Linux fwupd

ID

fwupd

Home page

https://fwupd.org

Version requirement

>= 1.9.5

Platforms

🐧 Linux

Operations

installed · outdated · install · upgrade · upgrade_all · sync

purl types

pkg:fwupd

CLI name

fwupdmgr

Every call

fwupdmgr --assume-yes --no-reboot-check --no-device-prompt <command>

Issues and PRs

📦 manager: fwupd

Source

meta_package_manager/managers/fwupd.py

fwupd manages device firmware, treating each updatable device as a package.

Firmware inventory and updates come from the LVFS (Linux Vendor Firmware Service). Each package is keyed by its fwupd DeviceId, carrying the device name and current firmware version. mpm drives fwupdmgr in JSON mode (get-devices --json, get-updates --json), which sets the version floor at 1.9.5: the first release to emit JSON for get-devices.

Note

installed and outdated report only devices carrying the updatable flag: fixed or unsupported hardware is skipped even though fwupdmgr still lists it.

Note

No search (firmware has no name catalog to query) and no remove (firmware cannot be uninstalled). Flashing is forced non-interactive: no confirmation prompt, no reboot check, no device-selection prompt.

Note

Escalation is polkit’s job, so no operation is marked sudo: fwupdmgr is an unprivileged client handing requests to the fwupd daemon over D-Bus, which authorizes firmware writes through polkit, like pkcon and flatpak. Under a strict polkit policy, unattended mutations need a rule permitting them without interactive authentication.

What mpm adds to fwupd

mpm reaches across every manager at once, not fwupd alone: mpm installed and mpm outdated cover fwupd alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your fwupd commands, in mpm

You already know fwupd: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…

With fwupd

With mpm

List what’s installed

fwupdmgr get-devices --json

mpm --fwupd installed

List outdated packages

fwupdmgr get-updates --json

mpm --fwupd outdated

Install a package

fwupdmgr install 362301da643102b9f38477387e2193e57abaa590

mpm install pkg:fwupd/362301da643102b9f38477387e2193e57abaa590

Upgrade one package

fwupdmgr update 362301da643102b9f38477387e2193e57abaa590

mpm --fwupd upgrade 362301da643102b9f38477387e2193e57abaa590

Upgrade everything

fwupdmgr update

mpm --fwupd upgrade --all

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation

Supported

installed

✓

outdated

✓

orphans

search

install

✓

upgrade

✓

upgrade_all

✓

remove

sync

✓

cleanup

doctor

Selecting and configuring fwupd

Deselect fwupd for a single run with --no-fwupd, or persist the choice in your configuration:

[mpm]
fwupd = false

The arguments and environment variables listed in the box atop this page are forced on every fwupd call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.fwupd]
timeout = 900

mpm config-template fwupd prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around fwupd, one mpm command each:

  • Snapshot and clone a machine: mpm --fwupd dump fwupd.toml, then mpm restore fwupd.toml on the next one.

  • Export a compliance SBOM: mpm --fwupd sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of Linux fwupd’s release-age gating, from the cooldown support table:

  • Status: ➖ N/A (LVFS staged deployment)

  • Reference: LVFS news

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

  • Registry: LVFS

  • Retraction: Index revert over staged remotes: firmware moves through embargo, testing and stable, and “You should only move stable firmware to testing and stable after completing an end-to-end test with the embargo remote” (LVFS). No withdrawal from stable is documented

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is probed by running:

$ fwupdmgr --version
compile   com.hughsie.libxmlb           0.3.18
compile   com.hughsie.libjcat           0.2.0
compile   org.freedesktop.fwupd         1.9.24
runtime   org.freedesktop.fwupd-efi     1.4
compile   org.freedesktop.gusb          0.4.8
runtime   com.hughsie.libxmlb           0.3.x
runtime   org.freedesktop.gusb          0.4.8
runtime   com.hughsie.libjcat           0.2.0
runtime   org.freedesktop.fwupd         1.9.24
runtime   org.kernel                    6.8.0-48-generic

and extracted with:

