Commit Graph
90170 Commits
Author SHA1 Message Date
Yu Watanabe 2b2ca3d7cb crypto-util: load several more functions from libcrypto.so
They will be used in later commits.
2026-06-28 00:26:56 +09:00
Yu Watanabe 73568eb5b5 crypto-util: sort symbols 2026-06-28 00:26:29 +09:00
Yu Watanabe d956568160 test-fsprg: add unit test for FSPRG 2026-06-28 00:20:38 +09:00
Yu Watanabe e8d21b76f0 test-journal-verify: replace HAVE_GCRYPT ifdef with journal_auth_supported() 2026-06-28 00:00:11 +09:00
Yu Watanabe a09feb7958 sd-journal: allow to verify sealed journals even when sealing support is disabled
Of course, if disabled, seal tags cannot be verified, hence the check is skipped.
2026-06-28 00:00:11 +09:00
Yu Watanabe 2e077b57a7 sd-journal: allow to read sealed journal files when sealing is not supported 2026-06-28 00:00:11 +09:00
Yu Watanabe 24c4729198 sd-journal: drop libgcrypt dependency from libsystemd
This introduce a vtable for journal tagging feature in sd-journal,
and makes libgcrypt dependent features loaded by users (journald,
journalctl, journal-remote, and unit tests) when necessary.
2026-06-28 00:00:11 +09:00
Yu Watanabe 14236c019b journal-authenticate: save mmaped size rather than file size field in the file 2026-06-28 00:00:11 +09:00
Yu Watanabe 917763586f sd-journal: introduce JournalAuthContext
Then, move several components for journal tagging in JournalFile
to JournalAuthContext.
This also introduces wrapper functions that checks gcrypt support.
2026-06-28 00:00:09 +09:00
Yu Watanabe 4b97dc5606 journal-authenticate: initialize hmac when necessary 2026-06-27 23:58:00 +09:00
Yu Watanabe 254cc90c5c journal-authenticate: several trivial cleanups
- adds several overflow check,
- adds missing assertion,
- drop unnecessary conditions,
- declare variables when necessary.
2026-06-27 23:58:00 +09:00
Yu Watanabe 0a12d5a60e journal-authenticate: check overflow 2026-06-27 23:57:55 +09:00
Yu Watanabe 7061e6f3cb journal-authenticate: merge several functions into journal_file_maybe_append_tag() 2026-06-27 23:54:46 +09:00
Yu Watanabe 2647d82a68 journal-authenticate: move several more functions 2026-06-27 23:54:46 +09:00
Yu Watanabe ede9ff4c8b journal-authenticate: move one more function 2026-06-27 23:54:46 +09:00
Yu Watanabe 130eca9323 journal-authenticate: move functions 2026-06-27 23:54:46 +09:00
Luca Boccassi 91631d899b mkosi: update debian commit ref and install new split-out packages (#42769) 2026-06-27 15:33:38 +01:00
Yu Watanabe e7f81e4ea9 journal: several cleanups for journal sealing feature (#42770) 2026-06-27 23:01:09 +09:00
Yu Watanabe 0609bb1894 journal: drop journal_file_tag_seqnum() and embed into journal_file_append_tag() 2026-06-27 20:36:36 +09:00
Yu Watanabe a97de75de7 journal: use FSS_HEADER_SIGNATURE at one more place 2026-06-27 20:36:36 +09:00
Yu Watanabe 1828327e75 journalctl-misc: several cleanups
- honor -ENOKEY from journal_file_verify(),
- use RET_GATHER(),
- use usec_sub_unsigned(),
- reduce indentation,
- tighten variable scope.
2026-06-27 20:35:35 +09:00
Yu Watanabe 4826f760bf journal-verify: coding style fixlets 2026-06-27 20:09:12 +09:00
Yu Watanabe 79acf8894b journal-authenticate: refuse invalid start and interval parameters
We have already checked that in journal_file_fss_load().
Let's also check the same in loading user provided key.
2026-06-27 20:08:53 +09:00
Luca Boccassi 0b57cfd797 mkosi: pull new split-out packages for deb/ubuntu 2026-06-27 10:20:47 +01:00
Luca Boccassi cb317e90d8 mkosi: update debian commit reference to 0b390d268323a49191a9a3bcc07a46b573c1e464
* 0b390d2683 One more fixup for d/copyright
* 91d3dadcb5 Update changelog for 261.1-1 release
* 3c287e1f86 d/copyright: update to add new licenses
* a82117f9a3 Install new files for upstream build
* 020caeb149 Override new Lintian false positive
* d55b67b66e d/control: demote libnss-{myhostname,resolve} to Suggests for systemd-resolved
* 1c537705ec Update changelog for 261-2 release
* 6235897bbc Note new package split in NEWS
* a440cb2c4a Install new files for upstream build
* 7eaa21ad05 Split tpm tools into new systemd-tpm package
* 52b28b74f3 Split metrics reporting tools into new systemd-report package
* de2f367f22 Split imds tools into new systemd-imds package
* 2d0a07f5ae d/t/control: do not install xserver-xorg-video-dummy on loong64
* c886c3efc8 Install new files for upstream build
* 0efa66b4af Update changelog for 261-1 release
* e36cf82a1d lintian-overrides: override error about derivative.ubuntu build profile
* fbd38c36ea d/control: do not build systemd-boot-efi-*-signed-template on ubuntu
2026-06-27 10:12:58 +01:00
Yu Watanabe c286c0daaf journal: use recognizable error code
EINVAL is too generic and widely used. Let's use more specific error code.
2026-06-27 14:04:49 +09:00
Yu Watanabe 20e0244bdf sd-journal: use iovec for fsprg state and friends
This also makes them erased before freed.
2026-06-27 14:04:49 +09:00
Yu Watanabe fff2c0beaf journalctl: use iovec for fsprg state and friends
This also makes them erased on exit.
2026-06-27 14:04:48 +09:00
Yu Watanabe 82ff3f71f5 iovec-util: introduce several helper functions 2026-06-27 14:04:48 +09:00
Yu Watanabe ee6522d036 journal-importer: avoid false maybe-uninitialized warning
Observerd on Ubuntu 24.04 with GCC 13 on arm64 architecture.
```
../src/shared/journal-importer.c: In function ‘journal_importer_process_data’:
../src/shared/journal-importer.c:344:30: error: ‘line’ may be used uninitialized [-Werror=maybe-uninitialized]
  344 |                         if (!journal_field_valid(line, n - 1, true)) {
      |                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../src/shared/journal-importer.c:295:23: note: ‘line’ was declared here
  295 |                 char *line, *sep;
      |                       ^~~~
cc1: all warnings being treated as errors
```
2026-06-27 14:04:48 +09:00
Yu Watanabe d983d231eb resolvectl: use more varlink (#41840)
There are already varlink methods for `ResolveHostname`,
`ResolveAddress`, and `ResolveRecord`. Use those in `resolvectl` instead
of the dbus equivalents.
2026-06-27 12:21:19 +09:00
Lennart Poettering 2358f400b6 sysupdate: Address review feedback on CheckNew varlink scaffolding
Follow-up to #42422:

 - Rename process_image() to context_process_image(), since it now
   operates on a Context object.
 - Use IN_SET() in image_type_can_sysupdate() instead of a switch.
 - Name the return parameters of context_list_components() ret_xyz, per
   our coding style.
 - Drop a redundant "else" after a return in vl_method_check_new().
2026-06-26 22:38:57 +02:00
Nick Rosbrook fa6fe468f4 resolvectl: use varlink instead of dbus for ResolveService 2026-06-26 16:03:18 -04:00
Nick Rosbrook 4e1943a209 nss-resolve: use resolve-varlink-util.h helpers
Re-factor using the shared code introduced for resolvectl.
2026-06-26 16:03:18 -04:00
Nick Rosbrook 3ecf3aba94 test: relax grep for DNS query refusal
The punctuation is not strictly important for the error.
2026-06-26 16:03:18 -04:00
Nick Rosbrook cfac7ec169 resolvectl: use varlink instead of dbus for ResolveRecord 2026-06-26 16:03:18 -04:00
Nick Rosbrook 5ff17fb750 resolvectl: use varlink instead of dbus for ResolveAddress 2026-06-26 16:03:18 -04:00
Nick Rosbrook 35d611622a resolvectl: use varlink instead of dbus for ResolveHostname 2026-06-26 16:03:18 -04:00
Yu Watanabe 0cc0b502d1 mkosi: add postmarketOS (#39823) 2026-06-27 03:54:39 +09:00
Lennart Poettering 4952662b59 sysupdate: Add a stub varlink interface and implement CheckNew (#42422)
This puts the scaffolding in place for a varlink interface, but so far
it only adds a `io.systemd.Sysupdate.CheckNew()` method. Varlinkifying
the other verbs on `systemd-sysupdate` will happen in follow-up PRs, but
I thought I’d try and land this one early to:
 * Get review of the overall varlinkification scaffolding
* Lower the chance of big merge conflicts with others’ work by getting
the more invasive changes out of the way
* Get the scaffolding in place so others can start to build on it if
they wish (although I am currently working on porting the other existing
verbs)

It rearranges how the `Context` struct is allocated so that it’ll be
easier to add per-method/verb context structs which contain it in
future. It also changes all the `sysupdate.c` code to use arguments from
`Context` rather than `arg_*` globals, allowing them to be specified as
varlink parameters in future.

It also moves the existing `systemd-sysupdate.{timer,service}` units
(which periodically run `systemd-sysupdate update`) to
`systemd-sysupdate-update.{timer,service}` to clear space for a
`systemd-sysupdate@.service` and `systemd-sysupdate.socket` to act as a
varlink entry point.

/cc @AdrianVovk
2026-06-26 17:31:30 +02:00
dirhamtriyadi 71c6c88606 hwdb: add touchpad toggle mapping for MSI Katana GF66 12UD 2026-06-26 16:21:20 +01:00
Yu Watanabe 0627dcc869 ci/mkosi: add postmarketos job
Currently, TEST-92-TPM2-SWTPM is skipped as it requires the following:
https://github.com/systemd/systemd/pull/42760
https://gitlab.alpinelinux.org/alpine/aports/-/work_items/18293
2026-06-27 00:18:16 +09:00
Yu Watanabe 1a787e5195 mkosi: add postmarketos support
postmarketOS image can be built with for example the following mkosi.local.conf:
```
[Distribution]
Distribution=postmarketos

[Output]
Format=disk

[Build]
UseSubvolumes=yes

[Runtime]
Firmware=uefi
```
2026-06-27 00:18:16 +09:00
Nick Rosbrook cc6bc699c7 resolve: add query string field to io.systemd.Resolve.DNSError
This is preparation for using varlink methods more in resolvectl. In
particular, this is helpful for proving more accurate error messages,
and maintaining compatibility with existing error messages from the
DBus API.
2026-06-26 09:12:10 -04:00
Nick Rosbrook 3f73f1ef75 json-util: introduce json_dispatch_in_addr_data
Generalize json_dispatch_address from nss-resolve, and add support for
strings to be compatible with the existing json_dispatch_{in,in6}_addr
helpers. This will be used in a later commit.
2026-06-26 09:12:10 -04:00
Nick Rosbrook c5f08a2e5c json-util: generalize json_dispatch_address_family
There are several places where address family is dispatched from JSON,
so take json_dispatch_address_family from networkd and put it in
json-util.c.

Update the all instances in the tree to use this new function, adding
SD_JSON_RELAX to the dispatch flags if AF_UNSPEC should be allowed
in that case.
2026-06-26 09:12:10 -04:00
Philip Withnall e261b552c8 sysupdate: Fix some clang-tidy lint warnings for argument names
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
2026-06-26 13:02:02 +01:00
Philip Withnall dffff8be67 test: Test error handling for non-existent targets in sysupdate
Primarily I want to test the new varlink error, but this will also test
the `systemd-sysupdate` CLI behaviour too.
2026-06-26 13:01:58 +01:00
Philip Withnall 7757ec3317 sysupdate: Add varlink CheckNew() method
This is the first varlink method added to sysupdate. The D-Bus interface
(via sysupdated) will remain for now; the varlink interface will exist
in parallel.

This method can be called via:
```
varlinkctl call ./path/to/systemd-sysupdate \
  io.systemd.SysUpdate.CheckNew \
  '{"target":{"class":"host"}}'
SYSTEMD_SYSUPDATE_NO_VERIFY=1 \
varlinkctl call ./path/to/systemd-sysupdate \
  io.systemd.SysUpdate.CheckNew \
  '{"target":{"class":"component","name":"some-component"}}'
```

This includes some changes to run the integration tests again using the
varlink interface rather than running `systemd-sysupdate` directly, to
test the new interface.
2026-06-26 13:01:53 +01:00
Philip Withnall 2d201a107b sysupdate: Add basic varlink interface scaffolding
This adds the scaffolding for being able to call sysupdate via varlink,
but it doesn’t yet define or implement any methods. Those will come in
following commits.

The existing `systemd-sysupdate.service` and `systemd-sysupdate.timer`
(which periodically ran `systemd-sysupdate update`) have been renamed
to `systemd-sysupdate-update.{service,timer}` to make way for a new
`systemd-sysupdate@.service` and `systemd-sysupdate.socket` file to
handle varlink activation.

Compatibility symlinks have been added for them.
2026-06-26 13:01:31 +01:00