-
|
Hey everyone, I've been asked to demonstrate how fwupd downloads are signed and validated. There's a jcat manifest in /var/lib/fwupd/metadata/lvfs/metadata.xml.xz.jcat, which references a file firmware.xml.xz, that's nowhere on the system. However, the checksums in the manifest suggest that metadata.xml.xz, in the same directory might be this missing firmware.xml.xz, and in fact, it is: What could be the reason for the actual filename being absent in the manifest? This is on Debian 12: |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 17 replies
-
The firmware.xml.xz is an alias -- i.e. what the file might be called. e.g. see: i.e. fwupd downloads metadata.xml.zst.jcat find the firmware-07437-stable.xml.zst filename, and then saves it as firmware.xml.zst in the cache. The reason we do this is that the cdn might give us a metadata.xml.zst.jcat from yesterday, in which case we want the exact metadata from yesterday -- rather than one 12 h old and one 6 hours old. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the reply! If both the XML and the JCAT file get routinely renamed, wouldn't it make sense to have the other filename embedded in the JCAT as well? Also, another question: How do /etc/pki/fwupd/ and /var/lib/fwupd/gnupg/ relate to each other? Is /var/lib/fwupd/gnupg/ only updated on the fly from /etc/pki/fwupd/ or may it at some later point update keys from a metadata server on the fly? |
Beta Was this translation helpful? Give feedback.
-
|
Aliases do seem to work, but the alias simply isn't there. |
Beta Was this translation helpful? Give feedback.
-
|
So I installed the snap, and packaged with it still is the same unupdated version of libjcat: Is there any way to see a validating signature out of the box, without having to manipulate the JCAT manifest? What makes you so confident the alias is in the JCAT when in fact it isn't? Am I using this wrong? |
Beta Was this translation helpful? Give feedback.
-
You need a new libjcat. Maybe @superm1 can update it in the snap? |
Beta Was this translation helpful? Give feedback.
-
|
It's because we don't have a bigger version in our subproject for 1_9_X. This will bump it. |
Beta Was this translation helpful? Give feedback.
-
|
OK, confirmed the 1_9_X snap build pulled it in: You can switch to the 1.9.x/edge build (1.9.24-4-g4a8c618a6) to pick it up. |
Beta Was this translation helpful? Give feedback.
-
|
Now validate /var/lib/fwupd/metadata/lvfs/metadata.xml.zstd using this manifest. |
Beta Was this translation helpful? Give feedback.
-
|
@superm1 i think the easiest thing to do would be to save the metadata |
Beta Was this translation helpful? Give feedback.
-
|
As long as we keep it in the metadata directory I think that's totally fine |
Beta Was this translation helpful? Give feedback.
-
|
Thanks to the JCAT clarifications in this topic, my corporate client here decided to permit the use of fwupd on a larger number of laptops. Thanks for your work and support. :-) |
Beta Was this translation helpful? Give feedback.
-
|
How about #7721 as a nice ending. :) |
Beta Was this translation helpful? Give feedback.
How about #7721 as a nice ending. :)