Merge ~bluca/ubuntu/+source/lvm2:errno_backport into ubuntu/+source/lvm2:ubuntu/noble

[Luca Boccassi]

libdm: backport patch to fix return code from device-mapper

When libcryptsetup tries to activate a signed dm-verity volume, and the key is not in the kernel keyring, libdevicemapper does not return the appropriate ENOKEY, so the failure cannot be distinguished from other generic issues.

This is fixed in the lvm2 version 2.03.23 upstream release.

Please consider backporting this patch for Noble.

Upstream PR: https://gitlab.com/lvmteam/lvm2/-/merge_requests/3
Upstream commit: 25ef7a7b1a876f491bd361369423d7309358f6c1

45e76ca... by Dave Jones on 2024-02-22

2.03.16-3ubuntu1 (patches unapplied)

Imported using git-ubuntu import.

Unmerged commits

d4580c5... by Luca Boccassi on 2024-02-22

libdm: backport patch to fix return code from device-mapper

Backport patch from latest upstream lvm2 version. Fixes returning an
accurate error code to libcryptsetup when opening a dm-verity device
fails due to a missing key. Needed for cryptsetup 2.7.0 and systemd
256.

45e76ca... by Dave Jones on 2024-02-22

2.03.16-3ubuntu1 (patches unapplied)

Imported using git-ubuntu import.

f261e93... by Bastian Blank on 2024-01-06

2.03.16-3 (patches unapplied)

Imported using git-ubuntu import.

diff --git a/debian/.gitignore b/debian/.gitignore
deleted file mode 100644
index a6c60b7..0000000
--- a/debian/.gitignore
+++ /dev/null
@@ -1,8 +0,0 @@
-/autoreconf.*
-/debhelper*
-/files
-/*.debhelper
-/*.log
-/*.substvars
-/*/
-!/bin/
diff --git a/debian/changelog b/debian/changelog
index b89e409..6547980 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,40 @@
+<<<<<<< debian/changelog
+=======
+lvm2 (2.03.16-3ubuntu1) noble; urgency=medium
+
+  * Merge from Debian unstable (LP: #2054683). Remaining changes:
+    - Lower libdevmapper1.02.1's Depends: dmsetup to a Recommends:. This
+      breaks the circular dependency that causes upgrade failures. As dmsetup
+      is "Priority: required", this has no other practical consequences.
+      (Debian #586424)
+    - Add debian/initramfs-tools/lvm2/scripts/init-bottom/lvm2: We cannot
+      properly synthesize LVM LV change events with udevadm trigger, so if we
+      use LVM, we need to let it finish; otherwise we get missing LV symlinks.
+    - Add enable-issue-discards.patch: Enable "issue_discards" option by
+      default to trim SSDs when changing PVs. This option has no effect if the
+      kernel or the drive does not support trimming, so it's safe to enable by
+      default. (Debian #717313)
+    - debian/rules:
+      - Copy .po file to .pot file for Rosetta (Ubuntu specific).
+    - debian/initramfs-tools/lvm2/hooks/lvm2: depend on udev since we ship
+      udev rules.
+    - Do not start lvm2-monitor in containers (LP #1576341)
+    - Fix patch of systemd-run in 69-lvm-metad.rules
+    - d/control: add thin-provisioning-tools build-dep as configure wants it
+      around for some checks at build time.
+    - Don't build udeb targets.
+
+ -- Dave Jones <[e-mail]>  Thu, 22 Feb 2024 10:28:18 +0000
+
+lvm2 (2.03.16-3) unstable; urgency=medium
+
+  * Remove obsolete dependency on lsb-base.
+  * Expect systemd relates files in /usr. (closes: #1052666)
+  * Move all remaining files to /usr.
+
+ -- Bastian Blank <[e-mail]>  Sat, 06 Jan 2024 18:47:24 +0100
+
+>>>>>>> debian/changelog
 lvm2 (2.03.16-2ubuntu1) mantic; urgency=medium
 
