[SRU] Backport wsl-pro-service to Jammy and Focal

[Carlos Nihelton]

As part of our offerings to bring Ubuntu Pro to wider audiences we need to backport this service to Ubuntu 22.04 LTS, so users can benefit of the upcoming GA of Ubuntu Pro for WSL, as Windows system that allows more easily secure and manage WSL instances, by automatically pro-attaching Ubuntu on WSL instances and even register with and manage them via Lansdcape.

wsl-pro-service is our bridge to the Windows application that performs key post-provisioning actions on an instance, such as updating a Pro token and Landscape configuration data if that changes on the Windows side.

As this service is only applicable for Ubuntu on WSL, its systemd unit is contained to not even start
if the condition `ConditionVirtualization=wsl` is unmet. systemd confinement options were validated to work on Jammy as of wsl-pro-service version 0.1.18 (the one being proposed via this SRU).

[Impact]

* wsl-pro-service is a new package for Jammy and Focal
* It depends on golang-1.23-go at build time, which is available on jammy-updates.
* A certain level of downgrades was necessary for focal, that requires golang-1.22-go.
* Ubuntu Pro for WSL relies on this service being seeded on the Ubuntu instances.
* That system is not yet generally available, but planned for later this year.
* At minimum Jammy and Noble must be supported, but Focal is planned.
* Beta customers were already provided with custom images of 22.04 and 24.04 from the get-go.
* As a new daemon, more often inert if the Windows side is not present, this should not affect users experience.
* Boot time measurements reveals negligible impact.
* The systemd unit is carefully and purposefully confined to allow only minimum requirements of our application while remaining compatible with systemd v245 (thus, compatible with Jammy and Focal).

[ Test plan ]

== 1. Less loging:

* Make sure the Ubuntu Pro for WSL Windows agent is not running:
  - On Windows run `taskkill /f /im ubuntu-pro-agent.exe`
  - Depending on the OS settings elevated permissions might be required.
* Install wsl-pro-service version 0.1.18 on Ubuntu 22.04 on WSL.
* Follow it's journal with `journalctl -f -u wsl-pro.service`
* Notice that it starts logging connection attempts too often, backing off exponentially up to 1min interval.
  Approximately 10 minutes after attempting to connect without success, it silents.
* systemd should take approximately 20 min to attempt to restart the unit.

== 2. Pro attachment works under systemd restrictions and without livepatch being installed.

(Most of this test case would be testing ubuntu-pro-client v35 indeed, but we must verify that our integration
is not harmed with the changes in wsl-pro-service systemd confinement)

* Create a fresh instance of Ubuntu on WSL:
  - On Windows run `wsl.exe --install -d Ubuntu-22.04`
* Install ubuntu-pro-agent v35 (currently available via the `-proposed` repository)
* Make sure livepatch is not installed: `sudo snap remove canonical-livepatch`
* Make sure the Ubuntu on WSL instance is not pro attached: `pro status` (`pro detach` if needed).
* Install wsl-pro-service version 0.1.18 on Ubuntu on WSL (Noble, Oracular and Plucky should behave exactly
the same)
* Install Ubuntu Pro for WSL (download the latest production build from https://github.com/canonical/ubuntu-pro-for-wsl/actions/runs/14386282882/artifacts/2921576467)
* Follow this guide to attach your Pro token: https://documentation.ubuntu.com/wsl/en/stable/tutorials/getting-started-with-up4w/#set-up-ubuntu-pro-for-wsl
* Follow it's journal with `journalctl -f -u wsl-pro.service`:
  - If pro-attaching fails because of systemd restrictions we should see some "permission denied" or "bad system
  call" errors in the journal.
  - If the livepatch fix was not correct, we should see mentions to `canonical-livepatch` in the journal.
  - Both conditions should be considered a failure. Otherwise, proceed.
* Confirm pro attachment `pro status` inside the Ubuntu instance.
* Finally assert that canonical-livepatch remains not installed on this machine.

