Merge ~enr0n/ubuntu/+source/systemd:ubuntu-kinetic-merge-251.2-2 into ~ubuntu-core-dev/ubuntu/+source/systemd:ubuntu-kinetic

[Nick Rosbrook]

This merges systemd 251.2-2 from Debian unstable.

In addition to routine changes like refreshing patches and dropping patches that are now applied upstream, there are a few notable changes for review:

1. Patch debian/Ubuntu-core-in-execute-soft-fail-setting-Nice-priority-when.patch was dropped (details in changelog and git log)
2. Patch Add-support-for-TuxOnIce-hibernation.patch was dropped (details in changelog and git log)
3. The systemd-hwdb patches that allow `query --root` have been pulled in from upstream. This adds a new symbol to libsystemd0 because these patches were not included in the v251 release.

[Nick Rosbrook (enr0n)]

PPA autopkgtest results:

amd64: https://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-enr0n-systemd-251/kinetic/amd64/s/systemd/20220623_213721_f2ecd@/log.gz
ppc64el: https://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-enr0n-systemd-251/kinetic/ppc64el/s/systemd/20220627_204001_d7c83@/log.gz
s390x: https://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-enr0n-systemd-251/kinetic/s390x/s/systemd/20220627_200506_483ca@/log.gz
armhf: https://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-enr0n-systemd-251/kinetic/armhf/s/systemd/20220623_203247_deea8@/log.gz
arm64: https://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-enr0n-systemd-251/kinetic/arm64/s/systemd/20220623_221745_62476@/log.gz

[Lukas Märdian (slyon)]

Sorry for taking a long time to review this!
* The sources match the upstream-stable v251.2 tag & orig tarball.
* The debian/ changes LGTM overall, I have a few remarks below, that we could/should improve upon.
* PPA build is looking fine: https://launchpad.net/~enr0n/+archive/ubuntu/systemd-251

#0 PPA autopkgtests are looking good so far, have there been any test against all the affected packages (i.e. Bileto), to notify them (or at least the 'main' packages) about any fallout?
https://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-enr0n-systemd-251/?format=plain

#1 d/patches/hwdb-implement-root-option-for-systemd-hwdb-query.patch, debian/patches/sd-hwdb-add-sd_hwdb_new_from_path.patch, please mention the upstream commit/fix in patch headers, e.g. using the "Forwarded:" DEP-3 header. It's not clear at first glance that this is a cherry-pick, missing any reference.

#2 d/patches/test-deny-TEST-29-PORTABLE-again.patch: is this needed for all architectures? We used to disable it on ppc64el only in the past, IIRC.

#3 d/control: Package: systemd-oomd => Is "Section: admin" needed? It is dropped in Debian and seems like unnecessary Ubuntu delta.

#4 d/patches/test-install-libgcc_s.so.1-for-TEST-70-TPM2.patch: please add some DEP-3 headers for this new patch. At least a bug reference and/or upstream fix. So we can easily decide when is the correct time to drop that again in the future.

#5 d/libsystemd0.symbols: Fix lintian error about version string, using "~" as suggested.
E: libsystemd0: symbols-file-contains-current-version-with-debian-revision on symbol sd_hwdb_new_from_path@LIBSYSTEMD_251 (libsystemd.so.0) [symbols]
N:
N: Debian revisions should be stripped from versions in symbols files. Not
N: doing so leads to dependencies unsatisfiable by backports (1.0-1~bpo <<
N: 1.0-1 while 1.0-1~bpo >= 1.0). If the Debian revision can't be stripped
N: because the symbol really appeared between two specific Debian revisions,
N: you should postfix the version with a single "~" (example: 1.0-3~ if the
N: symbol appeared in 1.0-3).
N:
N: This problem normally means that the symbols were added automatically by
N: dpkg-gensymbols. dpkg-gensymbols uses the full version number for the
N: dependency associated to any new symbol that it detects. The maintainer
N: must update the debian/<package>.symbols file by adding the new symbols
N: with the corresponding upstream version.

#6 d/control: dh-sequence-package-notes >= 0.8 (Doesn't work with the Jammy version) – Not sure if it's worth introducing Ubuntu delta for this, though. As the people building systemd isn't too big and people are usually in the known.

#7 Debian's 251.2-6 seems to have some interesting changes (features & fixes), but we can do a smaller merge later in the cycle to get those included.

[Nick Rosbrook (enr0n)]

Thanks for the review, Lukas!

> #0 PPA autopkgtests are looking good so far, have there been any test against
> all the affected packages (i.e. Bileto), to notify them (or at least the
> 'main' packages) about any fallout?
> https://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-
> enr0n-systemd-251/?format=plain

No, unfortunately I never got around to using Bileto.

> #1 d/patches/hwdb-implement-root-option-for-systemd-hwdb-query.patch,
> debian/patches/sd-hwdb-add-sd_hwdb_new_from_path.patch, please mention the
> upstream commit/fix in patch headers, e.g. using the "Forwarded:" DEP-3
> header. It's not clear at first glance that this is a cherry-pick, missing any
> reference.

Whoops, thanks for catching this.

> #2 d/patches/test-deny-TEST-29-PORTABLE-again.patch: is this needed for all
> architectures? We used to disable it on ppc64el only in the past, IIRC.

I will take another look at this. I was seeing it locally on amd64.

> #3 d/control: Package: systemd-oomd => Is "Section: admin" needed? It is
> dropped in Debian and seems like unnecessary Ubuntu delta.

I agree, this delta can be dropped.

> #4 d/patches/test-install-libgcc_s.so.1-for-TEST-70-TPM2.patch: please add
> some DEP-3 headers for this new patch. At least a bug reference and/or
> upstream fix. So we can easily decide when is the correct time to drop that
> again in the future.

Ack.

> #5 d/libsystemd0.symbols: Fix lintian error about version string, using "~" as
> suggested.
> E: libsystemd0: symbols-file-contains-current-version-with-debian-revision on
> symbol sd_hwdb_new_from_path@LIBSYSTEMD_251 (libsystemd.so.0) [symbols]
> N:
> N: Debian revisions should be stripped from versions in symbols files. Not
> N: doing so leads to dependencies unsatisfiable by backports (1.0-1~bpo <<
> N: 1.0-1 while 1.0-1~bpo >= 1.0). If the Debian revision can't be stripped
> N: because the symbol really appeared between two specific Debian revisions,
> N: you should postfix the version with a single "~" (example: 1.0-3~ if the
> N: symbol appeared in 1.0-3).
> N:
> N: This problem normally means that the symbols were added automatically by
> N: dpkg-gensymbols. dpkg-gensymbols uses the full version number for the
> N: dependency associated to any new symbol that it detects. The maintainer
> N: must update the debian/<package>.symbols file by adding the new symbols
> N: with the corresponding upstream version.

Ack.

> #6 d/control: dh-sequence-package-notes >= 0.8 (Doesn't work with the Jammy
> version) – Not sure if it's worth introducing Ubuntu delta for this, though.
> As the people building systemd isn't too big and people are usually in the
> known.

Okay, I will leave it as-is for now then.

> #7 Debian's 251.2-6 seems to have some interesting changes (features & fixes),
> but we can do a smaller merge later in the cycle to get those included.

Yeah, I have kept an eye on Debian's revisions, and I figured we would do a smaller merge later (based on the history in debian/changelog).

[Nick Rosbrook (enr0n)]

After further testing, it seems it was unnecessary to denylist TEST-29-PORTABLE again (must have been a flaky run), so I have dropped that patch.

I believe I addressed all other comments as requested.

[Lukas Märdian (slyon)]

Thank you very much for addressing my concerns, Nick. LGTM!

wrt the other notable changes for review:
We had already discussed those out-of-band and I agree with your assessment for dropping those old patches.

gbp tag'ed & uploaded!

review: Approve

diff --git a/.clang-format b/.clang-format
index c94866f..6aa4e6a 100644
--- a/.clang-format
+++ b/.clang-format
@@ -1,7 +1,7 @@
 # This configuration file can be used to auto-format the code base.
 # Not all guidelines specified in CODING_STYLE are followed, so the
 # result MUST NOT be committed indiscriminately, but each automated
-# change should be reviewed and only the appropriate ones commited.
+# change should be reviewed and only the appropriate ones committed.
 #
 # The easiest way to apply the formatting to your changes ONLY,
 # is to use the git-clang-format script (usually installed with clang-format).
diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile
new file mode 100644
index 0000000..31e442b
--- /dev/null
+++ b/.clusterfuzzlite/Dockerfile
@@ -0,0 +1,5 @@
+FROM gcr.io/oss-fuzz-base/base-builder:v1
+ENV MERGE_WITH_OSS_FUZZ_CORPORA=yes
+COPY . $SRC/systemd
+WORKDIR $SRC/systemd
+COPY tools/oss-fuzz.sh $SRC/build.sh
diff --git a/.editorconfig b/.editorconfig
index d24acc1..27bb375 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -18,6 +18,7 @@ charset = utf-8
 [*.{c,h}]
 indent_style = space
 indent_size = 8
+max_line_length = 109
 
 [*.sh]
 indent_style = space
@@ -30,3 +31,12 @@ indent_size = 8
 [man/*.xml]
 indent_size = 2
 indent_style = space
+max_line_length = 109
+
+[docs/**/*.css]
+indent_style = space
+indent_size = 2
+
+[docs/**/*.html]
+indent_style = space
+indent_size = 2
diff --git a/.gitattributes b/.gitattributes
index f89d1fc..c5b9d85 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,2 +1,11 @@
 *.[ch] whitespace=tab-in-indent,trailing-space
-test/dmidecode-dumps/*.bin binary
+*.gpg  binary generated
+*.bmp  binary
+
+# Mark files as "generated", i.e. no license applies to them.
+# This includes output from programs, directive lists generated by grepping
+# for all possibilities, samples from fuzzers, files from /proc, packet samples,
+# and anything else where no copyright can be asserted.
+#
+# Use 'git check-attr generated -- <path>' to query the attribute.
+[attr]generated
diff --git a/.github/ISSUE_TEMPLATE/Bug_report.md b/.github/ISSUE_TEMPLATE/Bug_report.md
index ca82138..592833e 100644
--- a/.github/ISSUE_TEMPLATE/Bug_report.md
+++ b/.github/ISSUE_TEMPLATE/Bug_report.md
@@ -1,7 +1,7 @@
 ---
 name: Bug report
 about: A report of an error in a recent systemd version
-
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 **systemd version the issue has been seen with**
@@ -10,7 +10,7 @@ about: A report of an error in a recent systemd version
 <!-- **NOTE:** Do not submit bug reports about anything but the two most recently released *major* systemd versions upstream! -->
 <!--           If there have been multiple stable releases for that major version, please consider updating to a recent one before reporting an issue. -->
 <!--           When using a distro package, please make sure that the version reported is meaningful for upstream. -->
-<!-- See https://github.com/systemd/systemd-stable/releases for the list of most recent releases. -->
+<!-- See https://github.com/systemd/systemd-stable/tags for the list of most recent releases. -->
 <!-- For older version please use distribution trackers (see https://systemd.io/CONTRIBUTING#filing-issues). -->
 
 **Used distribution**
diff --git a/.github/ISSUE_TEMPLATE/Feature_request.md b/.github/ISSUE_TEMPLATE/Feature_request.md
index 3c53d72..ad9f447 100644
--- a/.github/ISSUE_TEMPLATE/Feature_request.md
+++ b/.github/ISSUE_TEMPLATE/Feature_request.md
@@ -1,7 +1,7 @@
 ---
 name: Feature request
 about: Suggest an improvement
-
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 **Is your feature request related to a problem? Please describe.**
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..159187e
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,9 @@
+---
+# vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+blank_issues_enabled: true
+contact_links:
+  - name: systemd-devel mailing list
+    url: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
+    about: Please ask (and answer) questions here, use the issue tracker only for issues.
diff --git a/.github/codeql-config.yml b/.github/codeql-config.yml
new file mode 100644
index 0000000..447e53b
--- /dev/null
+++ b/.github/codeql-config.yml
@@ -0,0 +1,12 @@
+---
+# vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
+name: "CodeQL config"
+
+disable-default-queries: false
+
+queries:
+  - name: Enable possibly useful queries which are disabled by default
+    uses: ./.github/codeql-custom.qls
+  - name: systemd-specific CodeQL queries
+    uses: ./.lgtm/cpp-queries/
diff --git a/.github/codeql-custom.qls b/.github/codeql-custom.qls
new file mode 100644
index 0000000..28a22d3
--- /dev/null
+++ b/.github/codeql-custom.qls
@@ -0,0 +1,36 @@
+---
+# vi: ts=2 sw=2 et syntax=yaml:
+# SPDX-License-Identifier: LGPL-2.1-or-later
+#
+# Note: it is not recommended to directly reference the respective queries from
+#       the github/codeql repository, so we have to "dance" around it using
+#       a custom QL suite
+# See:
+#   - https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#running-additional-queries
+#   - https://github.com/github/codeql-action/issues/430#issuecomment-806092120
+#   - https://codeql.github.com/docs/codeql-cli/creating-codeql-query-suites/
+
+- import: codeql-suites/cpp-lgtm.qls
+  from: codeql/cpp-queries
+- include:
+    id:
+      - cpp/bad-strncpy-size
+      - cpp/declaration-hides-variable
+      - cpp/inconsistent-null-check
+      - cpp/mistyped-function-arguments
+      - cpp/nested-loops-with-same-variable
+      - cpp/sizeof-side-effect
+      - cpp/suspicious-pointer-scaling
+      - cpp/suspicious-pointer-scaling-void
+      - cpp/suspicious-sizeof
+      - cpp/unsafe-strcat
+      - cpp/unsafe-strncat
+      - cpp/unsigned-difference-expression-compared-zero
+      - cpp/unused-local-variable
+    tags:
+      - "security"
+      - "correctness"
+    severity: "error"
+- exclude:
+    id:
+      - cpp/fixme-comment
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..3e067c1
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 2
+  - package-ecosystem: "pip"
+    directory: "/.github/workflows"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 2
+  - package-ecosystem: "docker"
+    directory: "/.clusterfuzzlite"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 2
diff --git a/.github/labeler.yml b/.github/labeler.yml
index 773d575..7d128f4 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
 hwdb:
   - hwdb.d/**/*
 units:
diff --git a/.github/workflows/build_test.sh b/.github/workflows/build_test.sh
index 1200fa2..a43c343 100755
--- a/.github/workflows/build_test.sh
+++ b/.github/workflows/build_test.sh
@@ -1,4 +1,5 @@
-#!/bin/bash
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
 
 set -ex
 
@@ -8,9 +9,8 @@ success() { echo >&2 -e "\033[32;1m$1\033[0m"; }
 
 ARGS=(
     "--optimization=0"
-    "--optimization=2"
-    "--optimization=s"
-    "--optimization=3 -Db_lto=true"
+    "--optimization=s -Dgnu-efi=true -Defi-cflags=-m32 -Defi-libdir=/usr/lib32"
+    "--optimization=3 -Db_lto=true -Ddns-over-tls=false"
     "--optimization=3 -Db_lto=false"
     "--optimization=3 -Ddns-over-tls=openssl"
     "--optimization=3 -Dfexecve=true -Dstandalone-binaries=true -Dstatic-libsystemd=true -Dstatic-libudev=true"
@@ -26,6 +26,8 @@ PACKAGES=(
     itstool
     kbd
     libblkid-dev
+    libbpf-dev
+    libc6-dev-i386
     libcap-dev
     libcurl4-gnutls-dev
     libfdisk-dev
@@ -47,8 +49,8 @@ PACKAGES=(
     net-tools
     perl
     python3-evdev
-    python3-lxml
     python3-jinja2
+    python3-lxml
     python3-pip
     python3-pyparsing
     python3-setuptools
@@ -60,6 +62,8 @@ PACKAGES=(
 )
 COMPILER="${COMPILER:?}"
 COMPILER_VERSION="${COMPILER_VERSION:?}"
+LINKER="${LINKER:?}"
+CRYPTOLIB="${CRYPTOLIB:?}"
 RELEASE="$(lsb_release -cs)"
 
 bash -c "echo 'deb-src http://archive.ubuntu.com/ubuntu/ $RELEASE main restricted universe multiverse' >>/etc/apt/sources.list"
@@ -90,7 +94,7 @@ elif [[ "$COMPILER" == gcc ]]; then
     # Latest gcc stack deb packages provided by
     # https://launchpad.net/~ubuntu-toolchain-r/+archive/ubuntu/test
     add-apt-repository -y ppa:ubuntu-toolchain-r/test
-    PACKAGES+=(gcc-$COMPILER_VERSION)
+    PACKAGES+=("gcc-$COMPILER_VERSION" "gcc-$COMPILER_VERSION-multilib")
 else
     fatal "Unknown compiler: $COMPILER"
 fi
@@ -100,11 +104,11 @@ add-apt-repository -y ppa:upstream-systemd-ci/systemd-ci
 apt-get -y update
 apt-get -y build-dep systemd
 apt-get -y install "${PACKAGES[@]}"
-# Install the latest meson and ninja form pip, since the distro versions don't
-# support all the features we need (like --optimization=). Since the build-dep
+# Install more or less recent meson and ninja with pip, since the distro versions don't
+# always support all the features we need (like --optimization=). Since the build-dep
 # command above installs the distro versions, let's install the pip ones just
 # locally and add the local bin directory to the $PATH.
-pip3 install --user -U meson ninja
+pip3 install --user -r .github/workflows/requirements.txt --require-hashes
 export PATH="$HOME/.local/bin:$PATH"
 
 $CC --version
@@ -114,15 +118,42 @@ ninja --version
 for args in "${ARGS[@]}"; do
     SECONDS=0
 
+    # meson fails with
+    #   src/boot/efi/meson.build:52: WARNING: Not using lld as efi-ld, falling back to bfd
+    #   src/boot/efi/meson.build:52:16: ERROR: Fatal warnings enabled, aborting
+    # when LINKER is set to lld so let's just not turn meson warnings into errors with lld
+    # to make sure that the build systemd can pick up the correct efi-ld linker automatically.
+
+    # The install_tag feature introduced in 0.60 causes meson to fail with fatal-meson-warnings
+    # "Project targeting '>= 0.53.2' but tried to use feature introduced in '0.60.0': install_tag arg in custom_target"
+    # It can be safely removed from the CI since it isn't actually used anywhere to test anything.
+    find . -type f -name meson.build -exec sed -i '/install_tag/d' '{}' '+'
+    if [[ "$LINKER" != lld ]]; then
+        additional_meson_args="--fatal-meson-warnings"
+    fi
     info "Checking build with $args"
-    if ! AR="$AR" CC="$CC" CXX="$CXX" CFLAGS="-Werror" CXXFLAGS="-Werror" meson -Dtests=unsafe -Dslow-tests=true -Dfuzz-tests=true --werror $args build; then
+    # shellcheck disable=SC2086
+    if ! AR="$AR" \
+         CC="$CC" CC_LD="$LINKER" CFLAGS="-Werror" \
+         CXX="$CXX" CXX_LD="$LINKER" CXXFLAGS="-Werror" \
+         meson -Dtests=unsafe -Dslow-tests=true -Dfuzz-tests=true --werror \
+               -Dnobody-group=nogroup $additional_meson_args \
+               -Dcryptolib="${CRYPTOLIB:?}" $args build; then
+
+        cat build/meson-logs/meson-log.txt
         fatal "meson failed with $args"
     fi
 
-    if ! meson compile -C build; then
+    if ! meson compile -C build -v; then
         fatal "'meson compile' failed with $args"
     fi
 
+    for loader in build/src/boot/efi/*.efi; do
+        if sbverify --list "$loader" |& grep -q "gap in section table"; then
+            fatal "$loader: Gaps found in section table"
+        fi
+    done
+
     git clean -dxf
 
     success "Build with $args passed in $SECONDS seconds"
diff --git a/.github/workflows/build_test.yml b/.github/workflows/build_test.yml
index fa86236..94fb677 100644
--- a/.github/workflows/build_test.yml
+++ b/.github/workflows/build_test.yml
@@ -1,5 +1,6 @@
 ---
 # vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
 #
 name: Build test
 on:
@@ -11,24 +12,27 @@ on:
       - 'src/**'
       - 'test/fuzz/**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-20.04
     concurrency:
-      group: ${{ github.workflow }}-${{ matrix.env.COMPILER }}-${{ matrix.env.COMPILER_VERSION }}-${{ github.ref }}
+      group: ${{ github.workflow }}-${{ toJSON(matrix.env) }}-${{ github.ref }}
       cancel-in-progress: true
     strategy:
       fail-fast: false
       matrix:
         env:
-          - { COMPILER: "gcc",   COMPILER_VERSION: "10" }
-          - { COMPILER: "gcc",   COMPILER_VERSION: "11" }
-          - { COMPILER: "clang", COMPILER_VERSION: "10" }
-          - { COMPILER: "clang", COMPILER_VERSION: "11" }
-          - { COMPILER: "clang", COMPILER_VERSION: "12" }
+          - { COMPILER: "gcc",   COMPILER_VERSION: "10", LINKER: "bfd",  CRYPTOLIB: "gcrypt"  }
+          - { COMPILER: "gcc",   COMPILER_VERSION: "11", LINKER: "gold", CRYPTOLIB: "openssl" }
+          - { COMPILER: "clang", COMPILER_VERSION: "12", LINKER: "gold", CRYPTOLIB: "gcrypt"  }
+          - { COMPILER: "clang", COMPILER_VERSION: "13", LINKER: "lld",  CRYPTOLIB: "openssl" }
+          - { COMPILER: "clang", COMPILER_VERSION: "14", LINKER: "bfd",  CRYPTOLIB: "auto"    }
     env: ${{ matrix.env }}
     steps:
       - name: Repository checkout
-        uses: actions/checkout@v1
-      - name: Build check (${{ env.COMPILER }}-${{ env.COMPILER_VERSION }})
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+      - name: ${{ format('Build check ({0}-{1}-{2}-{3})', env.COMPILER, env.COMPILER_VERSION, env.LINKER, env.CRYPTOLIB) }}
         run: sudo -E .github/workflows/build_test.sh
diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml
new file mode 100644
index 0000000..a35a97f
--- /dev/null
+++ b/.github/workflows/cflite_pr.yml
@@ -0,0 +1,39 @@
+---
+# vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
+#
+name: ClusterFuzzLite PR fuzzing
+on:
+  pull_request:
+    branches:
+      - main
+      - v[0-9]+-stable
+
+permissions: read-all
+
+jobs:
+  PR:
+    runs-on: ubuntu-latest
+    if: github.repository != 'systemd/systemd' || github.event.pull_request.user.login == 'dependabot[bot]'
+    concurrency:
+      group: ${{ github.workflow }}-${{ matrix.sanitizer }}-${{ github.ref }}
+      cancel-in-progress: true
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address, undefined, memory]
+    steps:
+    - name: Build Fuzzers (${{ matrix.sanitizer }})
+      id: build
+      uses: google/clusterfuzzlite/actions/build_fuzzers@v1
+      with:
+        sanitizer: ${{ matrix.sanitizer }}
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Run Fuzzers (${{ matrix.sanitizer }})
+      id: run
+      uses: google/clusterfuzzlite/actions/run_fuzzers@v1
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        fuzz-seconds: 1200
+        mode: 'code-change'
+        sanitizer: ${{ matrix.sanitizer }}
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index 8ab2a4c..f674d43 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -1,8 +1,13 @@
 ---
 # vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
 # See: https://google.github.io/oss-fuzz/getting-started/continuous-integration/
 
 name: CIFuzz
+
+permissions:
+  contents: read
+
 on:
   pull_request:
     paths:
@@ -34,6 +39,8 @@ jobs:
           oss-fuzz-project-name: 'systemd'
           dry-run: false
           allowed-broken-targets-percentage: 0
+          # keep-unaffected-fuzz-targets should be removed once https://github.com/google/oss-fuzz/issues/7011 is fixed
+          keep-unaffected-fuzz-targets: true
           sanitizer: ${{ matrix.sanitizer }}
       - name: Run Fuzzers (${{ matrix.sanitizer }})
         uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
@@ -43,7 +50,7 @@ jobs:
           dry-run: false
           sanitizer: ${{ matrix.sanitizer }}
       - name: Upload Crash
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2
         if: failure() && steps.build.outcome == 'success'
         with:
           name: ${{ matrix.sanitizer }}-artifacts
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
new file mode 100644
index 0000000..4ee50ac
--- /dev/null
+++ b/.github/workflows/codeql-analysis.yml
@@ -0,0 +1,57 @@
+---
+# vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
+#
+name: "CodeQL"
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - .github/codeql-config.yml
+      - .github/codeql-custom.qls
+      - .github/workflows/codeql-analysis.yml
+      - .github/workflows/requirements.txt
+      - .github/workflows/unit_tests.sh
+  # It takes the workflow approximately 30 minutes to analyze the code base
+  # so it doesn't seem to make much sense to trigger it on every PR or commit.
+  # It runs daily at 01:00 to avoid colliding with the Coverity workflow.
+  schedule:
+    - cron: '0 1 * * *'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ matrix.language }}-${{ github.ref }}
+      cancel-in-progress: true
+    permissions:
+      actions: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'cpp', 'python' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@28eead240834b314f7def40f6fcba65d100d99b1
+      with:
+        languages: ${{ matrix.language }}
+        config-file: ./.github/codeql-config.yml
+
+    - run: sudo -E .github/workflows/unit_tests.sh SETUP
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@28eead240834b314f7def40f6fcba65d100d99b1
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@28eead240834b314f7def40f6fcba65d100d99b1
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index a0eb0f0..1c29c8b 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -1,5 +1,6 @@
 ---
 # vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
 #
 name: Coverity
 
@@ -8,6 +9,9 @@ on:
     # Run Coverity daily at midnight
     - cron:  '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-20.04
@@ -21,10 +25,10 @@ jobs:
       CURRENT_REF:                      "${{ github.ref }}"
     steps:
       - name: Repository checkout
-        uses: actions/checkout@v1
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       # https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
       - name: Set the $COVERITY_SCAN_NOTIFICATION_EMAIL env variable
-        run: echo "COVERITY_SCAN_NOTIFICATION_EMAIL=$(git log -1 ${{ github.sha }} --pretty=\"%aE\")" >> $GITHUB_ENV
+        run: echo "COVERITY_SCAN_NOTIFICATION_EMAIL=$(git log -1 ${{ github.sha }} --pretty=\"%aE\")" >> "$GITHUB_ENV"
       - name: Install Coverity tools
         run: tools/get-coverity.sh
       # Reuse the setup phase of the unit test script to avoid code duplication
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 76d67a3..680a2c1 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -1,12 +1,22 @@
+---
+# vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
+#
 name: "Pull Request Labeler"
+
 on:
 - pull_request_target
 
+permissions:
+  contents: read
+
 jobs:
   triage:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
-    - uses: actions/labeler@main
+    - uses: actions/labeler@9fd24f1f9d6ceb64ba34d181b329ee72f99978a0
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         configuration-path: .github/labeler.yml
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
new file mode 100644
index 0000000..ecdd797
--- /dev/null
+++ b/.github/workflows/linter.yml
@@ -0,0 +1,44 @@
+---
+# vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# https://github.com/marketplace/actions/super-linter
+name: Lint Code Base
+
+on:
+  pull_request:
+    branches:
+      - main
+      - v[0-9]+-stable
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Lint Code Base
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+
+    steps:
+      - name: Repo checkout
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        with:
+          # We need a full repo clone
+          fetch-depth: 0
+
+      - name: Lint Code Base
+        uses: github/super-linter/slim@ae4e373c56efad95924d9cc6b89624fdb2333007
+        env:
+          DEFAULT_BRANCH: main
+          MULTI_STATUS: false
+          # Excludes:
+          #   - man/.* - all snippets in man pages (false positives due to
+          #              missing shebangs)
+          #   - .*\.(in|SKELETON) - all template/skeleton files
+          #   - tools/coverity\.sh - external file (with some modifications)
+          FILTER_REGEX_EXCLUDE: .*/(man/.*|.*\.(in|SKELETON)|tools/coverity\.sh)$
+          VALIDATE_ALL_CODEBASE: false
+          VALIDATE_BASH: true
+          VALIDATE_GITHUB_ACTIONS: true
diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index c8d572a..50dd50b 100644
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -1,7 +1,9 @@
+---
+# vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# Simple boot tests that build and boot the mkosi images generated by the mkosi config files in mkosi.default.d/.
 name: mkosi
 
-# Simple boot tests that build and boot the mkosi images generated by the mkosi config files in .mkosi.
-
 on:
   push:
     branches:
@@ -12,39 +14,80 @@ on:
       - main
       - v[0-9]+-stable
 
+permissions:
+  contents: read
+
+env:
+  # Enable debug logging in systemd, but keep udev's log level to info,
+  # since it's _very_ verbose in the QEMU task
+  KERNEL_CMDLINE: "systemd.unit=mkosi-check-and-shutdown.service !quiet systemd.log_level=debug systemd.log_target=console udev.log_level=info systemd.default_standard_output=journal+console"
+
 jobs:
   ci:
     runs-on: ubuntu-20.04
     concurrency:
-      group: ${{ github.workflow }}-${{ matrix.distro }}-${{ github.ref }}
+      group: ${{ github.workflow }}-${{ matrix.distro }}-${{ matrix.release }}-${{ github.ref }}
       cancel-in-progress: true
     strategy:
       fail-fast: false
       matrix:
-        distro:
-          - arch
-          - debian
-          - ubuntu
-          - fedora
+        include:
+          - distro: arch
+            release: rolling
+          - distro: debian
+            release: testing
+          - distro: ubuntu
+            release: focal
+          - distro: fedora
+            release: "36"
+          - distro: opensuse
+            release: tumbleweed
+          - distro: centos_epel
+            release: 8-stream
+          - distro: centos_epel
+            release: 9-stream
 
     steps:
-    - uses: actions/checkout@v2
-    - uses: systemd/mkosi@v9
+    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+    - uses: systemd/mkosi@93098e2406e12ea7f06f962d4808952b8a06d345
 
     - name: Install
       run: sudo apt-get update && sudo apt-get install --no-install-recommends python3-pexpect python3-jinja2
 
-    - name: Symlink
-      run: ln -s .mkosi/mkosi.${{ matrix.distro }} mkosi.default
+    - name: Configure
+      run: |
+        tee mkosi.default <<- EOF
+        [Distribution]
+        Distribution=${{ matrix.distro }}
+        Release=${{ matrix.release }}
+
+        [Content]
+        Environment=CI_BUILD=1
+
+        [Output]
+        KernelCommandLine=${{ env.KERNEL_CMDLINE }}
+        EOF
 
     - name: Build ${{ matrix.distro }}
-      run: sudo python3 -m mkosi --password= --qemu-headless build
+      run: ./.github/workflows/run_mkosi.sh build
 
     - name: Show ${{ matrix.distro }} image summary
-      run: sudo python3 -m mkosi --password= --qemu-headless summary
+      run: ./.github/workflows/run_mkosi.sh summary
 
     - name: Boot ${{ matrix.distro }} systemd-nspawn
-      run: sudo ./.github/workflows/test_mkosi_boot.py python3 -m mkosi --password= --qemu-headless boot
+      run: ./.github/workflows/run_mkosi.sh boot ${{ env.KERNEL_CMDLINE }}
+
+    - name: Check ${{ matrix.distro }} systemd-nspawn
+      run: ./.github/workflows/run_mkosi.sh shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"
+
+      # TODO: Remove CentOS exclusion once Ubuntu 22.04 is available in GA.
+      # See https://github.com/systemd/systemd/pull/22417 and https://github.com/systemd/mkosi/pull/907 for
+      # more information.
 
