A new release of the Ubuntu Cloud Images for stable Ubuntu release 22.04 (Jammy Jellyfish) is available at [1]. These new images superseded the existing images [2]. Images are available for download or immediate use on EC2 via publish AMI ids. Users who wish to update their existing installations can do so with:
   'sudo apt-get update && sudo apt-get dist-upgrade && sudo reboot'.

The following packages have been updated. Please see the full changelogs
for a complete listing of changes:
 * base-files: 12ubuntu4.2 => 12ubuntu4.3 
 * curl: 7.81.0-1ubuntu1.7 => 7.81.0-1ubuntu1.8 
 * cyrus-sasl2: 2.1.27+dfsg2-3ubuntu1.1 => 2.1.27+dfsg2-3ubuntu1.2 
 * fwupd-signed: 1.44+1.2-3 => 1.51~22.04.1+1.2-3ubuntu0.2 
 * git: 1:2.34.1-1ubuntu1.6 => 1:2.34.1-1ubuntu1.8 
 * gnutls28: 3.7.3-4ubuntu1.1 => 3.7.3-4ubuntu1.2 
 * grub2-signed: 1.187.2+2.06-2ubuntu14 => 1.187.3~22.04.1+2.06-2ubuntu14.1 
 * grub2-unsigned: 2.06-2ubuntu14 => 2.06-2ubuntu14.1 
 * isc-dhcp: 4.4.1-2.3ubuntu2.3 => 4.4.1-2.3ubuntu2.4 
 * libmbim: 1.26.2-1build1 => 1.28.0-1~ubuntu20.04.1 
 * libqmi: 1.30.4-1 => 1.32.0-1ubuntu0.22.04.1 
 * linux-meta: 5.15.0.60.58 => 5.15.0.67.65 
 * linux-signed: 5.15.0-60.66 => 5.15.0-67.74 
 * modemmanager: 1.18.6-1 => 1.20.0-1~ubuntu22.04.1 
 * nss: 2:3.68.2-0ubuntu1.1 => 2:3.68.2-0ubuntu1.2 
 * python-apt: 2.4.0 => 2.4.0ubuntu1 
 * shim-signed: 1.51+15.4-0ubuntu9 => 1.51.3+15.7-0ubuntu1 
 * software-properties: 0.99.22.5 => 0.99.22.6 
 * tar: 1.34+dfsg-1build3 => 1.34+dfsg-1ubuntu0.1.22.04.1 
 * ubuntu-advantage-tools: 27.13.3~22.04.1 => 27.13.5~22.04.1 
 * ubuntu-release-upgrader: 1:22.04.15 => 1:22.04.16 


The following is a complete changelog for this image.
new: {'linux-headers-5.15.0-67': '5.15.0-67.74', 'linux-headers-5.15.0-67-generic': '5.15.0-67.74', 'linux-modules-5.15.0-67-generic': '5.15.0-67.74'}
removed: {'linux-modules-5.15.0-60-generic': '5.15.0-60.66', 'linux-headers-5.15.0-60-generic': '5.15.0-60.66', 'linux-headers-5.15.0-60': '5.15.0-60.66'}
changed: ['base-files', 'curl', 'fwupd-signed', 'git', 'git-man', 'grub-efi-amd64-bin', 'grub-efi-amd64-signed', 'isc-dhcp-client', 'isc-dhcp-common', 'libcurl3-gnutls:amd64', 'libcurl4:amd64', 'libgnutls30:amd64', 'libmbim-glib4:amd64', 'libmbim-proxy', 'libmm-glib0:amd64', 'libnss3:amd64', 'libqmi-glib5:amd64', 'libqmi-proxy', 'libsasl2-2:amd64', 'libsasl2-modules-db:amd64', 'libsasl2-modules:amd64', 'linux-headers-generic', 'linux-headers-virtual', 'linux-image-5.15.0-67-generic', 'linux-image-virtual', 'linux-virtual', 'motd-news-config', 'python-apt-common', 'python3-apt', 'python3-distupgrade', 'python3-software-properties', 'shim-signed', 'software-properties-common', 'tar', 'ubuntu-advantage-tools', 'ubuntu-release-upgrader-core']
new snaps: {}
removed snaps: {}
changed snaps: ['snapd']
==== base-files: 12ubuntu4.2 => 12ubuntu4.3 ====
====     base-files motd-news-config
  * /etc/issue{,.net}, /etc/{lsb,os}-release: bump version to 22.04.2
==== curl: 7.81.0-1ubuntu1.7 => 7.81.0-1ubuntu1.8 ====
====     curl libcurl3-gnutls:amd64 libcurl4:amd64
  * SECURITY UPDATE: multiple HSTS issues
    - debian/patches/CVE-2023-23914_5-1.patch: add sharing of HSTS cache
      among handles in docs/libcurl/opts/CURLSHOPT_SHARE.3,
      docs/libcurl/symbols-in-versions, include/curl/curl.h, lib/hsts.c,
      lib/hsts.h, lib/setopt.c, lib/share.c, lib/share.h, lib/transfer.c,
      lib/url.c, lib/urldata.h.
    - debian/patches/CVE-2023-23914_5-2.patch: share HSTS between handles
      in src/tool_operate.c.
    - debian/patches/CVE-2023-23914_5-3.patch: handle adding the same host
      name again in lib/hsts.c.
    - debian/patches/CVE-2023-23914_5-4.patch: support crlf="yes" for
      verify/proxy in tests/FILEFORMAT.md, tests/runtests.pl.
    - debian/patches/CVE-2023-23914_5-5.patch: verify hsts with two URLs in
      tests/data/Makefile.inc, tests/data/test446.
    - CVE-2023-23914
    - CVE-2023-23915
  * SECURITY UPDATE: HTTP multi-header compression denial of service
    - debian/patches/CVE-2023-23916-pre1.patch: do CRLF replacements in
      tests/FILEFORMAT.md, tests/data/test1, tests/runtests.pl.
    - debian/patches/CVE-2023-23916.patch: do not reset stage counter for
      each header in lib/content_encoding.c, lib/urldata.h,
      tests/data/Makefile.inc, tests/data/test418.
    - CVE-2023-23916
==== cyrus-sasl2: 2.1.27+dfsg2-3ubuntu1.1 => 2.1.27+dfsg2-3ubuntu1.2 ====
====     libsasl2-2:amd64 libsasl2-modules-db:amd64 libsasl2-modules:amd64
  * d/control, d/libsasl2-modules-gssapi-mit.install,
    d/libsasl2-modules.install: move the SCRAM mechanism to
    the libsasl2-modules package (LP: #1988730)
==== fwupd-signed: 1.44+1.2-3 => 1.51~22.04.1+1.2-3ubuntu0.2 ====
====     fwupd-signed
  * Remove i386 and armhf from the architecture list
  * Check that we are signing the correct version of fwupd and it is not revoked
  [ Julian Andres Klode ]
  * Rebuild for 2022v1 resigning (LP: #2003365)
  [ Andy Whitcroft ]
  * Fix signing artifact download when faced with an authenticated archive
    pool.  Switch to using common download-signed from grub2/kernel.
==== git: 1:2.34.1-1ubuntu1.6 => 1:2.34.1-1ubuntu1.8 ====
====     git git-man
  * SECURITY UPDATE: Overwritten path and using
    local clone optimization even when using a non-local transport
    - debian/patches/CVE_2023-22490_and_23946/0002-*.patch: adjust
      a mismatch data type in attr.c.
    - debian/patches/CVE_2023-22490_and_23946/0003-*.patch: demonstrate
      clone_local() with ambiguous transport in
      t/t5619-clone-local-ambiguous-transport.sh.
    - debian/patches/CVE_2023-22490_and_23946/0004-*.patch: delay
      picking a transport until after get_repo_path() in builtin/clone.c.
    - debian/patches/CVE_2023-22490_and_23946/0005-*.patch: prevent top-level
      symlinks without FOLLOW_SYMLINKS in dir-iterator, dir-iterator.h,
      t/t0066-dir-iterator.sh, t/t5604-clone-reference.sh.
    - debian/patches/CVE_2023-22490_and_23946/0006-*.patch: fix writing behind
      newly created symbolic links in apply.c, t/t4115-apply-symlink.sh.
    - CVE-2023-22490
    - CVE-2023-23946
==== gnutls28: 3.7.3-4ubuntu1.1 => 3.7.3-4ubuntu1.2 ====
====     libgnutls30:amd64
  * SECURITY UPDATE: timing sidechannel in RSA decryption
    - debian/patches/CVE-2023-0361-1.patch: side-step potential
      side-channel in lib/auth/rsa.c.
    - debian/patches/CVE-2023-0361-2.patch: remove dead code in
      lib/auth/rsa.c.
