number: context.issue.number,
+            body: newBody,
+        });
+    }
+}
+
+run().catch(error => {
+    console.error(error);
+    core.setFailed(error.message);
+})
diff --git a/.github/actions/bug-refs/package-lock.json b/.github/actions/bug-refs/package-lock.json
new file mode 100644
index 0000000..f9ad26b
--- /dev/null
+++ b/.github/actions/bug-refs/package-lock.json
@@ -0,0 +1,430 @@
+{
+  "name": "bug-refs",
+  "version": "1.0.0",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "bug-refs",
+      "version": "1.0.0",
+      "dependencies": {
+        "@actions/core": "^1.10.0",
+        "@actions/github": "^5.1.1"
+      }
+    },
+    "node_modules/@actions/core": {
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.0.tgz",
+      "integrity": "sha512-2aZDDa3zrrZbP5ZYg159sNoLRb61nQ7awl5pSvIq5Qpj81vwDzdMRKzkWJGJuwVvWpvZKx7vspJALyvaaIQyug==",
+      "dependencies": {
+        "@actions/http-client": "^2.0.1",
+        "uuid": "^8.3.2"
+      }
+    },
+    "node_modules/@actions/github": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-5.1.1.tgz",
+      "integrity": "sha512-Nk59rMDoJaV+mHCOJPXuvB1zIbomlKS0dmSIqPGxd0enAXBnOfn4VWF+CGtRCwXZG9Epa54tZA7VIRlJDS8A6g==",
+      "dependencies": {
+        "@actions/http-client": "^2.0.1",
+        "@octokit/core": "^3.6.0",
+        "@octokit/plugin-paginate-rest": "^2.17.0",
+        "@octokit/plugin-rest-endpoint-methods": "^5.13.0"
+      }
+    },
+    "node_modules/@actions/http-client": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.1.0.tgz",
+      "integrity": "sha512-BonhODnXr3amchh4qkmjPMUO8mFi/zLaaCeCAJZqch8iQqyDnVIkySjB38VHAC8IJ+bnlgfOqlhpyCUZHlQsqw==",
+      "dependencies": {
+        "tunnel": "^0.0.6"
+      }
+    },
+    "node_modules/@octokit/auth-token": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-2.5.0.tgz",
+      "integrity": "sha512-r5FVUJCOLl19AxiuZD2VRZ/ORjp/4IN98Of6YJoJOkY75CIBuYfmiNHGrDwXr+aLGG55igl9QrxX3hbiXlLb+g==",
+      "dependencies": {
+        "@octokit/types": "^6.0.3"
+      }
+    },
+    "node_modules/@octokit/core": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-3.6.0.tgz",
+      "integrity": "sha512-7RKRKuA4xTjMhY+eG3jthb3hlZCsOwg3rztWh75Xc+ShDWOfDDATWbeZpAHBNRpm4Tv9WgBMOy1zEJYXG6NJ7Q==",
+      "dependencies": {
+        "@octokit/auth-token": "^2.4.4",
+        "@octokit/graphql": "^4.5.8",
+        "@octokit/request": "^5.6.3",
+        "@octokit/request-error": "^2.0.5",
+        "@octokit/types": "^6.0.3",
+        "before-after-hook": "^2.2.0",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/endpoint": {
+      "version": "6.0.12",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-6.0.12.tgz",
+      "integrity": "sha512-lF3puPwkQWGfkMClXb4k/eUT/nZKQfxinRWJrdZaJO85Dqwo/G0yOC434Jr2ojwafWJMYqFGFa5ms4jJUgujdA==",
+      "dependencies": {
+        "@octokit/types": "^6.0.3",
+        "is-plain-object": "^5.0.0",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/graphql": {
+      "version": "4.8.0",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-4.8.0.tgz",
+      "integrity": "sha512-0gv+qLSBLKF0z8TKaSKTsS39scVKF9dbMxJpj3U0vC7wjNWFuIpL/z76Qe2fiuCbDRcJSavkXsVtMS6/dtQQsg==",
+      "dependencies": {
+        "@octokit/request": "^5.6.0",
+        "@octokit/types": "^6.0.3",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/openapi-types": {
+      "version": "12.11.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-12.11.0.tgz",
+      "integrity": "sha512-VsXyi8peyRq9PqIz/tpqiL2w3w80OgVMwBHltTml3LmVvXiphgeqmY9mvBw9Wu7e0QWk/fqD37ux8yP5uVekyQ=="
+    },
+    "node_modules/@octokit/plugin-paginate-rest": {
+      "version": "2.21.3",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-2.21.3.tgz",
+      "integrity": "sha512-aCZTEf0y2h3OLbrgKkrfFdjRL6eSOo8komneVQJnYecAxIej7Bafor2xhuDJOIFau4pk0i/P28/XgtbyPF0ZHw==",
+      "dependencies": {
+        "@octokit/types": "^6.40.0"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=2"
+      }
+    },
+    "node_modules/@octokit/plugin-rest-endpoint-methods": {
+      "version": "5.16.2",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-5.16.2.tgz",
+      "integrity": "sha512-8QFz29Fg5jDuTPXVtey05BLm7OB+M8fnvE64RNegzX7U+5NUXcOcnpTIK0YfSHBg8gYd0oxIq3IZTe9SfPZiRw==",
+      "dependencies": {
+        "@octokit/types": "^6.39.0",
+        "deprecation": "^2.3.1"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=3"
+      }
+    },
+    "node_modules/@octokit/request": {
+      "version": "5.6.3",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-5.6.3.tgz",
+      "integrity": "sha512-bFJl0I1KVc9jYTe9tdGGpAMPy32dLBXXo1dS/YwSCTL/2nd9XeHsY616RE3HPXDVk+a+dBuzyz5YdlXwcDTr2A==",
+      "dependencies": {
+        "@octokit/endpoint": "^6.0.1",
+        "@octokit/request-error": "^2.1.0",
+        "@octokit/types": "^6.16.1",
+        "is-plain-object": "^5.0.0",
+        "node-fetch": "^2.6.7",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/request-error": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-2.1.0.tgz",
+      "integrity": "sha512-1VIvgXxs9WHSjicsRwq8PlR2LR2x6DwsJAaFgzdi0JfJoGSO8mYI/cHJQ+9FbN21aa+DrgNLnwObmyeSC8Rmpg==",
+      "dependencies": {
+        "@octokit/types": "^6.0.3",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      }
+    },
+    "node_modules/@octokit/types": {
+      "version": "6.41.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-6.41.0.tgz",
+      "integrity": "sha512-eJ2jbzjdijiL3B4PrSQaSjuF2sPEQPVCPzBvTHJD9Nz+9dw2SGH4K4xeQJ77YfTq5bRQ+bD8wT11JbeDPmxmGg==",
+      "dependencies": {
+        "@octokit/openapi-types": "^12.11.0"
+      }
+    },
+    "node_modules/before-after-hook": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
+      "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ=="
+    },
+    "node_modules/deprecation": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
+      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ=="
+    },
+    "node_modules/is-plain-object": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
+      "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/node-fetch": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.9.tgz",
+      "integrity": "sha512-DJm/CJkZkRjKKj4Zi4BsKVZh3ValV5IR5s7LVZnW+6YMh0W1BfNA8XSs6DLMGYlId5F3KnA70uu2qepcR08Qqg==",
+      "dependencies": {
+        "whatwg-url": "^5.0.0"
+      },
+      "engines": {
+        "node": "4.x || >=6.0.0"
+      },
+      "peerDependencies": {
+        "encoding": "^0.1.0"
+      },
+      "peerDependenciesMeta": {
+        "encoding": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="
+    },
+    "node_modules/tunnel": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
+      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==",
+      "engines": {
+        "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
+      }
+    },
+    "node_modules/universal-user-agent": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.0.tgz",
+      "integrity": "sha512-isyNax3wXoKaulPDZWHQqbmIx1k2tb9fb3GGDBRxCscfYV2Ch7WxPArBsFEG8s/safwXTT7H4QGhaIkTp9447w=="
+    },
+    "node_modules/uuid": {
+      "version": "8.3.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
+    },
+    "node_modules/webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ=="
+    },
+    "node_modules/whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
+      "dependencies": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  },
+  "dependencies": {
+    "@actions/core": {
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.0.tgz",
+      "integrity": "sha512-2aZDDa3zrrZbP5ZYg159sNoLRb61nQ7awl5pSvIq5Qpj81vwDzdMRKzkWJGJuwVvWpvZKx7vspJALyvaaIQyug==",
+      "requires": {
+        "@actions/http-client": "^2.0.1",
+        "uuid": "^8.3.2"
+      }
+    },
+    "@actions/github": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-5.1.1.tgz",
+      "integrity": "sha512-Nk59rMDoJaV+mHCOJPXuvB1zIbomlKS0dmSIqPGxd0enAXBnOfn4VWF+CGtRCwXZG9Epa54tZA7VIRlJDS8A6g==",
+      "requires": {
+        "@actions/http-client": "^2.0.1",
+        "@octokit/core": "^3.6.0",
+        "@octokit/plugin-paginate-rest": "^2.17.0",
+        "@octokit/plugin-rest-endpoint-methods": "^5.13.0"
+      }
+    },
+    "@actions/http-client": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.1.0.tgz",
+      "integrity": "sha512-BonhODnXr3amchh4qkmjPMUO8mFi/zLaaCeCAJZqch8iQqyDnVIkySjB38VHAC8IJ+bnlgfOqlhpyCUZHlQsqw==",
+      "requires": {
+        "tunnel": "^0.0.6"
+      }
+    },
+    "@octokit/auth-token": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-2.5.0.tgz",
+      "integrity": "sha512-r5FVUJCOLl19AxiuZD2VRZ/ORjp/4IN98Of6YJoJOkY75CIBuYfmiNHGrDwXr+aLGG55igl9QrxX3hbiXlLb+g==",
+      "requires": {
+        "@octokit/types": "^6.0.3"
+      }
+    },
+    "@octokit/core": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-3.6.0.tgz",
+      "integrity": "sha512-7RKRKuA4xTjMhY+eG3jthb3hlZCsOwg3rztWh75Xc+ShDWOfDDATWbeZpAHBNRpm4Tv9WgBMOy1zEJYXG6NJ7Q==",
+      "requires": {
+        "@octokit/auth-token": "^2.4.4",
+        "@octokit/graphql": "^4.5.8",
+        "@octokit/request": "^5.6.3",
+        "@octokit/request-error": "^2.0.5",
+        "@octokit/types": "^6.0.3",
+        "before-after-hook": "^2.2.0",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "@octokit/endpoint": {
+      "version": "6.0.12",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-6.0.12.tgz",
+      "integrity": "sha512-lF3puPwkQWGfkMClXb4k/eUT/nZKQfxinRWJrdZaJO85Dqwo/G0yOC434Jr2ojwafWJMYqFGFa5ms4jJUgujdA==",
+      "requires": {
+        "@octokit/types": "^6.0.3",
+        "is-plain-object": "^5.0.0",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "@octokit/graphql": {
+      "version": "4.8.0",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-4.8.0.tgz",
+      "integrity": "sha512-0gv+qLSBLKF0z8TKaSKTsS39scVKF9dbMxJpj3U0vC7wjNWFuIpL/z76Qe2fiuCbDRcJSavkXsVtMS6/dtQQsg==",
+      "requires": {
+        "@octokit/request": "^5.6.0",
+        "@octokit/types": "^6.0.3",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "@octokit/openapi-types": {
+      "version": "12.11.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-12.11.0.tgz",
+      "integrity": "sha512-VsXyi8peyRq9PqIz/tpqiL2w3w80OgVMwBHltTml3LmVvXiphgeqmY9mvBw9Wu7e0QWk/fqD37ux8yP5uVekyQ=="
+    },
+    "@octokit/plugin-paginate-rest": {
+      "version": "2.21.3",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-2.21.3.tgz",
+      "integrity": "sha512-aCZTEf0y2h3OLbrgKkrfFdjRL6eSOo8komneVQJnYecAxIej7Bafor2xhuDJOIFau4pk0i/P28/XgtbyPF0ZHw==",
+      "requires": {
+        "@octokit/types": "^6.40.0"
+      }
+    },
+    "@octokit/plugin-rest-endpoint-methods": {
+      "version": "5.16.2",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-5.16.2.tgz",
+      "integrity": "sha512-8QFz29Fg5jDuTPXVtey05BLm7OB+M8fnvE64RNegzX7U+5NUXcOcnpTIK0YfSHBg8gYd0oxIq3IZTe9SfPZiRw==",
+      "requires": {
+        "@octokit/types": "^6.39.0",
+        "deprecation": "^2.3.1"
+      }
+    },
+    "@octokit/request": {
+      "version": "5.6.3",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-5.6.3.tgz",
+      "integrity": "sha512-bFJl0I1KVc9jYTe9tdGGpAMPy32dLBXXo1dS/YwSCTL/2nd9XeHsY616RE3HPXDVk+a+dBuzyz5YdlXwcDTr2A==",
+      "requires": {
+        "@octokit/endpoint": "^6.0.1",
+        "@octokit/request-error": "^2.1.0",
+        "@octokit/types": "^6.16.1",
+        "is-plain-object": "^5.0.0",
+        "node-fetch": "^2.6.7",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "@octokit/request-error": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-2.1.0.tgz",
+      "integrity": "sha512-1VIvgXxs9WHSjicsRwq8PlR2LR2x6DwsJAaFgzdi0JfJoGSO8mYI/cHJQ+9FbN21aa+DrgNLnwObmyeSC8Rmpg==",
+      "requires": {
+        "@octokit/types": "^6.0.3",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      }
+    },
+    "@octokit/types": {
+      "version": "6.41.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-6.41.0.tgz",
+      "integrity": "sha512-eJ2jbzjdijiL3B4PrSQaSjuF2sPEQPVCPzBvTHJD9Nz+9dw2SGH4K4xeQJ77YfTq5bRQ+bD8wT11JbeDPmxmGg==",
+      "requires": {
+        "@octokit/openapi-types": "^12.11.0"
+      }
+    },
+    "before-after-hook": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
+      "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ=="
+    },
+    "deprecation": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
+      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ=="
+    },
+    "is-plain-object": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
+      "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q=="
+    },
+    "node-fetch": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.9.tgz",
+      "integrity": "sha512-DJm/CJkZkRjKKj4Zi4BsKVZh3ValV5IR5s7LVZnW+6YMh0W1BfNA8XSs6DLMGYlId5F3KnA70uu2qepcR08Qqg==",
+      "requires": {
+        "whatwg-url": "^5.0.0"
+      }
+    },
+    "once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "requires": {
+        "wrappy": "1"
+      }
+    },
+    "tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="
+    },
+    "tunnel": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
+      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="
+    },
+    "universal-user-agent": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.0.tgz",
+      "integrity": "sha512-isyNax3wXoKaulPDZWHQqbmIx1k2tb9fb3GGDBRxCscfYV2Ch7WxPArBsFEG8s/safwXTT7H4QGhaIkTp9447w=="
+    },
+    "uuid": {
+      "version": "8.3.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="
+    },
+    "webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ=="
+    },
+    "whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
+      "requires": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    },
+    "wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  }
+}
diff --git a/.github/actions/bug-refs/package.json b/.github/actions/bug-refs/package.json
new file mode 100644
index 0000000..14ceb07
--- /dev/null
+++ b/.github/actions/bug-refs/package.json
@@ -0,0 +1,10 @@
+{
+  "name": "bug-refs",
+  "version": "1.0.0",
+  "description": "Block PRs on missing bug references",
+  "main": "index.js",
+  "dependencies": {
+    "@actions/core": "^1.10.0",
+    "@actions/github": "^5.1.1"
+  }
+}
diff --git a/.github/workflows/ci-base.yaml b/.github/workflows/ci-base.yaml
index 59174bf..dab17d3 100644
--- a/.github/workflows/ci-base.yaml
+++ b/.github/workflows/ci-base.yaml
@@ -29,6 +29,8 @@ jobs:
         run: tox -e mypy
       - name: Version Consistency
         run: python3 ./tools/check-versions-are-consistent.py
+      - name: Docs
+        run: tox -e docs
   unit-tests:
     name: Unit Tests
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/ci-integration.yaml b/.github/workflows/ci-integration.yaml
index 62df9e3..937de39 100644
--- a/.github/workflows/ci-integration.yaml
+++ b/.github/workflows/ci-integration.yaml
@@ -92,6 +92,9 @@ jobs:
           # in a way that is incompatible with lxd.
           # https://linuxcontainers.org/lxd/docs/master/howto/network_bridge_firewalld/#prevent-issues-with-lxd-and-docker
           sudo iptables -I DOCKER-USER -j ACCEPT
+      - name: Refresh LXD
+        if: matrix.platform == 'lxd' || matrix.platform == 'vm'
+        run: sudo snap refresh --channel latest/stable lxd
       - name: Initialize LXD
         if: matrix.platform == 'lxd' || matrix.platform == 'vm'
         run: sudo lxd init --auto
diff --git a/.github/workflows/custom_pr_checks.yaml b/.github/workflows/custom_pr_checks.yaml
new file mode 100644
index 0000000..b3be667
--- /dev/null
+++ b/.github/workflows/custom_pr_checks.yaml
@@ -0,0 +1,27 @@
+---
+
+name: Custom PR Checks
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+    branches:
+      - main
+
+jobs:
+  bug-refs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Git checkout
+        uses: actions/checkout@v3
+      - name: Install dependencies
+        run: cd ./.github/actions/bug-refs && npm install
+      - name: Check for bug references
+        uses: ./.github/actions/bug-refs
+        id: bug-refs
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 829d39d..d3ba122 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -4,7 +4,7 @@ repos:
     hooks:
     - id: black
   - repo: https://github.com/pycqa/isort
-    rev: 5.8.0  # Also stored in dev-requirements.txt; update both together!
+    rev: 5.12.0  # Also stored in dev-requirements.txt; update both together!
     hooks:
     - id: isort
   - repo: https://github.com/shellcheck-py/shellcheck-py
diff --git a/apport/source_ubuntu-advantage-tools.py b/apport/source_ubuntu-advantage-tools.py
index 193d557..f2c4f1a 100644
--- a/apport/source_ubuntu-advantage-tools.py
+++ b/apport/source_ubuntu-advantage-tools.py
@@ -2,6 +2,7 @@ import os
 import tempfile
 
 from apport.hookutils import attach_file_if_exists
+from uaclient import defaults
 from uaclient.actions import collect_logs
 from uaclient.config import UAConfig
 
@@ -12,7 +13,7 @@ def add_info(report, ui=None):
     cfg = UAConfig()
     with tempfile.TemporaryDirectory() as output_dir:
         collect_logs(cfg, output_dir)
-        auto_include_log_files = [
+        auto_include_log_files = {
             "cloud-id.txt",
             "cloud-id.txt-error",
             "ua-status.json",
@@ -24,6 +25,9 @@ def add_info(report, ui=None):
             os.path.basename(cfg.timer_log_file),
             os.path.basename(cfg.daemon_log_file),
             os.path.basename(cfg.data_path("jobs-status")),
-        ]
+            os.path.basename(defaults.CONFIG_DEFAULTS["log_file"]),
+            os.path.basename(defaults.CONFIG_DEFAULTS["timer_log_file"]),
+            os.path.basename(defaults.CONFIG_DEFAULTS["daemon_log_file"]),
+        }
         for f in auto_include_log_files:
             attach_file_if_exists(report, os.path.join(output_dir, f), key=f)
diff --git a/apt-hook/json-hook.cc b/apt-hook/json-hook.cc
index 1d36bd2..61548b7 100644
--- a/apt-hook/json-hook.cc
+++ b/apt-hook/json-hook.cc
@@ -218,13 +218,17 @@ CloudID get_cloud_id() {
     return ret;
 }
 
-bool is_xenial() {
+enum ESMInfraSeries {NOT_ESM_INFRA, XENIAL, BIONIC};
+
+ESMInfraSeries get_esm_infra_series() {
     std::ifstream os_release_file("/etc/os-release");
-    bool ret = false;
+    ESMInfraSeries ret = NOT_ESM_INFRA;
     if (os_release_file.is_open()) {
         std::string os_release_str((std::istreambuf_iterator<char>(os_release_file)), (std::istreambuf_iterator<char>()));
         if (os_release_str.find("xenial") != os_release_str.npos) {
-            ret = true;
+            ret = XENIAL;
+        } else if (os_release_str.find("bionic") != os_release_str.npos) {
+            ret = BIONIC;
         }
         os_release_file.close();
     }
@@ -238,27 +242,39 @@ struct ESMContext {
 
 ESMContext get_esm_context() {
     CloudID cloud_id = get_cloud_id();
-    bool is_x = is_xenial();
+    ESMInfraSeries esm_infra_series = get_esm_infra_series();
 
     ESMContext ret;
     ret.context = "";
     ret.url = "https://ubuntu.com/pro";
 