     - name: Boot ${{ matrix.distro }} QEMU
-      run: sudo ./.github/workflows/test_mkosi_boot.py python3 -m mkosi --password= --qemu-headless qemu
+      if: ${{ matrix.distro != 'centos_epel' }}
+      run: ./.github/workflows/run_mkosi.sh qemu
+
+    - name: Check ${{ matrix.distro }} QEMU
+      if: ${{ matrix.distro != 'centos_epel' }}
+      run: ./.github/workflows/run_mkosi.sh shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"
diff --git a/.github/workflows/requirements.txt b/.github/workflows/requirements.txt
new file mode 100644
index 0000000..d7b1365
--- /dev/null
+++ b/.github/workflows/requirements.txt
@@ -0,0 +1,18 @@
+meson==0.62.0 \
+    --hash=sha256:00e06dccac7d3b0568b5da82e70c2028c80c359aab6dc517bcbd1825511898c3 \
+    --hash=sha256:06f8c1cfa51bfdb533c82623ffa524cacdbea02ace6d709145e33aabdad6adcb
+ninja==1.10.2.3 \
+    --hash=sha256:0560eea57199e41e86ac2c1af0108b63ae77c3ca4d05a9425a750e908135935a \
+    --hash=sha256:21a1d84d4c7df5881bfd86c25cce4cf7af44ba2b8b255c57bc1c434ec30a2dfc \
+    --hash=sha256:279836285975e3519392c93c26e75755e8a8a7fafec9f4ecbb0293119ee0f9c6 \
+    --hash=sha256:29570a18d697fc84d361e7e6330f0021f34603ae0fcb0ef67ae781e9814aae8d \
+    --hash=sha256:5ea785bf6a15727040835256577239fa3cf5da0d60e618c307aa5efc31a1f0ce \
+    --hash=sha256:688167841b088b6802e006f911d911ffa925e078c73e8ef2f88286107d3204f8 \
+    --hash=sha256:6bd76a025f26b9ae507cf8b2b01bb25bb0031df54ed685d85fc559c411c86cf4 \
+    --hash=sha256:740d61fefb4ca13573704ee8fe89b973d40b8dc2a51aaa4e9e68367233743bb6 \
+    --hash=sha256:840a0b042d43a8552c4004966e18271ec726e5996578f28345d9ce78e225b67e \
+    --hash=sha256:84be6f9ec49f635dc40d4b871319a49fa49b8d55f1d9eae7cd50d8e57ddf7a85 \
+    --hash=sha256:9ca8dbece144366d5f575ffc657af03eb11c58251268405bc8519d11cf42f113 \
+    --hash=sha256:cc8b31b5509a2129e4d12a35fc21238c157038022560aaf22e49ef0a77039086 \
+    --hash=sha256:d5e0275d28997a750a4f445c00bdd357b35cc334c13cdff13edf30e544704fbd \
+    --hash=sha256:e1b86ad50d4e681a7dbdff05fc23bb52cb773edb90bc428efba33fa027738408
diff --git a/.github/workflows/run_mkosi.sh b/.github/workflows/run_mkosi.sh
new file mode 100755
index 0000000..153ebe3
--- /dev/null
+++ b/.github/workflows/run_mkosi.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# shellcheck disable=SC2064
+
+set -eu
+set -o pipefail
+
+EC=0
+TEMPFILE="$(mktemp)"
+TEMP_EXTRA_TREE="$(mktemp --directory)"
+trap "rm -rf '$TEMPFILE' '$TEMP_EXTRA_TREE'" EXIT
+
+# We need isc-dhcp-server to be installed for the networkd unit tests, but we don't want to
+# run it by default. mktemp creates the directory as 700, so change it, otherwise it will
+# affect the image's root folder permissions.
+chmod 755 "$TEMP_EXTRA_TREE"
+mkdir -p "$TEMP_EXTRA_TREE/etc/systemd/system/"
+ln -s /dev/null "$TEMP_EXTRA_TREE/etc/systemd/system/isc-dhcp-server.service"
+ln -s /dev/null "$TEMP_EXTRA_TREE/etc/systemd/system/isc-dhcp-server6.service"
+
+for ((i = 0; i < 5; i++)); do
+    EC=0
+    (sudo python3 -m mkosi --extra-tree="$TEMP_EXTRA_TREE" "$@") |& tee "$TEMPFILE" || EC=$?
+    if [[ $EC -eq 0 ]]; then
+        # The command passed — let's return immediately
+        break
+    fi
+
+    if ! grep -E "Failed to dissect image .+: Connection timed out" "$TEMPFILE"; then
+        # The command failed for other reason than the dissect-related timeout -
+        # let's exit with the same EC
+        exit $EC
+    fi
+
+    # The command failed due to the dissect-related timeout — let's try again
+    sleep 1
+done
+
+exit $EC
diff --git a/.github/workflows/test_mkosi_boot.py b/.github/workflows/test_mkosi_boot.py
deleted file mode 100755
index 3418fd3..0000000
--- a/.github/workflows/test_mkosi_boot.py
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/usr/bin/env python3
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-import pexpect
-import sys
-
-
-def run() -> None:
-    p = pexpect.spawnu(" ".join(sys.argv[1:]), logfile=sys.stdout, timeout=300)
-
-    p.expect("#")
-    p.sendline("systemctl poweroff")
-
-    p.expect(pexpect.EOF)
-
-
-try:
-    run()
-except pexpect.EOF:
-    print("UNEXPECTED EOF")
-    sys.exit(1)
-except pexpect.TIMEOUT:
-    print("TIMED OUT")
-    sys.exit(1)
diff --git a/.github/workflows/unit_tests.sh b/.github/workflows/unit_tests.sh
index e85c321..442202f 100755
--- a/.github/workflows/unit_tests.sh
+++ b/.github/workflows/unit_tests.sh
@@ -1,5 +1,7 @@
-#!/bin/bash
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
 
+# shellcheck disable=SC2206
 PHASES=(${@:-SETUP RUN RUN_ASAN_UBSAN CLEANUP})
 RELEASE="$(lsb_release -cs)"
 ADDITIONAL_DEPS=(
@@ -7,6 +9,7 @@ ADDITIONAL_DEPS=(
     expect
     fdisk
     jekyll
+    libbpf-dev
     libfdisk-dev
     libfido2-dev
     libp11-kit-dev
@@ -14,10 +17,12 @@ ADDITIONAL_DEPS=(
     libqrencode-dev
     libssl-dev
     libtss2-dev
+    libxkbcommon-dev
     libzstd-dev
     perl
     python3-libevdev
     python3-pyparsing
+    rpm
     zstd
 )
 
@@ -25,8 +30,17 @@ function info() {
     echo -e "\033[33;1m$1\033[0m"
 }
 
+function run_meson() {
+    if ! meson "$@"; then
+        find . -type f -name meson-log.txt -exec cat '{}' +
+        return 1
+    fi
+}
+
 set -ex
 
+MESON_ARGS=(-Dcryptolib=${CRYPTOLIB:-auto})
+
 for phase in "${PHASES[@]}"; do
     case $phase in
         SETUP)
@@ -37,28 +51,45 @@ for phase in "${PHASES[@]}"; do
             apt-get -y update
             apt-get -y build-dep systemd
             apt-get -y install "${ADDITIONAL_DEPS[@]}"
+            pip3 install -r .github/workflows/requirements.txt --require-hashes
             ;;
         RUN|RUN_GCC|RUN_CLANG)
             if [[ "$phase" = "RUN_CLANG" ]]; then
                 export CC=clang
                 export CXX=clang++
+                # The docs build is slow and is not affected by compiler/flags, so do it just once
+                MESON_ARGS+=(-Dman=true)
             fi
-            meson --werror -Dtests=unsafe -Dslow-tests=true -Dfuzz-tests=true -Dman=true build
+            # The install_tag feature introduced in 0.60 causes meson to fail with fatal-meson-warnings
+            # "Project targeting '>= 0.53.2' but tried to use feature introduced in '0.60.0': install_tag arg in custom_target"
+            # It can be safely removed from the CI since it isn't actually used anywhere to test anything.
+            find . -type f -name meson.build -exec sed -i '/install_tag/d' '{}' '+'
+            MESON_ARGS+=(--fatal-meson-warnings)
+            run_meson -Dnobody-group=nogroup --werror -Dtests=unsafe -Dslow-tests=true -Dfuzz-tests=true "${MESON_ARGS[@]}" build
             ninja -C build -v
             meson test -C build --print-errorlogs
             ;;
-        RUN_ASAN_UBSAN|RUN_GCC_ASAN_UBSAN|RUN_CLANG_ASAN_UBSAN)
+        RUN_ASAN_UBSAN|RUN_GCC_ASAN_UBSAN|RUN_CLANG_ASAN_UBSAN|RUN_CLANG_ASAN_UBSAN_NO_DEPS)
             MESON_ARGS=(--optimization=1)
 
-            if [[ "$phase" = "RUN_CLANG_ASAN_UBSAN" ]]; then
+            if [[ "$phase" =~ ^RUN_CLANG_ASAN_UBSAN ]]; then
                 export CC=clang
                 export CXX=clang++
                 # Build fuzzer regression tests only with clang (for now),
                 # see: https://github.com/systemd/systemd/pull/15886#issuecomment-632689604
                 # -Db_lundef=false: See https://github.com/mesonbuild/meson/issues/764
                 MESON_ARGS+=(-Db_lundef=false -Dfuzz-tests=true)
+
+                if [[ "$phase" == "RUN_CLANG_ASAN_UBSAN_NO_DEPS" ]]; then
+                    MESON_ARGS+=(-Dskip-deps=true)
+                fi
             fi
-            meson --werror -Dtests=unsafe -Db_sanitize=address,undefined "${MESON_ARGS[@]}" build
+            # The install_tag feature introduced in 0.60 causes meson to fail with fatal-meson-warnings
+            # "Project targeting '>= 0.53.2' but tried to use feature introduced in '0.60.0': install_tag arg in custom_target"
+            # It can be safely removed from the CI since it isn't actually used anywhere to test anything.
+            find . -type f -name meson.build -exec sed -i '/install_tag/d' '{}' '+'
+            MESON_ARGS+=(--fatal-meson-warnings)
+            run_meson -Dnobody-group=nogroup --werror -Dtests=unsafe -Db_sanitize=address,undefined "${MESON_ARGS[@]}" build
             ninja -C build -v
 
             export ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
index 4a19a6a..7226a77 100644
--- a/.github/workflows/unit_tests.yml
+++ b/.github/workflows/unit_tests.yml
@@ -1,5 +1,6 @@
 ---
 # vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
 #
 name: Unit tests
 on:
@@ -8,20 +9,31 @@ on:
       - main
       - v[0-9]+-stable
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-20.04
     concurrency:
-      group: ${{ github.workflow }}-${{ matrix.run_phase }}-${{ github.ref }}
+      group: ${{ github.workflow }}-${{ matrix.run_phase }}-${{ matrix.cryptolib }}-${{ github.ref }}
       cancel-in-progress: true
     strategy:
       fail-fast: false
       matrix:
-        run_phase: [GCC, GCC_ASAN_UBSAN, CLANG, CLANG_ASAN_UBSAN]
+        run_phase: [GCC, GCC_ASAN_UBSAN, CLANG, CLANG_ASAN_UBSAN, CLANG_ASAN_UBSAN_NO_DEPS]
+        cryptolib: [auto]
+        include:
+          - run_phase: GCC
+            cryptolib: openssl
+          - run_phase: CLANG
+            cryptolib: gcrypt
     steps:
       - name: Repository checkout
-        uses: actions/checkout@v1
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - name: Install build dependencies
         run: sudo -E .github/workflows/unit_tests.sh SETUP
-      - name: Build & test (${{ matrix.run_phase }})
+      - name: Build & test (${{ matrix.run_phase }}-${{ matrix.cryptolib }})
         run: sudo -E .github/workflows/unit_tests.sh RUN_${{ matrix.run_phase }}
+        env:
+          CRYPTOLIB: ${{ matrix.cryptolib }}
diff --git a/.gitignore b/.gitignore
index d6f6cac..9763766 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,11 +1,6 @@
-*.a
 *.cache
-*.gch
-*.log
-*.o
 *.plist
 *.py[co]
-*.stamp
 *.swp
 *.trs
 *~
@@ -31,11 +26,13 @@ __pycache__/
 /.#image.raw.lck
 /image.raw.cache-pre-dev
 /image.raw.cache-pre-inst
+/image.raw.manifest
 /install-tree
 /.mkosi-*
 /mkosi.builddir/
 /mkosi.output/
 /mkosi.default
-mkosi.default.d/*
-!mkosi.default.d/10-systemd.conf
+/mkosi.installdir/
+# Ignore any mkosi config files with "local" in the name
+/mkosi.default.d/**/*local*.conf
 /tags
diff --git a/.lgtm.yml b/.lgtm.yml
index 93f8b1c..86fd0e7 100644
--- a/.lgtm.yml
+++ b/.lgtm.yml
@@ -1,5 +1,27 @@
 ---
 # vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+# Explicitly enable certain checks which are hidden by default
+queries:
+  - include: cpp/bad-strncpy-size
+  - include: cpp/declaration-hides-variable
+  - include: cpp/inconsistent-null-check
+  - include: cpp/mistyped-function-arguments
+  - include: cpp/nested-loops-with-same-variable
+  - include: cpp/sizeof-side-effect
+  - include: cpp/suspicious-pointer-scaling
+  - include: cpp/suspicious-pointer-scaling-void
+  - include: cpp/suspicious-sizeof
+  - include: cpp/unsafe-strcat
+  - include: cpp/unsafe-strncat
+  - include: cpp/unsigned-difference-expression-compared-zero
+  - include: cpp/unused-local-variable
+  - include:
+      tags:
+        - "security"
+        - "correctness"
+      severity: "error"
 
 extraction:
   cpp:
@@ -10,6 +32,9 @@ extraction:
         - libp11-kit-dev
         - libssl-dev
         - python3-jinja2
+    after_prepare:
+      - pip3 install -r .github/workflows/requirements.txt --require-hashes
+      - export PATH="/opt/work/.local/bin:$PATH"
   python:
     python_setup:
       version: 3
diff --git a/.lgtm/cpp-queries/PotentiallyDangerousFunction.ql b/.lgtm/cpp-queries/PotentiallyDangerousFunction.ql
index 8653304..39e8ddd 100644
--- a/.lgtm/cpp-queries/PotentiallyDangerousFunction.ql
+++ b/.lgtm/cpp-queries/PotentiallyDangerousFunction.ql
@@ -1,15 +1,17 @@
 /**
+ * vi: sw=2 ts=2 et syntax=ql:
+ *
+ * Borrowed from
+ * https://github.com/Semmle/ql/blob/master/cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.ql
+ *
  * @name Use of potentially dangerous function
  * @description Certain standard library functions are dangerous to call.
+ * @id cpp/potentially-dangerous-function
  * @kind problem
  * @problem.severity error
  * @precision high
- * @id cpp/potentially-dangerous-function
  * @tags reliability
  *       security
- *
- * Borrowed from
- * https://github.com/Semmle/ql/blob/master/cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.ql
  */
 import cpp
 
diff --git a/.lgtm/cpp-queries/UninitializedVariableWithCleanup.ql b/.lgtm/cpp-queries/UninitializedVariableWithCleanup.ql
new file mode 100644
index 0000000..6b3b62f
--- /dev/null
+++ b/.lgtm/cpp-queries/UninitializedVariableWithCleanup.ql
@@ -0,0 +1,110 @@
+/**
+ * vi: sw=2 ts=2 et syntax=ql:
+ *
+ * Based on cpp/uninitialized-local.
+ *
+ * @name Potentially uninitialized local variable using the cleanup attribute
+ * @description Running the cleanup handler on a possibly uninitialized variable
+ *              is generally a bad idea.
+ * @id cpp/uninitialized-local-with-cleanup
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @tags security
+ */
+
+import cpp
+import semmle.code.cpp.controlflow.StackVariableReachability
+
+/** Auxiliary predicate: List cleanup functions we want to explicitly ignore
+  * since they don't do anything illegal even when the variable is uninitialized
+  */
+predicate cleanupFunctionDenyList(string fun) {
+  fun = "erase_char"
+}
+
+/**
+ * A declaration of a local variable using __attribute__((__cleanup__(x)))
+ * that leaves the variable uninitialized.
+ */
+DeclStmt declWithNoInit(LocalVariable v) {
+  result.getADeclaration() = v and
+  not v.hasInitializer() and
+  /* The variable has __attribute__((__cleanup__(...))) set */
+  v.getAnAttribute().hasName("cleanup") and
+  /* Check if the cleanup function is not on a deny list */
+  not cleanupFunctionDenyList(v.getAnAttribute().getAnArgument().getValueText())
+}
+
+class UninitialisedLocalReachability extends StackVariableReachability {
+  UninitialisedLocalReachability() { this = "UninitialisedLocal" }
+
+  override predicate isSource(ControlFlowNode node, StackVariable v) { node = declWithNoInit(v) }
+
+  /* Note: _don't_ use the `useOfVarActual()` predicate here (and a couple of lines
+   * below), as it assumes that the callee always modifies the variable if
+   * it's passed to the function.
+   *
+   * i.e.:
+   * _cleanup_free char *x;
+   * fun(&x);
+   * puts(x);
+   *
+   * `useOfVarActual()` won't treat this an an uninitialized read even if the callee
+   * doesn't modify the argument, however, `useOfVar()` will
+   */
+  override predicate isSink(ControlFlowNode node, StackVariable v) { useOfVar(v, node) }
+
+  override predicate isBarrier(ControlFlowNode node, StackVariable v) {
+    // only report the _first_ possibly uninitialized use
+    useOfVar(v, node) or
+    (
+      /* If there's an return statement somewhere between the variable declaration
+       * and a possible definition, don't accept is as a valid initialization.
+       *
+       * E.g.:
+       * _cleanup_free_ char *x;
+       * ...
+       * if (...)
+       *    return;
+       * ...
+       * x = malloc(...);
+       *
+       * is not a valid initialization, since we might return from the function
+       * _before_ the actual iniitialization (emphasis on _might_, since we
+       * don't know if the return statement might ever evaluate to true).
+       */
+      definitionBarrier(v, node) and
+      not exists(ReturnStmt rs |
+                 /* The attribute check is "just" a complexity optimization */
+                 v.getFunction() = rs.getEnclosingFunction() and v.getAnAttribute().hasName("cleanup") |
+                 rs.getLocation().isBefore(node.getLocation())
+      )
+    )
+  }
+}
+
+pragma[noinline]
+predicate containsInlineAssembly(Function f) { exists(AsmStmt s | s.getEnclosingFunction() = f) }
+
+/**
+ * Auxiliary predicate: List common exceptions or false positives
+ * for this check to exclude them.
+ */
+VariableAccess commonException() {
+  // If the uninitialized use we've found is in a macro expansion, it's
+  // typically something like va_start(), and we don't want to complain.
+  result.getParent().isInMacroExpansion()
+  or
+  result.getParent() instanceof BuiltInOperation
+  or
+  // Finally, exclude functions that contain assembly blocks. It's
+  // anyone's guess what happens in those.
+  containsInlineAssembly(result.getEnclosingFunction())
+}
+
+from UninitialisedLocalReachability r, LocalVariable v, VariableAccess va
+where
+  r.reaches(_, v, va) and
+  not va = commonException()
+select va, "The variable $@ may not be initialized here, but has a cleanup handler.", v, v.getName()
diff --git a/.lgtm/cpp-queries/qlpack.yml b/.lgtm/cpp-queries/qlpack.yml
new file mode 100644
index 0000000..a1a2dec
--- /dev/null
+++ b/.lgtm/cpp-queries/qlpack.yml
@@ -0,0 +1,11 @@
+---
+# vi: ts=2 sw=2 et syntax=yaml:
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+library: false
+name: systemd/cpp-queries
+version: 0.0.1
+dependencies:
+  codeql/cpp-all: "*"
+  codeql/suite-helpers: "*"
+extractor: cpp
diff --git a/.packit.yml b/.packit.yml
index 3a47c6a..a7502b2 100644
--- a/.packit.yml
+++ b/.packit.yml
@@ -13,11 +13,12 @@ downstream_package_name: systemd
 # `git describe` returns in systemd's case 'v245-xxx' which breaks RPM version
 # detection (that expects 245-xxxx'). Let's tweak the version string accordingly
 upstream_tag_template: "v{version}"
+srpm_build_deps: []
 
 actions:
   post-upstream-clone:
-    # Use the Fedora 35 specfile
-    - "git clone --branch f35 https://src.fedoraproject.org/rpms/systemd .packit_rpm --depth=1"
+    # Use the Fedora Rawhide specfile
+    - "git clone https://src.fedoraproject.org/rpms/systemd .packit_rpm --depth=1"
     # Drop the "sources" file so rebase-helper doesn't think we're a dist-git
     - "rm -fv .packit_rpm/sources"
     # Drop backported patches from the specfile, but keep the downstream-only ones
@@ -37,6 +38,8 @@ jobs:
   trigger: pull_request
   metadata:
     targets:
-    - fedora-35-aarch64
-    - fedora-35-i386
-    - fedora-35-x86_64
+    - fedora-rawhide-aarch64
+    - fedora-rawhide-i386
+    - fedora-rawhide-ppc64le
+    - fedora-rawhide-s390x
+    - fedora-rawhide-x86_64
diff --git a/.semaphore/semaphore-runner.sh b/.semaphore/semaphore-runner.sh
index e7dbcb2..ba21811 100755
--- a/.semaphore/semaphore-runner.sh
+++ b/.semaphore/semaphore-runner.sh
@@ -1,54 +1,65 @@
-#!/bin/bash
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
 
 set -eux
+set -o pipefail
 
 # default to Debian testing
-DISTRO=${DISTRO:-debian}
-RELEASE=${RELEASE:-bullseye}
-BRANCH=${BRANCH:-upstream-ci}
-ARCH=${ARCH:-amd64}
-CONTAINER=${RELEASE}-${ARCH}
-CACHE_DIR=${SEMAPHORE_CACHE_DIR:=/tmp}
+DISTRO="${DISTRO:-debian}"
+RELEASE="${RELEASE:-bullseye}"
+BRANCH="${BRANCH:-upstream-ci}"
+ARCH="${ARCH:-amd64}"
+CONTAINER="${RELEASE}-${ARCH}"
+CACHE_DIR="${SEMAPHORE_CACHE_DIR:-/tmp}"
 AUTOPKGTEST_DIR="${CACHE_DIR}/autopkgtest"
 # semaphore cannot expose these, but useful for interactive/local runs
 ARTIFACTS_DIR=/tmp/artifacts
+# shellcheck disable=SC2206
 PHASES=(${@:-SETUP RUN})
 UBUNTU_RELEASE="$(lsb_release -cs)"
 
 create_container() {
     # Create autopkgtest LXC image; this sometimes fails with "Unable to fetch
     # GPG key from keyserver", so retry a few times with different keyservers.
-    for keyserver in "" "keys.gnupg.net" "keys.openpgp.org" "keyserver.ubuntu.com"; do
+    for keyserver in "keys.openpgp.org" "" "keyserver.ubuntu.com" "keys.gnupg.net"; do
         for retry in {1..5}; do
-            sudo lxc-create -n $CONTAINER -t download -- -d $DISTRO -r $RELEASE -a $ARCH ${keyserver:+--keyserver "$keyserver"} && break 2
+            sudo lxc-create -n "$CONTAINER" -t download -- -d "$DISTRO" -r "$RELEASE" -a "$ARCH" ${keyserver:+--keyserver "$keyserver"} && break 2
             sleep $((retry*retry))
         done
     done
 
     # unconfine the container, otherwise some tests fail
-    echo 'lxc.apparmor.profile = unconfined' | sudo tee -a /var/lib/lxc/$CONTAINER/config
+    echo 'lxc.apparmor.profile = unconfined' | sudo tee -a "/var/lib/lxc/$CONTAINER/config"
 
-    sudo lxc-start -n $CONTAINER
+    sudo lxc-start -n "$CONTAINER"
 