    - CVE-2023-0361
==== grub2-signed: 1.187.2+2.06-2ubuntu14 => 1.187.3~22.04.1+2.06-2ubuntu14.1 ====
====     grub-efi-amd64-signed
==== grub2-unsigned: 2.06-2ubuntu14 => 2.06-2ubuntu14.1 ====
====     grub-efi-amd64-bin
  * Cherry-pick all memory patches from rhboot
    - Allocate initrd > 4 GB (LP: #1842320)
    - Allocate kernels as code, not data (needed for newer firmware)
  * ubuntu: Fix casts on i386-efi target
  * Cherry-pick all the 2.12 memory management changes (LP: #1842320)
  * Allocate executables as CODE, not DATA in chainloader and arm64
==== isc-dhcp: 4.4.1-2.3ubuntu2.3 => 4.4.1-2.3ubuntu2.4 ====
====     isc-dhcp-client isc-dhcp-common
  [ Mauricio Faria de Oliveira ]
  * Prevent race condition that might ignore DHCP OFFERs/ACKs
    when dhclient receives DHCP traffic noise. (LP: #1926139)
    The previous/racy behavior can be switched back on with
    the 'DHCP_FD_FLAGS_POKE=0' environment variable or
    the 'dhcp.fd_flags_poke=0' kernel cmdline option.
    - d/p/lp1926139-watch-socket-fd-later.patch: fix, switches.
    - d/apparmor/sbin.dhclient,usr.sbin.dhcpd: /proc/cmdline r.
  [ Steve Langasek ]
  * Include /etc/dhcp/dhclient-exit-hooks.d/rfc3442-classless-routes
    in the initramfs. (LP: #1937110)
    - d/initramfs-tools/share/hooks/zz-dhclient: copy_exec it.
==== libmbim: 1.26.2-1build1 => 1.28.0-1~ubuntu20.04.1 ====
====     libmbim-glib4:amd64 libmbim-proxy
  * Backport the newer modemmanager stack to the LTS as part of
    new hardware enablement including FM350 modems
    (lp: #1950282)
  * Update to a preversion doing a git snapshot, needed for newer hardware
  * B-D on meson and bash-completion
  * Updated the symbols
  * debian: lintian-driven fixes and small improvements.
    This commit includes minor changes spotted by `lintian-brush`:
    - `d/copyright`: use `https` for the file format spec URL
    - `d/upstream/metadata`: append `.git` to repo URL
    - `d/rules`: drop symbols migration (1.12 is long gone)
  * New upstream version 1.26.4
  * New upstream version 1.26.2
  * d/control: avoid duplicate build dependencies and sort list
    `gtk-doc-tools` was added to `Build-Depends` in order to fix build with
    latest autotools, but it was pulled in unconditionally and left in
    `Build-Depends-Indep`. This commit makes sure we avoid duplicates and
    don't need `gtk-doc-tools` when building with the `nodoc` profile.
    We also took the opportunity to sort build dependencies by alphabetical
    order for better readability.
  * d/libmbim-glib4: update symbols file for new version
  * debian: update lintian-overrides.
    Due to a change in how `lintian` reports issues, the `libmbim-glib4`
    overrides were ignored. This commit updates the corresponding file in
    order to fix that and adds a new override for `libmbim-glib-doc`:
    installing documentation to `/usr/share/gtk-doc` instead of
    `/usr/share/doc` is the standard practice for glib/gtk-based software.
  * d/rules: drop --fail-missing option for dh_missing.
    This is now the default with dh-compat level 13.
  * d/control: build-depend on gtk-doc-tools.
  * New upstream version 1.26.0
  * d/control: change maintainer to DebianOnMobile team.
  * d/control: bump debhelper-compat version and Standards-Version.
  * d/copyright: add Upstream-Contact and update maintainer email
  * d/copyright: fix libmbim-glib path
  * debian: add salsa CI pipeline
  * d/source: add upstream metadata
  * d/control: update build dependencies.
  * d/libmbim-glib4: update symbols file for new version
  * d/watch: bump watch file version, no change required
  * d/rules: add hardening build options
  * d/changelog: prepare new release
  * d/control: add more Uploaders.
  * New upstream version
  * Non-maintainer upload.
  * New upstream version (bug fixes).
  * Add upstream signing key.
  * Non-maintainer upload.
  * New upstream version (bug fixes).
  * debian/libmbim-glib4.symbols: Updated symbols for new release.
  * Non-maintainer upload.
  * New upstream version (bug fixes).
  * Fix reproducibility by removing superfluous Makefiles (Closes: #963603).
  * Non-maintainer upload.
  * New upstream version.
  * Non-maintainer upload.
  * Add package for GObject introspection (new upstream feature).
  * Non-maintainer upload.
  * Bump debhelper to 12, no further changes
  * Bump Standards-Version to 4.5.0 (no further changes)
  * Move mbim-proxy to /usr/libexec (Closes: #954145)
  * Do not build-depend on libgudev-dev package on non-linux architectures
  * Add help2man to the build-dependencies to ensure that the manpages are
    properly built (Closes: #952124)
  * Move gtk-doc-tools and libglib2.0-doc to the B-D-I instead of the
    build-dependencies, mark the with <!nodoc>
  * Add Build-Depends-Package to the symbols file to please lintian
  * debian/control: Remove a duplication section, to please lintian
  * Add a symlink for the documentation in /usr/share/doc and adjust the
    docbase file. This fixes the doc-base-file-references-wrong-path lintian
    warning
  * Non-maintainer upload.
  * Update Vcs-* to salsa.
  * Use Rules-Requires-Root: no
  * Really add the build-depends on autoconf-archive
  * New upstream version
  * debian/control.in:
    - Build-Depends on autoconf-archive
  * debian/patches/git_deprecation_warnings.patch:
    - removed, included in the new version
  * debian/patches/git_deprecation_warnings.patch:
    - disable deprecation warnings, fix the build with the new glib version
  * Non-maintainer upload.
  * New upstream release
  * New upstream release
    - Needed by ModemManager 1.10.
  * debian/libmbim-glib4.symbols: Updated symbols for new release.
  * New upstream release 1.16.0 (Closes: #887974)
  * Adopting the package. (Closes: #888680)
  * debian/control: bump libglib-dev Depends to (>= 2.36) as required by the
    new release.
  * debian/libmbim-glib4.symbols: update symbols for new release.
  * debian/rules: add DPKG_GENSYMBOLS_CHECK_LEVEL=4; it's more verbose with
    added or changed symbols then.
  [ Manuel A. Fernandez Montecelo ]
  * Non-maintainer upload.
  [ Helmut Grohne ]
  * Fix FTCBFS: Skip documentation in arch-only build. (Closes: #872813)
  * Remove myself as Maintainer and reinstate Thomas Bechtold.
  * New upstream version 1.14.2
  * Bump debhelper compat level to 10 for automatic dh-autoreconf
  * Update Vcs-* following the latest recommendation
  * Bump Standards-Version to 4.1.0
  * Switch to new dh_missing helper and use --fail-missing
  * New upstream release.
  * Explicitly build with udev support.
  * Update symbols file.
  * Bump Standards-Version to 3.9.8.
  * Install bash-completion file for mbimcli.
  [ Thomas Bechtold ]
  * Set biebl@debian.org as new Maintainer and move myself to
    Uploaders.
  [ Michael Biebl ]
  * New upstream release.
  * Use https:// for upstream homepage.
  * Drop libmbim-glib4-dbg now that we have automatic dbgsym packages.
  * Ensure proper upgrade from libmbim-glib4-dbg to new dbgsym packages by
    using dh_strip --dbgsym-migration. Bump Build-Depends on debhelper
    accordingly.
  * Bump Standards-Version to 3.9.7.
  * Drop debian/mbimcli.1 since we use the upstream man page.
  * Upload to unstable.
  * Add myself to Uploaders.
  * Team upload.
  [ Marius B. Kotsbak ]
  * Imported Upstream version 1.12.2
  * Update debian/libmbim-glib4.symbols for new upstream release.
  * Update Debian standards version to the latest.
  * Add experimental branch config in gbp.conf.
  [ Michael Biebl ]
  * Update Vcs-* to use canonical URLs, use cgit and https for Vcs-Browser.
  * Non-maintainer upload.
  * Apply patch from Boris Egorov to fix bashisms (Closes: #772325)
  * Team upload.
  * Use a strictly versioned dependency between libmbim-proxy and
    libmbim-glib4, so the two packages don't get out of sync.
  * Make any package linking against libmbim-glib4 get an explicit dependency
    on libmbim-proxy. The mbim-proxy binary is used internally by
    libmbim-glib4 and the package split is an implementation detail to
    properly support multi-arch. Convince lintian that this is intentional.
  * Team upload.
  [ Marius B. Kotsbak ]
  * New upstream release.
  * Rename libmbim-glib0  libmbim-glib4 for the soname bump.
  * Add new package libmbim-proxy holding mbim-proxy binary.
  * Add debug info package libmbim-glib4-dbg.
  [ Michael Biebl ]
  * Use dh_install --list-missing to show uninstalled files.
  * Install man pages via dh_install.
  * Drop obsolete --with-tests configure option.
  * New upstream release.
  * Update debian/libmbim-glib0.symbols.
  * debian/copyright: Mention GFDL-1.3+ license which is used for
    documentation (Closes: #732527).
  * debian/control: Bump Standards-Version to 3.9.5. No further changes
    needed.
  * New upstream release (Closes: #731908)
  * Fix Multi-Arch: same problem with separated doc package (Closes: #728195)
  * debian/patches/0001-build-filter-out-non-public-symbols.patch: Dropped,
    applied upstream.
  * debian/libmbim-utils.install: Provide mbim-network binary.
  * debian/libmbim-utils.manpages: Install manpages provided by upstream.
  * debian/rules: manpage creation no longer needed. manpages are provided by
    upstream.
  * debian/control: Use Debian email address in maintainer field.
