.fwupd.metadata

@@ -1,9 +1,4 @@
-699ad9c1e22655ebe0325ca9f6237b12bcffd8cc SOURCES/9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab
-59006fd556faeacc8185075c8fe7826249a2da32 SOURCES/fwupd-1.7.8.tar.xz
-26f05602b56e4d53e74cd3ebffa0f248d3de6aa1 SOURCES/fwupd-2.1.6.tar.xz
-08f697c52e73a2b3005f4b4991465d574ab177b7 SOURCES/fwupd-efi-1.8.tar.gz
-a62a28924d26cd49b6441170795a237ba33ec192 SOURCES/libjcat-0.1.9.tar.xz
-4a07b56e28741884b86da6ac91f8f9929541a1e4 SOURCES/redhatsecureboot301.cer
-33e260486f5c12e47b72b90dfb779ca892f56c45 SOURCES/redhatsecureboot503.cer
-cf9230e69000076727e5b784ec871d22716dc5da SOURCES/redhatsecurebootca3.cer
-e6f506462069aa17d2e8610503635c20f3a995c3 SOURCES/redhatsecurebootca5.cer
+8430697c343d4cb67f7c80ab906b018c82ee2c71 SOURCES/1.7.tar.gz
+ba051e72126cffa054a9dca6f935c3d9d943dff5 SOURCES/40d3a4630619b83026f66bc64d97a582bbd9223ad53aa3f519ff5e2121d11ca6-DBXUpdate-20250507-x64.cab
+1ccb8ca216756718c1033b134f8f96ee38674a8a SOURCES/fwupd-1.9.31.tar.xz
+bd84b581906b4f5bf9ca86f31b0c1bc69a18135a SOURCES/fwupd-2.0.19.tar.xz

.gitignore

@@ -1,9 +1,4 @@
-SOURCES/9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab
-SOURCES/fwupd-1.7.8.tar.xz
-SOURCES/fwupd-2.1.6.tar.xz
-SOURCES/fwupd-efi-1.8.tar.gz
-SOURCES/libjcat-0.1.9.tar.xz
-SOURCES/redhatsecureboot301.cer
-SOURCES/redhatsecureboot503.cer
-SOURCES/redhatsecurebootca3.cer
-SOURCES/redhatsecurebootca5.cer
+SOURCES/1.7.tar.gz
+SOURCES/40d3a4630619b83026f66bc64d97a582bbd9223ad53aa3f519ff5e2121d11ca6-DBXUpdate-20250507-x64.cab
+SOURCES/fwupd-1.9.31.tar.xz
+SOURCES/fwupd-2.0.19.tar.xz

SOURCES/0001-Disable-the-UEFI-plugins-on-32bit-x86.patch

@@ -0,0 +1,31 @@
+From f14115c509eeadfc65dafb78e2f7b8718de29eff Mon Sep 17 00:00:00 2001
+From: Richard Hughes <richard@hughsie.com>
+Date: Mon, 12 Jan 2026 10:16:19 +0000
+Subject: [PATCH] Disable the UEFI plugins on 32bit x86
+
+Although UEFI on 32 bit i686 is certainly possible to support, the dbx update
+for IA32 has been downloaded only *once* by real users of fwupd, the other
+downloads all being by bots or people syncing the entire LVFS repo.
+
+There have been no KEKs uploaded for 32 bit-only targets, and all the platforms
+are seemlying EOL. I'm not even going to bother to upload the next dbx for IA32.
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 16cad5108..b0b610ad5 100644
+--- a/meson.build
++++ b/meson.build
+@@ -885,7 +885,7 @@ if dbusmock.returncode() != 0 and get_option('umockdev_tests').allowed()
+ endif
+ 
+ allow_uefi = host_machine.system() in ['linux', 'freebsd'] and \
+-  host_machine.cpu_family() in ['x86', 'x86_64', 'aarch64', 'riscv64', 'loongarch64']
++  host_machine.cpu_family() in ['x86_64', 'aarch64', 'riscv64', 'loongarch64']
+ 
+ subdir('generate-build')
+ subdir('libfwupd')
+-- 
+2.52.0
+

