.fwupd.metadata

@@ -1,9 +0,0 @@
-699ad9c1e22655ebe0325ca9f6237b12bcffd8cc SOURCES/9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab
-59006fd556faeacc8185075c8fe7826249a2da32 SOURCES/fwupd-1.7.8.tar.xz
-26f05602b56e4d53e74cd3ebffa0f248d3de6aa1 SOURCES/fwupd-2.1.6.tar.xz
-08f697c52e73a2b3005f4b4991465d574ab177b7 SOURCES/fwupd-efi-1.8.tar.gz
-a62a28924d26cd49b6441170795a237ba33ec192 SOURCES/libjcat-0.1.9.tar.xz
-4a07b56e28741884b86da6ac91f8f9929541a1e4 SOURCES/redhatsecureboot301.cer
-33e260486f5c12e47b72b90dfb779ca892f56c45 SOURCES/redhatsecureboot503.cer
-cf9230e69000076727e5b784ec871d22716dc5da SOURCES/redhatsecurebootca3.cer
-e6f506462069aa17d2e8610503635c20f3a995c3 SOURCES/redhatsecurebootca5.cer

.gitignore

@@ -1,9 +1,88 @@
-SOURCES/9edea8bc287bf9bf4659856b28cf421f330eb2f658c163eab0a03512a98c0e78-DBXUpdate-20260402-x64.cab
-SOURCES/fwupd-1.7.8.tar.xz
-SOURCES/fwupd-2.1.6.tar.xz
-SOURCES/fwupd-efi-1.8.tar.gz
-SOURCES/libjcat-0.1.9.tar.xz
-SOURCES/redhatsecureboot301.cer
-SOURCES/redhatsecureboot503.cer
-SOURCES/redhatsecurebootca3.cer
-SOURCES/redhatsecurebootca5.cer
+/fwupd-0.1.0.tar.xz
+/fwupd-0.1.1.tar.xz
+/fwupd-0.1.2.tar.xz
+/fwupd-0.1.3.tar.xz
+/fwupd-0.1.4.tar.xz
+/fwupd-0.1.5.tar.xz
+/fwupd-0.1.6.tar.xz
+/fwupd-0.5.0.tar.xz
+/fwupd-0.5.1.tar.xz
+/fwupd-0.5.2.tar.xz
+/fwupd-0.5.3.tar.xz
+/fwupd-0.5.4.tar.xz
+/fwupd-0.6.0.tar.xz
+/fwupd-0.6.1.tar.xz
+/fwupd-0.6.2.tar.xz
+/fwupd-0.6.3.tar.xz
+/fwupd-0.7.0.tar.xz
+/fwupd-0.7.1.tar.xz
+/fwupd-0.7.2.tar.xz
+/fwupd-0.7.3.tar.xz
+/fwupd-0.7.4.tar.xz
+/fwupd-0.7.5.tar.xz
+/fwupd-0.8.0.tar.xz
+/fwupd-0.8.1.tar.xz
+/fwupd-0.8.2.tar.xz
+/fwupd-0.9.2.tar.xz
+/fwupd-0.9.3.tar.xz
+/fwupd-0.9.4.tar.xz
+/fwupd-0.9.5.tar.xz
+/fwupd-0.9.6.tar.xz
+/fwupd-0.9.7.tar.xz
+/fwupd-1.0.0.tar.xz
+/fwupd-1.0.1.tar.xz
+/fwupd-1.0.2.tar.xz
+/fwupd-1.0.3.tar.xz
+/fwupd-1.0.4.tar.xz
+/fwupd-1.0.5.tar.xz
+/fwupd-1.0.6.tar.xz
+/fwupd-1.0.7.tar.xz
+/fwupd-1.0.8.tar.xz
+/fwupd-1.1.0.tar.xz
+/fwupd-1.1.1.tar.xz
+/fwupd-1.1.2.tar.xz
+/fwupd-1.1.3.tar.xz
+/fwupd-1.2.0.tar.xz
+/fwupd-1.2.1.tar.xz
+/fwupd-1.2.2.tar.xz
+/fwupd-1.2.3.tar.xz
+/fwupd-1.2.4.tar.xz
+/fwupd-1.2.5.tar.xz
+/fwupd-1.2.6.tar.xz
+/fwupd-1.2.7.tar.xz
+/fwupd-1.2.8.tar.xz
+/fwupd-1.2.9.tar.xz
+/fwupd-1.2.10.tar.xz
+/fwupd-1.3.2.tar.xz
+/fwupd-1.3.3.tar.xz
+/fwupd-1.3.4.tar.xz
+/fwupd-1.3.5.tar.xz
+/fwupd-1.3.6.tar.xz
+/fwupd-1.3.7.tar.xz
+/fwupd-1.3.8.tar.xz
+/fwupd-1.3.9.tar.xz
+/fwupd-1.4.0.tar.xz
+/fwupd-1.4.1.tar.xz
+/fwupd-1.4.2.tar.xz
+/fwupd-1.4.3.tar.xz
+/fwupd-1.4.4.tar.xz
+/fwupd-1.4.5.tar.xz
+/fwupd-1.4.6.tar.xz
+/fwupd-1.5.0.tar.xz
+/fwupd-1.5.1.tar.xz
+/fwupd-1.5.2.tar.xz
+/fwupd-1.5.3.tar.xz
+/fwupd-1.5.4.tar.xz
+/fwupd-1.5.5.tar.xz
+/fwupd-1.5.9.tar.xz
+/DBXUpdate-20100307-x64.cab
+/DBXUpdate-20140413-x64.cab
+/DBXUpdate-20160809-x64.cab
+/DBXUpdate-20200729-aa64.cab
+/DBXUpdate-20200729-ia32.cab
+/DBXUpdate-20200729-x64.cab
+/fwupd-1.7.1.tar.xz
+/fwupd-efi-1.1.tar.xz
+/fwupd-1.7.4.tar.xz
+/fwupd-1.8.3.tar.xz
+/fwupd-efi-1.3.tar.xz

