Ubuntu pro reports CVE falsely as fixed

[Jonathan]

[Impact]
In some cases, a machine may not have access to the version of a package that we assume to be available in `pro fix`. The result is that `pro fix` says "CVE-1234 is resolved" after a successful `apt install` command, even though the version with the fix was not actually installed. This is a misleading message and may lead users to believe they are safe from the given CVE when they are not.

The fix is to check the local apt-cache before trying to install a version to make sure that the candidate version is the one with the fix applied. Only then do we proceed with the `apt install` and say that the CVE is resolved.

[Test Case]
This will be covered by our full test run for u-a-t 27.14.
The specific test that covers this scenario can be inspected here:
https://github.com/canonical/ubuntu-pro-client/blob/27.14/features/fix.feature#L474

[Regression Potential]
The new code to prevent this situation is an additional check before attempting to install the update. If there is a mistake in the implementation, it could prevent `pro fix` from resolving CVEs that can be resolved.

[Original Description]

pro version: 27.13.3-18.01.1

When running:
    sudo pro fix CVE-2023-0286
    CVE-2023-0286: OpenSSL vulnerabilities
    https://ubuntu.com/security/CVE-2023-0286
    2 affected source packages are installed: openssl, openssl1.0
    (1/2, 2/2) openssl, openssl1.0:
    A fix is available in Ubuntu standard updates.
    { apt update && apt install --only-upgrade -y libssl1.0.0 libssl1.1 openssl }
    ✔ CVE-2023-0286 is resolved.

The last line states that the CVE is resolved, but when checking it via apt policy, it is still the old version
    apt policy openssl
    openssl:
      Installed: 1.1.1-1ubuntu2.1~18.04.14
      Candidate: 1.1.1-1ubuntu2.1~18.04.14
      Version table:
     *** 1.1.1-1ubuntu2.1~18.04.14 500
        500 https://'an-outdated-ubuntu-mirror' bionic-updates/main amd64 Packages

(expected version is 1.1.1-1ubuntu2.1~18.04.21, from the http://security.ubuntu.com/ubuntu bionic-security/main repository)

Reason for the update not working is because the repositories the machine is subscribed to do not contain the fix.

The bug I want to file is the last line of the 'pro fix' command, being ' ✔ CVE-2023-0286 is resolved.'

This (presumably) is stated there because the apt install command successfully was able to run, but that does not mean the CVE is fixed (in this case, I had no repository in my sources.list offering the patch).

Suggestion to change that last line to: "❌ CVE-2023-0286 is not resolved."

Reason for reporting this as a security issue is the false claiming of a fixed security vulnerability.

[Eduardo Barretto (ebarretto)]

Hi Jonathan,

Thanks for taking the time to report this bug and helping to make Ubuntu better.

I will share this bug with the maintainers of the pro tool, and get this sorted out soon.

[Lucas Albuquerque Medeiros de Moura (lamoura)]

I can confirm that this issue is real and we will work on a fix for it

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.14~23.04.1

---------------
ubuntu-advantage-tools (27.14~23.04.1) lunar; urgency=medium

  * d/ubuntu-advantage-tools.{postinst,postrm,preinst}:
    - migrate certain settings out of uaclient.conf to a new file managed by
      the pro config subcommand (LP: #2004280)
  * d/ubuntu-advantage-tools.postinst:
    - refactor PREVIOUS_PKG_VER as a global variable
    - simplify how we add notices
  * New upstream release 27.14 (LP: #2011477)
    - api: new u.unattended_upgrades.status.v1 endpoint for querying status of
      unattended upgrades
    - apt:
      + remove legacy apt-hook
      + deliver json apt-hook for interim releases
      + fix cloud identification logic in json apt-hook
      + make all calls to esm-cache isolated from system configuration
        (LP: #2008280)
      + only set up the esm cache on supported systems (LP: #2004018)
    - fix:
      + format the output to be more readable (LP: #1926182)
      + add option to attach during a fix without a token
      + verify if fixed version can be installed before trying (LP: #2006705)
    - livepatch: show warning if current kernel is not supported
    - locks: alert user about corrupted lock files (LP: #1996931)
    - logging: logs are now formatted as jsonlines
    - motd: remove esm-apps announcement
    - notices: new representation on disk as separate files (LP: #1987738)
    - realtime: remove ubuntu-realtime package on disablement
    - status:
      + removed contract info update check network call
      + no longer includes warnings about notices when non-root (LP: #2006138)
      + unattached status sends virt type to contract server for better
        resource availability calculation
    - timer jobs: add daily job to check for contract updates
    - yaml: always import distro-provided pyyaml (LP: #2007234, LP: #2007241)

 -- Grant Orndorff <email address hidden> Mon, 13 Mar 2023 15:28:33 -0400

[Christian Ehrhardt  (paelzer)]

This is fixed in lunar and currently prepared to be fixed in all other releases.
By now we can update the state to no more be "private".

