Downgrade kbd dependency to Recommends unconditionally

Commit ab743db0 made the dependency weak for %{with upstream} builds
only, because upstream 3327a411be3e ("vconsole-setup: handle gracefully
if setfont/loadkeys are not available") landed after v260 was released.
Rawhide now has v261.2, so the condition is always true here.

The hard requirement came from 01e2d8a9 (2020, rhbz#1408878), which
"upgraded" the Recommends originally added in 4ebba8aa. Now that
systemd-vconsole-setup logs a notice and skips keymap and font setup
when the binaries are absent, kbd is only needed to actually apply a
non-default console keymap or font.

This again lets minimal images that disable weak dependencies leave out
kbd together with the libxkbcommon, xkeyboard-config, and libxml2 chain
it pulls in: about 9 MB uncompressed. That particularly affects initrds,
which are unpacked into RAM.

0001-Revert-units-drop-runlevel-0-6-.target.patch

@@ -1,88 +0,0 @@
-From 61750e265ce3f7783a8dba831e91140f84ad89f2 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
-Date: Wed, 5 Nov 2025 17:52:16 +0100
-Subject: [PATCH 1/3] Revert "units: drop runlevel[0-6].target"
-
-This partially reverts commit e58ba80a40fb6e96543d56774a5bc5aa9cdadbf3.
-The unit are still needed for compat.
----
- units/meson.build | 27 ++++++++++++++++++++++-----
- 1 file changed, 22 insertions(+), 5 deletions(-)
-
-diff --git a/units/meson.build b/units/meson.build
-index 2e04c4aa2b..46eaac4073 100644
---- a/units/meson.build
-+++ b/units/meson.build
-@@ -1,5 +1,7 @@
- # SPDX-License-Identifier: LGPL-2.1-or-later
- 
-+with_runlevels = conf.get('HAVE_SYSV_COMPAT') == 1
-+
- units = [
-         { 'file' : 'basic.target' },
-         { 'file' : 'blockdev@.target' },
-@@ -49,7 +51,7 @@ units = [
-         },
-         {
-           'file' : 'graphical.target',
--          'symlinks' : ['default.target'],
-+          'symlinks' : ['default.target'] + (with_runlevels ? ['runlevel5.target'] : []),
-         },
-         { 'file' : 'halt.target' },
-         {
-@@ -142,7 +144,10 @@ units = [
-           'conditions' : ['ENABLE_MACHINED'],
-         },
-         { 'file' : 'modprobe@.service' },
--        { 'file' : 'multi-user.target' },
-+        {
-+          'file' : 'multi-user.target',
-+          'symlinks' : with_runlevels ? ['runlevel2.target', 'runlevel3.target', 'runlevel4.target'] : [],
-+        },
-         {
-           'file' : 'systemd-mute-console.socket',
-           'symlinks' : ['sockets.target.wants/']
-@@ -155,7 +160,10 @@ units = [
-         { 'file' : 'nss-lookup.target' },
-         { 'file' : 'nss-user-lookup.target' },
-         { 'file' : 'paths.target' },
--        { 'file' : 'poweroff.target' },
-+        {
-+          'file' : 'poweroff.target',
-+          'symlinks' : with_runlevels ? ['runlevel0.target'] : [],
-+        },
-         { 'file' : 'printer.target' },
-         {
-           'file' : 'proc-sys-fs-binfmt_misc.automount',
-@@ -180,7 +188,7 @@ units = [
-         },
-         {
-           'file' : 'reboot.target',
--          'symlinks' : ['ctrl-alt-del.target'],
-+          'symlinks' : ['ctrl-alt-del.target'] + (with_runlevels ? ['runlevel6.target'] : []),
-         },
-         {
-           'file' : 'remote-cryptsetup.target',
-@@ -200,7 +208,10 @@ units = [
-           'symlinks' : ['initrd-root-device.target.wants/'],
-         },
-         { 'file' : 'rescue.service.in' },
--        { 'file' : 'rescue.target' },
-+        {
-+          'file' : 'rescue.target',
-+          'symlinks' : with_runlevels ? ['runlevel1.target'] : [],
-+        },
-         { 'file' : 'rpcbind.target' },
-         { 'file' : 'serial-getty@.service.in' },
-         { 'file' : 'shutdown.target' },
-@@ -1001,4 +1012,10 @@ else
-                             dbussessionservicedir / 'org.freedesktop.systemd1.service'))
- endif
- 
-+if conf.get('HAVE_SYSV_COMPAT') == 1
-+        foreach i : [1, 2, 3, 4, 5]
-+                install_emptydir(systemunitdir / 'runlevel@0@.target.wants'.format(i))
-+        endforeach
-+endif
-+
- subdir('user')

0001-core-create-userdb-root-directory-with-correct-label.patch

@@ -0,0 +1,42 @@
+From 64a0066cfaa4dfcf25c5f6d3ae58df4f24dd1108 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
+Date: Sat, 30 Aug 2025 13:55:56 +0200
+Subject: [PATCH 1/2] core: create userdb root directory with correct label
+
+Set up the /run/systemd/userdb directory with the default SELinux context
+on creation.
+
+With version 257.7-1 on Debian the directory was automatically created with the
+correct label. Starting with version 258 (only tested with 258~rc3-1) it no
+longer is. Regression introduced in 736349958efe34089131ca88950e2e5bb391d36a.
+
+[zjs: edited the patch to apply comments from review and update the description.]
+---
+ src/core/varlink.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/src/core/varlink.c b/src/core/varlink.c
+index 6074c55ab1..acd51fc47e 100644
+--- a/src/core/varlink.c
++++ b/src/core/varlink.c
+@@ -8,6 +8,7 @@
+ #include "json-util.h"
+ #include "manager.h"
+ #include "metrics.h"
++#include "mkdir.h"
+ #include "path-util.h"
+ #include "pidref.h"
+ #include "string-util.h"
+@@ -514,7 +515,11 @@ static int varlink_server_listen_many_idempotent_sentinel(
+                 if (!known_fresh && varlink_server_contains_socket(s, address))
+                         continue;
+ 
+-                r = sd_varlink_server_listen_address(s, address, 0666 | SD_VARLINK_SERVER_MODE_MKDIR_0755);
++                r = mkdir_parents_label(address, 0755);
++                if (r < 0)
++                        log_warning_errno(r, "Failed to create parent directory of '%s', ignoring: %m", address);
++
++                r = sd_varlink_server_listen_address(s, address, 0666);
+                 if (r < 0) {
+                         log_error_errno(r, "Failed to bind to varlink socket '%s': %m", address);
+                         break;

0002-machined-continue-without-resolve.hook-socket.patch

@@ -1,17 +1,17 @@
-From 8d6d86d1d7e45eeae921e88adde55d6524027c96 Mon Sep 17 00:00:00 2001
+From 786d3f382308d0119cce020e2c88a03ff96a25d9 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
 Date: Wed, 26 Nov 2025 22:29:53 +0100
-Subject: [PATCH 3/3] machined: continue without resolve.hook socket
+Subject: [PATCH 2/2] machined: continue without resolve.hook socket
 
