fwupd modules by nickanderson · Pull Request #145 · cfengine/modules

nickanderson · 2026-05-23T20:00:28Z

No description provided.

nickanderson · 2026-05-23T20:05:58Z

Ive got a little cleanup to do yet busted screenshot etc ..., but gotta jet to a wedding and i just wanted to get it iup and get some feedback

…ture, and monitoring measurements

…ferred reboot

… HSI

craigcomstock

got as far as my comment about "what is HSI". Will take some more looks later.

larsewi · 2026-05-26T14:46:40Z

+      "_devices_src" string => "/var/cache/fwupd/devices.json";
+      "_updates_src" string => "$(sys.statedir)/fwupd_inventory_updates.json";
+      "_security_src" string => "$(sys.statedir)/fwupd_inventory_security.json";
+      "_cache"       string => "$(sys.statedir)/fwupd_inventory_cache";
+      "_template"    string => "$(this.promise_dirname)/fwupd-inventory.mustache";


Suggested change

"_devices_src" string => "/var/cache/fwupd/devices.json";

"_updates_src" string => "$(sys.statedir)/fwupd_inventory_updates.json";

"_security_src" string => "$(sys.statedir)/fwupd_inventory_security.json";

"_cache" string => "$(sys.statedir)/fwupd_inventory_cache";

"_template" string => "$(this.promise_dirname)/fwupd-inventory.mustache";

"_devices_src" string => "/var/cache/fwupd/devices.json";

"_updates_src" string => "$(sys.statedir)/fwupd_inventory_updates.json";

"_security_src" string => "$(sys.statedir)/fwupd_inventory_security.json";

"_cache" string => "$(sys.statedir)/fwupd_inventory_cache";

"_template" string => "$(this.promise_dirname)/fwupd-inventory.mustache";

Last file uses hyphen compared while the other use underscore. Maybe this was intentional?

Would it me nice to keep them all under a $(sys.statedir)/fwupd/. directory instead of the name prefix?

larsewi · 2026-05-26T15:05:12Z

+     # Per-device pending firmware update inventory, emitted natively
+      # from the updates JSON cache. Mirrors the HSI bundle idiom.


Suggested change

# Per-device pending firmware update inventory, emitted natively

# from the updates JSON cache. Mirrors the HSI bundle idiom.

# Per-device pending firmware update inventory, emitted natively

# from the updates JSON cache. Mirrors the HSI bundle idiom.

larsewi · 2026-05-26T15:08:17Z

+# The rollup mirrors fwupd's own algorithm: walk levels 1-4 sequentially;
+# at each level, if any non-obsoleted attribute fails, stop — the result
+# is the highest level that had at least one success before the walk
+# stopped.  Empty levels (no attributes) are skipped without advancing


Suggested change

# stopped. Empty levels (no attributes) are skipped without advancing

# stopped. Empty levels (no attributes) are skipped without advancing

larsewi · 2026-05-26T15:12:54Z

+      # at or below it has a failure.  Checks highest first so the
+      # first match wins.  Mirrors fwupd's fu_security_attrs_calculate_hsi().


Suggested change

# at or below it has a failure. Checks highest first so the

# first match wins. Mirrors fwupd's fu_security_attrs_calculate_hsi().

# at or below it has a failure. Checks highest first so the

# first match wins. Mirrors fwupd's fu_security_attrs_calculate_hsi().

larsewi · 2026-05-26T15:14:35Z

+# @brief Surface per-device pending firmware update inventory.
+#
+# Reads the updates JSON cache and emits one inventory entry per device
+# that has a pending update.  Format:


Suggested change

# that has a pending update. Format:

# that has a pending update. Format:

larsewi · 2026-05-26T15:26:08Z

+# is deleted so the update can re-evaluate after reboot.
+#
+# When reboot_after_update resolves true the marker is removed and
+# a deferred reboot is scheduled.  On systemd systems a transient


Suggested change

# a deferred reboot is scheduled. On systemd systems a transient

# a deferred reboot is scheduled. On systemd systems a transient

larsewi · 2026-05-26T15:26:37Z

+# non-systemd systems the legacy shutdown -r +1 fallback is used.
+#
+# --no-reboot-check suppresses the interactive "reboot now?" prompt
+# that fwupdmgr emits after certain updates.  It does not skip or


Suggested change

# that fwupdmgr emits after certain updates. It does not skip or

# that fwupdmgr emits after certain updates. It does not skip or

larsewi · 2026-05-26T15:36:22Z

+
+** Allowed devices
+
+A list of device name patterns (regular expressions) controlling which


