[Lvfs-announce] Action Required: Check for generic non-OEM vendor IDs

Hi all,

In the next fwupd version we=E2=80=99ll include a now-merged change that
affects the elanfp, focalfp, fpc, goodix-moc and goodix-tp plugins:
https://github.com/fwupd/fwupd/pull/6316

During some high level security review it was identified that some
devices use a "generic" supplier USB vendor ID, and there is some
concern that it's technically possible that OEM A might accidentally
deploy firmware updates onto OEM B's hardware.

The best thing to do for future devices is to use the OEM USB vendor
ID -- which means we don't have to allow both OEM A and OEM B to
update a shared ISV vendor ID on the LVFS. This means that Dell can
only update hardware branded as Dell, and Lenovo can only update
hardware branded as Lenovo, etc. Most sub-components of things like
docks already use the OEM vendor ID, but some devices added by the
plugins listed above are the ones that are doing the unusual thing.

For devices already in the field, or that cannot be changed -- the
firmware on the LVFS might need a small modification: no re-upload is
required. We need to *add* a requirement to make sure only the update
only applies for the correct OEM, and this can be done using a CHID as
documented in https://lvfs.readthedocs.io/en/latest/metainfo.html#using-chi=
d
-- if the device is a removable peripheral, then it should have a
parent, child or sibling requirement added instead.

You can find the CHID for a specific platform by running "sudo
fwupdtool hwids" -- e.g. below shows that I'd use
6de5d951-d755-576b-bd09-c5cf66b27234 if I wanted to restrict the
update to Lenovo hardware:

$ sudo fwupdtool hwids
Computer Information
--------------------
BiosVendor: LENOVO
BiosVersion: N2VET45W (1.30 )
BiosMajorRelease: 1
BiosMinorRelease: 30
FirmwareMajorRelease: 01
FirmwareMinorRelease: 0b
Manufacturer: LENOVO
Family: ThinkPad P1 Gen 3
ProductName: 20TJS2F44A
ProductSku: LENOVO_MT_20TJ_BU_Think_FM_ThinkPad P1 Gen 3
EnclosureKind: a
BaseboardManufacturer: LENOVO
BaseboardProduct: 20TJS2F44A
Hardware IDs
------------
{687b4b40-14cf-5a9e-b9a2-84d93a5f99c9}   <- Manufacturer + Family +
ProductName + ProductSku + BiosVendor + BiosVersion + BiosMajorRelease
+ BiosMinorRelease
{d6dffdd4-f8c5-56b2-8a54-29d4554a81b7}   <- Manufacturer + Family +
ProductName + BiosVendor + BiosVersion + BiosMajorRelease +
BiosMinorRelease
{2f6d9243-39b3-561b-acb5-33c664ac656e}   <- Manufacturer + ProductName
+ BiosVendor + BiosVersion + BiosMajorRelease + BiosMinorRelease
{bf5fea93-df40-5336-922f-a2fa3ae67e5f}   <- Manufacturer + Family +
ProductName + ProductSku + BaseboardManufacturer + BaseboardProduct
{5ac99727-ff1a-5d8a-aef4-8a03d8f5cfe3}   <- Manufacturer + Family +
ProductName + ProductSku
{742d6de4-82fc-56b8-8079-963759c68dea}   <- Manufacturer + Family + Product=
Name
{ff4db33f-0e86-52e0-b531-5ecf58c194c1}   <- Manufacturer + ProductSku
+ BaseboardManufacturer + BaseboardProduct
{3969d15b-9209-5350-9f13-966ee621eb4b}   <- Manufacturer + ProductSku
{a4d618e0-6988-5177-800c-64405dbbcefa}   <- Manufacturer + ProductName
+ BaseboardManufacturer + BaseboardProduct
{2dc64c9e-97c4-59bf-b0be-892546d7e655}   <- Manufacturer + ProductName
{536c0c4c-e739-5bc7-8f93-042c73d961ef}   <- Manufacturer + Family +
BaseboardManufacturer + BaseboardProduct
{3667f735-639c-5ca5-9ae7-a464d4b49e27}   <- Manufacturer + Family
{e093d715-70f7-51f4-b6c8-b4a7e31def85}   <- Manufacturer + EnclosureKind
{eb8b729b-355c-5144-b23c-90f24e542a8c}   <- Manufacturer +
BaseboardManufacturer + BaseboardProduct
{6de5d951-d755-576b-bd09-c5cf66b27234}   <- Manufacturer

This GUID can be added on the LVFS in the =E2=80=9CRequires=E2=80=9D =E2=86=
=92 =E2=80=9CComputer
Hardware IDs=E2=80=9D section:

If you need more permission to change a firmware in testing/stable
please give me details as I'm an admin and can do it for you. I'm
happy to answer questions by email, but please don=E2=80=99t reply to the
mailing list. Thanks!

Richard