 ---
  src/machine/machined-varlink.c | 12 +++++++++---
  1 file changed, 9 insertions(+), 3 deletions(-)
 
 diff --git a/src/machine/machined-varlink.c b/src/machine/machined-varlink.c
-index f83cbb8562..0b30cd0531 100644
+index acc2137f83..d1c9453e41 100644
 --- a/src/machine/machined-varlink.c
 +++ b/src/machine/machined-varlink.c
-@@ -894,9 +894,15 @@ static int manager_varlink_init_resolve_hook(Manager *m) {
+@@ -904,9 +904,15 @@ static int manager_varlink_init_resolve_hook(Manager *m) {
  
          r = sd_varlink_server_listen_address(s, VARLINK_PATH_MACHINED_RESOLVE_HOOK,
                                               0666 | SD_VARLINK_SERVER_MODE_MKDIR_0755);

20-yama-ptrace.conf

@@ -1,42 +0,0 @@
-# The ptrace system call is used for interprocess services,
-# communication and introspection (like synchronisation, signaling,
-# debugging, tracing and profiling) of processes.
-#
-# Usage of ptrace is restricted by normal user permissions. Normal
-# unprivileged processes cannot use ptrace on processes that they
-# cannot send signals to or processes that are running set-uid or
-# set-gid. Nevertheless, processes running under the same uid will
-# usually be able to ptrace one another.
-#
-# Fedora enables the Yama security mechanism which restricts ptrace
-# even further. Sysctl setting kernel.yama.ptrace_scope can have one
-# of the following values:
-#
-# 0 - Normal ptrace security permissions.
-# 1 - Restricted ptrace. Only child processes plus normal permissions.
-# 2 - Admin-only attach. Only executables with CAP_SYS_PTRACE.
-# 3 - No attach. No process may call ptrace at all. Irrevocable.
-#
-# For more information see Documentation/security/Yama.txt in the
-# kernel sources.
-#
-# The default is 1., which allows tracing of child processes, but
-# forbids tracing of arbitrary processes. This allows programs like
-# gdb or strace to work when the most common way of having the
-# debugger start the debuggee is used:
-#    gdb /path/to/program ...
-# Attaching to already running programs is NOT allowed:
-#    gdb -p ...
-# This default setting is suitable for the common case, because it
-# reduces the risk that one hacked process can be used to attack other
-# processes. (For example, a hacked firefox process in a user session
-# will not be able to ptrace the keyring process and extract passwords
-# stored only in memory.)
-#
-# Developers and administrators might want to disable those protections
-# to be able to attach debuggers to existing processes. Use
-#   sysctl kernel.yama.ptrace_scope=0
-# for change the setting temporarily, or copy this file to
-# /etc/sysctl.d/20-yama-ptrace.conf to set it for future boots.
-
-kernel.yama.ptrace_scope = 0

38769.patch

@@ -1,42 +0,0 @@
-From 00d70f36a0866660693347009446b7f872a05bf4 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
-Date: Sat, 30 Aug 2025 13:55:56 +0200
-Subject: [PATCH] core: create userdb root directory with correct label
-
-Set up the /run/systemd/userdb directory with the default SELinux context
-on creation.
-
-With version 257.7-1 on Debian the directory was automatically created with the
-correct label. Starting with version 258 (only tested with 258~rc3-1) it no
-longer is. Regression introduced in 736349958efe34089131ca88950e2e5bb391d36a.
-
-[zjs: edited the patch to apply comments from review and update the description.]
----
- src/core/varlink.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/src/core/varlink.c b/src/core/varlink.c
-index 99f12c59e5..71a8ffd0e5 100644
---- a/src/core/varlink.c
-+++ b/src/core/varlink.c
-@@ -5,6 +5,7 @@
- #include "constants.h"
- #include "errno-util.h"
- #include "manager.h"
-+#include "mkdir-label.h"
- #include "path-util.h"
- #include "pidref.h"
- #include "string-util.h"
-@@ -441,7 +442,11 @@ static int manager_varlink_init_system(Manager *m) {
-                         if (!fresh && varlink_server_contains_socket(m->varlink_server, address))
-                                 continue;
- 
--                        r = sd_varlink_server_listen_address(m->varlink_server, address, 0666 | SD_VARLINK_SERVER_MODE_MKDIR_0755);
-+                        r = mkdir_parents_label(address, 0755);
-+                        if (r < 0)
-+                                log_warning_errno(r, "Failed to create parent directory of '%s', ignoring: %m", address);
-+
-+                        r = sd_varlink_server_listen_address(m->varlink_server, address, 0666);
-                         if (r < 0)
-                                 return log_error_errno(r, "Failed to bind to varlink socket '%s': %m", address);
-                 }

42668.patch

@@ -0,0 +1,44 @@
+From e6f1190eb6be465432cfbab267a59c851ae990c5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@amutable.com>
+Date: Fri, 19 Jun 2026 21:38:44 +0200
+Subject: [PATCH] crypto-util: prefer openssl-4
+
+Fedora has switched to openssl 4, and we generate a Requires dependency
+on libcrypto for the systemd-udev subpackage, so preferring openssl-3
+does the wrong thing. So the order in the dlopen note needs to be switched.
+But in general, we want to get rid of openssl-3, so we want to load
+openssl-4 in preference. Change the order in both places.
+
+(The "compat" order can stay in 261-stable for other distros.)
+---
+ src/shared/crypto-util.c | 3 +--
+ src/shared/crypto-util.h | 2 +-
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/src/shared/crypto-util.c b/src/shared/crypto-util.c
+index ed6d2a269c772..b345475fa4043 100644
+--- a/src/shared/crypto-util.c
++++ b/src/shared/crypto-util.c
+@@ -339,8 +339,7 @@ int dlopen_libcrypto(int log_level) {
+ 
+         LIBCRYPTO_NOTE(SD_ELF_NOTE_DLOPEN_PRIORITY_SUGGESTED);
+ 
+-        // FIXME: switch order to prefer libcrypto.so.4 in a future version once it has stabilized
+-        FOREACH_STRING(soname, "libcrypto.so.3", "libcrypto.so.4") {
++        FOREACH_STRING(soname, "libcrypto.so.4", "libcrypto.so.3") {
+                 r = dlopen_many_sym_or_warn(
+                         &libcrypto_dl,
+                         soname,
+diff --git a/src/shared/crypto-util.h b/src/shared/crypto-util.h
+index 980c1c60a2a5f..bd0cb7b67b8dd 100644
+--- a/src/shared/crypto-util.h
++++ b/src/shared/crypto-util.h
+@@ -37,7 +37,7 @@ int dlopen_libcrypto(int log_level);
+         SD_ELF_NOTE_DLOPEN("libcrypto",                                 \
+                            "Support for cryptographic operations",      \
+                            priority,                                    \
+-                           "libcrypto.so.3", "libcrypto.so.4")
++                           "libcrypto.so.4", "libcrypto.so.3")
+ 
+ #define DLOPEN_LIBCRYPTO(log_level, priority)                           \
+         ({                                                              \

