close some gaps towards eworms 258rc3

3 files changed, 43 insertions, 30 deletions

diff --git a/.SRCINFO b/.SRCINFO
index ac9fa3b..c96152f 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,11 +1,12 @@
 pkgbase = systemd-git
 	pkgdesc = systemd (git version)
-	pkgver = 258.devel.r80631.a94520dc78c
+	pkgver = 258.rc3.r83398.46a688c5598
 	pkgrel = 1
 	url = https://www.github.com/systemd/systemd
 	arch = x86_64
 	license = LGPL-2.1-or-later
 	makedepends = acl
+	makedepends = apparmor
 	makedepends = cryptsetup
 	makedepends = docbook-xsl
 	makedepends = gperf
@@ -53,6 +54,7 @@ pkgbase = systemd-git
 	makedepends = qrencode
 	makedepends = lib32-gcc-libs
 	makedepends = python-pefile
+	makedepends = linux-headers
 	conflicts = mkinitcpio<38-1
 	options = !strip
 	source = systemd-git-stable::git+https://github.com/systemd/systemd
@@ -68,6 +70,7 @@ pkgbase = systemd-git
 	source = 30-systemd-daemon-reload-system.hook
 	source = 30-systemd-daemon-reload-user.hook
 	source = 30-systemd-hwdb.hook
+	source = 30-systemd-restart-marked.hook
 	source = 30-systemd-sysctl.hook
 	source = 30-systemd-tmpfiles.hook
 	source = 30-systemd-udev-reload.hook
@@ -85,6 +88,7 @@ pkgbase = systemd-git
 	sha512sums = a436d3f5126c6c0d6b58c6865e7bd38dbfbfb7babe017eeecb5e9d162c21902cbf4e0a68cf3ac2f99815106f9fa003b075bd2b4eb5d16333fa913df6e2f3e32a
 	sha512sums = 190112e38d5a5c0ca91b89cd58f95595262a551530a16546e1d84700fc9644aa2ca677953ffff655261e8a7bff6e6af4e431424df5f13c00bc90b77c421bc32d
 	sha512sums = a1661ab946c6cd7d3c6251a2a9fd68afe231db58ce33c92c42594aedb5629be8f299ba08a34713327b373a3badd1554a150343d8d3e5dfb102999c281bd49154
+	sha512sums = f6b154fdc612916d7788720cf703e34255b43ba2d19413de5f3f63f07508f4ce561ca138f987c2118c7128e1dfb01976b0ac7d5efee4d9ebaadd180e70fa013e
 	sha512sums = 9426829605bbb9e65002437e02ed54e35c20fdf94706770a3dc1049da634147906d6b98bf7f5e7516c84068396a12c6feaf72f92b51bdf19715e0f64620319de
 	sha512sums = da7a97d5d3701c70dd5388b0440da39006ee4991ce174777931fea2aa8c90846a622b2b911f02ae4d5fffb92680d9a7e211c308f0f99c04896278e2ee0d9a4dc
 	sha512sums = a50d202a9c2e91a4450b45c227b295e1840cc99a5e545715d69c8af789ea3dd95a03a30f050d52855cabdc9183d4688c1b534eaa755ebe93616f9d192a855ee3
@@ -97,7 +101,7 @@ pkgname = systemd-git
 	license = CC0-1.0
 	license = GPL-2.0-or-later
 	license = MIT-0
-	depends = systemd-libs-git=258.devel.r80631.a94520dc78c
+	depends = systemd-libs-git=258.rc3.r83398.46a688c5598
 	depends = acl
 	depends = libacl.so
 	depends = bash
@@ -130,11 +134,11 @@ pkgname = systemd-git
 	depends = libcrypto.so
 	depends = libssl.so
 	optdepends = libmicrohttpd: systemd-journal-gatewayd and systemd-journal-remote
+	optdepends = apparmor: additional security features
 	optdepends = quota-tools: kernel-level quota management
 	optdepends = systemd-sysvcompat: symlink package to provide sysvinit binaries
-	optdepends = systemd-ukify-git=258.devel.r80631.a94520dc78c: combine kernel and initrd into a signed Unified Kernel Image
+	optdepends = systemd-ukify-git=258.rc3.r83398.46a688c5598: combine kernel and initrd into a signed Unified Kernel Image
 	optdepends = polkit: allow administration as unprivileged user
-	optdepends = python: Unified Kernel Image with ukify
 	optdepends = curl: systemd-journal-upload, machinectl pull-tar and pull-raw
 	optdepends = gnutls: systemd-journal-gatewayd and systemd-journal-remote
 	optdepends = qrencode: show QR codes
@@ -146,9 +150,9 @@ pkgname = systemd-git
 	optdepends = libp11-kit: support PKCS#11
 	optdepends = tpm2-tss: unlocking LUKS2 volumes with TPM2
 	provides = nss-myhostname
-	provides = systemd-tools=258.devel.r80631.a94520dc78c
-	provides = udev=258.devel.r80631.a94520dc78c
-	provides = systemd=258.devel.r80631.a94520dc78c
+	provides = systemd-tools=258.rc3.r83398.46a688c5598
+	provides = udev=258.rc3.r83398.46a688c5598
+	provides = systemd=258.rc3.r83398.46a688c5598
 	conflicts = nss-myhostname
 	conflicts = systemd-tools
 	conflicts = udev
@@ -156,7 +160,6 @@ pkgname = systemd-git
 	replaces = nss-myhostname
 	replaces = systemd-tools
 	replaces = udev
-	backup = etc/pam.d/systemd-user
 	backup = etc/systemd/coredump.conf
 	backup = etc/systemd/homed.conf
 	backup = etc/systemd/journald.conf
@@ -189,41 +192,41 @@ pkgname = systemd-libs-git
 	provides = libsystemd
 	provides = libsystemd.so
 	provides = libudev.so
-	provides = systemd-libs=258.devel.r80631.a94520dc78c
+	provides = systemd-libs=258.rc3.r83398.46a688c5598
 	conflicts = libsystemd
 	conflicts = systemd-libs
 	replaces = libsystemd
 
