[SRU] ubuntu-advantage-tools (27.8 -> 27.9) Xenial, Bionic, Focal, Impish, Jammy
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| ubuntu-advantage-tools (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
| Xenial |
Fix Released
|
Undecided
|
Unassigned | ||
| Bionic |
Fix Released
|
Undecided
|
Unassigned | ||
| Focal |
Fix Released
|
Undecided
|
Unassigned | ||
| Impish |
Fix Released
|
Undecided
|
Unassigned | ||
| Jammy |
Fix Released
|
Undecided
|
Unassigned | ||
Bug Description
[Impact]
This release sports both bug-fixes and new features and we would like to make sure all of our supported customers have access to these improvements. The notable ones are:
* A daemon that only runs on GCP
* Currently it ends early based on a default config setting - making it
hardly a deamon. But this config setting will be flipped on as soon
as it's needed via a follow up SRU, so please review as if the daemon
was long-running.
* When it turns on, it will long-poll the GCP metadata endpoint and run
`ua auto-attach` when a pro license is added.
* This replaces the 5 minute timer we currently have on GCP.
* A part of this is a shim service only on xenial to replace a needed
feature from cloud-init, that is not backported to xenial.
* Contract renewal UX improvements
* `ua status` now notifies you when your contract is updated (e.g.
renewed), and instructs the user to run `ua refresh`. (Note this
isn't technically required for renewal - services will keep working
for a renewed contract regardless.)
* `ua refresh` now ensures motd/apt messaging is all up to date in
addition to updating contract details.
* In combination, these two features address user concerns over
confusing
* More granular APT Proxy configuration with backwards compatibility
* apt_http(s)_proxy is renamed to global_
name still works)
* ua_apt_
configura
* `ua security-status` now includes counts of packages from each archive
component
See the changelog entry below for a full list of changes and bugs.
[Test Case]
The following development and SRU process was followed:
[https:/
The ubuntu-
[Regression Potential]
This is a big update, with several refactors touching many pieces of the codebase. It is possible that some behavior changed in subtle ways not captured by our integration tests.
There are also several small refactors and additions to the postinst script. Any adjustment to postinst poses the risk of breaking upgrades if a mistake was made.
We already dropped support for trusty, but we removed even more trusty related code in this release. It is possible that we were unknowingly relying on some of this trusty code for subtle behavior.
We included backwards compatibility for the proxy configuration changes, but it is possible that if we made a mistake then old configurations will stop working correctly.
[Discussion]
There were a series of discussions about the daemon and it was decided to limit the scope as much as possible. As such, it only runs on GCP on unattached instances. Python won't even be instantiated on other machines. The daemon checks several conditions on start up as well and ends early if any don't match.
There was some effort to keep the memory footprint from being too high. It depends on the python version; on xenial systemd says the daemon takes just under 14Mb and on focal, just under 11Mb. We have regression tests in place to keep on eye on memory usage. When the daemon is running, it will almost always be blocked on a long-poll endpoint, so CPU usage should be minimal.
The daemon does run as root, but doesn't listen on a socket or accept on any user input. It looks at root-only config files and talks to a particular GCP metadata endpoint. If a user were to maliciously MITM the metadata endpoint, they could provide data to the daemon that would cause it to send requests to the Contract Server unnecessarily.
[Changelog]
* d/rules
- remove trusty specific code
- remove ua-license-
- install ubuntu-
- only on xenial: install ubuntu-
* d/tools.postinst
- remove trusty specific code
- print warnings if /etc/os-release doesn't have required fields
- hardcode service list instead of exec-ing python3 for old migration
- refactor python to avoid instantiating UAConfig extra times
- refactor python to always use messages module for strings
- rm the old marker file that triggered ua-license-
- remove unnecessary deb-systemd-helper check in ua-messaging cleanup
- clean up old ua-license-check state
- run new cloud-id-shim script
* d/tools/postrm
- clean up ubuntu-
* New upstream release 27.9 (LP: #1973099)
- cli:
+ for json formatted output, include additional_info for some errors
+ new subcommand `ua refresh messages` to update motd and apt messages
- daemon:
+ replace ua-license-check timer with ubuntu-
+ detects on-boot if pro license was added and runs auto-attach
+ only runs on gcp and does not continuously long-poll by default for now
- enable:
+ fix error message on wrong service name when unattached
- fips:
+ allow enabling generic fips kernel on azure by default
+ clean up fips reboot message (LP: #1972026)
- fix:
+ handle errors during attach process
