rpms/fwupd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Rebase to 2.1.6

Browse Source 
Resolves: #RHEL-185627
This commit is contained in:
Richard Hughes 2026-07-03 15:27:17 +01:00
parent 85429e7e8d
commit 00a52684a2
7 changed files with 306 additions and 223 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.gitignore vendored
View File

@ -110,3 +110,6 @@
/fwupd-2.0.19.tar.xz
/40d3a4630619b83026f66bc64d97a582bbd9223ad53aa3f519ff5e2121d11ca6-DBXUpdate-20250507-x64.cab
/1.7.tar.gz
/fwupd-2.1.6.tar.xz
/fwupd-efi-1.8.tar.gz
/9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab

31
0001-Disable-the-UEFI-plugins-on-32bit-x86.patch
View File

@ -1,31 +0,0 @@
From f14115c509eeadfc65dafb78e2f7b8718de29eff Mon Sep 17 00:00:00 2001
From: Richard Hughes <richard@hughsie.com>
Date: Mon, 12 Jan 2026 10:16:19 +0000
Subject: [PATCH] Disable the UEFI plugins on 32bit x86
Although UEFI on 32 bit i686 is certainly possible to support, the dbx update
for IA32 has been downloaded only *once* by real users of fwupd, the other
downloads all being by bots or people syncing the entire LVFS repo.
There have been no KEKs uploaded for 32 bit-only targets, and all the platforms
are seemlying EOL. I'm not even going to bother to upload the next dbx for IA32.
---
meson.build | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meson.build b/meson.build
index 16cad5108..b0b610ad5 100644
--- a/meson.build
+++ b/meson.build
@@ -885,7 +885,7 @@ if dbusmock.returncode() != 0 and get_option('umockdev_tests').allowed()
endif
allow_uefi = host_machine.system() in ['linux', 'freebsd'] and \
- host_machine.cpu_family() in ['x86', 'x86_64', 'aarch64', 'riscv64', 'loongarch64']
+ host_machine.cpu_family() in ['x86_64', 'aarch64', 'riscv64', 'loongarch64']
subdir('generate-build')
subdir('libfwupd')
--
2.52.0

209
0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch Normal file
View File

@ -0,0 +1,209 @@
From 2ed98c7c2e0ac77b9967933af51615385f7e471d Mon Sep 17 00:00:00 2001
From: Richard Hughes <richard@hughsie.com>
Date: Thu, 2 Jul 2026 14:47:33 +0100
Subject: [PATCH] Fix the seal self tests when building on a tmpfs
When fwupd is exploded onto a tmpfs the assumption of 'is a local file *not* a
memfd' breaks. When fwupd is built using rpmbuild we do not control the
buildroot filesystem, so make the 'is a sealed fd required' check more explicit.
