The default behavior is to sync repository metadata for every image
that does not have a cache and we recently changed behavior to invalidate
all cached images whenever we decide the repository metadata needs to
be resynced.
In systemd we have two images that are not cached because they use BaseTrees=
hence set CacheOnly=metadata to explicitly indicate these two images
should never cause a repository metadata if resync even though they are
not cached.
* 66d51024b7 man: Update caching section
* 4eac60f168 Remove all cached images if repository metadata will be synced
* 025c6c0150 Move Incremental= to inherited settings in docs
* 427970d8fd Make MakeScriptsExecutable= a multiversal setting
* 53bd2da6fe Look at all CacheOnly= settings to determine if we need to sync metadata
* 114ae558ef config / qemu: add Console=headless
Building these over and over again is extremely wasteful. Let's just
build them once and not touch them again unless -ff is specified or
their cache is out-of-date, which is exactly what Incremental=relaxed
does.
This means mkosi.extra/ and such changes won't be picked up for these
anymore unless -ff is used, but that slight annoyance is totally
outweighed by the time saved building the images.
A more straightforward way to extend the default initrd rather than
using a subimage. This mainly allows us to take advantage of mkosi
automatically figuring out whether the initrd needs to be built or not,
speeding up builds when building directory images as the initrd can be
skipped in that case.
* d6ddc66acb Use python3.12 as interpreter in CentOS Stream 9 zipapp
* 89d876c86f tests: fix running pytest on undetected distro
* 61a47eeb1c centos: Fix EPEL repositories for RHEL 10
* e5aa19e2bc oci: allow user defined labels and annotations
* 1680fc5789 man: be more precise that the tools tree distribution is decided by the host distribution
* 7025b8e67d Support resizing output image
F41 is EOL, so we can unconditionally install this package, so that we
don't have to add a new version every time a new release is branched
Fixes test issues such as:
TEST-74-AUX-UTILS.sh[1363]: .//usr/lib/systemd/tests/testdata/units/TEST-74-AUX-UTILS.networkctl.sh: line 55: script: command not found
* 14d2d37a19 sandbox: Make sure we're dumpable before writing uidmap files
* 215a9497cc fedora: Use N-1 key as well when querying rawhide GPG key
* 842a37ed6c Add MakeScriptsExecutable= setting to optionally try to make scripts executable before bailing out
* 814f2004bb build(deps): bump github/codeql-action from 4.31.9 to 4.32.0
* d8f4f628bf build(deps): bump actions/checkout from 6.0.1 to 6.0.2
* 3e55361142 docs: remove superfluous definition colon
* 5901524c48 mkosi-tools: add libarchive-tools package.
* 968392f1b9 docs: Add information about gui mkosi-tools profile
* 0e2960c245 Add missing call to run_locale_gen()
* 41cd2067bc rpm: Set pkgverify_level to digest
* 86fe0f448a dnf: Give advanced users some control over plugins
* 50a1feee52 run: Improve sandbox command logging
* b1dffe1c3c Fix environment variable name for systemd-repart
* 07726068d9 Allow specifying "default" value for Initrds=
* 704f163ec0 Allow setting PORTABLE_PREFIXES= via Environment=
* e6588afb45 opensuse: More GPG key handling fixes
* c367f993dd opensuse: Fetch remote keys as well if RepositoryKeyFetch= is enabled
* 31852c9314 ci: Use mkosi box for unit test CI as well
* e4229f5bf5 Make sure we pass the right context to finalize_default_initrd()
* 9b431b783a tools: don't pull in virtiofsd in bookworm tools trees
* ae2d88d463 build(deps): bump github/codeql-action from 4.31.6 to 4.31.9
* 933401a8b6 build(deps): bump actions/checkout from 6.0.0 to 6.0.1
* 6bfeb4ac86 opensuse: Import GPG keys for all repositories
* 9829b9136f Add support for locale-gen
* 63ae86ec04 nixos: Use repository key fetching by default on nixos
* f01ca9904b docs: Reword dependencies vs tools tree requirement a bit
* ab47ba25ef docs: Minor correction on enabling unprivileged namespaces
* 7bd46a417e docs: Update unprivileged user namespace docs
* ecec612792 Stop installing /var/lib/systemd/
* 120f84266d d/rules: use --no-also for networkd and journald
* 41780703f2 d/rules: do not restart sockets, it fails if the service is running
* 5f219fbd65 Increase number of sections of sd-stub on amd64 too
* 5832d7f614 d/systemd.postinst: use --no-dbus for daemon-reexec
After debian updated the kernel from 6.17 to 6.18, mdadm command fails
with the following:
```
+ mdadm --create /dev/md/mdmirror ...