We are not exposing users to a risk by releasing the information about this.
In fact the opposite, users should know that there might have been false positives before.

And making it public helps everyone that might follow the changelog of the uploaded fix to understand the backgrounds.

[Andreas Hasenack (ahasenack)]

Hello Jonathan, or anyone else affected,

Accepted ubuntu-advantage-tools into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.14.4~22.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Hello Jonathan, or anyone else affected,

Accepted ubuntu-advantage-tools into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.14.4~22.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Hello Jonathan, or anyone else affected,

Accepted ubuntu-advantage-tools into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.14.4~20.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Hello Jonathan, or anyone else affected,

Accepted ubuntu-advantage-tools into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.14.4~18.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Hello Jonathan, or anyone else affected,

Accepted ubuntu-advantage-tools into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.14.4~16.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Lucas Albuquerque Medeiros de Moura (lamoura)]

I have verified that 27.14.4 fixed this issue with the integration tests mentioned on the bug template

[Andreas Hasenack (ahasenack)]

Why was just bionic tested? The link to the test case[1] also seems to only cover bionic. I don't see this test ("Fix command on a machine without security/updates source lists") in the non-bionic test logs attached to the main SRU bug at https://bugs.launchpad.net/bugs/2011477

I know sometimes an UA bug does not affect all releases, but this one seems like it does? Or I missed something.

1. https://github.com/canonical/ubuntu-pro-client/blob/27.14/features/fix.feature#L474

[Lucas Albuquerque Medeiros de Moura (lamoura)]

Yes, excellent point. I am now providing manual test for all of the other releases:

-----------------------------

#!/bin/bash
set -e

series=$1

name=$series-test

function cleanup {
  lxc delete $name --force
}

function on_err {
  echo -e "Test Failed"
  cleanup
  exit 1
}

trap on_err ERR

if [ $series == "xenial" ]; then
    security_id="CVE-2020-26262"
elif [ $series == "focal" ]; then
    security_id="USN-4539-1"
elif [ $series == "jammy" ]; then
    security_id="CVE-2023-1326"
elif [ $series == "kinetic" ]; then
    security_id="CVE-2023-1326"
fi

function upgrade_to_proposed {
    echo -e "\n-------------------------------------------"
    echo "** upgrading to 27.14.4 from proposed"
    echo "-------------------------------------------"
    lxc exec $name -- sh -c "echo \"deb http://archive.ubuntu.com/ubuntu $series-proposed main\" | tee /etc/apt/sources.list.d/proposed.list"
    lxc exec $name -- apt-get update > /dev/null
    lxc exec $name -- apt-get install ubuntu-advantage-tools -y
    lxc exec $name -- apt-cache policy ubuntu-advantage-tools
    echo "-------------------------------------------"
}

function set_up_env {
    echo -e "\n-------------------------------------------"
    echo "** Setting up environment for $series machine"
    echo "-------------------------------------------"
    if [ $series == "xenial" ]; then
        lxc exec $name -- apt-get install -y coturn=4.5.0.3-1build1 > /dev/null
    elif [ $series == "focal" ]; then
        lxc exec $name -- apt-get install -y libawl-php=0.60-1 > /dev/null
    elif [ $series == "jammy" ]; then
        lxc exec $name -- apt-get install -y apport=2.20.11-0ubuntu82.3 > /dev/null
    elif [ $series == "kinetic" ]; then
        lxc exec $name -- apt-get install -y apport=2.23.1-0ubuntu3.1 > /dev/null
    fi
    echo "-------------------------------------------"
}

lxc launch ubuntu-daily:$series $name
sleep 5
upgrade_to_proposed
set_up_env

echo -e "\n-------------------------------------------"
echo "** Verify pro fix command cannot install the update"
lxc exec $name -- sed -i "/$series-updates/d" /etc/apt/sources.list
lxc exec $name -- sed -i "/$series-security/d" /etc/apt/sources.list
lxc exec $name -- rm /etc/apt/sources.list.d/proposed.list

lxc exec $name -- apt-get update > /dev/null
lxc exec $name -- sh -c "pro fix $security_id || true"
echo "-------------------------------------------"

cleanup

---------------------------------

[Grant Orndorff (orndorffgrant)]

I've run the provided test script (with very small modifications to make the jammy and kinetic cases work) for xenial, focal, jammy, and kinetic.