SOURCES/0001-Downgrade-deps-for-RHEL-8.patch

@@ -1,419 +0,0 @@
-From 8b662c7baa91279a4d770ee402c6169ce16cc121 Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Fri, 29 May 2026 13:58:07 +0100
-Subject: [PATCH] Downgrade deps for RHEL-8
-
----
- contrib/qubes/meson.build           |  6 ---
- data/meson.build                    |  4 +-
- docs/meson.build                    | 13 ------
- libfwupd/meson.build                |  2 +-
- libfwupdplugin/meson.build          |  2 +-
- libfwupdplugin/tests/meson.build    |  5 ---
- meson.build                         | 62 +++++++++++------------------
- meson_options.txt                   |  2 +-
- plugins/lenovo-thinklmi/meson.build |  2 +-
- plugins/modem-manager/meson.build   |  2 +-
- plugins/test/meson.build            |  4 +-
- src/meson.build                     |  4 +-
- 12 files changed, 33 insertions(+), 75 deletions(-)
-
-diff --git a/contrib/qubes/meson.build b/contrib/qubes/meson.build
-index 9b5385e15..689b462a2 100644
---- a/contrib/qubes/meson.build
-+++ b/contrib/qubes/meson.build
-@@ -45,9 +45,3 @@ install_data(
-   'test/logs/metainfo_version/firmware.metainfo.xml',
-   install_dir: 'share/qubes-fwupd/test/logs/metainfo_version',
- )
--
--install_symlink(
--  'qubes-fwupdmgr',
--  pointing_to: '/usr/share/qubes-fwupd/src/qubes_fwupdmgr.py',
--  install_dir: '/usr/sbin',
--)
-diff --git a/data/meson.build b/data/meson.build
-index 74a9104c3..70bf55908 100644
---- a/data/meson.build
-+++ b/data/meson.build
-@@ -122,7 +122,7 @@ if build_daemon
-       # for BLKSSZGET
-       device_allows += ['block-blkext']
-     endif
--    if get_option('plugin_modem_manager').allowed()
-+    if get_option('plugin_modem_manager').enabled()
-       device_allows += ['char-wwan_port']
-       device_allows += ['char-ttyUSB']
-     endif
-@@ -152,9 +152,7 @@ if build_daemon
-       'vmsplice',
-       'copy_file_range', # for g_file_copy
-     ]
--    dynamic_options += ['SystemCallFilter=' + ' '.join(syscall_filter)]
-     if supported_build
--      dynamic_options += ['Environment="FWUPD_SYSCALL_FILTER=systemd"']
-       dynamic_options += ['SystemCallErrorNumber=EPERM']
-     else
-       # to debug what additional syscalls are required, we set SystemCallErrorNumber=SIGSYS
-diff --git a/docs/meson.build b/docs/meson.build
-index 6adb57ecf..e8e46de22 100644
---- a/docs/meson.build
-+++ b/docs/meson.build
-@@ -301,17 +301,4 @@ if build_docs
-     install_tag: 'doc',
-     install_dir: join_paths(datadir, 'doc', 'libfwupdplugin'),
-   )
--  #make devhelp work
--  install_symlink(
--    'libfwupd',
--    install_tag: 'doc',
--    install_dir: join_paths(datadir, 'doc', 'fwupd'),
--    pointing_to: join_paths('..', 'libfwupd'),
--  )
--  install_symlink(
--    'libfwupdplugin',
--    install_tag: 'doc',
--    install_dir: join_paths(datadir, 'doc', 'fwupd'),
--    pointing_to: join_paths('..', 'libfwupdplugin'),
--  )
- endif
-diff --git a/libfwupd/meson.build b/libfwupd/meson.build
-index 37ecc43ac..a0038e92d 100644
---- a/libfwupd/meson.build
-+++ b/libfwupd/meson.build
-@@ -180,7 +180,7 @@ pkgg.generate(
-   description: 'fwupd is a system daemon for installing device firmware',
- )
- 
--if introspection.allowed()
-+if introspection.enabled()
-   fwupd_gir_deps = [giounix, libcurl]
-   fwupd_gir = gnome.generate_gir(
-     fwupd,
-diff --git a/libfwupdplugin/meson.build b/libfwupdplugin/meson.build
-index 277c49424..7931b8a27 100644
---- a/libfwupdplugin/meson.build
-+++ b/libfwupdplugin/meson.build
-@@ -441,7 +441,7 @@ fwupdplugin_rs_dep = declare_dependency(
- )
- 
- fwupdplugin_gir_includes = []
--if introspection.allowed()
-+if introspection.enabled()
-   gir_dep = declare_dependency(
-     sources: fwupd_gir
-   )
-diff --git a/libfwupdplugin/tests/meson.build b/libfwupdplugin/tests/meson.build
-index 8cea8d2eb..86c0f0d46 100644
---- a/libfwupdplugin/tests/meson.build
-+++ b/libfwupdplugin/tests/meson.build
-@@ -97,11 +97,6 @@ install_data(
-   ['quirks.d/tests.quirk'],
-   install_dir: join_paths(installed_test_datadir, 'tests/quirks.d'),
- )
--install_symlink(
--  'localtime',
--  install_dir: join_paths(installed_test_datadir, 'tests'),
--  pointing_to: join_paths('America', 'New_York'),
--)
- 
- install_data(
-   ['bios-attrs/dell-xps13-9310/dell-wmi-sysman/attributes/pending_reboot'],
-diff --git a/meson.build b/meson.build
-index 51c2148af..5c76a7bdf 100644
---- a/meson.build
-+++ b/meson.build
-@@ -3,8 +3,8 @@ project(
-   'c',
-   version: '2.1.6',
-   license: 'LGPL-2.1-or-later',