== 3. wsl-pro-service outside of WSL

(Ensures the unit does nothing outside of WSL)

* Install wsl-pro-service on an instance of Ubuntu 22.04 on any platform other than WSL (Desktop,
Server bare-metal or VM, OCI containers).
* Verify that the unit is disabled due unmet condition: `systemctl status wsl-pro.service`

== 4. Boot time

(Ensures the unit does not significantly impact the boot time duration)
* Install wsl-pro-service on an Ubuntu 22.04 instance on WSL.
* Modify the default user's .bashrc to just exit (by appending `exit` as the last line of that script)
* On Windows PowerShell run `wsl --terminate Ubuntu-22.04; Measure-Command {wsl -d Ubuntu-22.04}` a few times and take notes of the duration that command takes to finish
* Start the WSL instance as root `wsl -d Ubuntu-22.04 -u root`
* Remove wsl-pro-service
* Repeat the measurement step
* Compare the results.

Spot differences are expected, because of the many layers involved, but there should not be more than 2% difference in **median** between boot times with and without that service enabled, per recent measurements taken by our team.

[ Where problems could occur ]

The few beta customers we have might have noticed that up until now, wsl-pro-service remains running all the time the unit is alive, thus anytime a user installs the
Ubuntu Pro for WSL application on Windows they could expect the communication with the Windows agents to start
briefly. That's also the case for the custom 22.04 images they've been playing with, which come with wsl-pro-service 0.1.5.

With the behaviour changes in v0.1.18, that won't be the case always, as the service could just had quit seconds before
and systemd will take about 20min to restart it. Users can always `sudo systemctl restart wsl-pro.service`.

Since the entire system is not yet generally available the number of users affected by this behaviour change
is very minimal, comprising of a handful of beta testers and internal collaborators (such as the
Landscape team).

[ Other Info ]

I intentionally skipped testing the changes related to Landscape because it's too complex to set up a server
just for this purpose.

[Carlos Nihelton (cnihelton)]

Proof of build can be seen in this PPA: https://launchpad.net/~cnihelton/+archive/ubuntu/pplayground/+packages?field.name_filter=&field.status_filter=published&field.series_filter=jammy

The version numbers are slightly changed because I wanted to make sure the archive will contain a higher version number in the end. Contents are essentially the same.

[Julian Andres Klode (juliank)]

To introduce version 0.1.18 of wsl-pro-service to jammy, first all later releases need updating to 0.1.18.

Alternatively, jammy may receive 0.1.4 as that's the version of noble.

[Vladimir Petko (vpa1977)]

Hi,

I have unsubscribed Sponsors. Please resubscribe once the comment above[1] is addressed.

Best regards,
 Vladimir.

[1] https://bugs.launchpad.net/ubuntu/+source/wsl-pro-service/+bug/2107145/comments/10

[Carlos Nihelton (cnihelton)]

> To introduce version 0.1.18 of wsl-pro-service to jammy, first all later releases need updating to 0.1.18.

wsl-pro-service 0.1.18 is in noble-proposed with verification-done. I think we now can resume this one.

[Carlos Nihelton (cnihelton)]

When resuming this, let's ignore the debdiffs and use the merge proposals linked to this bug instead. It's incredibly easier to review and reason about them IMO.

[Simon Chopin (schopin)]

What's the actual status here? ubuntu-sponsors has been resubscribe but the MPs are still marked as WIP.

[Carlos Nihelton (cnihelton)]

It's ready for review now. I kept it on hold while SRU'ing the same version for Noble was still ongoing. That SRU now is clear and close to complete aging, so my understanding is that's safe to resume this one.

[Didier Roche-Tolomelli (didrocks)]

I package is a NEW package in both Jammy and Focal. It looks fine to me as it mirrors the package that was already in more recent archives. The diff contains:
- changes due to different version of Go in Jammy and Focal. This affect vendoring of dependencies too.
- difference in debhelper compat due to older versions in Jammy and Focal.

