FFe: Move fwupd to zstd instead of xz

[Mario Limonciello]

Fwupd 1.9.16 has added support to get metadata from LVFS using ZSTD format instead of of XZ format.

In light of CVE-2024-3094 and Ubuntu 24.04 being an LTS I wanted to discuss considering an upgrade to fwupd 1.9.16 to make fwupd not use xz by default.

Also; there are a number of bug fixes in this release that I believe are worth pulling in before Ubuntu 24.04 releases.

[Mario Limonciello (superm1)]

Packages staged for testing here:
https://launchpad.net/~superm1/+archive/ubuntu/lp2060143

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Mario Limonciello (superm1)]

Here is the changelog for fwupd 1.9.16:

This release adds the following features:

Prefer zstd over xz for metadata
Relicense a few remaining plugin files to LGPL-2.1+

This release fixes the following bugs:

Correctly record UEFI success if adding ESRT nodes
Defer the DP Aux MST scanning on hotplug to workaround a kernel bug
Do not do the post-update version check if the device needs-reboot
Fix a fastboot warning when loading device
Fix a possible warning in fwupdmgr when excluding releases
Fix a qsi-dock warning when writing chunks
Ignore attribute-changed to work around a regression in macOS
Ignore ZFS zvols when finding the default ESP
Mark Pluton TPMs as part of the main CPU
Put the fwupd-efi verbose debugging in the journal
Recognize zfsbootmenu in ESP detection heuristic

This release adds support for the following hardware:

Acer T34 and U33 docks
Qualcomm Series 5 Gen 1 and Gen 2 and Series 3 Gen 1 and Gen 2 devices
Several Puya SPI chips
VIA VL822 C0

[Mario Limonciello (superm1)]

Here is the diff:

https://launchpadlibrarian.net/723307725/fwupd_1.9.15-2_1.9.16-1~noble1.diff.gz

[Mario Limonciello (superm1)]

Here is the testing from the PPA. I installed fwupd-tests and then ran below.

$ fwupdmgr --version
compile com.hughsie.libxmlb 0.3.17
compile com.hughsie.libjcat 0.2.0
compile org.freedesktop.fwupd 1.9.16
runtime org.freedesktop.fwupd-efi 1.4
compile org.freedesktop.gusb 0.4.8
runtime com.hughsie.libjcat 0.2.0
runtime org.freedesktop.gusb 0.4.8
runtime org.freedesktop.fwupd 1.9.16

$ sudo fwupdtool enable-test-devices
Loading… [************************************** ]
Successfully enabled test devices
$ sudo systemctl restart fwupd

$ fwupdmgr get-updates
Firmware metadata has not been updated for 30 days and may not be up to date.
Update now? (Requires internet connection) [y|N]: y
Updating lvfs
Downloading… [************************************** ]
Successfully downloaded new metadata: 3 local devices supported
Devices with no available firmware updates:
 • WD PC SN740 SDDPNQD-256G
Devices with the latest available firmware version:
 • Fingerprint Sensor
 • System Firmware
Framework Laptop 13 (AMD Ryzen 7040Series)
│
└─Integrated Webcam™:
  │ Device ID: 08d460be0f1f9f128413f816022a6439e0078018
  │ Summary: Fake webcam
  │ Current version: 1.2.2
  │ Minimum Version: 1.2.0
  │ Bootloader Version: 0.1.2
  │ Vendor: ACME Corp. (USB:0x046D)
  │ GUID: b585990a-003e-5270-89d5-3705a17f9a43
  │ Device Flags: • Updatable
  │ • System requires external power source
  │ • Supported on remote server
  │ • Cryptographic hash verification is available
  │ • Unsigned Payload
  │ Device Requests: • Message
  │
  └─FakeDevice Device Update:
        New version: 1.2.4
        Remote ID: lvfs
        Release ID: 81488
        Summary: Firmware for the ACME Corp Integrated Webcam
        License: GPL-2.0+
        Size: 10 bytes
        Created: 2024-01-21
        Urgency: Medium
        Tested by Google:
          Tested: 2024-03-09
          Distribution: chromeos 124
          Old version: 1.2.2
          Version[fwupd]: 1.9.13
        Source: https://github.com/fwupd/fwupd/tree/main/data/installed-tests
        Vendor: LVFS
        Release Flags: • Trusted metadata
                          • Is upgrade
        Description:
        Fixes another bug with the flux capacitor to prevent time going backwards.
        Checksum: a92d4f433e925ea8e4a10d25dfa58e64ba1e68d07ee963605a2ccbaa2e3185aa

$ fwupdmgr update
Devices with no available firmware updates:
 • WD PC SN740 SDDPNQD-256G
Devices with the latest available firmware version:
 • Fingerprint Sensor
╔══════════════════════════════════════════════════════════════════════════════╗
║ Upgrade Integrated Webcam™ from 1.2.2 to 1.2.4? ║
╠══════════════════════════════════════════════════════════════════════════════╣
║ Fixes another bug with the flux capacitor to prevent time going backwards....

[Mario Limonciello (superm1)]

I also attempted to do testing with firmware-updater snap. This is the version I tested with:

installed: 0+git.90251bb (121) 11MB -

I had no problems enumerating devices.

I however did run into two problems:
1) I couldn't reinstall the test firmware. This is not a new bug and was present previously, it's been reported back in February to the firmware-updater project.
https://github.com/canonical/firmware-updater/issues/264

2) I couldn't install firmware from a remote requiring authentication. This is not a new bug and was present previously, it's been reported last week to the firmware-updater project.
https://github.com/canonical/firmware-updater/issues/274

[Mario Limonciello (superm1)]

So I tried the same in the (apt version) of gnome-firmware. No problems reinstalling firmware there.

[Mario Limonciello (superm1)]

Actually Jeremy copied it over from Debian already, closing bug.