  * Initial release. (Closes: #716765)
==== libqmi: 1.30.4-1 => 1.32.0-1ubuntu0.22.04.1 ====
====     libqmi-glib5:amd64 libqmi-proxy
  * Backport the newer modemmanager stack to the LTS as part of
    new hardware enablement including FM350 modems
    (lp: #1950282)
  * Build without libqrtr for now, the MIR is blocked since we don't have
    hardware available to do the required testing of the feature,
    include some workarounds to fix the build
  * Update to a preversion doing a git snapshot, needed for newer hardware
  * Build-Depends on meson, help2man and bash-completion
  * Update the symbols
  * New upstream version 1.30.8
  * d/control: update my email address.
    Also bump Standards-Version, no change required.
  * debian: update lintian-overrides.
    Due to recent lintian updates, the overrides for `libqmi-glib-doc` are
    no longer needed, while the source package need new overrides: HTML
    files are their own sources, so the `source-is-missing` lintian error is
    not relevant here.
    Moreover, the tag format of the `libqmi-glib5` overrides needs to be
    updated so it can be useful again.
  * d/libqmi-glib5: update symbols file with new entries
  * d/control: make -dev package depend on libqrtr-glib
    `libqmi` is now compiled with QRTR support by linking against
    `libqrtr-glib`. However, `libqmi-glib-dev` doesn't depend on
    `libqrtr-glib-dev`, meaning users need to manually add the latter to
    their build dependencies. Avoid this by adding `libqrtr-glib-dev` as a
    dependency to `libqmi-glib-dev`.
  * debian: lintian-driven fixes and small improvements.
    This commit includes minor changes spotted by `lintian-brush`:
    - `d/upstream/metadata`: append `.git` to repo URL
    - `d/rules`: drop symbols migration (1.14 is long gone)
  * New upstream version 1.30.6
  * d/control: build-depend on libqrtr-glib.
    This enables support of QMI over QRTR, required to support Qualcomm SoCs
    in ModemManager.
  * d/libqmi-glib5: update symbols file with new entries.
    Building libqmi with QRTR support adds a few new symbols to the library,
    make sure those are present in the symbols file.
  * d/libqmi-glib-doc: add lintian override.
    Documentation generated by gtk-doc is installed to `/usr/share/gtk-doc`
    as expected. Add a corresponding lintian override, otherwise it will
    complain about docs installed outside `/usr/share/doc`.
  * d/copyright: use secure URL for copyright format.
    Also update copyright information for the `debian/` folder.
==== linux-meta: 5.15.0.60.58 => 5.15.0.67.65 ====
====     linux-headers-generic linux-headers-virtual linux-image-virtual linux-virtual
  * Bump ABI 5.15.0-67
  * Bump ABI 5.15.0-66
  * Bump ABI 5.15.0-65
  * Packaging resync (LP: #1786013)
    - [Packaging] update variants
    - [Packaging] resync debian/dkms-versions from main package
==== linux-signed: 5.15.0-60.66 => 5.15.0-67.74 ====
====     linux-image-5.15.0-67-generic
  * Master version: 5.15.0-67.74
  * Miscellaneous Ubuntu changes
    - debian/tracking-bug -- update from master
  * Master version: 5.15.0-66.73
  * Miscellaneous Ubuntu changes
    - debian/tracking-bug -- update from master
  * Master version: 5.15.0-65.72
  * Packaging resync (LP: #1786013)
    - [Packaging] update variants
  * SIGNEDv3: add a linux-generate ancillary package (LP: #1989705)
    - [Packaging] convert to v3.1 autogen form
  * Miscellaneous Ubuntu changes
    - debian/tracking-bug -- update from master
==== modemmanager: 1.18.6-1 => 1.20.0-1~ubuntu22.04.1 ====
====     libmm-glib0:amd64
  * Backport the newer modemmanager stack to the LTS as part of
    new hardware enablement including FM350 modems
    (lp: #1950282)
  * Build without libqrtr for now, the MIR is blocked since we don't have
    hardware available to do the required testing of the feature,
    include some workarounds to fix the build
  * New upstream snapshot, fixing build issues with the new glib serie
  * Update to a preversion doing a git snapshot, needed for newer hardware
  * Update the build requirements and build with meson
  * Refresh the symbols
  * New upstream version 1.18.10
  * d/control: update my email address and bump libqmi dependency.
    Upstream bumped the required version of `libqmi`, so let's ensure this
    is reflected in this package.
    This commit also bumps the Standards-Version, as no additional change is
    required.
  * debian: update linitian-overrides.
    Due to recent changes in `lintian`, our overrides for the -doc packages
    are no longer needed. However, a new `source-is-missing` lintian error
    message must be overridden as it relates to HTML files, which are source
    files themselves.
  * debian: lintian-driven fixes and small improvements.
    This commit includes minor changes spotted by `lintian-brush`:
    - remove obsolete/empty maintainer scripts
    - `d/upstream/metadata`: append `.git` to repo URL
    - `d/rules`: drop symbols migration (1.4.14 is long gone)
  * d/control: drop build dependency on libqrtr-glib
    `libqrtr-glib-dev` is now a dependency to `libqmi-glib-dev`, and as such
    can be safely omitted from this package's build deps.
    We must however increase the required `libqmi` version to ensure we
    avoid build failures.
  * New upstream version 1.18.8
  * d/symbols: update for new release.
  * d/control: build-depend on libqrtr-glib.
    This enables support for the QRTR protocol so we can use the integrated
    modem found on Qualcomm SoCs.
==== nss: 2:3.68.2-0ubuntu1.1 => 2:3.68.2-0ubuntu1.2 ====
====     libnss3:amd64
  * SECURITY UPDATE: Arbitrary memory write via PKCS 12 in NSS
    - debian/patches/CVE-2023-0767.patch: improve handling of unknown
      PKCS#12 safe bag types in nss/lib/pkcs12/p12d.c,
      nss/lib/pkcs12/p12t.h, nss/lib/pkcs12/p12tmpl.c.
    - CVE-2023-0767
==== python-apt: 2.4.0 => 2.4.0ubuntu1 ====
====     python-apt-common python3-apt
  * Update mirror lists.
==== shim-signed: 1.51+15.4-0ubuntu9 => 1.51.3+15.7-0ubuntu1 ====
====     shim-signed
  [ dann frazier ]
  * Fix arm64 issues due to hardcoding "x64" as the EFI architecture.
    (LP: #2004208)
  * is-not-revoked: Support vmlinux.gz files as used on arm64.
    (LP: #2004201)
  * New upstream version 15.7 (LP: #1996503)
    - SBAT level: shim,3
    - SBAT policy bumped to for grub,2 in previous and grub,3 in latest:
      SBAT policy: latest="shim,2\ngrub,3\n" previous="grub,2\n"
  * SECURITY FIX: Buffer overflow when loading crafted EFI images.
      - CVE-2022-28737
  * debian/control: Depend on new grub versions (1.191 on lunar+, 1.187.2 elsewhere)
  * Break fwupd-signed signed with old keys
  * Check for revoked fb,mm binaries in build, grubs, fwupd in autopkgtest
  * Install both previous and latest shim as alternatives. On secure boot
    systems, if the current kernel or any newer one is revoked, the previous
    shim will continue to be used until current kernel and all newer ones
    are signed with a non-revoked key.
==== software-properties: 0.99.22.5 => 0.99.22.6 ====
====     python3-software-properties software-properties-common
  [ Nathan Pratta Teodosio ]
  * Disable the Ubuntu Pro UI with an explanation when not connected
    (lp: #2004634)
  * Catch exceptions to wait (lp: #2003996)
  * Initialize pin as empty string (lp: #2004245)
==== tar: 1.34+dfsg-1build3 => 1.34+dfsg-1ubuntu0.1.22.04.1 ====
====     tar
  * SECURITY UPDATE: one-byte out of bounds
    - debian/patches/CVE-2022-48303.patch: check limit in
      src/list.c.