I'm attaching the modified script and the logs from the test runs.

Marking verification done.

Edit: I missed that lucas had already attached logs from test runs. The only thing missing was marking verification as done :)

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.14.4~16.04

---------------
ubuntu-advantage-tools (27.14.4~16.04) xenial; urgency=medium

  * Backport new upstream release: (LP: #2011477) to xenial

ubuntu-advantage-tools (27.14.4) lunar; urgency=medium

  * timer: disable update_contract_info job (LP: #2015302)
  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on non-amd64 systems (LP: #2015241)

ubuntu-advantage-tools (27.14.3) lunar; urgency=medium

  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on interim releases (LP: #2013409)

ubuntu-advantage-tools (27.14.2~23.04.1) lunar; urgency=medium

  * status:
    - always use dpkg instead of lscpu for fetching architecture
      information (LP: #2012735)

ubuntu-advantage-tools (27.14.1~23.04.1) lunar; urgency=medium

  * New upstream release 27.14.1
    - apt: fix a configuration leak in the apt.get_pkg_candidate_version
      function (LP: #2012642)

ubuntu-advantage-tools (27.14~23.04.1) lunar; urgency=medium

  * d/ubuntu-advantage-tools.{postinst,postrm,preinst}:
    - migrate certain settings out of uaclient.conf to a new file managed by
      the pro config subcommand (LP: #2004280)
  * d/ubuntu-advantage-tools.postinst:
    - refactor PREVIOUS_PKG_VER as a global variable
    - simplify how we add notices
  * New upstream release 27.14 (LP: #2011477)
    - api: new u.unattended_upgrades.status.v1 endpoint for querying status of
      unattended upgrades
    - apt:
      + remove legacy apt-hook
      + deliver json apt-hook for interim releases
      + fix cloud identification logic in json apt-hook
      + make all calls to esm-cache isolated from system configuration
        (LP: #2008280)
      + only set up the esm cache on supported systems (LP: #2004018)
    - fix:
      + format the output to be more readable (LP: #1926182)
      + add option to attach during a fix without a token
      + verify if fixed version can be installed before trying (LP: #2006705)
    - livepatch: show warning if current kernel is not supported
    - locks: alert user about corrupted lock files (LP: #1996931)
    - logging: logs are now formatted as jsonlines
    - motd: remove esm-apps announcement
    - notices: new representation on disk as separate files (LP: #1987738)
    - realtime: remove ubuntu-realtime package on disablement
    - status:
      + removed contract info update check network call
      + no longer includes warnings about notices when non-root (LP: #2006138)
      + unattached status sends virt type to contract server for better
        resource availability calculation
    - timer jobs: add daily job to check for contract updates
    - yaml: always import distro-provided pyyaml (LP: #2007234, LP: #2007241)

 -- Renan Rodrigo <email address hidden> Thu, 06 Apr 2023 10:50:05 -0300

[Chris Halse Rogers (raof)]

The verification of the Stable Release Update for ubuntu-advantage-tools has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.14.4~18.04

---------------
ubuntu-advantage-tools (27.14.4~18.04) bionic; urgency=medium

  * Backport new upstream release: (LP: #2011477) to bionic

ubuntu-advantage-tools (27.14.4) lunar; urgency=medium

  * timer: disable update_contract_info job (LP: #2015302)
  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on non-amd64 systems (LP: #2015241)

ubuntu-advantage-tools (27.14.3) lunar; urgency=medium

  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on interim releases (LP: #2013409)

ubuntu-advantage-tools (27.14.2~23.04.1) lunar; urgency=medium

  * status:
    - always use dpkg instead of lscpu for fetching architecture
      information (LP: #2012735)

ubuntu-advantage-tools (27.14.1~23.04.1) lunar; urgency=medium

  * New upstream release 27.14.1
    - apt: fix a configuration leak in the apt.get_pkg_candidate_version
      function (LP: #2012642)

