--- Begin Message ---
Source: gnome-firmware
Severity: important
Tags: patch
Due to changes in the secure boot summarized in
https://wiki.debian.org/SecureBoot/CAChanges)
there needs to be an upgrade to a newer fwupd version in bookworm to allow
updating the trust
chain.
This work is tracked by release team in the bookworm-pu bug:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1139252
Unfortunately; upgrading to the newer fwupd version requires an ABI bump which
means some minor
patches for the ABI change and rebuilding against the newer libfwupd.
I've validated this works properly, and I would like permission to send up a
NMU coordinating
with the updated fwupd. The proposed debdiff is attached to the release team
bug.
diff -Nru gnome-firmware-43.2/debian/changelog
gnome-firmware-43.2/debian/changelog
--- gnome-firmware-43.2/debian/changelog 2023-02-15 16:52:29.000000000
-0600
+++ gnome-firmware-43.2/debian/changelog 2026-06-27 11:06:53.000000000
-0500
@@ -1,3 +1,11 @@
+gnome-firmware (43.2-1+deb12u1) bookworm; urgency=medium
+
+ * Backport patches from upstream for fwupd 2.x compat
+ * d/control:
+ - b/d on newer libfwupd
+
+ -- Mario Limonciello <[email protected]> Sat, 27 Jun 2026 11:06:53 -0500
+
gnome-firmware (43.2-1) unstable; urgency=medium
* New upstream release
diff -Nru gnome-firmware-43.2/debian/control gnome-firmware-43.2/debian/control
--- gnome-firmware-43.2/debian/control 2023-02-15 16:52:29.000000000 -0600
+++ gnome-firmware-43.2/debian/control 2026-06-27 11:06:53.000000000 -0500
@@ -15,7 +15,7 @@
dh-sequence-gnome,
help2man,
libadwaita-1-dev (>= 1.0.0),
- libfwupd-dev (>= 1.7.5),
+ libfwupd-dev (>= 2.0.20),
libglib2.0-dev,
libgtk-4-dev (>= 4.6),
libxmlb-dev (>= 0.1.7),
diff -Nru gnome-firmware-43.2/debian/control.in
gnome-firmware-43.2/debian/control.in
--- gnome-firmware-43.2/debian/control.in 2023-02-15 16:52:29.000000000
-0600
+++ gnome-firmware-43.2/debian/control.in 2026-06-27 11:06:53.000000000
-0500
@@ -11,7 +11,7 @@
dh-sequence-gnome,
help2man,
libadwaita-1-dev (>= 1.0.0),
- libfwupd-dev (>= 1.7.5),
+ libfwupd-dev (>= 2.0.20),
libglib2.0-dev,
libgtk-4-dev (>= 4.6),
libxmlb-dev (>= 0.1.7),
diff -Nru gnome-firmware-43.2/debian/patches/allow-fwupd-main-branch.patch
gnome-firmware-43.2/debian/patches/allow-fwupd-main-branch.patch
--- gnome-firmware-43.2/debian/patches/allow-fwupd-main-branch.patch
1969-12-31 18:00:00.000000000 -0600
+++ gnome-firmware-43.2/debian/patches/allow-fwupd-main-branch.patch
2026-06-27 11:04:26.000000000 -0500
@@ -0,0 +1,167 @@
+Description: Allow compiling with fwupd from the main branch
+ Many fwupd 2.0 API functions were removed or renamed, causing
+ compilation errors. Add #if FWUPD_CHECK_VERSION(2,0,0) conditional
+ compilation to support both fwupd 1.x and fwupd 2.x.
