ubuntu-advantage-tools (19.7ubuntu0.1) trusty-security; urgency=medium

  * SECURITY UPDATE: Information disclosure
    - Remove credentials out of argv into apt's own auth.conf.d facility.
    - CVE-2026-9494
  * SECURITY UPDATE: Improper input validation
    - enforce StrictStringDataValue to applicable fields in directives
    - reject newline, carriage return, spaces, and shell meta characters
      in StrictStringDataValue
    - CVE-2026-11386

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Tue, 07 Jul 2026 18:28:29 +0200

ubuntu-advantage-tools (19.7) trusty; urgency=medium

  * Add support to new esm-infra-legacy service (LP: #2060566)

 -- Lucas Moura <lucas.moura@canonical.com>  Thu, 28 Mar 2024 14:43:22 -0300

ubuntu-advantage-tools (19.6~ubuntu14.04.4) trusty; urgency=medium

  * d/postinst: only configure ESM on supported architectures (LP: #1851858)

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 14 Nov 2019 14:34:50 -0300

ubuntu-advantage-tools (19.6~ubuntu14.04.3) trusty; urgency=medium

  * d/postinst: rename existing ubuntu-esm-precise.list file to trusty.
    This fixes the upgrade path from precise to trusty and to this client
    while esm is enabled (LP: #1850672)

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 30 Oct 2019 10:01:58 -0300

ubuntu-advantage-tools (19.6~ubuntu14.04.2) trusty; urgency=medium

  * d/control, d/rules: don't run flake8 tests since python3-flake8 is in
    universe (LP: #1849851)

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 25 Oct 2019 11:37:31 -0300

ubuntu-advantage-tools (19.6~ubuntu14.04.1) trusty; urgency=medium

  * New upstream release (LP: #1832757). Main changes:
    - drop SSO interactive login support
    - d/control: no longer depend on pymacaroons, which was only needed for
      the SSO interactive login support
    - drop keyrings for services not supported in trusty: cc-eal, fips,
      fips-updates, cis audit
    - make sure /var/lib/ubuntu-advantage/private has 0700 perms
    - rename esm to esm-infra. Also handle upgrades
    - don't unecessarily remove config files that are already handled by dpkg
    - expand the apt related runtime dependencies
    - handle sources.list.d esm snippet when release upgrading from precise
    - ua status now reports availability of services even in unattached state
    - the "ua status" output was changed, including the json format option
    - drop "ua status" call in postinst as it now requires internet access and
      that is restricted in LP builders and test runners.
    - fix the d/t/usage DEP8 test that was also using status

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 23 Oct 2019 13:12:08 -0300

ubuntu-advantage-tools (19.5.1) eoan; urgency=medium

  * d/t/usage: fix dep8 test ("entitlements" was renamed to "services")

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 03 Jul 2019 21:55:25 -0300

ubuntu-advantage-tools (19.5) eoan; urgency=medium

  * New upstream release (LP: #1832757):
    - packaging:
      + d/control: depend on libapt-pkg<ABI_VERSION> to use pin-priority never
      + d/postinst: adjust logfile permissions
      + d/postinst: remove public files and generate status cache on upgrade
      + d/postinst: Remove the old CACHE_DIR in postinst
      + d/postrm: remove log files on package purge
      + d/postrm: remove the ESM pinning file on purge
      + trusty should remove v1 esm key if present after upgrade
      + keyrings: regenerate keyrings on a trusty host
      + refresh keyrings to match current production for fips and cc-eal
    - apt:
      + all repo entitlements now call apt-get update on enable
      + enable -updates if -updates from the Ubuntu archive is enabled
      + Add basic i18n (good enough for lang packs)
      + retry apt install and update commands 3 times simple backoff
      + write commented -updates lines instead of omitting them
    - attach/detach:
      + added --no-auto-enable option
      + suppress messages from inapplicable default entitlements
      + two-factor auth reprompt only two-factor auth on failed 2fa
      + honour enableByDefault obligations from contract server
      + livepatch: no auto-enable on attach for trusty
      + don't attempt to disable inapplicable entitlements during detach
      + check for root before checking for attach in assert_attached_root
    - status:
      + add --json cli formatting option
      + emit a SERVICE header in status output
      + redact technical support and expiry for free contracts
      + unentitled services will report n/a
    - cc-eal:
      + add a warning about download size before install
      + change cc to cc-eal in docs, parameters and commandline help
    - esm:
      + add esm-v2 gpg keyring, drop old keyring, ignore aptKey directive
      + and livepatch auto enabled on attach where supported
      + on upgrade do not install preferences to pin never if esm enabled
      + remove only the apt auth entry on disable, leaving sources.list
      + use Pin-Priority never apt preference file to disable esm initially
    - fips:
      + display as pending when linux-fips is not the running kernel
      + only install/upgrade optional packages that are already on the system
    - logs:
      + no longer redact secrets as logfile is root read-only
      + separate console log devel from logfile level
      + remove level from messages to the console
    - add subcommand to refresh all contract details
    - config: allow contract_url and sso_auth_url to have a trailing slash
    - docker: fix persisting generated uuid on images without machine-id files
    - environ: allow lowercase ua_<config_option> overrides
    - repo: un-comment ESM sources.list lines on repo disable
    - updated manpage and help docs

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 03 Jul 2019 15:55:11 -0300

ubuntu-advantage-tools (19.4.1) eoan; urgency=medium

  * apt-hook: Add missing headers for APT 1.9

 -- Andreas Hasenack <andreas@canonical.com>  Tue, 18 Jun 2019 18:21:19 -0300

ubuntu-advantage-tools (19.4) disco; urgency=medium

  * Drop the self-test assert in the apt-hook, it's making the subiquity
    server install fail (LP: #1824523)

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 12 Apr 2019 17:59:16 -0300

# For older changelog entries, run 'apt-get changelog ubuntu-advantage-tools'
