** Description changed: ## FFE ## Release 0.17.0 of adsys includes bug fixes, quality-of-life changes, and new features customers requested and are already using through PPAs. To avoid users relying on PPAs as their source (and to avoid multiple versions across PPAs), we'd like to request an FFE for this release. The most notable change in this version is the addition of a new certificate auto-enrollment method through LDAP and MS-ICPR, implemented fully in Go. Although this is a big diff, this feature requires a Pro subscription, so it won't have any effect for any users in Stonking. + This is an opt-in feature, so it won't impact any existing installations + of adsys itself unless the user manually switches to it through adsys' + configuration files. Some features of this release, such as supporting dynamic values when configuring GPOs, asset normalization (e.g., replacing CRLF with LF in text files), and querying the global catalog when fetching GPOs, are already being used by customers in a custom release made for field engineering. This release also contains very important bug fixes that we intend to SRU to our LTS releases later in the cycle, such as the fix for the gdm greeter sessions. Adsys is not a seeded package, so this release will not impact Stonking's iso at all. Also, this is an enterprise-focused package, so it's very unlikely that any of its users would be running an interim release (and most of adsys' features require an active Pro subscription). Here's the full changelog of the release adsys (0.17.0) stonking; urgency=medium - * New upstream release - * Add native certificate enrollment against AD CS over LDAP and MS-ICPR, - removing the need for python3-cepces: - - Let AD decide which certificate templates the machine may enroll - - Bootstrap trust only against CAs adsys installed - - Manage enrolled certificates with the new adsysctl certificate - commands - - Default fresh installs to the native backend, leaving existing - installations on their current configuration - * Add support for dynamic values in policy entries - * Query the Global Catalog when fetching GPOs, fixing policy refresh for - users belonging to groups from another domain of the forest - * Normalize downloaded assets to Unix format, so scripts and AppArmor - profiles authored on Windows are no longer rejected because of CRLF - line endings or a UTF-8 BOM - * Normalize the end of the generated sudoers file - * Fix GDM integration issues: - - Stop denying greeter sessions running as a dynamic user, as - introduced in GDM 49 - - Seed generated dconf profiles from the matching system profile, so - the greeter no longer loses its vendor defaults - * Fix dconf policies not being applied, and user settings not being - saved, for users logging in with their short name: the PAM module now - uses the dconf profile name normalized by adsysd, and no longer points - DCONF_PROFILE to a profile that does not exist (LP: #2107971) - * Report dconf update failures leaving the ADSys databases missing or - stale instead of treating the policies as applied, and only warn when - unrelated databases fail so they cannot block logins - * Match certificate auto-enrollment registry keys case-insensitively, so - settings from GPOs storing them with a different casing are no longer - silently ignored (LP: #2169074) - * Fix GPO lookup failures when the SSSD ad_server option lists several - servers, falling back to the next one if a domain controller is - unreachable - * Reject unsupported Kerberos credential cache types, such as KCM: or - KEYRING:, instead of treating them as file paths or falling back to a - stale ticket cache - * Retry policy scripts the kernel still reports as busy, so they are no - longer occasionally skipped - * Fix a deadlock that could hang adsysctl service cat along with the - daemon output forwarding - * Add missing python3-requests dependency - * Install binaries, systemd units and the PAM module in their canonical - /usr locations instead of the aliased /sbin and /lib directories, as - required by DEP-17 (LP: #2139162) - * Migrate the adwatchd TUI to Bubble Tea v2 - * Bump Go version to 1.26 - * Refresh policy definition files - * Documentation updates: - - Added explanation of dynamic policy values - - Added meta descriptions to documentation pages - - Clarified language on network shares - - Documented native certificate enrollment and its