Accepting request 1305565 from Base:System

- Move systemd-pcrlock out from the experimental sub-package to udev (bsc#1248261)

- systemd.spec: use %sysusers_generate_pre so that some systemd users are
  already available in %pre. This is important because D-Bus automatically
  reloads its configuration whenever new configuration files are installed,
  i.e. between %pre and %post. (bsc#1248501)
  
  No needs for systemd and udev packages as they are always installed during
  the initial installation.

- Sign aarch64 and riscv systemd-boot EFI binaries (bsc#1247474)

OBS-URL: https://build.opensuse.org/request/show/1305565
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/systemd?expand=0&rev=457

0009-pid1-handle-console-specificities-weirdness-for-s390.patch

@@ -1,4 +1,4 @@
-From b090866bc0e9192224acaeeec875ef4c8846b829 Mon Sep 17 00:00:00 2001
+From 09184a555aec3ef612425ba6fe596cf05383ca09 Mon Sep 17 00:00:00 2001
 From: Franck Bui <fbui@suse.com>
 Date: Fri, 10 Jun 2016 15:19:57 +0200
 Subject: [PATCH 1/1] pid1: handle console specificities/weirdness for s390
@@ -14,26 +14,29 @@ imported from upsteam made them uneeded.
 The remaining bits are probably hackish but at least they are now
 minimal.
 
-It was an attempt to address bnc#860937. And yes turning the console
-color mode off by passing $TERM=dumb via the kernel command line would
-have been much more easier and enough.
-
-This is actually implemented by recent systemd. There's also another
-command line option: systemd.log_color=off.
+It was an attempt to address bnc#860937 to automatically turn the console color
+mode off by passing $TERM=dumb when the specified terminal device is other than
+"3270". For more details, see
+https://www.ibm.com/docs/en/linux-on-systems?topic=setup-kernel-parameters.
 
 See also a short discussion which happened on @systemd-maintainers
 whose $subject is "[PATCH] support conmode setting on command line".
 
 [fbui: fixes bsc#860937]
+
+Don't warn if "conmode=" is missing as this option should not be passed on
+s390x KVM.
+
+[fbui: fixes bsc#1236725]
 ---
- src/basic/terminal-util.c | 15 ++++++++++++++-
- 1 file changed, 14 insertions(+), 1 deletion(-)
+ src/basic/terminal-util.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
 
 diff --git a/src/basic/terminal-util.c b/src/basic/terminal-util.c
-index 878c1ec06a..355ecdc45f 100644
+index 409f2abb45..630fc81836 100644
 --- a/src/basic/terminal-util.c
 +++ b/src/basic/terminal-util.c
-@@ -923,7 +923,20 @@ bool tty_is_vc_resolve(const char *tty) {
+@@ -912,7 +912,19 @@ bool tty_is_vc_resolve(const char *tty) {
  }
  
  const char* default_term_for_tty(const char *tty) {
@@ -45,9 +48,8 @@ index 878c1ec06a..355ecdc45f 100644
 +        if (tty && tty_is_console(tty)) {
 +                _cleanup_free_ char *mode = NULL;
 +
-+                /* Simply return "dumb" in case of OOM. */
++                /* Returns "dumb" in case of OOM. */
 +                (void) proc_cmdline_get_key("conmode", 0, &mode);
-+                (void) proc_cmdline_value_missing("conmode", mode);
 +                return streq_ptr(mode, "3270") ? "ibm327x" : "dumb";
 +        }
 +#endif

5001-Revert-udev-update-devlink-with-the-newer-device-nod.patch

@@ -1,8 +1,8 @@
-From f847d3d3b73c22c674bb713f179522cef8ddabb7 Mon Sep 17 00:00:00 2001
+From 6b03bc81cccec72f6e6ee31e8b08816713c42dac Mon Sep 17 00:00:00 2001
 From: Franck Bui <fbui@suse.com>
 Date: Fri, 12 Jan 2024 10:54:57 +0100
-Subject: [PATCH 5001/5002] Revert "udev: update devlink with the newer device
- node even when priority is equivalent"
+Subject: [PATCH] Revert "udev: update devlink with the newer device node
+ even when priority is equivalent"
 
 This reverts commit 277cb24ffb7a520f640eb36d11340f11bf0c7c4f.
 ---
@@ -10,27 +10,27 @@ This reverts commit 277cb24ffb7a520f640eb36d11340f11bf0c7c4f.
  1 file changed, 5 insertions(+), 5 deletions(-)
 
 diff --git a/src/udev/udev-node.c b/src/udev/udev-node.c
-index 673f723ff2..6e2fff72e9 100644
+index 412775b38b..94149d7115 100644
 --- a/src/udev/udev-node.c
 +++ b/src/udev/udev-node.c
-@@ -457,13 +457,13 @@ static int link_update(sd_device *dev, const char *slink, bool add) {
-                                 /* The devlink priority is downgraded. Another device may have a higher
-                                  * priority now. Let's find the device node with the highest priority. */
-                         } else {
--                                if (current_prio > prio)
--                                        /* The devlink with a higher priority already exists and is owned by
--                                         * another device. Hence, it is not necessary to recreate it. */
-+                                if (current_prio >= prio)
-+                                        /* The devlink with equal or higher priority already exists and is
-+                                         * owned by another device. Hence, it is not necessary to recreate it. */
-                                         return 0;
+@@ -538,13 +538,13 @@ static int link_update(sd_device *dev, const char *slink, bool add) {
+                 return link_search_and_update(dev, slink, dirfd, add);
+         }
  
--                                /* This device has the equal or a higher priority than the current. Let's
--                                 * create the devlink to our device node. */
-+                                /* This device has a higher priority than the current. Let's create the
-+                                 * devlink to our device node. */
-                                 return node_create_symlink(dev, /* devnode = */ NULL, slink);
-                         }
+-        if (current_prio > prio)
+-                /* The devlink with a higher priority already exists and is owned by another device. Hence,
+-                 * it is not necessary to recreate it. */
++        if (current_prio >= prio)
++                /* The devlink with equal or higher priority already exists and is owned by another
++                 * device. Hence, it is not necessary to recreate it. */
+                 return 0;
+ 
+-        /* This device has the equal or a higher priority than the current. Let's create the devlink to our
+-         * device node. */
++        /* This device has a higher priority than the current. Let's create the devlink to our device
++         * node. */
+         return node_create_symlink(dev, /* devnode = */ NULL, slink);
+ }
  
 -- 
 2.43.0

5004-disable-session-freeze.patch

@@ -1,73 +0,0 @@
-From 88d0e79a7e4de9df6460ed4af694f15caedc3014 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Michal=20Koutn=C3=BD?= <mkoutny@suse.com>
-Date: Wed, 24 Jul 2024 14:20:17 +0200
-Subject: Disable session freeze
-
-Freezing of user.slice is not reliable and it breaks regular suspend/resume
-operations for users [1].
-Disable the partial (user.slice) freezing (rely on kernel freezing of every
-task upon suspend) since the benefit of user.slice freezing does not outweight
-the breakage caused by cgroup freezing implementation.
-
-[1] https://github.com/systemd/systemd/issues/33083
-
-[fbui: rebased on top of v257]
----
- src/home/homework.c | 7 ++++---
- src/sleep/sleep.c   | 8 +++++---
- 2 files changed, 9 insertions(+), 6 deletions(-)
-
-diff --git a/src/home/homework.c b/src/home/homework.c
-index 00e74894b3..d1de98e7b6 100644
---- a/src/home/homework.c
-+++ b/src/home/homework.c
-@@ -1880,7 +1880,7 @@ static int user_session_freezer_new(uid_t uid, UnitFreezer **ret) {
-         r = getenv_bool("SYSTEMD_HOME_LOCK_FREEZE_SESSION");
-         if (r < 0 && r != -ENXIO)
-                 log_warning_errno(r, "Cannot parse value of $SYSTEMD_HOME_LOCK_FREEZE_SESSION, ignoring: %m");
--        else if (r == 0) {
-+        else if (r == 0 || r == -ENXIO) { /* Do not freeze by default unless requested */
-                 *ret = NULL;
-                 return 0;
-         }
-@@ -1922,8 +1922,9 @@ static int home_lock(UserRecord *h) {
-                 if (r < 0)
-                         return r;
-         } else
--                log_notice("Session remains unfrozen on explicit request ($SYSTEMD_HOME_LOCK_FREEZE_SESSION=0).\n"
--                           "This is not recommended, and might result in unexpected behavior including data loss!");
-+                log_notice("Session remains unfrozen (add $SYSTEMD_HOME_LOCK_FREEZE_SESSION=1 to override).\n"
-+                           "This is a temporary downstream workaround for https://github.com/systemd/systemd/issues/33083.\n"
-+                           "Home locking is thus experimental and might result in unexpected behavior including data loss!");
- 
-         r = home_lock_luks(h, &setup);
-         if (r < 0) {
-diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 181bb4ccef..0181bcabc9 100644
---- a/src/sleep/sleep.c
-+++ b/src/sleep/sleep.c
-@@ -612,6 +612,8 @@ static int run(int argc, char *argv[]) {
-         r = getenv_bool("SYSTEMD_SLEEP_FREEZE_USER_SESSIONS");
-         if (r < 0 && r != -ENXIO)
-                 log_warning_errno(r, "Cannot parse value of $SYSTEMD_SLEEP_FREEZE_USER_SESSIONS, ignoring: %m");
-+        if (r == -ENXIO)
-+                r = 0; /* Do not freeze by default unless requested */
-         if (r != 0) {
-                 r = unit_freezer_new(SPECIAL_USER_SLICE, &user_slice_freezer);
-                 if (r < 0)
-@@ -619,9 +621,9 @@ static int run(int argc, char *argv[]) {
- 
-                 (void) unit_freezer_freeze(user_slice_freezer);
-         } else
--                log_notice("User sessions remain unfrozen on explicit request ($SYSTEMD_SLEEP_FREEZE_USER_SESSIONS=0).\n"
--                           "This is not recommended, and might result in unexpected behavior, particularly\n"
--                           "in suspend-then-hibernate operations or setups with encrypted home directories.");
-+                log_notice("User sessions remain unfrozen (add $SYSTEMD_SLEEP_FREEZE_USER_SESSIONS=1 to override),\n"
-+                           "relying on kernel to perform the freeze.\n"
-+                           "This is a temporary downstream workaround for https://github.com/systemd/systemd/issues/33083.");
- 
-         switch (arg_operation) {
- 
--- 
-2.43.0
-

_service

@@ -1,16 +1,15 @@
-<!-- See https://en.opensuse.org/openSUSE:Build_Service_Concept_SourceService -->
-<!-- for more details on the syntax -->
+<!-- for more details on the syntax, see: -->
+<!--    https://en.opensuse.org/openSUSE:Build_Service_Concept_SourceService -->
+<!--    https://github.com/openSUSE/obs-service-tar_scm/blob/master/tar_scm.service.in -->
+<!--    https://github.com/openSUSE/obs-service-tar_scm?tab=readme-ov-file#services -->
 
 <services>
-	<service name="tar_scm" mode="disabled">
-		<param name="scm">git</param>
-		<param name="url">https://github.com/openSUSE/systemd.git</param>
-		<param name="filename">systemd</param>
-		<param name="versionformat">@PARENT_TAG@+suse.@TAG_OFFSET@.g%h</param>
-		<param name="revision">openSUSE-Factory</param>
-	</service>
-	<service name="recompress" mode="disabled">
-		 <param name="file">*systemd-v243+suse.*.tar</param>
-		 <param name="compression">xz</param>
-	</service>
+  <service name="obs_scm" mode="disabled">
+    <param name="scm">git</param>
+    <param name="url">https://github.com/openSUSE/systemd.git</param>
+    <param name="filename">systemd</param>
+    <param name="versionformat">@PARENT_TAG@+suse.@TAG_OFFSET@.g%h</param>
+    <param name="revision">openSUSE-Factory</param>
+  </service>
+  <service name="tar" mode="disabled"/>
 </services>

files.container

@@ -6,6 +6,9 @@
 %if %{without bootstrap}
 %{_datadir}/bash-completion/completions/systemd-nspawn
 %{_datadir}/polkit-1/actions/io.systemd.mount-file-system.policy
+%if %{with upstream}
+%{_datadir}/polkit-1/actions/io.systemd.namespace-resource.policy
+%endif
 %{_datadir}/zsh/site-functions/_systemd-nspawn
 %{_mandir}/man1/systemd-nspawn.1.gz
 %{_mandir}/man5/systemd.nspawn.5.gz
@@ -25,15 +28,24 @@
 %{_systemd_util_dir}/network/80-container-vz.network
 %{_systemd_util_dir}/network/80-namespace-ns.link
 %{_systemd_util_dir}/network/80-namespace-ns.network
+%if %{with upstream}
+%{_systemd_util_dir}/network/80-namespace-ns-tun.link
+%{_systemd_util_dir}/network/80-namespace-ns-tun.network
+%endif
 %endif
 %if %{without bootstrap}
 %{_systemd_util_dir}/systemd-mountfsd
 %{_systemd_util_dir}/systemd-mountwork
 %{_systemd_util_dir}/systemd-nsresourced
 %{_systemd_util_dir}/systemd-nsresourcework
+%if %{with upstream}
+%{_systemd_util_dir}/user/systemd-nspawn@.service
+%endif
 %{_unitdir}/systemd-mountfsd.service
 %{_unitdir}/systemd-mountfsd.socket
+%endif
 %{_unitdir}/systemd-nspawn@.service
+%if %{without bootstrap}
 %{_unitdir}/systemd-nsresourced.service
 %{_unitdir}/systemd-nsresourced.socket
 %endif
@@ -55,15 +67,25 @@
 %{_mandir}/man5/org.freedesktop.machine1.5.gz
 %{_mandir}/man8/systemd-machined.8.gz
 %{_mandir}/man8/systemd-machined.service.8.gz
-%{_systemd_util_dir}/rpm/fixlet-container-post.sh
 %{_systemd_util_dir}/systemd-machined
+%if %{with upstream}
+%{_systemd_util_dir}/user/machine.slice
+%{_systemd_util_dir}/user/machines.target
+%{_systemd_util_dir}/user/systemd-nspawn@.service
+%endif
 %{_tmpfilesdir}/systemd-nspawn.conf
 %{_unitdir}/dbus-org.freedesktop.machine1.service
 %{_unitdir}/machine.slice
 %{_unitdir}/machines.target
 %{_unitdir}/machines.target.wants/var-lib-machines.mount
 %{_unitdir}/remote-fs.target.wants/var-lib-machines.mount
+%if %{with upstream}
+%{_unitdir}/sockets.target.wants/systemd-machined.socket
+%endif
 %{_unitdir}/systemd-machined.service
+%if %{with upstream}
+%{_unitdir}/systemd-machined.socket
+%endif
 %{_unitdir}/var-lib-machines.mount
 %endif
 
