Activity log for bug #1961864

Date Who What changed Old value New value Message
2022-02-23 03:53:42 Crag Wang bug added bug
2022-02-23 04:27:08 Yuan-Chen Cheng bug task added oem-priority
2022-02-23 04:28:58 Yuan-Chen Cheng tags oem-priority
2022-02-23 04:41:20 Yuan-Chen Cheng description The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. Impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted to verifying the signature for daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. Impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verifying the signature for daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions  gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library
2022-02-23 08:17:20 Yuan-Chen Cheng oem-priority: assignee Yuan-Chen Cheng (ycheng-twn)
2022-02-23 08:17:23 Yuan-Chen Cheng oem-priority: importance Undecided Critical
2022-02-23 09:13:13 Yuan-Chen Cheng bug task added libjcat (Ubuntu)
2022-02-23 09:13:34 Yuan-Chen Cheng tags oem-priority focal oem-priority
2022-02-23 10:03:14 Yuan-Chen Cheng oem-priority: status New Triaged
2022-02-23 13:53:12 Mario Limonciello nominated for series Ubuntu Focal
2022-02-23 13:53:12 Mario Limonciello bug task added fwupd (Ubuntu Focal)
2022-02-23 13:53:12 Mario Limonciello bug task added libjcat (Ubuntu Focal)
2022-02-23 13:53:12 Mario Limonciello nominated for series Ubuntu Impish
2022-02-23 13:53:12 Mario Limonciello bug task added fwupd (Ubuntu Impish)
2022-02-23 13:53:12 Mario Limonciello bug task added libjcat (Ubuntu Impish)
2022-02-23 13:53:12 Mario Limonciello nominated for series Ubuntu Jammy
2022-02-23 13:53:12 Mario Limonciello bug task added fwupd (Ubuntu Jammy)
2022-02-23 13:53:12 Mario Limonciello bug task added libjcat (Ubuntu Jammy)
2022-02-23 13:53:20 Mario Limonciello fwupd (Ubuntu Jammy): status New Fix Released
2022-02-23 13:53:24 Mario Limonciello libjcat (Ubuntu Jammy): status New Fix Released
2022-02-23 13:53:28 Mario Limonciello libjcat (Ubuntu Impish): status New Triaged
2022-02-23 13:53:31 Mario Limonciello libjcat (Ubuntu Focal): status New Triaged
2022-02-23 13:53:35 Mario Limonciello fwupd (Ubuntu Impish): status New Triaged
2022-02-23 13:53:39 Mario Limonciello fwupd (Ubuntu Focal): status New Triaged
2022-02-24 05:53:50 Mario Limonciello fwupd (Ubuntu Focal): status Triaged Invalid
2022-02-24 05:53:52 Mario Limonciello fwupd (Ubuntu Impish): status Triaged Invalid
2022-02-24 05:53:55 Mario Limonciello fwupd (Ubuntu Jammy): status Fix Released Invalid
2022-02-24 09:14:56 Yuan-Chen Cheng description The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. Impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verifying the signature for daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions  gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library We are going to SRU fwupd 1.7.5 to impish and focal to fix bug LP: #1949412. With update fwupd, the default config set OnlyTrusted=true With that, we need update libjcat. The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. Impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verifying the signature for daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions  gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library
2022-02-24 09:16:43 Yuan-Chen Cheng description We are going to SRU fwupd 1.7.5 to impish and focal to fix bug LP: #1949412. With update fwupd, the default config set OnlyTrusted=true With that, we need update libjcat. The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. Impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verifying the signature for daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions  gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library We are going to SRU fwupd 1.7.5 to impish and focal to fix bug LP: #1949412. With update fwupd, the default config set OnlyTrusted=true With that, we need update libjcat. [Impact] need to update libjcat so the recent firmware from lvfs could be installed by fwupd. [Test Plan] Will use fwupd SRU exception test plan to do those testing. IHV vendor will also contribute by testing recent firmware that can't be install without upgrade libjcat. [] The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. Impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verifying the signature for daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions  gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library
2022-02-24 09:18:29 Yuan-Chen Cheng description We are going to SRU fwupd 1.7.5 to impish and focal to fix bug LP: #1949412. With update fwupd, the default config set OnlyTrusted=true With that, we need update libjcat. [Impact] need to update libjcat so the recent firmware from lvfs could be installed by fwupd. [Test Plan] Will use fwupd SRU exception test plan to do those testing. IHV vendor will also contribute by testing recent firmware that can't be install without upgrade libjcat. [] The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. Impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verifying the signature for daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions  gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library We are going to SRU fwupd 1.7.5 to impish and focal to fix bug LP: #1949412. With update fwupd, the default config set OnlyTrusted=true With that, we need update libjcat. [Impact] need to update libjcat so the recent firmware from lvfs could be installed by fwupd. [Test Plan] Will use fwupd SRU exception test plan to do those testing. IHV vendor will also contribute by testing recent firmware that can't be install without upgrade libjcat. [Where problems could occur] fwupd will crash, signature verification will failed and the can't install firmware from LVFS. Given the test plan in the SRU exception document, plus IHV testing, I think those shall be fine. [Other Info] SRU exception page: https://wiki.ubuntu.com/firmware-updates ---- The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. Impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verifying the signature for daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions  gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library
