From be01b9bcf4c1546d19c13e79c6468066df3102f4 Mon Sep 17 00:00:00 2001
From: Richard Hughes <richard@hughsie.com>
Date: Mon, 6 Jul 2026 15:58:56 +0100
Subject: [PATCH] Rebase to 2.1.6

---
 .gitignore                                    |   4 +
 0001-Downgrade-deps-for-RHEL-8.patch          | 419 ++++++++++++++++
 ...-self-tests-when-building-on-a-tmpfs.patch | 209 ++++++++
 ...compatibility-with-newer-fwupd-daemo.patch |  42 ++
 ...usr-libexec-platform-python-for-RHEL.patch |  29 --
 ...permissions-of-redfish.conf-at-insta.patch |  28 --
 ...inary-compare-the-zlib-compressed-zi.patch |  27 +
 ...rivial-Lower-supported-meson-version.patch |  26 +
 ...pping-setting-NX-dll-characteristics.patch |  25 +
 ...ate-users-using-IPMI-when-we-know-it.patch |  47 --
 ...edfish-passwords-to-a-file-readable-.patch | 141 ------
 ...al-Lower-required-version-of-gnu-efi.patch |  25 +
 fwupd.spec                                    | 463 ++++++++----------
 sources                                       |  12 +-
 14 files changed, 978 insertions(+), 519 deletions(-)
 create mode 100644 0001-Downgrade-deps-for-RHEL-8.patch
 create mode 100644 0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch
 create mode 100644 0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch
 delete mode 100644 0001-Use-usr-libexec-platform-python-for-RHEL.patch
 delete mode 100644 0001-redfish-Set-the-permissions-of-redfish.conf-at-insta.patch
 create mode 100644 0001-trivial-Do-not-binary-compare-the-zlib-compressed-zi.patch
 create mode 100644 0001-trivial-Lower-supported-meson-version.patch
 create mode 100644 0002-Allow-skipping-setting-NX-dll-characteristics.patch
 delete mode 100644 0002-redfish-Only-create-users-using-IPMI-when-we-know-it.patch
 delete mode 100644 0003-Never-save-the-Redfish-passwords-to-a-file-readable-.patch
 create mode 100644 0003-trivial-Lower-required-version-of-gnu-efi.patch

