Commit Graph

372 Commits

Author SHA1 Message Date
Richard Hughes
8087b2c9e0 trivial: Set the 'downloading' state when starting the download
For small files we might not get progress callbacks and so we stay in IDLE
status forever.

Fixes https://github.com/fwupd/fwupd/issues/2522
2020-10-27 19:36:18 +00:00
Mario Limonciello
c3a8173a12 Show an error when a plugin is missing dependencies (Fixes: #1526)
```
$ sudo mv /usr/lib/x86_64-linux-gnu/libtss2-esys.so.0.0.0 /usr/lib/x86_64-linux-gnu/libtss2-esys.so.0.0.0.renamed
$ sudo fwupdtool get-devices --plugins=uefi
14:15:48:0735 FuEngine             cannot load: failed to open plugin /usr/local/lib/x86_64-linux-gnu/fwupd-plugins-3/libfu_plugin_uefi.so: libtss2-esys.so.0: cannot open shared object file: No such file or directory
Loading…                 [-                                      ]14:15:48:0753 FuEngine             failed to update history database: device ID b6c08fb9e5384d9d101853cc1ca20cf0ce2df2e2 was not found
Loading…                 [***************************************]
WARNING: Plugin depdendencies missing
No detected devices
```
2020-10-20 10:57:21 -05:00
Richard Hughes
7bcb8d4385 Export FwupdPlugin so we can convey enumerated system errors to the end user
For instance, we can tell the user that UEFI UpdateCapsule is disabled in the
system firmware, or that efivarfs is not mounted. This is much better than
creating "dummy" devices which are really just hacks around the problem because
no better API existed. THe dummy devices cause as many problems as they solve.

Plugins have to set FWUPD_PLUGIN_FLAG_USER_WARNING if a warning should be shown
to the user, and only one warning will be shown of each failure type.

It is expected that GUI clients like gnome-software and gnome-firmware would use
this API to notify the user the localized message for why firmware updates are
not being shown.

Fixes https://github.com/fwupd/fwupd/issues/2456
2020-10-13 15:56:49 +01:00
Richard Hughes
f4c206d319 libfwupd: Do not export the HSI AppStream IDs
The clients don't need to know this, and exporting them means we paint-ourselves
into a corner if we want to change the 'namespace' or how HSI actually works.
2020-10-08 16:36:56 +01:00
Richard Hughes
27b399ce27 libfwupd: Actually use the JCat file to select the metadata file
This recent regression was caused when porting libfwupd to the async model.

Fixes https://github.com/fwupd/fwupd/issues/2360
2020-10-07 15:38:08 +01:00
Richard Hughes
6450d0deb4 Add FwupdInstallFlags of _IGNORE_CHECKSUM, _IGNORE_VID_PID and _IGNORE_POWER
The FWUPD_INSTALL_FLAG_FORCE flag has really unclear semantics, and ignoring a
file CRC, checksum or model ID should only be done when using fwupdtool actually
debugging a plugin or firmware parser.

Use the existing --force flag when we want a "gentle nudge" like reuploading
previously processed reports.
2020-10-07 13:15:09 +01:00
Richard Hughes
5bbf013879 Add a --allow-branch-switch to fwupdmgr
This allows us to turn off the tests like version format differences and
checking for downgrades.
2020-10-07 13:15:09 +01:00
Mario Limonciello
2195237f12 trivial: don't show OS release paths checked 2020-10-03 06:58:13 -05:00
Richard Hughes
1a61258239 Allow devices to save the old firmware to disk for recovery
This would also help, for example, to go back to the nonfree firmware when the
alternate firmware did not work as well as hoped. It would also allow flashing
the firmware using an SPI programmer if everything went very wrong indeed.
2020-09-30 18:33:00 +01:00
Richard Hughes
460c4b75fe Add the concept of firmware 'branches'
This allows a device to identify with different streams, for instance a Lenovo
laptop could have a coreboot firmware or a AMI firmware. The GUIDs would be the
same, but switching firmware would only be done rarely and very carefully.

Another example would be switching the Broadcom BCM57xx nework adaptors from the
vendor nonfree firmware with a signed PXE image, to the free software reverse
engineered driver with no PXE support (and thus no signed DXE) at all.