SOURCES/0001-Downgrade-deps-for-RHEL-8.patch

@@ -1,419 +0,0 @@
-From 8b662c7baa91279a4d770ee402c6169ce16cc121 Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Fri, 29 May 2026 13:58:07 +0100
-Subject: [PATCH] Downgrade deps for RHEL-8
-
----
- contrib/qubes/meson.build           |  6 ---
- data/meson.build                    |  4 +-
- docs/meson.build                    | 13 ------
- libfwupd/meson.build                |  2 +-
- libfwupdplugin/meson.build          |  2 +-
- libfwupdplugin/tests/meson.build    |  5 ---
- meson.build                         | 62 +++++++++++------------------
- meson_options.txt                   |  2 +-
- plugins/lenovo-thinklmi/meson.build |  2 +-
- plugins/modem-manager/meson.build   |  2 +-
- plugins/test/meson.build            |  4 +-
- src/meson.build                     |  4 +-
- 12 files changed, 33 insertions(+), 75 deletions(-)
-
-diff --git a/contrib/qubes/meson.build b/contrib/qubes/meson.build
-index 9b5385e15..689b462a2 100644
---- a/contrib/qubes/meson.build
-+++ b/contrib/qubes/meson.build
-@@ -45,9 +45,3 @@ install_data(
-   'test/logs/metainfo_version/firmware.metainfo.xml',
-   install_dir: 'share/qubes-fwupd/test/logs/metainfo_version',
- )
--
--install_symlink(
--  'qubes-fwupdmgr',
--  pointing_to: '/usr/share/qubes-fwupd/src/qubes_fwupdmgr.py',
--  install_dir: '/usr/sbin',
--)
-diff --git a/data/meson.build b/data/meson.build
-index 74a9104c3..70bf55908 100644
---- a/data/meson.build
-+++ b/data/meson.build
-@@ -122,7 +122,7 @@ if build_daemon
-       # for BLKSSZGET
-       device_allows += ['block-blkext']
-     endif
--    if get_option('plugin_modem_manager').allowed()
-+    if get_option('plugin_modem_manager').enabled()
-       device_allows += ['char-wwan_port']
-       device_allows += ['char-ttyUSB']
-     endif
-@@ -152,9 +152,7 @@ if build_daemon
-       'vmsplice',
-       'copy_file_range', # for g_file_copy
-     ]
--    dynamic_options += ['SystemCallFilter=' + ' '.join(syscall_filter)]
-     if supported_build
--      dynamic_options += ['Environment="FWUPD_SYSCALL_FILTER=systemd"']
-       dynamic_options += ['SystemCallErrorNumber=EPERM']
-     else
-       # to debug what additional syscalls are required, we set SystemCallErrorNumber=SIGSYS
-diff --git a/docs/meson.build b/docs/meson.build
-index 6adb57ecf..e8e46de22 100644
---- a/docs/meson.build
-+++ b/docs/meson.build
-@@ -301,17 +301,4 @@ if build_docs
-     install_tag: 'doc',
-     install_dir: join_paths(datadir, 'doc', 'libfwupdplugin'),
-   )
--  #make devhelp work
--  install_symlink(
--    'libfwupd',
--    install_tag: 'doc',
--    install_dir: join_paths(datadir, 'doc', 'fwupd'),
--    pointing_to: join_paths('..', 'libfwupd'),
--  )
--  install_symlink(
--    'libfwupdplugin',
--    install_tag: 'doc',
--    install_dir: join_paths(datadir, 'doc', 'fwupd'),
--    pointing_to: join_paths('..', 'libfwupdplugin'),
--  )
- endif
-diff --git a/libfwupd/meson.build b/libfwupd/meson.build
-index 37ecc43ac..a0038e92d 100644
---- a/libfwupd/meson.build
-+++ b/libfwupd/meson.build
-@@ -180,7 +180,7 @@ pkgg.generate(
-   description: 'fwupd is a system daemon for installing device firmware',
- )
- 
--if introspection.allowed()
-+if introspection.enabled()
-   fwupd_gir_deps = [giounix, libcurl]
-   fwupd_gir = gnome.generate_gir(
-     fwupd,
-diff --git a/libfwupdplugin/meson.build b/libfwupdplugin/meson.build
-index 277c49424..7931b8a27 100644
---- a/libfwupdplugin/meson.build
-+++ b/libfwupdplugin/meson.build
-@@ -441,7 +441,7 @@ fwupdplugin_rs_dep = declare_dependency(
- )
- 
- fwupdplugin_gir_includes = []
--if introspection.allowed()
-+if introspection.enabled()
-   gir_dep = declare_dependency(
-     sources: fwupd_gir
-   )
-diff --git a/libfwupdplugin/tests/meson.build b/libfwupdplugin/tests/meson.build
-index 8cea8d2eb..86c0f0d46 100644
---- a/libfwupdplugin/tests/meson.build
-+++ b/libfwupdplugin/tests/meson.build
-@@ -97,11 +97,6 @@ install_data(
-   ['quirks.d/tests.quirk'],
-   install_dir: join_paths(installed_test_datadir, 'tests/quirks.d'),
- )
--install_symlink(
--  'localtime',
--  install_dir: join_paths(installed_test_datadir, 'tests'),
--  pointing_to: join_paths('America', 'New_York'),
--)
- 
- install_data(
-   ['bios-attrs/dell-xps13-9310/dell-wmi-sysman/attributes/pending_reboot'],
-diff --git a/meson.build b/meson.build
-index 51c2148af..5c76a7bdf 100644
---- a/meson.build
-+++ b/meson.build
-@@ -3,8 +3,8 @@ project(
-   'c',
-   version: '2.1.6',
-   license: 'LGPL-2.1-or-later',
--  meson_version: '>=0.63.0', # limited by RHEL-9
--  default_options: ['warning_level=2', 'c_std=c17'],
-+  meson_version: '>=0.58.2', # limited by RHEL-8
-+  default_options: ['warning_level=2', 'c_std=c11'],
- )
- 
- fwupd_version = meson.project_version()
-@@ -253,16 +253,16 @@ localedir = join_paths(prefix, get_option('localedir'))
- diffcmd = find_program('diff')
- glib = dependency(
-   'glib-2.0',
--  version: '>= 2.68.0',
-+  version: '>= 2.56.1',
-   include_type: 'system',
- ) # limited by RHEL-9, which has v2.68.4
- gio = dependency(
-   'gio-2.0',
--  version: '>= 2.68.0',
-+  version: '>= 2.56.1',
- ) # limited by RHEL-9, which has v2.68.4
- giounix = dependency(
-   'gio-unix-2.0',
--  version: '>= 2.68.0',
-+  version: '>= 2.56.1',
-   required: false,
- )
- if giounix.found()
-@@ -276,20 +276,18 @@ if get_option('udev_hotplug')
-   conf.set('HAVE_UDEV_HOTPLUG' , '1')
- endif
- if build_standalone
--  bluez = get_option('bluez').disable_auto_if(host_machine.system() != 'linux')
--  if bluez.allowed()
-+  bluez = get_option('bluez')
-+  if bluez.enabled()
-     conf.set('HAVE_BLUEZ', '1')
-   endif
-   host_cpu = host_machine.cpu_family()
--  hsi = get_option('hsi').require(host_machine.system() == 'linux').require(
--    host_cpu in ['x86', 'x86_64']
--  ).allowed()
-+  hsi = get_option('hsi').enabled()
-   if hsi
-     conf.set('HAVE_HSI', '1')
-   endif
-   libxmlb = dependency(
-     'xmlb',
--    version: '>= 0.3.19',
-+    version: '>= 0.1.15',
-     fallback: ['libxmlb', 'libxmlb_dep'],
-   )
-   if libxmlb.get_variable('zstd') == 'true'
-@@ -340,7 +338,7 @@ if build_standalone
-     'readline',
-     required: get_option('readline'),
-   )
--  if readline.found() and get_option('readline').allowed()
-+  if readline.found() and get_option('readline').enabled()
-     conf.set('HAVE_READLINE', '1')
-   endif
-   sqlite = dependency('sqlite3')
-@@ -351,7 +349,6 @@ if build_standalone
-     'passim',
-     version: '>= 0.1.6',
-     required: get_option('passim'),
--    fallback: ['passim', 'passim_dep'],
-   )
-   if passim.found()
-     conf.set('HAVE_PASSIM', '1')
-@@ -370,7 +367,7 @@ valgrind = dependency(
- )
- libcurl = dependency(
-   'libcurl',
--  version: '>= 7.62.0',
-+  version: '>= 7.61.1', # RHEL 8
- )
- libdrm = dependency(
-   'libdrm',
-@@ -380,7 +377,7 @@ if libdrm.found()
-   conf.set('HAVE_LIBDRM' , '1')
- endif
- polkit = dependency('polkit-gobject-1', version: '>= 0.103',
--         required: get_option('polkit').disable_auto_if(host_machine.system() != 'linux'))
-+         required: get_option('polkit'))
- if polkit.found()
-   conf.set('HAVE_POLKIT', '1')
-   if polkit.version().version_compare('>= 0.114')
-@@ -494,7 +491,7 @@ endif
- 
- libsystemd = dependency(
-   'libsystemd',
--  required: get_option('systemd').disable_auto_if(host_machine.system() != 'linux'),
-+  required: get_option('systemd'),
- )
- 
- if cc.has_header('sys/auxv.h')
-@@ -664,8 +661,8 @@ if build_standalone
- endif
- 
- logind = dependency(
--  'systemd', 'libelogind',
--  required: get_option('logind').disable_auto_if(host_machine.system() != 'linux'),
-+  'systemd',
-+  required: get_option('logind'),
- )
- 
- if logind.found()
-@@ -674,7 +671,7 @@ endif
- if libsystemd.found()
-   systemd = dependency(
-     'systemd',
--    version: '>= 249',
-+    version: '>= 239', # RHEL 8
-     required: get_option('systemd'),
-   )
-   conf.set('HAVE_SYSTEMD' , '1')
-@@ -712,7 +709,7 @@ if libsystemd.found()
-   endif
- endif
- 
--supported_build = get_option('supported_build').disable_auto_if(not tag).allowed()
-+supported_build = get_option('supported_build')
- if supported_build
-   conf.set('SUPPORTED_BUILD', '1')
- endif
-@@ -775,9 +772,7 @@ gobject_introspection_dep = dependency(
-   'gobject-introspection-1.0',
-   required: get_option('introspection'),
- )
--introspection = get_option('introspection').disable_auto_if(host_machine.system() != 'linux').disable_auto_if(
--  not gobject_introspection_dep.found()
--)
-+introspection = get_option('introspection')
- 
- gidocgen_dep = dependency(
-   'gi-docgen',
-@@ -790,17 +785,14 @@ gidocgen_app = find_program(
-   'gi-docgen',
-   required: gidocgen_dep.found(),
- )
--build_docs = gidocgen_dep.found() and gidocgen_app.found() and introspection.allowed()
-+build_docs = gidocgen_dep.found() and gidocgen_app.found() and introspection.enabled()
- 
- if build_docs and gidocgen_dep.version().version_compare('< 2022.2')
-   markdown_version = run_command(
-     [python3, '-c', 'import markdown; print(markdown.__version__)'],
-     check: true,
-   ).stdout().strip()
--  build_docs = get_option('docs').require(
--    markdown_version.version_compare('>=3.2'),
--    error_message: 'docs=enabled requires at least markdown >= 3.2',
--  ).allowed()
-+  build_docs = get_option('docs').enabled()
- endif
- 
- jinja2 = run_command(
-@@ -823,14 +815,12 @@ endif
- rustgen = generator(
-   python3,
-   output: ['@BASENAME@-struct.c', '@BASENAME@-struct.h'],
--  depfile: '@BASENAME@.deps',
-   arguments: [
-     join_paths(meson.project_source_root(), 'libfwupdplugin', 'rustgen.py'),
-     '--use', 'fwupd:@0@'.format(join_paths(meson.project_source_root(), 'libfwupdplugin')),
-     '@INPUT@',
-     '--outc', '@OUTPUT0@',
-     '--outh', '@OUTPUT1@',
--    '--depfile', '@DEPFILE@',
-     '--include',
-     'fwupdplugin.h',
-     '--prefix',
-@@ -844,13 +834,7 @@ dbusmock = run_command(
- )
- umockdev = dependency(
-   'umockdev-1.0',
--  required: get_option('umockdev_tests').require(dbusmock.returncode() == 0).require(
--    get_option('tests')
--  ).disable_auto_if(
--    not introspection.allowed()
--  ).disable_auto_if(
--    not run_sanitize_unsafe_tests
--  ),
-+  required: get_option('umockdev_tests')
- )
- 
- allow_uefi = host_machine.system() in ['linux', 'freebsd'] and \
-@@ -919,7 +903,7 @@ summary(
-     'vendor_ids_dir': vendor_ids_dir,
-     'docs': build_docs,
-     'gnutls': gnutls,
--    'introspection': introspection.allowed(),
-+    'introspection': introspection.enabled(),
-     'libblkid': libblkid,
-     'libdrm': libdrm,
-     'logind': logind,
-@@ -938,7 +922,7 @@ summary(
- if build_daemon
-   summary(
-     {
--      'bluez': bluez.allowed(),
-+      'bluez': bluez.enabled(),
-       'libusb': libusb,
-       'hsi': hsi,
-       'lvfs_metadata_format': lvfs_metadata_format,
-diff --git a/meson_options.txt b/meson_options.txt
-index 8f5a27620..196822f66 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -178,7 +178,7 @@ option(
- )
- option(
-   'supported_build',
--  type: 'feature',
-+  type: 'boolean',
-   description: 'distribution package with upstream support',
- )
- option(
-diff --git a/plugins/lenovo-thinklmi/meson.build b/plugins/lenovo-thinklmi/meson.build
-index b5218d4ea..9876a2268 100644
---- a/plugins/lenovo-thinklmi/meson.build
-+++ b/plugins/lenovo-thinklmi/meson.build
-@@ -16,7 +16,7 @@ plugin_builtin_lenovo_thinklmi = static_library('fu_plugin_lenovo_thinklmi',
- )
- plugin_builtins += plugin_builtin_lenovo_thinklmi
- 
--if get_option('tests')
-+if get_option('tests') and false
-   env = environment()
-   env.set('G_TEST_SRCDIR', meson.current_source_dir())
-   env.set('G_TEST_BUILDDIR', meson.current_build_dir())
-diff --git a/plugins/modem-manager/meson.build b/plugins/modem-manager/meson.build
-index 0cc7d51ed..4762b16bb 100644
---- a/plugins/modem-manager/meson.build
-+++ b/plugins/modem-manager/meson.build
-@@ -5,7 +5,7 @@ libmbim_glib = dependency('mbim-glib', version: '>= 1.28.0', required: get_optio
- libmm_glib.found() or subdir_done()
- libqmi_glib.found() or subdir_done()
- libmbim_glib.found() or subdir_done()
--get_option('plugin_modem_manager').allowed() or subdir_done()
-+get_option('plugin_modem_manager').enabled() or subdir_done()
- 
- cargs = ['-DG_LOG_DOMAIN="FuPluginMm"']
- cargs +=['-DMM_REQUIRED_VERSION="1.10.0"']
-diff --git a/plugins/test/meson.build b/plugins/test/meson.build
-index b9cf1c9a0..865ad24ff 100644
---- a/plugins/test/meson.build
-+++ b/plugins/test/meson.build
-@@ -1,7 +1,7 @@
- cargs = ['-DG_LOG_DOMAIN="FuPluginTest"']
- plugins += {meson.current_source_dir().split('/')[-1]: true}
- 
--if bluez.allowed()
-+if bluez.enabled()
-   plugin_quirks += files('test-ble.quirk')
- endif
- 
-@@ -16,7 +16,7 @@ plugin_builtins += static_library('fu_plugin_test',
-   dependencies: plugin_deps,
- )
- 
--if bluez.allowed()
-+if bluez.enabled()
- plugin_builtins += static_library('fu_plugin_test_ble',
-   sources: [
-     'fu-test-ble-plugin.c',
-diff --git a/src/meson.build b/src/meson.build
-index 6f149e243..6b65d18f5 100644
---- a/src/meson.build
-+++ b/src/meson.build
-@@ -15,7 +15,7 @@ engine_dep = [
-   fwupdplugin_rs_dep,
- ]
- 
--if get_option('passim').allowed()
-+if get_option('passim').enabled()
-   engine_dep += passim
- endif
- 
-@@ -72,7 +72,7 @@ endif
- if host_machine.system() in ['linux', 'android']
-   fwupd_engine_src += 'fu-udev-backend.c'
- endif
--if bluez.allowed()
-+if bluez.enabled()
-   fwupd_engine_src += 'fu-bluez-backend.c'
- endif
- 
--- 
-2.55.0
-

SOURCES/0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch

@@ -1,209 +0,0 @@
-From 2ed98c7c2e0ac77b9967933af51615385f7e471d Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Thu, 2 Jul 2026 14:47:33 +0100
-Subject: [PATCH] Fix the seal self tests when building on a tmpfs
-
-When fwupd is exploded onto a tmpfs the assumption of 'is a local file *not* a
-memfd' breaks. When fwupd is built using rpmbuild we do not control the
-buildroot filesystem, so make the 'is a sealed fd required' check more explicit.
----
- src/fu-dbus-daemon.c                     |  3 +
- src/fu-engine.c                          |  6 ++
- src/fu-unix-seekable-input-stream-test.c | 17 +++++-
- src/fu-unix-seekable-input-stream.c      | 70 ++++++++++++++++--------
- src/fu-unix-seekable-input-stream.h      |  2 +
- 5 files changed, 73 insertions(+), 25 deletions(-)
-
-diff --git a/src/fu-dbus-daemon.c b/src/fu-dbus-daemon.c
-index 72cc36fad..de8aa9a26 100644
---- a/src/fu-dbus-daemon.c
-+++ b/src/fu-dbus-daemon.c
-@@ -1158,6 +1158,9 @@ fu_dbus_daemon_invocation_get_input_stream(GDBusMethodInvocation *invocation, GE
- 	stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, error);
- 	if (stream == NULL)
- 		return NULL;
-+	if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
-+							error))
-+		return NULL;
- 	return g_steal_pointer(&stream);
- #else
- 	g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INTERNAL, "unsupported feature");
-diff --git a/src/fu-engine.c b/src/fu-engine.c
-index 9eaed95ab..5820ea891 100644
---- a/src/fu-engine.c
-+++ b/src/fu-engine.c
-@@ -5069,9 +5069,15 @@ fu_engine_update_metadata(FuEngine *self,
- 	stream_fd = fu_unix_seekable_input_stream_new(fd, TRUE, error);
- 	if (stream_fd == NULL)
- 		return FALSE;
-+	if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream_fd),
-+							error))
-+		return FALSE;
- 	stream_sig = fu_unix_seekable_input_stream_new(fd_sig, TRUE, error);
- 	if (stream_sig == NULL)
- 		return FALSE;
-+	if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream_sig),
-+							error))
-+		return FALSE;
- 
- 	/* read the entire file into memory */
- 	bytes_raw =
-diff --git a/src/fu-unix-seekable-input-stream-test.c b/src/fu-unix-seekable-input-stream-test.c
-index d65b70add..3b5e8d8ec 100644
---- a/src/fu-unix-seekable-input-stream-test.c
-+++ b/src/fu-unix-seekable-input-stream-test.c
-@@ -84,6 +84,7 @@ static void
- fu_unix_seekable_input_stream_sealed_memfd_func(void)
- {
- #if defined(HAVE_GIO_UNIX) && defined(HAVE_MEMFD_CREATE)
-+	gboolean ret;
- 	g_autofd gint fd = -1;
- 	g_autoptr(GError) error = NULL;
- 	g_autoptr(GInputStream) stream = NULL;
-@@ -93,11 +94,18 @@ fu_unix_seekable_input_stream_sealed_memfd_func(void)
- 	g_assert_cmpint(fd, >=, 0);
- 	g_assert_cmpint(write(fd, data, sizeof(data)), ==, sizeof(data));
- 	g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0);
--	g_assert_cmpint(fcntl(fd, F_ADD_SEALS, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW), ==, 0);
-+	g_assert_cmpint(
-+	    fcntl(fd, F_ADD_SEALS, F_SEAL_SEAL | F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW),
-+	    ==,
-+	    0);
- 
- 	stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, &error);
- 	g_assert_no_error(error);
- 	g_assert_nonnull(stream);
-+	ret = fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
-+							 &error);
-+	g_assert_no_error(error);
-+	g_assert_true(ret);
- #else
- 	g_test_skip("No gio-unix-2.0 or memfd_create support, skipping");
- #endif
-@@ -107,6 +115,7 @@ static void
- fu_unix_seekable_input_stream_unsealed_memfd_func(void)
- {
- #if defined(HAVE_GIO_UNIX) && defined(HAVE_MEMFD_CREATE)
-+	gboolean ret;
- 	g_autofd gint fd = -1;
- 	g_autoptr(GError) error = NULL;
- 	g_autoptr(GInputStream) stream = NULL;
-@@ -118,8 +127,12 @@ fu_unix_seekable_input_stream_unsealed_memfd_func(void)
- 	g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0);
- 
- 	stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, &error);
-+	g_assert_no_error(error);
-+	g_assert_nonnull(stream);
-+	ret = fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
-+							 &error);
- 	g_assert_error(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE);
--	g_assert_null(stream);
-+	g_assert_false(ret);
- #else
- 	g_test_skip("No gio-unix-2.0 or memfd_create support, skipping");
- #endif
-diff --git a/src/fu-unix-seekable-input-stream.c b/src/fu-unix-seekable-input-stream.c
-index 4955c366c..591173812 100644
---- a/src/fu-unix-seekable-input-stream.c
-+++ b/src/fu-unix-seekable-input-stream.c
-@@ -116,25 +116,6 @@ fu_unix_seekable_input_stream_seekable_iface_init(GSeekableIface *iface)
- 	iface->truncate_fn = fu_unix_seekable_input_stream_truncate;
- }
- 
--static gboolean
--fu_unix_seekable_input_stream_verify_sealed(gint fd, GError **error)
--{
--#ifdef HAVE_MEMFD_CREATE
--	gint seals = fcntl(fd, F_GET_SEALS);
--	if (seals >= 0 && (seals & (F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW)) !=
--			      (F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW)) {
--		g_set_error(error,
--			    FWUPD_ERROR,
--			    FWUPD_ERROR_INVALID_FILE,
--			    "fd is missing required seals, got 0x%x",
--			    (guint)seals);
--		return FALSE;
--	}
--#endif
--	/* success */
--	return TRUE;
--}
--
- /**
-  * fu_unix_seekable_input_stream_new:
-  * @fd: a UNIX file descriptor
-@@ -177,14 +158,57 @@ fu_unix_seekable_input_stream_new(gint fd, gboolean close_fd, GError **error)
- 		return NULL;
- 	}
- 
--	/* if the fd supports sealing (i.e. is a memfd) then require immutability */
--	if (!fu_unix_seekable_input_stream_verify_sealed(fd, error))
--		return NULL;
--
- 	/* success */
- 	return g_steal_pointer(&stream);
- }
- 
-+/**
-+ * fu_unix_seekable_input_stream_require_seal:
-+ * @stream: a #FuUnixSeekableInputStream
-+ * @error: (nullable): optional return location for an error
-+ *
-+ * Enforces that the file descriptor backing this stream is a memfd with the required seals set.
-+ *
-+ * Returns: %TRUE if sealed
-+ *
-+ * Since: 2.1.7
-+ **/
-+gboolean
-+fu_unix_seekable_input_stream_require_seal(FuUnixSeekableInputStream *stream, GError **error)
-+{
-+#ifdef HAVE_MEMFD_CREATE
-+	gint fd;
-+	gint seals;
-+
-+	g_return_val_if_fail(FU_IS_UNIX_SEEKABLE_INPUT_STREAM(stream), FALSE);
-+	g_return_val_if_fail(error == NULL || *error == NULL, FALSE);
-+
-+	fd = g_unix_input_stream_get_fd(G_UNIX_INPUT_STREAM(stream));
-+	seals = fcntl(fd, F_GET_SEALS);
-+	if (seals < 0) {
-+		/* not supported on this fd */
-+		return TRUE;
-+	}
-+	if ((seals & F_SEAL_SEAL) == 0) {
-+		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "fd not sealed");
-+		return FALSE;
-+	}
-+	if ((seals & F_SEAL_WRITE) == 0) {
-+		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no WRITE seal");
-+		return FALSE;
-+	}
-+	if ((seals & F_SEAL_SHRINK) == 0) {
-+		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no SHRINK seal");
-+		return FALSE;
-+	}
-+	if ((seals & F_SEAL_GROW) == 0) {
-+		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no GROW seal");
-+		return FALSE;
-+	}
-+#endif
-+	return TRUE;
-+}
-+
- static void
- fu_unix_seekable_input_stream_class_init(FuUnixSeekableInputStreamClass *klass)
- {
-diff --git a/src/fu-unix-seekable-input-stream.h b/src/fu-unix-seekable-input-stream.h
-index 5f0a0656a..6d7b2acde 100644
---- a/src/fu-unix-seekable-input-stream.h
-+++ b/src/fu-unix-seekable-input-stream.h
-@@ -18,3 +18,5 @@ G_DECLARE_FINAL_TYPE(FuUnixSeekableInputStream,
- 
- GInputStream *
- fu_unix_seekable_input_stream_new(gint fd, gboolean close_fd, GError **error);
-+gboolean
-+fu_unix_seekable_input_stream_require_seal(FuUnixSeekableInputStream *stream, GError **error);
--- 
-2.54.0
-

SOURCES/0001-Revert-Require-gnu-efi-3.0.18-or-later.patch

@@ -0,0 +1,45 @@
+From 856cde012b6ee114b8ce44e090651adbc6c6ddf8 Mon Sep 17 00:00:00 2001
+From: Richard Hughes <richard@hughsie.com>
+Date: Mon, 12 Jan 2026 12:07:40 +0000
+Subject: [PATCH] Revert "Require gnu-efi 3.0.18 or later"
+
+This reverts commit 26c6ec5c1e7765fb5dc6a4df511ab21ee6c6e67a.
+---
+ efi/meson.build | 6 ++++++
+ meson.build     | 3 ++-
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/efi/meson.build b/efi/meson.build
+index a034bc2..af4bfa3 100644
+--- a/efi/meson.build
++++ b/efi/meson.build
+@@ -45,6 +45,12 @@ if efi_libdir == ''
+   endif
+ endif
+ 
++have_gnu_efi = gnu_efi_path_arch != '' and efi_libdir != ''
++
++if not have_gnu_efi and not gnuefi.found()
++  error('gnu-efi headers were not found')
++endif
++
+ # The name we need to look for on this arch and OS: elf_x86_64_fbsd_efi.lds
+ lds_os = ''
+ if host_cpu == 'x86_64' and host_machine.system() == 'freebsd'
+diff --git a/meson.build b/meson.build
+index d632aaa..7052105 100644
+--- a/meson.build
++++ b/meson.build
+@@ -13,7 +13,8 @@ cc_ld = find_program(cc.get_linker_id())
+ objcopy = find_program('objcopy')
+ objcopy_version = run_command(objcopy, '--version', check: true).stdout().split('\n')[0].split(' ')[-1]
+ 
+-gnuefi = dependency('gnu-efi', version: '>= 3.0.18')
++# pkgconfig introduced in 3.0.18, allows compiling against older
++gnuefi = dependency('gnu-efi', required: false)
+ prefix = get_option('prefix')
+ libdir = join_paths(prefix, get_option('libdir'))
+ libexecdir = join_paths(prefix, get_option('libexecdir'))
+-- 
+2.52.0
+

SOURCES/0001-Revert-trivial-Remove-some-dead-JCat-compat-code.patch

@@ -0,0 +1,118 @@
+From 8c5c3fe46c4a10eafd8a11f888216f61448121f3 Mon Sep 17 00:00:00 2001
+From: Richard Hughes <richard@hughsie.com>
+Date: Fri, 9 Jan 2026 16:36:24 +0000
+Subject: [PATCH] Revert "trivial: Remove some dead JCat compat code"
+
+This reverts commit b3cd790875065fdda7b8bf7328c325af8ce30a52 so we can build
+on RHEL 9 without also upreving libjcat.
+
+(cherry picked from commit 4f6726f410cedcae7707366d89ef36f9d370950b)
+---
+ meson.build      |  2 +-
+ src/fu-cabinet.c | 12 +++++++++++-
+ src/fu-engine.c  |  9 +++++++++
+ 3 files changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 5726be646..1766ce8b6 100644
+--- a/meson.build
++++ b/meson.build
+@@ -360,7 +360,7 @@ if build_standalone
+ endif
+ libjcat = dependency(
+   'jcat',
+-  version: '>= 0.2.0',
++  version: '>= 0.1.6',
+   fallback: ['libjcat', 'libjcat_dep'],
+ )
+ libjsonglib = dependency(
+diff --git a/src/fu-cabinet.c b/src/fu-cabinet.c
+index dabc1eb6d..28b91b450 100644
+--- a/src/fu-cabinet.c
++++ b/src/fu-cabinet.c
+@@ -12,6 +12,11 @@
+ 
+ #include "fu-cabinet.h"
+ 
++/* fixed in 0.1.14 */
++#ifndef JCAT_CHECK_VERSION
++#define JCAT_CHECK_VERSION LIBJCAT_CHECK_VERSION
++#endif
++
+ /**
+  * FuCabinet:
+  *
+@@ -225,6 +230,7 @@ fu_cabinet_parse_release(FuCabinet *self,
+ 
+ 	/* the jcat file signed the *checksum of the payload*, not the payload itself */
+ 	item = jcat_file_get_item_by_id(self->jcat_file, basename, NULL);
++#if JCAT_CHECK_VERSION(0, 2, 0)
+ 	if (item != NULL && jcat_item_has_target(item)) {
+ 		g_autofree gchar *checksum_sha256 = NULL;
+ 		g_autofree gchar *checksum_sha512 = NULL;
+@@ -265,7 +271,9 @@ fu_cabinet_parse_release(FuCabinet *self,
+ 			g_info("verified indirect payload %s: %u", basename, results->len);
+ 			release_flags |= FWUPD_RELEASE_FLAG_TRUSTED_PAYLOAD;
+ 		}
+-	} else if (item != NULL) {
++	}
++#endif
++	if (item != NULL) {
+ 		g_autoptr(GBytes) blob = NULL;
+ 		g_autoptr(GError) error_local = NULL;
+ 		g_autoptr(GPtrArray) results = NULL;
+@@ -1079,10 +1087,12 @@ fu_cabinet_init(FuCabinet *self)
+ 	self->builder = xb_builder_new();
+ 	self->jcat_file = jcat_file_new();
+ 	self->jcat_context = jcat_context_new();
++#if JCAT_CHECK_VERSION(0, 1, 13)
+ 	jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_SHA256);
+ 	jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_SHA512);
+ 	jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_PKCS7);
+ 	jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_GPG);
++#endif
+ }
+ 
+ static void
+diff --git a/src/fu-engine.c b/src/fu-engine.c
+index 498b6ebf8..9f2df208d 100644
+--- a/src/fu-engine.c
++++ b/src/fu-engine.c
+@@ -76,6 +76,11 @@
+ /* only needed until we hard depend on jcat 0.1.3 */
+ #include <libjcat/jcat-version.h>
+ 
++/* fixed in 0.1.14 */
++#ifndef JCAT_CHECK_VERSION
++#define JCAT_CHECK_VERSION LIBJCAT_CHECK_VERSION
++#endif
++
+ #ifdef HAVE_SYSTEMD
+ #include "fu-systemd.h"
+ #endif
+@@ -9336,10 +9341,12 @@ fu_engine_constructed(GObject *obj)
+ 
+ 	/* setup Jcat context */
+ 	self->jcat_context = jcat_context_new();
++#if JCAT_CHECK_VERSION(0, 1, 13)
+ 	jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_SHA256);
+ 	jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_SHA512);
+ 	jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_PKCS7);
+ 	jcat_context_blob_kind_allow(self->jcat_context, JCAT_BLOB_KIND_GPG);
++#endif
+ 	keyring_path = fu_path_from_kind(FU_PATH_KIND_LOCALSTATEDIR_PKG);
+ 	jcat_context_set_keyring_path(self->jcat_context, keyring_path);
+ 	pkidir_fw = fu_path_build(FU_PATH_KIND_SYSCONFDIR, "pki", "fwupd", NULL);
+@@ -9349,7 +9356,9 @@ fu_engine_constructed(GObject *obj)
+ 
+ 	/* add some runtime versions of things the daemon depends on */
+ 	fu_engine_add_runtime_version(self, "org.freedesktop.fwupd", VERSION);
++#if JCAT_CHECK_VERSION(0, 1, 11)
+ 	fu_engine_add_runtime_version(self, "com.hughsie.libjcat", jcat_version_string());
++#endif
+ 	fu_engine_add_runtime_version(self, "com.hughsie.libxmlb", xb_version_string());
+ 
+ 	/* optional kernel version */
+-- 
+2.52.0
+

SOURCES/0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch

@@ -1,42 +0,0 @@
-From f7352aa9e2157a5ed88d10278ef420a78c8a52f8 Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Thu, 2 Jul 2026 16:16:28 +0100
-Subject: [PATCH] Seal memfds for compatibility with newer fwupd daemons
-
----
- libfwupd/fwupd-common.c | 12 +++++++++++-
- 1 file changed, 11 insertions(+), 1 deletion(-)
-
-diff --git a/libfwupd/fwupd-common.c b/libfwupd/fwupd-common.c
-index 3220c40a7..862210c8a 100644
---- a/libfwupd/fwupd-common.c
-+++ b/libfwupd/fwupd-common.c
-@@ -1054,7 +1054,7 @@ fwupd_unix_input_stream_from_bytes(GBytes *bytes, GError **error)
- #endif
- 
- #ifdef HAVE_MEMFD_CREATE
--	fd = memfd_create("fwupd", MFD_CLOEXEC);
-+	fd = memfd_create("fwupd", MFD_CLOEXEC | MFD_ALLOW_SEALING);
- #else
- 	/* emulate in-memory file by an unlinked temporary file */
- 	fd = g_mkstemp(tmp_file);
-@@ -1098,6 +1098,16 @@ fwupd_unix_input_stream_from_bytes(GBytes *bytes, GError **error)
- 			    g_strerror(errno));
- 		return NULL;
- 	}
-+#ifdef HAVE_MEMFD_CREATE
-+	if (fcntl(fd, F_ADD_SEALS, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_SEAL) < 0) {
-+		g_set_error(error,
-+			    FWUPD_ERROR,
-+			    FWUPD_ERROR_INVALID_FILE,
-+			    "failed to seal memfd: %s",
-+			    strerror(errno));
-+		return NULL;
-+	}
-+#endif
- 	return G_UNIX_INPUT_STREAM(g_unix_input_stream_new(fd, TRUE));
- }
- 
--- 
-2.54.0
-

SOURCES/0001-trivial-Do-not-binary-compare-the-zlib-compressed-zi.patch

@@ -1,27 +0,0 @@
-From d5f4c2fb3c3d7936d9ada1e16f0172674720192b Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 7 Jul 2026 17:26:23 +0100
-Subject: [PATCH] trivial: Do not binary-compare the zlib-compressed zip file
-
-On s390x we get a valid hardware-accelerated zlib bitstream, but it's different
-from the libz software version.
----
- libfwupdplugin/fu-firmware-test.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libfwupdplugin/fu-firmware-test.c b/libfwupdplugin/fu-firmware-test.c
-index b53005705..d9656bfa8 100644
---- a/libfwupdplugin/fu-firmware-test.c
-+++ b/libfwupdplugin/fu-firmware-test.c
-@@ -1176,7 +1176,7 @@ fu_firmware_builder_round_trip_func(void)
- 	    },
- 	    {
- 		"zip-compressed.builder.xml",
--		"10792ff01b036ed89d11a6480694ccfd89c4d9fd",
-+		NULL, /* not byte-identical */
- 		FU_FIRMWARE_BUILDER_FLAG_NONE,
- 	    },
- 	};
--- 
-2.55.0
-

SOURCES/0001-trivial-Lower-supported-meson-version.patch

@@ -1,26 +0,0 @@
-From 998fb28785a2d059dd53c0dec71b56bcf16f116f Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 7 Jul 2026 16:06:12 +0100
-Subject: [PATCH 1/3] trivial: Lower supported meson version
-
-We don't actually need any newer version...
----
- meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/meson.build b/meson.build
-index 0652f48..eefadbe 100644
---- a/meson.build
-+++ b/meson.build
-@@ -1,7 +1,7 @@
- project('fwupd-efi', 'c',
-   version : '1.8',
-   license : 'LGPL-2.1+',
--  meson_version : '>=0.62.0',
-+  meson_version : '>=0.58.2',
-   default_options : ['warning_level=2', 'c_std=c99'],
- )
- 
--- 
-2.55.0
-

SOURCES/0002-Allow-skipping-setting-NX-dll-characteristics.patch

@@ -1,25 +0,0 @@
-From 86090bb11b7799a38e6ec1376d526dfcb8bdb669 Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 7 Jul 2026 16:07:04 +0100
-Subject: [PATCH 2/3] Allow skipping setting NX dll characteristics
-
----
- efi/generate_binary.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/efi/generate_binary.py b/efi/generate_binary.py
-index 3f76c24..8370f21 100755
---- a/efi/generate_binary.py
-+++ b/efi/generate_binary.py
-@@ -72,7 +72,7 @@ def _add_nx_pefile(args):
-         import pefile
-     except ImportError:
-         print("Unable to add NX support to binaries without genpeimg or python3-pefile")
--        sys.exit(1)
-+        return
- 
-     pe = pefile.PE(args.outfile)
-     pe.OPTIONAL_HEADER.DllCharacteristics |= pefile.DLL_CHARACTERISTICS[
--- 
-2.55.0
-

SOURCES/0003-trivial-Lower-required-version-of-gnu-efi.patch

@@ -1,25 +0,0 @@
-From 23f3ca09e49bcb4d71c47014819540de6e3df8af Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 7 Jul 2026 16:08:06 +0100
-Subject: [PATCH 3/3] trivial: Lower required version of gnu-efi
-
----
- meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/meson.build b/meson.build
-index eefadbe..4035cf8 100644
---- a/meson.build
-+++ b/meson.build
-@@ -13,7 +13,7 @@ cc_ld = find_program(cc.get_linker_id())
- objcopy = find_program('objcopy')
- objcopy_version = run_command(objcopy, '--version', check: true).stdout().split('\n')[0].split(' ')[-1]
- 
--gnuefi = dependency('gnu-efi', version: '>= 3.0.18')
-+gnuefi = dependency('gnu-efi', required: false)
- prefix = get_option('prefix')
- libdir = join_paths(prefix, get_option('libdir'))
- libexecdir = join_paths(prefix, get_option('libexecdir'))
--- 
-2.55.0
-