Your message dated Fri, 26 Jun 2026 17:47:05 +0000
with message-id <[email protected]>
and subject line Bug#1138871: fixed in fwupd 2.0.20-1~deb13u1
has caused the Debian Bug report #1138871,
regarding fwupd fails to find CA updates
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1138871: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138871
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: fwupd
Version: 2.0.8-3+deb13u1
Severity: important
Justification: urgently needed for rolling out CA updates
Hi,
I'm running fwupd in Trixie and expecting to get CA updates for the
machine it's running on. Unfortunately, it's not working. I've run
"fwupdtool refresh" and "fwupdtool get-updates" multiple times and
it's not happening. The latest output on this Thinkpad s
# fwupdtool get-updates
...
Devices with no available firmware updates:
• KEK CA
• KEK CA
• SBAT
• THNSF5256GPUK TOSHIBA
• ThinkPad Product CA
• UEFI CA
• UEFI CA
• UEFI dbx
• Windows Production PCA
Devices with the latest available firmware version:
• Embedded Controller
• Intel Management Engine
• System Firmware
No updates available for remaining devices
It doesn't have the 2023 CAs installed in DB:
# mokutil --db | grep Subject:.*Microsoft
Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation,
CN=Microsoft Corporation UEFI CA 2011
Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation,
CN=Microsoft Windows Production PCA 2011
------
On another similar Thinkpad running the backport version
2.0.20-1~bpo13+1, things worked flawlessly and I'm currently looking
at:
# fwupdtool get-updates
...
Devices with no available firmware updates:
• KEK CA
• UEFI Device Firmware
• UEFI Device Firmware
• UEFI Device Firmware
• UEFI Device Firmware
• UEFI Device Firmware
• Integrated Camera
• KEK CA
• Option ROM UEFI CA
• Prometheus (IOTA Config)
• SBAT
• ThinkPad Product CA
• UEFI CA
• WD BLACK SN850X 1000GB
• Windows Production PCA
Devices with the latest available firmware version:
• Embedded Controller
• Intel Management Engine
• System Firmware
• Prometheus
• UEFI CA
• UEFI dbx
No updates available for remaining devices
This machine updated fine on a previous run and has the latest keys in
DB:
# mokutil --db | grep Subject:.*Microsoft
Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation,
CN=Microsoft Corporation UEFI CA 2011
Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation,
CN=Microsoft Windows Production PCA 2011
Subject: C=US, O=Microsoft Corporation, CN=Microsoft UEFI CA 2023
Subject: C=US, O=Microsoft Corporation, CN=Microsoft Option ROM UEFI CA
2023
Although even here it's not picking up on the latest Windows CA that
I'd expect:
Subject: C=US, O=Microsoft Corporation, CN=Windows UEFI CA 2023
-- System Information:
Debian Release: 13.5
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500,
'stable'), (500, 'oldstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 6.12.90+deb13-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8),
LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages fwupd depends on:
ii libarchive13t64 3.7.4-4+deb13u1
ii libblkid1 2.41-5
ii libc6 2.41-12+deb13u3
ii libcbor0.10 0.10.2-2
ii libcurl3t64-gnutls 8.14.1-2+deb13u3
ii libdrm-amdgpu1 2.4.124-2
ii libdrm2 2.4.124-2
ii libflashrom1 1.4.0-3
ii libfwupd3 2.0.14-1
ii libglib2.0-0t64 2.84.4-3~deb13u3
ii libgnutls30t64 3.8.9-3+deb13u4
ii libjcat1 0.2.3-1
ii libjson-glib-1.0-0 1.10.6+ds-2
ii liblzma5 5.8.1-1
ii libmbim-glib4 1.32.0-1
ii libmbim-proxy 1.32.0-1
ii libmm-glib0 1.24.0-1+deb13u1
ii libpolkit-gobject-1-0 126-2
ii libprotobuf-c1 1.5.1-1
ii libqmi-glib5 1.36.0-1
ii libqmi-proxy 1.36.0-1
ii libsqlite3-0 3.46.1-7+deb13u1
ii libsystemd0 257.13-1~deb13u1
ii libtss2-esys-3.0.2-0t64 4.1.3-1.2
ii libusb-1.0-0 2:1.0.28-1
ii libxmlb2 0.3.22-1
ii shared-mime-info 2.4-5+b2
ii systemd [systemd-sysusers] 257.13-1~deb13u1
ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1
Versions of packages fwupd recommends:
ii bolt 0.9.8-1
ii dbus [default-dbus-system-bus] 1.16.2-2
ii fwupd-amd64-signed [fwupd-signed] 1:1.7+1
ii jq 1.7.1-6+deb13u2
ii python3 3.13.5-1
ii udisks2 2.10.1-12.1+deb13u1
Versions of packages fwupd suggests:
pn gir1.2-fwupd-2.0 <none>
-- Configuration Files:
/etc/fwupd/fwupd.conf [Errno 13] Permission denied: '/etc/fwupd/fwupd.conf'
/etc/fwupd/remotes.d/lvfs-testing.conf changed [not included]
-- debconf-show failed
--- End Message ---
--- Begin Message ---
Source: fwupd
Source-Version: 2.0.20-1~deb13u1
Done: Mario Limonciello <[email protected]>
We believe that the bug you reported is fixed in the latest version of
fwupd, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Mario Limonciello <[email protected]> (supplier of updated fwupd package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 25 Jun 2026 23:38:59 -0500
Source: fwupd
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 2.0.20-1~deb13u1
Distribution: stable-updates
Urgency: medium
Maintainer: Debian EFI <[email protected]>
Changed-By: Mario Limonciello <[email protected]>
Closes: 1138871
Changes:
fwupd (2.0.20-1~deb13u1) stable-updates; urgency=medium
.
