mkosi: add postmarketos support

postmarketOS image can be built with for example the following mkosi.local.conf:
```
[Distribution]
Distribution=postmarketos

[Output]
Format=disk

[Build]
UseSubvolumes=yes

[Runtime]
Firmware=uefi
```

mkosi/mkosi.conf.d/postmarketos/mkosi.conf

@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=postmarketos
+
+[Distribution]
+Release=edge
+
+[Content]
+VolatilePackages=
+        systemd
+        systemd-journald
+        systemd-libs
+        systemd-logind
+        systemd-networkd
+        systemd-resolved
+        systemd-tests
+        systemd-timesyncd
+        systemd-udevd
+
+Packages=
+        agetty
+        bind-tools
+        bpftool
+        coreutils
+        erofs-utils
+        execline
+        gnutls-utils
+        iproute2
+        iputils
+        knot
+        knot-utils
+        libcap-ng-utils
+        libcap-utils
+        libmicrohttpd
+        linux-firmware-none
+        linux-stable
+        lvm2
+        man-db
+        musl-locales
+        net-tools
+        nmap-ncat
+        openssh-client
+        openssh-server
+        openssl
+        perf
+        postmarketos-base
+        procps-ng
+        psmisc
+        py3-elftools
+        py3-pexpect
+        py3-psutil
+        py3-pytest
+        py3-zstd
+        quota-tools
+        sfdisk
+        shadow
+        softhsm
+        squashfs-tools
+        stress-ng
+        tpm2-tools
+        uutils-coreutils-groups
+        vim-common

mkosi/mkosi.conf.d/postmarketos/mkosi.conf.d/debug.conf

@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Environment=WITH_DEBUG=1
+
+[Content]
+VolatilePackages=systemd-dbg

mkosi/mkosi.conf.d/postmarketos/mkosi.conf.d/efi.conf

@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Architecture=uefi
+
+[Content]
+Packages=
+        sbsigntool
+
+VolatilePackages=
+        systemd-boot
+        systemd-ukify

mkosi/mkosi.conf.d/postmarketos/mkosi.extra/usr/lib/systemd/resolved.conf.d/disable-dnsovertls.conf

@@ -0,0 +1,8 @@
+# This overrides the following dropin file installed by postmarketos-base-systemd-resolved,
+# which disables DNSOverTLS= and breaks integration tests for resolved.
+
+[Resolve]
+# This requires a DNS server that supports it. Disabling it instead of setting
+# to "opportunistic", since the latter can be defeated with a downgrade attack and
+# that gives a false sense of security.
+#DNSOverTLS=no

mkosi/mkosi.conf.d/postmarketos/mkosi.extra/usr/lib/systemd/resolved.conf.d/disable-mdns.conf

@@ -0,0 +1,7 @@
+# This overrides the following dropin file installed by postmarketos-base-systemd-resolved,
+# which disables MulticastDNS= and breaks integration tests for resolved.
+
+[Resolve]
+# CUPS doesn't work with systemd-resolved's mdns:
+# https://github.com/OpenPrinting/libcups/issues/81
+#MulticastDNS=no

mkosi/mkosi.conf.d/postmarketos/mkosi.extra/usr/lib/sysusers.d/10-testuser.conf

@@ -0,0 +1,4 @@
+# postmarketOS does not support userdbd, so creating the test user via
+# userdbd credentials does not work. We need to create the user entries
+# in /etc/passwd and /etc/group using sysusers instead.
+u testuser 4711 testuser /home/testuser /bin/bash

mkosi/mkosi.conf.d/postmarketos/mkosi.extra/usr/lib/tmpfiles.d/10-testuser.conf

@@ -0,0 +1,4 @@
+# postmarketOS does not support userdbd, so creating the test user via
+# userdbd credentials does not work. We need to create the user's home
+# directory using tmpfiles instead.
+Q /home/testuser 0700 testuser testuser - -

mkosi/mkosi.conf.d/postmarketos/mkosi.extra/usr/lib/udev/udev.conf

@@ -0,0 +1,2 @@
+# This overrides udev.conf installed by postmarketos-base package,
+# which sets udev_log=err and breaks TEST-17-UDEV.verify.

mkosi/mkosi.extra.common/usr/lib/systemd/system-preset/00-mkosi.preset

@@ -19,6 +19,13 @@ enable systemd-networkd-wait-online.service
 # systemd-resolved is disabled by default on CentOS so make sure it is enabled.
 enable systemd-resolved.service
 
+# systemd-time-wait-sync.service is enabled by default on postmarketOS.
+# It pulls in time-sync.target, but the target is never reached because the
+# test environment has no Internet connectivity. As a result, timer units
+# cannot be started. Disable the service explicitly to allow timer units to
+# start in the test environment.
+disable systemd-time-wait-sync.service
+
 # systemd-userdbd.socket is disabled by default on OpenSUSE
 enable systemd-userdbd.socket
 
@@ -61,3 +68,12 @@ disable multipathd.service
 # The socket unit is disabled by default in the upstream:
 # https://github.com/opensvc/multipath-tools/commit/346e9adda4e5f0ccfcbb7a3eccf5f96001d95027
 disable multipathd.socket
+
+# rtkit-daemon.service randomly fails with the following error on postmarketOS:
+# rtkit-daemon[54]: pthread_create failed: Resource temporarily unavailable
+# The service is not necessary on our test suites, let's disable it.
+disable rtkit-daemon.service
+
+# Disable postmarketOS specific zram swap service.
+# Maybe better to replace it with zram-generator?
+disable zram_swap.service

mkosi/mkosi.images/build/mkosi.conf.d/postmarketos/mkosi.build.chroot

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -e
+
+if [[ "$1" == "clangd" ]]; then
+    exit 0
+fi
+
+if [[ ! -f "pkg/$PKG_SUBDIR${GIT_SUBDIR:+/$GIT_SUBDIR}/APKBUILD" ]]; then
+    echo "APKBUILD not found at pkg/$PKG_SUBDIR${GIT_SUBDIR:+/$GIT_SUBDIR}/APKBUILD, run mkosi once with -ff to make sure the APKBUILD is cloned" >&2
+    exit 1
+fi
+
+. mkosi/mkosi.functions
+
+mkdir -p "$HOME/.abuild"
+cat >"$HOME/.abuild/abuild.conf" <<EOF
+PACKAGER="mkosi <mkosi@localhost>"
+CBUILD=$DISTRIBUTION_ARCHITECTURE
+EOF
+
+# shellcheck disable=SC2046
+abuild-keygen \
+    $( ((MESON_VERBOSE)) || echo "--quiet") \
+    -n --append
+
+DOWNSTREAM_SRCDIR="$(mktemp -d)/$DISTRIBUTION/systemd"
+mkdir -p "$DOWNSTREAM_SRCDIR"
+
+# Copy downstream files.
+cp -vr "$SRCDIR/pkg/$PKG_SUBDIR${GIT_SUBDIR:+/$GIT_SUBDIR}"/* "$DOWNSTREAM_SRCDIR/."
+
+# Before RC1, the version in meson.version ends with "~devel", e.g. "261-devel".
+# After RC1, the RC number prefixed with "~rc" is suffixed, e.g. "261~rc1".
+# After the final release, the version in meson.version has only number, e.g. "261" or "261.1".
+VERSION="$(sed -e 's/~/_/; s/devel/rc0/' meson.version)"
+TS="${SOURCE_DATE_EPOCH:-$(date +%s)}"
+RELEASE="$(date "+%Y%m%d%H%M%S" --date "@$TS")"
+
+# abuild-meson internally sets -Dwerror=false, hence we cannot override it with --werror.
+MESON_OPTIONS="${MESON_OPTIONS//--werror/-D werror=true}"
+
+# Patch version number.
+sed -i \
+    -e "/^pkgver=/ s|=.*|=$VERSION|" \
+    -e "/^pkgrel=/ s|=.*|=$RELEASE|" \
+    "$DOWNSTREAM_SRCDIR/APKBUILD"
+
+# Drop systemd-dbg package when WITH_DEBUG is unset.
+if ! ((WITH_DEBUG)); then
+    sed -i \
+        -e '/pkgname-dbg/ d' \
+        "$DOWNSTREAM_SRCDIR/APKBUILD"
+fi
+
+# Remove previously built packages.
+rm -rf "${BUILDDIR:?}/$DISTRIBUTION"
+
+# shellcheck disable=SC2046
+env \
+    srcdir="$DOWNSTREAM_SRCDIR" \
+    APKBUILD="$DOWNSTREAM_SRCDIR/APKBUILD" \
+    CFLAGS="$MKOSI_CFLAGS $CFLAGS" \
+    CXXFLAGS="$MKOSI_CFLAGS $CFLAGS" \
+    LDFLAGS="$MKOSI_LDFLAGS $LDFLAGS" \
+    REPODEST="$BUILDDIR" \
+    _systemd_upstream=1 \
+    _meson_extra_configure_options="$MKOSI_MESON_OPTIONS $MESON_OPTIONS" \
+    _meson_builddir="$BUILDDIR" \
+    _upstream_srcdir="$SRCDIR" \
+    abuild -F \
+    $( ((MESON_VERBOSE)) && echo "-v") \
+    build \
+    $( ((WITH_TESTS)) && echo "check") \
+    rootpkg
+
+cp -vr "$BUILDDIR/$DISTRIBUTION/$DISTRIBUTION_ARCHITECTURE"/*.apk "$PACKAGEDIR/."

mkosi/mkosi.images/build/mkosi.conf.d/postmarketos/mkosi.conf

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=postmarketos
+
+[Content]
+Packages=
+        alpine-sdk
+        bash
+        kmod

mkosi/mkosi.images/build/mkosi.conf.d/postmarketos/mkosi.prepare

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -e
+
+if [[ "$1" == "build" ]] || ((NO_BUILD)); then
+    exit 0
+fi
+
+APKBUILD="pkg/$PKG_SUBDIR${GIT_SUBDIR:+/$GIT_SUBDIR}/APKBUILD"
+if [[ ! -f "$APKBUILD" ]]; then
+    echo "APKBUILD not found at $APKBUILD, run mkosi once with -ff to make sure the APKBUILD is cloned" >&2
+    exit 1
+fi
+
+# shellcheck source=/dev/null
+CARCH="$DISTRIBUTION_ARCHITECTURE" \
+     _systemd_upstream=1 \
+     . "$APKBUILD"
+
+# shellcheck disable=SC2086
+mkosi-install ${makedepends:?}

mkosi/mkosi.images/minimal-base/mkosi.conf.d/postmarketos.conf

@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=postmarketos
+
+[Content]
+Packages=
+        coreutils
+        iproute2
+        libcap-utils
+        net-tools
+        nmap-ncat
+
+VolatilePackages=
+        systemd-libs

mkosi/mkosi.initrd.conf/mkosi.conf.d/postmarketos.conf

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=postmarketos
+
+[Content]
+Packages=
+        btrfs-progs
+        coreutils
+        device-mapper
+        e2fsprogs
+        musl-utils
+        tpm2-tools
+        # For TEST-92-TPM2-SWTPM, install following packages when
+        # https://github.com/systemd/systemd/pull/42760
+        # https://gitlab.alpinelinux.org/alpine/aports/-/work_items/18293
+        # are resolved.
+        #gnutls-utils
+        #kmod
+        #linux-firmware-none
+        #linux-stable
+
+VolatilePackages=
+        systemd
+        systemd-journald
+        systemd-libs
+        systemd-udevd

mkosi/mkosi.pkgenv/mkosi.conf.d/postmarketos.conf

@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=postmarketos
+
+[Build]
+Environment=
+        GIT_URL=https://gitlab.postmarketos.org/postmarketOS/pmaports
+        GIT_SUBDIR=extra-repos/systemd/systemd
+        GIT_BRANCH=main
+        GIT_COMMIT=bd970948e652e16e8ef8688cc891aa5ab80dbaa3
+        PKG_SUBDIR=postmarketos

mkosi/mkosi.sync

@@ -7,7 +7,7 @@ if ((${NO_SYNC:-0})) || ((${NO_BUILD:-0})); then
     exit 0
 fi
 
-# Distributions without downstream systemd packaging (e.g. postmarketOS) skip the mkosi.pkgenv entry
+# Distributions without downstream systemd packaging skip the mkosi.pkgenv entry
 # that sets PKG_SUBDIR (and the matching prepare script), so there's nothing to sync.
 if [[ -z "${PKG_SUBDIR:-}" ]]; then
     exit 0

mkosi/mkosi.tools.conf/mkosi.conf.d/postmarketos.conf

@@ -3,84 +3,8 @@
 [Match]
 Distribution=postmarketos
 
-# postmarketOS is musl-based natively, so it can host the musl build directly without needing
-# the musl-gcc wrapper that the Fedora tools tree uses. We don't run a PrepareScripts to pull
-# systemd build deps from a downstream packaging spec — postmarketOS doesn't ship one — so the
-# Packages= list below is the canonical set of build deps for the musl CI build in
-# .github/workflows/unit-tests.yml (build-musl job).
 [Content]
+PrepareScripts=%D/mkosi/mkosi.images/build/mkosi.conf.d/postmarketos/mkosi.prepare
 Packages=
-        acl
+        alpine-sdk
-        acl-dev
+        postmarketos-base
-        audit-dev
-        bash
-        bash-completion-dev
-        bpftool
-        build-base
-        bzip2-dev
-        coccinelle
-        coreutils
-        cryptsetup-dev
-        curl-dev
-        dbus
-        dbus-dev
-        elfutils-dev
-        gettext-dev
-        git
-        github-cli
-        glib-dev
-        gnutls-dev
-        gperf
-        grep
-        iproute2
-        iptables-dev
-        kbd
-        kmod
-        kmod-dev
-        lcov
-        libapparmor-dev
-        libarchive-dev
-        libbpf-dev
-        libcap-dev
-        libcap-utils
-        libfido2-dev
-        libgcrypt-dev
-        libgpg-error-dev
-        libidn2-dev
-        libmicrohttpd-dev
-        libpwquality-dev
-        libqrencode-dev
-        libseccomp-dev
-        libselinux-dev
-        libucontext-dev
-        libxkbcommon-dev
-        linux-pam-dev
-        lz4-dev
-        openssl
-        openssl-dev
-        p11-kit-dev
-        pcre2-dev
-        pkgconf
-        polkit-dev
-        py3-elftools
-        py3-jinja2
-        py3-lxml
-        py3-pefile
-        py3-pytest
-        quota-tools
-        ruff
-        rsync
-        sfdisk
-        shellcheck
-        tpm2-tss-dev
-        tpm2-tss-esys
-        tpm2-tss-rc
-        tpm2-tss-tcti-device
-        tzdata
-        util-linux-dev
-        util-linux-misc
-        utmps-dev
-        valgrind-dev
-        xen-dev
-        zlib-dev
-        zstd-dev