From 23a1c1fed99e152d9c498204175a7643371a822c Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 25 Feb 2026 12:58:09 +0000 Subject: [PATCH 01/63] Install /usr/lib/systemd/boot/hwids/ in ukify package For https://github.com/systemd/systemd/pull/40541 --- split-files.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/split-files.py b/split-files.py index 38bde60..86d7f47 100644 --- a/split-files.py +++ b/split-files.py @@ -121,7 +121,7 @@ for file in files(buildroot): o = outputs['rpm-macros'] elif '/usr/lib/systemd/tests' in n: o = outputs['tests'] - elif 'ukify' in n and '/man/' not in n: + elif ('ukify' in n or '/hwids/' in n) and '/man/' not in n: o = outputs['ukify'] elif re.search(r'/libsystemd-core-.*\.so$', n): o = outputs['main'] @@ -254,7 +254,7 @@ for file in files(buildroot): o = outputs['udev'] elif re.search(r'''/boot/efi| - /usr/lib/systemd/boot| + /usr/lib/systemd/boot/efi| sd-boot|systemd-boot\.|loader.conf ''', n, re.X): o = outputs['boot'] From 0183bc784e4eeb97b33f26efa3e004b71ffa6cef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 25 Feb 2026 18:28:51 +0100 Subject: [PATCH 02/63] Version 260~rc1 - See https://raw.githubusercontent.com/systemd/systemd/v260-rc1/NEWS. Too many changes to list or discuss here. --- ...vert-units-drop-runlevel-0-6-.target.patch | 88 ------------------- ...continue-without-resolve.hook-socket.patch | 8 +- ...pdate-helper-use-enqueue-marked-jobs.patch | 32 +++++++ 38769.patch | 32 +++---- sources | 2 +- systemd.spec | 8 +- 6 files changed, 56 insertions(+), 114 deletions(-) delete mode 100644 0001-Revert-units-drop-runlevel-0-6-.target.patch create mode 100644 0003-rpm-systemd-update-helper-use-enqueue-marked-jobs.patch diff --git a/0001-Revert-units-drop-runlevel-0-6-.target.patch b/0001-Revert-units-drop-runlevel-0-6-.target.patch deleted file mode 100644 index faf8341..0000000 --- a/0001-Revert-units-drop-runlevel-0-6-.target.patch +++ /dev/null @@ -1,88 +0,0 @@ -From 61750e265ce3f7783a8dba831e91140f84ad89f2 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= -Date: Wed, 5 Nov 2025 17:52:16 +0100 -Subject: [PATCH 1/3] Revert "units: drop runlevel[0-6].target" - -This partially reverts commit e58ba80a40fb6e96543d56774a5bc5aa9cdadbf3. -The unit are still needed for compat. ---- - units/meson.build | 27 ++++++++++++++++++++++----- - 1 file changed, 22 insertions(+), 5 deletions(-) - -diff --git a/units/meson.build b/units/meson.build -index 2e04c4aa2b..46eaac4073 100644 ---- a/units/meson.build -+++ b/units/meson.build -@@ -1,5 +1,7 @@ - # SPDX-License-Identifier: LGPL-2.1-or-later - -+with_runlevels = conf.get('HAVE_SYSV_COMPAT') == 1 -+ - units = [ - { 'file' : 'basic.target' }, - { 'file' : 'blockdev@.target' }, -@@ -49,7 +51,7 @@ units = [ - }, - { - 'file' : 'graphical.target', -- 'symlinks' : ['default.target'], -+ 'symlinks' : ['default.target'] + (with_runlevels ? ['runlevel5.target'] : []), - }, - { 'file' : 'halt.target' }, - { -@@ -142,7 +144,10 @@ units = [ - 'conditions' : ['ENABLE_MACHINED'], - }, - { 'file' : 'modprobe@.service' }, -- { 'file' : 'multi-user.target' }, -+ { -+ 'file' : 'multi-user.target', -+ 'symlinks' : with_runlevels ? ['runlevel2.target', 'runlevel3.target', 'runlevel4.target'] : [], -+ }, - { - 'file' : 'systemd-mute-console.socket', - 'symlinks' : ['sockets.target.wants/'] -@@ -155,7 +160,10 @@ units = [ - { 'file' : 'nss-lookup.target' }, - { 'file' : 'nss-user-lookup.target' }, - { 'file' : 'paths.target' }, -- { 'file' : 'poweroff.target' }, -+ { -+ 'file' : 'poweroff.target', -+ 'symlinks' : with_runlevels ? ['runlevel0.target'] : [], -+ }, - { 'file' : 'printer.target' }, - { - 'file' : 'proc-sys-fs-binfmt_misc.automount', -@@ -180,7 +188,7 @@ units = [ - }, - { - 'file' : 'reboot.target', -- 'symlinks' : ['ctrl-alt-del.target'], -+ 'symlinks' : ['ctrl-alt-del.target'] + (with_runlevels ? ['runlevel6.target'] : []), - }, - { - 'file' : 'remote-cryptsetup.target', -@@ -200,7 +208,10 @@ units = [ - 'symlinks' : ['initrd-root-device.target.wants/'], - }, - { 'file' : 'rescue.service.in' }, -- { 'file' : 'rescue.target' }, -+ { -+ 'file' : 'rescue.target', -+ 'symlinks' : with_runlevels ? ['runlevel1.target'] : [], -+ }, - { 'file' : 'rpcbind.target' }, - { 'file' : 'serial-getty@.service.in' }, - { 'file' : 'shutdown.target' }, -@@ -1001,4 +1012,10 @@ else - dbussessionservicedir / 'org.freedesktop.systemd1.service')) - endif - -+if conf.get('HAVE_SYSV_COMPAT') == 1 -+ foreach i : [1, 2, 3, 4, 5] -+ install_emptydir(systemunitdir / 'runlevel@0@.target.wants'.format(i)) -+ endforeach -+endif -+ - subdir('user') diff --git a/0002-machined-continue-without-resolve.hook-socket.patch b/0002-machined-continue-without-resolve.hook-socket.patch index 2903c5e..4d7f401 100644 --- a/0002-machined-continue-without-resolve.hook-socket.patch +++ b/0002-machined-continue-without-resolve.hook-socket.patch @@ -1,17 +1,17 @@ -From 8d6d86d1d7e45eeae921e88adde55d6524027c96 Mon Sep 17 00:00:00 2001 +From 9b1828c629007953a7c0abdd4a830d2d65017570 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 26 Nov 2025 22:29:53 +0100 -Subject: [PATCH 3/3] machined: continue without resolve.hook socket +Subject: [PATCH 2/2] machined: continue without resolve.hook socket --- src/machine/machined-varlink.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/machine/machined-varlink.c b/src/machine/machined-varlink.c -index f83cbb8562..0b30cd0531 100644 +index 543e4c8ee7..04091b9674 100644 --- a/src/machine/machined-varlink.c +++ b/src/machine/machined-varlink.c -@@ -894,9 +894,15 @@ static int manager_varlink_init_resolve_hook(Manager *m) { +@@ -881,9 +881,15 @@ static int manager_varlink_init_resolve_hook(Manager *m) { r = sd_varlink_server_listen_address(s, VARLINK_PATH_MACHINED_RESOLVE_HOOK, 0666 | SD_VARLINK_SERVER_MODE_MKDIR_0755); diff --git a/0003-rpm-systemd-update-helper-use-enqueue-marked-jobs.patch b/0003-rpm-systemd-update-helper-use-enqueue-marked-jobs.patch new file mode 100644 index 0000000..ddb665c --- /dev/null +++ b/0003-rpm-systemd-update-helper-use-enqueue-marked-jobs.patch @@ -0,0 +1,32 @@ +From ecab24999254a2601c5fb13686ab986ff40427ba Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= +Date: Wed, 25 Feb 2026 22:04:16 +0100 +Subject: [PATCH] rpm/systemd-update-helper: use 'enqueue-marked-jobs' + +Without this, a warning is emitted on upgrades. +--- + src/rpm/systemd-update-helper.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/rpm/systemd-update-helper.in b/src/rpm/systemd-update-helper.in +index 6467326e35..9063a2cc3b 100755 +--- a/src/rpm/systemd-update-helper.in ++++ b/src/rpm/systemd-update-helper.in +@@ -99,7 +99,7 @@ case "$command" in + fi + + if [[ "$command" =~ restart ]]; then +- systemctl reload-or-restart --marked ++ systemctl enqueue-marked-jobs + fi + ;; + +@@ -120,7 +120,7 @@ case "$command" in + + for user in $users; do + SYSTEMD_BUS_TIMEOUT={{UPDATE_HELPER_USER_TIMEOUT_SEC}}s \ +- systemctl --user -M "$user@" reload-or-restart --marked & ++ systemctl --user -M "$user@" enqueue-marked-jobs & + done + wait + fi diff --git a/38769.patch b/38769.patch index 09a7423..714a219 100644 --- a/38769.patch +++ b/38769.patch @@ -1,7 +1,7 @@ -From 00d70f36a0866660693347009446b7f872a05bf4 Mon Sep 17 00:00:00 2001 +From e364a55e4869288c3574c856c9c96ad174a204ac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= Date: Sat, 30 Aug 2025 13:55:56 +0200 -Subject: [PATCH] core: create userdb root directory with correct label +Subject: [PATCH 1/2] core: create userdb root directory with correct label Set up the /run/systemd/userdb directory with the default SELinux context on creation. @@ -16,27 +16,27 @@ longer is. Regression introduced in 736349958efe34089131ca88950e2e5bb391d36a. 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/core/varlink.c b/src/core/varlink.c -index 99f12c59e5..71a8ffd0e5 100644 +index ec4f8abad9..9a03bf9bda 100644 --- a/src/core/varlink.c +++ b/src/core/varlink.c -@@ -5,6 +5,7 @@ - #include "constants.h" +@@ -6,6 +6,7 @@ #include "errno-util.h" #include "manager.h" + #include "metrics.h" +#include "mkdir-label.h" #include "path-util.h" #include "pidref.h" #include "string-util.h" -@@ -441,7 +442,11 @@ static int manager_varlink_init_system(Manager *m) { - if (!fresh && varlink_server_contains_socket(m->varlink_server, address)) - continue; +@@ -469,7 +470,11 @@ static int varlink_server_listen_many_idempotent_sentinel( + if (!known_fresh && varlink_server_contains_socket(s, address)) + continue; -- r = sd_varlink_server_listen_address(m->varlink_server, address, 0666 | SD_VARLINK_SERVER_MODE_MKDIR_0755); -+ r = mkdir_parents_label(address, 0755); -+ if (r < 0) -+ log_warning_errno(r, "Failed to create parent directory of '%s', ignoring: %m", address); +- r = sd_varlink_server_listen_address(s, address, 0666 | SD_VARLINK_SERVER_MODE_MKDIR_0755); ++ r = mkdir_parents_label(address, 0755); ++ if (r < 0) ++ log_warning_errno(r, "Failed to create parent directory of '%s', ignoring: %m", address); + -+ r = sd_varlink_server_listen_address(m->varlink_server, address, 0666); - if (r < 0) - return log_error_errno(r, "Failed to bind to varlink socket '%s': %m", address); - } ++ r = sd_varlink_server_listen_address(s, address, 0666); + if (r < 0) { + log_error_errno(r, "Failed to bind to varlink socket '%s': %m", address); + break; diff --git a/sources b/sources index 323604e..4c6235c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-259.1.tar.gz) = 7cbeca5dad6413a876809200583854ddc706b7a69deff958eb1ca1afb726cf4dec014006c10d1945c450b754811d4b95a80fe1778cb3136997f6d11b11c0560e +SHA512 (systemd-260-rc1.tar.gz) = bb4762d7113aa3f47150fcb5de97ce1a7d6af1af1a810fb5b01def36f674e069529359947a42c0ff8746f7a87ebd14f9faf65361879a09a10586b17bffc0ae96 diff --git a/systemd.spec b/systemd.spec index 3b20779..2f3fad7 100644 --- a/systemd.spec +++ b/systemd.spec @@ -73,7 +73,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:259.1} +Version: %{?version_override}%{!?version_override:260~rc1} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif @@ -142,10 +142,6 @@ Patch: https://github.com/systemd/systemd/pull/26494.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2251843 Patch: 30846.patch -# Again create runlevelX.target. Dropping those files breaks upgrades. -# https://bugzilla.redhat.com/show_bug.cgi?id=2411195 -Patch: 0001-Revert-units-drop-runlevel-0-6-.target.patch - # userdb: create userdb root directory with correct label # We can drop this after SELinux policy is updated to handle the transition. Patch: 38769.patch @@ -153,6 +149,8 @@ Patch: 38769.patch # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2415701 Patch: 0002-machined-continue-without-resolve.hook-socket.patch +Patch: 0003-rpm-systemd-update-helper-use-enqueue-marked-jobs.patch + %endif %ifarch %{ix86} x86_64 aarch64 riscv64 From 455f27718826cb40110a4d697c2cca86e9ce3a40 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Thu, 26 Feb 2026 13:06:30 +0100 Subject: [PATCH 03/63] Move support for tpm2 to systemd-udev subpackage This was first attempted in ec5e1b1ed73209baf28cd871091c5b3cff3c8fee, together with some other changes. Moving of getty@.service was wrong, because it is needed in containers. But moving of the tpm2 stuff should be fine. List of affected files: /usr/lib/systemd/system-generators/systemd-tpm2-generator /usr/lib/systemd/system/sysinit.target.wants/systemd-tpm2-setup-early.service /usr/lib/systemd/system/sysinit.target.wants/systemd-tpm2-setup.service /usr/lib/systemd/system/systemd-tpm2-clear.service /usr/lib/systemd/system/systemd-tpm2-setup-early.service /usr/lib/systemd/system/systemd-tpm2-setup.service /usr/lib/systemd/system/tpm2.target /usr/lib/systemd/systemd-tpm2-clear /usr/lib/systemd/systemd-tpm2-setup /usr/share/man/man8/systemd-tpm2-clear.service.8.gz /usr/share/man/man8/systemd-tpm2-generator.8.gz /usr/share/man/man8/systemd-tpm2-setup-early.service.8.gz /usr/share/man/man8/systemd-tpm2-setup.8.gz /usr/share/man/man8/systemd-tpm2-setup.service.8.gz --- split-files.py | 1 + 1 file changed, 1 insertion(+) diff --git a/split-files.py b/split-files.py index 86d7f47..20f0417 100644 --- a/split-files.py +++ b/split-files.py @@ -233,6 +233,7 @@ for file in files(buildroot): integritysetup| integritytab| remount-fs| + tpm2| /initrd| systemd[.-]pcr| /pcrlock\.d| From ba7807fbcee83bb44fcbd16fa63d0fe48eb0ce45 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Thu, 26 Feb 2026 13:40:11 +0100 Subject: [PATCH 04/63] Drop scriptlet for upgrades from versions <253 --- systemd.spec | 7 ------- 1 file changed, 7 deletions(-) diff --git a/systemd.spec b/systemd.spec index 2f3fad7..b564bd1 100644 --- a/systemd.spec +++ b/systemd.spec @@ -1230,13 +1230,6 @@ fi # This is for upgrades from previous versions before systemd restart was moved to %%postun systemctl daemon-reexec || : -%triggerpostun -- systemd < 253~rc1-2 -# This is for upgrades from previous versions where systemd-journald-audit.socket -# had a static enablement symlink. -# We use %%triggerpostun here because rpm doesn't allow a second %%triggerun with -# a different package version. -systemctl --no-reload preset systemd-journald-audit.socket &>/dev/null || : - %global udev_services %{shrink: cryptsetup-pre.target cryptsetup.target From 6ff27708f787fc8a673c37c382eedc3f669acd7d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Thu, 26 Feb 2026 13:56:27 +0100 Subject: [PATCH 05/63] Enable getty@.service through presets This was first attempted in ec5e1b1ed73209baf28cd871091c5b3cff3c8fee, but then was reset. After the upgrade to v260-rc1 which includes the patch to add [Install] to getty@.service, we need to do this, or we don't get a autovt@.service symlink at all and gettys are not active. This time, a scriptlet to keep the service enabled after upgrades is added. --- systemd.spec | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/systemd.spec b/systemd.spec index b564bd1..5b35c07 100644 --- a/systemd.spec +++ b/systemd.spec @@ -1186,6 +1186,10 @@ fi \ %post systemd-machine-id-setup &>/dev/null || : +# This is for upgrades from previous versions before getty@.service needed to be enabled +[ $1 -gt 1 ] && systemctl is-enabled getty@tty1.service &>/dev/null && \ + touch %{_localstatedir}/lib/rpm-state/systemd-getty-was-active || : + [ $1 -eq 1 ] || exit 0 # create /var/log/journal only on initial installation, @@ -1213,6 +1217,8 @@ if [ $1 -ge 2 ]; then systemctl daemon-reexec || : systemd-tmpfiles --create &>/dev/null || : + + rm -f %{_localstatedir}/lib/rpm-state/systemd-getty-was-active || : fi %systemd_posttrans_with_restart systemd-timedated.service systemd-hostnamed.service systemd-journald.service systemd-localed.service systemd-userdbd.service @@ -1230,9 +1236,15 @@ fi # This is for upgrades from previous versions before systemd restart was moved to %%postun systemctl daemon-reexec || : +%triggerpostun -- systemd < 260~rc1 +if [ -f %{_localstatedir}/lib/rpm-state/systemd-getty-was-active ]; then + systemctl --no-reload enable getty@.service || : +fi + %global udev_services %{shrink: cryptsetup-pre.target cryptsetup.target + getty@.service hibernate.target hybrid-sleep.target initrd-cleanup.service From 809049777c31720a392a90ef4bdb2db6b55754e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Thu, 26 Feb 2026 14:37:09 +0100 Subject: [PATCH 06/63] Add patch for symlink creation error --- ...reversed-symlink-direction-in-error-.patch | 66 +++++++++++++++++++ systemd.spec | 2 + 2 files changed, 68 insertions(+) create mode 100644 0001-core-socket-fix-reversed-symlink-direction-in-error-.patch diff --git a/0001-core-socket-fix-reversed-symlink-direction-in-error-.patch b/0001-core-socket-fix-reversed-symlink-direction-in-error-.patch new file mode 100644 index 0000000..6d59275 --- /dev/null +++ b/0001-core-socket-fix-reversed-symlink-direction-in-error-.patch @@ -0,0 +1,66 @@ +From 13167bfc2f7b747d23494f5d878ddacfe237ac1c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= +Date: Thu, 26 Feb 2026 09:25:48 +0100 +Subject: [PATCH] core/socket: fix reversed symlink direction in error message +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +After the update to 260-rc1 in Fedora Rawhide, we get a lot of messages like +this: + systemd[1]: systemd-resolved-monitor.socket: + Failed to create symlink /run/systemd/resolve/io.systemd.Resolve.Monitor → + /run/varlink/registry/io.systemd.Resolve.Monitor, ignoring: Permission denied + +The actual issue will need to be fixed too, but let's fix the message first. +While at it, let's rename the variables to be meaningful. +--- + src/core/socket.