7be9032019015ddd61985e6a6721d813d62dad0b.patch

@@ -0,0 +1,38 @@
+From 7be9032019015ddd61985e6a6721d813d62dad0b Mon Sep 17 00:00:00 2001
+From: Luca Boccassi <luca.boccassi@gmail.com>
+Date: Sat, 20 Jun 2026 15:21:26 +0100
+Subject: [PATCH] ssl-util: prefer OpenSSL 4
+
+For the next version we can switch to preferring the new version
+---
+ src/shared/ssl-util.c | 3 +--
+ src/shared/ssl-util.h | 2 +-
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/src/shared/ssl-util.c b/src/shared/ssl-util.c
+index 226120c70e66f..4b7ab2ec29f74 100644
+--- a/src/shared/ssl-util.c
++++ b/src/shared/ssl-util.c
+@@ -40,8 +40,7 @@ int dlopen_libssl(int log_level) {
+ 
+         LIBSSL_NOTE(SD_ELF_NOTE_DLOPEN_PRIORITY_SUGGESTED);
+ 
+-        // FIXME: switch order to prefer libssl.so.4 in a future version once it has stabilized
+-        FOREACH_STRING(soname, "libssl.so.3", "libssl.so.4") {
++        FOREACH_STRING(soname, "libssl.so.4", "libssl.so.3") {
+                 r = dlopen_many_sym_or_warn(
+                                 &libssl_dl,
+                                 soname,
+diff --git a/src/shared/ssl-util.h b/src/shared/ssl-util.h
+index aa3b8308665ba..77b5c049f9e3a 100644
+--- a/src/shared/ssl-util.h
++++ b/src/shared/ssl-util.h
+@@ -12,7 +12,7 @@ int dlopen_libssl(int log_level);
+         SD_ELF_NOTE_DLOPEN("libssl",                                    \
+                            "Support for TLS",                           \
+                            priority,                                    \
+-                           "libssl.so.3", "libssl.so.4")
++                           "libssl.so.4", "libssl.so.3")
+ 
+ #define DLOPEN_LIBSSL(log_level, priority)                              \
+         ({                                                              \

99-kernel-hardening.conf

@@ -0,0 +1,66 @@
+# This file is disabled by default. It provides a few kernel
+# hardening settings. This file is automatically updated.
+# 
+# Please read the Fedora hardening page for further information
+# about this file (section 'Fedora-maintained (self-updating)
+# hardening for general and average use cases' and
+# section 'Fedora-maintained self-updating kernel hardening'):
+#   https://docs.fedoraproject.org/en-US/security/topics/hardening
+#
+# If you want to enable the hardening, create a symlink:
+#   sudo ln -s /usr/share/doc/systemd/99-kernel-hardening.conf /etc/sysctl.d/
+# -> do NOT copy or move or hardlink this file because
+# this would break the automatic updates!
+#
+#
+# Enabling this ptrace restriction can cause issues to some software
+# developers: the need to use ptrace is restricted in the hardening
+# because of the security issues it may cause in some
+# circumstances: to use applications like gdb or strace when the
+# hardening is enabled, users need to temporarily enable ptrace
+# during the runtime of their ptrace-dependent application.
+# Enabling ptrace implies disabling yama.ptrace_scope (which is
+# the security measure enabled below).
+# You can enable temporarily ptrace with:
+#   sysctl kernel.yama.ptrace_scope=0
+# You can subsequently disable it again with:
+#   sysctl kernel.yama.ptrace_scope=2 
+# -> it will be reset automatically after reboot.
+# For more information, read the Fedora hardening page
+# mentioned above.
+#
+# Details: https://docs.kernel.org/admin-guide/sysctl/net.html
+# Details: https://wiki.archlinux.org/title/Security#BPF_hardening
+# Minor / partially-related side note: Fedora's kernel is compiled 
+# with CONFIG_BPF_JIT_ALWAYS_ON=True
+net.core.bpf_jit_harden = 2
+
+# Details: https://docs.kernel.org/admin-guide/LSM/Yama.html
+# Details: https://wiki.archlinux.org/title/Security#ptrace_scope
+# Side note: 'setsebool -P deny_ptrace on' can add a
+# largely-overlapping security layer to achieve redundancy in
+# restricting ptrace: it is suggested to read the Fedora hardening
+# page (link above) section 'Fedora-maintained (self-updating)
+# hardening for general and average use cases' and section
+# 'Fedora-maintained 'enable & forget' SELinux & firewalld hardening'
+# for further information about this.
+kernel.yama.ptrace_scope = 2
+
+# Details: https://docs.kernel.org/admin-guide/sysctl/kernel.html#kptr-restrict
+# Details: https://wiki.archlinux.org/title/Security#Restricting_access_to_kernel_pointers_in_the_proc_filesystem
+# This is formally not adding security because Fedora and its
+# downstream use pre-compiled kernels, but it increases
+# the knowledge required for successful exploitation.
+kernel.kptr_restrict = 2
+
+# This is unlikely to cause exploitable attack surface in average use
+# cases of OS that are appropriately pre-configured, but for the same
+# reason it is unlikely to cause issues to the users.
+# In case of a doubt, it mitigates some potential for attack surface,
+# including some attack surface the user might create themselves by
+# accident. Even if the latter applies, it is unlikely to cause an
+# impact except mitigate exploitation
+# Details: https://docs.kernel.org/admin-guide/sysctl/fs.html#protected-fifos
+fs.protected_fifos = 2
+# Details: https://docs.kernel.org/admin-guide/sysctl/fs.html#protected-regular
+fs.protected_regular = 2

plans/run-integration-tests.sh

@@ -89,16 +89,23 @@ if [[ ! -e /dev/kvm ]]; then
 fi
 
 NPROC="$(nproc)"
-if [[ "$NPROC" -ge 10 ]]; then
-    export TEST_JOURNAL_USE_TMP=1
-    NPROC="$((NPROC / 3))"
-else
-    NPROC="$((NPROC - 1))"
+if [[ "$NPROC" -gt 4 ]]; then
+    # Cap the number of parallel tests to 4 to not overwhelm larger hosts
+    NPROC=4
 fi
 
+# Workaround for a kernel 7.x virtio/vsock bug, where a patch for a potential overflow inadvertently shrunk
+# the receive buffer's effective size below what was configured, which eventually causes the vsock connection
+# to get reset with ENOBUFS, that kills the journal forwarding over vsock
+#
+# Pending fix: https://lore.kernel.org/netdev/20260518090656.134588-3-sgarzare@redhat.com/
+sysctl -w net.core.rmem_max=16777216
+sysctl -w net.core.wmem_max=16777216
+
 # This test is only really useful if we're building with sanitizers and takes a long time, so let's skip it
 # for now.
 export TEST_SKIP="TEST-21-DFUZZER ${TEST_SKIP:-}"
+export TEST_JOURNAL_USE_TMP=1
 
 mkosi genkey
 mkosi summary

plans/upstream.fmf

@@ -17,6 +17,10 @@ prepare:
     exclude:
       - systemd-standalone-.*
 execute:
-    how: tmt
-    script: exec plans/run-integration-tests.sh
-    duration: 2h
+  how: tmt
+  script: exec plans/run-integration-tests.sh
+  duration: 2h
+adjust:
+  - when: distro == fedora-eln
+    execute:
+      script: echo skipped

rpminspect.yaml

@@ -1,4 +1,10 @@
- # Disable badfuncs check that has tons of false positives.
+annocheck:
+  ignore:
+    # This test is intentionally compiled with a minimal set of hardcoded
+    # options, so it always generates a predictable stack trace
+    - /usr/lib/systemd/tests/unit-tests/manual/test-coredump-stacktrace
+
+# Disable badfuncs check that has tons of false positives.
 badfuncs:
   allowed:
     /usr/lib/systemd/tests/unit-tests/*:

sources

@@ -1 +1 @@
-SHA512 (systemd-259.1.tar.gz) = 7cbeca5dad6413a876809200583854ddc706b7a69deff958eb1ca1afb726cf4dec014006c10d1945c450b754811d4b95a80fe1778cb3136997f6d11b11c0560e
+SHA512 (systemd-261.2.tar.gz) = 876f043970cb65b39ae15fba39f23bf94c7c3d80569503d6e8ea2c8013c30ee40ce43cb55cbcb1cf14d5c3021aafc09c0f67473bbf742d8964bf9fa30693b971

