Add sepolicy for the new features Patch upstream systemd service instead of duplicating it here Use more strict appstream-util validate, since relaxed missed important issues