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +diff --git a/src/core/socket.c b/src/core/socket.c +index 0ca9d80e04..c18f28aad6 100644 +--- a/src/core/socket.c ++++ b/src/core/socket.c +@@ -1347,30 +1347,29 @@ static int mq_address_create( + } + + static int socket_symlink(Socket *s) { +- const char *p; + int r; + + assert(s); + +- p = socket_find_symlink_target(s); +- if (!p) ++ const char *target = socket_find_symlink_target(s); ++ if (!target) + return 0; + +- STRV_FOREACH(i, s->symlinks) { +- (void) mkdir_parents_label(*i, s->directory_mode); ++ STRV_FOREACH(linkpath, s->symlinks) { ++ (void) mkdir_parents_label(*linkpath, s->directory_mode); + +- r = symlink_idempotent(p, *i, false); ++ r = symlink_idempotent(target, *linkpath, false); + if (r == -EEXIST && s->remove_on_stop) { +- /* If there's already something where we want to create the symlink, and the destructive +- * RemoveOnStop= mode is set, then we might as well try to remove what already exists and try +- * again. */ ++ /* If there's already something where we want to create the symlink, and the ++ * destructive RemoveOnStop= mode is set, then we might as well try to remove what ++ * already exists and try again. */ + +- if (unlink(*i) >= 0) +- r = symlink_idempotent(p, *i, false); ++ if (unlink(*linkpath) >= 0) ++ r = symlink_idempotent(target, *linkpath, false); + } + if (r < 0) + log_unit_warning_errno(UNIT(s), r, "Failed to create symlink %s %s %s, ignoring: %m", +- p, glyph(GLYPH_ARROW_RIGHT), *i); ++ *linkpath, glyph(GLYPH_ARROW_RIGHT), target); + } + + return 0; diff --git a/systemd.spec b/systemd.spec index 5b35c07..f567d31 100644 --- a/systemd.spec +++ b/systemd.spec @@ -149,7 +149,9 @@ Patch: 38769.patch # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2415701 Patch: 0002-machined-continue-without-resolve.hook-socket.patch +# Fixes after v260-rc1 Patch: 0003-rpm-systemd-update-helper-use-enqueue-marked-jobs.patch +Patch: 0001-core-socket-fix-reversed-symlink-direction-in-error-.patch %endif From ce1dec6a40ea0ce27924b28e15ad52a837b964f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 4 Mar 2026 15:15:23 +0100 Subject: [PATCH 07/63] Version 260~rc2 - A bunch of bugfixes in various components and documentation - Fix for GHSA-6pwp-j5vg-5j6m --- ...reversed-symlink-direction-in-error-.patch | 66 ------------------- ...pdate-helper-use-enqueue-marked-jobs.patch | 32 --------- sources | 2 +- systemd.spec | 6 +- 4 files changed, 2 insertions(+), 104 deletions(-) delete mode 100644 0001-core-socket-fix-reversed-symlink-direction-in-error-.patch delete mode 100644 0003-rpm-systemd-update-helper-use-enqueue-marked-jobs.patch diff --git a/0001-core-socket-fix-reversed-symlink-direction-in-error-.patch b/0001-core-socket-fix-reversed-symlink-direction-in-error-.patch deleted file mode 100644 index 6d59275..0000000 --- a/0001-core-socket-fix-reversed-symlink-direction-in-error-.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 13167bfc2f7b747d23494f5d878ddacfe237ac1c Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= -Date: Thu, 26 Feb 2026 09:25:48 +0100 -Subject: [PATCH] core/socket: fix reversed symlink direction in error message -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -After the update to 260-rc1 in Fedora Rawhide, we get a lot of messages like -this: - systemd[1]: systemd-resolved-monitor.socket: - Failed to create symlink /run/systemd/resolve/io.systemd.Resolve.Monitor → - /run/varlink/registry/io.systemd.Resolve.Monitor, ignoring: Permission denied - -The actual issue will need to be fixed too, but let's fix the message first. -While at it, let's rename the variables to be meaningful. ---- - src/core/socket.c | 23 +++++++++++------------ - 1 file changed, 11 insertions(+), 12 deletions(-) - -diff --git a/src/core/socket.c b/src/core/socket.c -index 0ca9d80e04..c18f28aad6 100644 ---- a/src/core/socket.c -+++ b/src/core/socket.c -@@ -1347,30 +1347,29 @@ static int mq_address_create( - } - - static int socket_symlink(Socket *s) { -- const char *p; - int r; - - assert(s); - -- p = socket_find_symlink_target(s); -- if (!p) -+ const char *target = socket_find_symlink_target(s); -+ if (!target) - return 0; - -- STRV_FOREACH(i, s->symlinks) { -- (void) mkdir_parents_label(*i, s->directory_mode); -+ STRV_FOREACH(linkpath, s->symlinks) { -+ (void) mkdir_parents_label(*linkpath, s->directory_mode); - -- r = symlink_idempotent(p, *i, false); -+ r = symlink_idempotent(target, *linkpath, false); - if (r == -EEXIST && s->remove_on_stop) { -- /* If there's already something where we want to create the symlink, and the destructive -- * RemoveOnStop= mode is set, then we might as well try to remove what already exists and try -- * again. */ -+ /* If there's already something where we want to create the symlink, and the -+ * destructive RemoveOnStop= mode is set, then we might as well try to remove what -+ * already exists and try again. */ - -- if (unlink(*i) >= 0) -- r = symlink_idempotent(p, *i, false); -+ if (unlink(*linkpath) >= 0) -+ r = symlink_idempotent(target, *linkpath, false); - } - if (r < 0) - log_unit_warning_errno(UNIT(s), r, "Failed to create symlink %s %s %s, ignoring: %m", -- p, glyph(GLYPH_ARROW_RIGHT), *i); -+ *linkpath, glyph(GLYPH_ARROW_RIGHT), target); - } - - return 0; diff --git a/0003-rpm-systemd-update-helper-use-enqueue-marked-jobs.patch b/0003-rpm-systemd-update-helper-use-enqueue-marked-jobs.patch deleted file mode 100644 index ddb665c..0000000 --- a/0003-rpm-systemd-update-helper-use-enqueue-marked-jobs.patch +++ /dev/null @@ -1,32 +0,0 @@ -From ecab24999254a2601c5fb13686ab986ff40427ba Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= -Date: Wed, 25 Feb 2026 22:04:16 +0100 -Subject: [PATCH] rpm/systemd-update-helper: use 'enqueue-marked-jobs' - -Without this, a warning is emitted on upgrades. ---- - src/rpm/systemd-update-helper.in | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/rpm/systemd-update-helper.in b/src/rpm/systemd-update-helper.in -index 6467326e35..9063a2cc3b 100755 ---- a/src/rpm/systemd-update-helper.in -+++ b/src/rpm/systemd-update-helper.in -@@ -99,7 +99,7 @@ case "$command" in - fi - - if [[ "$command" =~ restart ]]; then -- systemctl reload-or-restart --marked -+ systemctl enqueue-marked-jobs - fi - ;; - -@@ -120,7 +120,7 @@ case "$command" in - - for user in $users; do - SYSTEMD_BUS_TIMEOUT={{UPDATE_HELPER_USER_TIMEOUT_SEC}}s \ -- systemctl --user -M "$user@" reload-or-restart --marked & -+ systemctl --user -M "$user@" enqueue-marked-jobs & - done - wait - fi diff --git a/sources b/sources index 4c6235c..1b92d9f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-260-rc1.tar.gz) = bb4762d7113aa3f47150fcb5de97ce1a7d6af1af1a810fb5b01def36f674e069529359947a42c0ff8746f7a87ebd14f9faf65361879a09a10586b17bffc0ae96 +SHA512 (systemd-260-rc2.tar.gz) = 4b644449b75eb159eed39b1926ca299573aae733137c746bf69b6a222de63e48346569b9c454cb959a8758e1d4f696ab45b0f03e2104ee9af2f3ab4354d25e14 diff --git a/systemd.spec b/systemd.spec index f567d31..448abf5 100644 --- a/systemd.spec +++ b/systemd.spec @@ -73,7 +73,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:260~rc1} +Version: %{?version_override}%{!?version_override:260~rc2} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif @@ -149,10 +149,6 @@ Patch: 38769.patch # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2415701 Patch: 0002-machined-continue-without-resolve.hook-socket.patch -# Fixes after v260-rc1 -Patch: 0003-rpm-systemd-update-helper-use-enqueue-marked-jobs.patch -Patch: 0001-core-socket-fix-reversed-symlink-direction-in-error-.patch - %endif %ifarch %{ix86} x86_64 aarch64 riscv64 From 03b6637c352a4e10a5928372cdfcd629e67c45b6 Mon Sep 17 00:00:00 2001 From: Marcin Juszkiewicz Date: Wed, 4 Mar 2026 17:23:15 +0100 Subject: [PATCH 08/63] riscv64 port has LTO disabled --- systemd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/systemd.spec b/systemd.spec index 448abf5..ae7f071 100644 --- a/systemd.spec +++ b/systemd.spec @@ -23,7 +23,10 @@ # e.g. when re-building cryptsetup on a json-c SONAME-bump. %bcond bootstrap 0 %bcond tests 1 -%bcond lto 1 + +# riscv64 has LTO disabled globally +%bcond lto %["%_arch" != "riscv64"] + # Build docs on 64-bit architectures only %bcond docs %[%{?__isa_bits} >= 64] From 154edb7cdb379277af8c51ea2feb76e99bbe7cdd Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Thu, 5 Mar 2026 14:33:49 +0100 Subject: [PATCH 09/63] Silence false positive "HWID match failed, no DT blob" error (rhbz#2444759) --- 40957.patch | 38 ++++++++++++++++++++++++++++++++++++++ systemd.spec | 5 +++++ 2 files changed, 43 insertions(+) create mode 100644 40957.patch diff --git a/40957.patch b/40957.patch new file mode 100644 index 0000000..7932f99 --- /dev/null +++ b/40957.patch @@ -0,0 +1,38 @@ +From 6941d340092d30db4018803283cfb899c6f92c14 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 5 Mar 2026 14:20:06 +0100 +Subject: [PATCH] boot: Make missing CHID DTB match a debug message instead of + an error + +With distributions like Ubuntu and Fedora using systemd-stub to auto load +DTB's on Windows on ARM laptops, the CHID DTB match failing is expected +when that same UKI is instead booted on an ARM SystemReady system where +no DTB is necessary. + +In the ARM SystemReady case showing a big red error message is undesirable +and leads to confused users and bug-reports. Lower the message to debug +level when the status is EFI_NOT_FOUND to avoid these false positive error +messages. + +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2444759 +--- + src/boot/pe.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/boot/pe.c b/src/boot/pe.c +index 397a7a6940..255e8539de 100644 +--- a/src/boot/pe.c ++++ b/src/boot/pe.c +@@ -396,7 +396,8 @@ static void pe_locate_sections( + + EFI_STATUS err = chid_match(hwids, hwids_section[0].memory_size, DEVICE_TYPE_DEVICETREE, &device); + if (err != EFI_SUCCESS) { +- log_error_status(err, "HWID matching failed, no DT blob will be selected: %m"); ++ log_full(err, (err == EFI_NOT_FOUND) ? LOG_DEBUG : LOG_ERR, ++ "HWID matching failed, no DT blob will be selected: %m"); + hwids = NULL; + } + } +-- +2.52.0 + diff --git a/systemd.spec b/systemd.spec index ae7f071..c3305e8 100644 --- a/systemd.spec +++ b/systemd.spec @@ -152,6 +152,11 @@ Patch: 38769.patch # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2415701 Patch: 0002-machined-continue-without-resolve.hook-socket.patch +# Silence false positive "HWID match failed, no DT blob" error +# https://bugzilla.redhat.com/show_bug.cgi?id=2444759 +# https://github.com/systemd/systemd/pull/40957 +Patch: 40957.patch + %endif %ifarch %{ix86} x86_64 aarch64 riscv64 From 453696813e49581b0f332e99286ab6a9e706a8d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 6 Mar 2026 13:50:04 +0100 Subject: [PATCH 10/63] Fix typo in unit name in %post scriptlet --- systemd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/systemd.spec b/systemd.spec index c3305e8..4616017 100644 --- a/systemd.spec +++ b/systemd.spec @@ -1329,7 +1329,7 @@ fi systemd-suspend.service systemd-sysctl.service systemd-timesyncd.service - systemd-tmpfiles-clear.service + systemd-tmpfiles-clean.service systemd-tmpfiles-setup-dev-early.service systemd-tmpfiles-setup-dev.service systemd-udev-load-credentials.service From e4c1c2100bc5b93bec6f284c1f68eb33e0a53763 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Thu, 12 Mar 2026 19:48:11 +0100 Subject: [PATCH 11/63] Version 260~rc3 - A bunch of bugfixes - More sanitization for invalid values received from hardware and firmware --- 40957.patch | 38 -------------------------------------- sources | 2 +- systemd.spec | 7 +------ 3 files changed, 2 insertions(+), 45 deletions(-) delete mode 100644 40957.patch diff --git a/40957.patch b/40957.patch deleted file mode 100644 index 7932f99..0000000 --- a/40957.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 6941d340092d30db4018803283cfb899c6f92c14 Mon Sep 17 00:00:00 2001 -From: Hans de Goede -Date: Thu, 5 Mar 2026 14:20:06 +0100 -Subject: [PATCH] boot: Make missing CHID DTB match a debug message instead of - an error - -With distributions like Ubuntu and Fedora using systemd-stub to auto load -DTB's on Windows on ARM laptops, the CHID DTB match failing is expected -when that same UKI is instead booted on an ARM SystemReady system where -no DTB is necessary. - -In the ARM SystemReady case showing a big red error message is undesirable -and leads to confused users and bug-reports. Lower the message to debug -level when the status is EFI_NOT_FOUND to avoid these false positive error -messages. - -Link: https://bugzilla.redhat.com/show_bug.cgi?id=2444759 ---- - src/boot/pe.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/src/boot/pe.c b/src/boot/pe.c -index 397a7a6940..255e8539de 100644 ---- a/src/boot/pe.c -+++ b/src/boot/pe.c -@@ -396,7 +396,8 @@ static void pe_locate_sections( - - EFI_STATUS err = chid_match(hwids, hwids_section[0].memory_size, DEVICE_TYPE_DEVICETREE, &device); - if (err != EFI_SUCCESS) { -- log_error_status(err, "HWID matching failed, no DT blob will be selected: %m"); -+ log_full(err, (err == EFI_NOT_FOUND) ? LOG_DEBUG : LOG_ERR, -+ "HWID matching failed, no DT blob will be selected: %m"); - hwids = NULL; - } - } --- -2.52.0 - diff --git a/sources b/sources index 1b92d9f..8d1e791 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-260-rc2.tar.gz) = 4b644449b75eb159eed39b1926ca299573aae733137c746bf69b6a222de63e48346569b9c454cb959a8758e1d4f696ab45b0f03e2104ee9af2f3ab4354d25e14 +SHA512 (systemd-260-rc3.tar.gz) = 75063eaa11eb8b28b754960a311361d0b0e2a567ffa56280a3f5a2815c67f07518d7a8d67fa5df19af7ff438d5b873becf969defb558f411b469853e97dc78b9 diff --git a/systemd.spec b/systemd.spec index 4616017..31b6ad2 100644 --- a/systemd.spec +++ b/systemd.spec @@ -76,7 +76,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:260~rc2} +Version: %{?version_override}%{!?version_override:260~rc3} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif @@ -152,11 +152,6 @@ Patch: 38769.patch # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2415701 Patch: 0002-machined-continue-without-resolve.hook-socket.patch -# Silence false positive "HWID match failed, no DT blob" error -# https://bugzilla.redhat.com/show_bug.cgi?id=2444759 -# https://github.com/systemd/systemd/pull/40957 -Patch: 40957.patch - %endif %ifarch %{ix86} x86_64 aarch64 riscv64 From e3fab23aa0527a6e60a2ebe62088df7c941b6c1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 14 Mar 2026 00:34:55 +0100 Subject: [PATCH 12/63] Version 260~rc4 - Even more fixes, incl. a fix for a bad patch in ~rc3. --- sources | 2 +- systemd.spec | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sources b/sources index 8d1e791..e3a7f86 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-260-rc3.tar.gz) = 75063eaa11eb8b28b754960a311361d0b0e2a567ffa56280a3f5a2815c67f07518d7a8d67fa5df19af7ff438d5b873becf969defb558f411b469853e97dc78b9 +SHA512 (systemd-260-rc4.tar.gz) = f14fd373e303908dbd550336898940fdf01b2d27921c7c53dee1cc7bf30188b367121bb72a8ba4c6cb2bc68b4e24cb2bad4c6b7ade4db5979f5737c0fbf76154 diff --git a/systemd.spec b/systemd.spec index 31b6ad2..db74898 100644 --- a/systemd.spec +++ b/systemd.spec @@ -76,7 +76,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:260~rc3} +Version: %{?version_override}%{!?version_override:260~rc4} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif From 8f4f0f58e3dac42e201cc9956a54af845cddfd0e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 17 Mar 2026 22:16:42 +0100 Subject: [PATCH 13/63] Version 260 - No significant changes since ~rc4 --- sources | 2 +- systemd.spec | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sources b/sources index e3a7f86..4c77223 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-260-rc4.tar.gz) = f14fd373e303908dbd550336898940fdf01b2d27921c7c53dee1cc7bf30188b367121bb72a8ba4c6cb2bc68b4e24cb2bad4c6b7ade4db5979f5737c0fbf76154 +SHA512 (systemd-260.tar.gz) = 2b81a327319c6b06c04742aa8ee5f36ebc7b78aa6db2a82f2a7376fda8bf2079bfc418db290b0522e1d01a3449b3a4e847ebe22d260cc83aeb86a7a4de714d41 diff --git a/systemd.spec b/systemd.spec index db74898..747fc14 100644 --- a/systemd.spec +++ b/systemd.spec @@ -76,7 +76,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:260~rc4} +Version: %{?version_override}%{!?version_override:260} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif From 3681163f8140a6545c0c2d255c7a8f7eebecd4d5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 23 Mar 2026 21:06:28 +0100 Subject: [PATCH 14/63] Version 260.1 - Fixes for crashes and misbehaviours in PID1 and other components --- systemd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/systemd.spec b/systemd.spec index 747fc14..b5cbc73 100644 --- a/systemd.spec +++ b/systemd.spec @@ -76,7 +76,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:260} +Version: %{?version_override}%{!?version_override:260.1} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif From 36a234147fcabb698bebe627b09a6e684de9b23d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 23 Mar 2026 21:08:43 +0100 Subject: [PATCH 15/63] Upload sources [skip changelog] --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 4c77223..b4eba69 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-260.tar.gz) = 2b81a327319c6b06c04742aa8ee5f36ebc7b78aa6db2a82f2a7376fda8bf2079bfc418db290b0522e1d01a3449b3a4e847ebe22d260cc83aeb86a7a4de714d41 +SHA512 (systemd-260.1.tar.gz) = 9f975dce6861853a817a7ceab18a24449a85d1bda6939b3a5173430c02a4d8a9a2b34ebb8cce1c51db9b0ff9078fcc65da7b0f44e3bdcbbe013b9e04bb6f0ff9 From 207e2d004468bf79a8bd78182d9b10956edf45c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 14 Apr 2026 16:11:34 +0200 Subject: [PATCH 16/63] Stop building support for openssl engines It seems that the headers are gone on openssl-4.0.0~beta1. But already we're seeing build failurs on i686 because openssl-devel-engine is not available. Most likely multilib setup was borked. So let's drop this now and hope that the providers in f45 will be good enough. --- systemd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/systemd.spec b/systemd.spec index b5cbc73..5ef1613 100644 --- a/systemd.spec +++ b/systemd.spec @@ -202,7 +202,7 @@ BuildRequires: libcurl-devel BuildRequires: kmod-devel BuildRequires: elfutils-devel BuildRequires: openssl-devel -%if 0%{?fedora} >= 41 +%if 0%{?fedora} >= 41 && 0%{?fedora} < 45 BuildRequires: openssl-devel-engine %endif %if %{with gnutls} From 400494ada4064124dfbbe93de57ec8a2228f359f Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Tue, 14 Apr 2026 10:13:28 -0400 Subject: [PATCH 17/63] Update conditionals for RHEL 11 ELN (the future RHEL 11) tracks rawhide and therefore also has the latest setup and sysusers changes. --- systemd.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/systemd.spec b/systemd.spec index 5ef1613..bd1a262 100644 --- a/systemd.spec +++ b/systemd.spec @@ -306,7 +306,7 @@ Conflicts: initscripts < 9.56.1 %if 0%{?fedora} Conflicts: fedora-release < 23-0.12 %endif -%if 0%{?fedora} >= 41 +%if 0%{?fedora} >= 41 || 0%{?rhel} >= 11 BuildRequires: setup >= 2.15.0-3 BuildRequires: python3 Conflicts: setup < 2.15.0-3 @@ -1094,7 +1094,7 @@ install -Dm0644 -t %{buildroot}%{_prefix}/lib/udev/rules.d/ %{SOURCE18} sed -i 's|#!/usr/bin/env python3|#!