 pkgname = systemd-resolvconf-git
 	pkgdesc = systemd resolvconf replacement (for use with systemd-resolved) (git version)
-	depends = systemd-git=258.devel.r80631.a94520dc78c
+	depends = systemd-git=258.rc3.r83398.46a688c5598
 	provides = openresolv
 	provides = resolvconf
-	provides = systemd-resolvconf=258.devel.r80631.a94520dc78c
+	provides = systemd-resolvconf=258.rc3.r83398.46a688c5598
 	conflicts = resolvconf
 	conflicts = systemd-resolvconf
 
 pkgname = systemd-sysvcompat-git
 	pkgdesc = sysvinit compat for systemd (git version)
-	depends = systemd-git=258.devel.r80631.a94520dc78c
-	provides = systemd-sysvcompat=258.devel.r80631.a94520dc78c
+	depends = systemd-git=258.rc3.r83398.46a688c5598
+	provides = systemd-sysvcompat=258.rc3.r83398.46a688c5598
 	conflicts = sysvinit
 	conflicts = systemd-sysvcompat
 
 pkgname = systemd-tests-git
 	pkgdesc = systemd tests (git version)
-	depends = systemd=258.devel.r80631.a94520dc78c
-	provides = systemd-tests=258.devel.r80631.a94520dc78c
+	depends = systemd=258.rc3.r83398.46a688c5598
+	provides = systemd-tests=258.rc3.r83398.46a688c5598
 	conflicts = systemd-tests
 