    - CVE-2022-48303
==== ubuntu-advantage-tools: 27.13.3~22.04.1 => 27.13.5~22.04.1 ====
====     ubuntu-advantage-tools
  * Backport new upstream release
  * d/ubuntu-advantage-tools.postinst:
    - fix version for cleaning the esm-apps stale unauthenticated files
      (LP: #2006765)
  * d/ubuntu-advantage-tools.postinst:
    - remove stale esm-apps unauthenticated caches (LP: #2004193)
  * apt-hook:
    - Change esm-apps advertisement message on apt upgrade to
      make it clearer that the service is providing more upgrades
      and not restricting user to only get updates if esm-apps
      is enabled (LP: #2006510)
  * contract:
    - make code aware that the effective date is not a required field
      in the machine-token.json file (LP: #2006351)
  * esm_cache
    - do not fail if we cannot extract information from
      /etc/os-release file (LP: #2006508)
  * security-status:
    -  consider packages without a candidate as 'unknown' (LP: #2006049)
  * status:
    - treat null effective contract dates as unknown/expired
      (LP: #2004650)
  * timer:
    - recycle invalid jobs-status.json file if we detect it is
      corrupted (LP: #2006261)
  * d/ubuntu-advantage-tools.preinst: (LP: #2004279)
    - correct second set of md5sums to continue avoiding a dpkg conf prompt
      if the only change to the original config file was to the apt_news flag
    - restore correct default uaclient.conf when upgrading from 27.13.X and
      the only conf change is apt_news
  * esm-cache.service:
    - Catch errors when esm.ubuntu.com is unreachable to avoid causing crash
      reports and degraded systemd status from this non-critical service
      (LP: #2004130)
  * d/ubuntu-advantage-tools.{postinst,postrm,preinst}:
    - avoid a dpkg conf prompt if the only change to the original config file
      was to the apt_news flag (LP: #2003977)
  * apt-hook:
    - only run the pro client pre-update hook services when the apt update is
      executed as root user (LP: #2004057)
  * apt: better isolate apt esm cache by only fetching necessary
    configuration from the system apt
  * d/bash-completion:
    - enable autocomplete for the 'pro' command (GH: #2280)
  * d/control:
    - update the package description
  * d/postinst:
    - remove unauthenticated esm repos from Xenial systems (LP: #1990378)
  * New upstream release 27.13 (LP: #2003018)
    - apt:
      + remove logic which added repositories and pinned them to 'never' to
        enable access to esm package lists
      + add functionality to create and update a local apt esm cache with
        the lists for esm-infra and esm-apps
    - apt-hook: update the cpp hook to use the local esm apt cache
    - apt-news:
      + fetch and display APT News in apt upgrade
      + show contract expiration notices in the apt news output
    - attach: support attaching without being able to install snapd
      (LP: #1997514)
    - cli:
      + do not show invalid subcommands in autocomplete (GH: #2279)
      + add support for attaching through the web portal, without a token
    - config: add apt_news_url option
    - docs: reorganize documentation and correct information
    - esm-apps: release the service as GA
    - jobs:
      + remove the update_status job
      + remove unused job which checks for the system EOL
    - messaging: do not fail if the apt-hook executable is not present
      (LP: #1994480)
    - motd: announce esm-apps as GA
    - security-status:
      + use the local esm cache to report updates when the services are
        disabled
      + redesign output to properly show support (LP: #2002407)
    - services: add new service to update the local esm caches
    - ros: release the service as GA
    - bug fixes:
      + report reboot_required even if 'livepatch status' fails
      + do not create unexpected environment variables when the autocomplete
        script runs
      + contract requests do not cause 'pro status' to fail
      + remove auto-attach motd message if any failure happens
      + log when 'cloud-id' fails
      + always honor the metering job timer config
      + write files atomically
  * New upstream release 27.12 (LP: #1996424):
    - auto-attach:
      + retry auto-attach for up to one month on Ubuntu Pro cloud instances
      + make a best effort to auto-attach when using the API
    - enable: show deduplicated list of supported arches (GH: #917)
    - fips: remove cloud package override logic from the client
    - messaging: verify contract expiration date on contract server before
      outputting expired message on MOTD
    - realtime-kernel: make service non-beta
    - reboot-required:
      + add API support to show if the system requires a reboot
        (u.pro.security.status.reboot_required.v1)
      + add cli command for the functionality (pro system reboot-required)
    - security-status:
      + add API support to report standard updates (u.pro.packages.updates.v1)
      + add API support to show CVEs patched by Livepatch
        (u.pro.security.status.livepatch_cves.v1)
      + add API support to show packages summary information
        (u.pro.packages.summary.v1)
      + list packages in oci manifest format (u.security.package_manifest.v1)
    - systemd: do not attempt to auto-attach if a machine-token is present
  * New upstream release 27.11.3: (LP: #1993006)
    - d/postinst: remove the Ubuntu Pro beta apt message and set up the
      configurable flag for "APT news" instead
    - collect-logs: do not fail if a file cannot be read (LP: #1991858)
    - config: add a flag to disable "APT news" (LP: 1992026)
    - messaging: add announcement of "APT news" to apt output
    - messaging: only show "APT news" when using apt binary (GH: #2288)
    - version: use /run instead of /tmp for version file (GH: #2294)
  * New upstream release 27.11.2: (LP: #1991173)
    - esm: add the --beta flag back to esm-apps
    - messaging: show Ubuntu Pro beta message in apt output
    - security-status: don't show esm-apps information when the service is not
      enabled
    - ros: add the --beta flag back to ros and ros-updates
  * New upstream release 27.11.1: (LP: #1990907)
    - Fix release upgrade when ESM packages are installed
      + d/postinst: remove series information from the APT preferences template
      + esm: remove series information from the APT preferences file
  * d/control:
    - Update VCS references
  * d/links:
    - add usr/bin/pro as an alias to ubuntu-advantage
  * d/postinst:
    - include root_mode parameter when creating UAConfig instances
    - change calls to add_notice to notice_file.add
    - create public machine-token file if it does not exist
  * New upstream release 27.11 (LP: #1989279)
    - api:
      + new `pro api` command to access the public client API
      + 'version' endpoint returning version information
      + 'should auto attach' endpoint informing if a system should run
        auto-attach on startup
      + 'full auto attach' endpoint performing auto-attach
      + 'magic attach' endpoints for the Magic Attach flow
    - auto-attach:
      + better errors for invalid pro images (GH: #2180, #1833)
      + don't detach on already auto-attached instances
      + no-op when ubuntu-advantage information is present on cloud-init
        userdata
      + change systemd unit to run after cloud-config
    - cli:
      + cli: better error message on unrecognized flags (GH: #672)
    - collect-logs:
      + can now be executed as a non-root user
      + is executed automatically and result is appended when using apport to
        report a bug
    - docs: now formatted to be built with sphinx, and published in readthedocs
    - enable:
      + new access-only flag for usecases where auto-install is undesired
      + fix apt auth line replacement (LP: #1985863)
    - esm-apps: generally available as non-beta as part of Ubuntu Pro
    - fix: check if livepatch has already fixed a CVE before attempting a fix
    - jobs: new timer job to check if the release reached end of support
    - pro:
      + Ubuntu Pro is released as a product
      + make `pro` the recommended executable for the client
      + client, apt and motd messages updated/rewritten to show Pro 
        information
      + base URL changed from /advantage to /pro
      + ESM services renamed as part of Pro
    - ros: released as a non-beta entitlement
    - security-status
      + does not require the --format flag anymore
      + human readable output added based on ubuntu-security-status
      + machine readable output contains CVEs fixed by Livepatch
      + package counts include all esm-infra and esm-apps repositories
    - status:
      + don't show unavailable services by default (GH: #2156, #2159)
      + expiry date formatted based on timezone (GH: #695)
      + non-root users get the current status instead of a cached version
      + --wait flag now working for non-root users
    - version: warn about new available versions of the client in CLI command
      output and API calls
  * apt-hook: Fix missing import warning when compiling
  * d/control:
    - Drop golang dependencies
  * d/rules:
    - Only install APT hooks on LTS series
  * New upstream release 27.10 (LP: #1980990)
    - apt-hook: replace golang with cpp for json-hook
    - cli
      + properly sort services for detach/attach (GH: #1831)
      + collect-logs include rotated log files
      + display UA features directly on status
    - daemon: do not try enabling daemon during auto-attach (LP: #1980865)
    - fix:
      + update ua portal url when asking for attach
      + add --dry-run option
    - gcp-pro: better error message for metadata endpoint error
    - requests: Add default timeout for web requests
    - timer: log when job start running
    - security-status: include download size of package updates
  * d/rules
    - remove trusty specific code
    - remove ua-license-check.{timer,service,path}
    - install ubuntu-advantage.service
    - only on xenial: install ubuntu-advantage-cloud-id-shim.service
  * d/tools.preinst: remove old config field to avoid warnings in logs
  * d/tools.postinst
    - remove trusty specific code
    - print warnings if /etc/os-release doesn't have required fields
    - hardcode service list instead of exec-ing python3 for old migration
