[Lvfs-announce] Limiting sharing of embargo remotes

Hi all,

Recently we discovered that at least one LVFS vendor was sharing the
vendor-embargo.conf configuration to people outside of their vendor
group. Knowing the remote access token is enough to download the
vendor-specific metadata which *may* include firmware under security
embargo and so sharing the access token is certainly not recommended
by me. Vendors wanting to do this =E2=80=9Cthe correct way=E2=80=9D should =
ask
suppliers or QA companies to create a vendor account on the LVFS
(still 100% free!) and then the specific firmware can be shared with
them directly.

I appreciate some vendors are relying on the not-recommended sharing
access token feature right now, and don=E2=80=99t want to break that workfl=
ow
=E2=80=93 so don=E2=80=99t worry that everything is going to break.

I=E2=80=99ve just merged a new feature in
https://gitlab.com/fwupd/lvfs-website/-/merge_requests/1416 called
=E2=80=9Crequire vendors to set the username and password when downloading
embargoed metadata=E2=80=9D =E2=80=93 this makes it possible for vendors to=
 opt-in to
the more secure mode of checking who is downloading metadata for an
additional layer of protection. This means even if the remote access
token is accidentally leaked, only users with an LVFS account in the
correct vendor group can access it.

So now I need to know from each vendor what embargo metadata
permissions you=E2=80=99d like to choose. The choices are:

 * Only authenticated users =E2=80=93 the most secure mode =E2=80=93 a user=
name and
user token is required in the remote and the remote access token is
less of a secret

 * All users =E2=80=93 the less secure mode =E2=80=93 only the remote acces=
s token in
the metadata URL is required

At the moment the default is =E2=80=9Call users=E2=80=9D although this defa=
ult will be
swapped in the future. If you are an affected vendor that wants the
insecure mode (sharing the embargo remote with other companies) can
you also please tell me who you=E2=80=99re sharing it with =E2=80=93 as I=
=E2=80=99d much
rather set up the affiliate relationships in the LVFS so we=E2=80=99re able=
 to
revoke or modify permissions in the future.

Please reply to me personally, rather than the mailing list. Thanks!

Richard