 pkgname = systemd-ukify-git
 	pkgdesc = Combine kernel and initrd into a signed Unified Kernel Image (git version)
-	depends = systemd-git=258.devel.r80631.a94520dc78c
+	depends = systemd-git=258.rc3.r83398.46a688c5598
 	depends = binutils
 	depends = python-cryptography
 	depends = python-pefile
 	optdepends = python-pillow: Show the size of splash image
 	optdepends = sbsigntools: Sign the embedded kernel
 	provides = ukify
-	provides = systemd-ukify=258.devel.r80631.a94520dc78c
+	provides = systemd-ukify=258.rc3.r83398.46a688c5598
 	conflicts = systemd-ukify
diff --git a/30-systemd-restart-marked.hook b/30-systemd-restart-marked.hook
new file mode 100644
index 0000000..9f62fd0
--- /dev/null
+++ b/30-systemd-restart-marked.hook
@@ -0,0 +1,9 @@
+[Trigger]
+Type = Path
+Operation = Upgrade
+Target = usr/lib/systemd/system/*
+
+[Action]
+Description = Restarting marked services...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook restart-marked
diff --git a/PKGBUILD b/PKGBUILD
index 5f36d2a..6d37e85 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -10,19 +10,19 @@ pkgname=('systemd-git'
          'systemd-tests-git'
          'systemd-ukify-git')
 pkgdesc='systemd (git version)'
-pkgver=258.devel.r80631.a94520dc78c
+pkgver=258.rc3.r83398.46a688c5598
 pkgrel=1
 arch=('x86_64')
 license=('LGPL-2.1-or-later')
 url='https://www.github.com/systemd/systemd'
-makedepends=('acl' 'cryptsetup' 'docbook-xsl' 'gperf' 'lz4' 'xz' 'pam' 'libelf'
+makedepends=('acl' 'apparmor' 'cryptsetup' 'docbook-xsl' 'gperf' 'lz4' 'xz' 'pam' 'libelf'
              'intltool' 'iptables' 'kmod' 'libarchive' 'libcap' 'libidn2' 'libgcrypt'
              'libmicrohttpd' 'libxcrypt' 'libxslt' 'util-linux' 'linux-api-headers'
              'python-jinja' 'python-lxml' 'quota-tools' 'shadow' 'git'
              'meson' 'libseccomp' 'pcre2' 'audit' 'kexec-tools' 'libxkbcommon'
              'bash-completion' 'p11-kit' 'systemd' 'libfido2' 'tpm2-tss' 'rsync'
              'bpf' 'libbpf' 'clang' 'llvm' 'curl' 'gnutls' 'python-pyelftools'
-             'libpwquality' 'qrencode' 'lib32-gcc-libs' 'python-pefile')
+             'libpwquality' 'qrencode' 'lib32-gcc-libs' 'python-pefile' 'linux-headers')
 conflicts=("mkinitcpio<38-1")
 options=('!strip')
 source=("$pkgbase-stable::git+https://github.com/systemd/systemd"
@@ -41,6 +41,7 @@ source=("$pkgbase-stable::git+https://github.com/systemd/systemd"
         '30-systemd-daemon-reload-system.hook'
         '30-systemd-daemon-reload-user.hook'
         '30-systemd-hwdb.hook'
+        '30-systemd-restart-marked.hook'
         '30-systemd-sysctl.hook'
         '30-systemd-tmpfiles.hook'
         '30-systemd-udev-reload.hook'
@@ -58,6 +59,7 @@ sha512sums=('SKIP'
             'a436d3f5126c6c0d6b58c6865e7bd38dbfbfb7babe017eeecb5e9d162c21902cbf4e0a68cf3ac2f99815106f9fa003b075bd2b4eb5d16333fa913df6e2f3e32a'
             '190112e38d5a5c0ca91b89cd58f95595262a551530a16546e1d84700fc9644aa2ca677953ffff655261e8a7bff6e6af4e431424df5f13c00bc90b77c421bc32d'
             'a1661ab946c6cd7d3c6251a2a9fd68afe231db58ce33c92c42594aedb5629be8f299ba08a34713327b373a3badd1554a150343d8d3e5dfb102999c281bd49154'
+            'f6b154fdc612916d7788720cf703e34255b43ba2d19413de5f3f63f07508f4ce561ca138f987c2118c7128e1dfb01976b0ac7d5efee4d9ebaadd180e70fa013e'
             '9426829605bbb9e65002437e02ed54e35c20fdf94706770a3dc1049da634147906d6b98bf7f5e7516c84068396a12c6feaf72f92b51bdf19715e0f64620319de'
             'da7a97d5d3701c70dd5388b0440da39006ee4991ce174777931fea2aa8c90846a622b2b911f02ae4d5fffb92680d9a7e211c308f0f99c04896278e2ee0d9a4dc'
             'a50d202a9c2e91a4450b45c227b295e1840cc99a5e545715d69c8af789ea3dd95a03a30f050d52855cabdc9183d4688c1b534eaa755ebe93616f9d192a855ee3'
@@ -100,7 +102,7 @@ build() {
     -Dshared-lib-tag="${pkgver}-${pkgrel}"
     -Dmode=developer
 