     # enable source repositories so that apt-get build-dep works
-    sudo lxc-attach -n $CONTAINER -- sh -ex <<EOF
+    sudo lxc-attach -n "$CONTAINER" -- sh -ex <<EOF
 sed 's/^deb/deb-src/' /etc/apt/sources.list >> /etc/apt/sources.list.d/sources.list
-# wait until online
-while [ -z "\$(ip route list 0/0)" ]; do sleep 1; done
+# We might attach the console too soon
+while ! systemctl --quiet --wait is-system-running; do sleep 1; done
+# Manpages database trigger takes a lot of time and is not useful in a CI
+echo 'man-db man-db/auto-update boolean false' | debconf-set-selections
+# Speed up dpkg, image is thrown away after the test
+mkdir -p /etc/dpkg/dpkg.cfg.d/
+echo 'force-unsafe-io' > /etc/dpkg/dpkg.cfg.d/unsafe_io
+# For some reason, it is necessary to run this manually or the interface won't be configured
+# Note that we avoid networkd, as some of the tests will break it later on
+dhclient
 apt-get -q --allow-releaseinfo-change update
 apt-get -y dist-upgrade
 apt-get install -y eatmydata
 # The following four are needed as long as these deps are not covered by Debian's own packaging
-apt-get install -y fdisk tree libfdisk-dev libp11-kit-dev libssl-dev libpwquality-dev
+apt-get install -y fdisk tree libfdisk-dev libp11-kit-dev libssl-dev libpwquality-dev rpm
 apt-get purge --auto-remove -y unattended-upgrades
 systemctl unmask systemd-networkd
 systemctl enable systemd-networkd
 EOF
-    sudo lxc-stop -n $CONTAINER
+    sudo lxc-stop -n "$CONTAINER"
 }
 
 for phase in "${PHASES[@]}"; do
-    case $phase in
+    case "$phase" in
         SETUP)
             # remove semaphore repos, some of them don't work and cause error messages
             sudo rm -f /etc/apt/sources.list.d/*
@@ -59,17 +70,17 @@ for phase in "${PHASES[@]}"; do
             sudo apt-get install -y -t "$UBUNTU_RELEASE-backports" lxc
             sudo apt-get install -y python3-debian git dpkg-dev fakeroot python3-jinja2
 
-            [ -d $AUTOPKGTEST_DIR ] || git clone --quiet --depth=1 https://salsa.debian.org/ci-team/autopkgtest.git "$AUTOPKGTEST_DIR"
+            [ -d "$AUTOPKGTEST_DIR" ] || git clone --quiet --depth=1 https://salsa.debian.org/ci-team/autopkgtest.git "$AUTOPKGTEST_DIR"
 
             create_container
         ;;
         RUN)
             # add current debian/ packaging
-            git fetch --depth=1 https://salsa.debian.org/systemd-team/systemd.git $BRANCH
+            git fetch --depth=1 https://salsa.debian.org/systemd-team/systemd.git "$BRANCH"
             git checkout FETCH_HEAD debian
 
             # craft changelog
-            UPSTREAM_VER=$(git describe | sed 's/^v//;s/-/./g')
+            UPSTREAM_VER="$(git describe | sed 's/^v//;s/-/./g')"
             cat << EOF > debian/changelog.new
 systemd (${UPSTREAM_VER}.0) UNRELEASED; urgency=low
 
@@ -78,7 +89,7 @@ systemd (${UPSTREAM_VER}.0) UNRELEASED; urgency=low
  -- systemd test <[e-mail]>  $(date -R)
 
 EOF
-            cat debian/changelog >> debian/changelog.new
+            cat debian/changelog >>debian/changelog.new
             mv debian/changelog.new debian/changelog
 
             # clean out patches
@@ -91,15 +102,15 @@ EOF
             echo '1.0' > debian/source/format
 
             # build source package
-            dpkg-buildpackage -S -I -I$(basename "$CACHE_DIR") -d -us -uc -nc
+            dpkg-buildpackage -S -I -I"$(basename "$CACHE_DIR")" -d -us -uc -nc
 
             # now build the package and run the tests
             rm -rf "$ARTIFACTS_DIR"
             # autopkgtest exits with 2 for "some tests skipped", accept that
-            $AUTOPKGTEST_DIR/runner/autopkgtest --env DEB_BUILD_OPTIONS=noudeb \
-                                                --env TEST_UPSTREAM=1 ../systemd_*.dsc \
-                                                -o "$ARTIFACTS_DIR" \
-                                                -- lxc -s $CONTAINER \
+            "$AUTOPKGTEST_DIR/runner/autopkgtest" --env DEB_BUILD_OPTIONS=noudeb \
+                                                  --env TEST_UPSTREAM=1 ../systemd_*.dsc \
+                                                  -o "$ARTIFACTS_DIR" \
+                                                  -- lxc -s "$CONTAINER" \
                 || [ $? -eq 2 ]
         ;;
         *)
diff --git a/.semaphore/semaphore.yml b/.semaphore/semaphore.yml
index 7fc38a5..0774233 100644
--- a/.semaphore/semaphore.yml
+++ b/.semaphore/semaphore.yml
@@ -1,4 +1,5 @@
 ---
+# SPDX-License-Identifier: LGPL-2.1-or-later
 # vi: ts=2 sw=2 et:
 
 version: v1.0
@@ -6,7 +7,7 @@ name: Debian autopkgtest (LXC)
 agent:
   machine:
     type: e1-standard-2
-    os_image: ubuntu1804
+    os_image: ubuntu2004
 
 # Cancel any running or queued job for the same ref
 auto_cancel:
@@ -25,8 +26,3 @@ blocks:
             - checkout --use-cache
             - .semaphore/semaphore-runner.sh SETUP
             - .semaphore/semaphore-runner.sh RUN
-          env_vars:
-            # Pin the debian systemd repo to a specific revision, to work around
-            # missing systemd/systemd#20056 in pre-v250 stable branches
-            - name: BRANCH
-              value: e138f8573a14f8f094bd6c9582bc26ed62c1347f
diff --git a/LICENSES/BSD-2-Clause.txt b/LICENSES/BSD-2-Clause.txt
new file mode 100644
index 0000000..b0e20f5
--- /dev/null
+++ b/LICENSES/BSD-2-Clause.txt
@@ -0,0 +1,9 @@
+Copyright (c) <year> <owner> All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/LICENSES/BSD-3-Clause.txt b/LICENSES/BSD-3-Clause.txt
new file mode 100644
index 0000000..b9e779f
--- /dev/null
+++ b/LICENSES/BSD-3-Clause.txt
@@ -0,0 +1,27 @@
+// Copyright 2014 The Chromium OS Authors. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//    * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//    * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//    * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/LICENSES/CC0-1.0.txt b/LICENSES/CC0-1.0.txt
new file mode 100644
index 0000000..0e259d4
--- /dev/null
+++ b/LICENSES/CC0-1.0.txt
@@ -0,0 +1,121 @@
+Creative Commons Legal Code
+
+CC0 1.0 Universal
+
+    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+    HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without fear
+of later claims of infringement build upon, modify, incorporate in other
+works, reuse and redistribute as freely as possible in any form whatsoever
+and for any purposes, including without limitation commercial purposes.
+These owners may contribute to the Commons to promote the ideal of a free
+culture and the further production of creative, cultural and scientific
+works, or to gain reputation or greater distribution for their Work in
+part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under its
+terms, with knowledge of his or her Copyright and Related Rights in the
+Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be
+protected by copyright and related or neighboring rights ("Copyright and
+Related Rights"). Copyright and Related Rights include, but are not
+limited to, the following:
+
+  i. the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+ ii. moral rights retained by the original author(s) and/or performer(s);
+iii. publicity and privacy rights pertaining to a person's image or
+     likeness depicted in a Work;
+ iv. rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+  v. rights protecting the extraction, dissemination, use and reuse of data
+     in a Work;
+ vi. database rights (such as those arising under Directive 96/9/EC of the
+     European Parliament and of the Council of 11 March 1996 on the legal
+     protection of databases, and under any national implementation
+     thereof, including any amended or successor version of such
+     directive); and
+vii. other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention
+of, applicable law, Affirmer hereby overtly, fully, permanently,
+irrevocably and unconditionally waives, abandons, and surrenders all of
+Affirmer's Copyright and Related Rights and associated claims and causes
+of action, whether now known or unknown (including existing as well as
+future claims and causes of action), in the Work (i) in all territories
+worldwide, (ii) for the maximum duration provided by applicable law or
+treaty (including future time extensions), (iii) in any current or future
+medium and for any number of copies, and (iv) for any purpose whatsoever,
+including without limitation commercial, advertising or promotional
+purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+member of the public at large and to the detriment of Affirmer's heirs and
+successors, fully intending that such Waiver shall not be subject to
+revocation, rescission, cancellation, termination, or any other legal or
+equitable action to disrupt the quiet enjoyment of the Work by the public
+as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason
+be judged legally invalid or ineffective under applicable law, then the
+Waiver shall be preserved to the maximum extent permitted taking into
+account Affirmer's express Statement of Purpose. In addition, to the
+extent the Waiver is so judged Affirmer hereby grants to each affected
+person a royalty-free, non transferable, non sublicensable, non exclusive,
+irrevocable and unconditional license to exercise Affirmer's Copyright and
+Related Rights in the Work (i) in all territories worldwide, (ii) for the
+maximum duration provided by applicable law or treaty (including future
+time extensions), (iii) in any current or future medium and for any number
+of copies, and (iv) for any purpose whatsoever, including without
+limitation commercial, advertising or promotional purposes (the
+"License"). The License shall be deemed effective as of the date CC0 was
+applied by Affirmer to the Work. Should any part of the License for any
+reason be judged legally invalid or ineffective under applicable law, such
+partial invalidity or ineffectiveness shall not invalidate the remainder
+of the License, and in such case Affirmer hereby affirms that he or she
+will not (i) exercise any of his or her remaining Copyright and Related
+Rights in the Work or (ii) assert any associated claims and causes of
+action with respect to the Work, in either case contrary to Affirmer's
+express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
+    surrendered, licensed or otherwise affected by this document.
+ b. Affirmer offers the Work as-is and makes no representations or
+    warranties of any kind concerning the Work, express, implied,
+    statutory or otherwise, including without limitation warranties of
+    title, merchantability, fitness for a particular purpose, non
+    infringement, or the absence of latent or other defects, accuracy, or
+    the present or absence of errors, whether or not discoverable, all to
+    the greatest extent permissible under applicable law.
+ c. Affirmer disclaims responsibility for clearing rights of other persons
+    that may apply to the Work or any use thereof, including without
+    limitation any person's Copyright and Related Rights in the Work.
+    Further, Affirmer disclaims responsibility for obtaining any necessary
+    consents, permissions or other rights required for any use of the
+    Work.
+ d. Affirmer understands and acknowledges that Creative Commons is not a
+    party to this document and has no duty or obligation with respect to
+    this CC0 or use of the Work.
diff --git a/LICENSES/LGPL-2.0-or-later.txt b/LICENSES/LGPL-2.0-or-later.txt
new file mode 100644
index 0000000..eb3a4cd
--- /dev/null
+++ b/LICENSES/LGPL-2.0-or-later.txt
@@ -0,0 +1,174 @@
+GNU LIBRARY GENERAL PUBLIC LICENSE
+
+Version 2, June 1991
+
+Copyright (C) 1991 Free Software Foundation, Inc.
+51 Franklin St, Fifth Floor, Boston, MA  02110-1301, USA
+
+Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
+
+[This is the first released version of the library GPL.  It is numbered 2 because it goes with version 2 of the ordinary GPL.]
+
+Preamble
+
+The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users.
+
+This license, the Library General Public License, applies to some specially designated Free Software Foundation software, and to any other libraries whose authors decide to use it. You can use it for your libraries, too.
+
+When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things.
+
+To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library, or if you modify it.
+
+For example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link a program with the library, you must provide complete object files to the recipients so that they can relink them with the library, after making changes to the library and recompiling it. And you must show them these terms so they know their rights.
+
+Our method of protecting your rights has two steps: (1) copyright the library, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the library.
+
+Also, for each distributor's protection, we want to make certain that everyone understands that there is no warranty for this free library. If the library is modified by someone else and passed on, we want its recipients to know that what they have is not the original version, so that any problems introduced by others will not reflect on the original authors' reputations.
+
+Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that companies distributing free software will individually obtain patent licenses, thus in effect transforming the program into proprietary software. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all.
+
+Most GNU software, including some libraries, is covered by the ordinary GNU General Public License, which was designed for utility programs. This license, the GNU Library General Public License, applies to certain designated libraries. This license is quite different from the ordinary one; be sure to read it in full, and don't assume that anything in it is the same as in the ordinary license.
+
+The reason we have a separate public license for some libraries is that they blur the distinction we usually make between modifying or adding to a program and simply using it. Linking a program with a library, without changing the library, is in some sense simply using the library, and is analogous to running a utility program or application program. However, in a textual and legal sense, the linked executable is a combined work, a derivative of the original library, and the ordinary General Public License treats it as such.
+
+Because of this blurred distinction, using the ordinary General Public License for libraries did not effectively promote software sharing, because most developers did not use the libraries. We concluded that weaker conditions might promote sharing better.
+
+However, unrestricted linking of non-free programs would deprive the users of those programs of all benefit from the free status of the libraries themselves. This Library General Public License is intended to permit developers of non-free programs to use free libraries, while preserving your freedom as a user of such programs to change the free libraries that are incorporated in them. (We have not seen how to achieve this as regards changes in header files, but we have achieved it as regards changes in the actual functions of the Library.) The hope is that this will lead to faster development of free libraries.
+
+The precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, while the latter only works together with the library.
+
+Note that it is possible for a library to be covered by the ordinary General Public License rather than by this special one.
+
+TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+0. This License Agreement applies to any software library which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Library General Public License (also called "this License"). Each licensee is addressed as "you".
+
+A "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.
+
+The "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)
+
+"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.
+
+Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.
+
+1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.
+
+You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.
+
+2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:
+
+     a) The modified work must itself be a software library.
+
+     b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.
+
+     c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.
+
+     d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.
+
+(For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.
+
+3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.
+
+Once this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.
+
+This option is useful when you wish to copy part of the code of the Library into a program that is not a library.
+
+4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.
+
+If distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.
+
+5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.
+
+However, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.
+
+When a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.
+
+If such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)
+
+Otherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.
+
+6. As an exception to the Sections above, you may also compile or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.
+
+You must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:
+
+     a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)
+
+     b) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.
+
+     c) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.
+
+     d) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.
+
+For an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.
+
+It may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.
+
+7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:
+
+     a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.
+
+     b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.
+
+8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.
+
+9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.
+
+10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License.
+
+11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.
+
+This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.
+
+12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.
+
+13. The Free Software Foundation may publish revised and/or new versions of the Library General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.
+
+14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.
+
+NO WARRANTY
+
+15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+END OF TERMS AND CONDITIONS
+
+How to Apply These Terms to Your New Libraries
+
+If you develop a new library, and you want it to be of the greatest possible use to the public, we recommend making it free software that everyone can redistribute and change. You can do so by permitting redistribution under these terms (or, alternatively, under the terms of the ordinary General Public License).
+
+To apply these terms, attach the following notices to the library. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found.
+
+     one line to give the library's name and an idea of what it does.
+     Copyright (C) year  name of author
+
+     This library is free software; you can redistribute it and/or modify it under the terms of the GNU Library General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
+
+     This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Library General Public License for more details.
+
+     You should have received a copy of the GNU Library General Public License along with this library; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301, USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the library, if necessary. Here is a sample; alter the names:
+
+Yoyodyne, Inc., hereby disclaims all copyright interest in
+the library `Frob' (a library for tweaking knobs) written
+by James Random Hacker.
+
+signature of Ty Coon, 1 April 1990
+Ty Coon, President of Vice
+
+That's all there is to it!
diff --git a/LICENSES/Linux-syscall-note.txt b/LICENSES/Linux-syscall-note.txt
new file mode 100644
index 0000000..fcd0563
--- /dev/null
+++ b/LICENSES/Linux-syscall-note.txt
@@ -0,0 +1,12 @@
+   NOTE! This copyright does *not* cover user programs that use kernel
+ services by normal system calls - this is merely considered normal use
+ of the kernel, and does *not* fall under the heading of "derived work".
+ Also note that the GPL below is copyrighted by the Free Software
+ Foundation, but the instance of code that it refers to (the Linux
+ kernel) is copyrighted by me and others who actually wrote it.
+
+ Also note that the only valid version of the GPL as far as the kernel
+ is concerned is _this_ particular version of the license (ie v2, not
+ v2.2 or v3.x or whatever), unless explicitly otherwise stated.
+
+			Linus Torvalds
diff --git a/LICENSES/MIT.txt b/LICENSES/MIT.txt
new file mode 100644
index 0000000..2071b23
--- /dev/null
+++ b/LICENSES/MIT.txt
@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) <year> <copyright holders>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/LICENSES/OFL-1.1.txt b/LICENSES/OFL-1.1.txt
new file mode 100644
index 0000000..33f3666
--- /dev/null
+++ b/LICENSES/OFL-1.1.txt
@@ -0,0 +1,97 @@
+Copyright (c) <dates>, <Copyright Holder> (<URL|email>),
+with Reserved Font Name <Reserved Font Name>.
+Copyright (c) <dates>, <additional Copyright Holder> (<URL|email>),
+with Reserved Font Name <additional Reserved Font Name>.
+Copyright (c) <dates>, <additional Copyright Holder> (<URL|email>).
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/LICENSES/README.md b/LICENSES/README.md
new file mode 100644
index 0000000..69ef2d6
--- /dev/null
+++ b/LICENSES/README.md
@@ -0,0 +1,67 @@
+# systemd Project Licensing
+
+## Main License
+
+The systemd project uses single-line references to Unique License Identifiers as
+defined by the Linux Foundation's SPDX project (https://spdx.org/). The line in
+each individual source file identifies the license applicable to that file.
+
+The current set of valid, predefined SPDX identifiers can be found on the SPDX
+License List at https://spdx.org/licenses/.
+
+The 'LICENSES/' directory contains all the licenses used by the sources included in
+the systemd project source tree.
+
+Unless otherwise noted, the systemd project sources are licensed under the terms
+and conditions of the **GNU Lesser General Public License v2.1 or later**.
+
+New sources that cannot be distributed under LGPL-2.1-or-later will no longer
+be accepted for inclusion in the systemd project to maintain license uniformity.
+
+## Other Licenses
+
+The following exceptions apply:
+
+ * some udev sources under src/udev/ are licensed under **GPL-2.0-or-later**, so the
+   udev binaries as a whole are also distributed under **GPL-2.0-or-later**.
+ * the header files contained in src/basic/linux/ and src/shared/linux/ are copied
+   verbatim from the Linux kernel source tree and are licensed under **GPL-2.0 WITH
+   Linux-syscall-note** and are used within the scope of the Linux-syscall-note
+   exception provisions
+ * the src/shared/initreq.h header is licensed under original license,
+   **LGPL-2.0-or-later**.
+ * the src/shared/linux/bpf_insn.h header is copied from the Linux kernel
+   source tree and is licensed under either **BSD-2-Clause** or **GPL-2.0-only**,
+   and thus is included in the systemd build under the BSD-2-Clause license.
+ * The src/basic/linux/wireguard.h header is copied from the Linux kernel
+   source tree and is licensed under either **MIT** or **GPL-2.0 WITH Linux-syscall-note**,
+   and thus is included in the systemd build under the MIT license.
+ * the following sources are licensed under the **MIT** license (in case of our
+   scripts, to facilitate copying and reuse of those helpers to other projects):
+   - hwdb.d/parse_hwdb.py
+   - src/basic/linux/batman_adv.h
+   - src/basic/sparse-endian.h
+   - tools/catalog-report.py
+ * the following sources are licensed under the **CC0-1.0** license:
+   - src/basic/siphash24.c
+   - src/basic/siphash24.h
+   - src/systemctl/systemd-sysv-install.SKELETON
+   - tools/check-includes.pl
+   - all examples under man/
+   - config files and examples under /network
+ * the following sources are under **Public Domain** (LicenseRef-murmurhash2-public-domain):
+   - src/basic/MurmurHash2.c
+   - src/basic/MurmurHash2.h
+ * the following sources are under **Public Domain** (LicenseRef-lookup3-public-domain):
+   - src/libsystemd/sd-journal/lookup3.c
+   - src/libsystemd/sd-journal/lookup3.h
+ * the tools/chromiumos/gen_autosuspend_rules.py script is licensed under the
+   **BSD-3-Clause** license.
+ * Heebo fonts under docs/fonts/ are licensed under the **SIL Open Font License 1.1**,
+ * any files under test/ without an explicit license we assume non-copyrightable
+   (eg: computer-generated fuzzer data)
+
+## OpenSSL Notes
+
+Note that building the systemd project with OpenSSL does not affect the libsystemd.so
+shared library, which is not linked with the OpenSSL library.
diff --git a/LICENSES/lookup3-public-domain.txt b/LICENSES/lookup3-public-domain.txt
new file mode 100644
index 0000000..5eb8cd6
--- /dev/null
+++ b/LICENSES/lookup3-public-domain.txt
@@ -0,0 +1 @@
+lookup3.c, by Bob Jenkins, May 2006, Public Domain.
diff --git a/LICENSES/murmurhash2-public-domain.txt b/LICENSES/murmurhash2-public-domain.txt
new file mode 100644
index 0000000..c9b70e7
--- /dev/null
+++ b/LICENSES/murmurhash2-public-domain.txt
@@ -0,0 +1,2 @@
+MurmurHash2 was written by Austin Appleby, and is placed in the public
+domain. The author hereby disclaims copyright to this source code.
diff --git a/NEWS b/NEWS
index da5e6f8..5fc0033 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,1467 @@
 systemd System and Service Manager
 