--  meson_version: '>=0.63.0', # limited by RHEL-9
--  default_options: ['warning_level=2', 'c_std=c17'],
-+  meson_version: '>=0.58.2', # limited by RHEL-8
-+  default_options: ['warning_level=2', 'c_std=c11'],
- )
- 
- fwupd_version = meson.project_version()
-@@ -253,16 +253,16 @@ localedir = join_paths(prefix, get_option('localedir'))
- diffcmd = find_program('diff')
- glib = dependency(
-   'glib-2.0',
--  version: '>= 2.68.0',
-+  version: '>= 2.56.1',
-   include_type: 'system',
- ) # limited by RHEL-9, which has v2.68.4
- gio = dependency(
-   'gio-2.0',
--  version: '>= 2.68.0',
-+  version: '>= 2.56.1',
- ) # limited by RHEL-9, which has v2.68.4
- giounix = dependency(
-   'gio-unix-2.0',
--  version: '>= 2.68.0',
-+  version: '>= 2.56.1',
-   required: false,
- )
- if giounix.found()
-@@ -276,20 +276,18 @@ if get_option('udev_hotplug')
-   conf.set('HAVE_UDEV_HOTPLUG' , '1')
- endif
- if build_standalone
--  bluez = get_option('bluez').disable_auto_if(host_machine.system() != 'linux')
--  if bluez.allowed()
-+  bluez = get_option('bluez')
-+  if bluez.enabled()
-     conf.set('HAVE_BLUEZ', '1')
-   endif
-   host_cpu = host_machine.cpu_family()
--  hsi = get_option('hsi').require(host_machine.system() == 'linux').require(
--    host_cpu in ['x86', 'x86_64']
--  ).allowed()
-+  hsi = get_option('hsi').enabled()
-   if hsi
-     conf.set('HAVE_HSI', '1')
-   endif
-   libxmlb = dependency(
-     'xmlb',
--    version: '>= 0.3.19',
-+    version: '>= 0.1.15',
-     fallback: ['libxmlb', 'libxmlb_dep'],
-   )
-   if libxmlb.get_variable('zstd') == 'true'
-@@ -340,7 +338,7 @@ if build_standalone
-     'readline',
-     required: get_option('readline'),
-   )
--  if readline.found() and get_option('readline').allowed()
-+  if readline.found() and get_option('readline').enabled()
-     conf.set('HAVE_READLINE', '1')
-   endif
-   sqlite = dependency('sqlite3')
-@@ -351,7 +349,6 @@ if build_standalone
-     'passim',
-     version: '>= 0.1.6',
-     required: get_option('passim'),
--    fallback: ['passim', 'passim_dep'],
-   )
-   if passim.found()
-     conf.set('HAVE_PASSIM', '1')
-@@ -370,7 +367,7 @@ valgrind = dependency(
- )
- libcurl = dependency(
-   'libcurl',
--  version: '>= 7.62.0',
-+  version: '>= 7.61.1', # RHEL 8
- )
- libdrm = dependency(
-   'libdrm',
-@@ -380,7 +377,7 @@ if libdrm.found()
-   conf.set('HAVE_LIBDRM' , '1')
- endif
- polkit = dependency('polkit-gobject-1', version: '>= 0.103',
--         required: get_option('polkit').disable_auto_if(host_machine.system() != 'linux'))
-+         required: get_option('polkit'))
- if polkit.found()
-   conf.set('HAVE_POLKIT', '1')
-   if polkit.version().version_compare('>= 0.114')
-@@ -494,7 +491,7 @@ endif
- 
- libsystemd = dependency(
-   'libsystemd',
--  required: get_option('systemd').disable_auto_if(host_machine.system() != 'linux'),
-+  required: get_option('systemd'),
- )
- 
- if cc.has_header('sys/auxv.h')
-@@ -664,8 +661,8 @@ if build_standalone
- endif
- 
- logind = dependency(
--  'systemd', 'libelogind',
--  required: get_option('logind').disable_auto_if(host_machine.system() != 'linux'),
-+  'systemd',
-+  required: get_option('logind'),
- )
- 
- if logind.found()
-@@ -674,7 +671,7 @@ endif
- if libsystemd.found()
-   systemd = dependency(
-     'systemd',
--    version: '>= 249',
-+    version: '>= 239', # RHEL 8
-     required: get_option('systemd'),
-   )
-   conf.set('HAVE_SYSTEMD' , '1')
-@@ -712,7 +709,7 @@ if libsystemd.found()
-   endif
- endif
- 
--supported_build = get_option('supported_build').disable_auto_if(not tag).allowed()
-+supported_build = get_option('supported_build')
- if supported_build
-   conf.set('SUPPORTED_BUILD', '1')
- endif
-@@ -775,9 +772,7 @@ gobject_introspection_dep = dependency(
-   'gobject-introspection-1.0',
-   required: get_option('introspection'),
- )
--introspection = get_option('introspection').disable_auto_if(host_machine.system() != 'linux').disable_auto_if(
--  not gobject_introspection_dep.found()
--)
-+introspection = get_option('introspection')
- 
- gidocgen_dep = dependency(
-   'gi-docgen',
-@@ -790,17 +785,14 @@ gidocgen_app = find_program(
-   'gi-docgen',
-   required: gidocgen_dep.found(),
- )
--build_docs = gidocgen_dep.found() and gidocgen_app.found() and introspection.allowed()
-+build_docs = gidocgen_dep.found() and gidocgen_app.found() and introspection.enabled()
- 
- if build_docs and gidocgen_dep.version().version_compare('< 2022.2')
-   markdown_version = run_command(
-     [python3, '-c', 'import markdown; print(markdown.__version__)'],