commands - - Documented that only file-backed Kerberos caches are supported - - Dropped packagekit-tools from the getting started tutorial - - Fixed broken links and sitemap generation - - Implemented new homepage structure - - Migrated documentation tooling to Starter Pack v2 - - Removed in-docs release notes - - Restructured certificates documentation - - Updated configuration for the documentation URL migration - * CI and quality of life changes not impacting package functionality: - - Added AGENTS.md instructions - - Allowed labeled pull requests to run the end-to-end tests - - Got the end-to-end suite running again and made it validate the - certificate backend actually under test - - Fixed the TICS report action - - Fixed d/copyright with helper script - - Fixed typos and grammar errors in code comments and messages - - Improved test stability on CI - - Properly disable Kerberos usage in AD tests - - Skipped the patches tests when no debian directory exists - * Bump dependencies to latest: - - charm.land/bubbles/v2 v2.2.1 - - charm.land/bubbletea/v2 v2.0.10 - - charm.land/lipgloss/v2 v2.0.6 - - github.com/charmbracelet/glamour v1.0.0 - - github.com/coreos/go-systemd/v22 v22.7.0 - - github.com/fatih/color v1.19.0 - - github.com/fsnotify/fsnotify v1.10.1 - - github.com/godbus/dbus/v5 v5.2.2 - - github.com/kardianos/service v1.3.0 - - github.com/maruel/natural v1.3.0 - - github.com/oiweiwei/go-msrpc v1.6.4 - - github.com/oiweiwei/gokrb5.fork/v9 v9.0.8 - - github.com/pkg/sftp v1.13.11 - - github.com/sirupsen/logrus v1.10.2 - - github.com/spf13/cobra v1.10.2 - - github.com/stretchr/testify v1.12.1 - - golang.org/x/crypto v0.57.0 - - golang.org/x/exp v0.0.0-20231006140011-7918f672742d - - golang.org/x/sync v0.23.0 - - golang.org/x/sys v0.48.0 - - golang.org/x/text v0.42.0 - - google.golang.org/grpc v1.83.2 - - google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 - - google.golang.org/protobuf v1.36.12 - - gopkg.in/ini.v1 v1.67.3 - - github.com/golangci/golangci-lint/v2 v2.14.0 - - actions/checkout v7 - - actions/download-artifact v8 - - actions/setup-go v7 - - actions/upload-artifact v7 - - azure/login v3 - - codecov/codecov-action v7 - - jidicula/clang-format-action v4.18.0 - - peter-evans/create-pull-request v8 - - softprops/action-gh-release v3 - - tiobe/tics-github-action v4 + * New upstream release + * Add native certificate enrollment against AD CS over LDAP and MS-ICPR, + removing the need for python3-cepces: + - Let AD decide which certificate templates the machine may enroll + - Bootstrap trust only against CAs adsys installed + - Manage enrolled certificates with the new adsysctl certificate + commands + - Default fresh installs to the native backend, leaving existing + installations on their current configuration + * Add support for dynamic values in policy entries + * Query the Global Catalog when fetching GPOs, fixing policy refresh for + users belonging to groups from another domain of the forest + * Normalize downloaded assets to Unix format, so scripts and AppArmor + profiles authored on Windows are no longer rejected because of CRLF + line endings or a UTF-8 BOM + * Normalize the end of the generated sudoers file + * Fix GDM integration issues: + - Stop denying greeter sessions running as a dynamic user, as + introduced in GDM 49 + - Seed generated dconf profiles from the matching system profile, so + the greeter no longer loses its vendor defaults + * Fix dconf policies not being applied, and user settings not being + saved, for users logging in with their short name: the PAM module now + uses the dconf profile name normalized by adsysd, and no longer points + DCONF_PROFILE to a profile that does not exist (LP: #2107971) + * Report dconf update failures leaving the ADSys databases missing or + stale instead of treating the policies as applied, and only warn when + unrelated databases fail so they cannot block logins + * Match certificate auto-enrollment registry keys case-insensitively, so + settings from GPOs storing them with a different casing are no longer + silently ignored (LP: #2169074) + * Fix GPO lookup failures when the SSSD ad_server option lists several + servers, falling back to the next one if a domain controller is + unreachable + * Reject unsupported Kerberos credential cache types, such as KCM: or + KEYRING:, instead of treating them as file paths or falling back to a + stale ticket cache + * Retry policy scripts the kernel still reports as busy, so they are no + longer occasionally skipped + * Fix a deadlock that could hang adsysctl service cat along with the + daemon output forwarding + * Add missing python3-requests dependency + * Install binaries, systemd units and the PAM module in their canonical + /usr locations instead of the aliased /sbin and /lib directories, as + required by DEP-17 (LP: #2139162) + * Migrate the adwatchd TUI to Bubble Tea v2 + * Bump Go version to 1.26 + * Refresh policy definition files + * Documentation updates: + - Added explanation of dynamic policy values + - Added meta descriptions to documentation pages + - Clarified language on network shares + - Documented native certificate enrollment and its commands + - Documented that only file-backed Kerberos caches are supported + - Dropped packagekit-tools from the getting started tutorial + - Fixed broken links and sitemap generation + - Implemented new homepage structure + - Migrated documentation tooling to Starter Pack v2 + - Removed in-docs release notes + - Restructured certificates documentation + - Updated configuration for the documentation URL migration + * CI and quality of life changes not impacting package functionality: + - Added AGENTS.md instructions + - Allowed labeled pull requests to run the end-to-end tests + - Got the end-to-end suite running again and made it validate the + certificate backend actually under test + - Fixed the TICS report action + - Fixed d/copyright with helper script + - Fixed typos and grammar errors in code comments and messages + - Improved test stability on CI + - Properly disable Kerberos usage in AD tests + - Skipped the patches tests when no debian directory exists + * Bump dependencies to latest: + - charm.land/bubbles/v2 v2.2.1 + - charm.land/bubbletea/v2 v2.0.10 + - charm.land/lipgloss/v2 v2.0.6 + - github.com/charmbracelet/glamour v1.0.0 + - github.com/coreos/go-systemd/v22 v22.7.0 + - github.com/fatih/color v1.19.0 + - github.com/fsnotify/fsnotify v1.10.1 + - github.com/godbus/dbus/v5 v5.2.2 + - github.com/kardianos/service v1.3.0 + - github.com/maruel/natural v1.3.0 + - github.com/oiweiwei/go-msrpc v1.6.4 + - github.com/oiweiwei/gokrb5.fork/v9 v9.0.8 + - github.com/pkg/sftp v1.13.11 + - github.com/sirupsen/logrus v1.10.2 + - github.com/spf13/cobra v1.10.2 + - github.com/stretchr/testify v1.12.1 + - golang.org/x/crypto v0.57.0 + - golang.org/x/exp v0.0.0-20231006140011-7918f672742d + - golang.org/x/sync v0.23.0 + - golang.org/x/sys v0.48.0 + - golang.org/x/text v0.42.0 + - google.golang.org/grpc v1.83.2 + - google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 + - google.golang.org/protobuf v1.36.12 + - gopkg.in/ini.v1 v1.67.3 + - github.com/golangci/golangci-lint/v2 v2.14.0 + - actions/checkout v7 + - actions/download-artifact v8 + - actions/setup-go v7 + - actions/upload-artifact v7 + - azure/login v3 + - codecov/codecov-action v7 + - jidicula/clang-format-action v4.18.0 + - peter-evans/create-pull-request v8 + - softprops/action-gh-release v3 + - tiobe/tics-github-action v4 - -- Denison Barbosa <[email protected]> Tue, 06 Oct 2026 11:19:20 -0400 - + -- Denison Barbosa <[email protected]> Tue, 06 Oct 2026 + 11:19:20 -0400 - Our changes are covered by both unit and integration tests, and we have over 90% test coverage. CI results can be checked at: https://github.com/ubuntu/adsys/actions/runs/37459942591/job/112282638180 and https://github.com/ubuntu/adsys/actions/runs/37485916018/job/112346579890. The latest e2e failures are not related to the changes introduced by this release. - - Builds can be checked at: https://launchpad.net/~justdenis/+archive/ubuntu/adsys-candidate/+packages + Our changes are covered by both unit and integration tests, and we have + over 90% test coverage. CI results can be checked at: + https://github.com/ubuntu/adsys/actions/runs/37459942591/job/112282638180 + and + https://github.com/ubuntu/adsys/actions/runs/37485916018/job/112346579890. + The latest e2e failures are not related to the changes introduced by + this release. + + Builds can be checked at: + https://launchpad.net/~justdenis/+archive/ubuntu/adsys- + candidate/+packages
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2169827 Title: [FFE] Release adsys 0.17.0 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/adsys/+bug/2169827/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