@@ -80,7 +102,11 @@
 %{_mandir}/man8/systemd-importd.8.gz
 %{_mandir}/man8/systemd-importd.service.8.gz
 %{_mandir}/man8/systemd-import-generator.8.gz
+%if %{without upstream}
 %{_systemd_util_dir}/import-pubring.gpg
+%else
+%{_systemd_util_dir}/import-pubring.pgp
+%endif
 %{_systemd_util_dir}/systemd-export
 %{_systemd_util_dir}/systemd-import
 %{_systemd_util_dir}/systemd-import-fs

files.devel-doc

@@ -122,6 +122,7 @@
 %{_mandir}/man3/sd-journal.3.gz
 %{_mandir}/man3/sd-json.3.gz
 %{_mandir}/man3/sd-login.3.gz
+%{_mandir}/man3/sd-path.3.gz
 %{_mandir}/man3/sd-varlink.3.gz
 %{_mandir}/man3/sd_booted.3.gz
 %{_mandir}/man3/sd_bus_add_fallback.3.gz
@@ -284,6 +285,9 @@
 %{_mandir}/man3/sd_bus_message_close_container.3.gz
 %{_mandir}/man3/sd_bus_message_copy.3.gz
 %{_mandir}/man3/sd_bus_message_dump.3.gz
+%if %{with upstream}
+%{_mandir}/man3/sd_bus_message_dump_json.3.gz
+%endif
 %{_mandir}/man3/sd_bus_message_enter_container.3.gz
 %{_mandir}/man3/sd_bus_message_exit_container.3.gz
 %{_mandir}/man3/sd_bus_message_get_allow_interactive_authorization.3.gz
@@ -437,6 +441,26 @@
 %{_mandir}/man3/sd_bus_unref.3.gz
 %{_mandir}/man3/sd_bus_unrefp.3.gz
 %{_mandir}/man3/sd_bus_wait.3.gz
+%if %{with upstream}
+%{_mandir}/man3/sd_device_enumerator_add_all_parents.3.gz
+%{_mandir}/man3/sd_device_enumerator_add_match_parent.3.gz
+%{_mandir}/man3/sd_device_enumerator_add_match_property.3.gz
+%{_mandir}/man3/sd_device_enumerator_add_match_property_required.3.gz
+%{_mandir}/man3/sd_device_enumerator_add_match_subsystem.3.gz
+%{_mandir}/man3/sd_device_enumerator_add_match_sysattr.3.gz
+%{_mandir}/man3/sd_device_enumerator_add_match_sysname.3.gz
+%{_mandir}/man3/sd_device_enumerator_add_match_tag.3.gz
+%{_mandir}/man3/sd_device_enumerator_add_nomatch_sysname.3.gz
+%{_mandir}/man3/sd_device_enumerator_allow_uninitialized.3.gz
+%{_mandir}/man3/sd_device_enumerator_get_device_first.3.gz
+%{_mandir}/man3/sd_device_enumerator_get_device_next.3.gz
+%{_mandir}/man3/sd_device_enumerator_get_subsystem_first.3.gz
+%{_mandir}/man3/sd_device_enumerator_get_subsystem_next.3.gz
+%endif
+%{_mandir}/man3/sd_device_enumerator_new.3.gz
+%{_mandir}/man3/sd_device_enumerator_ref.3.gz
+%{_mandir}/man3/sd_device_enumerator_unref.3.gz
+%{_mandir}/man3/sd_device_enumerator_unrefp.3.gz
 %{_mandir}/man3/sd_device_get_device_id.3.gz
 %{_mandir}/man3/sd_device_get_devname.3.gz
 %{_mandir}/man3/sd_device_get_devnum.3.gz
@@ -686,6 +710,9 @@
 %{_mandir}/man3/sd_pid_notifyf.3.gz
 %{_mandir}/man3/sd_pid_notifyf_with_fds.3.gz
 %{_mandir}/man3/sd_pidfd_get_cgroup.3.gz
+%if %{with upstream}
+%{_mandir}/man3/sd_pidfd_get_inode_id.3.gz
+%endif
 %{_mandir}/man3/sd_pidfd_get_machine_name.3.gz
 %{_mandir}/man3/sd_pidfd_get_owner_uid.3.gz
 %{_mandir}/man3/sd_pidfd_get_session.3.gz
@@ -720,6 +747,15 @@
 %{_mandir}/man3/sd_uid_get_sessions.3.gz
 %{_mandir}/man3/sd_uid_get_state.3.gz
 %{_mandir}/man3/sd_uid_is_on_seat.3.gz
+%if %{with upstream}
+%{_mandir}/man3/sd_varlink_get_description.3.gz
+%{_mandir}/man3/sd_varlink_push_dup_fd.3.gz
+%{_mandir}/man3/sd_varlink_push_fd.3.gz
+%{_mandir}/man3/sd_varlink_send.3.gz
+%{_mandir}/man3/sd_varlink_sendb.3.gz
+%{_mandir}/man3/sd_varlink_sendbo.3.gz
+%{_mandir}/man3/sd_varlink_set_description.3.gz
+%endif
 %{_mandir}/man3/sd_watchdog_enabled.3.gz
 %{_mandir}/man3/udev_device_get_action.3.gz
 %{_mandir}/man3/udev_device_get_current_tags_list_entry.3.gz

files.experimental

@@ -5,52 +5,75 @@
 # the ssh proxy will likely be promoted to systemd-container
 %dir %{_distconfdir}/ssh
 %dir %{_distconfdir}/ssh/ssh_config.d
-%dir %{_prefix}/lib/pcrlock.d
-%dir %{_prefix}/lib/pcrlock.d/400-secureboot-separator.pcrlock.d
-%dir %{_prefix}/lib/pcrlock.d/500-separator.pcrlock.d
-%dir %{_prefix}/lib/pcrlock.d/700-action-efi-exit-boot-services.pcrlock.d
+%if %{without bootstrap}
 %dir %{_sysconfdir}/systemd/oomd.conf.d
+%endif
+%if %{with upstream}
+%dir %{_unitdir}/factory-reset.target.wants
+%endif
 %if %{with sd_boot}
 %dir %{_unitdir}/initrd.target.wants
 %endif
+%if %{with upstream}
+%dir %{_unitdir}/storage-target-mode.target.wants
+%endif
+%if %{without bootstrap}
 # Main config files have been replaced in favor of drop-ins.
 %ghost %{_sysconfdir}/systemd/oomd.conf
 %{_bindir}/oomctl
-%{_bindir}/run0
-%{_bindir}/systemd-vmspawn
-%if %{with sd_boot}
-%{_bindir}/ukify
 %endif
+%if %{without bootstrap}
+%if %{with upstream}
+%{_bindir}/systemd-pty-forward
+%endif
+%{_bindir}/systemd-vmspawn
+%{_bindir}/updatectl
 %{_datadir}/bash-completion/completions/oomctl
-%{_datadir}/bash-completion/completions/run0
 %{_datadir}/bash-completion/completions/systemd-vmspawn
 %{_datadir}/dbus-1/interfaces/org.freedesktop.oom1.Manager.xml
 %{_datadir}/dbus-1/interfaces/org.freedesktop.portable1.Image.xml
 %{_datadir}/dbus-1/interfaces/org.freedesktop.portable1.Manager.xml
+%{_datadir}/dbus-1/interfaces/org.freedesktop.sysupdate1.Job.xml
+%{_datadir}/dbus-1/interfaces/org.freedesktop.sysupdate1.Manager.xml
+%{_datadir}/dbus-1/interfaces/org.freedesktop.sysupdate1.Target.xml
 %{_datadir}/dbus-1/system-services/org.freedesktop.oom1.service
+%{_datadir}/dbus-1/system-services/org.freedesktop.sysupdate1.service
 %{_datadir}/dbus-1/system.d/org.freedesktop.oom1.conf
+%{_datadir}/dbus-1/system.d/org.freedesktop.sysupdate1.conf
+%{_datadir}/polkit-1/actions/org.freedesktop.sysupdate1.policy
 %{_datadir}/zsh/site-functions/_oomctl
-%{_datadir}/zsh/site-functions/_run0
+%endif
 %{_distconfdir}/ssh/ssh_config.d/20-systemd-ssh-proxy.conf
+%if %{without bootstrap}
 %{_mandir}/man1/oomctl.1.gz
-%{_mandir}/man1/run0.1.gz
 %{_mandir}/man1/systemd-keyutil.1.gz
 %{_mandir}/man1/systemd-measure.1.gz
+%if %{with upstream}
+%{_mandir}/man1/systemd-pty-forward.1.gz
+%endif
 %{_mandir}/man1/systemd-sbsign.1.gz
+%if %{with upstream}
+%{_mandir}/man1/systemd-ssh-issue.1.gz
+%endif
 %{_mandir}/man1/systemd-ssh-proxy.1.gz
 %{_mandir}/man1/systemd-vmspawn.1.gz
-%if %{with sd_boot}
-%{_mandir}/man1/ukify.1.gz
-%endif
+%{_mandir}/man1/updatectl.1.gz
 %{_mandir}/man5/oomd.conf.5.gz
 %{_mandir}/man5/oomd.conf.d.5.gz
 %{_mandir}/man5/org.freedesktop.oom1.5.gz
-%{_mandir}/man5/systemd.pcrlock.5.gz
-%{_mandir}/man5/systemd.pcrlock.d.5.gz
+%{_mandir}/man5/org.freedesktop.sysupdate1.5.gz
 %{_mandir}/man5/sysupdate.d.5.gz
 %{_mandir}/man5/sysupdate.features.5.gz
 %{_mandir}/man8/systemd-bsod.8.gz
 %{_mandir}/man8/systemd-bsod.service.8.gz
+%if %{with upstream}
+%{_mandir}/man8/systemd-factory-reset-complete.service.8.gz
+%{_mandir}/man8/systemd-factory-reset-generator.8.gz
+%{_mandir}/man8/systemd-factory-reset-request.service.8.gz
+%{_mandir}/man8/systemd-factory-reset.8.gz
+%{_mandir}/man8/systemd-factory-reset.socket.8.gz
+%{_mandir}/man8/systemd-factory-reset@.service.8.gz
+%endif
 %{_mandir}/man8/systemd-oomd.8.gz
 %{_mandir}/man8/systemd-oomd.service.8.gz
 %if %{with sd_boot}
@@ -64,7 +87,6 @@
 %{_mandir}/man8/systemd-pcrlock-make-policy.service.8.gz
 %{_mandir}/man8/systemd-pcrlock-secureboot-authority.service.8.gz
 %{_mandir}/man8/systemd-pcrlock-secureboot-policy.service.8.gz
-%{_mandir}/man8/systemd-pcrlock.8.gz
 %{_mandir}/man8/systemd-pcrmachine.service.8.gz
 %{_mandir}/man8/systemd-pcrphase-initrd.service.8.gz
 %{_mandir}/man8/systemd-pcrphase-sysinit.service.8.gz
@@ -78,61 +100,84 @@
 %{_mandir}/man8/systemd-sysupdate.8.gz
 %{_mandir}/man8/systemd-sysupdate.service.8.gz
 %{_mandir}/man8/systemd-sysupdate.timer.8.gz
+%{_mandir}/man8/systemd-sysupdated.8.gz
+%{_mandir}/man8/systemd-sysupdated.service.8.gz
+%if %{with upstream}
+%if %{with sd_boot}
+%{_mandir}/man8/systemd-tpm2-clear.service.8.gz
+%endif
+%endif
 %{_mandir}/man8/systemd-tpm2-generator.8.gz
 %if %{with sd_boot}
 %{_mandir}/man8/systemd-tpm2-setup-early.service.8.gz
 %{_mandir}/man8/systemd-tpm2-setup.8.gz
 %{_mandir}/man8/systemd-tpm2-setup.service.8.gz
 %endif
-%{_pam_vendordir}/systemd-run0
-%if %{with sd_boot}
-%{_prefix}/lib/kernel/install.d/60-ukify.install
+%if %{with upstream}
+%{_mandir}/man8/systemd-validatefs@.service.8.gz
 %endif
-%{_prefix}/lib/kernel/uki.conf
-%{_prefix}/lib/pcrlock.d/350-action-efi-application.pcrlock
-%{_prefix}/lib/pcrlock.d/400-secureboot-separator.pcrlock.d/300-0x00000000.pcrlock
-%{_prefix}/lib/pcrlock.d/400-secureboot-separator.pcrlock.d/600-0xffffffff.pcrlock
-%{_prefix}/lib/pcrlock.d/500-separator.pcrlock.d/300-0x00000000.pcrlock
-%{_prefix}/lib/pcrlock.d/500-separator.pcrlock.d/600-0xffffffff.pcrlock
-%{_prefix}/lib/pcrlock.d/700-action-efi-exit-boot-services.pcrlock.d/300-present.pcrlock
-%{_prefix}/lib/pcrlock.d/700-action-efi-exit-boot-services.pcrlock.d/600-absent.pcrlock
-%{_prefix}/lib/pcrlock.d/750-enter-initrd.pcrlock
-%{_prefix}/lib/pcrlock.d/800-leave-initrd.pcrlock
-%{_prefix}/lib/pcrlock.d/850-sysinit.pcrlock
-%{_prefix}/lib/pcrlock.d/900-ready.pcrlock
-%{_prefix}/lib/pcrlock.d/950-shutdown.pcrlock
-%{_prefix}/lib/pcrlock.d/990-final.pcrlock
+%endif
+%if %{without bootstrap}
 %{_systemd_util_dir}/oomd.conf
 %{_systemd_util_dir}/systemd-bsod
+%if %{with upstream}
+%{_systemd_util_dir}/systemd-factory-reset
+%endif
 %{_systemd_util_dir}/systemd-keyutil
 %{_systemd_util_dir}/systemd-measure
 %{_systemd_util_dir}/systemd-oomd
 %if %{with sd_boot}
 %{_systemd_util_dir}/systemd-pcrextend
 %endif
-%{_systemd_util_dir}/systemd-pcrlock
 %{_systemd_util_dir}/systemd-sbsign
+%if %{with upstream}
+%{_systemd_util_dir}/systemd-ssh-issue
+%endif
+%endif
 %{_systemd_util_dir}/systemd-ssh-proxy
+%if %{without bootstrap}
 %{_systemd_util_dir}/systemd-storagetm
 %{_systemd_util_dir}/systemd-sysupdate
+%{_systemd_util_dir}/systemd-sysupdated
 %if %{with sd_boot}
-%{_systemd_util_dir}/systemd-tpm2-setup
+%if %{with upstream}
+%{_systemd_util_dir}/systemd-tpm2-clear
+%endif
+%{_systemd_util_dir}/systemd-tpm2-setup
+%if %{with upstream}
+%{_systemd_util_dir}/systemd-validatefs
+%endif
+%endif
+%if %{with upstream}
+%{_systemd_util_dir}/user/systemd-vmspawn@.service
+%{_systemdgeneratordir}/systemd-factory-reset-generator
 %endif
-%{_systemd_util_dir}/systemd-userwork
-%if %{with sd_boot}
-%{_systemd_util_dir}/ukify
 %endif
 # ssh-generator: in the futur to be moved to the main package
 %{_systemdgeneratordir}/systemd-ssh-generator
 %{_systemdgeneratordir}/systemd-tpm2-generator
+%if %{without bootstrap}
 %{_sysusersdir}/systemd-oom.conf
+%{_unitdir}/dbus-org.freedesktop.sysupdate1.service
+%if %{with upstream}
+%{_unitdir}/factory-reset-now.target
+%{_unitdir}/factory-reset.target.wants/systemd-factory-reset-request.service
+%{_unitdir}/factory-reset.target.wants/systemd-pcrphase-factory-reset.service
+%endif
 %{_unitdir}/initrd.target.wants/systemd-bsod.service
 %if %{with sd_boot}
 %{_unitdir}/initrd.target.wants/systemd-pcrphase-initrd.service
+%endif
+%if %{with upstream}
+%{_unitdir}/sockets.target.wants/systemd-factory-reset.socket
+%endif
+%if %{with sd_boot}
 %{_unitdir}/sockets.target.wants/systemd-pcrextend.socket
-%{_unitdir}/sockets.target.wants/systemd-pcrlock.socket
 %endif
 %{_unitdir}/storage-target-mode.target
+%if %{with upstream}
+%{_unitdir}/storage-target-mode.target.wants/systemd-pcrphase-storage-target-mode.service
+%endif
 %if %{with sd_boot}
 %{_unitdir}/sysinit.target.wants/systemd-pcrmachine.service
 %{_unitdir}/sysinit.target.wants/systemd-pcrphase-sysinit.service
@@ -141,6 +186,13 @@
 %{_unitdir}/sysinit.target.wants/systemd-tpm2-setup.service
 %endif
 %{_unitdir}/systemd-bsod.service
+%if %{with upstream}
+%{_unitdir}/systemd-factory-reset-complete.service
+%{_unitdir}/systemd-factory-reset-reboot.service
+%{_unitdir}/systemd-factory-reset-request.service
+%{_unitdir}/systemd-factory-reset.socket
+%{_unitdir}/systemd-factory-reset@.service
+%endif
 %{_unitdir}/systemd-oomd.service
 %{_unitdir}/systemd-oomd.socket
 %if %{with sd_boot}
@@ -155,10 +207,15 @@
 %{_unitdir}/systemd-pcrlock-make-policy.service
 %{_unitdir}/systemd-pcrlock-secureboot-authority.service
 %{_unitdir}/systemd-pcrlock-secureboot-policy.service
-%{_unitdir}/systemd-pcrlock.socket
 %{_unitdir}/systemd-pcrlock@.service
 %{_unitdir}/systemd-pcrmachine.service
+%if %{with upstream}
+%{_unitdir}/systemd-pcrphase-factory-reset.service
+%endif
 %{_unitdir}/systemd-pcrphase-initrd.service
+%if %{with upstream}
+%{_unitdir}/systemd-pcrphase-storage-target-mode.service
+%endif
 %{_unitdir}/systemd-pcrphase-sysinit.service
 %{_unitdir}/systemd-pcrphase.service
 %endif
@@ -167,8 +224,21 @@
 %{_unitdir}/systemd-sysupdate-reboot.timer
 %{_unitdir}/systemd-sysupdate.service
 %{_unitdir}/systemd-sysupdate.timer
+%{_unitdir}/systemd-sysupdated.service
+%if %{with upstream}
+%if %{with sd_boot}
+%{_unitdir}/systemd-tpm2-clear.service
+%endif
+%endif
 %if %{with sd_boot}
 %{_unitdir}/systemd-tpm2-setup-early.service
 %{_unitdir}/systemd-tpm2-setup.service
 %endif
+%if %{with upstream}
+%{_unitdir}/systemd-validatefs@.service
+%endif
 %{_unitdir}/systemd-vmspawn@.service
+%if %{with upstream}
+/usr/etc/profile.d/80-systemd-osc-context.sh
+%endif
+%endif