   * Merge from Debian unstable (LP: #2020464). Remaining changes:
diff --git a/debian/control b/debian/control
index fff01ca..a43599e 100644
--- a/debian/control
+++ b/debian/control
@@ -11,7 +11,11 @@ Build-Depends:
  libaio-dev,
  libblkid-dev,
  pkg-config,
+<<<<<<< debian/control
  systemd,
+=======
+ systemd-dev (>= 255~rc1-1),
+>>>>>>> debian/control
  thin-provisioning-tools
 Build-Depends-Arch:
  libcmap-dev,
@@ -43,7 +47,6 @@ Pre-Depends:
 Depends:
  ${shlibs:Depends},
  ${misc:Depends},
- lsb-base,
  dmsetup (>= ${devmapper:Version}~),
  dmeventd (>= ${devmapper:Version}~),
 Recommends:
diff --git a/debian/dmeventd.install b/debian/dmeventd.install
index b2575e4..a7e600a 100644
--- a/debian/dmeventd.install
+++ b/debian/dmeventd.install
@@ -1,5 +1,5 @@
-lib/*/libdevmapper-event-*
-lib/*/device-mapper/libdevmapper-event-*
-lib/systemd/system/dm-event*
-sbin/dmeventd
+usr/lib/*/libdevmapper-event-*
+usr/lib/*/device-mapper/libdevmapper-event-*
+usr/lib/systemd/system/dm-event*
+usr/sbin/dmeventd
 usr/share/man/man8/dmeventd.8
diff --git a/debian/dmsetup-udeb.install b/debian/dmsetup-udeb.install
index 365b8c4..65a81e6 100644
--- a/debian/dmsetup-udeb.install
+++ b/debian/dmsetup-udeb.install
@@ -1 +1 @@
-sbin/dmsetup
+usr/sbin/dmsetup
diff --git a/debian/dmsetup.install b/debian/dmsetup.install
index 3c99dd4..92b6302 100644
--- a/debian/dmsetup.install
+++ b/debian/dmsetup.install
@@ -1,8 +1,8 @@
 ../../initramfs-tools/dmsetup/* usr/share/initramfs-tools
-lib/udev/rules.d/*-dm*.rules
-sbin/blkdeactivate
-sbin/dmsetup
-sbin/dmstats
+usr/lib/udev/rules.d/*-dm*.rules
+usr/sbin/blkdeactivate
+usr/sbin/dmsetup
+usr/sbin/dmstats
 usr/share/man/man8/blkdeactivate.8
 usr/share/man/man8/dmsetup.8
 usr/share/man/man8/dmstats.8
diff --git a/debian/libdevmapper-event1.02.1.install b/debian/libdevmapper-event1.02.1.install
index 95205d0..f8a341b 100644
--- a/debian/libdevmapper-event1.02.1.install
+++ b/debian/libdevmapper-event1.02.1.install
@@ -1 +1 @@
-lib/*/libdevmapper-event.so.*
+usr/lib/*/libdevmapper-event.so.*
diff --git a/debian/libdevmapper1.02.1-udeb.install b/debian/libdevmapper1.02.1-udeb.install
index b52a762..824d82a 100644
--- a/debian/libdevmapper1.02.1-udeb.install
+++ b/debian/libdevmapper1.02.1-udeb.install
@@ -1 +1 @@
-lib/libdevmapper.so.*
+usr/lib/*/libdevmapper.so.*
diff --git a/debian/libdevmapper1.02.1.install b/debian/libdevmapper1.02.1.install
index 3bb9eb5..824d82a 100644
--- a/debian/libdevmapper1.02.1.install
+++ b/debian/libdevmapper1.02.1.install
@@ -1 +1 @@
-lib/*/libdevmapper.so.*
+usr/lib/*/libdevmapper.so.*
diff --git a/debian/liblvm2cmd2.03.install b/debian/liblvm2cmd2.03.install
index 62dd951..d257beb 100644
--- a/debian/liblvm2cmd2.03.install
+++ b/debian/liblvm2cmd2.03.install
@@ -1 +1 @@
-lib/*/liblvm2cmd.so.2.03
+usr/lib/*/liblvm2cmd.so.2.03
diff --git a/debian/lvm2-dbusd.install b/debian/lvm2-dbusd.install
index f1fec56..7369c67 100644
--- a/debian/lvm2-dbusd.install
+++ b/debian/lvm2-dbusd.install
@@ -1,6 +1,6 @@
 etc/dbus-1/system.d/com.redhat.lvmdbus1.conf
-lib/systemd/system/lvm2-lvmdbusd.service
-sbin/lvmdbusd
+usr/lib/systemd/system/lvm2-lvmdbusd.service
