From: Daan De Meyer <daan@amutable.com>
Date: Sun, 5 Apr 2026 17:46:12 +0000 (+0000)
Subject: vmspawn: Use ~ instead of ! as negation prefix for --firmware-features=
X-Git-Tag: v261-rc1~592
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fb4bfe651b7dda85b0545d340eac21c7988fe383;p=thirdparty%2Fsystemd.git

vmspawn: Use ~ instead of ! as negation prefix for --firmware-features=

Switch the negation character for firmware feature exclusion from
"!" to "~" to be consistent with other systemd options that support
negation such as SystemCallFilter=.
---

diff --git a/man/systemd-vmspawn.xml b/man/systemd-vmspawn.xml
index d65bd965a39..cca7496ed04 100644
--- a/man/systemd-vmspawn.xml
+++ b/man/systemd-vmspawn.xml
@@ -358,7 +358,7 @@
           <listitem><para>Takes a comma-delimited list of firmware feature strings. This option may be
           specified multiple times, in which case the feature lists are combined. When specified, only
           firmware definitions that have all the required features will be considered during automatic
-          firmware discovery. Features prefixed with <literal>!</literal> are excluded: firmware that has
+          firmware discovery. Features prefixed with <literal>~</literal> are excluded: firmware that has
           such a feature will be skipped. If a feature appears in both the included and excluded lists,
           inclusion takes priority. By default, firmware with the <literal>enrolled-keys</literal>
           feature is excluded. If an empty string is passed, both the included and excluded feature lists
@@ -384,7 +384,7 @@
           <listitem><para>Configure whether to search for firmware which supports Secure Boot. Takes a
           boolean or <literal>auto</literal>. Setting this to yes is equivalent to
           <option>--firmware-features=secure-boot</option> and setting this to no is equivalent to
-          <option>--firmware-features=!secure-boot</option>. Setting this to <literal>auto</literal>
+          <option>--firmware-features=~secure-boot</option>. Setting this to <literal>auto</literal>
           removes <literal>secure-boot</literal> from both the included and excluded feature lists.</para>
 
           <xi:include href="version-info.xml" xpointer="v255"/></listitem>
diff --git a/src/vmspawn/vmspawn.c b/src/vmspawn/vmspawn.c
index 92a5555f64b..96ca4cee91e 100644
--- a/src/vmspawn/vmspawn.c
+++ b/src/vmspawn/vmspawn.c
@@ -857,7 +857,7 @@ static int parse_argv(int argc, char *argv[]) {
                                 return log_oom();
 
                         STRV_FOREACH(feature, features) {
-                                const char *e = startswith(*feature, "!");
+                                const char *e = startswith(*feature, "~");
                                 r = set_put_strdup(e ? &arg_firmware_features_exclude : &arg_firmware_features_include, e ?: *feature);
                                 if (r < 0)
                                         return log_oom();