* 9badaae1c4 Drop deprecated meson option
* 8700e5c4e5 Install new files for upstream build
* 7aaf05335d Update d/copyright
* 68b634db29 Update changelog for 261.2-1 release
* 07591e4f9a Open changelog for 261.2-1 release
* 2bd7f0db1f d/libnss-systemd.nss: install after files and compat in nsswitch.conf
* c2e3b3135c Drop OBS workarounds and use pkg.systemd.obs build profile
* aff99fcc49 d/control: clarify systemd-imds Description
* b5006dc64a d/systemd.links: drop procps.service alias (LP: #2153900)
* b630d1569f Make systemd-networkd example consistent with systemd.network(5)
parse_argv() requires at least one DEVICE unless --all is given, and
refuses DEVICE arguments when --all is given, so "[DEVICE…]" described
neither mode correctly. Spell out the three modes as separate synopsis
lines, like pcrextend and inhibit do, and update the man page to match.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The positional argument is spelled MOUNTPOINT
in the synopsis, like the other metavars, instead of /path/to/mountpoint,
and the man page synopsis, which said "[DEVICE]", is fixed to match: the
argument is required and it is a mount point.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The man page reference is fixed to
systemd-tpm2-clear.service(8), the only name that page is known by.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The abstract is changed to use the imperative
form ("Install …" instead of "Installs …"), consistent with the other
commands. This also fixes the doubled colon in the "Options::" heading.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The abstract is changed from the noun phrase
"Simple file system backed storage provider" to the imperative "Expose
regular files and directories as storage volumes.", following the man
page and consistent with the other commands.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The abstract is changed from the noun phrase
"Simple block device backed storage provider" to the imperative "Expose
local block devices as storage volumes.", following the man page and
consistent with the other commands.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. --help now also references the man page,
which the old help did not.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The synopsis no longer marks the target as
optional, since exactly one HOST:PORT or SOCKET argument is required.
The hint about systemd.time(7) is kept as the footer.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The old help had neither an abstract nor a
man page reference; both are added, with the abstract taken from the
man page.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The abstract is changed to use the imperative
form ("Load …" instead of "Loads …"), consistent with the other
commands.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The synopsis now marks the input files as
optional, since the local journal is read when none are given, and
--url= as optional, since URL= may come from journal-upload.conf,
matching the man page.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The synopsis now marks the input files as
optional, since input may also come from --url=, --getter=, --listen-*=
or passed file descriptors, matching the man page. The note about
sd_listen_fds() is kept as the footer.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The abstract is changed from the noun phrase
"HTTP server for journal events." to the imperative "Serve journal events
over HTTP.", consistent with the other commands, and the meaningless
"..." placeholder is dropped from the synopsis (the tool takes no
positional arguments).
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. --clear, which takes no positional
arguments, is listed as a separate synopsis line.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The positional argument is spelled MOUNTPOINT
in the synopsis, like the other metavars, instead of /path/to/mountpoint.
The man page is adjusted to match.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The two hand-written synopsis lines are
replaced by the generic one, and --help now lists the verbs in a
Commands: section generated from the verb table.
This is redundant for public programs, for which we test --help
more extensively, but is also good as a basic check that e.g. the
program name used to print help matches what is specified in COMMAND.
`run_subtests` now handle exit 77 as skip status, making successful
subtests distinguishable from passed tests. Introduce
`run_subtests_and_exit` as a helper to automatically write `/testok` if
all subtests passed, and to write `/skipped` and exit 77 if all subtests
were skipped.
Provides a Tokio-like #[tokio::main] entry point for binaries that want
to run their main function inside a fiber on a default sd_event loop.
DEFINE_MAIN_FUNCTION_FIBER(impl) mirrors DEFINE_MAIN_FUNCTION but routes
impl through a new run_main_fiber() helper, which:
- allocates the default sd_event,
- enables exit-on-idle so the loop terminates once all event sources
drain (structured concurrency: impl is expected to cancel and reap
whatever it spawned before returning),
- spawns impl as a fiber named after program_invocation_short_name,
- installs SIGINT/SIGTERM handlers that cancel the main fiber (and
disable themselves so the loop can go idle once the fiber unwinds),
- runs sd_event_loop and propagates impl's return value via
sd_future_result, normalising -ECANCELED to 0 since that just
represents an orderly signal-driven shutdown.
With DNSSEC on, resolved can't validate anything until the clock is
correct,
and without an RTC the only thing that fixes the clock is talking to the
NTP servers we're trying to resolve.
On glibc the timesyncd unit sets SYSTEMD_NSS_RESOLVE_VALIDATE=0 and
nss-resolve turns that into a per-query flag, which breaks the
chicken/egg. musl and systems not using nss-resolve have no NSS, so
nothing
reads it there and we're stuck.
So talk to resolved directly when it's there, and pass
SD_RESOLVED_NO_VALIDATE until we've synced the clock ourselves. Lookups
after that are validated normally, which is better than what we get from
nss. If resolved isn't around we keep using getaddrinfo().
Tested on musl in qemu with the RTC set to 2020 and DNSSEC=yes.
timesyncd syncs when it couldn't before, while `resolvectl query` still
fails with signature-expired, so the "relaxation" is scoped to only
timesyncd.
Once the clock is synced subsequent timesyncd resolver queries no longer
include the flag to disable validation.
fixes#20235
The 'changed' variable is either unused on error or unconditionally
overwritten on success, so coverity warns about it. Drop the unused
assignment.
CID#1685266
Follow-up for a572dd2f60
ipv6_is_supported only tells us the kernel has IPv6, not that
it's usable. ipv6_is_enabled also checks the sysctl that turns
it off, so we stop resolving addresses we can't use.
Our first resolve happens way before sockets.target, and
systemd-resolved-varlink.socket has no ordering of its own, so there's
nothing making sure the socket is listening by then. Without this the
connect fails and we quietly fall back to getaddrinfo(), which is exactly
the case the varlink path is there for.
Order after both the service and the socket since either one is enough
on its own but neither covers every install situation. For example
resolved binds the socket itself when nothing hands it one, and on
systems where only the socket is enabled the service isn't started at
boot at all.
With DNSSEC on, resolved can't validate anything until the clock is
right, and without an RTC the only thing that fixes the clock is talking
to the NTP servers we're trying to resolve. On glibc the timesyncd unit
sets SYSTEMD_NSS_RESOLVE_VALIDATE=0 and nss-resolve turns that into a
per-query flag, which breaks the chicken/egg. musl (and other systems
not using nss-resolve) have no NSS, so nothing reads it there and we're
stuck.
So talk to resolved directly when it's there, and pass
SD_RESOLVED_NO_VALIDATE until we've synced the clock ourselves.
NTP-related lookups after that are validated normally, which is better
than what we get from nss. If resolved isn't around we just keep using
getaddrinfo().
The reply handler duplicates the tail of the getaddrinfo handler, since
the two differ in how they report failures. Varlink discards what the
callback returns, so it has to move on to the next host itself.
This also drops SYSTEMD_NSS_RESOLVE_VALIDATE=0 from the unit because
nss-resolve talks to resolved over the same socket we do, so the
getaddrinfo() path is only ever taken when resolved is unreachable, and
then nothing validates anyway.
`sd_dhcp_server_configure_pool()` calculated the maximum pool size
before checking whether `PoolOffset=` was inside the subnet.
Because the calculation used unsigned arithmetic, an offset beyond the
broadcast address could wrap around to a large value and pass validation.
For example, `PoolOffset=256` with a `/24` and `PoolSize=1` was accepted,
allowing the DHCP server to offer an address outside its configured subnet.
Reject offsets at or beyond the broadcast address before performing the
subtraction, and calculate the remaining pool size directly as
`broadcast_off - offset`.
BrowseServices(ifindex=0) may observe the same service on multiple
links. Treat the link index as part of the discovered service
identity so add and remove events remain link-scoped.
Use the per-service ifindex for RFC 6762 maintenance queries.
Share the service identity predicate between add and remove handling,
and propagate RR comparison errors instead of reporting removals.
Extend coverage for scoped-browser ifindex fallback, goodbye TTL
handling, and monotonic expiry updates.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. --help now goes through the pager, like other
commands with --no-pager.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The synopsis now also lists the --list mode,
matching the man page. --help now goes through the pager, like other
commands with --no-pager.
The custom help() is replaced by a COMMAND() description, and
--introspect-cli is added. The abstract is left as it was, nonimperative.
I tried a few different forms but couldn't find one that was clearly
better.