-    if (cloud_id != AZURE && is_x) {
-        ret.context = " for 16.04";
-        ret.url = "https://ubuntu.com/16-04";
-    } else if (cloud_id == AZURE && !is_x) {
-        ret.context = " on Azure";
-        ret.url = "https://ubuntu.com/azure/pro";
-    } else if (cloud_id == AZURE && is_x) {
-        ret.context = " for 16.04 on Azure";
-        ret.url = "https://ubuntu.com/16-04/azure";
-    } else if (cloud_id == AWS && !is_x) {
-        ret.context = " on AWS";
-        ret.url = "https://ubuntu.com/aws/pro";
-    } else if (cloud_id == GCE && !is_x) {
-        ret.context = " on GCP";
-        ret.url = "https://ubuntu.com/gcp/pro";
+    if (esm_infra_series == XENIAL) {
+        if (cloud_id == AZURE) {
+            ret.context = " for 16.04 on Azure";
+            ret.url = "https://ubuntu.com/16-04/azure";
+        } else {
+            ret.context = " for 16.04";
+            ret.url = "https://ubuntu.com/16-04";
+        }
+    } else if (esm_infra_series == BIONIC) {
+        if (cloud_id == AZURE) {
+            ret.context = " for 18.04 on Azure";
+            ret.url = "https://ubuntu.com/18-04/azure";
+        } else {
+            ret.context = " for 18.04";
+            ret.url = "https://ubuntu.com/18-04";
+        }
+    } else {
+        if (cloud_id == AZURE) {
+            ret.context = " on Azure";
+            ret.url = "https://ubuntu.com/azure/pro";
+        } else if (cloud_id == AWS) {
+            ret.context = " on AWS";
+            ret.url = "https://ubuntu.com/aws/pro";
+        } else if (cloud_id == GCE) {
+            ret.context = " on GCP";
+            ret.url = "https://ubuntu.com/gcp/pro";
+        }
     }
 
     return ret;
diff --git a/apt.conf.d/51ubuntu-advantage-esm b/apt.conf.d/51ubuntu-advantage-esm
deleted file mode 100644
index e9b1c3a..0000000
--- a/apt.conf.d/51ubuntu-advantage-esm
+++ /dev/null
@@ -1,6 +0,0 @@
-Unattended-Upgrade::Allowed-Origins {
-  "${distro_id}ESM:${distro_codename}-infra-security";
-};
-Unattended-Upgrade::Allowed-Origins {
-  "${distro_id}ESMApps:${distro_codename}-apps-security";
-};
diff --git a/debian/changelog b/debian/changelog
index 69290bb..6a53910 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,57 @@
+ubuntu-advantage-tools (28) mantic; urgency=medium
+
+  * d/ubuntu-advantage-tools.postinst:
+    - more specific regex for ua_config warning
+  * d/source/lintian-overrides
+    - adjust missing-build-dependency-for-dh-addon systemd override to work
+      for the different but related error message on jammy onwards
+  * New upstream release 28 (LP: #2017949)
+    - api:
+      + new endpoint: u.pro.status.is_attached.v1
+      + new endpoint: u.pro.status.enabled_services.v1
+    - apport: collect default log files if present for bug reports
+    - apt messaging: add bionic-specific urls
+    - auto-attach:
+      + check for new Azure UBUNTU_PRO license on-boot of non-pro instances
+      + exit 4 if attach succeeds but service enablement fails
+    - cli:
+      + avoid unnecessary network calls during autocomplete (GH: #2556)
+      + warn users to not rely on human-readable output in scripts
+    - config: no longer load uaclient.conf from current working directory
+    - fix:
+      + add support for --no-related flag
+      + separate target USN from related USNs
+    - general:
+      + logs to user cache directory when run as non-root
+      + fix bug where non-root commands failed with file permission error
+        accessing /tmp/ubuntu-advantage (GH: #2567)
+      + use system environment vars by default in sub processes (GH: #2527)
+      + fall back to /usr/lib/os-release for release info
+      + start logging to default log file until config is loaded
+      + remove small timeout from contract checking request
+      + avoid crashes when processing unicode text (LP: #2019729)
+    - livepatch:
+      + use uname.machine for kernel arch when checking support
+        (GH: #2517)
+      + display tailored warning messages for granular support statuses
+    - realtime-kernel: add support for intel-iotg variant
+    - reboot-required: new criteria for "yes-kernel-livepatches-applied"
+      livepatch status must be either "applied" or "nothing-to-apply" and
+      livepatch support status must say "supported"
+    - security-status:
+      + always show available/installed counts for esm packages
+      + include hint to run apt-get update for up-to-date info (GH: #2443)
+      + improve visibility of installed and available updates (GH: #2442)
+      + change package info message hint to recommend apt-cache show
+      + avoids unnecessary network calls (LP: #2015286, GH: #2536)
+    - systemd: update service unit for reboot_cmds to not run if not attached
+    - status:
+      + add hint for pro status --all
+      + better message if no services are available (LP: #1994923)
+    - timer: only run timer when attached
+
+ -- Grant Orndorff <[e-mail]>  Thu, 27 Apr 2023 16:34:55 -0400
+
 ubuntu-advantage-tools (27.14.4) lunar; urgency=medium
 
   * timer: disable update_contract_info job (LP: #2015302)
diff --git a/debian/source/lintian-overrides b/debian/source/lintian-overrides
index e7419bd..b1ce79a 100644
--- a/debian/source/lintian-overrides
+++ b/debian/source/lintian-overrides
@@ -1,6 +1,8 @@
 # Lintian doesn't see dh-systemd alternative when building on xenial
 ubuntu-advantage-tools: missing-build-dependency-for-dh_-command dh_systemd_start => dh-systemd
-ubuntu-advantage-tools: missing-build-dependency-for-dh-addon systemd => dh-systemd
+
+# Lintian can't handle the multiline debhelper/dh-systemd dependencies explained in debian/control
+ubuntu-advantage-tools: missing-build-dependency-for-dh-addon *systemd*
 
 # Lintian doesn't like mentioning riscv64 for older go package
 ubuntu-advantage-tools: invalid-arch-string-in-source-relation riscv64 [build-depends: golang-1.10-go [!powerpc !riscv64]]
diff --git a/debian/ubuntu-advantage-tools.postinst b/debian/ubuntu-advantage-tools.postinst
index 7d9d03e..31d93ae 100644
--- a/debian/ubuntu-advantage-tools.postinst
+++ b/debian/ubuntu-advantage-tools.postinst
@@ -452,7 +452,7 @@ case "$1" in
           migrate_user_config_post
       fi
 
-      if grep -q "ua_config:" /etc/ubuntu-advantage/uaclient.conf; then
+      if grep -q "^ua_config:" /etc/ubuntu-advantage/uaclient.conf; then
           echo "Warning: uaclient.conf contains old ua_config field." >&2
           echo "         Please do the following:" >&2
           echo "         1. Run 'pro config set field=value' for each field/value pair" >&2
diff --git a/dev-docs/explanations/systemd_units.md b/dev-docs/explanations/systemd_units.md
index b5f4f0a..577960a 100644
--- a/dev-docs/explanations/systemd_units.md
+++ b/dev-docs/explanations/systemd_units.md
@@ -6,8 +6,8 @@
 There are three methods by which a cloud instance may auto-attach to become Ubuntu Pro.
 
 1. On boot auto-attach for known Pro cloud instances.
-2. Upgrade-in-place for non-Pro instances that get modified via the Cloud platform to entitle them to become Ubuntu Pro (only on GCP for now)
-3. Retry auto-attach in case of failures
+2. Upgrade-in-place for non-Pro instances that get modified via the Cloud platform to entitle them to become Ubuntu Pro (only on Azure and GCP for now).
+3. Retry auto-attach in case of failures.
 
 (1) is handled by a systemd unit (`ua-auto-attach.service`) delivered by a separate package called `ubuntu-advantage-pro`. This package is only installed on Ubuntu Pro Cloud images. In this way, an instance launched from an Ubuntu Pro Cloud image knows that it needs to auto-attach.
 
@@ -22,8 +22,8 @@ graph TD;
     is_pro{Is -pro installed?}
     auto_outcome{Success?}
     is_attached{Attached?}
-    should_run_daemon{on GCP? or retry flag set?}
-    is_gcp{GCP?}
+    should_run_daemon{on Azure? or GCP? or retry flag set?}
+    is_gcp{Azure or GCP?}
     is_retry{retry flag set?}
     is_gcp_pro{Pro license detected?}
     daemon_attach_outcome{Success?}
@@ -33,11 +33,11 @@ graph TD;
     auto_attach[/Try to Attach/]
     trigger_retry[/Create Retry Flag File/]
     trigger_retry2[/Create Retry Flag File/]
-    poll_gcp[/Poll for GCP Pro license/]
+    poll_gcp[/Poll for cloud Pro license/]
     daemon_attach[/Try to Attach/]
     daemon_attach2[/Try to Attach/]
     wait[/Wait a while/]
-    
+
     %%%% systemd units
     auto(ua-auto-attach.service)
     daemon(ubuntu-advantage.service)
diff --git a/docs/README.md b/dev-docs/howtoguides/build-docs.md
similarity index 100%
rename from docs/README.md
rename to dev-docs/howtoguides/build-docs.md
diff --git a/dev-docs/howtoguides/building.md b/dev-docs/howtoguides/building.md
index 17be892..40b4d70 100644
--- a/dev-docs/howtoguides/building.md
+++ b/dev-docs/howtoguides/building.md
@@ -41,16 +41,3 @@ sbuild-launchpad-chroot create --architecture="riscv64" "--name=focal-riscv64" "
 > # this script can be used to update all chroots
 > sudo PATTERN=\* sh /usr/share/doc/sbuild/examples/sbuild-debian-developer-setup-update-all
 > ```
-
-## Setting up an lxc development container
-```shell
-lxc launch ubuntu-daily:xenial dev-x -c user.user-data="$(cat tools/ua-dev-cloud-config.yaml)"
-lxc exec dev-x bash
-```
-
-## Setting up a kvm development environment with multipass
-**Note:** There is a sample procedure documented in tools/multipass.md as well.
-```shell
-multipass launch daily:focal -n dev-f --cloud-init tools/ua-dev-cloud-config.yaml
-multipass connect dev-f
-```
diff --git a/dev-docs/howtoguides/how_to_use_magic_attach_endpoints.md b/dev-docs/howtoguides/how_to_use_magic_attach_endpoints.md
index 792c5d8..c06c32b 100644
--- a/dev-docs/howtoguides/how_to_use_magic_attach_endpoints.md
+++ b/dev-docs/howtoguides/how_to_use_magic_attach_endpoints.md
@@ -28,7 +28,7 @@ It is expected for you to see the following json response:
   "_schema_version": "v1",
   "data": {
     "meta": {
-       "environment_vars": []}
+       "environment_vars": []
     },
     "attributes": {
       "expires": "EXPIRE_DATE",
diff --git a/dev-docs/howtoguides/how_to_release_a_new_version_of_ua.md b/dev-docs/howtoguides/release_a_new_version.md
similarity index 75%
rename from dev-docs/howtoguides/how_to_release_a_new_version_of_ua.md
rename to dev-docs/howtoguides/release_a_new_version.md
index 7a067dc..44ebd48 100644
--- a/dev-docs/howtoguides/how_to_release_a_new_version_of_ua.md
+++ b/dev-docs/howtoguides/release_a_new_version.md
@@ -31,6 +31,14 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
   ```
 * You must have Launchpad already properly configured in your system in order to upload packages to the PPAs. Follow [this guide](https://help.launchpad.net/Packaging/PPA/Uploading) to get set up.
 
+* In order to run the `ppa` command, install `ppa-dev-tools` from `bryce`'s PPA:
+  ```bash
+  sudo add-apt-repository ppa:bryce/ppa-dev-tools
+  sudo apt update
+  sudo apt install ppa-dev-tools
+  ```
+  When running `ppa` for the first time, there will be another round of launchpad authorization to be performed.
+
 ## I. Preliminary/staging release to team infrastructure
 1. Create a release PR:
 
@@ -38,10 +46,10 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
 
       * This step is currently not well defined. We currently are using `release-27` for all `27.X` releases and have been cherry-picking/rebasing all commits from `main` into this branch for a release.
 
-    b Create a new entry in the `debian/changelog` file:
+    b. Create a new entry in the `debian/changelog` file:
 
       * You can do that by running `dch --newversion <version-name>`.
-      * Remember to update the release from `UNRELEASED` to the ubuntu/devel release. Edit the version to look like: `27.2~21.10.1`, with the appropriate pro-client and ubuntu/devel version numbers.
+      * Remember to update the release from `UNRELEASED` to the ubuntu/devel release. Edit the version to look like: `27.2`, with the appropriate pro-client version number.
       * Populate `debian/changelog` with the commits you have cherry-picked.
       * You can do that by running `git log <first-cherry-pick-commit>..<last-cherry-pick-commit> | log2dch`
         * This will generate a list of commits that could be included in the changelog.
@@ -51,26 +59,26 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
         changelog.
       * To structure the changelog you can use the other entries as example. But we basically try to
         keep this order: debian changes, new features/modifications, testing. Within each section, bullet points should be alphabetized.
-        
+
     c. Create a PR on GitHub into the release branch. Ask in the ~UA channel on Mattermost for review.
 
     d. When reviewing the release PR, please use the following guidelines when reviewing the new changelog entry:
 
-       * Is the version correctly updated? We must ensure that the new version in the changelog is
-         correct and it also targets the latest Ubuntu release at the moment.
-       * Is the entry useful for the user? The changelog entries should be user focused, meaning
-         that we should only add entries that we think users will care about (i.e. we don't need
-         entries when fixing a test, as this doesn't provide meaningful information to the user).
-       * Is this entry redundant? Sometimes we may have changes that affect separate modules of the
-         code. We should have an entry only for the module that was most affected by it.
-       * Is the changelog entry unique? We need to verify that the changelog entry is not already
-         reflected in an earlier version of the changelog. If it is, we need not only to remove but double
-         check the process we are using to cherry-pick the commits.
-       * Is this entry actually reflected in the code? Sometimes, we can have changelog entries
-         that are not reflected in the code anymore. This can happen during development when we are
-         still unsure about the behaviour of a feature or when we fix a bug that removes the code
-         that was added. We must verify each changelog entry that is added to be sure of their
-         presence in the product.
+      * Is the version correctly updated? We must ensure that the new version in the changelog is
+        correct and it also targets the latest Ubuntu release at the moment.
+      * Is the entry useful for the user? The changelog entries should be user focused, meaning
+        that we should only add entries that we think users will care about (i.e. we don't need
+        entries when fixing a test, as this doesn't provide meaningful information to the user).
+      * Is this entry redundant? Sometimes we may have changes that affect separate modules of the
+        code. We should have an entry only for the module that was most affected by it.
+      * Is the changelog entry unique? We need to verify that the changelog entry is not already
+        reflected in an earlier version of the changelog. If it is, we need not only to remove but double
+        check the process we are using to cherry-pick the commits.
+      * Is this entry actually reflected in the code? Sometimes, we can have changelog entries
+        that are not reflected in the code anymore. This can happen during development when we are
+        still unsure about the behaviour of a feature or when we fix a bug that removes the code
+        that was added. We must verify each changelog entry that is added to be sure of their
+        presence in the product.
 
 2. After the release PR is merged, tag the head of the release branch with the version number, e.g., `27.1`. Push this tag to GitHub.
 
@@ -84,7 +92,7 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
 
     b. Edit the changelog
       * List yourself as the author of this release.
-      * Edit the version number to look like: `27.2~20.04.1~rc1` (`<version>~<ubuntu-release-number>.<revno>~rc<release-candidate-number>`)
+      * Edit the version number to look like: `27.2~rc1` (`<version>~rc<release-candidate-number>`)
       * Edit the Ubuntu release name. Start with the ubuntu/devel release.
       * `git add debian/changelog && git commit -m "throwaway"` - Do **not** push this commit!
 
@@ -95,9 +103,10 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
       * If this succeeds move on. If this fails, debug and fix before continuing.
 
     e. Repeat 3.b through 3.d for all supported Ubuntu Releases
-      * PS: remember to also change the version number on the changelog. For example, suppose
-        the new version is `1.1~20.04.1~rc1`. If you want to test Bionic now, change it to
-        `1.1~18.04.1~rc1`.
+      * The version for series other than devel should be in the form `<version>~<ubuntu-release-number>~rc<release-candidate-number>`
+        This means you must add the release number in the changelog. For example, suppose
+        the devel version is `1.1~rc1`. If you want to build for jammy now, change it to
+        `1.1~22.04~rc1`.
 
     f. For each release, dput to the staging PPA:
       * `dput ppa:ua-client/staging ../out/<package_name>_source.changes`
@@ -115,7 +124,7 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
     b. Create a new bug on Launchpad for ubuntu-advantage-tools and use the format defined [here](https://wiki.ubuntu.com/UbuntuAdvantageToolsUpdates#SRU_Template) for the description.
       * The title should be in the format `[SRU] ubuntu-advantage-tools (27.1 -> 27.2) Xenial, Bionic, Focal, Jammy`, substituting version numbers and release names as necessary.
       * If any of the changes for the SRU is in the [Early Review Sign-off list](../references/early_review_signoff.md), include a pointer in the `[Discussion]` section to where the discussion/approval of that feature took place (if possible).
-    
+
     c. For each Launchpad bug fixed by this release (which should all be referenced in our changelog), add the SRU template to the description and fill out each section.
       * Leave the original description in the bug at the bottom under the header `[Original Description]`.
       * For the testing steps, include steps to reproduce the bug. Then include instructions for adding `ppa:ua-client/staging`, and steps to verify the bug is no longer present.
@@ -136,18 +145,21 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
     e. `git checkout -B upload-<this-version>-kinetic`
       * This creates a new local branch name based on your detached branch.
 
-    f. Make sure the changelog version contains the release version in the name (e.g., `27.1~22.10.1`)
-
-    g. `git push <your_launchpad_user> upload-<this-version>-kinetic`
+    f. `git push <your_launchpad_user> upload-<this-version>-kinetic`
 
-    h. On Launchpad, create a merge proposal for this version which targets `ubuntu/devel`
-      * For an example, see the [27.9 merge proposal](https://code.launchpad.net/~orndorffgrant/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/+merge/422906).
+    g. On Launchpad, create a merge proposal for this version which targets `ubuntu/devel`
+      * For an example, see the [27.14.1 merge proposal](https://code.launchpad.net/~renanrodrigo/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/+merge/439507).
       * Add 2 review slots for `canonical-server-reporter` and `canonical-server-core-reviewers`.
 
-4. Server Team Review and Pre-SRU Review
+    h. With the packages published to `ppa:ua-client/staging`, add links to the autopkgtest triggers to the Merge Proposal. The reviewer will have permission to trigger those tests. The links can be obtained by running `ppa tests -r <release> -a <arch1,arch2> ua-client/staging -L`
+      * Make sure to post links to all the architectures built for a given release.
+      * The riscv64 autopkgtests are not avaialble and don't need to be included.
+      * The `ppa test` command will have two variations of tests: the regular one, and one with `all-proposed=1`; only the regular test need to be there.
+
+3. Server Team Review and Pre-SRU Review
 
     a. Ask the assigned ubuntu-advantage-tools reviewer/sponsor from Server team for a review of your MPs. If you don't know who that is, ask in ~Server. Include a link to the ubuntu/devel MP and to the SRU bug.
-    
+
     b. If they request changes, create a PR into the release branch on GitHub and ask Pro Client team for review. After that is merged, cherry-pick the commit into your `upload-<this-version>-<devel-release>` branch and push to launchpad. Then notify the Server Team member that you have addressed their requests.
       * Some issues may just be filed for addressing in the future if they are not urgent or pertinent to this release.
       * Unless the changes are very minor, or only testing related, you should upload a new release candidate version to `ppa:ua-client/staging` as described in I.3.
@@ -160,7 +172,12 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
       * Follow instructions in `II.4.b` if they request any changes.
 
     e. Once the SRU team member gives a pre-SRU approval, create the branches for each stable release. They should be named `upload-<this-version>-<codename>`.
+      * The versions for the stable releases must include `~<release-number>`
       * If you've followed the instructions precisely so far, you can just run `bash tools/create-lp-release-branches.sh`.
+        - When using the `create-lp-release-branches.sh` script, an important parameter is `SRU_BUG`:
+        - In the vast majority of cases, this should be set to the overall SRU bug written in step II.1.b.
+        - In the case where an existing SRU never got released, and a new patch version was uploaded on top of it to fix a new bug discovered during review, then the bug should still be the overall SRU bug.
+        - If the release is exclusively a bugfix release and the previous version has already been successfully released all the way through the SRU process, then the bug should instead be the specific bugfix number.
 
     f. Ask Server team member sponsor to upload to devel, and then the SRU proposed queue using the stable release branches you just created.
       * Ask them to tag the PR with the appropriate `upload/<version>` tag so git-ubuntu will import rich commit history.
@@ -170,7 +187,7 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
 
     h. Tell the SRU team member who performed the pre-SRU review that the packages are in the -proposed release queue. They will need to actually approve the package to move into -proposed.
 
-5. -proposed verification and release to -updates
+4. -proposed verification and release to -updates
 
     a. As soon as the SRU vanguard approves the packages, a bot in #ubuntu-release will announce that ubuntu-advantage-tools is accepted into the applicable -proposed pockets, or the [Xenial -proposed release rejection queue](https://launchpad.net/ubuntu/xenial/+queue?queue_state=4&queue_text=ubuntu-advantage-tools) will contain a reason for rejections. Double check the SRU process bug for any actionable review feedback.
       * Once accepted into `-proposed` by an SRU vanguard [ubuntu-advantage-tools shows up in the pending_sru page](https://people.canonical.com/~ubuntu-archive/pending-sru.html), check `rmadison ubuntu-advantage-tools | grep -proposed` to see if the upload exists in -proposed yet.
@@ -182,19 +199,21 @@ If this is your first time releasing ubuntu-advantage-tools, you'll need to do t
       * There may also be one-time test scripts added in the `sru/` directory for this release.
 
     d. After all tests have passed, tarball all of the output files and upload them to the SRU bug with a message that looks like this:
+
     ```
     We have run the full ubuntu-advantage-tools integration test suite against the version in -proposed. The results are attached. All tests passed.
-    
+
     You can verify the correct version was used by checking the output of the first test in each file, which prints the version number.
 
     I am marking the verification done for this SRU.
     ```
+
     Change the tags on the bug from `verification-needed` to `verification-done` (including the verification tags for each Ubuntu release).
 
     e. For any other related Launchpad bugs that are fixed in this release, perform the verification steps necessary for those bugs and mark them `verification-done` as needed. This will likely involve following the test steps, but instead of adding the staging PPA, enabling -proposed.
 
     f. Once all SRU bugs are tagged as `verification*-done`, all SRU-bugs should be listed as green in [the pending_sru page](https://people.canonical.com/~ubuntu-archive/pending-sru.html).
-    
+
     g. After the pending SRU page says that ubuntu-advantage-tools has been in proposed for 7 days, it is now time to ping the [current SRU vanguard](https://wiki.ubuntu.com/StableReleaseUpdates#Publishing) for acceptance of ubuntu-advantage-tools into -updates.
 
     h. Check `rmadison ubuntu-advantage-tools` for updated version in -updates.
diff --git a/dev-docs/howtoguides/testing.md b/dev-docs/howtoguides/testing.md
index fb0519a..24706d4 100644
--- a/dev-docs/howtoguides/testing.md
+++ b/dev-docs/howtoguides/testing.md
@@ -139,13 +139,13 @@ This adds an upfront cost that is amortized across several test scenarios.
 Based on some rough testing in July 2021, these are the situations
 when you should set UACLIENT_BEHAVE_SNAPSHOT_STRATEGY=1
 
-> At time of writing, starting a lxd.vm instance from a local snapshot takes
-> longer than starting a fresh lxd.vm instance and installing ua.
+> At time of writing, starting a lxd-vm instance from a local snapshot takes
+> longer than starting a fresh lxd-vm instance and installing ua.
 
 | machine_type  | condition          |
 | ------------- | ------------------ |
-| lxd.container | num_scenarios > 7  |
-| lxd.vm        | never              |
+| lxd-container | num_scenarios > 7  |
+| lxd-vm        | never              |
 | gcp           | num_scenarios > 5  |
 | azure         | num_scenarios > 14 |
 | aws           | num_scenarios > 11 |
@@ -175,17 +175,6 @@ To specifically run non-ubuntu pro tests using canonical cloud-images an
 additional token obtained from https://ubuntu.com/pro needs to be set:
   - UACLIENT_BEHAVE_CONTRACT_TOKEN=<your_token>
 
-By default, the public AMIs for Ubuntu Pro testing used for each Ubuntu
-release are defined in features/aws-ids.yaml. These ami-ids are determined by
-running `./tools/refresh-aws-pro-ids`.
-
-Integration tests will read features/aws-ids.yaml to determine which default
-AMI id to use for each supported Ubuntu release.
-
-To update `features/aws-ids.yaml`, run `./tools/refresh-aws-pro-ids` and put up
-a pull request against this repo to updated that content from the ua-contracts
-marketplace definitions.
-
 * To manually run EC2 integration tests with a specific AMI Id provide the
 following environment variable to launch your specific  AMI instead of building
 a daily ubuntu-advantage-tools image.
diff --git a/dev-docs/references/directory_layout.md b/dev-docs/references/directory_layout.md
index 241fa36..1fc1f77 100644
--- a/dev-docs/references/directory_layout.md
+++ b/dev-docs/references/directory_layout.md
@@ -9,12 +9,11 @@ The following describes the intent of Ubuntu Pro Client related directories:
 | ./uaclient/ | collection of python modules which will be packaged into ubuntu-advantage-tools package to deliver the Ubuntu Pro Client CLI |
 | uaclient.entitlements | Service-specific \*Entitlement class definitions which perform enable, disable, status, and entitlement operations etc. All classes derive from base.py:UAEntitlement and many derive from repo.py:RepoEntitlement |
 | ./uaclient/cli.py | The entry-point for the command-line client
-| ./uaclient/clouds/ | Cloud-platform detection logic used in Ubuntu Pro to determine if a given should be auto-attached to a contract |
+| ./uaclient/clouds/ | Cloud-platform detection logic used in Ubuntu Pro to determine if a given instance should be auto-attached to a contract |
 | uaclient.contract | Module for interacting with the Contract Server API |
 | uaclient.messages | Module that contains the messages delivered by `pro` to the user |
 | uaclient.security | Module that hold the logic used to run `pro fix` commands |
 | ./apt-hook/ | the C++ apt-hook delivering MOTD and apt command notifications about Ubuntu Pro support services |
-| ./apt-conf.d/ | apt config files delivered to /etc/apt/apt-conf.d to automatically allow unattended upgrades of ESM security-related components. If apt proxy settings are configured, an additional apt config file will be placed here to configure the apt proxy. |
 | /etc/ubuntu-advantage/uaclient.conf | Configuration file for the Ubuntu Pro Client.|
 | /var/lib/ubuntu-advantage/private | `root` read-only directory containing Contract API responses, machine-tokens and service credentials |
 | /var/lib/ubuntu-advantage/machine-token.json | `world` readable file containing redacted Contract API responses, machine-tokens and service credentials |
@@ -23,6 +22,7 @@ The following describes the intent of Ubuntu Pro Client related directories:
 ## Note
 
 We have two `machine-token.json` files, located at:
+
 - /var/lib/ubuntu-advantage/private/machine-token.json
 - /var/lib/ubuntu-advantage/machine-token.json
 
diff --git a/dev-docs/references/enabling_a_service.md b/dev-docs/references/enabling_a_service.md
index 17429d0..d799972 100644
--- a/dev-docs/references/enabling_a_service.md
+++ b/dev-docs/references/enabling_a_service.md
@@ -17,5 +17,5 @@ The Ubuntu Pro Client is simple in that it relies on the machine token on the at
 machine to describe whether a service is applicable for an environment and what
 configuration is required to properly enable that service.
 
