From 00a52684a2a4026aec642768af43ccd3d967c9d4 Mon Sep 17 00:00:00 2001 From: Richard Hughes Date: Fri, 3 Jul 2026 15:27:17 +0100 Subject: [PATCH] Rebase to 2.1.6 Resolves: #RHEL-185627 --- .gitignore | 3 + ...isable-the-UEFI-plugins-on-32bit-x86.patch | 31 --- ...-self-tests-when-building-on-a-tmpfs.patch | 209 ++++++++++++++++++ ...al-Remove-some-dead-JCat-compat-code.patch | 118 ---------- ...compatibility-with-newer-fwupd-daemo.patch | 42 ++++ fwupd.spec | 120 ++++------ sources | 6 +- 7 files changed, 306 insertions(+), 223 deletions(-) delete mode 100644 0001-Disable-the-UEFI-plugins-on-32bit-x86.patch create mode 100644 0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch delete mode 100644 0001-Revert-trivial-Remove-some-dead-JCat-compat-code.patch create mode 100644 0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch diff --git a/.gitignore b/.gitignore index 12ec002..dd1a179 100644 --- a/.gitignore +++ b/.gitignore @@ -110,3 +110,6 @@ /fwupd-2.0.19.tar.xz /40d3a4630619b83026f66bc64d97a582bbd9223ad53aa3f519ff5e2121d11ca6-DBXUpdate-20250507-x64.cab /1.7.tar.gz +/fwupd-2.1.6.tar.xz +/fwupd-efi-1.8.tar.gz +/9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab diff --git a/0001-Disable-the-UEFI-plugins-on-32bit-x86.patch b/0001-Disable-the-UEFI-plugins-on-32bit-x86.patch deleted file mode 100644 index eae0279..0000000 --- a/0001-Disable-the-UEFI-plugins-on-32bit-x86.patch +++ /dev/null @@ -1,31 +0,0 @@ -From f14115c509eeadfc65dafb78e2f7b8718de29eff Mon Sep 17 00:00:00 2001 -From: Richard Hughes -Date: Mon, 12 Jan 2026 10:16:19 +0000 -Subject: [PATCH] Disable the UEFI plugins on 32bit x86 - -Although UEFI on 32 bit i686 is certainly possible to support, the dbx update -for IA32 has been downloaded only *once* by real users of fwupd, the other -downloads all being by bots or people syncing the entire LVFS repo. - -There have been no KEKs uploaded for 32 bit-only targets, and all the platforms -are seemlying EOL. I'm not even going to bother to upload the next dbx for IA32. ---- - meson.build | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/meson.build b/meson.build -index 16cad5108..b0b610ad5 100644 ---- a/meson.build -+++ b/meson.build -@@ -885,7 +885,7 @@ if dbusmock.returncode() != 0 and get_option('umockdev_tests').allowed() - endif - - allow_uefi = host_machine.system() in ['linux', 'freebsd'] and \ -- host_machine.cpu_family() in ['x86', 'x86_64', 'aarch64', 'riscv64', 'loongarch64'] -+ host_machine.cpu_family() in ['x86_64', 'aarch64', 'riscv64', 'loongarch64'] - - subdir('generate-build') - subdir('libfwupd') --- -2.52.0 - diff --git a/0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch b/0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch new file mode 100644 index 0000000..8562e5b --- /dev/null +++ b/0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch @@ -0,0 +1,209 @@ +From 2ed98c7c2e0ac77b9967933af51615385f7e471d Mon Sep 17 00:00:00 2001 +From: Richard Hughes +Date: Thu, 2 Jul 2026 14:47:33 +0100 +Subject: [PATCH] Fix the seal self tests when building on a tmpfs + +When fwupd is exploded onto a tmpfs the assumption of 'is a local file *not* a +memfd' breaks. When fwupd is built using rpmbuild we do not control the +buildroot