[SRU] include recent version containing fips and livepatch

Bug #1719671 reported by Joy Latten on 2017-09-26
14
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ubuntu-advantage-tools (Ubuntu)
High
Unassigned
Trusty
Medium
Andreas Hasenack
Xenial
Medium
Andreas Hasenack
Zesty
Medium
Andreas Hasenack
Artful
Medium
Andreas Hasenack

Bug Description

This bug has some history that may be confusing from the comments. Basically it started out as a Feature Freeze Exception, that's why we had build logs, git logs and unit test runs attached.

Also, the "rename" that is mentioned elsewhere did not happen with this package: the ubuntu-advantage name was kept, no new aliases were added. This will happen in a later SRU, with a later version of the package.

PPA with test packages: https://launchpad.net/~ahasenack/+archive/ubuntu/ua-tools-1719671-take1

[IMPACT]
Most recent version of ubuntu-advantage-tool on github includes fips and livepatch enablement. The fips enablement will allow customers to easily install and configure Canonical's FIPS certified modules on xenial, whereas livepatch allows xenial and trusty customers to patch the running kernel without a reboot.

This SRU will cover both new features.

In addition to the new features themselves, a new "status" command was added that will give a short summary about the available modules and their status, at a glance.

Note: FIPS certified modules are only available for xenial. Livepatch is supported on xenial and trusty. The tool will refuse to enable either service on an unsupported ubuntu release.

Without this updated package, customers of those services have to enable them manually by following a series of steps.

[FIPS DESCRIPTION]
When "ubuntu-advantage enable-fips <token>" is issued from commandline,

 - configure the private PPA where the FIPS modules are located
 - install the FIPS modules from this PPA to the local machine from where the script is run
 - configure the bootloader to enable fips

Upon successful completion of these steps, the customer then gets a message stating to reboot
the machine to complete the fips enablement process.

Without the script, customers must perform the steps manually.

[LIVEPATCH DESCRIPTION]
Livepatch allows customers to apply kernel patches to a running system without rebooting it.

The current instructions live in http://ubuntu.com/livepatch and boil down to:
- install snapd if it's not installed already. On trusty this means a new kernel as well.
- install the canonical-livepatch snap
- obtain a livepatch token from Canonical
- run the enable command with the given token

The ubuntu-advantage-tools package simplifies this process by just requesting the token and performing all the other steps on behalf of the user. It also conveniently checks the running kernel and instructs the user to reboot into a newer kernel if needed to finish the installation (this is the case when running trusty).

[FIX]

Add fips and livepatch support to the ubuntu-adadvantage-tools package. See debdiff below.

[LIVEPATCH TESTCASES]

TRUSTY
0. Install the new ubuntu-advantage-tools package to add livepatch support.

1. Collect status before enabling livepatch

type on commandline:
    ubuntu-advantage status

expect:
livepatch: disabled

esm: disabled (not available)

fips: disabled (not available)

2. Enable livepatch

visit https://ubuntu.com/livepatch and obtain a token

type on commandline,
    sudo ubuntu-advantage enable-livepatch <yourtoken>

You may be required to install a newer kernel. In that case, expect the
following output:
 Installing missing dependency snapd... OK
 Installing the canonical-livepatch snap.
 This may take a few minutes depending on your bandwidth.
 canonical-livepatch 7.24 from 'canonical' installed

 Your currently running kernel (3.13.0-133-generic) is too old to
 support snaps. Version 4.4.0 or higher is needed.

 Please reboot your system into a supported kernel version
 and run the following command one more time to complete the
 installation:

 sudo ubuntu-advantage enable-livepatch <yourtoken>

Once you reboot and re-run the specified command, expect:
 Enabling Livepatch with the given token, stand by...
 Successfully enabled device. Using machine-token: <sometoken>
 Use "canonical-livepatch status" to verify current patch status.

3. Verify livepatch status

type on commandline,
    ubuntu-advantage status

expect an output like the following,
 livepatch: enabled
   client-version: "7.23"
   architecture: x86_64
   cpu-model: Intel Core Processor (Skylake)
   last-check: 2017-10-23T15:10:45.640938255Z
   boot-time: 2017-10-23T15:10:13Z
   uptime: 1m19s
   status:
   - kernel: 4.4.0-97.120~14.04.1-generic
     running: true
     livepatch:
       checkState: checked
       patchState: nothing-to-apply
       version: ""
       fixes: ""

 esm: disabled (not available)

 fips: disabled (not available)

XENIAL
0. Install the new ubuntu-advantage-tools package to add livepatch support.

1. Collect status before enabling livepatch

type on commandline,
    ubuntu-advantage status

expect,
    livepatch: disabled

    esm: disabled (not available)

    fips: disabled

2. Enable livepatch

visit https://ubuntu.com/livepatch and obtain a token

type on commandline,
    sudo ubuntu-advantage enable-livepatch <yourtoken>

expect,
    Installing the canonical-livepatch snap.
    This may take a few minutes depending on your bandwidth.
    2017-10-20T19:39:41Z INFO Waiting for restart...
    canonical-livepatch 7.24 from 'canonical' installed
    Enabling Livepatch with the given token, stand by...
    Successfully enabled device. Using machine-token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    Use "canonical-livepatch status" to verify current patch status.

