Repository files navigation

This project aims to make updating firmware on Linux automatic, safe, and reliable.

Additional information is availableat the website.

• GitHub issues & discussions inthis repository

SeeBuilding and Debugging for how to build the fwupd development environment.

NOTE: In most cases, end users should not compile fwupd from scratch; it's acomplicated project with dozens of dependencies (and as many configuration options)and there's just too many things that can go wrong.

Users should just have fwupd installed and updated by their distro, managed andtested by the package maintainer.The distribution will have also done some testing with how fwupd interacts withother software on your system, for instance using GNOME Software.

Installing fwupd usingSnapor usingFlatpak might beuseful to update a specific device on the command line that needs a bleedingedge fwupd version, but it should not be considered as a replacement to thedistro-provided system version.

Tartan is a LLVM staticanalysis plugin built to analyze GLib code. It can be installed and then run using:

mkdir build-tartanCC=clang-17 meson ../SCANBUILD=../contrib/tartan.sh ninja scan-build

This project is configured by default to download firmware from theLinux VendorFirmware Service (LVFS).

This service is available to all OEMs and firmware creators who would like to maketheir firmware available to Linux users.

You can find more information about the technical details of creating a firmwarecapsule in the hardware vendors section of thefwupd website.

If you have a device with firmware supported by fwupd, this is how you can checkfor updates and apply them using fwupd's command line tools.

# fwupdmgr get-devices

This will display all devices detected by fwupd.

# fwupdmgr refresh

This will download the latest metadata from LVFS.

# fwupdmgr get-updates

If updates are available for any devices on the system, they'll be displayed.

# fwupdmgr update

This will download and apply all updates for your system.

• Updates that can be applied live will be done immediately.
• Updates that run at bootup will be staged for the next reboot.

You can find more information about the update workflow in the endusers section of thefwupd website.

If thePassim project is also installedand enabled, fwupd will re-publish the downloaded metadata file to be served on0.0.0.0:27500by default.

Other clients on the same network can make use of this via mDNS/LLMNR to reduce network bandwidthto configured remotes.

To disable this functionality either setP2pPolicy=none in/etc/fwupd/daemon.conf, uninstallthe passim package or usesystemctl mask passim.service on the terminal.

fwupd will encourage users to report both successful and failed updates backto LVFS. This is an optional feature, but encouraged as it provides valuablefeedback to LVFS administrators and OEM developers regarding firmware updateprocess efficacy.

The privacy policy regarding this data can be viewed on thelvfs readthedocs site.

To report the status of an update, run:

# fwupdmgr report-history

Only updates that were distributed from the LVFS will be reported to the LVFS.

The flow of updates can be controlled in the enterprise using the"approved updates" feature. This allows the domain administrator to filterthe possible updates from a central server (e.g. the LVFS, or a mirror)to only firmware that have been tested specifically in your organization.

The list of approved updates can be enabled by addingApprovalRequired=trueto the remote configuration file, e.g.lvfs.conf. Once enabled, thelist of approved updates can be set infwupd.conf using a comma-delimited list.

For example:

ApprovedFirmware=foo,bar

Wherefoo,bar refers to the container checksums that would correspondto two updates in the metadata file.

Additionally, the list of approved firmware can be supplemented usingfwupdmgr set-approved-firmware baz or using the D-Bus interface.

fwupdmgr is a command line client, but various additional graphical frontends are enumerated in thefwupdmgr man page.

• Coverity - static analyzer for Java, C/C++, C#, JavaScript, Ruby, and Python code.
• PVS-Studio - static analyzer for C, C++, C#, and Java code.