+CHANGES WITH 251:
+
+        Backwards-incompatible changes:
+
+        * The minimum kernel version required has been bumped from 3.13 to 4.15,
+          and CLOCK_BOOTTIME is now assumed to always exist.
+
+        * C11 with GNU extensions (aka "gnu11") is now used to build our
+          components. Public API headers are still restricted to ISO C89.
+
+        * In v250, a systemd-networkd feature that automatically configures
+          routes to addresses specified in AllowedIPs= was added and enabled by
+          default. However, this causes network connectivity issues in many
+          existing setups. Hence, it has been disabled by default since
+          systemd-stable 250.3. The feature can still be used by explicitly
+          configuring RouteTable= setting in .netdev files.
+
+        * Jobs started via StartUnitWithFlags() will no longer return 'skipped'
+          when a Condition*= check does not succeed, restoring the JobRemoved
+          signal to the behaviour it had before v250.
+
+        * The org.freedesktop.portable1 methods GetMetadataWithExtensions() and
+          GetImageMetadataWithExtensions() have been fixed to provide an extra
+          return parameter, containing the actual extension release metadata.
+          The current implementation was judged to be broken and unusable, and
+          thus the usual procedure of adding a new set of methods was skipped,
+          and backward compatibility broken instead on the assumption that
+          nobody can be affected given the current state of this interface.
+
+        * All kernels supported by systemd mix RDRAND (or similar) into the
+          entropy pool at early boot. This means that on those systems, even if
+          /dev/urandom is not yet initialized, it still returns bytes that that
+          are at least as high quality as RDRAND. For that reason, we no longer
+          have reason to invoke RDRAND from systemd itself, which has
+          historically been a source of bugs. Furthermore, kernels ≥5.6 provide
+          the getrandom(GRND_INSECURE) interface for returning random bytes
+          before the entropy pool is initialized without warning into kmsg,
+          which is what we attempt to use if available. systemd's direct usage
+          of RDRAND has been removed. x86 systems ≥Broadwell that are running
+          an older kernel may experience kmsg warnings that were not seen with
+          250. For newer kernels, non-x86 systems, or older x86 systems, there
+          should be no visible changes.
+
+        * sd-boot will now measure the kernel command line into TPM PCR 12
+          rather than PCR 8. This improves usefulness of the measurements on
+          systems where sd-boot is chainloaded from Grub. Grub measures all
+          commands its executes into PCR 8, which makes it very hard to use
+          reasonably, hence separate ourselves from that and use PCR 12
+          instead, which is what certain Ubuntu editions already do. To retain
+          compatibility with systems running older systemd systems a new meson
+          option 'efi-tpm-pcr-compat' has been added (which defaults to false).
+          If enabled, the measurement is done twice: into the new-style PCR 12
+          *and* the old-style PCR 8. It's strongly advised to migrate all users
+          to PCR 12 for this purpose in the long run, as we intend to remove
+          this compatibility feature in two year's time.
+
+        * busctl capture now writes output in the newer pcapng format instead
+          of pcap.
+
+        * An udev rule that imported hwdb matches for USB devices with
+          lowercase hexadecimal vendor/product ID digits was added in systemd
+          250. This has been reverted, since uppercase hexadecimal digits are
+          supposed to be used, and we already had a rule that with the
+          appropriate match.
+
+          Users might need to adjust their local hwdb entries.
+
+        * arch_prctl(2) has been moved to the @default set in the syscall filters
+          (as exposed via the SystemCallFilter= setting in service unit files).
+          It is apparently used by the linker now.
+
+        * The tmpfiles entries that create the /run/systemd/netif directory and
+          its subdirectories were moved from tmpfiles.d/systemd.conf to
+          tmpfiles.d/systemd-network.conf.
+
+          Users might need to adjust their files that override tmpfiles.d/systemd.conf
+          to account for this change.
+
+        * The requirement for Portable Services images to contain a well-formed
+          os-release file (i.e.: contain at least an ID field) is now enforced.
+          This applies to base images and extensions, and also to systemd-sysext.
+
+        Changes in the Boot Loader Specification, kernel-install and sd-boot:
+
+        * kernel-install's and bootctl's Boot Loader Specification Type #1
+          entry generation logic has been reworked. The user may now pick
+          explicitly by which "token" string to name the installation's boot
+          entries, via the new /etc/kernel/entry-token file or the new
+          --entry-token= switch to bootctl. By default — as before — the
+          entries are named after the local machine ID. However, in "golden
+          image" environments, where the machine ID shall be initialized on
+          first boot (as opposed to at installation time before first boot) the
+          machine ID will not be available at build time. In this case the
+          --entry-token= switch to bootctl (or the /etc/kernel/entry-token
+          file) may be used to override the "token" for the entries, for
+          example the IMAGE_ID= or ID= fields from /etc/os-release. This will
+          make the OS images independent of any machine ID, and ensure that the
+          images will not carry any identifiable information before first boot,
+          but on the other hand means that multiple parallel installations of
+          the very same image on the same disk cannot be supported.
+
+          Summary: if you are building golden images that shall acquire
+          identity information exclusively on first boot, make sure to both
+          remove /etc/machine-id *and* to write /etc/kernel/entry-token to the
+          value of the IMAGE_ID= or ID= field of /etc/os-release or another
+          suitable identifier before deploying the image.
+
+        * The Boot Loader Specification has been extended with
+          /loader/entries.srel file located in the EFI System Partition (ESP)
+          that disambiguates the format of the entries in the /loader/entries/
+          directory (in order to discern them from incompatible uses of this
+          directory by other projects). For entries that follow the
+          Specification, the string "type1" is stored in this file.
+
+          bootctl will now write this file automatically when installing the
+          systemd-boot boot loader.
+
+        * kernel-install supports a new initrd_generator= setting in
+          /etc/kernel/install.conf, that is exported as
+          $KERNEL_INSTALL_INITRD_GENERATOR to kernel-install plugins. This
+          allows choosing different initrd generators.
+
+        * kernel-install will now create a "staging area" (an initially-empty
+          directory to gather files for a Boot Loader Specification Type #1
+          entry). The path to this directory is exported as
+          $KERNEL_INSTALL_STAGING_AREA to kernel-install plugins, which should
+          drop files there instead of writing them directly to the final
+          location. kernel-install will move them when all files have been
+          prepared successfully.
+
+        * New option sort-key= has been added to the Boot Loader Specification
+          to override the sorting order of the entries in the boot menu. It is
+          read by sd-boot and bootctl, and will be written by kernel-install,
+          with the default value of IMAGE_ID= or ID= fields from
+          os-release. Together, this means that on multiboot installations,
+          entries should be grouped and sorted in a predictable way.
+
+        * The sort order of boot entries has been updated: entries which have
+          the new field sort-key= are sorted by it first, and all entries
+          without it are ordered later. After that, entries are sorted by
+          version so that newest entries are towards the beginning of the list.
+
+        * The kernel-install tool gained a new 'inspect' verb which shows the
+          paths and other settings used.
+
+        * sd-boot can now optionally beep when the menu is shown and menu
+          entries are selected, which can be useful on machines without a
+          working display. (Controllable via a loader.conf setting.)
+
+        * The --make-machine-id-directory= switch to bootctl has been replaced
+          by --make-entry-directory=, given that the entry directory is not
+          necessarily named after the machine ID, but after some other suitable
+          ID as selected via --entry-token= described above. The old name of
+          the option is still understood to maximize compatibility.
+
+        * 'bootctl list' gained support for a new --json= switch to output boot
+          menu entries in JSON format.
+
+        * 'bootctl is-installed' now supports the --graceful, and various verbs
+          omit output with the new option --quiet.
+
+        Changes in systemd-homed:
+
+        * Starting with v250 systemd-homed uses UID/GID mapping on the mounts
+          of activated home directories it manages (if the kernel and selected
+          file systems support it). So far it mapped three UID ranges: the
+          range from 0…60000, the user's own UID, and the range 60514…65534,
+          leaving everything else unmapped (in other words, the 16bit UID range
+          is mapped almost fully, with the exception of the UID subrange used
+          for systemd-homed users, with one exception: the user's own UID).
+          Unmapped UIDs may not be used for file ownership in the home
+          directory — any chown() attempts with them will fail. With this
+          release a fourth range is added to these mappings:
+          524288…1879048191. This range is the UID range intended for container
+          uses, see:
+
+                  https://systemd.io/UIDS-GIDS
+
+          This range may be used for container managers that place container OS
+          trees in the home directory (which is a questionable approach, for
+          quota, permission, SUID handling and network file system
+          compatibility reasons, but nonetheless apparently commonplace). Note
+          that this mapping is mapped 1:1 in a pass-through fashion, i.e. the
+          UID assignments from the range are not managed or mapped by
+          `systemd-homed`, and must be managed with other mechanisms, in the
+          context of the local system.
+
+          Typically, a better approach to user namespacing in relevant
+          container managers would be to leave container OS trees on disk at
+          UID offset 0, but then map them to a dynamically allocated runtime
+          UID range via another UID mount map at container invocation
+          time. That way user namespace UID ranges become strictly a runtime
+          concept, and do not leak into persistent file systems, persistent
+          user databases or persistent configuration, thus greatly simplifying
+          handling, and improving compatibility with home directories intended
+          to be portable like the ones managed by systemd-homed.
+
+        Changes in shared libraries:
+
+        * A new libsystemd-core-<version>.so private shared library is
+          installed under /usr/lib/systemd/system, mirroring the existing
+          libsystemd-shared-<version>.so library. This allows the total
+          installation size to be reduced by binary code reuse.
+
+        * The <version> tag used in the name of libsystemd-shared.so and
+          libsystemd-core.so can be configured via the meson option
+          'shared-lib-tag'. Distributions may build subsequent versions of the
+          systemd package with unique tags (e.g. the full package version),
+          thus allowing multiple installations of those shared libraries to be
+          available at the same time. This is intended to fix an issue where
+          programs that link to those libraries would fail to execute because
+          they were installed earlier or later than the appropriate version of
+          the library.
+
+        * The sd-id128 API gained a new call sd_id128_to_uuid_string() that is
+          similar to sd_id128_to_string() but formats the ID in RFC 4122 UUID
+          format instead of simple series of hex characters.
+
+        * The sd-device API gained two new calls sd_device_new_from_devname()
+          and sd_device_new_from_path() which permit allocating an sd_device
+          object from a device node name or file system path.
+
+        * sd-device also gained a new call sd_device_open() which will open the
+          device node associated with a device for which an sd_device object
+          has been allocated. The call is supposed to address races around
+          device nodes being removed/recycled due to hotplug events, or media
+          change events: the call checks internally whether the major/minor of
+          the device node and the "diskseq" (in case of block devices) match
+          with the metadata loaded in the sd_device object, thus ensuring that
+          the device once opened really matches the provided sd_device object.
+
+        Changes in PID1, systemctl, and systemd-oomd:
+
+        * A new set of service monitor environment variables will be passed to
+          OnFailure=/OnSuccess= handlers, but only if exactly one unit lists the
+          handler unit as OnFailure=/OnSuccess=. The variables are:
+          $MONITOR_SERVICE_RESULT, $MONITOR_EXIT_CODE, $MONITOR_EXIT_STATUS,
+          $MONITOR_INVOCATION_ID and $MONITOR_UNIT. For cases when a single
+          handler needs to watch multiple units, use a templated handler.
+
+        * A new ExtensionDirectories= setting in service unit files allows
+          system extensions to be loaded from a directory. (It is similar to
+          ExtensionImages=, but takes paths to directories, instead of
+          disk image files.)
+
+          'portablectl attach --extension=' now also accepts directory paths.
+
+        * The user.delegate and user.invocation_id extended attributes on
+          cgroups are used in addition to trusted.delegate and
+          trusted.invocation_id. The latter pair requires privileges to set,
+          but the former doesn't and can be also set by the unprivileged user
+          manager.
+
+          (Only supported on kernels ≥5.6.)
+
+        * Units that were killed by systemd-oomd will now have a service result
+          of 'oom-kill'. The number of times a service was killed is tallied
+          in the 'user.oomd_ooms' extended attribute.
+
+          The OOMPolicy= unit file setting is now also honoured by
+          systemd-oomd.
+
+        * In unit files the new %y/%Y specifiers can be used to refer to
+          normalized unit file path, which is particularly useful for symlinked
+          unit files.
+
+          The new %q specifier resolves to the pretty hostname
+          (i.e. PRETTY_HOSTNAME= from /etc/machine-info).
+
+          The new %d specifier resolves to the credentials directory of a
+          service (same as $CREDENTIALS_DIRECTORY).
+
+        * The RootDirectory=, MountAPIVFS=, ExtensionDirectories=,
+          *Capabilities*=, ProtectHome=, *Directory=, TemporaryFileSystem=,
+          PrivateTmp=, PrivateDevices=, PrivateNetwork=, NetworkNamespacePath=,
+          PrivateIPC=, IPCNamespacePath=, PrivateUsers=, ProtectClock=,
+          ProtectKernelTunables=, ProtectKernelModules=, ProtectKernelLogs=,
+          MountFlags= service settings now also work in unprivileged user
+          services, i.e. those run by the user's --user service manager, as long
+          as user namespaces are enabled on the system.
+
+        * Services with Restart=always and a failing ExecCondition= will no
+          longer be restarted, to bring ExecCondition= behaviour in line with
+          Condition*= settings.
+
+        * LoadCredential= now accepts a directory as the argument; all files
+          from the directory will be loaded as credentials.
+
+        * A new D-Bus property ControlGroupId is now exposed on service units,
+          that encapsulates the service's numeric cgroup ID that newer kernels
+          assign to each cgroup.
+
+        * PID 1 gained support for configuring the "pre-timeout" of watchdog
+          devices and the associated governor, via the new
+          RuntimeWatchdogPreSec= and RuntimeWatchdogPreGovernor= configuration
+          options in /etc/systemd/system.conf.
+
+        * systemctl's --timestamp= option gained a new choice "unix", to show
+          timestamp as unix times, i.e. seconds since 1970, Jan 1st.
+
+        * A new "taint" flag named "old-kernel" is introduced which is set when
+          the kernel systemd runs on is older then the current baseline version
+          (see above). The flag is shown in "systemctl status" output.
+
+        * Two additional taint flags "short-uid-range" and "short-gid-range"
+          have been added as well, which are set when systemd notices it is run
+          within a userns namespace that does not define the full 0…65535 UID
+          range
+
+        * A new "unmerged-usr" taint flag has been added that is set whenever
+          running on systems where /bin/ + /sbin/ are *not* symlinks to their
+          counterparts in /usr/, i.e. on systems where the /usr/-merge has been
+          completed.
+
+        * Generators invoked by PID 1 will now have a couple of useful
+          environment variables set describing the execution context a
+          bit. $SYSTEMD_SCOPE encodes whether the generator is called from the
+          system service manager, or from the per-user service
+          manager. $SYSTEMD_IN_INITRD encodes whether the generator is invoked
+          in initrd context or on the host. $SYSTEMD_FIRST_BOOT encodes whether
+          systemd considers the current boot to be a "first"
+          boot. $SYSTEMD_VIRTUALIZATION encode whether virtualization is
+          detected and which type of hypervisor/container
+          manager. $SYSTEMD_ARCHITECTURE indicates which architecture the
+          kernel is built for.
+
+        * PID 1 will now automatically pick up system credentials from qemu's
+          fw_cfg interface, thus allowing passing arbitrary data into VM
+          systems similar to how this is already supported for passing them
+          into `systemd-nspawn` containers. Credentials may now also be passed
+          in via the new kernel command line option `systemd.set_credential=`
+          (note that kernel command line options are world-readable during
+          runtime, and only useful for credentials that require no
+          confidentiality). The credentials that can be passed to unified
+          kernels that use the `systemd-stub` UEFI stub are now similarly
+          picked up automatically. Automatic importing of system credentials
+          this way can be turned off via the new
+          `systemd.import_credentials=no` kernel command line option.
+
+        * LoadCredential= will now automatically look for credentials in the
+          /etc/credstore/, /run/credstore/, /usr/lib/credstore/ directories if
+          the argument is not an absolute path. Similarly,
+          LoadCredentialEncrypted= will check the same directories plus
+          /etc/credstore.encrypted/, /run/credstore.encrypted/ and
+          /usr/lib/credstore.encrypted/. The idea is to use those directories
+          as the system-wide location for credentials that services should pick
+          up automatically.
+
+        * System and service credentials are described in great detail in a new
+          document:
+
+          https://systemd.io/CREDENTIALS
+
+        Changes in systemd-journald:
+
+        * The journal JSON export format has been added to listed of stable
+          interfaces (https://systemd.io/PORTABILITY_AND_STABILITY/).
+
+        * journalctl --list-boots now supports JSON output and the --reverse option.
+
+        * Under docs/: JOURNAL_EXPORT_FORMATS was imported from the wiki and
+          updated, BUILDING_IMAGES is new:
+
+          https://systemd.io/JOURNAL_EXPORT_FORMATS
+          https://systemd.io/BUILDING_IMAGES
+
+        Changes in udev:
+
+        * Two new hwdb files have been added. One lists "handhelds" (PDAs,
+          calculators, etc.), the other AV production devices (DJ tables,
+          keypads, etc.) that should accessible to the seat owner user by
+          default.
+
+        * udevadm trigger gained a new --prioritized-subsystem= option to
+          process certain subsystems (and all their parent devices) earlier.
+
+          systemd-udev-trigger.service now uses this new option to trigger
+          block and TPM devices first, hopefully making the boot a bit faster.
+
+        * udevadm trigger now implements --type=all, --initialized-match,
+          --initialized-nomatch to trigger both subsystems and devices, only
+          already-initialized devices, and only devices which haven't been
+          initialized yet, respectively.
+
+        * udevadm gained a new "wait" command for safely waiting for a specific
+          device to show up in the udev device database. This is useful in
+          scripts that asynchronously allocate a block device (e.g. through
+          repartitioning, or allocating a loopback device or similar) and need
+          to synchronize on the creation to complete.
+
+        * udevadm gained a new "lock" command for locking one or more block
+          devices while formatting it or writing a partition table to it. It is
+          an implementation of https://systemd.io/BLOCK_DEVICE_LOCKING and
+          usable in scripts dealing with block devices.
+
+        * udevadm info will show a couple of additional device fields in its
+          output, and will not apply a limited set of coloring to line types.
+
+        * udevadm info --tree will now show a tree of objects (i.e. devices and
+          suchlike) in the /sys/ hierarchy.
+
+        * Block devices will now get a new set of device symlinks in
+          /dev/disk/by-diskseq/<nr>, which may be used to reference block
+          device nodes via the kernel's "diskseq" value. Note that this does
+          not guarantee that opening a device by a symlink like this will
+          guarantee that the opened device actually matches the specified
+          diskseq value. To be safe against races, the actual diskseq value of
+          the opened device (BLKGETDISKSEQ ioctl()) must still be compred with
+          the one in the symlink path.
+
+        * .link files gained support for setting MDI/MID-X on a link.
+
+        * .link files gained support for [Match] Firmware= setting to match on
+          the device firmware description string. By mistake, it was previously
+          only supported in .network files.
+
+        * .link files gained support for [Link] SR-IOVVirtualFunctions= setting
+          and [SR-IOV] section to configure SR-IOV virtual functions.
+
+        Changes in systemd-networkd:
+
+        * The default scope for unicast routes configured through [Route]
+          section is changed to "link", to make the behavior consistent with
+          "ip route" command. The manual configuration of [Route] Scope= is
+          still honored.
+
+        * A new unit systemd-networkd-wait-online@<interface>.service has been
+          added that can be used to wait for a specific network interface to be
+          up.
+
+        * systemd-networkd gained a new [Bridge] Isolated=true|false setting
+          that configures the eponymous kernel attribute on the bridge.
+
+        * .netdev files now can be used to create virtual WLAN devices, and
+          configure various settings on them, via the [WLAN] section.
+
+        * .link/.network files gained support for [Match] Kind= setting to match
+          on device kind ("bond", "bridge", "gre", "tun", "veth", etc.)
+
+          This value is also shown by 'networkctl status'.
+
+        * The Local= setting in .netdev files for various virtual network
+          devices gained support for specifying, in addition to the network
+          address, the name of a local interface which must have the specified
+          address.
+
+        * systemd-networkd gained a new [Tunnel] External= setting in .netdev
+          files, to configure tunnels in external mode (a.k.a. collect metadata
+          mode).
+
+        * [Network] L2TP= setting was removed. Please use interface specifier in
+          Local= setting in .netdev files of corresponding L2TP interface.
+
+        * New [DHCPServer] BootServerName=, BootServerAddress=, and
+          BootFilename= settings can be used to configure the server address,
+          server name, and file name sent in the DHCP packet (e.g. to configure
+          PXE boot).
+
+        Changes in systemd-resolved:
+
+        * systemd-resolved is started earlier (in sysinit.target), so it
+          available earlier and will also be started in the initrd if installed
+          there.
+
+        Changes in disk encryption:
+
+        * systemd-cryptenroll can now control whether to require the user to
+          enter a PIN when using TPM-based unlocking of a volume via the new
+          --tpm2-with-pin= option.
+
+          Option tpm2-pin= can be used in /etc/crypttab.
+
+        * When unlocking devices via TPM, TPM2 parameter encryption is now
+          used, to ensure that communication between CPU and discrete TPM chips
+          cannot be eavesdropped to acquire disk encryption keys.
+
+        * A new switch --fido2-credential-algorithm= has been added to
+          systemd-cryptenroll allowing selection of the credential algorithm to
+          use when binding encryption to FIDO2 tokens.
+
+        Changes in systemd-hostnamed:
+
+        * HARDWARE_VENDOR= and HARDWARE_MODEL= can be set in /etc/machine-info
+          to override the values gleaned from the hwdb.
+
+        * A ID_CHASSIS property can be set in the hwdb (for the DMI device
+          /sys/class/dmi/id) to override the chassis that is reported by
+          hostnamed.
+
+        * hostnamed's D-Bus interface gained a new method GetHardwareSerial()
+          for reading the hardware serial number, as reportd by DMI. It also
+          exposes a new method D-Bus property FirmwareVersion that encode the
+          firmware version of the system.
+
+        Changes in other components:
+
+        * /etc/locale.conf is now populated through tmpfiles.d factory /etc/
+          handling with the values that were configured during systemd build
+          (if /etc/locale.conf has not been created through some other
+          mechanism). This means that /etc/locale.conf should always have
+          reasonable contents and we avoid a potential mismatch in defaults.
+
+        * The userdbctl tool will now show UID range information as part of the
+          list of known users.
+
+        * A new build-time configuration setting default-user-shell= can be
+          used to set the default shell for user records and nspawn shell
+          invocations (instead of of the default /bin/bash).
+
+        * systemd-timesyncd now provides a D-Bus API for receiving NTP server
+          information dynamically at runtime via IPC.
+
+        * The systemd-creds tool gained a new "has-tpm2" verb, which reports
+          whether a functioning TPM2 infrastructure is available, i.e. if
+          firmware, kernel driver and systemd all have TPM2 support enabled and
+          a device found.
+
+        * The systemd-creds tool gained support for generating encrypted
+          credentials that are using an empty encryption key. While this
+          provides no integrity nor confidentiality it's useful to implement
+          codeflows that work the same on TPM-ful and TPM2-less systems. The
+          service manager will only accept credentials "encrypted" that way if
+          a TPM2 device cannot be detected, to ensure that credentials
+          "encrypted" like that cannot be used to trick TPM2 systems.
+
+        * When deciding whether to colorize output, all systemd programs now
+          also check $COLORTERM (in addition to $NO_COLOR, $SYSTEMD_COLORS, and
+          $TERM).
+
+        * Meson's new install_tag feature is now in use for several components,
+          allowing to build and install select binaries only: pam, nss, devel
+          (pkg-config files), systemd-boot, libsystemd, libudev. Example:
+           $ meson build systemd-boot
+           $ meson install --tags systemd-boot --no-rebuild
+          https://mesonbuild.com/Installing.html#installation-tags
+
+        * A new build configuration option has been added, to allow selecting the
+          default compression algorithm used by systemd-journald and systemd-coredump.
+          This allows to build-in support for decompressing all supported formats,
+          but choose a specific one for compression. E.g.:
+           $ meson -Ddefault-compression=xz
+
+        Experimental features:
+
+        * sd-boot gained a new *experimental* setting "reboot-for-bitlocker" in
+          loader.conf that implements booting Microsoft Windows from the
+          sd-boot in a way that first reboots the system, to reset the TPM
+          PCRs. This improves compatibility with BitLocker's TPM use, as the
+          PCRs will only record the Windows boot process, and not sd-boot
+          itself, thus retaining the PCR measurements not involving sd-boot.
+          Note that this feature is experimental for now, and is likely going
+          to be generalized and renamed in a future release, without retaining
+          compatibility with the current implementation.
+
+        * A new systemd-sysupdate component has been added that automatically
+          discovers, downloads, and installs A/B-style updates for the host
+          installation itself, or container images, portable service images,
+          and other assets. See the new systemd-sysupdate man page for updates.
+
+        Contributions from: 4piu, Adam Williamson, adrian5, Albert Brox,
+        AlexCatze, Alex Henrie, Alfonso Sánchez-Beato, Alice S,
+        Alvin Šipraga, amarjargal, Amarjargal, Andrea Pappacoda,
+        Andreas Rammhold, Andy Chi, Anita Zhang, Antonio Alvarez Feijoo,
+        Arfrever Frehtes Taifersar Arahesis, ash, Bastien Nocera, Be,
+        bearhoney, Ben Efros, Benjamin Berg, Benjamin Franzke,
+        Brett Holman, Christian Brauner, Clyde Byrd III, Curtis Klein,
+        Daan De Meyer, Daniele Medri, Daniel Mack, Danilo Krummrich,
+        David, David Bond, Davide Cavalca, David Tardon, davijosw,
+        dependabot[bot], Donald Chan, Dorian Clay, Eduard Tolosa,
+        Elias Probst, Eli Schwartz, Erik Sjölund, Evgeny Vereshchagin,
+        Federico Ceratto, Franck Bui, Frantisek Sumsal, Gaël PORTAY,
+        Georges Basile Stavracas Neto, Gibeom Gwon, Goffredo Baroncelli,
+        Grigori Goronzy, Hans de Goede, Heiko Becker, Hugo Carvalho,
+        Jakob Lell, James Hilliard, Jan Janssen, Jason A. Donenfeld,
+        Joan Bruguera, Joerie de Gram, Josh Triplett, Julia Kartseva,
+        Kazuo Moriwaka, Khem Raj, ksa678491784, Lance, Lan Tian,
+        Laura Barcziova, Lennart Poettering, Leviticoh, licunlong,
+        Lidong Zhong, lincoln auster, Lubomir Rintel, Luca Boccassi,
+        Luca BRUNO, lucagoc, Ludwig Nussel, Marcel Hellwig, march1993,
+        Marco Scardovi, Mario Limonciello, Mariusz Tkaczyk,
+        Markus Weippert, Martin, Martin Liska, Martin Wilck, Matija Skala,
+        Matthew Blythe, Matthias Lisin, Matthijs van Duin, Matt Walton,
+        Max Gautier, Michael Biebl, Michael Olbrich, Michal Koutný,
+        Michal Sekletár, Mike Gilbert, MkfsSion, Morten Linderud,
+        Nick Rosbrook, Nikolai Grigoriev, Nikolai Kostrigin,
+        Nishal Kulkarni, Noel Kuntze, Pablo Ceballos, Peter Hutterer,
+        Peter Morrow, Pigmy-penguin, Piotr Drąg, prumian, Richard Neill,
+        Rike-Benjamin Schuppner, rodin-ia, Romain Naour, Ruben Kerkhof,
+        Ryan Hendrickson, Santa Wiryaman, Sebastian Pucilowski, Seth Falco,
+        Simon Ellmann, Sonali Srivastava, Stefan Seering,
+        Stephen Hemminger, tawefogo, techtino, Temuri Doghonadze,
+        Thomas Batten, Thomas Haller, Thomas Weißschuh, Tobias Stoeckmann,
+        Tomasz Pala, Tyson Whitehead, Vishal Chillara Srinivas,
+        Vivien Didelot, w30023233, wangyuhang, Weblate, Xiaotian Wu,
+        yangmingtai, YmrDtnJu, Yonathan Randolph, Yutsuten, Yu Watanabe,
+        Zbigniew Jędrzejewski-Szmek, наб
+
+        — Edinburgh, 2022-05-21
+
+CHANGES WITH 250:
+
+        * Support for encrypted and authenticated credentials has been added.
+          This extends the credential logic introduced with v247 to support
+          non-interactive symmetric encryption and authentication, based on a
+          key that is stored on the /var/ file system or in the TPM2 chip (if
+          available), or the combination of both (by default if a TPM2 chip
+          exists the combination is used, otherwise the /var/ key only). The
+          credentials are automatically decrypted at the moment a service is
+          started, and are made accessible to the service itself in unencrypted
+          form. A new tool 'systemd-creds' encrypts credentials for this
+          purpose, and two new service file settings LoadCredentialEncrypted=
+          and SetCredentialEncrypted= configure such credentials.
+
+          This feature is useful to store sensitive material such as SSL
+          certificates, passwords and similar securely at rest and only decrypt
+          them when needed, and in a way that is tied to the local OS
+          installation or hardware.
+
+        * systemd-gpt-auto-generator can now automatically set up discoverable
+          LUKS2 encrypted swap partitions.
+
+        * The GPT Discoverable Partitions Specification has been substantially
+          extended with support for root and /usr/ partitions for the majority
+          of architectures systemd supports. This includes platforms that do
+          not natively support UEFI, because even though GPT is specified under
+          UEFI umbrella, it is useful on other systems too. Specifically,
+          systemd-nspawn, systemd-sysext, systemd-gpt-auto-generator and
+          Portable Services use the concept without requiring UEFI.
+
+        * The GPT Discoverable Partitions Specifications has been extended with
+          a new set of partitions that may carry PKCS#7 signatures for Verity
+          partitions, encoded in a simple JSON format. This implements a simple
+          mechanism for building disk images that are fully authenticated and
+          can be tested against a set of cryptographic certificates. This is
+          now implemented for the various systemd tools that can operate with
+          disk images, such as systemd-nspawn, systemd-sysext, systemd-dissect,
+          Portable services/RootImage=, systemd-tmpfiles, and systemd-sysusers.
+          The PKCS#7 signatures are passed to the kernel (where they are
+          checked against certificates from the kernel keyring), or can be
+          verified against certificates provided in userspace (via a simple
+          drop-in file mechanism).
+
+        * systemd-dissect's inspection logic will now report for which uses a
+          disk image is intended. Specifically, it will display whether an
+          image is suitable for booting on UEFI or in a container (using
+          systemd-nspawn's --image= switch), whether it can be used as portable
+          service, or attached as system extension.
+
+        * The system-extension.d/ drop-in files now support a new field
+          SYSEXT_SCOPE= that may encode which purpose a system extension image
+          is for: one of "initrd", "system" or "portable". This is useful to
+          make images more self-descriptive, and to ensure system extensions
+          cannot be attached in the wrong contexts.
+
+        * The os-release file learnt a new PORTABLE_PREFIXES= field which may
+          be used in portable service images to indicate which unit prefixes
+          are supported.
+
+        * The GPT image dissection logic in systemd-nspawn/systemd-dissect/…
+          now is able to decode images for non-native architectures as well.
+          This allows systemd-nspawn to boot images of non-native architectures
+          if the corresponding user mode emulator is installed and
+          systemd-binfmtd is running.
+
+        * systemd-logind gained new settings HandlePowerKeyLongPress=,
+          HandleRebootKeyLongPress=, HandleSuspendKeyLongPress= and
+          HandleHibernateKeyLongPress= which may be used to configure actions
+          when the relevant keys are pressed for more than 5s. This is useful
+          on devices that only have hardware for a subset of these keys. By
+          default, if the reboot key is pressed long the poweroff operation is
+          now triggered, and when the suspend key is pressed long the hibernate
+          operation is triggered. Long pressing the other two keys currently
+          does not trigger any operation by default.
+
+        * When showing unit status updates on the console during boot and
+          shutdown, and a service is slow to start so that the cylon animation
+          is shown, the most recent sd_notify() STATUS= text is now shown as
+          well. Services may use this to make the boot/shutdown output easier
+          to understand, and to indicate what precisely a service that is slow
+          to start or stop is waiting for. In particular, the per-user service
+          manager instance now reports what it is doing and which service it is
+          waiting for this way to the system service manager.
+
+        * The service manager will now re-execute on reception of the
+          SIGRTMIN+25 signal. It previously already did that on SIGTERM — but
+          only when running as PID 1. There was no signal to request this when
+          running as per-user service manager, i.e. as any other PID than 1.
+          SIGRTMIN+25 works for both system and user managers.
+
+        * The hardware watchdog logic in PID 1 gained support for operating
+          with the default timeout configured in the hardware, instead of
+          insisting on re-configuring it. Set RuntimeWatchdogSec=default to
+          request this behavior.
+
+        * A new kernel command line option systemd.watchdog_sec= is now
+          understood which may be used to override the hardware watchdog
+          time-out for the boot.
+
+        * A new setting DefaultOOMScoreAdjust= is now supported in
+          /etc/systemd/system.conf and /etc/systemd/user.conf. It may be used
+          to set the default process OOM score adjustment value for processes
+          started by the service manager. For per-user service managers this
+          now defaults to 100, but for per-system service managers is left as
+          is. This means that by default now services forked off the user
+          service manager are more likely to be killed by the OOM killer than
+          system services or the managers themselves.
+
+        * A new per-service setting RestrictFileSystems= as been added that
+          restricts the file systems a service has access to by their type.
+          This is based on the new BPF LSM of the Linux kernel. It provides an
+          effective way to make certain API file systems unavailable to
+          services (and thus minimizing attack surface). A new command
+          "systemd-analyze filesystems" has been added that lists all known
+          file system types (and how they are grouped together under useful
+          group handles).
+
+        * Services now support a new setting RestrictNetworkInterfaces= for
+          restricting access to specific network interfaces.
+
+        * Service unit files gained new settings StartupAllowedCPUs= and
+          StartupAllowedMemoryNodes=. These are similar to their counterparts
+          without the "Startup" prefix and apply during the boot process
+          only. This is useful to improve boot-time behavior of the system and
+          assign resources differently during boot than during regular
+          runtime. This is similar to the preexisting StartupCPUWeight=
+          vs. CPUWeight.
+
+        * Related to this: the various StartupXYZ= settings
+          (i.e. StartupCPUWeight=, StartupAllowedCPUs=, …) are now also applied
+          during shutdown. The settings not prefixed with "Startup" hence apply
+          during regular runtime, and those that are prefixed like that apply
+          during boot and shutdown.
+
