Tell the user when a new fwupd is required

[hughsie]

An idea someone suggested yesterday. At the moment, on refresh we have:

Successfully downloaded new metadata: 5 local devices supported

We might be in the situation where we're missing security updates because the local fwupd version is too old. What about something like:

Successfully downloaded new metadata: 5 local devices supported, 3 more would be supported with fwupd >= 1.9.13

Alternatively, we could do something like:

├─UEFI Device Firmware:
│     Device ID:          f37fb01122dd62c773f4e84ec89737e059712d59
│     Summary:            UEFI ESRT device
│     Current version:    24580
│     Minimum Version:    1
│     Vendor:             DMI:LENOVO
│     Problems:           • Requires a newer fwupd
│     GUID:               33967546-da89-4c51-9c95-5242bcb854e8
│     Device Flags:       • Internal device
│     Device Requests:    • Message

Other ideas welcome!

[superm1]

Various brain dump of thoughts:

1. To me it feels like a bandaid for distros that don't update frequently enough (looking at Ubuntu LTS and Debian stable).

2. To an average user who sees such a message how do we really want them to solve it? I feel like it's going to mean pushing the snap/flatpak harder.

Or maybe we just spin a standalone AppImage for them to use in this situation?

3. It isn't going to help for the situation that you don't have a plugin in the first place. How often are things really gated on a version instead of baseline functionality?

[hughsie]

To me it feels like a bandaid for distros that don't update frequently enough

Do you think enough user pressure would affect the policy of LTS/stable distros?

how do we really want them to solve it

That's the bit I'm also struggling with; there's no user action that means the user can fix the problem. That said, at the moment people have no ideas that they're missing security updates because the client is too old. Maybe it's something we shout return in get-updates? e.g.

LENOVO 20TJS2F44A
│
└─System Firmware:
  │   Device ID:          a45df35ac0e948ee180fe216a5f703f32dda163f
  │ 
  └─ThinkPad P1 Gen 3/X1 Extreme 3rd System Update:
	New version:      0.1.31
	Release Flags:    • Trusted metadata
			  • Is upgrade
			  • Requires a new fwupd version to deploy
	Issue:            CVE-2023-5058

It isn't going to help for the situation that you don't have a plugin in the first place

Agree, but I don't think we can do anything in that case as we don't enumerate the device. I think in the case of dbx updates the fwupd version is quite a common reason why it can't be deployed.

[superm1]

Once we have some text I can contact the release team for sure.

What is our actual ask? Latest lts always gets stable version? Or something tied to EOL dates? Should 1.7.x be EOL now or soon?

The part that I struggle with is how to justify the "risk of regressions" justifies updating.

[superm1]

Here's my stab at a new page. It's a wiki; please feel free to make changes to it.
https://wiki.ubuntu.com/firmware-updates-2.0

I think to support it we should make a few changes to SECURITY.md.

1. We should post what we expect the EOL date for 1.7.x and 1.8.x
2. The check marks for main, 1.9.x and 1.8.x/1.7.x are different but there is no legend.

[hughsie]

Is #6794 insane?

[superm1]

Can you review the wiki page? I want to make sure we're totally on the same page before I try to go make a case for a blanket policy exception.

[hughsie]

Ohh I did; it makes sense to me!