---
src/fu-dbus-daemon.c | 3 +
src/fu-engine.c | 6 ++
src/fu-unix-seekable-input-stream-test.c | 17 +++++-
src/fu-unix-seekable-input-stream.c | 70 ++++++++++++++++--------
src/fu-unix-seekable-input-stream.h | 2 +
5 files changed, 73 insertions(+), 25 deletions(-)
diff --git a/src/fu-dbus-daemon.c b/src/fu-dbus-daemon.c
index 72cc36fad..de8aa9a26 100644
--- a/src/fu-dbus-daemon.c
+++ b/src/fu-dbus-daemon.c
@@ -1158,6 +1158,9 @@ fu_dbus_daemon_invocation_get_input_stream(GDBusMethodInvocation *invocation, GE
stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, error);
if (stream == NULL)
return NULL;
+ if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
+ error))
+ return NULL;
return g_steal_pointer(&stream);
#else
g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INTERNAL, "unsupported feature");
diff --git a/src/fu-engine.c b/src/fu-engine.c
index 9eaed95ab..5820ea891 100644
--- a/src/fu-engine.c
+++ b/src/fu-engine.c
@@ -5069,9 +5069,15 @@ fu_engine_update_metadata(FuEngine *self,
stream_fd = fu_unix_seekable_input_stream_new(fd, TRUE, error);
if (stream_fd == NULL)
return FALSE;
+ if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream_fd),
+ error))
+ return FALSE;
stream_sig = fu_unix_seekable_input_stream_new(fd_sig, TRUE, error);
if (stream_sig == NULL)
return FALSE;
+ if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream_sig),
+ error))
+ return FALSE;
/* read the entire file into memory */
bytes_raw =
diff --git a/src/fu-unix-seekable-input-stream-test.c b/src/fu-unix-seekable-input-stream-test.c
index d65b70add..3b5e8d8ec 100644
--- a/src/fu-unix-seekable-input-stream-test.c
+++ b/src/fu-unix-seekable-input-stream-test.c
@@ -84,6 +84,7 @@ static void
fu_unix_seekable_input_stream_sealed_memfd_func(void)
{
#if defined(HAVE_GIO_UNIX) && defined(HAVE_MEMFD_CREATE)
+ gboolean ret;
g_autofd gint fd = -1;
g_autoptr(GError) error = NULL;
g_autoptr(GInputStream) stream = NULL;
@@ -93,11 +94,18 @@ fu_unix_seekable_input_stream_sealed_memfd_func(void)
g_assert_cmpint(fd, >=, 0);
g_assert_cmpint(write(fd, data, sizeof(data)), ==, sizeof(data));
g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0);
- g_assert_cmpint(fcntl(fd, F_ADD_SEALS, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW), ==, 0);
+ g_assert_cmpint(
+ fcntl(fd, F_ADD_SEALS, F_SEAL_SEAL | F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW),
+ ==,
+ 0);
stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, &error);
g_assert_no_error(error);
g_assert_nonnull(stream);
+ ret = fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
+ &error);
+ g_assert_no_error(error);
+ g_assert_true(ret);
#else
g_test_skip("No gio-unix-2.0 or memfd_create support, skipping");
#endif
@@ -107,6 +115,7 @@ static void
fu_unix_seekable_input_stream_unsealed_memfd_func(void)
{
#if defined(HAVE_GIO_UNIX) && defined(HAVE_MEMFD_CREATE)
+ gboolean ret;
g_autofd gint fd = -1;
g_autoptr(GError) error = NULL;
g_autoptr(GInputStream) stream = NULL;
@@ -118,8 +127,12 @@ fu_unix_seekable_input_stream_unsealed_memfd_func(void)
g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0);
stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, &error);
+ g_assert_no_error(error);
+ g_assert_nonnull(stream);
+ ret = fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
+ &error);
g_assert_error(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE);
- g_assert_null(stream);
+ g_assert_false(ret);
#else
g_test_skip("No gio-unix-2.0 or memfd_create support, skipping");
#endif
diff --git a/src/fu-unix-seekable-input-stream.c b/src/fu-unix-seekable-input-stream.c
index 4955c366c..591173812 100644
--- a/src/fu-unix-seekable-input-stream.c
+++ b/src/fu-unix-seekable-input-stream.c
@@ -116,25 +116,6 @@ fu_unix_seekable_input_stream_seekable_iface_init(GSeekableIface *iface)
iface->truncate_fn = fu_unix_seekable_input_stream_truncate;
}
-static gboolean
-fu_unix_seekable_input_stream_verify_sealed(gint fd, GError **error)
-{
-#ifdef HAVE_MEMFD_CREATE
- gint seals = fcntl(fd, F_GET_SEALS);
- if (seals >= 0 && (seals & (F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW)) !=
- (F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW)) {
- g_set_error(error,
- FWUPD_ERROR,
- FWUPD_ERROR_INVALID_FILE,
- "fd is missing required seals, got 0x%x",
- (guint)seals);
- return FALSE;
- }
-#endif
- /* success */
- return TRUE;
-}
-
/**
* fu_unix_seekable_input_stream_new:
* @fd: a UNIX file descriptor
@@ -177,14 +158,57 @@ fu_unix_seekable_input_stream_new(gint fd, gboolean close_fd, GError **error)
return NULL;
}
- /* if the fd supports sealing (i.e. is a memfd) then require immutability */
- if (!fu_unix_seekable_input_stream_verify_sealed(fd, error))
- return NULL;
-
/* success */
return g_steal_pointer(&stream);
}
+/**
+ * fu_unix_seekable_input_stream_require_seal:
+ * @stream: a #FuUnixSeekableInputStream
+ * @error: (nullable): optional return location for an error
+ *
+ * Enforces that the file descriptor backing this stream is a memfd with the required seals set.
