Since 99-hardening.conf is supposed to be symlinked as configuration,
it cannot be marked with %doc. Also add one more license file listed
in the License line, and clean things up a bit while at it.
[skip changelog]
Previously, the idea was that portabled is in -udev because it can be
used to implement generic services, incl. basic system functionality.
But it seems that nobody is doing that… People who _are_ packing
portables, are using them more like containers, i.e. to deliver
external payloads. So let's move it to the -container subpackage to
shrink -udev which is installed almost everywhere.
Also, fix bogus comment and fix typo, effectively moving updatectl to
-udev.
This adds the packaging required for
https://github.com/systemd/systemd/pull/42874. The build will work
with the changes here even before that the upstream changes are
merged and is in fact required for upstream CI to pass, so the plan
is to merge it early.
[skip changelog]
rpm -V systemd-udev would report that /var/lib/systemd/timesync/ has
wrong ownership. This happens because create the directory via %ghost
and it ends up with the default root:root ownership in the rpm %files
list. We _could_ fix the owernship in the listing, but it's actually OK
if the directory is owned by root or even some other account, as long as
the service is not running. Systemd will change owernship to the
systemd-timesync user:group when starting the service. Disabling of the
ownership verification makes it easier to precreate the timestamp (c.f.
https://src.fedoraproject.org/rpms/systemd/pull-request/238). So let's
just disable the owernship check.
This was first attempted in ec5e1b1ed7, together
with some other changes. Moving of getty@.service was wrong, because it is
needed in containers. But moving of the tpm2 stuff should be fine.
List of affected files:
/usr/lib/systemd/system-generators/systemd-tpm2-generator
/usr/lib/systemd/system/sysinit.target.wants/systemd-tpm2-setup-early.service
/usr/lib/systemd/system/sysinit.target.wants/systemd-tpm2-setup.service
/usr/lib/systemd/system/systemd-tpm2-clear.service
/usr/lib/systemd/system/systemd-tpm2-setup-early.service
/usr/lib/systemd/system/systemd-tpm2-setup.service
/usr/lib/systemd/system/tpm2.target
/usr/lib/systemd/systemd-tpm2-clear
/usr/lib/systemd/systemd-tpm2-setup
/usr/share/man/man8/systemd-tpm2-clear.service.8.gz
/usr/share/man/man8/systemd-tpm2-generator.8.gz
/usr/share/man/man8/systemd-tpm2-setup-early.service.8.gz
/usr/share/man/man8/systemd-tpm2-setup.8.gz
/usr/share/man/man8/systemd-tpm2-setup.service.8.gz
The previous commit fixed a lot of the test, but the '64bit cloud' and
'aarch64 cloud' tests still fail, there is no login prompt on the tty.
Also, make sure that the autovt@.service symlink is in -udev subpackage.
We want getty@.service to be enabled through presets, so that the
autovt@.service alias is created (or not). See
https://fedoraproject.org/wiki/Changes/UseKmsconVTConsole.
getty@.service was changed upstream to have a full [Install] section,
but we need to handle installation of the unit here. This will now
create the autovt@.service alias when enabled.
While looking at this, I noticed that the getty units are in the main
package. They don't have to be, virtual terminals are only available
if we have "hardware", i.e. the -udev subpackage is appropriate.
Same for the tpm2 stuff.
List of affected files:
/etc/systemd/system/getty.target.wants
/usr/lib/systemd/system-generators/systemd-getty-generator
/usr/lib/systemd/system-generators/systemd-tpm2-generator
/usr/lib/systemd/system/console-getty.service
/usr/lib/systemd/system/container-getty@.service
/usr/lib/systemd/system/getty-pre.target
/usr/lib/systemd/system/getty.target
/usr/lib/systemd/system/getty@.service
/usr/lib/systemd/system/multi-user.target.wants/getty.target
/usr/lib/systemd/system/serial-getty@.service
/usr/lib/systemd/system/sysinit.target.wants/systemd-tpm2-setup-early.service
/usr/lib/systemd/system/sysinit.target.wants/systemd-tpm2-setup.service
/usr/lib/systemd/system/systemd-tpm2-clear.service
/usr/lib/systemd/system/systemd-tpm2-setup-early.service
/usr/lib/systemd/system/systemd-tpm2-setup.service
/usr/lib/systemd/system/tpm2.target
/usr/lib/systemd/systemd-tpm2-clear
/usr/lib/systemd/systemd-tpm2-setup
/usr/share/man/man8/systemd-getty-generator.8.gz
/usr/share/man/man8/systemd-tpm2-clear.service.8.gz
/usr/share/man/man8/systemd-tpm2-generator.8.gz
/usr/share/man/man8/systemd-tpm2-setup-early.service.8.gz
/usr/share/man/man8/systemd-tpm2-setup.8.gz
/usr/share/man/man8/systemd-tpm2-setup.service.8.gz
I considered leaving getty.target in the main package, so that
foreign units that refer to it don't generate a warning about missing
units, but I think that those packages should not be installed on
systems without systemd-udev, so it's fine if the warning appears.