3. Verify livepatch status

type on commandline,
    ubuntu-advantage status

expect an output like the following,

    livepatch: enabled
      client-version: "7.23"
      architecture: x86_64
      cpu-model: Intel Core Processor (Skylake)
      last-check: 2017-10-20T19:39:54.451499227Z
      boot-time: 2017-10-20T19:28:09Z
      uptime: 15m30s
      status:
      - kernel: 4.4.0-97.120-generic
        running: true
        livepatch:
          checkState: checked
          patchState: nothing-to-apply
          version: ""
          fixes: ""

    esm: disabled (not available)

    fips: disabled

ZESTY
0. Install the new ubuntu-advantage-tools package to add livepatch support.

1. Collect status before enabling livepatch

type on commandline:
    ubuntu-advantage status

expect the livepatch service to be unavailable:
livepatch: disabled (not available)

esm: disabled (not available)

fips: disabled (not available)

2. Ensure that livepatch cannot be enabled on Zesty.
You can use a dummy set of credentials like "foobar" as the token:

type on commandline,
    sudo ubuntu-advantage enable-livepatch foobar

expect,
    Sorry, but Canonical Livepatch is not supported on zesty

[FIPS TESTCASES]
These testcases assume you have installed ubuntu-advantage-tools with the proposed changes. Prior to the upload they were performed on S390, PPC64EL and AMD64 architectures.

TRUSTY
(Note that FIPS is not supported on trusty.)

1. Collect status before enabling fips

type on commandline,
    ubuntu-advantage status

expect,
 livepatch: disabled

 esm: disabled (not available)

 fips: disabled (not available)

2. Ensure that fips cannot be enabled on trusty.
You can use a dummy set of credentials like user:secret as the token:

type on commandline,
    sudo ubuntu-advantage enable-fips user:secret

expect,
    Sorry, but Canonical FIPS 140-2 Modules is not supported on trusty

XENIAL
0. Install the new ubuntu-advantage-tools package to add fips support.

1. Collect status before enabling fips

type on commandline,
    ubuntu-advantage status

expect,
    livepatch: disabled

    esm: disabled (not available)

    fips: disabled

2. Enable fips
Note: This will require a token or credentials to fips Private PPA, in
the form xxx:xxx

type on commandline,
    sudo ubuntu-advantage enable-fips xxx:xxx

expect,
    [sudo] password for ubuntu:
    Running apt-get update... OK
    Ubuntu FIPS PPA repository enabled.
    Installing FIPS packages (this may take a while)... OK
    Configuring FIPS...
    Updating grub to enable fips... OK
    Successfully configured FIPS. Please reboot into the FIPS kernel to enable it.

type on commandline,
    sudo reboot

3. Log back into system after reboot

type on commandline,
    ubuntu-advantage status

expect,
    livepatch: disabled

    esm: disabled (not available)

    fips: enabled

4. verify fips kernel "4.4.0-1002-fips" has been installed

type on commandline,
    uname -a

expect,
    Linux xenialguest 4.4.0-1002-fips #2-Ubuntu SMP Thu Apr 27 19:37:46 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

ZESTY
(Note that FIPS is not supported on zesty.)

1. Collect status before enabling fips

type on commandline,
    ubuntu-advantage status

expect,
    livepatch: disabled (not available)

    esm: disabled (not available)

    fips: disabled (not available)

2. Ensure that fips cannot be enabled on Zesty.
You can use a dummy set of credentials like user:secret as the token:

type on commandline,
    sudo ubuntu-advantage enable-fips user:secret

expect,
    Sorry, but Canonical FIPS 140-2 Modules is not supported on zesty

[REGRESSION POTENTIAL]
The current ubuntu-advantage-tools package in trusty, xenial and zesty is basically a NOOP because the only service it supports is ESM, which is only available for precise.
This update adds two new features to the package: FIPS (xenial only) and Livepatch (trusty and xenial), essentially making the package useful in trusty and xenial. For zesty there is no change, as none of these products are available for non-LTS releases.

In case of broken core functionality or specific broken features, note that there is a manual instructions workaround if needed.

[OTHER INFO]
The way this package was made available in all the ubuntu releases where it is now was via a "pocket copy". That's why it has the exact same version in trusty, xenial and zesty. Currently artful has version 10 (a version 12 just missed the feature freeze), so in order for upgrades between releases to work, we adopted the backports versioning scheme, by appending the ubuntu release code with a tilda ("~") to the version.
Another point is that even though ubuntu-advantage-tools is "just" a shell script, it is unit tested with python3, and these tests (and lint runs) gate merges in the upstream github repository at github.com/CanonicalLtd/ubuntu-advantage-script/. The tests do not necessarily run on each ubuntu release because of the version of python that is available in each. A clean run without any changes can be obtained in xenial and higher. Trusty needs a newer python3 (3.5 at a minimum).

Related branches

Manoj Iyer (manjo) on 2017-09-26
Changed in ubuntu-advantage-tools (Ubuntu):
importance: Undecided → High
Joy Latten (j-latten) on 2017-10-09
description: updated
Joy Latten (j-latten) wrote :

Please note in the debdiff that the ubuntu-advantage script has been renamed to advantage. Links are created for backward compatibility.