diff --git a/.gitignore b/.gitignore
index 39ba958..5fdb0be 100644
--- a/.gitignore
+++ b/.gitignore
@@ -60,3 +60,7 @@
 /fwupd-1.7.8.tar.xz
 /fwupd-efi-1.3.tar.xz
 /libjcat-0.1.9.tar.xz
+/fwupd-2.1.6.tar.xz
+/fwupd-efi-1.8.tar.gz
+/fwupd-1.9.31.tar.xz
+/9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab
diff --git a/0001-Downgrade-deps-for-RHEL-8.patch b/0001-Downgrade-deps-for-RHEL-8.patch
new file mode 100644
index 0000000..3a3bd6e
--- /dev/null
+++ b/0001-Downgrade-deps-for-RHEL-8.patch
@@ -0,0 +1,419 @@
+From 8b662c7baa91279a4d770ee402c6169ce16cc121 Mon Sep 17 00:00:00 2001
+From: Richard Hughes <richard@hughsie.com>
+Date: Fri, 29 May 2026 13:58:07 +0100
+Subject: [PATCH] Downgrade deps for RHEL-8
+
+---
+ contrib/qubes/meson.build           |  6 ---
+ data/meson.build                    |  4 +-
+ docs/meson.build                    | 13 ------
+ libfwupd/meson.build                |  2 +-
+ libfwupdplugin/meson.build          |  2 +-
+ libfwupdplugin/tests/meson.build    |  5 ---
+ meson.build                         | 62 +++++++++++------------------
+ meson_options.txt                   |  2 +-
+ plugins/lenovo-thinklmi/meson.build |  2 +-
+ plugins/modem-manager/meson.build   |  2 +-
+ plugins/test/meson.build            |  4 +-
+ src/meson.build                     |  4 +-
+ 12 files changed, 33 insertions(+), 75 deletions(-)
+
+diff --git a/contrib/qubes/meson.build b/contrib/qubes/meson.build
+index 9b5385e15..689b462a2 100644
+--- a/contrib/qubes/meson.build
++++ b/contrib/qubes/meson.build
+@@ -45,9 +45,3 @@ install_data(
+   'test/logs/metainfo_version/firmware.metainfo.xml',
+   install_dir: 'share/qubes-fwupd/test/logs/metainfo_version',
+ )
+-
+-install_symlink(
+-  'qubes-fwupdmgr',
+-  pointing_to: '/usr/share/qubes-fwupd/src/qubes_fwupdmgr.py',
+-  install_dir: '/usr/sbin',
+-)
+diff --git a/data/meson.build b/data/meson.build
+index 74a9104c3..70bf55908 100644
+--- a/data/meson.build
++++ b/data/meson.build
+@@ -122,7 +122,7 @@ if build_daemon
+       # for BLKSSZGET
+       device_allows += ['block-blkext']
+     endif
+-    if get_option('plugin_modem_manager').allowed()
++    if get_option('plugin_modem_manager').enabled()
+       device_allows += ['char-wwan_port']
+       device_allows += ['char-ttyUSB']
+     endif
+@@ -152,9 +152,7 @@ if build_daemon
+       'vmsplice',
+       'copy_file_range', # for g_file_copy
+     ]
+-    dynamic_options += ['SystemCallFilter=' + ' '.join(syscall_filter)]
+     if supported_build
+-      dynamic_options += ['Environment="FWUPD_SYSCALL_FILTER=systemd"']
+       dynamic_options += ['SystemCallErrorNumber=EPERM']
+     else
+       # to debug what additional syscalls are required, we set SystemCallErrorNumber=SIGSYS
+diff --git a/docs/meson.build b/docs/meson.build
+index 6adb57ecf..e8e46de22 100644
+--- a/docs/meson.build
++++ b/docs/meson.build
+@@ -301,17 +301,4 @@ if build_docs
+     install_tag: 'doc',
+     install_dir: join_paths(datadir, 'doc', 'libfwupdplugin'),
+   )
+-  #make devhelp work
+-  install_symlink(
+-    'libfwupd',
+-    install_tag: 'doc',
+-    install_dir: join_paths(datadir, 'doc', 'fwupd'),
+-    pointing_to: join_paths('..', 'libfwupd'),
+-  )
+-  install_symlink(
+-    'libfwupdplugin',
+-    install_tag: 'doc',
+-    install_dir: join_paths(datadir, 'doc', 'fwupd'),
+-    pointing_to: join_paths('..', 'libfwupdplugin'),
+-  )
+ endif
+diff --git a/libfwupd/meson.build b/libfwupd/meson.build
+index 37ecc43ac..a0038e92d 100644
+--- a/libfwupd/meson.build
++++ b/libfwupd/meson.build
+@@ -180,7 +180,7 @@ pkgg.generate(
+   description: 'fwupd is a system daemon for installing device firmware',
+ )
+ 
+-if introspection.allowed()
++if introspection.enabled()
+   fwupd_gir_deps = [giounix, libcurl]
+   fwupd_gir = gnome.generate_gir(
+     fwupd,
+diff --git a/libfwupdplugin/meson.build b/libfwupdplugin/meson.build
+index 277c49424..7931b8a27 100644
+--- a/libfwupdplugin/meson.build
++++ b/libfwupdplugin/meson.build
+@@ -441,7 +441,7 @@ fwupdplugin_rs_dep = declare_dependency(
+ )
+ 
+ fwupdplugin_gir_includes = []
+-if introspection.allowed()
++if introspection.enabled()
+   gir_dep = declare_dependency(
+     sources: fwupd_gir
+   )
+diff --git a/libfwupdplugin/tests/meson.build b/libfwupdplugin/tests/meson.build
+index 8cea8d2eb..86c0f0d46 100644
+--- a/libfwupdplugin/tests/meson.build
++++ b/libfwupdplugin/tests/meson.build
+@@ -97,11 +97,6 @@ install_data(
+   ['quirks.d/tests.quirk'],
+   install_dir: join_paths(installed_test_datadir, 'tests/quirks.d'),
+ )
+-install_symlink(
+-  'localtime',
+-  install_dir: join_paths(installed_test_datadir, 'tests'),
+-  pointing_to: join_paths('America', 'New_York'),
+-)
+ 
+ install_data(
+   ['bios-attrs/dell-xps13-9310/dell-wmi-sysman/attributes/pending_reboot'],
+diff --git a/meson.build b/meson.build
+index 51c2148af..5c76a7bdf 100644
+--- a/meson.build
++++ b/meson.build
+@@ -3,8 +3,8 @@ project(
+   'c',
+   version: '2.1.6',
+   license: 'LGPL-2.1-or-later',
+-  meson_version: '>=0.63.0', # limited by RHEL-9
+-  default_options: ['warning_level=2', 'c_std=c17'],
++  meson_version: '>=0.58.2', # limited by RHEL-8
++  default_options: ['warning_level=2', 'c_std=c11'],
+ )
+ 
+ fwupd_version = meson.project_version()
+@@ -253,16 +253,16 @@ localedir = join_paths(prefix, get_option('localedir'))
+ diffcmd = find_program('diff')
+ glib = dependency(
+   'glib-2.0',
+-  version: '>= 2.68.0',
++  version: '>= 2.56.1',
+   include_type: 'system',
+ ) # limited by RHEL-9, which has v2.68.4
+ gio = dependency(
+   'gio-2.0',
+-  version: '>= 2.68.0',
++  version: '>= 2.56.1',
+ ) # limited by RHEL-9, which has v2.68.4
+ giounix = dependency(
+   'gio-unix-2.0',
+-  version: '>= 2.68.0',
++  version: '>= 2.56.1',
+   required: false,
+ )
+ if giounix.found()
+@@ -276,20 +276,18 @@ if get_option('udev_hotplug')
+   conf.set('HAVE_UDEV_HOTPLUG' , '1')
+ endif
+ if build_standalone
+-  bluez = get_option('bluez').disable_auto_if(host_machine.system() != 'linux')
+-  if bluez.allowed()
++  bluez = get_option('bluez')
++  if bluez.enabled()
+     conf.set('HAVE_BLUEZ', '1')
+   endif
+   host_cpu = host_machine.cpu_family()
+-  hsi = get_option('hsi').require(host_machine.system() == 'linux').require(
+-    host_cpu in ['x86', 'x86_64']
+-  ).allowed()
++  hsi = get_option('hsi').enabled()
+   if hsi
+     conf.set('HAVE_HSI', '1')
+   endif
+   libxmlb = dependency(
+     'xmlb',
+-    version: '>= 0.3.19',
++    version: '>= 0.1.15',
+     fallback: ['libxmlb', 'libxmlb_dep'],
+   )
+   if libxmlb.get_variable('zstd') == 'true'
+@@ -340,7 +338,7 @@ if build_standalone
+     'readline',
+     required: get_option('readline'),
+   )
+-  if readline.found() and get_option('readline').allowed()
++  if readline.found() and get_option('readline').enabled()
+     conf.set('HAVE_READLINE', '1')
+   endif
+   sqlite = dependency('sqlite3')
+@@ -351,7 +349,6 @@ if build_standalone
+     'passim',
+     version: '>= 0.1.6',
+     required: get_option('passim'),
+-    fallback: ['passim', 'passim_dep'],
+   )
+   if passim.found()
+     conf.set('HAVE_PASSIM', '1')
+@@ -370,7 +367,7 @@ valgrind = dependency(
+ )
+ libcurl = dependency(
+   'libcurl',
+-  version: '>= 7.62.0',
++  version: '>= 7.61.1', # RHEL 8
+ )
+ libdrm = dependency(
+   'libdrm',
+@@ -380,7 +377,7 @@ if libdrm.found()
+   conf.set('HAVE_LIBDRM' , '1')
+ endif
+ polkit = dependency('polkit-gobject-1', version: '>= 0.103',
+-         required: get_option('polkit').disable_auto_if(host_machine.system() != 'linux'))
++         required: get_option('polkit'))
+ if polkit.found()
+   conf.set('HAVE_POLKIT', '1')
+   if polkit.version().version_compare('>= 0.114')
+@@ -494,7 +491,7 @@ endif
+ 
+ libsystemd = dependency(
+   'libsystemd',
+-  required: get_option('systemd').disable_auto_if(host_machine.system() != 'linux'),
++  required: get_option('systemd'),
+ )
+ 
+ if cc.has_header('sys/auxv.h')
+@@ -664,8 +661,8 @@ if build_standalone
+ endif
+ 
+ logind = dependency(
+-  'systemd', 'libelogind',
+-  required: get_option('logind').disable_auto_if(host_machine.system() != 'linux'),
++  'systemd',
++  required: get_option('logind'),
+ )
+ 
+ if logind.found()
+@@ -674,7 +671,7 @@ endif
+ if libsystemd.found()
+   systemd = dependency(
+     'systemd',
+-    version: '>= 249',
++    version: '>= 239', # RHEL 8
+     required: get_option('systemd'),
+   )
+   conf.set('HAVE_SYSTEMD' , '1')
+@@ -712,7 +709,7 @@ if libsystemd.found()
+   endif
+ endif
+ 
+-supported_build = get_option('supported_build').disable_auto_if(not tag).allowed()
++supported_build = get_option('supported_build')
+ if supported_build
+   conf.set('SUPPORTED_BUILD', '1')
+ endif
+@@ -775,9 +772,7 @@ gobject_introspection_dep = dependency(
+   'gobject-introspection-1.0',
+   required: get_option('introspection'),
+ )
+-introspection = get_option('introspection').disable_auto_if(host_machine.system() != 'linux').disable_auto_if(
+-  not gobject_introspection_dep.found()
+-)
++introspection = get_option('introspection')
+ 
+ gidocgen_dep = dependency(
+   'gi-docgen',
+@@ -790,17 +785,14 @@ gidocgen_app = find_program(
+   'gi-docgen',
+   required: gidocgen_dep.found(),
+ )
+-build_docs = gidocgen_dep.found() and gidocgen_app.found() and introspection.allowed()
++build_docs = gidocgen_dep.found() and gidocgen_app.found() and introspection.enabled()
+ 
+ if build_docs and gidocgen_dep.version().version_compare('< 2022.2')
+   markdown_version = run_command(
+     [python3, '-c', 'import markdown; print(markdown.__version__)'],
+     check: true,
+   ).stdout().strip()
+-  build_docs = get_option('docs').require(
+-    markdown_version.version_compare('>=3.2'),
+-    error_message: 'docs=enabled requires at least markdown >= 3.2',
+-  ).allowed()
++  build_docs = get_option('docs').enabled()
+ endif
+ 
+ jinja2 = run_command(
+@@ -823,14 +815,12 @@ endif
+ rustgen = generator(
+   python3,
+   output: ['@BASENAME@-struct.c', '@BASENAME@-struct.h'],
+-  depfile: '@BASENAME@.deps',
+   arguments: [
+     join_paths(meson.project_source_root(), 'libfwupdplugin', 'rustgen.py'),
+     '--use', 'fwupd:@0@'.format(join_paths(meson.project_source_root(), 'libfwupdplugin')),
+     '@INPUT@',
+     '--outc', '@OUTPUT0@',
+     '--outh', '@OUTPUT1@',
+-    '--depfile', '@DEPFILE@',
+     '--include',
+     'fwupdplugin.h',
+     '--prefix',
+@@ -844,13 +834,7 @@ dbusmock = run_command(
+ )
+ umockdev = dependency(
+   'umockdev-1.0',
+-  required: get_option('umockdev_tests').require(dbusmock.returncode() == 0).require(
+-    get_option('tests')
+-  ).disable_auto_if(
+-    not introspection.allowed()
+-  ).disable_auto_if(
+-    not run_sanitize_unsafe_tests
+-  ),
++  required: get_option('umockdev_tests')
+ )
+ 
+ allow_uefi = host_machine.system() in ['linux', 'freebsd'] and \
+@@ -919,7 +903,7 @@ summary(
+     'vendor_ids_dir': vendor_ids_dir,
+     'docs': build_docs,
+     'gnutls': gnutls,
+-    'introspection': introspection.allowed(),
++    'introspection': introspection.enabled(),
+     'libblkid': libblkid,
+     'libdrm': libdrm,
+     'logind': logind,
+@@ -938,7 +922,7 @@ summary(
+ if build_daemon
+   summary(
+     {
+-      'bluez': bluez.allowed(),
++      'bluez': bluez.enabled(),
+       'libusb': libusb,
+       'hsi': hsi,
+       'lvfs_metadata_format': lvfs_metadata_format,
+diff --git a/meson_options.txt b/meson_options.txt
+index 8f5a27620..196822f66 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -178,7 +178,7 @@ option(
+ )
+ option(
+   'supported_build',
+-  type: 'feature',
++  type: 'boolean',
+   description: 'distribution package with upstream support',
+ )
+ option(
+diff --git a/plugins/lenovo-thinklmi/meson.build b/plugins/lenovo-thinklmi/meson.build
+index b5218d4ea..9876a2268 100644
+--- a/plugins/lenovo-thinklmi/meson.build
++++ b/plugins/lenovo-thinklmi/meson.build
+@@ -16,7 +16,7 @@ plugin_builtin_lenovo_thinklmi = static_library('fu_plugin_lenovo_thinklmi',
+ )
+ plugin_builtins += plugin_builtin_lenovo_thinklmi
+ 
+-if get_option('tests')
++if get_option('tests') and false
+   env = environment()
+   env.set('G_TEST_SRCDIR', meson.current_source_dir())
+   env.set('G_TEST_BUILDDIR', meson.current_build_dir())
+diff --git a/plugins/modem-manager/meson.build b/plugins/modem-manager/meson.build
+index 0cc7d51ed..4762b16bb 100644
+--- a/plugins/modem-manager/meson.build
++++ b/plugins/modem-manager/meson.build