However, afaik, there is no way for AA to move this from the "NEW" queue to the "unapproved" queue, as accepting the package moved them directly to the approved one and then built in the proposed pocket. Historically, it has been the SRU team doing taht action directly as part of their unapproved check.

So, +1 from me from the AA perspective.

[Nick Rosbrook (enr0n)]

Hello Carlos, or anyone else affected,

Accepted wsl-pro-service into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/wsl-pro-service/0.1.18~22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Nick Rosbrook (enr0n)]

Hello Carlos, or anyone else affected,

Accepted wsl-pro-service into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/wsl-pro-service/0.1.18~20.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Carlos Nihelton (cnihelton)]

The previous versions in the '-proposed' pocket had FTBFS issues in specific architectures. The newer uploads in the 'Unapproved' queues prevent that condition, thus it'd be better to accept them into '-proposed' instead.

[Julian Andres Klode (juliank)]

Hello Carlos, or anyone else affected,

Accepted wsl-pro-service into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/wsl-pro-service/0.1.18~22.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Julian Andres Klode (juliank)]

Hello Carlos, or anyone else affected,

Accepted wsl-pro-service into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/wsl-pro-service/0.1.18~20.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Carlos Nihelton (cnihelton)]

All tests happened in a Windows 11 VM with the following versions:

WSL: 2.6.1.0
Kernel: 6.6.87.2-1
WSLg: 1.0.66
MSRDC: 1.2.6353
Direct3D: 1.611.1-81528511
DXCore: 10.0.26100.1-240331-1435.ge-release
Windows: 10.0.26220.7271

----------------------------------------------------------------------------------------------------------
= JAMMY "22.04.5 LTS (Jammy Jellyfish)" Instance setup from the application available in MS Store.

Tested package version 0.1.18~22.04.2 from jammy-proposed/universe.

== 1. Less loging:

First line of comm failed: dez 03 14:58:06
Log line disabling the unit: dez 03 15:09:32 DESKTOP-551PQ9O systemd[1]: wsl-pro.service: Deactivated successfully.
Restarted at: dez 03 15:30:02 DESKTOP-551PQ9O systemd[1]: wsl-pro.service: Scheduled restart job, restart counter is at 1.

Overall result: Success. Unit was deactivated after 12 min. systemd reactivated it after about 20 min.

== 2. Pro attachment works under systemd restrictions and without livepatch being installed.

Instance originally had ubuntu-pro-client version 34~22.04, upgradable to 37.1ubuntu0~22.04 from jammy-updates.
Tests were carried after apt upgrade

Pro attachment just works and no canonical-livepatch was installed.

== 3. wsl-pro-service outside of WSL

Tested on a LXD container set from ubuntu-daily:jammy. LXD version 5.21.4 LTS.

> Dec 03 18:22:37 jammy-test systemd[1]: Condition check resulted in Bridge to Ubuntu Pro agent on Windows being skipped.

Overall result: unit successfully skipped outside of WSL.

== 4. Boot time (ms)

With 3299,4384 1856,6961 1712,4675 2849,6344 1736,0262 2867,8596 1806,6165
Without 2950,1094 1745,8530 1968,2877 1985,1943 1955,7354 1696,5452 4722,9145

Boot times fluctuate considerably with and without wsl-pro-service, thus no meaningful correlation can be established.
Overral result: success. No boot time pessimisation.

[Carlos Nihelton (cnihelton)]

All tests happened in a Windows 11 VM with the following versions:

WSL: 2.6.1.0
Kernel: 6.6.87.2-1
WSLg: 1.0.66
MSRDC: 1.2.6353
Direct3D: 1.611.1-81528511
DXCore: 10.0.26100.1-240331-1435.ge-release
Windows: 10.0.26220.7271

-----------------------------------------------------------------------------------------------------------
= FOCAL "20.04.5 LTS (Focal Fossa)" Instance setup from the application available in MS Store.