Joy Latten (j-latten) wrote :

If build log is required for P8 and s390x, please let me know and I will attach them.

Joy Latten (j-latten) wrote :

Will attach install.log shortly...

Joy Latten (j-latten) wrote :

The attachment "debdiff between v2 (curently in xenial) and v11" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

tags: added: patch
Joy Latten (j-latten) wrote :

Sorry, the attachment is a debdiff. I removed the patch flag.

Joy Latten (j-latten) wrote :

My apologies, still kinda new at this. But yes, the debdiff is a patch. So I put the patch flag back.

Nish Aravamudan (nacc) wrote :

@j-latten: It's unclear to me if this is actually intended for all releases (based upon the nominated tasks by Manoj and Andreas) or just Xenial (based upon the bug description). Can you clarify?

Nish Aravamudan (nacc) wrote :

After chatting on IRC, this was fixed in Artful in LP: #1718291.

Changed in ubuntu-advantage-tools (Ubuntu):
status: New → Fix Released
Joy Latten (j-latten) on 2017-10-12
summary: - [SRU][xenial] include fips enablement into ubuntu-advantage
+ [SRU][xenial] include new version
summary: - [SRU][xenial] include new version
+ [SRU][xenial] include recent version containing fips

After chatting on IRC, realized new version of tool is being worked on for #1721272 (artful). Will wait for this to complete and use this bug to SRU the changes which include enabling fips. Will also redo the data for this SRU.

description: updated
tags: added: sts
Joy Latten (j-latten) wrote :

Hopefully it is ok that I deleted prior attachments so that there is no confusion. This bug will be to add support for v10 (which includes fips support) of ubuntu-advantage-tool to xenial and zesty.

Joy Latten (j-latten) wrote :

Note that binary files (the key rings) are not represented in the debdiffs above.

Joy Latten (j-latten) wrote :

@nacc: I have "re-done" things and have included data for both xenial and zesty.

Joy Latten (j-latten) on 2017-10-17
description: updated
summary: - [SRU][xenial] include recent version containing fips
+ [SRU][xenial] include recent version containing fips and livepatch
description: updated
description: updated
description: updated

I'm updating the SRU template with livepatch bits, since livepatch is also included in this update.

Eric Desrochers (slashd) on 2017-10-18
tags: added: livepatch
description: updated
summary: - [SRU][xenial] include recent version containing fips and livepatch
+ [SRU] include recent version containing fips and livepatch
description: updated
description: updated
description: updated
Changed in ubuntu-advantage-tools (Ubuntu Trusty):
status: New → In Progress
Changed in ubuntu-advantage-tools (Ubuntu Xenial):
status: New → In Progress
Changed in ubuntu-advantage-tools (Ubuntu Zesty):
status: New → In Progress
Changed in ubuntu-advantage-tools (Ubuntu Trusty):
assignee: nobody → Andreas Hasenack (ahasenack)
Changed in ubuntu-advantage-tools (Ubuntu Xenial):
assignee: nobody → Andreas Hasenack (ahasenack)
Changed in ubuntu-advantage-tools (Ubuntu Zesty):
assignee: nobody → Andreas Hasenack (ahasenack)
description: updated
Andreas Hasenack (ahasenack) wrote :

trusty tarball

Andreas Hasenack (ahasenack) wrote :

xenial tarball

Andreas Hasenack (ahasenack) wrote :

zesty tarball

Andreas Hasenack (ahasenack) wrote :

trusty debdiff

Andreas Hasenack (ahasenack) wrote :

xenial debdiff

Andreas Hasenack (ahasenack) wrote :

zesty debdiff

description: updated
description: updated
description: updated
description: updated
description: updated
Eric Desrochers (slashd) on 2017-10-26
tags: added: sts-sponsor-slashd
Eric Desrochers (slashd) on 2017-10-26
description: updated
summary: - [SRU] include recent version containing fips and livepatch
+ [SRU] Microrelease : include recent version containing fips and
+ livepatch
description: updated
Changed in ubuntu-advantage-tools (Ubuntu Trusty):
importance: Undecided → Medium
Changed in ubuntu-advantage-tools (Ubuntu Xenial):
importance: Undecided → Medium
Changed in ubuntu-advantage-tools (Ubuntu Zesty):
importance: Undecided → Medium
Eric Desrochers (slashd) on 2017-10-26
description: updated
summary: - [SRU] Microrelease : include recent version containing fips and
- livepatch
+ [SRU] include recent version containing fips and livepatch
Eric Desrochers (slashd) on 2017-10-26
Changed in ubuntu-advantage-tools (Ubuntu Artful):
status: New → Fix Released
Eric Desrochers (slashd) wrote :

Sponsored for Zesty, Xenial & Trusty in their respective upload queue.
Now waiting for SRU verification team to approve the upload for the packages to enter in the test phase ($RELEASE-proposed)

- Eric

tags: added: sts-sponsor-slashd-done
removed: sts-sponsor-slashd
Łukasz Zemczak (sil2100) wrote :

I had a quick look at the zesty package in the queue. In generally I can understand and accept the idea of pushing a new upstream version to the stable series, considering the current and planned use of the package. One thing that caught my eye though is that build-time tests are disabled in the packaging for all series - why is that?