-Any interactions with the Contract server API are defined as UAContractClient
+Any interactions with the Contract Server API are defined as UAContractClient
 class methods in [uaclient/contract.py](../../uaclient/contract.py).
diff --git a/dev-docs/references/terminology.md b/dev-docs/references/terminology.md
index cc79893..0459eb7 100644
--- a/dev-docs/references/terminology.md
+++ b/dev-docs/references/terminology.md
@@ -5,8 +5,8 @@ Ubuntu Pro Client performs:
 
 | Term     | Meaning |
 | -------- | -------- |
-| Ubuntu Pro Client | The python command line client represented in this ubuntu-advantage-client repository. It is installed on each Ubuntu machine and is the entry-point to enable any Ubuntu Pro commercial service on an Ubuntu machine. |
-| Contract Server | The backend service exposing a REST API to which Ubuntu Pro Client authenticates in order to obtain contract and commercial service information and manage which support services are active on a machine.|
+| Ubuntu Pro Client | The python command line client represented in this ubuntu-pro-client repository. It is installed on each Ubuntu machine and is the entry-point to enable any Ubuntu Pro commercial service on an Ubuntu machine |
+| Contract Server | The backend service exposing a REST API to which Ubuntu Pro Client authenticates in order to obtain contract and commercial service information and manage which support services are active on a machine |
 | Entitlement/Service | An Ubuntu Pro commercial support service such as FIPS, ESM, Livepatch, CIS-Audit to which a contract may be entitled |
 | Affordance | Service-specific list of applicable architectures and Ubuntu series on which a service can run |
 | Directives | Service-specific configuration values which are applied to a service when enabling that service |
diff --git a/dev-docs/references/version_string_formatting.md b/dev-docs/references/version_string_formatting.md
index 98c150e..59f163c 100644
--- a/dev-docs/references/version_string_formatting.md
+++ b/dev-docs/references/version_string_formatting.md
@@ -5,10 +5,10 @@ Below are the versioning schemes used for publishing debs:
 | Build target                                                                      | Version Format                             |
 | --------------------------------------------------------------------------------- | ------------------------------------------ |
 | [Daily PPA](https://code.launchpad.net/~canonical-server/+recipe/ua-client-daily) | `XX.YY-<revno>~g<commitish>~ubuntu22.04.1` |
-| Staging PPA                                                                       | `XX.YY~22.04.1~rc1`                        |
-| Stable PPA                                                                        | `XX.YY~22.04.1~stableppa1`                 |
-| Archive release                                                                   | `XX.YY~22.04.1`                            |
-| Archive bugfix release                                                            | `XX.YY.Z~22.04.1`                          |
+| Staging PPA                                                                       | `XX.YY~22.04~rc1`                        |
+| Stable PPA                                                                        | `XX.YY~22.04~stableppa1`                 |
+| Archive release                                                                   | `XX.YY~22.04`                            |
+| Archive bugfix release                                                            | `XX.YY.Z~22.04`                          |
 
 ## Supported upgrade paths on same upstream version
 
@@ -18,10 +18,10 @@ This table demonstrates upgrade paths between sources for one particular upstrea
 
 | Upgrade path                    | Version diff example                                                    |
 | ------------------------------- | ----------------------------------------------------------------------- |
-| Staging to Next Staging rev     | `31.4~22.04.1~rc1` ➜ `31.4~22.04.1~rc2`                                 |
-| Staging to Stable               | `31.4~22.04.1~rc2` ➜ `31.4~22.04.1~stableppa1`                          |
-| Stable to Next Stable rev       | `31.4~22.04.1~stableppa1` ➜ `31.4~22.04.1~stableppa2`                   |
-| Stable to Archive               | `31.4~22.04.1~stableppa2` ➜ `31.4~22.04.1`                              |
-| LTS Archive to Next LTS Archive | `31.4~22.04.1` ➜ `31.4~24.04.1`                                         |
-| Archive to Daily                | `31.4~24.04.1` ➜ `31.4-1500~g75fa134~ubuntu24.04.1`                     |
+| Staging to Next Staging rev     | `31.4~22.04~rc1` ➜ `31.4~22.04~rc2`                                 |
+| Staging to Stable               | `31.4~22.04~rc2` ➜ `31.4~22.04~stableppa1`                          |
+| Stable to Next Stable rev       | `31.4~22.04~stableppa1` ➜ `31.4~22.04~stableppa2`                   |
+| Stable to Archive               | `31.4~22.04~stableppa2` ➜ `31.4~22.04`                              |
+| LTS Archive to Next LTS Archive | `31.4~22.04` ➜ `31.4~24.04`                                         |
+| Archive to Daily                | `31.4~24.04` ➜ `31.4-1500~g75fa134~ubuntu24.04.1`                     |
 | Daily to Next Daily             | `31.4-1500~g75fa134~ubuntu24.04.1` ➜ `31.4-1501~g3836375~ubuntu24.04.1` |
diff --git a/dev-docs/references/what_happens_during_attach.md b/dev-docs/references/what_happens_during_attach.md
index 21ad455..05854e1 100644
--- a/dev-docs/references/what_happens_during_attach.md
+++ b/dev-docs/references/what_happens_during_attach.md
@@ -1,7 +1,7 @@
 ### What happens during attach
 After running the command `pro attach TOKEN`, Ubuntu Pro Client will perform the following steps:
 
-* read the config from /etc/ubuntu-advantage/uaclient.conf to obtain
+* Read the config from /etc/ubuntu-advantage/uaclient.conf to obtain
   the contract\_url (default: https://contracts.canonical.com)
 * POSTs to the Contract Server API @
   <contract_url>/api/v1/context/machines/token providing the \<contractToken\>
diff --git a/dev-requirements.txt b/dev-requirements.txt
index 06712bf..00dd2fb 100644
--- a/dev-requirements.txt
+++ b/dev-requirements.txt
@@ -1,6 +1,6 @@
 # The black, isort and shellcheck-py versions are also in .pre-commit-config.yaml; 
 # make sure to update both together
 black==22.3.0
-isort==5.8.0
+isort==5.12.0
 pre-commit
 shellcheck-py==0.8.0.4
diff --git a/docs/_static/js/github_issue_links.js b/docs/_static/js/github_issue_links.js
index e449b4e..d339060 100644
--- a/docs/_static/js/github_issue_links.js
+++ b/docs/_static/js/github_issue_links.js
@@ -2,7 +2,7 @@ window.onload = function() {
     const link = document.createElement("a");
     link.classList.add("muted-link");
     link.classList.add("github-issue-link");
-    link.text = "Have a question?";
+    link.text = "Give feedback";
     link.href = (
         "https://github.com/canonical/ubuntu-pro-client/issues/new?"
         + "title=docs%3A+TYPE+YOUR+QUESTION+HERE"
diff --git a/docs/conf.py b/docs/conf.py
index 8dd4d59..33da04c 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -38,6 +38,8 @@ extensions = [
 
 templates_path = ["_templates"]
 
+html_extra_path = ["googleaf254801a5285c31.html", "sitemap-index.xml"]
+
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
 # This pattern also affects html_static_path and html_extra_path.
@@ -100,7 +102,7 @@ html_static_path = ["_static"]
 html_css_files = [
     "css/logo.css",
     "css/github_issue_links.css",
-    "css/custom.css"
+    "css/custom.css",
 ]
 html_js_files = [
     "js/github_issue_links.js",
diff --git a/docs/explanations.rst b/docs/explanations.rst
index a424451..78adb85 100644
--- a/docs/explanations.rst
+++ b/docs/explanations.rst
@@ -27,6 +27,7 @@ selection of some of the commands -- what they do, and how they work.
     :maxdepth: 1
 
     explanations/how_to_interpret_the_security_status_command.md
+    explanations/how_to_interpret_output_of_unattended_upgrades.md
     explanations/status_columns.md
     explanations/what_refresh_does.md
 
@@ -48,6 +49,7 @@ Other Pro features explained
 ..  toctree::
     :maxdepth: 1
     
+    explanations/cves_and_usns_explained.md
     explanations/what_are_the_timer_jobs.md
     explanations/what_is_the_daemon.md
     explanations/why_trusty_is_no_longer_supported.md
diff --git a/docs/explanations/apt_messages.md b/docs/explanations/apt_messages.md
index d4e62ef..edd50d2 100644
--- a/docs/explanations/apt_messages.md
+++ b/docs/explanations/apt_messages.md
@@ -25,7 +25,7 @@ Learn more about Ubuntu Pro for 16.04 at https://ubuntu.com/16-04
 
 ## LTS series with esm-apps service disabled
 
-When you are running `apt upgraded` on a LTS release, like Focal, we advertise
+When you are running `apt upgrade` on a LTS release, like Focal, we advertise
 the `esm-apps` service if packages could be upgraded by enabling the service:
 
 ```
diff --git a/docs/explanations/cves_and_usns_explained.md b/docs/explanations/cves_and_usns_explained.md
new file mode 100644
index 0000000..272c1d8
--- /dev/null
+++ b/docs/explanations/cves_and_usns_explained.md
@@ -0,0 +1,44 @@
+# CVEs and USNs explained
+
+## What is a CVE
+
+Common Vulnerabilities and Exposures (CVEs) are a way to catalogue and track public security
+vulnerabilities for a given software. Every CVE is identified through a unique identifier,
+for example [CVE-2023-0465](https://www.cve.org/CVERecord?id=CVE-2023-0465).
+
+CVEs are maintained by the [MITRE Corporation](https://cve.mitre.org/) and the goal of the project
+is to provide naming conventions for the public known security issues while also maintaining a
+centralised repository for all of the security issues. This makes it easier for an organization to
+submit a new security flaw though the CVE convention while also analysing any other existing CVEs
+in the database.
+
+You can search for any existing CVE related to Ubuntu using
+[the Ubuntu CVE page](https://ubuntu.com/security/cves).
+
+## What is a USN?
+
+An Ubuntu Security Notice (USN) is the way that Canonical publicly catalogues and displays security
+vulneratibilities for Ubuntu packages. Usually, a USN is composed of one or more
+[CVEs](#what-is-a-cve) and it also contains update instructions to fix the issue, if a fix is
+already available.
+
+USNs follow a naming convention of the format: [USN-5963-1](https://ubuntu.com/security/notices/USN-5963-1)
+
+You can search for any existing USN using
+[the Ubuntu Security Notices page](https://ubuntu.com/security/notices).
+
+## What are related USNs?
+
+A USN is composed of different CVEs. If the same CVE appears on multiple USNs, we say that those USNs are related.
+In the following image, we can see a visual representation of that concept, where USN-789 and USN-321
+are related USNs because both are affected by CVE-2:
+
+![Related USN example](../images/usn-related.png)
+
+
+A real example can be seen in [USN-5573-1](https://ubuntu.com/security/notices/USN-5573-1).
+In the section **Related notices**, it shows that both **USN-5570-1**
+and **USN-5570-2** are related to **USN-5573-1**.
+
+This information is useful for users that want to tackle
+all related USNs at once, making sure that a CVE is fully fixed on their Ubuntu machine.
diff --git a/docs/explanations/how_to_interpret_output_of_unattended_upgrades.md b/docs/explanations/how_to_interpret_output_of_unattended_upgrades.md
new file mode 100644
index 0000000..714c14a
--- /dev/null
+++ b/docs/explanations/how_to_interpret_output_of_unattended_upgrades.md
@@ -0,0 +1,82 @@
+# How to interpret the output of unattended-upgrades
+
+On Pro Client version 27.14~, we introduced the `u.pro.unattended_upgrades.status.v1` endpoint.
+This endpoint is designed to provide users with an overview of the configuration and setup for
+unattended-upgrades on the machine. The expected output follows this JSON example:
+
+```json
+{
+  "_schema_version": "v1",
+  "data": {
+    "attributes": {
+      "apt_periodic_job_enabled": true,
+      "package_lists_refresh_frequency_days": 1,
+      "systemd_apt_timer_enabled": true,
+      "unattended_upgrades_allowed_origins": [
+        "${distro_id}:${distro_codename}",
+        "${distro_id}:${distro_codename}-security",
+        "${distro_id}ESMApps:${distro_codename}-apps-security",
+        "${distro_id}ESM:${distro_codename}-infra-security"
+      ],
+      "unattended_upgrades_disabled_reason": null,
+      "unattended_upgrades_frequency_days": 1,
+      "unattended_upgrades_last_run": null,
+      "unattended_upgrades_running": true
+    },
+    "meta": {
+      "environment_vars": [],
+      "raw_config": {
+        "APT::Periodic::Enable": "1",
+        "APT::Periodic::Unattended-Upgrade": "1",
+        "APT::Periodic::Update-Package-Lists": "1",
+        "Unattended-Upgrade::Allowed-Origins": [
+          "${distro_id}:${distro_codename}",
+          "${distro_id}:${distro_codename}-security",
+          "${distro_id}ESMApps:${distro_codename}-apps-security",
+          "${distro_id}ESM:${distro_codename}-infra-security"
+        ]
+      }
+    },
+    "type": "UnattendedUpgradesStatus"
+  },
+  "errors": [],
+  "result": "success",
+  "version": "27.14~16.04.1",
+  "warnings": []
+}
+```
+
+As we can see from this output, we have a variable named `unattended_upgrades_running`. That variable
+indicates if unattended-upgrades is properly configured and running on the machine.
+The value of this field will only be `true` if *ALL*  of the following prerequisites are also true:
+
+* *`apt_periodic_job_enable` is true*: That variable indicates if the APT::Periodic::Enable configuration variable
+  is turned on. If it is turned off, unattended-upgrades will not automatically run on the machine.
+* *`package_lists_refresh_frequency_days` is non-zero*: That variable shows the value of APT::Periodic::Package-List-Frequency.
+  This configuration defines the daily frequency for updating package sources in the background. If it has a zero value, this step will never
+  happen and unattended-upgrades might not be able to install new versions of the packages.
+* *`systemd_apt_timer_enabled` is true*: This variable is true if both `apt-daily.timer` and `apt-daily-upgrade.timer` are running
+  on the machine. These timers are the ones that control when unattended-upgrades run. The first job, `apt-daily.timer` is responsible
+  for triggering the code that downloads the lastest package information on the system. The second job, `apt-daily-upgrade.timer` is
+  responsible for running unattended-upgrades to download the latest version of the packages. If one of these jobs is disabled,
+  unattended-upgrades might not work as expected.
+* *`unattended_upgrades_allowed_origins` is not empty*: This variable defines the origins that
+  unattended-upgrades can use to install a package. If that list is empty, no packages can be
+  installed and unattended-upgrades will not work as expected.
+* *`unattended_upgrades_frequency_days` is non-zero*: That variable shows the value of
+  APT::Periodic::Unattended-Upgrade. This configuration defines the daily frequency for running
+  unattended-upgrades in the background. Therefore, if it has a zero value, the command will never
+  run.
+
+
+If any of those conditions are not met, the variable
+*unattended_upgrades_disabled_reason* will contain an object explaining why unattended-upgrades is
+not running. For example, if `package_lists_refresh_frequency_days` has a zero value, we will see
+the following value for *unattended_upgrades_disabled_reason*:
+
+```json
+{
+    "msg": "APT::Periodic::Update-Package-Lists is turned off",
+    "code": "unattended-upgrades-cfg-value-turned-off"
+}
+```
diff --git a/docs/explanations/how_to_interpret_the_security_status_command.md b/docs/explanations/how_to_interpret_the_security_status_command.md
index 21be0b4..b0a56e9 100644
--- a/docs/explanations/how_to_interpret_the_security_status_command.md
+++ b/docs/explanations/how_to_interpret_the_security_status_command.md
@@ -1,7 +1,200 @@
 # What does `security-status` do?
 
-The `security-status` command is used to get an overview of the packages
-installed on your machine.
+The `security-status` command provides an overview of all the packages
+installed on your machine, and the security coverage that applies to those
+packages.
+
+The output of the `security-status` command varies, depending on the configuration of the machine you run it on. In this article, we'll take a look at the different outputs of `security-status` and the situations in which you might see them.
+
+## Command output
+
+If you run the `pro security-status` command, the first blocks of information
+you see look like:
+
+```
+2871 packages installed:
+     2337 packages from Ubuntu Main/Restricted repository
+     504 packages from Ubuntu Universe/Multiverse repository
+     8 packages from third parties
+     22 packages no longer available for download
+
+To get more information about the packages, run
+    pro security-status --help
+for a list of available options.
+```
+
+Those are counts for the `apt` packages installed in the system, sorted
+between the packages in main, universe, third party packages, and packages
+that are no longer available. You will also see a hint to run
+`pro security-status --help` to get more information.
+
+### `apt update` hint
+
+To get accurate package information, the `apt` caches must be up to date. If
+your cache was not updated recently, you may see a message in the output with
+a hint to update.
+
+```
+The system apt cache may be outdated. Make sure to run
+    sudo apt-get update
+to get the latest package information from apt.
+```
+
+### LTS coverage
+
+If `esm-infra` is disabled in your system, main/restricted packages will be
+covered during the LTS period - this information is presented right after the
+hints. A covered system will present this message:
+
+```
+This machine is receiving security patching for Ubuntu Main/Restricted
+repository until <year>.
+```
+
+On a system where the LTS period ended, you'll see:
+
+```
+This machine is NOT receiving security patches because the LTS period has ended
+and esm-infra is not enabled.
+```
+
+### Ubuntu Pro coverage
+
+An Ubuntu Pro subscription provides more security coverage than a standard LTS.
+The next blocks of information are related to Ubuntu Pro itself:
+
+```
+This machine is attached to an Ubuntu Pro subscription.
+
+Main/Restricted packages are receiving security updates from
+Ubuntu Pro with 'esm-infra' enabled until 2032.
+
+Universe/Multiverse packages are receiving security updates from
+Ubuntu Pro with 'esm-apps' enabled until 2032. You have received 21 security
+updates.
+```
+
+This system is already attached to Pro! It is a Jammy machine, which has
+installed some updates from `esm-apps`. Running the same command on a Xenial
+system without Pro enabled, the output looks like:
+
+```
+This machine is NOT attached to an Ubuntu Pro subscription.
+
+Ubuntu Pro with 'esm-infra' enabled provides security updates for
+Main/Restricted packages until 2026. There are 170 pending security updates.
+
+Ubuntu Pro with 'esm-apps' enabled provides security updates for
+Universe/Multiverse packages until 2026. There is 1 pending security update.
+
+Try Ubuntu Pro with a free personal subscription on up to 5 machines.
+Learn more at https://ubuntu.com/pro
+```
+
+There are lots of `esm-infra` updates for this machine, and even an `esm-apps`
+update. The hint in the end of the output has a link to the main Pro website,
+so the user can learn more about Pro and get their subscription.
+
+### Interim releases
+
+If you are running an interim release, the output is slightly different because
+there are no Ubuntu Pro services available. You will still see the package
+counts and support period though - your main/restricted packages are supported
+for 9 months from the release date.
+
+```
+613 packages installed:
+    601 packages from Ubuntu Main/Restricted repository
+    12 packages from Ubuntu Universe/Multiverse repository
+
+To get more information about the packages, run
+    pro security-status --help
+for a list of available options.
+
+Main/Restricted packages receive updates until 1/2024.
+
+Ubuntu Pro is not available for non-LTS releases.
+```
+
+### Optional flags for specific package sets
+
+Some flags can be passed to `security-status` to get information about coverage
+of specific package sets. As an example, let's look at the output of
+`pro security-status --esm-infra`:
+
+```
+442 packages installed:
+    441 packages from Ubuntu Main/Restricted repository
+
+Main/Restricted packages are receiving security updates from
+Ubuntu Pro with 'esm-infra' enabled until 2026. You have received 3 security
+updates. There are 160 pending security updates.
+
+Run 'pro help esm-infra' to learn more
+
+Installed packages with an available esm-infra update:
+( ... list of packages ... )
+
+Installed packages with an esm-infra update applied:
+( ... list of packages ... )
+
+Further installed packages covered by esm-infra:
+( ... list of packages ... )
+
+For example, run:
+    apt-cache show tcpdump
+to learn more about that package.
+```
+
+Besides the support information of main/restricted (which Ubuntu Pro with
+`esm-infra` extends) there are lists of:
+- packages which have some updated version available in esm-infra repositories
+- packages which have an installed version from the esm-infra repositories
+- packages which are covered by esm-infra
+
+You will see a similar output when running `pro security-status --esm-apps`,
+but with information regarding universe/multiverse packages.
+
+You can also get a list of the third-party packages installed in the system:
+
+```
+$ pro security-status --thirdparty
+2871 packages installed:
+     8 packages from third parties
+
+Packages from third parties are not provided by the official Ubuntu
+archive, for example packages from Personal Package Archives in Launchpad.
+
+Packages:
+( ... list of packages ... )
+
+For example, run:
+    apt-cache show <package_name>
+to learn more about that package.
+```
+
+And also a list of unavailable packages (which no longer have any installation
+source):
+
+```
+$ pro security-status --unavailable
+2871 packages installed:
+     22 packages no longer available for download
+
+Packages that are not available for download may be left over from a
+previous release of Ubuntu, may have been installed directly from a
+.deb file, or are from a source which has been disabled.
+
+Packages:
+( ... list of packages ... )
+
+
+For example, run:
+    apt-cache show <package_name>
+to learn more about that package.
+```
+
+## Machine-readable output
 
 If you run the `pro security-status --format yaml` command on your machine, you
 should expect to see an output that follows this structure:
@@ -41,10 +234,10 @@ livepatch:
       Patched: true
 ```
 
-Let's understand what each key means in the output of the `pro security-status`
-command:
+Let's understand what each key means in the output of the
+`pro security-status --format yaml` command:
 
-## `summary`
+### `summary`
 
 This provides a summary of the system related to Ubuntu Pro and the different
 package sources in the system:
@@ -102,7 +295,7 @@ package sources in the system:
   * **`entitled_services`**: A list of services that are entitled on your
     Ubuntu Pro subscription. If unattached, this will always be an empty list.
 