Tested package version 0.1.18~20.04.2 from focal-proposed/universe.

== 1. Less loging:

First line of comm failed: Dec 03 18:28:56
Log line disabling the unit: Dec 03 18:40:00 DESKTOP-551PQ9O systemd[1]: wsl-pro.service: Succeeded.
Restarted at: Dec 03 19:00:00 DESKTOP-551PQ9O systemd[1]: wsl-pro.service: Scheduled restart job, restart counter is at 1.

Overall result: Success. Unit was deactivated after 12 min. systemd reactivated it after 20 min.

== 2. Pro attachment works under systemd restrictions and without livepatch being installed.

Instance originally had ubuntu-advantage-tools version 27.14.4~20.04, upgradable to 37.1ubuntu0~20.04.
Tests were carried after apt upgrade

Pro attachment just works and no canonical-livepatch was installed.

== 3. wsl-pro-service outside of WSL

Tested on a LXD container set from ubuntu-daily:focal. LXD version 5.21.4 LTS.

> Dec 03 18:31:55 focal-test systemd[1]: Condition check resulted in Bridge to Ubuntu Pro agent on Windows being skipped.

Overall result: unit successfully skipped outside of WSL.

== 4. Boot time (ms)

With 4314,0509 1184,6262 1168,2596 1190,5518 1163,7839 1212,8859 1184,7327 1202,5132
Without 4375,8937 2409,5126 1199,7617 1199,0256 2439,5735 1223,8959 1212,6095 2150,3030

Boot times fluctuate considerably with and without wsl-pro-service, thus no meaningful correlation can be established.
Overral result: success. No boot time pessimisation.

[Carlos Nihelton (cnihelton)]

Since there is no scope for regression nor users installing this at this moment, I'd like to propose skip aging this SRU and move the package into '-updates' as early as possible.

[Andreas Hasenack (ahasenack)]

I agree there is no benefit for extra aging:
- it's a new package: opt-in
- even if new WSL images are produced for jammy and focal right after this SRU is released (early), they will still not contain wsl-pro-service, because seed/ubuntu-meta changes are needed. So no extra risk there until that happens.
- work on the seeds/ubuntu-meta is blocked until this SRU is released.

[Launchpad Janitor (janitor)]

This bug was fixed in the package wsl-pro-service - 0.1.18~22.04.2

---------------
wsl-pro-service (0.1.18~22.04.2) jammy; urgency=medium

  * Restricts supported architecture set (LP: #2132357)
    - matching what WSL supports (just AMD64 and ARM64)
    - preventing FTBFS on armhf.

wsl-pro-service (0.1.18~22.04.1) jammy; urgency=medium

  * Release wsl-pro-service 0.1.18 to jammy (LP: #2107145).

 -- Carlos Nihelton <email address hidden> Tue, 25 Nov 2025 11:23:30 -0300

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for wsl-pro-service has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package wsl-pro-service - 0.1.18~20.04.2

---------------
wsl-pro-service (0.1.18~20.04.2) focal; urgency=medium

  * Restricts supported architecture set (LP: #2132357)
    - matching what WSL supports (just AMD64 and ARM64)
    - preventing FTBFS on riscv64.

wsl-pro-service (0.1.18~20.04.1) focal; urgency=medium

  * Backport version 0.1.18 to focal (LP: #2107145):
    - with debhelper-compat=12 and Go 1.22, as required by focal
    - explicitly passing --buildsystem=golang otherwise the build target
      doesn't run properly.
    - downgrading dependencies to be able to compile with Go 1.22, which
      causes substantial difference in the vendor tree
    - debian/tests/test changed to adjust the PATH env var according to the
      version of Go listed in debian/control Build-Depends.
    - that requires the addition of dctrl-tools to Build-Depends.

 -- Carlos Nihelton <email address hidden> Mon, 24 Nov 2025 17:20:06 -0300