    - refactor python to avoid instantiating UAConfig extra times
    - refactor python to always use messages module for strings
    - rm the old marker file that triggered ua-license-check.path
    - remove unnecessary deb-systemd-helper check in ua-messaging cleanup
    - clean up old ua-license-check state
    - run new cloud-id-shim script
  * d/tools/postrm
    - clean up ubuntu-advantage-daemon log files
  * New upstream release 27.9 (LP: #1973099)
    - cli:
      + for json formatted output, include additional_info for some errors
      + new subcommand `ua refresh messages` to update motd and apt messages
    - daemon:
      + replace ua-license-check timer with ubuntu-advantage.service daemon
      + detects on-boot if pro license was added and runs auto-attach
      + only runs on gcp and does not continuously long-poll by default for now
    - enable:
      + fix error message on wrong service name when unattached
    - fips:
      + allow enabling generic fips kernel on azure by default
      + clean up fips reboot message (LP: #1972026)
    - fix:
      + handle errors during attach process
      + fix bug where enable or detach during a fix failed (LP: #1969809)
      + fix bug where attempting to fix some CVEs would never finish
    - performance:
      + remove unnecessary UAConfig object instantiation (also cleans up logs)
      + cache "apt-cache policy" output to avoid unnecessary subp calls
    - proxy:
      + apt_http(s)_proxy renamed to global_apt_http(s)_proxy
      + apt_http(s)_proxy config var names will still work
      + new ua_apt_http(s)_proxy for only ua-related apt traffic (LP: #1956764)
      + global_apt_http(s)_proxy and ua_apt_http(s)_proxy cannot be set at the
        same time
    - realtime: adjust warning to clarify that a manual revert is possible
    - refresh: a normal `ua refresh` will also update motd and apt messages
    - security-status: add counts of packages from each archive component
    - status: check if contract has updated and notify user to run "ua refresh"
  * New upstream release 27.8 (LP: #1969125)
    - entitlements: apply overrides from the contract response
    - fips:
      + unhold fips packages when enabling fips-updates
      + Automatically disable fips service before enabling fips-updates
      + unhold more packages when enabling fips
    - lib: fix upgrade script for unsupported releases (LP: #1968067)
    - realtime: add support for realtime kernel beta service on Jammy
  * fips:
    - make fips service incompatible with fips-updates
    - unhold more packages when enabling fips
  * d/changelog:
    - fix changelog trailer line for 27.4.1
  * d/logrotate:
    - make new logs world readable
  * d/tools.postinst:
    - refactor to catch exception from entitlement_factory
    - no longer always set log file to only root readable
    - when creating log file for the first time, make world readable
    - adapt postinst for new messages module
  * New upstream release 27.7 (LP: #1964028)
    - attach: --attach-config option for customizing auto-enabled services
      and supplying token via a file
    - auto-attach: fix bug where auto-attach caused a manually attached
      machine to detach
    - cli:
      + support --format=json for attach
      + support --format=json for detach
      + support --format=json for enable
      + support --format=json for disable
    - contract: include activity info when updating contract
    - detach: no longer contacts contract server on detach
    - fips: allow fips on containers
    - fix: support USNs that don't have related CVEs
    - logs: make all newly created logs world-readable
    - security-status:
      + show already installed esm package counts
      + include APT origin for each potential update
      + bump schema version to "0.1"
      + remove previously required --beta flag
    - status:
      + include blocked_by information in service status when format=json
      + --simulate-with-token now reports expired tokens as errors
      + --simulate-with-token now returns errors in the specified format
  * New upstream release 27.6 (LP: #1958556)
    - cli: only request available resources from contract server when needed
    - fips:
      + allow enabling FIPS on focal clouds
      + update prompt messages
    - jobs: disable license-check job on GCP after attach
    - message: fix how apt and motd messages are updated after ua commands
  * d/control:
    - Update homepage URL
  * d/tools.postinst:
    - Refactor to use valid_services
  * d/tools.postrm:
    - Use a wildcard to remove ua related gpg files
  * New upstream release 27.5 (LP: #1956456)
    - aws: add support for the IPv6 metadata endpoint
    - cis: update URL for the documentation
    - cli:
      + add endpoint to simulate the status using a specific contract token
      + fix return code when attaching an already attached machine (GH: #1867)
      + fix security-status to consider all possible origins to show updates
      + include cloud build.info in the collect-logs tarball
      + only show services which exist in the contracts server in ua status
    - docs: fix typos and wrong/outdated information
    - livepatch: always use the full path in livepatch calls (LP: #1951954)
    - logs:
      + improve rules to redact sensitive information from all log files
      + redact sensitive information from older unredacted log files
      + log errors from external software execution, for debugging purposes
    - usg:
      + support the presentedAs affordance from the contract server, showing
        services in the CLI with the appropriate names
      + replace the CIS entitlement by USG on Focal and onwards
  * d/tools.postinst:
    - Fix check_service_is_enabled function when the machine is
      unattached (LP: #1951705)
  * jobs: do not run the status job for unattached users
  * d/rules:
    - Remove conftest file from the package
  * d/tools.postinst:
    - hardcode python binary to run python scripts (LP: #1930121)
    - undo unnecessary log file creation
  * d/tools.prerm:
    - hardcode python binary to run python scripts (LP: #1930121)
  * New upstream release 27.4 (LP: #1949634)
    - cc-eal: remove beta flag
    - cli:
      + attach will save machine-id during operation
      + detach won't ask unnecessary questions
      + new security-status subcommand lists potentially available
        security and ESM updates (beta)
    - fix:
      + exit 0 when fix is successfully applied and completed
      + exit 1 when fix cannot be applied
      + exit 2 when fix requires a reboot to complete
      + check reboot-required.pkgs for better reboot suggestions
    - livepatch: allow livepatch and fips-updates at the same time
    - metering:
      + update how activity info is parsed
      + update contract response structure
      + enable job by default
    - proxy: no_proxy defaults for link-local IMDS routes
    - util:
      + cache get_platform_info calls
      + fix machine-id fallback path on get_machine_id
  * d/tools.postinst:
    - consider cloud to be "none" on any cloud-id error
    - purge old ua-messaging.timer/service files
    - keep ua-timer.timer disabled if ua-messaging.timer was disabled by
      the user
    - properly configure both ubuntu-advantage-timer and
      ubuntu-advantage-licence-check logs
  * d/tools.postrm:
    - remove ubuntu-advantage-timer and ubuntu-advantage-license-check logs
      during purge
  * systemd:
    - remove ua-messaging.timer/service
    - add new ua-timer.timer that runs every 6 hours
    - add new ua-license_check.timer that runs every 5 minutes only if
      activated by ua-license-check.path
  * New upstream release 27.3 (LP: #1942929)
    - ros:
      + add beta support to enable ros and ros-updates
      + add support for "required services" so that esm-infra and esm-apps
        get auto-enabled when enabling ros or ros-updates
      + add support for "dependent services" so that user gets prompted to
        disable ros/ros-updates if they disable esm-infra/esm-apps
    - fips:
      + allow fips on GCP bionic now that optimized kernel is ready
      + disallow enabling fips on focal on clouds until cloud-optimized focal
        fips-certified kernel is ready (LP: #1939449, LP: #1939932)
      + print warning about generic fips kernel if cloud-id fails
    - cloud:
      + rely only on cloud-id to determine cloud type (LP: #1940131)
      + catch errors when determining cloud type
        (LP: #1938207, LP: #1944676) (GH: #1541)
    - azure:
      + bump IMDS API version to support Azure published images
    - cli:
      + collect-logs command that creates a tar file with debug-relevant logs
        and status info (GH: #463)
      + clean locks on exceptions more thoroughly to avoid false "Operation in
        progress" status messages
      + retain past service state after detach
      + shows better error message when a port value in a proxy is invalid
    - non-unicode locale support:
      + remove unicode-only characters from help file
      + don't print unicode-only characters in ua fix if non-utf8 locale
        (GH: #1463)
    - logrotate:
      + add logrotate functionality for ubuntu-advantage-timer.log.
      + Fix root:root logrotate permissions.
    - ua-timer.timer:
      + introduce a single systemd timer to handle ua recurring jobs
      + timer runs every 2 hours to support most frequent timer job
      + recurring job intervals are configurable in uaclient.conf
      + individual jobs are disabled if their interval is set to 0
      - status job:
        + update ua status every 12 hours
      - messaging job:
        + update APT/MOTD ESM messaging every 6 hours
      - metering job:
        + disabled until infrastructure is ready
        + for attached machines only, periodically update contract server with
          status information for proper contract metering
    - ua-license-check.timer:
      + only runs on LTS GCP instances that are not attached
      + runs every 5 minutes to check if gcp instance has license required to
        auto-attach
    - logs:
      + fixes duplicate logging (GH: #553)
    - tests and support:
      + remove groovy integration tests
      + various improvements to integration tests
  * d/tools.postinst:
    - Do not fail in postinst if cloud-init did not run.