-## `packages`
+### `packages`
 
 This provides a list of security updates for packages installed on the system.
 Every entry on the list will follow this structure:
@@ -123,7 +316,7 @@ Every entry on the list will follow this structure:
 * **`download_size`**: The number of bytes that would be downloaded in order to
   install the update.
 
-## `livepatch`
+### `livepatch`
 
 This displays Livepatch-related information. Currently, the only information
 presented is **`fixed_cves`**. This represents a list of CVEs that were fixed
diff --git a/docs/explanations/motd_messages.md b/docs/explanations/motd_messages.md
index 337a4bd..6a8f22b 100644
--- a/docs/explanations/motd_messages.md
+++ b/docs/explanations/motd_messages.md
@@ -2,21 +2,51 @@
 
 When the Ubuntu Pro Client (`pro`) is installed on the system, it delivers
 custom messages on ["Message of the Day" (MOTD)](https://wiki.debian.org/motd).
-Those messages are generated directly by two different sources.
+Those messages are generated directly by three different sources.
 
-## Python-scripted MOTD
+* MOTD about available updates
+* MOTD about important subscription conditions
+* MOTD about ESM being available
+
+## MOTD about available updates
 
 The [update-notifier](https://wiki.ubuntu.com/UpdateNotifier) delivers a script
-called `apt_check.py`. With regards to Ubuntu Pro, this script is responsible
-for:
-  
+via the `update-notifier-common` package called
+`/usr/lib/update-notifier/apt_check.py.
+With regards to Ubuntu Pro, this script is responsible for:
+
 * Informing the user about the status of one of the ESM services; `esm-apps` if
   the machine is an LTS series, or `esm-infra` if the series is in ESM mode.
 * Showing the number of `esm-infra` or `esm-apps` packages that can be upgraded
   on the machine.
 
-For example, here is the output of the `apt_check.py` script on a LTS machine
-when both of those services are enabled:
+`update-notifier` has always added information about potential updates to
+MOTD to raise user awareness. With the advent of Ubuntu Pro they are
+just more differentiated.
+
+Note that if you run `apt_check.py` directly it might give you rather
+unreadable output as it is meant for program use. You can add `--human-readable`
+to see the information as it would be presented in MOTD.
+
+### Machine is unattached
+
+On a machine that runs an Ubuntu release for which the `esm-apps` service
+is available, but not yet attached to an Ubuntu Pro subscription, there will
+be a message notifying the user that there may be more security updates
+available through ESM Apps.
+
+```
+Expanded Security Maintenance for Applications is not enabled.
+
+0 updates can be applied immediately.
+
+Enable ESM Apps to receive additional future security updates.
+See https://ubuntu.com/esm or run: sudo pro status
+```
+
+### Machine is fully attached
+
+In the opposite situation, if an LTS machine has the `esm-infra` and `esm-apps` services enabled then users will see the following output in MOTD:
 
 ```
 Expanded Security Maintenance for Applications is enabled.
@@ -28,8 +58,16 @@ Expanded Security Maintenance for Applications is enabled.
 To see these additional updates run: apt list --upgradable
 ```
 
-However, if we were running this on an ESM series, we would instead see
-`esm-infra` being advertised:
+### Machine is fully attached, on an older release
+
+Above you have seen examples of recent (as in "still in their first 5
+years of support") Ubuntu releases, where the hint is about ESM Apps
+extending the coverage to the universe repositories.
+
+However, if running on an Ubuntu release that has is already past the initial
+5 years of support and has thereby entered Expanded Security Maintenance
+(["ESM"](https://ubuntu.com/security/esm)), we would instead see
+`esm-infra` (which provides coverage for another 5 years) being shown:
 
 ```
 Expanded Security Maintenance Infrastructure is enabled.
@@ -41,17 +79,19 @@ Expanded Security Maintenance Infrastructure is enabled.
 To see these additional updates run: apt list --upgradable
 ```
 
+### Partial service enablement
+
 Now let's consider a scenario where one of these services is not enabled. For
 example, if `esm-apps` was disabled, the output will be:
 
 ```
 Expanded Security Maintenance for Applications is not enabled.
-  
+
 6 updates can be applied immediately.
 1 of these updates is a ESM Infra security update.
 5 of these updates are standard security updates.
 To see these additional updates run: apt list --upgradable
-  
+
 5 additional security updates can be applied with ESM Apps
 Learn more about enabling ESM Apps for Ubuntu 16.04 at
 https://ubuntu.com/16-04
@@ -62,13 +102,13 @@ upgraded if that service was enabled. Note that we would deliver the same
 information for `esm-infra` if the service was disabled and the series running
 on the machine is in ESM state.
 
-## MOTD through Ubuntu Pro timer jobs
+## MOTD about important subscription conditions
 
-One of the timer jobs Ubuntu Pro uses can insert additional messages into MOTD.
-These messages will be always delivered before or after the content created by
-the Python script delivered by `update-notifier`. These additional messages are
-generated when `pro` detects that certain conditions on the machine have been
-met. They are:
+One of the [timer jobs](https://canonical-ubuntu-pro-client.readthedocs-hosted.com/en/latest/explanations/what_are_the_timer_jobs.html)
+Ubuntu Pro uses can insert additional messages into MOTD.
+These messages will be always delivered next to the content created by
+`update-notifier`. These additional messages are generated when `pro`
+detects that certain conditions on the machine have been met. They are:
 
 ### Subscription expired
 
@@ -104,8 +144,69 @@ coverage for your applications.
 Your grace period will expire in 9 days.
 ```
 
-### How are these messages updated and inserted into MOTD?
+## MOTD about ESM being available
+
+When Ubuntu Pro became generally available, a temporary announcement was made
+through MOTD. This was intended to raise awareness of Pro now being available
+and free for personal use, and was shown on systems that could be covered
+by `esm-apps`.
+It looked like:
+
+```
+ * Introducing Expanded Security Maintenance for Applications.
+   Receive updates to over 25,000 software packages with your
+   Ubuntu Pro subscription. Free for personal use.
+
+     https://ubuntu.com/pro
+```
+
+Since this message was intended as a limited-time announcement to coincide
+with the release of Ubuntu Pro into general availability, it was removed in
+27.14.
+
+## How are these messages inserted into MOTD and how can I disable them?
+
+Just as there are different purposes to the messages outlined above,
+there are different sources producing these MOTD elements that one
+sees at login.
+
+Those messages are considered important to ensure user awareness about
+the free additional security coverage provided by Ubuntu Pro and about
+not-yet-applied potential updates in general. Therefore it is generally not
+recommended to disable them. But still, you can selectively disable them
+by removing the config files that add them, as outlined below.
+
+Removing those files is considered a conffile change to customize a program
+and they will stay removed even on future upgrades or re-installations of the
+related packages.
+
+If you realize that you actually need them back you need
+to reinstall the related packages and tell apt/dpkg to offer you to restore
+those files via:
+
+```
+sudo apt install --reinstall -o Dpkg::Options::="--force-confask" ubuntu-advantage-tools update-notifier-common
+```
+
+## Source: MOTD about available updates
+
+1. `update-notifier-common` has a hook `/etc/apt/apt.conf.d/99update-notifier` that runs after `apt update`.
+2. That hook will update the information in `/var/lib/update-notifier/updates-available` matching the new package information that was just fetched by using `/usr/lib/update-notifier/apt-check --human-readable`.
+3. At MOTD generation time, the script located at `/etc/update-motd.d/90-updates-available` checks if `/var/lib/update-notifier/updates-available` exists and if it does, inserts the message into the full MOTD.
+
+If you want to disable any message of update-notifier (not just related to Ubuntu Pro and ESM) about potentially available updates remove `/etc/update-motd.d/90-updates-available`.
 
-1. The contract status is checked periodically in the background when the machine is attached to an Ubuntu Pro contract.
-2. If one of the above messages applies to the contract that the machine is attached to, then the message is stored in `/var/lib/ubuntu-advantage/messages/motd-contract-status`.
+## Source: MOTD about important subscription conditions
+
+1. The subscription status is checked periodically in the background when the machine is attached to an Ubuntu Pro subscription.
+2. If one of the above conditions applies to the subscription that the machine is attached to (there are no messages generated by this for unattached machines), then the message is stored in `/var/lib/ubuntu-advantage/messages/motd-contract-status`.
 3. At MOTD generation time, the script located at `/etc/update-motd.d/91-contract-ua-esm-status` checks if `/var/lib/ubuntu-advantage/messages/motd-contract-status` exists and if it does, inserts the message into the full MOTD.
+
+If you want to disable any message about important conditions of your attached subscription remove `/etc/update-motd.d/91-contract-ua-esm-status`.
+
+## Source: MOTD about ESM being available
+
+1. `pro` checks regularly if a system would have `esm-apps` available to it and if so places a message in `/var/lib/ubuntu-advantage/messages/motd-esm-announce`.
+2. At MOTD generation time, the script located at `/etc/update-motd.d/88-esm-announce` checks if `/var/lib/ubuntu-advantage/messages/motd-esm-announce` exists and if it does, inserts the message into the full MOTD.
+
+If you want to disable the ESM announcement remove `/etc/update-motd.d/88-esm-announce` (or upgrade to 27.14 or later which will remove it for you).
diff --git a/docs/explanations/status_columns.md b/docs/explanations/status_columns.md
index 1447b44..6e79449 100644
--- a/docs/explanations/status_columns.md
+++ b/docs/explanations/status_columns.md
@@ -101,3 +101,105 @@ allow_beta: True
 It's important to keep in mind that any feature defined like this will be
 listed, even if it is invalid or typed the wrong way. Those appear in `status`
 output for informational and debugging purposes.
+
+## Machine-readable output
+
+The `pro status` command supports a `--format` flag with options including `json` and `yaml`. These result in a machine-readable form of the information presented by the `pro status` command.
+
+```{note}
+`pro status` should return the same results whether using `sudo` or not, but earlier versions did not always do this. We recommend using `sudo` whenever possible.
+```
+
+For example, running `sudo pro status --format=json` on an attached machine may give you something like this:
+```javascript
+{
+  "_doc": "Content provided in json response is currently considered Experimental and may change",
+  "_schema_version": "0.1",
+  "account": {
+    "created_at": "2000-01-02T03:04:05+06:00",
+    "id": "account_id",
+    "name": "Test"
+  },
+  "attached": true,
+  "config": { ...effectiveConfiguration },
+  "config_path": "/etc/ubuntu-advantage/uaclient.conf",
+  "contract": {
+    "created_at": "2000-01-02T03:04:05+06:00",
+    "id": "contract_id",
+    "name": "contract_name",
+    "products": [ "uaa-essential" ],
+    "tech_support_level": "essential"
+  },
+  "effective": null,
+  "environment_vars": [...proClientEnvironmentVariables],
+  "errors": [],
+  "execution_details": "No Ubuntu Pro operations are running",
+  "execution_status": "inactive",
+  "expires": "9999-12-31T00:00:00+00:00",
+  "features": {},
+  "machine_id": "machine_id",
+  "notices": [],
+  "result": "success",
+  "services": [
+    {
+      "available": "yes",
+      "blocked_by": [],
+      "description": "Expanded Security Maintenance for Applications",
+      "description_override": null,
+      "entitled": "yes",
+      "name": "esm-apps",
+      "status": "enabled",
+      "status_details": "Ubuntu Pro: ESM Apps is active",
+      "warning": null
+    },
+    {
+      "available": "yes",
+      "blocked_by": [],
+      "description": "Expanded Security Maintenance for Infrastructure",
+      "description_override": null,
+      "entitled": "yes",
+      "name": "esm-infra",
+      "status": "enabled",
+      "status_details": "Ubuntu Pro: ESM Infra is active",
+      "warning": null
+    },
+    {
+      "available": "yes",
+      "blocked_by": [],
+      "description": "Canonical Livepatch service",
+      "description_override": null,
+      "entitled": "yes",
+      "name": "livepatch",
+      "status": "enabled",
+      "status_details": "",
+      "warning": null
+    },
+    ...otherServiceStatusObjects
+  ],
+  "simulated": false,
+  "version": "27.13.6~18.04.1",
+  "warnings": []
+}
+```
+
+Some particularly important attributes in the output include:
+* `attached`: This boolean value indicates whether this machine is attached to an Ubuntu Pro account. This does not tell you if any particular service (e.g. `esm-infra`) is enabled. You must check the individual service item in the `services` list for that status (described below).
+* `expires`: This is the date that the Ubuntu Pro subscription is valid until (in RFC3339 format). After this date has passed the machine should be treated as if not attached and no services are enabled. `attached` may still say `true` and services may still say they are `entitled` and `enabled`, but if the `expires` date has passed, you should assume the services are not functioning.
+* `services`: This is a list of Ubuntu Pro services. Each item has its own attributes. Widely applicable services include those with `name` equal to `esm-infra`, `esm-apps`, and `livepatch`. Some important fields in each service object are:
+  * `name`: The name of the service.
+  * `entitled`: A boolean indicating whether the attached Ubuntu Pro account is allowed to enable this service.
+  * `status`: A string indicating the service's current status on the machine. Any value other than `enabled` should be treated as if the service is not enabled and not working properly on the machine. Possible values are:
+    * `enabled`: The service is enabled and working.
+    * `disabled`: The service can be enabled but is not currently.
+    * `n/a`: The service cannot be enabled on this machine.
+    * `warning`: The service is supposed to be enabled but something is wrong. Check the `warning` field in the service item for additional information.
+
+For example, if you want to programatically find the status of esm-infra on a particular machine, you can use the following command:
+```shell
+sudo pro status --format=json | jq '.services[] | select(.name == "esm-infra").status'
+```
+That command will print one of the `status` values defined above.
+
+```{attention}
+In an future version of Ubuntu Pro Client, there will be an [API](../references/api.md) function to access this information. For now, though, `pro status --format=json` is the recommended machine-readable interface to this data.
+```
diff --git a/docs/googleaf254801a5285c31.html b/docs/googleaf254801a5285c31.html
new file mode 100644
index 0000000..b603071
--- /dev/null
+++ b/docs/googleaf254801a5285c31.html
@@ -0,0 +1 @@
+google-site-verification: googleaf254801a5285c31.html
\ No newline at end of file
diff --git a/docs/howtoguides.rst b/docs/howtoguides.rst
index 7127394..5b93de6 100644
--- a/docs/howtoguides.rst
+++ b/docs/howtoguides.rst
@@ -59,6 +59,7 @@ How to use ``pro`` commands
     :maxdepth: 1
 
     Run `fix` in "dry run" mode <howtoguides/how_to_run_fix_in_dry_run_mode.md>
+    Skip fixing related USNs <howtoguides/how_to_not_fix_related_usns.md>
 
 ``refresh``
 -----------
diff --git a/docs/howtoguides/enable_fips.md b/docs/howtoguides/enable_fips.md
index 8f614fb..4fe8b8a 100644
--- a/docs/howtoguides/enable_fips.md
+++ b/docs/howtoguides/enable_fips.md
@@ -36,5 +36,5 @@ been installed:
 ```
 Installing FIPS packages
 FIPS enabled
-A reboot is required to complete installl
+A reboot is required to complete install.
 ```
diff --git a/docs/howtoguides/get_rid_of_corrupt_lock.md b/docs/howtoguides/get_rid_of_corrupt_lock.md
index 03da4a3..17e8e37 100644
--- a/docs/howtoguides/get_rid_of_corrupt_lock.md
+++ b/docs/howtoguides/get_rid_of_corrupt_lock.md
@@ -2,7 +2,7 @@
 
 Some pro commands (`attach`, `enable`, `detach` and `disable`) will potentially change the
 internal state of your system. Since those commands can run in parallel, we have a lock file
-mechanism to guarantee that only one of these commands can run at the same time. The lock follow
+mechanism to guarantee that only one of these commands can run at the same time. The lock follows
 this pattern:
 
 ```
diff --git a/docs/howtoguides/get_token_and_attach.md b/docs/howtoguides/get_token_and_attach.md
index 41726ef..ff15c15 100644
--- a/docs/howtoguides/get_token_and_attach.md
+++ b/docs/howtoguides/get_token_and_attach.md
@@ -1,10 +1,21 @@
 # How to get an Ubuntu Pro token and attach to a subscription
 
+## Get an Ubuntu Pro token
+
 Retrieve your Ubuntu Pro token from the
-[Ubuntu Pro portal](https://ubuntu.com/pro/). You will log in with your "Single 
+[Ubuntu Pro portal](https://ubuntu.com/pro/). Log in with your "Single
 Sign On" credentials, the same credentials you use for https://login.ubuntu.com.
-Note that you can obtain a free personal token, which provides you with access
-to several of the Ubuntu Pro services.
+
+Being logged in you can then go to the
+[Ubuntu Pro Dashboard](https://ubuntu.com/pro/dashboard) that is associated to
+your user. It will show you all subscriptions currently available to you and
+for each the associated token.
+
+Note that even without buying anything you can always obtain a free personal
+token that way, which provides you with access to several of the Ubuntu Pro
+services.
+
+## Attach to a subscription
 
 Once that token is obtained, to attach your machine to a subscription, just run:
 
@@ -35,3 +46,26 @@ Enable services with: pro enable <service>
 Once the Ubuntu Pro Client is attached to your Ubuntu Pro account, you can use
 it to activate various services, including: access to ESM packages, Livepatch,
 FIPS, and CIS. Some features are specific to certain LTS releases.
+
+## Control of auto-enabled services
+
+Your subscription controls which services are available to you and which ones
+you can manage via the [Ubuntu Pro Dashboard](https://ubuntu.com/pro/dashboard).
+
+Recommended services are auto-enabled by default when attaching a system.
+You can choose which of the available services will be automatically
+enabled or disabled when you attach by toggling them in the
+[Ubuntu Pro Dashboard](https://ubuntu.com/pro/dashboard). 
+Available services can always be enabled or disabled on the command line
+with `pro enable` and `pro disable` after attaching.
+
+![Toggling recommended services in the Pro Dashboard](pro-dashboard-service-toggles.png)
+
+If your subscription does not permit you to change the default
+enabled services via the Dashboard, or if you want to keep the
+defaults but do not want to auto-enable any services while attaching a particular
+machine, you can pass the `--no-auto-enable` flag to `attach` using the following command:
+
+```
+$ sudo pro attach YOUR_TOKEN --no-auto-enable
+```
diff --git a/docs/howtoguides/how_to_not_fix_related_usns.md b/docs/howtoguides/how_to_not_fix_related_usns.md
new file mode 100644
index 0000000..c9fabf0
--- /dev/null
+++ b/docs/howtoguides/how_to_not_fix_related_usns.md
@@ -0,0 +1,65 @@
+# How to not fix related USNs
+
+When running the `pro fix` command for a USN, by default we also try to fix
+any related USNs as well. To better understand the concept of related USNs,
+you can refer to our [related USNs guide](../explanations/cves_and_usns_explained.md).
+To make this clear, let's take a look into the following example:
+
+```
+USN-5573-1: rsync vulnerability
+Found CVEs:
+  - https://ubuntu.com/security/CVE-2022-37434
+
+Fixing requested USN-5573-1
+1 affected source package is installed: rsync
+(1/1) rsync:
+A fix is available in Ubuntu standard updates.
+{ apt update && apt install --only-upgrade -y rsync }
+
+✔ USN-5573-1 is resolved.
+
+Found related USNs:
+- USN-5570-1
+- USN-5570-2
+
+Fixing related USNs:
+- USN-5570-1
+No affected source packages are installed.
+
+✔ USN-5570-1 does not affect your system.
+
+- USN-5570-2
+1 affected source package is installed: zlib
+(1/1) zlib:
+A fix is available in Ubuntu standard updates.
+{ apt update && apt install --only-upgrade -y zlib1g }
+
+✔ USN-5570-2 is resolved.
+
+Summary:
+✔ USN-5573-1 [requested] is resolved.
+✔ USN-5570-1 [related] does not affect your system.
+✔ USN-5570-2 [related] is resolved.
+```
+
+We can see here that the `pro fix` command fixed the requested **USN-5573-1** while also
+handling both **USN-5570-1** and **USN-5570-2**, which are related to the requested USN.
+If you don't want to fix any related USNs during the `fix` operation, just use the
+`--no-related` flag. By running the command `pro fix USN-5573-1 --no-related` we would get
+the following output instead:
+
+```
+USN-5573-1: rsync vulnerability
+Found CVEs:
+  - https://ubuntu.com/security/CVE-2022-37434
+
+Fixing requested USN-5573-1
+1 affected source package is installed: rsync
+(1/1) rsync:
+A fix is available in Ubuntu standard updates.
+{ apt update && apt install --only-upgrade -y rsync }
+
+✔ USN-5573-1 is resolved.
+```
+
+Note that we have not analysed or tried to fix any related USNs
diff --git a/docs/howtoguides/pro-dashboard-service-toggles.png b/docs/howtoguides/pro-dashboard-service-toggles.png
new file mode 100644
index 0000000..90095f5
Binary files /dev/null and b/docs/howtoguides/pro-dashboard-service-toggles.png differ
diff --git a/docs/images/usn-related.png b/docs/images/usn-related.png
new file mode 100644
index 0000000..9db73c0
Binary files /dev/null and b/docs/images/usn-related.png differ
diff --git a/docs/index.rst b/docs/index.rst
index b63cce0..d07dd4d 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -63,9 +63,10 @@ using it!
   
 - **Having trouble?**
   We would like to help! To get help on a specific page in this documentation,
-  simply click on the "Have a question?" link at the top of that page. This
+  simply click on the "Give feedback" link at the top of that page. This
   will open up an issue in GitHub where you can tell us more about the problem
-  you're having and we will do our best to resolve it for you.
+  you're having or suggestion you'd like to make, and we will do our best to
+  resolve it for you.
 
 - **Found a bug?**
   You can `Report bugs on Launchpad`_!
diff --git a/docs/references/api.md b/docs/references/api.md
index 4708d9b..117875e 100644
--- a/docs/references/api.md
+++ b/docs/references/api.md
@@ -75,6 +75,28 @@ except ImportError:
 
 You could do something similar by catching certain errors when using the `pro api` subcommand, but there are more cases that could indicate an old version, and it generally isn't recommended.
 
+
+### Errors and Warnings fields
+
+When using the API through the CLI, we use two distinct fields to list issues to the users; *errors*
+and *warnings*. Both of those fields will contain a list of JSON objects explaining unexpected
+behavior during the execution of a command. For example, the *errors* field will be populated like
+this if we have a connectivity issue when running a `pro api` command:
+
+```json
+[
+    {
+        "msg": "Failed to connect to authentication server",
+        "code": "connectivity-error",
+        "meta": {}
+    }
+]
+```
+
+Finally, *warnings* follow the exact same structure as *errors*. The only difference is that
+*warnings* means that the command was able to complete although unexpected scenarios happened
+when executing the command.
+
 ## Available endpoints
 The currently available endpoints are:
 - [u.pro.version.v1](#uproversionv1)
@@ -88,7 +110,10 @@ The currently available endpoints are:
 - [u.pro.security.status.reboot_required.v1](#uprosecuritystatusreboot_requiredv1)
 - [u.pro.packages.summary.v1](#upropackagessummaryv1)
 - [u.pro.packages.updates.v1](#upropackagesupdatesv1)
+- [u.pro.status.is_attached.v1](#uprostatusis_attachedv1)
+- [u.pro.status.enabled_services.v1](#uprostatusenabled_servicesv1)
 - [u.security.package_manifest.v1](#usecuritypackage_manifestv1)
+- [u.unattended_upgrades.status.v1](#uunattended_upgradesstatusv1)
 
 ## u.pro.version.v1
 
@@ -753,6 +778,86 @@ pro api u.pro.packages.updates.v1
 }
 ```
 