+Author: Richard Hughes <[email protected]>
+Origin:
https://salsa.debian.org/gnome-team/gnome-firmware/-/commit/851182b25b8bd4f79d849337fa4b8cf11b47178d
+Last-Update: 2026-06-27
+
+---
+Index: gnome-firmware-43.2/src/gfu-common.c
+===================================================================
+--- gnome-firmware-43.2.orig/src/gfu-common.c
++++ gnome-firmware-43.2/src/gfu-common.c
+@@ -362,26 +362,14 @@ gfu_common_device_flags_to_string(guint6
+ /* skip */
+ return NULL;
+ }
+- if (device_flag == FWUPD_DEVICE_FLAG_NO_AUTO_INSTANCE_IDS) {
+- /* skip */
+- return NULL;
+- }
+ if (device_flag == FWUPD_DEVICE_FLAG_NEEDS_ACTIVATION) {
+ /* TRANSLATORS: Device update needs to be separately activated
*/
+ return _("Device update needs activation");
+ }
+- if (device_flag == FWUPD_DEVICE_FLAG_ENSURE_SEMVER) {
+- /* skip */
+- return NULL;
+- }
+ if (device_flag == FWUPD_DEVICE_FLAG_HISTORICAL) {
+ /* skip */
+ return NULL;
+ }
+- if (device_flag == FWUPD_DEVICE_FLAG_ONLY_SUPPORTED) {
+- /* skip */
+- return NULL;
+- }
+ if (device_flag == FWUPD_DEVICE_FLAG_WILL_DISAPPEAR) {
+ /* TRANSLATORS: Device will not return after update completes */
+ return _("Device will not re-appear after update completes");
+@@ -523,12 +511,8 @@ gfu_common_device_icon_from_flag(FwupdDe
+ return "dialog-error-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_ANOTHER_WRITE_REQUIRED)
+ return "media-floppy-symbolic";
+- if (device_flag == FWUPD_DEVICE_FLAG_NO_AUTO_INSTANCE_IDS)
+- return "dialog-error-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_NEEDS_ACTIVATION)
+ return "emblem-important-symbolic";
+- if (device_flag == FWUPD_DEVICE_FLAG_ENSURE_SEMVER)
+- return "emblem-important-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_WILL_DISAPPEAR)
+ return "emblem-important-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_CAN_VERIFY)
+Index: gnome-firmware-43.2/src/gfu-main.c
+===================================================================
+--- gnome-firmware-43.2.orig/src/gfu-main.c
++++ gnome-firmware-43.2/src/gfu-main.c
+@@ -549,11 +549,25 @@ gfu_main_update_remotes_cb(GObject *sour
+ }
+ for (guint i = 0; i < remotes->len; i++) {
+ FwupdRemote *remote = g_ptr_array_index(remotes, i);
++#if FWUPD_CHECK_VERSION(2, 0, 0)
++ /* if another repository is turned on providing metadata */
+ g_debug("%s is %s",
+ fwupd_remote_get_id(remote),
+- fwupd_remote_get_enabled(remote) ? "enabled" :
"disabled");
+-
++ fwupd_remote_has_flag(remote,
FWUPD_REMOTE_FLAG_ENABLED) ? "enabled"
++ :
"disabled");
++ if (fwupd_remote_has_flag(remote, FWUPD_REMOTE_FLAG_ENABLED)) {
++ if (fwupd_remote_get_kind(remote) ==
FWUPD_REMOTE_KIND_DOWNLOAD)
++ enabled_any_download_remote = TRUE;
++ /* lvfs is present and disabled */
++ } else {
++ if (g_strcmp0(fwupd_remote_get_id(remote), "lvfs") == 0)
++ disabled_lvfs_remote = TRUE;
++ }
++#else
+ /* if another repository is turned on providing metadata */
++ g_debug("%s is %s",
++ fwupd_remote_get_id(remote),
++ fwupd_remote_get_enabled(remote) ? "enabled" :
"disabled");
+ if (fwupd_remote_get_enabled(remote)) {
+ if (fwupd_remote_get_kind(remote) ==