mdadm: size set to 64512K
mdadm: Can't open /sys/module/md_mod/parameters/legacy_async_del_gendisk
mdadm: init md module parameters fail
```
This seems a bug in mdadm, and fix is already merged in the upstream:
https://github.com/md-raid-utilities/mdadm/pull/228
Until the fix is backported, let's workaround the issue.
See also: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1125390
* 6f4d90be5c Do not install autovt@ for upstream builds
* 8cc28a6b82 Install new files for upstream build
* 0d15255073 Use deb-systemd-invoke to reexec instead of manual calls
* db04e5fa0b Use dh_installsystemd to handle journald and networkd
* d8756a4c82 Use dh_installsystemd more to manage units
* 40b23b0d5d d/tests: drop tests-in-lxd
* 5821c5a350 d/control: have systemd-boot depend on efibootmgr for amd64 and arm64 only
Follow-up for 072e72424b
This does not yet support directory images properly
as systemd itself does not support unpriv directory
images properly yet.
The user profiles are a copy of the system profiles but without
DynamicUser=yes (can't be used by user managers) and without
ProtectHome=yes (this masks /home which breaks StateDirectory= which
is lcoated inside /home)
Split out of #39771
We don't use make use of libucontext yet but merging this early makes
sure my mkosi cached images don't get invalidated every time I switch
between my other work and the fiber branch.
This is analogous to a change in mkosi[1] with the same motivation: some
scripts are run to bootstrap the distribution tree and are thus running
directly on the host system which may not have `/bin/bash` (e.g. NixOS).
As with the `mkosi` change, do that for each shebang for consistency
reasons.
[1] https://github.com/systemd/mkosi/commit/8d2cd50e5192cada7211724ecff3514f0c85cf0f
As announced by a few releases now, finally drop support for
sysvinit scripts.
Keep rc-local generator for now, as it's really a distinct
feature even though from the same era.
The qemu update migrated to noble-updates a couple weeks ago, so it is
no longer necessary to enable noble-proposed (or add the associated apt
pinning config).
* e3642f81d3 kmod: Only use --modname if available
* ddea81d81e arch: Download archlinux-keyring with pacman
* 4a44e1831b Remove unneeded lambdas
* 9c3d23757c Configure pyright included files
* 5e037d514c qemu: Register with systemd-machined in user session
* c4c3d793d0 Create package cache dir before invoking pacman
* d53761c4dd distribution: do not default to release=VERSION_ID for openSUSE Tumbleweed
* c5bc9138fc Wrap build_microcode_initrd in complete_step
* 635159975d Fix typo in manpage
* 59f5f0741e mkosi-addon: drop Output=addon, addon.py already has a default
* be85b8ca0b sandbox: return raw error code from the kernel and friends on failure
* 56f25c1a41 config: replace deprecated sandbox verb with box in help message
* ae24c527d7 sandbox: fix wrong errno passed to OSError()
* e7b9612760 verity: do not copy signing cert in addons/portables/extensions
* f3a029b736 Bump version to 27~devel
* 84af20892b Release 26
* 3fcd3a0fde Adjust logging messages for kmod/fw resolution
* d44aae12b4 Revert "Do not try to install packages that are listed in RemovePackages="
* 1873ad0184 portable: Make sure mountpoints exist in the image
* 5dc693feb0 initrd: Inherit keymap, timezone, hostname and rootpw by default
* cac8dde28a test: Allow passing in extra tests to skip via TEST_SKIP
* 56377438ba Disable sysinit-path for upstream builds