+ *
+ * Returns: %TRUE if sealed
+ *
+ * Since: 2.1.7
+ **/
+gboolean
+fu_unix_seekable_input_stream_require_seal(FuUnixSeekableInputStream *stream, GError **error)
+{
+#ifdef HAVE_MEMFD_CREATE
+ gint fd;
+ gint seals;
+
+ g_return_val_if_fail(FU_IS_UNIX_SEEKABLE_INPUT_STREAM(stream), FALSE);
+ g_return_val_if_fail(error == NULL || *error == NULL, FALSE);
+
+ fd = g_unix_input_stream_get_fd(G_UNIX_INPUT_STREAM(stream));
+ seals = fcntl(fd, F_GET_SEALS);
+ if (seals < 0) {
+ /* not supported on this fd */
+ return TRUE;
+ }
+ if ((seals & F_SEAL_SEAL) == 0) {
+ g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "fd not sealed");
+ return FALSE;
+ }
+ if ((seals & F_SEAL_WRITE) == 0) {
+ g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no WRITE seal");
+ return FALSE;
+ }
+ if ((seals & F_SEAL_SHRINK) == 0) {
+ g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no SHRINK seal");
+ return FALSE;
+ }
+ if ((seals & F_SEAL_GROW) == 0) {
+ g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no GROW seal");
+ return FALSE;
+ }
+#endif
+ return TRUE;
+}
+
static void
fu_unix_seekable_input_stream_class_init(FuUnixSeekableInputStreamClass *klass)
{
diff --git a/src/fu-unix-seekable-input-stream.h b/src/fu-unix-seekable-input-stream.h
index 5f0a0656a..6d7b2acde 100644
--- a/src/fu-unix-seekable-input-stream.h
+++ b/src/fu-unix-seekable-input-stream.h
@@ -18,3 +18,5 @@ G_DECLARE_FINAL_TYPE(FuUnixSeekableInputStream,
GInputStream *
fu_unix_seekable_input_stream_new(gint fd, gboolean close_fd, GError **error);
+gboolean
+fu_unix_seekable_input_stream_require_seal(FuUnixSeekableInputStream *stream, GError **error);
--
2.54.0

118
0001-Revert-trivial-Remove-some-dead-JCat-compat-code.patch
View File

@ -1,118 +0,0 @@
From 8c5c3fe46c4a10eafd8a11f888216f61448121f3 Mon Sep 17 00:00:00 2001
From: Richard Hughes <richard@hughsie.com>
Date: Fri, 9 Jan 2026 16:36:24 +0000
Subject: [PATCH] Revert "trivial: Remove some dead JCat compat code"
This reverts commit b3cd790875065fdda7b8bf7328c325af8ce30a52 so we can build
on RHEL 9 without also upreving libjcat.