-     check: true,
-   ).stdout().strip()
--  build_docs = get_option('docs').require(
--    markdown_version.version_compare('>=3.2'),
--    error_message: 'docs=enabled requires at least markdown >= 3.2',
--  ).allowed()
-+  build_docs = get_option('docs').enabled()
- endif
- 
- jinja2 = run_command(
-@@ -823,14 +815,12 @@ endif
- rustgen = generator(
-   python3,
-   output: ['@BASENAME@-struct.c', '@BASENAME@-struct.h'],
--  depfile: '@BASENAME@.deps',
-   arguments: [
-     join_paths(meson.project_source_root(), 'libfwupdplugin', 'rustgen.py'),
-     '--use', 'fwupd:@0@'.format(join_paths(meson.project_source_root(), 'libfwupdplugin')),
-     '@INPUT@',
-     '--outc', '@OUTPUT0@',
-     '--outh', '@OUTPUT1@',
--    '--depfile', '@DEPFILE@',
-     '--include',
-     'fwupdplugin.h',
-     '--prefix',
-@@ -844,13 +834,7 @@ dbusmock = run_command(
- )
- umockdev = dependency(
-   'umockdev-1.0',
--  required: get_option('umockdev_tests').require(dbusmock.returncode() == 0).require(
--    get_option('tests')
--  ).disable_auto_if(
--    not introspection.allowed()
--  ).disable_auto_if(
--    not run_sanitize_unsafe_tests
--  ),
-+  required: get_option('umockdev_tests')
- )
- 
- allow_uefi = host_machine.system() in ['linux', 'freebsd'] and \
-@@ -919,7 +903,7 @@ summary(
-     'vendor_ids_dir': vendor_ids_dir,
-     'docs': build_docs,
-     'gnutls': gnutls,
--    'introspection': introspection.allowed(),
-+    'introspection': introspection.enabled(),
-     'libblkid': libblkid,
-     'libdrm': libdrm,
-     'logind': logind,
-@@ -938,7 +922,7 @@ summary(
- if build_daemon
-   summary(
-     {
--      'bluez': bluez.allowed(),
-+      'bluez': bluez.enabled(),
-       'libusb': libusb,
-       'hsi': hsi,
-       'lvfs_metadata_format': lvfs_metadata_format,
-diff --git a/meson_options.txt b/meson_options.txt
-index 8f5a27620..196822f66 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -178,7 +178,7 @@ option(
- )
- option(
-   'supported_build',
--  type: 'feature',
-+  type: 'boolean',
-   description: 'distribution package with upstream support',
- )
- option(
-diff --git a/plugins/lenovo-thinklmi/meson.build b/plugins/lenovo-thinklmi/meson.build
-index b5218d4ea..9876a2268 100644
---- a/plugins/lenovo-thinklmi/meson.build
-+++ b/plugins/lenovo-thinklmi/meson.build
-@@ -16,7 +16,7 @@ plugin_builtin_lenovo_thinklmi = static_library('fu_plugin_lenovo_thinklmi',
- )
- plugin_builtins += plugin_builtin_lenovo_thinklmi
- 
--if get_option('tests')
-+if get_option('tests') and false
-   env = environment()
-   env.set('G_TEST_SRCDIR', meson.current_source_dir())
-   env.set('G_TEST_BUILDDIR', meson.current_build_dir())
-diff --git a/plugins/modem-manager/meson.build b/plugins/modem-manager/meson.build
-index 0cc7d51ed..4762b16bb 100644
---- a/plugins/modem-manager/meson.build
-+++ b/plugins/modem-manager/meson.build
-@@ -5,7 +5,7 @@ libmbim_glib = dependency('mbim-glib', version: '>= 1.28.0', required: get_optio
- libmm_glib.found() or subdir_done()
- libqmi_glib.found() or subdir_done()
- libmbim_glib.found() or subdir_done()
--get_option('plugin_modem_manager').allowed() or subdir_done()
-+get_option('plugin_modem_manager').enabled() or subdir_done()
- 
- cargs = ['-DG_LOG_DOMAIN="FuPluginMm"']
- cargs +=['-DMM_REQUIRED_VERSION="1.10.0"']
-diff --git a/plugins/test/meson.build b/plugins/test/meson.build
-index b9cf1c9a0..865ad24ff 100644
---- a/plugins/test/meson.build
-+++ b/plugins/test/meson.build
-@@ -1,7 +1,7 @@
- cargs = ['-DG_LOG_DOMAIN="FuPluginTest"']
- plugins += {meson.current_source_dir().split('/')[-1]: true}
- 
--if bluez.allowed()
-+if bluez.enabled()
-   plugin_quirks += files('test-ble.quirk')
- endif
- 
-@@ -16,7 +16,7 @@ plugin_builtins += static_library('fu_plugin_test',
-   dependencies: plugin_deps,
- )
- 
--if bluez.allowed()
-+if bluez.enabled()
- plugin_builtins += static_library('fu_plugin_test_ble',
-   sources: [
-     'fu-test-ble-plugin.c',
-diff --git a/src/meson.build b/src/meson.build
-index 6f149e243..6b65d18f5 100644
---- a/src/meson.build
-+++ b/src/meson.build
-@@ -15,7 +15,7 @@ engine_dep = [
-   fwupdplugin_rs_dep,
- ]
- 
--if get_option('passim').allowed()
-+if get_option('passim').enabled()
-   engine_dep += passim
- endif
- 
-@@ -72,7 +72,7 @@ endif
- if host_machine.system() in ['linux', 'android']
-   fwupd_engine_src += 'fu-udev-backend.c'
- endif
--if bluez.allowed()
-+if bluez.enabled()
-   fwupd_engine_src += 'fu-bluez-backend.c'
- endif
- 
--- 
-2.55.0
-