Andreas Hasenack (ahasenack) wrote :

They are disabled because not all ubuntu releases have the python version we need to run the tests. Note that python is not used at runtime, but it's needed for the tests.

Andreas Hasenack (ahasenack) wrote :

Ok, we managed to change the code a bit to support running tests with python 3.4, which is in trusty. But we did that for master only:
https://github.com/CanonicalLtd/ubuntu-advantage-script/commit/4f6740e1a9b6106eb5567f4be057baca82f23b91

Then a following packaging change to run the tests at package build time:
https://github.com/CanonicalLtd/ubuntu-advantage-script/commit/f3b6bfac5911f248499c79a42a0d18f12ca9065a

Here is our recipe for daily builds with those two incorporated:
https://code.launchpad.net/~ahasenack/+recipe/ubuntu-advantage-script-daily

All binary builds there have a test run incorporated.

This is not contemplated in this SRU, but is a step in the right direction.

The SRU started with backporting what's in artful, and there the tests don't run at package build time. Would such a change be accepted in the SRU'ed packages only? I.e., add tests at package build time for xenial and zesty, while artful (and bionic) don't have them yet?

Or maybe just a manual test run for trusty, xenial and zesty, and attach the logs to this bug? Given that upstream is now running tests at package build time for all of these. In trusty I can run the tests from this package as long as I install python 3.5 or 3.6 on it.

Andreas Hasenack (ahasenack) wrote :

I'm working to release v13 into bionic. That is master as of now, and has tests running during package build.

Andreas Hasenack (ahasenack) wrote :

https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/1721272 has v13 attached to it, which fixes that bug specifically and also runs the tests at package build time.

Eric Desrochers (slashd) on 2017-11-03
Changed in ubuntu-advantage-tools (Ubuntu Artful):
assignee: nobody → Andreas Hasenack (ahasenack)
importance: Undecided → Medium
status: Fix Released → In Progress
description: updated
description: updated
Eric Desrochers (slashd) wrote :

As we speak 'ubuntu-advantage-tools' is stuck in the autopkgtest ... auto-sync and there are transitions still in progress and put the autopkgtest environment under heavy load.

It may take severals day and maybe weeks before it catch-up.

Current status :
ubuntu-advantage-tools (10 to 13)

    Maintainer: Ubuntu Developers
    2 days old
    autopkgtest for ubuntu-advantage-tools/13: amd64: Test in progress, armhf: Test in progress, i386: Test in progress, ppc64el: Pass, s390x: Pass
    Not considered

After a discussion with SRU verification team (sil2100), in this situation we can proceed with the SRU :

--
[07:18:54] <slashd> We are waiting for 3 days for the autopkgtest to complete, but apparently the infra is under a big load of testing and it may take 2 weeks to catch up apparently
[07:19:27] <slashd> What are our options ? Wait until the autopkgtest for bionic finish and goes to -releases ?
[07:19:45] <slashd> or there is something we can do to start the SRU and not having to wait another week or so for bionic to complete
[07:27:50] <sil2100> Hey!
[07:28:33] <sil2100> So the new version is in bionic-proposed right now, right?
[07:28:41] <slashd> yeah
[07:28:45] <sil2100> I'd say that's 'good enough' for this situation, autopkgtests are swarmed right now and will be so for a while

ChristianEhrhardt (paelzer) wrote :

I had reviewed the uploads and only still waiting to appear in bionic, per former comment and review/sru-template/tests being good sponsoring SRUs into T/X/Z/A now.

Hello Joy, or anyone else affected,

Accepted ubuntu-advantage-tools into artful-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/10ubuntu0.17.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-artful to verification-done-artful. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-artful. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in ubuntu-advantage-tools (Ubuntu Artful):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-artful
Łukasz Zemczak (sil2100) wrote :

Hello Joy, or anyone else affected,

Accepted ubuntu-advantage-tools into zesty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/10ubuntu0.17.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-zesty to verification-done-zesty. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-zesty. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in ubuntu-advantage-tools (Ubuntu Zesty):
status: In Progress → Fix Committed
tags: added: verification-needed-zesty
Łukasz Zemczak (sil2100) wrote :

Hello Joy, or anyone else affected,

Accepted ubuntu-advantage-tools into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/10ubuntu0.16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in ubuntu-advantage-tools (Ubuntu Xenial):
status: In Progress → Fix Committed
tags: added: verification-needed-xenial
Changed in ubuntu-advantage-tools (Ubuntu Trusty):
status: In Progress → Fix Committed
tags: added: verification-needed-trusty
Łukasz Zemczak (sil2100) wrote :

Hello Joy, or anyone else affected,

Accepted ubuntu-advantage-tools into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/10ubuntu0.14.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-trusty to verification-done-trusty. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-trusty. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Andreas Hasenack (ahasenack) wrote :

Zesty verification:
  Version table:
 *** 10ubuntu0.17.04.1 500
        500 http://br.archive.ubuntu.com/ubuntu zesty-proposed/main amd64 Packages

status shows everything unavailable as expected:
ubuntu@04-57:~$ ubuntu-advantage status
livepatch: disabled (not available)

esm: disabled (not available)

fips: disabled (not available)