+        * A new per-unit set of conditions/asserts
+          [Condition|Assert][Memory|CPU|IO]Pressure= have been added to make a
+          unit skip/fail activation if the system's (or a slice's) memory/cpu/io
+          pressure is above the configured threshold, using the kernel PSI
+          feature. For more details see systemd.unit(5) and
+          https://www.kernel.org/doc/html/latest/accounting/psi.html
+
+        * The combination of ProcSubset=pid and ProtectKernelTunables=yes and/or
+          ProtectKernelLogs=yes can now be used.
+
+        * The default maximum numbers of inodes have been raised from 64k to 1M
+          for /dev/, and from 400k to 1M for /tmp/.
+
+        * The per-user service manager learnt support for communicating with
+          systemd-oomd to acquire OOM kill information.
+
+        * A new service setting ExecSearchPath= has been added that allows
+          changing the search path for executables for services. It affects
+          where we look for the binaries specified in ExecStart= and similar,
+          and the specified directories are also added the $PATH environment
+          variable passed to invoked processes.
+
+        * A new setting RuntimeRandomizedExtraSec= has been added for service
+          and scope units that allows extending the runtime time-out as
+          configured by RuntimeMaxSec= with a randomized amount.
+
+        * The syntax of the service unit settings RuntimeDirectory=,
+          StateDirectory=, CacheDirectory=, LogsDirectory= has been extended:
+          if the specified value is now suffixed with a colon, followed by
+          another filename, the latter will be created as symbolic link to the
+          specified directory. This allows creating these service directories
+          together with alias symlinks to make them available under multiple
+          names.
+
+        * Service unit files gained two new settings TTYRows=/TTYColumns= for
+          configuring rows/columns of the TTY device passed to
+          stdin/stdout/stderr of the service. This is useful to propagate TTY
+          dimensions to a virtual machine.
+
+        * A new service unit file setting ExitType= has been added that
+          specifies when to assume a service has exited. By default systemd
+          only watches the main process of a service. By setting
+          ExitType=cgroup it can be told to wait for the last process in a
+          cgroup instead.
+
+        * Automount unit files gained a new setting ExtraOptions= that can be
+          used to configure additional mount options to pass to the kernel when
+          mounting the autofs instance.
+
+        * "Urlification" (generation of ESC sequences that generate clickable
+          hyperlinks in modern terminals) may now be turned off altogether
+          during build-time.
+
+        * Path units gained new TriggerLimitBurst= and TriggerLimitIntervalSec=
+          settings that default to 200 and 2 s respectively. The ratelimit
+          ensures that a path unit cannot cause PID1 to busy-loop when it is
+          trying to trigger a service that is skipped because of a Condition*=
+          not being satisfied. This matches the configuration and behaviour of
+          socket units.
+
+        * The TPM2/FIDO2/PKCS11 support in systemd-cryptsetup is now also built
+          as a plug-in for cryptsetup. This means the plain cryptsetup command
+          may now be used to unlock volumes set up this way.
+
+        * The TPM2 logic in cryptsetup will now automatically detect systems
+          where the TPM2 chip advertises SHA256 PCR banks but the firmware only
+          updates the SHA1 banks. In such a case PCR policies will be
+          automatically bound to the latter, not the former. This makes the PCR
+          policies reliable, but of course do not provide the same level of
+          trust as SHA256 banks.
+
+        * The TPM2 logic in systemd-cryptsetup/systemd-cryptsetup now supports
+          RSA primary keys in addition to ECC, improving compatibility with
+          TPM2 chips that do not support ECC. RSA keys are much slower to use
+          than ECC, and hence are only used if ECC is not available.
+
+        * /etc/crypttab gained support for a new token-timeout= setting for
+          encrypted volumes that allows configuration of the maximum time to
+          wait for PKCS#11/FIDO2 tokens to be plugged in. If the time elapses
+          the logic will query the user for a regular passphrase/recovery key
+          instead.
+
+        * Support for activating dm-integrity volumes at boot via a new file
+          /etc/integritytab and the tool systemd-integritysetup have been
+          added. This is similar to /etc/crypttab and /etc/veritytab, but deals
+          with dm-integrity instead of dm-crypt/dm-verity.
+
+        * The systemd-veritysetup-generator now understands a new usrhash=
+          kernel command line option for specifying the Verity root hash for
+          the partition backing the /usr/ file system. A matching set of
+          systemd.verity_usr_* kernel command line options has been added as
+          well. These all work similar to the corresponding options for the
+          root partition.
+
+        * The sd-device API gained a new API call sd_device_get_diskseq() to
+          return the DISKSEQ property of a device structure. The "disk
+          sequence" concept is a new feature recently introduced to the Linux
+          kernel that allows detecting reuse cycles of block devices, i.e. can
+          be used to recognize when loopback block devices are reused for a
+          different purpose or CD-ROM drives get their media changed.
+
+        * A new unit systemd-boot-update.service has been added. If enabled
+          (the default) and the sd-boot loader is detected to be installed, it
+          is automatically updated to the newest version when out of date. This
+          is useful to ensure the boot loader remains up-to-date, and updates
+          automatically propagate from the OS tree in /usr/.
+
+        * sd-boot will now build with SBAT by default in order to facilitate
+          working with recent versions of Shim that require it to be present.
+
+        * sd-boot can now parse Microsoft Windows' Boot Configuration Data.
+          This is used to robustly generate boot entry titles for Windows.
+
+        * A new generic target unit factory-reset.target has been added. It is
+          hooked into systemd-logind similar in fashion to
+          reboot/poweroff/suspend/hibernate, and is supposed to be used to
+          initiate a factory reset operation. What precisely this operation
+          entails is up for the implementer to decide, the primary goal of the
+          new unit is provide a framework where to plug in the implementation
+          and how to trigger it.
+
+        * A new meson build-time option 'clock-valid-range-usec-max' has been
+          added which takes a time in µs and defaults to 15 years. If the RTC
+          time is noticed to be more than the specified time ahead of the
+          built-in epoch of systemd (which by default is the release timestamp
+          of systemd) it is assumed that the RTC is not working correctly, and
+          the RTC is reset to the epoch. (It already is reset to the epoch when
+          noticed to be before it.) This should increase the chance that time
+          doesn't accidentally jump too far ahead due to faulty hardware or
+          batteries.
+
+        * A new setting SaveIntervalSec= has been added to systemd-timesyncd,
+          which may be used to automatically save the current system time to
+          disk in regular intervals. This is useful to maintain a roughly
+          monotonic clock even without RTC hardware and with some robustness
+          against abnormal system shutdown.
+
+        * systemd-analyze verify gained support for a pair of new --image= +
+          --root= switches for verifying units below a specific root
+          directory/image instead of on the host.
+
+        * systemd-analyze verify gained support for verifying unit files under
+          an explicitly specified unit name, independently of what the filename
+          actually is.
+
+        * systemd-analyze verify gained a new switch --recursive-errors= which
+          controls whether to only fail on errors found in the specified units
+          or recursively any dependent units.
+
+        * systemd-analyze security now supports a new --offline mode for
+          analyzing unit files stored on disk instead of loaded units. It may
+          be combined with --root=/--image to analyze unit files under a root
+          directory or disk image. It also learnt a new --threshold= parameter
+          for specifying an exposure level threshold: if the exposure level
+          exceeds the specified value the call will fail. It also gained a new
+          --security-policy= switch for configuring security policies to
+          enforce on the units. A policy is a JSON file that lists which tests
+          shall be weighted how much to determine the overall exposure
+          level. Altogether these new features are useful for fully automatic
+          analysis and enforcement of security policies on unit files.
+
+        * systemd-analyze security gain a new --json= switch for JSON output.
+
+        * systemd-analyze learnt a new --quiet switch for reducing
+          non-essential output. It's honored by the "dot", "syscall-filter",
+          "filesystems" commands.
+
+        * systemd-analyze security gained a --profile= option that can be used
+          to take into account a portable profile when analyzing portable
+          services, since a lot of the security-related settings are enabled
+          through them.
+
+        * systemd-analyze learnt a new inspect-elf verb that parses ELF core
+          files, binaries and executables and prints metadata information,
+          including the build-id and other info described on:
+          https://systemd.io/COREDUMP_PACKAGE_METADATA/
+
+        * .network files gained a new UplinkInterface= in the [IPv6SendRA]
+          section, for automatically propagating DNS settings from other
+          interfaces.
+
+        * The static lease DHCP server logic in systemd-networkd may now serve
+          IP addresses outside of the configured IP pool range for the server.
+
+        * CAN support in systemd-networkd gained four new settings Loopback=,
+          OneShot=, PresumeAck=, ClassicDataLengthCode= for tweaking CAN
+          control modes. It gained a number of further settings for tweaking
+          CAN timing quanta.
+
+        * The [CAN] section in .network file gained new TimeQuantaNSec=,
+          PropagationSegment=, PhaseBufferSegment1=, PhaseBufferSegment2=,
+          SyncJumpWidth=, DataTimeQuantaNSec=, DataPropagationSegment=,
+          DataPhaseBufferSegment1=, DataPhaseBufferSegment2=, and
+          DataSyncJumpWidth= settings to control bit-timing processed by the
+          CAN interface.
+
+        * DHCPv4 client support in systemd-networkd learnt a new Label= option
+          for configuring the address label to apply to configure IPv4
+          addresses.
+
+        * The [IPv6AcceptRA] section of .network files gained support for a new
+          UseMTU= setting that may be used to control whether to apply the
+          announced MTU settings to the local interface.
+
+        * The [DHCPv4] section in .network file gained a new Use6RD= boolean
+          setting to control whether the DHCPv4 client request and process the
+          DHCP 6RD option.
+
+        * The [DHCPv6PrefixDelegation] section in .network file is renamed to
+          [DHCPPrefixDelegation], as now the prefix delegation is also supported
+          with DHCPv4 protocol by enabling the Use6RD= setting.
+
+        * The [DHCPPrefixDelegation] section in .network file gained a new
+          setting UplinkInterface= to specify the upstream interface.
+
+        * The [DHCPv6] section in .network file gained a new setting
+          UseDelegatedPrefix= to control whether the delegated prefixes will be
+          propagated to the downstream interfaces.
+
+        * The [IPv6AcceptRA] section of .network files now understands two new
+          settings UseGateway=/UseRoutePrefix= for explicitly configuring
+          whether to use the relevant fields from the IPv6 Router Advertisement
+          records.
+
+        * The ForceDHCPv6PDOtherInformation= setting in the [DHCPv6] section
+          has been removed. Please use the WithoutRA= and UseDelegatedPrefix=
+          settings in the [DHCPv6] section and the DHCPv6Client= setting in the
+          [IPv6AcceptRA] section to control when the DHCPv6 client is started
+          and how the delegated prefixes are handled by the DHCPv6 client.
+
+        * The IPv6Token= section in the [Network] section is deprecated, and
+          the [IPv6AcceptRA] section gained the Token= setting for its
+          replacement. The [IPv6Prefix] section also gained the Token= setting.
+          The Token= setting gained 'eui64' mode to explicitly configure an
+          address with the EUI64 algorithm based on the interface MAC address.
+          The 'prefixstable' mode can now optionally take a secret key. The
+          Token= setting in the [DHCPPrefixDelegation] section now supports all
+          algorithms supported by the same settings in the other sections.
+
+        * The [RoutingPolicyRule] section of .network file gained a new
+          SuppressInterfaceGroup= setting.
+
+        * The IgnoreCarrierLoss= setting in the [Network] section of .network
+          files now allows a duration to be specified, controlling how long to
+          wait before reacting to carrier loss.
+
+        * The [DHCPServer] section of .network file gained a new Router=
+          setting to specify the router address.
+
+        * The [CAKE] section of .network files gained various new settings
+          AutoRateIngress=, CompensationMode=, FlowIsolationMode=, NAT=,
+          MPUBytes=, PriorityQueueingPreset=, FirewallMark=, Wash=, SplitGSO=,
+          and UseRawPacketSize= for configuring CAKE.
+
+        * systemd-networkd now ships with new default .network files:
+          80-container-vb.network which matches host-side network bridge device
+          created by systemd-nspawn's --network-bridge or --network-zone
+          switch, and 80-6rd-tunnel.network which matches automatically created
+          sit tunnel with 6rd prefix when the DHCP 6RD option is received.
+
+        * systemd-networkd's handling of Endpoint= resolution for WireGuard
+          interfaces has been improved.
+
+        * systemd-networkd will now automatically configure routes to addresses
+          specified in AllowedIPs=. This feature can be controlled via
+          RouteTable= and RouteMetric= settings in [WireGuard] or
+          [WireGuardPeer] sections.
+
+        * systemd-networkd will now once again automatically generate persistent
+          MAC addresses for batadv and bridge interfaces. Users can disable this
+          by using MACAddress=none in .netdev files.
+
+        * systemd-networkd and systemd-udevd now support IP over InfiniBand
+          interfaces. The Kind= setting in .netdev file accepts "ipoib". And
+          systemd.netdev files gained the [IPoIB] section.
+
+        * systemd-networkd and systemd-udevd now support net.ifname-policy=
+          option on the kernel command-line. This is implemented through the
+          systemd-network-generator service that automatically generates
+          appropriate .link, .network, and .netdev files.
+
+        * The various systemd-udevd "ethtool" buffer settings now understand
+          the special value "max" to configure the buffers to the maximum the
+          hardware supports.
+
+        * systemd-udevd's .link files may now configure a large variety of
+          NIC coalescing settings, plus more hardware offload settings.
+
+        * .link files gained a new WakeOnLanPassword= setting in the [Link]
+          section that allows to specify a WoL "SecureOn" password on hardware
+          that supports this.
+
+        * systemd-nspawn's --setenv= switch now supports an additional syntax:
+          if only a variable name is specified (i.e. without being suffixed by
+          a '=' character and a value) the current value of the environment
+          variable is propagated to the container. e.g. --setenv=FOO will
+          lookup the current value of $FOO in the environment, and pass it down
+          to the container. Similar behavior has been added to homectl's,
+          machinectl's and systemd-run's --setenv= switch.
+
+        * systemd-nspawn gained a new switch --suppress-sync= which may be used
+          to optionally suppress the effect of the sync()/fsync()/fdatasync()
+          system calls for the container payload. This is useful for build
+          system environments where safety against abnormal system shutdown is
+          not essential as all build artifacts can be regenerated any time, but
+          the performance win is beneficial.
+
+        * systemd-nspawn will now raise the RLIMIT_NOFILE hard limit to the
+          same value that PID 1 uses for most forked off processes.
+
+        * systemd-nspawn's --bind=/--bind-ro= switches now optionally take
+          uidmap/nouidmap options as last parameter. If "uidmap" is used the
+          bind mounts are created with UID mapping taking place that ensures
+          the host's file ownerships are mapped 1:1 to container file
+          ownerships, even if user namespacing is used. This way
+          files/directories bound into containers will no longer show up as
+          owned by the nobody user as they typically did if no special care was
+          taken to shift them manually.
+
+        * When discovering Windows installations sd-boot will now attempt to
+          show the Windows version.
+
+        * The color scheme to use in sd-boot may now be configured at
+          build-time.
+
+        * sd-boot gained the ability to change screen resolution during
+          boot-time, by hitting the "r" key. This will cycle through available
+          resolutions and save the last selection.
+
+        * sd-boot learnt a new hotkey "f". When pressed the system will enter
+          firmware setup. This is useful in environments where it is difficult
+          to hit the right keys early enough to enter the firmware, and works
+          on any firmware regardless which key it natively uses.
+
+        * sd-boot gained support for automatically booting into the menu item
+          selected on the last boot (using the "@saved" identifier for menu
+          items).
+
+        * sd-boot gained support for automatically loading all EFI drivers
+          placed in the /EFI/systemd/drivers/ subdirectory of the EFI System
+          Partition (ESP). These drivers are loaded before the menu entries are
+          loaded. This is useful e.g. to load additional file system drivers
+          for the XBOOTLDR partition.
+
+        * systemd-boot will now paint the input cursor on its own instead of
+          relying on the firmware to do so, increasing compatibility with broken
+          firmware that doesn't make the cursor reasonably visible.
+
+        * sd-boot now embeds a .osrel PE section like we expect from Boot
+          Loader Specification Type #2 Unified Kernels. This means sd-boot
+          itself may be used in place of a Type #2 Unified Kernel. This is
+          useful for debugging purposes as it allows chain-loading one a
+          (development) sd-boot instance from another.
+
+        * sd-boot now supports a new "devicetree" field in Boot Loader
+          Specification Type #1 entries: if configured the specified device
+          tree file is installed before the kernel is invoked. This is useful
+          for installing/applying new devicetree files without updating the
+          kernel image.
+
+        * Similarly, sd-stub now can read devicetree data from a PE section
+          ".dtb" and apply it before invoking the kernel.
+
+        * sd-stub (the EFI stub that can be glued in front of a Linux kernel)
+          gained the ability to pick up credentials and sysext files, wrap them
+          in a cpio archive, and pass as an additional initrd to the invoked
+          Linux kernel, in effect placing those files in the /.extra/ directory
+          of the initrd environment. This is useful to implement trusted initrd
+          environments which are fully authenticated but still can be extended
+          (via sysexts) and parameterized (via encrypted/authenticated
+          credentials, see above).
+
+          Credentials can be located next to the kernel image file (credentials
+          specific to a single boot entry), or in one of the shared directories
+          (credentials applicable to multiple boot entries).
+
+        * sd-stub now comes with a full man page, that explains its feature set
+          and how to combine a kernel image, an initrd and the stub to build a
+          complete EFI unified kernel image, implementing Boot Loader
+          Specification Type #2.
+
+        * sd-stub may now provide the initrd to the executed kernel via the
+          LINUX_EFI_INITRD_MEDIA_GUID EFI protocol, adding compatibility for
+          non-x86 architectures.
+
+        * bootctl learnt new set-timeout and set-timeout-oneshot commands that
+          may be used to set the boot menu time-out of the boot loader (for all
+          or just the subsequent boot).
+
+        * bootctl and kernel-install will now read variables
+          KERNEL_INSTALL_LAYOUT= from /etc/machine-info and layout= from
+          /etc/kernel/install.conf. When set, it specifies the layout to use
+          for installation directories on the boot partition, so that tools
+          don't need to guess it based on the already-existing directories. The
+          only value that is defined natively is "bls", corresponding to the
+          layout specified in
+          https://systemd.io/BOOT_LOADER_SPECIFICATION/. Plugins for
+          kernel-install that implement a different layout can declare other
+          values for this variable.
+
+          'bootctl install' will now write KERNEL_INSTALL_LAYOUT=bls, on the
+          assumption that if the user installed sd-boot to the ESP, they intend
+          to use the entry layout understood by sd-boot. It'll also write
+          KERNEL_INSTALL_MACHINE_ID= if it creates any directories using the ID
+          (and it wasn't specified in the config file yet). Similarly,
+          kernel-install will now write KERNEL_INSTALL_MACHINE_ID= (if it
+          wasn't specified in the config file yet). Effectively, those changes
+          mean that the machine-id used for boot loader entry installation is
+          "frozen" upon first use and becomes independent of the actual
+          machine-id.
+
+          Configuring KERNEL_INSTALL_MACHINE_ID fixes the following problem:
+          images created for distribution ("golden images") are built with no
+          machine-id, so that a unique machine-id can be created on the first
+          boot. But those images may contain boot loader entries with the
+          machine-id used during build included in paths. Using a "frozen"
+          value allows unambiguously identifying entries that match the
+          specific installation, while still permitting parallel installations
+          without conflict.
+
+          Configuring KERNEL_INSTALL_LAYOUT obviates the need for
+          kernel-install to guess the installation layout. This fixes the
+          problem where a (possibly empty) directory in the boot partition is
+          created from a different layout causing kernel-install plugins to
+          assume the wrong layout. A particular example of how this may happen
+          is the grub2 package in Fedora which includes directories under /boot
+          directly in its file list. Various other packages pull in grub2 as a
+          dependency, so it may be installed even if unused, breaking
+          installations that use the bls layout.
+
+        * bootctl and systemd-bless-boot can now be linked statically.
+
+        * systemd-sysext now optionally doesn't insist on extension-release.d/
+          files being placed in the image under the image's file name. If the
+          file system xattr user.extension-release.strict is set on the
+          extension release file, it is accepted regardless of its name. This
+          relaxes security restrictions a bit, as system extension may be
+          attached under a wrong name this way.
+
+        * udevadm's test-builtin command learnt a new --action= switch for
+          testing the built-in with the specified action (in place of the
+          default 'add').
+
+        * udevadm info gained new switches --property=/--value for showing only
+          specific udev properties/values instead of all.
+
+        * A new hwdb database has been added that contains matches for various
+          types of signal analyzers (protocol analyzers, logic analyzers,
+          oscilloscopes, multimeters, bench power supplies, etc.) that should
+          be accessible to regular users.
+
+        * A new hwdb database entry has been added that carries information
+          about types of cameras (regular or infrared), and in which direction
+          they point (front or back).
+
+        * A new rule to allow console users access to rfkill by default has been
+          added to hwdb.
+
+        * Device nodes for the Software Guard eXtension enclaves (sgx_vepc) are
+          now also owned by the system group "sgx".
+
+        * A new build-time meson option "extra-net-naming-schemes=" has been
+          added to define additional naming schemes schemes for udev's network
+          interface naming logic. This is useful for enterprise distributions
+          and similar which want to pin the schemes of certain distribution
+          releases under a specific name and previously had to patch the
+          sources to introduce new named schemes.
+
+        * The predictable naming logic for network interfaces has been extended
+          to generate stable names from Xen netfront device information.
+
+        * hostnamed's chassis property can now be sourced from chassis-type
+          field encoded in devicetree (in addition to the existing DMI
+          support).
+
+        * systemd-cgls now optionally displays cgroup IDs and extended
+          attributes for each cgroup. (Controllable via the new --xattr= +
+          --cgroup-id= switches.)
+
+        * coredumpctl gained a new --all switch for operating on all
+          Journal files instead of just the local ones.
+
+        * systemd-coredump will now use libdw/libelf via dlopen() rather than
+          directly linking, allowing users to easily opt-out of backtrace/metadata
+          analysis of core files, and reduce image sizes when this is not needed.
+
+        * systemd-coredump will now analyze core files with libdw/libelf in a
+          forked, sandboxed process.
+
+        * systemd-homed will now try to unmount an activate home area in
+          regular intervals once the user logged out fully. Previously this was
+          attempted exactly once but if the home directory was busy for some
+          reason it was not tried again.
+
+        * systemd-homed's LUKS2 home area backend will now create a BSD file
+          system lock on the image file while the home area is active
+          (i.e. mounted). If a home area is found to be locked, logins are
+          politely refused. This should improve behavior when using home areas
+          images that are accessible via the network from multiple clients, and
+          reduce the chance of accidental file system corruption in that case.
+
+        * Optionally, systemd-homed will now drop the kernel buffer cache once
+          a user has fully logged out, configurable via the new --drop-caches=
+          homectl switch.
+
+        * systemd-homed now makes use of UID mapped mounts for the home areas.
+          If the kernel and used file system support it, files are now
+          internally owned by the "nobody" user (i.e. the user typically used
+          for indicating "this ownership is not mapped"), and dynamically
+          mapped to the UID used locally on the system via the UID mapping
+          mount logic of recent kernels. This makes migrating home areas
+          between different systems cheaper because recursively chown()ing file
+          system trees is no longer necessary.
+
+        * systemd-homed's CIFS backend now optionally supports CIFS service
+          names with a directory suffix, in order to place home directories in
+          a subdirectory of a CIFS share, instead of the top-level directory.
+
+        * systemd-homed's CIFS backend gained support for specifying additional
+          mount options in the JSON user record (cifsExtraMountOptions field,
+          and --cifs-extra-mount-options= homectl switch). This is for example
+          useful for configuring mount options such as "noserverino" that some
+          SMB3 services require (use that to run a homed home directory from a
+          FritzBox SMB3 share this way).
+
+        * systemd-homed will now default to btrfs' zstd compression for home
+          areas. This is inspired by Fedora's recent decision to switch to zstd
+          by default.
+
+        * Additional mount options to use when mounting the file system of
+          LUKS2 volumes in systemd-homed has been added. Via the
+          $SYSTEMD_HOME_MOUNT_OPTIONS_BTRFS, $SYSTEMD_HOME_MOUNT_OPTIONS_EXT4,
+          $SYSTEMD_HOME_MOUNT_OPTIONS_XFS environment variables to
+          systemd-homed or via the luksExtraMountOptions user record JSON
+          property. (Exposed via homectl --luks-extra-mount-options)
+
+        * homectl's resize command now takes the special size specifications
+          "min" and "max" to shrink/grow the home area to the minimum/maximum
+          size possible, taking disk usage/space constraints and file system
+          limitations into account. Resizing is now generally graceful: the
+          logic will try to get as close to the specified size as possible, but
+          not consider it a failure if the request couldn't be fulfilled
+          precisely.
+
+        * systemd-homed gained the ability to automatically shrink home areas
+          on logout to their minimal size and grow them again on next
+          login. This ensures that while inactive, a home area only takes up
+          the minimal space necessary, but once activated, it provides
+          sufficient space for the user's needs. This behavior is only
+          supported if btrfs is used as file system inside the home area
+          (because only for btrfs online growing/shrinking is implemented in
+          the kernel). This behavior is now enabled by default, but may be
+          controlled via the new --auto-resize-mode= setting of homectl.
+
+        * systemd-homed gained support for automatically re-balancing free disk
+          space among active home areas, in case the LUKS2 backends are used,
+          and no explicit disk size was requested. This way disk space is
+          automatically managed and home areas resized in regular intervals and
+          manual resizing when disk space becomes scarce should not be
+          necessary anymore. This behavior is only supported if btrfs is used
+          within the home areas (as only then online shrinking and growing is
+          supported), and may be configured via the new rebalanceWeight JSON
+          user record field (as exposed via the new --rebalance-weight= homectl
+          setting). Re-balancing is mostly automatic, but can also be requested
+          explicitly via "homectl rebalance", which is synchronous, and thus
+          may be used to wait until the rebalance run is complete.
+
+        * userdbctl gained a --json= switch for configured the JSON formatting
+          to use when outputting user or group records.
+
+        * userdbctl gained a new --multiplexer= switch for explicitly
+          configuring whether to use the systemd-userdbd server side user
+          record resolution logic.
+
+        * userdbctl's ssh-authorized-keys command learnt a new --chain switch,
+          for chaining up another command to execute after completing the
+          look-up. Since the OpenSSH's AuthorizedKeysCommand only allows
+          configuration of a single command to invoke, this maybe used to
+          invoke multiple: first userdbctl's own implementation, and then any
+          other also configured in the command line.
+
+        * The sd-event API gained a new function sd_event_add_inotify_fd() that
+          is similar to sd_event_add_inotify() but accepts a file descriptor
+          instead of a path in the file system for referencing the inode to
+          watch.
+
+        * The sd-event API gained a new function
+          sd_event_source_set_ratelimit_expire_callback() that may be used to
+          define a callback function that is called whenever an event source
+          leaves the rate limiting phase.
+
+        * New documentation has been added explaining which steps are necessary
+          to port systemd to a new architecture:
+
+          https://systemd.io/PORTING_TO_NEW_ARCHITECTURES
+
+        * The x-systemd.makefs option in /etc/fstab now explicitly supports
+          ext2, ext3, and f2fs file systems.
+
+        * Mount units and units generated from /etc/fstab entries with 'noauto'
+          are now ordered the same as other units. Effectively, they will be
+          started earlier (if something actually pulled them in) and stopped
+          later, similarly to normal mount units that are part of
+          fs-local.target. This change should be invisible to users, but
+          should prevent those units from being stopped too early during
+          shutdown.
+
+        * The systemd-getty-generator now honors a new kernel command line
+          argument systemd.getty_auto= and a new environment variable
+          $SYSTEMD_GETTY_AUTO that allows turning it off at boot. This is for
+          example useful to turn off gettys inside of containers or similar
+          environments.
+
+        * systemd-resolved now listens on a second DNS stub address: 127.0.0.54
+          (in addition to 127.0.0.53, as before). If DNS requests are sent to
+          this address they are propagated in "bypass" mode only, i.e. are
+          almost not processed locally, but mostly forwarded as-is to the
+          current upstream DNS servers. This provides a stable DNS server
+          address that proxies all requests dynamically to the right upstream
+          DNS servers even if these dynamically change. This stub does not do
+          mDNS/LLMNR resolution. However, it will translate look-ups to
+          DNS-over-TLS if necessary. This new stub is particularly useful in
+          container/VM environments, or for tethering setups: use DNAT to
+          redirect traffic to any IP address to this stub.
+
+        * systemd-importd now honors new environment variables
+          $SYSTEMD_IMPORT_BTRFS_SUBVOL, $SYSTEMD_IMPORT_BTRFS_QUOTA,
+          $SYSTEMD_IMPORT_SYNC, which may be used disable btrfs subvolume
+          generation, btrfs quota setup and disk synchronization.
+
+        * systemd-importd and systemd-resolved can now be optionally built with
+          OpenSSL instead of libgcrypt.
+
+        * systemd-repart no longer requires OpenSSL.
+
+        * systemd-sysusers will no longer create the redundant 'nobody' group
+          by default, as the 'nobody' user is already created with an
+          appropriate primary group.
+
+        * If a unit uses RuntimeMaxSec, systemctl show will now display it.
+
+        * systemctl show-environment gained support for --output=json.
+
+        * pam_systemd will now first try to use the X11 abstract socket, and
+          fallback to the socket file in /tmp/.X11-unix/ only if that does not
+          work.
+
+        * systemd-journald will no longer go back to volatile storage
+          regardless of configuration when its unit is restarted.
+
+        * Initial support for the LoongArch architecture has been added (system
+          call lists, GPT partition table UUIDs, etc).
+
+        * systemd-journald's own logging messages are now also logged to the
+          journal itself when systemd-journald logs to /dev/kmsg.
+
+        * systemd-journald now re-enables COW for archived journal files on
+          filesystems that support COW. One benefit of this change is that
+          archived journal files will now get compressed on btrfs filesystems
+          that have compression enabled.
+
+        * systemd-journald now deduplicates fields in a single log message
+          before adding it to the journal. In archived journal files, it will
+          also punch holes for unused parts and truncate the file as
+          appropriate, leading to reductions in disk usage.
+
+        * journalctl --verify was extended with more informative error
+          messages.
+
+        * More of sd-journal's functions are now resistant against journal file
+          corruption.
+
+        * The shutdown command learnt a new option --show, to display the
+          scheduled shutdown.
+
+        * A LICENSES/ directory is now included in the git tree. It contains a
+          README.md file that explains the licenses used by source files in
+          this repository.  It also contains the text of all applicable
+          licenses as they appear on spdx.org.
+
+        Contributions from: Aakash Singh, acsfer, Adolfo Jayme Barrientos,
+        Adrian Vovk, Albert Brox, Alberto Mardegan, Alexander Kanavin,
+        alexlzhu, Alfonso Sánchez-Beato, Alvin Šipraga, Alyssa Ross,
+        Amir Omidi, Anatol Pomozov, Andika Triwidada, Andreas Rammhold,
+        Andreas Valder, Andrej Lajovic, Andrew Soutar, Andrew Stone, Andy Chi,
+        Anita Zhang, Anssi Hannula, Antonio Alvarez Feijoo,
+        Antony Deepak Thomas, Arnaud Ferraris, Arvid E. Picciani,
+        Bastien Nocera, Benjamin Berg, Benjamin Herrenschmidt, Ben Stockett,
+        Bogdan Seniuc, Boqun Feng, Carl Lei, chlorophyll-zz, Chris Packham,
+        Christian Brauner, Christian Göttsche, Christian Wehrli,
+        Christoph Anton Mitterer, Cristian Rodríguez, Daan De Meyer,
+        Daniel Maixner, Dann Frazier, Dan Streetman, Davide Cavalca,
+        David Seifert, David Tardon, dependabot[bot], Dimitri John Ledkov,
+        Dimitri Papadopoulos, Dimitry Ishenko, Dmitry Khlebnikov,
+        Dominique Martinet, duament, Egor, Egor Ignatov, Emil Renner Berthing,
+        Emily Gonyer, Ettore Atalan, Evgeny Vereshchagin, Florian Klink,
+        Franck Bui, Frantisek Sumsal, Geass-LL, Gibeom Gwon, GnunuX,
+        Gogo Gogsi, gregzuro, Greg Zuro, Gustavo Costa, Hans de Goede,
+        Hela Basa, Henri Chain, hikigaya58, Hugo Carvalho,
+        Hugo Osvaldo Barrera, Iago Lopez Galeiras, Iago López Galeiras,
+        I-dont-need-name, igo95862, Jack Dähn, James Hilliard, Jan Janssen,
+        Jan Kuparinen, Jan Macku, Jan Palus, Jarkko Sakkinen, Jayce Fayne,
+        jiangchuangang, jlempen, John Lindgren, Jonas Dreßler, Jonas Jelten,
+        Jonas Witschel, Joris Hartog, José Expósito, Julia Kartseva,
+        Kai-Heng Feng, Kai Wohlfahrt, Kay Siver Bø, KennthStailey,
+        Kevin Kuehler, Kevin Orr, Khem Raj, Kristian Klausen, Kyle Laker,
+        lainahai, LaserEyess, Lennart Poettering, Lia Lenckowski, longpanda,
+        Luca Boccassi, Luca BRUNO, Ludwig Nussel, Lukas Senionis,
+        Maanya Goenka, Maciek Borzecki, Marcel Menzel, Marco Scardovi,
+        Marcus Harrison, Mark Boudreau, Matthijs van Duin, Mauricio Vásquez,
+        Maxime de Roucy, Max Resch, MertsA, Michael Biebl, Michael Catanzaro,
+        Michal Koutný, Michal Sekletár, Miika Karanki, Mike Gilbert,
+        Milo Turner, ml, monosans, Nacho Barrientos, nassir90, Nishal Kulkarni,
+        nl6720, Ondrej Kozina, Paulo Neves, Pavel Březina, pedro martelletto,
+        Peter Hutterer, Peter Morrow, Piotr Drąg, Rasmus Villemoes, ratijas,
+        Raul Tambre, rene, Riccardo Schirone, Robert-L-Turner, Robert Scheck,
+        Ross Jennings, saikat0511, Scott Lamb, Scott Worley,
+        Sergei Trofimovich, Sho Iizuka, Slava Bacherikov, Slimane Selyan Amiri,
+        StefanBruens, Steven Siloti, svonohr, Taiki Sugawara, Takashi Sakamoto,
+        Takuro Onoue, Thomas Blume, Thomas Haller, Thomas Mühlbacher,
+        Tianlu Shao, Toke Høiland-Jørgensen, Tom Yan, Tony Asleson,
+        Topi Miettinen, Ulrich Ölmann, Urs Ritzmann, Vincent Bernat,
+        Vito Caputo, Vladimir Panteleev, WANG Xuerui, Wind/owZ, Wu Xiaotian,
+        xdavidwu, Xiaotian Wu, xujing, yangmingtai, Yao Wei, Yao Wei (魏銘廷),
+        Yegor Alexeyev, Yu Watanabe, Zbigniew Jędrzejewski-Szmek,
+        Дамјан Георгиевски, наб
+
+        — Warsaw, 2021-12-23
+
 CHANGES WITH 249:
 