* Release to stable updates to enable updating UEFI CA. (Closes: #1138871)
* Note: Fix deploying the thunderbolt controller on the X280 is now part of
the upstream release and the patch is dropped.
Checksums-Sha1:
2dca260ca5a4c14892796c07fcd1c680f4380a70 3539 fwupd_2.0.20-1~deb13u1.dsc
3e88ecd53bd333683a16df189b27a5ba18ed8389 29152
fwupd_2.0.20-1~deb13u1.debian.tar.xz
9609c01f8d81313b3e2dd91add3d90bb23e5eecf 17774
fwupd_2.0.20-1~deb13u1_source.buildinfo
Checksums-Sha256:
b70f58d2b40cf2330be6fe22e0ea7f5cab2afaba0c207618dc341d8b1ce88df2 3539
fwupd_2.0.20-1~deb13u1.dsc
ce95da58d060727c897f2c0425b9fa4f5c558cd17490f11e3138f81df8b308c6 29152
fwupd_2.0.20-1~deb13u1.debian.tar.xz
f634837a4914aa95dc4c03d8b44023f68c1e3f11d6de923fda9c7e1b7264bb6b 17774
fwupd_2.0.20-1~deb13u1_source.buildinfo
Files:
932b6d69c56e6ad1a104a3c18c015abc 3539 admin optional fwupd_2.0.20-1~deb13u1.dsc
443067c8151950ebd756e5d937d3044a 29152 admin optional
fwupd_2.0.20-1~deb13u1.debian.tar.xz
2b9f0f44bef6b05ff2ac7dee68b5bbce 17774 admin optional
fwupd_2.0.20-1~deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJHBAEBCgAxFiEECwtuSU6dXvs5GA2aLRkspiR3AnYFAmo+AosTHHN1cGVybTFA
ZGViaWFuLm9yZwAKCRAtGSymJHcCdlcVD/492GM1zvRIQVjkSMrKr0vYLB4QlnGN
YmdGPkhANyLC1Me4zloCfQEH0eG05PcAl2//cWy/sR9ay1HteeKl9XIvk2j4Hydh
ID19qvS6enC+2lVjTce6/a34niOabVuWhQFWSLY0b5GjQEjvHKWc6+dLns00Yblp
w+aqJE8mMDJdn21qkIL/M6nG1x2Y5CrpBVTDeEiHnkQfcWrW5W36YdgIG3xyDdgt
vv/yzRr4tVzqBL4YqqgDLM99Mb/jgW/ZPhbochTrsdgE/EQjYLn7VPjWWB4LYcRe
xlNzbuZxng6x8OyPwc+TRhie3dtF+Y5bcMQbL/q6ECkzC+Zb2O9dPltvqMXhYcT6
/2jXqzD5jp72Gt5RErCEgouMgMY0Fn6EnXwfcQn3IxwdjwMkttBnqZNESRw9rR9F
lxzQJVfbqnbTngL1cBwJ1c+b4E8zurEsTUOgxzdDOapb6w8qQnHeT1S/J5B1s88d
OT6mrTExTFCu8iF0TJvXrpSZcmKM6XN7caWF2/CCB4agzQJyycBluU+Bkrrc/Wgi
OBBr/WnTN64T9CoYM0MhMU7huPvax2Qu6z6XDcwm8FTIIysSomRvdburUuY33OrJ
Ke9JNuNXrWukFlTp4U7ofFNdYXKh0wEsBg2IDwJcQZEW5oJE0MP2UOZ99PtnEo+h
Xop9xDzWhUFAuQ==
=AGSp
-----END PGP SIGNATURE-----
pgpWM_dnzVVYU.pgp
Description: PGP signature
--- End Message ---