(cherry picked from commit 4f6726f410cedcae7707366d89ef36f9d370950b)
---
meson.build | 2 +-
src/fu-cabinet.c | 12 +++++++++++-
src/fu-engine.c | 9 +++++++++
3 files changed, 21 insertions(+), 2 deletions(-)
diff --git a/meson.build b/meson.build
index 5726be646..1766ce8b6 100644
--- a/meson.build
+++ b/meson.build
@@ -360,7 +360,7 @@ if build_standalone
endif
libjcat = dependency(
'jcat',
- version: '>= 0.2.0',
+ version: '>= 0.1.6',
fallback: ['libjcat', 'libjcat_dep'],
)
libjsonglib = dependency(
diff --git a/src/fu-cabinet.c b/src/fu-cabinet.c
index dabc1eb6d..28b91b450 100644
--- a/src/fu-cabinet.c
+++ b/src/fu-cabinet.c
@@ -12,6 +12,11 @@
#include "fu-cabinet.h"
+/* fixed in 0.1.14 */
+#ifndef JCAT_CHECK_VERSION
+#define JCAT_CHECK_VERSION LIBJCAT_CHECK_VERSION
+#endif
+
/**
* FuCabinet:
*
@@ -225,6 +230,7 @@ fu_cabinet_parse_release(FuCabinet *self,
/* the jcat file signed the *checksum of the payload*, not the payload itself */
item = jcat_file_get_item_by_id(self->jcat_file, basename, NULL);
+#if JCAT_CHECK_VERSION(0, 2, 0)
if (item != NULL && jcat_item_has_target(item)) {
g_autofree gchar *checksum_sha256 = NULL;
g_autofree gchar *checksum_sha512 = NULL;
@@ -265,7 +271,9 @@ fu_cabinet_parse_release(FuCabinet *self,
g_info("verified indirect payload %s: %u", basename, results->len);
release_flags |= FWUPD_RELEASE_FLAG_TRUSTED_PAYLOAD;
}
- } else if (item != NULL) {
+ }
+#endif
+ if (item != NULL) {
g_autoptr(GBytes) blob = NULL;
g_autoptr(GError) error_local = NULL;
g_autoptr(GPtrArray) results = NULL;
@@ -1079,10 +1087,12 @@ fu_cabinet_init(FuCabinet *self)
self->builder = xb_builder_new();
self->jcat_file = jcat_file_new();
self->jcat_context = jcat_context_new();
+#if JCAT_CHECK_VERSION(0, 1, 13)
jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_SHA256);
jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_SHA512);
jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_PKCS7);
jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_GPG);
+#endif
}
static void
diff --git a/src/fu-engine.c b/src/fu-engine.c
index 498b6ebf8..9f2df208d 100644
--- a/src/fu-engine.c
+++ b/src/fu-engine.c
@@ -76,6 +76,11 @@
/* only needed until we hard depend on jcat 0.1.3 */
#include <libjcat/jcat-version.h>
+/* fixed in 0.1.14 */
+#ifndef JCAT_CHECK_VERSION
+#define JCAT_CHECK_VERSION LIBJCAT_CHECK_VERSION
+#endif
+
#ifdef HAVE_SYSTEMD
#include "fu-systemd.h"
#endif
@@ -9336,10 +9341,12 @@ fu_engine_constructed(GObject *obj)
/* setup Jcat context */
self->jcat_context = jcat_context_new();
+#if JCAT_CHECK_VERSION(0, 1, 13)
jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_SHA256);
jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_SHA512);
jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_PKCS7);
jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_GPG);
+#endif
keyring_path = fu_path_from_kind(FU_PATH_KIND_LOCALSTATEDIR_PKG);
jcat_context_set_keyring_path(self->jcat_context, keyring_path);