      This fixes the regression introduced in 27.2.1. (LP: #1936833)
  * d/control:
    - remove unnecessary distro-info dependency from build-depends
  * d/rules:
    - pick right version of distro-info based on release
  * docs:
    + add information about proxy auth to manpage and readme
  * lib:
    + handle missing configStatus key in patch status json script
  * d/control:
    - add comments to explain complex build-depends
    - add version requirement to distro-info (LP: #1932028)
  * d/tools.postinst:
    - run status.json schema patch script to avoid non-root status errors
  * New upstream release 27.2:
    - attach: print contract server reason for 403 (GH: #1630)
    - cli: add ua config set, unset and show subcommands
    - config:
      + add default ua_config setting values
      + only allow some fields to be set by envvar
      + use defaults for contract and security url
    - docs:
      + add proxy config options to man page
      + add instructions to generate MOTD messages
      + add support matrix info
      + remove broken api link
    - enable: allow downgrading packages during enable (GH: #1659)
    - fips:
      + add focal test for fips-updates
      + alert if wrong fips package installed on gov clouds
      + install correct fips package on gov clouds
      + only install conditional_packages if necessary and available
    - logs: log env vars that affect config on cli runs
    - proxy:
      + add config options to set proxies
      + print message when setting proxy
      + support configuring apt proxies
      + support configuring snap and livepatch proxies
      + support setting proxy for web requests
      + validate urls before setting as proxies
    - refresh: support refreshing config and contract separately
    - status
      + add config info to json output
      + add env vars to json output
      + do not show unavailable services in json output
      + support yaml format with same content as json format
      + update account info in json output
      + update contract info in json output
      + update root level keys of json output
    - refactor:
      + remove side effects from can_enable (GH: #1654, #1571)
      + use DatetimeAwareJSONDecoder to parse date strings
    - tests:
      + add additional enable test for incompatible services
      + add flag to enable proposed pocket
      + add test to check and print version being tested
      + drop trusty specific tests
  * Cherrypick upstream pr #1681 to unbreak many migrations. LP: #1930741
  * d/control:
    - specify debianutils min version
  * d/changelog:
    - fix lintian typos amend and redact incorrect 27.0 entry (GH: #1624)
  * lintian:
    - override ubuntu-advantage-pro wanted-by-target cloud-init
    - override xenial specific errors
    - rename package-specific overrides for pro vs tools
  * New upstream release 27.1:
    - apt-hook:
      + avoid segfault when comparing null Apt file origin to esm
        (LP: #1929123)
      + avoid wrapping static message formats at 80 chars
      + update go build flags based on lintian warnings (GH: #1626)
      + only add newlines for MOTD if message file length is non-zero
    - attach: do not print contract name if empty
    - autocomplete: Do not show beta services in autocomplete (GH: #1594)
    - cis:
      + make service non-beta
      + post enable message pointing to docs
      + update cis help url
    - docs: update releases.md per SRU review feedback on branch structuring
    - enable: correct messaging for beta service (GH: #1588)
    - errors: print a more helpful message when ssl fails (GH: #1618)
    - fips:
      + Block enabling fips if fips-updates once enabled (GH: #1600)
      + Update output of fips commands (GH: #1631)
    - livepatch: alert when snapd does not have wait cmd (LP: #1927329)
    - logging: remove tracebacks for UserFacingErrors (GH: #1586)
    - messaging:
      + Infra and Apps messaging is mutually exclusive (GH: #1573)
      + point to u.com/16-04 instead of u.com/advantage on ESM (GH: #1584)
      + separate _remove_msg_template. emit no warranty on infra disabled
    - pro: obtain AWS IMDSv2 API token before trying to grab pkcs7 doc
      (GH: #1608)
    - status: do not show info if not on contract (GH: #1592)
    - tests:
      + drop trusty specific tests
      + fix mock for handle_message_operations
      + fix motd message for bionic (GH: #1615)
      + integration tests for hirsute and groovy
      + manual test for trusty upgrade to xenial
      + reboot after dist-upgrade for upgrade test
      + test enabling CIS on focal (GH: #1582)
      + update messages in integration tests (GH: #1635)
      + use proposed pocket on xenial upgrade test
    - jenkins:
      + add pytest runs for xenial and bionic
      + run focal lxd integration tests
  * d/control:
    - order build-depends alternatives newer first (LP: #1926949)
    - apt-hook: do not attempt to package go APT JSON hook on some
      architectures (GH: #1603) (LP: #1927886, LP: #1927795)
  * Bug-fix release 27.0.2: build failures on riscv64 and powerpc
    - apt-hook: refactor json hook messaging to be dry
    - tests: fix subp ls error case for powerpc builds
    - jenkinsfile: add --resolve-alternatives for trusty builds
    - amend changelog: add omitted apt-hook message for 27.0.1 stanza
  * Add .gitignore and cleanup ignored directory .pytest_cache
  * apt-hook: mitigate failures with true
  * New upstream release 27.0:
    - [redacted: actually landed in 27.0.1] apt-hook: mitigate failures with
      true
    - messages: add optional (s) to apt messaging to include
      singular/plural pkgs
    - apt-hook: avoid reporting and counting duplicate package
      names (GH: #1578)
    - fix: don't say reboot required when unnecessary (LP: #1926183)
    - test: uncomment additional xenial upgrade tests
  * New upstream beta3 release:
    - config: avoid tracebacks on invalid features value in uaclient.conf
      (GH: #1564)
    - apt-hook: new json hook for security update counts
    - Remove redundant messaging from uaclient
  * d/control:
    - add distro-info dependency
    - add new debianutils dependency
    - add optional dh-systemd | debhelper (>= 13.3) to fallback on hirsute
      and later when dh-systemd is not present
  * d/rules: enable and start ua-messaging.timer on package install
  * d/postinst:
    - configure esm on any LTS release avoid beta services
    - configure esm-infra when is_active_esm and apps on LTS
    - xenial enable unauthenticated apt source for apps/infra
  * New upstream release 27.0~beta:
    - apt-hook:
      + adapt hook to process separate message templates
      + esm-apps and esm-infra pkg counts not mutually-exclusive
      + print static messages on apt upgrade/dist-upgrade (GH: #1546)
    - config: create settings_overrides on config (GH: #1507)
    - docs: add entry for uploading new version to ppa
    - esm:
      + add pin never when disabling esm-infra/apps on xenial
      + enable infra when EOL LTS and apps on all LTS (GH: #1558)
    - fips: add notice when installing over old fips
    - fix:
      + add links to ubuntu.com/gcp/aws in messaging when on non-PRO
      + add notice to reboot operation on ua fix
      + do not prompt user for beta services (GH: #1544)
      + notify users if reboot is required  (GH: #1476)
      + update how the expired token logic works
      + wrap output greater than 80 chars (GH: #1487)
    - lib: fix notice handling on reboot script
    - messages
      + provide static message files for use in APT and MOTD
      + update_ua_messages on attach/detach/disable
    - mypy: add lib/ dir for coverage
    - status: do not remove notices on non-root call (GH: #1518)
    - subp: separate % format strings when logging (GH: #1520)
    - systemd: add ua-messaging.timer to update ua MOTD and APT msgs
    - update-motd.d: add conditional hooks for motd to source ua messages
    - util: add is_lts and is_active_esm funtions to support ESM
    - test
      + add integration tests asserting esm-apps setup due to postinst
      + manual test script for xenial upgrade
      + trusty and xenial infra and apps disabled in pkg install
    - behave: use unaltered cloud images unsetting UACLIENT_BEHAVE_PPA
    - jenkins: make lint and style stage run sequentially
  * d/*: prefix all the debhelper conf files with the package name
  * d/control:
    - add Rules-Requires-Root: no
    - bump Standards-Version to 4.5.1
    - make ubuntu-advantage-pro Architecture: all
  * d/lintian-overrides:
    - override maintainer-script-calls-service
    - package-supports-alternative-init-but-no-init.d-script
  * d/postinst: move the u-a-pro note to a config script
  * d/ubuntu-advantage-tools.templates: suggest the use of apt
  * New upstream release 27.0~beta:
    - apt: add retry for apt-helper command (GH: #1431)
    - cli: drop subcommand repeated help output, fix enable & refresh
      (GH: #1440)
    - config:
      + allow parsing yaml delivered from env values
      + environment variable support for feature overrides (GH: #1395)
      + create config to add extra params to security url
    - docs:
      + add ppas and fix typos
      + use Ubuntu Pro not Ubuntu PRO
      + add stop "." punctuation to messages (GH: #1320)
    - fips: fix FIPS message when disable operation fails
    - fix:
      + add basic UASecurityClient to which queries CVE and USNs
      + add security_url to config
      + check if service is enabled during ua fix (GH: #1462)
      + closer representation of cve and usn responses
      + filter usns by cve details (GH: #1470)
      + fix regex to be more permissive and strict
      + get_cve_affected_source_packages_status won't list not-affected
        (GH: #1467)
      + handle other package status when running ua fix (GH: #1435)
      + improve error message for ua fix (GH: #1420)
      + install pkg fixes when they are on standard pocket (GH: #1401)
      + move timeout and retries to security client only
      + only prompt for subscription attach for UA-related pkg updates
      + parse all related USNS to a given CVE when fixing
      + parse full API responses for related CVEs and USNs
      + prefer USN.release_packages binary pkg versions to CVE src ver
        (GH: #1436)
      + prompt for new ua token when expired one is used (GH: #1475)
      + prompt to emit pro suggestion on pro_clouds if unattached (GH: #1386)
      + prompt to enable service during ua fix (GH: #1455)
      + provide related CVE URLs instead of USNs (GH: #1456)
      + raise errors when source_link is null or unexpected format
      + show packages that were not fixed in the output
      + update output for released packages in ua fix (GH: #1438)
      + update message for invalid issue in ua fix (GH: #1433)
      + use pocket values from USNs (GH: #1439)
    - logs: emit error response on API errors and redact sensitive logs
      (GH: #1424)
    - serviceclient: add 10 second timeout and two retries to API calls
      (GH: #1374)
    - util:
      + add error prompts on invalid selection
      + add timeout to readurl
    - tests:
      + Add disable_auto_attach config to all test PRO vms
      + add merge_usn_released_binary_package_versions tests
      + add unittest coverage for override_usn_release_package_status
      + drop traceback checks on fips integration tests
      + refactor integration tests for ua fix cmd
      + run status wait before detach in PRO tests
      + use ssh to run commands on lxd containers
    - jenkins: archiveArtifacts can only reference paths within workspace
  * d/control: add new debianutils dependency
  * New upstream release 26.3
    - util: improve is_container check for chroot
    - cli: pass assume_yes param to services on detach (GH: #1530)
  * Drop dh-systemd build dependency.