%{__python3}|' %{buildroot}/usr/lib/systemd/tests/run-unit-tests.py -%if 0%{?fedora} >= 42 +%if 0%{?fedora} >= 42 || 0%{?rhel} >= 11 install -m 0644 -D %{SOURCE21} %{buildroot}%{_rpmconfigdir}/macros.d/macros.sysusers %else install -m 0644 -D %{SOURCE20} %{buildroot}%{_rpmconfigdir}/macros.d/macros.sysusers @@ -1120,13 +1120,13 @@ ln -s --relative %{buildroot}%{_bindir}/kernel-install %{buildroot}%{_sbindir}/i mv -v %{buildroot}/usr/sbin/* %{buildroot}%{_bindir}/ %endif -%if 0%{?fedora} >= 41 +%if 0%{?fedora} >= 41 || 0%{?rhel} >= 11 %if %{without upstream} # This requires https://pagure.io/setup/pull-request/50 # and https://src.fedoraproject.org/rpms/setup/pull-request/10. # We skip this on upstream builds so that new users and groups # can be added without breaking the build. -%if 0%{?fedora} >= 43 +%if 0%{?fedora} >= 43 || 0%{?rhel} >= 11 IGNORED=empower \ %{python3} %{SOURCE4} /usr/lib/sysusers.d/setup.conf %{buildroot}/usr/lib/sysusers.d/basic.conf %else From ab743db0feaff7bc50b424156df8e59c3270cbdd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 12 May 2026 12:31:08 +0200 Subject: [PATCH 18/63] Downgrade kbd dependency to Recommends Since upstream commit 3327a411be3ef4a203d23ae86e6c50b30d929d50, we can downgrade the dep. --- systemd.spec | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/systemd.spec b/systemd.spec index bd1a262..2084123 100644 --- a/systemd.spec +++ b/systemd.spec @@ -511,8 +511,14 @@ Recommends: libtss2-rc.so.0%{?elf_suffix} # https://bugzilla.redhat.com/show_bug.cgi?id=1377733#c9 Suggests: systemd-bootchart + # https://bugzilla.redhat.com/show_bug.cgi?id=1408878 +%if %{with upstream} +# v261 handles missing setfont/loadkeys gracefully +Recommends: kbd +%else Requires: kbd +%endif # https://bugzilla.redhat.com/show_bug.cgi?id=1753381 Provides: u2f-hidraw-policy = 1.0.2-40 From 32a20386275c41aff6eac6f2d386fb61dab9a927 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 6 Feb 2026 11:50:19 +0100 Subject: [PATCH 19/63] spec: drop duplicated line [skip changelog] --- systemd.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/systemd.spec b/systemd.spec index 2084123..c932b86 100644 --- a/systemd.spec +++ b/systemd.spec @@ -842,7 +842,6 @@ CONFIGURE_OPTS=( -Daudit=enabled -Delfutils=enabled -Dlibcryptsetup=%[%{with bootstrap}?"disabled":"enabled"] - -Delfutils=enabled -Drepart=enabled -Dpwquality=enabled -Dqrencode=%[%{defined rhel}?"disabled":"enabled"] From ee6d0b9d27ce2646f8bdb377ae3dbe6ecc6ee522 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 6 Feb 2026 11:50:28 +0100 Subject: [PATCH 20/63] Use dlopen-notes to automatically generate library Recommends/Requires/Suggests --- systemd.spec | 73 +++++++--------------------------------------------- 1 file changed, 9 insertions(+), 64 deletions(-) diff --git a/systemd.spec b/systemd.spec index c932b86..df2a103 100644 --- a/systemd.spec +++ b/systemd.spec @@ -175,6 +175,8 @@ BuildRequires: cryptsetup-devel # Require (previous version) of our macros package. # We use the %%systemd_{post,preun,…} macros for various services. BuildRequires: systemd-rpm-macros +# Use dlopen-notes to generate Requires/Recommends from embedded metadata. +BuildRequires: package-notes %endif BuildRequires: dbus-devel BuildRequires: util-linux @@ -339,44 +341,15 @@ Provides: /usr/sbin/shutdown %endif # libmount is always required, even in containers, so make it a hard dependency. -Requires: libmount.so.1%{?elf_suffix} -Requires: libmount.so.1(MOUNT_2.26)%{?elf_bits} # Various systemd services have syscall filters so make libseccomp a hard dependency. -Requires: libseccomp.so.2%{?elf_suffix} +# +# Libkmod is used to load modules. Assume that if we need udevd, we certainly +# want to load modules, so make this into a hard dependency here. +# udev uses libblkid in various builtins so make it a hard dependency. -# Recommends to replace normal Requires deps for stuff that is dlopen()ed -Recommends: libxkbcommon.so.0%{?elf_suffix} -Recommends: libidn2.so.0%{?elf_suffix} -Recommends: libidn2.so.0(IDN2_0.0.0)%{?elf_bits} -Recommends: libpcre2-8.so.0%{?elf_suffix} -Recommends: libpwquality.so.1%{?elf_suffix} -Recommends: libpwquality.so.1(LIBPWQUALITY_1.0)%{?elf_bits} -%if 0%{?fedora} -Recommends: libqrencode.so.4%{?elf_suffix} -%endif -Recommends: libbpf.so.1%{?elf_suffix} -Recommends: libbpf.so.1(LIBBPF_0.4.0)%{?elf_bits} - -# used by systemd-coredump and systemd-analyze -Recommends: libdw.so.1%{?elf_suffix} -Recommends: libdw.so.1(ELFUTILS_0.186)%{?elf_bits} -Recommends: libelf.so.1%{?elf_suffix} -Recommends: libelf.so.1(ELFUTILS_1.7)%{?elf_bits} - -# used by dissect, integritysetup, veritysetyp, growfs, repart, cryptenroll, home -Recommends: libcryptsetup.so.12%{?elf_suffix} -Recommends: libcryptsetup.so.12(CRYPTSETUP_2.4)%{?elf_bits} - -# Libkmod is used to load modules. -Recommends: libkmod.so.2%{?elf_suffix} -# kmod_list_next, kmod_load_resources, kmod_module_get_initstate, -# kmod_module_get_module, kmod_module_get_name, kmod_module_new_from_lookup, -# kmod_module_probe_insert_module, kmod_module_unref, kmod_module_unref_list, -# kmod_new, kmod_set_log_fn, kmod_unref, kmod_validate_resources -# are part of LIBKMOD_5. -Recommends: libkmod.so.2(LIBKMOD_5)%{?elf_bits} - -Recommends: libarchive.so.13%{?elf_suffix} +%define __dlopen_notes_requires_opts --rpm-features=systemd:mount,systemd:seccomp,systemd-udev:kmod,systemd-udev:blkid,systemd-resolved:idn +# Upgrade upstream priority:suggested to Recommends +%define __dlopen_notes_recommends_opts --rpm-features=*:cryptsetup,*:xkbcommon,*:idn,*:pcre2,*:pwquality,%[0%{?fedora}?"*:qrencode":""],*:bpf,*:dw,*:elf,*:archive,systemd-udev:fido2,systemd-udev:tpm,systemd-udev:p11-kit %description systemd is a system and service manager that runs as PID 1 and starts the rest @@ -483,32 +456,6 @@ Provides: systemd-timesyncd = %{version}-%{release} %endif Conflicts: systemd-networkd < %{version}-%{release} -# Libkmod is used to load modules. Assume that if we need udevd, we certainly -# want to load modules, so make this into a hard dependency here. -Requires: libkmod.so.2%{?elf_suffix} -Requires: libkmod.so.2(LIBKMOD_5)%{?elf_bits} -# udev uses libblkid in various builtins so make it a hard dependency. -Requires: libblkid.so.1%{?elf_suffix} -Requires: libblkid.so.1(BLKID_2.30)%{?elf_bits} - -# Recommends to replace normal Requires deps for stuff that is dlopen()ed -# used by dissect, integritysetup, veritysetyp, growfs, repart, cryptenroll, home -Recommends: libcryptsetup.so.12%{?elf_suffix} -Recommends: libcryptsetup.so.12(CRYPTSETUP_2.4)%{?elf_bits} - -# used by systemd-coredump and systemd-analyze -Recommends: libdw.so.1%{?elf_suffix} -Recommends: libdw.so.1(ELFUTILS_0.186)%{?elf_bits} -Recommends: libelf.so.1%{?elf_suffix} -Recommends: libelf.so.1(ELFUTILS_1.7)%{?elf_bits} - -# used by home, cryptsetup, cryptenroll, logind -Recommends: libfido2.so.1%{?elf_suffix} -Recommends: libp11-kit.so.0%{?elf_suffix} -Recommends: libtss2-esys.so.0%{?elf_suffix} -Recommends: libtss2-mu.so.0%{?elf_suffix} -Recommends: libtss2-rc.so.0%{?elf_suffix} - # https://bugzilla.redhat.com/show_bug.cgi?id=1377733#c9 Suggests: systemd-bootchart @@ -685,8 +632,6 @@ enabled for this to have any effect. %package resolved Summary: Network Name Resolution manager Requires: systemd%{_isa} = %{version}-%{release} -Requires: libidn2.so.0%{?elf_suffix} -Requires: libidn2.so.0(IDN2_0.0.0)%{?elf_bits} Requires(posttrans): grep %description resolved From d8abb91805b7a40f63422a248cc921ca5cd3f125 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 6 Feb 2026 12:38:15 +0100 Subject: [PATCH 21/63] Drop scriptlet workarounds for upgrades from versions < 247 247 was in 2020, so this should be OK. --- systemd.spec | 32 +------------------------------- 1 file changed, 1 insertion(+), 31 deletions(-) diff --git a/systemd.spec b/systemd.spec index df2a103..4324dc6 100644 --- a/systemd.spec +++ b/systemd.spec @@ -1296,18 +1296,6 @@ fi } %post udev -# Move old stuff around in /var/lib -mv %{_localstatedir}/lib/random-seed %{_localstatedir}/lib/systemd/random-seed &>/dev/null -mv %{_localstatedir}/lib/backlight %{_localstatedir}/lib/systemd/backlight &>/dev/null -if [ -L %{_localstatedir}/lib/systemd/timesync ]; then - rm %{_localstatedir}/lib/systemd/timesync - mv %{_localstatedir}/lib/private/systemd/timesync %{_localstatedir}/lib/systemd/timesync -fi -if [ -f %{_localstatedir}/lib/systemd/clock ]; then - mkdir -p %{_localstatedir}/lib/systemd/timesync - mv %{_localstatedir}/lib/systemd/clock %{_localstatedir}/lib/systemd/timesync/. -fi - systemd-hwdb update &>/dev/null %systemd_post %udev_services @@ -1316,11 +1304,6 @@ systemd-hwdb update &>/dev/null /usr/lib/systemd/systemd-random-seed save 2>&1 | \ grep -v 'Failed to open /dev/urandom' || : -# Replace obsolete keymaps -# https://bugzilla.redhat.com/show_bug.cgi?id=1151958 -grep -q -E '^KEYMAP="?fi-latin[19]"?' /etc/vconsole.conf 2>/dev/null && - sed -i.rpm.bak -r 's/^KEYMAP="?fi-latin[19]"?/KEYMAP="fi"/' /etc/vconsole.conf || : - %preun udev %systemd_preun %udev_services @@ -1359,20 +1342,7 @@ fi } %post networkd -# systemd-networkd was split out in systemd-246.6-2. -# Ideally, we would have a trigger scriptlet to record enablement -# state when upgrading from systemd <= systemd-246.6-1. But, AFAICS, -# rpm doesn't allow us to trigger on another package, short of -# querying the rpm database ourselves, which seems risky. For rpm, -# systemd and systemd-networkd are completely unrelated. So let's use -# a hack to detect if an old systemd version is currently present in -# the file system. -# https://bugzilla.redhat.com/show_bug.cgi?id=1943263 -if [ $1 -eq 1 ] && ls /usr/lib/systemd/libsystemd-shared-24[0-6].so &>/dev/null; then - echo "Skipping presets for systemd-networkd.service, seems we are upgrading from old systemd." -else - %systemd_post %networkd_services -fi +%systemd_post %networkd_services %preun networkd %systemd_preun %networkd_services From 8b3d1726f5f9386422c82d078e34d95ea88bada8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 19 May 2026 11:41:51 +0200 Subject: [PATCH 22/63] Add back various explit Requires The idn feature is in libsystemd-shared, and systemd-resolved doesn't contain any files that'd tie it to that shared library, so the genarator doesn't generate this dependency. This is a fundamental limitation of the rpm interface. Let's add a manual listing for now. Similarly, systemd-udev would miss many relevant Requires. --- systemd.spec | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/systemd.spec b/systemd.spec index 4324dc6..22bb56a 100644 --- a/systemd.spec +++ b/systemd.spec @@ -439,6 +439,33 @@ Requires(preun): systemd%{_isa} = %{version}-%{release} Requires(postun): systemd%{_isa} = %{version}-%{release} Requires(post): grep Requires: kmod >= 18-4 + +# Libkmod is used to load modules. Assume that if we need udevd, we certainly +# want to load modules, so make this into a hard dependency here. +Requires: libkmod.so.2%{?elf_suffix} +Requires: libkmod.so.2(LIBKMOD_5)%{?elf_bits} +# udev uses libblkid in various builtins so make it a hard dependency. +Requires: libblkid.so.1%{?elf_suffix} +Requires: libblkid.so.1(BLKID_2.30)%{?elf_bits} + +# Recommends to replace normal Requires deps for stuff that is dlopen()ed +# used by dissect, integritysetup, veritysetyp, growfs, repart, cryptenroll, home +Recommends: libcryptsetup.so.12%{?elf_suffix} +Recommends: libcryptsetup.so.12(CRYPTSETUP_2.4)%{?elf_bits} + +# used by systemd-coredump and systemd-analyze +Recommends: libdw.so.1%{?elf_suffix} +Recommends: libdw.so.1(ELFUTILS_0.186)%{?elf_bits} +Recommends: libelf.so.1%{?elf_suffix} +Recommends: libelf.so.1(ELFUTILS_1.7)%{?elf_bits} + +# used by home, cryptsetup, cryptenroll, logind +Recommends: libfido2.so.1%{?elf_suffix} +Recommends: libp11-kit.so.0%{?elf_suffix} +Recommends: libtss2-esys.so.0%{?elf_suffix} +Recommends: libtss2-mu.so.0%{?elf_suffix} +Recommends: libtss2-rc.so.0%{?elf_suffix} + Provides: udev = %{version} Provides: udev%{_isa} = %{version} %if 0%{?fedora} || 0%{?rhel} >= 10 @@ -632,6 +659,8 @@ enabled for this to have any effect. %package resolved Summary: Network Name Resolution manager Requires: systemd%{_isa} = %{version}-%{release} +Requires: libidn2.so.0%{?elf_suffix} +Requires: libidn2.so.0(IDN2_0.0.0)%{?elf_bits} Requires(posttrans): grep %description resolved From 3770fa7c92fa16cb9cb594d4917bca64ef17490a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 22 May 2026 18:12:29 +0200 Subject: [PATCH 23/63] Revert "Use dlopen-notes to automatically generate library Recommends/Requires/Suggests" This reverts commit ee6d0b9d27ce2646f8bdb377ae3dbe6ecc6ee522. The approach with dlopen-notes is not fully cooked yet. In particular, the case where the note is present in a shared library, but we'd like to declare the dependency for a binary which is a different package, is not supported by rpm. Let's revert for now and come back to this later. --- systemd.spec | 71 +++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 62 insertions(+), 9 deletions(-) diff --git a/systemd.spec b/systemd.spec index 22bb56a..a1aa899 100644 --- a/systemd.spec +++ b/systemd.spec @@ -175,8 +175,6 @@ BuildRequires: cryptsetup-devel # Require (previous version) of our macros package. # We use the %%systemd_{post,preun,…} macros for various services. BuildRequires: systemd-rpm-macros -# Use dlopen-notes to generate Requires/Recommends from embedded metadata. -BuildRequires: package-notes %endif BuildRequires: dbus-devel BuildRequires: util-linux @@ -341,15 +339,44 @@ Provides: /usr/sbin/shutdown %endif # libmount is always required, even in containers, so make it a hard dependency. +Requires: libmount.so.1%{?elf_suffix} +Requires: libmount.so.1(MOUNT_2.26)%{?elf_bits} # Various systemd services have syscall filters so make libseccomp a hard dependency. -# -# Libkmod is used to load modules. Assume that if we need udevd, we certainly -# want to load modules, so make this into a hard dependency here. -# udev uses libblkid in various builtins so make it a hard dependency. +Requires: libseccomp.so.2%{?elf_suffix} -%define __dlopen_notes_requires_opts --rpm-features=systemd:mount,systemd:seccomp,systemd-udev:kmod,systemd-udev:blkid,systemd-resolved:idn -# Upgrade upstream priority:suggested to Recommends -%define __dlopen_notes_recommends_opts --rpm-features=*:cryptsetup,*:xkbcommon,*:idn,*:pcre2,*:pwquality,%[0%{?fedora}?"*:qrencode":""],*:bpf,*:dw,*:elf,*:archive,systemd-udev:fido2,systemd-udev:tpm,systemd-udev:p11-kit +# Recommends to replace normal Requires deps for stuff that is dlopen()ed +Recommends: libxkbcommon.so.0%{?elf_suffix} +Recommends: libidn2.so.0%{?elf_suffix} +Recommends: libidn2.so.0(IDN2_0.0.0)%{?elf_bits} +Recommends: libpcre2-8.so.0%{?elf_suffix} +Recommends: libpwquality.so.1%{?elf_suffix} +Recommends: libpwquality.so.1(LIBPWQUALITY_1.0)%{?elf_bits} +%if 0%{?fedora} +Recommends: libqrencode.so.4%{?elf_suffix} +%endif +Recommends: libbpf.so.1%{?elf_suffix} +Recommends: libbpf.so.1(LIBBPF_0.4.0)%{?elf_bits} + +# used by systemd-coredump and systemd-analyze +Recommends: libdw.so.1%{?elf_suffix} +Recommends: libdw.so.1(ELFUTILS_0.186)%{?elf_bits} +Recommends: libelf.so.1%{?elf_suffix} +Recommends: libelf.so.1(ELFUTILS_1.7)%{?elf_bits} + +# used by dissect, integritysetup, veritysetyp, growfs, repart, cryptenroll, home +Recommends: libcryptsetup.so.12%{?elf_suffix} +Recommends: libcryptsetup.so.12(CRYPTSETUP_2.4)%{?elf_bits} + +# Libkmod is used to load modules. +Recommends: libkmod.so.2%{?elf_suffix} +# kmod_list_next, kmod_load_resources, kmod_module_get_initstate, +# kmod_module_get_module, kmod_module_get_name, kmod_module_new_from_lookup, +# kmod_module_probe_insert_module, kmod_module_unref, kmod_module_unref_list, +# kmod_new, kmod_set_log_fn, kmod_unref, kmod_validate_resources +# are part of LIBKMOD_5. +Recommends: libkmod.so.2(LIBKMOD_5)%{?elf_bits} + +Recommends: libarchive.so.13%{?elf_suffix} %description systemd is a system and service manager that runs as PID 1 and starts the rest @@ -483,6 +510,32 @@ Provides: systemd-timesyncd = %{version}-%{release} %endif Conflicts: systemd-networkd < %{version}-%{release} +# Libkmod is used to load modules. Assume that if we need udevd, we certainly +# want to load modules, so make this into a hard dependency here. +Requires: libkmod.so.2%{?elf_suffix} +Requires: libkmod.so.2(LIBKMOD_5)%{?elf_bits} +# udev uses libblkid in various builtins so make it a hard dependency. +Requires: libblkid.so.1%{?elf_suffix} +Requires: libblkid.so.1(BLKID_2.30)%{?elf_bits} + +# Recommends to replace normal Requires deps for stuff that is dlopen()ed +# used by dissect, integritysetup, veritysetyp, growfs, repart, cryptenroll, home +Recommends: libcryptsetup.so.12%{?elf_suffix} +Recommends: libcryptsetup.so.12(CRYPTSETUP_2.4)%{?elf_bits} + +# used by systemd-coredump and systemd-analyze +Recommends: libdw.so.1%{?elf_suffix} +Recommends: libdw.so.1(ELFUTILS_0.186)%{?elf_bits} +Recommends: libelf.so.1%{?elf_suffix} +Recommends: libelf.so.1(ELFUTILS_1.7)%{?elf_bits} + +# used by home, cryptsetup, cryptenroll, logind +Recommends: libfido2.so.1%{?elf_suffix} +Recommends: libp11-kit.so.0%{?elf_suffix} +Recommends: libtss2-esys.so.0%{?elf_suffix} +Recommends: libtss2-mu.so.0%{?elf_suffix} +Recommends: libtss2-rc.so.0%{?elf_suffix} + # https://bugzilla.redhat.com/show_bug.cgi?id=1377733#c9 Suggests: systemd-bootchart From 7d16ad00bd9f30409afcabdf3ade94047fd8092d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 14 Apr 2026 19:02:46 +0200 Subject: [PATCH 24/63] Fix compilation with openssl 4.0 --- 41639.patch | 81 ++++++++++++++++++++++++++++++++++++++++++++++++++++ systemd.spec | 3 ++ 2 files changed, 84 insertions(+) create mode 100644 41639.patch diff --git a/41639.patch b/41639.patch new file mode 100644 index 0000000..654f46f --- /dev/null +++ b/41639.patch @@ -0,0 +1,81 @@ +From 92c93fc9cc0012c3596e312167b054facafc216f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= +Date: Tue, 14 Apr 2026 18:59:07 +0200 +Subject: [PATCH] various: fix compilation with openssl-4.0.0-beta1 + +Various types have been made opaque, so we need to use some accessor +functions. +--- + src/sbsign/sbsign.c | 6 ++++-- + src/shared/pkcs11-util.c | 16 +++++++++------- + 2 files changed, 13 insertions(+), 9 deletions(-) + +diff --git a/src/sbsign/sbsign.c b/src/sbsign/sbsign.c +index d13dc5e326..2453ebb3ea 100644 +--- a/src/sbsign/sbsign.c ++++ b/src/sbsign/sbsign.c +@@ -262,8 +262,10 @@ static int spc_indirect_data_content_new(const void *digest, size_t digestsz, ui + return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get SpcPeImageData object: %s", + ERR_error_string(ERR_get_error(), NULL)); + +- idc->data->value->value.sequence->data = TAKE_PTR(peidraw); +- idc->data->value->value.sequence->length = peidrawsz; ++ if (!ASN1_STRING_set(idc->data->value->value.sequence, peidraw, peidrawsz)) ++ return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to set ASN1_STRING data."); ++ TAKE_PTR(peidraw); ++ + idc->messageDigest->digestAlgorithm->algorithm = OBJ_nid2obj(NID_sha256); + if (!idc->messageDigest->digestAlgorithm->algorithm) + return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get SHA256 object: %s", +diff --git a/src/shared/pkcs11-util.c b/src/shared/pkcs11-util.c +index 3062bcc554..693445eb41 100644 +--- a/src/shared/pkcs11-util.c ++++ b/src/shared/pkcs11-util.c +@@ -553,8 +553,13 @@ int pkcs11_token_read_public_key( + if (EVP_PKEY_fromdata_init(ctx) != 1) + return log_debug_errno(SYNTHETIC_ERRNO(EIO), "Failed to init an EVP_PKEY_CTX for EC."); + ++ + OSSL_PARAM ec_params[8] = { +- OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_PUB_KEY, os->data, os->length) ++ /* We need to drop the const from the data param, because ec_params is ++ * modified below. But we'll not modify ec_params[0]. */ ++ OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_PUB_KEY, ++ (unsigned char *) ASN1_STRING_get0_data(os), ++ ASN1_STRING_length(os)), + }; + + _cleanup_free_ void *order = NULL, *p = NULL, *a = NULL, *b = NULL, *generator = NULL; +@@ -657,13 +662,10 @@ int pkcs11_token_read_x509_certificate( + CK_OBJECT_HANDLE object, + X509 **ret_cert) { + +- _cleanup_free_ char *t = NULL; + CK_ATTRIBUTE attribute = { + .type = CKA_VALUE + }; + CK_RV rv; +- _cleanup_(X509_freep) X509 *x509 = NULL; +- X509_NAME *name = NULL; + int r; + + r = dlopen_p11kit(); +@@ -687,15 +689,15 @@ int pkcs11_token_read_x509_certificate( + "Failed to read X.509 certificate data off token: %s", sym_p11_kit_strerror(rv)); + + const unsigned char *p = attribute.pValue; +- x509 = d2i_X509(NULL, &p, attribute.ulValueLen); ++ _cleanup_(X509_freep) X509 *x509 = d2i_X509(NULL, &p, attribute.ulValueLen); + if (!x509) + return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "Failed to parse X.509 certificate."); + +- name = X509_get_subject_name(x509); ++ const X509_NAME *name = X509_get_subject_name(x509); + if (!name) + return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "Failed to acquire X.509 subject name."); + +- t = X509_NAME_oneline(name, NULL, 0); ++ _cleanup_free_ char *t = X509_NAME_oneline(name, NULL, 0); + if (!t) + return log_debug_errno(SYNTHETIC_ERRNO(EIO), "Failed to format X.509 subject name as string."); + diff --git a/systemd.spec b/systemd.spec index a1aa899..a4a1bee 100644 --- a/systemd.spec +++ b/systemd.spec @@ -152,6 +152,9 @@ Patch: 38769.patch # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2415701 Patch: 0002-machined-continue-without-resolve.hook-socket.patch +# Fix compilation with openssl 4.0 +Patch: https://github.com/systemd/systemd/pull/41639.patch + %endif %ifarch %{ix86} x86_64 aarch64 riscv64 From 9cb09470c9c5a437f8e9c1e0e449b87de83733eb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 22 May 2026 19:09:27 +0200 Subject: [PATCH 25/63] Version 261~rc1 - explicit dependencies are added for various libraries loaded using dlopen() --- ...db-root-directory-with-correct-label.patch | 12 +-- ...continue-without-resolve.hook-socket.patch | 6 +- 41639.patch | 81 ------------------- sources | 2 +- split-files.py | 3 + systemd.spec | 39 ++++++--- 6 files changed, 43 insertions(+), 100 deletions(-) rename 38769.patch => 0001-core-create-userdb-root-directory-with-correct-label.patch (87%) delete mode 100644 41639.patch diff --git a/38769.patch b/0001-core-create-userdb-root-directory-with-correct-label.patch similarity index 87% rename from 38769.patch rename to 0001-core-create-userdb-root-directory-with-correct-label.patch index 714a219..9cc2cbd 100644 --- a/38769.patch +++ b/0001-core-create-userdb-root-directory-with-correct-label.patch @@ -1,4 +1,4 @@ -From e364a55e4869288c3574c856c9c96ad174a204ac Mon Sep 17 00:00:00 2001 +From 64a0066cfaa4dfcf25c5f6d3ae58df4f24dd1108 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= Date: Sat, 30 Aug 2025 13:55:56 +0200 Subject: [PATCH 1/2] core: create userdb root directory with correct label @@ -16,18 +16,18 @@ longer is. Regression introduced in 736349958efe34089131ca88950e2e5bb391d36a. 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/core/varlink.c b/src/core/varlink.c -index ec4f8abad9..9a03bf9bda 100644 +index 6074c55ab1..acd51fc47e 100644 --- a/src/core/varlink.c +++ b/src/core/varlink.c -@@ -6,6 +6,7 @@ - #include "errno-util.h" +@@ -8,6 +8,7 @@ + #include "json-util.h" #include "manager.h" #include "metrics.h" -+#include "mkdir-label.h" ++#include "mkdir.h" #include "path-util.h" #include "pidref.h" #include "string-util.h" -@@ -469,7 +470,11 @@ static int varlink_server_listen_many_idempotent_sentinel( +@@ -514,7 +515,11 @@ static int varlink_server_listen_many_idempotent_sentinel( if (!known_fresh && varlink_server_contains_socket(s, address)) continue; diff --git a/0002-machined-continue-without-resolve.hook-socket.patch b/0002-machined-continue-without-resolve.hook-socket.patch index 4d7f401..7de7adf 100644 --- a/0002-machined-continue-without-resolve.hook-socket.patch +++ b/0002-machined-continue-without-resolve.hook-socket.patch @@ -1,4 +1,4 @@ -From 9b1828c629007953a7c0abdd4a830d2d65017570 Mon Sep 17 00:00:00 2001 +From 786d3f382308d0119cce020e2c88a03ff96a25d9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 26 Nov 2025 22:29:53 +0100 Subject: [PATCH 2/2] machined: continue without resolve.hook socket @@ -8,10 +8,10 @@ Subject: [PATCH 2/2] machined: continue without resolve.hook socket 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/machine/machined-varlink.c b/src/machine/machined-varlink.c -index 543e4c8ee7..04091b9674 100644 +index acc2137f83..d1c9453e41 100644 --- a/src/machine/machined-varlink.c +++ b/src/machine/machined-varlink.c -@@ -881,9 +881,15 @@ static int manager_varlink_init_resolve_hook(Manager *m) { +@@ -904,9 +904,15 @@ static int manager_varlink_init_resolve_hook(Manager *m) { r = sd_varlink_server_listen_address(s, VARLINK_PATH_MACHINED_RESOLVE_HOOK, 0666 | SD_VARLINK_SERVER_MODE_MKDIR_0755); diff --git a/41639.patch b/41639.patch deleted file mode 100644 index 654f46f..0000000 --- a/41639.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 92c93fc9cc0012c3596e312167b054facafc216f Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= -Date: Tue, 14 Apr 2026 18:59:07 +0200 -Subject: [PATCH] various: fix compilation with openssl-4.0.0-beta1 - -Various types have been made opaque, so we need to use some accessor -functions. ---- - src/sbsign/sbsign.c | 6 ++++-- - src/shared/pkcs11-util.c | 16 +++++++++------- - 2 files changed, 13 insertions(+), 9 deletions(-) - -diff --git a/src/sbsign/sbsign.c b/src/sbsign/sbsign.c -index d13dc5e326..2453ebb3ea 100644 ---- a/src/sbsign/sbsign.c -+++ b/src/sbsign/sbsign.c -@@ -262,8 +262,10 @@ static int spc_indirect_data_content_new(const void *digest, size_t digestsz, ui - return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get SpcPeImageData object: %s", - ERR_error_string(ERR_get_error(), NULL)); - -- idc->data->value->value.sequence->data = TAKE_PTR(peidraw); -- idc->data->value->value.sequence->length = peidrawsz; -+ if (!ASN1_STRING_set(idc->data->value->value.sequence, peidraw, peidrawsz)) -+ return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to set ASN1_STRING data."); -+ TAKE_PTR(peidraw); -+ - idc->messageDigest->digestAlgorithm->algorithm = OBJ_nid2obj(NID_sha256); - if (!idc->messageDigest->digestAlgorithm->algorithm) - return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get SHA256 object: %s", -diff --git a/src/shared/pkcs11-util.c b/src/shared/pkcs11-util.c -index 3062bcc554..693445eb41 100644 ---- a/src/shared/pkcs11-util.c -+++ b/src/shared/pkcs11-util.c -@@ -553,8 +553,13 @@ int pkcs11_token_read_public_key( - if (EVP_PKEY_fromdata_init(ctx) != 1) - return log_debug_errno(SYNTHETIC_ERRNO(EIO), "Failed to init an EVP_PKEY_CTX for EC."); - -+ - OSSL_PARAM ec_params[8] = { -- OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_PUB_KEY, os->data, os->length) -+ /* We need to drop the const from the data param, because ec_params is -+ * modified below. But we'll not modify ec_params[0]. */ -+ OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_PUB_KEY, -+ (unsigned char *) ASN1_STRING_get0_data(os), -+ ASN1_STRING_length(os)), - }; - - _cleanup_free_ void *order = NULL, *p = NULL, *a = NULL, *b = NULL, *generator = NULL; -@@ -657,13 +662,10 @@ int pkcs11_token_read_x509_certificate( - CK_OBJECT_HANDLE object, - X509 **ret_cert) { - -- _cleanup_free_ char *t = NULL; - CK_ATTRIBUTE attribute = { - .type = CKA_VALUE - }; - CK_RV rv; -- _cleanup_(X509_freep) X509 *x509 = NULL; -- X509_NAME *name = NULL; - int r; - - r = dlopen_p11kit(); -@@ -687,15 +689,15 @@ int pkcs11_token_read_x509_certificate( - "Failed to read X.509 certificate data off token: %s", sym_p11_kit_strerror(rv)); - - const unsigned char *p = attribute.pValue; -- x509 = d2i_X509(NULL, &p, attribute.ulValueLen); -+ _cleanup_(X509_freep) X509 *x509 = d2i_X509(NULL, &p, attribute.ulValueLen); - if (!x509) - return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "Failed to parse X.509 certificate."); - -- name = X509_get_subject_name(x509); -+ const X509_NAME *name = X509_get_subject_name(x509); - if (!name) - return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "Failed to acquire X.509 subject name."); - -- t = X509_NAME_oneline(name, NULL, 0); -+ _cleanup_free_ char *t = X509_NAME_oneline(name, NULL, 0); - if (!t) - return log_debug_errno(SYNTHETIC_ERRNO(EIO), "Failed to format X.509 subject name as string."); - diff --git a/sources b/sources index b4eba69..b1a4b48 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-260.1.tar.gz) = 9f975dce6861853a817a7ceab18a24449a85d1bda6939b3a5173430c02a4d8a9a2b34ebb8cce1c51db9b0ff9078fcc65da7b0f44e3bdcbbe013b9e04bb6f0ff9 +SHA512 (systemd-261-rc1.tar.gz) = f5601cb007c594e981132daa93f19d7205fb71842ce969c67de23a2d3b5714e65e135bb8d2154e1368f97c7f30ac8c9b63f546434714982509982ae03212057f diff --git a/split-files.py b/split-files.py index 20f0417..84cc955 100644 --- a/split-files.py +++ b/split-files.py @@ -235,7 +235,10 @@ for file in files(buildroot): remount-fs| tpm2| /initrd| + systemd-sysinstall| systemd[.-]pcr| + systemd-imdsd| + systemd-loop| /pcrlock\.d| systemd-measure| /boot$| diff --git a/systemd.spec b/systemd.spec index a4a1bee..a7e264f 100644 --- a/systemd.spec +++ b/systemd.spec @@ -76,7 +76,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:260.1} +Version: %{?version_override}%{!?version_override:261~rc1} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif @@ -147,14 +147,11 @@ Patch: 30846.patch # userdb: create userdb root directory with correct label # We can drop this after SELinux policy is updated to handle the transition. -Patch: 38769.patch +Patch: 0001-core-create-userdb-root-directory-with-correct-label.patch # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2415701 Patch: 0002-machined-continue-without-resolve.hook-socket.patch -# Fix compilation with openssl 4.0 -Patch: https://github.com/systemd/systemd/pull/41639.patch - %endif %ifarch %{ix86} x86_64 aarch64 riscv64 @@ -292,6 +289,8 @@ Requires: systemd-shared%{_isa} = %{version}-%{release} Requires: /usr/bin/systemd-sysusers # The standalone version doesn't Provide the _isa suffix, # so this biases towards the common version. +Requires: libzstd.so.1%{?elf_suffix} + Recommends: systemd-sysusers%{_isa} = %{version}-%{release} Recommends: diffutils Requires: (util-linux-core or util-linux) @@ -347,6 +346,10 @@ Requires: libmount.so.1(MOUNT_2.26)%{?elf_bits} # Various systemd services have syscall filters so make libseccomp a hard dependency. Requires: libseccomp.so.2%{?elf_suffix} +Requires: libacl.so.1%{?elf_suffix} + +Recommends: libaudit.so.1%{?elf_suffix} + # Recommends to replace normal Requires deps for stuff that is dlopen()ed Recommends: libxkbcommon.so.0%{?elf_suffix} Recommends: libidn2.so.0%{?elf_suffix} @@ -379,7 +382,14 @@ Recommends: libkmod.so.2%{?elf_suffix} # are part of LIBKMOD_5. Recommends: libkmod.so.2(LIBKMOD_5)%{?elf_bits} -Recommends: libarchive.so.13%{?elf_suffix} +# This is mentioned here, but the assumption is that systems which use SELinux +# will have the libraries. +Suggests: libselinux.so.1%{?elf_suffix} + +# Those can be useful to read old journal files. +Suggests: liblzma.so.5%{?elf_suffix} +Suggests: liblz4.so.1%{?elf_suffix} +Suggests: libz.so.1%{?elf_suffix} %description systemd is a system and service manager that runs as PID 1 and starts the rest @@ -478,6 +488,8 @@ Requires: libkmod.so.2(LIBKMOD_5)%{?elf_bits} Requires: libblkid.so.1%{?elf_suffix} Requires: libblkid.so.1(BLKID_2.30)%{?elf_bits} +Requires: libfdisk.so.1%{?elf_suffix} + # Recommends to replace normal Requires deps for stuff that is dlopen()ed # used by dissect, integritysetup, veritysetyp, growfs, repart, cryptenroll, home Recommends: libcryptsetup.so.12%{?elf_suffix} @@ -495,6 +507,9 @@ Recommends: libp11-kit.so.0%{?elf_suffix} Recommends: libtss2-esys.so.0%{?elf_suffix} Recommends: libtss2-mu.so.0%{?elf_suffix} Recommends: libtss2-rc.so.0%{?elf_suffix} +Recommends: libtss2-tcti-device.so.0%{?elf_suffix} + +Recommends: libarchive.so.13%{?elf_suffix} Provides: udev = %{version} Provides: udev%{_isa} = %{version} @@ -661,6 +676,12 @@ Recommends: qemu-kvm-core Recommends: qemu-device-display-virtio-gpu Recommends: qemu-device-display-virtio-vga %endif + +# May be used to decompress downloads +Recommends: liblzma.so.5%{?elf_suffix} +Recommends: libz.so.1%{?elf_suffix} +Recommends: libbz2.so.1%{?elf_suffix} + # Bias the system towards libcurl-minimal if nothing pulls in full libcurl (#1997040) Suggests: libcurl-minimal License: LGPL-2.1-or-later @@ -679,6 +700,8 @@ License: LGPL-2.1-or-later Requires: firewalld-filesystem Provides: systemd-journal-gateway = %{version}-%{release} Provides: systemd-journal-gateway%{_isa} = %{version}-%{release} +Requires: libmicrohttpd.so.12%{?elf_suffix} +Requires: libcurl.so.4%{?elf_suffix} # Bias the system towards libcurl-minimal if nothing pulls in full libcurl (#1997040) Suggests: libcurl-minimal @@ -840,8 +863,6 @@ VMLINUX_H_PATH=$(%python3 -c '%find_vmlinux_h') CONFIGURE_OPTS=( -Dmode=release -Dslow-tests=true - -Dsysvinit-path=/etc/rc.d/init.d - -Drc-local=/etc/rc.d/rc.local -Dntp-servers='0.%{ntpvendor}.pool.ntp.org 1.%{ntpvendor}.pool.ntp.org 2.%{ntpvendor}.pool.ntp.org 3.%{ntpvendor}.pool.ntp.org' -Ddns-servers= -Dservice-watchdog= @@ -879,7 +900,6 @@ CONFIGURE_OPTS=( -Dmicrohttpd=enabled -Dvmspawn=enabled -Dlibidn2=enabled - -Dlibiptc=disabled -Dlibcurl=enabled -Dlibfido2=enabled -Dxenctrl=%[0%{?have_xen}?"enabled":"disabled"] @@ -1343,6 +1363,7 @@ fi systemd-pcrlock.socket systemd-pcrlock@.service systemd-pcrmachine.service + systemd-pcrosseparator.service systemd-pcrphase-initrd.service systemd-pcrphase-sysinit.service systemd-pcrphase.service From bd81a14bfc7a6902797cd3d18efd99454b17c1b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 26 May 2026 23:10:30 +0200 Subject: [PATCH 26/63] Version 261~rc2 - A few fixes for this and that incl. rhbz#2481304, rhbz#2481466 --- sources | 2 +- systemd.spec | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sources b/sources index b1a4b48..7282b0a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-261-rc1.tar.gz) = f5601cb007c594e981132daa93f19d7205fb71842ce969c67de23a2d3b5714e65e135bb8d2154e1368f97c7f30ac8c9b63f546434714982509982ae03212057f +SHA512 (systemd-261-rc2.tar.gz) = 4a46d24b4b4dd386a3077669b74fc4f98be064d19b72089d271724c097eb0c6d07a1cc9322fdcb7d501135e51d2f1dda01eb90bbfbda0aecabc900fefb1b8aa0 diff --git a/systemd.spec b/systemd.spec index a7e264f..1ca4aea 100644 --- a/systemd.spec +++ b/systemd.spec @@ -76,7 +76,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:261~rc1} +Version: %{?version_override}%{!?version_override:261~rc2} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif From 6ddbd499e83f7a53c908ff6b9ea0ad04f2c0d8c3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Jun 2026 19:12:37 +0200 Subject: [PATCH 27/63] Drop unused tree build dependency MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported by Marián Konček. [skip changelog] --- systemd.