For packages in Debian's repositories, hashes and signatures are checked as described here (and questions linked there) to ensure the integrity of the software to at least some degree (under development).
But how is the integrity of firmware ensured on GNU/Linux?
I think there broadly would only be one way to reliably ensure integrity: the firmware being open source and reproducible, the reproducible hashsums of the files being public and a reliable way to check the local firmware against these hashsums. I don't think this currently is the case - nevertheless, less optimal ways could also go a long way to help ensure security.
How is the integrity of firmware currently ensured and how can it be ensured manually?
With firmware I'm referring to preinstalled firmware on components of the computer (including things connected to it) and updates of firmware using fwupd (fwupdmgr update
).
I don't know of tools to update nonspecific PC firmware on GNU/Linux other than fwupd but maybe there are some more. On Debian11/KDE by default the firmware updates are separate to the package manager. One can only configure the KDE package manager "Discover" to also show (prompt the user) and carry out these updates. I wondered if it's still not part of the package managers by default because the integrity of the downloaded update files is not checked in a way as secure as other packages that can be installed from the package managers (like Apper for example).