         * When operating on disk images via the --image= switch of various
@@ -518,6 +1980,11 @@ CHANGES WITH 249:
           distribution does not install it yet, it might make sense to change
           that.
 
+        * Intel HID rfkill event is no longer masked, since it's the only
+          source of rfkill event on newer HP laptops. To have both backward and
+          forward compatibility, userspace daemon needs to debounce duplicated
+          events in a short time window.
+
         Contributions from: Aakash Singh, adrian5, Albert Brox,
         Alexander Sverdlin, Alexander Tsoy, Alexey Rubtsov, alexlzhu,
         Allen Webb, Alvin Šipraga, Alyssa Ross, Anders Wenhaug,
@@ -3867,7 +5334,7 @@ CHANGES WITH 240:
 
           Consult the kernel documentation for details on this sysctl:
           https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt
-          
+
         * The v239 change to turn on "net.ipv4.tcp_ecn" by default has been
           reverted.
 
@@ -5609,6 +7076,15 @@ CHANGES WITH 234:
           temporary directory is passed as the entry directory and removed
           after all the plugins exit.
 
+        * If KERNEL_INSTALL_MACHINE_ID is set in /etc/machine-info, kernel-install
+          will now use its value as the machine ID instead of the machine ID
+          from /etc/machine-id. If KERNEL_INSTALL_MACHINE_ID isn't set in
+          /etc/machine-info and no machine ID is set in /etc/machine-id,
+          kernel-install will try to store the current machine ID there as
+          KERNEL_INSTALL_MACHINE_ID. If there is no machine ID, kernel-install
+          will generate a new UUID, store it in /etc/machine-info as
+          KERNEL_INSTALL_MACHINE_ID and use it as the machine ID.
+
         Contributions from: Adrian Heine né Lang, Aggelos Avgerinos, Alexander
         Kurtz, Alexandros Frantzis, Alexey Brodkin, Alex Lu, Amir Pakdel, Amir
         Yalon, Anchor Cat, Anthony Parsons, Bastien Nocera, Benjamin Gilbert,
@@ -11481,7 +12957,7 @@ CHANGES WITH 197:
           based on a calendar time specification such as "Thu,Fri
           2013-*-1,5 11:12:13" which refers to 11:12:13 of the first
           or fifth day of any month of the year 2013, given that it is
-          a thursday or friday. This brings timer event support
+          a Thursday or a Friday. This brings timer event support
           considerably closer to cron's capabilities. For details on
           the supported calendar time specification language see
           systemd.time(7).
diff --git a/README b/README
index 9e5bcab..3b104c2 100644
--- a/README
+++ b/README
@@ -27,21 +27,26 @@ AUTHOR:
         ...and many others
 
 LICENSE:
-        LGPLv2.1+ for all code
-        - except src/basic/MurmurHash2.c which is Public Domain
-        - except src/basic/siphash24.c which is CC0 Public Domain
-        - except src/journal/lookup3.c which is Public Domain
-        - except src/udev/* which is (currently still) GPLv2, GPLv2+
-        - except tools/chromiumos/* which is BSD-style
+        LGPL-2.1-or-later for all code, exceptions noted in LICENSES/README.md
 
 REQUIREMENTS:
-        Linux kernel >= 3.13
-        Linux kernel >= 4.2 for unified cgroup hierarchy support
-        Linux kernel >= 4.10 for cgroup-bpf egress and ingress hooks
-        Linux kernel >= 4.15 for cgroup-bpf device hook
-        Linux kernel >= 4.17 for cgroup-bpf socket address hooks
-        Linux kernel >= 5.3 for bounded-loops in BPF program
-        Linux kernel >= 5.4 for signed Verity images support
+        Linux kernel ≥ 3.15
+                     ≥ 4.3 for ambient capabilities
+                     ≥ 4.5 for pids controller in cgroup v2
+                     ≥ 4.6 for cgroup namespaces
+                     ≥ 4.9 for RENAME_NOREPLACE support in vfat
+                     ≥ 4.10 for cgroup-bpf egress and ingress hooks
+                     ≥ 4.15 for cgroup-bpf device hook and cpu controller in cgroup v2
+                     ≥ 4.17 for cgroup-bpf socket address hooks
+                     ≥ 4.20 for PSI (used by systemd-oomd)
+                     ≥ 5.3 for bounded loops in BPF program
+                     ≥ 5.4 for signed Verity images
+                     ≥ 5.7 for BPF links and the BPF LSM hook
+
+        Kernel versions below 4.15 have significant gaps in functionality and
+        are not recommended for use with this version of systemd. Taint flag
+        'old-kernel' will be set. Systemd will most likely still function, but
+        upstream support and testing are limited.
 
         Kernel Config Options:
           CONFIG_DEVTMPFS
@@ -55,7 +60,7 @@ REQUIREMENTS:
           CONFIG_PROC_FS
           CONFIG_FHANDLE (libudev, mount and bind mount handling)
 
-        Kernel crypto/hash API
+        Kernel crypto/hash API:
           CONFIG_CRYPTO_USER_API_HASH
           CONFIG_CRYPTO_HMAC
           CONFIG_CRYPTO_SHA256
@@ -66,15 +71,15 @@ REQUIREMENTS:
         Legacy hotplug slows down the system and confuses udev:
           CONFIG_UEVENT_HELPER_PATH=""
 
-        Userspace firmware loading is not supported and should
-        be disabled in the kernel:
+        Userspace firmware loading is not supported and should be disabled in
+        the kernel:
           CONFIG_FW_LOADER_USER_HELPER=n
 
         Some udev rules and virtualization detection relies on it:
           CONFIG_DMIID
 
-        Support for some SCSI devices serial number retrieval, to
-        create additional symlinks in /dev/disk/ and /dev/tape:
+        Support for some SCSI devices serial number retrieval, to create
+        additional symlinks in /dev/disk/ and /dev/tape:
           CONFIG_BLK_DEV_BSG
 
         Required for PrivateNetwork= in service units:
@@ -92,25 +97,26 @@ REQUIREMENTS:
           CONFIG_{TMPFS,EXT4_FS,XFS,BTRFS_FS,...}_POSIX_ACL
           CONFIG_SECCOMP
           CONFIG_SECCOMP_FILTER (required for seccomp support)
-          CONFIG_CHECKPOINT_RESTORE (for the kcmp() syscall)
+          CONFIG_KCMP (for the kcmp() syscall, used to be under
+                       CONFIG_CHECKPOINT_RESTORE before ~5.12)
 
-        Required for CPUShares= in resource control unit settings
+        Required for CPUShares= in resource control unit settings:
           CONFIG_CGROUP_SCHED
           CONFIG_FAIR_GROUP_SCHED
 
-        Required for CPUQuota= in resource control unit settings
+        Required for CPUQuota= in resource control unit settings:
           CONFIG_CFS_BANDWIDTH
 
         Required for IPAddressDeny=, IPAddressAllow=, IPIngressFilterPath=,
-        IPEgressFilterPath= in resource control unit settings
-        unit settings
+        IPEgressFilterPath= in resource control unit settings unit settings:
           CONFIG_BPF
           CONFIG_BPF_SYSCALL
           CONFIG_BPF_JIT
           CONFIG_HAVE_EBPF_JIT
           CONFIG_CGROUP_BPF
 
-        Required for SocketBind{Allow|Deny}= in resource control unit settings
+        Required for SocketBind{Allow|Deny}=, RestrictNetworkInterfaces= in
+        resource control unit settings:
           CONFIG_BPF
           CONFIG_BPF_SYSCALL
           CONFIG_BPF_JIT
@@ -124,22 +130,28 @@ REQUIREMENTS:
         Required for signed Verity images support:
           CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
 
-        We recommend to turn off Real-Time group scheduling in the
-        kernel when using systemd. RT group scheduling effectively
-        makes RT scheduling unavailable for most userspace, since it
-        requires explicit assignment of RT budgets to each unit whose
-        processes making use of RT. As there's no sensible way to
-        assign these budgets automatically this cannot really be
-        fixed, and it's best to disable group scheduling hence.
+        Required for RestrictFileSystems= in service units:
+          CONFIG_BPF
+          CONFIG_BPF_SYSCALL
+          CONFIG_BPF_LSM
+          CONFIG_DEBUG_INFO_BTF
+          CONFIG_LSM="...,bpf" or kernel booted with lsm="...,bpf".
+
+        We recommend to turn off Real-Time group scheduling in the kernel when
+        using systemd. RT group scheduling effectively makes RT scheduling
+        unavailable for most userspace, since it requires explicit assignment of
+        RT budgets to each unit whose processes making use of RT. As there's no
+        sensible way to assign these budgets automatically this cannot really be
+        fixed, and it's best to disable group scheduling hence:
            CONFIG_RT_GROUP_SCHED=n
 
         It's a good idea to disable the implicit creation of networking bonding
         devices by the kernel networking bonding module, so that the
         automatically created "bond0" interface doesn't conflict with any such
-        device created by systemd-networkd (or other tools). Ideally there
-        would be a kernel compile-time option for this, but there currently
-        isn't. The next best thing is to make this change through a modprobe.d
-        drop-in. This is shipped by default, see modprobe.d/systemd.conf.
+        device created by systemd-networkd (or other tools). Ideally there would
+        be a kernel compile-time option for this, but there currently isn't. The
+        next best thing is to make this change through a modprobe.d drop-in.
+        This is shipped by default, see modprobe.d/systemd.conf.
 
         Required for systemd-nspawn:
           CONFIG_DEVPTS_MULTIPLE_INSTANCES or Linux kernel >= 4.7
@@ -147,19 +159,17 @@ REQUIREMENTS:
         Required for systemd-oomd:
           CONFIG_PSI
 
-        Note that kernel auditing is broken when used with systemd's
-        container code. When using systemd in conjunction with
-        containers, please make sure to either turn off auditing at
-        runtime using the kernel command line option "audit=0", or
-        turn it off at kernel compile time using:
+        Note that kernel auditing is broken when used with systemd's container
+        code. When using systemd in conjunction with containers, please make
+        sure to either turn off auditing at runtime using the kernel command
+        line option "audit=0", or turn it off at kernel compile time using:
           CONFIG_AUDIT=n
-        If systemd is compiled with libseccomp support on
-        architectures which do not use socketcall() and where seccomp
-        is supported (this effectively means x86-64 and ARM, but
-        excludes 32-bit x86!), then nspawn will now install a
-        work-around seccomp filter that makes containers boot even
-        with audit being enabled. This works correctly only on kernels
-        3.14 and newer though. TL;DR: turn audit off, still.
+        If systemd is compiled with libseccomp support on architectures which do
+        not use socketcall() and where seccomp is supported (this effectively
+        means x86-64 and ARM, but excludes 32-bit x86!), then nspawn will now
+        install a work-around seccomp filter that makes containers boot even
+        with audit being enabled. This works correctly only on kernels 3.14 and
+        newer though. TL;DR: turn audit off, still.
 
         glibc >= 2.16
         libcap
@@ -195,11 +205,12 @@ REQUIREMENTS:
         python-jinja2
         python-lxml (optional, required to build the indices)
         python >= 3.5
-        meson >= 0.46 (>= 0.49 is required to build position-independent executables)
+        meson >= 0.53.2
         ninja
         gcc, awk, sed, grep, and similar tools
         clang >= 10.0, llvm >= 10.0 (optional, required to build BPF programs
                 from source code in C)
+        gnu-efi >= 3.0.5 (optional, required for systemd-boot)
 
         During runtime, you need the following additional
         dependencies:
@@ -212,7 +223,7 @@ REQUIREMENTS:
         polkit (optional)
 
         To build in directory build/:
-          meson setup build/ && meson compile -C build/
+          meson setup build/ && ninja -C build/
 
         Any configuration options can be specified as -Darg=value... arguments
         to meson. After the build directory is initially configured, meson will
@@ -222,29 +233,28 @@ REQUIREMENTS:
         their current values.
 
         Useful commands:
-          meson compile -v -C build/ some/target
+          ninja -C build -v some/target
           meson test -C build/
-          sudo meson install -C build/
+          sudo meson install -C build/ --no-rebuild
           DESTDIR=... meson install -C build/
 
         A tarball can be created with:
-          git archive --format=tar --prefix=systemd-222/ v222 | xz > systemd-222.tar.xz
+          v=250 && git archive --prefix=systemd-$v/ v$v | zstd >systemd-$v.tar.zstd
 
-        When systemd-hostnamed is used, it is strongly recommended to
-        install nss-myhostname to ensure that, in a world of
-        dynamically changing hostnames, the hostname stays resolvable
-        under all circumstances. In fact, systemd-hostnamed will warn
-        if nss-myhostname is not installed.
+        When systemd-hostnamed is used, it is strongly recommended to install
+        nss-myhostname to ensure that, in a world of dynamically changing
+        hostnames, the hostname stays resolvable under all circumstances. In
+        fact, systemd-hostnamed will warn if nss-myhostname is not installed.
 
         nss-systemd must be enabled on systemd systems, as that's required for
         DynamicUser= to work. Note that we ship services out-of-the-box that
         make use of DynamicUser= now, hence enabling nss-systemd is not
         optional.
 
-        Note that the build prefix for systemd must be /usr. (Moreover,
-        packages systemd relies on — such as D-Bus — really should use the same
-        prefix, otherwise you are on your own.) -Dsplit-usr=false (which is the
-        default and does not need to be specified) is the recommended setting.
+        Note that the build prefix for systemd must be /usr. (Moreover, packages
+        systemd relies on — such as D-Bus — really should use the same prefix,
+        otherwise you are on your own.) -Dsplit-usr=false (which is the default
+        and does not need to be specified) is the recommended setting.
         -Dsplit-usr=true can be used to give a semblance of support for systems
         with programs installed split between / and /usr. Moving everything
         under /usr is strongly encouraged.
@@ -257,34 +267,51 @@ REQUIREMENTS:
         - strace             (used by test/test-functions)
         - capsh              (optional, used by test-execute)
 
+POLICY FOR SUPPORT OF DISTRIBUTIONS AND ARCHITECTURES:
+
+        systemd main branch and latest major or stable releases are generally
+        expected to compile on current versions of popular distributions (at
+        least all non-EOL versions of Fedora, Debian unstable/testing/stable,
+        latest Ubuntu LTS and non-LTS releases, openSUSE Tumbleweed/Leap,
+        CentOS Stream 8 and 9, up-to-date Arch, etc.)  We will generally
+        attempt to support also other non-EOL versions of various distros.
+        Features which would break compilation on slightly-older distributions
+        will only be introduced if there are significant reasons for this
+        (i.e. supporting them interferes with development or requires too many
+        resources to support). In some cases backports of specific libraries or
+        tools might be required.
+
+        The policy is similar wrt. architecture support. systemd is regularly
+        tested on popular architectures (currently amd64, i386, arm64, ppc64el,
+        and s390x), but should compile and work also on other architectures, for
+        which support has been added. systemd will emit warnings when
+        architecture-specific constants are not defined.
+
 USERS AND GROUPS:
-        Default udev rules use the following standard system group
-        names, which need to be resolvable by getgrnam() at any time,
-        even in the very early boot stages, where no other databases
-        and network are available:
+        Default udev rules use the following standard system group names, which
+        need to be resolvable by getgrnam() at any time, even in the very early
+        boot stages, where no other databases and network are available:
 
         audio, cdrom, dialout, disk, input, kmem, kvm, lp, render, tape, tty, video
 
-        During runtime, the journal daemon requires the
-        "systemd-journal" system group to exist. New journal files will
-        be readable by this group (but not writable), which may be used
-        to grant specific users read access. In addition, system
-        groups "wheel" and "adm" will be given read-only access to
-        journal files using systemd-tmpfiles.service.
+        During runtime, the journal daemon requires the "systemd-journal" system
+        group to exist. New journal files will be readable by this group (but
+        not writable), which may be used to grant specific users read access. In
+        addition, system groups "wheel" and "adm" will be given read-only access
+        to journal files using systemd-tmpfiles.service.
 
-        The journal remote daemon requires the
-        "systemd-journal-remote" system user and group to
-        exist. During execution this network facing service will drop
-        privileges and assume this uid/gid for security reasons.
+        The journal remote daemon requires the "systemd-journal-remote" system
+        user and group to exist. During execution this network facing service
+        will drop privileges and assume this uid/gid for security reasons.
 
-        Similarly, the network management daemon requires the
-        "systemd-network" system user and group to exist.
+        Similarly, the network management daemon requires the "systemd-network"
+        system user and group to exist.
 
-        Similarly, the name resolution daemon requires the
-        "systemd-resolve" system user and group to exist.
+        Similarly, the name resolution daemon requires the "systemd-resolve"
+        system user and group to exist.
 
-        Similarly, the coredump support requires the
-        "systemd-coredump" system user and group to exist.
+        Similarly, the coredump support requires the "systemd-coredump" system
+        user and group to exist.
 
 NSS:
         systemd ships with four glibc NSS modules:
@@ -304,9 +331,9 @@ NSS:
         DynamicUser= setting in unit files.)
 
         To make use of these NSS modules, please add them to the "hosts:",
-        "passwd:" and "group:" lines in /etc/nsswitch.conf. The "resolve"
-        module should replace the glibc "dns" module in this file (and don't
-        worry, it chain-loads the "dns" module if it can't talk to resolved).
+        "passwd:" and "group:" lines in /etc/nsswitch.conf. The "resolve" module
+        should replace the glibc "dns" module in this file (and don't worry, it
+        chain-loads the "dns" module if it can't talk to resolved).
 
         The four modules should be used in the following order:
 
@@ -325,24 +352,48 @@ SYSV INIT.D SCRIPTS:
         Please see src/systemctl/systemd-sysv-install.SKELETON for how this
         needs to look like, and provide an implementation at the marked places.
 
-WARNINGS:
+WARNINGS and TAINT FLAGS:
         systemd will warn during early boot if /usr is not already mounted at
         this point (that means: either located on the same file system as / or
         already mounted in the initrd). While in systemd itself very little
-        will break if /usr is on a separate, late-mounted partition, many of
-        its dependencies very likely will break sooner or later in one form or
+        will break if /usr is on a separate late-mounted partition, many of its
+        dependencies very likely will break sooner or later in one form or
         another. For example, udev rules tend to refer to binaries in /usr,
         binaries that link to libraries in /usr or binaries that refer to data
         files in /usr. Since these breakages are not always directly visible,
-        systemd will warn about this, since this kind of file system setup is
-        not really supported anymore by the basic set of Linux OS components.
-
-        systemd requires that the /run mount point exists. systemd also
-        requires that /var/run is a symlink to /run.
+        systemd will warn about this. Such setups are not really supported by
+        the basic set of Linux OS components. Taint flag 'split-usr' will be
+        set when this condition is detected.
 