+@@ -5,7 +5,7 @@ libmbim_glib = dependency('mbim-glib', version: '>= 1.28.0', required: get_optio
+ libmm_glib.found() or subdir_done()
+ libqmi_glib.found() or subdir_done()
+ libmbim_glib.found() or subdir_done()
+-get_option('plugin_modem_manager').allowed() or subdir_done()
++get_option('plugin_modem_manager').enabled() or subdir_done()
+ 
+ cargs = ['-DG_LOG_DOMAIN="FuPluginMm"']
+ cargs +=['-DMM_REQUIRED_VERSION="1.10.0"']
+diff --git a/plugins/test/meson.build b/plugins/test/meson.build
+index b9cf1c9a0..865ad24ff 100644
+--- a/plugins/test/meson.build
++++ b/plugins/test/meson.build
+@@ -1,7 +1,7 @@
+ cargs = ['-DG_LOG_DOMAIN="FuPluginTest"']
+ plugins += {meson.current_source_dir().split('/')[-1]: true}
+ 
+-if bluez.allowed()
++if bluez.enabled()
+   plugin_quirks += files('test-ble.quirk')
+ endif
+ 
+@@ -16,7 +16,7 @@ plugin_builtins += static_library('fu_plugin_test',
+   dependencies: plugin_deps,
+ )
+ 
+-if bluez.allowed()
++if bluez.enabled()
+ plugin_builtins += static_library('fu_plugin_test_ble',
+   sources: [
+     'fu-test-ble-plugin.c',
+diff --git a/src/meson.build b/src/meson.build
+index 6f149e243..6b65d18f5 100644
+--- a/src/meson.build
++++ b/src/meson.build
+@@ -15,7 +15,7 @@ engine_dep = [
+   fwupdplugin_rs_dep,
+ ]
+ 
+-if get_option('passim').allowed()
++if get_option('passim').enabled()
+   engine_dep += passim
+ endif
+ 
+@@ -72,7 +72,7 @@ endif
+ if host_machine.system() in ['linux', 'android']
+   fwupd_engine_src += 'fu-udev-backend.c'
+ endif
+-if bluez.allowed()
++if bluez.enabled()
+   fwupd_engine_src += 'fu-bluez-backend.c'
+ endif
+ 
+-- 
+2.55.0
+
diff --git a/0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch b/0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch
new file mode 100644
index 0000000..8562e5b
--- /dev/null
+++ b/0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch
@@ -0,0 +1,209 @@
+From 2ed98c7c2e0ac77b9967933af51615385f7e471d Mon Sep 17 00:00:00 2001
+From: Richard Hughes <richard@hughsie.com>
+Date: Thu, 2 Jul 2026 14:47:33 +0100
+Subject: [PATCH] Fix the seal self tests when building on a tmpfs
+
+When fwupd is exploded onto a tmpfs the assumption of 'is a local file *not* a
+memfd' breaks. When fwupd is built using rpmbuild we do not control the
+buildroot filesystem, so make the 'is a sealed fd required' check more explicit.
+---
+ src/fu-dbus-daemon.c                     |  3 +
+ src/fu-engine.c                          |  6 ++
+ src/fu-unix-seekable-input-stream-test.c | 17 +++++-
+ src/fu-unix-seekable-input-stream.c      | 70 ++++++++++++++++--------
+ src/fu-unix-seekable-input-stream.h      |  2 +
+ 5 files changed, 73 insertions(+), 25 deletions(-)
+
+diff --git a/src/fu-dbus-daemon.c b/src/fu-dbus-daemon.c
+index 72cc36fad..de8aa9a26 100644
+--- a/src/fu-dbus-daemon.c
++++ b/src/fu-dbus-daemon.c
+@@ -1158,6 +1158,9 @@ fu_dbus_daemon_invocation_get_input_stream(GDBusMethodInvocation *invocation, GE
+ 	stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, error);
+ 	if (stream == NULL)
+ 		return NULL;
++	if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
++							error))
++		return NULL;
+ 	return g_steal_pointer(&stream);
+ #else
+ 	g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INTERNAL, "unsupported feature");
+diff --git a/src/fu-engine.c b/src/fu-engine.c
+index 9eaed95ab..5820ea891 100644
+--- a/src/fu-engine.c
++++ b/src/fu-engine.c
+@@ -5069,9 +5069,15 @@ fu_engine_update_metadata(FuEngine *self,
+ 	stream_fd = fu_unix_seekable_input_stream_new(fd, TRUE, error);
+ 	if (stream_fd == NULL)
+ 		return FALSE;
++	if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream_fd),
++							error))
++		return FALSE;
+ 	stream_sig = fu_unix_seekable_input_stream_new(fd_sig, TRUE, error);
+ 	if (stream_sig == NULL)
+ 		return FALSE;
++	if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream_sig),
++							error))
++		return FALSE;
+ 
+ 	/* read the entire file into memory */
+ 	bytes_raw =
+diff --git a/src/fu-unix-seekable-input-stream-test.c b/src/fu-unix-seekable-input-stream-test.c
+index d65b70add..3b5e8d8ec 100644
+--- a/src/fu-unix-seekable-input-stream-test.c
++++ b/src/fu-unix-seekable-input-stream-test.c
+@@ -84,6 +84,7 @@ static void
+ fu_unix_seekable_input_stream_sealed_memfd_func(void)
+ {
+ #if defined(HAVE_GIO_UNIX) && defined(HAVE_MEMFD_CREATE)
++	gboolean ret;
+ 	g_autofd gint fd = -1;
+ 	g_autoptr(GError) error = NULL;
+ 	g_autoptr(GInputStream) stream = NULL;
+@@ -93,11 +94,18 @@ fu_unix_seekable_input_stream_sealed_memfd_func(void)
+ 	g_assert_cmpint(fd, >=, 0);
+ 	g_assert_cmpint(write(fd, data, sizeof(data)), ==, sizeof(data));
+ 	g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0);
+-	g_assert_cmpint(fcntl(fd, F_ADD_SEALS, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW), ==, 0);
++	g_assert_cmpint(
++	    fcntl(fd, F_ADD_SEALS, F_SEAL_SEAL | F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW),
++	    ==,
++	    0);
+ 
+ 	stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, &error);
+ 	g_assert_no_error(error);
+ 	g_assert_nonnull(stream);
++	ret = fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
++							 &error);
++	g_assert_no_error(error);
++	g_assert_true(ret);
+ #else
+ 	g_test_skip("No gio-unix-2.0 or memfd_create support, skipping");
+ #endif
+@@ -107,6 +115,7 @@ static void
+ fu_unix_seekable_input_stream_unsealed_memfd_func(void)
+ {
+ #if defined(HAVE_GIO_UNIX) && defined(HAVE_MEMFD_CREATE)
++	gboolean ret;
+ 	g_autofd gint fd = -1;
+ 	g_autoptr(GError) error = NULL;
+ 	g_autoptr(GInputStream) stream = NULL;
+@@ -118,8 +127,12 @@ fu_unix_seekable_input_stream_unsealed_memfd_func(void)
+ 	g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0);
+ 
+ 	stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, &error);
++	g_assert_no_error(error);
++	g_assert_nonnull(stream);
++	ret = fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
++							 &error);
+ 	g_assert_error(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE);
+-	g_assert_null(stream);
++	g_assert_false(ret);
+ #else
+ 	g_test_skip("No gio-unix-2.0 or memfd_create support, skipping");
+ #endif
+diff --git a/src/fu-unix-seekable-input-stream.c b/src/fu-unix-seekable-input-stream.c
+index 4955c366c..591173812 100644
+--- a/src/fu-unix-seekable-input-stream.c
++++ b/src/fu-unix-seekable-input-stream.c
+@@ -116,25 +116,6 @@ fu_unix_seekable_input_stream_seekable_iface_init(GSeekableIface *iface)
+ 	iface->truncate_fn = fu_unix_seekable_input_stream_truncate;
+ }
+ 
+-static gboolean
+-fu_unix_seekable_input_stream_verify_sealed(gint fd, GError **error)
+-{
+-#ifdef HAVE_MEMFD_CREATE
+-	gint seals = fcntl(fd, F_GET_SEALS);
+-	if (seals >= 0 && (seals & (F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW)) !=
+-			      (F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW)) {
+-		g_set_error(error,
+-			    FWUPD_ERROR,
+-			    FWUPD_ERROR_INVALID_FILE,
+-			    "fd is missing required seals, got 0x%x",
+-			    (guint)seals);
+-		return FALSE;
+-	}
+-#endif
+-	/* success */
+-	return TRUE;
+-}
+-
+ /**
+  * fu_unix_seekable_input_stream_new:
+  * @fd: a UNIX file descriptor
+@@ -177,14 +158,57 @@ fu_unix_seekable_input_stream_new(gint fd, gboolean close_fd, GError **error)
+ 		return NULL;
+ 	}
+ 
+-	/* if the fd supports sealing (i.e. is a memfd) then require immutability */
+-	if (!fu_unix_seekable_input_stream_verify_sealed(fd, error))
+-		return NULL;
+-
+ 	/* success */
+ 	return g_steal_pointer(&stream);
+ }
+ 
++/**
++ * fu_unix_seekable_input_stream_require_seal:
++ * @stream: a #FuUnixSeekableInputStream
++ * @error: (nullable): optional return location for an error
++ *
++ * Enforces that the file descriptor backing this stream is a memfd with the required seals set.
++ *
++ * Returns: %TRUE if sealed
++ *
++ * Since: 2.1.7
++ **/
++gboolean
++fu_unix_seekable_input_stream_require_seal(FuUnixSeekableInputStream *stream, GError **error)
++{
++#ifdef HAVE_MEMFD_CREATE
++	gint fd;
++	gint seals;
++
++	g_return_val_if_fail(FU_IS_UNIX_SEEKABLE_INPUT_STREAM(stream), FALSE);
++	g_return_val_if_fail(error == NULL || *error == NULL, FALSE);
++
++	fd = g_unix_input_stream_get_fd(G_UNIX_INPUT_STREAM(stream));
++	seals = fcntl(fd, F_GET_SEALS);
++	if (seals < 0) {
++		/* not supported on this fd */
++		return TRUE;
++	}
++	if ((seals & F_SEAL_SEAL) == 0) {
++		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "fd not sealed");
++		return FALSE;
++	}
++	if ((seals & F_SEAL_WRITE) == 0) {
++		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no WRITE seal");
++		return FALSE;
++	}
++	if ((seals & F_SEAL_SHRINK) == 0) {
++		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no SHRINK seal");
++		return FALSE;
++	}
++	if ((seals & F_SEAL_GROW) == 0) {
++		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no GROW seal");
++		return FALSE;
++	}
++#endif
++	return TRUE;
++}
++
+ static void
+ fu_unix_seekable_input_stream_class_init(FuUnixSeekableInputStreamClass *klass)
+ {
+diff --git a/src/fu-unix-seekable-input-stream.h b/src/fu-unix-seekable-input-stream.h
+index 5f0a0656a..6d7b2acde 100644
+--- a/src/fu-unix-seekable-input-stream.h
++++ b/src/fu-unix-seekable-input-stream.h
+@@ -18,3 +18,5 @@ G_DECLARE_FINAL_TYPE(FuUnixSeekableInputStream,
+ 
+ GInputStream *
+ fu_unix_seekable_input_stream_new(gint fd, gboolean close_fd, GError **error);
++gboolean
++fu_unix_seekable_input_stream_require_seal(FuUnixSeekableInputStream *stream, GError **error);
+-- 
+2.54.0
+
diff --git a/0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch b/0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch
new file mode 100644
index 0000000..d84b921
--- /dev/null
+++ b/0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch
@@ -0,0 +1,42 @@
+From f7352aa9e2157a5ed88d10278ef420a78c8a52f8 Mon Sep 17 00:00:00 2001
+From: Richard Hughes <richard@hughsie.com>
+Date: Thu, 2 Jul 2026 16:16:28 +0100
+Subject: [PATCH] Seal memfds for compatibility with newer fwupd daemons
+
+---
+ libfwupd/fwupd-common.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/libfwupd/fwupd-common.c b/libfwupd/fwupd-common.c
+index 3220c40a7..862210c8a 100644
+--- a/libfwupd/fwupd-common.c
++++ b/libfwupd/fwupd-common.c
+@@ -1054,7 +1054,7 @@ fwupd_unix_input_stream_from_bytes(GBytes *bytes, GError **error)
+ #endif
+ 
+ #ifdef HAVE_MEMFD_CREATE
+-	fd = memfd_create("fwupd", MFD_CLOEXEC);
++	fd = memfd_create("fwupd", MFD_CLOEXEC | MFD_ALLOW_SEALING);
+ #else
+ 	/* emulate in-memory file by an unlinked temporary file */
+ 	fd = g_mkstemp(tmp_file);
+@@ -1098,6 +1098,16 @@ fwupd_unix_input_stream_from_bytes(GBytes *bytes, GError **error)
+ 			    g_strerror(errno));
+ 		return NULL;
+ 	}
++#ifdef HAVE_MEMFD_CREATE
++	if (fcntl(fd, F_ADD_SEALS, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_SEAL) < 0) {
++		g_set_error(error,
++			    FWUPD_ERROR,
++			    FWUPD_ERROR_INVALID_FILE,
++			    "failed to seal memfd: %s",
++			    strerror(errno));
++		return NULL;
++	}
++#endif
+ 	return G_UNIX_INPUT_STREAM(g_unix_input_stream_new(fd, TRUE));
+ }
+ 
+-- 
+2.54.0
+
diff --git a/0001-Use-usr-libexec-platform-python-for-RHEL.patch b/0001-Use-usr-libexec-platform-python-for-RHEL.patch
deleted file mode 100644
index 4bc0dc7..0000000
--- a/0001-Use-usr-libexec-platform-python-for-RHEL.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 1fc24adecbb62b3cd77ef965c5daf1b72f6c7aa8 Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 22 Aug 2023 10:05:27 +0100
-Subject: [PATCH] Use /usr/libexec/platform-python for RHEL
-
----
- meson.build | 6 +-----
- 1 file changed, 1 insertion(+), 5 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index bb406d616..ac90c8ee6 100644
---- a/meson.build
-+++ b/meson.build
-@@ -261,11 +261,7 @@ if libgcab.type_name() == 'pkgconfig' and cc.has_function('gcab_file_set_bytes',
- endif
- 
- bashcomp = dependency('bash-completion', required: false)
--if host_machine.system() != 'freebsd'
--  python3 = find_program('python3')
--else
--  python3 = find_program('python3.8', 'python3', 'python3.9')
--endif
-+python3 = find_program('/usr/libexec/platform-python')
- 
- if get_option('gnutls')
-   gnutls = dependency('gnutls', version : '>= 3.6.0')
--- 
-2.41.0
-
diff --git a/0001-redfish-Set-the-permissions-of-redfish.conf-at-insta.patch b/0001-redfish-Set-the-permissions-of-redfish.conf-at-insta.patch
deleted file mode 100644
index b3f334e..0000000
--- a/0001-redfish-Set-the-permissions-of-redfish.conf-at-insta.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 442f7f9200fbf6ec509dd0ee40eae2e37b2fb73e Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 20 Sep 2022 08:06:12 +0100
