The LVFS is a webservice designed to allow system OEMs and ODMs to upload firmware easily, and for it to be distributed securely to tens of millions of end users. For some people, this simply does not work for good business reasons:
- They don’t trust me, fwupd.org, GPG, certain OEMs or the CDN we use
- They don’t want thousands of computers on an internal network downloading all the files over and over again
- The internal secure network has no internet connectivity
For these cases there are a few different ways to keep your hardware updated, in order of simplicity:
Download just the files you need manually
.cab files you found for your hardware and then install them on the target hardware via Ansible or Puppet using
fwupdmgr install foo.cab — you can use
fwupdmgr get-devices to get the existing firmware versions of all hardware. If someone wants to write the patch to add JSON/XML export to
fwupdmgr that would be a very welcome thing indeed.
Download and deploy firmware as part of an immutable image
If you’re shipping an image, you can just dump the
.cab files into a directory in the deployment along with something like
/etc/fwupd/remotes.d/immutable.conf (only on fwupd >= 1.2.3):
Then once you disable the LVFS, running
fwupdtool will use only the cabinet archives you deploy in your immutable image (or even from an .rpm for that matter). Of course, you’re deploying a larger image because you might have several firmware files included, but this is how Google ChromeOS is using fwupd.
Sync all the public firmware from the LVFS to a local directory
You can use Pulp to mirror the entire contents of the LVFS (not private or embargoed firmware, for obvious reasons). Create a repo pointing to PULP_MANIFEST and then sync that on a regular basis to download the metadata and firmware. The Pulp documentation can explain how to set all this up. Make sure the local files are available from a webserver in your private network using SSL.
Then, disable the LVFS by deleting/modifying lvfs.conf and then create a
myprivateserver.conf file on the clients
Export a share to all clients
Again, use Pulp to create a big directory holding all the firmware (currently ~10GB), and keep it synced. This time create a NFS or Samba share and export it to clients. Map the folder on clients, and then create a
myprivateshare.conf file in
Create your own LVFS instance
The LVFS is a free software Python 3 Flask application and can be set up internally, or even externally for that matter. You have to configure much more this way, including things like generating your own GPG keys, uploading your own firmware and setting up users and groups on the server. Doing all this has a few advantages, namely:
- You can upload your own private firmware and QA it, only pushing it to stable when ready
- You don’t ship firmware which you didn’t upload
- You can control the staged deployment, e.g. only allowing the same update to be deployed to 1000 servers per day
- You can see failure reports from clients, to verify if the deployment is going well
- You can see nice graphs about how many updates are being deployed across your organisation
I’m hoping to make the satellite deployment LVFS use cases more concrete, and hopefully add some code to the LVFS to make this easier, although it’s not currently required for any Red Hat customer. Certainly a “setup wizard” would make setting up the LVFS much easier than obscure commands on the console.