** Description changed: [Impact] This release brings changes to match the Contract Server new affordance, presentedAs, to present a resource via CLI with the appropriate name based on the contract definition. The main use for this functionality is to show CIS as USG on series where the latter is available, enabling user access to this new service. Furthermore, these are the additional functionalities/bug fixes contained: * Improvement on redaction of sensitive information in log files * Support for getting AWS metadata through IPv6 * Ability to do a preflight query for contract/entitlements for a token without attaching * Fix the return codes when attaching an already attached machine - (GH: #1867) * Change the calls to livepatch to use the full path - (LP: #1951954) See the changelog entry below for a full list of changes and bugs. [Test Case] The following development and SRU process was followed: https://wiki.ubuntu.com/UbuntuAdvantageToolsUpdates The ubuntu-advantage-tools team will be in charge of attaching the artifacts and console output of the appropriate run to the bug. ubuntu-advantage-tools team members will not mark ‘verification-done’ until this has happened. <TODO After released to -proposed: attach integration test artifacts> [Regression Potential] Most of the changes are adding new things and the integration tests make sure that the existing functionality is preserved. Redacting the logs is still a work in progress, and to avoid problems we will only make the logs world readable in the future, when all cases where sensitive information can be logged are verified. + In postinst, we changed a dictionary iteration to the equivalent + function implementation. Tests show that the return value is exactly the + same, but we may be inadvertently adding a bug there. + + In postrm, we are using a wildcard to remove gpg keys that matches the + naming schema we have for files. There is a risk if someone names an + unrelated apt gpg key with the ua prefix - it will end up being removed + as well. + [Discussion] This is the first version of the CIS/USG migration, and we do expect the security team to come with more requests/fixes on this in the future. However, we did agree to do that iteratively over SRUs. [Changelog] * d/control: - Update homepage URL * d/tools.postinst: - Refactor to use valid_services - * d/tools.postrm: - - Use a wildcard to remove ua related gpg files * New upstream release 27.5: - aws: add support for the IPv6 metadata endpoint - cis: update URL for the documentation - cli: + add endpoint to simulate the status using a specific contract token + fix return code when attaching an already attached machine (GH: #1867) + fix security-status to consider all possible origins to show updates + include cloud build.info in the collect-logs tarball + only show services which exist in the contracts server in ua status - docs: fix typos and wrong/outdated information - livepatch: always use the full path in livepatch calls (LP: #1951954) - logs: + improve rules to redact sensitive information from all log files + redact sensitive information from older unredacted log files + log errors from external software execution, for debugging purposes - usg: + support the presentedAs affordance from the contract server, showing services in the CLI with the appropriate names + replace the CIS entitlement by USG on Focal and onwards
** Description changed: [Impact] This release brings changes to match the Contract Server new affordance, presentedAs, to present a resource via CLI with the appropriate name based on the contract definition. The main use for this functionality is to show CIS as USG on series where the latter is available, enabling user access to this new service. Furthermore, these are the additional functionalities/bug fixes contained: * Improvement on redaction of sensitive information in log files * Support for getting AWS metadata through IPv6 * Ability to do a preflight query for contract/entitlements for a token without attaching * Fix the return codes when attaching an already attached machine - (GH: #1867) * Change the calls to livepatch to use the full path - (LP: #1951954) See the changelog entry below for a full list of changes and bugs. [Test Case] The following development and SRU process was followed: https://wiki.ubuntu.com/UbuntuAdvantageToolsUpdates The ubuntu-advantage-tools team will be in charge of attaching the artifacts and console output of the appropriate run to the bug. ubuntu-advantage-tools team members will not mark ‘verification-done’ until this has happened. <TODO After released to -proposed: attach integration test artifacts> [Regression Potential] Most of the changes are adding new things and the integration tests make sure that the existing functionality is preserved. Redacting the logs is still a work in progress, and to avoid problems we will only make the logs world readable in the future, when all cases where sensitive information can be logged are verified. In postinst, we changed a dictionary iteration to the equivalent function implementation. Tests show that the return value is exactly the same, but we may be inadvertently adding a bug there. In postrm, we are using a wildcard to remove gpg keys that matches the naming schema we have for files. There is a risk if someone names an unrelated apt gpg key with the ua prefix - it will end up being removed as well. [Discussion] This is the first version of the CIS/USG migration, and we do expect the security team to come with more requests/fixes on this in the future. However, we did agree to do that iteratively over SRUs. + The Xenial and Bionic series should see only UI text changes, preserving + exactly the same functionality as before. + + From Focal on, it is expected that USG will replace CIS. Being a + superset of CIS, USG enables people interested in CIS to use the + functionality without problems, and security will have documentation up + to guide on that. + + For the migration path, users on Focal which have already enabled CIS + will see USG instead, while still keeping the functionality they enabled + before. + + `ua enable cis` will still work from Focal onwards with the same + functionality as before, but informing the user that USG should be used + instead, and pointing to relevant documentation. + [Changelog] * d/control: - Update homepage URL * d/tools.postinst: - Refactor to use valid_services * New upstream release 27.5: - aws: add support for the IPv6 metadata endpoint - cis: update URL for the documentation - cli: + add endpoint to simulate the status using a specific contract token + fix return code when attaching an already attached machine (GH: #1867) + fix security-status to consider all possible origins to show updates + include cloud build.info in the collect-logs tarball + only show services which exist in the contracts server in ua status - docs: fix typos and wrong/outdated information - livepatch: always use the full path in livepatch calls (LP: #1951954) - logs: + improve rules to redact sensitive information from all log files + redact sensitive information from older unredacted log files + log errors from external software execution, for debugging purposes - usg: + support the presentedAs affordance from the contract server, showing services in the CLI with the appropriate names + replace the CIS entitlement by USG on Focal and onwards -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1956456 Title: [SRU] ubuntu-advantage-tools (27.4.2 -> 27.5) Xenial, Bionic, Focal, Hirsute, Impish To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/1956456/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
