Linux fwupd

ID

fwupd

Links

Home page · Documentation · Repository · Wikipedia

Upstream stars

⭐ 4,180

Last commit

2026-09-29

Version requirement

>= 1.9.5

Platforms

🐧 Linux

Operations

installed · outdated · install · upgrade · upgrade_all · sync

purl types

pkg:fwupd/

CLI name

fwupdmgr

Every call

fwupdmgr --assume-yes --no-reboot-check --no-device-prompt <command>

Issues and PRs

📦 manager: fwupd

Source

fwupd.py

fwupd manages device firmware, treating each updatable device as a package.

Firmware inventory and updates come from the LVFS (Linux Vendor Firmware Service). Each package is keyed by its fwupd DeviceId, carrying the device name and current firmware version. mpm drives fwupdmgr in JSON mode (get-devices --json, get-updates --json), which sets the version floor at 1.9.5: the first release to emit JSON for get-devices.

Flashing is forced non-interactive: no confirmation prompt, no reboot check, no device-selection prompt.

Note

Escalation is polkit’s job, so no operation is marked sudo: fwupdmgr is an unprivileged client handing requests to the fwupd daemon over D-Bus, which authorizes firmware writes through polkit, like pkcon and flatpak. Under a strict polkit policy, unattended mutations need a rule permitting them without interactive authentication.

What mpm adds to fwupd

mpm reaches across every manager at once, not fwupd alone: mpm installed and mpm outdated cover fwupd alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your fwupd commands, in mpm

You already know fwupd: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…

With fwupd

With mpm

List what’s installed

fwupdmgr get-devices --json

mpm --fwupd installed

List outdated packages

fwupdmgr get-updates --json

mpm --fwupd outdated

Install a package

fwupdmgr install 362301da643102b9f38477387e2193e57abaa590

mpm install pkg:fwupd/362301da643102b9f38477387e2193e57abaa590

Upgrade one package

fwupdmgr update 362301da643102b9f38477387e2193e57abaa590

mpm --fwupd upgrade 362301da643102b9f38477387e2193e57abaa590

Upgrade everything

fwupdmgr update

mpm --fwupd upgrade --all

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation

Supported

Notes

installed

✅

Only devices carrying the updatable flag are reported; fixed or unsupported hardware is skipped.

outdated

✅

Only devices carrying the updatable flag are reported; fixed or unsupported hardware is skipped.

orphans

search

❌

Firmware has no name catalog to query.

install

✅

upgrade

✅

upgrade_all

✅

remove

❌

Firmware cannot be uninstalled.

sync

✅

cleanup

doctor

Configuration

  • Ignore fwupd on the mpm CLI by passing the --no-fwupd option.

  • Ignore it for every run in your configuration:

    [mpm]
fwupd = false

  • Raise the timeout of all fwupd calls:

    [mpm.overrides.fwupd]
timeout = 900

  • Run mpm config-template fwupd to print all overridable settings for your configuration file:

    [mpm.overrides.fwupd]
cli_names = [
    "fwupdmgr",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = [
    "--assume-yes",
    "--no-reboot-check",
    "--no-device-prompt",
]
pre_cmds = []
requirement = ">=1.9.5"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    "compile\\s+org\\.freedesktop\\.fwupd\\s+(?P<version>\\S+)\\s+",
]

The arguments and environment variables listed in the box atop this page are forced on every fwupd call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes

A few jobs you would otherwise script around fwupd, one mpm command each:

  • Snapshot and clone a machine: mpm --fwupd dump fwupd.toml, then mpm restore fwupd.toml on the next one.