+## u.pro.status.is_attached.v1
+
+Introduced in Ubuntu Pro Client Version: `28~`
+
+Shows if the machine is attached to a Pro subscription.
+
+### Args
+
+This endpoint takes no arguments.
+
+### Python API interaction
+
+#### Calling from Python code
+
+```python
+from uaclient.api.u.pro.status.is_attached.v1 import is_attached
+
+result = is_attached()
+```
+
+#### Expected return object:
+
+`uaclient.api.u.pro.status.is_attached.v1.IsAttachedResult`
+
+|Field Name|Type|Description|
+|-|-|-|
+|`is_attached`|*bool*|If the machine is attached to a Pro subscription|
+
+### CLI interaction
+
+#### Calling from the CLI:
+
+```bash
+pro api u.pro.status.is_attached.v1
+```
+
+## u.pro.status.enabled_services.v1
+
+Introduced in Ubuntu Pro Client Version: `28~`
+
+Shows the Pro services that are enabled in the machine.
+
+### Args
+
+This endpoint takes no arguments.
+
+### Python API interaction
+
+#### Calling from Python code
+
+```python
+from uaclient.api.u.pro.status.enabled_services.v1 import enabled_services
+
+result = enabled_services()
+```
+
+#### Expected return object:
+
+`uaclient.api.u.pro.status.enabled_services.v1.EnabledServicesResult`
+
+|Field Name|Type|Description|
+|-|-|-|
+|`enabled_services`|*List[EnabledService]*|A list of EnabledServices objects|
+
+`uaclient.api.u.pro.status.enabled_services.v1.EnabledService`
+
+|Field Name|Type|Description|
+|-|-|-|
+|`name`           |*str*           |name of the service                         |
+|`variant_enabled`|*bool*          |If a variant of the service is enabled      |
+|`variant_name`   |*Optional[str]* |name of the variant, if a variant is enabled|
+
+### CLI interaction
+
+#### Calling from the CLI:
+
+```bash
+pro api u.pro.status.enabled_services.v1
+```
+
 ## u.security.package_manifest.v1
 
 Introduced in Ubuntu Pro Client Version: `27.12~`
@@ -801,3 +906,105 @@ pro api u.security.package_manifest.v1
     "package_manifest":"package1\t1.0\npackage2\t2.3\n"
 }
 ```
+
+## u.unattended_upgrades.status.v1
+
+Introduced in Ubuntu Pro Client Version: `27.14~`
+
+Returns the status around unattended-upgrades. The focus of the endpoint
+is to verify if the application is running and how it is configured on
+the machine.
+
+```{important}
+For this endpoint, we deliver a unique key under `meta` called `raw_config`. This field contains
+all related unattended-upgrades configurations unparsed. This means that this field will maintain
+both original name and values for those configurations.
+``` 
+
+### Args
+
+This endpoint takes no arguments.
+
+### Python API interaction
+
+#### Calling from Python code
+
+```python
+from uaclient.api.u.unattended_upgrades.status.v1 import status
+
+result = status()
+```
+
+#### Expected return object:
+`uaclient.api.u.unattended_upgrades.status.v1.UnattendedUpgradesStatusResult
+
+|Field Name|Type|Description|
+|-|-|-|
+|`systemd_apt_timer_enabled`|*bool*|Indicate if the apt-daily.timer jobs are enabled|
+|`apt_periodic_job_enabled`|*bool*|Indicate if the APT::Periodic::Enabled configuration is turned off|
+|`package_lists_refresh_frequency_days`|*int*|The value of the APT::Periodic::Update-Package-Lists configuration|
+|`unattended_upgrades_frequency_days`|*int*|The value of the APT::Periodic::Unattended-Upgrade configuration|
+|`unattended_upgrades_allowed_origins`|*List[str]*|The value of the Unattended-Upgrade::Allowed-Origins configuration|
+|`unattended_upgrades_running`|*bool*|Indicate if the unattended-upgrade service is correctly configured and running|
+|`unattended_upgrades_disabled_reason`|*object*|Object that explains why unattended-upgrades is not running. In case the application is running, the object will be null|
+|`unatteded_upgrades_last_run`|`datetime.datetime`|The last time unattended-upgrades has run|
+
+`uaclient.api.u.unattended_upgrades.status.v1.UnattendedUpgradesStatusDisabledReason`
+
+|Field Name|Type|Description|
+|-|-|-|
+|`msg`|*str*|The reason why unattended-upgrades is not running in the system|
+|`code`|*str*|The message code associated with the message|
+
+### Raised exceptions
+
+- `UnattendedUpgradesError`: Raised in case we cannot run a necessary command to show the status
+  of unattended-upgrades
+
+### CLI interaction
+
+#### Calling from the CLI:
+
+```bash
+pro api u.unattended_upgrades.status.v1
+```
+
+#### Expected attributes in JSON structure
+
+```json
+{
+    "apt_periodic_job_enabled": true,
+    "package_lists_refresh_frequency_days": 1,
+    "systemd_apt_timer_enabled": true,
+    "unattended_upgrades_allowed_origins": [
+      "${distro_id}:${distro_codename}",
+      "${distro_id}:${distro_codename}-security",
+      "${distro_id}ESMApps:${distro_codename}-apps-security",
+      "${distro_id}ESM:${distro_codename}-infra-security"
+    ],
+    "unattended_upgrades_disabled_reason": null,
+    "unattended_upgrades_frequency_days": 1,
+    "unattended_upgrades_last_run": null,
+    "unattended_upgrades_running": true
+}
+```
+
+#### Possible attributes in JSON meta field
+```json
+{
+    "meta": {
+      "environment_vars": [],
+      "raw_config": {
+        "APT::Periodic::Enable": "1",
+        "APT::Periodic::Unattended-Upgrade": "1",
+        "APT::Periodic::Update-Package-Lists": "1",
+        "Unattended-Upgrade::Allowed-Origins": [
+          "${distro_id}:${distro_codename}",
+          "${distro_id}:${distro_codename}-security",
+          "${distro_id}ESMApps:${distro_codename}-apps-security",
+          "${distro_id}ESM:${distro_codename}-infra-security"
+        ]
+      }
+    }
+}
+```
diff --git a/docs/references/network_requirements.md b/docs/references/network_requirements.md
index cb25256..66d01df 100644
--- a/docs/references/network_requirements.md
+++ b/docs/references/network_requirements.md
@@ -1,35 +1,41 @@
 # Ubuntu Pro Client network requirements
 
-Using the Ubuntu Pro Client to enable support services will rely on network
-access to:
-
-- Obtain updated service credentials
-- Add APT repositories to install `deb` packages
-- Install [`snap` packages](https://snapcraft.io/about) when Livepatch is
-  enabled.
+The Ubuntu Pro Client (`pro`) and Ubuntu Pro services need to make network requests to certain services to function correctly.
 
 ```{seealso}
-
-You can also refer to our [Proxy Configuration guide](/../howtoguides/configure_proxies.md)
+You can also refer to our [Proxy Configuration guide](../howtoguides/configure_proxies.md)
 to learn how to inform Ubuntu Pro Client of HTTP(S)/APT proxies.
 ```
 
-## Network-limited
+## Authentication
+`pro` needs to authenticate with Canonical servers to provision credentials for access to the individual Ubuntu Pro services.
 
-Ensure the managed system has access to the following port:urls if in a
-network-limited environment:
+Necessary endpoints:
+- `contracts.canonical.com:443`
 
-* `443:https://contracts.canonical.com/`: HTTP PUTs, GETs and POSTs for Ubuntu
-  Pro Client interaction.
-* `443:https://esm.ubuntu.com/\*`: APT repository access for most services.
 
-## Enable kernel Livepatch
+## APT package based services
+Many services are delivered via authenticated APT repositories. These include:
+- `esm-infra` and `esm-apps`
+- `fips` and `fips-updates`
+- `cis` and `usg`
+- `cc-eal`
+- `ros` and `ros-updates`
+- `realtime-kernel`
 
-Enabling kernel Livepatch requires additional network egress:
+Necessary endpoints:
+- `esm.ubuntu.com:443`
 
-* `snap` endpoints required in order to install and run snaps as defined in
-  [snap forum network-requirements post](https://forum.snapcraft.io/t/network-requirements/5147)
-* `443:api.snapcraft.io`
-* `443:dashboard.snapcraft.io`
-* `443:login.ubuntu.com`
-* `443:\*.snapcraftcontent.com` - Download CDNs
+## Livepatch
+`livepatch` requires a `snap`-packaged client, so `snap`-related endpoints are necessary. The Livepatch client itself also requires network access to download the patches from the Livepatch server.
+```{seealso}
+The [snap documentation page](https://snapcraft.io/docs/network-requirements) may have more up-to-date information on snap-related network requirements.
+```
+Necessary endpoints for `snap`:
+- `api.snapcraft.io:443`
+- `dashboard.snapcraft.io:443`
+- `login.ubuntu.com:443`
+- `*.snapcraftcontent.com:443`
+
+Necessary endpoints for `livepatch`:
+- `livepatch.canonical.com:443`
diff --git a/docs/sitemap-index.xml b/docs/sitemap-index.xml
new file mode 100644
index 0000000..efce50f
--- /dev/null
+++ b/docs/sitemap-index.xml
@@ -0,0 +1,8 @@
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+    <url>
+        <loc>https://canonical-ubuntu-pro-client.readthedocs-hosted.com/en/latest/</loc>
+        <changefreq>weekly</changefreq>
+        <priority>1.0</priority>
+    </url>
+</urlset>
+
diff --git a/docs/tutorials/create_a_fips_updates_pro_cloud_image.md b/docs/tutorials/create_a_fips_updates_pro_cloud_image.md
index e4427bc..10b87b3 100644
--- a/docs/tutorials/create_a_fips_updates_pro_cloud_image.md
+++ b/docs/tutorials/create_a_fips_updates_pro_cloud_image.md
@@ -1,8 +1,8 @@
-# Customised Cloud Ubuntu Pro images with FIPS updates
+# How to customise a cloud Ubuntu Pro image with FIPS updates
 
 ## Launch an Ubuntu Pro instance on your cloud
 
-See the following links for up to date information for each supported Cloud:
+See the following links for up to date information for each supported cloud:
 
 * https://ubuntu.com/aws/pro
 * https://ubuntu.com/azure/pro
@@ -10,20 +10,20 @@ See the following links for up to date information for each supported Cloud:
 
 ## Enable FIPS updates
 
-First, we need to wait for the standard Ubuntu Pro services to be set up:
+Wait for the standard Ubuntu Pro services to be set up:
 
 ```bash
 sudo pro status --wait
 ```
 
-We can then use [the `enable` command](../howtoguides/enable_fips.md) to set up
+Use [the `enable` command](../howtoguides/enable_fips.md) to set up
 FIPS updates.
 
 ```bash
 sudo pro enable fips-updates --assume-yes
 ```
 
-Now, we need to reboot the instance:
+Now, reboot the instance:
 
 ```bash
 sudo reboot
@@ -49,12 +49,12 @@ Cloud-specific instructions are here:
 * [Azure](https://docs.microsoft.com/en-us/azure/virtual-machines/windows/capture-image-resource)
 * [GCP](https://cloud.google.com/compute/docs/machine-images/create-machine-images)
 
-## Launch your custom image!
+## Launch your custom image
 
-Use your specific Cloud to launch a new instance from your custom image.
+Use your specific cloud to launch a new instance from the custom image.
 
 ````{note}
-For versions prior to 27.11, you will need to re-enable `fips-updates` on each
+For versions of the Ubuntu Pro Client prior to 27.11, you will need to re-enable `fips-updates` on each
 instance launched from the custom image.
 
 This won't require a reboot and is only necessary to ensure the instance gets
@@ -64,7 +64,7 @@ updates to FIPS packages when they become available.
 sudo pro enable fips-updates --assume-yes
 ```
 
-You can easily script this using [cloud-init user data](https://cloudinit.readthedocs.io/en/latest/topics/modules.html#runcmd) at launch time:
+This can be scripted using [cloud-init user data](https://cloudinit.readthedocs.io/en/latest/topics/modules.html#runcmd) at launch time:
 ```yaml
 #cloud-config
 # Enable fips-updates after pro auto-attach and reboot after cloud-init completes
diff --git a/docs/tutorials/fix_scenarios.md b/docs/tutorials/fix_scenarios.md
index fe6f8e2..1c96800 100644
--- a/docs/tutorials/fix_scenarios.md
+++ b/docs/tutorials/fix_scenarios.md
@@ -81,7 +81,9 @@ You should see an output like this:
 ```
 CVE-2020-15180: MariaDB vulnerabilities
 https://ubuntu.com/security/CVE-2020-15180
+
 No affected source packages are installed.
+
 ✔ CVE-2020-15180 does not affect your system.
 ```
 
@@ -110,10 +112,12 @@ You will then see the following output:
 ```
 CVE-2020-25686: Dnsmasq vulnerabilities
 https://ubuntu.com/security/CVE-2020-25686
+
 1 affected package is installed: dnsmasq
 (1/1) dnsmasq:
 A fix is available in Ubuntu standard updates.
 { apt update && apt install --only-upgrade -y dnsmasq }
+
 ✔ CVE-2020-25686 is resolved.
 ```
 
@@ -137,10 +141,12 @@ run the `pro fix` command again, and we should now see the following:
 ```
 CVE-2020-25686: Dnsmasq vulnerabilities
 https://ubuntu.com/security/CVE-2020-25686
+
 1 affected package is installed: dnsmasq
 (1/1) dnsmasq:
 A fix is available in Ubuntu standard updates.
 The update is already installed.
+
 ✔ CVE-2020-25686 is resolved.
 ```
 
@@ -151,30 +157,34 @@ let you know! Before we reproduce this scenario, let us first install a package
 that we know has no fix available by running:
 
 ```console
-$ sudo apt install -y libawl-php
+$ sudo apt-get install -y expat=2.1.0-7 swish-e matanza ghostscript
 ```
 
 Now, we can confirm that there is no fix by running the following command:
 
 ```console
-$ pro fix USN-4539-1
+$ pro fix CVE-2017-9233
 ```
 
 You will see the following output:
 
 ```
-USN-4539-1: AWL vulnerability
-Found CVEs:
-https://ubuntu.com/security/CVE-2020-11728
-1 affected source package is installed: awl
-(1/1) awl:
-Sorry, no fix is available.
-1 package is still affected: awl
-✘ USN-4539-1 is not resolved.
+CVE-2017-9233: Coin3D vulnerability
+  - https://ubuntu.com/security/CVE-2017-9233
+
+3 affected source packages are installed: expat, matanza, swish-e
+(1/3, 2/3) matanza, swish-e:
+Ubuntu security engineers are investigating this issue.
+(3/3) expat:
+A fix is available in Ubuntu standard updates.
+{ apt update && apt install --only-upgrade -y expat }
+
+2 packages are still affected: matanza, swish-e
+✘ CVE-2017-9233 is not resolved.
 ```
 
-As you can see, we are informed by `pro fix` that there is no fix available. In
-the last line, we can also see that the USN is not resolved.
+As you can see, we are informed by `pro fix` that some packages do not have a fix available. In
+the last line, we can also see that the CVE is not resolved.
 
 ## CVE/USN that require an Ubuntu Pro subscription
 
@@ -193,6 +203,8 @@ USN-5079-2: curl vulnerabilities
 Found CVEs:
 https://ubuntu.com/security/CVE-2021-22946
 https://ubuntu.com/security/CVE-2021-22947
+
+Fixing requested USN-5079-2
 1 affected package is installed: curl
 (1/1) curl:
 A fix is available in Ubuntu Pro: ESM Infra.
@@ -222,6 +234,7 @@ USN-5079-2: curl vulnerabilities
 Found CVEs:
 https://ubuntu.com/security/CVE-2021-22946
 https://ubuntu.com/security/CVE-2021-22947
+
 1 affected package is installed: curl
 (1/1) curl:
 A fix is available in Ubuntu Pro: ESM Infra.
@@ -258,22 +271,40 @@ Enable services with: pro enable <service>
 Technical support level: essential
 { apt update && apt install --only-upgrade -y curl libcurl3-gnutls }
 ✔ USN-5079-2 is resolved.
+
+Found related USNs:
+- USN-5079-1
+
+Fixing related USNs:
+- USN-5079-1
+No affected source packages are installed.
+
+✔ USN-5079-1 does not affect your system.
+
+Summary:
+✔ USN-5079-2 [requested] is resolved.
+✔ USN-5079-1 [related] does not affect your system.
 ```
 
-We can see that that the attach command was successful, which can be verified
+We can see that this command also fixed related USN **USN-5079-1**.
+If you want to learn more about related USNs, refer to [our explanation guide](../explanations/cves_and_usns_explained.md#what-are-related-usns)
+
+Finally, we can see that that the attach command was successful, which can be verified
 by the status output we see when executing the command. Additionally, we can
 observe that the USN is indeed fixed, which you can confirm by running the
 `pro fix` command again:
 
 ```
-N-5079-2: curl vulnerabilities
+USN-5079-2: curl vulnerabilities
 Found CVEs:
 https://ubuntu.com/security/CVE-2021-22946
 https://ubuntu.com/security/CVE-2021-22947
+
 1 affected package is installed: curl
 (1/1) curl:
 A fix is available in Ubuntu Pro: ESM Infra.
 The update is already installed.
+
 ✔ USN-5079-2 is resolved.
 ```
 
@@ -308,6 +339,7 @@ prompted):
 ```
 CVE-2021-44731: snapd vulnerabilities
 https://ubuntu.com/security/CVE-2021-44731
+
 1 affected package is installed: snapd
 (1/1) snapd:
 A fix is available in Ubuntu Pro: ESM Infra.
@@ -321,6 +353,7 @@ One moment, checking your subscription first
 Updating package lists
 Ubuntu Pro: ESM Infra enabled
 { apt update && apt install --only-upgrade -y ubuntu-core-launcher snapd }
+
 ✔ CVE-2021-44731 is resolved.
 ```
 
@@ -342,13 +375,15 @@ $ sudo pro fix CVE-2022-0778
 Then you will see the following output:
 
 ```
-VE-2022-0778: OpenSSL vulnerability
+CVE-2022-0778: OpenSSL vulnerability
 https://ubuntu.com/security/CVE-2022-0778
+
 1 affected package is installed: openssl
 (1/1) openssl:
 A fix is available in Ubuntu Pro: ESM Infra.
 { apt update && apt install --only-upgrade -y libssl1.0.0 openssl }
 A reboot is required to complete fix operation.
+
 ✘ CVE-2022-0778 is not resolved.
 ```
 
@@ -358,10 +393,12 @@ indeed fixed:
 ```
 CVE-2022-0778: OpenSSL vulnerability
 https://ubuntu.com/security/CVE-2022-0778
+
 1 affected package is installed: openssl
 (1/1) openssl:
 A fix is available in Ubuntu Pro: ESM Infra.
 The update is already installed.
+
 ✔ CVE-2022-0778 is resolved.
 ```
 
@@ -390,6 +427,7 @@ And you will see the following output:
 ```
 CVE-2017-9233: Expat vulnerability
 https://ubuntu.com/security/CVE-2017-9233
+
 3 affected packages are installed: expat, matanza, swish-e
 (1/3, 2/3) matanza, swish-e:
 Sorry, no fix is available.
@@ -397,6 +435,7 @@ Sorry, no fix is available.
 A fix is available in Ubuntu standard updates.
 { apt update && apt install --only-upgrade -y expat }
 2 packages are still affected: matanza, swish-e
+
 ✘ CVE-2017-9233 is not resolved.
 ```
 
diff --git a/features/_version.feature b/features/_version.feature
index 2a575d8..3530d3d 100644
--- a/features/_version.feature
+++ b/features/_version.feature
@@ -2,17 +2,17 @@ Feature: Pro is expected version
 
     @series.all
     @uses.config.check_version
-    @uses.config.machine_type.lxd.container
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-container
+    @uses.config.machine_type.lxd-vm
     @uses.config.machine_type.aws.generic
     @uses.config.machine_type.aws.pro
-    @uses.config.machine_type.aws.pro.fips
+    @uses.config.machine_type.aws.pro-fips
     @uses.config.machine_type.azure.generic
     @uses.config.machine_type.azure.pro
-    @uses.config.machine_type.azure.pro.fips
+    @uses.config.machine_type.azure.pro-fips
     @uses.config.machine_type.gcp.generic
     @uses.config.machine_type.gcp.pro
-    @uses.config.machine_type.gcp.pro.fips
+    @uses.config.machine_type.gcp.pro-fips
     Scenario Outline: Check pro version
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I run `dpkg-query --showformat='${Version}' --show ubuntu-advantage-tools` with sudo
@@ -44,7 +44,7 @@ Feature: Pro is expected version
 
