Commit ab743db0 made the dependency weak for %{with upstream} builds
only, because upstream 3327a411be3e ("vconsole-setup: handle gracefully
if setfont/loadkeys are not available") landed after v260 was released.
Rawhide now has v261.2, so the condition is always true here.
The hard requirement came from 01e2d8a9 (2020, rhbz#1408878), which
"upgraded" the Recommends originally added in 4ebba8aa. Now that
systemd-vconsole-setup logs a notice and skips keymap and font setup
when the binaries are absent, kbd is only needed to actually apply a
non-default console keymap or font.
This again lets minimal images that disable weak dependencies leave out
kbd together with the libxkbcommon, xkeyboard-config, and libxml2 chain
it pulls in: about 9 MB uncompressed. That particularly affects initrds,
which are unpacked into RAM.
Since 99-hardening.conf is supposed to be symlinked as configuration,
it cannot be marked with %doc. Also add one more license file listed
in the License line, and clean things up a bit while at it.
[skip changelog]
20-yama-ptrace.conf has the same (non-comment) content as
/usr/lib/sysctl.d/10-default-yama-scope.conf provided by
elfutils-default-yama-scope. We can drop our file.
And the new 99-kernel-hardening.conf provides a suitable replacement.
Instead of shipping /usr/sbin symlinks directly in the RPM, rely on
filesystem(unmerged-sbin-symlinks) file triggers to create them at
install time. This avoids file conflicts when the package (built on an
unmerged system) is installed into a merged-sbin buildroot, eliminating
the bootstrap ordering problem with the bin/sbin merge.
On unmerged systems, the filesystem file trigger creates the symlinks
when files are installed to /usr/bin. On merged systems, /usr/sbin is
already a symlink to bin so no action is needed.
The bcond defaults to enabled. Use --without sbin_compat to revert to
the old behavior of shipping sbin symlinks in the package.
They were supposed to apply on old rhel only, but applied
on Fedora too by mistake.
Also restore the old dracut workaround. It *is* a few years
old at this point, but it's not certain that the dracut patch
has been propagated everywhere so it's safe to keep it.
[skip changelog]
The test suite currently fails there during setup, because ELN ships
with a reduced package set and it's missing several tools that mkosi
expects to be available:
Updating and loading repositories:
Repositories loaded.
Failed to resolve the transaction:
No match for argument: apk
No match for argument: apt
No match for argument: apt-utils
No match for argument: archlinux-keyring
No match for argument: coccinelle
No match for argument: gh
No match for argument: gh
No match for argument: lcov
No match for argument: musl-clang
No match for argument: musl-gcc
No match for argument: musl-libc
No match for argument: pacman
No match for argument: python3-mypy
No match for argument: qemu-system-aarch64-core
No match for argument: qemu-system-ppc-core
No match for argument: qemu-system-s390x-core
No match for argument: ruff
No match for argument: sbsigntools
No match for argument: zypper
You can try to add to command line:
--skip-unavailable to skip unavailable packages
Switching the tools tree to Rawhide doesn't help either, as that breaks
other things:
Updating and loading repositories:
fedora 100% | 69.2 MiB/s | 20.9 MiB | 00m00s
>>> Downloading successful, but checksum doesn't match. Calculated: ...
cannot open file: (95) - Operation not supported [/var/cache/libdnf5/fedora-306b6523e9c8dc02/repodata/fc1f05fc361729498fd568dec450c1e27598bd38e3179f9b80ae01fbc8a0b74d-primary.xml.zck]
We can revisit this later if running the test suite on ELN is desirable.
The "skip" on ELN is slightly unconventional, as using "enabled: false"
here causes Packit to error.
[skip changelog]
There's a virtio/vsock bug in kernel 7.1-rc where a patch for a
potential overflow inadvertently shrunk the receive buffer's effective
size below what was configured, which eventually causes the vsock
connection to get reset with ENOBUFS, that kills the journal forwarding
over vsock:
read(7, ..., 16392): No buffer space available
Entry too big, skipped
read(8, ..., 16392): No buffer space available
Entry too big, skipped
read(12, ..., 16392): No buffer space available
Entry too big, skipped
Finishing after writing 6685 entries
This then affects other systemd components that try to write to the now
broken journal, causing them to fail as well.
Let's just bump the default vsock buffer size to work around this until
the kernel fix lands.
Pending fix: https://lore.kernel.org/netdev/20260518090656.134588-3-sgarzare@redhat.com/
[skip changelog]
Cap the number of parallel tests to 4 to not overwhelm beefier hosts.
I tried this with 8 jobs, but it often caused annoying timeouts in
nspawn-based tests; maybe this could be investigated and potentially
addressed in the future.
[skip changelog]
Unfortunately package-notes >= 0.18 are not available on CentoOS
Stream 9 and 10 right now. We actually want >= 0.20 for the best
expreience. Disable the requirement for now, to allow CI builds to
happen. This will need to be resolved before the builds are used for
real.
[skip changelog]
Previously, the idea was that portabled is in -udev because it can be
used to implement generic services, incl. basic system functionality.
But it seems that nobody is doing that… People who _are_ packing
portables, are using them more like containers, i.e. to deliver
external payloads. So let's move it to the -container subpackage to
shrink -udev which is installed almost everywhere.
Also, fix bogus comment and fix typo, effectively moving updatectl to
-udev.
This adds the packaging required for
https://github.com/systemd/systemd/pull/42874. The build will work
with the changes here even before that the upstream changes are
merged and is in fact required for upstream CI to pass, so the plan
is to merge it early.
[skip changelog]
This requires updated dlopen-notes. A version dependency is introduced.
The levels of various dendencies were adjusted, see comments.
The motivation for this change is to make management of the dependencies
(Requires, Recommends, Suggests). Previously, we had to adjust the
depencencies whenever things were converted to dlopen, or the list
of libraries used was changed. This was tedious and hard to get right.
Now we have good metadata provided by upstream, so we mostly rely on
that only only do some overrides downstream.
rpm -V systemd-udev would report that /var/lib/systemd/timesync/ has
wrong ownership. This happens because create the directory via %ghost
and it ends up with the default root:root ownership in the rpm %files
list. We _could_ fix the owernship in the listing, but it's actually OK
if the directory is owned by root or even some other account, as long as
the service is not running. Systemd will change owernship to the
systemd-timesync user:group when starting the service. Disabling of the
ownership verification makes it easier to precreate the timestamp (c.f.
https://src.fedoraproject.org/rpms/systemd/pull-request/238). So let's
just disable the owernship check.
- Various smaller and larger fixes
- A hint is emitted if init is called with the legacy
telinit args (rhbz#2479961)
- Various messages for missing dlopened libraries have been
downgraded (rhbz#2463540)
This reverts commit ee6d0b9d27.
The approach with dlopen-notes is not fully cooked yet. In particular,
the case where the note is present in a shared library, but we'd like to
declare the dependency for a binary which is a different package, is
not supported by rpm. Let's revert for now and come back to this later.
The idn feature is in libsystemd-shared, and systemd-resolved doesn't
contain any files that'd tie it to that shared library, so the
genarator doesn't generate this dependency. This is a fundamental
limitation of the rpm interface. Let's add a manual listing for now.
Similarly, systemd-udev would miss many relevant Requires.
It seems that the headers are gone on openssl-4.0.0~beta1. But already
we're seeing build failurs on i686 because openssl-devel-engine is not
available. Most likely multilib setup was borked. So let's drop this
now and hope that the providers in f45 will be good enough.
