[Bug 1921544] Re: [bionic] fwupd 1.2.x, 1.3.x, 1.4.x: vendor-id requirement on LVFS causes failures

Tue Sep 7 08:19:56 UTC 2021

This bug was fixed in the package fwupd - 1.2.14-0~18.04.2

---------------
fwupd (1.2.14-0~18.04.2) bionic; urgency=medium

  * debian/rules: catch up to generate sbat section.

fwupd (1.2.14-0~18.04.1) bionic; urgency=medium

  * New upstream version (1.2.14) (LP: #1884788)
  * Bug fixes:
    - Fixes crashes on fwupdaa64.efi on startup (LP: #1858590)
    - Check version was updated by checking version
    - Correctly import PKCS-7 remote metadata
    - Decrease minimum battery requirement to 10%
    - Disable the battery percentage checks if UPower is unavailable
    - Do not do semver conversion in fu_common_vercmp()
    - Fix the DeviceID set by GetDetails
    - Force the synaptics-prometheus minor version from 0x02 to 0x01
    - Prevent Dell updates to occur via synaptics-mst
    - Read all releases and convert versions when comparing
    - Use the correct timeout for unifying IO channel writes
    - Validate that gpgme_op_verify_result() returned at least one signature
    - Avoid checking for bolt support when not required
    - Correct HWID support in wacom-raw
    - Fix offset of vendor id of hidraw devices
    - Make loading vendor/product/serial strings non-fatal
    - Only check the vendor ID if the device has one set
    - Use more systemd directives for directories
    - Actually write the new device path if different than before
    - Add a SynapticsMSTBoardID for a few Lenovo docks
    - Add the counterpart GUID for the DW5821e
    - Be more accepting when trying to recover a failed database migration
    - Do not ask the user to upload a report if ReportURI is not set
    - Do not segfault when trying to quit the downgrade selection
    - Fix a crash when stopping the fwupd service
    - Never show AppStream markup on the console
    - Relax the certificate time checks in the self tests for the legacy certificate
    - Reload metadata store when configuration changes
    - Remove replug flag after the device comes back from reboot
    - Update device_modified in sql database during updates
    - Work properly with ICL thunderbolt controller
  * New features:
    - Add support for tpm2-tools 4.X
    - Allow specifying a firmware GUID to check any version exists
    - Add SBAT region support (LP: #1921539)
  * Don't cleanup /var/cache/fwupdate anymore
  * Drop upstreamed patches:
    - 0001-Relax-the-certificate-time-checks-in-the-self-tests-.patch
    - 0001-trivial-libfwupd-skip-tests-if-machine-id-is-empty-t.patch
    - 0001-Allows-confined-snaps-to-activate-fwupd-via-D-Bus.patch
    - 0001-Only-check-the-vendor-ID-if-the-device-has-one-set.patch
    - 0001-efi-use-a-wildcard-section-copy-for-final-EFI-genera.patch
    - CVE-2020-10759.patch
  * Remaining changes:
    - meson-0.45-bc.patch: Fix build with meson 0.45
    - Drop added Recommends: on bolt which is not in flavor seeds and adds a
      new service.
  * Backport a patch from upstream 1_2_X branch to fix SBAT character.
  * Backport a patch from upstream 1_2_X branch to fix vendor-id requirement
    error on Dell WD19 (LP: #1921544)

 -- Yuan-Chen Cheng <yc.cheng at canonical.com>  Tue, 31 Aug 2021 15:58:09
+0800

** Changed in: fwupd (Ubuntu Bionic)
       Status: Fix Committed => Fix Released

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-10759

** Changed in: fwupd-signed (Ubuntu Bionic)
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to fwupd-signed in Ubuntu.
https://bugs.launchpad.net/bugs/1921544

Title:
  [bionic] fwupd 1.2.x, 1.3.x, 1.4.x: vendor-id requirement on LVFS
  causes failures

Status in OEM Priority Project:
  Confirmed
Status in fwupd package in Ubuntu:
  Fix Released
Status in fwupd-signed package in Ubuntu:
  Fix Released
Status in fwupd source package in Bionic:
  Fix Released
Status in fwupd-signed source package in Bionic:
  Fix Released
Status in fwupd source package in Focal:
  Fix Released
Status in fwupd-signed source package in Focal:
  Fix Released
Status in fwupd source package in Groovy:
  Fix Released
Status in fwupd-signed source package in Groovy:
  Fix Released

Bug description:
  [Impact]
  A new requirement was introduced into LVFS to enforce vendor IDs for devices.  This caused problems for upgrades on Dell's WD19 dock with fwupd 1.2.x and 1.3.x. and 1.4.x versions.

  $ fwupdmgr update
  No upgrades for RTS5487 in Dell dock, current is 01.47: 01.47=same, 01.47=same, 01.47=same
  No releases found for device: cannot handle firmware requirement 'vendor-id'
  No releases found for device: cannot handle firmware requirement 'vendor-id'
  No releases found for device: cannot handle firmware requirement 'vendor-id'
  No upgrades for RTS5413 in Dell dock, current is 01.21: 01.21=same, 01.21=same, 01.21=same

  [Test Case]
  Plug in an up to date WD19 and try to issue "fwupdmgr update".  Find the results should look like this instead:

  $ fwupdmgr update
  No upgrades for RTS5487 in Dell dock, current is 01.47: 01.47=same, 01.47=same, 01.47=same
  No upgrades for WD19, current is 01.00.00.05: 01.00.00.05=same, 01.00.00.04=older, 01.00.00.00=older
  No upgrades for Package level of Dell dock, current is 01.00.15.01: 01.00.15.01=same, 01.00.14.01=older, 01.00.04.01=older
  No upgrades for VMM5331 in Dell dock, current is 05.04.06: 05.04.06=same, 05.04.03=older, 05.03.10=older
  No upgrades for RTS5413 in Dell dock, current is 01.21: 01.21=same, 01.21=same, 01.21=same

  [Regression Potential]
  This particular fix is low risk, it only affects vendor ID path.

To manage notifications about this bug go to:
https://bugs.launchpad.net/oem-priority/+bug/1921544/+subscriptions