+ fix bug where enable or detach during a fix failed (LP: #1969809)
+ fix bug where attempting to fix some CVEs would never finish
- performance:
+ remove unnecessary UAConfig object instantiation (also cleans up logs)
+ cache "apt-cache policy" output to avoid unnecessary subp calls
- proxy:
+ apt_http(s)_proxy renamed to global_
+ apt_http(s)_proxy config var names will still work
+ new ua_apt_
+ global_
same time
- realtime: adjust warning to clarify that a manual revert is possible
- refresh: a normal `ua refresh` will also update motd and apt messages
- security-status: add counts of packages from each archive component
- status: check if contract has updated and notify user to run "ua refresh"
| description: | updated |
| description: | updated |
| Launchpad Janitor (janitor) wrote | #1 |
| Changed in ubuntu-advantage-tools (Ubuntu): | |
| status: | New → Fix Released |
| Robie Basak (racb) wrote Please test proposed package | #2 |
| Changed in ubuntu-advantage-tools (Ubuntu Jammy): | |
| status: | New → Fix Committed |
| tags: | added: verification-needed verification-needed-jammy |
| Changed in ubuntu-advantage-tools (Ubuntu Impish): | |
| status: | New → Fix Committed |
| tags: | added: verification-needed-impish |
| Robie Basak (racb) wrote | #3 |
| Changed in ubuntu-advantage-tools (Ubuntu Focal): | |
| status: | New → Fix Committed |
| tags: | added: verification-needed-focal |
| Robie Basak (racb) wrote | #4 |
| Changed in ubuntu-advantage-tools (Ubuntu Bionic): | |
| status: | New → Fix Committed |
| tags: | added: verification-needed-bionic |
| Robie Basak (racb) wrote | #5 |
| Changed in ubuntu-advantage-tools (Ubuntu Xenial): | |
| status: | New → Fix Committed |
| tags: | added: verification-needed-xenial |
| Robie Basak (racb) wrote | #6 |
| Grant Orndorff (orndorffgrant) wrote | #7 |
| tags: |
added: verification-done verification-done-bionic verification-done-focal verification-done-impish verification-done-jammy verification-done-xenial removed: verification-needed verification-needed-bionic verification-needed-focal verification-needed-impish verification-needed-jammy verification-needed-xenial |
| Launchpad Janitor (janitor) wrote | #8 |
| Changed in ubuntu-advantage-tools (Ubuntu Jammy): | |
| status: | Fix Committed → Fix Released |
| Brian Murray (brian-murray) wrote Update Released | #9 |
| Launchpad Janitor (janitor) wrote | #10 |
| Changed in ubuntu-advantage-tools (Ubuntu Impish): | |
| status: | Fix Committed → Fix Released |
| Launchpad Janitor (janitor) wrote | #11 |
| Changed in ubuntu-advantage-tools (Ubuntu Focal): | |
| status: | Fix Committed → Fix Released |
| Launchpad Janitor (janitor) wrote | #12 |
| Changed in ubuntu-advantage-tools (Ubuntu Bionic): | |
| status: | Fix Committed → Fix Released |
| Launchpad Janitor (janitor) wrote | #13 |
| Changed in ubuntu-advantage-tools (Ubuntu Xenial): | |
| status: | Fix Committed → Fix Released |
This bug was fixed in the package ubuntu-
---------------
ubuntu-
* d/rules
- remove trusty specific code
- remove ua-license-
- install ubuntu-
- only on xenial: install ubuntu-
* d/tools.preinst: remove old config field to avoid warnings in logs
* d/tools.postinst
- remove trusty specific code
- print warnings if /etc/os-release doesn't have required fields
- hardcode service list instead of exec-ing python3 for old migration
- refactor python to avoid instantiating UAConfig extra times
- refactor python to always use messages module for strings
- rm the old marker file that triggered ua-license-
- remove unnecessary deb-systemd-helper check in ua-messaging cleanup
- clean up old ua-license-check state
- run new cloud-id-shim script
* d/tools/postrm
- clean up ubuntu-
* New upstream release 27.9 (LP: #1973099)
- cli:
+ for json formatted output, include additional_info for some errors
+ new subcommand `ua refresh messages` to update motd and apt messages
- daemon:
+ replace ua-license-check timer with ubuntu-
+ detects on-boot if pro license was added and runs auto-attach
+ only runs on gcp and does not continuously long-poll by default for now
- enable:
+ fix error message on wrong service name when unattached
- fips:
+ allow enabling generic fips kernel on azure by default
+ clean up fips reboot message (LP: #1972026)
- fix:
+ handle errors during attach process
+ fix bug where enable or detach during a fix failed (LP: #1969809)
+ fix bug where attempting to fix some CVEs would never finish
- performance:
+ remove unnecessary UAConfig object instantiation (also cleans up logs)
+ cache "apt-cache policy" output to avoid unnecessary subp calls
- proxy:
+ apt_http(s)_proxy renamed to global_
+ apt_http(s)_proxy config var names will still work
+ new ua_apt_
+ global_
same time
- realtime: adjust warning to clarify that a manual revert is possible
- refresh: a normal `ua refresh` will also update motd and apt messages
- security-status: add counts of packages from each archive component
- status: check if contract has updated and notify user to run "ua refresh"
-- Grant Orndorff <email address hidden> Wed, 11 May 2022 13:04:46 -0400