In the light of the recent discussion about dropping i686 packages, let's stop
building our docs there. This reduces the amount of tools needed in the mock
root.
Unfortunately we need to move the man page out of the noarch ukify subpackage,
because it needs to be the same on all architectures where it is built.
When testing build reproducibility, we got the following result:
+ rpmdiff cache/rpms/systemd-257.6-1.fc43/systemd-257.6-1.fc43.x86_64.rpm \
cache/build/systemd-257.6-1.fc43/rebuild/systemd-257.6-1.fc43.x86_64.rpm
......V..F. /etc/xdg/systemd/user
This is because we'd apply %ghost to a symlink to a directory, if the directory
stat reported 0 blocks. It seems that this depends on the filesystem type or
something and didn't pop up in previous rebuilds.
The first chunk is a noop to increase clarity.
The resulting difference from this patch in the file list:
$ diff -u systemd-257.6-build/systemd-257.6/.file-list-main{.0,}
-%config(noreplace) %ghost /etc/xdg/systemd/user
+%config(noreplace) /etc/xdg/systemd/user
... (rhbz#2344322)
rpm-libs has Requires:/usr/bin/systemd-sysusers.
We split split out /usr/bin/systemd-sysusers (the normal version) to a
subpackage, and the shared library
/usr/lib64/systemd/libsystemd-shared-257.2-14.fc42.so to a second subpackage.
(In preparation for maybe making further splits later.)
systemd-sysusers+libsystemd-shared.so is 4.8MB, but libsystemd-shared.so also
pulls in a bunch of libraries. We'll find out what the actual change in
installation footprint (compared to systemd-standalone-sysusers) really is when
we build some images with the new split.
- systemd-ac-power is moved to systemd-udev
- portablectl and importctl are moved to systemd-container (rhbz#2345551)
ac-power clearly is only useful for real hardware. portablectl
and importctl are niche tools that don't need to be in the main package
(even though they could theoretically be used not for containers).
... (rhbz#2328723)
The files systemd-networkd-generator generates are read by udev (.link files)
and by networkd (.netdev, .netdev files). We can't move it to systemd-networkd
subpackage only, because that would potentially break the corner case of people
having systemd-udev installed and using the generator, but not systemd-networkd.
And there is no dependency from systemd-networkd to systemd-udev. I think this
is correct, because networkd can be used in containers without udev. But the
generator is not useful without either of those two daemons, so let's move
it to make the core package a bit lighter.
Even on non-uefi architectures, ukify can be used to build UKIs for
UEFI images. For example, mkosi can use it to build UKIs on s390x.
To enable this use case, let's always build ukify, but with a conditional
dependency on systemd-boot only on arches that support UEFI.
Our config files in /etc/ were marked as %config(noreplace). This means that the
would not be replaced on upgraded if local modifications have been made. But
when we moved them to /usr/lib, they would be be renamed to .rpmsave, if they
had local modifications. This is not what I expected, but what rpm apparently
does. So we need to add them as %ghost to prevent the removal. This is probably
for the better anyway.
This is a bit of a mess: sshd can only load configuration from
/etc/ssh/sshd_config.d, and that directory is declared as non-world-readable.
This is in violation of the packaging guidelines which say that packaged files
must be world-readable, and also makes very little sense, since those files
are part of the package payload.
If we create the directory with different permissions, and list it in %files,
installation will fail. If we don't list it in %files, and the user doesn't have
openssh-server installed, they will have an unowned directory. Another option
would be to depend on owner of this directory, i.e. openssh-server, but we don't
want to have that dependency. So let's copy the %files line from openssh-server
and figure out what to do if it changes in openssh-server again.
We would fail later anyway, because rpm refuses %files with an empty filelist
file. But this is much later, after %check, so let's fail already in %install.
[skip changelog]
The idea was that it's nicer to keep that config in .spec where it's subject
to syntax highlighting. split-files.py was supposed to a stand-alone program.
But in practice this split is confusing, because file rules are listed in two
places and we need to modify split-files.py quite often. This will be easier if
everything is in one file.
[skip changelog]
... (for details see https://raw.githubusercontent.com/systemd/systemd/v252-rc1/NEWS)
systemd-pcrphase and systemd-measure and initrd-* units are moved to systemd-udev.
systemd-udev should be part of the initrd, and those tools don't make much sense
in systems without hardware (i.e. containers). (systemd-measure could possibly be
useful, but we can always move it back if there's a good reason.)
Now that the tmpfiles snippet is a separate file shipped as part
of the networkd package, we can ship the sysusers snippet as a part
of the networkd package as well.