+usr/sbin/lvmdbusd
 usr/lib/python*/*-packages/lvmdbusd/
 usr/share/dbus-1/system-services/com.redhat.lvmdbus1.service
 usr/share/man/man8/lvmdbusd.8
diff --git a/debian/lvm2-lockd.install b/debian/lvm2-lockd.install
index 47bb346..c0cba36 100644
--- a/debian/lvm2-lockd.install
+++ b/debian/lvm2-lockd.install
@@ -1,6 +1,6 @@
-lib/systemd/system/lvmlockd.service
-lib/systemd/system/lvmlocks.service
-sbin/lvmlockctl
-sbin/lvmlockd
+usr/lib/systemd/system/lvmlockd.service
+usr/lib/systemd/system/lvmlocks.service
+usr/sbin/lvmlockctl
+usr/sbin/lvmlockd
 usr/share/man/man8/lvmlockctl.8
 usr/share/man/man8/lvmlockd.8
diff --git a/debian/lvm2-udeb.install b/debian/lvm2-udeb.install
index e89e9be..2a4f950 100644
--- a/debian/lvm2-udeb.install
+++ b/debian/lvm2-udeb.install
@@ -1,45 +1,45 @@
 etc/lvm/lvm.conf
-sbin/lvchange
-sbin/lvconvert
-sbin/lvcreate
-sbin/lvdisplay
-sbin/lvextend
-sbin/lvm
-sbin/lvmconfig
-sbin/lvmdiskscan
-sbin/lvmsadc
-sbin/lvmsar
-sbin/lvreduce
-sbin/lvremove
-sbin/lvrename
-sbin/lvresize
-sbin/lvs
-sbin/lvscan
-sbin/pvchange
-sbin/pvck
-sbin/pvcreate
-sbin/pvdisplay
-sbin/pvmove
-sbin/pvremove
-sbin/pvresize
-sbin/pvs
-sbin/pvscan
-sbin/vgcfgbackup
-sbin/vgcfgrestore
-sbin/vgchange
-sbin/vgck
-sbin/vgconvert
-sbin/vgcreate
-sbin/vgdisplay
-sbin/vgexport
-sbin/vgextend
-sbin/vgimport
-sbin/vgimportclone
-sbin/vgmerge
-sbin/vgmknodes
-sbin/vgreduce
-sbin/vgremove
-sbin/vgrename
-sbin/vgs
-sbin/vgscan
-sbin/vgsplit
+usr/sbin/lvchange
+usr/sbin/lvconvert
+usr/sbin/lvcreate
+usr/sbin/lvdisplay
+usr/sbin/lvextend
+usr/sbin/lvm
+usr/sbin/lvmconfig
+usr/sbin/lvmdiskscan
+usr/sbin/lvmsadc
+usr/sbin/lvmsar
+usr/sbin/lvreduce
+usr/sbin/lvremove
+usr/sbin/lvrename
+usr/sbin/lvresize
+usr/sbin/lvs
+usr/sbin/lvscan
+usr/sbin/pvchange
+usr/sbin/pvck
+usr/sbin/pvcreate
+usr/sbin/pvdisplay
+usr/sbin/pvmove
+usr/sbin/pvremove
+usr/sbin/pvresize
+usr/sbin/pvs
+usr/sbin/pvscan
+usr/sbin/vgcfgbackup
+usr/sbin/vgcfgrestore
+usr/sbin/vgchange
+usr/sbin/vgck
+usr/sbin/vgconvert
+usr/sbin/vgcreate
+usr/sbin/vgdisplay
+usr/sbin/vgexport
+usr/sbin/vgextend
+usr/sbin/vgimport
+usr/sbin/vgimportclone
+usr/sbin/vgmerge
+usr/sbin/vgmknodes
+usr/sbin/vgreduce
+usr/sbin/vgremove
+usr/sbin/vgrename
+usr/sbin/vgs
+usr/sbin/vgscan
+usr/sbin/vgsplit
diff --git a/debian/lvm2.install b/debian/lvm2.install
index 7cee14f..f5f5ee4 100644
--- a/debian/lvm2.install
+++ b/debian/lvm2.install
@@ -1,56 +1,56 @@
 ../../initramfs-tools/lvm2/* usr/share/initramfs-tools
 etc/lvm
-lib/systemd/system/blk-availability*
-lib/systemd/system/lvm2-lvmpolld*
-lib/systemd/system/lvm2-monitor*
-lib/udev/rules.d/*-lvm*.rules
-sbin/fsadm
-sbin/lvchange
-sbin/lvconvert
-sbin/lvcreate
-sbin/lvdisplay
-sbin/lvextend
-sbin/lvm
-sbin/lvmconfig
-sbin/lvmdiskscan
-sbin/lvmdump
-sbin/lvmpolld
-sbin/lvmsadc
-sbin/lvmsar
-sbin/lvreduce
-sbin/lvremove
-sbin/lvrename
-sbin/lvresize
-sbin/lvs
-sbin/lvscan
-sbin/pvchange
-sbin/pvck
-sbin/pvcreate
-sbin/pvdisplay
-sbin/pvmove
-sbin/pvremove
-sbin/pvresize
-sbin/pvs
-sbin/pvscan
-sbin/vgcfgbackup
-sbin/vgcfgrestore
-sbin/vgchange
-sbin/vgck
-sbin/vgconvert
-sbin/vgcreate
-sbin/vgdisplay