-    -Dapparmor=disabled
+    -Dapparmor=enabled
     -Dbootloader=enabled
     -Dxenctrl=disabled
     -Dbpf-framework=enabled
@@ -110,6 +112,9 @@ build() {
     -Dlz4=enabled
     -Dman=enabled
     -Dselinux=disabled
+    -Dsshdprivsepdir=/usr/share/empty.sshd
+    -Dvmlinux-h=provided
+    -Dvmlinux-h-path=/usr/src/linux/vmlinux.h
 
     # We disable DNSSEC by default, it still causes trouble:
     # https://github.com/systemd/systemd/issues/10579
@@ -166,11 +171,11 @@ package_systemd-git() {
   conflicts=('nss-myhostname' 'systemd-tools' 'udev')
   conflicts+=('systemd')
   optdepends=('libmicrohttpd: systemd-journal-gatewayd and systemd-journal-remote'
+              'apparmor: additional security features'
               'quota-tools: kernel-level quota management'
               'systemd-sysvcompat: symlink package to provide sysvinit binaries'
               "systemd-ukify-git=${pkgver}: combine kernel and initrd into a signed Unified Kernel Image"
               'polkit: allow administration as unprivileged user'
-              'python: Unified Kernel Image with ukify'
               'curl: systemd-journal-upload, machinectl pull-tar and pull-raw'
               'gnutls: systemd-journal-gatewayd and systemd-journal-remote'
               'qrencode: show QR codes'
@@ -181,8 +186,7 @@ package_systemd-git() {
               'libfido2: unlocking LUKS2 volumes with FIDO2 token'
               'libp11-kit: support PKCS#11'
               'tpm2-tss: unlocking LUKS2 volumes with TPM2')
-  backup=(etc/pam.d/systemd-user
-          etc/systemd/coredump.conf
+  backup=(etc/systemd/coredump.conf
           etc/systemd/homed.conf
           etc/systemd/journald.conf
           etc/systemd/journal-remote.conf
@@ -200,7 +204,7 @@ package_systemd-git() {
           etc/udev/udev.conf)
   install=systemd.install
 
-  meson install -C build --destdir "${pkgdir}"
+  meson install -C build --no-rebuild --destdir "${pkgdir}"
 
   # we'll create this on installation
   rmdir "$pkgdir"/var/log/journal/remote
@@ -247,9 +251,6 @@ package_systemd-git() {
   # will fix the permissions for us. (see /usr/lib/tmpfiles.d/systemd.conf)
   install -d -o root -g root -m 2755 "$pkgdir"/var/log/journal
 
-  # match directory owner/group and mode from polkit
-  install -d -o root -g 102 -m 0750 "$pkgdir"/usr/share/polkit-1/rules.d
-
   # add example bootctl configuration
   install -D -m0644 arch.conf "$pkgdir"/usr/share/systemd/bootctl/arch.conf
   install -D -m0644 loader.conf "$pkgdir"/usr/share/systemd/bootctl/loader.conf
@@ -260,7 +261,7 @@ package_systemd-git() {
   install -D -m0644 -t "$pkgdir"/usr/share/libalpm/hooks *.hook
 
   # overwrite the systemd-user PAM configuration with our own
-  install -D -m0644 systemd-user.pam "$pkgdir"/etc/pam.d/systemd-user
+  install -D -m0644 systemd-user.pam "$pkgdir"/usr/lib/pam.d/systemd-user
 
   # create a directory for cryptsetup keys
   install -d -m0700 "$pkgdir"/etc/cryptsetup-keys.d
@@ -341,7 +342,7 @@ package_systemd-ukify-git() {
   conflicts=('systemd-ukify')
   provides=('ukify')
   provides+=("systemd-ukify=$pkgver")
-  depends=("systemd-git=$pkgver" 'binutils' 'python-cryptography' 'python-pefile')
+  depends=("systemd-git=${pkgver}" 'binutils' 'python-cryptography' 'python-pefile')
   optdepends=('python-pillow: Show the size of splash image'
               'sbsigntools: Sign the embedded kernel')