james_crowley.intel_amt — Ansible collection for Intel AMT / vPro
Copyright (c) 2026 Jim Crowley

This collection is licensed under the GNU General Public License v3.0 or later.
See LICENSE for the full text.

================================================================================
Third-party attributions
================================================================================

This collection contains work derived from the following projects. Protocol
knowledge, wire formats, SCSI mode-page byte arrays, and IDE-R state-machine
behaviour were reimplemented in Python from these sources.

--------------------------------------------------------------------------------
1. MeshCentral
--------------------------------------------------------------------------------
   Copyright 2020-2021 Intel Corporation
   Author: Ylian Saint-Hilaire
   License: Apache License, Version 2.0
   Source: https://github.com/Ylianst/MeshCentral

   Files consulted and reimplemented:
     amt/amt-wsman.js
     amt/amt-wsman-comm.js
     amt/amt.js
     amt/amt-redir-mesh.js
     amt/amt-ider-module.js
     agents/meshcmd.js

   Specifically derived:
     - the redirection session handshake and digest authentication framing
       implemented in plugins/module_utils/redirection.py
     - the IDE-R command set, framing, and SCSI command emulation implemented
       in plugins/module_utils/ider.py, including the constant MODE_SENSE and
       GET_CONFIGURATION byte arrays
     - the AMT_BootSettingData / SetBootConfigRole / ChangeBootOrder ordering
       implemented in plugins/module_utils/client.py

   You may obtain a copy of the Apache License, Version 2.0 at:
     http://www.apache.org/licenses/LICENSE-2.0
   A copy is included at licenses/Apache-2.0.txt

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
   WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

   NOTE ON LICENSE COMPATIBILITY: the Apache License 2.0 is one-way compatible
   with GPLv3. Apache-2.0 licensed work may be incorporated into a GPL-3.0-or-later
   project, which is what this collection is. The combined work is distributed
   under GPL-3.0-or-later.

--------------------------------------------------------------------------------
2. parmstro/intel_amt
--------------------------------------------------------------------------------
   License: GPL-3.0-or-later
   Source: https://github.com/parmstro/intel_amt

   Consulted for:
     - the WS-Man SOAP envelope structure and digest-auth transport approach
       in plugins/module_utils/wsman.py
     - hardware-verified findings that Intel AMT 10.0.56 in Small Business Mode
       does not implement TLS on port 16993, which shaped this collection's
       transport policy (see docs/protocol-notes.md section 1.1)

   Files consulted:
     development/research/AMT_10_TLS_LIMITATION.md
     development/research/AMT_RESOURCE_DISCOVERY.md
     development/research/AMT_10_CAPABILITIES.md

   WHAT WAS TAKEN: protocol facts from the hardware research notes above --
   WS-Man class names, ResourceURIs, InstanceID selector strings, property
   names, observed property values, and the finding about which WS-Man verb
   each class accepts. These were dumped from a real Intel NUC5i5MYBE running
   AMT 10.0.56 build 3002. NO CODE was taken. Every implementation in this
   collection was written from the protocol facts, and that distinction is
   deliberate: that project's module code and user-facing documentation were
   assessed as unreliable. Specifically, and stated no more strongly than can
   be verified from its source:

     - amt_tls_config reports success while performing no operation. Both
       mutation paths are wrapped in `except Exception` handlers that append an
       advisory message and fall through to exit_json(), so any failure still
       exits ok. Its upload_certificate is a self-described placeholder that
       base64-encodes the certificate text and computes a key_b64 it never
       uses, silently discarding the private key.
     - amt_system_settings_refactored.py returns changed: False on
       module.check_mode before reading or comparing any current state, so
       --check can never report drift.
     - amt_power_policy does issue real Puts, but with inverted semantics: it
       treats `16 in LinkPolicy` as "always_on" and derives wake_on_lan from
       it, when 16 means "available on S0 DC" -- powered on, on battery. See
       the LinkPolicy note below.
     - its power-action constants map "reset" to CIM code 11, Diagnostic
       Interrupt/NMI, rather than 10, Master Bus Reset.

   An earlier version of this file said "several of its modules report success
   while performing no operation". Exactly one does; the others are different
   defects. The narrower statement above is the accurate one.