-Subject: [PATCH 1/3] redfish: Set the permissions of redfish.conf at install
- time
-
-Although typically we set the password using fu_plugin_set_secure_config_value()
-or something like Ansible or Puppet -- the user could just edit the file with
-vim and we still want the permissions set correctly.
----
- plugins/redfish/meson.build | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/plugins/redfish/meson.build b/plugins/redfish/meson.build
-index 34ba4b7f6..7b19574de 100644
---- a/plugins/redfish/meson.build
-+++ b/plugins/redfish/meson.build
-@@ -48,6 +48,7 @@ shared_module('fu_plugin_redfish',
- 
- install_data(['redfish.conf'],
-   install_dir:  join_paths(sysconfdir, 'fwupd'),
-+  install_mode: 'rw-r-----',
- )
- 
- if get_option('tests')
--- 
-2.39.1
-
diff --git a/0001-trivial-Do-not-binary-compare-the-zlib-compressed-zi.patch b/0001-trivial-Do-not-binary-compare-the-zlib-compressed-zi.patch
new file mode 100644
index 0000000..ba7d345
--- /dev/null
+++ b/0001-trivial-Do-not-binary-compare-the-zlib-compressed-zi.patch
@@ -0,0 +1,27 @@
+From d5f4c2fb3c3d7936d9ada1e16f0172674720192b Mon Sep 17 00:00:00 2001
+From: Richard Hughes <richard@hughsie.com>
+Date: Tue, 7 Jul 2026 17:26:23 +0100
+Subject: [PATCH] trivial: Do not binary-compare the zlib-compressed zip file
+
+On s390x we get a valid hardware-accelerated zlib bitstream, but it's different
+from the libz software version.
+---
+ libfwupdplugin/fu-firmware-test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libfwupdplugin/fu-firmware-test.c b/libfwupdplugin/fu-firmware-test.c
+index b53005705..d9656bfa8 100644
+--- a/libfwupdplugin/fu-firmware-test.c
++++ b/libfwupdplugin/fu-firmware-test.c
+@@ -1176,7 +1176,7 @@ fu_firmware_builder_round_trip_func(void)
+ 	    },
+ 	    {
+ 		"zip-compressed.builder.xml",
+-		"10792ff01b036ed89d11a6480694ccfd89c4d9fd",
++		NULL, /* not byte-identical */
+ 		FU_FIRMWARE_BUILDER_FLAG_NONE,
+ 	    },
+ 	};
+-- 
+2.55.0
+
diff --git a/0001-trivial-Lower-supported-meson-version.patch b/0001-trivial-Lower-supported-meson-version.patch
new file mode 100644
index 0000000..09006eb
--- /dev/null
+++ b/0001-trivial-Lower-supported-meson-version.patch
@@ -0,0 +1,26 @@
+From 998fb28785a2d059dd53c0dec71b56bcf16f116f Mon Sep 17 00:00:00 2001
+From: Richard Hughes <richard@hughsie.com>
+Date: Tue, 7 Jul 2026 16:06:12 +0100
+Subject: [PATCH 1/3] trivial: Lower supported meson version
+
+We don't actually need any newer version...
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 0652f48..eefadbe 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1,7 +1,7 @@
+ project('fwupd-efi', 'c',
+   version : '1.8',
+   license : 'LGPL-2.1+',
+-  meson_version : '>=0.62.0',
++  meson_version : '>=0.58.2',
+   default_options : ['warning_level=2', 'c_std=c99'],
+ )
+ 
+-- 
+2.55.0
+
diff --git a/0002-Allow-skipping-setting-NX-dll-characteristics.patch b/0002-Allow-skipping-setting-NX-dll-characteristics.patch
new file mode 100644
index 0000000..ed56941
--- /dev/null
+++ b/0002-Allow-skipping-setting-NX-dll-characteristics.patch
@@ -0,0 +1,25 @@
+From 86090bb11b7799a38e6ec1376d526dfcb8bdb669 Mon Sep 17 00:00:00 2001
+From: Richard Hughes <richard@hughsie.com>
+Date: Tue, 7 Jul 2026 16:07:04 +0100
+Subject: [PATCH 2/3] Allow skipping setting NX dll characteristics
+
+---
+ efi/generate_binary.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/efi/generate_binary.py b/efi/generate_binary.py
+index 3f76c24..8370f21 100755
+--- a/efi/generate_binary.py
++++ b/efi/generate_binary.py
+@@ -72,7 +72,7 @@ def _add_nx_pefile(args):
+         import pefile
+     except ImportError:
+         print("Unable to add NX support to binaries without genpeimg or python3-pefile")
+-        sys.exit(1)
++        return
+ 
+     pe = pefile.PE(args.outfile)
+     pe.OPTIONAL_HEADER.DllCharacteristics |= pefile.DLL_CHARACTERISTICS[
+-- 
+2.55.0
+
diff --git a/0002-redfish-Only-create-users-using-IPMI-when-we-know-it.patch b/0002-redfish-Only-create-users-using-IPMI-when-we-know-it.patch
deleted file mode 100644
index f7ec617..0000000
--- a/0002-redfish-Only-create-users-using-IPMI-when-we-know-it.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 4f39b747a6d860e32a3000451dd2635366c81776 Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 20 Sep 2022 09:13:52 +0100
-Subject: [PATCH 2/3] redfish: Only create users using IPMI when we know it's
- going to work
-
-Make the IPMI auto-account feature allow-listed on specific vendors as some IPMI
-implementations are not specification compliant and do entirely the wrong thing.
----
- plugins/redfish/fu-plugin-redfish.c | 8 ++++++++
- plugins/redfish/redfish.quirk       | 2 +-
- 2 files changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/plugins/redfish/fu-plugin-redfish.c b/plugins/redfish/fu-plugin-redfish.c
-index deb0fe742..3972d4b4b 100644
---- a/plugins/redfish/fu-plugin-redfish.c
-+++ b/plugins/redfish/fu-plugin-redfish.c
-@@ -422,6 +422,14 @@ fu_plugin_redfish_startup(FuPlugin *plugin, GError **error)
- #ifdef HAVE_LINUX_IPMI_H
- 	/* we got neither a type 42 entry or config value, lets try IPMI */
- 	if (fu_redfish_backend_get_username(data->backend) == NULL) {
-+		if (!fu_context_has_hwid_flag(fu_plugin_get_context(plugin), "ipmi-create-user")) {
-+			g_set_error_literal(error,
-+					    FWUPD_ERROR,
-+					    FWUPD_ERROR_NOT_SUPPORTED,
-+					    "no username and password specified, "
-+					    "and no vendor quirk for 'ipmi-create-user'");
-+			return FALSE;
-+		}
- 		if (!fu_plugin_get_config_value_boolean(plugin, "IpmiDisableCreateUser")) {
- 			g_debug("attempting to create user using IPMI");
- 			if (!fu_redfish_plugin_ipmi_create_user(plugin, error))
-diff --git a/plugins/redfish/redfish.quirk b/plugins/redfish/redfish.quirk
-index b12439926..5e9722fda 100644
---- a/plugins/redfish/redfish.quirk
-+++ b/plugins/redfish/redfish.quirk
-@@ -1,6 +1,6 @@
- # Lenovo ThinkSystem
- [42f00735-c9ab-5374-bd63-a5deee5881e0]
--Flags = wildcard-targets,reset-required
-+Flags = wildcard-targets,reset-required,ipmi-create-user
- 
- [REDFISH\VENDOR_Lenovo&ID_BMC-Backup]
- ParentGuid = REDFISH\VENDOR_Lenovo&ID_BMC-Primary
--- 
-2.39.1
-
diff --git a/0003-Never-save-the-Redfish-passwords-to-a-file-readable-.patch b/0003-Never-save-the-Redfish-passwords-to-a-file-readable-.patch
deleted file mode 100644
index f9e717d..0000000
--- a/0003-Never-save-the-Redfish-passwords-to-a-file-readable-.patch
+++ /dev/null
@@ -1,141 +0,0 @@
-From 41575afd93ca0e68bced78ca43a4488f124906a1 Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Wed, 21 Sep 2022 14:56:10 +0100
-Subject: [PATCH 3/3] Never save the Redfish passwords to a file readable by
- users
-
-When the redfish plugin automatically creates an OPERATOR user account on the
-BMC we save the autogenerated password to /etc/fwupd/redfish.conf, ensuring it
-is chmod'ed to 0660 before writing the file with g_key_file_save_to_file().
-
-Under the covers, g_key_file_save_to_file() calls g_file_set_contents() with
-the keyfile string data.
-I was under the impression that G_FILE_CREATE_REPLACE_DESTINATION was being
-used to copy permissions, but alas not.
-
-GLib instead calls g_file_set_contents_full() with the mode hardcoded to 0666,
-which undoes the previous chmod().
-
-Use g_file_set_contents_full() with the correct mode for newer GLib versions,
-and provide a fallback with the same semantics for older versions.
----
- contrib/fwupd.spec.in         |  3 ++
- libfwupdplugin/fu-plugin.c    | 65 +++++++++++++++++++++++++++++------
- libfwupdplugin/fu-self-test.c | 57 ++++++++++++++++++++++++++++++
- 3 files changed, 114 insertions(+), 11 deletions(-)
-
-diff --git a/contrib/fwupd.spec.in b/contrib/fwupd.spec.in
-index a50e30a9c..0854fcf4f 100644
---- a/contrib/fwupd.spec.in
-+++ b/contrib/fwupd.spec.in
-@@ -313,6 +313,9 @@ for fn in /etc/fwupd/remotes.d/*.conf; do
-     fi
- done
- 
-+# ensure this is private
-+chmod 0660 /etc/fwupd/redfish.conf
-+
- %preun
- %systemd_preun fwupd.service
- 
-diff --git a/libfwupdplugin/fu-plugin.c b/libfwupdplugin/fu-plugin.c
-index 18042a028..04951de85 100644
---- a/libfwupdplugin/fu-plugin.c
-+++ b/libfwupdplugin/fu-plugin.c
-@@ -9,6 +9,7 @@
- #include "config.h"
- 
- #include <errno.h>
-+#include <fcntl.h>
- #include <fwupd.h>
- #include <glib/gstdio.h>
- #include <gmodule.h>
-@@ -2256,6 +2257,46 @@ fu_plugin_set_config_value(FuPlugin *self, const gchar *key, const gchar *value,
- 	return g_key_file_save_to_file(keyfile, conf_path, error);
- }
- 
-+#if !GLIB_CHECK_VERSION(2, 66, 0)
-+
-+#define G_FILE_SET_CONTENTS_CONSISTENT 0
-+typedef guint GFileSetContentsFlags;
-+static gboolean
-+g_file_set_contents_full(const gchar *filename,
-+			 const gchar *contents,
-+			 gssize length,
-+			 GFileSetContentsFlags flags,
-+			 int mode,
-+			 GError **error)
-+{
-+	gint fd;
-+	gssize wrote;
-+
-+	if (length < 0)
-+		length = strlen(contents);
-+	fd = g_open(filename, O_CREAT, mode);
-+	if (fd <= 0) {
-+		g_set_error(error,
-+			    G_IO_ERROR,
-+			    G_IO_ERROR_FAILED,
-+			    "could not open %s file",
-+			    filename);
-+		return FALSE;
-+	}
-+	wrote = write(fd, contents, length);
-+	if (wrote != length) {
-+		g_set_error(error,
-+			    G_IO_ERROR,
-+			    G_IO_ERROR_FAILED,
-+			    "did not write %s file",
-+			    filename);
-+		g_close(fd, NULL);
-+		return FALSE;
-+	}
-+	return g_close(fd, error);
-+}
-+#endif
-+
- /**
-  * fu_plugin_set_secure_config_value:
-  * @self: a #FuPlugin
-@@ -2277,7 +2318,8 @@ fu_plugin_set_secure_config_value(FuPlugin *self,
- 				  GError **error)
- {
- 	g_autofree gchar *conf_path = fu_plugin_get_config_filename(self);
--	gint ret;
-+	g_autofree gchar *data = NULL;
-+	g_autoptr(GKeyFile) keyfile = g_key_file_new();
- 
- 	g_return_val_if_fail(FU_IS_PLUGIN(self), FALSE);
- 	g_return_val_if_fail(error == NULL || *error == NULL, FALSE);
-@@ -2286,17 +2328,18 @@ fu_plugin_set_secure_config_value(FuPlugin *self,
- 		g_set_error(error, FWUPD_ERROR, FWUPD_ERROR_NOT_FOUND, "%s is missing", conf_path);
- 		return FALSE;
- 	}
--	ret = g_chmod(conf_path, 0660);
--	if (ret == -1) {
--		g_set_error(error,
--			    FWUPD_ERROR,
--			    FWUPD_ERROR_INTERNAL,
--			    "failed to set permissions on %s",
--			    conf_path);
-+	if (!g_key_file_load_from_file(keyfile, conf_path, G_KEY_FILE_KEEP_COMMENTS, error))
- 		return FALSE;
--	}
--
--	return fu_plugin_set_config_value(self, key, value, error);
-+	g_key_file_set_string(keyfile, fu_plugin_get_name(self), key, value);
-+	data = g_key_file_to_data(keyfile, NULL, error);
-+	if (data == NULL)
-+		return FALSE;
-+	return g_file_set_contents_full(conf_path,
-+					data,
-+					-1,
-+					G_FILE_SET_CONTENTS_CONSISTENT,
-+					0660,
-+					error);
- }
- 
- /**
--- 
-2.39.1
-
diff --git a/0003-trivial-Lower-required-version-of-gnu-efi.patch b/0003-trivial-Lower-required-version-of-gnu-efi.patch
new file mode 100644
index 0000000..ca40833
--- /dev/null
+++ b/0003-trivial-Lower-required-version-of-gnu-efi.patch
@@ -0,0 +1,25 @@
+From 23f3ca09e49bcb4d71c47014819540de6e3df8af Mon Sep 17 00:00:00 2001
+From: Richard Hughes <richard@hughsie.com>
+Date: Tue, 7 Jul 2026 16:08:06 +0100
+Subject: [PATCH 3/3] trivial: Lower required version of gnu-efi
+
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index eefadbe..4035cf8 100644
+--- a/meson.build
++++ b/meson.build
+@@ -13,7 +13,7 @@ cc_ld = find_program(cc.get_linker_id())
+ objcopy = find_program('objcopy')
+ objcopy_version = run_command(objcopy, '--version', check: true).stdout().split('\n')[0].split(' ')[-1]
+ 
+-gnuefi = dependency('gnu-efi', version: '>= 3.0.18')
++gnuefi = dependency('gnu-efi', required: false)
+ prefix = get_option('prefix')
+ libdir = join_paths(prefix, get_option('libdir'))
+ libexecdir = join_paths(prefix, get_option('libexecdir'))
+-- 
+2.55.0
+
diff --git a/fwupd.spec b/fwupd.spec
index 03d4fa2..e070cb2 100644
--- a/fwupd.spec
+++ b/fwupd.spec
@@ -1,10 +1,13 @@
-%global glib2_version 2.45.8
+%global glib2_version 2.56.4
 %global libxmlb_version 0.1.3
 %global libgusb_version 0.2.11
-%global libcurl_version 7.61.0
-%global systemd_version 231
+%global libusb_version 1.0.30
+%global libcurl_version 7.61.1
+%global systemd_version 237
 %global json_glib_version 1.1.1
-%global fwupdplugin_version 5
+
+# to use this feature use `rpmbuild -ba fwupd.spec --with=libfwupdcompat`
+%bcond_with libfwupdcompat
 