ubuntu-advantage-tools (27.14~23.04.1) lunar; urgency=medium

  * d/ubuntu-advantage-tools.{postinst,postrm,preinst}:
    - migrate certain settings out of uaclient.conf to a new file managed by
      the pro config subcommand (LP: #2004280)
  * d/ubuntu-advantage-tools.postinst:
    - refactor PREVIOUS_PKG_VER as a global variable
    - simplify how we add notices
  * New upstream release 27.14 (LP: #2011477)
    - api: new u.unattended_upgrades.status.v1 endpoint for querying status of
      unattended upgrades
    - apt:
      + remove legacy apt-hook
      + deliver json apt-hook for interim releases
      + fix cloud identification logic in json apt-hook
      + make all calls to esm-cache isolated from system configuration
        (LP: #2008280)
      + only set up the esm cache on supported systems (LP: #2004018)
    - fix:
      + format the output to be more readable (LP: #1926182)
      + add option to attach during a fix without a token
      + verify if fixed version can be installed before trying (LP: #2006705)
    - livepatch: show warning if current kernel is not supported
    - locks: alert user about corrupted lock files (LP: #1996931)
    - logging: logs are now formatted as jsonlines
    - motd: remove esm-apps announcement
    - notices: new representation on disk as separate files (LP: #1987738)
    - realtime: remove ubuntu-realtime package on disablement
    - status:
      + removed contract info update check network call
      + no longer includes warnings about notices when non-root (LP: #2006138)
      + unattached status sends virt type to contract server for better
        resource availability calculation
    - timer jobs: add daily job to check for contract updates
    - yaml: always import distro-provided pyyaml (LP: #2007234, LP: #2007241)

 -- Renan Rodrigo <email address hidden> Thu, 06 Apr 2023 10:49:20 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.14.4~20.04

---------------
ubuntu-advantage-tools (27.14.4~20.04) focal; urgency=medium

  * Backport new upstream release: (LP: #2011477) to focal

ubuntu-advantage-tools (27.14.4) lunar; urgency=medium

  * timer: disable update_contract_info job (LP: #2015302)
  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on non-amd64 systems (LP: #2015241)

ubuntu-advantage-tools (27.14.3) lunar; urgency=medium

  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on interim releases (LP: #2013409)

ubuntu-advantage-tools (27.14.2~23.04.1) lunar; urgency=medium

  * status:
    - always use dpkg instead of lscpu for fetching architecture
      information (LP: #2012735)

ubuntu-advantage-tools (27.14.1~23.04.1) lunar; urgency=medium

  * New upstream release 27.14.1
    - apt: fix a configuration leak in the apt.get_pkg_candidate_version
      function (LP: #2012642)

ubuntu-advantage-tools (27.14~23.04.1) lunar; urgency=medium

  * d/ubuntu-advantage-tools.{postinst,postrm,preinst}:
    - migrate certain settings out of uaclient.conf to a new file managed by
      the pro config subcommand (LP: #2004280)
  * d/ubuntu-advantage-tools.postinst:
    - refactor PREVIOUS_PKG_VER as a global variable
    - simplify how we add notices
  * New upstream release 27.14 (LP: #2011477)
    - api: new u.unattended_upgrades.status.v1 endpoint for querying status of
      unattended upgrades
    - apt:
      + remove legacy apt-hook
      + deliver json apt-hook for interim releases
      + fix cloud identification logic in json apt-hook
      + make all calls to esm-cache isolated from system configuration
        (LP: #2008280)
      + only set up the esm cache on supported systems (LP: #2004018)
    - fix:
      + format the output to be more readable (LP: #1926182)
      + add option to attach during a fix without a token
      + verify if fixed version can be installed before trying (LP: #2006705)
    - livepatch: show warning if current kernel is not supported
    - locks: alert user about corrupted lock files (LP: #1996931)
    - logging: logs are now formatted as jsonlines
    - motd: remove esm-apps announcement
    - notices: new representation on disk as separate files (LP: #1987738)
    - realtime: remove ubuntu-realtime package on disablement
    - status:
      + removed contract info update check network call
      + no longer includes warnings about notices when non-root (LP: #2006138)
      + unattached status sends virt type to contract server for better
        resource availability calculation
    - timer jobs: add daily job to check for contract updates
    - yaml: always import distro-provided pyyaml (LP: #2007234, LP: #2007241)

 -- Renan Rodrigo <email address hidden> Thu, 06 Apr 2023 10:48:25 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.14.4~22.04

---------------
ubuntu-advantage-tools (27.14.4~22.04) jammy; urgency=medium

  * Backport new upstream release: (LP: #2011477) to jammy

ubuntu-advantage-tools (27.14.4) lunar; urgency=medium

  * timer: disable update_contract_info job (LP: #2015302)
  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on non-amd64 systems (LP: #2015241)

ubuntu-advantage-tools (27.14.3) lunar; urgency=medium

  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on interim releases (LP: #2013409)

ubuntu-advantage-tools (27.14.2~23.04.1) lunar; urgency=medium

  * status:
    - always use dpkg instead of lscpu for fetching architecture
      information (LP: #2012735)