2022-02-24 23:09:51 Yuan-Chen Cheng oem-priority: status Triaged In Progress
2022-02-24 23:12:20 Yuan-Chen Cheng description We are going to SRU fwupd 1.7.5 to impish and focal to fix bug LP: #1949412. With update fwupd, the default config set OnlyTrusted=true With that, we need update libjcat. [Impact] need to update libjcat so the recent firmware from lvfs could be installed by fwupd. [Test Plan] Will use fwupd SRU exception test plan to do those testing. IHV vendor will also contribute by testing recent firmware that can't be install without upgrade libjcat. [Where problems could occur] fwupd will crash, signature verification will failed and the can't install firmware from LVFS. Given the test plan in the SRU exception document, plus IHV testing, I think those shall be fine. [Other Info] SRU exception page: https://wiki.ubuntu.com/firmware-updates ---- The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. Impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verifying the signature for daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions  gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library We are going to SRU fwupd 1.7.5 to impish and focal to fix bug LP: #1949412. With update fwupd, the default config set OnlyTrusted=true With that, we need update libjcat. [Impact] need to update libjcat so the recent firmware from lvfs could be installed by fwupd. [Test Plan] Will use fwupd SRU exception test plan to do those testing. IHV vendor will also contribute by testing recent firmware that can't be install without upgrade libjcat. [Where problems could occur] fwupd will crash, signature verification will failed and the can't install firmware from LVFS. Given the test plan in the SRU exception document, plus IHV testing, I think those shall be fine. [Other Info] SRU exception page: https://wiki.ubuntu.com/firmware-updates There are several commits between 0.1.3 (current one in focal) and 0.1.4 (the target version for this SRU). The non-trivial commits are: https://github.com/hughsie/libjcat/commit/109399e1f28cec84b43c355b2be77bac38943df7 https://github.com/hughsie/libjcat/commit/583df67e3ee25201f1e1830ae6d92bf846c082a3 Per the logic there, I think we should SRU those. ---- The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. Impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verifying the signature for daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions  gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library
2022-02-24 23:13:20 Yuan-Chen Cheng description We are going to SRU fwupd 1.7.5 to impish and focal to fix bug LP: #1949412. With update fwupd, the default config set OnlyTrusted=true With that, we need update libjcat. [Impact] need to update libjcat so the recent firmware from lvfs could be installed by fwupd. [Test Plan] Will use fwupd SRU exception test plan to do those testing. IHV vendor will also contribute by testing recent firmware that can't be install without upgrade libjcat. [Where problems could occur] fwupd will crash, signature verification will failed and the can't install firmware from LVFS. Given the test plan in the SRU exception document, plus IHV testing, I think those shall be fine. [Other Info] SRU exception page: https://wiki.ubuntu.com/firmware-updates There are several commits between 0.1.3 (current one in focal) and 0.1.4 (the target version for this SRU). The non-trivial commits are: https://github.com/hughsie/libjcat/commit/109399e1f28cec84b43c355b2be77bac38943df7 https://github.com/hughsie/libjcat/commit/583df67e3ee25201f1e1830ae6d92bf846c082a3 Per the logic there, I think we should SRU those. ---- The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. Impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verifying the signature for daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions  gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library We are going to SRU fwupd 1.7.5 to impish and focal to fix bug LP: #1949412. With update fwupd, the default config set OnlyTrusted=true With that, we need update libjcat. [Impact] need to update libjcat so the recent firmware from lvfs could be installed by fwupd. [Test Plan] Will use fwupd SRU exception test plan to do those testing. IHV vendor will also contribute by testing recent firmware that can't be install without upgrade libjcat. [Where problems could occur] fwupd will crash, signature verification will failed and the can't install firmware from LVFS. Given the test plan in the SRU exception document, plus IHV testing, I think those shall be fine. [Other Info] SRU exception page: https://wiki.ubuntu.com/firmware-updates There are several commits between 0.1.3 (current one in focal) and 0.1.4 (the target version for this SRU). The non-trivial commits are: https://github.com/hughsie/libjcat/commit/109399e1f28cec84b43c355b2be77bac38943df7 https://github.com/hughsie/libjcat/commit/583df67e3ee25201f1e1830ae6d92bf846c082a3 Per the logic there, I think we should SRU those. Also note per: https://github.com/fwupd/fwupd/commit/7157ca79e4d6b13d82b0a21f8586b86be0cbb80e We do need updated libjcat to support new firmware from LVFS. ---- The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. Impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verifying the signature for daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions  gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library