filesystem, so make the 'is a sealed fd required' check more explicit. +--- + src/fu-dbus-daemon.c | 3 + + src/fu-engine.c | 6 ++ + src/fu-unix-seekable-input-stream-test.c | 17 +++++- + src/fu-unix-seekable-input-stream.c | 70 ++++++++++++++++-------- + src/fu-unix-seekable-input-stream.h | 2 + + 5 files changed, 73 insertions(+), 25 deletions(-) + +diff --git a/src/fu-dbus-daemon.c b/src/fu-dbus-daemon.c +index 72cc36fad..de8aa9a26 100644 +--- a/src/fu-dbus-daemon.c ++++ b/src/fu-dbus-daemon.c +@@ -1158,6 +1158,9 @@ fu_dbus_daemon_invocation_get_input_stream(GDBusMethodInvocation *invocation, GE + stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, error); + if (stream == NULL) + return NULL; ++ if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream), ++ error)) ++ return NULL; + return g_steal_pointer(&stream); + #else + g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INTERNAL, "unsupported feature"); +diff --git a/src/fu-engine.c b/src/fu-engine.c +index 9eaed95ab..5820ea891 100644 +--- a/src/fu-engine.c ++++ b/src/fu-engine.c +@@ -5069,9 +5069,15 @@ fu_engine_update_metadata(FuEngine *self, + stream_fd = fu_unix_seekable_input_stream_new(fd, TRUE, error); + if (stream_fd == NULL) + return FALSE; ++ if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream_fd), ++ error)) ++ return FALSE; + stream_sig = fu_unix_seekable_input_stream_new(fd_sig, TRUE, error); + if (stream_sig == NULL) + return FALSE; ++ if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream_sig), ++ error)) ++ return FALSE; + + /* read the entire file into memory */ + bytes_raw = +diff --git a/src/fu-unix-seekable-input-stream-test.c b/src/fu-unix-seekable-input-stream-test.c +index d65b70add..3b5e8d8ec 100644 +--- a/src/fu-unix-seekable-input-stream-test.c ++++ b/src/fu-unix-seekable-input-stream-test.c +@@ -84,6 +84,7 @@ static void + fu_unix_seekable_input_stream_sealed_memfd_func(void) + { + #if defined(HAVE_GIO_UNIX) && defined(HAVE_MEMFD_CREATE) ++ gboolean ret; + g_autofd gint fd = -1; + g_autoptr(GError) error = NULL; + g_autoptr(GInputStream) stream = NULL; +@@ -93,11 +94,18 @@ fu_unix_seekable_input_stream_sealed_memfd_func(void) + g_assert_cmpint(fd, >=, 0); + g_assert_cmpint(write(fd, data, sizeof(data)), ==, sizeof(data)); + g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0); +- g_assert_cmpint(fcntl(fd, F_ADD_SEALS, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW), ==, 0); ++ g_assert_cmpint( ++ fcntl(fd, F_ADD_SEALS, F_SEAL_SEAL | F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW), ++ ==, ++ 0); + + stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, &error); + g_assert_no_error(error); + g_assert_nonnull(stream); ++ ret = fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream), ++ &error); ++ g_assert_no_error(error); ++ g_assert_true(ret); + #else + g_test_skip("No gio-unix-2.0 or memfd_create support, skipping"); + #endif +@@ -107,6 +115,7 @@ static void + fu_unix_seekable_input_stream_unsealed_memfd_func(void) + { + #if defined(HAVE_GIO_UNIX) && defined(HAVE_MEMFD_CREATE) ++ gboolean ret; + g_autofd gint fd = -1; + g_autoptr(GError) error = NULL; + g_autoptr(GInputStream) stream = NULL; +@@ -118,8 +127,12 @@ fu_unix_seekable_input_stream_unsealed_memfd_func(void) + g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0); + + stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, &error); ++ g_assert_no_error(error); ++ g_assert_nonnull(stream); ++ ret = fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream), ++ &error); + g_assert_error(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE); +- g_assert_null(stream); ++ g_assert_false(ret); + #else + g_test_skip("No gio-unix-2.0 or memfd_create support, skipping"); + #endif +diff --git a/src/fu-unix-seekable-input-stream.c b/src/fu-unix-seekable-input-stream.c +index 4955c366c..591173812 100644 +--- a/src/fu-unix-seekable-input-stream.c ++++ b/src/fu-unix-seekable-input-stream.c +@@ -116,25 +116,6 @@ fu_unix_seekable_input_stream_seekable_iface_init(GSeekableIface *iface) + iface->truncate_fn = fu_unix_seekable_input_stream_truncate; + } + +-static gboolean +-fu_unix_seekable_input_stream_verify_sealed(gint fd, GError **error) +-{ +-#ifdef HAVE_MEMFD_CREATE +- gint seals = fcntl(fd, F_GET_SEALS); +- if (seals >= 0 && (seals & (F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW)) != +- (F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW)) { +- g_set_error(error, +- FWUPD_ERROR, +- FWUPD_ERROR_INVALID_FILE, +- "fd is missing required seals, got 0x%x", +- (guint)seals); +- return FALSE; +- } +-#endif +- /* success */ +- return TRUE; +-} +- + /** + * fu_unix_seekable_input_stream_new: + * @fd: a UNIX file descriptor +@@ -177,14 +158,57 @@ fu_unix_seekable_input_stream_new(gint fd, gboolean close_fd, GError **error) + return NULL; + } + +- /* if the fd supports sealing (i.e. is a memfd) then require immutability */ +- if (!fu_unix_seekable_input_stream_verify_sealed(fd, error)) +- return NULL; +- + /* success */ + return g_steal_pointer(&stream); + } + ++/** ++ * fu_unix_seekable_input_stream_require_seal: ++ * @stream: a #FuUnixSeekableInputStream ++ * @error: (nullable): optional return location for an error ++ * ++ * Enforces that the file descriptor backing this stream is a memfd with the required seals set. ++ * ++ * Returns: %TRUE if sealed ++ * ++ * Since: 2.1.7 ++ **/ ++gboolean ++fu_unix_seekable_input_stream_require_seal(FuUnixSeekableInputStream *stream, GError **error) ++{ ++#ifdef HAVE_MEMFD_CREATE ++ gint fd; ++ gint seals; ++ ++ g_return_val_if_fail(FU_IS_UNIX_SEEKABLE_INPUT_STREAM(stream), FALSE); ++ g_return_val_if_fail(error == NULL || *error == NULL, FALSE); ++ ++ fd = g_unix_input_stream_get_fd(G_UNIX_INPUT_STREAM(stream)); ++ seals = fcntl(fd, F_GET_SEALS); ++ if (seals < 0) { ++ /* not supported on this fd */ ++ return TRUE; ++ } ++ if ((seals & F_SEAL_SEAL) == 0) { ++ g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "fd not sealed"); ++ return FALSE; ++ } ++ if ((seals & F_SEAL_WRITE) == 0) { ++ g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no WRITE seal"); ++ return FALSE; ++ } ++ if ((seals & F_SEAL_SHRINK) == 0) { ++ g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no SHRINK seal"); ++ return FALSE; ++ } ++ if ((seals & F_SEAL_GROW) == 0) { ++ g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no GROW seal"); ++ return FALSE; ++ } ++#endif ++ return TRUE; ++} ++ + static void + fu_unix_seekable_input_stream_class_init(FuUnixSeekableInputStreamClass *klass) + { +diff --git a/src/fu-unix-seekable-input-stream.h b/src/fu-unix-seekable-input-stream.h +index 5f0a0656a..6d7b2acde 100644 +--- a/src/fu-unix-seekable-input-stream.h ++++ b/src/fu-unix-seekable-input-stream.h +@@ -18,3 +18,5 @@ G_DECLARE_FINAL_TYPE(FuUnixSeekableInputStream, + + GInputStream * + fu_unix_seekable_input_stream_new(gint fd, gboolean close_fd, GError **error); ++gboolean ++fu_unix_seekable_input_stream_require_seal(FuUnixSeekableInputStream *stream, GError **error); +-- +2.54.0 + diff --git a/0001-Revert-trivial-Remove-some-dead-JCat-compat-code.patch b/0001-Revert-trivial-Remove-some-dead-JCat-compat-code.patch deleted file mode 100644 index f990a9b..0000000 --- a/0001-Revert-trivial-Remove-some-dead-JCat-compat-code.patch +++ /dev/null @@ -1,118 +0,0 @@ -From 8c5c3fe46c4a10eafd8a11f888216f61448121f3 Mon Sep 17 00:00:00 2001 -From: Richard Hughes -Date: Fri, 9 Jan 2026 16:36:24 +0000 -Subject: [PATCH] Revert "trivial: Remove some dead JCat compat code" - -This reverts commit b3cd790875065fdda7b8bf7328c325af8ce30a52 so we can build -on RHEL 9 without also upreving libjcat. - -(cherry picked from commit 4f6726f410cedcae7707366d89ef36f9d370950b) ---- - meson.build | 2 +- - src/fu-cabinet.c | 12 +++++++++++- - src/fu-engine.c | 9 +++++++++ - 3 files changed, 21 insertions(+), 2 deletions(-) - -diff --git a/meson.build b/meson.build -index 5726be646..1766ce8b6 100644 ---- a/meson.build -+++ b/meson.build -@@ -360,7 +360,7 @@ if build_standalone - endif - libjcat = dependency( - 'jcat', -- version: '>= 0.2.0', -+ version: '>= 0.1.6', - fallback: ['libjcat', 'libjcat_dep'], - ) - libjsonglib = dependency( -diff --git a/src/fu-cabinet.c b/src/fu-cabinet.c -index dabc1eb6d..28b91b450 100644 ---- a/src/fu-cabinet.c -+++ b/src/fu-cabinet.c -@@ -12,6 +12,11 @@ - - #include "fu-cabinet.h" - -+/* fixed in 0.1.14 */ -+#ifndef JCAT_CHECK_VERSION -+#define JCAT_CHECK_VERSION LIBJCAT_CHECK_VERSION -+#endif -+ - /** - * FuCabinet: - * -@@ -225,6 +230,7 @@ fu_cabinet_parse_release(FuCabinet *self, - - /* the jcat file signed the *checksum of the payload*, not the payload itself */ - item = jcat_file_get_item_by_id(self->jcat_file, basename, NULL); -+#if JCAT_CHECK_VERSION(0, 2, 0) - if (item != NULL && jcat_item_has_target(item)) { - g_autofree gchar *checksum_sha256 = NULL; - g_autofree gchar *checksum_sha512 = NULL; -@@ -265,7 +271,9 @@ fu_cabinet_parse_release(FuCabinet *self, - g_info("verified indirect payload %s: %u", basename, results->len); - release_flags |= FWUPD_RELEASE_FLAG_TRUSTED_PAYLOAD; - } -- } else if (item != NULL) { -+ } -+#endif -+ if (item != NULL) { - g_autoptr(GBytes) blob = NULL; - g_autoptr(GError) error_local = NULL; - g_autoptr(GPtrArray) results = NULL; -@@ -1079,10 +1087,12 @@ fu_cabinet_init(FuCabinet *self) - self->builder = xb_builder_new(); - self->jcat_file = jcat_file_new(); - self->jcat_context = jcat_context_new(); -+#if JCAT_CHECK_VERSION(0, 1, 13) - jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_SHA256); - jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_SHA512); - jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_PKCS7); - jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_GPG); -+#endif - } - - static void -diff --git a/src/fu-engine.c b/src/fu-engine.c -index 498b6ebf8..9f2df208d 100644 ---- a/src/fu-engine.c -+++ b/src/fu-engine.c -@@ -76,6 +76,11 @@ - /* only needed until we hard depend on jcat 0.1.3 */ - #include - -+/* fixed in 0.1.14 */ -+#ifndef JCAT_CHECK_VERSION -+#define JCAT_CHECK_VERSION LIBJCAT_CHECK_VERSION -+#endif -+ - #ifdef HAVE_SYSTEMD - #include "fu-systemd.h" - #endif -@@ -9336,10 +9341,12 @@ fu_engine_constructed(GObject *obj) - - /* setup Jcat context */ - self->jcat_context = jcat_context_new(); -+#if JCAT_CHECK_VERSION(0, 1, 13) - jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_SHA256); - jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_SHA512); - jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_PKCS7); - jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_GPG); -+#endif - keyring_path = fu_path_from_kind(FU_PATH_KIND_LOCALSTATEDIR_PKG); - jcat_context_set_keyring_path(self->jcat_context, keyring_path); - pkidir_fw = fu_path_build(FU_PATH_KIND_SYSCONFDIR, "pki", "fwupd", NULL); -@@ -9349,7 +9356,9 @@ fu_engine_constructed(GObject *obj) - - /* add some runtime versions of things the daemon depends on */ - fu_engine_add_runtime_version(self, "org.freedesktop.fwupd", VERSION); -+#if JCAT_CHECK_VERSION(0, 1, 11) - fu_engine_add_runtime_version(self, "com.hughsie.libjcat", jcat_version_string()); -+#endif - fu_engine_add_runtime_version(self, "com.hughsie.libxmlb", xb_version_string()); - - /* optional kernel version */ --- -2.52.0 - diff --git a/0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch b/0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch new file mode 100644 index 0000000..d84b921 --- /dev/null +++ b/0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch @@ -0,0 +1,42 @@ +From f7352aa9e2157a5ed88d10278ef420a78c8a52f8 Mon Sep 17 00:00:00 2001 +From: Richard Hughes +Date: Thu, 2 Jul 2026 16:16:28 +0100 +Subject: [PATCH] Seal memfds for compatibility with newer fwupd daemons + +--- + libfwupd/fwupd-common.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/libfwupd/fwupd-common.c b/libfwupd/fwupd-common.c +index 3220c40a7..862210c8a 100644 +--- a/libfwupd/fwupd-common.c ++++ b/libfwupd/fwupd-common.c +@@ -1054,7 +1054,7 @@ fwupd_unix_input_stream_from_bytes(GBytes *bytes, GError **error) + #endif + + #ifdef HAVE_MEMFD_CREATE +- fd = memfd_create("fwupd", MFD_CLOEXEC); ++ fd = memfd_create("fwupd", MFD_CLOEXEC | MFD_ALLOW_SEALING); + #else + /* emulate in-memory file by an unlinked temporary file */ + fd = g_mkstemp(tmp_file); +@@ -1098,6 +1098,16 @@ fwupd_unix_input_stream_from_bytes(GBytes *bytes, GError **error) + g_strerror(errno)); + return NULL; + } ++#ifdef HAVE_MEMFD_CREATE ++ if (fcntl(fd, F_ADD_SEALS, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_SEAL) < 0) { ++ g_set_error(error, ++ FWUPD_ERROR, ++ FWUPD_ERROR_INVALID_FILE, ++ "failed to seal memfd: %s", ++ strerror(errno)); ++ return NULL; ++ } ++#endif + return G_UNIX_INPUT_STREAM(g_unix_input_stream_new(fd, TRUE)); + } + +-- +2.54.0 + diff --git a/fwupd.spec b/fwupd.spec index 99fffbb..d0cd30f 100644 --- a/fwupd.spec +++ b/fwupd.spec @@ -1,5 +1,5 @@ %global glib2_version 2.68.0 -%global libxmlb_version 