SOURCES/0001-Fix-the-seal-self-tests-when-building-on-a-tmpfs.patch

@@ -1,209 +0,0 @@
-From 2ed98c7c2e0ac77b9967933af51615385f7e471d Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Thu, 2 Jul 2026 14:47:33 +0100
-Subject: [PATCH] Fix the seal self tests when building on a tmpfs
-
-When fwupd is exploded onto a tmpfs the assumption of 'is a local file *not* a
-memfd' breaks. When fwupd is built using rpmbuild we do not control the
-buildroot filesystem, so make the 'is a sealed fd required' check more explicit.
----
- src/fu-dbus-daemon.c                     |  3 +
- src/fu-engine.c                          |  6 ++
- src/fu-unix-seekable-input-stream-test.c | 17 +++++-
- src/fu-unix-seekable-input-stream.c      | 70 ++++++++++++++++--------
- src/fu-unix-seekable-input-stream.h      |  2 +
- 5 files changed, 73 insertions(+), 25 deletions(-)
-
-diff --git a/src/fu-dbus-daemon.c b/src/fu-dbus-daemon.c
-index 72cc36fad..de8aa9a26 100644
---- a/src/fu-dbus-daemon.c
-+++ b/src/fu-dbus-daemon.c
-@@ -1158,6 +1158,9 @@ fu_dbus_daemon_invocation_get_input_stream(GDBusMethodInvocation *invocation, GE
- 	stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, error);
- 	if (stream == NULL)
- 		return NULL;
-+	if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
-+							error))
-+		return NULL;
- 	return g_steal_pointer(&stream);
- #else
- 	g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INTERNAL, "unsupported feature");
-diff --git a/src/fu-engine.c b/src/fu-engine.c
-index 9eaed95ab..5820ea891 100644
---- a/src/fu-engine.c
-+++ b/src/fu-engine.c
-@@ -5069,9 +5069,15 @@ fu_engine_update_metadata(FuEngine *self,
- 	stream_fd = fu_unix_seekable_input_stream_new(fd, TRUE, error);
- 	if (stream_fd == NULL)
- 		return FALSE;
-+	if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream_fd),
-+							error))
-+		return FALSE;
- 	stream_sig = fu_unix_seekable_input_stream_new(fd_sig, TRUE, error);
- 	if (stream_sig == NULL)
- 		return FALSE;
-+	if (!fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream_sig),
-+							error))
-+		return FALSE;
- 
- 	/* read the entire file into memory */
- 	bytes_raw =
-diff --git a/src/fu-unix-seekable-input-stream-test.c b/src/fu-unix-seekable-input-stream-test.c
-index d65b70add..3b5e8d8ec 100644
---- a/src/fu-unix-seekable-input-stream-test.c
-+++ b/src/fu-unix-seekable-input-stream-test.c
-@@ -84,6 +84,7 @@ static void
- fu_unix_seekable_input_stream_sealed_memfd_func(void)
- {
- #if defined(HAVE_GIO_UNIX) && defined(HAVE_MEMFD_CREATE)
-+	gboolean ret;
- 	g_autofd gint fd = -1;
- 	g_autoptr(GError) error = NULL;
- 	g_autoptr(GInputStream) stream = NULL;
-@@ -93,11 +94,18 @@ fu_unix_seekable_input_stream_sealed_memfd_func(void)
- 	g_assert_cmpint(fd, >=, 0);
- 	g_assert_cmpint(write(fd, data, sizeof(data)), ==, sizeof(data));
- 	g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0);
--	g_assert_cmpint(fcntl(fd, F_ADD_SEALS, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW), ==, 0);
-+	g_assert_cmpint(
-+	    fcntl(fd, F_ADD_SEALS, F_SEAL_SEAL | F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW),
-+	    ==,
-+	    0);
- 
- 	stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, &error);
- 	g_assert_no_error(error);
- 	g_assert_nonnull(stream);
-+	ret = fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
-+							 &error);
-+	g_assert_no_error(error);
-+	g_assert_true(ret);
- #else
- 	g_test_skip("No gio-unix-2.0 or memfd_create support, skipping");
- #endif
-@@ -107,6 +115,7 @@ static void
- fu_unix_seekable_input_stream_unsealed_memfd_func(void)
- {
- #if defined(HAVE_GIO_UNIX) && defined(HAVE_MEMFD_CREATE)
-+	gboolean ret;
- 	g_autofd gint fd = -1;
- 	g_autoptr(GError) error = NULL;
- 	g_autoptr(GInputStream) stream = NULL;
-@@ -118,8 +127,12 @@ fu_unix_seekable_input_stream_unsealed_memfd_func(void)