split-files.py

@@ -1,7 +1,11 @@
 import re, sys, os, collections
 
 buildroot = sys.argv[1]
-no_bootloader = '--no-bootloader' in sys.argv
+
+potentially_empty_outputs = [
+    'standalone-report',
+    *(['boot'] if '--no-bootloader' in sys.argv else []),
+]
 
 known_files = '''
 %ghost %config(noreplace) /etc/crypttab
@@ -26,8 +30,8 @@ known_files = '''
 %ghost %dir /var/lib/private/systemd
 %ghost %dir /var/lib/private/systemd/journal-upload
 %ghost /var/lib/private/systemd/journal-upload/state
-%ghost %dir /var/lib/systemd/timesync
-%ghost /var/lib/systemd/timesync/clock
+%ghost %dir %verify(not user group) /var/lib/systemd/timesync
+%ghost %verify(not user group) /var/lib/systemd/timesync/clock
 %ghost %dir /var/lib/systemd/backlight
 %ghost /var/lib/systemd/catalog/database
 %ghost %dir /var/lib/systemd/coredump
@@ -73,6 +77,7 @@ outputs = {suffix: open(f'.file-list-{suffix}', 'w')
                    'resolve',
                    'tests',
                    'standalone-repart',
+                   'standalone-report',
                    'standalone-tmpfiles',
                    'standalone-sysusers',
                    'standalone-shutdown',
@@ -94,10 +99,11 @@ for file in files(buildroot):
                     /usr/lib.*/(security|pkgconfig)$|
                     /usr/lib/rpm(/macros.d|)$|
                     /usr/lib/firewalld(/services|)$|
-                    /usr/share/(locale|licenses|doc)|             # no $
+                    /usr/share/(locale|licenses)|             # no $
+                    LICENSE|
                     /etc(/pam\.d|/xdg|/X11|/X11/xinit|/X11.*\.d|)$|
                     /etc/(dnf|dnf/protected.d)$|
-                    /usr/(src|lib/debug)|                         # no $
+                    /usr/(src|lib/debug)|                     # no $
                     /run$|
                     /var(/cache|/log|/lib|/run|)$
     ''', n, re.X):
@@ -106,6 +112,8 @@ for file in files(buildroot):
     if n.endswith('.standalone'):
         if 'repart' in n:
             o = outputs['standalone-repart']
+        elif 'report' in n:
+            o = outputs['standalone-report']
         elif 'tmpfiles' in n:
             o = outputs['standalone-tmpfiles']
         elif 'sysusers' in n:
@@ -113,7 +121,7 @@ for file in files(buildroot):
         elif 'shutdown' in n:
             o = outputs['standalone-shutdown']
         else:
-            assert False, 'Found .standalone not belonging to known packages'
+            assert False, f'Found {n} not belonging to known standalone packages'
 
     elif '/security/pam_' in n or '/man8/pam_' in n:
         o = outputs['pam']
@@ -121,7 +129,7 @@ for file in files(buildroot):
         o = outputs['rpm-macros']
     elif '/usr/lib/systemd/tests' in n:
         o = outputs['tests']
-    elif 'ukify' in n and '/man/' not in n:
+    elif ('ukify' in n or '/hwids/' in n) and '/man/' not in n:
         o = outputs['ukify']
     elif re.search(r'/libsystemd-core-.*\.so$', n):
         o = outputs['main']
@@ -151,6 +159,7 @@ for file in files(buildroot):
                        mount.ddi|
                        importctl|
                        portablectl|
+                       portabled|portable1|
                        systemd-nspawn|
                        systemd\.nspawn|
                        systemd-vmspawn|
@@ -233,8 +242,12 @@ for file in files(buildroot):
                        integritysetup|
                        integritytab|
                        remount-fs|
+                       tpm2|
                        /initrd|
+                       systemd-sysinstall|
                        systemd[.-]pcr|
+                       systemd-imdsd|
+                       systemd-loop|
                        /pcrlock\.d|
                        systemd-measure|
                        /boot$|
@@ -244,17 +257,15 @@ for file in files(buildroot):
                        binfmt|
                        sysctl|
                        coredump|
+                       homectl|
                        homed|home1|
-                       sysupdate|updatctl|
-                       oomd|
-                       portabled|portable1
-    ''', n, re.X):     # coredumpctl, homectl, portablectl are included in the main package because
-                       # they can be used to interact with remote daemons. Also, the user could be
-                       # confused if those user-facing binaries are not available.
+                       sysupdate|updatectl|
+                       oomd
+    ''', n, re.X):
         o = outputs['udev']
 
     elif re.search(r'''/boot/efi|
-                       /usr/lib/systemd/boot|
+                       /usr/lib/systemd/boot/efi|
                        sd-boot|systemd-boot\.|loader.conf
     ''', n, re.X):
         o = outputs['boot']
@@ -273,7 +284,8 @@ for file in files(buildroot):
         prefix = known_files[n].split()[:-1]
     elif file.is_dir(follow_symlinks=False):
         prefix = ['%dir']
-    elif 'README' in n:
+    # Allow .conf files to be linked as config. They must not be %doc.
+    elif ('README' in n or '/doc/' in n) and not n.endswith('.conf'):
         prefix = ['%doc']
     elif n.startswith('/etc'):
         prefix = ['%config(noreplace)']
@@ -290,9 +302,10 @@ for file in files(buildroot):
     for file in o:
         print(f'{prefix}{n}{suffix}', file=file)
 
-if [print(f'ERROR: no file names were written to {o.name}')
-    for name, o in outputs.items()
-    if (o.tell() == 0 and
-        not (no_bootloader and name == 'boot'))
-    ]:
+
+if [
+        print(f'ERROR: no file names were written to {o.name}')
+        for name, o in outputs.items()
+        if o.tell() == 0 and name not in potentially_empty_outputs
+]:
     sys.exit(1)

systemd.spec

@@ -7,11 +7,6 @@
 %global system_unit_dir %{pkgdir}/system
 %global user_unit_dir %{pkgdir}/user
 
-%if 0%{?__isa_bits} == 64
-%global elf_bits (64bit)
-%global elf_suffix ()%{elf_bits}
-%endif
-
 %bcond bzip2     1
 %bcond gnutls    1
 %bcond lz4       1
@@ -23,7 +18,16 @@
 # e.g. when re-building cryptsetup on a json-c SONAME-bump.
 %bcond bootstrap 0
 %bcond tests     1
-%bcond lto       1
+
+# When enabled, rely on filesystem(unmerged-sbin-symlinks) file triggers to
+# create /usr/sbin symlinks instead of shipping them in the package. This
+# avoids file conflicts when installing on merged-sbin systems and eliminates
+# bootstrap ordering issues with the bin/sbin merge.
+%bcond sbin_compat 1
+
+# riscv64 has LTO disabled globally
+%bcond lto       %["%_arch" != "riscv64"]
+
 # Build docs on 64-bit architectures only
 %bcond docs      %[%{?__isa_bits} >= 64]
 
@@ -66,6 +70,11 @@
 %define noarch_requires_version %{version}-%{release}
 %endif
 
+%if 0%{?__isa_bits} == 64
+%global elf_bits (64bit)
+%global elf_suffix ()%{elf_bits}
+%endif
+
 Name:           systemd
 Url:            https://systemd.io
 # Allow users to specify the version and release when building the rpm by
@@ -73,7 +82,7 @@ Url:            https://systemd.io
 # But don't do that on OBS, otherwise the version subst fails, and will be
 # like 257-123-gabcd257.1 instead of 257-123-gabcd
 %if %{without obs}
-Version:        %{?version_override}%{!?version_override:259.1}
+Version:        %{?version_override}%{!?version_override:261.2}
 %else
 Version:        %{?version_override}%{!?version_override:%(cat meson.version)}
 %endif
@@ -81,6 +90,9 @@ Release:        %autorelease
 
 %global stable %(c="%version"; [ "$c" = "${c#*.*}" ]; echo $?)
 
