Yu Watanabe [Sat, 4 Oct 2025 21:35:54 +0000 (23:35 +0200)]
shared/bootspec: don't warn for new `loader.conf` options and correctly parse new `uki` and `profile` boot entry options (#39165)
Commit e2a3d562189c413de3262ec47cdc1e1b0b13d78b added the `uki` option
to sd-boot, and 1e9c9773b994f2f703a5aa5ba80961e90be3a892 added
`profile`, but because these were not added in src/shared/bootspec,
bootctl still shows warnings like `Unknown line 'uki', ignoring.` when
parsing the config. This PR allows parsing and displaying them correctly
in `bootctl` output. It also stops it from printing a warning for any of
the new `loader.conf` options (`log-level`, `reboot-on-error`, etc.).
Note that `uki-url` is still not handled as I can't easily test it.
man: fix advice regarding thread safety of libsystemd
The prohibition to move libsystemd objects between threads was added in 64a7ef8bc06b5dcfcd9f99ea10a43bde75c4370f ('man: be more explicit about thread
safety of sd_journal'). At the time, this was valid, because we were using the
mempool for allocation and it apparently didn't handle access from different
threads. Sadlly, the commit links to a bugzilla entry referenced in the commit
is not publicly visible anymore, so the details are murky. But we stopped using
the mempool in a5d8835c78112206bbf0812dd4cb471f803bfe88 ('mempool: only enable
mempool use when linked to libsystemd-shared.so'), with subsequent followup in b01f31954f1c7c4601925173ae2638b572224e9a ('Turn mempool_enabled() into a weak
symbol'). The restriction added in the man page is not necessary since then.
The text in the man page was arguably incorrect in calling the code
"thread-agnostic". If the code does not support being touched from threads at
all and has global state to tied to the main thread, it is not "agnostic", but
just doesn't support threads.
(I'm looking into https://github.com/systemd/python-systemd/issues/143, and
with the current scheme, the python-systemd module and all python code using
libsystemd would be very hard to use. With the change to free-threaded python
in python3.13, i.e. the replacement of single Global Interpreter Lock by
locking on individual objects, this limitation would become even more
constraining.)
val4oss [Wed, 1 Oct 2025 15:32:53 +0000 (17:32 +0200)]
TEST-74-AUX-UTILS: use sshd_config.d
* From the TEST-74-AUX-UTILS.ssh.sh writing directly into
/etc/ssh/sshd_config can hide config from distro using /usr/etc.
* Using directory configuration /etc/ssh/sshd_config.d/* suits for all
cases.
Most of those were dropped in 7d247d3cb875e1778e6cc81dbf255b13092b29e0. I left
behind the few cases where the 'output' name was different from the target name.
But we actually don't need those either, so get rid of those. (And one case
where I missed the name argument.)
No functional change, except that e.g. 'ninja -C build update-man-rules-impl'
doesn't work, but I hope nobody was using that.
Stop specifying license for generated file, instead mark as generated
I exclude generated files from license check, and I noticed
that this file was marked with a license header, which doesn't
make much sense, it is not copyrightable.
Commit 1e9c9773b994f2f703a5aa5ba80961e90be3a892 makes sd-boot recognize
a 'profile' option in a boot loader entry but bootctl and other
components parsing said config do not know about it.
This commit makes the option get parsed correctly and displays it too.
Felix Pehla [Sat, 27 Sep 2025 13:01:06 +0000 (15:01 +0200)]
shared/bootspec: parse 'uki' boot entry option
Commit e2a3d562189c413de3262ec47cdc1e1b0b13d78b (as part of #36314)
makes sd-boot recognize a 'uki' stanza in a boot loader entry and
uapi-group/specifications@3f2bd8236d7f9ce6dedf8bda9cadffd0d363cb08 adds
it to the BLS, but bootctl and other components parsing said config do
not know about it, leading to the error message
`Unknown line 'uki', ignoring.` when attempting to parse the same entry.
This commit makes it get parsed the same way that that 'efi' is.
This adds what #39101 and #39070 did for the regular firstboot wizard
but for the homectl firstboot part: i.e. port to the generic prompt
loop, show the "chrome" bars, and mute the console.
And then it also makes querying for aux groups and shells optional,
because quite frankly, i am not sure what to answer there.
vmspawn: try to set up swtpm state for 4K RSA keys support
The next version of swtpm will support RSA4096, but it needs to be called
with a new parameter in order to do so. Try with it first, and if
execution fails, fallback to running without it.
This is especially needed for OBS builds, as the signing key is RSA4096
and cannot be changed by users, so the generated UKIs have RSA4096 signatures
for the pcrsig sections, and swtpm refuses them without the new support.
Revert "Bump required minimum version of libfido2 to 1.5.0" and add missing def instead
It helps nobody to break compatibility for a missing definition
for printing an error.
Just add the missing definition if not present, as it is already
done for thousands of others from the kernel, glibc, etc.
time-util: fix issues in parse_timestamp() and optimize performance
Previously, an input string ends with short timezone spec e.g. WET,
was parsed by setting $TZ environment variable to the timezone.
But the timezone might be different from the original local timezone,
thus the result might not follow the timezone change in the original
local timezone.
This makes the check of the short timezone spec with tzname[] earlier,
then it is not necessary to load another timezone file for e.g. WET,
and provides expected time.
This also make it use SAVE_TIMEZONE macro and drop use of forking
process. This makes greatly improve performance when parsing string
that contains timezone different from the current local timezone.
Unfortunately, there is still one corner case that our test fails.
When tzdata is built with rearguard enabled, then at least
Africa/Windhoek timezone does not provide correct time, but time shifted
1 hour from the original.
man: add missing description for udev_enumerate_new functions
Add proper description section for udev_enumerate_new(), udev_enumerate_ref(),
and udev_enumerate_unref() functions. The description matches the source code
comments for consistency.
firstboot: don't talk about any 'new' installation
The firstboot interface might pop-up also during live mode (because it's
just very useful to have the right kbd mapping applied), and that's
hardly a "new installation". Hence use more generic terms
firstboot: optionally, don't query for keymap unless connected to a real VT
The keymap only really matters if there's local access to a system, i.e.
if there's actually a physical kbd directly connected to it, to apply it
to. If during firstboot we are not talked to via a VT (but via SSH,
container, or hypervisor console or so instead), then it's very unlikely
we ever are. Hence, don't ask for a keymap, and let#s shortcut the
questions asked at boot.
We only show this blurb on the first question, but the first question is
interactive anyway, hence no need to wait for input first explicitly, we
won't progress anyway without user input.
ethtool-util: drop use of union ethtool_link_usettings
Previously, we shift arrays on read and then shift back on write.
It is inefficient and not necessary.
Let's directly use the buffer that kernel provides as is.
The very initial implementation sets cmd with zero when the bitmap
length does not match. But, it is fixed by
https://github.com/torvalds/linux/commit/793cf87de9d1a62dc9079c3ec5fcc01cfc62fafb
Fortunately, our code does not follow the outdated comment, but checks
cmd field correctly.
ethtool-util: drop use of deprecated ETHTOOL_GSET and ETHTOOL_SSET
The methods are deprecated since kernel v4.20,
https://github.com/torvalds/linux/commit/9b3004953503462a4fab31b85e44ae446d48f0bd
and they are trivial wrapper of ETHTOOL_GLINKSETTINGS and ETHTOOL_SLINKSETTINGS,
respectively. Hence, the fallback logic is nowadays completely
meaningless. Let's drop them.
Let's check both the per user machined and the system machined instead
of only the system machined. We give preference to the per user machined
and fall back to the system machined.
projects / thirdparty / systemd.git / log