-sbin/vgexport
-sbin/vgextend
-sbin/vgimport
-sbin/vgimportclone
-sbin/vgmerge
-sbin/vgmknodes
-sbin/vgreduce
-sbin/vgremove
-sbin/vgrename
-sbin/vgs
-sbin/vgscan
-sbin/vgsplit
+usr/lib/systemd/system/blk-availability*
+usr/lib/systemd/system/lvm2-lvmpolld*
+usr/lib/systemd/system/lvm2-monitor*
+usr/lib/udev/rules.d/*-lvm*.rules
+usr/sbin/fsadm
+usr/sbin/lvchange
+usr/sbin/lvconvert
+usr/sbin/lvcreate
+usr/sbin/lvdisplay
+usr/sbin/lvextend
+usr/sbin/lvm
+usr/sbin/lvmconfig
+usr/sbin/lvmdiskscan
+usr/sbin/lvmdump
+usr/sbin/lvmpolld
+usr/sbin/lvmsadc
+usr/sbin/lvmsar
+usr/sbin/lvreduce
+usr/sbin/lvremove
+usr/sbin/lvrename
+usr/sbin/lvresize
+usr/sbin/lvs
+usr/sbin/lvscan
+usr/sbin/pvchange
+usr/sbin/pvck
+usr/sbin/pvcreate
+usr/sbin/pvdisplay
+usr/sbin/pvmove
+usr/sbin/pvremove
+usr/sbin/pvresize
+usr/sbin/pvs
+usr/sbin/pvscan
+usr/sbin/vgcfgbackup
+usr/sbin/vgcfgrestore
+usr/sbin/vgchange
+usr/sbin/vgck
+usr/sbin/vgconvert
+usr/sbin/vgcreate
+usr/sbin/vgdisplay
+usr/sbin/vgexport
+usr/sbin/vgextend
+usr/sbin/vgimport
+usr/sbin/vgimportclone
+usr/sbin/vgmerge
+usr/sbin/vgmknodes
+usr/sbin/vgreduce
+usr/sbin/vgremove
+usr/sbin/vgrename
+usr/sbin/vgs
+usr/sbin/vgscan
+usr/sbin/vgsplit
 usr/lib/tmpfiles.d/lvm2.conf
 usr/share/man/man5/lvm.conf.5
 usr/share/man/man7/lvmcache.7
diff --git a/debian/patches/debian-changes b/debian/patches/debian-changes
index 62551a4..f870cae 100644
--- a/debian/patches/debian-changes
+++ b/debian/patches/debian-changes
@@ -1,5 +1,17 @@
+diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
+new file mode 100644
+index 0000000000000000000000000000000000000000..a3240a084f5f4374c38470467d51462e4d6bf905
+--- /dev/null
++++ b/.gitlab-ci.yml
+@@ -0,0 +1,6 @@
++include:
++- local: debian/pipeline/workflow.yml
++- local: debian/pipeline/variables.yml
++- local: debian/pipeline/source.yml
++- local: debian/pipeline/build.yml
++- local: debian/pipeline/test.yml
 diff --git a/configure.ac b/configure.ac
-index 6cdf1a7e6..181a62be8 100644
+index 6cdf1a7e652a982cd648e8b194d774ebfeb9aa41..181a62be87e66be444f3f3af3928c61be828567d 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -708,8 +708,8 @@ AC_ARG_VAR([AIO_LIBS], [linker flags for AIO])
@@ -123,7 +135,7 @@ index 6cdf1a7e6..181a62be8 100644
  AC_SUBST(UDEV_HAS_BUILTIN_BLKID)
  AC_SUBST(USE_TRACKING)
 diff --git a/daemons/dmeventd/.exported_symbols b/daemons/dmeventd/.exported_symbols
-index fab74dc1d..46c14fb5a 100644
+index fab74dc1d6f3dd8e740a3806d8424855bb399df6..46c14fb5ae4935104891f41e2cd626078baf22f9 100644
 --- a/daemons/dmeventd/.exported_symbols
 +++ b/daemons/dmeventd/.exported_symbols
 @@ -1,4 +1,4 @@
@@ -135,7 +147,7 @@ index fab74dc1d..46c14fb5a 100644
 +dm_event_daemon_talk
  dm_event_get_version
 diff --git a/daemons/dmeventd/dmeventd.c b/daemons/dmeventd/dmeventd.c
-index d89ab4af8..d31a5d558 100644
+index d89ab4af8aeb3ffbaa7744fb26100063e035b0ec..d31a5d558ba989d0078a7941df67be8a68171de4 100644
 --- a/daemons/dmeventd/dmeventd.c
 +++ b/daemons/dmeventd/dmeventd.c
 @@ -1986,7 +1986,7 @@ static int _reinstate_registrations(struct dm_event_fifos *fifos)
@@ -223,7 +235,7 @@ index d89ab4af8..d31a5d558 100644
  }
  