- 	g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0);
- 
- 	stream = fu_unix_seekable_input_stream_new(g_steal_fd(&fd), TRUE, &error);
-+	g_assert_no_error(error);
-+	g_assert_nonnull(stream);
-+	ret = fu_unix_seekable_input_stream_require_seal(FU_UNIX_SEEKABLE_INPUT_STREAM(stream),
-+							 &error);
- 	g_assert_error(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE);
--	g_assert_null(stream);
-+	g_assert_false(ret);
- #else
- 	g_test_skip("No gio-unix-2.0 or memfd_create support, skipping");
- #endif
-diff --git a/src/fu-unix-seekable-input-stream.c b/src/fu-unix-seekable-input-stream.c
-index 4955c366c..591173812 100644
---- a/src/fu-unix-seekable-input-stream.c
-+++ b/src/fu-unix-seekable-input-stream.c
-@@ -116,25 +116,6 @@ fu_unix_seekable_input_stream_seekable_iface_init(GSeekableIface *iface)
- 	iface->truncate_fn = fu_unix_seekable_input_stream_truncate;
- }
- 
--static gboolean
--fu_unix_seekable_input_stream_verify_sealed(gint fd, GError **error)
--{
--#ifdef HAVE_MEMFD_CREATE
--	gint seals = fcntl(fd, F_GET_SEALS);
--	if (seals >= 0 && (seals & (F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW)) !=
--			      (F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW)) {
--		g_set_error(error,
--			    FWUPD_ERROR,
--			    FWUPD_ERROR_INVALID_FILE,
--			    "fd is missing required seals, got 0x%x",
--			    (guint)seals);
--		return FALSE;
--	}
--#endif
--	/* success */
--	return TRUE;
--}
--
- /**
-  * fu_unix_seekable_input_stream_new:
-  * @fd: a UNIX file descriptor
-@@ -177,14 +158,57 @@ fu_unix_seekable_input_stream_new(gint fd, gboolean close_fd, GError **error)
- 		return NULL;
- 	}
- 
--	/* if the fd supports sealing (i.e. is a memfd) then require immutability */
--	if (!fu_unix_seekable_input_stream_verify_sealed(fd, error))
--		return NULL;
--
- 	/* success */
- 	return g_steal_pointer(&stream);
- }
- 
-+/**
-+ * fu_unix_seekable_input_stream_require_seal:
-+ * @stream: a #FuUnixSeekableInputStream
-+ * @error: (nullable): optional return location for an error
-+ *
-+ * Enforces that the file descriptor backing this stream is a memfd with the required seals set.
-+ *
-+ * Returns: %TRUE if sealed
-+ *
-+ * Since: 2.1.7
-+ **/
-+gboolean
-+fu_unix_seekable_input_stream_require_seal(FuUnixSeekableInputStream *stream, GError **error)
-+{
-+#ifdef HAVE_MEMFD_CREATE
-+	gint fd;
-+	gint seals;
-+
-+	g_return_val_if_fail(FU_IS_UNIX_SEEKABLE_INPUT_STREAM(stream), FALSE);
-+	g_return_val_if_fail(error == NULL || *error == NULL, FALSE);
-+
-+	fd = g_unix_input_stream_get_fd(G_UNIX_INPUT_STREAM(stream));
-+	seals = fcntl(fd, F_GET_SEALS);
-+	if (seals < 0) {
-+		/* not supported on this fd */
-+		return TRUE;
-+	}
-+	if ((seals & F_SEAL_SEAL) == 0) {
-+		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "fd not sealed");
-+		return FALSE;
-+	}
-+	if ((seals & F_SEAL_WRITE) == 0) {
-+		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no WRITE seal");
-+		return FALSE;
-+	}
-+	if ((seals & F_SEAL_SHRINK) == 0) {
-+		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no SHRINK seal");
-+		return FALSE;
-+	}
-+	if ((seals & F_SEAL_GROW) == 0) {
-+		g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_INVALID_FILE, "no GROW seal");
-+		return FALSE;
-+	}
-+#endif
-+	return TRUE;
-+}
-+
- static void
- fu_unix_seekable_input_stream_class_init(FuUnixSeekableInputStreamClass *klass)
- {
-diff --git a/src/fu-unix-seekable-input-stream.h b/src/fu-unix-seekable-input-stream.h
-index 5f0a0656a..6d7b2acde 100644
---- a/src/fu-unix-seekable-input-stream.h
-+++ b/src/fu-unix-seekable-input-stream.h
-@@ -18,3 +18,5 @@ G_DECLARE_FINAL_TYPE(FuUnixSeekableInputStream,
- 
- GInputStream *
- fu_unix_seekable_input_stream_new(gint fd, gboolean close_fd, GError **error);
-+gboolean
-+fu_unix_seekable_input_stream_require_seal(FuUnixSeekableInputStream *stream, GError **error);
--- 
-2.54.0
-