         For more information on this issue consult
         https://www.freedesktop.org/wiki/Software/systemd/separate-usr-is-broken
 
+        systemd will warn if the filesystem is not usr-merged (i.e.: /bin, /sbin
+        and /lib* are not symlinks to their counterparts under /usr). Taint flag
+        'unmerged-usr' will be set when this condition is detected.
+
+        For more information on this issue consult
+        https://www.freedesktop.org/wiki/Software/systemd/TheCaseForTheUsrMerge
+
+        systemd requires that the /run mount point exists. systemd also
+        requires that /var/run is a symlink to /run. Taint flag 'var-run-bad'
+        will be set when this condition is detected.
+
+        Systemd will also warn when the cgroup support is unavailable in the
+        kernel (taint flag 'cgroups-missing'), the system is using the old
+        cgroup hierarchy (taint flag 'cgroupsv1'), the hardware clock is
+        running in non-UTC mode (taint flag 'local-hwclock'), the kernel
+        overflow UID or GID are not 65534 (taint flags 'overflowuid-not-65534'
+        and 'overflowgid-not-65534'), the UID or GID range assigned to the
+        running systemd instance covers less than 0…65534 (taint flags
+        'short-uid-range' and 'short-gid-range').
+
+        Taint conditions are logged during boot, but may also be checked at any
+        time with:
+
+          busctl get-property org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager Tainted
+
+VALGRIND:
         To run systemd under valgrind, compile with meson option
         -Dvalgrind=true and have valgrind development headers installed
         (i.e. valgrind-devel or equivalent). Otherwise, false positives will be
diff --git a/README.md b/README.md
index 6734e92..f0ed551 100644
--- a/README.md
+++ b/README.md
@@ -2,18 +2,20 @@
 
 System and Service Manager
 
-<a href="https://in.waw.pl/systemd-github-state/systemd-systemd-issues.svg"><img align="right" src="https://in.waw.pl/systemd-github-state/systemd-systemd-issues-small.svg" alt="Count of open issues over time"></a>
-<a href="https://in.waw.pl/systemd-github-state/systemd-systemd-pull-requests.svg"><img align="right" src="https://in.waw.pl/systemd-github-state/systemd-systemd-pull-requests-small.svg" alt="Count of open pull requests over time"></a>
+<a href="http://in.waw.pl/systemd-github-state/systemd-systemd-issues.svg"><img align="right" src="http://in.waw.pl/systemd-github-state/systemd-systemd-issues-small.svg" alt="Count of open issues over time"></a>
+<a href="http://in.waw.pl/systemd-github-state/systemd-systemd-pull-requests.svg"><img align="right" src="http://in.waw.pl/systemd-github-state/systemd-systemd-pull-requests-small.svg" alt="Count of open pull requests over time"></a>
 [![Semaphore CI 2.0 Build Status](https://the-real-systemd.semaphoreci.com/badges/systemd/branches/main.svg?style=shields)](https://the-real-systemd.semaphoreci.com/projects/systemd)<br/>
 [![Coverity Scan Status](https://scan.coverity.com/projects/350/badge.svg)](https://scan.coverity.com/projects/350)<br/>
 [![OSS-Fuzz Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/systemd.svg)](https://oss-fuzz-build-logs.storage.googleapis.com/index.html#systemd)<br/>
 [![CIFuzz](https://github.com/systemd/systemd/workflows/CIFuzz/badge.svg)](https://github.com/systemd/systemd/actions)<br/>
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1369/badge)](https://bestpractices.coreinfrastructure.org/projects/1369)<br/>
 [![Language Grade: C/C++](https://img.shields.io/lgtm/grade/cpp/g/systemd/systemd.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/systemd/systemd/context:cpp)<br/>
-[![CentOS CI - CentOS 7](https://jenkins-systemd.apps.ocp.ci.centos.org/buildStatus/icon?subject=CentOS%20CI%20-%20CentOS%207&job=upstream-centos7)](https://jenkins-systemd.apps.ocp.ci.centos.org/job/upstream-centos7/)<br/>
+[![CentOS CI - CentOS 8](https://jenkins-systemd.apps.ocp.ci.centos.org/buildStatus/icon?subject=CentOS%20CI%20-%20CentOS%208&job=upstream-centos8)](https://jenkins-systemd.apps.ocp.ci.centos.org/job/upstream-centos8/)<br/>
 [![CentOS CI - Arch](https://jenkins-systemd.apps.ocp.ci.centos.org/buildStatus/icon?subject=CentOS%20CI%20-%20Arch&job=upstream-vagrant-archlinux)](https://jenkins-systemd.apps.ocp.ci.centos.org/job/upstream-vagrant-archlinux/)<br/>
 [![CentOS CI - Arch (sanitizers)](https://jenkins-systemd.apps.ocp.ci.centos.org/buildStatus/icon?subject=CentOS%20CI%20-%20Arch%20(sanitizers)&job=upstream-vagrant-archlinux-sanitizers)](https://jenkins-systemd.apps.ocp.ci.centos.org/job/upstream-vagrant-archlinux-sanitizers/)<br/>
+[![CentOS CI - Rawhide (SELinux)](https://jenkins-systemd.apps.ocp.ci.centos.org/buildStatus/icon?subject=CentOS%20CI%20-%20Rawhide%20(SELinux)&job=upstream-vagrant-rawhide-selinux)](https://jenkins-systemd.apps.ocp.ci.centos.org/view/Upstream/job/upstream-vagrant-rawhide-selinux/)<br/>
 [![Fossies codespell report](https://fossies.org/linux/test/systemd-main.tar.gz/codespell.svg)](https://fossies.org/linux/test/systemd-main.tar.gz/codespell.html)</br>
+[![Coverage Status](https://coveralls.io/repos/github/systemd/systemd/badge.svg?branch=main)](https://coveralls.io/github/systemd/systemd?branch=main)</br>
 [![Packaging status](https://repology.org/badge/tiny-repos/systemd.svg)](https://repology.org/project/systemd/versions)
 
 ## Details
diff --git a/TODO b/TODO
index d31d003..2ae9aae 100644
--- a/TODO
+++ b/TODO
@@ -4,11 +4,6 @@ Bugfixes:
   manager or system manager can be always set. It would be better to reject
   them when parsing config.
 
-* userdbctl: "Password OK: yes" is shown even when there are no passwords
-  or the password is locked.
-
-* Get rid of nftw(). We should refuse to use such useless APIs on principle.
-
 * Jun 01 09:43:02 krowka systemd[1]: Unit [e-mail] has alias user@.service.
   Jun 01 09:43:02 krowka systemd[1]: Unit [e-mail] has alias user@.service.
   Jun 01 09:43:02 krowka systemd[1]: Unit [e-mail] has alias user-runtime-dir@.service.
@@ -36,6 +31,7 @@ External:
 * zsh shell completion:
   - <command> <verb> -<TAB> should complete options, but currently does not
   - systemctl add-wants,add-requires
+  - systemctl reboot --boot-loader-entry=
 
 * systemctl status should know about 'systemd-analyze calendar ... --iterations='
 * If timer has just OnInactiveSec=..., it should fire after a specified time
@@ -83,12 +79,481 @@ Janitorial Clean-ups:
 
 Features:
 
+* homed/userdb: maybe define a "companion" dir for home directories where apps
+  can safely put privileged stuff in. Would not be writable by the user, but
+  still conceptually belong to the user. Would be included in user's quota if
+  possible, even if files are not owned by UID of user. Usecase: container
+  images that owned by arbitrary UIDs, and are owned/managed by the users, but
+  are not directly belonging to the user's UID. Goal: we shouldn't place more
+  privileged dirs inside of unprivileged dirs, and thus containers really
+  should not be placed inside of traditional UNIX home dirs (which are owned by
+  users themselves) but somewhere else, that is separate, but still close
+  by. Inform user code about path to this companion dir via env var, so that
+  container managers find it. the ~/.identity file is also a candidate for a
+  file to move there, since it is managed by privileged code (i.e. homed) and
+  not unprivileged code.
+
+* given that /etc/ssh/ssh_config.d/ is a thing now, ship a drop-in for that
+  that hooks up userbdctl ssh-key stuff.
+
+* allow embedding a signature blob for PCR hashes into separate section in
+  unified kernel binaries. This section should be picked up by sd-stub, and
+  passed in a file to the booted kernel (via initrd cpio, as usual). Usecase:
+  this way we can implement disk encryption policies that bind to specific
+  kernel PCR state, without breaking things on every kernel update. As long as
+  the kernel includes the PCR signature blob we should be good, as disk
+  encryption can then pass the signature to the TPM to unlock their secrets.
+  Why do this via a separate PE section? That's because the PCR state depends
+  on the measured kernel/initrd of course, thus we cannot put the signature
+  into the kernel/initrd itself, because that would require a time machine.
+  Hence we have to find a separate place. A simple solution is a PE section
+  of its own, because then it is next to the kernel and initrd which after all
+  are stored in PE sections of their own too. Building a unified kernel would
+  thus mean, calculating PCR values for the raw kernel image, and raw initrd
+  image, then signing those PCR values with a vendor key, and then combining
+  sd-stub, raw kernel image, raw initrd, and PCR signature into a unified
+  kernel image.
+
+* a new tool "systemd-trust" or so, that can calculate PCR hashes offline, and
+  optionally sign them. for that we should extend our syntax for specifying pcr
+  policies (e.g. the string like "4+7+9") so that it can also include explicit
+  hash values, i.e.
+  4=sha256:0ef149998289474e4bb31813edda6ad7f3c991b2d8dec6e8fe4db7a1f039f2d1+7=sha256:87428fc522803d31065e7bce3cf03fe475096631e5e07bbd7a0fde60c4cf25c7+9=sha256:0263829989b6fd954f72baaf2fc64bc2e2f01d692d4de72986ea808f6e99813f
+  and file names to calculate hashes from, i.e.
+  4=file:/boot/vmlinuz+7=file:/boot/initrd/+9=file:/etc/fstab"
+  The systemd-trust tool should then be able to resolve any "underspecifed"
+  form into the form with explicit hash values.
+
+* maybe add support for binding and connecting AF_UNIX sockets in the file
+  system outside of the 108ch limit. When connecting, open O_PATH fd to socket
+  inode first, then connect to /proc/self/fd/XYZ. When binding, create symlink
+  to target dir in /tmp, and bind through it.
+
+* tmpfiles: for f/F/w lines, if the argument columns is left unspecified, look
+  for a service credential named after the file path to write to, and load
+  contents to write from there. Usecase: provision arbitrary files from
+  credentials. Example use: with a line like "f /root/.ssh/authorized-keys
+  0644 root root" in a tmpfiles.d/ snippet add
+  LoadCredential=root.ssh.authorized-keys via drop-in to
+  systemd-tmpfiles.service, and then provision an SSH access key through
+  nspawn's --load-credential=, through qemu's fw_cfg, or via systemd-stub's
+  credntial pick-up. The latter is particularly interesting to implement SSH
+  access to an initrd.
+
+* systemd-homed: when initializing, look for a credential sysemd.homed.register
+  or so with JSON user records to automatically register if not registered yet.
+  Usecase: deploy a system, and add an account one can directly log into.
+
+* add a proper concept of a "developer" mode, i.e. where cryptographic
+  protections of the root OS are weakened after interactive confirmation, to
+  allow hackers to allow their own stuff. idea: allow entering developer mode
+  only via explicit choice in boot menu: i.e. add explicit boot menu item for
+  it. when developer mode is entered generate a key pair in the TPM2, and add
+  the public part of it automatically to keychain of valid code signature keys
+  on subsequent boots. Then provide a tool to sign code with the key in the
+  TPM2. Ensure that boot menu item is only way to enter developer mode, by
+  binding it to locality/PCRs so that that keys cannot be generated otherwise.
+
+* services: add support for cryptographically unlocking per-service directories
+  via TPM2. Specifically, for StateDirectory= (and related dirs) use fscrypt to
+  set up the directory so that it can only be accessed if host and app are in
+  order.
+
+* TPM2: add auth policy for signed PCR values to make updates easy. i.e. do
+  what tpm2_policyauthorize tool does.  To be truly useful scheme needs to be a
+  bit more elaborate though: policy probably must take some nvram based
+  generation counter into account that can only monotonically increase and can
+  be used to invalidate old PCR signatures. Otherwise people could downgrade to
+  old signed PCR sets whenever they want. Usecase: encrypt the rootfs with LUKS
+  with a key that can only be unlocked via a pristine pre-built Fedora
+  kernel+initrd.
+
+* update HACKING.md to suggest developing systemd with the ideas from:
+  https://0pointer.net/blog/testing-my-system-code-in-usr-without-modifying-usr.html
+  https://0pointer.net/blog/running-an-container-off-the-host-usr.html
+
+* add a clear concept how the initrd can make up credentials on their own to
+  pass to the system when transitioning into the host OS. usecase: things like
+  cloud-init/ignitation and similar can parameterize the host with data they
+  acquire.
+
+* Add ConditionCredentialExists= or so, that allows conditionalizing services
+  depending on whether a specific system credential is set. Usecase: a service
+  similar to the ssh keygen service that installs any SSH host key supplied via
+  system credentials into /etc/ssh.
+
+* drop support for kernels that lack ambient capabilities support (i.e. make
+  4.3 new baseline). Then drop support for "!!" modifier for ExecStart= which
+  is only supported for such old kernels
+
+* sd-event: compat wd reuse in inotify code: keep a set of removed watch
+  descriptors, and clear this set piecemeal when we see the IN_IGNORED event
+  for it, or when read() returns EAGAIN or on IN_Q_OVERFLOW. Then, whenever we
+  see an inotify wd event check against this set, and if it is contained ignore
+  the event. (to be fully correct this would have to count the occurrences, in
+  case the same wd is reused multiple times before we start processing
+  IN_IGNORED again)
+
+* sd-stub: set efi var indicating stub features, i.e. whether they pick up
+  creds, sysexts and so on. similar to existing variable of sd-boot
+
+* sd-stub: set efi vars declaring TPM PCRs we measured creds/cmdline + sysext
+  into (even if we hardcode them)
+
+* systemd-fstab-generator: support addition mount specifications via kernel
+  cmdline. Usecase: invoke a VM, and mount a host homedir into it via
+  virtio-fs.
+
+* for vendor-built signed initrds:
+  - make sysext run in the initrd
+  - sysext should pick up sysext images from /.extra/ in the initrd, and insist
+    on verification if in secureboot mode
+  - kernel-install should be able to install pre-built unified kernel images in
+    type #2 drop-in dir in the ESP.
+  - kernel-install should be able install encrypted creds automatically for
+    machine id, root pw, rootfs uuid, resume partition uuid, and place next to
+    EFI kernel, for sd-stub to pick them up. These creds should be locked to
+    the TPM, and bind to the right PCR the kernel is measured to.
+  - kernel-install should be able to pick up initrd sysexts automatically and
+    place them next to EFI kernel, for sd-stub to pick them up.
+  - systemd-fstab-generator should look for rootfs device to mount in creds
+  - pid 1 should look for machine ID in creds
+  - systemd-resume-generator should look for resume partition uuid in creds
+  - sd-stub: automatically pick up microcode from ESP (/loader/microcode/*)
+    and synthesize initrd from it, and measure it. Signing is not necessary, as
+    microcode does that on its own. Pass as first initrd to kernel.
+  - sd-stub should measure the kernel/initrd/… into a separate PCR, so that we
+    have one PCR we can bind the encrypted creds to that is not effected by
+    anything else but what we drop in via kernel-install, i.e. by earlier EFI
+    code running (i.e. like PCR 4)
+
+* Add a new service type very similar to Type=notify, that goes one step
+  further and extends the protocol to cover reloads. Specifically, SIGHUP will
+  become the official way to reload, and daemon has to respond with sd_notify()
+  to report when it starts reloading, and when it is complete reloading. Care
+  must be taken to remove races from this model. I.e. PID 1 needs to take
+  CLOCK_MONOTONIC, then send SIGHUP, then wait for at least one RELOADING=1
+  message that comes with a newer timestamp, then wait for a READY=1 message.
+  while we are at it, also maybe extend the logic to require handling of some
+  specific SIGRT signal for setting debug log level, that carries the level via
+  the sigqueue() data parameter. With that we extended with minimal logic the
+  service runtime logic quite substantially.
+
+* firstboot: maybe just default to C.UTF-8 locale if nothing is set, so that we
+  don't query this unnecessarily in entirely uninitialized
+  containers. (i.e. containers with empty /etc).
+
+* beef up sd_notify() to support AV_VSOCK in $NOTIFY_SOCKET, so that VM
+  managers can get ready notifications from VMs, just like container managers
+  from their payload. Also pick up address from qemu/fw_cfg if set there.
+  (which has benefits, given SecureBoot and kernel cmdline are not necessarily
+  friends.)
+
+* mirroring this: maybe support binding to AV_VSOCK in Type=notify services,
+  then passing $NOTIFY_SOCKET and $NOTIFY_GUESTCID with PID1's cid (typically
+  fixed to "2", i.e. the official host cid) and the expected guest cid, for the
+  two sides of the channel. The latter env var could then be used in an
+  appropriate qemu cmdline. That way qemu payloads could talk sd_notify()
+  directly to host service manager.
+
+* maybe write a tool that binds an AF_VFSOCK socket, then invokes qemu,
+  extending the command line to enable vsock on the VM, and using fw_cfg to
+  configure socket address.
+
+* sd-boot: rework random seed handling following recent kernel changes: always
+  pass seed to kernel, but credit only if secure boot is used
+
+* sd-boot: hash data from GetNextHighMonotonicCount() into updated random seed,
+  so that we might even open up up the random seed logic to non-SecureBoot
+  systems?
+
+* sd-boot: also include the hyperv "vm generation id" in the random seed hash,
+  to cover nicely for machine clones. It's found in the ACPI tables, which
+  should be easily accessible from UEFI.
+
+* sd-boot: add menu item for shutdown? or hotkey?
+
+* sd-device has an API to create an sd_device object from a device id, but has
+  no api to query the device id
+
+* sd-device should return the devnum type (i.e. 'b' or 'c') via some API for an
+  sd_device object, so that data passed into sd_device_new_from_devnum() can
+  also be queried.
+
+* sd-event: optionally, if per-event source rate limit is hit, downgrade
+  priority, but leave enabled, and once ratelimit window is over, upgrade
+  priority again. That way we can combat event source starvation without
+  stopping processing events from one source entirely.
+
+* sd-event: similar to existing inotify support add fanotify support (given
+  that apparently new features in this area are only going to be added to the
+  latter).
+
+* sd-event: add 1st class event source for clock changes
+
+* sd-event: add 1st class event source for timezone changes
+
+* support uefi/http boots with sd-boot: instead of looking for dropin files in
+  /loader/entries/ dir, look for a file /loader/entries/SHA256SUMS and use that
+  as directory manifest. The file would be a standard directory listing as
+  generated by GNU sha256sums.
+
+* sd-boot: maybe add support for embedding the various auxiliary resources we
+  look for right in the sd-boot binary. i.e. take inspiration from sd-stub
+  logic: allow combining sd-boot via objcopy with kernels to enumerate, .conf
+  files, drivers, keys to enroll and so on. Then, add whatever we find that way
+  to the menu. Usecase: allow building a single PE image you can boot into via
+  UEFI HTTP boot.
+
+* maybe add a new UEFI stub binary "sd-http". It works similar to sd-stub, but
+  all it does is download a file from a http server, and execute it, after
+  optionally checking its hash sum. idea would be: combine this "sd-http" stub
+  binary with some minimal info about an URL + hash sum, plus .osrel data, and
+  drop it into the unified kernel dir in the ESP. And bam you have something
+  that is tiny, feels a lot like a unified kernel, but all it does is chainload
+  the real kernel. benefit: downloading these stubs would be tiny and quick,
+  hence cheap for enumeration.
+
+* initialize machine ID from systemd credential picked up from the ESP via
+  sd-stub, so that machine ID is stable even on systems where unified kernels
+  are used, and hence kernel cmdline cannot be modified locally
+
+* in gpt-auto-generator: check partition uuids against such uuids supplied via
+  sd-stub credentials. That way, we can support parallel OS installations with
+  pre-built kernels.
+
+* sysext: measure all activated sysext into a TPM PCR
+
+* maybe add a "syscfg" concept, that is almost entirely identical to "sysext",
+  but operates on /etc/ instead of /usr/ and /opt/. Use case would be: trusted,
+  authenticated, atomic, additive configuration management primitive: drop in a
+  configuration bundle, and activate it, so that it is instantly visible,
+  comprehensively.
+
+* systemd-dissect: show available versions inside of a disk image, i.e. if
+  multiple versions are around of the same resource, show which ones. (in other
+  words: show partition labels).
+
+* systemd-nspawn: make boot assessment do something sensible in a
+  container. i.e send an sd_notify() from payload to container manager once
+  boot-up is completed successfully, and use that in nspawn for dealing with
+  boot counting, implemented in the partition table labels and directory names.
+
+* maybe add a generator that reads /proc/cmdline, looks for
+  systemd.pull-raw-portable=, systemd-pull-raw-sysext= and similar switches
+  that take an URL as parameter. It then generates service units for
+  systemd-pull calls that download these URLs if not installed yet. usecase:
+  invoke a VM or nspawn container in a way it automatically deploys/runs these
+  images as OS payloads. i.e. have a generic OS image you can point to any
+  payload you like, which is then downloaded, securely verified and run.
+
+* improve scope units to support creation by pidfd instead of by PID
+
+* deprecate cgroupsv1 further (print log message at boot)
+
+* systemd-dissect: add --cat switch for dumping files such as /etc/os-release
+
+* per-service sandboxing option: ProtectIds=. If used, will overmount
+  /etc/machine-id and /proc/sys/kernel/random/boot_id with synthetic files, to
+  make it harder for the service to identify the host. Depending on the user
+  setting it should be fully randomized at invocation time, or a hash of the
+  real thing, keyed by the unit name or so. Of course, there are other ways to
+  get these IDs (e.g. journal) or similar ids (e.g. MAC addresses, DMI ids, CPU
+  ids), so this knob would only be useful in combination with other lockdown
+  options. Particularly useful for portable services, and anything else that
+  uses RootDirectory= or RootImage=. (Might also over-mount
+  /sys/class/dmi/id/*{uuid,serial} with /dev/null).
+
+* journalctl/timesyncd: whenever timesyncd acquires a synchronization from NTP,
+  create a structured log entry that contains boot ID, monotonic clock and
+  realtime clock (I mean, this requires no special work, as these three fields
+  are implicit). Then in journalctl when attempting to display the realtime
+  timestamp of a log entry, first search for the closest later log entry
+  of this kinda that has a matching boot id, and convert the monotonic clock
+  timestamp of the entry to the realtime clock using this info. This way we can
+  retroactively correct the wallclock timestamps, in particular for systems
+  without RTC, i.e. where initially wallclock timestamps carry rubbish, until
+  an NTP sync is acquired.
+
+* kernel-install:
+  - add --all switch for rerunning kernel-install for all installed kernels
+  - maybe add env var that shortcuts kernel-install for installers that want to
+    call it at the end only
+
+* doc: prep a document explaining resolved's internal objects, i.e. Query
+  vs. Question vs. Transaction vs. Stream and so on.
+
+* doc: prep a document explaining PID 1's internal logic, i.e. transactions,
+  jobs, units
+
+* bootspec: remove tries counter from boot entry ids
+
+* bootspec: bring UEFI and userspace enumeration of bootspec entries back into
+  sync, i.e. parse out tries in both
+
+* automatically ignore threaded cgroups in cg_xyz().
+
+* add linker script that implicitly adds symbol for build ID and new coredump
+  json package metadata, and use that when logging
+
+* systemd-dissect: show GPT disk UUID in output
+
+* Enable RestricFileSystems= for all our long-running services (similar:
+  RestrictNetworkInterfaces=)
+
+* Add systemd-analyze security checks for RestrictFileSystems= and
+  RestrictNetworkInterfaces=
+
+* cryptsetup/homed: implement TOTP authentication backed by TPM2 and its
+  internal clock.
+
+* nspawn: optionally set up nftables/iptables routes that forward UDP/TCP
+  traffic on port 53 to resolved stub 127.0.0.54
+
+* man: rework os-release(5), and clearly separate our extension-release.d/ and
+  initrd-release parts, i.e. list explicitly which fields are about what.
+
+* sysext: before applying a sysext, do a superficial validation run so that
+  things are not rearranged to wildy. I.e. protect against accidental fuckups,
+  such as masking out /usr/lib/ or so. We should probably refuse if existing
+  inodes are replaced by other types of inodes or so.
+
+* sysext: ensure one can build a sysext that can safely apply to *any* system
+  (because it contains only static go binaries in /opt/ or so)
+
+* userdb: when synthesizing NSS records, pick "best" password from defined
+  passwords, not just the first. i.e. if there are multiple defined, prefer
+  unlocked over locked and prefer non-empty over empty.
+
+* maybe add a tool inspired by the GPT auto discovery spec that runs in the
+  initrd and rearranges the rootfs hierarchy via bind mounts, if
+  enabled. Specifically in some top-level dir /@auto/ it will look for
+  dirs/symlinks/subvolumes that are named after their purpose, and optionally
+  encode a version as well as assessment counters, and then mount them into the
+  file system tree to boot into, similar to how we do that for the gpt auto
+  logic. Maybe then bind mount the original root into /.superior or something
+  like that (so that update tools can look there). Further discussion in this
+  thread:
+  https://lists.freedesktop.org/archives/systemd-devel/2021-November/047059.html
+  The GPT dissection logic should automatically enable this tool whenever we
+  detect a specially marked root fs (i.e introduce a new generic root gpt type
+  for this, that is arch independent). The also implement this in the image
+  dissection logic, so that nspawn/RootImage= and so on grok it. Maybe make
+  generic enough so that it can also work for ostrees arrangements.
+
+* if a path ending in ".auto.d/" is set for RootDirectory=/RootImage= then do a
+  strverscmp() of everything inside that dir and use that. i.e. implement very
+  simple version control. Also use this in systemd-nspawn --image= and so on.
+
+* homed: while a home dir is not activated generate slightly different NSS
+  records for it, that reports the home dir as "/" and the shell as some binary
+  provided by us. Then, when an SSH login happens and SSH permits it our binary
+  is invoked. This binary can then talk to homed and activate the homedir if
+  it's not around yet, prompting the user for a password. Once that succeeded
+  we'll switch to the real user record, i.e. home dir and shell, and our tool
+  exec()s the latter. Net effect: ssh'ing into a homed account will just work:
+  we'll neatly prompt for the homedir's password if its needed. –– Building on
+  this we could take this even further: since this tool will potentially have
+  access to the client's ssh-agent (if ssh-agent forwarding is enabled) we
+  could implement SSH unlocking of a homedir with that: when enrolling a new
+  ssh pubkey in a user record we'd ask the ssh-agent to sign some random value
+  with the privkey, then use that as luks key to unlock the home dir. Will not
+  work for ECDSA keys since their signatures contain a random component, but
+  will work for RSA and Ed25519 keys.
+
+* add tiny service that decrypts encrypted user records passed via initrd
+  credential logic and drops them into /run where nss-systemd can pick them up,
+  similar to /run/host/userdb/. Usecase: drop a root user JSON record there,
+  and use it in the initrd to log in as root with locally selected password,
+  for debugging purposes. Other usecase: boot into qemu with regular user
+  mounted from host. maybe put this in systemd-user-sessions.service?
+
+* drop dependency on libcap, replace by direct syscalls based on
+  CapabilityQuintet we already have. (This likely allows us drop drop libcap
+  dep in the base OS image)
+
+* sysext: automatically activate sysext images dropped in via new sd-stub
+  sysext pickup logic.
+
+* add concept for "exitrd" as inverse of "initrd", that we can transition to at
+  shutdown, and has similar security semantics. This should then take the place
+  of dracut's shutdown logic. Should probably support sysexts too. Care needs
+  to be taken that the resulting logic ends up in RAM, i.e. is copied out of
+  on-disk storage.
+
+* userdbd: implement an additional varlink service socket that provides the
+  host user db in restricted form, then allow this to be bind mounted into
+  sandboxed environments that want the host database in minimal form. All
+  records would be stripped of all meta info, except the basic UID/name
+  info. Then use this in portabled environments that do not use PrivateUsers=1.
+
+* logind introduce two types of sessions: "heavy" and "light". The former would
+  be our current sessions. But the latter would be a new type of session that
+  is mostly the same but does not pull in user@.service or wait for it. Then,
+  allow configuration which type of session is desired via pam_systemd
+  parameters, and then make user@.service's session one of these "light" ones.
+  People could then choose to make FTP sessions and suchlike "light" if they
+  don't want the service manager to be started for that.
+
+* /etc/veritytab: allow that the roothash column can be specified as fs path
+  including a path to an AF_UNIX path, similar to how we do things with the
+  keys of /etc/crypttab. That way people can store/provide the roothash
+  externally and provide to us on demand only.
+
+* add high-level lockdown level for GPT dissection logic: e.g. an enum that can
+  be ANY (to mount anything), TRUSTED (to require that /usr is on signed
+  verity, but rest doesn't matter), LOCKEDDOWN (to require that everything is
+  on signed verity, except for ESP), SUPERLOCKDOWN (like LOCKEDDOWN but ESP not
+  allowed). And then maybe some flavours of that that declare what is expected
+  from home/srv/var… Then, add a new cmdline flag to all tools that parse such
+  images, to configure this. Also, add a kernel cmdline option for this, to be
+  honoured by the gpt auto generator.
+
+* nspawn: maybe optionally insert .nspawn file as GPT partition into images, so
+  that such container images are entirely stand-alone and can be updated as
+  one.
+
+* we probably should extend the root verity hash of the root fs into some PCR
+  on boot. (i.e. maybe add a crypttab option tpm2-measure=8 or so to measure it
+  into PCR 8)
+
+* add a "policy" to the dissection logic. i.e. a bit mask what is OK to mount,
+  what must be read-only, what requires encryption, and what requires
+  authentication.
+
+* in uefi stub: query firmware regarding which PCRs are being used, store that
+  in EFI var. then use this when enrolling TPM2 in cryptsetup to verify that
+  the selected PCRs actually are used by firmware.
+
+* rework recursive read-only remount to use new mount API
+
+* PAM: pick up authentication token from credentials
+
+* when mounting disk images: if IMAGE_ID/IMAGE_VERSION is set in os-release
+  data in the image, make sure the image filename actually matches this, so
+  that images cannot be misused.
+
 * New udev block device symlink names:
-  /dev/disk/by-parttypelabel/<pttype>/<ptlabel>. Use case: if pt label is used
+  /dev/disk/by-parttypelabel/<pttype>-<ptlabel>. Use case: if pt label is used
   as partition image version string, this is a safe way to reference a specific
   version of a specific partition type, in particular where related partitions
   are processed (e.g. verity + rootfs both named "LennartOS_0.7").
 