  * status: show beta services in status if enabled (GH: #1410)
  *  New upstream release 26.1
     - contract: block detach call to contract if machine-id change
     - docs: add readme docs about mastering clean golden images
     - fips: add reboot notices for fips operations (GH: #1368)
     - livepatch: add retry when running canonical-livepatch status
       (GH: #1360)
     - util: use lru_cache to avoid re-reading os-release and machine-id
       (GH: #1329)
     - tests:
       + add disable_auto_attach config to all test PRO vms
       + add more log artifacts during failed integration test
       + check cloudinit status after launching image
       + mock leaking livepatch.application_status for fips test
       + retry package installs on apt exit 100
     - jenkins: parameterize build stages to avoid parallel job collision
  * auto-attach: fix comparing numeric iid
  * New upstream release 26.0:
    - auto-attach: systemd unit to run before ua-reboot-cmds.service
    - config: remove_notice should remove notices.json when empty
    - fips:
      + add notice if running a deactivated FIPS kernel (GH: #1348)
      + block enabling FIPS on clouds using Xenial
      + block enabling fips on GCP instances
      + check /proc/sys/crypto/fips_enable to see if fips is enabled
      + override fips metapackage when on bionic cloud
      + update metapackage override logic on fips
    - notices: clear lock file and notice when encountering any exception
      (GH: #1326)
    - reboot_cmds: retry on lock held errors due to pro auto-attach
    - services: allow uaclient to disable services during enable
    - status: include beta services in json formatted output with --all
      (GH: #1341)
    - tests:
      + add FIPS tests to AWS and Azure bionic images
      + add GCP pro test for focal machine
      + add after_step collection of artifacts on failure
      + remove proc file check after disabling fips
      + pro: block auto-attach with cloud-config bootcmd
      + add validation of systemd unit ua-reboot-cmds.service
      + test enabling fips-updates when fips is enabled
    - jenkins:
      - add deb build stage to assert package builds
      - use series-specific sbuild --build-dir avoid races
      - use --append-to-version for each sbuild run to avoid races
      - presume success when no integration artifacts created
  * d/rules:
    - add --with systemd to allow reboot init script
    - do not remove lib/systemd/system folder
  * d/postinst:
    - create marker file when reboot script need to run:
      - enable livepatch across trusty to xenial upgrade
      - update fips on existing fips pro machines
  * New upstream release 26.0~beta:
    - gcp: add Google Cloud Platform support (GH #1269)
    - fips:
      + remove is_beta from fips sevices
      + fips pro: add upgrade support to require reboot to unmark held fips pkgs
      + update origin UbuntuFIPSUpdates
    - status:
      + add notice to tabular output
      + held locks emit notice about Operation in progress
    - cli: help sort output so trusty ordering matches xenial++
    - cis: rename service from cis-audit
    - config: provide config notices and add_notice and remove_notice methods
    - contract: add resource-machine-access route and datapath
    - init: add init script to run commands on reboot
    - keys: add ubuntu-advantage-cis keyring
    - livepatch: make livepatch react to enableByDefault delta
    - log: log when we install pkgs because of contract delta
    - make: drop six testdeps target
    - pro: do not install pro debs on non-pro instances
    - services: Update beta info for services (GH #1220)
    - tools: add tox-lxd-runner, that execute the test command in a shell
    - tools: refresh-keyrings handles cis keys. drop series-specific keys
    - tests:
      + add GCE support for integration tests
      + add cis integration tests for unattached and pro
      + add pytest constraint for mypy tests
      + add unittests for reboot_cmds script
      + fix esm package messages for new update notifier version
      + pin importlib-metadata for mypy tests
      + repo tests for request_resource_machine_access
      + unit tests for config cache clearing and machine-access data
    - jenkins:
      + add basic Jenkinsfile for CI runs per PR
      + add jenkins parseable test results
      + add lxc cleanup stage on Jenkinsfile
  * Release version 25.0
  * New upstream release 25.0~beta3:
    - upgrade-lts-conract: noop during do-release-upgrade on unattached
      (GH: #1255)
    - ua-auto-attach: order systemd unit before cloud-config.service
    - Update FIPSUpdates pin origin
    - fips: unmark held fips packages for ubuntu pro fips image support
      (GH: #1109)
    - repo: handle changes to additionalPackages contract deltas
    - repo: move package installation to install_packages method
    - pro: trigger auto-attach as soon as instance-data.json is available
      (GH: #1234)
    - Conditionally install packages when enabling FIPS
    - fips: allow disable (GH: #1168)
    - cli: add trailing newline to argparse errors (GH: #1236)
    - Install fips metapacking when enabling service
    - integration test improvements:
      + upgrade-test: fix upgrade path restart failures on trusty (GH: #1257)
      + Fix integration test setup scripts (GH: #1253)
      + strict checking for command success on behave
      + Update tests to use new pycloudlib LXD abstraction
      + Add upgrade scenario tests when FIPS is enabled
      + Improve FIPS tests for checking packages
      + Update esm-infra xenial lxd test
      + Fix vm tests as esm-apps is beta service
      + Fix azure generic integration testing
      + Update esm-apps check on staging_commands tests
      + Install pycloudlib for azure jobs only
      + Fix shell condition in run_azure_travis_integration_tests.sh
      + Update azure jobs on travis
      + Update travis url in README
      + Update travis scripts to use ppa only on master
      + Fix cron event type check on travis yaml
  * New upstream release 25.0~beta2:
    - help: update esm-infra help text (GH: #1212)
    - apt-hook: update apt cli messaging for UA Infra: ESM and UA Apps: ESM
      product names
    - help: update fips help docs (GH: #1213)
    - help: revert CIS help doc URL (GH: #1211)
    - help: add new fips help URLs to CLI help docs (GH: #1210)
    - Show error when enabling service with invalid repo [Lucas Moura]
      (GH: #954)
    - Update beta info for services (#1220) [Lucas Moura] (GH: #1216)
    - Do not enable fips when fips-updates is active [Lucas Moura] (GH: #1209)
    - Add vm test commands in tox.ini (#1204) [Lucas Moura]
  * Beta bug fix release
    - status: fix missing description_override key after upgrade from
      trusty (GH: #1201)
    - During contract delta processing use _check_application_status_on_cache
      instead of live service status
  * d/control:
    - add po-debconf dependency and fix lintian not-using-po-debconf and
      untranslatable-debconf-templates
    - add ${misc:Depends} dep to ubuntu-advantage-pro to fix lintian
      debhelper-but-no-misc-depends (GH: #1024)
  * d/rules:
    - drop --with systemd fix build-depends-on-obsolete-package
    - set fix lintian warning extra:Depends even if empty
  * d/postrm
    - Add more gpg keys to be deleted in postrm for Xenial+ support
  * d/postinst:
    - do not unconfigure non-trusty esm. no series in apt filenames (GH: #1170)
    - check if esm is already enabled (GH: #1095)
  * New upstream release 25.0:
    - Do not uninstall additionalPackages or livepatch when disabling services
    - check for issubclass on clean_apt_files
    - Add do-release-upgrade support for esm-infra and apps suites (GH: #1169)
    - Apply contract deltas during do-release-upgrade operations
    - cli: add ua help command
    - cli: status add blocking --wait param and lock files for config change
    - Fix livepatch behaviour on aws pro focal machine
    - travis: drop inapplicable workspaces from specific awsgeneric release
      jobs
    - Add possible reboot text after enabling/disabling services
    - apt-hook: package apt-hook and apt configuration files on all releases
      (GH: #1150)
    - Fix enable fail bug
    - Add uaclient.conf override mechanism for auto-attach, beta services and
      machine-token
    - Support ESM Apps [Brian Murray] (GH: #930)
    - Do not enable services if blocking services is active (GH: #1029)
    - contract: handle 401 on invalid token, 403 on expired (GH: #1335)
    - Hide beta services from default status output and enable/disable
      operations (GH: #1079) (GH: #1091)
    - fips: force apt noninteractive prompts during package installs
      (GH: #1084)
    - tests: add unit tests for aws-gov/aws-china cloud detection
    - Add AWS China and GovCloud partitions [Robert Jennings]
    - Disable beta services to be show/enabled without flag
    - Add missing build_pr command to environment
    - Use additionalPackages from service payload
    - Add integration testing for Travis runs [patriciadomin] (GH: #856)
      (GH: #857)  (GH: #853)
  * New bug-fix-only release 24.4:
    - uaclient.version bump to 24.4
    - fips: honor additionalPackage directive from contract for bionic
      (GH #1173)
  * New bug-fix-only release 24.3:
    - uaclient.version bump to 24.3
    - fips: add conditional reboot message only if /var/run/reboot-required is
      present
    - fips: add apt repo key for FIPS and FIPS updates (GH #1026)
  * New bug-fix-only release 24.2:
    - uaclient.version bump to 24.2
    - pro: Add AWS China and GovCloud partitions support (GH #1077)
  * New bug-fix-only release 24.1:
    - livepatch: run snap wait system snap.seeded before trying to install
      (GH: #1049)
    - version: return debian/changelog version when git describe fails to
      match upstream <major>.<minor> tags for git-ubuntu workflow
      (GH: #1058)
  * bump version to 24.0 for new versioninig scheme
  * New upstream release 20.3:
    - ubuntu-pro: automatically reattach across instance id delta
      (LP: #1867573)
    - integration testing:
      + add behave tests ua subcommands for attached vm
      + add invalid token tests
      + add reuse_container test docs
      + refactor token parameter
  * d/templates: add a debconf note on upgrade from pre-ubuntu pro package
  * d/control: create a separate ubuntu-advantage-pro package which
      delivers the tooling and scripts necessary to auto-attach pro machines
      This change breaks/replaces ubuntu-advantage-tools <= 20.1
  * d/maintscript: rm_conffile /etc/init/ua-auto-attach.conf from ua-tools pkg
  * d/postint: remove stale systemd symlinks which have migrated to ubuntu-pro
  * d/rules: only install the apt hook on trusty
  * d/rules: provide --no-start to debhelper to avoid auto-attach on pkg install
  * Release 20.2:
    - ubuntu-pro:
      + azure: fix detection of DatasourceAzureNet as azure on trusty
      + generalize identity_doc to return dict instead of string
      + auto-attach: any 4XX errors during auto-attach are the result of non-Pro
      + auto-attach: handle 403 errors raised by contract server for invalid vms
    - attach: persist any status config changes after attach failures
    - output: add messaging using a different subscription if attached
  * Release 20.1:
    - azure-pro, support for azure ubuntu pro auto-attach:
      + add azure auto-attach instance as valid cloud_instance_factory
      + add azure cloud instance module and tests
      + generalize request_aws_contract_token for multiple cloud_types
      + contract: request_auto_attach_contract_token takes an instance param
    - constraints: add constraint on pyyaml version in trusty
    - auto-attach: move duplicate invalid cloud_type check out of cli
  * d/postinst: only configure ESM on supported architectures (LP: #1851858)
      [Andreas Hasenack]
  * d/postinst: rename existing ubuntu-esm-precise.list file to trusty.
