fwupd comes as a UEFI binary today, so bootupd would actually take care of updating fwupd itself.

At the moment to schedule an update fwupd

• mounts the ESP if not already mounted
• copies the /usr/libexec/fwupd/efi/fwupdx64.efi.signed binary to EFI/fedora/fwupdx64.efi
• copies the firmware from the archive to EFI/fedora/fw/fwupd-{guid}.cap
• futzes with the BootOnce EFI key
• unmounts the ESP if it wasn't mounted before we started

...so we don't actually care if fwupdx64.efi is old or insecure or whatever, as it's going to be overwritten on next firmware update anyway. We could even mount->rm EFI/fedora/fwupdx64.efi -> unmount on next startup if that helps, although I'm not sure it's a helpful thing to do.

We did used to install into the ESP fro the rpm %install phase, but various distros don't automount the ESP (perhaps sensibly) and so we stopped doing that.

If I've massively misunderstood the problem, apologies.