THE FIELD GUIDE / PATCHING
Firmware inventory, rollout & recovery
Discover, review and verify firmware on supported devices, from trusted catalog to running version.
Identify the device and provider
The capability matrix describes supported distro, architecture, provider and device combinations. fwupd covers supported devices, Raspberry Pi EEPROM tooling covers applicable models, and native package workflows cover eligible firmware and microcode. Inventory separates running and pending versions, freshness, unsupported devices and collection gaps. Device serials stay redacted by default.
Review trusted artifacts and activation
Review applicable releases, provider provenance, artifact digests, prerequisites, power and reboot requirements before approving an exact device and version. Connected and disconnected staging verify the same trust evidence. Durable receipts distinguish download, installation, pending reboot or manual activation, and verification of the active version.
Stage policy and recovery
Use device-class policy, version pins, time-limited exceptions, canaries and maintenance windows. Verify installed firmware and service health before advancing. An uncertain activation keeps the recovery hold until evidence resolves the outcome. Downgrade, cancellation and manual recovery depend on the provider and hardware.
Inspect firmware security posture
Review supported host-security attributes, vendor advisories, Secure Boot evidence and current versus pending BIOS or UEFI values. Baseline checks are read-only by default. An exact, separately reviewed plan controls supported configuration changes and shows whether a reboot or vendor action is required.
Open the application reference for capability scope and technical details.
Open View scope in issue #396 ↗