 diff --git a/daemons/dmeventd/dmeventd.h b/daemons/dmeventd/dmeventd.h
-index afe0b0c4b..a3dad10a0 100644
+index afe0b0c4b66740bb021719bb54c5c426080ba7cf..a3dad10a0c5a14005a5ef095ff8698ccb1cdccd2 100644
 --- a/daemons/dmeventd/dmeventd.h
 +++ b/daemons/dmeventd/dmeventd.h
 @@ -65,12 +65,12 @@ struct dm_event_fifos {
@@ -243,7 +255,7 @@ index afe0b0c4b..a3dad10a0 100644
  
  #endif /* __DMEVENTD_DOT_H__ */
 diff --git a/daemons/dmeventd/libdevmapper-event.c b/daemons/dmeventd/libdevmapper-event.c
-index 30df1da21..282293463 100644
+index 30df1da216dbe75c8140fd989e8e16989f6de86b..2822934636a7bd0d74aa9df484efa9c371e58d66 100644
 --- a/daemons/dmeventd/libdevmapper-event.c
 +++ b/daemons/dmeventd/libdevmapper-event.c
 @@ -349,7 +349,7 @@ static int _daemon_write(struct dm_event_fifos *fifos,
@@ -307,7 +319,7 @@ index 30df1da21..282293463 100644
  	p = msg.data;
  	*version = 0;
 diff --git a/daemons/lvmdbusd/Makefile.in b/daemons/lvmdbusd/Makefile.in
-index d9cf5d886..2fa80c465 100644
+index d9cf5d8863110e4fe185083ac0ec68ab137bd002..2fa80c465ad99db28ce393783675da90e7d3e261 100644
 --- a/daemons/lvmdbusd/Makefile.in
 +++ b/daemons/lvmdbusd/Makefile.in
 @@ -16,7 +16,7 @@ top_srcdir = @top_srcdir@
@@ -330,7 +342,7 @@ index d9cf5d886..2fa80c465 100644
  install_lvm2: install_lvmdbusd
  
