Bug#943465: fwupd is wrongly marked Multi-Arch: foreign

[Helmut Grohne <helmut@subdivi.de>]

Package: fwupd
Version: 1.3.2-5
Severity: important
User: debian-cross@lists.debian.org
Usertags: ftcbfs
Control: affects -1 + src:fwupd-armhf-signed

TL;DR: The *.efi images must not live in a M-A:foreign binary package.

fwupd is presently marked Multi-Arch: foreign. Likely for good reasons.
Unfortunately, this is subtly wrong. fwupd contains (unsigned) efi
binaries in /usr/lib/fwupd/efi. These binaries have
architecture-dependent names. When you cross build fwupd-armhf-signed
from amd64, it tries to sign fwupdx64.efi and the build fails.

Now we have two possible routes. Either fwupdx64.efi is part of the
interface of fwupd. Then clearly the interface is architecture-dependent
and the Multi-Arch: foreign marking is wrong. In the other case,
fwupd-armhf-signed is accessing an internal aspect of fwupd and must not
do that. The latter would essentially mean that cannot have
fwupd-armhf-signed, so the former seems more plausible.

Simply removing the foreign marking isn't going to make us much happier
either (though it might fix cross building fwupd-armhf-signed). I think
what we need here is recognizing that fwupd has both
architecture-independent and architecture-dependent interfaces. The
logical consequence is splitting the package into two (usually one being
M-A:foreign and the other M-A:same).

So I see two possible routes here:
 1. Remove M-A:foreign. (Nobody likes that)
 2. a. Move the efi packages to a separate non-M-A:foreign package.
    b. Have fwupd depend on that new package.
    c. Rename the fwupd dependency of fwupd-armhf-signed to that new
       package.

Helmut