[UEFI] Adding snap support for Ubuntu < 22 and handling error code 2 for fwupgmgr refresh

[Rajasi Rane (rane-rajasi)]

This includes 2 updates:

1. Using snap to install fwupd for Ubuntu versions < 22. Refer: https://discourse.ubuntu.com/t/microsoft-uefi-ca-rotation-what-it-means-for-ubuntu-users-and-vendors/82652
2. Not marking return code = 2 for fwupdmgr refresh command as error. Refer: Exit code 2 (invalid arg) with fwupdmgr refresh when no metadata updates are found fwupd/fwupd#10208 and https://manpages.debian.org/trixie/fwupd/fwupdmgr.1.en.html

Tests Results:

1. [Success] Handling error code 2 for fwupdmgr refresh: Is not marked as an error: 2.status.txt, 2.core.log
2. [Failed due to snapd config] Using snap for Ubuntu < 22: 2.core.log, 2.status.txt

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.93%. Comparing base (adc7934) to head (ceb7609).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #382      +/-   ##
==========================================
+ Coverage   94.87%   94.93%   +0.06%     
==========================================
  Files         111      111              
  Lines       20844    20883      +39     
==========================================
+ Hits        19776    19826      +50     
+ Misses       1068     1057      -11     

Flag	Coverage Δ
python27	94.91% <100.00%> (+0.03%)	⬆️
python312	94.90% <100.00%> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR updates the Ubuntu (APT) certificate-update flow to (1) install fwupd via Snap on Ubuntu releases older than 22.04, and (2) treat fwupdmgr refresh exit code 2 (“no updates available”) as a non-error during certificate update.

Changes:

• Add Ubuntu-version gating in AptitudePackageManager to choose snap install fwupd on Ubuntu < 22.04, otherwise use apt-get install.
• Treat fwupdmgr refresh exit code 2 as success in the cert update shell-step runner.
• Extend unit tests and legacy env-layer command mocks to cover the new Snap install path and fwupd exit-code handling.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/core/tests/Test_AptitudePackageManager.py	Adds tests for Snap-vs-APT selection by Ubuntu version and for handling fwupd refresh/update exit codes.
src/core/tests/library/LegacyEnvLayerExtensions.py	Updates legacy command mocking to recognize snap install fwupd and less strict fwupdmgr refresh/update matching.
src/core/src/package_managers/AptitudePackageManager.py	Implements Snap gating for fwupd install and treats fwupd refresh exit code 2 as success in cert update flow.

Suppressed comments (1)

src/core/src/package_managers/AptitudePackageManager.py:108

• When is_snap_fwupd_required is True, the code still relies on running fwupdmgr by name (e.g., fwupdmgr --version, sudo fwupdmgr refresh). EnvLayer.run_command_output() runs commands with shell=True and does not modify the environment, so PATH may not include /snap/bin in non-interactive contexts. This can cause the cert update flow to fail with fwupdmgr: not found even after snap install fwupd succeeds. Consider using an explicit path when snap is required (e.g., /snap/bin/fwupdmgr) or ensuring /snap/bin is added to PATH for these invocations.

        self.is_snap_fwupd_required = self.__is_snap_fwupd_required()
        self.get_installed_fwupd_version_cmd = "fwupdmgr --version"
        self.install_fwupd_cmd = "sudo snap install fwupd" if self.is_snap_fwupd_required else "sudo apt-get install -y fwupd"
        self.fwupd_refresh_cmd = "sudo fwupdmgr refresh" # NOTE: This could be made generic in package manager, depending on what solution type is adopted for other distros
        self.fwupd_update_cmd = "sudo fwupdmgr update -y"

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Michelle McDaniel (michellemcdaniel)]

Looks like there are still some code coverage issues

[deepaksh-microsoft]

One suggestion here:
Can we change it to "sudo fwupdmgr refresh --force" ?
That way, we'd never see the ignorable error.