files.networkd

@@ -1,7 +1,6 @@
 #
 # Please keep the list sorted (with `LC_ALL=C sort`).
 #
-%if %{with networkd}
 %dir %{_sysconfdir}/systemd/network
 %dir %{_sysconfdir}/systemd/networkd.conf.d
 %dir %{_systemd_util_dir}/network
@@ -47,38 +46,10 @@
 %{_sysusersdir}/systemd-network.conf
 %{_tmpfilesdir}/systemd-network.conf
 %{_unitdir}/systemd-networkd-persistent-storage.service
+%if %{with upstream}
+%{_unitdir}/systemd-networkd-varlink.socket
+%endif
 %{_unitdir}/systemd-networkd-wait-online.service
 %{_unitdir}/systemd-networkd-wait-online@.service
 %{_unitdir}/systemd-networkd.service
 %{_unitdir}/systemd-networkd.socket
-%endif
-
-%if %{with resolved}
-%dir %{_sysconfdir}/systemd/resolved.conf.d
-%{_bindir}/resolvectl
-%{_bindir}/systemd-resolve
-%{_datadir}/bash-completion/completions/resolvectl
-%{_datadir}/bash-completion/completions/systemd-resolve
-%{_datadir}/dbus-1/interfaces/org.freedesktop.resolve1.DnssdService.xml
-%{_datadir}/dbus-1/interfaces/org.freedesktop.resolve1.Link.xml
-%{_datadir}/dbus-1/interfaces/org.freedesktop.resolve1.Manager.xml
-%{_datadir}/dbus-1/system-services/org.freedesktop.resolve1.service
-%{_datadir}/dbus-1/system.d/org.freedesktop.resolve1.conf
-%{_datadir}/polkit-1/actions/org.freedesktop.resolve1.policy
-%{_datadir}/zsh/site-functions/_resolvectl
-%{_libdir}/libnss_resolve.so.2
-%{_mandir}/man1/resolvectl.1.gz
-%{_mandir}/man5/org.freedesktop.resolve1.5.gz
-%{_mandir}/man5/resolved.conf.5.gz
-%{_mandir}/man5/resolved.conf.d.5.gz
-%{_mandir}/man8/libnss_resolve.so.2.8.gz
-%{_mandir}/man8/nss-resolve.8.gz
-%{_mandir}/man8/systemd-resolved.8.gz
-%{_mandir}/man8/systemd-resolved.service.8.gz
-%{_systemd_util_dir}/resolv.conf
-%{_systemd_util_dir}/resolved.conf
-%{_systemd_util_dir}/systemd-resolved
-%{_sysusersdir}/systemd-resolve.conf
-%{_tmpfilesdir}/systemd-resolve.conf
-%{_unitdir}/systemd-resolved.service
-%endif

files.resolved

@@ -0,0 +1,40 @@
+#
+# Please keep the list sorted (with `LC_ALL=C sort`).
+#
+%dir %{_sysconfdir}/systemd/resolved.conf.d
+%{_bindir}/resolvectl
+%{_bindir}/systemd-resolve
+%{_datadir}/bash-completion/completions/resolvectl
+%{_datadir}/bash-completion/completions/systemd-resolve
+%if %{with upstream}
+%{_datadir}/dbus-1/interfaces/org.freedesktop.resolve1.DnsDelegate.xml
+%endif
+%{_datadir}/dbus-1/interfaces/org.freedesktop.resolve1.DnssdService.xml
+%{_datadir}/dbus-1/interfaces/org.freedesktop.resolve1.Link.xml
+%{_datadir}/dbus-1/interfaces/org.freedesktop.resolve1.Manager.xml
+%{_datadir}/dbus-1/system-services/org.freedesktop.resolve1.service
+%{_datadir}/dbus-1/system.d/org.freedesktop.resolve1.conf
+%{_datadir}/polkit-1/actions/org.freedesktop.resolve1.policy
+%{_datadir}/zsh/site-functions/_resolvectl
+%{_libdir}/libnss_resolve.so.2
+%{_mandir}/man1/resolvectl.1.gz
+%{_mandir}/man5/org.freedesktop.resolve1.5.gz
+%{_mandir}/man5/resolved.conf.5.gz
+%{_mandir}/man5/resolved.conf.d.5.gz
+%if %{with upstream}
+%{_mandir}/man5/systemd.dns-delegate.5.gz
+%endif
+%{_mandir}/man8/libnss_resolve.so.2.8.gz
+%{_mandir}/man8/nss-resolve.8.gz
+%{_mandir}/man8/systemd-resolved.8.gz
+%{_mandir}/man8/systemd-resolved.service.8.gz
+%{_systemd_util_dir}/resolv.conf
+%{_systemd_util_dir}/resolved.conf
+%{_systemd_util_dir}/systemd-resolved
+%{_sysusersdir}/systemd-resolve.conf
+%{_tmpfilesdir}/systemd-resolve.conf
+%{_unitdir}/systemd-resolved.service
+%if %{with upstream}
+%{_unitdir}/systemd-resolved-monitor.socket
+%{_unitdir}/systemd-resolved-varlink.socket
+%endif

files.systemd

@@ -47,6 +47,9 @@
 %dir %{_systemd_system_env_generator_dir}
 %dir %{_systemd_user_env_generator_dir}
 %dir %{_systemd_util_dir}
+%if %{with upstream}
+%dir %{_systemd_util_dir}/initrd-preset
+%endif
 %dir %{_systemd_util_dir}/ntp-units.d
 %dir %{_systemd_util_dir}/rpm
 %dir %{_systemd_util_dir}/system-preset
@@ -107,6 +110,7 @@
 %{_bindir}/journalctl
 %{_bindir}/localectl
 %{_bindir}/loginctl
+%{_bindir}/run0
 %{_bindir}/systemctl
 %{_bindir}/systemd-ac-power
 %{_bindir}/systemd-analyze
@@ -149,6 +153,7 @@
 %{_datadir}/bash-completion/completions/localectl
 %{_datadir}/bash-completion/completions/loginctl
 %{_datadir}/bash-completion/completions/portablectl
+%{_datadir}/bash-completion/completions/run0
 %{_datadir}/bash-completion/completions/systemctl
 %{_datadir}/bash-completion/completions/systemd-analyze
 %{_datadir}/bash-completion/completions/systemd-cat
@@ -165,6 +170,9 @@
 %{_datadir}/bash-completion/completions/systemd-sysext
 %{_datadir}/bash-completion/completions/systemd-vpick
 %{_datadir}/bash-completion/completions/timedatectl
+%if %{with upstream}
+%{_datadir}/bash-completion/completions/userdbctl
+%endif
 %endif
 # dbus introspection data for code generators: https://github.com/systemd/systemd/pull/20294
 %{_datadir}/dbus-1/interfaces/org.freedesktop.LogControl1.xml
@@ -208,6 +216,9 @@
 %{_datadir}/polkit-1/actions/org.freedesktop.login1.policy
 %{_datadir}/polkit-1/actions/org.freedesktop.systemd1.policy
 %{_datadir}/polkit-1/actions/org.freedesktop.timedate1.policy
+%if %{with upstream}
+%{_datadir}/polkit-1/rules.d/10-systemd-logind-root-ignore-inhibitors.rules.example
+%endif
 %{_datadir}/systemd/kbd-model-map
 %{_datadir}/systemd/language-fallback-map
 %if %{without bootstrap}
@@ -217,6 +228,7 @@
 %{_datadir}/zsh/site-functions/_journalctl
 %{_datadir}/zsh/site-functions/_localectl
 %{_datadir}/zsh/site-functions/_loginctl
+%{_datadir}/zsh/site-functions/_run0
 %{_datadir}/zsh/site-functions/_sd_hosts_or_user_at_host
 %{_datadir}/zsh/site-functions/_sd_outputmodes
 %{_datadir}/zsh/site-functions/_sd_unit_files
@@ -237,8 +249,8 @@
 %{_libdir}/libnss_myhostname.so.2
 %{_libdir}/libnss_systemd.so.2
 %endif
-%{_libdir}/systemd/libsystemd-core-%{systemd_major}.so
-%{_libdir}/systemd/libsystemd-shared-%{systemd_major}.so
+%{_libdir}/systemd/libsystemd-core-%{base_version}-%{release}.so
+%{_libdir}/systemd/libsystemd-shared-%{base_version}-%{release}.so
 %if %{without bootstrap}
 %{_mandir}/man1/busctl.1.gz
 %{_mandir}/man1/coredumpctl.1.gz
@@ -248,6 +260,7 @@
 %{_mandir}/man1/localectl.1.gz
 %{_mandir}/man1/loginctl.1.gz
 %{_mandir}/man1/mount.ddi.1.gz
+%{_mandir}/man1/run0.1.gz
 %{_mandir}/man1/systemctl.1.gz
 %{_mandir}/man1/systemd-ac-power.1.gz
 %{_mandir}/man1/systemd-analyze.1.gz
@@ -370,6 +383,9 @@
 %{_mandir}/man8/systemd-binfmt.service.8.gz
 %{_mandir}/man8/systemd-boot-check-no-failures.8.gz
 %{_mandir}/man8/systemd-boot-check-no-failures.service.8.gz
+%if %{with upstream}
+%{_mandir}/man8/systemd-confext-initrd.service.8.gz
+%endif
 %{_mandir}/man8/systemd-confext.8.gz
 %{_mandir}/man8/systemd-confext.service.8.gz
 %{_mandir}/man8/systemd-coredump.8.gz
@@ -395,6 +411,9 @@
 %{_mandir}/man8/systemd-localed.service.8.gz
 %{_mandir}/man8/systemd-logind.8.gz
 %{_mandir}/man8/systemd-logind.service.8.gz
+%if %{with upstream}
+%{_mandir}/man8/systemd-loop@.service.8.gz
+%endif
 %{_mandir}/man8/systemd-machine-id-commit.service.8.gz
 %{_mandir}/man8/systemd-poweroff.service.8.gz
 %{_mandir}/man8/systemd-reboot.service.8.gz
@@ -404,6 +423,9 @@
 %{_mandir}/man8/systemd-soft-reboot.service.8.gz
 %{_mandir}/man8/systemd-sysctl.8.gz
 %{_mandir}/man8/systemd-sysctl.service.8.gz
+%if %{with upstream}
+%{_mandir}/man8/systemd-sysext-initrd.service.8.gz
+%endif
 %{_mandir}/man8/systemd-sysext.8.gz
 %{_mandir}/man8/systemd-sysext.service.8.gz
 %{_mandir}/man8/systemd-system-update-generator.8.gz
@@ -432,6 +454,7 @@
 %{_modprobedir}/systemd.conf
 %{_pam_moduledir}/pam_systemd.so
 %{_pam_moduledir}/pam_systemd_loadkey.so
+%{_pam_vendordir}/systemd-run0
 %{_pam_vendordir}/systemd-user
 %{_sbindir}/halt
 %{_sbindir}/init
@@ -448,6 +471,10 @@
 %if %{without bootstrap}
 %{_systemd_util_dir}/coredump.conf
 %endif
+%if %{with upstream}
+%{_systemd_util_dir}/initrd-preset/90-systemd.preset
+%{_systemd_util_dir}/initrd-preset/99-default.preset
+%endif
 %{_systemd_util_dir}/journald.conf
 %{_systemd_util_dir}/logind.conf
 %{_systemd_util_dir}/rpm/fixlet-systemd-post.sh
@@ -456,7 +483,9 @@
 %{_systemd_util_dir}/systemd
 %{_systemd_util_dir}/systemd-binfmt
 %{_systemd_util_dir}/systemd-boot-check-no-failures
+%if %{without upstream}
 %{_systemd_util_dir}/systemd-cgroups-agent
+%endif
 %if %{without bootstrap}
 %{_systemd_util_dir}/systemd-coredump
 %endif
@@ -482,6 +511,7 @@
 %{_systemd_util_dir}/systemd-user-sessions
 %if %{without bootstrap}
 %{_systemd_util_dir}/systemd-userdbd
+%{_systemd_util_dir}/systemd-userwork
 %endif
 %{_systemd_util_dir}/systemd-xdg-autostart-condition
 %{_systemd_util_dir}/user-preset/90-systemd.preset
@@ -501,7 +531,14 @@
 %{_systemd_util_dir}/user/shutdown.target
 %{_systemd_util_dir}/user/smartcard.target
 %{_systemd_util_dir}/user/sockets.target
+%if %{with upstream}
+%{_systemd_util_dir}/user/sockets.target.wants/systemd-ask-password.socket
+%endif
 %{_systemd_util_dir}/user/sound.target
+%if %{with upstream}
+%{_systemd_util_dir}/user/systemd-ask-password.socket
+%{_systemd_util_dir}/user/systemd-ask-password@.service
+%endif
 %{_systemd_util_dir}/user/systemd-exit.service
 %{_systemd_util_dir}/user/systemd-tmpfiles-clean.service
 %{_systemd_util_dir}/user/systemd-tmpfiles-clean.timer
@@ -517,6 +554,9 @@
 %{_sysusersdir}/systemd-coredump.conf
 %endif
 %{_sysusersdir}/systemd-journal.conf
+%if %{with sd_boot}
+%{_tmpfilesdir}/20-systemd-stub.conf
+%endif
 %{_tmpfilesdir}/credstore.conf
 %{_tmpfilesdir}/journal-nocow.conf
 %{_tmpfilesdir}/provision.conf
@@ -534,6 +574,12 @@
 %{_unitdir}/blockdev@.target
 %{_unitdir}/bluetooth.target
 %{_unitdir}/boot-complete.target
+%if %{with upstream}
+%{_unitdir}/breakpoint-pre-basic.service
+%{_unitdir}/breakpoint-pre-mount.service
+%{_unitdir}/breakpoint-pre-switch-root.service
+%{_unitdir}/breakpoint-pre-udev.service
+%endif
 %{_unitdir}/capsule.slice
 %{_unitdir}/capsule@.service
 %{_unitdir}/console-getty.service
@@ -558,6 +604,10 @@
 %{_unitdir}/getty@.service
 %{_unitdir}/graphical.target
 %{_unitdir}/halt.target
+%if %{with upstream}
+%{_unitdir}/imports-pre.target
+%{_unitdir}/imports.target
+%endif
 %{_unitdir}/initrd-cleanup.service
 %{_unitdir}/initrd-fs.target
 %{_unitdir}/initrd-parse-etc.service
@@ -567,6 +617,10 @@
 %{_unitdir}/initrd-switch-root.target
 %{_unitdir}/initrd-usr-fs.target
 %{_unitdir}/initrd.target
+%if %{with upstream}
+%{_unitdir}/initrd.target.wants/systemd-confext-initrd.service
+%{_unitdir}/initrd.target.wants/systemd-sysext-initrd.service
+%endif
 %{_unitdir}/kexec.target
 %{_unitdir}/local-fs-pre.target
 %{_unitdir}/local-fs.target
@@ -598,6 +652,9 @@
 %{_unitdir}/slices.target
 %{_unitdir}/smartcard.target
 %{_unitdir}/sockets.target
+%if %{with upstream}
+%{_unitdir}/sockets.target.wants/systemd-ask-password.socket
+%endif
 %if %{without bootstrap}
 %{_unitdir}/sockets.target.wants/systemd-coredump.socket
 %endif
@@ -605,6 +662,9 @@
 %{_unitdir}/sockets.target.wants/systemd-hostnamed.socket
 %{_unitdir}/sockets.target.wants/systemd-journald-dev-log.socket
 %{_unitdir}/sockets.target.wants/systemd-journald.socket
+%if %{with upstream}
+%{_unitdir}/sockets.target.wants/systemd-logind-varlink.socket
+%endif
 %{_unitdir}/sockets.target.wants/systemd-sysext.socket
 %{_unitdir}/soft-reboot.target
 %{_unitdir}/sound.target
@@ -631,6 +691,9 @@
 %{_unitdir}/sysinit.target.wants/systemd-machine-id-commit.service
 %{_unitdir}/sysinit.target.wants/systemd-sysctl.service
 %{_unitdir}/sysinit.target.wants/systemd-sysusers.service
+%if %{with upstream}
+%{_unitdir}/sysinit.target.wants/imports.target
+%endif
 %{_unitdir}/sysinit.target.wants/systemd-tmpfiles-setup.service
 %{_unitdir}/sysinit.target.wants/systemd-update-done.service
 %if %{with utmp}
@@ -644,8 +707,15 @@
 %{_unitdir}/systemd-ask-password-console.service
 %{_unitdir}/systemd-ask-password-wall.path
 %{_unitdir}/systemd-ask-password-wall.service
+%if %{with upstream}
+%{_unitdir}/systemd-ask-password.socket
+%{_unitdir}/systemd-ask-password@.service
+%endif
 %{_unitdir}/systemd-binfmt.service
 %{_unitdir}/systemd-boot-check-no-failures.service
+%if %{with upstream}
+%{_unitdir}/systemd-confext-initrd.service
+%endif
 %{_unitdir}/systemd-confext.service
 %if %{without bootstrap}
 %{_unitdir}/systemd-coredump.socket
@@ -670,11 +740,18 @@
 %{_unitdir}/systemd-kexec.service
 %{_unitdir}/systemd-localed.service
 %{_unitdir}/systemd-logind.service
+%if %{with upstream}
+%{_unitdir}/systemd-logind-varlink.socket
+%{_unitdir}/systemd-loop@.service
+%endif
 %{_unitdir}/systemd-machine-id-commit.service
 %{_unitdir}/systemd-poweroff.service
 %{_unitdir}/systemd-reboot.service
 %{_unitdir}/systemd-soft-reboot.service
 %{_unitdir}/systemd-sysctl.service
+%if %{with upstream}
+%{_unitdir}/systemd-sysext-initrd.service
+%endif
 %{_unitdir}/systemd-sysext.service
 %{_unitdir}/systemd-sysext.socket
 %{_unitdir}/systemd-sysext@.service
@@ -690,6 +767,9 @@
 %endif
 %{_unitdir}/systemd-user-sessions.service
 %if %{without bootstrap}
+%if %{with upstream}
+%{_unitdir}/systemd-userdb-load-credentials.service
+%endif
 %{_unitdir}/systemd-userdbd.service
 %{_unitdir}/systemd-userdbd.socket
 %endif

