Merge pull request #90539 from r-ryantm/auto-update/fwupd

nixos/modules/services/hardware/fwupd.nix

@@ -6,6 +6,23 @@ with lib;
 
 let
   cfg = config.services.fwupd;
+
+  customEtc = {
+    "fwupd/daemon.conf" = {
+      source = pkgs.writeText "daemon.conf" ''
+        [fwupd]
+        BlacklistDevices=${lib.concatStringsSep ";" cfg.blacklistDevices}
+        BlacklistPlugins=${lib.concatStringsSep ";" cfg.blacklistPlugins}
+      '';
+    };
+    "fwupd/uefi.conf" = {
+      source = pkgs.writeText "uefi.conf" ''
+        [uefi]
+        OverrideESPMountPoint=${config.boot.loader.efi.efiSysMountPoint}
+      '';
+    };
+  };
+
   originalEtc =
     let
       mkEtcFile = n: nameValuePair n { source = "${cfg.package}/etc/${n}"; };
@@ -96,22 +113,8 @@ in {
 
     environment.systemPackages = [ cfg.package ];
 
-    environment.etc = {
-      "fwupd/daemon.conf" = {
-        source = pkgs.writeText "daemon.conf" ''
-          [fwupd]
-          BlacklistDevices=${lib.concatStringsSep ";" cfg.blacklistDevices}
-          BlacklistPlugins=${lib.concatStringsSep ";" cfg.blacklistPlugins}
-        '';
-      };
-      "fwupd/uefi.conf" = {
-        source = pkgs.writeText "uefi.conf" ''
-          [uefi]
-          OverrideESPMountPoint=${config.boot.loader.efi.efiSysMountPoint}
-        '';
-      };
-
-    } // originalEtc // extraTrustedKeys // testRemote;
+    # customEtc overrides some files from the package
+    environment.etc = originalEtc // customEtc // extraTrustedKeys // testRemote;
 
     services.dbus.packages = [ cfg.package ];
 

pkgs/os-specific/linux/firmware/fwupd/default.nix

@@ -51,6 +51,7 @@
 , flashrom
 , tpm2-tools
 , nixosTests
+, runCommand
 }:
 
 let
@@ -83,15 +84,20 @@ let
   # Experimental
   haveFlashrom = false;
 
-in
+  runPythonCommand = name: buildCommandPython: runCommand name {
+    nativeBuildInputs = [ python3 ];
+      inherit buildCommandPython;
+  } ''
+    exec python3 -c "$buildCommandPython"
+  '';
 
-stdenv.mkDerivation rec {
+  self = stdenv.mkDerivation rec {
     pname = "fwupd";
-  version = "1.4.2";
+    version = "1.4.4";
 
     src = fetchurl {
       url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "1wch1n0z89ymfxx7ganiab4h64rdxr54rcg37n5nshw35bc3f390";
+      sha256 = "03yn96kxs53vxcbza17y99rdhbjlybv44gkc90vaj6301grxahnp";
     };
 
     # libfwupd goes to lib
@@ -241,11 +247,10 @@ stdenv.mkDerivation rec {
       done
     '';
 
-  # /etc/fwupd/uefi.conf is created by the services.hardware.fwupd NixOS module
     passthru = {
       filesInstalledToEtc = [
         "fwupd/ata.conf"
-      # "fwupd/daemon.conf" # already created by the module
+        "fwupd/daemon.conf"
         "fwupd/redfish.conf"
         "fwupd/remotes.d/lvfs-testing.conf"
         "fwupd/remotes.d/lvfs.conf"
@@ -253,7 +258,7 @@ stdenv.mkDerivation rec {
         "fwupd/remotes.d/vendor-directory.conf"
         "fwupd/thunderbolt.conf"
         "fwupd/upower.conf"
-      # "fwupd/uefi.conf" # already created by the module
+        "fwupd/uefi.conf"
         "pki/fwupd/GPG-KEY-Hughski-Limited"
         "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
         "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
@@ -271,8 +276,31 @@ stdenv.mkDerivation rec {
         "invalid"
       ];
 
-    tests = {
+      tests = let
+        listToPy = list: "[${stdenv.lib.concatMapStringsSep ", " (f: "'${f}'") list}]";
+      in {
         installedTests = nixosTests.installed-tests.fwupd;
+
+        passthruMatches = runPythonCommand "fwupd-test-passthru-matches" ''
+          import itertools
+          import configparser
+          import os
+          import pathlib
+
+          etc = '${self}/etc'
+          package_etc = set(itertools.chain.from_iterable([[os.path.relpath(os.path.join(prefix, file), etc) for file in files] for (prefix, dirs, files) in os.walk(etc)]))
+          passthru_etc = set(${listToPy passthru.filesInstalledToEtc})
+          assert len(package_etc - passthru_etc) == 0, f'fwupd package contains the following paths in /etc that are not listed in passthru.filesInstalledToEtc: {package_etc - passthru_etc}'
+          assert len(passthru_etc - package_etc) == 0, f'fwupd package lists the following paths in passthru.filesInstalledToEtc that are not contained in /etc: {passthru_etc - package_etc}'
+
+          config = configparser.RawConfigParser()
+          config.read('${self}/etc/fwupd/daemon.conf')
+          package_blacklisted_plugins = config.get('fwupd', 'BlacklistPlugins').rstrip(';').split(';')
+          passthru_blacklisted_plugins = ${listToPy passthru.defaultBlacklistedPlugins}
+          assert package_blacklisted_plugins == passthru_blacklisted_plugins, f'Default blacklisted plug-ins in the package {package_blacklisted_plugins} do not match those listed in passthru.defaultBlacklistedPlugins {passthru_blacklisted_plugins}'
+
+          pathlib.Path(os.getenv('out')).touch()
+        '';
       };
     };
 
@@ -282,4 +310,6 @@ stdenv.mkDerivation rec {
       license = [ licenses.gpl2 ];
       platforms = platforms.linux;
     };
-}
+  };
+
+in self