+* sysupdate:
+  - add fuzzing to the pattern parser
+  - support casync as download mechanism
+  - direct TPM2 PCR change handling, possible renrolling LUKS2 media if needed.
+  - "systemd-sysupdate update --all" support, that iterates through all components
+    defined on the host, plus all images installed into /var/lib/machines/,
+    /var/lib/portable/ and so on.
+  - figure out what to do about system extensions (i.e. they need to imply an
+    update component, since otherwise system extenion' sysupdate.d/ files would
+    override the host's update files.)
+  - Allow invocation with a single transfer definition, i.e. with
+    --definitions= pointing to a file rather than a dir.
+  - add ability to disable implicit decompression of downloaded artifacts,
+    i.e. a Compress=no option in the transfer definitions
+
 * in sd-id128: also parse UUIDs in RFC4122 URN syntax (i.e. chop off urn:uuid: prefix)
 
 * DynamicUser= + StateDirectory= → use uid mapping mounts, too, in order to
@@ -103,11 +568,6 @@ Features:
   https://github.com/dvdhrm/docs/blob/master/drm-howto/modeset.c for an example
   for doing that.
 
-* pass systemd-detect-virt result to generators as env var. Modifying behaviour
-  based on whether we are virtualized or not is a pretty common thing, hence
-  maybe just pass that info along for free in an env var. We cache the result
-  anyway, so it's basically free.
-
 * introduce /dev/disk/root/* symlinks that allow referencing partitions on the
   disk the rootfs is on in a reasonably secure way. (or maybe: add
   /dev/gpt-auto-{home,srv,boot,…} similar in style to /dev/gpt-auto-root as we
@@ -121,6 +581,13 @@ Features:
   our usual socket activation protocol. If passed path refers to AF_UNIX
   socket: connect() to it.
 
+* Similar, ConnectStream= which takes IP addresses and connects to them.
+
+* Similar, Load= which takes literal data in text or base64 format, and puts it
+  into a memfd, and passes that. This enables some fun stuff, such as embedding
+  bash scripts in unit files, by combining Load= with ExecStart=/bin/bash
+  /proc/self/fd/3
+
 * add a ConnectSocket= setting to service unit files, that may reference a
   socket unit, and which will connect to the socket defined therein, and pass
   the resulting fd to the service program via socket activation proto.
@@ -131,9 +598,6 @@ Features:
 * importd: support image signature verification with PKCS#7 + OpenBSD signify
   logic, as alternative to crummy gpg
 
-* sysext: optionally, if the merged trees allow it use bind mounts instead of
-  overlayfs
-
 * add "systemd-analyze debug" + AttachDebugger= in unit files: The former
   specifies a command to execute; the latter specifies that an already running
   "systemd-analyze debug" instance shall be contacted and execution paused
@@ -142,20 +606,23 @@ Features:
 
 * expose MS_NOSYMFOLLOW in various places
 
-* ability to insert trusted configuration and secrets into the boot parameters
-  of a kernel booting in a VM or on baremetal some way, via TPM
-  protection. idea:
-  1. pass via /proc/bootconfig
-  2. for secrets: put secrets in node of /proc/bootconfig, decrypt them via
-     TPM early on in PID 1, put them in $CREDENTIAL_PATH logic
-  3. for config: put signed data in node /proc/booconfig, validate via TPM
-     early on in PID 1, put data into /run/bootconfig/ as individual files
-  4. boot loader/stub should pick these up automatically from the boot loader
-     file systems
-
-* tpm2: support a PIN policy, i.e. allowing windows-style short authentication
-  passwords by using the TPM2 to enforce ratelimiting and such, use for
-  cryptsetup and homed
+* credentials system:
+  - acquire from EFI variable?
+  - acquire via via ask-password?
+  - acquire creds via keyring?
+  - pass creds via keyring?
+  - pass creds via memfd?
+  - acquire + decrypt creds from pkcs11?
+  - make systemd-cryptsetup acquire pw via creds logic
+  - make PAMName= acquire pw via creds logic
+  - make macsec/wireguard code in networkd read key via creds logic
+  - make gatwayd/remote read key via creds logic
+  - add sd_notify() command for flushing out creds not needed anymore
+  - make user manager instances create and use a user-specific key (the one in
+    /var/lib is root-only) and add --user switch to systemd-creds to use it
+
+* add tpm.target or so which is delayed until TPM2 device showed up in case
+  firmware indicates there is one.
 
 * Add concept for upgrading TPM2 enrollments, maybe a new switch
   --pcrs=4:<hash> or so, i.e. select a PCR to include in the hash, and then
@@ -166,9 +633,6 @@ Features:
 
 * introduce a new group to own TPM devices
 
-* cryptenroll: politely refuse enrolling new keys to homed volumes, since we
-  we cannot update identity info
-
 * cryptsetup: if only recovery keys are registered and no regular passphrases,
   ask user for "recovery key", not "passphrase"
 
@@ -177,9 +641,6 @@ Features:
 * cryptsetup: optionally, when run during boot-up and password is never
   entered, and we are on battery power (or so), power off machine again
 
-* cryptsetup: when FIDO2/PKCS#11/TPM2 token/chip didn't show up after some
-  time, abort the attempt, fallback to asking for pw
-
 * cryptsetup: when waiting for FIDO2/PKCS#11 token, tell plymouth that, and
   allow plymouth to abort the waiting and enter pw instead
 
@@ -195,19 +656,6 @@ Features:
   - cryptsetup-generator: allow specification of passwords in crypttab itself
   - support rd.luks.allow-discards= kernel cmdline params in cryptsetup generator
 
-* credentials system:
-  - maybe add AcquireCredential= for querying a cred via ask-password
-  - maybe try to acquire creds via keyring?
-  - maybe try to pass creds via keyring?
-  - maybe optionally pass creds via memfd
-  - maybe add support for decrypting creds via TPM
-  - maybe add support for decrypting/importing creds via pkcs11
-  - make systemd-cryptsetup acquire pw via creds logic
-  - make PAMName= acquire pw via creds logic
-  - make macsec/wireguard code in networkd read key via creds logic
-  - make gatwayd/remote read key via creds logic
-  - add sd_notify() command for flushing out creds not needed anymore
-
 * when configuring loopback netif, and it fails due to EPERM, eat up error if
   it happens to be set up alright already.
 
@@ -223,9 +671,6 @@ Features:
   address as conduit for some minimal connection metainfo, and use it to
   restore the "description" logic that kdbus used to have.
 
-* teach LoadCredential= the ability to load all files from a specified dir as
-  individual creds
-
 * systemd-analyze netif that explains predictable interface (or networkctl)
 
 * Add service setting to run a service within the specified VRF. i.e. do the
@@ -238,15 +683,10 @@ Features:
 * special case some calls of chase_symlinks() to use openat2() internally, so
   that the kernel does what we otherwise do.
 
-* make use of new glibc 2.32 APIs sigabbrev_np() and strerrorname_np().
-
-* add /etc/integritytab, to support dm-integrity setups. In particular those
-  with HMAC as hash function, so that we can have a protected /home without
-  encryption (leaving encryption to the individual dirs/homed).
+* add a new flag to chase_symlinks() that stops chasing once the first missing
+  component is found and then allows the caller to create the rest.
 
-* complement root=, rootflags=, rootfstype= with rootsubdir= which allows
-  mounting a subdir of the root fs as actual root. This can be used as
-  fstype-agnostic version of btrfs' rootflags=subvol=foobar.
+* make use of new glibc 2.32 APIs sigabbrev_np() and strerrorname_np().
 
 * if /usr/bin/swapoff fails due to OOM, log a friendly explanatory message about it
 
@@ -262,7 +702,6 @@ Features:
 
 * make us use dynamically fewer deps for containers in general purpose distros:
   o turn into dlopen() deps:
-    - elfutils (always)
     - p11-kit-trust (always)
     - kmod-libs (only when called from PID 1)
     - libblkid (only in RootImage= handling in PID 1, but not elsewhere)
@@ -289,8 +728,6 @@ Features:
 * seccomp: don't install filters for ABIs that are masked anyway for the
   specific service
 
-* seccomp: maybe merge all filters we install into one with that libseccomp API that allows merging.
-
 * busctl: maybe expose a verb "ping" for pinging a dbus service to see if it
   exists and responds.
 
@@ -298,20 +735,14 @@ Features:
   for "hibernate" partitions, that are exactly like swap partitions but only
   activated right before hibernation and thus never used for regular swapping.
 
-* by default, in systemd --user service bump the OOMAdjust to 100, as privs
-  allow so that systemd survives
-
 * socket units: allow creating a udev monitor socket with ListenDevices= or so,
   with matches, then activate app through that passing socket over
 
-* unify on openssl (as soon as OpenSSL 3.0 is out, and the Debian license
-  confusion is gone)
-  - port sd_id128_get_machine_app_specific() over from khash
-  - port resolved over from libgcrypt (DNSSEC code)
-  - port journald + fsprg over from libgcrypt
-  - port importd over from libgcrypt
-  - when that's done: kill khash.c
-  - when that's done: kill gnutls support in resolved
+* unify on openssl:
+  - kill gnutls support in resolved
+  - figure out what to do about libmicrohttpd, which has a hard dependency on
+    gnutls
+  - port fsprg over to a dlopen lib, then switch it to openssl
 
 * add growvol and makevol options for /etc/crypttab, similar to
   x-systemd.growfs and x-systemd-makefs.
@@ -371,9 +802,8 @@ Features:
   https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby-wake-sources
   at the end).
 
-* We should probably replace /var/log/README, /etc/rc.d/README with symlinks
-  that are linked to these places instead of copied. After all they are
-  constant vendor data.
+* We should probably replace /etc/rc.d/README with a symlink to doc
+  content. After all it is constant vendor data.
 
 * maybe add kernel cmdline params: to force random seed crediting
 
@@ -420,12 +850,10 @@ Features:
 * paranoia: whenever we process passwords, call mlock() on the memory
   first. i.e. look for all places we use free_and_erasep() and
   augment them with mlock(). Also use MADV_DONTDUMP.
+  Alternatively (preferably?) use memfd_secret().
 
 * Move RestrictAddressFamily= to the new cgroup create socket
 
-* support the bind/connect/sendmsg cgroup stuff for sandboxing, and possibly
-  patching around
-
 * maybe implicitly attach monotonic+realtime timestamps to outgoing messages in
   log.c and sd-journal-send
 
@@ -433,9 +861,6 @@ Features:
 
 * introduce per-unit (i.e. per-slice, per-service) journal log size limits.
 
-* sd-boot: automatically load EFI modules from some drop-in dir, so that people
-  can add in file system drivers and such
-
 * sd-boot: optionally, show boot menu when previous default boot item has
   non-zero "tries done" count
 
@@ -481,9 +906,7 @@ Features:
   selected user is resolvable in the service even if it ships its own /etc/passwd)
 
 * Fix DECIMAL_STR_MAX or DECIMAL_STR_WIDTH. One includes a trailing NUL, the
-  other doesn't. What a disaster. Probably to exclude it. Also
-  DECIMAL_STR_WIDTH should probably add an extra "-" into account for negative
-  numbers.
+  other doesn't. What a disaster. Probably to exclude it.
 
 * Check that users of inotify's IN_DELETE_SELF flag are using it properly, as
   usually IN_ATTRIB is the right way to watch deleted files, as the former only
@@ -551,8 +974,6 @@ Features:
   systemd-journald writes to /var/log/journal, which could be useful when we
   doing disk usage calculations and so on.
 
-* taint systemd if there are fewer than 65536 users assigned (userns) to the system.
-
 * deprecate RootDirectoryStartOnly= in favour of a new ExecStart= prefix char
 
 * add a new RuntimeDirectoryPreserve= mode that defines a similar lifecycle for
@@ -583,7 +1004,7 @@ Features:
 * beef up pam_systemd to take unit file settings such as cgroups properties as
   parameters
 
-* maybe hook of xfs/ext4 quotactl() with services? i.e. automatically manage
+* maybe hook up xfs/ext4 quotactl() with services? i.e. automatically manage
   the quota of the user indicated in User= via unit file settings, like the
   other resource management concepts. Would mix nicely with DynamicUser=1. Or
   alternatively, do this with projids, so that we can also cover services
@@ -606,10 +1027,6 @@ Features:
 
   ReadWritePaths=:/var/lib/foobar
 
-* hostnamed: populate form factor data from a new hwdb database, so that old
-  yogas can be recognized as "convertible" too, even if they predate the DMI
-  "convertible" form factor
-
 * Add ExecMonitor= setting. May be used multiple times. Forks off a process in
   the service cgroup, which is supposed to monitor the service, and when it
   exits the service is considered failed by its monitor.
@@ -684,8 +1101,6 @@ Features:
 
 * when we detect that there are waiting jobs but no running jobs, do something
 
-* push CPUAffinity= also into the "cpuset" cgroup controller
-
 * PID 1 should send out sd_notify("WATCHDOG=1") messages (for usage in the --user mode, and when run via nspawn)
 
 * there's probably something wrong with having user mounts below /sys,
@@ -877,8 +1292,7 @@ Features:
   - add verification of [Install] section to systemd-analyze verify
 
 * timer units:
-  - timer units should get the ability to trigger when:
-    o DST changes
+  - timer units should get the ability to trigger when DST changes
   - Modulate timer frequency based on battery state
 
 * add libsystemd-password or so to query passwords during boot using the password agent logic
@@ -889,8 +1303,6 @@ Features:
 
 * make repeated alt-ctrl-del presses printing a dump
 
-* hostnamed: before returning information from /etc/machine-info.conf check the modification data and reread. Similar for localed, ...
-
 * currently x-systemd.timeout is lost in the initrd, since crypttab is copied into dracut, but fstab is not
 
 * add a pam module that passes the hdd passphrase into the PAM stack and then expires it, for usage by gdm auto-login.
@@ -914,10 +1326,8 @@ Features:
   ConditionConfigSearchPathNotEmpty= or different syntax? See the discussion starting at
   https://github.com/systemd/systemd/pull/15109#issuecomment-607740136.
 
-* BootLoaderSpec: Clarify that the kernel has to be in $BOOT. Clarify
-  that the boot loader should be installed to the ESP. Define a way
-  how an installer can figure out whether a BLS compliant boot loader
-  is installed.
+* BootLoaderSpec: Define a way how an installer can figure out whether a BLS
+  compliant boot loader is installed.
 
 * think about requeuing jobs when daemon-reload is issued? usecase:
   the initrd issues a reload after fstab from the host is accessible
@@ -932,9 +1342,6 @@ Features:
 
 * merge unit_kill_common() and unit_kill_context()
 
-* hw watchdog: optionally try to use the preset watchdog timeout instead of always overriding it
-  https://bugs.freedesktop.org/show_bug.cgi?id=54712
-
 * add a dependency on standard-conf.xml and other included files to man pages
 
 * MountFlags=shared acts as MountFlags=slave right now.
@@ -1010,14 +1417,16 @@ Features:
 
 * bootctl,sd-boot: actually honour the "architecture" key
 
-* sd-boot: add service that automatically runs "bootctl update" on every boot,
-  in a graceful way, so that updated /usr trees automatically propagate into
-  updated boot loaders on reboot.
-
 * bootctl:
+  - show whether UEFI audit mode is available
   - teach it to prepare an ESP wholesale, i.e. with mkfs.vfat invocation
   - teach it to copy in unified kernel images and maybe type #1 boot loader spec entries from host
   - make it operate on loopback files, dissecting enough to find ESP to operate on
+  - bootspec: properly support boot attempt counters when parsing entry file names
+  - support --quiet in is-installed, update
+
+* kernel-install:
+  - optionally, support generating type #2 entries instead of type #1, including signing them
 
 * logind:
   - logind: optionally, ignore idle-hint logic for autosuspend, block suspend as long as a session is around
@@ -1044,8 +1453,9 @@ Features:
   - follow PropertiesChanged state more closely, to deal with quick logouts and
     relogins
   - (optionally?) spawn seat-manager@$SEAT.service whenever a seat shows up that as CanGraphical set
-
-* move logind udev rules to top-level rule.d/ directory
+  - expose details of boot entries on the bus. In particular, it should be possible
+    to query the list of boot entry titles that bootctl / sd-boot would show.
+    Currently we only expose their identifiers.
 
 * move multiseat vid/pid matches from logind udev rule to hwdb
 
@@ -1155,8 +1565,6 @@ Features:
   - when user tries to log into record signed by unrecognized key, automatically add key to our chain after polkit auth
   - rollback when resize fails mid-operation
   - GNOME's side for forget key on suspend (requires rework so that lock screen runs outside of uid)
-  - resize on login?
-  - shrink fs on logout?
   - update LUKS password on login if we find there's a password that unlocks the JSON record but not the LUKS device.
   - create on activate?
   - properties: icon url?, preferred session type?, administrator bool (which translates to 'wheel' membership)?, address?, telephone?, vcard?, samba stuff?, parental controls?
@@ -1173,63 +1581,49 @@ Features:
   - make size of $XDG_RUNTIME_DIR configurable in user record
   - query password from kernel keyring first
   - update even if record is "absent"
-  - add a "access mode" + "fstype" field to the "status" section of json identity records reflecting the actually used access mode and fstype, even on non-luks backends
   - move acct mgmt stuff from pam_systemd_home to pam_systemd?
   - when "homectl --pkcs11-token-uri=" is used, synthesize ssh-authorized-keys records for all keys we have private keys on the stick for
   - make slice for users configurable (requires logind rework)
   - logind: populate auto-login list bus property from PKCS#11 token
   - when determining state of a LUKS home directory, check DM suspended sysfs file
-  - introduce API for "making room", that grows/shrinks home directory
-    according to elastic parameters, discards blocks, and removes additional snapshots. Call it
-    either from UI when disk space gets low
-
-* homed: during login resize fs automatically towards size goal. Specifically,
-  resize to diskSize if possible, but leave a certain amount (configured by a
-  new value diskLeaveFreeSize) of space free on the backing fs.
-
-* homed: permit multiple user record signing keys to be used locally, and pick
-  the right one for signing records automatically depending on a pre-existing
-  signature
-
-* homed: add a way to "adopt" a home directory, i.e. strip foreign signatures
-  and insert a local signature instead.
-
-* homed: as an extension to the directory+subvolume backend: if located on
-  especially marked fs, then sync down password into LUKS header of that fs,
-  and always verify passwords against it too. Bootstrapping is a problem
-  though: if no one is logged in (or no other user even exists yet), how do you
-  unlock the volume in order to create the first user and add the first pw.
-
-* homed: support new FS_IOC_ADD_ENCRYPTION_KEY ioctl for setting up fscrypt
-
-* homed: maybe pre-create ~/.cache as subvol so that it can have separate quota
-  easily?
-
-* homed: if kernel 5.12 uid mapping mounts exist, use that instead of recursive
-  chowns.
-
-* add a switch to homectl (maybe called --first-boot) where it will check if
-  any non-system users exist, and if not prompts interactively for basic user
-  info, mimicking systemd-firstboot. Then, place this in a service that runs
-  after systemd-homed, but before gdm and friends, as a simple, barebones
-  fallback logic to get a regular user created on uninitialized systems.
-
-* homed: store PKCS#11 + FIDO2 token info in LUKS2 header, compatible with
-  systemd-cryptsetup, so that it can unlock homed volumes
-
-* homed: try to unmount in regular intervals when home dir was busy when we
-  tried because idle.
-
-* homed: keep an fd to the homedir open at all times, to keep the fs pinned
-  (autofs and such) while user is logged in.
-
-* when we resize disks (homed?) always round up to 4K sectors, not 512K
+  - when homed is in use, maybe start the user session manager in a mount namespace with MS_SLAVE,
+    so that mounts propagate down but not up - eg, user A setting up a backup volume
+    doesn't mean user B sees it
+  - use credentials logic/TPM2 logic to store homed signing key
+  - permit multiple user record signing keys to be used locally, and pick
+    the right one for signing records automatically depending on a pre-existing
+    signature
+  - add a way to "adopt" a home directory, i.e. strip foreign signatures
+    and insert a local signature instead.
+  - as an extension to the directory+subvolume backend: if located on
+    especially marked fs, then sync down password into LUKS header of that fs,
+    and always verify passwords against it too. Bootstrapping is a problem
+    though: if no one is logged in (or no other user even exists yet), how do you
+    unlock the volume in order to create the first user and add the first pw.
+  - support new FS_IOC_ADD_ENCRYPTION_KEY ioctl for setting up fscrypt
+  - maybe pre-create ~/.cache as subvol so that it can have separate quota
+    easily?
+  - add a switch to homectl (maybe called --first-boot) where it will check if
+    any non-system users exist, and if not prompts interactively for basic user
+    info, mimicking systemd-firstboot. Then, place this in a service that runs
+    after systemd-homed, but before gdm and friends, as a simple, barebones
+    fallback logic to get a regular user created on uninitialized systems.
+  - store PKCS#11 + FIDO2 token info in LUKS2 header, compatible with
+    systemd-cryptsetup, so that it can unlock homed volumes
+  - maybe make all *.home files owned by `systemd-home` user or so, so that we
+    can easily set overall quota for all users
+  - on login, if we can't fallocate initially, but rebalance is on, then allow
+    login in discard mode, then immediately rebalance, then turn off discard
+  - extend user records with optional "bulk" data. Specifically, a user
+    avatar/photo or so. This data should be stored along with the user record,
+    but probably shouldn't be part of the record itself, since it might be
+    large.
 
 * add a new switch --auto-definitions=yes/no or so to systemd-repart. If
   specified, synthesize a definition automatically if we can: enlarge last
   partition on disk, but only if it is marked for growing and not read-only.
 
-* systemd-repart: read LUKS encryption key from $CREDENTIALS_PATH
+* systemd-repart: read LUKS encryption key from $CREDENTIALS_DIRECTORY
 
 * systemd-repart: add a switch to factory reset the partition table without
   immediately applying the new configuration again. i.e. --factory-reset=leave
@@ -1360,9 +1754,6 @@ Features:
   - optionally automatically add FORWARD rules to iptables whenever nspawn is
     running, remove them when shut down.
 
-* nspawn: make --bind= work sanely with --private-users when uid mapping mounts
-  are used.
-
 * nspawn: add support for sysext extensions, too. i.e. a new --extension=
   switch that takes one or more arguments, and applies the extensions already
   during startup.
diff --git a/catalog/meson.build b/catalog/meson.build
index 7139c2e..6a0a219 100644
--- a/catalog/meson.build
+++ b/catalog/meson.build
@@ -1,25 +1,24 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-in_files = '''
-        systemd.bg.catalog
-        systemd.be.catalog
-        [e-mail]
-        systemd.de.catalog
-        systemd.fr.catalog
-        systemd.it.catalog
-        systemd.pl.catalog
-        systemd.pt_BR.catalog
-        systemd.ru.catalog
-        systemd.zh_CN.catalog
-        systemd.zh_TW.catalog
-        systemd.catalog
-'''.split()
+in_files = [
+        'systemd.bg.catalog',
+        'systemd.be.catalog',
+        '[e-mail]',
+        'systemd.de.catalog',
+        'systemd.fr.catalog',
+        'systemd.it.catalog',
+        'systemd.pl.catalog',
+        'systemd.pt_BR.catalog',
+        'systemd.ru.catalog',
+        'systemd.zh_CN.catalog',
+        'systemd.zh_TW.catalog',
+        'systemd.catalog']
 
 support_url = get_option('support-url')
 support_sed = 's~%SUPPORT_URL%~@0@~'.format(support_url)
 
 foreach file : in_files
-        custom_target(
+        catalogs += custom_target(
                 file,
                 input : file + '.in',
                 output: file,
diff --git a/catalog/systemd.catalog.in b/catalog/systemd.catalog.in
index 3e08f56..a3f05c0 100644
--- a/catalog/systemd.catalog.in
+++ b/catalog/systemd.catalog.in
@@ -188,6 +188,15 @@ Support: %SUPPORT_URL%
 System shutdown has been initiated. The shutdown has now begun and
 all system services are terminated and all file systems unmounted.
 
+-- c14aaf76ec284a5fa1f105f88dfb061c
+Subject: System factory reset initiated
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+System factory reset has been initiated. The precise operation this
+executes is implementation-defined, but typically has the effect of
+reverting the system's state and configuration to vendor defaults.
+
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: A start job for unit @UNIT@ has begun execution
 Defined-By: systemd
@@ -517,3 +526,11 @@ be updated to operate in a hotplug fashion without depending on
 systemd-udev-settle.service:
 
     @OFFENDING_UNITS@
+
+-- 7c8a41f37b764941a0e1780b1be2f037
+Subject: Initial clock synchronization
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+For the first time during the current boot an NTP synchronization has been
+acquired and the local system clock adjustment has been initiated.
diff --git a/catalog/systemd.pl.catalog.in b/catalog/systemd.pl.catalog.in
index 58706f5..fce35ee 100644
--- a/catalog/systemd.pl.catalog.in
+++ b/catalog/systemd.pl.catalog.in
@@ -187,6 +187,16 @@ Support: %SUPPORT_URL%
 Zainicjowano wyłączenie systemu. Wyłączenie zostało rozpoczęte i wszystkie
 usługi systemowe zostały zakończone, a wszystkie systemy plików odmontowane.
 
+-- c14aaf76ec284a5fa1f105f88dfb061c
+Subject: Zainicjowano przywrócenie danych fabrycznych systemu
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Zainicjowano przywrócenie danych fabrycznych systemu. Dokładne działanie,
+jakie zostanie wykonane jest określone przez implementację, ale zwykle
+powoduje przywrócenie stanu i konfiguracji systemu do domyślnych wartości
+producenta.
+
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
 Subject: Rozpoczęto wykonywanie zadania uruchamiania dla jednostki @UNIT@
 Defined-By: systemd
@@ -524,3 +534,11 @@ o ich aktualizację tak, aby działały w sposób dynamiczny
 bez zależności od usługi systemd-udev-settle.service:
 
     @OFFENDING_UNITS@