It is expected firmware would have additional metadata something like this:

    ...
    <branch>sdcc</branch>
    <description>
      <p>
        This is an alternate firmware built by the community using only free
        software tools.
      </p>
    </description>
    <requires>
      <id compare="ge" version="1.5.0">org.freedesktop.fwupd</id>
      <client>switch-branch</client>
    </requires>
    ...

Additionally, alternate branch firmware will not be returned for clients not
setting the FWUPD_FEATURE_FLAG_SWITCH_BRANCH before the GetReleases request.
2020-09-30 18:33:00 +01:00
Richard Hughes
6f4f1caca4 trivial: Fix some typos spotted by codespell 2020-09-24 10:48:26 +01:00
mendel5
923d01b840 flag_require_ac: System requires external power source 2020-09-20 12:08:52 -05:00
Mario Limonciello
fbd3508655 trivial: correct some documentation typos 2020-09-17 13:51:59 -05:00
Richard Hughes
7c8a830659 libfwupd: Add async versions of the library for GUI tools
Rather than force the GUI to interact with fwupd using threads, provide
async versions so thay can be run without blocking the UI thread.
2020-09-03 15:46:57 +01:00
Richard Hughes
f0735f4583 trivial: Fix a logic thinko spotted by Coverity 2020-09-01 14:14:02 +01:00
Richard Hughes
ec2fbb054c trivial: Fix a copy paste mistake spotted by Coverity 2020-09-01 13:49:05 +01:00
Richard Hughes
93ba041ce2 trivial: Use @self in FwupdClient to modernize the object 2020-08-27 08:03:16 +01:00
Mario Limonciello
82c3e3471d Remove support for UEFI dbx security attribute
This is no longer relevant as fwupd is providing dbxtool now.
2020-08-19 07:38:51 +01:00
Richard Hughes
fd0ee5153e Add some of the HSI specification to the generated documentation 2020-08-17 20:23:49 +01:00
Daniel Campello
722f532781 fwupd-remote: Download remote firmware on local remote
This changes allows for downloading firmware from a remote server
pointed from a local remote manifest.xml.gz file

Change-Id: Id00870f9c2817d48d6d301d2b6d229ba1ca6045a
2020-08-12 20:09:17 +01:00
Richard Hughes
3120683143 Allow blocking specific firmware releases by checksum
Fixes https://github.com/fwupd/fwupd/issues/2280
2020-08-10 17:14:15 +01:00
Richard Hughes
cad96542e2 Check if CET is actually being used on the runtime system
With thanks to H.J. Lu <hjl.tools@gmail.com> for the initial code.
2020-07-27 15:53:38 +01:00
Richard Hughes
a99b5adfb6 trivial: Export fwupd_client_ensure_networking()
This is required when the calling application needs the low-level soup-session
with the user agent set correctly rather than using the helper methods like
fwupd_client_download_bytes().

This is what GNOME Software needs to handle the GsApp progress completion.
2020-07-23 13:00:39 +01:00
Richard Hughes
30f7ffbdbd pci-mei: Split up the bootguard HSI checks into multiple entries
Additionally, demote the error policy to HSI-3 and do not show the other
failures if BootGuard is disabled.

Fixes https://github.com/fwupd/fwupd/issues/2265
2020-07-20 22:50:31 +01:00
Richard Hughes
474d1442f1 trivial: Use proper AppStream namespacing for HSI attributes 2020-07-20 22:50:31 +01:00
Richard Hughes
9a04ce8f29 msr: Add a new plugin to detect the Intel DCI state 2020-07-16 20:13:06 +01:00
Richard Hughes
f4c55d888e libfwupd: Add fwupd_client_install_release()
This allows us to remove a lot of copy-and-paste code in GNOME Software.
2020-07-09 20:57:00 +01:00
Richard Hughes
02d94d3139 libfwupd: Add fwupd_client_install_bytes()
Sometimes you do not have a filename and just a blob of memory.
2020-07-09 20:57:00 +01:00
Richard Hughes
59f871deda libfwupd: Move GUnixInputStream-creating functions to common code
We'll need to use them from other methods soon.
2020-07-09 20:57:00 +01:00
Richard Hughes
d528571971 libfwupd: Add fwupd_client_refresh_remote()
This takes care of downloading the correct files and allows remotes to be
refreshed from other CLI and GUI tools without copying large chunks of code.