0.1.3 +%global libxmlb_version 0.3.24 %global libusb_version 1.0.9 %global libcurl_version 7.62.0 %global libjcat_version 0.1.0 @@ -27,22 +27,17 @@ %endif # fwupd.efi is only available on these arches -%ifarch x86_64 aarch64 riscv64 +%ifarch x86_64 aarch64 riscv64 loongarch64 %global have_uefi 1 %define sb_ca %{_datadir}/pki/sb-certs/secureboot-ca-%{_arch}.cer %define sb_cer %{_datadir}/pki/sb-certs/secureboot-fwupd-%{_arch}.cer %if 0%{?centos} -%define sb_key centossecureboot202 +%define sb_key centossecureboot802 %else %define sb_key redhatsecureboot802 %endif %endif -# flashrom is only available on these arches -%ifarch i686 x86_64 armv7hl aarch64 ppc64le riscv64 -%global have_flashrom 1 -%endif - %ifarch i686 x86_64 %global have_msr 1 %endif @@ -58,20 +53,20 @@ Summary: Firmware update daemon Name: fwupd -Version: 2.0.19 -Release: 2%{?dist} +Version: 2.1.6 +Release: 1%{?dist} License: LGPL-2.1-or-later URL: https://github.com/fwupd/fwupd Source0: http://people.freedesktop.org/~hughsient/releases/%{name}-%{version}.tar.xz %if 0%{?libfwupd_19x_version} -Source1: https://github.com/fwupd/%{name}-efi/archive/refs/tags/1.7.tar.gz +Source1: https://github.com/fwupd/%{name}-efi/archive/refs/tags/fwupd-efi-1.8.tar.gz Source2: https://github.com/fwupd/%{name}/releases/download/1.9.%{libfwupd_19x_version}/%{name}-1.9.%{libfwupd_19x_version}.tar.xz %endif -Source24: https://fwupd.org/downloads/40d3a4630619b83026f66bc64d97a582bbd9223ad53aa3f519ff5e2121d11ca6-DBXUpdate-20250507-x64.cab +Source24: https://fwupd.org/downloads/9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab -Patch101: 0001-Revert-trivial-Remove-some-dead-JCat-compat-code.patch -Patch102: 0001-Disable-the-UEFI-plugins-on-32bit-x86.patch +Patch1: 0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch +Patch2: 0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch Patch201: 0001-Revert-Require-gnu-efi-3.0.18-or-later.patch @@ -83,20 +78,14 @@ BuildRequires: libusb1-devel >= %{libusb_version} BuildRequires: libcurl-devel >= %{libcurl_version} BuildRequires: libjcat-devel >= %{libjcat_version} BuildRequires: polkit-devel >= 0.103 -BuildRequires: protobuf-c-devel BuildRequires: python3-packaging BuildRequires: python3-jinja2 BuildRequires: sqlite-devel BuildRequires: systemd >= %{systemd_version} BuildRequires: systemd-devel -BuildRequires: libarchive-devel -BuildRequires: libcbor-devel BuildRequires: libblkid-devel BuildRequires: readline-devel BuildRequires: libmnl-devel -%if 0%{?have_passim} -BuildRequires: passim-devel -%endif BuildRequires: gobject-introspection-devel %ifarch %{valgrind_arches} BuildRequires: valgrind @@ -112,9 +101,6 @@ BuildRequires: json-glib-devel >= %{json_glib_version} BuildRequires: vala BuildRequires: pkgconfig(bash-completion) BuildRequires: git-core -%if 0%{?have_flashrom} -BuildRequires: flashrom-devel >= 1.2-2 -%endif BuildRequires: libdrm-devel # For fu-polkit-test BuildRequires: polkit @@ -157,6 +143,10 @@ Recommends: python3 Obsoletes: dbxtool < 9 Provides: dbxtool +# this was removed in 2.1.4 +Obsoletes: %{name}-plugin-flashrom < 2.1.4 +Obsoletes: %{name}-plugin-flashrom-debuginfo < 2.1.4 + %if 0%{?rhel} > 7 Obsoletes: fwupdate < 11-4 Obsoletes: fwupdate-efi < 11-4 @@ -176,9 +166,6 @@ Recommends: passim %if 0%{?have_modem_manager} Recommends: %{name}-plugin-modem-manager %endif -%if 0%{?have_flashrom} -Recommends: %{name}-plugin-flashrom -%endif %if 0%{?have_uefi} Recommends: %{name}-efi Recommends: %{name}-plugin-uefi-capsule-data @@ -213,16 +200,6 @@ This provides the optional package which is only required on hardware that might have mobile broadband hardware. It is probably not required on servers. %endif -%if 0%{?have_flashrom} -%package plugin-flashrom -Summary: fwupd plugin using flashrom -Requires: %{name}%{?_isa} = %{version}-%{release} - -%description plugin-flashrom -This provides the optional package which is only required on hardware that -can be flashed using flashrom. It is probably not required on servers. -%endif - %if 0%{?have_uefi} %package plugin-uefi-capsule-data Summary: Localized data for the UEFI UX capsule @@ -237,9 +214,7 @@ or server machines. %prep %setup -q - -%patch -p1 101 -%patch -p1 102 +%patch 1 -p1 # the EFI helper %if 0%{?libfwupd_19x_version} @@ -253,6 +228,8 @@ cd - # and the old version for libfwupd1 %if 0%{?libfwupd_19x_version} tar xfs %{SOURCE2} +cd fwupd-1.9.%{libfwupd_19x_version} +%patch 2 -p1 %endif %build @@ -268,19 +245,14 @@ cd fwupd-1.9.%{libfwupd_19x_version} -Dbash_completion=false \ -Dplugin_msr=disabled \ -Dintrospection=disabled \ + -Dplugin_logitech_bulkcontroller=disabled \ -Dlaunchd=disabled %meson_build cd - %endif %meson \ - -Dsupported_build=enabled \ -Dumockdev_tests=disabled \ -%if 0%{?have_uefi} - -Defi_binary=true \ - -Dfwupd-efi:genpeimg=disabled \ - -Defi_os_dir=%{efi_vendor} \ -%endif %if 0%{?have_gi_docgen} -Ddocs=enabled \ %else @@ -291,10 +263,10 @@ cd - %else -Dtests=false \ %endif -%if 0%{?have_flashrom} - -Dplugin_flashrom=enabled \ -%else - -Dplugin_flashrom=disabled \ +%if 0%{?have_uefi} + -Defi_binary=true \ + -Dfwupd-efi:genpeimg=disabled \ + -Defi_os_dir=%{efi_vendor} \ %endif %if 0%{?have_modem_manager} -Dplugin_modem_manager=enabled \ @@ -307,26 +279,30 @@ cd - -Dpassim=enabled \ %else -Dpassim=disabled \ +%endif +%ifarch i686 x86_64 + -Dhsi=enabled \ +%else + -Dhsi=disabled \ +%endif +%ifarch %{valgrind_arches} + -Dvalgrind=enabled \ +%else + -Dvalgrind=disabled \ %endif -Dman=true \ -Dsystemd_unit_user="" \ - -Dbluez=enabled + -Dbluez=enabled \ + -Dsupported_build=enabled %meson_build -%if 0%{?enable_tests} -%check -%meson_test -%endif - %install - %if 0%{?libfwupd_19x_version} cd fwupd-1.9.%{libfwupd_19x_version} %meson_install cd - %endif - %meson_install # on RHEL the LVFS is disabled by default @@ -338,29 +314,31 @@ install \ %ifarch x86_64 %global efiarch x64 %global fwup_efi_fn $RPM_BUILD_ROOT%{_libexecdir}/fwupd/efi/fwupd%{efiarch}.efi +%define __pesign_client_cert fwupd-signer %pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.signed -a %{sb_ca} -c %{sb_cer} -n %{sb_key} %endif # literally pointless if we are building fwupd-efi as a subproject rm -f %{buildroot}%{_libdir}/pkgconfig/fwupd-efi.pc -mkdir -p --mode=0700 $RPM_BUILD_ROOT%{_localstatedir}/lib/fwupd/gnupg +mkdir -p --mode=0700 $RPM_BUILD_ROOT%{_localstatedir}/lib/fwupd # workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1757948 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/cache/fwupd %find_lang %{name} +%check +%if 0%{?enable_tests} +%meson_test +%endif +%ifarch x86_64 +pesigcheck -i %{fwup_efi_fn}.signed -n0 -c %{sb_cer} +%endif + %post %systemd_post fwupd.service fwupd-refresh.timer -# change vendor-installed remotes to use the default keyring type -for fn in /etc/fwupd/remotes.d/*.conf; do - if grep -q "Keyring=gpg" "$fn"; then - sed -i 's/Keyring=gpg/#Keyring=pkcs/g' "$fn"; - fi -done - %preun %systemd_preun fwupd.service fwupd-refresh.timer @@ -394,6 +372,7 @@ systemctl --no-reload preset fwupd-refresh.timer &>/dev/null || : %{_sysconfdir}/fwupd/bios-settings.d/README.md %dir %{_sysconfdir}/fwupd/remotes.d %config(noreplace)%{_sysconfdir}/fwupd/remotes.d/lvfs.conf +%config(noreplace)%{_sysconfdir}/fwupd/remotes.d/lvfs-embargo.conf %config(noreplace)%{_sysconfdir}/fwupd/remotes.d/lvfs-testing.conf %config(noreplace)%{_sysconfdir}/fwupd/remotes.d/vendor-directory.conf %config(noreplace)%{_sysconfdir}/pki/fwupd @@ -452,19 +431,14 @@ systemctl --no-reload preset fwupd-refresh.timer &>/dev/null || : /usr/lib/systemd/system-shutdown/fwupd.shutdown %dir %{_libdir}/fwupd-%{version} %{_libdir}/fwupd-%{version}/libfwupd*.so -%ghost %{_localstatedir}/lib/fwupd/gnupg %if 0%{?have_modem_manager} %files plugin-modem-manager %{_libdir}/fwupd-%{version}/libfu_plugin_modem_manager.so %endif -%if 0%{?have_flashrom} -%files plugin-flashrom -%{_libdir}/fwupd-%{version}/libfu_plugin_flashrom.so -%endif %if 0%{?have_uefi} %files plugin-uefi-capsule-data -%{_datadir}/fwupd/uefi-capsule-ux.tar.xz +%{_datadir}/fwupd/uefi-capsule-ux.zip %endif %files devel @@ -492,6 +466,10 @@ systemctl --no-reload preset fwupd-refresh.timer &>/dev/null || : %endif %changelog +* Fri Jul 03 2026 Richard Hughes 2.1.6-1 +- Rebase to get new hardware support +- Resolves: #RHEL-185627 + * Fri Jan 09 2026 Richard Hughes 2.0.19-1 - Rebase to get new hardware support - Resolves: #RHEL-125778 diff --git a/sources b/sources index 20f29d4..b245bed 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ -SHA512 (fwupd-2.0.19.tar.xz) = a4db6a776cbbedc54cd929899e9df7029f7ca9931a82c5a7661f48bcdc60c7dd18c926254b1b90e1fad225269fbe81f5323cba7ab37624b044c888648dce1944 -SHA512 (1.7.tar.gz) = db0857e76964c6e36dd8708fe3b4a0b56290543c374e40a9e1f0919e0016d59de6bd6d2e4f43fb2ddd706841917b60d36da086e1290d3351283504d287083a7e +SHA512 (fwupd-2.1.6.tar.xz) = ac6400017df913b96f0df2616ffe92d4eeb4bf97d2c33fa1fe6ed8f5aba86438418d56db0b1e54a9977cb729b35c23c2010d778ef37486d0ed7058640e9c35d0 +SHA512 (fwupd-efi-1.8.tar.gz) = bd361eb60397850af025228ea9f4efbf289f8e1c2612f240ae4c5ffee8caea15c31aa0748c06e57b28a7f38b8c2708147a228d8a99077798f4435436f12e092e SHA512 (fwupd-1.9.31.tar.xz) = ce9cd5129d0bcbedade6ba11f661fd3350445557d3116f479a8628376e9e8d6a933e6d2632ac3576d47ad9dbf0eafd54480d2765be86f776e8f04f689287ec80 -SHA512 (40d3a4630619b83026f66bc64d97a582bbd9223ad53aa3f519ff5e2121d11ca6-DBXUpdate-20250507-x64.cab) = f94e4f44a62621fc0a032a99613df81452bfc8eefc41f473708a43502fb298b477ed9d902166c833278397303a166d29ed891d797fe8e3b3afece5d6bc9645f2 +SHA512 (9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab) = 7fff3d5757b6ca5392ae21b7eab06d216d8eb3ccf24f68399679c402d21c842b7d9b0f716071b3f1163325f216926d3941fe494ca784ef257c466477525af76f