SOURCES/0001-Seal-memfds-for-compatibility-with-newer-fwupd-daemo.patch

@@ -1,42 +0,0 @@
-From f7352aa9e2157a5ed88d10278ef420a78c8a52f8 Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Thu, 2 Jul 2026 16:16:28 +0100
-Subject: [PATCH] Seal memfds for compatibility with newer fwupd daemons
-
----
- libfwupd/fwupd-common.c | 12 +++++++++++-
- 1 file changed, 11 insertions(+), 1 deletion(-)
-
-diff --git a/libfwupd/fwupd-common.c b/libfwupd/fwupd-common.c
-index 3220c40a7..862210c8a 100644
---- a/libfwupd/fwupd-common.c
-+++ b/libfwupd/fwupd-common.c
-@@ -1054,7 +1054,7 @@ fwupd_unix_input_stream_from_bytes(GBytes *bytes, GError **error)
- #endif
- 
- #ifdef HAVE_MEMFD_CREATE
--	fd = memfd_create("fwupd", MFD_CLOEXEC);
-+	fd = memfd_create("fwupd", MFD_CLOEXEC | MFD_ALLOW_SEALING);
- #else
- 	/* emulate in-memory file by an unlinked temporary file */
- 	fd = g_mkstemp(tmp_file);
-@@ -1098,6 +1098,16 @@ fwupd_unix_input_stream_from_bytes(GBytes *bytes, GError **error)
- 			    g_strerror(errno));
- 		return NULL;
- 	}
-+#ifdef HAVE_MEMFD_CREATE
-+	if (fcntl(fd, F_ADD_SEALS, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_SEAL) < 0) {
-+		g_set_error(error,
-+			    FWUPD_ERROR,
-+			    FWUPD_ERROR_INVALID_FILE,
-+			    "failed to seal memfd: %s",
-+			    strerror(errno));
-+		return NULL;
-+	}
-+#endif
- 	return G_UNIX_INPUT_STREAM(g_unix_input_stream_new(fd, TRUE));
- }
- 
--- 
-2.54.0
-

SOURCES/0001-trivial-Do-not-binary-compare-the-zlib-compressed-zi.patch

@@ -1,27 +0,0 @@
-From d5f4c2fb3c3d7936d9ada1e16f0172674720192b Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 7 Jul 2026 17:26:23 +0100
-Subject: [PATCH] trivial: Do not binary-compare the zlib-compressed zip file
-
-On s390x we get a valid hardware-accelerated zlib bitstream, but it's different
-from the libz software version.
----
- libfwupdplugin/fu-firmware-test.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libfwupdplugin/fu-firmware-test.c b/libfwupdplugin/fu-firmware-test.c
-index b53005705..d9656bfa8 100644
---- a/libfwupdplugin/fu-firmware-test.c
-+++ b/libfwupdplugin/fu-firmware-test.c
-@@ -1176,7 +1176,7 @@ fu_firmware_builder_round_trip_func(void)
- 	    },
- 	    {
- 		"zip-compressed.builder.xml",
--		"10792ff01b036ed89d11a6480694ccfd89c4d9fd",
-+		NULL, /* not byte-identical */
- 		FU_FIRMWARE_BUILDER_FLAG_NONE,
- 	    },
- 	};
--- 
-2.55.0
-