files.sysvcompat

@@ -1,18 +1,23 @@
 #
 # Please keep the list sorted (with `LC_ALL=C sort`).
 #
+%if %{without upstream}
 %dir %{_unitdir}/runlevel1.target.wants
 %dir %{_unitdir}/runlevel2.target.wants
 %dir %{_unitdir}/runlevel3.target.wants
 %dir %{_unitdir}/runlevel4.target.wants
 %dir %{_unitdir}/runlevel5.target.wants
+%endif
 %{_mandir}/man8/rc-local.service.8.gz
+%if %{without upstream}
 %{_mandir}/man8/runlevel.8.gz
 %{_mandir}/man8/systemd-initctl.8.gz
 %{_mandir}/man8/systemd-initctl.service.8.gz
 %{_mandir}/man8/systemd-initctl.socket.8.gz
+%endif
 %{_mandir}/man8/systemd-rc-local-generator.8.gz
 %{_mandir}/man8/systemd-sysv-generator.8.gz
+%if %{without upstream}
 %if %{with utmp}
 %{_mandir}/man8/systemd-update-utmp-runlevel.service.8.gz
 %endif
@@ -20,14 +25,18 @@
 %{_sbindir}/runlevel
 %{_sbindir}/telinit
 %{_systemd_util_dir}/systemd-initctl
+%endif
 %{_systemd_util_dir}/systemd-sysv-install
 %{_systemdgeneratordir}/systemd-rc-local-generator
 %{_systemdgeneratordir}/systemd-sysv-generator
+%if %{without upstream}
 %if %{with utmp}
 %{_unitdir}/graphical.target.wants/systemd-update-utmp-runlevel.service
 %{_unitdir}/multi-user.target.wants/systemd-update-utmp-runlevel.service
 %endif
+%endif
 %{_unitdir}/rc-local.service
+%if %{without upstream}
 %if %{with utmp}
 %{_unitdir}/rescue.target.wants/systemd-update-utmp-runlevel.service
 %endif
@@ -48,3 +57,4 @@
 /sbin/runlevel
 /sbin/telinit
 %endif
+%endif

files.udev

@@ -8,6 +8,10 @@
 %if %{without bootstrap}
 %dir %{_prefix}/lib/kernel
 %dir %{_prefix}/lib/kernel/install.d
+%dir %{_prefix}/lib/pcrlock.d
+%dir %{_prefix}/lib/pcrlock.d/400-secureboot-separator.pcrlock.d
+%dir %{_prefix}/lib/pcrlock.d/500-separator.pcrlock.d
+%dir %{_prefix}/lib/pcrlock.d/700-action-efi-exit-boot-services.pcrlock.d
 %endif
 %dir %{_prefix}/lib/udev
 %if %{without bootstrap}
@@ -85,6 +89,8 @@
 %{_mandir}/man5/repart.d.5.gz
 %{_mandir}/man5/sleep.conf.d.5.gz
 %{_mandir}/man5/systemd-sleep.conf.5.gz
+%{_mandir}/man5/systemd.pcrlock.5.gz
+%{_mandir}/man5/systemd.pcrlock.d.5.gz
 %{_mandir}/man5/timesyncd.conf.5.gz
 %{_mandir}/man5/timesyncd.conf.d.5.gz
 %{_mandir}/man5/udev.conf.5.gz
@@ -93,6 +99,9 @@
 %{_mandir}/man5/veritytab.5.gz
 %{_mandir}/man7/hwdb.7.gz
 %{_mandir}/man7/smbios-type-11.7.gz
+%if %{with upstream}
+%{_mandir}/man7/systemd.image-filter.7.gz
+%endif
 %{_mandir}/man7/systemd.image-policy.7.gz
 %{_mandir}/man7/udev.7.gz
 %{_mandir}/man8/kernel-install.8.gz
@@ -128,10 +137,18 @@
 %{_mandir}/man8/systemd-modules-load.service.8.gz
 %{_mandir}/man8/systemd-network-generator.8.gz
 %{_mandir}/man8/systemd-network-generator.service.8.gz
+%if %{with sd_boot}
+%{_mandir}/man8/systemd-pcrlock.8.gz
+%endif
 %{_mandir}/man8/systemd-pstore.8.gz
 %{_mandir}/man8/systemd-pstore.service.8.gz
 %{_mandir}/man8/systemd-quotacheck.8.gz
+%if %{with upstream}
+%{_mandir}/man8/systemd-quotacheck@.service.8.gz
+%{_mandir}/man8/systemd-quotacheck-root.service.8.gz
+%else
 %{_mandir}/man8/systemd-quotacheck.service.8.gz
+%endif
 %{_mandir}/man8/systemd-random-seed.8.gz
 %{_mandir}/man8/systemd-random-seed.service.8.gz
 %{_mandir}/man8/systemd-remount-fs.8.gz
@@ -151,6 +168,9 @@
 %{_mandir}/man8/systemd-udev-settle.service.8.gz
 %{_mandir}/man8/systemd-udevd-control.socket.8.gz
 %{_mandir}/man8/systemd-udevd-kernel.socket.8.gz
+%if %{with upstream}
+%{_mandir}/man8/systemd-udevd-varlink.socket.8.gz
+%endif
 %{_mandir}/man8/systemd-udevd.8.gz
 %{_mandir}/man8/systemd-udevd.service.8.gz
 %{_mandir}/man8/systemd-vconsole-setup.8.gz
@@ -165,6 +185,19 @@
 %{_prefix}/lib/kernel/install.d/50-depmod.install
 %{_prefix}/lib/kernel/install.d/90-loaderentry.install
 %{_prefix}/lib/kernel/install.d/90-uki-copy.install
+%{_prefix}/lib/pcrlock.d/350-action-efi-application.pcrlock
+%{_prefix}/lib/pcrlock.d/400-secureboot-separator.pcrlock.d/300-0x00000000.pcrlock
+%{_prefix}/lib/pcrlock.d/400-secureboot-separator.pcrlock.d/600-0xffffffff.pcrlock
+%{_prefix}/lib/pcrlock.d/500-separator.pcrlock.d/300-0x00000000.pcrlock
+%{_prefix}/lib/pcrlock.d/500-separator.pcrlock.d/600-0xffffffff.pcrlock
+%{_prefix}/lib/pcrlock.d/700-action-efi-exit-boot-services.pcrlock.d/300-present.pcrlock
+%{_prefix}/lib/pcrlock.d/700-action-efi-exit-boot-services.pcrlock.d/600-absent.pcrlock
+%{_prefix}/lib/pcrlock.d/750-enter-initrd.pcrlock
+%{_prefix}/lib/pcrlock.d/800-leave-initrd.pcrlock
+%{_prefix}/lib/pcrlock.d/850-sysinit.pcrlock
+%{_prefix}/lib/pcrlock.d/900-ready.pcrlock
+%{_prefix}/lib/pcrlock.d/950-shutdown.pcrlock
+%{_prefix}/lib/pcrlock.d/990-final.pcrlock
 %endif
 %{_prefix}/lib/udev/ata_id
 %{_prefix}/lib/udev/cdrom_id
@@ -214,6 +247,9 @@
 %{_systemd_util_dir}/systemd-modules-load
 %endif
 %{_systemd_util_dir}/systemd-network-generator
+%if %{without bootstrap}
+%{_systemd_util_dir}/systemd-pcrlock
+%endif
 %{_systemd_util_dir}/systemd-pstore
 %{_systemd_util_dir}/systemd-quotacheck
 %{_systemd_util_dir}/systemd-random-seed
@@ -266,9 +302,11 @@
 %{_udevhwdbdir}/70-cameras.hwdb
 %{_udevhwdbdir}/70-hardware-wallets.hwdb
 %{_udevhwdbdir}/70-joystick.hwdb
+%{_udevhwdbdir}/70-maker-tools.hwdb
 %{_udevhwdbdir}/70-mouse.hwdb
 %{_udevhwdbdir}/70-pda.hwdb
 %{_udevhwdbdir}/70-pointingstick.hwdb
+%{_udevhwdbdir}/70-software-radio.hwdb
 %{_udevhwdbdir}/70-sound-card.hwdb
 %{_udevhwdbdir}/70-touchpad.hwdb
 %{_udevhwdbdir}/80-ieee1394-unit-function.hwdb
@@ -283,6 +321,9 @@
 %{_udevrulesdir}/60-infiniband.rules
 %{_udevrulesdir}/60-input-id.rules
 %{_udevrulesdir}/60-persistent-alsa.rules
+%if %{with upstream}
+%{_udevrulesdir}/60-persistent-hidraw.rules
+%endif
 %{_udevrulesdir}/60-persistent-input.rules
 %{_udevrulesdir}/60-persistent-storage-mtd.rules
 %{_udevrulesdir}/60-persistent-storage-tape.rules
@@ -306,7 +347,13 @@
 %{_udevrulesdir}/80-drivers.rules
 %endif
 %{_udevrulesdir}/80-net-setup-link.rules
+%if %{with upstream}
+%{_udevrulesdir}/81-net-bridge.rules
+%endif
 %{_udevrulesdir}/81-net-dhcp.rules
+%if %{with upstream}
+%{_udevrulesdir}/90-image-dissect.rules
+%endif
 %{_udevrulesdir}/90-iocost.rules
 %{_udevrulesdir}/90-vconsole.rules
 %if %{without bootstrap}
@@ -317,6 +364,9 @@
 %{_unitdir}/hybrid-sleep.target
 %if %{without bootstrap}
 %{_unitdir}/initrd-root-device.target.wants/remote-cryptsetup.target
+%if %{with upstream}
+%{_unitdir}/initrd-root-device.target.wants/remote-integritysetup.target
+%endif
 %{_unitdir}/initrd-root-device.target.wants/remote-veritysetup.target
 %endif
 %{_unitdir}/initrd-udevadm-cleanup-db.service
@@ -330,14 +380,21 @@
 %{_unitdir}/quotaon@.service
 %if %{without bootstrap}
 %{_unitdir}/remote-cryptsetup.target
+%if %{with upstream}
+%{_unitdir}/remote-integritysetup.target
+%endif
 %{_unitdir}/remote-veritysetup.target
 %endif
 %{_unitdir}/sleep.target
 %if %{with sd_boot}
 %{_unitdir}/sockets.target.wants/systemd-bootctl.socket
+%{_unitdir}/sockets.target.wants/systemd-pcrlock.socket
 %endif
 %{_unitdir}/sockets.target.wants/systemd-udevd-control.socket
 %{_unitdir}/sockets.target.wants/systemd-udevd-kernel.socket
+%if %{with upstream}
+%{_unitdir}/sockets.target.wants/systemd-udevd-varlink.socket
+%endif
 %{_unitdir}/suspend-then-hibernate.target
 %{_unitdir}/suspend.target
 %if %{without bootstrap}
@@ -384,6 +441,9 @@
 %{_unitdir}/systemd-modules-load.service
 %endif
 %{_unitdir}/systemd-network-generator.service
+%if %{with sd_boot}
+%{_unitdir}/systemd-pcrlock.socket
+%endif
 %{_unitdir}/systemd-pstore.service
 %{_unitdir}/systemd-quotacheck-root.service
 %{_unitdir}/systemd-quotacheck@.service
@@ -405,6 +465,9 @@
 %{_unitdir}/systemd-udevd-control.socket
 %{_unitdir}/systemd-udevd-kernel.socket
 %{_unitdir}/systemd-udevd.service
+%if %{with upstream}
+%{_unitdir}/systemd-udevd-varlink.socket
+%endif
 %{_unitdir}/systemd-vconsole-setup.service
 %{_unitdir}/systemd-volatile-root.service
 %{_unitdir}/tpm2.target

files.uefi-boot

@@ -15,6 +15,9 @@
 %{_mandir}/man8/systemd-bless-boot-generator.8.gz
 %{_mandir}/man8/systemd-bless-boot.8.gz
 %{_mandir}/man8/systemd-bless-boot.service.8.gz
+%if %{with upstream}
+%{_mandir}/man8/systemd-boot-clear-sysfail.service.8.gz
+%endif
 %{_mandir}/man8/systemd-boot-random-seed.service.8.gz
 %endif
 # These are the few exceptions where glob pattern is allowed.
@@ -23,8 +26,10 @@
 %{_systemd_util_dir}/boot/efi/systemd-boot*.efi
 %{_systemd_util_dir}/systemd-bless-boot
 %{_systemdgeneratordir}/systemd-bless-boot-generator
-%{_tmpfilesdir}/20-systemd-stub.conf
 %{_unitdir}/sysinit.target.wants/systemd-boot-random-seed.service
 %{_unitdir}/systemd-bless-boot.service
+%if %{with upstream}
+%{_unitdir}/systemd-boot-clear-sysfail.service
+%endif
 %{_unitdir}/systemd-boot-random-seed.service
 %{_unitdir}/systemd-boot-update.service

files.ukify

@@ -0,0 +1,8 @@
+#
+# Please keep the list sorted (with `LC_ALL=C sort`).
+#
+%{_bindir}/ukify
+%{_mandir}/man1/ukify.1.gz
+%{_prefix}/lib/kernel/install.d/60-ukify.install
+%{_prefix}/lib/kernel/uki.conf
+%{_systemd_util_dir}/ukify