r"compile\s+org\.freedesktop\.fwupd\s+(?P<version>\S+)\s+"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Linux fwupd well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ fwupdmgr --assume-yes --no-reboot-check --no-device-prompt get-devices --json
{
  "Devices": [
    {
      "Name": "USB2.0 Hub",
      "DeviceId": "7622d5fdbf1d1e08138156da7d83bf693986ad16",
      "ParentDeviceId" : "b5540761dfe33d9abccd3bb21f1d725f9e69f541",
      "CompositeId" : "b5540761dfe33d9abccd3bb21f1d725f9e69f541",
      "InstanceIds": [
        "USB\VID_17EF&PID_3080",
        "USB\VID_17EF&PID_3080&REV_5163",
        "USB\VID_17EF&PID_3080&HUB_20",
        "USB\VID_17EF&PID_3080&SPI_C220",
        "USB\VID_17EF&PID_3080&SPI_C220&REV_5163",
        "USB\VID_17EF&PID_3080&DEV_VL820Q7"
      ],
      "Guid": [
        "8ee94f0e-9b44-596a-bdd9-6f90401664cc",
        "35199e34-cf82-5b09-9287-622d225056e4",
        "0987e3c9-b1ee-5763-ac6e-51329b034e4b",
        "163cea66-5a78-58af-80ba-21be960aae5c",
        "c7def18d-66ae-5531-924b-2020c3638181"
      ],
      "Summary": "USB 3.x hub",
      "Plugin": "vli",
      "Protocol" : "com.vli.usbhub",
      "Flags": [
        "updatable",
        "registered",
        "can-verify",
        "can-verify-image",
        "dual-image",
        "self-recovery",
        "add-counterpart-guids",
        "unsigned-payload"
      ],
      "Vendor": "VIA Labs, Inc.",
      "VendorId" : "USB:0x17EF",
      "Version": "51.63",
      "VersionFormat" : "bcd",
      "VersionRaw": 20835,
      "Icons": [
        "usb-hub"
      ],
      "InstallDuration" : 15,
      "Created": 1686048073
    },
    {
      "DeviceId" : "20de1d77d0d1787bc56ef62f7d05de49361e1e07",
      "InstanceIds" : [
        "DRM\VEN_RHT&DEV_1234"
      ],
      "Guid" : [
        "90b1437c-86da-5374-a9a7-ceca8b0afd5e"
      ],
      "Plugin" : "linux_display",
      "Flags" : [
        "registered"
      ],
      "Created" : 1731659840
    },
    {
      "Name" : "UEFI dbx",
      "DeviceId" : "362301da643102b9f38477387e2193e57abaa590",
      "InstanceIds" : [
        "UEFI\CRT_E1FFABB40A30D9EE750BDA8BAF36ACA304FF20526138129247576B3339C54537&ARCH_AA64",
        "UEFI\CRT_A1117F516A32CEFCBA3F2D1ACE10A87972FD6BBE8FE0D0B996E09E65D802A503&ARCH_AA64"
      ],
      "Guid" : [
        "a9b31b16-b184-560f-97cb-1aa25e418c7d",
        "67d35028-ca5b-5834-834a-f97380381082"
      ],
      "Summary" : "UEFI revocation database",
      "Plugin" : "uefi_dbx",
      "Protocol" : "org.uefi.dbx",
      "Flags" : [
        "internal",
        "updatable",
        "supported",
        "registered",
        "needs-reboot",
        "usable-during-update",
        "only-version-upgrade",
        "signed-payload"
      ],
      "Checksums" : [
        "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
      ],
      "VendorId" : "UEFI:Linux Foundation",
      "Version" : "0",
      "VersionLowest" : "0",
      "VersionFormat" : "number",
      "Icons" : [
        "computer"
      ],
      "InstallDuration" : 1,
      "Created" : 1731659840,
      "Releases" : [
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "35289",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>Insecure versions of the Microsoft Windows boot manager affected by Black Lotus were added to the list of forbidden signatures due to a discovered security problem.This updates the dbx to the latest release from Microsoft.</p><p>Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.Applying this update may also cause some Windows install media to not start correctly.</p>",
          "Version" : "26",
          "Filename" : "DBXUpdate-20230509-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2022-21894"
          ],
          "Checksum" : [
            "46a42362cd34c0d103cf534ca431508d24715e51",
            "3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4610,
          "Created" : 1683590400,
          "Locations" : [
            "https://fwupd.org/downloads/3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6-DBXUpdate-20230509-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6-DBXUpdate-20230509-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        },
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "28503",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>An insecure version of software from vmware has been added to the list of forbidden signatures due to a discovered security problem.This updates the dbx to the latest release from Microsoft.</p><p>Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.</p>",
          "Version" : "22",
          "Filename" : "DBXUpdate-20230314-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2023-28005"
          ],
          "Checksum" : [
            "611e745638f05e9a11c2998cfba38f0bad651141",
            "533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4418,
          "Created" : 1678752000,
          "Locations" : [
            "https://fwupd.org/downloads/533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3-DBXUpdate-20230314-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3-DBXUpdate-20230314-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        },
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "15180",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>This updates the dbx to the latest release from Microsoft which adds insecure versions of grub and shim to the list of forbidden signatures due to multiple discovered security updates.</p>",
          "Version" : "21",
          "Filename" : "DBXUpdate-20220812-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2022-34303",
            "309662",
            "CVE-2022-34302",
            "CVE-2022-34301"
          ],
          "Checksum" : [
            "4032a1d8734e6085f4a6e4bb26a038eb639603b9",
            "bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4370,
          "Created" : 1595980800,
          "Locations" : [
            "https://fwupd.org/downloads/bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999-DBXUpdate-20220812-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999-DBXUpdate-20220812-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        }
      ]
    },
    {
      "Name" : "Virtio network device",
      "DeviceId" : "17076870bcf7a84a9c8e999d7e54e39b446032bb",
      "InstanceIds" : [
        "PCI\VEN_1AF4&DEV_1000",
        "PCI\VEN_1AF4&DEV_1000&SUBSYS_1AF40001"
      ],
      "Guid" : [
        "21c85fac-5270-576f-a84e-04969f8cf75a",
        "b93ef629-0df1-5505-9fee-6992b8b9abd8"
      ],
      "Plugin" : "optionrom",
      "Flags" : [
        "internal",
        "registered",
        "can-verify",
        "can-verify-image"
      ],
      "Vendor" : "Red Hat, Inc.",
      "VendorId" : "PCI:0x1AF4",
      "Created" : 1731659840
    }
  ]
}