2022-02-27 00:01:16 Yuan-Chen Cheng summary fwupd daemon failed verifying firmware signature fwupd daemon failed to verify firmware signature
2022-02-28 10:35:13 Yuan-Chen Cheng description We are going to SRU fwupd 1.7.5 to impish and focal to fix bug LP: #1949412. With update fwupd, the default config set OnlyTrusted=true With that, we need update libjcat. [Impact] need to update libjcat so the recent firmware from lvfs could be installed by fwupd. [Test Plan] Will use fwupd SRU exception test plan to do those testing. IHV vendor will also contribute by testing recent firmware that can't be install without upgrade libjcat. [Where problems could occur] fwupd will crash, signature verification will failed and the can't install firmware from LVFS. Given the test plan in the SRU exception document, plus IHV testing, I think those shall be fine. [Other Info] SRU exception page: https://wiki.ubuntu.com/firmware-updates There are several commits between 0.1.3 (current one in focal) and 0.1.4 (the target version for this SRU). The non-trivial commits are: https://github.com/hughsie/libjcat/commit/109399e1f28cec84b43c355b2be77bac38943df7 https://github.com/hughsie/libjcat/commit/583df67e3ee25201f1e1830ae6d92bf846c082a3 Per the logic there, I think we should SRU those. Also note per: https://github.com/fwupd/fwupd/commit/7157ca79e4d6b13d82b0a21f8586b86be0cbb80e We do need updated libjcat to support new firmware from LVFS. ---- The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. Impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verifying the signature for daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions  gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library We are going to SRU fwupd 1.7.5 to impish and focal to fix bug LP: #1949412. With update fwupd, the default config set OnlyTrusted=true With that, we need update libjcat. [Impact] need to update libjcat so the recent firmware from lvfs could be installed by fwupd. [Test Plan] Will use fwupd SRU exception test plan to do those testing. IHV vendor will also contribute by testing recent firmware that can't be install without upgrade libjcat. [Where problems could occur] fwupd will crash, signature verification will failed and the can't install firmware from LVFS. Given the test plan in the SRU exception document, plus IHV testing, I think those shall be fine. [Other Info] SRU exception page: https://wiki.ubuntu.com/firmware-updates There are several commits between 0.1.3 (current one in focal) and 0.1.4 (the target version for this SRU). Those non-trivial commits between 0.1.3 and 0.1.4 are: https://github.com/hughsie/libjcat/commit/109399e1f28cec84b43c355b2be77bac38943df7 https://github.com/hughsie/libjcat/commit/583df67e3ee25201f1e1830ae6d92bf846c082a3 Given they are clean and clear, I think SRU those shall be fine. Also, note per: https://github.com/fwupd/fwupd/commit/7157ca79e4d6b13d82b0a21f8586b86be0cbb80e We do need updated libjcat to support new firmware from LVFS. ---- The firmware blobs in cabinet archive are presently LVFS signed with gpg and pkcs7, if libjcat at compilation time without one then the blobs signed with both can't be verified. The impact is fwupd daemon will fail the firmware install immediately because OnlyTrusted=true is defaulted (in fwupd 1.7.x) to verify the signature for the daemon. We need uprev libjcat at least 0.1.4 onward to fix this issue. Issue is reproducible with fwupd 1.7.4 -> https://launchpad.net/~ycheng-twn/+archive/ubuntu/fwupd174 $ fwupdmgr --version client version: 1.7.4 compile-time dependency versions  gusb: 0.3.4 daemon version: 1.7.4 $ dpkg -l | grep libjcat ii libjcat1:amd64 0.1.3-2 amd64 JSON catalog library
2022-02-28 15:42:14 Łukasz Zemczak libjcat (Ubuntu Impish): status Triaged Fix Committed
2022-02-28 15:42:16 Łukasz Zemczak bug added subscriber Ubuntu Stable Release Updates Team
2022-02-28 15:42:18 Łukasz Zemczak bug added subscriber SRU Verification
2022-02-28 15:42:20 Łukasz Zemczak tags focal oem-priority focal oem-priority verification-needed verification-needed-impish
2022-02-28 15:50:16 Łukasz Zemczak libjcat (Ubuntu Focal): status Triaged Fix Committed
2022-02-28 15:50:21 Łukasz Zemczak tags focal oem-priority verification-needed verification-needed-impish focal oem-priority verification-needed verification-needed-focal verification-needed-impish
2022-03-04 03:43:11 Yuan-Chen Cheng tags focal oem-priority verification-needed verification-needed-focal verification-needed-impish focal oem-priority verification-done-focal verification-needed verification-needed-impish
2022-03-07 06:33:55 Kai-Chuan Hsieh tags focal oem-priority verification-done-focal verification-needed verification-needed-impish focal oem-priority verification-done verification-done-focal verification-done-impish
2022-03-07 07:02:32 Yuan-Chen Cheng oem-priority: status In Progress Fix Committed
2022-03-10 17:04:46 Launchpad Janitor libjcat (Ubuntu Impish): status Fix Committed Fix Released
2022-03-10 17:05:01 Łukasz Zemczak removed subscriber Ubuntu Stable Release Updates Team
2022-03-10 17:07:55 Launchpad Janitor libjcat (Ubuntu Focal): status Fix Committed Fix Released
2022-06-29 01:34:05 Yuan-Chen Cheng oem-priority: status Fix Committed Fix Released