The Trezor dependency (which enables support for the Trezor hardware wallet) was gated behind the
enablePythonEcdsa override prior to this change because the trezor python package used to depend on
the ecdsa python package which is marked insecure. However, modern versions of the trezor package no
longer depend on ecdsa so it should be enabled by default, like the Ledger hardware wallet package.
Archived upstream since 2026-02-23 (https://github.com/RaitaroH/adl).
None of the animdl providers work anymore, and animdl itself has not
been updated since 2024.
Assisted-by: claude-code with claude-opus-5[1m]-high
fwupd stopped honouring the FWUPD_EFIAPPDIR environment variable in
https://github.com/fwupd/fwupd/pull/9846; the location is a compile-time
constant (`EFI_APP_LOCATION`) since then, so setting the variable on
fwupd.service had no effect.
Drop `RuntimeDirectory` from the signing unit too: the directory is now
created and populated by the fwupd module, and RuntimeDirectoryPreserve
defaults to `no`, so systemd removed it (together with the unsigned app)
whenever the unit stopped -- which `partOf = fwupd.service` makes happen
on every fwupd restart.
Cover the whole path in the limine secure boot test, which so far never
enabled fwupd: it now asserts that both the unsigned app and the signed
variant end up in /run/fwupd-efi.
Assisted-by: claude-code with claude-opus-5[1m]-high
fwupd is now built with `efi_app_location = /run/fwupd-efi` so that
setups signing their EFI binaries (lanzaboote, sbctl, ...) can place the
signed app next to the unsigned one, which is impossible inside the
read-only store.
Nothing created that directory yet, so copy the unsigned app there from
`fwupd.fwupd-efi`. `C+` merges into an existing directory without
replacing files, so signed variants written by a bootloader module are
kept; the copy is refreshed whenever the rule (and thus the fwupd-efi
store path) changes.
Assisted-by: claude-code with claude-opus-5[1m]-high
This introduces a breaking change where the default location for EFI
apps are now in /run/fwupd-efi.
This is not breaking for lanzaboote users who already had the
environment variable setting but this setting was removed in
https://github.com/fwupd/fwupd/pull/9846.
Since 2.1.6 this no longer needs a meson.build patch: upstream exposes
the location as the `efi_app_location` meson option, which we already
set to point at the fwupd-efi store path. Point it at the runtime
directory instead; the NixOS module populates it from
`fwupd.fwupd-efi`.
Ref: https://github.com/fwupd/fwupd/issues/10202
Change-Id: Ie058ece7d284cbce960fdf0ce14a151f1cf269ca
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
Co-authored-by: Aliaksandr <grubian2@gmail.com>
Assisted-by: claude-code with claude-opus-5[1m]-high
The fwupd package ships /etc/grub.d/35_fwupd, which the module
symlinks unconditionally via filesInstalledToEtc.
Gate it on config.boot.loader.grub.enable option
so the hook only appears on GRUB systems.
Assisted-by: claude-code with Opus 4.7 xhigh
`nix-channel` reads its channel list from $HOME/.nix-channels, so running
it through a non-login `sudo`/`su` keeps the caller's $HOME and operates
on the wrong user's channels (e.g. `nix-channel --list` prints nothing).
Add a login-shell prerequisite before the first root command in the
upgrading chapter, so the commands that follow work as written, and
rewrite the per-user channel note to lead with what a login shell does
before describing the mistake.
Trim the `#`-prompt note in the preface to a single sentence; the
login-shell details belong next to the commands that need them.
Closes#27172
Assisted-by: claude-code with claude-opus-5[1m]-high