FWUPD_REMOTE_KIND_DOWNLOAD)
+ enabled_any_download_remote = TRUE;
+@@ -563,6 +577,7 @@ gfu_main_update_remotes_cb(GObject *sour
+ if (g_strcmp0(fwupd_remote_get_id(remote), "lvfs") == 0)
+ disabled_lvfs_remote = TRUE;
+ }
++#endif
+ }
+
+ w = GTK_WIDGET(gtk_builder_get_object(self->builder,
"infobar_enable_lvfs"));
+@@ -785,11 +800,20 @@ gfu_main_get_lvfs_remote_cb(GObject *sou
+ gfu_main_error_dialog(self, _("Failed to find LVFS"),
error->message);
+ return;
+ }
++#if FWUPD_CHECK_VERSION(2, 0, 0)
++ fwupd_client_refresh_remote_async(self->client,
++ remote,
++ FWUPD_CLIENT_DOWNLOAD_FLAG_NONE,
++ self->cancellable,
++ gfu_main_refresh_remote_cb,
++ self);
++#else
+ fwupd_client_refresh_remote_async(self->client,
+ remote,
+ self->cancellable,
+ gfu_main_refresh_remote_cb,
+ self);
++#endif
+ }
+
+ static void
+@@ -846,6 +870,19 @@ gfu_main_get_remotes_cb(GObject *source,
+ }
+ for (guint i = 0; i < remotes->len; i++) {
+ FwupdRemote *remote = g_ptr_array_index(remotes, i);
++#if FWUPD_CHECK_VERSION(2, 0, 0)
++ if (!fwupd_remote_has_flag(remote, FWUPD_REMOTE_FLAG_ENABLED))
++ continue;
++ if (fwupd_remote_get_kind(remote) != FWUPD_REMOTE_KIND_DOWNLOAD)
++ continue;
++ /* should this be a single async action? */
++ fwupd_client_refresh_remote_async(self->client,
++ remote,
++
FWUPD_CLIENT_DOWNLOAD_FLAG_NONE,
++ self->cancellable,
++ gfu_main_refresh_remote_cb,
++ self);
++#else
+ if (!fwupd_remote_get_enabled(remote))
+ continue;
+ if (fwupd_remote_get_kind(remote) != FWUPD_REMOTE_KIND_DOWNLOAD)
+@@ -856,6 +893,7 @@ gfu_main_get_remotes_cb(GObject *source,
+ self->cancellable,
+ gfu_main_refresh_remote_cb,
+ self);
++#endif
+ }
+ }
+
+@@ -1055,6 +1093,16 @@ static void
+ gfu_main_release_install(GfuMain *self)
+ {
+ /* begin installing, show loading animation */
++#if FWUPD_CHECK_VERSION(2, 0, 0)
++ fwupd_client_install_release_async(self->client,
++ self->device,
++ self->release,
++ self->flags |
FWUPD_INSTALL_FLAG_ALLOW_BRANCH_SWITCH,
++ FWUPD_CLIENT_DOWNLOAD_FLAG_NONE,
++ self->cancellable,
++ gfu_main_install_release_cb,
++ self);
++#else
+ fwupd_client_install_release2_async(self->client,
+ self->device,
+ self->release,
+@@ -1063,6 +1111,7 @@ gfu_main_release_install(GfuMain *self)
+ self->cancellable,
+ gfu_main_install_release_cb,
+ self);
++#endif
+ }
+
+ static GtkWidget *
diff -Nru
gnome-firmware-43.2/debian/patches/drop-device-flags-private-in-fwupd-2.0.0.patch
gnome-firmware-43.2/debian/patches/drop-device-flags-private-in-fwupd-2.0.0.patch
---
gnome-firmware-43.2/debian/patches/drop-device-flags-private-in-fwupd-2.0.0.patch
1969-12-31 18:00:00.000000000 -0600
+++
gnome-firmware-43.2/debian/patches/drop-device-flags-private-in-fwupd-2.0.0.patch
2026-06-27 11:06:53.000000000 -0500
@@ -0,0 +1,98 @@
+From de34a84f56280b28c5b9f45682f7640588f9948b Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <[email protected]>
+Date: Thu, 12 Sep 2024 23:38:50 -0500
+Subject: [PATCH] drop device flags that were turned private in fwupd 2.0.0
+
+These aren't useful to a user anyway on older versions, so don't
+worry about showing them based on what version gnome-firmware
+is compiled against.
