Commit Graph
90176 Commits
Author SHA1 Message Date
Frantisek Sumsal 7804fd182c vmspawn: complain loudly if we can't prepare a unix socket for virtiofsd
I couldn't convince vmspawn to start a VM on a Fedora image I just
downloaded, and it was pretty light on any useful details:

$ build/systemd-vmspawn --image ~/Downloads/Fedora-Server-Guest-Generic-Rawhide-20260627.n.0.x86_64.qcow2 --image-format=qcow2 --bind-ro=/tmp/bar; echo $?
░ Spawning VM Fedora-Server-Guest-Generic-Rawhide-20260627.n.0.x8664.qcow2 on /home/mrc0mmand/Downloads/Fedora-Server-Guest-Generic-Rawhide-20260627.n.0.x86_64.qcow2.
░ Press Ctrl-] three times within 1s to kill VM.
1

Turns out that the unix socket path vmspawn generates for the virtiofsd
socket is too long. Let's relay this information to the user as well to
make debugging this a little less painful:

$ build/systemd-vmspawn --image ~/Downloads/Fedora-Server-Guest-Generic-Rawhide-20260627.n.0.x86_64.qcow2 --image-format=qcow2 --bind-ro=/tmp/bar
░ Spawning VM Fedora-Server-Guest-Generic-Rawhide-20260627.n.0.x8664.qcow2 on /home/mrc0mmand/Downloads/Fedora-Server-Guest-Generic-Rawhide-20260627.n.0.x86_64.qcow2.
░ Press Ctrl-] three times within 1s to kill VM.
Failed to prepare unix socket '/run/user/1000/systemd/vmspawn/Fedora-Server-Guest-Generic-Rawhide-20260627.n.0.x8664.qcow2/sock-9594581dcf598992': File name too long
2026-06-28 12:52:02 +09:00
Yu Watanabe dc416f5825 journal: replace libgcrypt with openssl (#42695) 2026-06-28 03:45:22 +09:00
Yu Watanabe ca5100dbad gcrypt-util: drop several unused definitions 2026-06-28 00:26:56 +09:00
Yu Watanabe 6461c1b017 tree-wide: drop gcrypt dependency from all binaries except for unit tests
With this change, gcrypt dependency is not mandatory. Hence, allow to build
systemd even when -D gcrypt=enabled but gcrypt devel package is not installed.
2026-06-28 00:26:56 +09:00
Yu Watanabe 005e94da17 journal: replace gcrypt with openssl 2026-06-28 00:26:56 +09:00
Yu Watanabe 7fae5c5bcc fsprg-openssl: rewrite fsprg with OpenSSL
This introduce OpenSSL port of fsprg, which is implemented by using libgcrypt.
2026-06-28 00:26:56 +09:00
Yu Watanabe 2b2ca3d7cb crypto-util: load several more functions from libcrypto.so
They will be used in later commits.
2026-06-28 00:26:56 +09:00
Yu Watanabe 73568eb5b5 crypto-util: sort symbols 2026-06-28 00:26:29 +09:00
Yu Watanabe d956568160 test-fsprg: add unit test for FSPRG 2026-06-28 00:20:38 +09:00
Yu Watanabe e8d21b76f0 test-journal-verify: replace HAVE_GCRYPT ifdef with journal_auth_supported() 2026-06-28 00:00:11 +09:00
Yu Watanabe a09feb7958 sd-journal: allow to verify sealed journals even when sealing support is disabled
Of course, if disabled, seal tags cannot be verified, hence the check is skipped.
2026-06-28 00:00:11 +09:00
Yu Watanabe 2e077b57a7 sd-journal: allow to read sealed journal files when sealing is not supported 2026-06-28 00:00:11 +09:00
Yu Watanabe 24c4729198 sd-journal: drop libgcrypt dependency from libsystemd
This introduce a vtable for journal tagging feature in sd-journal,
and makes libgcrypt dependent features loaded by users (journald,
journalctl, journal-remote, and unit tests) when necessary.
2026-06-28 00:00:11 +09:00
Yu Watanabe 14236c019b journal-authenticate: save mmaped size rather than file size field in the file 2026-06-28 00:00:11 +09:00
Yu Watanabe 917763586f sd-journal: introduce JournalAuthContext
Then, move several components for journal tagging in JournalFile
to JournalAuthContext.
This also introduces wrapper functions that checks gcrypt support.
2026-06-28 00:00:09 +09:00
Yu Watanabe 4b97dc5606 journal-authenticate: initialize hmac when necessary 2026-06-27 23:58:00 +09:00
Yu Watanabe 254cc90c5c journal-authenticate: several trivial cleanups
- adds several overflow check,
- adds missing assertion,
- drop unnecessary conditions,
- declare variables when necessary.
2026-06-27 23:58:00 +09:00
Yu Watanabe 0a12d5a60e journal-authenticate: check overflow 2026-06-27 23:57:55 +09:00
Yu Watanabe 7061e6f3cb journal-authenticate: merge several functions into journal_file_maybe_append_tag() 2026-06-27 23:54:46 +09:00
Yu Watanabe 2647d82a68 journal-authenticate: move several more functions 2026-06-27 23:54:46 +09:00
Yu Watanabe ede9ff4c8b journal-authenticate: move one more function 2026-06-27 23:54:46 +09:00
Yu Watanabe 130eca9323 journal-authenticate: move functions 2026-06-27 23:54:46 +09:00
Luca Boccassi 91631d899b mkosi: update debian commit ref and install new split-out packages (#42769) 2026-06-27 15:33:38 +01:00
Yu Watanabe e7f81e4ea9 journal: several cleanups for journal sealing feature (#42770) 2026-06-27 23:01:09 +09:00
Yu Watanabe 0609bb1894 journal: drop journal_file_tag_seqnum() and embed into journal_file_append_tag() 2026-06-27 20:36:36 +09:00
Yu Watanabe a97de75de7 journal: use FSS_HEADER_SIGNATURE at one more place 2026-06-27 20:36:36 +09:00
Yu Watanabe 1828327e75 journalctl-misc: several cleanups
- honor -ENOKEY from journal_file_verify(),
- use RET_GATHER(),
- use usec_sub_unsigned(),
- reduce indentation,
- tighten variable scope.
2026-06-27 20:35:35 +09:00
Yu Watanabe 4826f760bf journal-verify: coding style fixlets 2026-06-27 20:09:12 +09:00
Yu Watanabe 79acf8894b journal-authenticate: refuse invalid start and interval parameters
We have already checked that in journal_file_fss_load().
Let's also check the same in loading user provided key.
2026-06-27 20:08:53 +09:00
Luca Boccassi 0b57cfd797 mkosi: pull new split-out packages for deb/ubuntu 2026-06-27 10:20:47 +01:00
Luca Boccassi cb317e90d8 mkosi: update debian commit reference to 0b390d268323a49191a9a3bcc07a46b573c1e464
* 0b390d2683 One more fixup for d/copyright
* 91d3dadcb5 Update changelog for 261.1-1 release
* 3c287e1f86 d/copyright: update to add new licenses
* a82117f9a3 Install new files for upstream build
* 020caeb149 Override new Lintian false positive
* d55b67b66e d/control: demote libnss-{myhostname,resolve} to Suggests for systemd-resolved
* 1c537705ec Update changelog for 261-2 release
* 6235897bbc Note new package split in NEWS
* a440cb2c4a Install new files for upstream build
* 7eaa21ad05 Split tpm tools into new systemd-tpm package
* 52b28b74f3 Split metrics reporting tools into new systemd-report package
* de2f367f22 Split imds tools into new systemd-imds package
* 2d0a07f5ae d/t/control: do not install xserver-xorg-video-dummy on loong64
* c886c3efc8 Install new files for upstream build
* 0efa66b4af Update changelog for 261-1 release
* e36cf82a1d lintian-overrides: override error about derivative.ubuntu build profile
* fbd38c36ea d/control: do not build systemd-boot-efi-*-signed-template on ubuntu
2026-06-27 10:12:58 +01:00
Yu Watanabe c286c0daaf journal: use recognizable error code
EINVAL is too generic and widely used. Let's use more specific error code.
2026-06-27 14:04:49 +09:00
Yu Watanabe 20e0244bdf sd-journal: use iovec for fsprg state and friends
This also makes them erased before freed.
2026-06-27 14:04:49 +09:00
Yu Watanabe fff2c0beaf journalctl: use iovec for fsprg state and friends
This also makes them erased on exit.
2026-06-27 14:04:48 +09:00
Yu Watanabe 82ff3f71f5 iovec-util: introduce several helper functions 2026-06-27 14:04:48 +09:00
Yu Watanabe ee6522d036 journal-importer: avoid false maybe-uninitialized warning
Observerd on Ubuntu 24.04 with GCC 13 on arm64 architecture.
```
../src/shared/journal-importer.c: In function ‘journal_importer_process_data’:
../src/shared/journal-importer.c:344:30: error: ‘line’ may be used uninitialized [-Werror=maybe-uninitialized]
  344 |                         if (!journal_field_valid(line, n - 1, true)) {
      |                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../src/shared/journal-importer.c:295:23: note: ‘line’ was declared here
  295 |                 char *line, *sep;
      |                       ^~~~
cc1: all warnings being treated as errors
```
2026-06-27 14:04:48 +09:00
Yu Watanabe d983d231eb resolvectl: use more varlink (#41840)
There are already varlink methods for `ResolveHostname`,
`ResolveAddress`, and `ResolveRecord`. Use those in `resolvectl` instead
of the dbus equivalents.
2026-06-27 12:21:19 +09:00
Lennart Poettering 2358f400b6 sysupdate: Address review feedback on CheckNew varlink scaffolding
Follow-up to #42422:

 - Rename process_image() to context_process_image(), since it now
   operates on a Context object.
 - Use IN_SET() in image_type_can_sysupdate() instead of a switch.
 - Name the return parameters of context_list_components() ret_xyz, per
   our coding style.
 - Drop a redundant "else" after a return in vl_method_check_new().
2026-06-26 22:38:57 +02:00
Nick Rosbrook fa6fe468f4 resolvectl: use varlink instead of dbus for ResolveService 2026-06-26 16:03:18 -04:00
Nick Rosbrook 4e1943a209 nss-resolve: use resolve-varlink-util.h helpers
Re-factor using the shared code introduced for resolvectl.
2026-06-26 16:03:18 -04:00
Nick Rosbrook 3ecf3aba94 test: relax grep for DNS query refusal
The punctuation is not strictly important for the error.
2026-06-26 16:03:18 -04:00
Nick Rosbrook cfac7ec169 resolvectl: use varlink instead of dbus for ResolveRecord 2026-06-26 16:03:18 -04:00
Nick Rosbrook 5ff17fb750 resolvectl: use varlink instead of dbus for ResolveAddress 2026-06-26 16:03:18 -04:00
Nick Rosbrook 35d611622a resolvectl: use varlink instead of dbus for ResolveHostname 2026-06-26 16:03:18 -04:00
Yu Watanabe 0cc0b502d1 mkosi: add postmarketOS (#39823) 2026-06-27 03:54:39 +09:00
Lennart Poettering 4952662b59 sysupdate: Add a stub varlink interface and implement CheckNew (#42422)
This puts the scaffolding in place for a varlink interface, but so far
it only adds a `io.systemd.Sysupdate.CheckNew()` method. Varlinkifying
the other verbs on `systemd-sysupdate` will happen in follow-up PRs, but
I thought I’d try and land this one early to:
 * Get review of the overall varlinkification scaffolding
* Lower the chance of big merge conflicts with others’ work by getting
the more invasive changes out of the way
* Get the scaffolding in place so others can start to build on it if
they wish (although I am currently working on porting the other existing
verbs)

It rearranges how the `Context` struct is allocated so that it’ll be
easier to add per-method/verb context structs which contain it in
future. It also changes all the `sysupdate.c` code to use arguments from
`Context` rather than `arg_*` globals, allowing them to be specified as
varlink parameters in future.

It also moves the existing `systemd-sysupdate.{timer,service}` units
(which periodically run `systemd-sysupdate update`) to
`systemd-sysupdate-update.{timer,service}` to clear space for a
`systemd-sysupdate@.service` and `systemd-sysupdate.socket` to act as a
varlink entry point.

/cc @AdrianVovk
2026-06-26 17:31:30 +02:00
dirhamtriyadi 71c6c88606 hwdb: add touchpad toggle mapping for MSI Katana GF66 12UD 2026-06-26 16:21:20 +01:00
Yu Watanabe 0627dcc869 ci/mkosi: add postmarketos job
Currently, TEST-92-TPM2-SWTPM is skipped as it requires the following:
https://github.com/systemd/systemd/pull/42760
https://gitlab.alpinelinux.org/alpine/aports/-/work_items/18293
2026-06-27 00:18:16 +09:00
Yu Watanabe 1a787e5195 mkosi: add postmarketos support
postmarketOS image can be built with for example the following mkosi.local.conf:
```
[Distribution]
Distribution=postmarketos

[Output]
Format=disk

[Build]
UseSubvolumes=yes

[Runtime]
Firmware=uefi
```
2026-06-27 00:18:16 +09:00
Nick Rosbrook cc6bc699c7 resolve: add query string field to io.systemd.Resolve.DNSError
This is preparation for using varlink methods more in resolvectl. In
particular, this is helpful for proving more accurate error messages,
and maintaining compatibility with existing error messages from the
DBus API.
2026-06-26 09:12:10 -04:00