pkidir_fw = fu_path_build(FU_PATH_KIND_SYSCONFDIR, "pki", "fwupd", NULL);
@@ -9349,7 +9356,9 @@ fu_engine_constructed(GObject *obj)
/* add some runtime versions of things the daemon depends on */
fu_engine_add_runtime_version(self, "org.freedesktop.fwupd", VERSION);
+#if JCAT_CHECK_VERSION(0, 1, 11)
fu_engine_add_runtime_version(self, "com.hughsie.libjcat", jcat_version_string());
+#endif
fu_engine_add_runtime_version(self, "com.hughsie.libxmlb", xb_version_string());
/* optional kernel version */
--
2.52.0

42
0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch Normal file
View File

@ -0,0 +1,42 @@
From f7352aa9e2157a5ed88d10278ef420a78c8a52f8 Mon Sep 17 00:00:00 2001
From: Richard Hughes <richard@hughsie.com>
Date: Thu, 2 Jul 2026 16:16:28 +0100
Subject: [PATCH] Seal memfds for compatibility with newer fwupd daemons
---
libfwupd/fwupd-common.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/libfwupd/fwupd-common.c b/libfwupd/fwupd-common.c
index 3220c40a7..862210c8a 100644
--- a/libfwupd/fwupd-common.c
+++ b/libfwupd/fwupd-common.c
@@ -1054,7 +1054,7 @@ fwupd_unix_input_stream_from_bytes(GBytes *bytes, GError **error)
#endif
#ifdef HAVE_MEMFD_CREATE
- fd = memfd_create("fwupd", MFD_CLOEXEC);
+ fd = memfd_create("fwupd", MFD_CLOEXEC | MFD_ALLOW_SEALING);
#else
/* emulate in-memory file by an unlinked temporary file */
fd = g_mkstemp(tmp_file);
@@ -1098,6 +1098,16 @@ fwupd_unix_input_stream_from_bytes(GBytes *bytes, GError **error)
g_strerror(errno));
return NULL;
}
+#ifdef HAVE_MEMFD_CREATE
+ if (fcntl(fd, F_ADD_SEALS, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_SEAL) < 0) {
+ g_set_error(error,
+ FWUPD_ERROR,
+ FWUPD_ERROR_INVALID_FILE,
+ "failed to seal memfd: %s",
+ strerror(errno));
+ return NULL;
+ }
+#endif
return G_UNIX_INPUT_STREAM(g_unix_input_stream_new(fd, TRUE));
}
--
2.54.0

120
fwupd.spec
View File

@ -1,5 +1,5 @@
%global glib2_version 2.68.0
%global libxmlb_version 0.1.3
%global libxmlb_version 0.3.24
%global libusb_version 1.0.9
%global libcurl_version 7.62.0
%global libjcat_version 0.1.0
@ -27,22 +27,17 @@
%endif
# fwupd.efi is only available on these arches
%ifarch x86_64 aarch64 riscv64
%ifarch x86_64 aarch64 riscv64 loongarch64
%global have_uefi 1
%define sb_ca %{_datadir}/pki/sb-certs/secureboot-ca-%{_arch}.cer
%define sb_cer %{_datadir}/pki/sb-certs/secureboot-fwupd-%{_arch}.cer
%if 0%{?centos}
%define sb_key centossecureboot202
%define sb_key centossecureboot802
%else
%define sb_key redhatsecureboot802
%endif
%endif
# flashrom is only available on these arches
%ifarch i686 x86_64 armv7hl aarch64 ppc64le riscv64
%global have_flashrom 1
%endif
%ifarch i686 x86_64
%global have_msr 1
%endif
@ -58,20 +53,20 @@
Summary: Firmware update daemon
Name: fwupd
Version: 2.0.19
Release: 2%{?dist}
Version: 2.1.6
Release: 1%{?dist}
License: LGPL-2.1-or-later
URL: https://github.com/fwupd/fwupd
Source0: http://people.freedesktop.org/~hughsient/releases/%{name}-%{version}.tar.xz
%if 0%{?libfwupd_19x_version}
Source1: https://github.com/fwupd/%{name}-efi/archive/refs/tags/1.7.tar.gz