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/systemd.spec b/systemd.spec index 1ca4aea..9ffadf8 100644 --- a/systemd.spec +++ b/systemd.spec @@ -229,7 +229,6 @@ BuildRequires: docbook-style-xsl BuildRequires: pkgconfig BuildRequires: gperf BuildRequires: gawk -BuildRequires: tree BuildRequires: hostname BuildRequires: python3 BuildRequires: python3-devel From 06bd9926f272e1689e53e1a4b4bcc2a44795d576 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Thu, 4 Jun 2026 18:28:12 +0200 Subject: [PATCH 28/63] Version 261~rc3 - Various smaller and larger fixes - A hint is emitted if init is called with the legacy telinit args (rhbz#2479961) - Various messages for missing dlopened libraries have been downgraded (rhbz#2463540) --- sources | 2 +- systemd.spec | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sources b/sources index 7282b0a..4cdd84b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-261-rc2.tar.gz) = 4a46d24b4b4dd386a3077669b74fc4f98be064d19b72089d271724c097eb0c6d07a1cc9322fdcb7d501135e51d2f1dda01eb90bbfbda0aecabc900fefb1b8aa0 +SHA512 (systemd-261-rc3.tar.gz) = facbcb7831fb84a38eaee5804d9aa03382486006cdb559010d6d353ad9a3986b516522cde1f0e0808fb49365859f790dd1caed24875a1c9e339e892d09d2cf30 diff --git a/systemd.spec b/systemd.spec index 9ffadf8..c6bb2ea 100644 --- a/systemd.spec +++ b/systemd.spec @@ -76,7 +76,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:261~rc2} +Version: %{?version_override}%{!?version_override:261~rc3} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif From 720fa8259a64a2de8c0119d59d7545fba5319c36 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 10 Jun 2026 13:06:11 +0200 Subject: [PATCH 29/63] Do not check ownership of /var/lib/systemd/timesync/ in rpm -V rpm -V systemd-udev would report that /var/lib/systemd/timesync/ has wrong ownership. This happens because create the directory via %ghost and it ends up with the default root:root ownership in the rpm %files list. We _could_ fix the owernship in the listing, but it's actually OK if the directory is owned by root or even some other account, as long as the service is not running. Systemd will change owernship to the systemd-timesync user:group when starting the service. Disabling of the ownership verification makes it easier to precreate the timestamp (c.f. https://src.fedoraproject.org/rpms/systemd/pull-request/238). So let's just disable the owernship check. --- split-files.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/split-files.py b/split-files.py index 84cc955..f7f9989 100644 --- a/split-files.py +++ b/split-files.py @@ -26,8 +26,8 @@ known_files = ''' %ghost %dir /var/lib/private/systemd %ghost %dir /var/lib/private/systemd/journal-upload %ghost /var/lib/private/systemd/journal-upload/state -%ghost %dir /var/lib/systemd/timesync -%ghost /var/lib/systemd/timesync/clock +%ghost %dir %verify(not user group) /var/lib/systemd/timesync +%ghost %verify(not user group) /var/lib/systemd/timesync/clock %ghost %dir /var/lib/systemd/backlight %ghost /var/lib/systemd/catalog/database %ghost %dir /var/lib/systemd/coredump From 14a9aac87e97a693d1347ae376512dd434af2296 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Jun 2026 15:38:46 +0200 Subject: [PATCH 30/63] Use dlopen notes again This requires updated dlopen-notes. A version dependency is introduced. The levels of various dendencies were adjusted, see comments. The motivation for this change is to make management of the dependencies (Requires, Recommends, Suggests). Previously, we had to adjust the depencencies whenever things were converted to dlopen, or the list of libraries used was changed. This was tedious and hard to get right. Now we have good metadata provided by upstream, so we mostly rely on that only only do some overrides downstream. --- systemd.spec | 143 +++++++++------------------------------------------ 1 file changed, 25 insertions(+), 118 deletions(-) diff --git a/systemd.spec b/systemd.spec index c6bb2ea..4c4c5b7 100644 --- a/systemd.spec +++ b/systemd.spec @@ -7,11 +7,6 @@ %global system_unit_dir %{pkgdir}/system %global user_unit_dir %{pkgdir}/user -%if 0%{?__isa_bits} == 64 -%global elf_bits (64bit) -%global elf_suffix ()%{elf_bits} -%endif - %bcond bzip2 1 %bcond gnutls 1 %bcond lz4 1 @@ -151,7 +146,6 @@ Patch: 0001-core-create-userdb-root-directory-with-correct-label.patch # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2415701 Patch: 0002-machined-continue-without-resolve.hook-socket.patch - %endif %ifarch %{ix86} x86_64 aarch64 riscv64 @@ -175,6 +169,8 @@ BuildRequires: cryptsetup-devel # Require (previous version) of our macros package. # We use the %%systemd_{post,preun,…} macros for various services. BuildRequires: systemd-rpm-macros +# Use dlopen-notes to generate Requires/Recommends from embedded metadata. +BuildRequires: package-notes >= 0.18 %endif BuildRequires: dbus-devel BuildRequires: util-linux @@ -286,11 +282,11 @@ Requires: systemd-libs%{_isa} = %{version}-%{release} %{?fedora:Recommends: systemd-resolved = %{version}-%{release}} Requires: systemd-shared%{_isa} = %{version}-%{release} Requires: /usr/bin/systemd-sysusers + # The standalone version doesn't Provide the _isa suffix, # so this biases towards the common version. -Requires: libzstd.so.1%{?elf_suffix} - Recommends: systemd-sysusers%{_isa} = %{version}-%{release} + Recommends: diffutils Requires: (util-linux-core or util-linux) Requires: (libbpf >= 2:1.4.7 if libbpf) @@ -339,56 +335,33 @@ Provides: /usr/sbin/reboot Provides: /usr/sbin/shutdown %endif -# libmount is always required, even in containers, so make it a hard dependency. -Requires: libmount.so.1%{?elf_suffix} -Requires: libmount.so.1(MOUNT_2.26)%{?elf_bits} -# Various systemd services have syscall filters so make libseccomp a hard dependency. -Requires: libseccomp.so.2%{?elf_suffix} +%define dlopen_notes_features %{expand: + # Various systemd services have syscall filters so make libseccomp a hard dependency. + systemd:seccomp:required -Requires: libacl.so.1%{?elf_suffix} + # zstd is used for compression in the journal + systemd:zstd:required -Recommends: libaudit.so.1%{?elf_suffix} + # Libkmod is used to load modules. Assume that if we need udevd, we certainly + # want to load modules, so make this into a hard dependency here. + systemd-udev:kmod:required -# Recommends to replace normal Requires deps for stuff that is dlopen()ed -Recommends: libxkbcommon.so.0%{?elf_suffix} -Recommends: libidn2.so.0%{?elf_suffix} -Recommends: libidn2.so.0(IDN2_0.0.0)%{?elf_bits} -Recommends: libpcre2-8.so.0%{?elf_suffix} -Recommends: libpwquality.so.1%{?elf_suffix} -Recommends: libpwquality.so.1(LIBPWQUALITY_1.0)%{?elf_bits} -%if 0%{?fedora} -Recommends: libqrencode.so.4%{?elf_suffix} -%endif -Recommends: libbpf.so.1%{?elf_suffix} -Recommends: libbpf.so.1(LIBBPF_0.4.0)%{?elf_bits} + # We want to always use idn with resolved. + systemd-resolved:idn:required -# used by systemd-coredump and systemd-analyze -Recommends: libdw.so.1%{?elf_suffix} -Recommends: libdw.so.1(ELFUTILS_0.186)%{?elf_bits} -Recommends: libelf.so.1%{?elf_suffix} -Recommends: libelf.so.1(ELFUTILS_1.7)%{?elf_bits} + # libcurl is required by systemd-imdsd and systemd-report. + # Downgrade the dep for now. + systemd:curl:recommended + systemd-udev:curl:recommended -# used by dissect, integritysetup, veritysetyp, growfs, repart, cryptenroll, home -Recommends: libcryptsetup.so.12%{?elf_suffix} -Recommends: libcryptsetup.so.12(CRYPTSETUP_2.4)%{?elf_bits} + # libssl + libcrypto are required by systemd-resolved/resolvectl. + # Downgrade the dep in the main package. + systemd:libssl:recommended + systemd:libcrypto:recommended -# Libkmod is used to load modules. -Recommends: libkmod.so.2%{?elf_suffix} -# kmod_list_next, kmod_load_resources, kmod_module_get_initstate, -# kmod_module_get_module, kmod_module_get_name, kmod_module_new_from_lookup, -# kmod_module_probe_insert_module, kmod_module_unref, kmod_module_unref_list, -# kmod_new, kmod_set_log_fn, kmod_unref, kmod_validate_resources -# are part of LIBKMOD_5. -Recommends: libkmod.so.2(LIBKMOD_5)%{?elf_bits} - -# This is mentioned here, but the assumption is that systems which use SELinux -# will have the libraries. -Suggests: libselinux.so.1%{?elf_suffix} - -# Those can be useful to read old journal files. -Suggests: liblzma.so.5%{?elf_suffix} -Suggests: liblz4.so.1%{?elf_suffix} -Suggests: libz.so.1%{?elf_suffix} + # Disable qrencode on non-fedora builds + %{!?fedora:*:qrencode:ignored} +} %description systemd is a system and service manager that runs as PID 1 and starts the rest @@ -479,37 +452,6 @@ Requires(postun): systemd%{_isa} = %{version}-%{release} Requires(post): grep Requires: kmod >= 18-4 -# Libkmod is used to load modules. Assume that if we need udevd, we certainly -# want to load modules, so make this into a hard dependency here. -Requires: libkmod.so.2%{?elf_suffix} -Requires: libkmod.so.2(LIBKMOD_5)%{?elf_bits} -# udev uses libblkid in various builtins so make it a hard dependency. -Requires: libblkid.so.1%{?elf_suffix} -Requires: libblkid.so.1(BLKID_2.30)%{?elf_bits} - -Requires: libfdisk.so.1%{?elf_suffix} - -# Recommends to replace normal Requires deps for stuff that is dlopen()ed -# used by dissect, integritysetup, veritysetyp, growfs, repart, cryptenroll, home -Recommends: libcryptsetup.so.12%{?elf_suffix} -Recommends: libcryptsetup.so.12(CRYPTSETUP_2.4)%{?elf_bits} - -# used by systemd-coredump and systemd-analyze -Recommends: libdw.so.1%{?elf_suffix} -Recommends: libdw.so.1(ELFUTILS_0.186)%{?elf_bits} -Recommends: libelf.so.1%{?elf_suffix} -Recommends: libelf.so.1(ELFUTILS_1.7)%{?elf_bits} - -# used by home, cryptsetup, cryptenroll, logind -Recommends: libfido2.so.1%{?elf_suffix} -Recommends: libp11-kit.so.0%{?elf_suffix} -Recommends: libtss2-esys.so.0%{?elf_suffix} -Recommends: libtss2-mu.so.0%{?elf_suffix} -Recommends: libtss2-rc.so.0%{?elf_suffix} -Recommends: libtss2-tcti-device.so.0%{?elf_suffix} - -Recommends: libarchive.so.13%{?elf_suffix} - Provides: udev = %{version} Provides: udev%{_isa} = %{version} %if 0%{?fedora} || 0%{?rhel} >= 10 @@ -527,32 +469,6 @@ Provides: systemd-timesyncd = %{version}-%{release} %endif Conflicts: systemd-networkd < %{version}-%{release} -# Libkmod is used to load modules. Assume that if we need udevd, we certainly -# want to load modules, so make this into a hard dependency here. -Requires: libkmod.so.2%{?elf_suffix} -Requires: libkmod.so.2(LIBKMOD_5)%{?elf_bits} -# udev uses libblkid in various builtins so make it a hard dependency. -Requires: libblkid.so.1%{?elf_suffix} -Requires: libblkid.so.1(BLKID_2.30)%{?elf_bits} - -# Recommends to replace normal Requires deps for stuff that is dlopen()ed -# used by dissect, integritysetup, veritysetyp, growfs, repart, cryptenroll, home -Recommends: libcryptsetup.so.12%{?elf_suffix} -Recommends: libcryptsetup.so.12(CRYPTSETUP_2.4)%{?elf_bits} - -# used by systemd-coredump and systemd-analyze -Recommends: libdw.so.1%{?elf_suffix} -Recommends: libdw.so.1(ELFUTILS_0.186)%{?elf_bits} -Recommends: libelf.so.1%{?elf_suffix} -Recommends: libelf.so.1(ELFUTILS_1.7)%{?elf_bits} - -# used by home, cryptsetup, cryptenroll, logind -Recommends: libfido2.so.1%{?elf_suffix} -Recommends: libp11-kit.so.0%{?elf_suffix} -Recommends: libtss2-esys.so.0%{?elf_suffix} -Recommends: libtss2-mu.so.0%{?elf_suffix} -Recommends: libtss2-rc.so.0%{?elf_suffix} - # https://bugzilla.redhat.com/show_bug.cgi?id=1377733#c9 Suggests: systemd-bootchart @@ -676,11 +592,6 @@ Recommends: qemu-device-display-virtio-gpu Recommends: qemu-device-display-virtio-vga %endif -# May be used to decompress downloads -Recommends: liblzma.so.5%{?elf_suffix} -Recommends: libz.so.1%{?elf_suffix} -Recommends: libbz2.so.1%{?elf_suffix} - # Bias the system towards libcurl-minimal if nothing pulls in full libcurl (#1997040) Suggests: libcurl-minimal License: LGPL-2.1-or-later @@ -699,8 +610,6 @@ License: LGPL-2.1-or-later Requires: firewalld-filesystem Provides: systemd-journal-gateway = %{version}-%{release} Provides: systemd-journal-gateway%{_isa} = %{version}-%{release} -Requires: libmicrohttpd.so.12%{?elf_suffix} -Requires: libcurl.so.4%{?elf_suffix} # Bias the system towards libcurl-minimal if nothing pulls in full libcurl (#1997040) Suggests: libcurl-minimal @@ -737,8 +646,6 @@ enabled for this to have any effect. %package resolved Summary: Network Name Resolution manager Requires: systemd%{_isa} = %{version}-%{release} -Requires: libidn2.so.0%{?elf_suffix} -Requires: libidn2.so.0(IDN2_0.0.0)%{?elf_bits} Requires(posttrans): grep %description resolved From 0064f73d973687bea141161fb104f94f845a8226 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 12 Jun 2026 12:23:09 -0400 Subject: [PATCH 31/63] Rebuilt for openssl 4.0 From 8ff635a921f8932d37ce62a40700e808d817b6f2 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 12 Jun 2026 19:52:53 -0400 Subject: [PATCH 32/63] Rebuilt for openssl 4.0 From 4faee7ab7de28cb4271d610596a26c0aec85bba9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 17 Jun 2026 00:27:47 +0200 Subject: [PATCH 33/63] Version 261~rc4 - New translations and various other fixes --- sources | 2 +- systemd.spec | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sources b/sources index 4cdd84b..5b25319 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-261-rc3.tar.gz) = facbcb7831fb84a38eaee5804d9aa03382486006cdb559010d6d353ad9a3986b516522cde1f0e0808fb49365859f790dd1caed24875a1c9e339e892d09d2cf30 +SHA512 (systemd-261-rc4.tar.gz) = b50c3391722bc28e5945666b4271d86926d1bdce4353c0a566a7765e1f0784ee00e6a5096f658c64917a7aeffd135acad15d7189c8e3041dce11e10d2c49d7cb diff --git a/systemd.spec b/systemd.spec index 4c4c5b7..280dccc 100644 --- a/systemd.spec +++ b/systemd.spec @@ -71,7 +71,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:261~rc3} +Version: %{?version_override}%{!?version_override:261~rc4} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif From 5a3e750ef8102447a9a7b8d2324f52bafac6a5a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 19 Jun 2026 20:17:09 +0200 Subject: [PATCH 34/63] Version 261 - Still some fixes after -rc4, incl. a change to how openssl/libcrypto is loaded and to imds service ordering at startup --- sources | 2 +- systemd.spec | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sources b/sources index 5b25319..d3c45e1 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-261-rc4.tar.gz) = b50c3391722bc28e5945666b4271d86926d1bdce4353c0a566a7765e1f0784ee00e6a5096f658c64917a7aeffd135acad15d7189c8e3041dce11e10d2c49d7cb +SHA512 (systemd-261.tar.gz) = 6a21c2a9bd83d962db4e6c095078ec79259d8109583b59094d17e76c0826e96a6183778f46b64352b0fe62cb8890736e9331f35e9a4c8b65f9b574fa915f9fd8 diff --git a/systemd.spec b/systemd.spec index 280dccc..e0b8792 100644 --- a/systemd.spec +++ b/systemd.spec @@ -71,7 +71,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:261~rc4} +Version: %{?version_override}%{!?version_override:261} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif From 054158500a9fb8a5867055fe1ec430b56c04569c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 19 Jun 2026 21:44:06 +0200 Subject: [PATCH 35/63] Update to load openssl-4 rather than openssl-3 The autogenerated dependency (Requires:libcrypto.so.3()(64bit) in systemd-udev.rpm) is causing a failure in coreos.cosa.build-and-test. --- 42668.patch | 44 ++++++++++++++++++++++++++++++++++++++++++++ systemd.spec | 3 +++ 2 files changed, 47 insertions(+) create mode 100644 42668.patch diff --git a/42668.patch b/42668.patch new file mode 100644 index 0000000..4754a3a --- /dev/null +++ b/42668.patch @@ -0,0 +1,44 @@ +From e6f1190eb6be465432cfbab267a59c851ae990c5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= +Date: Fri, 19 Jun 2026 21:38:44 +0200 +Subject: [PATCH] crypto-util: prefer openssl-4 + +Fedora has switched to openssl 4, and we generate a Requires dependency +on libcrypto for the systemd-udev subpackage, so preferring openssl-3 +does the wrong thing. So the order in the dlopen note needs to be switched. +But in general, we want to get rid of openssl-3, so we want to load +openssl-4 in preference. Change the order in both places. + +(The "compat" order can stay in 261-stable for other distros.) +--- + src/shared/crypto-util.c | 3 +-- + src/shared/crypto-util.h | 2 +- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/src/shared/crypto-util.c b/src/shared/crypto-util.c +index ed6d2a269c772..b345475fa4043 100644 +--- a/src/shared/crypto-util.c ++++ b/src/shared/crypto-util.c +@@ -339,8 +339,7 @@ int dlopen_libcrypto(int log_level) { + + LIBCRYPTO_NOTE(SD_ELF_NOTE_DLOPEN_PRIORITY_SUGGESTED); + +- // FIXME: switch order to prefer libcrypto.so.4 in a future version once it has stabilized +- FOREACH_STRING(soname, "libcrypto.so.3", "libcrypto.so.4") { ++ FOREACH_STRING(soname, "libcrypto.so.4", "libcrypto.so.3") { + r = dlopen_many_sym_or_warn( + &libcrypto_dl, + soname, +diff --git a/src/shared/crypto-util.h b/src/shared/crypto-util.h +index 980c1c60a2a5f..bd0cb7b67b8dd 100644 +--- a/src/shared/crypto-util.h ++++ b/src/shared/crypto-util.h +@@ -37,7 +37,7 @@ int dlopen_libcrypto(int log_level); + SD_ELF_NOTE_DLOPEN("libcrypto", \ + "Support for cryptographic operations", \ + priority, \ +- "libcrypto.so.3", "libcrypto.so.4") ++ "libcrypto.so.4", "libcrypto.so.3") + + #define DLOPEN_LIBCRYPTO(log_level, priority) \ + ({ \ diff --git a/systemd.spec b/systemd.spec index e0b8792..4e780be 100644 --- a/systemd.spec +++ b/systemd.spec @@ -146,6 +146,9 @@ Patch: 0001-core-create-userdb-root-directory-with-correct-label.patch # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2415701 Patch: 0002-machined-continue-without-resolve.hook-socket.patch + +# We want to depend on and load openssl-4 in preference +Patch: https://github.com/systemd/systemd/pull/42668.patch %endif %ifarch %{ix86} x86_64 aarch64 riscv64 From 714b0799d2901802fad5bf94f39fdbafee96c3ad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 26 Jun 2026 16:43:23 +0200 Subject: [PATCH 36/63] Version 261.1 - The first batch of fixes post-release --- sources | 2 +- systemd.spec | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sources b/sources index d3c45e1..fe6ce37 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-261.tar.gz) = 6a21c2a9bd83d962db4e6c095078ec79259d8109583b59094d17e76c0826e96a6183778f46b64352b0fe62cb8890736e9331f35e9a4c8b65f9b574fa915f9fd8 +SHA512 (systemd-261.1.tar.gz) = 5dbf8b902fbed6e719367266da658b46ed55e76c93b7aa48ebaf9daca36cb19261ebd45cb97139c51227022a8ca3d07da360953bd9b0aebb429dce6d111f7e5c diff --git a/systemd.spec b/systemd.spec index 4e780be..fd85426 100644 --- a/systemd.spec +++ b/systemd.spec @@ -71,7 +71,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:261} +Version: %{?version_override}%{!?version_override:261.1} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif From 9c87a3f8ad4b172ee08640aee5e125dd60d46891 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 27 Jun 2026 22:09:42 +0200 Subject: [PATCH 37/63] Load libssl.so.4 rather than libssl.so.3 --- ...032019015ddd61985e6a6721d813d62dad0b.patch | 38 +++++++++++++++++++ systemd.spec | 1 + 2 files changed, 39 insertions(+) create mode 100644 7be9032019015ddd61985e6a6721d813d62dad0b.patch diff --git a/7be9032019015ddd61985e6a6721d813d62dad0b.patch b/7be9032019015ddd61985e6a6721d813d62dad0b.patch new file mode 100644 index 0000000..c1de086 --- /dev/null +++ b/7be9032019015ddd61985e6a6721d813d62dad0b.patch @@ -0,0 +1,38 @@ +From 7be9032019015ddd61985e6a6721d813d62dad0b Mon Sep 17 00:00:00 2001 +From: Luca Boccassi +Date: Sat, 20 Jun 2026 15:21:26 +0100 +Subject: [PATCH] ssl-util: prefer OpenSSL 4 + +For the next version we can switch to preferring the new version +--- + src/shared/ssl-util.c | 3 +-- + src/shared/ssl-util.h | 2 +- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/src/shared/ssl-util.c b/src/shared/ssl-util.c +index 226120c70e66f..4b7ab2ec29f74 100644 +--- a/src/shared/ssl-util.c ++++ b/src/shared/ssl-util.c +@@ -40,8 +40,7 @@ int dlopen_libssl(int log_level) { + + LIBSSL_NOTE(SD_ELF_NOTE_DLOPEN_PRIORITY_SUGGESTED); + +- // FIXME: switch order to prefer libssl.so.4 in a future version once it has stabilized +- FOREACH_STRING(soname, "libssl.so.3", "libssl.so.4") { ++ FOREACH_STRING(soname, "libssl.so.4", "libssl.so.3") { + r = dlopen_many_sym_or_warn( + &libssl_dl, + soname, +diff --git a/src/shared/ssl-util.h b/src/shared/ssl-util.h +index aa3b8308665ba..77b5c049f9e3a 100644 +--- a/src/shared/ssl-util.h ++++ b/src/shared/ssl-util.h +@@ -12,7 +12,7 @@ int dlopen_libssl(int log_level); + SD_ELF_NOTE_DLOPEN("libssl", \ + "Support for TLS", \ + priority, \ +- "libssl.so.3", "libssl.so.4") ++ "libssl.so.4", "libssl.so.3") + + #define DLOPEN_LIBSSL(log_level, priority) \ + ({ \ diff --git a/systemd.spec b/systemd.spec index fd85426..882fe63 100644 --- a/systemd.spec +++ b/systemd.spec @@ -149,6 +149,7 @@ Patch: 0002-machined-continue-without-resolve.hook-socket.patch # We want to depend on and load openssl-4 in preference Patch: https://github.com/systemd/systemd/pull/42668.patch +Patch: https://github.com/systemd/systemd/commit/7be9032019015ddd61985e6a6721d813d62dad0b.patch %endif %ifarch %{ix86} x86_64 aarch64 riscv64 From ee2dff42d615ceb09ad0930cbd7ba87fb069abe1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 3 Jul 2026 14:19:00 +0200 Subject: [PATCH 38/63] Add systemd-report-standalone This adds the packaging required for https://github.com/systemd/systemd/pull/42874. The build will work with the changes here even before that the upstream changes are merged and is in fact required for upstream CI to pass, so the plan is to merge it early. [skip changelog] --- split-files.py | 15 +++++++++++---- systemd.spec | 23 ++++++++++++++++++++++- 2 files changed, 33 insertions(+), 5 deletions(-) diff --git a/split-files.py b/split-files.py index f7f9989..03f7822 100644 --- a/split-files.py +++ b/split-files.py @@ -1,7 +1,11 @@ import re, sys, os, collections buildroot = sys.argv[1] -no_bootloader = '--no-bootloader' in sys.argv + +potentially_empty_outputs = [ + 'standalone-report', + *(['boot'] if '--no-bootloader' in sys.argv else []), +] known_files = ''' %ghost %config(noreplace) /etc/crypttab @@ -73,6 +77,7 @@ outputs = {suffix: open(f'.file-list-{suffix}', 'w') 'resolve', 'tests', 'standalone-repart', + 'standalone-report', 'standalone-tmpfiles', 'standalone-sysusers', 'standalone-shutdown', @@ -106,6 +111,8 @@ for file in files(buildroot): if n.endswith('.standalone'): if 'repart' in n: o = outputs['standalone-repart'] + elif 'report' in n: + o = outputs['standalone-report'] elif 'tmpfiles' in n: o = outputs['standalone-tmpfiles'] elif 'sysusers' in n: @@ -294,9 +301,9 @@ for file in files(buildroot): for file in o: print(f'{prefix}{n}{suffix}', file=file) + + if [print(f'ERROR: no file names were written to {o.name}') for name, o in outputs.items() - if (o.tell() == 0 and - not (no_bootloader and name == 'boot')) - ]: + if o.tell() == 0 and name not in potentially_empty_outputs]: sys.exit(1) diff --git a/systemd.spec b/systemd.spec index 882fe63..66d43c1 100644 --- a/systemd.spec +++ b/systemd.spec @@ -323,11 +323,14 @@ Conflicts: dracut < 060-2 Conflicts: dracut < 059-16 %endif +Conflicts: systemd-standalone-report +Provides: systemd-report = %{version}-%{release} Conflicts: systemd-standalone-tmpfiles Provides: systemd-tmpfiles = %{version}-%{release} Conflicts: systemd-standalone-shutdown Provides: systemd-shutdown = %{version}-%{release} + %if "%{_sbindir}" == "%{_bindir}" # Compat symlinks for Requires in other packages. # We rely on filesystem to create the symlinks for us. @@ -691,7 +694,21 @@ RemovePathPostfixes: .standalone %description standalone-repart Standalone systemd-repart binary with no dependencies on the systemd-shared library or other libraries from systemd-libs. This package conflicts with the -main systemd package and is meant for use on systems without systemd. +systemd-udev package and is meant for use on systems without systemd-udev. + +%if %{with upstream} +%package standalone-report +Summary: Standalone systemd-report binaries for use on systems without systemd +Provides: systemd-report = %{version}-%{release} +Conflicts: systemd +RemovePathPostfixes: .standalone + +%description standalone-report +Standalone systemd-report, systemd-report-basic, systemd-report-sign-plain, … +binaries with no dependencies on the systemd-shared library or other libraries +from systemd-libs. This package conflicts with the main systemd package and +is meant for use on systems without systemd or with older version of it. +%endif %package standalone-tmpfiles Summary: Standalone systemd-tmpfiles binary for use on systems without systemd @@ -1497,6 +1514,10 @@ fi %files standalone-repart -f .file-list-standalone-repart +%if %{with upstream} +%files standalone-report -f .file-list-standalone-report +%endif + %files standalone-tmpfiles -f .file-list-standalone-tmpfiles %files standalone-sysusers -f .file-list-standalone-sysusers From c783e7479113210c0c91760f8c515ca908ad5b04 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 3 Jul 2026 15:51:45 +0200 Subject: [PATCH 39/63] split-files: improve error message [skip changelog] --- split-files.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/split-files.py b/split-files.py index 03f7822..8d52021 100644 --- a/split-files.py +++ b/split-files.py @@ -120,7 +120,7 @@ for file in files(buildroot): elif 'shutdown' in n: o = outputs['standalone-shutdown'] else: - assert False, 'Found .standalone not belonging to known packages' + assert False, f'Found {n} not belonging to known standalone packages' elif '/security/pam_' in n or '/man8/pam_' in n: o = outputs['pam'] From 893fcd99787958280f24e68517bc772df49b7fd0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 3 Jul 2026 16:37:30 +0200 Subject: [PATCH 40/63] Add missing conditionalization and more debugging [skip changelog] --- systemd.spec | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/systemd.spec b/systemd.spec index 66d43c1..e00678e 100644 --- a/systemd.spec +++ b/systemd.spec @@ -323,8 +323,10 @@ Conflicts: dracut < 060-2 Conflicts: dracut < 059-16 %endif +%if %{with upstream} Conflicts: systemd-standalone-report Provides: systemd-report = %{version}-%{release} +%endif Conflicts: systemd-standalone-tmpfiles Provides: systemd-tmpfiles = %{version}-%{release} Conflicts: systemd-standalone-shutdown @@ -746,6 +748,26 @@ library or other libraries from systemd-libs. This package conflicts with the main systemd package and is meant for use in exitrds. %prep +# Print varius with's and without's to make it easier to figure out what is going on +echo %{shrink: + '**' + bzip2=%{?with_bzip2}%{!?with_bzip2:0} + gnutls=%{?with_gnutls}%{!?with_gnutls:0} + lz4=%{?with_lz4}%{!?with_lz4:0} + xz=%{?with_xz}%{!?with_xz:0} + zlib=%{?with_zlib}%{!?with_zlib:0} + zstd=%{?with_zstd}%{!?with_zstd:0} + bootstrap=%{?with_bootstrap}%{!?with_bootstrap:0} + tests=%{?with_tests}%{!?with_tests:0} + lto=%{?with_lto}%{!?with_lto:0} + docs=%{?with_docs}%{!?with_docs:0} + upstream=%{?with_upstream}%{!?with_upstream:0} + obs=%{?with_obs}%{!?with_obs:0} + fedora=%{?fedora} + rhel=%{?rhel} + _arch=%{_arch} + '**'} + %if %{with obs} # Recipe files in the OBS build are in a distro-specific dir, as they conflict (e.g. with SUSE ones) mv %{_sourcedir}/%{name}.fedora/* %{_sourcedir} From 48306418448284f36d4d331b6b1abf54896a3685 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 3 Jul 2026 17:00:33 +0200 Subject: [PATCH 41/63] Move portabled to systemd-container subpackage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously, the idea was that portabled is in -udev because it can be used to implement generic services, incl. basic system functionality. But it seems that nobody is doing that… People who _are_ packing portables, are using them more like containers, i.e. to deliver external payloads. So let's move it to the -container subpackage to shrink -udev which is installed almost everywhere. Also, fix bogus comment and fix typo, effectively moving updatectl to -udev. --- split-files.py | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/split-files.py b/split-files.py index 8d52021..71df1b1 100644 --- a/split-files.py +++ b/split-files.py @@ -158,6 +158,7 @@ for file in files(buildroot): mount.ddi| importctl| portablectl| + portabled|portable1| systemd-nspawn| systemd\.nspawn| systemd-vmspawn| @@ -255,13 +256,11 @@ for file in files(buildroot): binfmt| sysctl| coredump| + homectl| homed|home1| - sysupdate|updatctl| - oomd| - portabled|portable1 - ''', n, re.X): # coredumpctl, homectl, portablectl are included in the main package because - # they can be used to interact with remote daemons. Also, the user could be - # confused if those user-facing binaries are not available. + sysupdate|updatectl| + oomd + ''', n, re.X): o = outputs['udev'] elif re.search(r'''/boot/efi| From de7b685908c0964672af830b157baf97d45c2a38 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 5 Jul 2026 12:06:39 +0200 Subject: [PATCH 42/63] Disable reqs for dlopen'ed libraries on CentOS Unfortunately package-notes >= 0.18 are not available on CentoOS Stream 9 and 10 right now. We actually want >= 0.20 for the best expreience. Disable the requirement for now, to allow CI builds to happen. This will need to be resolved before the builds are used for real. [skip changelog] --- systemd.spec | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/systemd.spec b/systemd.spec index e00678e..ccb9b74 100644 --- a/systemd.spec +++ b/systemd.spec @@ -173,9 +173,14 @@ BuildRequires: cryptsetup-devel # Require (previous version) of our macros package. # We use the %%systemd_{post,preun,…} macros for various services. BuildRequires: systemd-rpm-macros +%endif + +%if 0%{?rhel} == 0 # Use dlopen-notes to generate Requires/Recommends from embedded metadata. +# Currently, package-notes are not available on Centos Stream 9 or 10. BuildRequires: package-notes >= 0.18 %endif + BuildRequires: dbus-devel BuildRequires: util-linux # /usr/bin/getfacl is needed by test-acl-util From 9bd26bb71f381589e937ee5d308bff559e9aaa60 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Thu, 2 Jul 2026 15:25:56 -0400 Subject: [PATCH 43/63] Fix ntpvendor for ELN This has to match a registered vendor, and ELN is one case where the OS and vendor name are different. https://github.com/fedora-eln/eln/issues/567 --- systemd.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/systemd.spec b/systemd.spec index ccb9b74..f45408e 100644 --- a/systemd.spec +++ b/systemd.spec @@ -789,7 +789,11 @@ mv %{_sourcedir}/%{name}.fedora/* %{_sourcedir} sed -r -i 's/^u!/u/' sysusers.d/*.conf* %build +%if 0%{?eln} +%global ntpvendor fedora +%else %global ntpvendor %(source /etc/os-release; echo ${ID}) +%endif %{!?ntpvendor: echo 'NTP vendor zone is not set!'; exit 1} VMLINUX_H_PATH='' From c53b2fb30757ef43cd4c7288fb014ebc0785fa3b Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 19 Jun 2026 23:01:51 +0200 Subject: [PATCH 44/63] test: cap the number of parallel tests Cap the number of parallel tests to 4 to not overwhelm beefier hosts. I tried this with 8 jobs, but it often caused annoying timeouts in nspawn-based tests; maybe this could be investigated and potentially addressed in the future. [skip changelog] --- plans/run-integration-tests.sh | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/plans/run-integration-tests.sh b/plans/run-integration-tests.sh index 6d2ee37..d9edd5d 100755 --- a/plans/run-integration-tests.sh +++ b/plans/run-integration-tests.sh @@ -89,16 +89,15 @@ if [[ ! -e /dev/kvm ]]; then fi NPROC="$(nproc)" -if [[ "$NPROC" -ge 10 ]]; then - export TEST_JOURNAL_USE_TMP=1 - NPROC="$((NPROC / 3))" -else - NPROC="$((NPROC - 1))" +if [[ "$NPROC" -gt 4 ]]; then + # Cap the number of parallel tests to 4 to not overwhelm larger hosts + NPROC=4 fi # This test is only really useful if we're building with sanitizers and takes a long time, so let's skip it # for now. export TEST_SKIP="TEST-21-DFUZZER ${TEST_SKIP:-}" +export TEST_JOURNAL_USE_TMP=1 mkosi genkey mkosi summary From 9d4edaa576e609413cdc987e6127e5f228c62ac6 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Thu, 25 Jun 2026 16:04:01 +0200 Subject: [PATCH 45/63] test: work around a kernel bug in virtio/vsock There's a virtio/vsock bug in kernel 7.1-rc where a patch for a potential overflow inadvertently shrunk the receive buffer's effective size below what was configured, which eventually causes the vsock connection to get reset with ENOBUFS, that kills the journal forwarding over vsock: read(7, ..., 16392): No buffer space available Entry too big, skipped read(8, ..., 16392): No buffer space available Entry too big, skipped read(12, ..., 16392): No buffer space available Entry too big, skipped Finishing after writing 6685 entries This then affects other systemd components that try to write to the now broken journal, causing them to fail as well. Let's just bump the default vsock buffer size to work around this until the kernel fix lands. Pending fix: https://lore.kernel.org/netdev/20260518090656.134588-3-sgarzare@redhat.com/ [skip changelog] --- plans/run-integration-tests.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/plans/run-integration-tests.sh b/plans/run-integration-tests.sh index d9edd5d..dab8525 100755 --- a/plans/run-integration-tests.sh +++ b/plans/run-integration-tests.sh @@ -94,6 +94,14 @@ if [[ "$NPROC" -gt 4 ]]; then NPROC=4 fi +# Workaround for a kernel 7.x virtio/vsock bug, where a patch for a potential overflow inadvertently shrunk +# the receive buffer's effective size below what was configured, which eventually causes the vsock connection +# to get reset with ENOBUFS, that kills the journal forwarding over vsock +# +# Pending fix: https://lore.kernel.org/netdev/20260518090656.134588-3-sgarzare@redhat.com/ +sysctl -w net.core.rmem_max=16777216 +sysctl -w net.core.wmem_max=16777216 + # This test is only really useful if we're building with sanitizers and takes a long time, so let's skip it # for now. export TEST_SKIP="TEST-21-DFUZZER ${TEST_SKIP:-}" From 453447b79ba6a260b3a53fdf2aa38dc9db4aa5ae Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Sat, 27 Jun 2026 09:46:09 +0200 Subject: [PATCH 46/63] rpminspect: ignore test-coredump-stacktrace in annocheck As this test is intentionally compiled with a minimal set of hardcoded options, so it always generates a predictable stack trace. [skip changelog] --- rpminspect.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/rpminspect.yaml b/rpminspect.yaml index 6318820..e080618 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -1,4 +1,10 @@ - # Disable badfuncs check that has tons of false positives. +annocheck: + ignore: + # This test is intentionally compiled with a minimal set of hardcoded + # options, so it always generates a predictable stack trace + - /usr/lib/systemd/tests/unit-tests/manual/test-coredump-stacktrace + +# Disable badfuncs check that has tons of false positives. badfuncs: allowed: /usr/lib/systemd/tests/unit-tests/*: From 521ab0fb095bf1435f96f59c536fec4f5a139141 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Sat, 27 Jun 2026 13:31:56 +0200 Subject: [PATCH 47/63] test: skip the integration test suite on Fedora ELN (for now) The test suite currently fails there during setup, because ELN ships with a reduced package set and it's missing several tools that mkosi expects to be available: Updating and loading repositories: Repositories loaded. Failed to resolve the transaction: No match for argument: apk No match for argument: apt No match for argument: apt-utils No match for argument: archlinux-keyring No match for argument: coccinelle No match for argument: gh No match for argument: gh No match for argument: lcov No match for argument: musl-clang No match for argument: musl-gcc No match for argument: musl-libc No match for argument: pacman No match for argument: python3-mypy No match for argument: qemu-system-aarch64-core No match for argument: qemu-system-ppc-core No match for argument: qemu-system-s390x-core No match for argument: ruff No match for argument: sbsigntools No match for argument: zypper You can try to add to command line: --skip-unavailable to skip unavailable packages Switching the tools tree to Rawhide doesn't help either, as that breaks other things: Updating and loading repositories: fedora 100% | 69.2 MiB/s | 20.9 MiB | 00m00s >>> Downloading successful, but checksum doesn't match. Calculated: ... cannot open file: (95) - Operation not supported [/var/cache/libdnf5/fedora-306b6523e9c8dc02/repodata/fc1f05fc361729498fd568dec450c1e27598bd38e3179f9b80ae01fbc8a0b74d-primary.xml.zck] We can revisit this later if running the test suite on ELN is desirable. The "skip" on ELN is slightly unconventional, as using "enabled: false" here causes Packit to error. [skip changelog] --- plans/upstream.fmf | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/plans/upstream.fmf b/plans/upstream.fmf index 494e816..d6edac5 100644 --- a/plans/upstream.fmf +++ b/plans/upstream.fmf @@ -17,6 +17,10 @@ prepare: exclude: - systemd-standalone-.