* 0c8ea706f9 Fix links to patches
* 4f5b5a9615 Version 259
* bf8019c840 Version 259~rc3
* ef777d6572 Check if --max-lines is supported by meson
* b562e38e22 Fix use of removed $LOCAL_CONF variable
* 0289127dae Patch machined to continue after selinux denial
* 7e409130ee Version 259~rc2
* 33b38cdbc7 Suppress errors from tar
* ddb6474e94 Drop provides for removed sysvinit tools
* 9ac8c36307 Set meson auto features to auto when building for upstream
* d9f2aa1704 Install systemd-tpm2-generator.8 only for UEFI builds
* ac1c7d8048 Drop dependencies on libcap-dev, no longer used since v259
* c36e5871ca Do not install systemd-sysv-generator.8 in upstream build
* bac0cca0e8 Install new files for upstream build
* 2855fb1302 Update changelog for 259-1 release
* 6f15bdaae7 Update architecture match for 50-pid-max.conf (v3)
* 333cc1fcc5 Downgrade depends to recommends for IPC endpoint of respective libnss modules
* ab99a1b51a Revert "Update architecture match for 50-pid-max.conf"
* b93d7f855a Update changelog for 259~rc3-1 release
* 95c7f8a3d6 Install new udev rule
* 89509d9692 d/t/tests-in-lxd: re-construct --pin-packages arguments for autopkgtest
* 6b77249c71 d/extra/dbus-1: rename systemd-localed-read-only.conf
* 819831c19a Update architecture match for 50-pid-max.conf
* 0ddff89e9d Mirror dmi_arches from meson.build into debian/udev.install
* 398e8791db d/t/control: pull in optional libs for boot-and-services too
* c727922ad5 Update changelog for 259~rc2-1 release
* 8faf105531 Install new varlinkctl bash completion script
* f4b4cea2be d/t/control: ensure unit-tests autopkgtest pulls in dlopened libraries for test
* 7e8aba9883 Update changelog for 259~rc1-1 release
* 5953c42402 Update symbols file for v259~rc1
* 353125ccfa Install new files for v259~rc1
* ca22d1ca4f Drop patches, all merged upstream
* 32c75efca2 d/t/unit-config: fix python decorator copypasta
* e32179d633 d/rules: disable sysv compat in upstream builds
* cf77bd44be Install new files for upstream build
* aa564e5d3b kernel-install: skip 55-initrd.install when an initrd is already staged
* 9e31235211 pacman: Make sure hookdir exists
* 20009b7f48 make_image: log systemd-repart *.conf files at the --debug level
* b94b415db9 run: Increase string limit for strace when debugging sandbox
* 9f6d9405d6 Ring the terminal bell after the last image has been built
* b509b4246d Add glob in default initrd to exclude some exotic drivers
* 189394b8b9 Allow KernelModules= globs to also match relative to modules root dir
* 92bd086e4e zypper: add --force-resolution flag
* 3637749702 kmod: Only add fully resolved fw path if it exists
* d41ac276c9 Add details to KernelModulesInitrd= doc
* 1b6960ddb1 Fix SplitArtifacts=repart-definitions for addons
* 07464f38d6 Add log_step call in build_kernel_modules_initrd
* 18f5885362 Use proper constants for ansi colors
* 454c1602b6 mkosi-obs: add SplitArtifacts=repart-definitions and use it
* 9e57461af6 Copy repart definitions to staging directory
* 1acab18874 Add SplitArtifacts=repart-definitions
* c5c5c225e8 mkosi-obs: always include verity certificate
* ac5babb8e0 Revert "Use Path.relative_to instead of Path.parts"
* cbb1daeb76 action: Use environment variables instead of inputs
* 97c81eef72 portable: support split roothash
This is also temporary, but demonstrates that the version of qemu
currently in noble-proposed fixes https://launchpad.net/bugs/2127974,
which will ultimately allow for the fix to be released to noble-updates.
* 5a476a92de Use Path.relative_to instead of Path.parts
* 03f41faf9f Update doc for mkosi ssh to mention sd v256 sshd-vsock
* e054976d18 Rewrite note on fw deps of kernel modules in manpage
* a046243a50 Add python3-pefile to fedora tools conf
* 0bab54087e Fix truthy condition
* 01c38544b2 code review
* 563dca41da code review
* 6074d14c0e code review
* 7e842db3b1 Don't discard ordering of include/exclude entries in KernelModules=
* 0047b64785 build(deps): bump github/codeql-action from 4.31.2 to 4.31.6
* f13325bc4b build(deps): bump actions/checkout from 5.0.0 to 6.0.0
* 9ac31d1795 Add zram and nfnetlink to default initrd
* 4bdb47b6da verity: copy signing certificate to /usr/lib/verity.d/
* 8865afde9e Improve manpage output using pandoc lua filter (#4005)
* a425313c58 Pass environment to systemd-sysusers invocation
* 23f09d5de7 Make Ruff check for dangling whitespace
* abeed73d13 qemu: Add missing sandbox
* a05872e523 Ssh=yes maps to Ssh=always, update the manpage
* 79489534ca Warn of mkosi's sshd lacking support in distros' SElinux policy
* 696f99da43 Manpage: Update supported output formats
* 21675c4822 Silence swtpm SHA1 signature deprecation warning
* df53510982 DOC: update Ssh= to note sd-v256+ already generates sshd-vsock
* 50ccef7926 Configure default tools tree with ToolsTree=yes
* 0b701c690d opensuse: do not install openSUSE-release for Leap >= 16.0
* 4bababf421 opensuse: fix mirror URL for Leap >= 16.0
* c43123398c config.py: add config_default_proxy_exclude()
* 07a0a2be67 installer: Only mount configured state subdirs into sandbox
* d5efbf6f8c build(deps): bump github/codeql-action from 3.30.5 to 4.31.2
* 2912ed20d5 PTY forward fixes
* 66dab75259 sandbox: Drop all capabilities that don't make sense in userns
* 8fe5df4400 Respect SYSTEMD_TINT_BACKGROUND and SYSTEMD_ADJUST_TERMINAL_TITLE
* b9d208789d log: Drop konsole hack
* 7fa6eac65c Clarify that mkosi.images is not picked up in mkosi.conf.d
* 08a0f768dd vmspawn: Support BindUser=
* c7c3eaee4e mkosi-vm: Enable universe repository for ubuntu in mkosi-vm
* 688e77f1a8 vmspawn: Use --grow-image
* c47b7fe57b arch: Switch to the newly established fastly mirror
* 7db8f2cda3 Match compressed pacman packages too
* e3b3b93c50 Prevent using Overlay=yes with Format=portable
* 83a25324b3 Make sure apt sources are installed when BaseTrees= is in the mix
* f6fa2fd6a0 test: add unit tests for parents_below() utility function
* 1eafbd8d03 Don't print newlines in stash_terminal_title()
* bbaf92b50e Don't print newline after ansi sequences
* d1b84f5fb3 Look for .sdmagic before we consider a PE binary a UKI/addon
* b4efdbf14e Treat /opt the same as /usr for the sandbox
* 71ffced0f1 Rework PACKAGE_GLOBS to be a PackageManager classmethod
* 29605c2757 Various SPDX and whitespace fixes
In the CentOS Hyperscale SIG, we maintain a backport of systemd with
its own rpm spec forked from rawhide.
Let's make it easy to build upstream rpms using the Hyperscale spec
by adding a mkosi hyperscale profile.
Instead of including distribution specific files in the subimages,
let's have one common mkosi.pkgenv/ directory that handles all the
matching which is then included in the subimages.
This gives us more control on exactly how we do the matching.
* 10544812b3 Don't fix up vmlinuz locations if not required
* 9baf551923 Reduce amount of packages in default image
* 9e1a2f18b8 Add support for assert sections
* c7c6e2c0b1 ubuntu: Switch to devel as the default release
* 0822deb69c Improve logging when we can not extract kernel version from filename
* 1fd7ef3db7 Do not build default initrd if Initrds= is specified
* 611c8b46c8 Don't unconditionally sync when PackageCacheDirectory=/var
* ab37f24d38 README: add link to OBS docs for mkosi builds
* 02bf256ebb completion: add reuse ignore comments
* 10ccb0b04f Make sure not all subimages depend on default-initrd subimage
* 442e1ce0f1 mkosi-tools: systemd-boot-tools is now available for all arches
* 307fc1dba3 action: make it work when used as a submodule
* c37a55f91b config: serialize dataclass instances in our JSONEncoder
* f26cb34155 log: set terminal window title in complete_step while mkosi runs
* 280c78e681 Make sure inherited settings are applied for the default initrd
* ae4f2fd718 Fix typo
* 5644f3e83e build(deps): bump github/codeql-action from 3.29.7 to 3.30.5
* 7d7b26b8c9 build(deps): bump actions/checkout from 4.2.2 to 5.0.0
* e805253447 postmarketos: implement is_kernel_package
* dd51d2e019 postmarketos: provide missing i386-vars.fd
* e23e6de66b Do not relabel files when building extension image
* ab05ead5eb Bump various systemd version checks to 258
* 382cc8b450 preset: drop systemd-networkd-wait-online.service
* 477b6b2ed5 mkosi-initrd: install systemd-container in network profile
* 1d167c0b53 mkosi-initrd: add 89-ethernet.network for network profile
* b1e81dec3a mkosi-initrd: Install libseccomp explicitly
* 3c431a141c opensuse: repository non-oss-debug is invalid
* 62ab363149 ci: add an s390x build job for additional coverage
* 62765f2d07 mailmap: deduplicate Daan
* 47f963f40b Revert "ci: Disable PPC jobs temporarily"
* 6a48f83dda dnf: Always specify --best again
* 3702368616 sandbox: Make all relative paths absolute during argparsing
* a587af0bf7 dnf: Fix /var package cache directory check in package_subdirs()
* 56cdbc25b5 Always use repository metadata from /var package cache directory
* 669d4418a3 Add note on Encrypt=yes to Passphrase= docs
* caa129edae Drop BuildSourcesEphemeral=yes from default image config
* 7edca63478 Add devicetree-auto support for UKI
* 6cb1649074 Don't add ncdu for ppc64-le on Fedora
* e019d2d2a6 ci: Disable PPC jobs temporarily
* efdd7a6377 Install new file for upstream build
* 9ebdc6099e d/rules: enable 10-systemd-logind-root-ignore-inhibitors.rules.example on Ubuntu
* 1255cc7663 initramfs-tools: only skip chzdev rules if zdev_early=0
* 4675b281ee d/t/boot-and-services: skip apparmor test on armhf
* 214d6e37b2 d/t/boot-and-services: run transient unit to check syslog messages
* f4e196aa26 d/t/boot-and-services: tweak test_rsyslog regex
* dbd366a43e Install new files for upstream build
* bb7f8ef532 Install new files for upstream build
* efa7cee8a7 Install new file for upstream build
* 95aa1d1685 Install new file for upstream build
* b770f0f01b kernel-install: skip 55-initrd.install when an initrd generator is configured
* af8d1e3134 Update changelog for 258.1-2 release
* 2d0e73cd14 d/libnss-systemd.postinst: Ensure module is enabled for all four databases
* 8e2833a5b6 Automatically figure out the name of the top-level tar dir
* dffbf2beba Make sure fallback source is listed first
* 1d3b892105 Enable sysupdate and sysupdated
Follow up for fe0342edf4
This also drops the mkosi testuser from the wheel and systemd-journal
groups as the integration tests rely on the testuser not being to read
the full journal.
* ea1d871ecd Add missing networkd socket units
* b76b5da2e6 Merge #214 `Drop backwards compat logic from integration tests script`
* 7208fa2b1b Require systemd-rpm-macros for build
* 2e1a6c7474 Require python3-zstandard in ELN
* 79c9db1bc8 Require systemd-libs and systemd-shared to be in the same version
* db38445a7e Drop two patches with workaround (selinux, kernel)
* 593a204189 Version 258.1
* a3e9e27982 Change '%{systemd}' to systemd in Conflicts/Provides/Requires/Recommends
* 88877a4184 Require systemd-networkd and systemd-udev to be in the same version
* 8a446daec7 Version 258 💝
* cceac93491 Pre-create /etc/userdb directory
* b442086d5f Version 258~rc4
* 327e54e421 Add to patch to create userdb root directory with correct label
* 2289d65726 Fix unit name in scriptlet
* 5acde9f1fd Add workaround patch to hopefully pass podman CI tests
* 1f5ed0da1f Version 258~rc3
* 50936458a7 obs: move recipe files in place
* 1bdb4efe40 obs: switch to xz for compression
* be7a4d0863 Version 258~rc2
* 2ace9416e8 obs: also use version with tilde for Source0
* 8d1645af75 Use again %{version} when building in OBS
* 98cc5fd91a Version 258~rc1
* ed7d2f1132 Add "test" that LTO effectively removes unused code from shared lib
* 40b38a04d2 Build docs on 64-bit architectures only
* 5d30fd3b26 Version 257.7
Daan De Meyer
Luca Boccassi
Yu Watanabe
Daan De Meyer
Mike Yuan
Maximilian Bosch
Nick Rosbrook
Zbigniew Jędrzejewski-Szmek