    This fixes the upgrade path from precise to trusty and to this client
    while esm is enabled (LP: #1850672)
  * Release 19.7:
    - aws: handle missing SYS_HYPERVISOR_PRODUCT_UUID
    - aws-pro: support for aws ubuntu pro auto-attach
    - pro: add cloud identity module and fix unit tests
    - pro: update systemd service and upstart boot scripts to auto-attach
    - pro: esm do not do apt pin never on disable on xenial or bionic
    - pro: esm-apps has origin UbuntuESMApps and esm-infra is UbuntuESM
    - status: dynamic status available now from refreshed machine-token
    - uaclient: update customer visible messages after UX review
    - esm-apps: allow unattended security upgrades for esm-apps
    - systemd: needs WantedBy=multi-user.target to get pulled into boot
    - cli: update docstring to describe errors raised from auto-attach
    - keyrings: update ubuntu-advantage-esm-apps.gpg with correct key
    - repo: match strict repo url in apt-policy to avoid esm substring matches
    - esm: don't disable_apt_auth_only for ESM entitlements
    - initial implementation of esm-apps
    - repo: don't raise exception in application_status if aptURL missing
    - entitlements: rely solely on contract server for repo_url
    - cli: exit 0 if already attached
    - cli: use decorators for action_attach and action_attach_premium
    - cli: add assert_not_attached decorator
    - status: custom descriptions for n/a service status
  * New upstream release. Main changes:
    - drop SSO interactive login support
    - d/control: no longer depend on pymacaroons, which was only needed for
      the SSO interactive login support
    - drop keyrings for services not supported in trusty: cc-eal, fips,
      fips-updates, cis audit
    - make sure /var/lib/ubuntu-advantage/private has 0700 perms
    - rename esm to esm-infra. Also handle upgrades
    - don't unecessarily remove config files that are already handled by dpkg
    - expand the apt related runtime dependencies
    - handle sources.list.d esm snippet when release upgrading from precise
    - ua status now reports availability of services even in unattached state
    - the "ua status" output was changed, including the json format option
    - drop "ua status" call in postinst as it now requires internet access and
      that is restricted in LP builders and test runners.
    - fix the d/t/usage DEP8 test that was also using status
  * d/t/usage: fix dep8 test ("entitlements" was renamed to "services")
  * New upstream release (LP: #1832757):
    - packaging:
      + d/control: depend on libapt-pkg<ABI_VERSION> to use pin-priority never
      + d/postinst: adjust logfile permissions
      + d/postinst: remove public files and generate status cache on upgrade
      + d/postinst: Remove the old CACHE_DIR in postinst
      + d/postrm: remove log files on package purge
      + d/postrm: remove the ESM pinning file on purge
      + trusty should remove v1 esm key if present after upgrade
      + keyrings: regenerate keyrings on a trusty host
      + refresh keyrings to match current production for fips and cc-eal
    - apt:
      + all repo entitlements now call apt-get update on enable
      + enable -updates if -updates from the Ubuntu archive is enabled
      + Add basic i18n (good enough for lang packs)
      + retry apt install and update commands 3 times simple backoff
      + write commented -updates lines instead of omitting them
    - attach/detach:
      + added --no-auto-enable option
      + suppress messages from inapplicable default entitlements
      + two-factor auth reprompt only two-factor auth on failed 2fa
      + honour enableByDefault obligations from contract server
      + livepatch: no auto-enable on attach for trusty
      + don't attempt to disable inapplicable entitlements during detach
      + check for root before checking for attach in assert_attached_root
    - status:
      + add --json cli formatting option
      + emit a SERVICE header in status output
      + redact technical support and expiry for free contracts
      + unentitled services will report n/a
    - cc-eal:
      + add a warning about download size before install
      + change cc to cc-eal in docs, parameters and commandline help
    - esm:
      + add esm-v2 gpg keyring, drop old keyring, ignore aptKey directive
      + and livepatch auto enabled on attach where supported
      + on upgrade do not install preferences to pin never if esm enabled
      + remove only the apt auth entry on disable, leaving sources.list
      + use Pin-Priority never apt preference file to disable esm initially
    - fips:
      + display as pending when linux-fips is not the running kernel
      + only install/upgrade optional packages that are already on the system
    - logs:
      + no longer redact secrets as logfile is root read-only
      + separate console log devel from logfile level
      + remove level from messages to the console
    - add subcommand to refresh all contract details
    - config: allow contract_url and sso_auth_url to have a trailing slash
    - docker: fix persisting generated uuid on images without machine-id files
    - environ: allow lowercase ua_<config_option> overrides
    - repo: un-comment ESM sources.list lines on repo disable
    - updated manpage and help docs
  * apt-hook: Add missing headers for APT 1.9
  * Drop the self-test assert in the apt-hook, it's making the subiquity
    server install fail (LP: #1824523)
  * apt-hook: Do not crash/fail if we can't read /proc/self/status
    (LP: #1824523)
  * Ubuntu Advantage Tools rewrite in Python (LP: #1814157):
    - Allow attaching a system to a contract or account
    - More complete status output, dropping MOTD updates
    - Easily enable and disable services offered
  * Have ua status cope with the additional livepatch of running a kernel
    that is not supported for livepatches.
  * Have an option for enable-livepatch to install a compatible kernel if
    needed.
  [ Vineetha Kamath ]
  * Add support to common criteria EAL2 artifacts installation #144
  * New upstream release
    - added enable-fips-updates command. This command enables the fips-updates
      repository to install updates to FIPS modules. The updated modules from
      fips-updates repository are non-certified.
  * d/t/update-motd-run: fix path to the esm motd (LP: #1757490)
  * Rename motd scripts so they are shown a bit earlier (LP: #1757171)
  * Move empty line placement in the livepatch motd to the beginning of the
    message to avoid double blank lines.
  * New upstream release:
    - repositories are only added after credentials are verified
      (LP: #1730361)
    - Livepatch MOTD script (LP: #1710976)
    - better "status" command output formatting (LP: #1719034)
    - sources.list.d files no longer contain credentials. The "auth.conf"
      facility is used instead. (LP: #1700611)
    - enabled Livepatch support for Bionic 18.04 LTS
  * New upstream release:
    - run tests during package build
  * New upstream release:
    - revert the latest name changes
    - instead of "advantage", add a "ua" symlink pointing at the
      ubuntu-advantage script. Likewise for its manpage. (LP: #1721272)
  * New upstream release:
    - rename the ubuntu-advantage script to advantage, including where it's
      mentioned in the documentation. Also provide symlinks pointing at the
      previous name. (LP: #1721272)
    - slightly reword some of the FIPS messages
  * New upstream release with FIPS support (LP: #1718291)
  * New upstream release:
    - call apt-get with the non-interactive frontend variable set, and tell
      dpkg to keep the old config file by default should there be any prompts
      about that. (LP: #1715012)
    - split the one big test file into multiple smaller files, for better
      maintainability.
  * Release to artful (LP: #1711369)
  * d/control: update package description
  * New release version 6. Main changes:
    - document return codes on the manpage (Fixes: #33)
    - new status command (Fixes: #40)
    - restrict esm to precise only (Fixes: #43)
    - drop the livepatch motd update, only esm has motd output now
      (Fixes: #44)
    - skip tests during package building (Fixes #49)
  * Only display apt output in the case of errors (Fixes #34).
  * Check running kernel version before enabling the Livepatch service
    (Fixes #30).
  * Add livepatch support:
    - New commands:
      + enable-livepatch
      + disable-livepatch
      + is-livepatch-enabled
    - new tests
    - new manpage
    - new help output
    - new README.md
    - new MOTD
  * ubuntu-advantage & /etc/update-motd.d/99-esm now build, run and are quiet
    on non-precise release. (LP: #1686183)
  * Add simple dep8 tests.
  * Also install ca-certificates (LP: #1690270)
  * Initial Release. LP: #1686183
==== ubuntu-release-upgrader: 1:22.04.15 => 1:22.04.16 ====
====     python3-distupgrade ubuntu-release-upgrader-core
  * Run pre-build.sh: updating mirrors and translations for 22.04.2.

--
[1] http://cloud-images.ubuntu.com/releases/jammy/release-20230302/
[2] http://cloud-images.ubuntu.com/releases/jammy/release-20230210/