SOURCES/0001-trivial-Lower-supported-meson-version.patch

@@ -1,26 +0,0 @@
-From 998fb28785a2d059dd53c0dec71b56bcf16f116f Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 7 Jul 2026 16:06:12 +0100
-Subject: [PATCH 1/3] trivial: Lower supported meson version
-
-We don't actually need any newer version...
----
- meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/meson.build b/meson.build
-index 0652f48..eefadbe 100644
---- a/meson.build
-+++ b/meson.build
-@@ -1,7 +1,7 @@
- project('fwupd-efi', 'c',
-   version : '1.8',
-   license : 'LGPL-2.1+',
--  meson_version : '>=0.62.0',
-+  meson_version : '>=0.58.2',
-   default_options : ['warning_level=2', 'c_std=c99'],
- )
- 
--- 
-2.55.0
-

SOURCES/0002-Allow-skipping-setting-NX-dll-characteristics.patch

@@ -1,25 +0,0 @@
-From 86090bb11b7799a38e6ec1376d526dfcb8bdb669 Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 7 Jul 2026 16:07:04 +0100
-Subject: [PATCH 2/3] Allow skipping setting NX dll characteristics
-
----
- efi/generate_binary.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/efi/generate_binary.py b/efi/generate_binary.py
-index 3f76c24..8370f21 100755
---- a/efi/generate_binary.py
-+++ b/efi/generate_binary.py
-@@ -72,7 +72,7 @@ def _add_nx_pefile(args):
-         import pefile
-     except ImportError:
-         print("Unable to add NX support to binaries without genpeimg or python3-pefile")
--        sys.exit(1)
-+        return
- 
-     pe = pefile.PE(args.outfile)
-     pe.OPTIONAL_HEADER.DllCharacteristics |= pefile.DLL_CHARACTERISTICS[
--- 
-2.55.0
-

SOURCES/0003-trivial-Lower-required-version-of-gnu-efi.patch

@@ -1,25 +0,0 @@
-From 23f3ca09e49bcb4d71c47014819540de6e3df8af Mon Sep 17 00:00:00 2001
-From: Richard Hughes <richard@hughsie.com>
-Date: Tue, 7 Jul 2026 16:08:06 +0100
-Subject: [PATCH 3/3] trivial: Lower required version of gnu-efi
-
----
- meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/meson.build b/meson.build
-index eefadbe..4035cf8 100644
---- a/meson.build
-+++ b/meson.build
-@@ -13,7 +13,7 @@ cc_ld = find_program(cc.get_linker_id())
- objcopy = find_program('objcopy')
- objcopy_version = run_command(objcopy, '--version', check: true).stdout().split('\n')[0].split(' ')[-1]
- 
--gnuefi = dependency('gnu-efi', version: '>= 3.0.18')
-+gnuefi = dependency('gnu-efi', required: false)
- prefix = get_option('prefix')
- libdir = join_paths(prefix, get_option('libdir'))
- libexecdir = join_paths(prefix, get_option('libexecdir'))
--- 
-2.55.0
-

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - rhel-9
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.hardware-fwupd.tier0.functional}

sources

@@ -0,0 +1,8 @@
+SHA512 (fwupd-1.8.3.tar.xz) = 1044eb59b9dfb0c477b858564cc09f7bbbf59042aac84d133f83fb902342618bc8ffeddf816c706aea3ad473d5a3ca38b194b65e1d396e83764854b1d562d1ae
+SHA512 (fwupd-efi-1.3.tar.xz) = 582bc0298f773b3017fab317a392b6fe95a9d1698bfe17e56370515f4563c8d45c12f28ae52d304866e4b077043bb0c9d5c1abf4b75ded5f70b6d8ccad495ea5
+SHA512 (DBXUpdate-20100307-x64.cab) = f8ad56cf015f4cdc5c305856ff1f7a8589c25a2a671708c61883f427f38eb9b6a7abd3f2c8d79ef9d5076222255e42585917f8705a2a4b13f860bad4e02ec409
+SHA512 (DBXUpdate-20140413-x64.cab) = 75771876a2309fa8ca083c2e76520173d434229b7cacf1e7636bd9b1bc4f871d745c348b9792bfb65fd9f40ef54c25bb427b1431151e817e7050b7829456731a
+SHA512 (DBXUpdate-20160809-x64.cab) = c27c564999ae84515540f1a598cd0fd9ef3a80cdfaaf439f1c4cb04eaee0e73074548b6d76c21ca3af1ba9c4c0625907e821582998eb5617e33ecd412e6c8a13
+SHA512 (DBXUpdate-20200729-aa64.cab) = 7a0cea13ed9b645fd9f1d5e3410a451d83643a75f5dc603272b0771b093f2c012f9a19419160403631c250cf64127ad2ce1c8fa2079b04064af73fe85b9add33
+SHA512 (DBXUpdate-20200729-ia32.cab) = 578ec9cccf2001b8bfa54b66809a1662269677050e74bd3225536fbd2be56a8162c48669bd16ea553723580195df1693a28dc01fc1cf62ff06e36a2c5568f74f
+SHA512 (DBXUpdate-20200729-x64.cab) = b8b195167d286a3f16aaa7c89149a0d5b4c8f53080e3265758b912f250fa655533c603359b7d1c989ebad6953ce443809b3317ec1d00f750326945ee0537e43b