fwupd metadata bug due to outdated version in Ubuntu 22.04 repositories

[Paddy Landau]

The Ubuntu 22.04 repositories have fwupd version 1.7.9. This is a badly outdated version that cannot cope with some of the newer updates.

(This doesn't affect all updates, and so it affects only some machines depending on the hardware being supported.)

EXAMPLE:

$ fwupdmgr refresh
Failed to update metadata for lvfs: checksum failure: failed to verify data, expected 0a5a850327f8e8b196b2d79e79ce347cb86037f1

This has been discussed in the GitHub for fwupd:
https://github.com/fwupd/fwupd/issues/6888

This problem was solved in the newest version of fwupd.

LONG-TERM SOLUTION

Therefore, the Ubuntu repositories for 22.04 must be updated to have the latest version of fwupd.

It's not appropriate to use snap or flatpak, because they can be development versions rather than stable:
https://github.com/fwupd/fwupd?tab=readme-ov-file#compiling

WORKAROUND

For people currently having this problem, the current solution is to uninstall the apt version fwupd (this is important) and then install either the snap or flatpak version of fwupd. However, this should be a temporary solution as the snap and flatpak versions are for development rather than stable.

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: fwupd 1.7.9-1~22.04.3
ProcVersionSignature: Ubuntu 6.5.0-25.25~22.04.1-generic 6.5.13
Uname: Linux 6.5.0-25-generic x86_64
ApportVersion: 2.20.11-0ubuntu82.5
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Fri Mar 8 12:14:03 2024
InstallationDate: Installed on 2022-08-28 (558 days ago)
InstallationMedia: Ubuntu 22.04.1 LTS "Jammy Jellyfish" - Release amd64 (20220809.1)
SourcePackage: fwupd
UpgradeStatus: No upgrade log present (probably fresh install)
modified.conffile..etc.fwupd.remotes.d.lvfs-testing.conf: [modified]
modified.conffile..etc.fwupd.remotes.d.lvfs.conf: [modified]
mtime.conffile..etc.fwupd.remotes.d.lvfs-testing.conf: 2022-11-23T08:07:53.266347
mtime.conffile..etc.fwupd.remotes.d.lvfs.conf: 2022-11-23T08:07:53.358347

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Mario Limonciello (superm1)]

JFYI, Noble already has 1.9.14, this request is for Jammy. There are a bunch of other Jammy specific bugs that would be fixed by such a SRU.

https://bugs.launchpad.net/ubuntu/jammy/+source/fwupd

The SRU process (https://wiki.ubuntu.com/StableReleaseUpdate) has an exception for fwupd (https://wiki.ubuntu.com/firmware-updates) that /should/ allow migrating from 1.7.x to 1.9.x.

[Paddy Landau (paddy-landau)]

@superm1 — Thank you. I missed those when I was searching for the problem.

Bug #2028548 would solve this bug; it's not quite a duplicate, but it has the same solution.

It would also solve bug #1979963 — again, not a duplicate, but the same solution.

[Pavel Malyshev (afunix)]

Using fwupd from snap doesn't sound like a solution, more of a manual workaround.

People out there won't notice fwupd silently fails to update their firmware (currently it says "Not compatible with org.freedesktop.fwupd version 1.7.9, requires >= 1.9.1"). Which is likely to end up with an unpatched vulnerability in some firmware during 22.04 lifetime.

Also fwupd from snap is not maintained by Canonical, so it doesn't follow all the policies (including security) Canonical software follows.

[Pavel Malyshev (afunix)]

fwupd GitHub page states: "Installing fwupd using Snap or using Flatpak might be useful to update a specific device on the command line that needs a bleeding edge fwupd version, but it should not be considered as a replacement to the distro-provided system version."

fwupd snap does not have any timers to download or update firmware.
I can't consider fwupd snap to be a replacement for fwupd deb package.

[Paddy Landau (paddy-landau)]

@afunix — Thank you for that information about snap and flatpak, which I had missed. I'll update the bug report accordingly.

[Mario Limonciello (superm1)]

I've uploaded a 1.9.16 fwupd and 0.3.18 libxmlb (build-dependency for fwpud 1.9.16) to the archive for an SRU team member to review. It should fall under https://launchpad.net/~superm1/+archive/ubuntu/uefi/+packages

I've got build logs and a diff of the uploads posted at this PPA as well:
https://launchpad.net/~superm1/+archive/ubuntu/uefi/+packages

FYI - this does NOT cover focal.

[Timo Aaltonen (tjaalton)]

An upload of fwupd to mantic-proposed has been rejected from the upload queue for the following reason: "mantic will be EOL in six days".