+
+---
+ src/gfu-common.c | 40 ---------------------------------------
+ 1 file changed, 40 deletions(-)
+
+--- a/src/gfu-common.c
++++ b/src/gfu-common.c
+@@ -302,10 +302,6 @@ gfu_common_device_flags_to_string(guint64 device_flag)
+ /* TRANSLATORS: Device is updatable in this or any other mode */
+ return _("Updatable");
+ }
+- if (device_flag == FWUPD_DEVICE_FLAG_ONLY_OFFLINE) {
+- /* TRANSLATORS: Update can only be done from offline mode */
+- return _("Update requires a reboot");
+- }
+ if (device_flag == FWUPD_DEVICE_FLAG_REQUIRE_AC) {
+ /* TRANSLATORS: Must be plugged in to an outlet */
+ return _("System requires external power source");
+@@ -338,14 +334,6 @@ gfu_common_device_flags_to_string(guint64 device_flag)
+ /* TRANSLATORS: User has been notified */
+ return _("User has been notified");
+ }
+- if (device_flag == FWUPD_DEVICE_FLAG_USE_RUNTIME_VERSION) {
+- /* skip */
+- return NULL;
+- }
+- if (device_flag == FWUPD_DEVICE_FLAG_INSTALL_PARENT_FIRST) {
+- /* TRANSLATORS: Install composite firmware on the parent before
the child */
+- return _("Install to parent device first");
+- }
+ if (device_flag == FWUPD_DEVICE_FLAG_IS_BOOTLOADER) {
+ /* TRANSLATORS: Is currently in bootloader mode */
+ return _("Is in bootloader mode");
+@@ -354,10 +342,6 @@ gfu_common_device_flags_to_string(guint64 device_flag)
+ /* TRANSLATORS: The hardware is waiting to be replugged */
+ return _("Hardware is waiting to be replugged");
+ }
+- if (device_flag == FWUPD_DEVICE_FLAG_IGNORE_VALIDATION) {
+- /* TRANSLATORS: Ignore validation safety checks when flashing
this device */
+- return _("Ignore validation safety checks");
+- }
+ if (device_flag == FWUPD_DEVICE_FLAG_ANOTHER_WRITE_REQUIRED) {
+ /* skip */
+ return NULL;
+@@ -398,10 +382,6 @@ gfu_common_device_flags_to_string(guint64 device_flag)
+ /* TRANSLATORS: Device does not jump directly to the newest */
+ return _("Device installs all intermediate releases");
+ }
+- if (device_flag == FWUPD_DEVICE_FLAG_SKIPS_RESTART) {
+- /* TRANSLATORS: Device does not restart and requires a manual
action */
+- return _("Device skips restart");
+- }
+ if (device_flag == FWUPD_DEVICE_FLAG_HAS_MULTIPLE_BRANCHES) {
+ /* TRANSLATORS: the stream can be provided by different vendors
*/
+ return _("Device supports switching to a different stream of
firmware");
+@@ -481,8 +461,6 @@ gfu_common_device_icon_from_flag(FwupdDeviceFlags
device_flag)
+ return "drive-harddisk-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_UPDATABLE)
+ return "software-update-available-symbolic";
+- if (device_flag == FWUPD_DEVICE_FLAG_ONLY_OFFLINE)
+- return "network-offline-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_REQUIRE_AC)
+ return "battery-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_LOCKED)
+@@ -499,16 +477,10 @@ gfu_common_device_icon_from_flag(FwupdDeviceFlags
device_flag)
+ return "task-due-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_NOTIFIED)
+ return "task-due-symbolic";
+- if (device_flag == FWUPD_DEVICE_FLAG_USE_RUNTIME_VERSION)
+- return "system-run-symbolic";
+- if (device_flag == FWUPD_DEVICE_FLAG_INSTALL_PARENT_FIRST)
+- return "system-software-install-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_IS_BOOTLOADER)
+ return "computer-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_WAIT_FOR_REPLUG)
+ return "battery-low-symbolic";
+- if (device_flag == FWUPD_DEVICE_FLAG_IGNORE_VALIDATION)
+- return "dialog-error-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_ANOTHER_WRITE_REQUIRED)
+ return "media-floppy-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_NEEDS_ACTIVATION)
+@@ -525,8 +497,6 @@ gfu_common_device_icon_from_flag(FwupdDeviceFlags
device_flag)
+ return "emblem-important-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_INSTALL_ALL_RELEASES)
+ return "media-skip-forward-symbolic";
+- if (device_flag == FWUPD_DEVICE_FLAG_SKIPS_RESTART)
+- return "process-stop-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_HAS_MULTIPLE_BRANCHES)
+ return "emblem-shared-symbolic";
+ if (device_flag == FWUPD_DEVICE_FLAG_BACKUP_BEFORE_INSTALL)
diff -Nru gnome-firmware-43.2/debian/patches/series
gnome-firmware-43.2/debian/patches/series
--- gnome-firmware-43.2/debian/patches/series 2023-02-15 16:52:29.000000000
-0600
+++ gnome-firmware-43.2/debian/patches/series 2026-06-27 11:06:53.000000000
-0500
@@ -0,0 +1,2 @@
+allow-fwupd-main-branch.patch
+drop-device-flags-private-in-fwupd-2.0.0.patch
--- End Message ---
pgpXaqYOS5HwZ.pgp