* execute: - how: tmt - script: exec plans/run-integration-tests.sh - duration: 2h + how: tmt + script: exec plans/run-integration-tests.sh + duration: 2h +adjust: + - when: distro == fedora-eln + execute: + script: echo skipped From 2d6fd95c709f109ad92d42626de40c770a6ea9f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 6 Jul 2026 22:10:51 +0200 Subject: [PATCH 48/63] Restore explicit requires for Centos Stream 9 and 10 It seems that CI VMs don't boot without this. [skip changelog] --- systemd.spec | 44 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 43 insertions(+), 1 deletion(-) diff --git a/systemd.spec b/systemd.spec index f45408e..e766080 100644 --- a/systemd.spec +++ b/systemd.spec @@ -175,7 +175,7 @@ BuildRequires: cryptsetup-devel BuildRequires: systemd-rpm-macros %endif -%if 0%{?rhel} == 0 +%if 0%{?rhel} <= 10 # Use dlopen-notes to generate Requires/Recommends from embedded metadata. # Currently, package-notes are not available on Centos Stream 9 or 10. BuildRequires: package-notes >= 0.18 @@ -296,6 +296,10 @@ Requires: /usr/bin/systemd-sysusers # so this biases towards the common version. Recommends: systemd-sysusers%{_isa} = %{version}-%{release} +%if 0%{?rhel} <= 10 +Requires: libzstd.so.1%{?elf_suffix} +%endif + Recommends: diffutils Requires: (util-linux-core or util-linux) Requires: (libbpf >= 2:1.4.7 if libbpf) @@ -349,6 +353,15 @@ Provides: /usr/sbin/reboot Provides: /usr/sbin/shutdown %endif +%if 0%{?rhel} <= 10 +# libmount is always required, even in containers, so make it a hard dependency. +Requires: libmount.so.1%{?elf_suffix} +Requires: libmount.so.1(MOUNT_2.26)%{?elf_bits} +# Various systemd services have syscall filters so make libseccomp a hard dependency. +Requires: libseccomp.so.2%{?elf_suffix} +Requires: libacl.so.1%{?elf_suffix} +%endif + %define dlopen_notes_features %{expand: # Various systemd services have syscall filters so make libseccomp a hard dependency. systemd:seccomp:required @@ -466,6 +479,17 @@ Requires(postun): systemd%{_isa} = %{version}-%{release} Requires(post): grep Requires: kmod >= 18-4 +%if 0%{?rhel} <= 10 +# Libkmod is used to load modules. Assume that if we need udevd, we certainly +# want to load modules, so make this into a hard dependency here. +Requires: libkmod.so.2%{?elf_suffix} +Requires: libkmod.so.2(LIBKMOD_5)%{?elf_bits} +# udev uses libblkid in various builtins so make it a hard dependency. +Requires: libblkid.so.1%{?elf_suffix} +Requires: libblkid.so.1(BLKID_2.30)%{?elf_bits} +Requires: libfdisk.so.1%{?elf_suffix} +%endif + Provides: udev = %{version} Provides: udev%{_isa} = %{version} %if 0%{?fedora} || 0%{?rhel} >= 10 @@ -483,6 +507,16 @@ Provides: systemd-timesyncd = %{version}-%{release} %endif Conflicts: systemd-networkd < %{version}-%{release} +%if 0%{?rhel} <= 10 +# Libkmod is used to load modules. Assume that if we need udevd, we certainly +# want to load modules, so make this into a hard dependency here. +Requires: libkmod.so.2%{?elf_suffix} +Requires: libkmod.so.2(LIBKMOD_5)%{?elf_bits} +# udev uses libblkid in various builtins so make it a hard dependency. +Requires: libblkid.so.1%{?elf_suffix} +Requires: libblkid.so.1(BLKID_2.30)%{?elf_bits} +%endif + # https://bugzilla.redhat.com/show_bug.cgi?id=1377733#c9 Suggests: systemd-bootchart @@ -624,6 +658,10 @@ License: LGPL-2.1-or-later Requires: firewalld-filesystem Provides: systemd-journal-gateway = %{version}-%{release} Provides: systemd-journal-gateway%{_isa} = %{version}-%{release} +%if 0%{?rhel} <= 10 +Requires: libmicrohttpd.so.12%{?elf_suffix} +Requires: libcurl.so.4%{?elf_suffix} +%endif # Bias the system towards libcurl-minimal if nothing pulls in full libcurl (#1997040) Suggests: libcurl-minimal @@ -660,6 +698,10 @@ enabled for this to have any effect. %package resolved Summary: Network Name Resolution manager Requires: systemd%{_isa} = %{version}-%{release} +%if 0%{?rhel} <= 10 +Requires: libidn2.so.0%{?elf_suffix} +Requires: libidn2.so.0(IDN2_0.0.0)%{?elf_bits} +%endif Requires(posttrans): grep %description resolved From 2382c910b70921c8b7da3dec0bfe30580490e920 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 7 Jul 2026 00:20:07 +0200 Subject: [PATCH 49/63] Disable the standalone report yet again It should be disabled until the changes are merged upstream. Also fix and adjust the conditions for package-note use. [skip changelog] --- systemd.spec | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/systemd.spec b/systemd.spec index e766080..23ded1b 100644 --- a/systemd.spec +++ b/systemd.spec @@ -31,6 +31,9 @@ # Build with OBS-specific quirks %bcond obs 0 +# Temporary macro to enable systemd-report.standalone +%bcond report_standalone 0 + # When bootstrap, libcryptsetup is disabled # but auto-features causes many options to be turned on # that depend on libcryptsetup (e.g. libcryptsetup-plugins, homed) @@ -175,10 +178,10 @@ BuildRequires: cryptsetup-devel BuildRequires: systemd-rpm-macros %endif -%if 0%{?rhel} <= 10 +%if 0%{?rhel} == 0 || 0%{?rhel} > 10 # Use dlopen-notes to generate Requires/Recommends from embedded metadata. # Currently, package-notes are not available on Centos Stream 9 or 10. -BuildRequires: package-notes >= 0.18 +BuildRequires: package-notes >= 0.20 %endif BuildRequires: dbus-devel @@ -332,7 +335,7 @@ Conflicts: dracut < 060-2 Conflicts: dracut < 059-16 %endif -%if %{with upstream} +%if %{with report_standalone} Conflicts: systemd-standalone-report Provides: systemd-report = %{version}-%{release} %endif @@ -745,7 +748,7 @@ Standalone systemd-repart binary with no dependencies on the systemd-shared library or other libraries from systemd-libs. This package conflicts with the systemd-udev package and is meant for use on systems without systemd-udev. -%if %{with upstream} +%if %{with report_standalone} %package standalone-report Summary: Standalone systemd-report binaries for use on systems without systemd Provides: systemd-report = %{version}-%{release} @@ -1587,7 +1590,7 @@ fi %files standalone-repart -f .file-list-standalone-repart -%if %{with upstream} +%if %{with report_standalone} %files standalone-report -f .file-list-standalone-report %endif From 3cc7e03365040c1d00c5e20ad98250d7fe49be8d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 7 Jul 2026 09:04:19 +0200 Subject: [PATCH 50/63] Restore definitions of helper macros Fixes 2d6fd95c709f109ad92d42626de40c770a6ea9f7. [skip changelog] --- systemd.spec | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/systemd.spec b/systemd.spec index 23ded1b..36dff93 100644 --- a/systemd.spec +++ b/systemd.spec @@ -67,6 +67,11 @@ %define noarch_requires_version %{version}-%{release} %endif +%if 0%{?__isa_bits} == 64 +%global elf_bits (64bit) +%global elf_suffix ()%{elf_bits} +%endif + Name: systemd Url: https://systemd.io # Allow users to specify the version and release when building the rpm by From 034fa693f2da8a0f9ea261128cc81654a8be905f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 7 Jul 2026 09:13:58 +0200 Subject: [PATCH 51/63] Print the build status also in %build %prep is not executed in no-prep builds which we use with mkosi. [skip changelog] --- systemd.spec | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/systemd.spec b/systemd.spec index 36dff93..2fd1dd9 100644 --- a/systemd.spec +++ b/systemd.spec @@ -134,13 +134,6 @@ Source25: 98-default-mac-none.link Source26: systemd-user -%if 0%{?fedora} < 40 && 0%{?rhel} < 10 -# Work-around for dracut issue: run generators directly when we are in initrd -# https://bugzilla.redhat.com/show_bug.cgi?id=2164404 -# Drop when dracut-060 is available. -Patch: https://github.com/systemd/systemd/pull/26494.patch -%endif - %if %{without upstream} # Those are downstream-only patches, but we don't want them in packit builds. @@ -802,9 +795,7 @@ Standalone systemd-shutdown binary with no dependencies on the systemd-shared library or other libraries from systemd-libs. This package conflicts with the main systemd package and is meant for use in exitrds. -%prep -# Print varius with's and without's to make it easier to figure out what is going on -echo %{shrink: +%define status %{shrink: '**' bzip2=%{?with_bzip2}%{!?with_bzip2:0} gnutls=%{?with_gnutls}%{!?with_gnutls:0} @@ -823,6 +814,10 @@ echo %{shrink: _arch=%{_arch} '**'} +%prep +# Print varius with's and without's to make it easier to figure out what is going on +echo %{status} + %if %{with obs} # Recipe files in the OBS build are in a distro-specific dir, as they conflict (e.g. with SUSE ones) mv %{_sourcedir}/%{name}.fedora/* %{_sourcedir} @@ -839,6 +834,8 @@ mv %{_sourcedir}/%{name}.fedora/* %{_sourcedir} sed -r -i 's/^u!/u/' sysusers.d/*.conf* %build +echo %{status} + %if 0%{?eln} %global ntpvendor fedora %else From 45c16dd369c961b70664e473552def34d5469664 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 7 Jul 2026 12:12:43 +0200 Subject: [PATCH 52/63] Use uniform format for %rhel conditionals They were supposed to apply on old rhel only, but applied on Fedora too by mistake. Also restore the old dracut workaround. It *is* a few years old at this point, but it's not certain that the dracut patch has been propagated everywhere so it's safe to keep it. [skip changelog] --- systemd.spec | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/systemd.spec b/systemd.spec index 2fd1dd9..146dbd2 100644 --- a/systemd.spec +++ b/systemd.spec @@ -134,6 +134,13 @@ Source25: 98-default-mac-none.link Source26: systemd-user +%if 0%{?fedora} < 40 && 0%{?rhel} < 10 +# Work-around for dracut issue: run generators directly when we are in initrd +# https://bugzilla.redhat.com/show_bug.cgi?id=2164404 +# Drop when dracut-060 is available. +Patch: https://github.com/systemd/systemd/pull/26494.patch +%endif + %if %{without upstream} # Those are downstream-only patches, but we don't want them in packit builds. @@ -176,7 +183,7 @@ BuildRequires: cryptsetup-devel BuildRequires: systemd-rpm-macros %endif -%if 0%{?rhel} == 0 || 0%{?rhel} > 10 +%if !%{defined rhel} || 0%{?rhel} > 10 # Use dlopen-notes to generate Requires/Recommends from embedded metadata. # Currently, package-notes are not available on Centos Stream 9 or 10. BuildRequires: package-notes >= 0.20 @@ -297,7 +304,7 @@ Requires: /usr/bin/systemd-sysusers # so this biases towards the common version. Recommends: systemd-sysusers%{_isa} = %{version}-%{release} -%if 0%{?rhel} <= 10 +%if %{defined rhel} && 0%{?rhel} <= 10 Requires: libzstd.so.1%{?elf_suffix} %endif @@ -354,7 +361,7 @@ Provides: /usr/sbin/reboot Provides: /usr/sbin/shutdown %endif -%if 0%{?rhel} <= 10 +%if %{defined rhel} && 0%{?rhel} <= 10 # libmount is always required, even in containers, so make it a hard dependency. Requires: libmount.so.1%{?elf_suffix} Requires: libmount.so.1(MOUNT_2.26)%{?elf_bits} @@ -480,7 +487,7 @@ Requires(postun): systemd%{_isa} = %{version}-%{release} Requires(post): grep Requires: kmod >= 18-4 -%if 0%{?rhel} <= 10 +%if %{defined rhel} && 0%{?rhel} <= 10 # Libkmod is used to load modules. Assume that if we need udevd, we certainly # want to load modules, so make this into a hard dependency here. Requires: libkmod.so.2%{?elf_suffix} @@ -508,7 +515,7 @@ Provides: systemd-timesyncd = %{version}-%{release} %endif Conflicts: systemd-networkd < %{version}-%{release} -%if 0%{?rhel} <= 10 +%if %{defined rhel} && 0%{?rhel} <= 10 # Libkmod is used to load modules. Assume that if we need udevd, we certainly # want to load modules, so make this into a hard dependency here. Requires: libkmod.so.2%{?elf_suffix} @@ -659,7 +666,7 @@ License: LGPL-2.1-or-later Requires: firewalld-filesystem Provides: systemd-journal-gateway = %{version}-%{release} Provides: systemd-journal-gateway%{_isa} = %{version}-%{release} -%if 0%{?rhel} <= 10 +%if %{defined rhel} && 0%{?rhel} <= 10 Requires: libmicrohttpd.so.12%{?elf_suffix} Requires: libcurl.so.4%{?elf_suffix} %endif @@ -699,7 +706,7 @@ enabled for this to have any effect. %package resolved Summary: Network Name Resolution manager Requires: systemd%{_isa} = %{version}-%{release} -%if 0%{?rhel} <= 10 +%if %{defined rhel} && 0%{?rhel} <= 10 Requires: libidn2.so.0%{?elf_suffix} Requires: libidn2.so.0(IDN2_0.0.0)%{?elf_bits} %endif From d69c17b1651129162d58e8920398940581c5df10 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 7 Jul 2026 13:49:37 +0200 Subject: [PATCH 53/63] Enable report-standalone for upstream builds (The definition of the conditional needed to be moved below Version to work.) [skip changelog] --- systemd.spec | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/systemd.spec b/systemd.spec index 146dbd2..0df274c 100644 --- a/systemd.spec +++ b/systemd.spec @@ -31,9 +31,6 @@ # Build with OBS-specific quirks %bcond obs 0 -# Temporary macro to enable systemd-report.standalone -%bcond report_standalone 0 - # When bootstrap, libcryptsetup is disabled # but auto-features causes many options to be turned on # that depend on libcryptsetup (e.g. libcryptsetup-plugins, homed) @@ -87,6 +84,9 @@ Release: %autorelease %global stable %(c="%version"; [ "$c" = "${c#*.*}" ]; echo $?) +# Temporary macro to enable systemd-report.standalone +%bcond report_standalone %[ v"%{version}" >= v"262~devel" ] + # For a breakdown of the licensing, see README License: LGPL-2.1-or-later AND MIT AND GPL-2.0-or-later Summary: System and Service Manager @@ -816,6 +816,7 @@ main systemd package and is meant for use in exitrds. docs=%{?with_docs}%{!?with_docs:0} upstream=%{?with_upstream}%{!?with_upstream:0} obs=%{?with_obs}%{!?with_obs:0} + report_standalone=%{?with_report_standalone}%{!?with_report_standalone:0} fedora=%{?fedora} rhel=%{?rhel} _arch=%{_arch} From 57cbcf979ce2dd872a871c59e87d2c65dfa996e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 7 Jul 2026 18:36:12 +0200 Subject: [PATCH 54/63] Also enable report-standalone for OBS builds OBS uses version strings like "261.999+587+g900ce6f36". [skip changelog] --- systemd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/systemd.spec b/systemd.spec index 0df274c..9bf8c7b 100644 --- a/systemd.spec +++ b/systemd.spec @@ -85,7 +85,7 @@ Release: %autorelease %global stable %(c="%version"; [ "$c" = "${c#*.*}" ]; echo $?) # Temporary macro to enable systemd-report.standalone -%bcond report_standalone %[ v"%{version}" >= v"262~devel" ] +%bcond report_standalone %[ v"%{version}" >= v"261.999" ] # For a breakdown of the licensing, see README License: LGPL-2.1-or-later AND MIT AND GPL-2.0-or-later From cca95abc4619e91186ef00a194c5b9616e570722 Mon Sep 17 00:00:00 2001 From: Stewart Smith Date: Fri, 15 May 2026 16:33:47 -0700 Subject: [PATCH 55/63] Add sbin_compat bcond to rely on filesystem file triggers for sbin symlinks Instead of shipping /usr/sbin symlinks directly in the RPM, rely on filesystem(unmerged-sbin-symlinks) file triggers to create them at install time. This avoids file conflicts when the package (built on an unmerged system) is installed into a merged-sbin buildroot, eliminating the bootstrap ordering problem with the bin/sbin merge. On unmerged systems, the filesystem file trigger creates the symlinks when files are installed to /usr/bin. On merged systems, /usr/sbin is already a symlink to bin so no action is needed. The bcond defaults to enabled. Use --without sbin_compat to revert to the old behavior of shipping sbin symlinks in the package. --- systemd.spec | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/systemd.spec b/systemd.spec index 9bf8c7b..c172dc5 100644 --- a/systemd.spec +++ b/systemd.spec @@ -19,6 +19,12 @@ %bcond bootstrap 0 %bcond tests 1 +# When enabled, rely on filesystem(unmerged-sbin-symlinks) file triggers to +# create /usr/sbin symlinks instead of shipping them in the package. This +# avoids file conflicts when installing on merged-sbin systems and eliminates +# bootstrap ordering issues with the bin/sbin merge. +%bcond sbin_compat 1 + # riscv64 has LTO disabled globally %bcond lto %["%_arch" != "riscv64"] @@ -349,8 +355,7 @@ Provides: systemd-tmpfiles = %{version}-%{release} Conflicts: systemd-standalone-shutdown Provides: systemd-shutdown = %{version}-%{release} - -%if "%{_sbindir}" == "%{_bindir}" +%if %{with sbin_compat} || "%{_sbindir}" == "%{_bindir}" # Compat symlinks for Requires in other packages. # We rely on filesystem to create the symlinks for us. Requires: filesystem(unmerged-sbin-symlinks) @@ -547,7 +552,7 @@ Provides: systemd-repart = %{version}-%{release} Conflicts: xorg-x11-drv-evdev < 2.11.0 Conflicts: xorg-x11-drv-libinput < 1.5.0 -%if "%{_sbindir}" == "%{_bindir}" +%if %{with sbin_compat} || "%{_sbindir}" == "%{_bindir}" # Compat symlinks for Requires in other packages. # We rely on filesystem to create the symlinks for us. Requires: filesystem(unmerged-sbin-symlinks) @@ -1032,7 +1037,7 @@ sed -r 's|/system/|/user/|g' %{SOURCE16} >10-timeout-abort.conf.user %meson_install # udev links -%if "%{_sbindir}" != "%{_bindir}" +%if !