 diff --git a/daemons/lvmlockd/Makefile.in b/daemons/lvmlockd/Makefile.in
-index 91beb1ad8..44378b01b 100644
+index 91beb1ad8ef3a8741887347a4cee981e74d4a8f9..44378b01b506bdce827693ad811849263f725c6f 100644
 --- a/daemons/lvmlockd/Makefile.in
 +++ b/daemons/lvmlockd/Makefile.in
 @@ -15,8 +15,6 @@ srcdir = @srcdir@
@@ -361,7 +373,7 @@ index 91beb1ad8..44378b01b 100644
  lvmlockd: $(OBJECTS) $(top_builddir)/libdaemon/server/libdaemonserver.a $(INTERNAL_LIBS)
  	@echo "    [CC] $@"
 diff --git a/make.tmpl.in b/make.tmpl.in
-index cccda10d6..01f149cc9 100644
+index cccda10d6f1045ee828ed41bf389334d63c160da..01f149cc9447ec112e84c045daa8d72db255f972 100644
 --- a/make.tmpl.in
 +++ b/make.tmpl.in
 @@ -27,20 +27,10 @@ SHELL = @SHELL@
@@ -464,7 +476,7 @@ index cccda10d6..01f149cc9 100644
  %.so: %.o
  	@echo "    [CC] $(<F)"
 diff --git a/scripts/blk_availability_systemd_red_hat.service.in b/scripts/blk_availability_systemd_red_hat.service.in
-index 4102566be..17414ac37 100644
+index 4102566be0cfa174609aceebabe25cd5415c50ff..17414ac3756da59d307b2433fcf9c10a7db73df9 100644
 --- a/scripts/blk_availability_systemd_red_hat.service.in
 +++ b/scripts/blk_availability_systemd_red_hat.service.in
 @@ -7,7 +7,6 @@ Conflicts=shutdown.target
@@ -476,7 +488,7 @@ index 4102566be..17414ac37 100644
  RemainAfterExit=yes
  
 diff --git a/udev/10-dm.rules.in b/udev/10-dm.rules.in
-index b4fa52ab7..69d2c47ec 100644
+index b4fa52ab766effb04fc198fd52e6181ad5758eef..69d2c47ecce84c03f06abc61fe4f9e12f58231cb 100644
 --- a/udev/10-dm.rules.in
 +++ b/udev/10-dm.rules.in
 @@ -32,7 +32,6 @@ KERNEL=="device-mapper", NAME="(DM_DIR)/control"
@@ -522,7 +534,7 @@ index b4fa52ab7..69d2c47ec 100644
  
  ENV{DM_UDEV_DISABLE_DM_RULES_FLAG}!="1", ENV{DM_NAME}=="?*", SYMLINK+="(DM_DIR)/$env{DM_NAME}"
 diff --git a/udev/69-dm-lvm-metad.rules.in b/udev/69-dm-lvm-metad.rules.in
-index a2384f2af..264c40e4a 100644
+index a2384f2afe904ced407393b549b19387c230da32..264c40e4a27743b9626eb1889360a2b945b60485 100644
 --- a/udev/69-dm-lvm-metad.rules.in
 +++ b/udev/69-dm-lvm-metad.rules.in
 @@ -46,7 +46,7 @@ LABEL="next"
@@ -574,7 +586,7 @@ index a2384f2af..264c40e4a 100644
  