+# Temporary macro to enable systemd-report.standalone
+%bcond report_standalone %[ v"%{version}" >= v"261.999" || %{defined commit} ]
+
 # For a breakdown of the licensing, see README
 License:        LGPL-2.1-or-later AND MIT AND GPL-2.0-or-later
 Summary:        System and Service Manager
@@ -107,7 +119,6 @@ Source6:        inittab
 Source7:        sysctl.conf.README
 Source8:        systemd-journal-remote.xml
 Source9:        systemd-journal-gatewayd.xml
-Source10:       20-yama-ptrace.conf
 Source11:       systemd-udev-trigger-no-reload.conf
 # https://fedoraproject.org/wiki/How_to_filter_libabigail_reports
 Source13:       libabigail.abignore
@@ -117,7 +128,7 @@ Source15:       10-oomd-per-slice-defaults.conf
 Source16:       10-timeout-abort.conf
 Source17:       10-map-count.conf
 Source18:       60-block-scheduler.rules
-
+Source19:       99-kernel-hardening.conf
 Source20:       macros.sysusers.compat
 Source21:       macros.sysusers
 Source22:       sysusers.attr
@@ -142,17 +153,16 @@ Patch:          https://github.com/systemd/systemd/pull/26494.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2251843
 Patch:          30846.patch
 
-# Again create runlevelX.target. Dropping those files breaks upgrades.
-# https://bugzilla.redhat.com/show_bug.cgi?id=2411195
-Patch:          0001-Revert-units-drop-runlevel-0-6-.target.patch
-
 # userdb: create userdb root directory with correct label
 # We can drop this after SELinux policy is updated to handle the transition.
-Patch:          38769.patch
+Patch:          0001-core-create-userdb-root-directory-with-correct-label.patch
 
 # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2415701
 Patch:          0002-machined-continue-without-resolve.hook-socket.patch
 
+# We want to depend on and load openssl-4 in preference
+Patch:          https://github.com/systemd/systemd/pull/42668.patch
+Patch:          https://github.com/systemd/systemd/commit/7be9032019015ddd61985e6a6721d813d62dad0b.patch
 %endif
 
 %ifarch %{ix86} x86_64 aarch64 riscv64
@@ -177,6 +187,13 @@ BuildRequires:  cryptsetup-devel
 # We use the %%systemd_{post,preun,…} macros for various services.
 BuildRequires:  systemd-rpm-macros
 %endif
+
+%if !%{defined rhel} || 0%{?rhel} > 10
+# Use dlopen-notes to generate Requires/Recommends from embedded metadata.
+# Currently, package-notes are not available on Centos Stream 9 or 10.
+BuildRequires:  package-notes >= 0.20
+%endif
+
 BuildRequires:  dbus-devel
 BuildRequires:  util-linux
 # /usr/bin/getfacl is needed by test-acl-util
@@ -203,7 +220,7 @@ BuildRequires:  libcurl-devel
 BuildRequires:  kmod-devel
 BuildRequires:  elfutils-devel
 BuildRequires:  openssl-devel
-%if 0%{?fedora} >= 41
+%if 0%{?fedora} >= 41 && 0%{?fedora} < 45
 BuildRequires:  openssl-devel-engine
 %endif
 %if %{with gnutls}
@@ -230,7 +247,6 @@ BuildRequires:  docbook-style-xsl
 BuildRequires:  pkgconfig
 BuildRequires:  gperf
 BuildRequires:  gawk
-BuildRequires:  tree
 BuildRequires:  hostname
 BuildRequires:  python3
 BuildRequires:  python3-devel
@@ -288,9 +304,15 @@ Requires:       systemd-libs%{_isa} = %{version}-%{release}
 %{?fedora:Recommends:     systemd-resolved = %{version}-%{release}}
 Requires:       systemd-shared%{_isa} = %{version}-%{release}
 Requires:       /usr/bin/systemd-sysusers
+
 # The standalone version doesn't Provide the _isa suffix,
 # so this biases towards the common version.
 Recommends:     systemd-sysusers%{_isa} = %{version}-%{release}
+
+%if %{defined rhel} && 0%{?rhel} <= 10
+Requires:       libzstd.so.1%{?elf_suffix}
+%endif
+
 Recommends:     diffutils
 Requires:       (util-linux-core or util-linux)
 Requires:       (libbpf >= 2:1.4.7 if libbpf)
@@ -307,7 +329,7 @@ Conflicts:      initscripts < 9.56.1
 %if 0%{?fedora}
 Conflicts:      fedora-release < 23-0.12
 %endif
-%if 0%{?fedora} >= 41
+%if 0%{?fedora} >= 41 || 0%{?rhel} >= 11
 BuildRequires:  setup >= 2.15.0-3
 BuildRequires:  python3
 Conflicts:      setup < 2.15.0-3
@@ -323,12 +345,16 @@ Conflicts:      dracut < 060-2
 Conflicts:      dracut < 059-16
 %endif
 
+%if %{with report_standalone}
+Conflicts:      systemd-standalone-report
+Provides:       systemd-report = %{version}-%{release}
+%endif
 Conflicts:      systemd-standalone-tmpfiles
 Provides:       systemd-tmpfiles = %{version}-%{release}
 Conflicts:      systemd-standalone-shutdown
 Provides:       systemd-shutdown = %{version}-%{release}
 
-%if "%{_sbindir}" == "%{_bindir}"
+%if %{with sbin_compat} || "%{_sbindir}" == "%{_bindir}"
 # Compat symlinks for Requires in other packages.
 # We rely on filesystem to create the symlinks for us.
 Requires:       filesystem(unmerged-sbin-symlinks)
@@ -339,45 +365,42 @@ Provides:       /usr/sbin/reboot
 Provides:       /usr/sbin/shutdown
 %endif
 
+%if %{defined rhel} && 0%{?rhel} <= 10
 # libmount is always required, even in containers, so make it a hard dependency.
 Requires:       libmount.so.1%{?elf_suffix}
 Requires:       libmount.so.1(MOUNT_2.26)%{?elf_bits}
 # Various systemd services have syscall filters so make libseccomp a hard dependency.
 Requires:       libseccomp.so.2%{?elf_suffix}
-
-# Recommends to replace normal Requires deps for stuff that is dlopen()ed
-Recommends:     libxkbcommon.so.0%{?elf_suffix}
-Recommends:     libidn2.so.0%{?elf_suffix}
-Recommends:     libidn2.so.0(IDN2_0.0.0)%{?elf_bits}
-Recommends:     libpcre2-8.so.0%{?elf_suffix}
-Recommends:     libpwquality.so.1%{?elf_suffix}
-Recommends:     libpwquality.so.1(LIBPWQUALITY_1.0)%{?elf_bits}
-%if 0%{?fedora}
-Recommends:     libqrencode.so.4%{?elf_suffix}
+Requires:       libacl.so.1%{?elf_suffix}
 %endif
-Recommends:     libbpf.so.1%{?elf_suffix}
-Recommends:     libbpf.so.1(LIBBPF_0.4.0)%{?elf_bits}
 