  • Export a compliance SBOM: mpm --fwupd sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown

State of Linux fwupd’s release-age gating, from the cooldown support table:

  • Status: ➖ N/A (LVFS staged deployment)

  • Reference: LVFS news

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

  • Registry: LVFS

  • Retraction: Index revert over staged remotes: firmware moves through embargo, testing and stable, and “You should only move stable firmware to testing and stable after completing an end-to-end test with the embargo remote” (LVFS). No withdrawal from stable is documented

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces

A collection of raw native outputs captured from the manager’s own CLI and recorded in the manager source. If you know Linux fwupd well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ fwupdmgr --assume-yes --no-reboot-check --no-device-prompt get-devices --json
{
  "Devices": [
    {
      "Name": "USB2.0 Hub",
      "DeviceId": "7622d5fdbf1d1e08138156da7d83bf693986ad16",
      "ParentDeviceId" : "b5540761dfe33d9abccd3bb21f1d725f9e69f541",
      "CompositeId" : "b5540761dfe33d9abccd3bb21f1d725f9e69f541",
      "InstanceIds": [
        "USB\VID_17EF&PID_3080",
        "USB\VID_17EF&PID_3080&REV_5163",
        "USB\VID_17EF&PID_3080&HUB_20",
        "USB\VID_17EF&PID_3080&SPI_C220",
        "USB\VID_17EF&PID_3080&SPI_C220&REV_5163",
        "USB\VID_17EF&PID_3080&DEV_VL820Q7"
      ],
      "Guid": [
        "8ee94f0e-9b44-596a-bdd9-6f90401664cc",
        "35199e34-cf82-5b09-9287-622d225056e4",
        "0987e3c9-b1ee-5763-ac6e-51329b034e4b",
        "163cea66-5a78-58af-80ba-21be960aae5c",
        "c7def18d-66ae-5531-924b-2020c3638181"
      ],
      "Summary": "USB 3.x hub",
      "Plugin": "vli",
      "Protocol" : "com.vli.usbhub",
      "Flags": [
        "updatable",
        "registered",
        "can-verify",
        "can-verify-image",
        "dual-image",
        "self-recovery",
        "add-counterpart-guids",
        "unsigned-payload"
      ],
      "Vendor": "VIA Labs, Inc.",
      "VendorId" : "USB:0x17EF",
      "Version": "51.63",
      "VersionFormat" : "bcd",
      "VersionRaw": 20835,
      "Icons": [
        "usb-hub"
      ],
      "InstallDuration" : 15,
      "Created": 1686048073
    },
    {
      "DeviceId" : "20de1d77d0d1787bc56ef62f7d05de49361e1e07",
      "InstanceIds" : [
        "DRM\VEN_RHT&DEV_1234"
      ],
      "Guid" : [
        "90b1437c-86da-5374-a9a7-ceca8b0afd5e"
      ],
      "Plugin" : "linux_display",
      "Flags" : [
        "registered"
      ],
      "Created" : 1731659840
    },
    {
      "Name" : "UEFI dbx",
      "DeviceId" : "362301da643102b9f38477387e2193e57abaa590",
      "InstanceIds" : [
        "UEFI\CRT_E1FFABB40A30D9EE750BDA8BAF36ACA304FF20526138129247576B3339C54537&ARCH_AA64",
        "UEFI\CRT_A1117F516A32CEFCBA3F2D1ACE10A87972FD6BBE8FE0D0B996E09E65D802A503&ARCH_AA64"
      ],
      "Guid" : [
        "a9b31b16-b184-560f-97cb-1aa25e418c7d",
        "67d35028-ca5b-5834-834a-f97380381082"
      ],
      "Summary" : "UEFI revocation database",
      "Plugin" : "uefi_dbx",
      "Protocol" : "org.uefi.dbx",
      "Flags" : [
        "internal",
        "updatable",
        "supported",
        "registered",
        "needs-reboot",
        "usable-during-update",
        "only-version-upgrade",
        "signed-payload"
      ],
      "Checksums" : [
        "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
      ],
      "VendorId" : "UEFI:Linux Foundation",
      "Version" : "0",
      "VersionLowest" : "0",
      "VersionFormat" : "number",
      "Icons" : [
        "computer"
      ],
      "InstallDuration" : 1,
      "Created" : 1731659840,
      "Releases" : [
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "35289",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>Insecure versions of the Microsoft Windows boot manager affected by Black Lotus were added to the list of forbidden signatures due to a discovered security problem.This updates the dbx to the latest release from Microsoft.</p><p>Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.Applying this update may also cause some Windows install media to not start correctly.</p>",
          "Version" : "26",
          "Filename" : "DBXUpdate-20230509-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2022-21894"
          ],
          "Checksum" : [
            "46a42362cd34c0d103cf534ca431508d24715e51",
            "3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4610,
          "Created" : 1683590400,
          "Locations" : [
            "https://fwupd.org/downloads/3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6-DBXUpdate-20230509-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6-DBXUpdate-20230509-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        },
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "28503",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>An insecure version of software from vmware has been added to the list of forbidden signatures due to a discovered security problem.This updates the dbx to the latest release from Microsoft.</p><p>Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.</p>",
          "Version" : "22",
          "Filename" : "DBXUpdate-20230314-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2023-28005"
          ],
          "Checksum" : [
            "611e745638f05e9a11c2998cfba38f0bad651141",
            "533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4418,
          "Created" : 1678752000,
          "Locations" : [
            "https://fwupd.org/downloads/533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3-DBXUpdate-20230314-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3-DBXUpdate-20230314-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        },
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "15180",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>This updates the dbx to the latest release from Microsoft which adds insecure versions of grub and shim to the list of forbidden signatures due to multiple discovered security updates.</p>",
          "Version" : "21",
          "Filename" : "DBXUpdate-20220812-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2022-34303",
            "309662",
            "CVE-2022-34302",
            "CVE-2022-34301"
          ],
          "Checksum" : [
            "4032a1d8734e6085f4a6e4bb26a038eb639603b9",
            "bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4370,
          "Created" : 1595980800,
          "Locations" : [
            "https://fwupd.org/downloads/bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999-DBXUpdate-20220812-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999-DBXUpdate-20220812-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        }
      ]
    },
    {
      "Name" : "Virtio network device",
      "DeviceId" : "17076870bcf7a84a9c8e999d7e54e39b446032bb",
      "InstanceIds" : [
        "PCI\VEN_1AF4&DEV_1000",
        "PCI\VEN_1AF4&DEV_1000&SUBSYS_1AF40001"
      ],
      "Guid" : [
        "21c85fac-5270-576f-a84e-04969f8cf75a",
        "b93ef629-0df1-5505-9fee-6992b8b9abd8"
      ],
      "Plugin" : "optionrom",
      "Flags" : [
        "internal",
        "registered",
        "can-verify",
        "can-verify-image"
      ],
      "Vendor" : "Red Hat, Inc.",
      "VendorId" : "PCI:0x1AF4",
      "Created" : 1731659840
    }
  ]
}