And they cannot be enabled:ubuntu@04-57:~$ sudo ubuntu-advantage enable-fips foo:bar
Sorry, but Canonical FIPS 140-2 Modules is not supported on zesty
ubuntu@04-57:~$ sudo ubuntu-advantage enable-livepatch xxx
Sorry, but Canonical Livepatch is not supported on zesty

Verification successful for zesty.

tags: added: verification-done-zesty
removed: verification-needed-zesty
Andreas Hasenack (ahasenack) wrote :

Artful verification:
  Version table:
 *** 10ubuntu0.17.10.1 500
        500 http://br.archive.ubuntu.com/ubuntu artful-proposed/main amd64 Packages

status shows everything unavailable as expected:
andreas@nsnx:~$ ubuntu-advantage status
livepatch: disabled (not available)

esm: disabled (not available)

fips: disabled (not available)

And they cannot be enabled:
andreas@nsnx:~$ sudo ubuntu-advantage enable-fips foo:bar
Sorry, but Canonical FIPS 140-2 Modules is not supported on artful
andreas@nsnx:~$ sudo ubuntu-advantage enable-livepatch xxx
Sorry, but Canonical Livepatch is not supported on artful
andreas@nsnx:~$

Verification successful for artful.

tags: added: verification-done-artful
removed: verification-needed-artful
Andreas Hasenack (ahasenack) wrote :

There is no trusty build of ubuntu-advantage-tools in trusty-proposed. Looks like it failed to build:
https://launchpadlibrarian.net/344718911/buildlog_ubuntu-trusty-i386.ubuntu-advantage-tools_10ubuntu0.14.04.1_BUILDING.txt.gz

The following packages have unmet dependencies:
 sbuild-build-depends-ubuntu-advantage-tools-dummy : Depends: flake8 but it is not installable or
                                                              python3-flake8 but it is not installable
E: Unable to correct problems, you have held broken packages.

Trusty has no flake8, but python3-flake8 is there. But in universe. Is that the problem? Then how did the other packages build, since flake8 is also in universe, in xenial, zesty and artful?

Colin Watson (cjwatson) wrote :

Policy changed in xenial to allow source packages in main to build-depend on universe, but that change was not retroactive.

Andreas Hasenack (ahasenack) wrote :

Xenial verification:

  Version table:
 *** 10ubuntu0.16.04.1 500
        500 http://br.archive.ubuntu.com/ubuntu xenial-proposed/main amd64 Packages

status shows that both fips and livepatch are available:

ubuntu@10-e2:~$ ubuntu-advantage status
livepatch: disabled

esm: disabled (not available)

fips: disabled

a) enabling livepatch
ubuntu@10-e2:~$ sudo ubuntu-advantage enable-livepatch <redacted>
Installing the canonical-livepatch snap.
This may take a few minutes depending on your bandwidth.
canonical-livepatch 7.24 from 'canonical' installed
Enabling Livepatch with the given token, stand by...
Successfully enabled device. Using machine-token: <redacted>
Use "canonical-livepatch status" to verify current patch status.

status now includes livepatch information:
ubuntu@10-e2:~$ ubuntu-advantage status
livepatch: enabled
  client-version: "7.23"
  architecture: x86_64
  cpu-model: Intel Core Processor (Skylake)
  last-check: 2017-11-07T13:50:09.110003132Z
  boot-time: 2017-11-07T13:44:56Z
  uptime: 5m51s
  status:
  - kernel: 4.4.0-98.121-generic
    running: true
    livepatch:
      checkState: checked
      patchState: nothing-to-apply
      version: ""
      fixes: ""

esm: disabled (not available)

fips: disabled

b) FIPSubuntu@10-e2:~$ sudo ubuntu-advantage enable-fips <redacted>
Running apt-get update... OK
Ubuntu FIPS PPA repository enabled.
Installing FIPS packages (this may take a while)... OK
Configuring FIPS...
Updating grub to enable fips... OK
Successfully configured FIPS. PLEASE REBOOT to complete FIPS enablement.

(reboot)

status shows fips enabled:
ubuntu@10-e2:~$ ubuntu-advantage status
livepatch: disabled

esm: disabled (not available)

fips: enabled

And uname confirms the fips kernel:
ubuntu@10-e2:~$ uname -r
4.4.0-1002-fips

Xenial verification on x86_64 successful.

Andreas Hasenack (ahasenack) wrote :

xenial fips verification on s390:

ubuntu@xenial-andreas:~$ sudo ubuntu-advantage enable-fips <redacted>
Running apt-get update... OK
Ubuntu FIPS PPA repository enabled.
Installing FIPS packages (this may take a while)... OK
Configuring FIPS...
Updating zipl to enable fips... OK
Successfully configured FIPS. PLEASE REBOOT to complete FIPS enablement.

We can see the extra "Updating zipl to enable fips" line.

