Properly handle fwupd update capsules

[dasJ]

Closes #85

$ sudo sbctl verify
Verifying file database and EFI images in /boot...
✓ /boot/EFI/BOOT/BOOTX64.EFI is signed
✓ /boot/EFI/Linux/nixos-generation-553.efi is signed
✓ /boot/EFI/Linux/nixos-generation-554.efi is signed
✓ /boot/EFI/Linux/nixos-generation-555.efi is signed
✓ /boot/EFI/Linux/nixos-generation-556.efi is signed
✓ /boot/EFI/Linux/nixos-generation-557.efi is signed
✓ /boot/EFI/Linux/nixos-generation-558.efi is signed
✓ /boot/EFI/Linux/nixos-generation-559.efi is signed
✓ /boot/EFI/Linux/nixos-generation-560.efi is signed
✓ /boot/EFI/Linux/nixos-generation-561.efi is signed
✓ /boot/EFI/Linux/nixos-generation-562.efi is signed
✓ /boot/EFI/Linux/nixos-generation-563.efi is signed
✓ /boot/EFI/nixos/fwupdx64.efi is signed
✓ /boot/EFI/systemd/systemd-bootx64.efi is signed

[RaitoBezarius]

Thank you for this cool change!

[blitz]

@dasJ Looks good. Can you maybe provide a happy path test in another PR? :) I think even testing that everything evualates with fwupd on is better than nothing.

[mweinelt]

This caused a regression against nixos-unstable.

error: The option `environment.etc."fwupd/uefi_capsule.conf".source' has conflicting definition values:
       - In `/nix/store/s2lni0idfkhs0lcnr8walzhdqzarfb0m-source/nixos/modules/system/etc/etc.nix': <derivation etc-uefi_capsule.conf>
       - In `/nix/store/s2lni0idfkhs0lcnr8walzhdqzarfb0m-source/nixos/modules/services/hardware/fwupd.nix': "/nix/store/nxv27wliyqqdxvp44mx715d2v568k9ym-fwupd-1.8.10/etc/fwupd/uefi_capsule.conf"
       Use `lib.mkForce value` or `lib.mkDefault value` to change the priority on any of these definitions.

[blitz]

@mweinelt Thanks for reporting. I've reverted this for now.

[lilyinstarlight]

I can confirm a slightly modified version of this PR (commit at lilyinstarlight@9404722) and NixOS/nixpkgs#220555 makes this work correctly

I just successfully did a BIOS update with secureboot enforcing using a UEFI capsule with fwupd

[mweinelt]

@lilyinstarlight PR in nixpkgs is merged. Please create a new pr on the repo.

[lilyinstarlight]

@lilyinstarlight PR in nixpkgs is merged. Please create a new pr on the repo.

I was going to give @dasJ a chance to since they did the harder work, but I've gone ahead and opened #131 now