fixlet-container-post.sh

@@ -1,146 +0,0 @@
-#! /bin/bash
-#
-# This script contains all the fixups run when systemd-container package is
-# installed or updated.
-#
-
-warn() {
-	echo >&2 "warning: $@"
-}
-
-is_btrfs_subvolume() {
-	# On btrfs subvolumes always have the inode 256
-	test $(stat --format=%i "$1") -eq 256
-}
-
-# This assumes the directory/subvol is emptied by the caller.
-rm_subvolume_or_directory() {
-	is_btrfs_subvolume "$1" && {
-		btrfs subvolume delete "$1"
-		return
-	}
-	rmdir "$1"
-}
-
-# On systems using BTRFS, convert /var/lib/machines into a subvolume suitable
-# for snapper to perform snapshots, rollbacks.. in case it was not properly set
-# up, see bsc#992573. The installer has been fixed to properly initialize it at
-# installation time.
-#
-# The conversion might only be problematic for openSUSE distros (TW/Factory)
-# where the subvolume was created at the wrong place (via tmpfiles for example)
-# and it got populated before we had time to fix it. In this case we'll let the
-# user fix it manually.
-#
-# On SLE12 this subvolume was only introduced during the upgrade from v210 to
-# v228 (ie SLE12-SP[01] -> SLE12-SP2+ when we added this workaround hence no
-# user should had time to populate it. Note that the subvolume is still created
-# at the wrong place due to the call to tmpfiles_create macro in the %post
-# section however it's empty so again we shouldn't face any issue to convert it.
-#
-# In order to avoid ugly dependencies added in systemd package, this function
-# should only be called during package updates when mksubvolume(8) is
-# available. During installation, /var/lib/machines is supposed to be created by
-# the installer now.
-#
-# See bsc#992573
-#
-fix_machines_subvol() {
-	local tagfile=/var/lib/systemd/rpm/container-machines_subvol
-
-	if [ -e $tagfile ]; then
-		return 0
-	fi
-	touch $tagfile
-
-	#
-	# If there's already an entry in fstab for /var/lib/machines, it
-	# means that:
-	#
-	#   - the installer initialized /var/lib/machines correctly (default)
-	#   - we already fixed it
-	#   - the sysadmin added it manually
-	#
-	# In any cases we should return.
-	#
-	# Note: we can't simply check if /var/lib/machines has been mounted
-	# because an update through a chroot might be in progress (see
-	# bsc#1030290).
-	#
-	if mount --fake /var/lib/machines 2>/dev/null; then
-		return
-	fi
-
-	#
-	# If there is already an entry in fstab for /var, it means that:
-	#
-	#   - the system has a seperate /var subvolume (default from Feb 2018)
-	#   - the system has a seperate /var partition
-	#
-	# In any case we should return.
-	#
-	if mount --fake /var 2>/dev/null; then
-		return
-	fi
-
-	#
-	# If something is already mounted don't try to fix anything, it's been
-	# done manually by the sysadmin.
-	#
-	if mountpoint -q /var/lib/machines; then
-		return
-	fi
-
-	#
-	# Let's try to figure out if the current filesystem uses a Snapper
-	# BTRFS specific layout. Note that TW uses a different layout than
-	# SLE...
-	#
-	# FIXME: not sure if it's correct, reliable or optimal.
-	#
-	case $(findmnt -nr -t btrfs -o FSROOT / 2>/dev/null) in
-	*.snapshots/*/snapshot*)
-		;;
-	*)
-		return 0
-	esac
-
-	if test -d /var/lib/machines; then
-		#
-		# Ok, we're on a system supporting rollbacks and
-		# /var/lib/machines is not a subvolume remotely mounted so it
-		# cannot be suitable for systems supporting rollback. Fix it.
-		#
-		echo "Making /var/lib/machines suitable for rollbacks..."
-
-		type mksubvolume >/dev/null 2>&1 || {
-			warn "mksubvolume(8) is not installed, aborting."
-			return 1
-		}
-		test "$(ls -A /var/lib/machines/)" && {
-			warn "/var/lib/machines is not empty, aborting."
-			return 1
-		}
-
-		echo "Deleting empty /var/lib/machines directory/subvolume"
-		rm_subvolume_or_directory /var/lib/machines || {
-			warn "fail to delete /var/lib/machines"
-			return 1
-		}
-	fi
-
-	# At this point /var/lib/machines shouldn't exist.
-	echo "Creating /var/lib/machines subvolume suitable for rollbacks."
-	mksubvolume /var/lib/machines
-}
-
-r=0
-if [ $1 -gt 1 ]; then
-	# During upgrade
-	fix_machines_subvol || {
-		warn "Please fix /var/lib/machines manually."
-		r=1
-	}
-fi
-
-exit $r

fixlet-systemd-post.sh

@@ -4,213 +4,8 @@
 # updated.
 #
 
-# /etc/sysconfig/console   | /etc/vconsole.conf
-# -------------------------+---------------------
-# CONSOLE_FONT             | FONT
-# CONSOLE_SCREENMAP        | FONT_MAP
-# CONSOLE_UNICODEMAP       | FONT_UNIMAP
-migrate_locale () {
-	local migrated=""
-
-	if ! test -f /etc/sysconfig/console; then
-		return
-	fi
-	source /etc/sysconfig/console || return
-
-	if test -f /etc/vconsole.conf; then
-		source /etc/vconsole.conf || return
-	fi
-
-	if test -n "$CONSOLE_FONT" && test -z "$FONT"; then
-		echo "FONT=$CONSOLE_FONT" >>/etc/vconsole.conf
-		migrated+="CONSOLE_FONT "
-	fi
-	if test -n "$CONSOLE_SCREENMAP" && test -z "$FONT_MAP"; then
-		echo "FONT_MAP=$CONSOLE_SCREENMAP" >>/etc/vconsole.conf
-		migrated+="CONSOLE_SCREENMAP "
-	fi
-	if test -n "$CONSOLE_UNICODEMAP" && test -z "$FONT_UNIMAP"; then
-		echo "FONT_UNIMAP=$CONSOLE_UNICODEMAP" >>/etc/vconsole.conf
-		migrated+="CONSOLE_UNICODEMAP "
-	fi
-
-	if test -n "$migrated"; then
-		echo >&2 "The following variables from /etc/sysconfig/console have been migrated"
-		echo >&2 "into /etc/vconsole.conf:"
-		echo >&2
-		for v in $migrated; do echo "  - $v=${!v}"; done
-		echo >&2
-		echo >&2 "Please edit /etc/vconsole.conf if you need to tune these settings"
-		echo >&2 "as /etc/sysconfig/console won't be considered anymore."
-		echo >&2
-	fi
-}
-
-# /etc/sysconfig/keyboard  | /etc/vconsole.conf
-# -------------------------+---------------------
-# KEYTABLE                 | KEYMAP
-migrate_keyboard () {
-	local migrated=""
-
-	if ! test -f /etc/sysconfig/keyboard; then
-		return
-	fi
-	source /etc/sysconfig/keyboard || return
-
-	if test -f /etc/vconsole.conf; then
-		source /etc/vconsole.conf || return
-	fi
-
-	if test -n "$KEYTABLE" && test -z "$KEYMAP"; then
-		echo "KEYMAP=$KEYTABLE" >>/etc/vconsole.conf
-		migrated+="KEYTABLE "
-	fi
-
-	if test -n "$migrated"; then
-		echo >&2 "The following variables from /etc/sysconfig/keyboard have been migrated"
-		echo >&2 "into /etc/vconsole.conf:"
-		echo >&2
-		for v in $migrated; do echo "  - $v=${!v}"; done
-		echo >&2
-		echo >&2 "Please use localectl(1) if you need to tune these settings since"
-		echo >&2 "/etc/sysconfig/keyboard won't be considered anymore."
-		echo >&2
-	fi
-}
-
-# According to
-# https://www.suse.com/documentation/sles-12/book_sle_admin/data/sec_suse_l10n.html,
-# variables in /etc/sysconfig/language are supposed to be passed to the users'
-# shell *only*. However it seems that there has been some confusion and they
-# ended up configuring the system-wide locale as well.  The logic followed by
-# systemd was implemented in commit 01c4b6f4f0d951d17f6873f68156ecd7763429c6,
-# which was reverted. The code below follows the same logic to migrate content
-# of /etc/sysconfig/language into locale.conf.
-migrate_language () {
-	local lang=
-	local migrated=false
-
-	if ! test -f /etc/sysconfig/language; then
-		return
-	fi
-	source /etc/sysconfig/language || return
-
-	lang=$(grep ^LANG= /etc/locale.conf 2>/dev/null)
-	lang=${lang#LANG=}
-
-	case "$ROOT_USES_LANG" in
-        yes)
-		if test -z "$lang" && test -n "$RC_LANG"; then
-			echo "LANG=$RC_LANG" >>/etc/locale.conf
-			migrated=true
-		fi
-		;;
-	ctype)
-		if ! grep -q ^LC_CTYPE= /etc/locale.conf 2>/dev/null; then
-
-			: ${lc_ctype:="$lang"}
-			: ${lc_ctype:="$RC_LC_CTYPE"}
-			: ${lc_ctype:="$RC_LANG"}
-
-			if test -n "$lc_ctype"; then
-				echo "LC_CTYPE=$lc_ctype" >>/etc/locale.conf
-				migrated=true
-			fi
-		fi
-		;;
-	esac
-
-	if $migrated; then
-		echo >&2 "The content of /etc/sysconfig/language has been migrated into"
-		echo >&2 "/etc/locale.conf. The former file is now only used for setting"
-		echo >&2 "the locale used by user's shells. The system-wide locale is"
-		echo >&2 "only read from /etc/locale.conf since now."
-		echo >&2
-		echo >&2 "Please only use localectl(1) or YaST if you need to change the"
-		echo >&2 "settings of the *system-wide* locale from now."
-	fi
-}
-
-#
-# Migrate old i18n settings previously configured in /etc/sysconfig to the new
-# locations used by systemd (/etc/locale.conf, /etc/vconsole.conf, ...). Recent
-# versions of systemd parse the new locations only.
-#
-# This is needed both at package updates and package installations because we
-# might be upgrading from a system which was running SysV init (systemd package
-# is being installed).
-#
-# Note: run only once.
-#
-migrate_sysconfig_i18n() {
-	local tagfile=/var/lib/systemd/rpm/systemd-i18n_migrated
-	local -i rv=0
-
-	if [ -e $tagfile ]; then
-		return 0
-	fi
-
-	# The marker could have been incorrectly put in /usr/lib.
-	mv /usr/lib/systemd/scripts/.migrate-sysconfig-i18n.sh~done $tagfile &>/dev/null
-	# The tag files have been moved to /var/lib/systemd/rpm later.
-	mv /var/lib/systemd/i18n-migrated $tagfile &>/dev/null
-
-	if [ -e $tagfile ]; then
-		return 0
-	fi
-	touch $tagfile
-
-	migrate_locale;   rv+=$?
-	migrate_keyboard; rv+=$?
-	migrate_language; rv+=$?
-
-	if [ $rv -gt 0 ]; then
-		echo >&2 "Failed to migrate i18n settings from /etc/sysconfig, ignoring."
-	fi
-
-	return $rv
-}
-
-#
-# This function is supposed to be called from the %post section of the main
-# package. It contains all the fixups needed when the system was running a
-# version of systemd older than v210.
-#
-# All hacks can potentially break the admin settings since they work in /etc.
-#
-fix_pre_210() {
-	local tagfile=/var/lib/systemd/rpm/systemd-pre_210_fixed
-
-	if [ -e $tagfile ]; then
-		return 0
-	fi
-	touch $tagfile
-
-	#
-	# During migration from sysvinit to systemd, we used to set the systemd
-	# default target to one of the 'runlevel*.target' after reading the
-	# default runlevel from /etc/inittab. We don't do that anymore because
-	# in most cases using the graphical.target target, which is the default,
-	# will do the right thing. Moreover the runlevel targets are considered
-	# as deprecated, so we convert them into "true" systemd targets instead
-	# here.
-	#
-	if target=$(readlink /etc/systemd/system/default.target); then
-		target=$(basename $target)
-		case "$target" in
-		runlevel?.target)
-			echo "Default target is '$target' but use of runlevels is deprecated, converting"
-			systemctl --no-reload set-default $target
-		esac
-	fi
-
-	#
-	# Migrate any symlink which may refer to the old path (ie /lib/systemd).
-	#
-	for f in $(find /etc/systemd/system -type l -xtype l); do
-		new_target="/usr$(readlink $f)"
-		[ -f "$new_target" ] && ln -s -f "$new_target" "$f"
-	done
+warn() {
+	echo >&2 "warning: $@"
 }
 
 #
@@ -301,12 +96,152 @@ EOF
 	done
 }
 
+# On systems using the old btrfs layout, where /var was not a separate
+# subvolume, convert /var/lib/machines into a subvolume suitable for snapper to
+# perform snapshots, rollbacks, see bsc#992573.
+#
+# The conversion might only be problematic for openSUSE distros (TW/Factory)
+# where the subvolume was created at the wrong place (via tmpfiles for example)
+# and it got populated before we had time to fix it. In this case we'll let the
+# user fix it manually.
+#
+# On SLE12 this subvolume was only introduced during the upgrade from v210 to
+# v228 (ie SLE12-SP[01] -> SLE12-SP2+ when we added this workaround hence no
+# user should had time to populate it. Note that the subvolume is still created
+# at the wrong place due to the call to tmpfiles_create macro in the %post
+# section however it's empty so again we shouldn't face any issue to convert it.
+#
+# In order to avoid ugly dependencies added in systemd package, this function
+# should only be called during package updates when mksubvolume(8) is
+# available. During installation, /var/lib/machines is supposed to be created by
+# the installer now.
+#
+# See bsc#992573.
+#
+is_btrfs_subvolume() {
+	# On btrfs subvolumes always have the inode 256
+	test $(stat --format=%i "$1") -eq 256
+}
+
+# This assumes the directory/subvol to remove is empty.
+rm_subvolume_or_directory() {
+	is_btrfs_subvolume "$1" && {
+		btrfs subvolume delete "$1"
+		return
+	}
+	rmdir "$1"
+}
+
+fix_machines_subvol() {
+	local tagfile=/var/lib/systemd/rpm/container-machines_subvol
+
+	#
+	# This test is probably redundant with the ones below but we don't want
+	# to run this on transactional systems since /var has always been a
+	# separate subvolume on such systems.
+	#
+	if [ -n "${TRANSACTIONAL_UPDATE}" ]; then
+		return 0
+	fi
+
+	if [ -e $tagfile ]; then
+		return 0
+	fi
+	touch $tagfile
+
+	#
+	# If there's already an entry in fstab for /var/lib/machines, it
+	# means that:
+	#
+	#   - the installer initialized /var/lib/machines correctly (default)
+	#   - we already fixed it
+	#   - the sysadmin added it manually
+	#
+	# In any cases we should return.
+	#
+	# Note: we can't simply check if /var/lib/machines has been mounted
+	# because an offline update might be in progress (see bsc#1030290).
+	#
+	if mount --fake /var/lib/machines 2>/dev/null; then
+		return
+	fi
+
+	#
+	# If there is already an entry in fstab for /var, it means that:
+	#
+	#   - the system has a seperate /var subvolume (default from Feb 2018)
+	#   - the system has a seperate /var partition
+	#
+	# In any case we should return.
+	#
+	if mount --fake /var 2>/dev/null; then
+		return
+	fi
+
+	#
+	# If something is already mounted don't try to fix anything, it's been
+	# done manually by the sysadmin.
+	#
+	if mountpoint -q /var/lib/machines; then
+		return
+	fi
+
+	#
+	# Let's try to figure out if the current filesystem uses a Snapper
+	# BTRFS specific layout. Note that TW uses a different layout than
+	# SLE...
+	#
+	# FIXME: not sure if it's correct, reliable or optimal.
+	#
+	case $(findmnt -nr -t btrfs -o FSROOT / 2>/dev/null) in
+	*.snapshots/*/snapshot*)
+		;;
+	*)
+		return 0
+	esac
+
+	if test -d /var/lib/machines; then
+		#
+		# Ok, we're on a system supporting rollbacks and
+		# /var/lib/machines is not a subvolume remotely mounted so it
+		# cannot be suitable for systems supporting rollback. Fix it.
+		#
+		echo "Making /var/lib/machines suitable for rollbacks..."
+
+		type mksubvolume >/dev/null 2>&1 || {
+			warn "mksubvolume(8) is not installed, aborting."
+			return 1
+		}
+		test "$(ls -A /var/lib/machines/)" && {
+			warn "/var/lib/machines is not empty, aborting."
+			return 1
+		}
+
+		echo "Deleting empty /var/lib/machines directory/subvolume"
+		rm_subvolume_or_directory /var/lib/machines || {
+			warn "fail to delete /var/lib/machines"
+			return 1
+		}
+	fi
+
+	# At this point /var/lib/machines shouldn't exist.
+	echo "Creating /var/lib/machines subvolume suitable for rollbacks."
+	mksubvolume /var/lib/machines
+}
+
+
 r=0
 fix_machine_id_perms || r=1
-fix_pre_210 || r=1
-migrate_sysconfig_i18n || r=1
 fix_bsc_1020601 || r=1
 fix_issue_11329 || r=1
 drop_after_local_support || r=1
 
+if [ $1 -gt 1 ]; then
+	# During upgrade
+	fix_machines_subvol || {
+		warn "Please fix the initialization of /var/lib/machines manually."
+		r=1
+	}
+fi
+
 exit $r

pam.systemd-run0

@@ -3,6 +3,10 @@
 #
 # Used by run0 session.
 