Source1: https://github.com/fwupd/%{name}-efi/archive/refs/tags/fwupd-efi-1.8.tar.gz
Source2: https://github.com/fwupd/%{name}/releases/download/1.9.%{libfwupd_19x_version}/%{name}-1.9.%{libfwupd_19x_version}.tar.xz
%endif
Source24: https://fwupd.org/downloads/40d3a4630619b83026f66bc64d97a582bbd9223ad53aa3f519ff5e2121d11ca6-DBXUpdate-20250507-x64.cab
Source24: https://fwupd.org/downloads/9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab
Patch101: 0001-Revert-trivial-Remove-some-dead-JCat-compat-code.patch
Patch102: 0001-Disable-the-UEFI-plugins-on-32bit-x86.patch
Patch1: 0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch
Patch2: 0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch
Patch201: 0001-Revert-Require-gnu-efi-3.0.18-or-later.patch
@ -83,20 +78,14 @@ BuildRequires: libusb1-devel >= %{libusb_version}
BuildRequires: libcurl-devel >= %{libcurl_version}
BuildRequires: libjcat-devel >= %{libjcat_version}
BuildRequires: polkit-devel >= 0.103
BuildRequires: protobuf-c-devel
BuildRequires: python3-packaging
BuildRequires: python3-jinja2
BuildRequires: sqlite-devel
BuildRequires: systemd >= %{systemd_version}
BuildRequires: systemd-devel
BuildRequires: libarchive-devel
BuildRequires: libcbor-devel
BuildRequires: libblkid-devel
BuildRequires: readline-devel
BuildRequires: libmnl-devel
%if 0%{?have_passim}
BuildRequires: passim-devel
%endif
BuildRequires: gobject-introspection-devel
%ifarch %{valgrind_arches}
BuildRequires: valgrind
@ -112,9 +101,6 @@ BuildRequires: json-glib-devel >= %{json_glib_version}
BuildRequires: vala
BuildRequires: pkgconfig(bash-completion)
BuildRequires: git-core
%if 0%{?have_flashrom}
BuildRequires: flashrom-devel >= 1.2-2
%endif
BuildRequires: libdrm-devel
# For fu-polkit-test
BuildRequires: polkit
@ -157,6 +143,10 @@ Recommends: python3
Obsoletes: dbxtool < 9
Provides: dbxtool
# this was removed in 2.1.4
Obsoletes: %{name}-plugin-flashrom < 2.1.4
Obsoletes: %{name}-plugin-flashrom-debuginfo < 2.1.4
%if 0%{?rhel} > 7
Obsoletes: fwupdate < 11-4
Obsoletes: fwupdate-efi < 11-4
@ -176,9 +166,6 @@ Recommends: passim
%if 0%{?have_modem_manager}
Recommends: %{name}-plugin-modem-manager
%endif
%if 0%{?have_flashrom}
Recommends: %{name}-plugin-flashrom
%endif
%if 0%{?have_uefi}
Recommends: %{name}-efi
Recommends: %{name}-plugin-uefi-capsule-data
@ -213,16 +200,6 @@ This provides the optional package which is only required on hardware that
might have mobile broadband hardware. It is probably not required on servers.
%endif
%if 0%{?have_flashrom}
%package plugin-flashrom
Summary: fwupd plugin using flashrom
Requires: %{name}%{?_isa} = %{version}-%{release}
%description plugin-flashrom
This provides the optional package which is only required on hardware that
can be flashed using flashrom. It is probably not required on servers.
%endif
%if 0%{?have_uefi}
%package plugin-uefi-capsule-data
Summary: Localized data for the UEFI UX capsule
@ -237,9 +214,7 @@ or server machines.