     @series.all
     @uses.config.check_version
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     @upgrade
     Scenario Outline: Check pro version
         Given a `<release>` machine with ubuntu-advantage-tools installed
diff --git a/features/airgapped.feature b/features/airgapped.feature
index 707d25b..2997971 100644
--- a/features/airgapped.feature
+++ b/features/airgapped.feature
@@ -2,7 +2,7 @@
 Feature: Performing attach using ua-airgapped
 
     @series.jammy
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable Common Criteria service in an ubuntu lxd container
         Given a `<release>` machine with ubuntu-advantage-tools installed
         # set up the apt mirror configuration
diff --git a/features/api.feature b/features/api.feature
index 8ac86f4..950b012 100644
--- a/features/api.feature
+++ b/features/api.feature
@@ -1,7 +1,7 @@
 Feature: Client behaviour for the API endpoints
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: API invalid endpoint or args
     Given a `<release>` machine with ubuntu-advantage-tools installed
     When I verify that running `pro api invalid.endpoint` `with sudo` exits `1`
@@ -25,7 +25,7 @@ Feature: Client behaviour for the API endpoints
            | lunar   |
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Basic endpoints
     Given a `<release>` machine with ubuntu-advantage-tools installed
     When I run `pro api u.pro.version.v1` with sudo
@@ -43,6 +43,16 @@ Feature: Client behaviour for the API endpoints
     """
     {"_schema_version": "v1", "data": {"attributes": {"should_auto_attach": false}, "meta": {"environment_vars": \[\]}, "type": "ShouldAutoAttach"}, "errors": \[\], "result": "success", "version": ".*", "warnings": \[\]}
     """
+    When I run `ua api u.pro.status.is_attached.v1` with sudo
+    Then stdout matches regexp:
+    """
+    {"_schema_version": "v1", "data": {"attributes": {"is_attached": false}, "meta": {"environment_vars": \[\]}, "type": "IsAttached"}, "errors": \[\], "result": "success", "version": ".*", "warnings": \[\]}
+    """
+    When I run `ua api u.pro.status.enabled_services.v1` with sudo
+    Then stdout matches regexp:
+    """
+    {"_schema_version": "v1", "data": {"attributes": {"enabled_services": \[\]}, "meta": {"environment_vars": \[\]}, "type": "EnabledServices"}, "errors": \[\], "result": "success", "version": ".*", "warnings": \[\]}
+    """
 
     Examples: ubuntu release
            | release |
diff --git a/features/api_configure_retry_service.feature b/features/api_configure_retry_service.feature
index d3d6edb..31ef305 100644
--- a/features/api_configure_retry_service.feature
+++ b/features/api_configure_retry_service.feature
@@ -1,7 +1,7 @@
 Feature: api.u.pro.attach.auto.configure_retry_service
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: v1 successfully triggers retry service when run during startup
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I change contract to staging with sudo
diff --git a/features/api_full_auto_attach.feature b/features/api_full_auto_attach.feature
index c65fca5..9df2f69 100644
--- a/features/api_full_auto_attach.feature
+++ b/features/api_full_auto_attach.feature
@@ -27,7 +27,7 @@ Feature: Full Auto-Attach Endpoint
         """
         Then stdout matches regexp:
         """
-        livepatch     +yes +(disabled|n/a)  +Canonical Livepatch service
+        livepatch     +yes +(disabled|n/a)  +(Canonical Livepatch service|Current kernel is not supported)
         """
         Examples:
            | release |
diff --git a/features/api_magic_attach.feature b/features/api_magic_attach.feature
index 4ab6592..2364a81 100644
--- a/features/api_magic_attach.feature
+++ b/features/api_magic_attach.feature
@@ -1,7 +1,7 @@
 Feature: Magic Attach endpoints
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Call magic attach endpoints
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I change contract to staging with sudo
diff --git a/features/api_packages.feature b/features/api_packages.feature
index e22798b..da63bbc 100644
--- a/features/api_packages.feature
+++ b/features/api_packages.feature
@@ -1,7 +1,7 @@
 Feature: Package related API endpoints
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     @uses.config.contract_token
     Scenario Outline: Call packages API endpoints to see information in a Ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
diff --git a/features/api_security.feature b/features/api_security.feature
index 85e8ae8..c682bee 100644
--- a/features/api_security.feature
+++ b/features/api_security.feature
@@ -1,7 +1,7 @@
 Feature: API security/security status tests
 
     @series.xenial
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     @uses.config.contract_token
     Scenario: Call Livepatched CVEs endpoint
         Given a `xenial` machine with ubuntu-advantage-tools installed
@@ -17,7 +17,7 @@ Feature: API security/security status tests
          """
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     @uses.config.contract_token
     Scenario Outline: Call package manifest endpoint for machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
diff --git a/features/api_unattended_upgrades.feature b/features/api_unattended_upgrades.feature
index 43f0ef6..9449ef5 100644
--- a/features/api_unattended_upgrades.feature
+++ b/features/api_unattended_upgrades.feature
@@ -1,7 +1,7 @@
 Feature: api.u.unattended_upgrades.status.v1
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: v1 unattended upgrades status
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I run `pro api u.unattended_upgrades.status.v1` as non-root
diff --git a/features/apt_messages.feature b/features/apt_messages.feature
index 401360d..90ed066 100644
--- a/features/apt_messages.feature
+++ b/features/apt_messages.feature
@@ -1,7 +1,7 @@
 Feature: APT Messages
 
     @series.xenial
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: APT JSON Hook prints package counts correctly on xenial
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -99,7 +99,7 @@ Feature: APT Messages
            | xenial  | accountsservice=0.6.40-2ubuntu10 libaccountsservice0=0.6.40-2ubuntu10 | curl=7.47.0-1ubuntu2 libcurl3-gnutls=7.47.0-1ubuntu2 | hello=2.10-1 |
 
     @series.xenial
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: APT Hook advertises esm-infra on upgrade
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I run `apt-get update` with sudo
@@ -157,7 +157,7 @@ Feature: APT Messages
     @series.bionic
     @series.focal
     @series.jammy
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: APT Hook advertises esm-apps on upgrade
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I run `apt-get update` with sudo
@@ -175,7 +175,7 @@ Feature: APT Messages
         Calculating upgrade...
         Get more security updates through Ubuntu Pro with 'esm-apps' enabled:
           <package>
-        Learn more about Ubuntu Pro at https://ubuntu.com/pro
+        <learn_more_msg>
         0 upgraded, 0 newly installed, 0 to remove and \d+ not upgraded.
         """
         When I run `apt-get upgrade` with sudo
@@ -211,13 +211,13 @@ Feature: APT Messages
         0 upgraded, 0 newly installed, 0 to remove and \d+ not upgraded\.
         """
         Examples: ubuntu release
-          | release | package |
-          | bionic  | ansible |
-          | focal   | hello   |
-          | jammy   | hello   |
+          | release | package | learn_more_msg                                                    |
+          | bionic  | ansible | Learn more about Ubuntu Pro for 18.04 at https://ubuntu.com/18-04 |
+          | focal   | hello   | Learn more about Ubuntu Pro at https://ubuntu.com/pro             |
+          | jammy   | hello   | Learn more about Ubuntu Pro at https://ubuntu.com/pro             |
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: APT News
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -613,60 +613,35 @@ Feature: APT Messages
 
     @series.xenial
     @series.bionic
+    @series.focal
+    @uses.config.machine_type.any
     @uses.config.machine_type.aws.generic
-    Scenario Outline: AWS URLs
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I run `apt-get update` with sudo
-        When I run `apt-get install ansible -y` with sudo
-        When I run `apt-get update` with sudo
-        When I run `apt upgrade --dry-run` with sudo
-        Then stdout matches regexp:
-        """
-        <msg>
-        """
-        Examples: ubuntu release
-          | release | msg                                                                    |
-          | xenial  | Learn more about Ubuntu Pro for 16\.04 at https:\/\/ubuntu\.com\/16-04 |
-          | bionic  | Learn more about Ubuntu Pro on AWS at https:\/\/ubuntu\.com\/aws\/pro  |
-
-    @series.xenial
-    @series.bionic
     @uses.config.machine_type.azure.generic
-    Scenario Outline: Azure URLs
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I run `apt-get update` with sudo
-        When I run `apt-get install ansible -y` with sudo
-        When I run `apt-get update` with sudo
-        When I run `apt upgrade --dry-run` with sudo
-        Then stdout matches regexp:
-        """
-        <msg>
-        """
-        Examples: ubuntu release
-          | release | msg                                                                                    |
-          | xenial  | Learn more about Ubuntu Pro for 16\.04 on Azure at https:\/\/ubuntu\.com\/16-04\/azure |
-          | bionic  | Learn more about Ubuntu Pro on Azure at https:\/\/ubuntu\.com\/azure\/pro              |
-
-    @series.xenial
-    @series.bionic
     @uses.config.machine_type.gcp.generic
-    Scenario Outline: GCP URLs
-        Given a `<release>` machine with ubuntu-advantage-tools installed
+    Scenario Outline: Cloud and series-specific URLs
+        Given a `<release>` `<machine_type>` machine with ubuntu-advantage-tools installed
         When I run `apt-get update` with sudo
         When I run `apt-get install ansible -y` with sudo
         When I run `apt-get update` with sudo
         When I run `apt upgrade --dry-run` with sudo
-        Then stdout matches regexp:
+        Then stdout contains substring:
         """
         <msg>
         """
-        Examples: ubuntu release
-          | release | msg                                                                    |
-          | xenial  | Learn more about Ubuntu Pro for 16\.04 at https:\/\/ubuntu\.com\/16-04 |
-          | bionic  | Learn more about Ubuntu Pro on GCP at https:\/\/ubuntu\.com\/gcp\/pro  |
+        Examples: release-per-machine-type
+          | release | machine_type  | msg                                                                              |
+          | xenial  | aws.generic   | Learn more about Ubuntu Pro for 16.04 at https://ubuntu.com/16-04                |
+          | xenial  | azure.generic | Learn more about Ubuntu Pro for 16.04 on Azure at https://ubuntu.com/16-04/azure |
+          | xenial  | gcp.generic   | Learn more about Ubuntu Pro for 16.04 at https://ubuntu.com/16-04                |
+          | bionic  | aws.generic   | Learn more about Ubuntu Pro for 18.04 at https://ubuntu.com/18-04                |
+          | bionic  | azure.generic | Learn more about Ubuntu Pro for 18.04 on Azure at https://ubuntu.com/18-04/azure |
+          | bionic  | gcp.generic   | Learn more about Ubuntu Pro for 18.04 at https://ubuntu.com/18-04                |
+          | focal   | aws.generic   | Learn more about Ubuntu Pro on AWS at https://ubuntu.com/aws/pro                 |
+          | focal   | azure.generic | Learn more about Ubuntu Pro on Azure at https://ubuntu.com/azure/pro             |
+          | focal   | gcp.generic   | Learn more about Ubuntu Pro on GCP at https://ubuntu.com/gcp/pro                 |
 
     @series.kinetic
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: APT Hook do not advertises esm-apps on upgrade for interim releases
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I run `apt-get update` with sudo
diff --git a/features/attach_invalidtoken.feature b/features/attach_invalidtoken.feature
index d3c145d..5897668 100644
--- a/features/attach_invalidtoken.feature
+++ b/features/attach_invalidtoken.feature
@@ -2,7 +2,7 @@ Feature: Command behaviour when trying to attach a machine to an Ubuntu
          Pro subscription using an invalid token
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attach command failure on invalid token
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I verify that running `pro attach INVALID_TOKEN` `with sudo` exits `1`
@@ -32,7 +32,7 @@ Feature: Command behaviour when trying to attach a machine to an Ubuntu
            | lunar   |
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     @uses.config.contract_token_staging_expired
     Scenario Outline: Attach command failure on expired token
        Given a `<release>` machine with ubuntu-advantage-tools installed
diff --git a/features/attach_validtoken.feature b/features/attach_validtoken.feature
index da04c06..e894c1e 100644
--- a/features/attach_validtoken.feature
+++ b/features/attach_validtoken.feature
@@ -4,22 +4,35 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Pro
 
     @series.kinetic
     @series.lunar
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached command in a non-lts ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
-        And I run `pro status --all` as non-root
+        And I run `pro status` as non-root
         Then stdout matches regexp:
-            """
-            SERVICE       +ENTITLED  STATUS    DESCRIPTION
-            cc-eal        +yes      +n/a      +Common Criteria EAL2 Provisioning Packages
-            cis           +yes      +n/a      +Security compliance and audit tools
-            esm-apps      +yes      +n/a      +Expanded Security Maintenance for Applications
-            esm-infra     +yes      +n/a      +Expanded Security Maintenance for Infrastructure
-            fips          +yes      +n/a      +NIST-certified core packages
-            fips-updates  +yes      +n/a      +NIST-certified core packages with priority security updates
-            livepatch     +yes      +n/a      +Canonical Livepatch service
-            """
+        """
+        No Ubuntu Pro services are available to this system.
+        """
+        And stdout matches regexp:
+        """
+        For a list of all Ubuntu Pro services, run 'pro status --all'
+        """
+        When I run `pro status --all` as non-root
+        Then stdout matches regexp:
+        """
+        SERVICE       +ENTITLED  STATUS    DESCRIPTION
+        cc-eal        +yes      +n/a      +Common Criteria EAL2 Provisioning Packages
+        cis           +yes      +n/a      +Security compliance and audit tools
+        esm-apps      +yes      +n/a      +Expanded Security Maintenance for Applications
+        esm-infra     +yes      +n/a      +Expanded Security Maintenance for Infrastructure
+        fips          +yes      +n/a      +NIST-certified core packages
+        fips-updates  +yes      +n/a      +NIST-certified core packages with priority security updates
+        livepatch     +yes      +n/a      +Canonical Livepatch service
+        """
+        And stdout does not match regexp:
+        """
+        For a list of all Ubuntu Pro services, run 'pro status --all'
+        """
 
         Examples: ubuntu release
             | release |
@@ -27,7 +40,7 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Pro
             | lunar   |
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attach command in a ubuntu lxd container
        Given a `<release>` machine with ubuntu-advantage-tools installed
         When I run `apt-get update` with sudo, retrying exit [100]
@@ -83,10 +96,10 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Pro
            | xenial  | libkrad0=1.13.2+dfsg-5      | disabled  | cis        | disabled | disabled | Canonical Livepatch service   |
            | bionic  | libkrad0=1.16-2build1       | disabled  | cis        | disabled | disabled | Canonical Livepatch service   |
            | focal   | hello=2.10-2ubuntu2         | n/a       | usg        | disabled | disabled | Canonical Livepatch service   |
-           | jammy   | hello=2.10-2ubuntu4         | n/a       | usg        | n/a      | n/a      | Available with the HWE kernel |
+           | jammy   | hello=2.10-2ubuntu4         | n/a       | usg        | n/a      | n/a      | Canonical Livepatch service   |
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attach command with attach config
         Given a `<release>` machine with ubuntu-advantage-tools installed
         # simplest happy path
@@ -306,7 +319,7 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Pro
            | jammy   | enabled   | n/a         | n/a       | usg        | n/a        |
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attach command with json output
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I verify that running attach `as non-root` with json response exits `1`
@@ -334,7 +347,7 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Pro
           | jammy   | n/a      |
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attach and Check for contract change in status checking
        Given a `<release>` machine with ubuntu-advantage-tools installed
        When I attach `contract_token` with sudo
@@ -380,6 +393,7 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Pro
 
         Examples: ubuntu release livepatch status
            | release |
-           | xenial  |
-           | bionic  |
-           | focal   |
+           # removing until we add this feature back in a way that doesn't hammer the server
+           #| xenial  |
+           #| bionic  |
+           #| focal   |
diff --git a/features/attached_commands.feature b/features/attached_commands.feature
index 524e4e0..2681466 100644
--- a/features/attached_commands.feature
+++ b/features/attached_commands.feature
@@ -2,7 +2,7 @@
 Feature: Command behaviour when attached to an Ubuntu Pro subscription
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached refresh in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -60,7 +60,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
            | lunar   |
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached disable of an already disabled service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -86,7 +86,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
            | lunar   |
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached disable with json format
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -144,7 +144,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
     @series.xenial
     @series.bionic
     @series.jammy
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached disable of a service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -183,7 +183,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
            | jammy   | Try cc-eal, esm-apps, esm-infra, fips, fips-updates, livepatch, realtime-kernel,\nros, ros-updates, usg. |
 
     @series.focal
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario: Attached disable of a service in a ubuntu machine
         Given a `focal` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -218,86 +218,91 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
 
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached detach in an ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
+        And I run `pro api u.pro.status.enabled_services.v1` as non-root
+        Then stdout matches regexp:
+        """
+        {"_schema_version": "v1", "data": {"attributes": {"enabled_services": \[{"name": "esm-apps", "variant_enabled": false, "variant_name": null}, {"name": "esm-infra", "variant_enabled": false, "variant_name": null}\]}, "meta": {"environment_vars": \[\]}, "type": "EnabledServices"}, "errors": \[\], "result": "success", "version": ".*", "warnings": \[\]}
+        """
         Then I verify that running `pro detach` `as non-root` exits `1`
         And stderr matches regexp:
-            """
-            This command must be run as root \(try using sudo\).
-            """
+        """
+        This command must be run as root \(try using sudo\).
+        """
         When I run `pro detach --assume-yes` with sudo
         Then I will see the following on stdout:
-            """
-            Detach will disable the following services:
-                esm-apps
-                esm-infra
-            Updating package lists
-            Updating package lists
-            This machine is now detached.
-            """
+        """
+        Detach will disable the following services:
+            esm-apps
+            esm-infra
+        Updating package lists
+        Updating package lists
+        This machine is now detached.
+        """
        When I run `pro status --all` as non-root
        Then stdout matches regexp:
-          """
-          SERVICE       +AVAILABLE  DESCRIPTION
-          cc-eal        +<cc-eal>   +Common Criteria EAL2 Provisioning Packages
-          """
+       """
+       SERVICE       +AVAILABLE  DESCRIPTION
+       cc-eal        +<cc-eal>   +Common Criteria EAL2 Provisioning Packages
+       """
        Then stdout matches regexp:
-          """
-          esm-apps      +<esm-apps> +Expanded Security Maintenance for Applications
-          esm-infra     +yes        +Expanded Security Maintenance for Infrastructure
-          fips          +<fips>     +NIST-certified core packages
-          fips-updates  +<fips>     +NIST-certified core packages with priority security updates
-          livepatch     +(yes|no)   +(Canonical Livepatch service|Current kernel is not supported)
-          realtime-kernel +<realtime-kernel> +Ubuntu kernel with PREEMPT_RT patches integrated
-          ros           +<ros>      +Security Updates for the Robot Operating System
-          ros-updates   +<ros>      +All Updates for the Robot Operating System
-          """
+       """
+       esm-apps      +<esm-apps> +Expanded Security Maintenance for Applications
+       esm-infra     +yes        +Expanded Security Maintenance for Infrastructure
+       fips          +<fips>     +NIST-certified core packages
+       fips-updates  +<fips>     +NIST-certified core packages with priority security updates
+       livepatch     +(yes|no)   +(Canonical Livepatch service|Current kernel is not supported)
+       realtime-kernel +<realtime-kernel> +Ubuntu kernel with PREEMPT_RT patches integrated
+       ros           +<ros>      +Security Updates for the Robot Operating System
+       ros-updates   +<ros>      +All Updates for the Robot Operating System
+       """
        Then stdout matches regexp:
-          """
-          <cis_or_usg>           +<cis>      +Security compliance and audit tools
-          """
+       """
+       <cis_or_usg>           +<cis>      +Security compliance and audit tools
+       """
        And stdout matches regexp:
-          """
-          This machine is not attached to an Ubuntu Pro subscription.
-          """
+       """
+       This machine is not attached to an Ubuntu Pro subscription.
+       """
        And I verify that running `apt update` `with sudo` exits `0`
        When I attach `contract_token` with sudo
        Then I verify that running `pro enable foobar --format json` `as non-root` exits `1`
        And stdout is a json matching the `ua_operation` schema
        And I will see the following on stdout:
-           """
-           {"_schema_version": "0.1", "errors": [{"message": "json formatted response requires --assume-yes flag.", "message_code": "json-format-require-assume-yes", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
-            """
+       """
+       {"_schema_version": "0.1", "errors": [{"message": "json formatted response requires --assume-yes flag.", "message_code": "json-format-require-assume-yes", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+        """
        Then I verify that running `pro enable foobar --format json` `with sudo` exits `1`
        And stdout is a json matching the `ua_operation` schema
        And I will see the following on stdout:
-           """
-           {"_schema_version": "0.1", "errors": [{"message": "json formatted response requires --assume-yes flag.", "message_code": "json-format-require-assume-yes", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
-           """
+       """
+       {"_schema_version": "0.1", "errors": [{"message": "json formatted response requires --assume-yes flag.", "message_code": "json-format-require-assume-yes", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+       """
        Then I verify that running `pro detach --format json --assume-yes` `as non-root` exits `1`
        And stdout is a json matching the `ua_operation` schema
        And I will see the following on stdout:
-           """
-           {"_schema_version": "0.1", "errors": [{"message": "This command must be run as root (try using sudo).", "message_code": "nonroot-user", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
-           """
+       """
+       {"_schema_version": "0.1", "errors": [{"message": "This command must be run as root (try using sudo).", "message_code": "nonroot-user", "service": null, "type": "system"}], "failed_services": [], "needs_reboot": false, "processed_services": [], "result": "failure", "warnings": []}
+       """
        When I run `pro detach --format json --assume-yes` with sudo
        Then stdout is a json matching the `ua_operation` schema
        And I will see the following on stdout:
-           """
-           {"_schema_version": "0.1", "errors": [], "failed_services": [], "needs_reboot": false, "processed_services": ["esm-apps", "esm-infra"], "result": "success", "warnings": []}
-           """
+       """
+       {"_schema_version": "0.1", "errors": [], "failed_services": [], "needs_reboot": false, "processed_services": ["esm-apps", "esm-infra"], "result": "success", "warnings": []}
+       """
 
        Examples: ubuntu release
            | release | esm-apps | cc-eal | cis | fips | fips-update | ros | cis_or_usg | realtime-kernel |
            | xenial  | yes      | yes    | yes | yes  | yes         | yes | cis        | no              |
            | bionic  | yes      | yes    | yes | yes  | yes         | yes | cis        | no              |
            | focal   | yes      | no     | yes | yes  | yes         | no  | usg        | no              |
-           | jammy   | yes      | no     | no  | no   | no          | no  | usg        | yes             |
+           | jammy   | yes      | no     | yes | no   | no          | no  | usg        | yes             |
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached auto-attach in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -323,7 +328,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
            | lunar   |
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached show version in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -346,7 +351,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
            | lunar   |
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached status in a ubuntu machine with feature overrides
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I create the file `/tmp/machine-token-overlay.json` with the following:
@@ -416,7 +421,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
 
     @series.xenial
     @series.bionic
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached disable of different services in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -463,7 +468,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
            | jammy   |
 
     @series.focal
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario: Attached disable of different services in a ubuntu machine
         Given a `focal` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -504,7 +509,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
             """
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Help command on an attached machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -611,7 +616,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
 