And after issuing the reboot we are running a fips kernel on s390:
ubuntu@xenial-andreas:~$ ubuntu-advantage status
livepatch: disabled

esm: disabled (not available)

fips: enabled
ubuntu@xenial-andreas:~$ uname -a
Linux xenial-andreas 4.4.0-1002-fips #2-Ubuntu SMP Thu Apr 27 19:35:14 UTC 2017 s390x s390x s390x GNU/Linux

Łukasz Zemczak (sil2100) wrote :

Hello Joy, or anyone else affected,

Accepted ubuntu-advantage-tools into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/10ubuntu0.14.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-trusty to verification-done-trusty. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-trusty. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Eric Desrochers (slashd) wrote :

Based on the above discussion about Trusty package

A new version of "ubuntu-advantage-tools [10ubuntu0.14.04.2]" has been uploaded for Trusty :

* Skipping tests during package builds.
    - d/rules: Disabling the tests.
    - d/control: Removing tests dependencies.

- Eric

tags: added: verification-done-xenial
removed: verification-needed-xenial
Chris Newcomer (chris-8k) wrote :

Xenial Verification:

root@test3:/home/ubuntu# dpkg -l ubuntu-advantage-tools
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-===================-==============-==============-===========================================
ii ubuntu-advantage-to 10ubuntu0.16.0 all management tools for Ubuntu Advantage

root@test3:/home/ubuntu# ubuntu-advantage enable-livepatch <redacted>
Installing the canonical-livepatch snap.
This may take a few minutes depending on your bandwidth.
2017-11-07T16:35:23Z INFO Waiting for restart...
canonical-livepatch 7.24 from 'canonical' installed
Enabling Livepatch with the given token, stand by...
Successfully enabled device. Using machine-token: <redacted>
Use "canonical-livepatch status" to verify current patch status.

root@test3:/home/ubuntu# ubuntu-advantage enable-fips chris-8k:<redacted>
Running apt-get update... OK
Ubuntu FIPS PPA repository enabled.
Installing FIPS packages (this may take a while)... OK
Configuring FIPS...
Updating grub to enable fips... OK
Successfully configured FIPS. PLEASE REBOOT to complete FIPS enablement.

ubuntu@test3:~$ uname -r
4.4.0-1002-fips

ubuntu@test3:~$ ubuntu-advantage status
livepatch: enabled
  client-version: "7.23"
  architecture: x86_64
  cpu-model: Intel Core Processor (Haswell, no TSX)
  last-check: 2017-11-07T16:51:03.482519271Z
  boot-time: 2017-11-07T16:45:05Z
  uptime: 6m36s
  status:
  - kernel: 4.4.0-1002.2-fips
    running: true
    livepatch:
      checkState: checked
      patchState: nothing-to-apply
      version: ""
      fixes: ""

esm: disabled (not available)

fips: enabled

Chris Newcomer (chris-8k) wrote :

Artful verification:

root@test1:~# dpkg -l ubuntu-advantage-tools
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-=============================-===================-===================-================================================================
ii ubuntu-advantage-tools 10ubuntu0.17.10.1 all management tools for Ubuntu Advantage

root@test1:~# ubuntu-advantage enable-livepatch <redacted>
Sorry, but Canonical Livepatch is not supported on artful

root@test1:~# ubuntu-advantage enable-fips chris-8k:<redacted>
Sorry, but Canonical FIPS 140-2 Modules is not supported on artful

root@test1:~# ubuntu-advantage status
livepatch: disabled (not available)

esm: disabled (not available)

fips: disabled (not available)

Chris Newcomer (chris-8k) wrote :

Zesty verification:

root@test2:~# dpkg -l ubuntu-advantage-tools
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-================================-=====================-=====================-=====================================================================
ii ubuntu-advantage-tools 10ubuntu0.17.04.1 all management tools for Ubuntu Advantage

root@test2:~# ubuntu-advantage enable-livepatch <redacted>
Sorry, but Canonical Livepatch is not supported on zesty

root@test2:~# ubuntu-advantage enable-fips chris-8k:<redacted>
Sorry, but Canonical FIPS 140-2 Modules is not supported on zesty

root@test2:~# ubuntu-advantage status
livepatch: disabled (not available)

esm: disabled (not available)

fips: disabled (not available)

Andreas Hasenack (ahasenack) wrote :

Trusty verification
 *** 10ubuntu0.14.04.2 0
        500 http://archive.ubuntu.com/ubuntu/ trusty-proposed/main amd64 Packages

status correctly shows just livepatch available:

ubuntu@04-57:~$ ubuntu-advantage status
livepatch: disabled

esm: disabled (not available)

fips: disabled (not available)

fips can't be enabled, which is correct:
ubuntu@04-57:~$ sudo ubuntu-advantage enable-fips foo:bar
Sorry, but Canonical FIPS 140-2 Modules is not supported on trusty

Enabling livepatch:
ubuntu@04-57:~$ sudo ubuntu-advantage enable-livepatch <redacted>
Installing missing dependency snapd... OK
Installing the canonical-livepatch snap.
This may take a few minutes depending on your bandwidth.
canonical-livepatch 7.24 from 'canonical' installed

Your currently running kernel (3.13.0-135-generic) is too old to
support snaps. Version 4.4.0 or higher is needed.

Please reboot your system into a supported kernel version
and run the following command one more time to complete the
installation:

sudo ubuntu-advantage enable-livepatch <redacted>

The snap is installed, but you indeed need to reboot into the newer kernel that ubuntu-advantage-tools installed for you.