%prep
%setup -q
%patch -p1 101
%patch -p1 102
%patch 1 -p1
# the EFI helper
%if 0%{?libfwupd_19x_version}
@ -253,6 +228,8 @@ cd -
# and the old version for libfwupd1
%if 0%{?libfwupd_19x_version}
tar xfs %{SOURCE2}
cd fwupd-1.9.%{libfwupd_19x_version}
%patch 2 -p1
%endif
%build
@ -268,19 +245,14 @@ cd fwupd-1.9.%{libfwupd_19x_version}
-Dbash_completion=false \
-Dplugin_msr=disabled \
-Dintrospection=disabled \
-Dplugin_logitech_bulkcontroller=disabled \
-Dlaunchd=disabled
%meson_build
cd -
%endif
%meson \
-Dsupported_build=enabled \
-Dumockdev_tests=disabled \
%if 0%{?have_uefi}
-Defi_binary=true \
-Dfwupd-efi:genpeimg=disabled \
-Defi_os_dir=%{efi_vendor} \
%endif
%if 0%{?have_gi_docgen}
-Ddocs=enabled \
%else
@ -291,10 +263,10 @@ cd -
%else
-Dtests=false \
%endif
%if 0%{?have_flashrom}
-Dplugin_flashrom=enabled \
%else
-Dplugin_flashrom=disabled \
%if 0%{?have_uefi}
-Defi_binary=true \
-Dfwupd-efi:genpeimg=disabled \
-Defi_os_dir=%{efi_vendor} \
%endif
%if 0%{?have_modem_manager}
-Dplugin_modem_manager=enabled \
@ -307,26 +279,30 @@ cd -
-Dpassim=enabled \
%else
-Dpassim=disabled \
%endif
%ifarch i686 x86_64
-Dhsi=enabled \
%else
-Dhsi=disabled \
%endif
%ifarch %{valgrind_arches}
-Dvalgrind=enabled \
%else
-Dvalgrind=disabled \
%endif
-Dman=true \
-Dsystemd_unit_user="" \
-Dbluez=enabled
-Dbluez=enabled \
-Dsupported_build=enabled
%meson_build
%if 0%{?enable_tests}
%check
%meson_test
%endif
%install
%if 0%{?libfwupd_19x_version}
cd fwupd-1.9.%{libfwupd_19x_version}
%meson_install
cd -
%endif
%meson_install
# on RHEL the LVFS is disabled by default
@ -338,29 +314,31 @@ install \
%ifarch x86_64
%global efiarch x64
%global fwup_efi_fn $RPM_BUILD_ROOT%{_libexecdir}/fwupd/efi/fwupd%{efiarch}.efi
%define __pesign_client_cert fwupd-signer
%pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.signed -a %{sb_ca} -c %{sb_cer} -n %{sb_key}
%endif
# literally pointless if we are building fwupd-efi as a subproject
rm -f %{buildroot}%{_libdir}/pkgconfig/fwupd-efi.pc
mkdir -p --mode=0700 $RPM_BUILD_ROOT%{_localstatedir}/lib/fwupd/gnupg
mkdir -p --mode=0700 $RPM_BUILD_ROOT%{_localstatedir}/lib/fwupd
# workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1757948
mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/cache/fwupd
%find_lang %{name}
%check
%if 0%{?enable_tests}
%meson_test
%endif
%ifarch x86_64
pesigcheck -i %{fwup_efi_fn}.signed -n0 -c %{sb_cer}
%endif
%post
%systemd_post fwupd.service fwupd-refresh.timer
# change vendor-installed remotes to use the default keyring type
for fn in /etc/fwupd/remotes.d/*.conf; do
if grep -q "Keyring=gpg" "$fn"; then
sed -i 's/Keyring=gpg/#Keyring=pkcs/g' "$fn";
fi
done
%preun
%systemd_preun fwupd.service fwupd-refresh.timer