-# used by systemd-coredump and systemd-analyze
-Recommends:     libdw.so.1%{?elf_suffix}
-Recommends:     libdw.so.1(ELFUTILS_0.186)%{?elf_bits}
-Recommends:     libelf.so.1%{?elf_suffix}
-Recommends:     libelf.so.1(ELFUTILS_1.7)%{?elf_bits}
+%define dlopen_notes_features %{expand:
+  # Various systemd services have syscall filters so make libseccomp a hard dependency.
+  systemd:seccomp:required
 
-# used by dissect, integritysetup, veritysetyp, growfs, repart, cryptenroll, home
-Recommends:     libcryptsetup.so.12%{?elf_suffix}
-Recommends:     libcryptsetup.so.12(CRYPTSETUP_2.4)%{?elf_bits}
+  # zstd is used for compression in the journal
+  systemd:zstd:required
 
-# Libkmod is used to load modules.
-Recommends:     libkmod.so.2%{?elf_suffix}
-# kmod_list_next, kmod_load_resources, kmod_module_get_initstate,
-# kmod_module_get_module, kmod_module_get_name, kmod_module_new_from_lookup,
-# kmod_module_probe_insert_module, kmod_module_unref, kmod_module_unref_list,
-# kmod_new, kmod_set_log_fn, kmod_unref, kmod_validate_resources
-# are part of LIBKMOD_5.
-Recommends:     libkmod.so.2(LIBKMOD_5)%{?elf_bits}
+  # Libkmod is used to load modules. Assume that if we need udevd, we certainly
+  # want to load modules, so make this into a hard dependency here.
+  systemd-udev:kmod:required
 
-Recommends:     libarchive.so.13%{?elf_suffix}
+  # We want to always use idn with resolved.
+  systemd-resolved:idn:required
+
+  # libcurl is required by systemd-imdsd and systemd-report.
+  # Downgrade the dep for now.
+  systemd:curl:recommended
+  systemd-udev:curl:recommended
+
+  # libssl + libcrypto are required by systemd-resolved/resolvectl.
+  # Downgrade the dep in the main package.
+  systemd:libssl:recommended
+  systemd:libcrypto:recommended
+
+  # Disable qrencode on non-fedora builds
+  %{!?fedora:*:qrencode:ignored}
+}
 
 %description
 systemd is a system and service manager that runs as PID 1 and starts the rest
@@ -467,6 +490,18 @@ Requires(preun):  systemd%{_isa} = %{version}-%{release}
 Requires(postun): systemd%{_isa} = %{version}-%{release}
 Requires(post): grep
 Requires:       kmod >= 18-4
+
+%if %{defined rhel} && 0%{?rhel} <= 10
+# Libkmod is used to load modules. Assume that if we need udevd, we certainly
+# want to load modules, so make this into a hard dependency here.
+Requires:       libkmod.so.2%{?elf_suffix}
+Requires:       libkmod.so.2(LIBKMOD_5)%{?elf_bits}
+# udev uses libblkid in various builtins so make it a hard dependency.
+Requires:       libblkid.so.1%{?elf_suffix}
+Requires:       libblkid.so.1(BLKID_2.30)%{?elf_bits}
+Requires:       libfdisk.so.1%{?elf_suffix}
+%endif
+
 Provides:       udev = %{version}
 Provides:       udev%{_isa} = %{version}
 %if 0%{?fedora} || 0%{?rhel} >= 10
@@ -484,6 +519,7 @@ Provides:       systemd-timesyncd = %{version}-%{release}
 %endif
 Conflicts:      systemd-networkd < %{version}-%{release}
 
+%if %{defined rhel} && 0%{?rhel} <= 10
 # Libkmod is used to load modules. Assume that if we need udevd, we certainly
 # want to load modules, so make this into a hard dependency here.
 Requires:       libkmod.so.2%{?elf_suffix}
@@ -491,29 +527,13 @@ Requires:       libkmod.so.2(LIBKMOD_5)%{?elf_bits}
 # udev uses libblkid in various builtins so make it a hard dependency.
 Requires:       libblkid.so.1%{?elf_suffix}
 Requires:       libblkid.so.1(BLKID_2.30)%{?elf_bits}
-
-# Recommends to replace normal Requires deps for stuff that is dlopen()ed
-# used by dissect, integritysetup, veritysetyp, growfs, repart, cryptenroll, home
-Recommends:     libcryptsetup.so.12%{?elf_suffix}
-Recommends:     libcryptsetup.so.12(CRYPTSETUP_2.4)%{?elf_bits}
-
-# used by systemd-coredump and systemd-analyze
-Recommends:     libdw.so.1%{?elf_suffix}
-Recommends:     libdw.so.1(ELFUTILS_0.186)%{?elf_bits}
-Recommends:     libelf.so.1%{?elf_suffix}
-Recommends:     libelf.so.1(ELFUTILS_1.7)%{?elf_bits}
-
-# used by home, cryptsetup, cryptenroll, logind
-Recommends:     libfido2.so.1%{?elf_suffix}
-Recommends:     libp11-kit.so.0%{?elf_suffix}
-Recommends:     libtss2-esys.so.0%{?elf_suffix}
-Recommends:     libtss2-mu.so.0%{?elf_suffix}
-Recommends:     libtss2-rc.so.0%{?elf_suffix}
+%endif
 
 # https://bugzilla.redhat.com/show_bug.cgi?id=1377733#c9
 Suggests:       systemd-bootchart
-# https://bugzilla.redhat.com/show_bug.cgi?id=1408878
-Requires:       kbd
+
+# v261 handles missing setfont/loadkeys gracefully
+Recommends:     kbd
 
 # https://bugzilla.redhat.com/show_bug.cgi?id=1753381
 Provides:       u2f-hidraw-policy = 1.0.2-40
@@ -526,7 +546,7 @@ Provides:       systemd-repart = %{version}-%{release}
 Conflicts:      xorg-x11-drv-evdev < 2.11.0
 Conflicts:      xorg-x11-drv-libinput < 1.5.0
 
-%if "%{_sbindir}" == "%{_bindir}"
+%if %{with sbin_compat} || "%{_sbindir}" == "%{_bindir}"
 # Compat symlinks for Requires in other packages.
 # We rely on filesystem to create the symlinks for us.
 Requires:       filesystem(unmerged-sbin-symlinks)
@@ -626,6 +646,7 @@ Recommends:     qemu-kvm-core
 Recommends:     qemu-device-display-virtio-gpu
 Recommends:     qemu-device-display-virtio-vga
 %endif
+
 # Bias the system towards libcurl-minimal if nothing pulls in full libcurl (#1997040)
 Suggests:       libcurl-minimal
 License:        LGPL-2.1-or-later
@@ -644,6 +665,10 @@ License:        LGPL-2.1-or-later
 Requires:       firewalld-filesystem
 Provides:       systemd-journal-gateway = %{version}-%{release}
 Provides:       systemd-journal-gateway%{_isa} = %{version}-%{release}
+%if %{defined rhel} && 0%{?rhel} <= 10
+Requires:       libmicrohttpd.so.12%{?elf_suffix}
+Requires:       libcurl.so.4%{?elf_suffix}
+%endif
 # Bias the system towards libcurl-minimal if nothing pulls in full libcurl (#1997040)
 Suggests:       libcurl-minimal
 
