From 0703b4e5067c03c6cac8910ebe3d8d16648dbb2a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Kope=C4=87?= Date: Wed, 19 Aug 2026 10:54:04 +0200 Subject: [PATCH 1/7] docs/variants/asrock_turind8ud/releases.md: Add HSI breakdown MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michał Kopeć --- docs/variants/asrock_turind8ud/releases.md | 53 ++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/docs/variants/asrock_turind8ud/releases.md b/docs/variants/asrock_turind8ud/releases.md index 71f1d06eeed..7c71f49533e 100644 --- a/docs/variants/asrock_turind8ud/releases.md +++ b/docs/variants/asrock_turind8ud/releases.md @@ -138,3 +138,56 @@ artifact is in CycloneDX format and can be viewed by SBOM tools, for example [asrock_turind8ud_v0.9.0.sbom.json_file]: https://dl.3mdeb.com/open-source-firmware/Dasharo/asrock_turind8ud/uefi/v0.9.0/asrock_turind8ud_v0.9.0.sbom.json [asrock_turind8ud_v0.9.0.sbom.json_hash]: https://dl.3mdeb.com/open-source-firmware/Dasharo/asrock_turind8ud/uefi/v0.9.0/asrock_turind8ud_v0.9.0.sbom.json.sha256 [asrock_turind8ud_v0.9.0.sbom.json_sig]: https://dl.3mdeb.com/open-source-firmware/Dasharo/asrock_turind8ud/uefi/v0.9.0/asrock_turind8ud_v0.9.0.sbom.json.sha256.sig + +### fwupd HSI + +```text +HSI-1 +✔ SMM locked down: Locked +✔ BIOS firmware updates: Enabled +✔ Fused platform: Locked +✔ Supported CPU: Valid +✔ TPM empty PCRs: Valid +✔ TPM v2.0: Found +✔ UEFI bootservice variables: Locked +✔ UEFI platform key: Valid + +HSI-2 +✔ IOMMU: Enabled +✔ Platform debugging: Locked +✔ TPM PCR0 reconstruction: Valid +✘ Platform secure boot: Disabled +✘ SPI write protection: Disabled + +HSI-3 +✔ CET Platform: Supported +✔ Suspend-to-ram: Disabled +✘ SPI replay protection: Not supported +✘ Pre-boot DMA protection: Disabled +✘ Suspend-to-idle: Disabled + +HSI-4 +✔ Processor rollback protection: Enabled +✔ SMAP: Enabled +✘ Encrypted RAM: Not supported + +Runtime Suffix -! +✔ fwupd plugins: Untainted +✔ Linux kernel: Untainted +✔ UEFI db: Valid +✘ CET OS Support: Not supported +✘ Linux kernel lockdown: Disabled +✘ Linux swap: Unencrypted +✘ UEFI secure boot: Disabled +``` + +### Failure reasons + +- Platform Secure Boot is currently not implemented in Dasharo firmware. +- SPI Write Protection can be fixed by selecting SMM BIOS Write Protection in + the UEFI Setup Menu. +- SPI Replay Protection (RPMC) is unsupported by the board's SPI BIOS chip. +- Pre-boot DMA protection is currently not supported for AMD platforms in + Dasharo firmware. +- Suspend-to-idle isn't supported on server hardware. +- Encrypted RAM is currently not supported in Dasharo firmware. From 3789bbf6c420f32588ca2886628b2c05185a8c41 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Kope=C4=87?= Date: Wed, 19 Aug 2026 11:17:32 +0200 Subject: [PATCH 2/7] docs/variants/asrock_turind8ud/releases.md: Add CRA compliance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michał Kopeć --- docs/variants/asrock_turind8ud/releases.md | 26 ++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/docs/variants/asrock_turind8ud/releases.md b/docs/variants/asrock_turind8ud/releases.md index 7c71f49533e..3dd353fd96f 100644 --- a/docs/variants/asrock_turind8ud/releases.md +++ b/docs/variants/asrock_turind8ud/releases.md @@ -139,6 +139,32 @@ artifact is in CycloneDX format and can be viewed by SBOM tools, for example [asrock_turind8ud_v0.9.0.sbom.json_hash]: https://dl.3mdeb.com/open-source-firmware/Dasharo/asrock_turind8ud/uefi/v0.9.0/asrock_turind8ud_v0.9.0.sbom.json.sha256 [asrock_turind8ud_v0.9.0.sbom.json_sig]: https://dl.3mdeb.com/open-source-firmware/Dasharo/asrock_turind8ud/uefi/v0.9.0/asrock_turind8ud_v0.9.0.sbom.json.sha256.sig +#### CRA compliance + +CRA