[ Apologies, I thought I'd already sent this a couple of days
  back. :-( ]

Hey folks,

Related to the wider issue report in #1135716:

We should update fwupd in trixie to aid with the UEFI Secure Boot CA
updates process that I've laid out in

https://wiki.debian.org/SecureBoot/CAChanges

and in #1138871

Our initial expectations that 2.0.8 (already in trixie) would work for
these updates were proven to be incorrect. We'd therefore like to
update to 2.0.20 in trixie, which matches the existing bpo release. We
know that works, and the fact that it has already seen good testing in
-backports outweighs the downside of bumping by a number of upstream
releases here.

Mario has already prepped the changes in git, but not yet
uploaded. We'd like to get approval before doing that please.

The debdiff is large, too large to sensibly include in mail. :-(

See also https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138890

See also https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138890

Hi,

Please go ahead (unusually, yes without a debdiff - it's likely
unreviewable anyway, and I've done minimum checking in VCS including the
symbols file and that's probably as good as we're going to manage for this
one, no precedents).

I have not seen the changelog but the version should likely be
2.0.20-1~deb13u1, not +deb13u1. Please send the changelog if you want
advice before uploading.

Thanks,

Hi,

--- fwupd-2.0.8/debian/changelog	2026-05-05 04:24:33.000000000 +0000
+++ fwupd-2.0.20/debian/changelog	2026-06-04 22:35:20.000000000 +0000
@@ -1,9 +1,145 @@
-fwupd (2.0.8-3+deb13u1) trixie; urgency=medium
+fwupd (2.0.20-1~deb13u1) trixie; urgency=medium

-  * Non-maintainer upload.
-  * thunderbolt: Fix deploying the thunderbolt controller on the X280 (closes: #1123749)
+  * Release to stable updates to enable updating UEFI CA. (Closes: #1139251)

- -- Julien Cristau <jcristau@debian.org>  Tue, 05 May 2026 14:24:33 +1000
+ -- Mario Limonciello <superm1@debian.org>  Thu, 04 Jun 2026 17:35:20 -0500
+
+fwupd (2.0.20-1~bpo13+1) trixie-backports; urgency=medium

There are several problems with this changelog:

 - you have not integrated the NMU that was already in trixie
 - you're not uploading to stable-updates, just stable
 - do not close the request bug in your upload, that will be done later

I will reject so you can try again.

Thanks,

Hi,

--- fwupd-2.0.8/debian/changelog	2026-05-05 04:24:33.000000000 +0000
+++ fwupd-2.0.20/debian/changelog	2026-06-04 22:35:20.000000000 +0000
@@ -1,9 +1,145 @@
-fwupd (2.0.8-3+deb13u1) trixie; urgency=medium
+fwupd (2.0.20-1~deb13u1) trixie; urgency=medium

-  * Non-maintainer upload.
-  * thunderbolt: Fix deploying the thunderbolt controller on the X280 (closes: #1123749)
+  * Release to stable updates to enable updating UEFI CA. (Closes: #1139251)

- -- Julien Cristau <jcristau@debian.org>  Tue, 05 May 2026 14:24:33 +1000
+ -- Mario Limonciello <superm1@debian.org>  Thu, 04 Jun 2026 17:35:20 -0500
+
+fwupd (2.0.20-1~bpo13+1) trixie-backports; urgency=medium

There are several problems with this changelog:

 - you have not integrated the NMU that was already in trixie
 - you're not uploading to stable-updates, just stable
 - do not close the request bug in your upload, that will be done later

I will reject so you can try again.

Thanks,

IMHO that was correct, since the NMU was a backport of a change that is
already in 2.0.12-1 (according to #1123749 metadata).

cu
Adrian

Yeah; that was my expectation as well.

Regarding stable vs stable-updates, I thought that it gets remapped by
dak.  Is that not the case?  I saw this on my upload.

Mapping trixie to stable.
Mapping stable to proposed-updates.

https://www.debian.org/doc/manuals/developers-reference/pkgs.html#special-case-the-stable-updates-suite
  "Once the upload has been accepted to proposed-updates and is ready
   for release, the stable release managers will then copy it to the
   stable-updates suite and issue a Stable Update"

and like the previous package in stable-updates:
https://tracker.debian.org/news/1664770/accepted-systemd-2578-1deb13u2-source-into-proposed-updates/
https://lists.debian.org/debian-stable-announce/2025/09/msg00002.html

cu
Adrian

Those aren't stable-updates, which is the accelerated release route. You're
just doing stable, and the internal detail of it being via proposed-updates
is not relevant for readers of the changelog.

Hi,

Just for the avoidance of doubt (and not to nag) I'm awaiting an upload
from you with the same version number and the appropriate corrections.

Thanks,

Your new upload still targets stable-updates where it should be 'trixie' or
'stable'. Fortunately I can map that so I will not reject again but please
be mindful in future.

Thanks,

package release.debian.org
tags 1139251 = trixie pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian trixie.

Thanks for your contribution!

Upload details
==============

Package: fwupd
Version: 2.0.20-1~deb13u1

Explanation: enable UEFI CA/db/KEK updates for the 2026 Secure Boot certificate transition; fix UEFI PK/KEK/dbx enumeration; fix Thunderbolt controller deployment; correct firmware update regressions; update fwupd hardware support and tests

package release.debian.org
tags 1139251 = trixie pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian trixie.

Thanks for your contribution!

Upload details
==============

Package: fwupd
Version: 2.0.20-1~deb13u1

Explanation: enable UEFI CA/db/KEK updates for the 2026 Secure Boot certificate transition; fix UEFI PK/KEK/dbx enumeration; fix Thunderbolt controller deployment; correct firmware update regressions; update fwupd hardware support and tests