 # although we ship a few tiny python files these are utilities that 99.99%
 # of users do not need -- use this to avoid dragging python onto CoreOS
@@ -14,12 +17,10 @@
 %ifnarch ppc64le
 %global enable_tests 1
 %endif
-
-%global enable_dummy 1
-%global __meson_wrap_mode default
+%global __meson_wrap_mode nodownload
 
 # fwupd.efi is only available on these arches
-%ifarch x86_64 aarch64
+%ifarch x86_64 aarch64 riscv64 loongarch64
 %global have_uefi 1
 %endif
 
@@ -27,32 +28,18 @@
 %global have_msr 1
 %endif
 
-# libsmbios is only available on x86
-%ifarch x86_64
-%global have_dell 1
-%endif
-
-# only available recently
-%if 0%{?fedora} >= 34 || 0%{?rhel} >= 9
-%global have_modem_manager 1
-%endif
-
 Summary:   Firmware update daemon
 Name:      fwupd
-Version:   1.7.8
-Release:   2%{?dist}
-License:   LGPLv2+
+Version:   2.1.6
+Release:   1%{?dist}
+License:   LGPL-2.1-or-later
 URL:       https://github.com/fwupd/fwupd
 Source0:   http://people.freedesktop.org/~hughsient/releases/%{name}-%{version}.tar.xz
-Source1:   http://people.freedesktop.org/~hughsient/releases/libjcat-0.1.9.tar.xz
-Source2:   http://people.freedesktop.org/~hughsient/releases/fwupd-efi-1.3.tar.xz
+Source1:   http://people.freedesktop.org/~hughsient/releases/fwupd-efi-1.8.tar.gz
+Source2:   https://github.com/fwupd/%{name}/releases/download/1.7.8/%{name}-1.7.8.tar.xz
+Source3:   http://people.freedesktop.org/~hughsient/releases/libjcat-0.1.9.tar.xz
 