%{with sbin_compat} && "%{_sbindir}" != "%{_bindir}" mkdir -p %{buildroot}/%{_sbindir} ln -sf ../bin/udevadm %{buildroot}%{_sbindir}/udevadm %endif @@ -1181,7 +1186,7 @@ install -Dm0644 -t %{buildroot}%{_prefix}/lib/systemd/network/ %{SOURCE25} ln -s --relative %{buildroot}%{_bindir}/kernel-install %{buildroot}%{_sbindir}/installkernel %endif -%if "%{_sbindir}" == "%{_bindir}" +%if %{with sbin_compat} || "%{_sbindir}" == "%{_bindir}" # Systemd has the split-sbin option which is also used to select the directory # for alias symlinks. We need to keep split-sbin=true for now, to support # unmerged systems. Move the symlinks here instead. From 4fbce183cee0d38f76ec3c66f2eb7da781c6671c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jul 2026 07:19:12 +0000 Subject: [PATCH 56/63] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild From eaee67a709c7c5cd8fb8fcf3b84e987619abe500 Mon Sep 17 00:00:00 2001 From: Christopher Klooz Date: Fri, 17 Jul 2026 11:18:21 +0200 Subject: [PATCH 57/63] add 99-kernel-hardening.conf --- 99-kernel-hardening.conf | 70 ++++++++++++++++++++++++++++++++++++++++ systemd.spec | 5 ++- 2 files changed, 74 insertions(+), 1 deletion(-) create mode 100644 99-kernel-hardening.conf diff --git a/99-kernel-hardening.conf b/99-kernel-hardening.conf new file mode 100644 index 0000000..9d75be7 --- /dev/null +++ b/99-kernel-hardening.conf @@ -0,0 +1,70 @@ +# This file is disabled by default. It provides a few kernel +# hardening settings. This file is automatically updated. +# +# Please read the Fedora hardening page for further information +# about this file (section 'Fedora-maintained (self-updating) +# hardening for general and average use cases' and +# section 'Fedora-maintained self-updating kernel hardening'): +# https://docs.fedoraproject.org/en-US/security/topics/hardening +# +# If you want to enable the hardening, please create a symlink: +# sudo ln -s /usr/share/doc/systemd/99-kernel-hardening.conf /etc/sysctl.d/ +# -> do NOT copy or move or hardlink this file because +# this would break the automatic updates! +# +# Enabling this file can cause issues to some software developers: +# the need to use ptrace is restricted in the hardening +# because of the security issues it may cause in some +# circumstances: to use applications like gdb or strace when the +# hardening is enabled, users need to temporarily enable ptrace +# during the runtime of their ptrace-dependent application. +# Enabling ptrace implies disabling yama.ptrace_scope (which is +# the security measure enabled below). +# You can enable temporarily ptrace with: +# sysctl kernel.yama.ptrace_scope=0 +# You can subsequently disable it again with: +# sysctl kernel.yama.ptrace_scope=2 +# -> it will be reset automatically after reboot. +# For more information, read the Fedora hardening page +# mentioned above. +# +# The parameter below are complemented by links to +# their upstream and other useful documentation +# +# +# Details: https://docs.kernel.org/admin-guide/sysctl/net.html +# Details: https://wiki.archlinux.org/title/Security#BPF_hardening +# Minor / partially-related side note: Fedora's kernel is compiled +# with CONFIG_BPF_JIT_ALWAYS_ON=True +net.core.bpf_jit_harden = 2 + +# Details: https://docs.kernel.org/admin-guide/LSM/Yama.html +# Details: https://wiki.archlinux.org/title/Security#ptrace_scope +# Minor / partially-related site note: 'setsebool -P deny_ptrace on' +# can add a largely-overlapping security layer to achieve redundancy +# in restricting ptrace: it is suggested to read the Fedora hardening +# page (link above) section 'Fedora-maintained (self-updating) +# hardening for general and average use cases' and section +# 'Fedora-maintained 'enable & forget' SELinux & firewalld hardening' +# for further information about this. +kernel.yama.ptrace_scope = 2 + +# Details: https://docs.kernel.org/admin-guide/sysctl/kernel.html#kptr-restrict +# Details: https://wiki.archlinux.org/title/Security#Restricting_access_to_kernel_pointers_in_the_proc_filesystem +# This is formally not adding security because Fedora and its +# downstream use pre-compiled kernels, but in vulnerable situations, +# this can massively increase the required knowledge and necessary +# understanding for hostile exploitation +kernel.kptr_restrict = 2 + +# This is unlikely to cause exploitable attack surface in average use +# cases of OS that are appropriately pre-configured, but for the same +# reason it is unlikely to cause issues to the users. +# In case of a doubt, it mitigates some potential for attack surface, +# including some attack surface the user might create themselves by +# accident. Even if the latter applies, it is unlikely to cause an +# impact except mitigate exploitation +# Details: https://docs.kernel.org/admin-guide/sysctl/fs.html#protected-fifos +fs.protected_fifos = 2 +# Details: https://docs.kernel.org/admin-guide/sysctl/fs.html#protected-regular +fs.protected_regular = 2 diff --git a/systemd.spec b/systemd.spec index c172dc5..f11b19d 100644 --- a/systemd.spec +++ b/systemd.spec @@ -129,7 +129,7 @@ Source15: 10-oomd-per-slice-defaults.conf Source16: 10-timeout-abort.conf Source17: 10-map-count.conf Source18: 60-block-scheduler.rules - +Source19: 99-kernel-hardening.conf Source20: macros.sysusers.compat Source21: macros.sysusers Source22: sysusers.attr @@ -1141,6 +1141,9 @@ install -Dm0644 -t %{buildroot}/usr/lib/firewalld/services/ %{SOURCE8} %{SOURCE9 # https://bugzilla.redhat.com/show_bug.cgi?id=1234951 install -Dm0644 -t %{buildroot}%{_pkgdocdir}/ %{SOURCE10} +# Install kernel hardening file. Disabled by default. +install -Dm0644 -t %{buildroot}%{_pkgdocdir}/ %{SOURCE19} + # https://bugzilla.redhat.com/show_bug.cgi?id=1378974 install -Dm0644 -t %{buildroot}%{system_unit_dir}/systemd-udev-trigger.service.d/ %{SOURCE11} From e48f1014bdcc667bef34fc3ea45521d42c4ed2f3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 17 Jul 2026 11:33:30 +0200 Subject: [PATCH 58/63] Adjust 99-kernel-hardening.conf Adjust the wording for brevity and fix some typos. [skip changelog] --- 99-kernel-hardening.conf | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/99-kernel-hardening.conf b/99-kernel-hardening.conf index 9d75be7..bf42b85 100644 --- a/99-kernel-hardening.conf +++ b/99-kernel-hardening.conf @@ -7,13 +7,14 @@ # section 'Fedora-maintained self-updating kernel hardening'): # https://docs.fedoraproject.org/en-US/security/topics/hardening # -# If you want to enable the hardening, please create a symlink: +# If you want to enable the hardening, create a symlink: # sudo ln -s /usr/share/doc/systemd/99-kernel-hardening.conf /etc/sysctl.d/ # -> do NOT copy or move or hardlink this file because # this would break the automatic updates! # -# Enabling this file can cause issues to some software developers: -# the need to use ptrace is restricted in the hardening +# +# Enabling this ptrace restriction can cause issues to some software +# developers: the need to use ptrace is restricted in the hardening # because of the security issues it may cause in some # circumstances: to use applications like gdb or strace when the # hardening is enabled, users need to temporarily enable ptrace @@ -28,10 +29,6 @@ # For more information, read the Fedora hardening page # mentioned above. # -# The parameter below are complemented by links to -# their upstream and other useful documentation -# -# # Details: https://docs.kernel.org/admin-guide/sysctl/net.html # Details: https://wiki.archlinux.org/title/Security#BPF_hardening # Minor / partially-related side note: Fedora's kernel is compiled @@ -40,9 +37,9 @@ net.core.bpf_jit_harden = 2 # Details: https://docs.kernel.org/admin-guide/LSM/Yama.html # Details: https://wiki.archlinux.org/title/Security#ptrace_scope -# Minor / partially-related site note: 'setsebool -P deny_ptrace on' -# can add a largely-overlapping security layer to achieve redundancy -# in restricting ptrace: it is suggested to read the Fedora hardening +# Side note: 'setsebool -P deny_ptrace on' can add a +# largely-overlapping security layer to achieve redundancy in +# restricting ptrace: it is suggested to read the Fedora hardening # page (link above) section 'Fedora-maintained (self-updating) # hardening for general and average use cases' and section # 'Fedora-maintained 'enable & forget' SELinux & firewalld hardening' @@ -52,9 +49,8 @@ kernel.yama.ptrace_scope = 2 # Details: https://docs.kernel.org/admin-guide/sysctl/kernel.html#kptr-restrict # Details: https://wiki.archlinux.org/title/Security#Restricting_access_to_kernel_pointers_in_the_proc_filesystem # This is formally not adding security because Fedora and its -# downstream use pre-compiled kernels, but in vulnerable situations, -# this can massively increase the required knowledge and necessary -# understanding for hostile exploitation +# downstream use pre-compiled kernels, but it increases +# the knowledge required for successful exploitation. kernel.kptr_restrict = 2 # This is unlikely to cause exploitable attack surface in average use From ec1593fa55dcdc10067d24372d715855fb02cad9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 17 Jul 2026 11:39:26 +0200 Subject: [PATCH 59/63] Drop 20-yama-ptrace.conf 20-yama-ptrace.conf has the same (non-comment) content as /usr/lib/sysctl.d/10-default-yama-scope.conf provided by elfutils-default-yama-scope. We can drop our file. And the new 99-kernel-hardening.conf provides a suitable replacement. --- 20-yama-ptrace.conf | 42 ------------------------------------------ systemd.spec | 5 ----- 2 files changed, 47 deletions(-) delete mode 100644 20-yama-ptrace.conf diff --git a/20-yama-ptrace.conf b/20-yama-ptrace.conf deleted file mode 100644 index 4fbaf97..0000000 --- a/20-yama-ptrace.conf +++ /dev/null @@ -1,42 +0,0 @@ -# The ptrace system call is used for interprocess services, -# communication and introspection (like synchronisation, signaling, -# debugging, tracing and profiling) of processes. -# -# Usage of ptrace is restricted by normal user permissions. Normal -# unprivileged processes cannot use ptrace on processes that they -# cannot send signals to or processes that are running set-uid or -# set-gid. Nevertheless, processes running under the same uid will -# usually be able to ptrace one another. -# -# Fedora enables the Yama security mechanism which restricts ptrace -# even further. Sysctl setting kernel.yama.ptrace_scope can have one -# of the following values: -# -# 0 - Normal ptrace security permissions. -# 1 - Restricted ptrace. Only child processes plus normal permissions. -# 2 - Admin-only attach. Only executables with CAP_SYS_PTRACE. -# 3 - No attach. No process may call ptrace at all. Irrevocable. -# -# For more information see Documentation/security/Yama.txt in the -# kernel sources. -# -# The default is 1., which allows tracing of child processes, but -# forbids tracing of arbitrary processes. This allows programs like -# gdb or strace to work when the most common way of having the -# debugger start the debuggee is used: -# gdb /path/to/program ... -# Attaching to already running programs is NOT allowed: -# gdb -p ... -# This default setting is suitable for the common case, because it -# reduces the risk that one hacked process can be used to attack other -# processes. (For example, a hacked firefox process in a user session -# will not be able to ptrace the keyring process and extract passwords -# stored only in memory.) -# -# Developers and administrators might want to disable those protections -# to be able to attach debuggers to existing processes. Use -# sysctl kernel.yama.ptrace_scope=0 -# for change the setting temporarily, or copy this file to -# /etc/sysctl.d/20-yama-ptrace.conf to set it for future boots. - -kernel.yama.ptrace_scope = 0 diff --git a/systemd.spec b/systemd.spec index f11b19d..2d81fcd 100644 --- a/systemd.spec +++ b/systemd.spec @@ -119,7 +119,6 @@ Source6: inittab Source7: sysctl.conf.README Source8: systemd-journal-remote.xml Source9: systemd-journal-gatewayd.xml -Source10: 20-yama-ptrace.conf Source11: systemd-udev-trigger-no-reload.conf # https://fedoraproject.org/wiki/How_to_filter_libabigail_reports Source13: libabigail.abignore @@ -1137,10 +1136,6 @@ EOF install -Dm0644 -t %{buildroot}/usr/lib/firewalld/services/ %{SOURCE8} %{SOURCE9} -# Install additional docs -# https://bugzilla.redhat.com/show_bug.cgi?id=1234951 -install -Dm0644 -t %{buildroot}%{_pkgdocdir}/ %{SOURCE10} - # Install kernel hardening file. Disabled by default. install -Dm0644 -t %{buildroot}%{_pkgdocdir}/ %{SOURCE19} From f4e7691d3bf232e444d00ab91571503135ebd028 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 17 Jul 2026 12:14:57 +0200 Subject: [PATCH 60/63] Make .conf files non-%doc, install one more license file Since 99-hardening.conf is supposed to be symlinked as configuration, it cannot be marked with %doc. Also add one more license file listed in the License line, and clean things up a bit while at it. [skip changelog] --- split-files.py | 17 ++++++++++------- systemd.spec | 2 +- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/split-files.py b/split-files.py index 71df1b1..52fa5c1 100644 --- a/split-files.py +++ b/split-files.py @@ -99,10 +99,11 @@ for file in files(buildroot): /usr/lib.*/(security|pkgconfig)$| /usr/lib/rpm(/macros.d|)$| /usr/lib/firewalld(/services|)$| - /usr/share/(locale|licenses|doc)| # no $ + /usr/share/(locale|licenses)| # no $ + LICENSE| /etc(/pam\.d|/xdg|/X11|/X11/xinit|/X11.*\.d|)$| /etc/(dnf|dnf/protected.d)$| - /usr/(src|lib/debug)| # no $ + /usr/(src|lib/debug)| # no $ /run$| /var(/cache|/log|/lib|/run|)$ ''', n, re.X): @@ -283,7 +284,8 @@ for file in files(buildroot): prefix = known_files[n].split()[:-1] elif file.is_dir(follow_symlinks=False): prefix = ['%dir'] - elif 'README' in n: + # Allow .conf files to be linked as config. They must not be %doc. + elif ('README' in n or '/doc/' in n) and not n.endswith('.conf'): prefix = ['%doc'] elif n.startswith('/etc'): prefix = ['%config(noreplace)'] @@ -301,8 +303,9 @@ for file in files(buildroot): print(f'{prefix}{n}{suffix}', file=file) - -if [print(f'ERROR: no file names were written to {o.name}') - for name, o in outputs.items() - if o.tell() == 0 and name not in potentially_empty_outputs]: +if [ + print(f'ERROR: no file names were written to {o.name}') + for name, o in outputs.items() + if o.tell() == 0 and name not in potentially_empty_outputs +]: sys.exit(1) diff --git a/systemd.spec b/systemd.spec index 2d81fcd..a7e1f6e 100644 --- a/systemd.spec +++ b/systemd.spec @@ -1537,10 +1537,10 @@ fi %global _docdir_fmt %{name} %files -f %{name}.lang -f .file-list-main -%doc %{_pkgdocdir} %exclude %{_pkgdocdir}/LICENSE* # Only the licenses texts for the licenses in License line are included. %license LICENSE.GPL2 +%license LICENSE.LGPL2.1 %license LICENSES/MIT.txt %ghost %dir %attr(0755,-,-) /etc/systemd/system/basic.target.wants %ghost %dir %attr(0755,-,-) /etc/systemd/system/bluetooth.target.wants From 6282eacf43a27ff206b97cfd59e51158f49d2c82 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 22 Jul 2026 12:51:57 +0200 Subject: [PATCH 61/63] Expect report-standalone to be built also for commit builds [skip changelog] --- systemd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/systemd.spec b/systemd.spec index a7e1f6e..a4ad773 100644 --- a/systemd.spec +++ b/systemd.spec @@ -91,7 +91,7 @@ Release: %autorelease %global stable %(c="%version"; [ "$c" = "${c#*.*}" ]; echo $?) # Temporary macro to enable systemd-report.standalone -%bcond report_standalone %[ v"%{version}" >= v"261.999" ] +%bcond report_standalone %[ v"%{version}" >= v"261.999" || %{defined commit} ] # For a breakdown of the licensing, see README License: LGPL-2.1-or-later AND MIT AND GPL-2.0-or-later From 94948d9db3fa19630276d3579d7d0f51b0128456 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 25 Jul 2026 10:49:20 -0600 Subject: [PATCH 62/63] Version 261.2 - a bugfix release with correctness and security-relevant fixes too. 276 patches, so too much to describe here. --- sources | 2 +- systemd.spec | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sources b/sources index fe6ce37..43d70f2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (systemd-261.1.tar.gz) = 5dbf8b902fbed6e719367266da658b46ed55e76c93b7aa48ebaf9daca36cb19261ebd45cb97139c51227022a8ca3d07da360953bd9b0aebb429dce6d111f7e5c +SHA512 (systemd-261.2.tar.gz) = 876f043970cb65b39ae15fba39f23bf94c7c3d80569503d6e8ea2c8013c30ee40ce43cb55cbcb1cf14d5c3021aafc09c0f67473bbf742d8964bf9fa30693b971 diff --git a/systemd.spec b/systemd.spec index a4ad773..71a9958 100644 --- a/systemd.spec +++ b/systemd.spec @@ -82,7 +82,7 @@ Url: https://systemd.io # But don't do that on OBS, otherwise the version subst fails, and will be # like 257-123-gabcd257.1 instead of 257-123-gabcd %if %{without obs} -Version: %{?version_override}%{!?version_override:261.1} +Version: %{?version_override}%{!?version_override:261.2} %else Version: %{?version_override}%{!?version_override:%(cat meson.version)} %endif From 8c0ffebeea68533f40a2e53ac8620e45eafbc3d7 Mon Sep 17 00:00:00 2001 From: Martin Pitt Date: Wed, 29 Jul 2026 17:08:59 +0000 Subject: [PATCH 63/63] Downgrade kbd dependency to Recommends unconditionally Commit ab743db0 made the dependency weak for %{with upstream} builds only, because upstream 3327a411be3e ("vconsole-setup: handle gracefully if setfont/loadkeys are not available") landed after v260 was released. Rawhide now has v261.2, so the condition is always true here. The hard requirement came from 01e2d8a9 (2020, rhbz#1408878), which "upgraded" the Recommends originally added in 4ebba8aa. Now that systemd-vconsole-setup logs a notice and skips keymap and font setup when the binaries are absent, kbd is only needed to actually apply a non-default console keymap or font. This again lets minimal images that disable weak dependencies leave out kbd together with the libxkbcommon, xkeyboard-config, and libxml2 chain it pulls in: about 9 MB uncompressed. That particularly affects initrds, which are unpacked into RAM. --- systemd.spec | 5 ----- 1 file changed, 5 deletions(-) diff --git a/systemd.spec b/systemd.spec index 71a9958..6a028bd 100644 --- a/systemd.spec +++ b/systemd.spec @@ -532,13 +532,8 @@ Requires: libblkid.so.1(BLKID_2.30)%{?elf_bits} # https://bugzilla.redhat.com/show_bug.cgi?id=1377733#c9 Suggests: systemd-bootchart -# https://bugzilla.redhat.com/show_bug.cgi?id=1408878 -%if %{with upstream} # v261 handles missing setfont/loadkeys gracefully Recommends: kbd -%else -Requires: kbd -%endif # https://bugzilla.redhat.com/show_bug.cgi?id=1753381 Provides: u2f-hidraw-policy = 1.0.2-40