  LABEL="lvm_end"
 diff --git a/udev/69-dm-lvm.rules.in b/udev/69-dm-lvm.rules.in
-index 14e7dd26d..b32b94ac7 100644
+index 14e7dd26d6c3eb3f32394e12a3daaa0250fe2725..b32b94ac7cdc37896f7c0ef874b0a42521e0a77c 100644
 --- a/udev/69-dm-lvm.rules.in
 +++ b/udev/69-dm-lvm.rules.in
 @@ -80,8 +80,14 @@ ENV{SYSTEMD_READY}="1"
@@ -593,7 +605,7 @@ index 14e7dd26d..b32b94ac7 100644
  LABEL="lvm_end"
  
 diff --git a/udev/95-dm-notify.rules.in b/udev/95-dm-notify.rules.in
-index 80d59d37d..d22abba1a 100644
+index 80d59d37d3f27373efaf385b15664478c3f647fc..d22abba1a69b568deb9c4c4752d5130bc06e553b 100644
 --- a/udev/95-dm-notify.rules.in
 +++ b/udev/95-dm-notify.rules.in
 @@ -9,4 +9,4 @@
@@ -603,7 +615,7 @@ index 80d59d37d..d22abba1a 100644
 -ENV{DM_COOKIE}=="?*", RUN+="(DM_EXEC)/dmsetup udevcomplete $env{DM_COOKIE}"
 +ENV{DM_COOKIE}=="?*", RUN+="/sbin/dmsetup udevcomplete $env{DM_COOKIE}"
 diff --git a/udev/Makefile.in b/udev/Makefile.in
-index e777dda16..0e237dd13 100644
+index e777dda16d6b5155f4a701364b60d0f1e49752cd..0e237dd13b30e9900074307359d496cd7e6c5d8d 100644
 --- a/udev/Makefile.in
 +++ b/udev/Makefile.in
 @@ -17,8 +17,8 @@ top_builddir = @top_builddir@
diff --git a/debian/patches/libdm-propagate-ioctl-errors-back-to-caller.patch b/debian/patches/libdm-propagate-ioctl-errors-back-to-caller.patch
new file mode 100644
index 0000000..f0f49f0
--- /dev/null
+++ b/debian/patches/libdm-propagate-ioctl-errors-back-to-caller.patch
@@ -0,0 +1,67 @@
+Author: Lennart Poettering <[e-mail]>
+Origin: upstream, commit:25ef7a7b1a876f491bd361369423d7309358f6c1
+Forwarded: https://gitlab.com/lvmteam/lvm2/-/merge_requests/3
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/lvm2/+bug/2054620
+Description: libdm: propagate ioctl errors back to caller
+ When setting up dm-verity devices with signed root hashes it is very
+ useful to have a recognizable error code when a key is not present in
+ the kernel keyring. Turns out the kernel actually returns ENOKEY in that
+ case, but this gets lost in libdevmapper.
+ .
+ This fixes this: in _create_and_load_v4() it copies the error code from
+ the ioctl from the sub-tasks back to the main task field on failure.
+ .
+ This is not enough to make libcryptsetup actually propagate the ENOKEY
+ correctly, that also needs a patch to libcryptsetup, but this is part of
+ the puzzle.
+--- a/libdm/ioctl/libdm-iface.c
++++ b/libdm/ioctl/libdm-iface.c
+@@ -1471,7 +1471,7 @@ static int _create_and_load_v4(struct dm_task *dmt)
+ {
+ 	struct dm_info info;
+ 	struct dm_task *task;
+-	int r;
++	int r, ioctl_errno = 0;
+ 	uint32_t cookie;
+ 
+ 	/* Use new task struct to create the device */
+@@ -1497,8 +1497,10 @@ static int _create_and_load_v4(struct dm_task *dmt)
+ 	task->cookie_set = dmt->cookie_set;
+ 	task->add_node = dmt->add_node;
+ 
+-	if (!dm_task_run(task))
++	if (!dm_task_run(task)) {
++		ioctl_errno = task->ioctl_errno;
+ 		goto_bad;
++	}
+ 
+ 	if (!dm_task_get_info(task, &info) || !info.exists)
+ 		goto_bad;
+@@ -1529,6 +1531,8 @@ static int _create_and_load_v4(struct dm_task *dmt)
+ 	task->ima_measurement = dmt->ima_measurement;
+ 
+ 	r = dm_task_run(task);
++	if (!r)
++		ioctl_errno = task->ioctl_errno;
+ 
+ 	task->head = NULL;
+ 	task->tail = NULL;
+@@ -1575,12 +1579,18 @@ static int _create_and_load_v4(struct dm_task *dmt)
+ 	if (!dm_task_run(dmt))
+ 		log_error("Failed to revert device creation.");
+ 
++	if (ioctl_errno != 0)
++		dmt->ioctl_errno =  ioctl_errno;
++
+ 	return 0;
+ 
+       bad:
+ 	dm_task_destroy(task);
+ 	_udev_complete(dmt);
+ 
++	if (ioctl_errno != 0)
++		dmt->ioctl_errno =  ioctl_errno;
++
+ 	return 0;
+ }
+ 
diff --git a/debian/patches/series b/debian/patches/series
index a4eda8e..b41545c 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -2,3 +2,7 @@ debian-changes
 enable-issue-discards.patch
 0014-no-lvm2-monitor-in-containers.patch
 fix-systemd-run-location.patch
+<<<<<<< debian/patches/series
+=======
+libdm-propagate-ioctl-errors-back-to-caller.patch
+>>>>>>> debian/patches/series
diff --git a/debian/pipeline/build.yml b/debian/pipeline/build.yml
new file mode 100644
index 0000000..d386108
--- /dev/null
+++ b/debian/pipeline/build.yml
@@ -0,0 +1,42 @@
+build:
+  stage: build
+  image: debian:sid-slim
+
+  parallel:
+    matrix:
+    - JOB_HOST_ARCH:
+      - all
+      - amd64
+      - arm64
+      - i386
+      - s390x
+
+  variables:
+    GIT_STRATEGY: none
+    GIT_SUBMODULE_STRATEGY: none
+
+  script:
+  - apt upgrade
+  - |
+    # Install build-deps
+    if [[ $JOB_HOST_ARCH = all ]]; then
+      BUILDPACKAGE_ARGS="--build=all"
+      apt build-dep --indep-only ./debian/_build/*.dsc
+    else
+      BUILDPACKAGE_ARGS="--build=any --host-arch=$JOB_HOST_ARCH"
+      apt build-dep --arch-only --host-architecture $JOB_HOST_ARCH ./debian/_build/*.dsc
+      JOB_HOST_GNU_TYPE_PACKAGE=$(dpkg-architecture --host-arch $JOB_HOST_ARCH --query DEB_HOST_GNU_TYPE | tr _ -)
+      # Workaround for non-multiarch build-essential. See https://bugs.debian.org/666743