-Source10:  http://people.redhat.com/rhughes/dbx/DBXUpdate-20100307-x64.cab
-Source11:  http://people.redhat.com/rhughes/dbx/DBXUpdate-20140413-x64.cab
-Source12:  http://people.redhat.com/rhughes/dbx/DBXUpdate-20160809-x64.cab
-Source13:  http://people.redhat.com/rhughes/dbx/DBXUpdate-20200729-aa64.cab
-Source14:  http://people.redhat.com/rhughes/dbx/DBXUpdate-20200729-ia32.cab
-Source15:  http://people.redhat.com/rhughes/dbx/DBXUpdate-20200729-x64.cab
+Source24:  https://fwupd.org/downloads/9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab
 
 # these are numbered high just to keep them wildly away from colliding with
 # the real package sources, in order to reduce churn.
@@ -61,49 +48,54 @@ Source301:   redhatsecureboot301.cer
 Source500:   redhatsecurebootca5.cer
 Source503:   redhatsecureboot503.cer
 
-Patch1:    0001-redfish-Set-the-permissions-of-redfish.conf-at-insta.patch
-Patch2:    0002-redfish-Only-create-users-using-IPMI-when-we-know-it.patch
-Patch3:    0003-Never-save-the-Redfish-passwords-to-a-file-readable-.patch
-Patch4:    0001-Use-usr-libexec-platform-python-for-RHEL.patch
+Patch1:    0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch
+Patch2:    0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch
+Patch3:    0001-trivial-Do-not-binary-compare-the-zlib-compressed-zi.patch
+Patch5:    0001-Downgrade-deps-for-RHEL-8.patch
+
+Patch201:  0001-trivial-Lower-supported-meson-version.patch
+Patch202:  0002-Allow-skipping-setting-NX-dll-characteristics.patch
+Patch203:  0003-trivial-Lower-required-version-of-gnu-efi.patch
 
 BuildRequires: efi-srpm-macros
 BuildRequires: gettext
+BuildRequires: hwdata
 BuildRequires: glib2-devel >= %{glib2_version}
 BuildRequires: libxmlb-devel >= %{libxmlb_version}
 BuildRequires: libgcab1-devel
 BuildRequires: libgudev1-devel
 BuildRequires: libgusb-devel >= %{libgusb_version}
+BuildRequires: libusb1-devel >= %{libusb_version}
 BuildRequires: libcurl-devel >= %{libcurl_version}
 BuildRequires: polkit-devel >= 0.103
+BuildRequires: python3-packaging
+BuildRequires: python3-jinja2
 BuildRequires: sqlite-devel
 BuildRequires: gpgme-devel
 BuildRequires: systemd >= %{systemd_version}
 BuildRequires: systemd-devel
-BuildRequires: libarchive-devel
+BuildRequires: libblkid-devel
+BuildRequires: zlib-devel
+BuildRequires: readline-devel
+BuildRequires: libmnl-devel
 BuildRequires: gobject-introspection-devel
 BuildRequires: gcab
 %ifarch %{valgrind_arches}
 BuildRequires: valgrind
 BuildRequires: valgrind-devel
 %endif
-BuildRequires: gtk-doc
 BuildRequires: gnutls-devel
 BuildRequires: gnutls-utils
 BuildRequires: meson
-BuildRequires: help2man
 BuildRequires: json-glib-devel >= %{json_glib_version}
 BuildRequires: vala
-BuildRequires: bash-completion
+BuildRequires: pkgconfig(bash-completion)
 BuildRequires: git-core
-
-%if 0%{?have_modem_manager}
-BuildRequires: ModemManager-glib-devel >= 1.10.0
-BuildRequires: libqmi-devel >= 1.22.0
-BuildRequires: libmbim-devel
-%endif
+BuildRequires: libdrm-devel
+# For fu-polkit-test
+BuildRequires: polkit
 
 %if 0%{?have_uefi}
-BuildRequires: efivar-devel >= 33
 BuildRequires: python3 python3-cairo python3-gobject
 BuildRequires: pango-devel
 BuildRequires: cairo-devel cairo-gobject-devel
@@ -111,32 +103,37 @@ BuildRequires: freetype
 BuildRequires: fontconfig
 BuildRequires: google-noto-sans-cjk-ttc-fonts
 BuildRequires: gnu-efi-devel
+BuildRequires: tpm2-tss-devel >= 2.2.3
 BuildRequires: pesign
 %endif
 
-%if 0%{?have_dell}
-BuildRequires: efivar-devel >= 33
-BuildRequires: libsmbios-devel >= 2.3.0
-%endif
-
 Requires(post): systemd
 Requires(preun): systemd
 Requires(postun): systemd
 
 Requires: glib2%{?_isa} >= %{glib2_version}
 Requires: libxmlb%{?_isa} >= %{libxmlb_version}
-Requires: libgusb%{?_isa} >= %{libgusb_version}
-Requires: bubblewrap
 Requires: shared-mime-info
 
+# deliberately has no _isa as libusbx in RHEL-9 does not include it
+Requires: libusb1 >= %{libusb_version}
+
 Obsoletes: fwupd-sign < 0.1.6
 Obsoletes: libebitdo < 0.7.5-3
 Obsoletes: libdfu < 1.0.0
 Obsoletes: fwupd-labels < 1.1.0-1
 
+%if 0%{?rhel} > 7 || 0%{?fedora} > 28
+Recommends: python3
+%endif
+
 Obsoletes: dbxtool < 9
 Provides: dbxtool
 
+# this was removed in 2.1.4
+Obsoletes: %{name}-plugin-flashrom < 2.1.4
+Obsoletes: %{name}-plugin-flashrom-debuginfo < 2.1.4
+
 %if 0%{?rhel} > 7
 Obsoletes: fwupdate < 13
 Obsoletes: fwupdate-efi < 13
@@ -147,6 +144,13 @@ Provides: fwupdate-efi
 
 # optional, but a really good idea
 Recommends: udisks2
+Recommends: bluez
+Recommends: jq
+
+%if 0%{?have_uefi}
+Recommends: %{name}-efi
+Recommends: %{name}-plugin-uefi-capsule-data
+%endif
 
 %description
 fwupd is a daemon to allow session software to update device firmware.
@@ -167,14 +171,46 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
 %description tests
 Data files for installed tests.
 
+%if 0%{?have_uefi}
+%package plugin-uefi-capsule-data
+Summary: Localized data for the UEFI UX capsule
+Requires: %{name}%{?_isa} = %{version}-%{release}
+
+%description plugin-uefi-capsule-data
+This provides the pregenerated BMP artwork for the UX capsule, which allows the
+"Installing firmware update…" localized text to be shown during a UEFI firmware
+update operation. This subpackage is probably not required on embedded hardware
+or server machines.
+%endif
+
 %prep
-%autosetup -p1
+%setup -q
+%patch -P 1 -p1
+%patch -P 3 -p1
+%patch -P 5 -p1
 
 mkdir -p subprojects/libjcat
-tar xfvs %{SOURCE1} -C subprojects/libjcat --strip-components=1
+tar xfvs %{SOURCE3} -C subprojects/libjcat --strip-components=1
 
+# the EFI helper
+%if %{with libfwupdcompat} || 0%{?rhel}
 mkdir -p subprojects/fwupd-efi
-tar xfvs %{SOURCE2} -C subprojects/fwupd-efi --strip-components=1
+tar xfvs %{SOURCE1} -C subprojects/fwupd-efi --strip-components=1
+cd subprojects/fwupd-efi
+%patch -P 201 -p1
+%patch -P 202 -p1
+%patch -P 203 -p1
+cd -
+%endif
+
+# and the old version for libfwupd1
+%if %{with libfwupdcompat} || 0%{?rhel}
+tar xfs %{SOURCE2}
+cd fwupd-1.7.8
+%patch -P 2 -p1
+mkdir -p subprojects/libjcat
+tar xfvs %{SOURCE3} -C subprojects/libjcat --strip-components=1
+%endif
 
 sed -ri '1s=^#!/usr/bin/(env )?python3=#!%{__python3}=' \
         contrib/ci/*.py \
@@ -192,10 +228,29 @@ sed -ri '1s=^#!/usr/bin/(env )?python3=#!%{__python3}=' \
 # allow rh-signing-tools package for RHEL-8
 export RHEL_ALLOW_PYTHON2_FOR_BUILD=1
 