(reboot)

ubuntu@04-57:~$ uname -a
Linux 04-57 4.4.0-100-generic #123~14.04.1-Ubuntu SMP Fri Nov 3 09:36:06 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
ubuntu@04-57:~$ sudo ubuntu-advantage enable-livepatch <redacted>
Enabling Livepatch with the given token, stand by...
Successfully enabled device. Using machine-token: <redacted>
Use "canonical-livepatch status" to verify current patch status.

status now shows livepatch information:
ubuntu@04-57:~$ ubuntu-advantage status
livepatch: enabled
  client-version: "7.23"
  architecture: x86_64
  cpu-model: Intel Core Processor (Skylake)
  last-check: 2017-11-07T18:19:10.452071038Z
  boot-time: 2017-11-07T18:18:05Z
  uptime: 1m25s
  status:
  - kernel: 4.4.0-100.123~14.04.1-generic
    running: true
    livepatch:
      checkState: checked
      patchState: nothing-to-apply
      version: ""
      fixes: ""

esm: disabled (not available)

fips: disabled (not available)
ubuntu@04-57:~$

trusty verification successful.

tags: added: verification-done-trusty
removed: verification-needed-trusty
Chris Newcomer (chris-8k) wrote :

Trusty:

NOTE: This is a pass for the ubuntu-advantage-tools script. The duplicate machine-id issue I had was traced back to the canonical-livepatch snap.

root@test4:~# dpkg -l ubuntu-advantage-tools
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-=================================-=====================-=====================-=======================================================================
ii ubuntu-advantage-tools 10ubuntu0.14.04.2 all management tools for Ubuntu Advantage

root@test4:~# ubuntu-advantage enable-livepatch <redacted>
Installing missing dependency snapd... OK
Installing the canonical-livepatch snap.
This may take a few minutes depending on your bandwidth.
canonical-livepatch 7.24 from 'canonical' installed

Your currently running kernel (3.13.0-135-generic) is too old to
support snaps. Version 4.4.0 or higher is needed.

Please reboot your system into a supported kernel version
and run the following command one more time to complete the
installation:

sudo ubuntu-advantage enable-livepatch <redacted>

root@test4:~# ubuntu-advantage enable-fips chris-8k:<redacted>
Sorry, but Canonical FIPS 140-2 Modules is not supported on trusty

root@test4:~# ubuntu-advantage enable-livepatch <redacted>
Enabling Livepatch with the given token, stand by...
2017/11/07 19:16:15 Error executing enable?auth-token=<redacted>
This machine ID is already enabled with a different key or is non-unique. Either "sudo canonical-livepatch disable" on the other machine, or regenerate a unique /etc/machine-id on this machine with "sudo rm /etc/machine-id /var/lib/dbus/machine-id && sudo systemd-machine-id-setup" : {"error": "Conflicting machine-id"}

root@test4:~# ubuntu-advantage status
livepatch: disabled

esm: disabled (not available)

fips: disabled (not available)

root@test4:~# sudo rm /etc/machine-id /var/lib/dbus/machine-id && sudo systemd-machine-id-setup
Initializing machine ID from KVM UUID.

root@test4:~# ubuntu-advantage enable-livepatch <redacted>
Enabling Livepatch with the given token, stand by...
Successfully enabled device. Using machine-token: <redacted>
Use "canonical-livepatch status" to verify current patch status.

root@test4:~# ubuntu-advantage status
livepatch: enabled
  client-version: "7.23"
  architecture: x86_64
  cpu-model: Intel Core Processor (Haswell, no TSX)
  last-check: 2017-11-07T19:17:36.506320725Z
  boot-time: 2017-11-07T19:15:15Z
  uptime: 2m58s
  status:
  - kernel: 4.4.0-100.123~14.04.1-generic
    running: true
    livepatch:
      checkState: checked
      patchState: nothing-to-apply
      version: ""
      fixes: ""

esm: disabled (not available)

fips: disabled (not available)

Łukasz Zemczak (sil2100) wrote :

As per discussion, I approve of an earlier release of this update to -updates. The testing done is sufficient. Let me take care of this. Please inform me instantly if there's any regression noticed after the release.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ubuntu-advantage-tools - 10ubuntu0.17.10.1

---------------
ubuntu-advantage-tools (10ubuntu0.17.10.1) artful; urgency=medium

  * Backports from upstream version 13 (LP: #1719671):
    - support older python3 versions in the test suite
    - d/control, d/rules: run tests at package build time
    - default FIPS tests to the x86_64 architecture
    - add FIPS test for unsupported architecture

 -- Andreas Hasenack <email address hidden> Sun, 05 Nov 2017 18:45:21 -0200

Changed in ubuntu-advantage-tools (Ubuntu Artful):
status: Fix Committed → Fix Released

The verification of the Stable Release Update for ubuntu-advantage-tools has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ubuntu-advantage-tools - 10ubuntu0.17.04.1

---------------
ubuntu-advantage-tools (10ubuntu0.17.04.1) zesty; urgency=medium

  * Backport version 10 to zesty.
  * Backports from upstream version 13 (LP: #1719671):
    - support older python3 versions in the test suite
    - d/control, d/rules: run tests at package build time
    - default FIPS tests to the x86_64 architecture
    - add FIPS test for unsupported architecture