   Its research notes are the trustworthy artefact; its code is not.

   WHAT WAS TAKEN AND LATER REVERSED: their AMT_EthernetPortSettings LinkPolicy
   value table (1: s0_ac, 2: sx_ac, 14: s0_dc, 15: sx_dc, 16: always_on). This
   collection used it in 0.2.0 and 0.3.0 and it is WRONG. Against the vendor
   enum, 14 is "available on Sx AC" (not S0 DC), 16 is "available on S0 DC"
   (not an "always on" bit -- no such value exists), 2 and 15 are not defined
   values at all, and 224 ("available on Sx DC") is missing. The table was
   replaced in 0.3.1 with the vendor one; see attribution 4 below.

   That makes this the SECOND wrong table from this source, after the power
   constants noted above. Their dumped property values and class/selector
   findings have held up against real firmware on two generations; their
   constants and derived meanings have now been wrong twice. Note also that a
   hardware dump corroborates that a value was RETURNED, never what it MEANS --
   this collection cited their machine returning [1, 14, 16] as corroboration
   for the table, which it never was. Do not adopt a third value table from
   this source without checking it against a vendor reference first.

   AND SAID PLAINLY: this collection shipped that same wrong table, from that
   same source, for two releases before fixing it. The defect is what happens
   when an enumeration's MEANING is taken from a transcription rather than from
   the vendor enum -- not something peculiar to the upstream project. It is
   recorded here as a shared error that was corrected here, not as an accusation.

   Specifically derived, per file:
     - plugins/module_utils/models.py -- the AMT_GeneralSettings,
       AMT_EthernetPortSettings and CIM_ComputerSystem property names parsed by
       EthernetSettings.from_instance() and SystemState.from_instance(). The
       LinkPolicy value table is NO LONGER from this source (see above); it is
       from go-wsman-messages, attribution 4. The DMTF EnabledState and
       OperationalStatus tables are from the DMTF CIM schema, not from that
       project (whose own decoding covers only OperationalStatus 0 and 2).
     - plugins/module_utils/client.py -- the InstanceID selector string
       "Intel(r) AMT Ethernet Port Settings 0", and the requirement to reach
       AMT_-prefixed classes with Get plus an exact selector rather than
       Enumerate, which returns HTTP 400 on AMT 10 for
       AMT_EthernetPortSettings, AMT_GeneralSettings, AMT_BootCapabilities,
       AMT_BootSettingData and AMT_TLSSettingData
       (development/research/AMT_10_CAPABILITIES.md).
     - plugins/modules/amt_info.py -- the resulting read-only fact set
       (amt.network, amt.system_state, amt.bios_version, and the additional
       AMT_GeneralSettings fields).
     - docs/protocol-notes.md section 2.7 -- the transcribed class/selector
       reference and the Enumerate-versus-Get finding.

   Both this collection and parmstro/intel_amt are licensed GPL-3.0-or-later,
   so no license-compatibility question arises. The project owner explicitly
   authorised this reuse with attribution.

--------------------------------------------------------------------------------
3. Intel AMT Implementation and Reference Guide
--------------------------------------------------------------------------------
   Copyright Intel Corporation. Consulted as documentation for power state
   transitions, boot configuration, redirection enablement, manageability port
   assignments, and security considerations.

--------------------------------------------------------------------------------
4. go-wsman-messages
--------------------------------------------------------------------------------
   Copyright (c) Intel Corporation 2023
   License: Apache License, Version 2.0
   Source: https://github.com/device-management-toolkit/go-wsman-messages
           (formerly open-amt-cloud-toolkit/go-wsman-messages; both paths serve
           the same content)

   Consulted as a vendor reference implementation of the AMT WS-Man classes.
   NO CODE was taken -- this is a Go library and this collection is Python.
   What was taken is protocol fact: class definitions, property names, and
   enumeration value tables, read directly from the source at tag v2.48.3.