+      apt install binutils-$JOB_HOST_GNU_TYPE_PACKAGE gcc-$JOB_HOST_GNU_TYPE_PACKAGE g++-$JOB_HOST_GNU_TYPE_PACKAGE libc6-dev:$JOB_HOST_ARCH
+    fi
+  - dpkg-source -x debian/_build/*.dsc debian/_build/src
+  - chown nobody -R debian/_build
+  - ( cd debian/_build/src; runuser -u nobody -- dpkg-buildpackage --jobs=auto $BUILDPACKAGE_ARGS )
+
+  interruptible: true
+  needs:
+  - source
+  artifacts:
+    paths:
+    - debian/_build/*_${JOB_HOST_ARCH}.*
+    expire_in: 2 days
diff --git a/debian/pipeline/source.yml b/debian/pipeline/source.yml
new file mode 100644
index 0000000..28aed3e
--- /dev/null
+++ b/debian/pipeline/source.yml
@@ -0,0 +1,34 @@
+source:
+  stage: source
+  image: debian:trixie-slim
+
+  variables:
+    GIT_DEPTH: 1
+
+  script:
+  - apt install devscripts git
+  - git clone -c advice.detachedHead=false . debian/_build/src
+  - cd debian/_build/src
+  - |
+    # Set version
+    if [[ ${CI_MERGE_REQUEST_IID:-} ]]; then
+      VERSION="$(dpkg-parsechangelog -SVersion)+ci.${CI_MERGE_REQUEST_IID}.${CI_PIPELINE_ID}.${CI_COMMIT_SHORT_SHA}"
+      dch --newversion $VERSION --distribution UNRELEASED --force-distribution -- \
+        "Snapshot from merge request ${CI_MERGE_REQUEST_IID}."
+    else
+      VERSION="$(dpkg-parsechangelog -SVersion)+ci.0.${CI_PIPELINE_ID}.${CI_COMMIT_SHORT_SHA}"
+      dch --newversion $VERSION --distribution UNRELEASED --force-distribution -- \
+        "Snapshot from branch ${CI_COMMIT_REF_NAME}."
+    fi
+  - echo '1.0' > debian/source/format
+  - dpkg-buildpackage -us -uc -S -I -nc -d
+
+  interruptible: true
+  needs: []
+  artifacts:
+    paths:
+    - debian/_build/*.buildinfo
+    - debian/_build/*.changes
+    - debian/_build/*.dsc
+    - debian/_build/*.tar.*
+    expire_in: 2 days
diff --git a/debian/pipeline/test.yml b/debian/pipeline/test.yml
new file mode 100644
index 0000000..196be23
--- /dev/null
+++ b/debian/pipeline/test.yml
@@ -0,0 +1,30 @@
+test lintian:
+  stage: test
+  image: debian:sid-slim
+
+  variables:
+    GIT_STRATEGY: none
+    GIT_SUBMODULE_STRATEGY: none
+
+  script:
+  - apt install lintian
+  - lintian --version
+  - >
+    lintian
+    --fail-on error
+    --color always
+    --display-info
+    --pedantic
+    --allow-root
+    --suppress-tags malformed-debian-changelog-version,debian-revision-not-well-formed
+    debian/_build/*.changes
+
+  needs:
+  - job: source
+  - job: build
+# Requires GitLab 16.3
+#    parallel:
+#      matrix:
+#      - JOB_HOST_ARCH:
+#        - all
+#        - s390x
diff --git a/debian/pipeline/variables.yml b/debian/pipeline/variables.yml
new file mode 100644
index 0000000..8386814
--- /dev/null
+++ b/debian/pipeline/variables.yml
@@ -0,0 +1,5 @@
+variables:
+  DEB_BUILD_OPTIONS: terse
+  DEBIAN_FRONTEND: noninteractive
+  DEBFULLNAME: $CI_SERVER_NAME $CI_SERVER_HOST
+  DEBEMAIL: [e-mail]
diff --git a/debian/pipeline/workflow.yml b/debian/pipeline/workflow.yml
new file mode 100644
index 0000000..55a239e
--- /dev/null
+++ b/debian/pipeline/workflow.yml
@@ -0,0 +1,40 @@
+stages:
+- source
+- build
+- test
+
+workflow:
+  rules:
+  - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+  - if: $CI_COMMIT_BRANCH =~ /^debian\//
+  - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  - if: $CI_PIPELINE_SOURCE == "schedule"
+  - if: $CI_PIPELINE_SOURCE == "web"
+
+default:
+  before_script:
+  - |
+    # Setup apt
+    : ${JOB_BUILD_ARCH:=$(dpkg --print-architecture)}
+    : ${JOB_HOST_ARCH:=$(dpkg --print-architecture)}
+    if [[ $JOB_HOST_ARCH != $JOB_BUILD_ARCH ]] && [[ $JOB_HOST_ARCH != all ]]; then
+      export DEB_BUILD_OPTIONS="${DEB_BUILD_OPTIONS:-} nocheck"
+      export DEB_BUILD_PROFILES="${DEB_BUILD_PROFILES:-} cross"
+    fi
+    if [[ $JOB_HOST_ARCH != all ]]; then
+      dpkg --add-architecture $JOB_HOST_ARCH
+    fi
+    function apt() {
+      local e tmp
+      tmp=$(mktemp)
+      apt-get -o APT::Install-Recommends=false -o DPkg::Options::=--force-unsafe-io -qy "$@" >$tmp 2>&1 || e=$?
+      if [[ $e -gt 0 ]]; then
+        cat $tmp
+        rm $tmp
+        false
+      else
+        rm $tmp
+        true
+      fi
+    }
+  - apt update
diff --git a/debian/rules b/debian/rules
index b6153d0..3fa9486 100755
--- a/debian/rules
+++ b/debian/rules
@@ -24,8 +24,8 @@ CFLAGS_OPT_UDEB = -Os
 endif
 
 define CONFARGS.deb
-	--libdir=/lib/$(DEB_HOST_MULTIARCH)
-	--sbindir=/sbin
+	--prefix=/usr
+	--exec-prefix=/usr
 	--with-usrlibdir=/usr/lib/$(DEB_HOST_MULTIARCH)
 	--with-optimisation="$(CFLAGS_OPT_DEB)"
 	--with-cache=internal
@@ -39,7 +39,6 @@ define CONFARGS.deb
 	--with-thin-check=/usr/sbin/thin_check
 	--with-thin-dump=/usr/sbin/thin_dump
 	--with-thin-repair=/usr/sbin/thin_repair
-	--with-udev-prefix=/
 	--enable-applib
 	--enable-blkid_wiping
 	--enable-cmdlib
@@ -56,16 +55,12 @@ define CONFARGS.deb
 endef
 
 define CONFARGS.deb_all
-	--sbindir=/sbin
 	--enable-dbus-service
 	--disable-readline
 	--disable-selinux
 endef
 
 define CONFARGS.udeb
-	--libdir=/lib
-	--sbindir=/sbin
-	--with-usrlibdir=/usr/lib
 	--with-optimisation="$(CFLAGS_OPT_UDEB)"
 	--with-lvm1=none
 	--with-pool=none