ubuntu-advantage-tools (27.14.1~23.04.1) lunar; urgency=medium

  * New upstream release 27.14.1
    - apt: fix a configuration leak in the apt.get_pkg_candidate_version
      function (LP: #2012642)

ubuntu-advantage-tools (27.14~23.04.1) lunar; urgency=medium

  * d/ubuntu-advantage-tools.{postinst,postrm,preinst}:
    - migrate certain settings out of uaclient.conf to a new file managed by
      the pro config subcommand (LP: #2004280)
  * d/ubuntu-advantage-tools.postinst:
    - refactor PREVIOUS_PKG_VER as a global variable
    - simplify how we add notices
  * New upstream release 27.14 (LP: #2011477)
    - api: new u.unattended_upgrades.status.v1 endpoint for querying status of
      unattended upgrades
    - apt:
      + remove legacy apt-hook
      + deliver json apt-hook for interim releases
      + fix cloud identification logic in json apt-hook
      + make all calls to esm-cache isolated from system configuration
        (LP: #2008280)
      + only set up the esm cache on supported systems (LP: #2004018)
    - fix:
      + format the output to be more readable (LP: #1926182)
      + add option to attach during a fix without a token
      + verify if fixed version can be installed before trying (LP: #2006705)
    - livepatch: show warning if current kernel is not supported
    - locks: alert user about corrupted lock files (LP: #1996931)
    - logging: logs are now formatted as jsonlines
    - motd: remove esm-apps announcement
    - notices: new representation on disk as separate files (LP: #1987738)
    - realtime: remove ubuntu-realtime package on disablement
    - status:
      + removed contract info update check network call
      + no longer includes warnings about notices when non-root (LP: #2006138)
      + unattached status sends virt type to contract server for better
        resource availability calculation
    - timer jobs: add daily job to check for contract updates
    - yaml: always import distro-provided pyyaml (LP: #2007234, LP: #2007241)

 -- Renan Rodrigo <email address hidden> Thu, 06 Apr 2023 10:48:43 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.14.4~22.10

---------------
ubuntu-advantage-tools (27.14.4~22.10) kinetic; urgency=medium

  * Backport new upstream release: (LP: #2011477) to kinetic

ubuntu-advantage-tools (27.14.4) lunar; urgency=medium

  * timer: disable update_contract_info job (LP: #2015302)
  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on non-amd64 systems (LP: #2015241)

ubuntu-advantage-tools (27.14.3) lunar; urgency=medium

  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on interim releases (LP: #2013409)

ubuntu-advantage-tools (27.14.2~23.04.1) lunar; urgency=medium

  * status:
    - always use dpkg instead of lscpu for fetching architecture
      information (LP: #2012735)

ubuntu-advantage-tools (27.14.1~23.04.1) lunar; urgency=medium

  * New upstream release 27.14.1
    - apt: fix a configuration leak in the apt.get_pkg_candidate_version
      function (LP: #2012642)

ubuntu-advantage-tools (27.14~23.04.1) lunar; urgency=medium

  * d/ubuntu-advantage-tools.{postinst,postrm,preinst}:
    - migrate certain settings out of uaclient.conf to a new file managed by
      the pro config subcommand (LP: #2004280)
  * d/ubuntu-advantage-tools.postinst:
    - refactor PREVIOUS_PKG_VER as a global variable
    - simplify how we add notices
  * New upstream release 27.14 (LP: #2011477)
    - api: new u.unattended_upgrades.status.v1 endpoint for querying status of
      unattended upgrades
    - apt:
      + remove legacy apt-hook
      + deliver json apt-hook for interim releases
      + fix cloud identification logic in json apt-hook
      + make all calls to esm-cache isolated from system configuration
        (LP: #2008280)
      + only set up the esm cache on supported systems (LP: #2004018)
    - fix:
      + format the output to be more readable (LP: #1926182)
      + add option to attach during a fix without a token
      + verify if fixed version can be installed before trying (LP: #2006705)
    - livepatch: show warning if current kernel is not supported
    - locks: alert user about corrupted lock files (LP: #1996931)
    - logging: logs are now formatted as jsonlines
    - motd: remove esm-apps announcement
    - notices: new representation on disk as separate files (LP: #1987738)
    - realtime: remove ubuntu-realtime package on disablement
    - status:
      + removed contract info update check network call
      + no longer includes warnings about notices when non-root (LP: #2006138)
      + unattached status sends virt type to contract server for better
        resource availability calculation
    - timer jobs: add daily job to check for contract updates
    - yaml: always import distro-provided pyyaml (LP: #2007234, LP: #2007241)

 -- Renan Rodrigo <email address hidden> Thu, 06 Apr 2023 10:48:43 -0300