@ -394,6 +372,7 @@ systemctl --no-reload preset fwupd-refresh.timer &>/dev/null || :
%{_sysconfdir}/fwupd/bios-settings.d/README.md
%dir %{_sysconfdir}/fwupd/remotes.d
%config(noreplace)%{_sysconfdir}/fwupd/remotes.d/lvfs.conf
%config(noreplace)%{_sysconfdir}/fwupd/remotes.d/lvfs-embargo.conf
%config(noreplace)%{_sysconfdir}/fwupd/remotes.d/lvfs-testing.conf
%config(noreplace)%{_sysconfdir}/fwupd/remotes.d/vendor-directory.conf
%config(noreplace)%{_sysconfdir}/pki/fwupd
@ -452,19 +431,14 @@ systemctl --no-reload preset fwupd-refresh.timer &>/dev/null || :
/usr/lib/systemd/system-shutdown/fwupd.shutdown
%dir %{_libdir}/fwupd-%{version}
%{_libdir}/fwupd-%{version}/libfwupd*.so
%ghost %{_localstatedir}/lib/fwupd/gnupg
%if 0%{?have_modem_manager}
%files plugin-modem-manager
%{_libdir}/fwupd-%{version}/libfu_plugin_modem_manager.so
%endif
%if 0%{?have_flashrom}
%files plugin-flashrom
%{_libdir}/fwupd-%{version}/libfu_plugin_flashrom.so
%endif
%if 0%{?have_uefi}
%files plugin-uefi-capsule-data
%{_datadir}/fwupd/uefi-capsule-ux.tar.xz
%{_datadir}/fwupd/uefi-capsule-ux.zip
%endif
%files devel
@ -492,6 +466,10 @@ systemctl --no-reload preset fwupd-refresh.timer &>/dev/null || :
%endif
%changelog
* Fri Jul 03 2026 Richard Hughes <richard@hughsie.com> 2.1.6-1
- Rebase to get new hardware support
- Resolves: #RHEL-185627
* Fri Jan 09 2026 Richard Hughes <richard@hughsie.com> 2.0.19-1
- Rebase to get new hardware support
- Resolves: #RHEL-125778

6
sources
View File

@ -1,4 +1,4 @@
SHA512 (fwupd-2.0.19.tar.xz) = a4db6a776cbbedc54cd929899e9df7029f7ca9931a82c5a7661f48bcdc60c7dd18c926254b1b90e1fad225269fbe81f5323cba7ab37624b044c888648dce1944
SHA512 (1.7.tar.gz) = db0857e76964c6e36dd8708fe3b4a0b56290543c374e40a9e1f0919e0016d59de6bd6d2e4f43fb2ddd706841917b60d36da086e1290d3351283504d287083a7e
SHA512 (fwupd-2.1.6.tar.xz) = ac6400017df913b96f0df2616ffe92d4eeb4bf97d2c33fa1fe6ed8f5aba86438418d56db0b1e54a9977cb729b35c23c2010d778ef37486d0ed7058640e9c35d0
SHA512 (fwupd-efi-1.8.tar.gz) = bd361eb60397850af025228ea9f4efbf289f8e1c2612f240ae4c5ffee8caea15c31aa0748c06e57b28a7f38b8c2708147a228d8a99077798f4435436f12e092e
SHA512 (fwupd-1.9.31.tar.xz) = ce9cd5129d0bcbedade6ba11f661fd3350445557d3116f479a8628376e9e8d6a933e6d2632ac3576d47ad9dbf0eafd54480d2765be86f776e8f04f689287ec80
SHA512 (40d3a4630619b83026f66bc64d97a582bbd9223ad53aa3f519ff5e2121d11ca6-DBXUpdate-20250507-x64.cab) = f94e4f44a62621fc0a032a99613df81452bfc8eefc41f473708a43502fb298b477ed9d902166c833278397303a166d29ed891d797fe8e3b3afece5d6bc9645f2
SHA512 (9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab) = 7fff3d5757b6ca5392ae21b7eab06d216d8eb3ccf24f68399679c402d21c842b7d9b0f716071b3f1163325f216926d3941fe494ca784ef257c466477525af76f