@@ -680,8 +705,10 @@ enabled for this to have any effect.
 %package resolved
 Summary:        Network Name Resolution manager
 Requires:       systemd%{_isa} = %{version}-%{release}
+%if %{defined rhel} && 0%{?rhel} <= 10
 Requires:       libidn2.so.0%{?elf_suffix}
 Requires:       libidn2.so.0(IDN2_0.0.0)%{?elf_bits}
+%endif
 Requires(posttrans): grep
 
 %description resolved
@@ -723,7 +750,21 @@ RemovePathPostfixes: .standalone
 %description standalone-repart
 Standalone systemd-repart binary with no dependencies on the systemd-shared
 library or other libraries from systemd-libs. This package conflicts with the
-main systemd package and is meant for use on systems without systemd.
+systemd-udev package and is meant for use on systems without systemd-udev.
+
+%if %{with report_standalone}
+%package standalone-report
+Summary:       Standalone systemd-report binaries for use on systems without systemd
+Provides:      systemd-report = %{version}-%{release}
+Conflicts:     systemd
+RemovePathPostfixes: .standalone
+
+%description standalone-report
+Standalone systemd-report, systemd-report-basic, systemd-report-sign-plain, …
+binaries with no dependencies on the systemd-shared library or other libraries
+from systemd-libs. This package conflicts with the main systemd package and
+is meant for use on systems without systemd or with older version of it.
+%endif
 
 %package standalone-tmpfiles
 Summary:       Standalone systemd-tmpfiles binary for use on systems without systemd
@@ -760,7 +801,30 @@ Standalone systemd-shutdown binary with no dependencies on the systemd-shared
 library or other libraries from systemd-libs. This package conflicts with the
 main systemd package and is meant for use in exitrds.
 
+%define status %{shrink:
+       '**'
+       bzip2=%{?with_bzip2}%{!?with_bzip2:0}
+       gnutls=%{?with_gnutls}%{!?with_gnutls:0}
+       lz4=%{?with_lz4}%{!?with_lz4:0}
+       xz=%{?with_xz}%{!?with_xz:0}
+       zlib=%{?with_zlib}%{!?with_zlib:0}
+       zstd=%{?with_zstd}%{!?with_zstd:0}
+       bootstrap=%{?with_bootstrap}%{!?with_bootstrap:0}
+       tests=%{?with_tests}%{!?with_tests:0}
+       lto=%{?with_lto}%{!?with_lto:0}
+       docs=%{?with_docs}%{!?with_docs:0}
+       upstream=%{?with_upstream}%{!?with_upstream:0}
+       obs=%{?with_obs}%{!?with_obs:0}
+       report_standalone=%{?with_report_standalone}%{!?with_report_standalone:0}
+       fedora=%{?fedora}
+       rhel=%{?rhel}
+       _arch=%{_arch}
+       '**'}
+
 %prep
+# Print varius with's and without's to make it easier to figure out what is going on
+echo %{status}
+
 %if %{with obs}
 # Recipe files in the OBS build are in a distro-specific dir, as they conflict (e.g. with SUSE ones)
 mv %{_sourcedir}/%{name}.fedora/* %{_sourcedir}
@@ -777,7 +841,13 @@ mv %{_sourcedir}/%{name}.fedora/* %{_sourcedir}
 sed -r -i 's/^u!/u/' sysusers.d/*.conf*
 
 %build
+echo %{status}
+
+%if 0%{?eln}
+%global ntpvendor fedora
+%else
 %global ntpvendor %(source /etc/os-release; echo ${ID})
+%endif
 %{!?ntpvendor: echo 'NTP vendor zone is not set!'; exit 1}
 
 VMLINUX_H_PATH=''
@@ -805,8 +875,6 @@ VMLINUX_H_PATH=$(%python3 -c '%find_vmlinux_h')
 CONFIGURE_OPTS=(
         -Dmode=release
         -Dslow-tests=true
-        -Dsysvinit-path=/etc/rc.d/init.d
-        -Drc-local=/etc/rc.d/rc.local
         -Dntp-servers='0.%{ntpvendor}.pool.ntp.org 1.%{ntpvendor}.pool.ntp.org 2.%{ntpvendor}.pool.ntp.org 3.%{ntpvendor}.pool.ntp.org'
         -Ddns-servers=
         -Dservice-watchdog=
@@ -837,7 +905,6 @@ CONFIGURE_OPTS=(
         -Daudit=enabled
         -Delfutils=enabled
         -Dlibcryptsetup=%[%{with bootstrap}?"disabled":"enabled"]
-        -Delfutils=enabled
         -Drepart=enabled
         -Dpwquality=enabled
         -Dqrencode=%[%{defined rhel}?"disabled":"enabled"]
@@ -845,7 +912,6 @@ CONFIGURE_OPTS=(
         -Dmicrohttpd=enabled
         -Dvmspawn=enabled
         -Dlibidn2=enabled
-        -Dlibiptc=disabled
         -Dlibcurl=enabled
         -Dlibfido2=enabled
         -Dxenctrl=%[0%{?have_xen}?"enabled":"disabled"]
@@ -965,7 +1031,7 @@ sed -r 's|/system/|/user/|g' %{SOURCE16} >10-timeout-abort.conf.user
 %meson_install
 
 # udev links
-%if "%{_sbindir}" != "%{_bindir}"
+%if !%{with sbin_compat} && "%{_sbindir}" != "%{_bindir}"
 mkdir -p %{buildroot}/%{_sbindir}
 ln -sf ../bin/udevadm %{buildroot}%{_sbindir}/udevadm
 %endif
@@ -1065,9 +1131,8 @@ EOF
 
 install -Dm0644 -t %{buildroot}/usr/lib/firewalld/services/ %{SOURCE8} %{SOURCE9}
 
-# Install additional docs
-# https://bugzilla.redhat.com/show_bug.cgi?id=1234951
-install -Dm0644 -t %{buildroot}%{_pkgdocdir}/ %{SOURCE10}
+# Install kernel hardening file. Disabled by default.
+install -Dm0644 -t %{buildroot}%{_pkgdocdir}/ %{SOURCE19}
 
 # https://bugzilla.redhat.com/show_bug.cgi?id=1378974
 install -Dm0644 -t %{buildroot}%{system_unit_dir}/systemd-udev-trigger.service.d/ %{SOURCE11}
@@ -1095,7 +1160,7 @@ install -Dm0644 -t %{buildroot}%{_prefix}/lib/udev/rules.d/ %{SOURCE18}
 
 sed -i 's|#!/usr/bin/env python3|#!%{__python3}|' %{buildroot}/usr/lib/systemd/tests/run-unit-tests.py
 
-%if 0%{?fedora} >= 42
+%if 0%{?fedora} >= 42 || 0%{?rhel} >= 11
 install -m 0644 -D %{SOURCE21} %{buildroot}%{_rpmconfigdir}/macros.d/macros.sysusers
 %else
 install -m 0644 -D %{SOURCE20} %{buildroot}%{_rpmconfigdir}/macros.d/macros.sysusers
@@ -1114,20 +1179,20 @@ install -Dm0644 -t %{buildroot}%{_prefix}/lib/systemd/network/ %{SOURCE25}
 ln -s --relative %{buildroot}%{_bindir}/kernel-install %{buildroot}%{_sbindir}/installkernel
 %endif
 
-%if "%{_sbindir}" == "%{_bindir}"
+%if %{with sbin_compat} || "%{_sbindir}" == "%{_bindir}"
 # Systemd has the split-sbin option which is also used to select the directory
 # for alias symlinks. We need to keep split-sbin=true for now, to support
 # unmerged systems. Move the symlinks here instead.
 mv -v %{buildroot}/usr/sbin/* %{buildroot}%{_bindir}/
 %endif
 
-%if 0%{?fedora} >= 41
+%if 0%{?fedora} >= 41 || 0%{?rhel} >= 11
 %if %{without upstream}
 # This requires https://pagure.io/setup/pull-request/50
 # and https://src.fedoraproject.org/rpms/setup/pull-request/10.
 # We skip this on upstream builds so that new users and groups
 # can be added without breaking the build.
-%if 0%{?fedora} >= 43
+%if 0%{?fedora} >= 43 || 0%{?rhel} >= 11
 IGNORED=empower \
   %{python3} %{SOURCE4} /usr/lib/sysusers.d/setup.conf %{buildroot}/usr/lib/sysusers.d/basic.conf
 %else
@@ -1188,6 +1253,10 @@ fi \
 %post
 systemd-machine-id-setup &>/dev/null || :
 
+# This is for upgrades from previous versions before getty@.service needed to be enabled
+[ $1 -gt 1 ] && systemctl is-enabled getty@tty1.service &>/dev/null && \
+    touch %{_localstatedir}/lib/rpm-state/systemd-getty-was-active || :
+
 [ $1 -eq 1 ] || exit 0
 
 # create /var/log/journal only on initial installation,
@@ -1215,6 +1284,8 @@ if [ $1 -ge 2 ]; then
   systemctl daemon-reexec || :
 
   systemd-tmpfiles --create &>/dev/null || :
+
+  rm -f %{_localstatedir}/lib/rpm-state/systemd-getty-was-active || :
 fi
 
 %systemd_posttrans_with_restart systemd-timedated.service systemd-hostnamed.service systemd-journald.service systemd-localed.service systemd-userdbd.service
@@ -1232,16 +1303,15 @@ fi
 # This is for upgrades from previous versions before systemd restart was moved to %%postun
 systemctl daemon-reexec || :
 
-%triggerpostun -- systemd < 253~rc1-2
-# This is for upgrades from previous versions where systemd-journald-audit.socket
-# had a static enablement symlink.
-# We use %%triggerpostun here because rpm doesn't allow a second %%triggerun with
-# a different package version.
-systemctl --no-reload preset systemd-journald-audit.socket &>/dev/null || :
+%triggerpostun -- systemd < 260~rc1
+if [ -f %{_localstatedir}/lib/rpm-state/systemd-getty-was-active ]; then
+    systemctl --no-reload enable getty@.service || :
+fi
 
 %global udev_services %{shrink:
                         cryptsetup-pre.target
                         cryptsetup.target
+                        getty@.service
                         hibernate.target
                         hybrid-sleep.target
                         initrd-cleanup.service
@@ -1304,6 +1374,7 @@ systemctl --no-reload preset systemd-journald-audit.socket &>/dev/null || :
                         systemd-pcrlock.socket
                         systemd-pcrlock@.service
                         systemd-pcrmachine.service
+                        systemd-pcrosseparator.service
                         systemd-pcrphase-initrd.service
                         systemd-pcrphase-sysinit.service
                         systemd-pcrphase.service
@@ -1320,7 +1391,7 @@ systemctl --no-reload preset systemd-journald-audit.socket &>/dev/null || :
                         systemd-suspend.service
                         systemd-sysctl.service
                         systemd-timesyncd.service
-                        systemd-tmpfiles-clear.service
+                        systemd-tmpfiles-clean.service
                         systemd-tmpfiles-setup-dev-early.service
                         systemd-tmpfiles-setup-dev.service
                         systemd-udev-load-credentials.service
@@ -1342,18 +1413,6 @@ systemctl --no-reload preset systemd-journald-audit.socket &>/dev/null || :
                        }
 
 %post udev
-# Move old stuff around in /var/lib
-mv %{_localstatedir}/lib/random-seed %{_localstatedir}/lib/systemd/random-seed &>/dev/null
-mv %{_localstatedir}/lib/backlight %{_localstatedir}/lib/systemd/backlight &>/dev/null
-if [ -L %{_localstatedir}/lib/systemd/timesync ]; then
-    rm %{_localstatedir}/lib/systemd/timesync
-    mv %{_localstatedir}/lib/private/systemd/timesync %{_localstatedir}/lib/systemd/timesync
-fi
-if [ -f %{_localstatedir}/lib/systemd/clock ]; then
-    mkdir -p %{_localstatedir}/lib/systemd/timesync
-    mv %{_localstatedir}/lib/systemd/clock %{_localstatedir}/lib/systemd/timesync/.
-fi
-
 systemd-hwdb update &>/dev/null
 
 %systemd_post %udev_services
@@ -1362,11 +1421,6 @@ systemd-hwdb update &>/dev/null
 /usr/lib/systemd/systemd-random-seed save 2>&1 | \
     grep -v 'Failed to open /dev/urandom' || :
 
-# Replace obsolete keymaps
-# https://bugzilla.redhat.com/show_bug.cgi?id=1151958
-grep -q -E '^KEYMAP="?fi-latin[19]"?' /etc/vconsole.conf 2>/dev/null &&
-    sed -i.rpm.bak -r 's/^KEYMAP="?fi-latin[19]"?/KEYMAP="fi"/' /etc/vconsole.conf || :
-
 %preun udev
 %systemd_preun %udev_services
 
@@ -1405,20 +1459,7 @@ fi
                            }
 
 %post networkd
-# systemd-networkd was split out in systemd-246.6-2.
-# Ideally, we would have a trigger scriptlet to record enablement
-# state when upgrading from systemd <= systemd-246.6-1. But, AFAICS,
-# rpm doesn't allow us to trigger on another package, short of
-# querying the rpm database ourselves, which seems risky. For rpm,
-# systemd and systemd-networkd are completely unrelated.  So let's use
-# a hack to detect if an old systemd version is currently present in
-# the file system.
-# https://bugzilla.redhat.com/show_bug.cgi?id=1943263
-if [ $1 -eq 1 ] && ls /usr/lib/systemd/libsystemd-shared-24[0-6].so &>/dev/null; then
-    echo "Skipping presets for systemd-networkd.service, seems we are upgrading from old systemd."
-else
-    %systemd_post %networkd_services
-fi
+%systemd_post %networkd_services
 
 %preun networkd
 %systemd_preun %networkd_services
@@ -1491,10 +1532,10 @@ fi
 %global _docdir_fmt %{name}
 
 %files -f %{name}.lang -f .file-list-main
-%doc %{_pkgdocdir}
 %exclude %{_pkgdocdir}/LICENSE*
 # Only the licenses texts for the licenses in License line are included.
 %license LICENSE.GPL2
+%license LICENSE.LGPL2.1
 %license LICENSES/MIT.txt
 %ghost %dir %attr(0755,-,-) /etc/systemd/system/basic.target.wants
 %ghost %dir %attr(0755,-,-) /etc/systemd/system/bluetooth.target.wants
@@ -1557,6 +1598,10 @@ fi
 
 %files standalone-repart -f .file-list-standalone-repart
 
+%if %{with report_standalone}
+%files standalone-report -f .file-list-standalone-report
+%endif
+
 %files standalone-tmpfiles -f .file-list-standalone-tmpfiles
 
 %files standalone-sysusers -f .file-list-standalone-sysusers