compliance status generated with [sbom-tools](https://github.com/sbom-tool/sbom-tools) + +##### Phase 1 + +```text +EU CRA Phase 1 (2027) + COMPLIANT — With warnings + Integrity ███████████████░░░░░░░░░░░░░░░░░░░░░░░░░ 3 (37.5%) + Security ███████████████░░░░░░░░░░░░░░░░░░░░░░░░░ 3 (37.5%) + Doc Meta █████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 1 (12.5%) + License █████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 1 (12.5%) +``` + +##### Phase 2 + +```text +EU CRA Phase 2 (2029) + COMPLIANT — With warnings + Security ██████████████████░░░░░░░░░░░░░░░░░░░░░░ 5 (45.5%) + Integrity ███████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 3 (27.3%) + Doc Meta ███████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 2 (18.2%) + License ████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 1 (9.1%) +``` + ### fwupd HSI ```text From 8af22c03e837554a0eb144f7f35d696ca59f535f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Kope=C4=87?= Date: Wed, 19 Aug 2026 11:23:19 +0200 Subject: [PATCH 3/7] docs/variants/overview.md: Add HSI table MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michał Kopeć --- docs/variants/overview.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/variants/overview.md b/docs/variants/overview.md index 19d27b76dc2..b70fbcd9ca8 100644 --- a/docs/variants/overview.md +++ b/docs/variants/overview.md @@ -144,3 +144,11 @@ Each metric is calculated using the formula: | Novacustom NS5xMU | novacustom_ns5x_tgl_v1.6.0.rom | NS50_70MU_1.07.14.bin | -29.8 | 43.3 | -18.6 | | Gigabyte MZ33-AR1 | gigabyte_mz33_ar1_v0.9.0.rom | MZ33-AR1_R21_F14/image.bin | -80.0 | 5301.8 | 227.3 | | MSI MS-7E56 | msi_ms7e56_v0.9.0.rom | E7E56AMSI.2A92 | -79.1 | 167010300.0 | 377.3 | + +## fwupd HSI compliance + +The following table shows the HSI levels achieved by each Dasharo release. + +| Platform | Dasharo version | Flavor | HSI | Notes | +| --- | --- | --- | --- | --- | +| ASRock Rack TURIND8UD | v0.9.0 | coreboot+UEFI | 1 | [link](../asrock_turind8ud/releases#fwupd-hsi) | From 87d3ec55132b339e90f5b7ded5afb06aee21fd95 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Kope=C4=87?= Date: Wed, 19 Aug 2026 12:31:23 +0200 Subject: [PATCH 4/7] docs/variants/asrock_turind8ud/releases.md: Add sbom-tools version MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michał Kopeć --- docs/variants/asrock_turind8ud/releases.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/variants/asrock_turind8ud/releases.md b/docs/variants/asrock_turind8ud/releases.md index 3dd353fd96f..71c35c34b7e 100644 --- a/docs/variants/asrock_turind8ud/releases.md +++ b/docs/variants/asrock_turind8ud/releases.md @@ -142,6 +142,7 @@ artifact is in CycloneDX format and can be viewed by SBOM tools, for example #### CRA compliance CRA compliance status generated with [sbom-tools](https://github.com/sbom-tool/sbom-tools) +0.1.19 ##### Phase 1 From d4bcfad12456dd667757631fd6ec2394805f3247 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Kope=C4=87?= Date: Wed, 19 Aug 2026 13:50:28 +0200 Subject: [PATCH 5/7] docs/variants/asrock_turind8ud/releases.md: Sync SBOM and HSI with templates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michał Kopeć --- docs/variants/asrock_turind8ud/releases.md | 33 +++++++--------------- 1 file changed, 10 insertions(+), 23 deletions(-) diff --git a/docs/variants/asrock_turind8ud/releases.md b/docs/variants/asrock_turind8ud/releases.md index 71c35c34b7e..46720001fa0 100644 --- a/docs/variants/asrock_turind8ud/releases.md +++ b/docs/variants/asrock_turind8ud/releases.md @@ -139,31 +139,19 @@ artifact is in CycloneDX format and can be viewed by SBOM tools, for example [asrock_turind8ud_v0.9.0.sbom.json_hash]: https://dl.3mdeb.com/open-source-firmware/Dasharo/asrock_turind8ud/uefi/v0.9.0/asrock_turind8ud_v0.9.0.sbom.json.sha256 [asrock_turind8ud_v0.9.0.sbom.json_sig]: https://dl.3mdeb.com/open-source-firmware/Dasharo/asrock_turind8ud/uefi/v0.9.0/asrock_turind8ud_v0.9.0.sbom.json.sha256.sig -#### CRA compliance +### CRA compliance CRA compliance status generated with [sbom-tools](https://github.com/sbom-tool/sbom-tools) -0.1.19 -##### Phase 1 +#### Phase 2 ```text -EU CRA Phase 1 (2027) - COMPLIANT — With warnings - Integrity ███████████████░░░░░░░░░░░░░░░░░░░░░░░░░ 3 (37.5%) - Security ███████████████░░░░░░░░░░░░░░░░░░░░░░░░░ 3 (37.5%) - Doc Meta █████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 1 (12.5%) - License █████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 1 (12.5%) -``` - -##### Phase 2 - -```text -EU CRA Phase 2 (2029) - COMPLIANT — With warnings - Security ██████████████████░░░░░░░░░░░░░░░░░░░░░░ 5 (45.5%) - Integrity ███████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 3 (27.3%) - Doc Meta ███████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 2 (18.2%) - License ████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 1 (9.1%) +EU CRA Phase 2 (2027) +COMPLIANT — With warnings +Security ███████████████████████░░░░░░░░░░░░░░░░░ 9 (56.2%) +Integrity ████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 3 (18.8%) +Doc Meta ████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 3 (18.8%) +License ███░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 1 (6.2%) ``` ### fwupd HSI @@ -208,11 +196,10 @@ Runtime Suffix -! ✘ UEFI secure boot: Disabled ``` -### Failure reasons +#### Failure reasons - Platform Secure Boot is currently not implemented in Dasharo firmware. -- SPI Write Protection can be fixed by selecting SMM BIOS Write Protection in - the UEFI Setup Menu. +- [SPI Write Protection can be fixed by selecting SMM BIOS Write Protection in the UEFI Setup Menu.](https://docs.dasharo.com/dasharo-menu-docs/dasharo-system-features/#dasharo-security-options) - SPI Replay Protection (RPMC) is unsupported by the board's SPI BIOS chip. - Pre-boot DMA protection is currently not supported for AMD platforms in Dasharo firmware. From 3039062217b0cfdb9ff66f2aba95bc735f523040 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Kope=C4=87?= Date: Fri, 21 Aug 2026 11:18:56 +0200 Subject: [PATCH 6/7] docs/variants/asrock_turind8ud/releases.md: Improve HSI reporting MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michał Kopeć --- docs/variants/asrock_turind8ud/releases.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/docs/variants/asrock_turind8ud/releases.md b/docs/variants/asrock_turind8ud/releases.md index 46720001fa0..ee5bf4cdda1 100644 --- a/docs/variants/asrock_turind8ud/releases.md +++ b/docs/variants/asrock_turind8ud/releases.md @@ -172,7 +172,7 @@ HSI-2 ✔ Platform debugging: Locked ✔ TPM PCR0 reconstruction: Valid ✘ Platform secure boot: Disabled -✘ SPI write protection: Disabled +✔ SPI write protection: Enabled HSI-3 ✔ CET Platform: Supported @@ -198,10 +198,8 @@ Runtime Suffix -! #### Failure reasons -- Platform Secure Boot is currently not implemented in Dasharo firmware. -- [SPI Write Protection can be fixed by selecting SMM BIOS Write Protection in the UEFI Setup Menu.](https://docs.dasharo.com/dasharo-menu-docs/dasharo-system-features/#dasharo-security-options) +- [Platform Secure Boot is currently not implemented in Dasharo firmware.](https://blog.3mdeb.com/2026/2026-07-02-msi_pro_b850p_part6/#platform-secure-boot) - SPI Replay Protection (RPMC) is unsupported by the board's SPI BIOS chip. -- Pre-boot DMA protection is currently not supported for AMD platforms in - Dasharo firmware. +- [Pre-boot DMA protection is currently not supported for AMD platforms in Dasharo firmware.](https://github.com/Dasharo/dasharo-issues/issues/1903) - Suspend-to-idle isn't supported on server hardware. -- Encrypted RAM is currently not supported in Dasharo firmware. +- [Encrypted RAM is currently not supported in Dasharo firmware.](https://github.com/Dasharo/dasharo-issues/issues/1920) From 1591394a66d4e2817f7009d1abf03c2da0a83191 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Kope=C4=87?