[Bug 1961864] Re: fwupd daemon failed to verify firmware signature

[Łukasz Zemczak]

Hello Crag, or anyone else affected,

Accepted libjcat into impish-proposed. The package will build now and be
available at
https://launchpad.net/ubuntu/+source/libjcat/0.1.4-0ubuntu0.21.10.1 in a
few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, what testing has been
performed on the package and change the tag from verification-needed-
impish to verification-done-impish. If it does not fix the bug for you,
please add a comment stating that, and change the tag to verification-
failed-impish. In either case, without details of your testing we will
not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: libjcat (Ubuntu Impish)
       Status: Triaged => Fix Committed

** Tags added: verification-needed verification-needed-impish

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to libjcat in Ubuntu.
https://bugs.launchpad.net/bugs/1961864

Title:
  fwupd daemon failed to verify firmware signature

Status in OEM Priority Project:
  In Progress
Status in fwupd package in Ubuntu:
  Invalid
Status in libjcat package in Ubuntu:
  Fix Released
Status in fwupd source package in Focal:
  Invalid
Status in libjcat source package in Focal:
  Fix Committed
Status in fwupd source package in Impish:
  Invalid
Status in libjcat source package in Impish:
  Fix Committed
Status in fwupd source package in Jammy:
  Invalid
Status in libjcat source package in Jammy:
  Fix Released

Bug description:
  We are going to SRU fwupd 1.7.5 to impish and focal to fix bug LP: #1949412. With update fwupd, the default config set OnlyTrusted=true
  With that, we need update libjcat.

  [Impact]

  need to update libjcat so the recent firmware from lvfs could be installed
  by fwupd.

  [Test Plan]
  Will use fwupd SRU exception test plan to do those testing.
  IHV vendor will also contribute by testing recent firmware that
  can't be install without upgrade libjcat.

  [Where problems could occur]
  fwupd will crash, signature verification will failed and the can't
  install firmware from LVFS.

  Given the test plan in the SRU exception document, plus IHV testing,
  I think those shall be fine.

  [Other Info]
  SRU exception page: https://wiki.ubuntu.com/firmware-updates
  There are several commits between 0.1.3 (current one in focal)
  and 0.1.4 (the target version for this SRU).
  Those non-trivial commits between 0.1.3 and 0.1.4 are:

  https://github.com/hughsie/libjcat/commit/109399e1f28cec84b43c355b2be77bac38943df7
  https://github.com/hughsie/libjcat/commit/583df67e3ee25201f1e1830ae6d92bf846c082a3

  Given they are clean and clear, I think SRU those shall be fine.

  Also, note per:

  https://github.com/fwupd/fwupd/commit/7157ca79e4d6b13d82b0a21f8586b86be0cbb80e

  We do need updated libjcat to support new firmware from LVFS.

  ----

  The firmware blobs in cabinet archive are presently LVFS signed with
  gpg and pkcs7, if libjcat at compilation time without one then the
  blobs signed with both can't be verified.

  The impact is fwupd daemon will fail the firmware install immediately
  because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verify the
  signature for the daemon.

  We need uprev libjcat at least 0.1.4 onward to fix this issue.

  Issue is reproducible with fwupd 1.7.4
  -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174

  $ fwupdmgr --version
  client version:	1.7.4
  compile-time dependency versions
   gusb:	0.3.4

  daemon version: 1.7.4

  $ dpkg -l | grep libjcat
  ii  libjcat1:amd64    0.1.3-2   amd64   JSON catalog library

To manage notifications about this bug go to:
https://bugs.launchpad.net/oem-priority/+bug/1961864/+subscriptions