This also allows us to download the metadata without writing two temp files
to the users cache directory. Although not security sensitive, it's probably
not a good idea if we can avoid it.
2020-07-09 20:57:00 +01:00
Richard Hughes
71ba813a71 libfwupd: Add fwupd_client_update_metadata_bytes()
Sometimes the data is coming from a blob of memory and not a cached file, so
use a memfd to create a file descriptor that can be passed to the daemon.
2020-07-09 20:57:00 +01:00
Richard Hughes
9a5bd5e9d7 libfwupd: Split up a function for future new API 2020-07-09 20:57:00 +01:00
Richard Hughes
17da521916 libfwupd: Add fwupd_remote_load_signature_bytes() for when a file is not available 2020-07-09 20:57:00 +01:00
Richard Hughes
9b6d616383 fwupd: Export fwupd_client_download_bytes() into the client library
The logic here is that we can use one central session for all client actions.

Also, set the user agent for the *runtime* version of fwupd -- it's the runtime
version we use when checking capabilities, rather than the built-against
version. This would also explain why there are so many very obsolete versions
of fwupd being recorded on the LVFS...
2020-07-08 19:00:42 +01:00
Richard Hughes
77d0fd31df fwupd: Split out two trivial helpers 2020-07-08 19:00:42 +01:00
Richard Hughes
6269a839eb Add a security attribute for BootGuard
This information is obtained from the MEI configuration space.
2020-07-02 20:25:48 +01:00
Richard Hughes
7b57ce226b libfwupd: Allow storing metadata on the security attr 2020-07-01 20:10:39 +01:00
Richard Hughes
ec2a4b586f trivial: Move some code for future use 2020-07-01 20:10:39 +01:00
Richard Hughes
dc805b41f1 trivial: Remove unused variables 2020-07-01 20:10:39 +01:00
Richard Hughes
85226fd9d1 Remove potentially problematic language
Red Hat wants to drive an initiative in correcting problematic and potentially
divisive language in open source projects. These naming conventions and
descriptive phrases are hurtful and offensive to many of our colleagues across
the open source universe.

See https://www.redhat.com/en/blog/making-open-source-more-inclusive-eradicating-problematic-language
2020-06-30 17:31:17 +01:00
Richard Hughes
df89cd566e Allow firmware to require specific features from front-end clients
At the moment we just blindly assume the capabilities of the front-end client
when installing firmware. We can somewhat work around by requiring a new enough
fwupd daemon version, but the client software may be older or just incomplete.

This would allow, for instance, the firmware to specify that it requries the
client to be able to show a detach image. This would not be set by a command
line tool using FwupdClient, but would be set by a GUI client that is capable
of downloading a URL and showing a PNG image.

Clients that do not register features are assumed to be dumb.
2020-06-27 15:43:57 +01:00
Richard Hughes
4fd4b982ac Support LVFS::UpdateImage in GUI clients
The idea here is that we can show the user both a string and an optional
line-art image when the update has completed. The line art is often more well
understood for non-English speakers.
2020-06-26 12:29:54 +01:00
Richard Hughes
3382fb10d7 trivial: Correctly format the FwupdRelease:created attribute 2020-06-25 22:30:15 +01:00
Richard Hughes
19a60e62bc trivial: Check for the _UNKNOWN enum when mashalling to GVariant 2020-06-17 18:37:27 +01:00
Richard Hughes
0f6d754d5a Detect if the MEI device has known security issues
If it has, fail HSI-1.
2020-06-01 22:49:39 +01:00
Richard Hughes
bb228cbe53 pci-mei: Check the HFS register for the override strap 2020-05-29 17:34:18 +01:00
Mario Limonciello
bb6b1a8693 Revert "amt: Add a security attestation for provisioning"
This reverts commit f160e6b7fc.
2020-05-22 15:13:19 +01:00
Richard Hughes
c821923668 Add an HSI attribute for Intel SMAP
See https://en.wikipedia.org/wiki/Supervisor_Mode_Access_Prevention for details.
2020-05-22 07:26:47 +01:00
Richard Hughes
9bc9debd98 Allow uploading security attributes to the LVFS
We sign the data with the client cert to allow users with LVFS accounts to
publish 'official' HSI ratings.
2020-05-21 11:48:09 +01:00
Richard Hughes
6ecc4ca144 Export the report metadata on the D-Bus interface
This allows the client to easily query metadata to upload with the report,
without exporting rarely used attributes as D-Bus properties on the interface.

It also allows us to add extra metadata values in the future without changing
the public API.
2020-05-20 19:47:53 +01:00