I find these in the syslog every hour.  Not always every hour, but mostly so:

systemd[1]: Starting fwupd-refresh.service - Refresh fwupd metadata and update motd...
fwupdmgr[3722980]: Updating lvfs
systemd[1]: fwupd-refresh.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: fwupd-refresh.service: Failed with result 'exit-code'.
systemd[1]: Failed to start fwupd-refresh.service - Refresh fwupd metadata and update motd.

I can provide further detail and make tests if necessary

I should add that when called by root on the command line, `fwupdmgr refresh` works without errors

I should add that when called by root on the command line, `fwupdmgr refresh` works without errors

New evidence.

Once I add this (note the --json option to fwupdmgr):

===File /etc/systemd/system/fwupd-refresh.service.d/override.conf===
[Service]
DynamicUser=no
ExecStart=
ExecStart=/usr/bin/fwupdmgr --json refresh
============================================================

I get these on syslog:

 fwupdmgr[3604332]: {
 fwupdmgr[3604332]:   "Error": {
 fwupdmgr[3604332]:     "Domain": "FwupdError",
 fwupdmgr[3604332]:     "Code": 9,
 fwupdmgr[3604332]:     "Message": "Metadata is up to date; use --force to refresh again."
 fwupdmgr[3604332]:   }
 fwupdmgr[3604332]: }

Which, in my understanding, means that fwupdmgr refuses to annoy the database so often and returns an error because it is being called too often.

In fact pinging the database hourly as the Debian package does makes no sense to me.  So I added an override to run it weekly:

===File /etc/systemd/system/fwupd-refresh.timer.d/override.conf===
[Timer]
OnCalendar=
OnCalendar=weekly
============================================================

If I observe errors next week I will report that (hoping that I do not miss it).

Today I got this on syslog:

{
  "Error": {
    "Domain": "FwupdError",
    "Code": 4,
    "Message": "Failed to obtain auth"
  }
}

So it appears there are two problems.

# First problem: refresh too frequent

The first is that the refresh is done too often, that is, every hour.

# Second problem: auth fails under systemd, but not from the command line

Even after changing this to one week, as I have done, it does not work as it fails with auth.

It does work from the command line, though.  The following four commands were given immeditately one after the other:

# fwupdmgr --json refresh

# fwupdmgr --json refresh
{
  "Error": {
    "Domain": "FwupdError",
    "Code": 9,
    "Message": "Metadata is up to date; use --force to refresh again."
  }
}

tucano:~# fwupdmgr --json --force refresh

tucano:~# echo $?
0

Next, I changed the overrides so that fwupmgr is called every hour (as shipped by Debian) with both --force option to avoid an error because of strict timing and --json option to get the reason in case of failure.  This is what I get after one hour:

{
  "Error": {
    "Domain": "FwupdError",
    "Code": 4,
    "Message": "Failed to obtain auth"
  }
}

Which confirms that the problem is there: auth fails when executed by systemd, but works from the command line.  Here I am stuck.  Any suggestions on how to debug this?

We believe that the bug you reported is fixed in the latest version of
fwupd, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1141569@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mario Limonciello <superm1@debian.org> (supplier of updated fwupd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 27 Jul 2026 16:00:45 -0500
Source: fwupd
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 2.1.7-1
Distribution: unstable
Urgency: medium
Maintainer: Debian EFI <debian-efi@lists.debian.org>
Changed-By: Mario Limonciello <superm1@debian.org>
Closes: 1108201 1137540 1139344 1141569 1141921 1141944 1142129
Changes:
 fwupd (2.1.7-1) unstable; urgency=medium
 .
   * New upstream version (2.1.7)
   * Merge packaging with upstream.
     - Update python package deps (Closes: #1141944)
     - Update shebang (Closes: #1141921)
     - Detects unencrypted swap in more situations (Closes: #1108201)
     - Don't show errors from fwupd-refresh.service (Closes: #1141569, #1139344)
     - Don't show warnings for version command (Closes: #1137540)
     - Fixes regression in d/control (Closes: #1142129)
Checksums-Sha1:
 625002ed8366b328b77b1dca52fc65d69772c48e 3557 fwupd_2.1.7-1.dsc
 2c70ac202d4e653871daf1ca2bdcaabacbeb061c 7127883 fwupd_2.1.7.orig.tar.gz
 0728b4e0407366f3c6656d8b044595788f741cb6 30464 fwupd_2.1.7-1.debian.tar.xz
 20fc5dbdee01492194e509dc00a810ee950915b2 17930 fwupd_2.1.7-1_source.buildinfo
Checksums-Sha256:
 27dea9e5322708f23b3b650b7373657061a4469d3d129016f7b8841d58fcc1f0 3557 fwupd_2.1.7-1.dsc
 338ea5b139f9a37447ff2215d0a8d2cf23851fb5a39fba7b1b0ded52a40240cc 7127883 fwupd_2.1.7.orig.tar.gz
 bd20a926e68c97102113859b19e59d734eabf70bbaae4c095608bdd46365b7dc 30464 fwupd_2.1.7-1.debian.tar.xz
 57894a4e76351b86fdf0780dae42f4cc27cc751803b785d45b256977870214ed 17930 fwupd_2.1.7-1_source.buildinfo
Files:
 d09229c8351bdfdbd0445340c0816403 3557 admin optional fwupd_2.1.7-1.dsc
 e113d1ffd2898bbccb6729ae7867f1d2 7127883 admin optional fwupd_2.1.7.orig.tar.gz
 70ea165c2509cdd34c28807b6a708cfb 30464 admin optional fwupd_2.1.7-1.debian.tar.xz
 092799c47af28c0731ad5e24658a50f2 17930 admin optional fwupd_2.1.7-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJHBAEBCgAxFiEECwtuSU6dXvs5GA2aLRkspiR3AnYFAmpnxx4THHN1cGVybTFA
ZGViaWFuLm9yZwAKCRAtGSymJHcCdkjgEACA68eqClkZ9zztkolVp5rvfVzSvsiL
uf32wnKcsnR/IUmylWrW8dDyrd2sJQqGXFaM7w5zpYGRdEpnu+8kvIOvxi304AyC
BtdAsxdH0UvU6wlYLzCjtF6hC0MWOBdv+SZaJdoDzUHxVvBGBibT3PJJplzBsUUu
u2JX5J3V90wu8+xYSACLT/AI5xVXlcQ6vBzSql9+O25zpUh84e2oNBbRk/unIQR8
xYFK1s3fYVX6HhgL+ODK+4qdyOimRfRGS8Smhe2J8NUQhovwPosyrA6mNo9ltiq9
FN9LMTDao4mf1bUypnPoatwBLj8E+rvM5VBOoV4ay4Li7XEPu/ppU8xxMdR11XBp
J/BYYHPkdI49Ki2Uacn8iKCkgifCVssDrxfMkyosxRdrLLHmt3SrL//kEsZ3Skq9
LpchKSyDJ2Imhq7htyigqVYUORbA/glW0/hNwmkJwLC2VC/PwaLJxnRsCbZ5WA6L
Y3RJV6SLETmx7OmLql8dS5yFG27lmMYrT/AeQTTYJ3To6mL/5+obQR7P1H2fJIqf
2KKbUU9fqnxrl2tzxhAFhuVpSkJDlWlZlg8cB3ZSrWge/oB2aApb0tJ55q6P4nKg
H9I7RdqvtB7qViBJ9HwTyTA6tygl+rq56Vl5K1RtQ6Iefz6kS5s1017DBYK7L4pa
ohIdJ9Jo00ofdg==
=lQaA
-----END PGP SIGNATURE-----