     @series.jammy
     @series.focal
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Help command on an attached machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -727,7 +732,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
            | jammy   |
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Enable command with invalid repositories in user machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -753,7 +758,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
            | jammy   | cloud-init-dev-ubuntu-daily-jammy  |
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Run timer script on an attached machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I run `systemctl stop ua-timer.timer` with sudo
@@ -831,7 +836,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
            | lunar   |
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Run timer script to valid machine activity endpoint
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -902,7 +907,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
            | jammy   |
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Run timer script to valid machine activity endpoint
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
diff --git a/features/attached_enable.feature b/features/attached_enable.feature
index e833c54..d730fc8 100644
--- a/features/attached_enable.feature
+++ b/features/attached_enable.feature
@@ -4,7 +4,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
     @slow
     @series.xenial
     @series.bionic
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable Common Criteria service in an ubuntu lxd container
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -30,7 +30,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
 
     @series.xenial
     @series.bionic
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Enable cc-eal with --access-only
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -52,7 +52,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
     @series.jammy
     @series.kinetic
     @series.lunar
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable Common Criteria service in an ubuntu lxd container
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -75,7 +75,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
             | lunar   | 23.04      | Lunar Lobster    |
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Empty series affordance means no series, null means all series
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo and options `--no-auto-enable`
@@ -126,7 +126,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
             | jammy   |
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable of different services using json format
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -196,7 +196,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
            | jammy   | cc-eal, esm-apps, esm-infra, fips, fips-updates, livepatch, realtime-kernel,\nros, ros-updates, usg. |
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable of a service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -251,7 +251,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
            | bionic  | libkrad0  | https://esm.ubuntu.com/infra/ubuntu |
 
     @series.focal
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario: Attached enable of a service in a ubuntu machine
         Given a `focal` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -302,7 +302,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
         """
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline:  Attached enable of non-container services in a ubuntu lxd container
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -328,7 +328,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
            | lunar   |
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable not entitled service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I set the machine token overlay to the following yaml
@@ -362,7 +362,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
 
     @series.xenial
     @series.bionic
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable of cis service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -446,7 +446,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
            | xenial  | Canonical_Ubuntu_16.04_CIS_v1.1.0-harden.sh |
 
     @series.focal
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable of cis service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -526,7 +526,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
 
     @series.bionic
     @series.xenial
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable of usg service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -547,7 +547,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
            | xenial  |
 
     @series.focal
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable of usg service in a focal machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -608,7 +608,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
 
     @series.bionic
     @series.xenial
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: Attached disable of livepatch in a lxd vm
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -651,7 +651,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
 
     @series.xenial
     @series.bionic
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: Attach works when snapd cannot be installed
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I run `apt-get remove -y snapd` with sudo
@@ -690,7 +690,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
 
     @series.bionic
     @series.xenial
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: Attached enable livepatch
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I verify that running `canonical-livepatch status` `with sudo` exits `1`
@@ -722,7 +722,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
 
 
     @series.xenial
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: Attached enable livepatch
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -792,7 +792,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
 
     @slow
     @series.bionic
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario: Attached enable livepatch on a machine with fips active
         Given a `bionic` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -831,7 +831,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
             """
 
     @series.bionic
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario: Attached enable fips on a machine with livepatch active
         Given a `bionic` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -863,7 +863,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
     @slow
     @series.xenial
     @series.bionic
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: Attached enable fips on a machine with livepatch active
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -905,7 +905,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
     @slow
     @series.xenial
     @series.bionic
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: Attached enable fips on a machine with fips-updates active
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -943,7 +943,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
     @series.xenial
     @series.bionic
     @uses.config.contract_token
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable ros on a machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -1158,7 +1158,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
 
     @series.xenial
     @uses.config.contract_token
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: APT auth file is edited correctly on enable
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -1188,7 +1188,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
            | xenial  |
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable esm-apps on a machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -1231,7 +1231,7 @@ Feature: Enable command behaviour when attached to an Ubuntu Pro subscription
            | focal   | ant      |
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable with corrupt lock
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
diff --git a/features/attached_status.feature b/features/attached_status.feature
index b01386e..ad086d0 100644
--- a/features/attached_status.feature
+++ b/features/attached_status.feature
@@ -2,7 +2,7 @@
 Feature: Attached status
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached status in a ubuntu machine - formatted
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -42,7 +42,7 @@ Feature: Attached status
            | lunar   |
 
     @series.xenial
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Non-root status can see in-progress operations
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -83,7 +83,7 @@ Feature: Attached status
 
     @series.xenial
     @series.bionic
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached status in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -101,6 +101,7 @@ Feature: Attached status
         ros             +yes      +disabled +Security Updates for the Robot Operating System
         ros-updates     +yes      +disabled +All Updates for the Robot Operating System
 
+        For a list of all Ubuntu Pro services, run 'pro status --all'
         Enable services with: pro enable <service>
         """
         When I verify root and non-root `pro status --all` calls have the same output
@@ -128,7 +129,7 @@ Feature: Attached status
            | bionic  |
 
     @series.focal
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached status in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -143,6 +144,7 @@ Feature: Attached status
         fips-updates    +yes      +disabled +NIST-certified core packages with priority security updates
         usg             +yes      +disabled +Security compliance and audit tools
 
+        For a list of all Ubuntu Pro services, run 'pro status --all'
         Enable services with: pro enable <service>
         """
         When I verify root and non-root `pro status --all` calls have the same output
@@ -169,7 +171,7 @@ Feature: Attached status
            | focal   |
 
     @series.jammy
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached status in the latest LTS ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -180,7 +182,9 @@ Feature: Attached status
         SERVICE         +ENTITLED +STATUS   +DESCRIPTION
         esm-apps        +yes      +enabled  +Expanded Security Maintenance for Applications
         esm-infra       +yes      +enabled  +Expanded Security Maintenance for Infrastructure
+        usg             +yes      +disabled +Security compliance and audit tools
 
+        For a list of all Ubuntu Pro services, run 'pro status --all'
         Enable services with: pro enable <service>
         """
         When I verify root and non-root `pro status --all` calls have the same output
@@ -197,7 +201,7 @@ Feature: Attached status
         realtime-kernel +yes      +n/a      +Ubuntu kernel with PREEMPT_RT patches integrated
         ros             +yes      +n/a      +Security Updates for the Robot Operating System
         ros-updates     +yes      +n/a      +All Updates for the Robot Operating System
-        usg             +yes      +n/a      +Security compliance and audit tools
+        usg             +yes      +disabled +Security compliance and audit tools
 
         Enable services with: pro enable <service>
         """
diff --git a/features/cloud.py b/features/cloud.py
index 1a5d11b..8f3bcb0 100644
--- a/features/cloud.py
+++ b/features/cloud.py
@@ -15,8 +15,6 @@ class Cloud:
 
     :cloud_credentials_path:
         A string containing the path for the pycloudlib cloud credentials file
-    :machine_type:
-        A string representing the type of machine to launch (pro or generic)
     :region:
         The region to create the cloud resources on
     :param tag:
@@ -30,7 +28,6 @@ class Cloud:
 
     def __init__(
         self,
-        machine_type: str,
         cloud_credentials_path: Optional[str],
         tag: Optional[str] = None,
         timestamp_suffix: bool = True,
@@ -39,11 +36,11 @@ class Cloud:
             self.tag = tag
         else:
             self.tag = "uaclient-ci"
-        self.machine_type = machine_type
         self._api = None
         self.key_name = pycloudlib.util.get_timestamped_tag(self.tag)
         self.timestamp_suffix = timestamp_suffix
         self.cloud_credentials_path = cloud_credentials_path
+        self._ssh_key_managed = False
 
     @property
     def pycloudlib_cls(self):
@@ -65,6 +62,7 @@ class Cloud:
     def _create_instance(
         self,
         series: str,
+        machine_type: str,
         instance_name: Optional[str] = None,
         image_name: Optional[str] = None,
         user_data: Optional[str] = None,
@@ -77,6 +75,8 @@ class Cloud:
             The ubuntu release to be used when creating an instance. We will
             create an image based on this value if the used does not provide
             a image_name value
+        :machine_type:
+            string representing the type of machine to launch (pro or generic)
         :param instance_name:
             The name of the instance to be created
         :param image_name:
@@ -115,6 +115,7 @@ class Cloud:
     def launch(
         self,
         series: str,
+        machine_type: str,
         instance_name: Optional[str] = None,
         image_name: Optional[str] = None,
         user_data: Optional[str] = None,
@@ -127,6 +128,8 @@ class Cloud:
             The ubuntu release to be used when creating an instance. We will
             create an image based on this value if the used does not provide
             a image_name value
+        :machine_type:
+            string representing the type of machine to launch (pro or generic)
         :param instance_name:
             The name of the instance to be created
         :param image_name:
@@ -143,6 +146,7 @@ class Cloud:
         """
         inst = self._create_instance(
             series=series,
+            machine_type=machine_type,
             instance_name=instance_name,
             image_name=image_name,
             user_data=user_data,
@@ -168,11 +172,15 @@ class Cloud:
         """
         return instance.id
 
-    def locate_image_name(self, series: str) -> str:
+    def locate_image_name(
+        self, series: str, machine_type: str, daily: bool = True
+    ) -> str:
         """Locate and return the image name to use for vm provision.
 
         :param series:
             The ubuntu release to be used when locating the image name
+        :machine_type:
+            string representing the type of machine to launch (pro or generic)
 
         :returns:
             A image name to use when provisioning a virtual machine
@@ -184,12 +192,19 @@ class Cloud:
             )
 
         image_type = ImageType.GENERIC
-        if "pro.fips" in self.machine_type:
+        if "pro-fips" in machine_type:
             image_type = ImageType.PRO_FIPS
-        elif "pro" in self.machine_type:
+        elif "pro" in machine_type:
             image_type = ImageType.PRO
 
-        return self.api.daily_image(release=series, image_type=image_type)
+        if daily:
+            logging.debug("looking up daily image for {}".format(series))
+            return self.api.daily_image(release=series, image_type=image_type)
+        else:
+            logging.debug("looking up released image for {}".format(series))
+            return self.api.released_image(
+                release=series, image_type=image_type
+            )
 
     def manage_ssh_key(
         self,
@@ -202,6 +217,11 @@ class Cloud:
             Location of the private key path to use. If None, the location
             will be a default location.
         """
+        if self._ssh_key_managed:
+            logging.debug("SSH key already set up")
+            return
+
+        logging.debug("Setting up SSH key")
         if key_name:
             self.key_name = key_name
         cloud_name = self.name.lower().replace("_", "-")
@@ -221,10 +241,17 @@ class Cloud:
         self.api.use_key(
             public_key_path=pub_key_path, private_key_path=priv_key_path
         )
+        self._ssh_key_managed = True
 
 
 class EC2(Cloud):
-    """Class that represents the EC2 cloud provider."""
+    """
+    Class that represents the EC2 cloud provider.
+
+    For AWS, we need to specify on the pycloudlib config file that
+    the AWS region must be us-east-2. The reason for that is because
+    our image ids were captured using that region.
+    """
 
     name = "aws"
 
@@ -270,6 +297,7 @@ class EC2(Cloud):
     def _create_instance(
         self,
         series: str,
+        machine_type: str,
         instance_name: Optional[str] = None,
         image_name: Optional[str] = None,
         user_data: Optional[str] = None,
@@ -282,6 +310,8 @@ class EC2(Cloud):
             The ubuntu release to be used when creating an instance. We will
             create an image based on this value if the used does not provide
             a image_name value
+        :machine_type:
+            string representing the type of machine to launch (pro or generic)
         :param instance_name:
             The name of the instance to be created
         :param image_name:
@@ -297,7 +327,16 @@ class EC2(Cloud):
             An AWS cloud provider instance
         """
         if not image_name:
-            image_name = self.locate_image_name(series)
+            if series == "xenial" and "pro" not in machine_type:
+                logging.debug(
+                    "defaulting to non-daily image for awsgeneric-16.04"
+                )
+                daily = False
+            else:
+                daily = True
+            image_name = self.locate_image_name(
+                series, machine_type, daily=daily
+            )
 
         logging.info(
             "--- Launching AWS image {}({})".format(image_name, series)
@@ -316,7 +355,7 @@ class EC2(Cloud):
 class Azure(Cloud):
     """Class that represents the Azure cloud provider."""
 
-    name = "Azure"
+    name = "azure"
 
     @property
     def pycloudlib_cls(self):
@@ -376,6 +415,7 @@ class Azure(Cloud):
     def _create_instance(
         self,
         series: str,
+        machine_type: str,
         instance_name: Optional[str] = None,
         image_name: Optional[str] = None,
         user_data: Optional[str] = None,
@@ -388,6 +428,8 @@ class Azure(Cloud):
             The ubuntu release to be used when creating an instance. We will
             create an image based on this value if the used does not provide
             a image_name value
+        :machine_type:
+            string representing the type of machine to launch (pro or generic)
         :param instance_name:
             The name of the instance to be created
         :param image_name:
@@ -403,7 +445,7 @@ class Azure(Cloud):
             An Azure cloud provider instance
         """
         if not image_name:
-            image_name = self.locate_image_name(series)
+            image_name = self.locate_image_name(series, machine_type)
 
         logging.info(
             "--- Launching Azure image {}({})".format(image_name, series)
@@ -430,13 +472,11 @@ class GCP(Cloud):
 
     def __init__(
         self,
-        machine_type: str,
         cloud_credentials_path: Optional[str],
         tag: Optional[str] = None,
         timestamp_suffix: bool = True,
     ) -> None:
         super().__init__(
-            machine_type=machine_type,
             cloud_credentials_path=cloud_credentials_path,
             tag=tag,
             timestamp_suffix=timestamp_suffix,
@@ -494,6 +534,7 @@ class GCP(Cloud):
     def _create_instance(
         self,
         series: str,
+        machine_type: str,
         instance_name: Optional[str] = None,
         image_name: Optional[str] = None,
         user_data: Optional[str] = None,
@@ -506,6 +547,8 @@ class GCP(Cloud):
             The ubuntu release to be used when creating an instance. We will
             create an image based on this value if the used does not provide
             a image_name value
+        :machine_type:
+            string representing the type of machine to launch (pro or generic)
         :param instance_name:
             The name of the instance to be created
         :param image_name:
@@ -521,7 +564,7 @@ class GCP(Cloud):
             An GCP cloud provider instance
         """
         if not image_name:
-            image_name = self.locate_image_name(series)
+            image_name = self.locate_image_name(series, machine_type)
 
         logging.info(
             "--- Launching GCP image {}({})".format(image_name, series)
@@ -536,6 +579,7 @@ class _LXD(Cloud):
     def _create_instance(
         self,
         series: str,
+        machine_type: str,
         instance_name: Optional[str] = None,
         image_name: Optional[str] = None,
         user_data: Optional[str] = None,
@@ -548,6 +592,8 @@ class _LXD(Cloud):
             The ubuntu release to be used when creating an instance. We will
             create an image based on this value if the used does not provide
             a image_name value
+        :machine_type:
+            string representing the type of machine to launch (pro or generic)
         :param instance_name:
             The name of the instance to be created
         :param image_name:
@@ -563,7 +609,7 @@ class _LXD(Cloud):
             An AWS cloud provider instance
         """
         if not image_name:
-            image_name = self.locate_image_name(series)
+            image_name = self.locate_image_name(series, machine_type)
 
         image_type = self.name.title().replace("-", " ")
 
@@ -603,11 +649,15 @@ class _LXD(Cloud):
         # instead of the instance id
         return instance.name
 
-    def locate_image_name(self, series: str) -> str:
+    def locate_image_name(
+        self, series: str, machine_type: str, daily: bool = True
+    ) -> str:
         """Locate and return the image name to use for vm provision.
 
         :param series:
             The ubuntu release to be used when locating the image name
+        :machine_type:
+            string representing the type of machine to launch (pro or generic)
 
         :returns:
             A image name to use when provisioning a virtual machine
@@ -618,7 +668,13 @@ class _LXD(Cloud):
                 "Must provide either series or image_name to launch azure"
             )
 
-        image_name = self.api.daily_image(release=series)
+        if daily:
+            logging.debug("looking up daily image for {}".format(series))
+            image_name = self.api.daily_image(release=series)
+        else:
+            logging.debug("looking up released image for {}".format(series))
+            image_name = self.api.released_image(release=series)
+
         return image_name
 
 
diff --git a/features/cloud_pro_clone.feature b/features/cloud_pro_clone.feature
index 6895c47..9ec5e0a 100644
--- a/features/cloud_pro_clone.feature
+++ b/features/cloud_pro_clone.feature
@@ -13,11 +13,7 @@ Feature: Creating golden images based on Cloud Ubuntu Pro instances
         log_file: /var/log/ubuntu-advantage.log
         """
         When I run `pro auto-attach` with sudo
-        And I run `pro status --format yaml` with sudo
-        Then stdout matches regexp:
-        """
-        attached: true
-        """
+        Then the machine is attached
         When I run `apt install -y jq` with sudo
         When I save the `activityInfo.activityToken` value from the contract
         When I save the `activityInfo.activityID` value from the contract
@@ -37,11 +33,7 @@ Feature: Creating golden images based on Cloud Ubuntu Pro instances
         When I launch a `<release>` machine named `clone` from the snapshot of `system-under-test`
         # The clone will run auto-attach on boot
         When I run `pro status --wait` `with sudo` on the `clone` machine
-        When I run `pro status --format yaml` `with sudo` on the `clone` machine
-        Then stdout matches regexp:
-        """
-        attached: true
-        """
+        Then the machine is attached
         When I run `python3 /usr/lib/ubuntu-advantage/timer.py` `with sudo` on the `clone` machine
         Then I verify that `activityInfo.activityToken` value has been updated on the contract on the `clone` machine
         Then I verify that `activityInfo.activityID` value has been updated on the contract on the `clone` machine
diff --git a/features/collect_logs.feature b/features/collect_logs.feature
index f45046f..bc9cb39 100644
--- a/features/collect_logs.feature
+++ b/features/collect_logs.feature
@@ -2,7 +2,7 @@
 Feature: Command behaviour when attached to an Ubuntu Pro subscription
 
     @series.all
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Run collect-logs on an unattached machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I run `python3 /usr/lib/ubuntu-advantage/timer.py` with sudo
@@ -51,7 +51,7 @@ Feature: Command behaviour when attached to an Ubuntu Pro subscription
           | lunar   |
 
     @series.lts
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Run collect-logs on an attached machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
diff --git a/features/config.feature b/features/config.feature
index 47b21d5..1c99798 100644
--- a/features/config.feature
+++ b/features/config.feature
@@ -3,7 +3,7 @@ Feature: pro config sub-command
     @series.xenial
     @series.jammy
     @series.kinetic
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: old ua_config in uaclient.conf is still supported
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I run `pro config show` with sudo
diff --git a/features/daemon.feature b/features/daemon.feature
index ed74ec5..42d999d 100644
--- a/features/daemon.feature
+++ b/features/daemon.feature
@@ -2,7 +2,7 @@ Feature: Pro Upgrade Daemon only runs in environments where necessary
 
     @series.all
     @uses.config.contract_token
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: cloud-id-shim service is not installed on anything other than xenial
         Given a `<release>` machine with ubuntu-advantage-tools installed
         Then I verify that running `systemctl status ubuntu-advantage-cloud-id-shim.service` `with sudo` exits `4`
@@ -20,7 +20,7 @@ Feature: Pro Upgrade Daemon only runs in environments where necessary
 
     @series.lts
     @uses.config.contract_token
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: cloud-id-shim should run in postinst and on boot
         Given a `<release>` machine with ubuntu-advantage-tools installed
         # verify installing pro created the cloud-id file
@@ -105,10 +105,10 @@ Feature: Pro Upgrade Daemon only runs in environments where necessary
         Active: active \(running\)
         """
         # TODO find out what caused memory to go up, try to lower it again
-        Then on `xenial`, systemd status output says memory usage is less than `16` MB
-        Then on `bionic`, systemd status output says memory usage is less than `14` MB
-        Then on `focal`, systemd status output says memory usage is less than `12` MB
-        Then on `jammy`, systemd status output says memory usage is less than `13` MB
+        Then on `xenial`, systemd status output says memory usage is less than `17` MB
+        Then on `bionic`, systemd status output says memory usage is less than `15` MB
+        Then on `focal`, systemd status output says memory usage is less than `13` MB
+        Then on `jammy`, systemd status output says memory usage is less than `14` MB
 
         When I run `cat /var/log/ubuntu-advantage-daemon.log` with sudo
         Then stdout matches regexp:
@@ -208,10 +208,79 @@ Feature: Pro Upgrade Daemon only runs in environments where necessary
             | focal   |
             | jammy   |
 
+    @series.lts
+    @uses.config.contract_token
+    @uses.config.machine_type.azure.generic
+    Scenario Outline: daemon should run when appropriate on azure generic lts
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        # verify its enabled, but stops itself when not configured to poll
+        When I run `cat /var/log/ubuntu-advantage-daemon.log` with sudo
+        Then stdout matches regexp:
+        """
+        daemon starting
+        """
+        Then stdout matches regexp:
+        """
+        Configured to not poll for pro license, shutting down
+        """
+        Then stdout matches regexp:
+        """
+        daemon ending
+        """
+        When I run `systemctl is-enabled ubuntu-advantage.service` with sudo
+        Then stdout matches regexp:
+        """
+        enabled
+        """
+        Then I verify that running `systemctl is-failed ubuntu-advantage.service` `with sudo` exits `1`
+        Then stdout matches regexp:
+        """
+        inactive
+        """
+
+        # verify it stays on when configured to do so
+        When I create the file `/var/lib/ubuntu-advantage/user-config.json` with the following:
+        """
+        { "poll_for_pro_license": true }
+        """
+        When I run `systemctl restart ubuntu-advantage.service` with sudo
+        # give it time to get past the initial request
+        When I wait `5` seconds
+        When I run `cat /var/log/ubuntu-advantage-daemon.log` with sudo
+        Then stdout matches regexp:
+        """
+        daemon starting
+        """
+        Then stdout matches regexp:
+        """
+        Cancelling polling
+        """
+        Then stdout matches regexp:
+        """
+        daemon ending
+        """
+        When I run `systemctl is-enabled ubuntu-advantage.service` with sudo
+        Then stdout matches regexp:
+        """
+        enabled
+        """
+        Then I verify that running `systemctl is-failed ubuntu-advantage.service` `with sudo` exits `1`
+        Then stdout matches regexp:
+        """
+        inactive
+        """
+        Examples: version
+            | release |
+            | xenial  |
+            | bionic  |
+            | focal   |
+            | jammy   |
+
     @series.kinetic
     @uses.config.contract_token
+    @uses.config.machine_type.azure.generic
     @uses.config.machine_type.gcp.generic
-    Scenario Outline: daemon does not start on gcp generic non lts
+    Scenario Outline: daemon does not start on gcp,azure generic non lts
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I wait `1` seconds
         When I run `cat /var/log/ubuntu-advantage-daemon.log` with sudo
@@ -233,11 +302,10 @@ Feature: Pro Upgrade Daemon only runs in environments where necessary
 