+%if %{with libfwupdcompat} || 0%{?rhel}
+cd fwupd-1.7.8
 %meson \
-    -Ddocs=gtkdoc \
-    -Dlvfs=disabled \
-    -Defi_os_dir=%{efi_vendor} \
+    -Dlibjcat:gtkdoc=false \
+    -Dlibjcat:introspection=false \
+    -Dlibjcat:tests=false \
+    -Dbuild=library \
+    -Ddocs=none \
+    -Dpolkit=false \
+    -Dgusb=false \
+    -Dlibarchive=false \
+    -Dtests=false \
+    -Dbash_completion=false \
+    -Dplugin_msr=false \
+    -Dintrospection=false \
+    -Dplugin_logitech_bulkcontroller=false
+%meson_build
+cd -
+%endif
+
+%meson \
+    -Dumockdev_tests=disabled \
+    -Ddocs=disabled \
     -Dlibjcat:gtkdoc=false \
     -Dlibjcat:introspection=false \
     -Dlibjcat:tests=false \
@@ -204,88 +259,82 @@ export RHEL_ALLOW_PYTHON2_FOR_BUILD=1
 %else
     -Dtests=false \
 %endif
-%if 0%{?enable_dummy}
-    -Dplugin_dummy=true \
-%else
-    -Dplugin_dummy=false \
-%endif
-    -Dplugin_flashrom=false \
-%if 0%{?have_msr}
-    -Dplugin_msr=true \
-%else
-    -Dplugin_msr=false \
-%endif
-    -Dplugin_thunderbolt=true \
 %if 0%{?have_uefi}
-    -Dplugin_uefi_capsule=true \
-    -Dplugin_uefi_pk=false \
+    -Defi_binary=true \
+    -Dfwupd-efi:genpeimg=disabled \
+    -Defi_os_dir=%{efi_vendor} \
+%endif
+    -Dplugin_modem_manager=disabled \
+    -Dbluez=disabled \
+    -Dlvfs=disabled \
+    -Dpassim=disabled \
+%ifarch i686 x86_64
+    -Dhsi=enabled \
+%else
+    -Dhsi=disabled \
+%endif
+%ifarch %{valgrind_arches}
+    -Dvalgrind=enabled \
+%else
+    -Dvalgrind=disabled \
+%endif
+    -Dintrospection=disabled \
+    -Dreadline=disabled \
 %ifarch x86_64
     -Dfwupd-efi:efi_sbat_distro_id="rhel" \
     -Dfwupd-efi:efi_sbat_distro_summary="Red Hat Enterprise Linux" \
     -Dfwupd-efi:efi_sbat_distro_pkgname="%{name}" \
     -Dfwupd-efi:efi_sbat_distro_version="%{version}" \
-    -Dfwupd-efi:efi_sbat_distro_url="mail:secalert@redhat.com" \
+    -Dfwupd-efi:efi_sbat_distro_url="mailto:secalert@redhat.com" \
     -Dfwupd-efi:efi-libdir="/usr/lib64" \
 %endif
-    -Dplugin_tpm=false \
-%else
-    -Dplugin_uefi_capsule=false \
-    -Dplugin_uefi_pk=false \
-    -Dplugin_tpm=false \
-%endif
-%if 0%{?have_dell}
-    -Dplugin_dell=true \
-    -Dplugin_synaptics_mst=true \
-%else
-    -Dplugin_dell=false \
-    -Dplugin_synaptics_mst=false \
-%endif
-%if 0%{?have_modem_manager}
-    -Dplugin_modem_manager=true \
-%else
-    -Dplugin_modem_manager=false \
-%endif
-    -Dplugin_logitech_bulkcontroller=false \
     -Dman=true \
-    -Dbluez=false \
-    -Dplugin_cfu=false \
-    -Dplugin_mtd=false \
-    -Dplugin_powerd=false \
-    -Dplugin_uf2=false \
+    -Dsystemd_unit_user="" \
     -Dsupported_build=true
 
 %meson_build
 
-%if 0%{?enable_tests}
-%check
-%meson_test
-%endif
-
 %install
+
+%if %{with libfwupdcompat} || 0%{?rhel}
+cd fwupd-1.7.8
+%meson_install
+cd -
+%endif
 %meson_install
 
 # on RHEL the LVFS is disabled by default
-mkdir -p %{buildroot}/%{_datadir}/dbxtool
-install %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} %{buildroot}/%{_datadir}/dbxtool
+install \
+  %{SOURCE24} \
+  %{buildroot}/%{_datadir}/fwupd/remotes.d/vendor/firmware/
 
 # sign fwupd.efi loader
 %ifarch x86_64
 %global efiarch x64
 %global fwup_efi_fn $RPM_BUILD_ROOT%{_libexecdir}/fwupd/efi/fwupd%{efiarch}.efi
+%define __pesign_client_cert fwupd-signer
 %pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.tmp -a %{SOURCE300} -c %{SOURCE301} -n redhatsecureboot301
 %pesign -s -i %{fwup_efi_fn}.tmp -o %{fwup_efi_fn}.signed -a %{SOURCE500} -c %{SOURCE503} -n redhatsecureboot503
 rm -fv %{fwup_efi_fn}.tmp
 %endif
 
-mkdir -p --mode=0700 $RPM_BUILD_ROOT%{_localstatedir}/lib/fwupd/gnupg
+# literally pointless if we are building fwupd-efi as a subproject
+rm -f %{buildroot}%{_libdir}/pkgconfig/fwupd-efi.pc
+
+mkdir -p --mode=0700 $RPM_BUILD_ROOT%{_localstatedir}/lib/fwupd
 
 # workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1757948
 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/cache/fwupd
 
 %find_lang %{name}
 
+%check
+%if 0%{?enable_tests}
+%meson_test
+%endif
+
 %post
-%systemd_post fwupd.service
+%systemd_post fwupd.service fwupd-refresh.timer
 
 # change vendor-installed remotes to use the default keyring type
 for fn in /etc/fwupd/remotes.d/*.conf; do
@@ -295,242 +344,124 @@ for fn in /etc/fwupd/remotes.d/*.conf; do
 done
 
 %preun
-%systemd_preun fwupd.service
+%systemd_preun fwupd.service fwupd-refresh.timer
 
 %postun
-%systemd_postun_with_restart fwupd.service
-%systemd_postun_with_restart pesign.service
+%systemd_postun_with_restart fwupd.service fwupd-refresh.timer
+
+%triggerun -- fedora-release-common < 39-0.28
+# For upgrades from versions before fwupd-refresh.timer was enabled by default
+systemctl --no-reload preset fwupd-refresh.timer &>/dev/null || :
 
 %files -f %{name}.lang
-%doc README.md AUTHORS
+%doc README.md
 %license COPYING
-%config(noreplace)%{_sysconfdir}/fwupd/daemon.conf
-%if 0%{?have_uefi}
-%config(noreplace)%{_sysconfdir}/fwupd/uefi_capsule.conf
-%endif
-%config(noreplace)%{_sysconfdir}/fwupd/redfish.conf
-%config(noreplace)%{_sysconfdir}/fwupd/thunderbolt.conf
+%config(noreplace)%{_sysconfdir}/fwupd/fwupd.conf
 %dir %{_libexecdir}/fwupd
 %{_libexecdir}/fwupd/fwupd
-%ifarch i686 x86_64
+%ifarch x86_64
 %{_libexecdir}/fwupd/fwupd-detect-cet
 %endif
-%{_libexecdir}/fwupd/fwupdoffline
 %if 0%{?have_uefi}
 %{_libexecdir}/fwupd/efi/*.efi
 %ifarch x86_64
 %{_libexecdir}/fwupd/efi/*.efi.signed
 %endif
-%{_bindir}/fwupdate
-%endif
-%{_bindir}/dfu-tool
-%if 0%{?have_uefi}
 %{_bindir}/dbxtool
 %endif
 %{_bindir}/fwupdmgr
 %{_bindir}/fwupdtool
-%{_bindir}/fwupdagent
 %{_bindir}/jcat-tool
 %dir %{_sysconfdir}/fwupd
+%dir %{_sysconfdir}/fwupd/bios-settings.d
+%{_sysconfdir}/fwupd/bios-settings.d/README.md
 %dir %{_sysconfdir}/fwupd/remotes.d
-%if 0%{?have_dell}
-%config(noreplace)%{_sysconfdir}/fwupd/remotes.d/dell-esrt.conf
-%endif
 %config(noreplace)%{_sysconfdir}/fwupd/remotes.d/lvfs.conf
+%config(noreplace)%{_sysconfdir}/fwupd/remotes.d/lvfs-embargo.conf
 %config(noreplace)%{_sysconfdir}/fwupd/remotes.d/lvfs-testing.conf
-%config(noreplace)%{_sysconfdir}/fwupd/remotes.d/vendor.conf
 %config(noreplace)%{_sysconfdir}/fwupd/remotes.d/vendor-directory.conf
 %config(noreplace)%{_sysconfdir}/pki/fwupd
 %{_sysconfdir}/pki/fwupd-metadata
 %if 0%{?have_msr}
 /usr/lib/modules-load.d/fwupd-msr.conf
-%config(noreplace)%{_sysconfdir}/fwupd/msr.conf
 %endif
+/usr/lib/modules-load.d/fwupd-i2c.conf
 %{_datadir}/dbus-1/system.d/org.freedesktop.fwupd.conf
 %{_datadir}/bash-completion/completions/fwupdmgr
 %{_datadir}/bash-completion/completions/fwupdtool
-%{_datadir}/bash-completion/completions/fwupdagent
 %{_datadir}/fish/vendor_completions.d/fwupdmgr.fish
+%dir %{_datadir}/fwupd
+%dir %{_datadir}/fwupd/metainfo
 %{_datadir}/fwupd/metainfo/org.freedesktop.fwupd*.metainfo.xml
-%if 0%{?have_dell}
-%{_datadir}/fwupd/remotes.d/dell-esrt/metadata.xml
-%endif
+%dir %{_datadir}/fwupd/remotes.d
+%dir %{_datadir}/fwupd/remotes.d/vendor
+%dir %{_datadir}/fwupd/remotes.d/vendor/firmware
+%{_datadir}/fwupd/remotes.d/vendor/firmware/*.cab
 %{_datadir}/fwupd/remotes.d/vendor/firmware/README.md
 %{_datadir}/dbus-1/interfaces/org.freedesktop.fwupd.xml
 %{_datadir}/polkit-1/actions/org.freedesktop.fwupd.policy
 %{_datadir}/polkit-1/rules.d/org.freedesktop.fwupd.rules
 %{_datadir}/dbus-1/system-services/org.freedesktop.fwupd.service
-%dir %{_datadir}/dbxtool
-%{_datadir}/dbxtool/DBXUpdate-20100307-x64.cab
-%{_datadir}/dbxtool/DBXUpdate-20140413-x64.cab
-%{_datadir}/dbxtool/DBXUpdate-20160809-x64.cab
-%{_datadir}/dbxtool/DBXUpdate-20200729-aa64.cab
-%{_datadir}/dbxtool/DBXUpdate-20200729-ia32.cab
-%{_datadir}/dbxtool/DBXUpdate-20200729-x64.cab
 %{_mandir}/man1/fwupdtool.1*
-%{_mandir}/man1/fwupdagent.1*
-%{_mandir}/man1/dfu-tool.1*
+%{_mandir}/man1/jcat-tool.1*
 %if 0%{?have_uefi}
 %{_mandir}/man1/dbxtool.*
 %endif
 %{_mandir}/man1/fwupdmgr.1*
-%if 0%{?have_uefi}
-%{_mandir}/man1/fwupdate.1*
-%endif
-%{_mandir}/man1/jcat-tool.1*
+%{_mandir}/man5/*
+%{_mandir}/man8/*
 %{_datadir}/metainfo/org.freedesktop.fwupd.metainfo.xml
-%{_datadir}/icons/hicolor/scalable/apps/org.freedesktop.fwupd.svg
+%{_datadir}/icons/hicolor/*/apps/org.freedesktop.fwupd.*
 %{_datadir}/fwupd/firmware_packager.py
 %{_datadir}/fwupd/simple_client.py
 %{_datadir}/fwupd/add_capsule_header.py
 %{_datadir}/fwupd/install_dell_bios_exe.py
-%{_unitdir}/fwupd-offline-update.service
 %{_unitdir}/fwupd.service
 %{_unitdir}/fwupd-refresh.service
 %{_unitdir}/fwupd-refresh.timer
-%{_presetdir}/fwupd-refresh.preset
-%{_unitdir}/system-update.target.wants/
 %dir %{_localstatedir}/lib/fwupd
 %dir %{_localstatedir}/cache/fwupd
 %dir %{_datadir}/fwupd/quirks.d
-%{_datadir}/fwupd/quirks.d/*.quirk
-%{_datadir}/doc/fwupd/builder/README.md
+%{_datadir}/fwupd/quirks.d/builtin.quirk.gz
 %if 0%{?have_uefi}
-%{_sysconfdir}/grub.d/35_fwupd
+%config(noreplace)%{_sysconfdir}/grub.d/35_fwupd
 %endif
+%if %{with libfwupdcompat} || 0%{?rhel}
 %{_libdir}/libfwupd.so.2*
-%{_libdir}/libfwupdplugin.so.%{fwupdplugin_version}*
+%endif
+%{_libdir}/libfwupd.so.3*
 %{_libdir}/libjcat.so.*
-%{_libdir}/girepository-1.0/Fwupd-2.0.typelib
-%{_libdir}/girepository-1.0/FwupdPlugin-1.0.typelib
-/usr/lib/udev/rules.d/*.rules
 /usr/lib/systemd/system-shutdown/fwupd.shutdown
-%dir %{_libdir}/fwupd-plugins-%{fwupdplugin_version}
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_acpi_dmar.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_acpi_facp.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_acpi_phat.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_amt.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_analogix.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_ata.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_bcm57xx.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_ccgx.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_colorhug.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_cros_ec.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_cpu.so
-%if 0%{?have_dell}
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_dell.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_dell_esrt.so
-%endif
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_dell_dock.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_dfu.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_dfu_csr.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_ebitdo.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_elantp.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_elanfp.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_emmc.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_ep963x.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_fastboot.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_fresco_pd.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_genesys.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_hailuck.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_iommu.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_jabra.so
-%if 0%{?have_uefi}
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_lenovo_thinklmi.so
-%endif
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_linux_lockdown.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_linux_sleep.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_linux_swap.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_linux_tainted.so
-%if 0%{?have_msr}
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_msr.so
-%endif
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_nitrokey.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_nordic_hid.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_nvme.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_optionrom.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_parade_lspcon.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_pci_bcr.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_pci_mei.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_pixart_rf.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_realtek_mst.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_redfish.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_rts54hid.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_rts54hub.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_scsi.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_steelseries.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_superio.so
-%if 0%{?have_dell}
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_synaptics_mst.so
-%endif
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_synaptics_cape.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_synaptics_cxaudio.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_synaptics_prometheus.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_synaptics_rmi.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_system76_launch.so
-%if 0%{?enable_dummy}
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_test.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_invalid.so
-%endif
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_thelio_io.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_thunderbolt.so
-%if 0%{?have_uefi}
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_bios.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_uefi_capsule.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_uefi_dbx.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_uefi_recovery.so
-%endif
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_usi_dock.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_logind.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_logitech_hidpp.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_upower.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_vli.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_wacom_raw.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_wacom_usb.so
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_goodixmoc.so
-%ghost %{_localstatedir}/lib/fwupd/gnupg
+%dir %{_libdir}/fwupd-%{version}
+%{_libdir}/fwupd-%{version}/libfwupd*.so
 