$ fwupdmgr --assume-yes --no-reboot-check --no-device-prompt get-updates --json
{
  "Devices" : [
    {
      "Name" : "UEFI dbx",
      "DeviceId" : "362301da643102b9f38477387e2193e57abaa590",
      "InstanceIds" : [
        "UEFI\CRT_E1FFABB40A30D9EE750BDA8BAF36ACA304FF20526138129247576B3339C54537&ARCH_AA64",
        "UEFI\CRT_A1117F516A32CEFCBA3F2D1ACE10A87972FD6BBE8FE0D0B996E09E65D802A503&ARCH_AA64"
      ],
      "Guid" : [
        "a9b31b16-b184-560f-97cb-1aa25e418c7d",
        "67d35028-ca5b-5834-834a-f97380381082"
      ],
      "Summary" : "UEFI revocation database",
      "Plugin" : "uefi_dbx",
      "Protocol" : "org.uefi.dbx",
      "Flags" : [
        "internal",
        "updatable",
        "supported",
        "registered",
        "needs-reboot",
        "usable-during-update",
        "only-version-upgrade",
        "signed-payload"
      ],
      "Checksums" : [
        "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
      ],
      "VendorId" : "UEFI:Linux Foundation",
      "Version" : "0",
      "VersionLowest" : "0",
      "VersionFormat" : "number",
      "Icons" : [
        "computer"
      ],
      "InstallDuration" : 1,
      "Created" : 1731659840,
      "Releases" : [
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "35289",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>Insecure versions of the Microsoft Windows boot manager affected by Black Lotus were added to the list of forbidden signatures due to a discovered security problem.This updates the dbx to the latest release from Microsoft.</p><p>Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.Applying this update may also cause some Windows install media to not start correctly.</p>",
          "Version" : "26",
          "Filename" : "DBXUpdate-20230509-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2022-21894"
          ],
          "Checksum" : [
            "46a42362cd34c0d103cf534ca431508d24715e51",
            "3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4610,
          "Created" : 1683590400,
          "Locations" : [
            "https://fwupd.org/downloads/3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6-DBXUpdate-20230509-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6-DBXUpdate-20230509-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        },
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "28503",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>An insecure version of software from vmware has been added to the list of forbidden signatures due to a discovered security problem.This updates the dbx to the latest release from Microsoft.</p><p>Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.</p>",
          "Version" : "22",
          "Filename" : "DBXUpdate-20230314-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2023-28005"
          ],
          "Checksum" : [
            "611e745638f05e9a11c2998cfba38f0bad651141",
            "533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4418,
          "Created" : 1678752000,
          "Locations" : [
            "https://fwupd.org/downloads/533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3-DBXUpdate-20230314-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3-DBXUpdate-20230314-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        },
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "15180",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>This updates the dbx to the latest release from Microsoft which adds insecure versions of grub and shim to the list of forbidden signatures due to multiple discovered security updates.</p>",
          "Version" : "21",
          "Filename" : "DBXUpdate-20220812-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2022-34303",
            "309662",
            "CVE-2022-34302",
            "CVE-2022-34301"
          ],
          "Checksum" : [
            "4032a1d8734e6085f4a6e4bb26a038eb639603b9",
            "bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4370,
          "Created" : 1595980800,
          "Locations" : [
            "https://fwupd.org/downloads/bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999-DBXUpdate-20220812-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999-DBXUpdate-20220812-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        }
      ]
    }
  ]
}