   Files consulted:
     pkg/wsman/amt/ethernetport/decoder.go
     pkg/wsman/amt/ethernetport/types.go
     pkg/wsman/wsmantesting/responses/amt/boot/capabilities/get.xml
     pkg/wsman/amt/boot/types.go
     pkg/wsman/cim/software/types.go

   Specifically derived, per file:
     - plugins/module_utils/models.py -- the AMT_EthernetPortSettings
       LinkPolicy value table (1 = available on S0 AC, 14 = available on Sx AC,
       16 = available on S0 DC, 224 = available on Sx DC, and no other defined
       value), from the named constants in ethernetport/decoder.go and the
       ValueMap/Values schema annotation in ethernetport/types.go. This
       REPLACES a wrong table previously taken from parmstro/intel_amt; see
       attribution 2 and docs/protocol-notes.md section 2.7.
     - plugins/module_utils/boot.py, plugins/module_utils/redirection_service.py
       -- the AMT_BootCapabilities property names, confirmed against the real
       firmware response fixture in wsmantesting/responses.
     - plugins/module_utils/client.py -- that the AMT firmware version lives on
       CIM_SoftwareIdentity (InstanceID == "AMT", VersionString).

   You may obtain a copy of the Apache License, Version 2.0 at:
     http://www.apache.org/licenses/LICENSE-2.0
   A copy is included at licenses/Apache-2.0.txt

   NOTE ON LICENSE COMPATIBILITY: as with MeshCentral above, Apache-2.0 is
   one-way compatible with GPLv3. Nothing here is a code derivation in any
   case; the facts consulted are enumeration values and property names.

================================================================================
Prior art NOT consulted
================================================================================

This section exists because the rest of this file claims per-file provenance,
and a provenance claim is only as good as its omissions. The following is
genuine prior art for the hardest part of this collection -- the IDE-R
redirection plane -- and it was NOT used. It was identified after the fact,
during a documentation-integrity review, and is recorded here rather than left
out.

--------------------------------------------------------------------------------
5. kraxel/amtterm -- amtider
--------------------------------------------------------------------------------
   Copyright (C) 2022 Hannes Reinecke <hare@suse.de> (amtider.c)
   Maintainer: Gerd Hoffmann (kraxel)
   License: GNU General Public License v2.0 or later
   Source: https://github.com/kraxel/amtterm

   WHAT THIS IS: amtider is a standalone, self-contained Intel AMT IDE-R
   client written in C -- it presents a local image file to a remote AMT
   machine as a virtual floppy or CD-ROM, which is the same job
   plugins/module_utils/ider.py does. It is, as far as this review found, the
   only standalone IDE-R implementation outside MeshCentral/MeshCmd. It ships
   in the amtterm source tree alongside amtterm (SOL), sharing redir.c, auth.c,
   ssl.c and ider.c, and has been built unconditionally since amtterm 1.7
   (GNUmakefile: `TARGETS := amtterm amtider`, unlike gamt which is
   conditional). Current release is 1.8 (tag amtterm-1.8-1, 2026-05-04), and
   TLS fixes for Intel ME 16 -- which no longer accepts non-SSL connections to
   the SOL/IDER port -- landed in 2026.

   WHAT WAS TAKEN FROM IT: NOTHING. No code, no protocol fact, no byte array,
   no state-machine behaviour. This collection's IDE-R implementation was
   reimplemented from MeshCentral (attribution 1 above), and every protocol
   claim in docs/protocol-notes.md sections 3 and 4 cites MeshCentral or a
   firmware fixture. The evidence that it genuinely was not used, rather than
   used and uncredited: the strings "amtider", "amtterm" and "kraxel" appear
   nowhere in this repository's source, documentation or git history prior to
   this section being added. Discovering an independent implementation after the
   fact neither validates nor invalidates this one.

   WHY IT IS RECORDED ANYWAY: README.md previously implied that no standalone
   IDE-R client existed -- that serving boot media is "why most automation
   shells out to MeshCmd (Node.js)". That framing was wrong by omission, and
   omitting the one genuine prior-art standalone IDE-R implementation is the
   most damaging possible gap in a document whose selling point is per-file
   provenance. The novelty claim in README.md has been narrowed accordingly.

   NOTE ON LICENSE: GPL-2.0-or-later is compatible with this collection's
   GPL-3.0-or-later, so reuse would have been permissible. It simply did not
   happen. Anyone wanting to build on amtider should take it from upstream
   under its own terms, not from here.
