Files
systemd/man
Lennart Poettering 2c4e3b9a6b sysupdate: add PartitionZeroFill= and enable it by default for verity signature partitions
A verity signature partition carries a JSON object that must be followed by
NUL bytes only, up to the end of the partition (dissect refuses anything
else). The split-out artifact repart generates for it however is trimmed of
that padding since b54ef83414, so that it is a plain JSON text file (which
jq nowadays insists on).

sysupdate installs such a file into a partition by simply writing it at the
partition's offset, leaving whatever follows in place. Hence, once a shorter
signature (e.g. after rotating to a different key type) is installed into a
partition that previously held a longer one, the tail of the old signature
survives right after the new JSON object, and the partition becomes
unparsable.

Add a new PartitionZeroFill= boolean setting to the [Target] section, which
makes the importer continue writing zeroes up to the end of the partition
once the payload has been written, by passing --zero-fill= to systemd-import
and systemd-pull. It defaults to off, except for verity signature partitions
(which are tiny, hence this is cheap) where it defaults to on.

Fixes: #43567
(cherry picked from commit d3b6d765a5b320d6d864591c6a7b87e1047d0c78)
2026-10-16 17:24:51 +01:00
..
2024-12-25 17:00:31 +01:00
2023-12-25 09:15:53 +01:00
2025-09-18 10:57:38 +01:00
2025-08-10 13:40:32 +02:00
2025-08-11 10:30:26 +02:00
2025-10-04 18:13:27 +02:00
2026-05-18 21:42:56 +02:00
2025-08-11 10:30:26 +02:00
2025-08-11 10:30:26 +02:00
2024-12-25 17:00:31 +01:00
2024-12-25 17:00:31 +01:00
2025-08-10 13:40:32 +02:00
2023-12-26 08:59:53 +01:00
2023-12-26 08:59:53 +01:00
2023-12-26 13:10:36 +01:00
2026-02-20 01:18:54 +09:00
2026-09-18 20:23:00 +02:00
2025-07-16 05:47:38 +09:00
2023-12-24 09:32:26 +01:00
2024-11-06 19:06:40 +09:00
2025-09-18 10:57:38 +01:00