Version check

The version is probed by running:

$ fwupdmgr --version
compile   com.hughsie.libxmlb           0.3.18
compile   com.hughsie.libjcat           0.2.0
compile   org.freedesktop.fwupd         1.9.24
runtime   org.freedesktop.fwupd-efi     1.4
compile   org.freedesktop.gusb          0.4.8
runtime   com.hughsie.libxmlb           0.3.x
runtime   org.freedesktop.gusb          0.4.8
runtime   com.hughsie.libjcat           0.2.0
runtime   org.freedesktop.fwupd         1.9.24
runtime   org.kernel                    6.8.0-48-generic

and extracted with:

r"compile\s+org\.freedesktop\.fwupd\s+(?P<version>\S+)\s+"

Upstream project

Metrics

fwupd/fwupd

Activity

commit activity commits since open issues open pull requests

Popularity

forks watchers contributors

Metadata

latest release release date license main language

Changelog

  • 8.0.0 (2026-09-20)

    • Fix every query aborting on a host with no updatable device, which fwupd answers with an Error object in place of its device list, or with a device carrying no flags, name or version. Refs #1528.

  • 7.4.0 (2026-07-25)

    • Mutating operations no longer escalate through sudo, aligning fwupd with the other polkit-native daemon clients (flatpak, pkcon): fwupdmgr hands firmware writes to the fwupd daemon over D-Bus, which authorizes them through polkit. Under a strict polkit policy, unattended mutations need a rule permitting them without interactive authentication, or an mpm run as root.

  • 7.1.0 (2026-07-07)

    • Fix version-pinned installs: the device ID and release version were joined into a single CLI argument that fwupdmgr could not parse.

  • 5.21.0 (2025-05-29)

    • Remove --offline parameter which has been silently disabled and has now been remove in v2.0.0 of fwupd. Refs #1511.

  • 5.20.0 (2024-11-25)

    • Add support for new fwupd manager. Closes #1289.