= Date: Fri, 21 Aug 2026 11:50:42 +0200 Subject: [PATCH 7/7] docs/variants/asrock_turind8ud/releases_linuxboot.md: Add cra and hsi stats MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michał Kopeć --- .../asrock_turind8ud/releases_linuxboot.md | 63 +++++++++++++++++++ 1 file changed, 63 insertions(+) diff --git a/docs/variants/asrock_turind8ud/releases_linuxboot.md b/docs/variants/asrock_turind8ud/releases_linuxboot.md index de0d47e9025..99c848305ad 100644 --- a/docs/variants/asrock_turind8ud/releases_linuxboot.md +++ b/docs/variants/asrock_turind8ud/releases_linuxboot.md @@ -120,3 +120,66 @@ artifact is in CycloneDX format and can be viewed by SBOM tools, for example [asrock_turind8ud_v0.9.0.sbom.json_file]: https://dl.3mdeb.com/open-source-firmware/Dasharo/asrock_turind8ud/linuxboot/v0.9.0/asrock_turind8ud_v0.9.0.sbom.json [asrock_turind8ud_v0.9.0.sbom.json_hash]: https://dl.3mdeb.com/open-source-firmware/Dasharo/asrock_turind8ud/linuxboot/v0.9.0/asrock_turind8ud_v0.9.0.sbom.json.sha256 [asrock_turind8ud_v0.9.0.sbom.json_sig]: https://dl.3mdeb.com/open-source-firmware/Dasharo/asrock_turind8ud/linuxboot/v0.9.0/asrock_turind8ud_v0.9.0.sbom.json.sha256.sig + +### CRA compliance + +CRA compliance status generated with [sbom-tools](https://github.com/sbom-tool/sbom-tools) + +#### Phase 2 + +```text +EU CRA Phase 2 (2027) +NON-COMPLIANT — With errors +Integrity ████████████████░░░░░░░░░░░░░░░░░░░░░░░░ 11 (40.7%) +Security █████████████░░░░░░░░░░░░░░░░░░░░░░░░░░░ 9 (33.3%) +Doc Meta ██████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 4 (14.8%) +Component Identification ███░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 2 (7.4%) +License █░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 1 (3.7%) +``` + +### fwupd HSI + +```text +HSI-1 +✔ SMM locked down: Locked +✔ BIOS firmware updates: Enabled +✔ Fused platform: Locked +✔ Supported CPU: Valid +✔ TPM empty PCRs: Valid +✔ TPM v2.0: Found + +HSI-2 +✔ IOMMU: Enabled +✔ Platform debugging: Locked +✔ TPM PCR0 reconstruction: Valid +✘ Platform secure boot: Disabled +✘ SPI write protection: Disabled + +HSI-3 +✔ CET Platform: Supported +✔ Suspend-to-ram: Disabled +✘ SPI replay protection: Not supported +✘ Pre-boot DMA protection: Disabled +✘ Suspend-to-idle: Disabled + +HSI-4 +✔ Processor rollback protection: Enabled +✔ SMAP: Enabled +✘ Encrypted RAM: Not supported + +Runtime Suffix -! +✔ fwupd plugins: Untainted +✔ Linux kernel: Untainted +✘ CET OS Support: Not supported +✘ Linux kernel lockdown: Disabled +✘ Linux swap: Unencrypted +``` + +#### Failure reasons + +- [Platform Secure Boot is currently not implemented in Dasharo firmware.](https://blog.3mdeb.com/2026/2026-07-02-msi_pro_b850p_part6/#platform-secure-boot) +- SPI Write Protection cannot be enabled on LinuxBoot. +- SPI Replay Protection (RPMC) is unsupported by the board's SPI BIOS chip. +- [Pre-boot DMA protection is currently not supported for AMD platforms in Dasharo firmware.](https://github.com/Dasharo/dasharo-issues/issues/1903) +- Suspend-to-idle isn't supported on server hardware. +- [Encrypted RAM is currently not supported in Dasharo firmware.](https://github.com/Dasharo/dasharo-issues/issues/1920)