$ fwupdmgr --assume-yes --no-reboot-check --no-device-prompt get-updates --json
{
  "Devices" : [
    {
      "Name" : "UEFI dbx",
      "DeviceId" : "362301da643102b9f38477387e2193e57abaa590",
      "InstanceIds" : [
        "UEFI\CRT_E1FFABB40A30D9EE750BDA8BAF36ACA304FF20526138129247576B3339C54537&ARCH_AA64",
        "UEFI\CRT_A1117F516A32CEFCBA3F2D1ACE10A87972FD6BBE8FE0D0B996E09E65D802A503&ARCH_AA64"
      ],
      "Guid" : [
        "a9b31b16-b184-560f-97cb-1aa25e418c7d",
        "67d35028-ca5b-5834-834a-f97380381082"
      ],
      "Summary" : "UEFI revocation database",
      "Plugin" : "uefi_dbx",
      "Protocol" : "org.uefi.dbx",
      "Flags" : [
        "internal",
        "updatable",
        "supported",
        "registered",
        "needs-reboot",
        "usable-during-update",
        "only-version-upgrade",
        "signed-payload"
      ],
      "Checksums" : [
        "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
      ],
      "VendorId" : "UEFI:Linux Foundation",
      "Version" : "0",
      "VersionLowest" : "0",
      "VersionFormat" : "number",
      "Icons" : [
        "computer"
      ],
      "InstallDuration" : 1,
      "Created" : 1731659840,
      "Releases" : [
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "35289",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>Insecure versions of the Microsoft Windows boot manager affected by Black Lotus were added to the list of forbidden signatures due to a discovered security problem.This updates the dbx to the latest release from Microsoft.</p><p>Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.Applying this update may also cause some Windows install media to not start correctly.</p>",
          "Version" : "26",
          "Filename" : "DBXUpdate-20230509-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2022-21894"
          ],
          "Checksum" : [
            "46a42362cd34c0d103cf534ca431508d24715e51",
            "3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4610,
          "Created" : 1683590400,
          "Locations" : [
            "https://fwupd.org/downloads/3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6-DBXUpdate-20230509-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6-DBXUpdate-20230509-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        },
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "28503",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>An insecure version of software from vmware has been added to the list of forbidden signatures due to a discovered security problem.This updates the dbx to the latest release from Microsoft.</p><p>Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.</p>",
          "Version" : "22",
          "Filename" : "DBXUpdate-20230314-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2023-28005"
          ],
          "Checksum" : [
            "611e745638f05e9a11c2998cfba38f0bad651141",
            "533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4418,
          "Created" : 1678752000,
          "Locations" : [
            "https://fwupd.org/downloads/533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3-DBXUpdate-20230314-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3-DBXUpdate-20230314-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        },
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "15180",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>This updates the dbx to the latest release from Microsoft which adds insecure versions of grub and shim to the list of forbidden signatures due to multiple discovered security updates.</p>",
          "Version" : "21",
          "Filename" : "DBXUpdate-20220812-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2022-34303",
            "309662",
            "CVE-2022-34302",
            "CVE-2022-34301"
          ],
          "Checksum" : [
            "4032a1d8734e6085f4a6e4bb26a038eb639603b9",
            "bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4370,
          "Created" : 1595980800,
          "Locations" : [
            "https://fwupd.org/downloads/bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999-DBXUpdate-20220812-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999-DBXUpdate-20220812-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        }
      ]
    }
  ]
}

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --fwupd installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

  • 7.4.0 (2026-07-25)

    • Mutating operations no longer escalate through sudo, aligning fwupd with the other polkit-native daemon clients (flatpak, pkcon): fwupdmgr hands firmware writes to the fwupd daemon over D-Bus, which authorizes them through polkit. Under a strict polkit policy, unattended mutations need a rule permitting them without interactive authentication, or an mpm run as root.

  • 7.1.0 (2026-07-07)

    • Fix version-pinned installs: the device ID and release version were joined into a single CLI argument that fwupdmgr could not parse.

  • 5.21.0 (2025-05-29)

    • Remove --offline parameter which has been silently disabled and has now been remove in v2.0.0 of fwupd. Refs #1511.

  • 5.20.0 (2024-11-25)

    • Add support for new fwupd manager. Closes #1289.