-account  include        common-account
-session  optional       pam_keyinit.so force revoke
-session  include        common-session
+account  include     common-account
+
+session  required    pam_selinux.so close
+session  required    pam_selinux.so open
+session  required    pam_loginuid.so
+session  optional    pam_keyinit.so force revoke
+session  include     common-session

systemd-update-helper

@@ -14,77 +14,116 @@ command -v systemctl >/dev/null || exit 0
 
 UPDATE_HELPER_USER_TIMEOUT_SEC=15
 
-case "$command" in
-    mark-install-system-units)
-        mkdir -p /run/systemd/rpm/needs-preset
+do_mark_install_units() {
+    mode=$1
+    shift
+    mkdir -p /run/systemd/rpm/$mode/{needs-preset,dont-disable}
 
-        for unit in "$@" ; do
-            if [ ! -e /usr/lib/systemd/system/"$unit" ]; then
-                touch /run/systemd/rpm/needs-preset/"$unit"
-            fi
-        done
-        ;;
+    for unit in "$@" ; do
+        # Clean any leftovers that might remain from a previous transaction
+        # which exited abnormally.
+        rm -f /run/systemd/rpm/$mode/*/"$unit"
 
-    install-system-units)
-        units=()
+        if [ ! -e /usr/lib/systemd/$mode/"$unit" ]; then
+            # The unit is being introduced: remember we need to apply preset on
+            # this new unit regardless of whether it's a package update or
+            # installation.
+            touch /run/systemd/rpm/$mode/needs-preset/"$unit"
+        fi
 
-        for unit in "$@" ; do
-            if [ -e /run/systemd/rpm/needs-preset/"$unit" ]; then
-		rm /run/systemd/rpm/needs-preset/"$unit"
-                units+=("$unit")
-            fi
-	done
+        # All passed units are part of a package being installed or updated and
+        # therefore should not be disabled by the removal of a different package
+        # part of the same rpm transaction. This can happen when the package
+        # shipping the unit is being renamed (e.g. from "A" to "B"), where "A"
+        # is installed first, followed by the removal "B". In that case, "B" is
+        # removed and its %preun scriptlet runs %systemd_preun on the unit.
+        touch /run/systemd/rpm/$mode/dont-disable/"$unit"
+    done
+}
 
-        [ ${#units[*]} -gt 0 ] &&
-                systemctl --no-reload preset "${units[@]}"
-        ;;
+do_install_units() {
+    mode=$1
+    shift
+    units=()
 
-    mark-install-user-units)
-        mkdir -p /run/systemd/rpm/needs-user-preset
+    for unit in "$@" ; do
+        if [ -e /run/systemd/rpm/$mode/needs-preset/"$unit" ]; then
+            units+=("$unit")
+        fi
+    done
 
-        for unit in "$@" ; do
-            if [ ! -e /usr/lib/systemd/user/"$unit" ]; then
-                touch /run/systemd/rpm/needs-user-preset/"$unit"
-            fi
-        done
-        ;;
+    [ ${#units[*]} -gt 0 ] && {
+        case $mode in
+        system)
+            systemctl --no-reload preset "${units[@]}" ;;
+        user)
+            systemctl --no-reload preset --global "${units[@]}" ;;
+        esac
+    }
+}
 
-    install-user-units)
-        units=()
+do_remove_units() {
+    mode=$1
+    shift
+    units=()
 
-        for unit in "$@" ; do
-            if [ -e /run/systemd/rpm/needs-user-preset/"$unit" ]; then
-                rm /run/systemd/rpm/needs-user-preset/"$unit"
-                units+=("$unit")
-            fi
-        done
+    for unit in "$@" ; do
+        if [ ! -e /run/systemd/rpm/$mode/dont-disable/"$unit" ]; then
+            units+=("$unit")
+        fi
+    done
 
-        [ ${#units[*]} -gt 0 ] &&
-            systemctl --no-reload preset --global "$@" || :
-        ;;
+    [ ${#units[*]} -eq 0 ] && return
 
-    remove-system-units)
+    case $mode in
+    system)
         if [ -d /run/systemd/system ]; then
-            systemctl --no-reload disable --now --no-warn "$@"
+            systemctl --no-reload disable --now --no-warn "${units[@]}"
         else
-            systemctl --no-reload disable --no-warn "$@"
+            systemctl --no-reload disable --no-warn "${units[@]}"
         fi
         ;;
+    user)
+        systemctl --global disable --no-warn "${units[@]}"
 
-    remove-user-units)
-        systemctl --global disable --no-warn "$@"
-
-        [ -d /run/systemd/system ] || exit 0
+        [ -d /run/systemd/system ] || return
 
         users=$(systemctl list-units 'user@*' --legend=no | sed -n -r 's/.*user@([0-9]+).service.*/\1/p')
         for user in $users; do
             SYSTEMD_BUS_TIMEOUT=${UPDATE_HELPER_USER_TIMEOUT_SEC}s \
-                    systemctl --user -M "$user@" disable --now --no-warn "$@" &
+                    systemctl --user -M "$user@" disable --now --no-warn "${units[@]}" &
         done
         wait
         ;;
+    esac
+}
 
-    mark-restart-system-units)
+case "$command" in
+    mark-install-system-units) # called from %pre (on install or upgrade)
+        do_mark_install_units system "$@"
+        ;;
+
+    mark-install-user-units)
+        do_mark_install_units user "$@"
+        ;;
+
+    install-system-units) # called from %post (on install or upgrade)
+        do_install_units system "$@"
+        ;;
+
+    install-user-units)
+        do_install_units user "$@"
+        ;;
+
+    remove-system-units) # called from %preun (on removal)
+        do_remove_units system "$@"
+        ;;
+
+    remove-user-units)
+        do_remove_units user "$@"
+        ;;
+
+    mark-restart-system-units) # called from %postun (on upgrade)
         [ -d /run/systemd/system ] || exit 0
 
         for unit in "$@"; do
@@ -106,12 +145,16 @@ case "$command" in
         wait
         ;;
 
-    system-reload-restart|system-reload|system-restart)
+    system-reload-restart|system-reload|system-restart) # called from %transfiletriggerin
         if [ -n "$*" ]; then
             echo >&2 "Unexpected arguments for '$command': $*"
             exit 2
         fi
 
+        # Clean up all flags created during executions of %pre (i.e. on
+        # install/upgrade/rename) at the very end of the transaction.
+        rm -fr /run/systemd/rpm/system
+
         [ -d /run/systemd/system ] || exit 0
 
         if [[ "$command" =~ reload ]]; then
@@ -123,12 +166,16 @@ case "$command" in
         fi
         ;;
 
-    user-reload-restart|user-reload|user-restart|user-reexec)
+    user-reload-restart|user-reload|user-restart|user-reexec) # called from %transfiletriggerin
         if [ -n "$*" ]; then
             echo >&2 "Unexpected arguments for '$command': $*"
             exit 2
         fi
 
+        # Clean up all flags created during executions of %pre (i.e. on
+        # install/upgrade/rename) at the very end of the transaction.
+        rm -fr /run/systemd/rpm/user
+
         [ -d /run/systemd/system ] || exit 0
 
         if [[ "$command" =~ reexec|reload ]]; then
@@ -146,6 +193,10 @@ case "$command" in
         fi
         ;;
 
+    clean-state)
+        # Not used anymore, to be removed
+        ;;
+
     *)
         echo >&2 "Unknown verb '$command'"
         exit 3

systemd.changes

@@ -1,3 +1,302 @@
+-------------------------------------------------------------------
+Tue Sep 16 10:32:38 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Move systemd-pcrlock out from the experimental sub-package to udev (bsc#1248261)
+
+-------------------------------------------------------------------
+Mon Sep 15 13:03:57 UTC 2025 - Valentin Lefebvre <valentin.lefebvre@suse.com>
+
+- systemd.spec: use %sysusers_generate_pre so that some systemd users are
+  already available in %pre. This is important because D-Bus automatically
+  reloads its configuration whenever new configuration files are installed,
+  i.e. between %pre and %post. (bsc#1248501)
+  
+  No needs for systemd and udev packages as they are always installed during
+  the initial installation.
+
+-------------------------------------------------------------------
+Mon Sep 15 09:04:44 UTC 2025 - Alberto Planas Dominguez <aplanas@suse.com>
+
+- Sign aarch64 and riscv systemd-boot EFI binaries (bsc#1247474)
+
+-------------------------------------------------------------------
+Tue Sep  9 08:30:35 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Import commit c139debf2c6e9556df8ee6eca77ae18d5b98f027 (merge of v257.9)
+
+  For a complete list of changes, visit:
+  https://github.com/openSUSE/systemd/compare/835af70f4e4fab4746319145d9fdb1a01e33f4c8...c139debf2c6e9556df8ee6eca77ae18d5b98f027
+
+- Rebase 5001-Revert-udev-update-devlink-with-the-newer-device-nod.patch
+
+-------------------------------------------------------------------
+Mon Aug  4 08:54:26 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Move run0 from the experimental sub-package to the main package
+
+-------------------------------------------------------------------
+Mon Aug  4 07:44:57 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Import commit 835af70f4e4fab4746319145d9fdb1a01e33f4c8
+
+  835af70f4e core/cgroup: Properly handle aborting a pending freeze operation
+  1f96f9da13 detect-virt: add bare-metal support for GCE (bsc#1244449)
+
+----------------------------------------------------------------------------
+Mon Aug  2 11:21:30 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Update pam.systemd-run0 (in the experimental sub-package)
+
+----------------------------------------------------------------------------
+Sat Aug  2 10:40:37 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Build the experimental package for the mini flavor too
+
+  Some tools in the experimental sub-package cannot be disabled at compile
+  time. Previously, these tools were manually deleted after installation to
+  prevent rpmbuild from reporting unpackaged files. However, as the number of such
+  tools continues to grow, it's simpler to include them in the mini-experimental
+  sub-package.
+
+-------------------------------------------------------------------
+Thu Jul 31 14:59:23 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Remove the script used to help migrating the language and locale settings
+  located in /etc/sysconfig/language on old systems to the systemd default
+  locations (bsc#1247074)
+
+  The script was introduced more than 7 years ago and all systems running TW
+  should have been migrated since then. Moreover the installer supports the
+  systemd default locations since approximately SLE15. 
+
+-------------------------------------------------------------------
+Mon Jul 21 08:53:43 UTC 2025 - Valentin Lefebvre <valentin.lefebvre@suse.com>
+
+- systemd-testsuite: fix Requires to systemd-ukify
+
+-------------------------------------------------------------------
+Thu Jul 17 15:25:27 UTC 2025 - Fabian Vogt <fvogt@suse.com>
+
+- Build systemd-boot for riscv64
+
+-------------------------------------------------------------------
+Tue Jul 15 17:25:48 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- systemd-update-helper: fix regression introduced when support for package
+  renaming/splitting was added (bsc#1245551)
+
+  The cleanup of the flags in /run/systemd/rpm was previously handled in the
+  %pretrans/%posttrans sections of the systemd main package. However, this
+  method was ineffective if systemd was not part of the transaction. The cleanup
+  is now run in %transfiletriggerin instead.
+
+-------------------------------------------------------------------
+Tue Jul 15 07:23:37 UTC 2025 - Valentin Lefebvre <valentin.lefebvre@suse.com>
+
+- Add sub-package for ukify binary.
+
+  move ukify from experimental package to a dedicated sub package.
+
+-------------------------------------------------------------------
+Fri Jul 11 16:52:08 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Import commit c3bcfc95582fd573e0b5686ce8115e3cf9a8122e
+
+  c3bcfc9558 uki.conf is used by the ukify tool to create an Unified Kernel Image [...]
+
+-------------------------------------------------------------------
+Fri Jul 11 14:44:12 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Make sure that the ordering trick used to update the udev package as close as
+  as possible to the update of the systemd package also works with zypper.
+
+  We also need to add "Suggests: udev", which serves the same purpose as
+  "OrderWithRequires: udev" but is part of the repository metadata. It should
+  therefore hint zypper to install systemd and udev as close together as
+  possible (see bsc#1228659)
+
+-------------------------------------------------------------------
+Fri Jul  4 14:57:26 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Move the workaround which consists in converting /var/lib/machines as a
+  separate subvolume in cases where it was incorrectly created inside a
+  snapshot.
+
+  Relocating the workaround from the systemd-container sub-package to the main
+  package ensures it's applied on old systems where it's still needed [1] even
+  if the systemd-container sub-package is not installed.
+
+  This change should allow us to eventually drop the workaround in the future.
+
+  [1] The workaround is required on legacy installations (those made more than
+  eight years ago) where /var was not a separate subvolume.
+
+-------------------------------------------------------------------
+Fri Jul  4 12:43:24 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- triggers.systemd: skip update of hwdb, journal-catalog if executed during
+  an offline update.
+
+-------------------------------------------------------------------
+Tue Jul  1 10:05:12 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Import commit a0dfd5de4cdc3f97ef2ad23396904f3e20769317 (merge of v257.7)
+
+  For a complete list of changes, visit:
+  https://github.com/openSUSE/systemd/compare/1e42ecf5a145589954df77da05937ee69619f3e5...a0dfd5de4cdc3f97ef2ad23396904f3e20769317
+
+-------------------------------------------------------------------
+Thu Jun 19 12:42:37 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Import commit 1e42ecf5a145589954df77da05937ee69619f3e5
+
+  1e42ecf5a1 firstboot: make sure labelling is enabled
+  3bdb2efbe0 tmpfiles: fix symlink creation when replacing
+  61c228d2cc firstboot: use WRITE_STRING_FILE_LABEL more
+  f5148acf37 env-file: port write_env_file() to label_ops_pre()
+  bbff8b5523 fs-util: replace symlink_atomic_full_label() by a flag to symlinkat_atomic_full() (bsc#1244237)
+  2b39393efa env-file: rework write_env_file() to make use of O_TMPFILE
+
+-------------------------------------------------------------------
+Mon Jun  2 06:51:45 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Import commit c929295b4c1fb3cd6b9963bc7588fbc3e597ab86 (merge of v257.6)
+
+  This merge includes the following fix:
+
+    c58a8a6ec9 coredump: use %d in kernel core pattern (bsc#1243935 CVE-2025-4598)
+
+  For a complete list of changes, visit:
+  https://github.com/openSUSE/systemd/compare/8e9840a2897e36ae3f926f8d10a2b0d7e4102c67...c929295b4c1fb3cd6b9963bc7588fbc3e597ab86
+
+-------------------------------------------------------------------
+Fri May 16 10:49:22 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Import commit 8e9840a2897e36ae3f926f8d10a2b0d7e4102c67 (bsc#1243280)
+
+  8e9840a289 bless-boot: never try to rename an entry file onto itself
+  5b5cde8866 bless-boot: in "status" output report bad state from prev boot as "dirty"
+  49949fa9fb bless-boot: switch from last_path_component() to path_find_last_component()
+
+-------------------------------------------------------------------
+Thu May 15 12:04:47 UTC 2025 - Fabian Vogt <fvogt@suse.com>
+
+- systemd-update-helper: Fix invalid use of "break" in case statement
+
+-------------------------------------------------------------------
+Tue Apr 22 15:06:19 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- systemd-update-helper: do not stop or disable services when they are migrated
+  to other packages. This can occur during package renaming or splitting.
+
+-------------------------------------------------------------------
+Wed Apr 16 14:09:42 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Split systemd-network into two new sub-packages: systemd-networkd and
+  systemd-resolved (bsc#1224386 jsc#PED-12669)
+
+-------------------------------------------------------------------
+Fri Apr  4 08:43:26 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Import commit c10a66fb4dd34b86d42fa92501bd88db63df479a (merge of v257.5)
+
+  This merge includes the following fixes:
+
+    9b52c10986 test-network: replace symlink to 99-default.link with a copy
+    d7577221b8 man/pstore.conf: pstore.conf template is not always installed in /etc
+    62071a984d man: coredump.conf template is not always installed in /etc (bsc#1237496)
+    18dde3dd2a umount: do not move busy network mounts (bsc#1236177)
+
+  For a complete list of changes, visit:
+  https://github.com/openSUSE/systemd/compare/f133e5974e69708d7491d4823780690c913f7bda...c10a66fb4dd34b86d42fa92501bd88db63df479a
+
+-------------------------------------------------------------------
+Wed Mar 12 20:21:42 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- triggers.systemd: more posix.fork() conversion (bsc#1238566)
+
+-------------------------------------------------------------------
+Wed Mar 12 14:41:02 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Import commit f133e5974e69708d7491d4823780690c913f7bda (merge of v257.4)
+
+  For a complete list of changes, visit:
+  https://github.com/openSUSE/systemd/compare/e03ffd74c4a30c1c75e05874ce18d31e503437b7...f133e5974e69708d7491d4823780690c913f7bda
+
+-------------------------------------------------------------------
+Mon Mar  3 09:56:53 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Name libsystemd-{shared,core} based on the major version of systemd and the
+  package release number (bsc#1228081)
+
+  This way, both the old and new versions of these shared libraries will be
+  present during the update. This should prevent issues during package updates
+  when incompatible changes are introduced in the new versions of these shared
+  libraries.
+
+  Note: these libraries are private so only binaries shipped by systemd and its
+  sub-packages can be linked against them.
+
+-------------------------------------------------------------------
+Wed Feb 26 09:39:53 UTC 2025 - Luca Boccassi <luca.boccassi@gmail.com>
+
+- Move 20-systemd-stub.conf tmpfiles.d from the systemd-boot
+  package to the systemd main package, as it is needed in the
+  initrd to copy stuff from /.extra to /run/systemd/stub.
+  Installing systemd-boot in the initrd is not the right approach,
+  as that pulls in the bootloader and other files that have no use
+  in the initrd and just take up space. The main package is always
+  in the initrd, so it's the right place to ensure that, if
+  systemd-boot is used, the snippet is present, and it will be a
+  no-op otherwise.
+
+-------------------------------------------------------------------
+Fri Feb 14 09:00:29 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Import commit e03ffd74c4a30c1c75e05874ce18d31e503437b7 (merge of v257.3)
+
+  For a complete list of changes, visit:
+  https://github.com/openSUSE/systemd/compare/47794646786ae4ddb6d3deb2030e2761447999ec...e03ffd74c4a30c1c75e05874ce18d31e503437b7
+
+-------------------------------------------------------------------
+Wed Feb 12 14:12:10 UTC 2025 - Thorsten Kukuk <kukuk@suse.com>
+
+- Enable systemd-sysupdated and updatectl as experimental subpackage
+
+-------------------------------------------------------------------
+Fri Feb  7 14:14:01 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Import commit 47794646786ae4ddb6d3deb2030e2761447999ec
+
+  4779464678 import-pubring.gpg: add openSUSE build key (bsc#1236751)
+  2c8382881f systemd-pull: support .asc and .sha256.* signature (bsc#1236887)
+
+-------------------------------------------------------------------
+Tue Feb  4 17:12:46 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- triggers.systemd: convert posix.fork() and posix.exec() to rpm.execute() (bsc#1236741)
+
+-------------------------------------------------------------------
+Tue Feb  4 10:51:41 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Update 0009-pid1-handle-console-specificities-weirdness-for-s390.patch to not
+  warn when "conmode=" is not specified on s390x (bsc#1236725).
+
+-------------------------------------------------------------------
+Tue Feb  4 09:05:34 UTC 2025 - Franck Bui <fbui@suse.com>
+
+- Move systemd-userwork from the experimental sub-package to the main package (bsc#1236643)
+
+  It is likely an oversight from when systemd-userdb was migrated from the
+  experimental package to the main one. 
+
+-------------------------------------------------------------------
+Thu Jan 30 15:28:33 UTC 2025 - Michal Koutný <mkoutny@suse.com>
+
+- Drop 5004-disable-session-freeze.patch since the kernel fix commit
+  d96c77bd4eeba ("KVM: x86: switch hugepage recovery thread to vhost_task")
+  v6.13-rc1~97^2~3 is in Tumbleweed kernel
+
 -------------------------------------------------------------------
 Wed Jan  8 16:43:48 UTC 2025 - Franck Bui <fbui@suse.com>
 
@@ -27,6 +326,7 @@ Thu Dec 26 10:07:33 UTC 2024 - Franck Bui <fbui@suse.com>
 
     - commit 9258e27f4a1ddf2834d0cadd66770ad65e55e066 (boo#1233752, bsc#1234313)
     - commit 423de11f046cc2c9b6904e4eff71d6a48cd661c9 (boo#1233752, bsc#1234313)
+    - commit 2ae79a31b7c7947e2c16e18eb85ac5607ebc40b6 (bsc#1232844)
 
 - Drop 5006-tpm2-util-Also-retry-unsealing-after-policy_pcr-retu.patch and
   5005-Revert-boot-Make-initrd_prepare-semantically-equival.patch
@@ -39,6 +339,11 @@ Thu Dec 26 10:07:33 UTC 2024 - Franck Bui <fbui@suse.com>
   for details. For running the testsuite, the systemd git repository has to be
   cloned for now. We'll try to adapt the testsuite sub-package these changes.
 
+-------------------------------------------------------------------
+Tue Dec 24 08:43:42 UTC 2024 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- Fix systemd-network recommending libidn2-devel (boo#1234765)
+
 -------------------------------------------------------------------
 Sun Dec 22 17:31:07 UTC 2024 - Franck Bui <fbui@suse.com>
 
@@ -218,6 +523,9 @@ Thu Jul  4 09:07:28 UTC 2024 - Franck Bui <fbui@suse.com>
   - This includes the following bug fixes:
 
     - commit 3b2e7dc5a285edbbb1bf6aed2d88b889d801613f (bsc#1234015)
+    - commit c072860593329293e19580b337504adb52248462 (bsc#1229518)
+    - commit cfbf7538d87023840c5574fa5b0452e5b0f42149 (bsc#1229228)
+    - commit 3c85d3fda50f71755aa276cfa60807c315bfc04b (bsc#1236886)
 
   - Added pam.systemd-run0
 

systemd.spec

@@ -1,7 +1,8 @@
 #
-# spec file
+# spec file for package systemd
 #
 # Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2025 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -25,13 +26,16 @@
 %define systemd_version    %{?version_override}%{!?version_override:%(cat meson.version)}
 %define systemd_release    %{?release_override}%{!?release_override:0}
 %define archive_version    %{nil}
-%else
-%define systemd_version    257.2
-%define systemd_release    0
-%define archive_version    %{nil}
 %endif
 
-%define systemd_major      %{sub %systemd_version 1 3}
+# Enable this feature if the package version is set by obs-service-set_version.
+%bcond_with obs_service_set_version
+
+%if %{without obs_service_set_version}
+%define systemd_version    257.9
+%define systemd_release    0
+%define archive_version    +suse.23.gc139debf2c
+%endif
 
 %define _testsuitedir %{_systemd_util_dir}/tests
 %define xinitconfdir  %{?_distconfdir}%{!?_distconfdir:%{_sysconfdir}}/X11/xinit
@@ -63,14 +67,13 @@
 %bcond_without  networkd
 %bcond_without  portabled
 %bcond_without  resolved
-%ifarch %{ix86} x86_64 aarch64
+%ifarch %{ix86} x86_64 aarch64 riscv64
 %bcond_without  sd_boot
 %else
 %bcond_with     sd_boot
 %endif
 %bcond_without  selinux
 %bcond_without  sysvcompat
-%bcond_without  experimental
 %bcond_without  testsuite
 %endif
 
@@ -82,8 +85,8 @@
 
 Name:           systemd%{?mini}
 URL:            http://www.freedesktop.org/wiki/Software/systemd
-Version:        %systemd_version
-Release:        %systemd_release
+Version:        %{?systemd_version}
+Release:        0%{?systemd_release}
 Summary:        A System and Session Manager
 License:        LGPL-2.1-or-later
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
@@ -123,6 +126,7 @@ BuildRequires:  meson >= 0.53.2
 BuildRequires:  pam-devel
 BuildRequires:  python3-Jinja2
 BuildRequires:  systemd-rpm-macros
+BuildRequires:  sysuser-tools
 BuildRequires:  pkgconfig(blkid) >= 2.26
 # The following packages are only required by the execution of the unit tests
 # during the 'check' section.
@@ -156,14 +160,17 @@ Requires(post): coreutils
 Requires(post): findutils
 Requires(post): systemd-presets-branding
 Requires(post): pam-config >= 0.79-5
-# See bsc#1228659
-OrderWithRequires(post): udev
-OrderWithRequires(post): systemd-boot
 # These weak dependencies because some features are optional and enabled at
 # runtime with the presence of the relevant libs.
 Recommends:     libpcre2-8-0
 Recommends:     libbpf1
 %endif
+# These 2 dependencies (the first for rpm the second for zypper) ensure that
+# udev and systemd are updated as close together as possible in order to reduce
+# the window during which libsystemd-shared.so has been updated but udev has not
+# and still relies on the old version of the shared lib (see bsc#1228659).
+OrderWithRequires(post): udev
+Suggests:       udev
 Provides:       group(systemd-journal)
 Conflicts:      filesystem < 11.5
 Provides:       sbin_init
@@ -182,7 +189,7 @@ Provides:       systemd-analyze = %{version}-%{release}
 Obsoletes:      pm-utils <= 1.4.1
 Obsoletes:      suspend <= 1.0
 Obsoletes:      systemd-analyze < 201
-Source0:        systemd-v%{version}%{archive_version}.tar.xz
+Source0:        systemd-%{version}%{?archive_version}.tar.xz
 Source1:        systemd-rpmlintrc
 Source3:        systemd-update-helper
 %if %{with sysvcompat}
@@ -195,22 +202,23 @@ Source8:        pam.systemd-user
 Source9:        pam.systemd-run0
 Source14:       kbd-model-map.legacy
 
-Source100:      fixlet-container-post.sh
 Source101:      fixlet-systemd-post.sh
 
 Source200:      files.systemd
 Source201:      files.udev
 Source202:      files.container
-Source203:      files.network
+Source203:      files.networkd
 Source204:      files.devel
 Source205:      files.sysvcompat
 Source206:      files.uefi-boot
 Source207:      files.experimental
+Source208:      files.resolved
 Source209:      files.homed
 Source210:      files.lang
 Source211:      files.journal-remote
 Source212:      files.portable
 Source213:      files.devel-doc
+Source214:      files.ukify
 
 #
 # All changes backported from upstream are tracked by the git repository, which
@@ -239,7 +247,6 @@ Patch:          0009-pid1-handle-console-specificities-weirdness-for-s390.patch
 # and will be removed as soon as a proper fix is merged by upstream.
 Patch:          5001-Revert-udev-update-devlink-with-the-newer-device-nod.patch
 Patch:          5002-Revert-udev-revert-workarounds-for-issues-caused-by-.patch
-Patch:          5004-disable-session-freeze.patch
 %endif
 
 %description
@@ -331,7 +338,7 @@ Requires:       filesystem
 %if %{without bootstrap}
 # kmod executable is needed by kmod-static-nodes.service
 Requires:       kmod
-# By v256 libkmod will be dlopen()ed.
+# From v256 libkmod is dlopen()ed.
 Requires:       libkmod2
 %endif
 Requires:       system-group-hardware
@@ -342,7 +349,7 @@ Requires:       group(lp)
 Requires(pre):  group(kvm)
 Requires(post): sed
 Requires(post): coreutils
-Requires(postun):coreutils
+Requires(postun): coreutils
 # 'regenerate_initrd_post' macro is expanded during build, hence this BR.
 BuildRequires:  suse-module-tools
 %if %{without bootstrap}
@@ -473,29 +480,47 @@ UID/GIDs ranges used by containers to useful names.
 To activate this NSS module, you will need to include it in /etc/nsswitch.conf,
 see nss-mymachines(8) manpage for more details.
 
-%if %{with networkd} || %{with resolved}
-%package network
-Summary:        Systemd Network And Network Name Resolution Managers
+%if %{with networkd}
+%package networkd
+Summary:        Systemd Network Manager
 License:        LGPL-2.1-or-later
 Requires:       %{name} = %{version}-%{release}
 %systemd_requires
-# This Recommends because some symbols of libidn2 are dlopen()ed by resolved
-Recommends:     pkgconfig(libidn2)
-BuildRequires:  pkgconfig(libidn2)
-BuildRequires:  pkgconfig(openssl)
-Obsoletes:      nss-resolve < %{version}-%{release}
-Provides:       nss-resolve = %{version}-%{release}
-Provides:       systemd:/usr/lib/systemd/systemd-networkd
-Provides:       systemd:/usr/lib/systemd/systemd-resolved
+%sysusers_requires
+Obsoletes:      systemd-network < %{version}-%{release}
+Provides:       systemd-network = %{version}-%{release}
+Provides:       systemd-network:/usr/lib/systemd/systemd-networkd
+# Workaround for bsc#1241513 and libzypp: ensure systemd-resolved is always
+# installed before systemd-network is being removed when the latter is replaced
+# by both systemd-resolved and systemd-networkd. The systemd-update-helper
+# script logic depends on it.
+Suggests:       systemd-resolved
 
-%description network
+%description networkd
 systemd-networkd is a system service that manages networks. It detects and
 configures network devices as they appear, as well as manages network addresses
 and routes for any link for which it finds a .network file, see
 systemd.network(5). It can also create virtual network devices based on their
 description given by systemd.netdev(5) files. It may be controlle by
 networkctl(1).
+%endif
 
+%if %{with resolved}
+%package resolved
+Summary:        Systemd Network Name Resolution Manager
+License:        LGPL-2.1-or-later
+Requires:       %{name} = %{version}-%{release}
+%systemd_requires
+%sysusers_requires
+# This Recommends because some symbols of libidn2 are dlopen()ed by resolved
+Recommends:     libidn2
+BuildRequires:  pkgconfig(libidn2)
+BuildRequires:  pkgconfig(openssl)
+Obsoletes:      nss-resolve < %{version}-%{release}
+Provides:       nss-resolve = %{version}-%{release}
+Provides:       systemd-network:/usr/lib/systemd/systemd-resolved
+
+%description resolved
 systemd-resolved is a system service that provides network name resolution to
 local applications. It implements a caching and validating DNS/DNSSEC stub
 resolver, as well as an LLMNR and MulticastDNS resolver and responder. It may be
@@ -640,19 +665,15 @@ Requires:       pkgconfig(libarchive)
 Requires:       pkgconfig(libfido2)
 Requires:       pkgconfig(libidn2)
 Requires:       pkgconfig(libkmod)
-%if %{with experimental}
 Requires:       pkgconfig(libqrencode)
 Requires:       pkgconfig(pwquality)
-%endif
 Requires:       pkgconfig(tss2-esys)
 Requires:       pkgconfig(tss2-mu)
 Requires:       pkgconfig(tss2-rc)
 %if %{with sd_boot}
 Requires:       systemd-boot
 %endif
-%if %{with experimental}
 Requires:       systemd-experimental
-%endif
 %if %{with homed}
 Requires:       systemd-homed
 %endif
@@ -660,11 +681,14 @@ Requires:       systemd-homed
 Requires:       systemd-journal-remote
 %endif
 %if %{with networkd}
-Requires:       systemd-network
+Requires:       systemd-networkd
 %endif
 %if %{with portabled}
 Requires:       systemd-portable
 %endif
+%if %{with sd_boot}
+Requires:       systemd-ukify
+%endif
 Requires:       xz
 
 %description testsuite
@@ -688,12 +712,15 @@ For more details on the available options to run the extended testsuite, please
 refer to %{_testsuitedir}/integration-tests/README.testsuite.
 %endif
 
-%if %{with experimental}
 %package experimental
 Summary:        Experimental systemd features
 License:        LGPL-2.1-or-later
 Requires:       %{name} = %{version}-%{release}
 %systemd_requires
+%if %{with bootstrap}
+Conflicts:      systemd-experimental
+Provides:       systemd-experimental = %{version}-%{release}
+%endif
 
 %description experimental
 This package contains optional extra services that are considered as previews
@@ -709,10 +736,25 @@ Components that turn out to be stable and considered as fully supported will be
 merged into the main package or moved into a dedicated package.
 
 Currently this package contains the following features : bsod, oomd, measure,
-pcrextend, pcrlock, run0, ssh-generator, storagetm, systemd-vmspawn, sysupdate,
-tpm2-setup, userwork and ukify.
+pcrextend, pcrlock, ssh-generator, storagetm, systemd-vmspawn, sysupdate,
+tpm2-setup and userwork.
 
 Have fun (at your own risk).
+
+%if %{with sd_boot}
+%package ukify
+Summary:        Tool to build Unified Kernel Image
+License:        LGPL-2.1-or-later
+BuildArch:      noarch
+Requires:       %{name} = %{version}-%{release}
+Requires:       python3-cryptography
+Requires:       python3-pefile
+Requires:       systemd-boot
+
+%description ukify
+This package provides ukify, a script that combines a kernel image, an initrd,
+with a command line, and possibly PCR measurements and other metadata, into a
+Unified Kernel Image (UKI).
 %endif
 
 %if %{without bootstrap}
@@ -729,12 +771,19 @@ for the C APIs.
 %endif
 
 %prep
-%autosetup -p1 -n systemd-v%{version}%{archive_version}
+%autosetup -p1 -n systemd-%{version}%{?archive_version}
+
+# When building on OBS with version substitution, systemd_version is not
+# defined, and the "Version:" field contains the base version plus the archive
+# version. Therefore, recompute the base version so it can be used seamlessly to
+# name the private shared libraries.
+%global base_version %(v=%{version}; echo ${v%%+*})
 
 %build
 %meson \
         -Dmode=release \
-        -Dversion-tag=%{version}%{archive_version} \
+        -Dversion-tag=%{version}%{?archive_version} \
+        -Dshared-lib-tag=%{base_version}-%{release} \
         -Ddocdir=%{_docdir}/systemd \
         -Dconfigfiledir=/usr/lib \
         -Dsplit-bin=true \
@@ -745,7 +794,6 @@ for the C APIs.
         -Dwheel-group=false \
         -Dgroup-render-mode=0660 \
         -Dutmp=false \
-        -Ddefault-hierarchy=unified \
         -Ddefault-kill-user-processes=false \
         -Dpamconfdir=no \
         -Dpamlibdir=%{_pam_moduledir} \
@@ -837,6 +885,7 @@ for the C APIs.
         -Dbootloader=%{enabled_with sd_boot} \
         -Defi=%{when sd_boot} \
         -Defi-color-highlight="black,green" \
+        -Dukify=%{enabled_with sd_boot} \
         \
         -Dsbat-distro="%{?sbat_distro}" \
         -Dsbat-distro-summary="%{?sbat_distro_summary}" \
@@ -850,19 +899,13 @@ for the C APIs.
         -Ddns-over-tls=%{when resolved openssl} \
         -Dresolve=%{when resolved} \
         \
-        -Doomd=%{when experimental} \
-%if %{with experimental}
+        -Doomd=%{when_not bootstrap} \
         -Dsshdconfdir=%{_distconfdir}/ssh/sshd_config.d \
         -Dsshconfdir=%{_distconfdir}/ssh/ssh_config.d \
-        -Dukify=%{enabled_with sd_boot} \
-%else
-        -Dsshdconfdir=no \
-        -Dsshconfdir=no \
-        -Dukify=disabled \
-%endif
         -Dsshdprivsepdir=no \
-        -Dsysupdate=%{enabled_with experimental} \
-        -Dvmspawn=%{enabled_with experimental} \
+        -Dsysupdate=%{when_not bootstrap} \
+        -Dsysupdated=%{disabled_with bootstrap} \
+        -Dvmspawn=%{disabled_with bootstrap} \
         \
         -Dtests=%{when testsuite unsafe} \
         -Dinstall-tests=%{when testsuite} \
@@ -878,6 +921,12 @@ for the C APIs.
 %ifarch x86_64
 export BRP_PESIGN_FILES="%{_systemd_util_dir}/boot/efi/systemd-bootx64.efi"
 %endif
+%ifarch aarch64
+export BRP_PESIGN_FILES="%{_systemd_util_dir}/boot/efi/systemd-bootaa64.efi"
+%endif
+%ifarch riscv64
+export BRP_PESIGN_FILES="%{_systemd_util_dir}/boot/efi/systemd-bootriscv64.efi"
+%endif
 %endif
 
 # Don't ship resolvconf symlink for now as it conflicts with the binary shipped
@@ -894,9 +943,6 @@ install -m0755 -D %{SOURCE4} %{buildroot}/%{_systemd_util_dir}/systemd-sysv-inst
 
 # Install the fixlets
 mkdir -p %{buildroot}%{_systemd_util_dir}/rpm
-%if %{with machined}
-install -m0755 %{SOURCE100} %{buildroot}%{_systemd_util_dir}/rpm/
-%endif
 install -m0755 %{SOURCE101} %{buildroot}%{_systemd_util_dir}/rpm/
 
 # Make sure /usr/lib/modules-load.d exists in udev(-mini)?, so other
@@ -910,9 +956,7 @@ rm -f %{buildroot}%{_sysconfdir}/systemd/system/default.target
 
 # Replace upstream PAM configuration files with openSUSE ones.
 install -m0644 -D %{SOURCE8} %{buildroot}%{_pam_vendordir}/systemd-user
-%if %{with experimental}
 install -m0644 -D %{SOURCE9} %{buildroot}%{_pam_vendordir}/systemd-run0
-%endif
 
 # Don't enable wall ask password service, it spams every console (bnc#747783).
 rm %{buildroot}%{_unitdir}/multi-user.target.wants/systemd-ask-password-wall.path
@@ -1053,15 +1097,12 @@ cat %{SOURCE14} >>%{buildroot}%{_datarootdir}/systemd/kbd-model-map
 # -Dinstall_test took care of installing the unit tests only (those in
 # src/tests) and testdata directory. Here we copy the integration tests
 # including also all related scripts used to prepare and run the integration
-# tests in dedicated VMs. During the copy, all symlinks are replaced by the
-# files they point to making sure we won't try to embed dangling symlinks.
+# tests in dedicated VMs.
 mkdir -p %{buildroot}%{_testsuitedir}/integration-tests
 tar -cO \
-    --dereference \
-    --exclude=testdata \
     --exclude-vcs  \
     --exclude-vcs-ignores \
-    -C test/ . | tar -xC %{buildroot}%{_testsuitedir}/integration-tests
+    -C test/integration-tests/ . | tar -xC %{buildroot}%{_testsuitedir}/integration-tests/
 %endif
 
 %if %{without bootstrap}
@@ -1069,11 +1110,14 @@ tar -cO \
 %else
 rm -f  %{buildroot}%{_journalcatalogdir}/*
 rm -fr %{buildroot}%{_docdir}/systemd
-rm -f %{buildroot}%{_bindir}/run0
-rm -f %{buildroot}%{_systemdgeneratordir}/systemd-ssh-generator
-rm -f %{buildroot}%{_systemdgeneratordir}/systemd-tpm2-generator
-rm -f %{buildroot}%{_unitdir}/systemd-nspawn@.service
-rm -f %{buildroot}%{_systemd_util_dir}/systemd-ssh-proxy
+%endif
+
+# Generate system users for pre scriptlets.
+%if %{with resolved}
+%sysusers_generate_pre %{buildroot}/%{_sysusersdir}/systemd-resolve.conf systemd-resolve systemd-resolve.conf
+%endif
+%if %{with networkd}
+%sysusers_generate_pre %{buildroot}/%{_sysusersdir}/systemd-network.conf systemd-network systemd-network.conf
 %endif
 
 # Don't drop the following 'pre' section even if it becomes empty: the build
@@ -1152,8 +1196,6 @@ journalctl --update-catalog || :
 %systemd_postun_with_restart systemd-userdbd.service
 
 %pre -n udev%{?mini}
-# Units listed below can be enabled at installation accoding to their preset
-# setting.
 %systemd_pre remote-cryptsetup.target
 %systemd_pre systemd-pstore.service
 %systemd_pre systemd-timesyncd.service
@@ -1226,7 +1268,6 @@ fi
 %systemd_post systemd-mountfsd.socket
 %systemd_post systemd-nsresourced.socket
 %systemd_post machines.target
-%{_systemd_util_dir}/rpm/fixlet-container-post.sh $1 || :
 %endif
 
 %if %{with journal_remote}
@@ -1255,53 +1296,45 @@ fi
 %systemd_postun_with_restart systemd-journal-upload.service
 %endif
 
-%if %{with networkd} || %{with resolved}
-%pre network
 %if %{with networkd}
+%pre networkd -f systemd-network.pre
 %systemd_pre systemd-networkd.service
 %systemd_pre systemd-networkd-wait-online.service
-%endif
-%if %{with resolved}
-%systemd_pre systemd-resolved.service
-%endif
 
-%post network
-%if %{with networkd}
+%post networkd
 %if %{without filetriggers}
-%sysusers_create systemd-network.conf
 %tmpfiles_create systemd-network.conf
 %endif
 %systemd_post systemd-networkd.service
 %systemd_post systemd-networkd-wait-online.service
-%endif
-%if %{with resolved}
-%ldconfig
-%if %{without filetriggers}
-%sysusers_create systemd-resolve.conf
-%tmpfiles_create systemd-resolve.conf
-%endif
-%systemd_post systemd-resolved.service
-%endif
 
-%preun network
-%if %{with networkd}
+%preun networkd
 %systemd_preun systemd-networkd.service
 %systemd_preun systemd-networkd-wait-online.service
-%endif
-%if %{with resolved}
-%systemd_preun systemd-resolved.service
-%endif
 
-%postun network
-%if %{with networkd}
+%postun networkd
 %systemd_postun systemd-networkd.service
 %systemd_postun systemd-networkd-wait-online.service
 %endif
+
 %if %{with resolved}
+%pre resolved -f systemd-resolve.pre
+%systemd_pre systemd-resolved.service
+
+%post resolved
+%ldconfig
+%if %{without filetriggers}
+%tmpfiles_create systemd-resolve.conf
+%endif
+%systemd_post systemd-resolved.service
+
+%preun resolved
+%systemd_preun systemd-resolved.service
+
+%postun resolved
 %ldconfig
 %systemd_postun systemd-resolved.service
 %endif
-%endif
 
 %if %{with homed}
 %pre homed
@@ -1340,23 +1373,25 @@ fi
 %systemd_postun_with_restart systemd-portabled.service
 %endif
 
-%if %{with experimental}
-%pre experimental
-%systemd_pre systemd-oomd.service systemd-oomd.socket
-
 %post experimental
 %if %{without filetriggers}
+%if %{without bootstrap}
 %sysusers_create systemd-oom.conf
 %endif
-%systemd_post systemd-oomd.service systemd-oomd.socket
-
-%preun experimental
-%systemd_preun systemd-oomd.service systemd-oomd.socket
-
-%postun experimental
-%systemd_postun systemd-oomd.service systemd-oomd.socket
 %endif
 
+# Keep the clean section until the following issue is solved:
+# https://github.com/rpm-software-management/rpm/issues/3658
+%clean
+rm -rf \
+    $RPM_BUILD_ROOT \
+    %{name}.lang \
+    debugfiles.list \
+    debuglinks.list \
+    debugsourcefiles.list \
+    debugsources.list \
+    elfbins.list
+
 # File trigger definitions
 %if %{with filetriggers}
 %include %{SOURCE7}
@@ -1376,11 +1411,16 @@ fi
 %files container
 %include %{SOURCE202}
 
-%if %{with networkd} || %{with resolved}
-%files network
+%if %{with networkd}
+%files networkd
 %include %{SOURCE203}
 %endif
 
+%if %{with resolved}
+%files resolved
+%include %{SOURCE208}
+%endif
+
 %files devel
 %license LICENSE.LGPL2.1
 %include %{SOURCE204}
@@ -1409,6 +1449,9 @@ fi
 %include %{SOURCE213}
 %endif
 
+%files experimental
+%include %{SOURCE207}
+
 %if %{with journal_remote}
 %files journal-remote
 %include %{SOURCE211}
@@ -1426,13 +1469,13 @@ fi
 
 %if %{with testsuite}
 %files testsuite
-%doc %{_testsuitedir}/integration-tests/README.testsuite
+%doc %{_testsuitedir}/integration-tests/README.md
 %{_testsuitedir}
 %endif
 
-%if %{with experimental}
-%files experimental
-%include %{SOURCE207}
+%if %{with sd_boot}
+%files ukify
+%include %{SOURCE214}
 %endif
 
 %changelog

triggers.systemd

@@ -6,27 +6,17 @@
 
 # The contents of this are an example to be copied into systemd.spec.
 #
-# Minimum rpm version supported: 4.14.0
+# Minimum rpm version supported: 4.15.0
 
 %transfiletriggerin -P 900900 -p <lua> -- /usr/lib/systemd/system /etc/systemd/system
 -- This script will run after any package is initially installed or
 -- upgraded. We care about the case where a package is initially
 -- installed, because other cases are covered by the *un scriptlets,
 -- so sometimes we will reload needlessly.
-pid = posix.fork()
-if pid == 0 then
-    assert(posix.exec("/usr/lib/systemd/systemd-update-helper", "system-reload-restart"))
-elseif pid > 0 then
-    posix.wait(pid)
-end
+assert(rpm.execute("/usr/lib/systemd/systemd-update-helper", "system-reload-restart"))
 
 %transfiletriggerin -P 900899 -p <lua> -- /usr/lib/systemd/user /etc/systemd/user
-pid = posix.fork()
-if pid == 0 then
-    assert(posix.exec("/usr/lib/systemd/systemd-update-helper", "user-reload-restart"))
-elseif pid > 0 then
-    posix.wait(pid)
-end
+assert(rpm.execute("/usr/lib/systemd/systemd-update-helper", "user-reload-restart"))
 
 %transfiletriggerpostun -P 1000100 -p <lua> -- /usr/lib/systemd/system /etc/systemd/system
 -- On removal, we need to run daemon-reload after any units have been
@@ -34,45 +24,25 @@ end
 -- On upgrade, we need to run daemon-reload after any new unit files
 -- have been installed, but before %postun scripts in packages get
 -- executed.
-pid = posix.fork()
-if pid == 0 then
-    assert(posix.exec("/usr/lib/systemd/systemd-update-helper", "system-reload"))
-elseif pid > 0 then
-    posix.wait(pid)
-end
+assert(rpm.execute("/usr/lib/systemd/systemd-update-helper", "system-reload"))
 
-%transfiletriggerpostun -P 1000100 -p <lua> -- /usr/lib/systemd/system /etc/systemd/system
+%transfiletriggerpostun -P 1000100 -p <lua> -- /usr/lib/systemd/user /etc/systemd/user
 -- Execute daemon-reload in user managers.
-pid = posix.fork()
-if pid == 0 then
-    assert(posix.exec("/usr/lib/systemd/systemd-update-helper", "user-reload"))
-elseif pid > 0 then
-    posix.wait(pid)
-end
+assert(rpm.execute("/usr/lib/systemd/systemd-update-helper", "user-reload"))
 
 %transfiletriggerpostun -P 10000 -p <lua> -- /usr/lib/systemd/system /etc/systemd/system
 -- We restart remaining system services that should be restarted here.
-pid = posix.fork()
-if pid == 0 then
-    assert(posix.exec("/usr/lib/systemd/systemd-update-helper", "system-restart"))
-elseif pid > 0 then
-    posix.wait(pid)
-end
+assert(rpm.execute("/usr/lib/systemd/systemd-update-helper", "system-restart"))
 
 %transfiletriggerpostun -P 9999 -p <lua> -- /usr/lib/systemd/user /etc/systemd/user
 -- We restart remaining user services that should be restarted here.
-pid = posix.fork()
-if pid == 0 then
-    assert(posix.exec("/usr/lib/systemd/systemd-update-helper", "user-restart"))
-elseif pid > 0 then
-    posix.wait(pid)
-end
+assert(rpm.execute("/usr/lib/systemd/systemd-update-helper", "user-restart"))
 
 %transfiletriggerin -P 1000700 -p <lua> -- /usr/lib/sysusers.d
 -- This script will process files installed in /usr/lib/sysusers.d to create
 -- specified users automatically. The priority is set such that it
 -- will run before the tmpfiles file trigger.
--- Note: /run is never mounted during transactional updates.
+-- Note: this should be skipped during offline updates.
 if posix.access("/run/systemd/system") then
     assert(rpm.execute("systemd-sysusers"))
 end
@@ -81,31 +51,32 @@ end
 %transfiletriggerin -P 1000700 -n udev -p <lua> -- /usr/lib/udev/hwdb.d
 -- This script will automatically invoke hwdb update if files have been
 -- installed or updated in /usr/lib/udev/hwdb.d.
-assert(rpm.execute("systemd-hwdb", "update"))
+-- Note: this should be skipped during offline updates.
+if posix.access("/run/systemd/system") then
+    assert(rpm.execute("systemd-hwdb", "update"))
+end
 %endif
 
 %transfiletriggerin -P 1000700 -p <lua> -- /usr/lib/systemd/catalog
 -- This script will automatically invoke journal catalog update if files
 -- have been installed or updated in /usr/lib/systemd/catalog.
-assert(rpm.execute("journalctl", "--update-catalog"))
+-- Note: this should be skipped during offline updates.
+if posix.access("/run/systemd/system") then
+    assert(rpm.execute("journalctl", "--update-catalog"))
+end
 
 %transfiletriggerin -P 1000700 -p <lua> -- /usr/lib/binfmt.d
 -- This script will automatically apply binfmt rules if files have been
 -- installed or updated in /usr/lib/binfmt.d.
 if posix.access("/run/systemd/system") then
-    pid = posix.fork()
-    if pid == 0 then
-        assert(posix.exec("/usr/lib/systemd/systemd-binfmt"))
-    elseif pid > 0 then
-        posix.wait(pid)
-    end
+    assert(rpm.execute("/usr/lib/systemd/systemd-binfmt"))
 end
 
 %transfiletriggerin -P 1000600 -p <lua> -- /usr/lib/tmpfiles.d
 -- This script will process files installed in /usr/lib/tmpfiles.d to create
 -- tmpfiles automatically. The priority is set such that it will run
 -- after the sysusers file trigger, but before any other triggers.
--- Note: /run is never mounted during transactional updates.
+-- Note: this should be skipped during offline updates.
 if posix.access("/run/systemd/system") then
     assert(rpm.execute("systemd-tmpfiles", "--create"))
 end
@@ -122,11 +93,7 @@ end
 %transfiletriggerin -P 1000500 -p <lua> -- /usr/lib/sysctl.d
 -- This script will automatically apply sysctl rules if files have been
 -- installed or updated in /usr/lib/sysctl.d.
+-- Note: this should be skipped if executed in a chroot environment.
 if posix.access("/run/systemd/system") then
-    pid = posix.fork()
-    if pid == 0 then
-        assert(posix.exec("/usr/lib/systemd/systemd-sysctl"))
-    elseif pid > 0 then
-        posix.wait(pid)
-    end
+    assert(rpm.execute("/usr/lib/systemd/systemd-sysctl"))
 end