 -- Andreas Hasenack <email address hidden> Sun, 05 Nov 2017 18:41:46 -0200

Changed in ubuntu-advantage-tools (Ubuntu Zesty):
status: Fix Committed → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ubuntu-advantage-tools - 10ubuntu0.16.04.1

---------------
ubuntu-advantage-tools (10ubuntu0.16.04.1) xenial; urgency=medium

  * Backport version 10 to xenial.
  * Backports from upstream version 13 (LP: #1719671):
    - support older python3 versions in the test suite
    - d/control, d/rules: run tests at package build time
    - default FIPS tests to the x86_64 architecture
    - add FIPS test for unsupported architecture

 -- Andreas Hasenack <email address hidden> Sun, 05 Nov 2017 18:37:47 -0200

Changed in ubuntu-advantage-tools (Ubuntu Xenial):
status: Fix Committed → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ubuntu-advantage-tools - 10ubuntu0.14.04.2

---------------
ubuntu-advantage-tools (10ubuntu0.14.04.2) trusty; urgency=medium

  * Skipping tests during package builds.
    - d/rules: Disabling the tests.
    - d/control: Removing tests dependencies.

ubuntu-advantage-tools (10ubuntu0.14.04.1) trusty; urgency=medium

  * Backport version 10 to trusty.
  * Backports from upstream version 13 (LP: #1719671):
    - support older python3 versions in the test suite
    - d/control, d/rules: run tests at package build time
    - default FIPS tests to the x86_64 architecture
    - add FIPS test for unsupported architecture

 -- Eric Desrochers <email address hidden> Tue, 07 Nov 2017 10:07:49 -0500

Changed in ubuntu-advantage-tools (Ubuntu Trusty):
status: Fix Committed → Fix Released
Alex Moldovan (alexmoldovan) wrote :

TEST RESULTS for Trusty, Xenial, Zesty and Artful:

===== 14.04.5 =====

ubuntu@ua-trusty:~$ ubuntu-advantage status
livepatch: disabled

esm: disabled (not available)

fips: disabled (not available)

$ sudo ubuntu-advantage enable-fips alexmoldovan:<REDACTED>
Sorry, but Canonical FIPS 140-2 Modules is not supported on trusty

===== 16.04.3 =====

$ ubuntu-advantage status
livepatch: disabled
esm: disabled (not available)
fips: disabled

$ sudo ubuntu-advantage enable-livepatch <REDACTED>
Installing the canonical-livepatch snap.
This may take a few minutes depending on your bandwidth.
2017-11-07T22:46:53Z INFO Waiting for restart...
canonical-livepatch 7.24 from 'canonical' installed
Enabling Livepatch with the given token, stand by...
Successfully enabled device. Using machine-token: <REDACTED>
Use "canonical-livepatch status" to verify current patch status.

$ ubuntu-advantage status
livepatch: enabled
  client-version: "7.23"
  architecture: x86_64
  cpu-model: Intel(R) Core(TM)2 Duo CPU T7700 @ 2.40GHz
  last-check: 2017-11-07T22:46:59.875848798Z
  boot-time: 2017-11-07T22:13:25Z
  uptime: 34m41s
  status:
  - kernel: 4.4.0-100.123-generic
    running: true
    livepatch:
      checkState: checked
      patchState: nothing-to-apply
      version: ""
      fixes: ""

esm: disabled (not available)
fips: disabled

$ sudo ubuntu-advantage enable-fips alexmoldovan:<REDACTED>
Running apt-get update... OK
Ubuntu FIPS PPA repository enabled.
Installing FIPS packages (this may take a while)... OK
Configuring FIPS...
Updating grub to enable fips... OK
Successfully configured FIPS. PLEASE REBOOT to complete FIPS enablement.

$ ubuntu-advantage status
livepatch: enabled
  client-version: "7.23"
  architecture: x86_64
  cpu-model: Intel Core Processor (Haswell, no TSX)
  last-check: 2017-11-08T10:44:39.356-05:00
  boot-time: 2017-11-08T10:44:32-05:00
  uptime: 1m39s
  status:
  - kernel: 4.4.0-1002.2-fips
    running: true
    livepatch:
      checkState: checked
      patchState: nothing-to-apply
      version: ""
      fixes: ""

esm: disabled (not available)
fips: enabled

$ uname -a
Linux ubuntu1604 4.4.0-1002-fips #2-Ubuntu SMP Thu Apr 27 19:37:46 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

===== 17.04 =====

$ ubuntu-advantage status
livepatch: disabled (not available)

esm: disabled (not available)

fips: disabled (not available)

$ sudo ubuntu-advantage enable-livepatch foobar
Sorry, but Canonical Livepatch is not supported on zesty

===== 17.10 =====

$ ubuntu-advantage status
livepatch: disabled (not available)

esm: disabled (not available)

fips: disabled (not available)

$ sudo ubuntu-advantage enable-livepatch foobar
Sorry, but Canonical Livepatch is not supported on artful

$ sudo ubuntu-advantage enable-fips alexmoldovan:<REDACTED>
Sorry, but Canonical FIPS 140-2 Modules is not supported on artful

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers