Bump actions/upload-artifact from 3.1.2 to 4.3.1

.circleci/config.yml

@@ -0,0 +1,25 @@
+version: 2.1
+
+setup: true
+
+orbs:
+  continuation: circleci/[email protected]
+  droidian-buildd: droidian-releng/droidian-buildd-orb@volatile
+
+jobs:
+  setup:
+    executor: continuation/default
+    resource_class: small
+    steps:
+      - droidian-buildd/checkout
+      - droidian-buildd/generate
+      - continuation/continue:
+          configuration_path: generated_config.yml
+
+workflows:
+  setup:
+    jobs:
+      - setup:
+          filters:
+            tags:
+              only: /^droidian\/.*\/.*/

.github/workflows/cifuzz.yml

@@ -60,7 +60,7 @@ jobs:
           sanitizer: ${{ matrix.sanitizer }}
           output-sarif: true
       - name: Upload Crash
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3
         if: failure() && steps.build.outcome == 'success'
         with:
           name: ${{ matrix.sanitizer }}-${{ matrix.architecture }}-artifacts

.github/workflows/gather-pr-metadata.yml

@@ -30,7 +30,7 @@ jobs:
           echo ${{ github.event.number }} >./${{ env.PULL_REQUEST_METADATA_DIR }}/${{ env.PULL_REQUEST_METADATA_FILE }}
 
       - name: Upload Pull Request Metadata artifact
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3
         with:
           name: ${{ env.PULL_REQUEST_METADATA_FILE }}
           path: ${{ env.PULL_REQUEST_METADATA_DIR }}

.packit.yml

@@ -16,6 +16,13 @@ upstream_tag_template: "v{version}"
 srpm_build_deps: []
 
 actions:
+  get-current-version:
+    # Show the closest matching tag for the checked out revision, otherwise
+    # Packit tries to get the latest tag by creation date, which doesn't work
+    # well in the systemd-stable repo. We also need to sanitize it manually
+    # since "upstream_tag_template" defined above doesn't apply here.
+    - "bash -ec 'git describe --tags --abbrev=0 | cut -b 2-'"
+
   post-upstream-clone:
     # Use the Fedora Rawhide specfile
     - "git clone https://src.fedoraproject.org/rpms/systemd .packit_rpm --depth=1"

debian/changelog

@@ -1,3 +1,47 @@
+systemd (255.3-2) sid; urgency=medium
+
+  * Backport patches to fix reproducibility issues
+  * Salsa: re-enable reprotest
+
+ -- Luca Boccassi <[email protected]>  Mon, 29 Jan 2024 10:46:19 +0000
+
+systemd (255.3-1) sid; urgency=medium
+
+  * New upstream version 255.3
+  * Drop patches merged upstream
+  * Refresh patches
+
+ -- Luca Boccassi <[email protected]>  Wed, 24 Jan 2024 20:03:15 +0000
+
+systemd (255.2-4) sid; urgency=medium
+
+  * autopkgtest: add btrfs-progs Depends to upstream suite.
+    Required by TEST-83-BTRFS and testcase_btrfs_basic from
+    TEST-64-UDEV-STORAGE.
+  * Revert "test: deny-list TEST-13-NSPAWN"
+    This reverts commit df8e5367aca20e0c75c9c91f826d22d8a0f7e36d.
+  * autopkgtest: add multipath-tools and kpartx Depends to upstream suite.
+    Required by testcase_multipath_basic_failover from TEST-64-UDEV-STORAGE.
+  * test: install correct kpartx udev rules on Debian
+
+ -- Michael Biebl <[email protected]>  Sat, 06 Jan 2024 16:21:03 +0100
+
+systemd (255.2-3) sid; urgency=medium
+
+  * Cherry-pick fixes for upstream integration tests.
+    Fixes TEST-07-PID1, TEST-08-INITRD (skip), TEST-26-SYSTEMCTL and
+    TEST-75-RESOLVED.
+  * Add explicit Build-Depends on debhelper (>= 13.11.6)
+    This ensures we have a recent enough version of dh_installsystemd that
+    supports service files in /usr/lib/.
+  * test: deny-list TEST-13-NSPAWN.
+    The default ram size of 1024M for qemu virt is not sufficient
+    to make the test pass reliably on Debian sid/trixie.
+    Disable the test for now until this has been addressed in debci:
+    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059840
+
+ -- Michael Biebl <[email protected]>  Tue, 02 Jan 2024 11:44:49 +0100
+
 systemd (255.2-2) unstable; urgency=medium
 
   * udev: mips does not install dmi_memory_id and its rules

debian/control

@@ -14,6 +14,7 @@ Vcs-Git: https://salsa.debian.org/systemd-team/systemd.git
 Vcs-Browser: https://salsa.debian.org/systemd-team/systemd
 Homepage: https://www.freedesktop.org/wiki/Software/systemd
 Build-Depends: debhelper-compat (= 13),
+               debhelper (>= 13.11.6),
                dh-exec,
                dh-package-notes,
                dh-sequence-installnss,
@@ -105,6 +106,7 @@ Conflicts: consolekit,
            libpam-ck-connector,
            systemd-shim,
            opensysusers,
+           droidian-quirks-brightness (< 79),
 Breaks: less (<< 563),
         sicherboot (<< 0.1.6),
         dracut (<< 059-5),

debian/patches/Sort-input-file-list.patch

@@ -0,0 +1,28 @@
+From: "Bernhard M. Wiedemann" <[email protected]>
+Date: Thu, 25 Jan 2024 05:48:35 +0100
+Subject: Sort input file list
+
+so that /usr/lib/systemd/tests/unit-tests/test-libsystemd-sym
+builds in a reproducible way
+in spite of non-deterministic filesystem readdir order
+
+See https://reproducible-builds.org/ for why this is good.
+
+This patch was done while working on reproducible builds for openSUSE.
+---
+ src/test/generate-sym-test.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/test/generate-sym-test.py b/src/test/generate-sym-test.py
+index e97b6bb..028d108 100755
+--- a/src/test/generate-sym-test.py
++++ b/src/test/generate-sym-test.py
+@@ -66,7 +66,7 @@ print('''        {}
+ }, symbols_from_source[] = {''')
+
+ for dirpath, _, filenames in sorted(os.walk(sys.argv[2])):
+-    for filename in filenames:
++    for filename in sorted(filenames):
+         if not filename.endswith(".c") and not filename.endswith(".h"):
+             continue
+         with open(os.path.join(dirpath, filename), "r") as f:

debian/patches/debian/fsckd-daemon-for-inter-fsckd-communication.patch

@@ -241,10 +241,10 @@ index 0000000..b7ad58d
 +
 +</refentry>
 diff --git a/meson.build b/meson.build
-index 7419e2b..4efaa1b 100644
+index f1f4e7e..24f5bd2 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2149,6 +2149,7 @@ subdir('src/environment-d-generator')
+@@ -2152,6 +2152,7 @@ subdir('src/environment-d-generator')
  subdir('src/escape')
  subdir('src/firstboot')
  subdir('src/fsck')

debian/patches/meson-drop-arch-filtering-in-syscall-list.patch

@@ -0,0 +1,47 @@
+From: =?utf-8?q?Zbigniew_J=C4=99drzejewski-Szmek?= <[email protected]>
+Date: Thu, 25 Jan 2024 13:26:21 +0100
+Subject: meson: drop arch filtering in syscall list
+
+I added the filtering in 752fedbea7c02c82287c7ff2a4139f528b3f7ba8 as a way
+to reduce the number of items in the tables. I thought it's "obvious", but
+it might not be so.
+
+One immediate problem is that the filter is broken, because on arm64,
+os.uname().machine returns "aarch64", so we incorrectly filter out the arm
+syscalls (there is just one: arm_fadvise64_64). Of course we could fix the
+filter, but I think it's better to nuke it altogether. The filter on applies to
+1 arm syscall and 5 s390 syscalls, and we have 500+ other syscalls, so this
+"optimization" doesn't really matter. OTOH, if we get the filter wrong,
+the result is bad. And also, the existence of the filter at all creates
+problems for cross-builds.
+
+I wanted to get rid of 'generate-syscall-list.py', but we need to generate a
+backslash in the output. https://github.com/mesonbuild/meson/issues/1564 makes
+this very very hard, since any attempt to put a backslash an inline argument
+results in the backslash being replaces by a forward slash, which doesn't quite
+have the same meaning. So let's use a standalone script until
+https://github.com/mesonbuild/meson/issues/1564 is resolved.
+---
+ src/shared/generate-syscall-list.py | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/src/shared/generate-syscall-list.py b/src/shared/generate-syscall-list.py
+index 3ee19ff..c0975a0 100755
+--- a/src/shared/generate-syscall-list.py
++++ b/src/shared/generate-syscall-list.py
+@@ -2,15 +2,6 @@
+ # SPDX-License-Identifier: LGPL-2.1-or-later
+
+ import sys
+-import os
+-
+-s390 = 's390' in os.uname().machine
+-arm = 'arm' in os.uname().machine
+
+ for line in open(sys.argv[1]):
+-    if line.startswith('s390_') and not s390:
+-        continue
+-    if line.startswith('arm_') and not arm:
+-        continue
+-
+     print('"{}\\0"'.format(line.strip()))

debian/patches/series

@@ -7,3 +7,10 @@ debian/systemctl-do-not-shutdown-immediately-on-scheduled-shutdo.patch
 debian/Downgrade-a-couple-of-warnings-to-debug.patch
 debian/Skip-flaky-test_resolved_domain_restricted_dns-in-network.patch
 debian/localectl-disable-keymap-support.patch
+test-skip-TEST-08-INITRD-if-systemd-didn-t-run-in-the-ini.patch
+test-install-empty-directories-with-NO_BUILD-1.patch
+test-don-t-check-for-Dinstall-tests-true-with-NO_BUILD-1.patch
+test-tell-delv-to-load-anchors-from-etc-bind.keys-explici.patch
+Sort-input-file-list.patch
+meson-drop-arch-filtering-in-syscall-list.patch
+test-unset-TZ-before-timezone-sensitive-unit-tests-are-ru.patch

debian/patches/test-don-t-check-for-Dinstall-tests-true-with-NO_BUILD-1.patch

@@ -0,0 +1,27 @@
+From: Frantisek Sumsal <[email protected]>
+Date: Thu, 14 Dec 2023 15:06:46 +0100
+Subject: test: don't check for -Dinstall-tests=true with NO_BUILD=1
+
+(cherry picked from commit 58bcbad86cc910e007fae3c66c3a5cfc17046801)
+---
+ test/test-functions | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/test/test-functions b/test/test-functions
+index 8f04a37..948a00b 100644
+--- a/test/test-functions
++++ b/test/test-functions
+@@ -3345,9 +3345,10 @@ test_create_image() {
+ }
+
+ test_setup() {
+-    if get_bool "${TEST_REQUIRE_INSTALL_TESTS:?}" && \
+-            command -v meson >/dev/null && \
+-            [[ "$(meson configure "${BUILD_DIR:?}" | grep install-tests | awk '{ print $2 }')" != "true" ]]; then
++    if ! get_bool "$NO_BUILD" && \
++         get_bool "${TEST_REQUIRE_INSTALL_TESTS:?}" && \
++         command -v meson >/dev/null && \
++         [[ "$(meson configure "${BUILD_DIR:?}" | grep install-tests | awk '{ print $2 }')" != "true" ]]; then
+         dfatal "$BUILD_DIR needs to be built with -Dinstall-tests=true"
+         exit 1
+     fi

debian/patches/test-install-empty-directories-with-NO_BUILD-1.patch

@@ -0,0 +1,76 @@
+From: Frantisek Sumsal <[email protected]>
+Date: Thu, 14 Dec 2023 15:06:12 +0100
+Subject: test: install empty directories with NO_BUILD=1
+
+Resolves: #30478
+(cherry picked from commit fdd380dde2ec2cbcecbd20b91cf6b819ef3dc0db)
+---
+ test/test-functions | 42 ++++++++++++++++++++++++------------------
+ 1 file changed, 24 insertions(+), 18 deletions(-)
+
+diff --git a/test/test-functions b/test/test-functions
+index 1777982..8f04a37 100644
+--- a/test/test-functions
++++ b/test/test-functions
+@@ -1327,19 +1327,35 @@ install_compiled_systemd() {
+     fi
+ }
+
++install_package_file() {
++    local file="${1:?}"
++
++    # Skip missing files (like /etc/machine-info)
++    [[ ! -e "$file" ]] && return 0
++    # Skip python unit tests, since the image_install machinery will try to pull
++    # in the whole python stack in a very questionable state, making the tests fail.
++    # And given we're trying to transition to mkosi-based images anyway I'm not even
++    # going to bother
++    [[ "$file" =~ /tests/unit-tests/.*.py$ ]] && return 0
++    # If the current file is a directory, create it with the original
++    # mode; if it's a symlink to a directory, copy it as-is
++    if [[ -d "$file" ]]; then
++        inst_dir "$file"
++    else
++        inst "$file"
++    fi
++}
++
+ install_debian_systemd() {
+     dinfo "Install debian systemd"
+
+-    local files
++    local deb file
+
+     while read -r deb; do
+-        files="$(dpkg-query -L "$deb" 2>/dev/null)" || continue
+         ddebug "Install debian files from package $deb"
+-        for file in $files; do
+-            [ -e "$file" ] || continue
+-            [ ! -L "$file" ] && [ -d "$file" ] && continue
+-            inst "$file"
+-        done
++        while read -r file; do
++            install_package_file "$file"
++        done < <(dpkg-query -L "$deb" 2>/dev/null)
+     done < <(grep -E '^Package:' "${SOURCE_DIR}/debian/control" | cut -d ':' -f 2)
+ }
+
+@@ -1354,17 +1370,7 @@ install_rpm() {
+
+     dinfo "Installing contents of RPM $rpm"
+     while read -r file; do
+-        # Skip missing files (like /etc/machine-info)
+-        [[ ! -e "$file" ]] && continue
+-        # Skip directories unless they are a symlink (both -L and -d pass in this case)
+-        [[ -d "$file" && ! -L "$file" ]] && continue
+-        # Skip python unit tests, since the image_install machinery will try to pull
+-        # in the whole python stack in a very questionable state, making the tests fail.
+-        # And given we're trying to transition to mkosi-based images anyway I'm not even
+-        # going to bother
+-        [[ "$file" =~ /tests/unit-tests/.*.py$ ]] && continue
+-
+-        image_install "$file"
++        install_package_file "$file"
+     done < <(rpm -ql "$rpm")
+ }
+

debian/patches/test-skip-TEST-08-INITRD-if-systemd-didn-t-run-in-the-ini.patch

@@ -0,0 +1,51 @@
+From: Frantisek Sumsal <[email protected]>
+Date: Fri, 15 Dec 2023 11:04:39 +0100
+Subject: test: skip TEST-08-INITRD if systemd didn't run in the initrd
+
+This test requires systemd in the initrd, which is not the case in
+mkinitrd-based initrds (Ubuntu/Debian).
+
+Resolves: #30481
+(cherry picked from commit 57d61ff319ec217294d9e0c4646010322b8be5e5)
+---
+ test/TEST-08-INITRD/test.sh | 5 +++++
+ test/units/testsuite-08.sh  | 8 ++++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/test/TEST-08-INITRD/test.sh b/test/TEST-08-INITRD/test.sh
+index 29fd1f7..caa27f6 100755
+--- a/test/TEST-08-INITRD/test.sh
++++ b/test/TEST-08-INITRD/test.sh
+@@ -44,8 +44,13 @@ EOF
+ }
+
+ check_result_qemu_hook() {
++    local workspace="${1:?}"
+     local console_log="${TESTDIR:?}/console.log"
+
++    if [[ -e "$workspace/skipped" ]]; then
++        return 0
++    fi
++
+     if [[ ! -e "$console_log" ]]; then
+         dfatal "Missing console log - this shouldn't happen"
+         return 1
+diff --git a/test/units/testsuite-08.sh b/test/units/testsuite-08.sh
+index 9598c8e..5c6b4ce 100755
+--- a/test/units/testsuite-08.sh
++++ b/test/units/testsuite-08.sh
+@@ -8,6 +8,14 @@ if systemd-detect-virt -qc; then
+     exit 1
+ fi
+
++# This test requires systemd to run in the initrd as well, which is not the case
++# for mkinitrd-based initrd (Ubuntu/Debian)
++if [[ "$(systemctl show -P InitRDTimestampMonotonic)" -eq 0 ]]; then
++    echo "systemd didn't run in the initrd, skipping the test"
++    touch /skipped
++    exit 0
++fi
++
+ # We should've created a mount under /run in initrd (see the other half of the test)
+ # that should've survived the transition from initrd to the real system
+ test -d /run/initrd-mount-target