Cleanup `shimx64-fedora.efi` from adopted installations (was: Can't upgrade UEFI dbx from 77 to 371)

Hello bootupd developers,

When I run

fwupdmgr update

and try to upgrade UEFI dbx from 77 to 371

╔══════════════════════════════════════════════════════════════════════════════╗
║ Upgrade UEFI dbx from 77 to 371?                                             ║
╠══════════════════════════════════════════════════════════════════════════════╣
║ Insecure versions of the Microsoft Windows boot manager affected by Black    ║
║ Lotus were added to the list of forbidden signatures due to a discovered     ║
║ security problem.This updates the dbx to the latest release from Microsoft.  ║
║                                                                              ║
║ Before installing the update, fwupd will check for any affected executables  ║
║ in the ESP and will refuse to update if it finds any boot binaries signed    ║
║ with any of the forbidden signatures.Applying this update may also cause     ║
║ some Windows install media to not start correctly.                           ║
║                                                                              ║
╚══════════════════════════════════════════════════════════════════════════════╝
Perform operation? [Y|n]: Y

I get the following error message:

Decompressing…           [                                       ]
Blocked executable in the ESP, ensure grub and shim are up to date: /boot/efi/EFI/fedora/shimx64-fedora.efi Authenticode checksum [0ce02100f67c7ef85f4eed368f02bf7092380a3c23ca91fd7f19430d94b00c19] is present in dbx

This even after I upgraded the system today and bootupd 0.2.25-1.fc41 got installed.

rpm-ostree status

● fedora:fedora/41/x86_64/silverblue
                  Version: 41.20241130.0 (2024-11-30T01:11:46Z)
               BaseCommit: 71b49b45ef9ed102aed5a48e5d20be664e00fe38893d6e2a39cb8e360a1fe206
             GPGSignature: Valid signature by 466CF2D8B60BC3057AA9453ED0622462E99D6AD1
          LayeredPackages: gnome-tweaks google-tinos-fonts rpmfusion-free-release rpmfusion-nonfree-release VirtualBox
            LocalPackages: Publii-0.46.1-1.x86_64 uld-1.00.39.12-2.fc38.x86_64

lsblk

NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
zram0       252:0    0     8G  0 disk [SWAP]
nvme0n1     259:0    0 476,9G  0 disk 
├─nvme0n1p1 259:1    0   600M  0 part /boot/efi
├─nvme0n1p2 259:2    0     1G  0 part /boot
└─nvme0n1p3 259:3    0 475,4G  0 part /var/home
                                      /var
                                      /sysroot/ostree/deploy/fedora/var
                                      /usr
                                      /etc
                                      /
                                      /sysroot

Let me know if you need the output of other commands!

Start by reproducing the failure with fwupdmgr update and inspect /boot/efi/EFI/fedora/shimx64-fedora.efi, using the reported Authenticode checksum as the affected artifact. Review how bootupd handles adopted Fedora installations and blocked ESP executables; done means the obsolete shim is cleaned up and the UEFI dbx update can proceed without this error.