FYI: Canonical's bug tracker has a bug in it on launchpad.net, so I'm incapable of posting this bug on their platform. Canonical decided not to provide direct support, so this security flaw is now being released into the wild so they have to do something about it.
Before we begin, I've marked this as a security vulnerability simply because the whole purpose of canonical-livepatch is to keep the system secure, and with this bug, it's incapable of doing so.
All of our machines are reporting an HTTP 400 error when using their respective URL for the live patch service.
The canonical-livepatch tool runs automatically after being configured as per the instructions on the Canonical website. Whenever it runs, it sends us the following error in our alerts.log file from OSSEC.
canonical-livepatch[31251]: during refresh: cannot check: Bad server status code: 400. URL: https://livepatch.canonical.com/api/machine/[REDACTED MACHINE TOKEN] {"details": {"Status.0.Livepatch.State": "\"kernel-upgrade-required\" is not one of applied, apply-failed, unapplied, needs-check, nothing-to-apply, unknown, check-failed"}, "error": "Invalid payload"}
Running an "apt-get update" and then "apt-get-upgrade" does not yield any upgradable Linux kernels. Presumably your software is out of sync with the API server. If that's not the case, please let me know if there's some way for me to fix it on our end.
When I try to do it manually, here's what it says:
$ sudo canonical-livepatch refresh
Before refresh:
kernel: 4.15.0-29.31-generic
fully-patched: false
version: "42.1"
After refresh:
kernel: 4.15.0-29.31-generic
fully-patched: false
version: "42.1"
Here's the config dump:
$ sudo canonical-livepatch config
http-proxy: ""
https-proxy: ""
no-proxy: ""
remote-server: https://livepatch.canonical.com
ca-certs: ""
check-interval: 60 # minutes