On 5/20/20 11:15 AM, Richard Hughes wrote:
On Wed, May 20, 2020 at 6:58 PM Michel Alexandre Salim
<michel(a)michel-slm.name> wrote:
> For normal packages, we just set up dnf-automatic to automatically apply
> security updates. Would it be possible to flag critical/security
> firmware updates so that we can just create a process that automatically
> apply these, say on a daily basis, without us having to chase every
> single firmware GUIDs?
It's available in the urgency field, no?
└─ThinkPad P50 System Update:
New version: 0.1.53
Remote ID: lvfs
Summary: Lenovo ThinkPad P50 System Firmware
Licence: Proprietary
Size: 9.4 MB
Created: 2018-09-13
Urgency: High
Vendor: Lenovo Ltd.
Ah, indeed, thanks! What seems missing is a CLI option to only install
updates matching the requested urgency field.
e.g. with DNF you have all these filters:
--bugfix Include bugfix relevant packages, in updates
--enhancement Include enhancement relevant packages, in updates
--newpackage Include newpackage relevant packages, in updates
--security Include security relevant packages, in updates
--advisory ADVISORY, --advisories ADVISORY
Include packages needed to fix the given
advisory, in
updates
--bz BUGZILLA, --bzs BUGZILLA
Include packages needed to fix the given BZ, in
updates
--cve CVES, --cves CVES
Include packages needed to fix the given CVE, in
updates
--sec-severity {Critical,Important,Moderate,Low}, --secseverity
{Critical,Important,Moderate,Low}
Include security relevant packages matching the
severity, in updates
If it's reasonable to have such toggles for fwupdmgr, we're happy to
send a pull request for it.
Thanks,
--
Michel Alexandre Salim
profile:
https://keybase.io/michel_slm
chat via email:
https://delta.chat/
GPG key: 96A7 A6ED FB4D 2113 4056 3257 CAF9 AD10 ACB1 BEF2