-%if 0%{?have_modem_manager}
-%{_libdir}/fwupd-plugins-%{fwupdplugin_version}/libfu_plugin_modem_manager.so
-%endif
 %if 0%{?have_uefi}
-%{_datadir}/fwupd/uefi-capsule-ux.tar.xz
+%files plugin-uefi-capsule-data
+%{_datadir}/fwupd/uefi-capsule-ux.zip
 %endif
 
 %files devel
-%{_datadir}/gir-1.0/Fwupd-2.0.gir
-%{_datadir}/gir-1.0/FwupdPlugin-1.0.gir
-%{_datadir}/gtk-doc/html/fwupd
-%{_datadir}/vala/vapi
 %{_includedir}/fwupd-1
+%{_includedir}/fwupd-3
 %{_includedir}/libjcat-1
-%{_libdir}/libfwupd*.so
+%{_libdir}/libfwupd.so
 %{_libdir}/libjcat.so
 %{_libdir}/pkgconfig/fwupd.pc
-%{_libdir}/pkgconfig/fwupdplugin.pc
-%if 0%{?have_uefi}
-%{_libdir}/pkgconfig/fwupd-efi.pc
-%endif
 %{_libdir}/pkgconfig/jcat.pc
 
 %files tests
-%if 0%{?enable_tests}
-%dir %{_datadir}/installed-tests/fwupd
-%{_datadir}/installed-tests/fwupd/tests/*
-%{_datadir}/installed-tests/fwupd/fwupd-tests.xml
-%{_datadir}/installed-tests/fwupd/*.test
-%{_datadir}/installed-tests/fwupd/*.cab
-%{_datadir}/installed-tests/fwupd/*.sh
-%if 0%{?have_uefi}
-%{_datadir}/installed-tests/fwupd/efi
-%endif
-%{_datadir}/fwupd/device-tests/*.json
-%{_libexecdir}/installed-tests/fwupd/*
-%dir %{_sysconfdir}/fwupd/remotes.d
-%config(noreplace)%{_sysconfdir}/fwupd/remotes.d/fwupd-tests.conf
+%ifnarch ppc64le
+%{_datadir}/fwupd/host-emulate.d/*.json.gz
+%{_datadir}/installed-tests/fwupd
+%{_libexecdir}/installed-tests/fwupd
+%{_datadir}/fwupd/remotes.d/fwupd-tests.conf
 %endif
 
 %changelog
+* Fri Jul 03 2026 Richard Hughes <richard@hughsie.com> 2.1.6-1
+- Rebase to a new version.
+- Resolves: RHEL-185615
+
 * Mon Feb 20 2023 Richard Hughes <richard@hughsie.com> 1.7.8-2
 - Backport the Redfish security fixes which affect IDRAC.
 - Resolves: rhbz#2170950
diff --git a/sources b/sources
index d3686af..65a7609 100644
--- a/sources
+++ b/sources
@@ -1,9 +1,5 @@
-SHA512 (fwupd-1.7.8.tar.xz) = c90c86b1b336e47083b0b6f558ba321cceb1717f2e663fd569d17c81cc8bee52599909c5aa9b163a9936ca2948b53c83edc7e460a107c52969e7618244713f48
-SHA512 (fwupd-efi-1.3.tar.xz) = 582bc0298f773b3017fab317a392b6fe95a9d1698bfe17e56370515f4563c8d45c12f28ae52d304866e4b077043bb0c9d5c1abf4b75ded5f70b6d8ccad495ea5
+SHA512 (fwupd-2.1.6.tar.xz) = ac6400017df913b96f0df2616ffe92d4eeb4bf97d2c33fa1fe6ed8f5aba86438418d56db0b1e54a9977cb729b35c23c2010d778ef37486d0ed7058640e9c35d0
+SHA512 (fwupd-efi-1.8.tar.gz) = bd361eb60397850af025228ea9f4efbf289f8e1c2612f240ae4c5ffee8caea15c31aa0748c06e57b28a7f38b8c2708147a228d8a99077798f4435436f12e092e
 SHA512 (libjcat-0.1.9.tar.xz) = 7fe29c82033eeb24965311496e948c0a78a09db5af6655c62da1ce6c39d817647aac0e9299dddf7ce13515c0e32a6c00d2a4b35ad045e7ac79d27034b96f4ec6
-SHA512 (DBXUpdate-20100307-x64.cab) = f8ad56cf015f4cdc5c305856ff1f7a8589c25a2a671708c61883f427f38eb9b6a7abd3f2c8d79ef9d5076222255e42585917f8705a2a4b13f860bad4e02ec409
-SHA512 (DBXUpdate-20140413-x64.cab) = 75771876a2309fa8ca083c2e76520173d434229b7cacf1e7636bd9b1bc4f871d745c348b9792bfb65fd9f40ef54c25bb427b1431151e817e7050b7829456731a
-SHA512 (DBXUpdate-20160809-x64.cab) = c27c564999ae84515540f1a598cd0fd9ef3a80cdfaaf439f1c4cb04eaee0e73074548b6d76c21ca3af1ba9c4c0625907e821582998eb5617e33ecd412e6c8a13
-SHA512 (DBXUpdate-20200729-aa64.cab) = 7a0cea13ed9b645fd9f1d5e3410a451d83643a75f5dc603272b0771b093f2c012f9a19419160403631c250cf64127ad2ce1c8fa2079b04064af73fe85b9add33
-SHA512 (DBXUpdate-20200729-ia32.cab) = 578ec9cccf2001b8bfa54b66809a1662269677050e74bd3225536fbd2be56a8162c48669bd16ea553723580195df1693a28dc01fc1cf62ff06e36a2c5568f74f
-SHA512 (DBXUpdate-20200729-x64.cab) = b8b195167d286a3f16aaa7c89149a0d5b4c8f53080e3265758b912f250fa655533c603359b7d1c989ebad6953ce443809b3317ec1d00f750326945ee0537e43b
+SHA512 (fwupd-1.7.8.tar.xz) = c90c86b1b336e47083b0b6f558ba321cceb1717f2e663fd569d17c81cc8bee52599909c5aa9b163a9936ca2948b53c83edc7e460a107c52969e7618244713f48
+SHA512 (9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab) = 7fff3d5757b6ca5392ae21b7eab06d216d8eb3ccf24f68399679c402d21c842b7d9b0f716071b3f1163325f216926d3941fe494ca784ef257c466477525af76f