     @series.all
     @uses.config.contract_token
-    @uses.config.machine_type.lxd.container
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-container
+    @uses.config.machine_type.lxd-vm
     @uses.config.machine_type.aws.generic
-    @uses.config.machine_type.azure.generic
-    Scenario Outline: daemon does not start when not on gcpgeneric
+    Scenario Outline: daemon does not start when not on gcpgeneric or azuregeneric
         Given a `<release>` machine with ubuntu-advantage-tools installed
         Then I verify that running `systemctl status ubuntu-advantage.service` `with sudo` exits `3`
         Then stdout matches regexp:
@@ -266,8 +334,7 @@ Feature: Pro Upgrade Daemon only runs in environments where necessary
 
     @series.lts
     @uses.config.machine_type.aws.pro
-    @uses.config.machine_type.azure.pro
-    Scenario Outline: daemon does not start when not on gcpgeneric
+    Scenario Outline: daemon does not start when not on gcpgeneric or azuregeneric
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I create the file `/etc/ubuntu-advantage/uaclient.conf` with the following:
         """
@@ -301,7 +368,8 @@ Feature: Pro Upgrade Daemon only runs in environments where necessary
 
     @series.lts
     @uses.config.machine_type.gcp.pro
-    Scenario Outline: daemon does not start when not on gcpgeneric
+    @uses.config.machine_type.azure.pro
+    Scenario Outline: daemon does not start when not on gcpgeneric or azuregeneric
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I create the file `/etc/ubuntu-advantage/uaclient.conf` with the following:
         """
diff --git a/features/docker.feature b/features/docker.feature
index 2e82266..6724512 100644
--- a/features/docker.feature
+++ b/features/docker.feature
@@ -4,7 +4,7 @@ Feature: Build docker images with pro services
     @slow
     @docker
     @series.focal
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: Build docker images with pro services
         Given a `focal` machine with ubuntu-advantage-tools installed
         When I have the `<container_release>` debs under test in `/home/ubuntu`
@@ -77,4 +77,3 @@ Feature: Build docker images with pro services
            | focal   | xenial            | [ esm-infra ]  | curl              | esm                  |
            | focal   | bionic            | [ fips ]       | openssl           | fips                 |
            | focal   | focal             | [ esm-apps ]   | hello             | esm                  |
-
diff --git a/features/enable_fips_cloud.feature b/features/enable_fips_cloud.feature
index c14b39b..41edbb0 100644
--- a/features/enable_fips_cloud.feature
+++ b/features/enable_fips_cloud.feature
@@ -217,7 +217,7 @@ Feature: FIPS enablement in cloud based machines
         And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
         When I run `apt-cache policy ubuntu-fips` as non-root
         Then stdout does not match regexp:
-        ""
+        """
         .*Installed: \(none\)
         """
         When I reboot the machine
diff --git a/features/enable_fips_container.feature b/features/enable_fips_container.feature
index 178b6ad..a908d2b 100644
--- a/features/enable_fips_container.feature
+++ b/features/enable_fips_container.feature
@@ -5,7 +5,7 @@ Feature: FIPS enablement in lxd containers
     @series.xenial
     @series.bionic
     @series.focal
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Attached enable of FIPS in an ubuntu lxd container
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -100,7 +100,7 @@ Feature: FIPS enablement in lxd containers
     @series.xenial
     @series.bionic
     @series.focal
-    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd-container
     Scenario Outline: Try to enable FIPS after FIPS Updates in a lxd container
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
diff --git a/features/enable_fips_vm.feature b/features/enable_fips_vm.feature
index ea6c38e..f27a5e9 100644
--- a/features/enable_fips_vm.feature
+++ b/features/enable_fips_vm.feature
@@ -4,14 +4,14 @@ Feature: FIPS enablement in lxd VMs
     @slow
     @series.xenial
     @series.bionic
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: Attached enable of FIPS in an ubuntu lxd vm
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
         When I run `pro status --format json` with sudo
         Then stdout contains substring
         """
-        {"available": "yes", "blocked_by": [{"name": "livepatch", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "disabled", "status_details": "FIPS is not configured"}
+        {"available": "yes", "blocked_by": [{"name": "livepatch", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "disabled", "status_details": "FIPS is not configured", "warning": null}
         """
         When I run `pro disable livepatch` with sudo
         And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo, retrying exit [100]
@@ -48,15 +48,14 @@ Feature: FIPS enablement in lxd VMs
         When I run `pro status --format json --all` with sudo
         Then stdout contains substring:
         """
-        {"available": "no", "blocked_by": [{"name": "fips", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}], "description": "Canonical Livepatch service", "description_override": null, "entitled": "yes", "name": "livepatch", "status": "n/a", "status_details": "Cannot enable Livepatch when FIPS is enabled."}
+        {"available": "no", "blocked_by": [{"name": "fips", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}], "description": "Canonical Livepatch service", "description_override": null, "entitled": "yes", "name": "livepatch", "status": "n/a", "status_details": "Cannot enable Livepatch when FIPS is enabled.", "warning": null}
         """
-
         When I reboot the machine
         And  I run `uname -r` as non-root
         Then stdout matches regexp:
-            """
-            fips
-            """
+        """
+        fips
+        """
         When I run `cat /proc/sys/crypto/fips_enabled` with sudo
         Then I will see the following on stdout:
         """
@@ -64,24 +63,24 @@ Feature: FIPS enablement in lxd VMs
         """
         When I run `pro status --all` with sudo
         Then stdout does not match regexp:
-            """
-            FIPS support requires system reboot to complete configuration
-            """
+        """
+        FIPS support requires system reboot to complete configuration
+        """
         When I run `pro disable <fips-service>` `with sudo` and stdin `y`
         Then stdout matches regexp:
-            """
-            This will disable the FIPS entitlement but the FIPS packages will remain installed.
-            """
+        """
+        This will disable the FIPS entitlement but the FIPS packages will remain installed.
+        """
         And stdout matches regexp:
-            """
-            Updating package lists
-            A reboot is required to complete disable operation
-            """
+        """
+        Updating package lists
+        A reboot is required to complete disable operation
+        """
         When I run `pro status --all` with sudo
         Then stdout matches regexp:
-            """
-            Disabling FIPS requires system reboot to complete operation
-            """
+        """
+        Disabling FIPS requires system reboot to complete operation
+        """
         When I run `apt-cache policy ubuntu-fips` as non-root
         Then stdout matches regexp:
         """
@@ -103,13 +102,13 @@ Feature: FIPS enablement in lxd VMs
         """
         When I run `pro status --all` with sudo
         Then stdout matches regexp:
-            """
-            <fips-service> +yes                disabled
-            """
+        """
+        <fips-service> +yes                disabled
+        """
         Then stdout does not match regexp:
-            """
-            Disabling FIPS requires system reboot to complete operation
-            """
+        """
+        Disabling FIPS requires system reboot to complete operation
+        """
         When I run `pro enable <fips-service> --assume-yes --format json --assume-yes` with sudo
         Then stdout is a json matching the `ua_operation` schema
         And I will see the following on stdout:
@@ -125,9 +124,9 @@ Feature: FIPS enablement in lxd VMs
         """
         When I run `pro status --all` with sudo
         Then stdout matches regexp:
-            """
-            <fips-service> +yes                disabled
-            """
+        """
+        <fips-service> +yes                disabled
+        """
 
         Examples: ubuntu release
            | release | fips-name    | fips-service |fips-apt-source                                |
@@ -137,7 +136,7 @@ Feature: FIPS enablement in lxd VMs
     @slow
     @series.xenial
     @series.bionic
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: Attached enable of FIPS-updates in an ubuntu lxd vm
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -171,7 +170,7 @@ Feature: FIPS enablement in lxd VMs
         When I run `pro status --all --format json` with sudo
         Then stdout contains substring:
         """
-        {"available": "no", "blocked_by": [{"name": "fips-updates", "reason": "FIPS cannot be enabled if FIPS Updates has ever been enabled because FIPS Updates installs security patches that aren't officially certified.", "reason_code": "fips-updates-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "n/a", "status_details": "Cannot enable FIPS when FIPS Updates is enabled."}
+        {"available": "no", "blocked_by": [{"name": "fips-updates", "reason": "FIPS cannot be enabled if FIPS Updates has ever been enabled because FIPS Updates installs security patches that aren't officially certified.", "reason_code": "fips-updates-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "n/a", "status_details": "Cannot enable FIPS when FIPS Updates is enabled.", "warning": null}
         """
 
         When I reboot the machine
@@ -245,7 +244,7 @@ Feature: FIPS enablement in lxd VMs
         When I run `pro status --all --format json` with sudo
         Then stdout contains substring:
         """
-        {"available": "no", "blocked_by": [{"name": "livepatch", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}, {"name": "fips-updates", "reason": "FIPS cannot be enabled if FIPS Updates has ever been enabled because FIPS Updates installs security patches that aren't officially certified.", "reason_code": "fips-updates-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "n/a", "status_details": "Cannot enable FIPS when FIPS Updates is enabled."}
+        {"available": "no", "blocked_by": [{"name": "livepatch", "reason": "Livepatch cannot be enabled while running the official FIPS certified kernel. If you would like a FIPS compliant kernel with additional bug fixes and security updates, you can use the FIPS Updates service with Livepatch.", "reason_code": "livepatch-invalidates-fips"}, {"name": "fips-updates", "reason": "FIPS cannot be enabled if FIPS Updates has ever been enabled because FIPS Updates installs security patches that aren't officially certified.", "reason_code": "fips-updates-invalidates-fips"}], "description": "NIST-certified core packages", "description_override": null, "entitled": "yes", "name": "fips", "status": "n/a", "status_details": "Cannot enable FIPS when FIPS Updates is enabled.", "warning": null}
         """
         When I run `pro disable <fips-service> --assume-yes` with sudo
         And I run `pro enable <fips-service> --assume-yes --format json --assume-yes` with sudo
@@ -275,7 +274,7 @@ Feature: FIPS enablement in lxd VMs
     @slow
     @series.xenial
     @series.bionic
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: Attached enable FIPS-updates while livepatch is enabled
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -332,7 +331,7 @@ Feature: FIPS enablement in lxd VMs
 
     @slow
     @series.focal
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: Attached enable of FIPS in an ubuntu lxd vm
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -342,7 +341,6 @@ Feature: FIPS enablement in lxd VMs
             """
             Updating package lists
             Installing <fips-name> packages
-            FIPS strongswan-hmac package could not be installed
             <fips-name> enabled
             A reboot is required to complete install
             """
@@ -376,6 +374,8 @@ Feature: FIPS enablement in lxd VMs
         When I reboot the machine
         Then I verify that `openssh-server` installed version matches regexp `fips`
         And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
         When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
         Then I will see the following on stdout:
         """
@@ -395,7 +395,7 @@ Feature: FIPS enablement in lxd VMs
 
     @slow
     @series.focal
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: Attached enable of FIPS-updates in an ubuntu lxd vm
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -465,7 +465,7 @@ Feature: FIPS enablement in lxd VMs
 
     @slow
     @series.lts
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: Attached enable fips-updates on fips enabled vm
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -520,7 +520,7 @@ Feature: FIPS enablement in lxd VMs
                 """
             And stdout matches regexp:
                 """
-                livepatch +yes                enabled
+                livepatch +yes                (enabled|warning)
                 """
             When  I run `uname -r` as non-root
             Then stdout matches regexp:
@@ -542,7 +542,7 @@ Feature: FIPS enablement in lxd VMs
     @slow
     @series.xenial
     @series.bionic
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: FIPS enablement message when cloud init didn't run properly
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I delete the file `/run/cloud-init/instance-data.json`
@@ -566,7 +566,7 @@ Feature: FIPS enablement in lxd VMs
 
     @slow
     @series.focal
-    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.lxd-vm
     Scenario Outline: FIPS enablement message when cloud init didn't run properly
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I delete the file `/run/cloud-init/instance-data.json`
diff --git a/features/environment.py b/features/environment.py
index 8c3f685..7e553b4 100644
--- a/features/environment.py
+++ b/features/environment.py
@@ -6,6 +6,7 @@ import random
 import re
 import string
 import sys
+import tarfile
 from typing import Dict, List, Optional, Tuple, Union  # noqa: F401
 
 import pycloudlib  # type: ignore  # noqa: F401
@@ -46,7 +47,7 @@ class UAClientBehaveConfig:
         This indicates whether the image created for this test run should be
         cleaned up when all tests are complete.
     :param machine_type:
-        The default machine_type to test: lxd.container, lxd.vm, azure.pro,
+        The default machine_type to test: lxd-container, lxd-vm, azure.pro,
             azure.generic, aws.pro or aws.generic
     :param private_key_file:
         Optional path to pre-existing private key file to use when connecting
@@ -105,8 +106,6 @@ class UAClientBehaveConfig:
     # This variable is used in .from_environ() but also to emit the "Config
     # options" stanza in __init__
     all_options = boolean_options + str_options
-    cloud_api = None  # type: pycloudlib.cloud.BaseCloud
-    cloud_manager = None  # type: cloud.Cloud
 
     def __init__(
         self,
@@ -116,15 +115,15 @@ class UAClientBehaveConfig:
         destroy_instances: bool = True,
         ephemeral_instance: bool = False,
         snapshot_strategy: bool = False,
-        machine_type: str = "lxd.container",
+        machine_type: str = "lxd-container",
         private_key_file: Optional[str] = None,
         private_key_name: str = "uaclient-integration",
         reuse_image: Optional[str] = None,
         contract_token: Optional[str] = None,
         contract_token_staging: Optional[str] = None,
         contract_token_staging_expired: Optional[str] = None,
-        artifact_dir: Optional[str] = None,
-        install_from: InstallationSource = InstallationSource.DAILY,
+        artifact_dir: str = "artifacts",
+        install_from: InstallationSource = InstallationSource.LOCAL,
         custom_ppa: Optional[str] = None,
         debs_path: Optional[str] = None,
         userdata_file: Optional[str] = None,
@@ -214,47 +213,39 @@ class UAClientBehaveConfig:
         )
         timed_job_tag += "-" + random_suffix
 
-        if "aws" in self.machine_type:
-            # For AWS, we need to specify on the pycloudlib config file that
-            # the AWS region must be us-east-2. The reason for that is because
-            # our image ids were captured using that region.
-            self.cloud_manager = cloud.EC2(
-                machine_type=self.machine_type,
+        self.clouds = {
+            "aws": cloud.EC2(
                 cloud_credentials_path=self.cloud_credentials_path,
                 tag=timed_job_tag,
                 timestamp_suffix=False,
-            )
-            self.cloud = "aws"
-        elif "azure" in self.machine_type:
-            self.cloud_manager = cloud.Azure(
-                machine_type=self.machine_type,
+            ),
+            "azure": cloud.Azure(
                 cloud_credentials_path=self.cloud_credentials_path,
                 tag=timed_job_tag,
                 timestamp_suffix=False,
-            )
-            self.cloud = "azure"
-        elif "gcp" in self.machine_type:
-            self.cloud_manager = cloud.GCP(
-                machine_type=self.machine_type,
+            ),
+            "gcp": cloud.GCP(
                 cloud_credentials_path=self.cloud_credentials_path,
                 tag=timed_job_tag,
                 timestamp_suffix=False,
-            )
-            self.cloud = "gcp"
-        elif "lxd.vm" in self.machine_type:
-            self.cloud_manager = cloud.LXDVirtualMachine(
-                machine_type=self.machine_type,
+            ),
+            "lxd-vm": cloud.LXDVirtualMachine(
                 cloud_credentials_path=self.cloud_credentials_path,
-            )
-            self.cloud = "lxd.vm"
-        else:
-            self.cloud_manager = cloud.LXDContainer(
-                machine_type=self.machine_type,
+            ),
+            "lxd-container": cloud.LXDContainer(
                 cloud_credentials_path=self.cloud_credentials_path,
-            )
-            self.cloud = "lxd"
-
-        self.cloud_api = self.cloud_manager.api
+            ),
+        }
+        if "aws" in self.machine_type:
+            self.default_cloud = self.clouds["aws"]
+        elif "azure" in self.machine_type:
+            self.default_cloud = self.clouds["azure"]
+        elif "gcp" in self.machine_type:
+            self.default_cloud = self.clouds["gcp"]
+        elif "lxd-vm" in self.machine_type:
+            self.default_cloud = self.clouds["lxd-vm"]
+        else:
+            self.default_cloud = self.clouds["lxd-container"]
 
         # Finally, print the config options.  This helps users debug the use of
         # config options, and means they'll be included in test logs in CI.
@@ -299,6 +290,9 @@ class UAClientBehaveConfig:
                     bool_value = False
                 kwargs[key] = bool_value
 
+        # userdata should override environment variables
+        kwargs.update(config.userdata)
+
         if "install_from" in kwargs:
             kwargs["install_from"] = InstallationSource(kwargs["install_from"])
 
@@ -329,17 +323,16 @@ def before_all(context: Context) -> None:
             print("   - {} = {}".format(key, value))
     context.series_image_name = {}
     context.series_reuse_image = ""
-    context.config = UAClientBehaveConfig.from_environ(context.config)
-    context.config.cloud_manager.manage_ssh_key()
+    context.pro_config = UAClientBehaveConfig.from_environ(context.config)
     context.snapshots = {}
     context.machines = {}
 
-    if context.config.reuse_image:
+    if context.pro_config.reuse_image:
         series = lxc_get_property(
-            context.config.reuse_image, property_name="series", image=True
+            context.pro_config.reuse_image, property_name="series", image=True
         )
         machine_type = lxc_get_property(
-            context.config.reuse_image,
+            context.pro_config.reuse_image,
             property_name="machine_type",
             image=True,
         )
@@ -347,26 +340,26 @@ def before_all(context: Context) -> None:
             print("Found machine_type: {vm_type}".format(vm_type=machine_type))
         if series is not None:
             context.series_reuse_image = series
-            context.series_image_name[series] = context.config.reuse_image
+            context.series_image_name[series] = context.pro_config.reuse_image
         else:
             print(" Could not check image series. It will not be used. ")
-            context.config.reuse_image = None
+            context.pro_config.reuse_image = None
 
 
 def _should_skip_tags(context: Context, tags: List) -> str:
     """Return a reason if a feature or scenario should be skipped"""
-    machine_type = getattr(context.config, "machine_type", "")
+    machine_type = getattr(context.pro_config, "machine_type", "")
     machine_types = []
 
     for tag in tags:
         parts = tag.split(".")
-        if parts[0] != "uses":
-            continue  # Only process @uses.* tags for skipping:
-        val = context
-        for idx, attr in enumerate(parts[1:], 1):
+        if parts[0] != "uses" or parts[1] != "config":
+            continue  # Only process @uses.config.* tags for skipping:
+        val = context.pro_config
+        for idx, attr in enumerate(parts[2:], 1):
             val = getattr(val, attr, None)
             if attr == "machine_type":
-                curr_machine_type = ".".join(parts[idx + 1 :])
+                curr_machine_type = ".".join(parts[idx + 2 :])
                 machine_types.append(curr_machine_type)
                 if curr_machine_type == machine_type:
                     return ""
@@ -397,9 +390,9 @@ def before_scenario(context: Context, scenario: Scenario):
         scenario.skip(reason=reason)
         return
 
-    filter_series = context.config.filter_series
+    filter_series = context.pro_config.filter_series
     given_a_series_match = re.match(
-        "a `(.*)` machine with ubuntu-advantage-tools installed",
+        "a `([a-z]*)` machine with ubuntu-advantage-tools installed",
         scenario.steps[0].name,
     )
     if filter_series and given_a_series_match:
@@ -415,6 +408,38 @@ def before_scenario(context: Context, scenario: Scenario):
             )
             return
 
+    if hasattr(scenario, "_row") and scenario._row is not None:
+        row_release = scenario._row.get("release")
+        if (
+            row_release
+            and len(filter_series) > 0
+            and row_release not in filter_series
+        ):
+            scenario.skip(
+                reason=(
+                    "Skipping scenario outline series `{series}`."
+                    " Cmdline provided @series tags: {cmdline_series}".format(
+                        series=row_release, cmdline_series=filter_series
+                    )
+                )
+            )
+            return
+        row_machine_type = scenario._row.get("machine_type")
+        if (
+            row_machine_type
+            and context.pro_config.machine_type != "any"
+            and row_machine_type != context.pro_config.machine_type
+        ):
+            scenario.skip(
+                reason=(
+                    "Skipping scenario outline machine_type `{}`."
+                    " Cmdline provided machine_type: {}".format(
+                        row_machine_type, context.pro_config.machine_type
+                    )
+                )
+            )
+            return
+
     # before_step doesn't execute early enough to modify the step
     # so we perform step text surgery here
     # Also, logging capture is not set up when before_scenario is called,
@@ -431,61 +456,30 @@ def before_scenario(context: Context, scenario: Scenario):
             )
 
 
-FAILURE_FILES = (
-    "/etc/ubuntu-advantage/uaclient.log",
-    "/var/log/cloud-init.log",
-    "/var/log/ubuntu-advantage.log",
-    "/var/log/ubuntu-advantage-daemon.log",
-    "/var/log/ubuntu-advantage-timer.log",
-    "/var/lib/cloud/instance/user-data.txt",
-    "/var/lib/cloud/instance/vendor-data.txt",
-)
-FAILURE_CMDS = {
-    "ua-version": ["pro", "version"],
-    "cloud-init-analyze": ["cloud-init", "analyze", "show"],
-    "cloud-init.status": ["cloud-init", "status", "--long"],
-    "status.yaml": ["pro", "status", "--all", "--format=yaml"],
-    "journal.log": ["journalctl", "-b", "0"],
-    "systemd-analyze-blame": ["systemd-analyze", "blame"],
-    "systemctl-status": ["systemctl", "status"],
-    "systemctl-status-ua-auto-attach": [
-        "systemctl",
-        "status",
-        "ua-auto-attach.service",
-    ],
-    "systemctl-status-ua-reboot-cmds": [
-        "systemctl",
-        "status",
-        "ua-reboot-cmds.service",
-    ],
-    "systemctl-status-ubuntu-advantage": [
-        "systemctl",
-        "status",
-        "ubuntu-advantage.service",
-    ],
-    "systemctl-status-apt-news": [
-        "systemctl",
-        "status",
-        "apt-news.service",
-    ],
-}
-
-
 def after_step(context, step):
     """Collect test artifacts in the event of failure."""
     if step.status == "failed":
-        if context.config.artifact_dir:
-            artifacts_dir = context.config.artifact_dir
-        else:
-            artifacts_dir = "artifacts"
-        artifacts_dir = os.path.join(
-            artifacts_dir,
+        logging.warning("STEP FAILED. Collecting logs.")
+        inner_dir = os.path.join(
+            datetime.datetime.now().strftime("%Y-%m-%dT%H-%M-%S"),
             "{}_{}".format(os.path.basename(step.filename), step.line),
         )
+        new_artifacts_dir = os.path.join(
+            context.pro_config.artifact_dir,
+            inner_dir,
+        )