Could mention whether the regular expressions are anchored or not

larsewi · 2026-05-26T15:38:30Z

+Linux only. The =fwupd= package must be available in the system's
+package repositories.
+
+* Warnings


Maybe this section should be earlier 😉

larsewi · 2026-05-26T15:51:57Z

+| Attribute                  | Values                                                          |
+|----------------------------+-----------------------------------------------------------------|
+| *Firmware update status*   | =OK= -- no pending updates                                     |
+|                            | =UPDATES_AVAILABLE= -- one or more devices have pending updates |
+|                            | =NO_DEVICES= -- fwupd present but no updatable devices          |
+|                            | =FWUPD_MISSING= -- fwupd is not installed                       |


Suggested change

| Attribute | Values |

|----------------------------+-----------------------------------------------------------------|

| *Firmware update status* | =OK= -- no pending updates |

| | =UPDATES_AVAILABLE= -- one or more devices have pending updates |

| | =NO_DEVICES= -- fwupd present but no updatable devices |

| | =FWUPD_MISSING= -- fwupd is not installed |

| Attribute | Values |

|----------------------------+-----------------------------------------------------------------|

| *Firmware update status* | =OK= -- no pending updates |

| | =UPDATES_AVAILABLE= -- one or more devices have pending updates |

| | =NO_DEVICES= -- fwupd present but no updatable devices |

| | =FWUPD_MISSING= -- fwupd is not installed |

These tables can probably be quickly aligned with some formatter

nickanderson requested review from craigcomstock, larsewi, olehermanse and vpodzime May 23, 2026 20:01

nickanderson marked this pull request as draft May 23, 2026 20:03

nickanderson force-pushed the fwupd-inventory/master branch 2 times, most recently from 7ac3fcf to aa4a6ed Compare May 24, 2026 20:46

nickanderson marked this pull request as ready for review May 24, 2026 20:47

nickanderson force-pushed the fwupd-inventory/master branch 2 times, most recently from b8fefc5 to be41bfc Compare May 25, 2026 20:59

Nick Anderson added 3 commits May 25, 2026 18:02

Added inventory-fwupd module for firmware inventory, HSI security pos…

9c0ba63

…ture, and monitoring measurements

Added manage-fwupd module for firmware updates with allow-list and de…

950573f

…ferred reboot

Added compliance-report-fwupd for firmware security posture via fwupd…

1287241

… HSI

nickanderson force-pushed the fwupd-inventory/master branch from be41bfc to 1287241 Compare May 25, 2026 23:03

craigcomstock reviewed May 26, 2026

View reviewed changes

Comment thread inventory/inventory-fwupd/policy.cf

larsewi approved these changes May 26, 2026

View reviewed changes

Nick Anderson added 4 commits May 26, 2026 11:16

Removed un-necessary create attributes

3426a77

Improved consistency of HSI ID vs IDentifier

95f7cb0

Moved state files to common directory

0e92223

Comment cleanup

50e597c

nickanderson merged commit c879e82 into cfengine:master May 26, 2026
10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fwupd modules#145

fwupd modules#145
nickanderson merged 7 commits into
cfengine:masterfrom
nickanderson:fwupd-inventory/master

nickanderson commented May 23, 2026

Uh oh!

nickanderson commented May 23, 2026

Uh oh!

craigcomstock left a comment

Uh oh!

Uh oh!

larsewi May 26, 2026

Uh oh!

larsewi May 26, 2026

Uh oh!

larsewi May 26, 2026

Uh oh!

larsewi May 26, 2026

Uh oh!

larsewi May 26, 2026

Uh oh!

larsewi May 26, 2026

Uh oh!

larsewi May 26, 2026

Uh oh!

larsewi May 26, 2026

Uh oh!

larsewi May 26, 2026

Uh oh!

larsewi May 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

		# Per-device pending firmware update inventory, emitted natively
		# from the updates JSON cache. Mirrors the HSI bundle idiom.

	# stopped. Empty levels (no attributes) are skipped without advancing
	# stopped. Empty levels (no attributes) are skipped without advancing

		# at or below it has a failure. Checks highest first so the
		# first match wins. Mirrors fwupd's fu_security_attrs_calculate_hsi().

	# that has a pending update. Format:
	# that has a pending update. Format:

	# a deferred reboot is scheduled. On systemd systems a transient
	# a deferred reboot is scheduled. On systemd systems a transient

	# that fwupdmgr emits after certain updates. It does not skip or
	# that fwupdmgr emits after certain updates. It does not skip or


		** Allowed devices

		A list of device name patterns (regular expressions) controlling which

Conversation

nickanderson commented May 23, 2026

Uh oh!

nickanderson commented May 23, 2026

Uh oh!

craigcomstock left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants