.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1,10 +1,146 @@
-SOURCES/DBXUpdate-20100307-x64.cab
-SOURCES/DBXUpdate-20140413-x64.cab
-SOURCES/DBXUpdate-20160809-x64.cab
-SOURCES/DBXUpdate-20200729-aa64.cab
-SOURCES/DBXUpdate-20200729-ia32.cab
-SOURCES/DBXUpdate-20200729-x64.cab
-SOURCES/almalinuxsecurebootca0.cer
-SOURCES/fwupd-1.7.8.tar.xz
-SOURCES/fwupd-efi-1.3.tar.xz
-SOURCES/libjcat-0.1.9.tar.xz
+/fwupd-0.1.0.tar.xz
+/fwupd-0.1.1.tar.xz
+/fwupd-0.1.2.tar.xz
+/fwupd-0.1.3.tar.xz
+/fwupd-0.1.4.tar.xz
+/fwupd-0.1.5.tar.xz
+/fwupd-0.1.6.tar.xz
+/fwupd-0.5.0.tar.xz
+/fwupd-0.5.1.tar.xz
+/fwupd-0.5.2.tar.xz
+/fwupd-0.5.3.tar.xz
+/fwupd-0.5.4.tar.xz
+/fwupd-0.6.0.tar.xz
+/fwupd-0.6.1.tar.xz
+/fwupd-0.6.2.tar.xz
+/fwupd-0.6.3.tar.xz
+/fwupd-0.7.0.tar.xz
+/fwupd-0.7.1.tar.xz
+/fwupd-0.7.2.tar.xz
+/fwupd-0.7.3.tar.xz
+/fwupd-0.7.4.tar.xz
+/fwupd-0.7.5.tar.xz
+/fwupd-0.8.0.tar.xz
+/fwupd-0.8.1.tar.xz
+/fwupd-0.8.2.tar.xz
+/fwupd-0.9.2.tar.xz
+/fwupd-0.9.3.tar.xz
+/fwupd-0.9.4.tar.xz
+/fwupd-0.9.5.tar.xz
+/fwupd-0.9.6.tar.xz
+/fwupd-0.9.7.tar.xz
+/fwupd-1.0.0.tar.xz
+/fwupd-1.0.1.tar.xz
+/fwupd-1.0.2.tar.xz
+/fwupd-1.0.3.tar.xz
+/fwupd-1.0.4.tar.xz
+/fwupd-1.0.5.tar.xz
+/fwupd-1.0.6.tar.xz
+/fwupd-1.0.7.tar.xz
+/fwupd-1.0.8.tar.xz
+/fwupd-1.1.0.tar.xz
+/fwupd-1.1.1.tar.xz
+/fwupd-1.1.2.tar.xz
+/fwupd-1.1.3.tar.xz
+/fwupd-1.2.0.tar.xz
+/fwupd-1.2.1.tar.xz
+/fwupd-1.2.2.tar.xz
+/fwupd-1.2.3.tar.xz
+/fwupd-1.2.4.tar.xz
+/fwupd-1.2.5.tar.xz
+/fwupd-1.2.6.tar.xz
+/fwupd-1.2.7.tar.xz
+/fwupd-1.2.8.tar.xz
+/fwupd-1.2.9.tar.xz
+/fwupd-1.2.10.tar.xz
+/fwupd-1.3.2.tar.xz
+/fwupd-1.3.3.tar.xz
+/fwupd-1.3.4.tar.xz
+/fwupd-1.3.5.tar.xz
+/fwupd-1.3.6.tar.xz
+/fwupd-1.3.7.tar.xz
+/fwupd-1.3.8.tar.xz
+/fwupd-1.3.9.tar.xz
+/fwupd-1.4.0.tar.xz
+/fwupd-1.4.1.tar.xz
+/fwupd-1.4.2.tar.xz
+/fwupd-1.4.3.tar.xz
+/fwupd-1.4.4.tar.xz
+/fwupd-1.4.5.tar.xz
+/fwupd-1.4.6.tar.xz
+/fwupd-1.5.0.tar.xz
+/fwupd-1.5.1.tar.xz
+/fwupd-1.5.2.tar.xz
+/fwupd-1.5.3.tar.xz
+/fwupd-1.5.4.tar.xz
+/fwupd-1.5.5.tar.xz
+/fwupd-1.5.6.tar.xz
+/fwupd-1.5.7.tar.xz
+/fwupd-1.5.8.tar.xz
+/fwupd-1.5.9.tar.xz
+/fwupd-1.6.0.tar.xz
+/fwupd-1.6.1.tar.xz
+/fwupd-1.6.2.tar.xz
+/fwupd-1.6.3.tar.xz
+/fwupd-1.6.4.tar.xz
+/fwupd-1.7.0.tar.xz
+/fwupd-1.7.1.tar.xz
+/fwupd-1.7.2.tar.xz
+/fwupd-1.7.3.tar.xz
+/fwupd-1.7.4.tar.xz
+/fwupd-1.7.5.tar.xz
+/fwupd-1.7.6.tar.xz
+/fwupd-1.7.7.tar.xz
+/fwupd-1.8.0.tar.xz
+/fwupd-1.8.1.tar.xz
+/fwupd-1.8.2.tar.xz
+/fwupd-1.8.3.tar.xz
+/fwupd-1.8.4.tar.xz
+/fwupd-1.8.5.tar.xz
+/fwupd-1.8.6.tar.xz
+/fwupd-1.8.7.tar.xz
+/fwupd-1.8.8.tar.xz
+/fwupd-1.8.9.tar.xz
+/fwupd-1.8.10.tar.xz
+/fwupd-1.8.11.tar.xz
+/fwupd-1.8.12.tar.xz
+/fwupd-1.8.13.tar.xz
+/fwupd-1.8.14.tar.xz
+/fwupd-1.8.15.tar.xz
+/fwupd-1.9.1.tar.xz
+/fwupd-1.9.2.tar.xz
+/fwupd-1.9.3.tar.xz
+/fwupd-1.9.4.tar.xz
+/fwupd-1.9.5.tar.xz
+/fwupd-1.9.6.tar.xz
+/fwupd-1.9.7.tar.xz
+/fwupd-1.9.8.tar.xz
+/fwupd-1.9.9.tar.xz
+/fwupd-1.9.10.tar.xz
+/fwupd-1.9.11.tar.xz
+/fwupd-1.9.12.tar.xz
+/fwupd-1.9.13.tar.xz
+/fwupd-1.9.19.tar.xz
+/DBXUpdate-20100307-x64.cab
+/DBXUpdate-20140413-x64.cab
+/DBXUpdate-20160809-x64.cab
+/DBXUpdate-20200729-aa64.cab
+/DBXUpdate-20200729-ia32.cab
+/DBXUpdate-20200729-x64.cab
+/DBXUpdate-20210429-x64.cab
+/DBXUpdate-20220812-aa64.cab
+/DBXUpdate-20220812-ia32.cab
+/DBXUpdate-20220812-x64.cab
+/DBXUpdate-20230509-aa64.cab
+/DBXUpdate-20230509-ia32.cab
+/DBXUpdate-20230509-x64.cab
+/fwupd-1.9.26.tar.xz
+/fwupd-1.9.29.tar.xz
+/DBXUpdate-20241101-x64.cab
+/fwupd-1.9.31.tar.xz
+/DBXUpdate-20250507-legacy-x64.cab
+/fwupd-2.0.16.tar.xz
+/40d3a4630619b83026f66bc64d97a582bbd9223ad53aa3f519ff5e2121d11ca6-DBXUpdate-20250507-x64.cab
+/fwupd-2.0.19.tar.xz
+/fwupd-2.1.6.tar.xz
+/9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab

0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch

@@ -0,0 +1,209 @@
+From 2ed98c7c2e0ac77b9967933af51615385f7e471d Mon Sep 17 00:00:00 2001
+From: Richard Hughes <richard@hughsie.com>
+Date: Thu, 2 Jul 2026 14:47:33 +0100
+Subject: [PATCH] Fix the seal self tests when building on a tmpfs
+
+When fwupd is exploded onto a tmpfs the assumption of 'is a local file *not* a
+memfd' breaks. When fwupd is built using rpmbuild we do not control the
+buildroot filesystem, so make the 'is a sealed fd required' check more explicit.
+---
+ src/fu-dbus-daemon.c                     |  3 +
+ src/fu-engine.c                          |  6 ++
+ src/fu-unix-seekable-input-stream-test.c | 17 +++++-
+ src/fu-unix-seekable-input-stream.c      | 70 ++++++++++++++++--------
+ src/fu-unix-seekable-input-stream.h      |  2 +
+ 5 files changed, 73 insertions(+), 25 deletions(-)
+
+diff --git a/src/fu-dbus-daemon.c b/src/fu-dbus-daemon.c
+index 72cc36fad..de8aa9a26 100644
+--- a/src/fu-dbus-daemon.c
++++ b/src/fu-dbus-daemon.c
+@@ -1158,6 +1158,9 @@ fu_dbus_daemon_invocation_get_input_stream(GDBusMethodInvocation *invocation, GE
+ 	stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, error);
+ 	if (stream == NULL)
+ 		return NULL;
++	if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
++							error))
++		return NULL;
+ 	return g_steal_pointer(&stream);
+ #else
+ 	g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INTERNAL, "unsupported feature");
+diff --git a/src/fu-engine.c b/src/fu-engine.c
+index 9eaed95ab..5820ea891 100644
+--- a/src/fu-engine.c
++++ b/src/fu-engine.c
+@@ -5069,9 +5069,15 @@ fu_engine_update_metadata(FuEngine *self,
+ 	stream_fd = fu_unix_seekable_input_stream_new(fd, TRUE, error);
+ 	if (stream_fd == NULL)
+ 		return FALSE;
++	if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream_fd),
++							error))
++		return FALSE;
+ 	stream_sig = fu_unix_seekable_input_stream_new(fd_sig, TRUE, error);
+ 	if (stream_sig == NULL)
+ 		return FALSE;
++	if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream_sig),
++							error))
++		return FALSE;
+ 
+ 	/* read the entire file into memory */
+ 	bytes_raw =
+diff --git a/src/fu-unix-seekable-input-stream-test.c b/src/fu-unix-seekable-input-stream-test.c
+index d65b70add..3b5e8d8ec 100644
+--- a/src/fu-unix-seekable-input-stream-test.c
++++ b/src/fu-unix-seekable-input-stream-test.c
+@@ -84,6 +84,7 @@ static void
+ fu_unix_seekable_input_stream_sealed_memfd_func(void)
+ {
+ #if defined(HAVE_GIO_UNIX) && defined(HAVE_MEMFD_CREATE)
++	gboolean ret;
+ 	g_autofd gint fd = -1;
+ 	g_autoptr(GError) error = NULL;
+ 	g_autoptr(GInputStream) stream = NULL;
+@@ -93,11 +94,18 @@ fu_unix_seekable_input_stream_sealed_memfd_func(void)
+ 	g_assert_cmpint(fd, >=, 0);
+ 	g_assert_cmpint(write(fd, data, sizeof(data)), ==, sizeof(data));
+ 	g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0);
+-	g_assert_cmpint(fcntl(fd, F_ADD_SEALS, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW), ==, 0);
++	g_assert_cmpint(
++	    fcntl(fd, F_ADD_SEALS, F_SEAL_SEAL | F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW),
++	    ==,
++	    0);
+ 
+ 	stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, &error);
+ 	g_assert_no_error(error);
+ 	g_assert_nonnull(stream);
++	ret = fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
++							 &error);
++	g_assert_no_error(error);
++	g_assert_true(ret);
+ #else
+ 	g_test_skip("No gio-unix-2.0 or memfd_create support, skipping");
+ #endif
+@@ -107,6 +115,7 @@ static void
+ fu_unix_seekable_input_stream_unsealed_memfd_func(void)
+ {
+ #if defined(HAVE_GIO_UNIX) && defined(HAVE_MEMFD_CREATE)
++	gboolean ret;
+ 	g_autofd gint fd = -1;
+ 	g_autoptr(GError) error = NULL;
+ 	g_autoptr(GInputStream) stream = NULL;
+@@ -118,8 +127,12 @@ fu_unix_seekable_input_stream_unsealed_memfd_func(void)
+ 	g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0);
+ 
+ 	stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, &error);
++	g_assert_no_error(error);
++	g_assert_nonnull(stream);
++	ret = fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
++							 &error);
+ 	g_assert_error(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE);
+-	g_assert_null(stream);
++	g_assert_false(ret);
+ #else
+ 	g_test_skip("No gio-unix-2.0 or memfd_create support, skipping");
+ #endif
+diff --git a/src/fu-unix-seekable-input-stream.c b/src/fu-unix-seekable-input-stream.c
+index 4955c366c..591173812 100644
+--- a/src/fu-unix-seekable-input-stream.c
++++ b/src/fu-unix-seekable-input-stream.c
+@@ -116,25 +116,6 @@ fu_unix_seekable_input_stream_seekable_iface_init(GSeekableIface *iface)
+ 	iface->truncate_fn = fu_unix_seekable_input_stream_truncate;
+ }
+ 
+-static gboolean
+-fu_unix_seekable_input_stream_verify_sealed(gint fd, GError **error)
+-{
+-#ifdef HAVE_MEMFD_CREATE
+-	gint seals = fcntl(fd, F_GET_SEALS);
+-	if (seals >= 0 && (seals & (F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW)) !=
+-			      (F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW)) {
+-		g_set_error(error,
+-			    FWUPD_ERROR,
+-			    FWUPD_ERROR_INVALID_FILE,
+-			    "fd is missing required seals, got 0x%x",
+-			    (guint)seals);
+-		return FALSE;
+-	}
+-#endif
+-	/* success */
+-	return TRUE;
+-}
+-
+ /**
+  * fu_unix_seekable_input_stream_new:
+  * @fd: a UNIX file descriptor
+@@ -177,14 +158,57 @@ fu_unix_seekable_input_stream_new(gint fd, gboolean close_fd, GError **error)
+ 		return NULL;
+ 	}
+ 
+-	/* if the fd supports sealing (i.e. is a memfd) then require immutability */
+-	if (!fu_unix_seekable_input_stream_verify_sealed(fd, error))
+-		return NULL;
+-
+ 	/* success */
+ 	return g_steal_pointer(&stream);
+ }
+ 
++/**
++ * fu_unix_seekable_input_stream_require_seal:
++ * @stream: a #FuUnixSeekableInputStream
++ * @error: (nullable): optional return location for an error
++ *
++ * Enforces that the file descriptor backing this stream is a memfd with the required seals set.
++ *
++ * Returns: %TRUE if sealed
++ *
++ * Since: 2.1.7
++ **/
++gboolean
++fu_unix_seekable_input_stream_require_seal(FuUnixSeekableInputStream *stream, GError **error)
++{
++#ifdef HAVE_MEMFD_CREATE
++	gint fd;
++	gint seals;
++
++	g_return_val_if_fail(FU_IS_UNIX_SEEKABLE_INPUT_STREAM(stream), FALSE);
++	g_return_val_if_fail(error == NULL || *error == NULL, FALSE);
++
++	fd = g_unix_input_stream_get_fd(G_UNIX_INPUT_STREAM(stream));
++	seals = fcntl(fd, F_GET_SEALS);
++	if (seals < 0) {
++		/* not supported on this fd */
++		return TRUE;
++	}
++	if ((seals & F_SEAL_SEAL) == 0) {
++		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "fd not sealed");
++		return FALSE;
++	}
++	if ((seals & F_SEAL_WRITE) == 0) {
++		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no WRITE seal");
++		return FALSE;
++	}
++	if ((seals & F_SEAL_SHRINK) == 0) {
++		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no SHRINK seal");
++		return FALSE;
++	}
++	if ((seals & F_SEAL_GROW) == 0) {
++		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no GROW seal");
++		return FALSE;
++	}
++#endif
++	return TRUE;
++}
++
+ static void
+ fu_unix_seekable_input_stream_class_init(FuUnixSeekableInputStreamClass *klass)
+ {
+diff --git a/src/fu-unix-seekable-input-stream.h b/src/fu-unix-seekable-input-stream.h
+index 5f0a0656a..6d7b2acde 100644
+--- a/src/fu-unix-seekable-input-stream.h
++++ b/src/fu-unix-seekable-input-stream.h
+@@ -18,3 +18,5 @@ G_DECLARE_FINAL_TYPE(FuUnixSeekableInputStream,
+ 
+ GInputStream *
+ fu_unix_seekable_input_stream_new(gint fd, gboolean close_fd, GError **error);
++gboolean
++fu_unix_seekable_input_stream_require_seal(FuUnixSeekableInputStream *stream, GError **error);
+-- 
+2.54.0
+

0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch

@@ -0,0 +1,42 @@
+From f7352aa9e2157a5ed88d10278ef420a78c8a52f8 Mon Sep 17 00:00:00 2001
+From: Richard Hughes <richard@hughsie.com>
+Date: Thu, 2 Jul 2026 16:16:28 +0100
+Subject: [PATCH] Seal memfds for compatibility with newer fwupd daemons
+
+---
+ libfwupd/fwupd-common.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/libfwupd/fwupd-common.c b/libfwupd/fwupd-common.c
+index 3220c40a7..862210c8a 100644
+--- a/libfwupd/fwupd-common.c
++++ b/libfwupd/fwupd-common.c
+@@ -1054,7 +1054,7 @@ fwupd_unix_input_stream_from_bytes(GBytes *bytes, GError **error)
+ #endif
+ 
+ #ifdef HAVE_MEMFD_CREATE
+-	fd = memfd_create("fwupd", MFD_CLOEXEC);
++	fd = memfd_create("fwupd", MFD_CLOEXEC | MFD_ALLOW_SEALING);
+ #else
+ 	/* emulate in-memory file by an unlinked temporary file */
+ 	fd = g_mkstemp(tmp_file);
+@@ -1098,6 +1098,16 @@ fwupd_unix_input_stream_from_bytes(GBytes *bytes, GError **error)
+ 			    g_strerror(errno));
+ 		return NULL;
+ 	}
++#ifdef HAVE_MEMFD_CREATE
++	if (fcntl(fd, F_ADD_SEALS, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_SEAL) < 0) {
++		g_set_error(error,
++			    FWUPD_ERROR,
++			    FWUPD_ERROR_INVALID_FILE,
++			    "failed to seal memfd: %s",
++			    strerror(errno));
++		return NULL;
++	}
++#endif
+ 	return G_UNIX_INPUT_STREAM(g_unix_input_stream_new(fd, TRUE));
+ }
+ 
+-- 
+2.54.0
+

SOURCES/0001-Use-usr-libexec-platform-python-for-RHEL.patch

@@ -1,29 +0,0 @@
-From 1fc24adecbb62b3cd77ef965c5daf1b72f6c7aa8 Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 22 Aug 2023 10:05:27 +0100
-Subject: [PATCH] Use /usr/libexec/platform-python for RHEL
-
----
- meson.build | 6 +-----
- 1 file changed, 1 insertion(+), 5 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index bb406d616..ac90c8ee6 100644
---- a/meson.build
-+++ b/meson.build
-@@ -261,11 +261,7 @@ if libgcab.type_name() == 'pkgconfig' and cc.has_function('gcab_file_set_bytes',
- endif
- 
- bashcomp = dependency('bash-completion', required: false)
--if host_machine.system() != 'freebsd'
--  python3 = find_program('python3')
--else
--  python3 = find_program('python3.8', 'python3', 'python3.9')
--endif
-+python3 = find_program('/usr/libexec/platform-python')
- 
- if get_option('gnutls')
-   gnutls = dependency('gnutls', version : '>= 3.6.0')
--- 
-2.41.0
-

SOURCES/0001-redfish-Set-the-permissions-of-redfish.conf-at-insta.patch

@@ -1,28 +0,0 @@
-From 442f7f9200fbf6ec509dd0ee40eae2e37b2fb73e Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 20 Sep 2022 08:06:12 +0100
-Subject: [PATCH 1/3] redfish: Set the permissions of redfish.conf at install
- time
-
-Although typically we set the password using fu_plugin_set_secure_config_value()
-or something like Ansible or Puppet -- the user could just edit the file with
-vim and we still want the permissions set correctly.
----
- plugins/redfish/meson.build | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/plugins/redfish/meson.build b/plugins/redfish/meson.build
-index 34ba4b7f6..7b19574de 100644
---- a/plugins/redfish/meson.build
-+++ b/plugins/redfish/meson.build
-@@ -48,6 +48,7 @@ shared_module('fu_plugin_redfish',
- 
- install_data(['redfish.conf'],
-   install_dir:  join_paths(sysconfdir, 'fwupd'),
-+  install_mode: 'rw-r-----',
- )
- 
- if get_option('tests')
--- 
-2.39.1
-

SOURCES/0002-redfish-Only-create-users-using-IPMI-when-we-know-it.patch

@@ -1,47 +0,0 @@
-From 4f39b747a6d860e32a3000451dd2635366c81776 Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 20 Sep 2022 09:13:52 +0100
-Subject: [PATCH 2/3] redfish: Only create users using IPMI when we know it's
- going to work
-
-Make the IPMI auto-account feature allow-listed on specific vendors as some IPMI
-implementations are not specification compliant and do entirely the wrong thing.
----
- plugins/redfish/fu-plugin-redfish.c | 8 ++++++++
- plugins/redfish/redfish.quirk       | 2 +-
- 2 files changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/plugins/redfish/fu-plugin-redfish.c b/plugins/redfish/fu-plugin-redfish.c
-index deb0fe742..3972d4b4b 100644
---- a/plugins/redfish/fu-plugin-redfish.c
-+++ b/plugins/redfish/fu-plugin-redfish.c
-@@ -422,6 +422,14 @@ fu_plugin_redfish_startup(FuPlugin *plugin, GError **error)
- #ifdef HAVE_LINUX_IPMI_H
- 	/* we got neither a type 42 entry or config value, lets try IPMI */
- 	if (fu_redfish_backend_get_username(data->backend) == NULL) {
-+		if (!fu_context_has_hwid_flag(fu_plugin_get_context(plugin), "ipmi-create-user")) {
-+			g_set_error_literal(error,
-+					    FWUPD_ERROR,
-+					    FWUPD_ERROR_NOT_SUPPORTED,
-+					    "no username and password specified, "
-+					    "and no vendor quirk for 'ipmi-create-user'");
-+			return FALSE;
-+		}
- 		if (!fu_plugin_get_config_value_boolean(plugin, "IpmiDisableCreateUser")) {
- 			g_debug("attempting to create user using IPMI");
- 			if (!fu_redfish_plugin_ipmi_create_user(plugin, error))
-diff --git a/plugins/redfish/redfish.quirk b/plugins/redfish/redfish.quirk
-index b12439926..5e9722fda 100644
---- a/plugins/redfish/redfish.quirk
-+++ b/plugins/redfish/redfish.quirk
-@@ -1,6 +1,6 @@
- # Lenovo ThinkSystem
- [42f00735-c9ab-5374-bd63-a5deee5881e0]
--Flags = wildcard-targets,reset-required
-+Flags = wildcard-targets,reset-required,ipmi-create-user
- 
- [REDFISH\VENDOR_Lenovo&ID_BMC-Backup]
- ParentGuid = REDFISH\VENDOR_Lenovo&ID_BMC-Primary
--- 
-2.39.1
-

SOURCES/0003-Never-save-the-Redfish-passwords-to-a-file-readable-.patch

@@ -1,141 +0,0 @@
-From 41575afd93ca0e68bced78ca43a4488f124906a1 Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Wed, 21 Sep 2022 14:56:10 +0100
-Subject: [PATCH 3/3] Never save the Redfish passwords to a file readable by
- users
-
-When the redfish plugin automatically creates an OPERATOR user account on the
-BMC we save the autogenerated password to /etc/fwupd/redfish.conf, ensuring it
-is chmod'ed to 0660 before writing the file with g_key_file_save_to_file().
-
-Under the covers, g_key_file_save_to_file() calls g_file_set_contents() with
-the keyfile string data.
-I was under the impression that G_FILE_CREATE_REPLACE_DESTINATION was being
-used to copy permissions, but alas not.
-
-GLib instead calls g_file_set_contents_full() with the mode hardcoded to 0666,
-which undoes the previous chmod().
-
-Use g_file_set_contents_full() with the correct mode for newer GLib versions,
-and provide a fallback with the same semantics for older versions.
----
- contrib/fwupd.spec.in         |  3 ++
- libfwupdplugin/fu-plugin.c    | 65 +++++++++++++++++++++++++++++------
- libfwupdplugin/fu-self-test.c | 57 ++++++++++++++++++++++++++++++
- 3 files changed, 114 insertions(+), 11 deletions(-)
-
-diff --git a/contrib/fwupd.spec.in b/contrib/fwupd.spec.in
-index a50e30a9c..0854fcf4f 100644
---- a/contrib/fwupd.spec.in
-+++ b/contrib/fwupd.spec.in
-@@ -313,6 +313,9 @@ for fn in /etc/fwupd/remotes.d/*.conf; do
-     fi
- done
- 
-+# ensure this is private
-+chmod 0660 /etc/fwupd/redfish.conf
-+
- %preun
- %systemd_preun fwupd.service
- 
-diff --git a/libfwupdplugin/fu-plugin.c b/libfwupdplugin/fu-plugin.c
-index 18042a028..04951de85 100644
---- a/libfwupdplugin/fu-plugin.c
-+++ b/libfwupdplugin/fu-plugin.c
-@@ -9,6 +9,7 @@
- #include "config.h"
- 
- #include <errno.h>
-+#include <fcntl.h>
- #include <fwupd.h>
- #include <glib/gstdio.h>
- #include <gmodule.h>
-@@ -2256,6 +2257,46 @@ fu_plugin_set_config_value(FuPlugin *self, const gchar *key, const gchar *value,
- 	return g_key_file_save_to_file(keyfile, conf_path, error);
- }
- 
-+#if !GLIB_CHECK_VERSION(2, 66, 0)
-+
-+#define G_FILE_SET_CONTENTS_CONSISTENT 0
-+typedef guint GFileSetContentsFlags;
-+static gboolean
-+g_file_set_contents_full(const gchar *filename,
-+			 const gchar *contents,
-+			 gssize length,
-+			 GFileSetContentsFlags flags,
-+			 int mode,
-+			 GError **error)
-+{
-+	gint fd;
-+	gssize wrote;
-+
-+	if (length < 0)
-+		length = strlen(contents);
-+	fd = g_open(filename, O_CREAT, mode);
-+	if (fd <= 0) {
-+		g_set_error(error,
-+			    G_IO_ERROR,
-+			    G_IO_ERROR_FAILED,
-+			    "could not open %s file",
-+			    filename);
-+		return FALSE;
-+	}
-+	wrote = write(fd, contents, length);
-+	if (wrote != length) {
-+		g_set_error(error,
-+			    G_IO_ERROR,
-+			    G_IO_ERROR_FAILED,
-+			    "did not write %s file",
-+			    filename);
-+		g_close(fd, NULL);
-+		return FALSE;
-+	}
-+	return g_close(fd, error);
-+}
-+#endif
-+
- /**
-  * fu_plugin_set_secure_config_value:
-  * @self: a #FuPlugin
-@@ -2277,7 +2318,8 @@ fu_plugin_set_secure_config_value(FuPlugin *self,
- 				  GError **error)
- {
- 	g_autofree gchar *conf_path = fu_plugin_get_config_filename(self);
--	gint ret;
-+	g_autofree gchar *data = NULL;
-+	g_autoptr(GKeyFile) keyfile = g_key_file_new();
- 
- 	g_return_val_if_fail(FU_IS_PLUGIN(self), FALSE);
- 	g_return_val_if_fail(error == NULL || *error == NULL, FALSE);
-@@ -2286,17 +2328,18 @@ fu_plugin_set_secure_config_value(FuPlugin *self,
- 		g_set_error(error, FWUPD_ERROR, FWUPD_ERROR_NOT_FOUND, "%s is missing", conf_path);
- 		return FALSE;
- 	}
--	ret = g_chmod(conf_path, 0660);
--	if (ret == -1) {
--		g_set_error(error,
--			    FWUPD_ERROR,
--			    FWUPD_ERROR_INTERNAL,
--			    "failed to set permissions on %s",
--			    conf_path);
-+	if (!g_key_file_load_from_file(keyfile, conf_path, G_KEY_FILE_KEEP_COMMENTS, error))
- 		return FALSE;
--	}
--
--	return fu_plugin_set_config_value(self, key, value, error);
-+	g_key_file_set_string(keyfile, fu_plugin_get_name(self), key, value);
-+	data = g_key_file_to_data(keyfile, NULL, error);
-+	if (data == NULL)
-+		return FALSE;
-+	return g_file_set_contents_full(conf_path,
-+					data,
-+					-1,
-+					G_FILE_SET_CONTENTS_CONSISTENT,
-+					0660,
-+					error);
- }
- 
- /**
--- 
-2.39.1
-

fwupd.spec

@@ -0,0 +1,427 @@
+%global glib2_version 2.68.0
+%global libxmlb_version 0.3.24
+%global libusb_version 1.0.9
+%global libcurl_version 7.62.0
+%global libjcat_version 0.1.0
+%global systemd_version 249
+%global json_glib_version 1.1.1
+
+# to use this feature use `rpmbuild -ba fwupd.spec --with=libfwupdcompat`
+%bcond_with libfwupdcompat
+%if %{with libfwupdcompat} || 0%{?rhel}
+%global libfwupd_19x_version 31
+%endif
+
+# although we ship a few tiny python files these are utilities that 99.99%
+# of users do not need -- use this to avoid dragging python onto CoreOS
+%global __requires_exclude ^%{python3}$
+
+# PPC64 is too slow to complete the tests under 3 minutes...
+%ifnarch ppc64le
+%global enable_tests 1
+%endif
+%global __meson_wrap_mode nodownload
+
+%if 0%{?fedora} >= 30 || 0%{?rhel} >= 10
+%global have_gi_docgen 1
+%endif
+
+# fwupd.efi is only available on these arches
+%ifarch x86_64 aarch64 riscv64 loongarch64
+%global have_uefi 1
+%endif
+
+%ifarch i686 x86_64
+%global have_msr 1
+%endif
+
+# only available recently
+%if 0%{?fedora} >= 30
+%global have_modem_manager 1
+%endif
+
+%if 0%{?fedora}
+%global have_passim 1
+%endif
+
+Summary:   Firmware update daemon
+Name:      fwupd
+Version:   2.1.6
+Release:   %autorelease
+License:   LGPL-2.1-or-later
+URL:       https://github.com/fwupd/fwupd
+Source0:   http://people.freedesktop.org/~hughsient/releases/%{name}-%{version}.tar.xz
+%if 0%{?libfwupd_19x_version}
+Source2:   https://github.com/fwupd/%{name}/releases/download/1.9.%{libfwupd_19x_version}/%{name}-1.9.%{libfwupd_19x_version}.tar.xz
+%endif
+
+Source24:  https://fwupd.org/downloads/9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab
+
+Patch1:    0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch
+Patch2:    0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch
+
+BuildRequires: gettext
+BuildRequires: hwdata
+BuildRequires: glib2-devel >= %{glib2_version}
+BuildRequires: libxmlb-devel >= %{libxmlb_version}
+BuildRequires: libusb1-devel >= %{libusb_version}
+BuildRequires: libcurl-devel >= %{libcurl_version}
+BuildRequires: libjcat-devel >= %{libjcat_version}
+BuildRequires: polkit-devel >= 0.103
+BuildRequires: python3-packaging
+BuildRequires: python3-jinja2
+BuildRequires: sqlite-devel
+BuildRequires: systemd >= %{systemd_version}
+BuildRequires: systemd-devel
+BuildRequires: libblkid-devel
+BuildRequires: readline-devel
+BuildRequires: libmnl-devel
+BuildRequires: gobject-introspection-devel
+%ifarch %{valgrind_arches}
+BuildRequires: valgrind
+BuildRequires: valgrind-devel
+%endif
+%if 0%{?have_gi_docgen}
+BuildRequires: gi-docgen
+%endif
+BuildRequires: gnutls-devel
+BuildRequires: gnutls-utils
+BuildRequires: meson
+BuildRequires: json-glib-devel >= %{json_glib_version}
+BuildRequires: vala
+BuildRequires: pkgconfig(bash-completion)
+BuildRequires: git-core
+BuildRequires: libdrm-devel
+# For fu-polkit-test
+BuildRequires: polkit
+
+%if 0%{?have_modem_manager}
+BuildRequires: ModemManager-glib-devel >= 1.10.0
+BuildRequires: libqmi-devel >= 1.22.0
+BuildRequires: libmbim-devel
+%endif
+
+%if 0%{?have_uefi}
+BuildRequires: python3 python3-cairo python3-gobject
+BuildRequires: pango-devel
+BuildRequires: cairo-devel cairo-gobject-devel
+BuildRequires: freetype
+BuildRequires: fontconfig
+BuildRequires: google-noto-sans-cjk-ttc-fonts
+BuildRequires: tpm2-tss-devel >= 2.2.3
+%endif
+
+Requires(post): systemd
+Requires(preun): systemd
+Requires(postun): systemd
+
+Requires: glib2%{?_isa} >= %{glib2_version}
+Requires: libxmlb%{?_isa} >= %{libxmlb_version}
+Requires: shared-mime-info
+
+# deliberately has no _isa as libusbx in RHEL-9 does not include it
+Requires: libusb1 >= %{libusb_version}
+
+%if 0%{?rhel} > 7 || 0%{?fedora} > 28
+Recommends: python3
+%endif
+
+Obsoletes: dbxtool < 9
+Provides: dbxtool
+
+# this was removed in 2.1.4
+Obsoletes: %{name}-plugin-flashrom < 2.1.4
+Obsoletes: %{name}-plugin-flashrom-debuginfo < 2.1.4
+
+%if 0%{?rhel} > 7
+Obsoletes: fwupdate < 11-4
+Obsoletes: fwupdate-efi < 11-4
+
+Provides: fwupdate
+Provides: fwupdate-efi
+%endif
+
+# optional, but a really good idea
+Recommends: udisks2
+Recommends: bluez
+Recommends: jq
+%if 0%{?have_passim}
+Recommends: passim
+%endif
+
+%if 0%{?have_modem_manager}
+Recommends: %{name}-plugin-modem-manager
+%endif
+%if 0%{?have_uefi}
+Recommends: %{name}-efi
+Recommends: %{name}-plugin-uefi-capsule-data
+%endif
+
+%description
+fwupd is a daemon to allow session software to update device firmware.
+
+%package devel
+Summary: Development package for %{name}
+Requires: %{name}%{?_isa} = %{version}-%{release}
+Obsoletes: libebitdo-devel < 0.7.5-3
+Obsoletes: libdfu-devel < 1.0.0
+
+%description devel
+Files for development with %{name}.
+
+%package tests
+Summary: Data files for installed tests
+Requires: %{name}%{?_isa} = %{version}-%{release}
+
+%description tests
+Data files for installed tests.
+
+%if 0%{?have_modem_manager}
+%package plugin-modem-manager
+Summary: fwupd plugin using ModemManger
+Requires: %{name}%{?_isa} = %{version}-%{release}
+
+%description plugin-modem-manager
+This provides the optional package which is only required on hardware that
+might have mobile broadband hardware. It is probably not required on servers.
+%endif
+
+%if 0%{?have_uefi}
+%package plugin-uefi-capsule-data
+Summary: Localized data for the UEFI UX capsule
+Requires: %{name}%{?_isa} = %{version}-%{release}
+
+%description plugin-uefi-capsule-data
+This provides the pregenerated BMP artwork for the UX capsule, which allows the
+"Installing firmware update…" localized text to be shown during a UEFI firmware
+update operation. This subpackage is probably not required on embedded hardware
+or server machines.
+%endif
+
+%prep
+%setup -q
+%patch 1 -p1
+
+# and the old version for libfwupd1
+%if 0%{?libfwupd_19x_version}
+tar xfs %{SOURCE2}
+cd fwupd-1.9.%{libfwupd_19x_version}
+%patch 2 -p1
+%endif
+
+%build
+
+%if 0%{?libfwupd_19x_version}
+cd fwupd-1.9.%{libfwupd_19x_version}
+%meson \
+    -Dbuild=library \
+    -Ddocs=disabled \
+    -Dcbor=disabled \
+    -Dpolkit=disabled \
+    -Dtests=false \
+    -Dbash_completion=false \
+    -Dplugin_msr=disabled \
+    -Dintrospection=disabled \
+    -Dplugin_logitech_bulkcontroller=disabled \
+    -Dlaunchd=disabled
+%meson_build
+cd -
+%endif
+
+%meson \
+    -Dumockdev_tests=disabled \
+%if 0%{?have_gi_docgen}
+    -Ddocs=enabled \
+%else
+    -Ddocs=disabled \
+%endif
+%if 0%{?enable_tests}
+    -Dtests=true \
+%else
+    -Dtests=false \
+%endif
+%if 0%{?have_uefi}
+    -Defi_binary=false \
+    -Defi_os_dir=%{efi_vendor} \
+%endif
+%if 0%{?have_modem_manager}
+    -Dplugin_modem_manager=enabled \
+%else
+    -Dplugin_modem_manager=disabled \
+%endif
+    -Dbluez=disabled \
+    -Dlvfs=disabled \
+%if 0%{?have_passim}
+    -Dpassim=enabled \
+%else
+    -Dpassim=disabled \
+%endif
+%ifarch i686 x86_64
+    -Dhsi=enabled \
+%else
+    -Dhsi=disabled \
+%endif
+%ifarch %{valgrind_arches}
+    -Dvalgrind=enabled \
+%else
+    -Dvalgrind=disabled \
+%endif
+    -Dman=true \
+    -Dsystemd_unit_user="" \
+    -Dbluez=enabled \
+    -Dsupported_build=enabled
+
+%meson_build
+
+%if 0%{?enable_tests}
+%check
+%meson_test
+%endif
+
+%install
+%if 0%{?libfwupd_19x_version}
+cd fwupd-1.9.%{libfwupd_19x_version}
+%meson_install
+cd -
+%endif
+%meson_install
+
+# on RHEL the LVFS is disabled by default
+install \
+  %{SOURCE24} \
+  %{buildroot}/%{_datadir}/fwupd/remotes.d/vendor/firmware/
+
+mkdir -p --mode=0700 $RPM_BUILD_ROOT%{_localstatedir}/lib/fwupd
+
+# workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1757948
+mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/cache/fwupd
+
+%find_lang %{name}
+
+%post
+%systemd_post fwupd.service fwupd-refresh.timer
+
+%preun
+%systemd_preun fwupd.service fwupd-refresh.timer
+
+%postun
+%systemd_postun_with_restart fwupd.service fwupd-refresh.timer
+
+%triggerun -- fedora-release-common < 39-0.28
+# For upgrades from versions before fwupd-refresh.timer was enabled by default
+systemctl --no-reload preset fwupd-refresh.timer &>/dev/null || :
+
+%files -f %{name}.lang
+%doc README.md
+%license COPYING
+%config(noreplace)%{_sysconfdir}/fwupd/fwupd.conf
+%dir %{_libexecdir}/fwupd
+%{_libexecdir}/fwupd/fwupd
+%ifarch x86_64
+%{_libexecdir}/fwupd/fwupd-detect-cet
+%endif
+%if 0%{?have_uefi}
+%{_bindir}/dbxtool
+%endif
+%{_bindir}/fwupdmgr
+%{_bindir}/fwupdtool
+%dir %{_sysconfdir}/fwupd
+%dir %{_sysconfdir}/fwupd/bios-settings.d
+%{_sysconfdir}/fwupd/bios-settings.d/README.md
+%dir %{_sysconfdir}/fwupd/remotes.d
+%config(noreplace)%{_sysconfdir}/fwupd/remotes.d/lvfs.conf
+%config(noreplace)%{_sysconfdir}/fwupd/remotes.d/lvfs-embargo.conf
+%config(noreplace)%{_sysconfdir}/fwupd/remotes.d/lvfs-testing.conf
+%config(noreplace)%{_sysconfdir}/fwupd/remotes.d/vendor-directory.conf
+%config(noreplace)%{_sysconfdir}/pki/fwupd
+%{_sysconfdir}/pki/fwupd-metadata
+%if 0%{?have_msr}
+/usr/lib/modules-load.d/fwupd-msr.conf
+%endif
+/usr/lib/modules-load.d/fwupd-i2c.conf
+%{_datadir}/dbus-1/system.d/org.freedesktop.fwupd.conf
+%{_datadir}/bash-completion/completions/fwupdmgr
+%{_datadir}/bash-completion/completions/fwupdtool
+%{_datadir}/fish/vendor_completions.d/fwupdmgr.fish
+%dir %{_datadir}/fwupd
+%dir %{_datadir}/fwupd/metainfo
+%{_datadir}/fwupd/metainfo/org.freedesktop.fwupd*.metainfo.xml
+%dir %{_datadir}/fwupd/remotes.d
+%dir %{_datadir}/fwupd/remotes.d/vendor
+%dir %{_datadir}/fwupd/remotes.d/vendor/firmware
+%{_datadir}/fwupd/remotes.d/vendor/firmware/*.cab
+%{_datadir}/fwupd/remotes.d/vendor/firmware/README.md
+%{_datadir}/dbus-1/interfaces/org.freedesktop.fwupd.xml
+%{_datadir}/polkit-1/actions/org.freedesktop.fwupd.policy
+%{_datadir}/polkit-1/rules.d/org.freedesktop.fwupd.rules
+%{_datadir}/dbus-1/system-services/org.freedesktop.fwupd.service
+%{_mandir}/man1/fwupdtool.1*
+%if 0%{?have_uefi}
+%{_mandir}/man1/dbxtool.*
+%endif
+%{_mandir}/man1/fwupdmgr.1*
+%{_mandir}/man5/*
+%{_mandir}/man8/*
+%{_datadir}/metainfo/org.freedesktop.fwupd.metainfo.xml
+%{_datadir}/icons/hicolor/*/apps/org.freedesktop.fwupd.*
+%{_datadir}/fwupd/firmware_packager.py
+%{_datadir}/fwupd/simple_client.py
+%{_datadir}/fwupd/add_capsule_header.py
+%{_datadir}/fwupd/install_dell_bios_exe.py
+%{_unitdir}/fwupd.service
+%{_unitdir}/fwupd-refresh.service
+%{_unitdir}/fwupd-refresh.timer
+%dir %{_localstatedir}/lib/fwupd
+%dir %{_localstatedir}/cache/fwupd
+%dir %{_datadir}/fwupd/quirks.d
+%{_datadir}/fwupd/quirks.d/builtin.quirk.gz
+%if 0%{?have_gi_docgen}
+%{_datadir}/doc/fwupd/*.html
+%endif
+%if 0%{?have_uefi}
+%config(noreplace)%{_sysconfdir}/grub.d/35_fwupd
+%endif
+%if 0%{?libfwupd_19x_version}
+%{_libdir}/libfwupd.so.2*
+%endif
+%{_libdir}/libfwupd.so.3*
+%{_libdir}/girepository-1.0/Fwupd-2.0.typelib
+/usr/lib/systemd/system-shutdown/fwupd.shutdown
+%dir %{_libdir}/fwupd-%{version}
+%{_libdir}/fwupd-%{version}/libfwupd*.so
+
+%if 0%{?have_modem_manager}
+%files plugin-modem-manager
+%{_libdir}/fwupd-%{version}/libfu_plugin_modem_manager.so
+%endif
+%if 0%{?have_uefi}
+%files plugin-uefi-capsule-data
+%{_datadir}/fwupd/uefi-capsule-ux.zip
+%endif
+
+%files devel
+%{_datadir}/gir-1.0/Fwupd-2.0.gir
+%if 0%{?have_gi_docgen}
+%{_datadir}/doc/fwupd/libfwupdplugin
+%{_datadir}/doc/fwupd/libfwupd
+%{_datadir}/doc/libfwupdplugin
+%{_datadir}/doc/libfwupd
+%endif
+%{_datadir}/vala/vapi
+%if 0%{?libfwupd_19x_version}
+%{_includedir}/fwupd-1
+%endif
+%{_includedir}/fwupd-3
+%{_libdir}/libfwupd.so
+%{_libdir}/pkgconfig/fwupd.pc
+
+%files tests
+%if 0%{?enable_tests}
+%{_datadir}/fwupd/host-emulate.d/*.json.gz
+%{_datadir}/installed-tests/fwupd
+%{_libexecdir}/installed-tests/fwupd
+%{_datadir}/fwupd/remotes.d/fwupd-tests.conf
+%endif
+
+%changelog
+%autochangelog

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - rhel-10
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.hardware-fwupd.tier0.functional}

main.fmf

@@ -0,0 +1,5 @@
+plan:
+    import:
+        url: https://gitlab.cee.redhat.com/desktopqe/fwupd.git
+        name: /plan/gate
+        ref: rhel-10

sources

@@ -0,0 +1,3 @@
+SHA512 (fwupd-2.1.6.tar.xz) = ac6400017df913b96f0df2616ffe92d4eeb4bf97d2c33fa1fe6ed8f5aba86438418d56db0b1e54a9977cb729b35c23c2010d778ef37486d0ed7058640e9c35d0
+SHA512 (fwupd-1.9.31.tar.xz) = ce9cd5129d0bcbedade6ba11f661fd3350445557d3116f479a8628376e9e8d6a933e6d2632ac3576d47ad9dbf0eafd54480d2765be86f776e8f04f689287ec80
+SHA512 (9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab) = 7fff3d5757b6ca5392ae21b7eab06d216d8eb3ccf24f68399679c402d21c842b7d9b0f716071b3f1163325f216926d3941fe494ca784ef257c466477525af76f