Merge ~enr0n/ubuntu/+source/systemd:ubuntu-lunar into ~ubuntu-core-dev/ubuntu/+source/systemd:ubuntu-lunar

[Nick Rosbrook]

Merge 252.1-1 from Debian unstable. The package is built in my PPA: https://launchpad.net/~enr0n/+archive/ubuntu/systemd. I will post autopkgtest results here when they are ready.

[Lukas Märdian (slyon)]

Hi Nick! Thank you very much, this is looking good at first glance, skimming through it.

Here are my initial comments (more to come in a 2nd round review), let's also try to get those PPA autopkgtests fixed (upstream-2 & tests-in-lxd).

=== git diff pkg/import/252.1-1 -- . ':(exclude)debian/changelog' ':(exclude)debian/patches/*'

d/control:
+ systemd-sysv package => do we really need "Depends: systemd" if we have the pre-depends already? (well.. there's a versioned dependency..)

d/rules:
+ do we have any reference for that "CET on ubuntu amd64" enablement compiler issue/fix? we should add it to the comment

d/systemd.postinst:
+ I feel like we can drop all of that v234 delta, as we don't support upgrading from < Bionic to Lunar

d/systemd.prerm:
+ I don't think we support removing systemd at all... so I wonder why this file was dropped? Couldn't we just keep it, to reduce delta?

d/t/boot-and-services:
+ We should be able to unskip "test_service", as https://github.com/systemd/systemd/issues/20989 seems to be fixed in v251+

d/t/control:
+ boot-and-services: the "gdm3 [amd64]" dependency looks suspicious, why do we need to diverge from Debian here?
+ upstream-1, upstream-2: do we still need this libgcc-s1 test-dependency? Why isn't it needed in Debian? (maybe we should add a comment)

d/t/systemd-fsckd:
+ what's wrong with this test after all?? We're basically skipping/ignoring it, still we have a huge delta on it. This should probably be investigated in the future and we should drop the delta if we don't actually use it.

=== git diff pkg/ubuntu/devel -- debian/ ':(exclude)debian/patches/*'

d/t/control:
+ unit-tests: libqrencode-dev dependency on i386 (well.. I guess i386 adt tests are failing anyways...)
+ upstream-{1,2}: libqrencode-dev dependency on i386 (well.. I guess i386 adt tests are failing anyways...)

review: Needs Fixing

[Nick Rosbrook (enr0n)]

Thanks for taking a first pass!

> === git diff pkg/import/252.1-1 -- . ':(exclude)debian/changelog' ':(exclude)debian/patches/*'
>
> d/control:
> + systemd-sysv package => do we really need "Depends: systemd" if we have the pre-depends already? (well.. there's a versioned dependency..)

Please see https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=d1ecf0c372f5212129c85ae60fddf26b2271a1fe.

>
> d/rules:
> + do we have any reference for that "CET on ubuntu amd64" enablement compiler issue/fix? we should add it to the comment

I am not sure, the commit does not explain much: https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=cc42a377e7e8c372124bcf43d9f4fb9c169f4292.

>
> d/systemd.postinst:
> + I feel like we can drop all of that v234 delta, as we don't support upgrading from < Bionic to Lunar

Good idea, thanks.

>
> d/systemd.prerm:
> + I don't think we support removing systemd at all... so I wonder why this file was dropped? Couldn't we just keep it, to reduce delta?

Please see https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=0244c4d56556317f14eecc2f51871969ef02ba7b and bug 1758438.

> d/t/boot-and-services:
> + We should be able to unskip "test_service", as https://github.com/systemd/systemd/issues/20989 seems to be fixed in v251+

Good catch, thanks.

>
> d/t/control:
> + boot-and-services: the "gdm3 [amd64]" dependency looks suspicious, why do we need to diverge from Debian here?

Please see https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=97cb13685dfb353045c449ec5d6d1df60f661079. It does not contain a lot of information or an LP, but I don't feel very strongly about removing that delta.

> + upstream-1, upstream-2: do we still need this libgcc-s1 test-dependency? Why isn't it needed in Debian? (maybe we should add a comment)

Yes, the package is definitely still needed, and I believe it is best to be explicit since pthread calls dlopen() on it. See https://github.com/systemd/systemd/pull/23858 and https://github.com/systemd/systemd/pull/24178 for background. I think Debian does not hit this because their autopkgtest does not run upstream tests AFAICT.

>
> d/t/systemd-fsckd:
> + what's wrong with this test after all?? We're basically skipping/ignoring it, still we have a huge delta on it. This should probably be investigated in the future and we should drop the delta if we don't actually use it.

As far as why it's always skipped, it's because:

 autopkgtest [11:22:51]: test systemd-fsckd: [-----------------------
 SKIP: root file system is being checked by initramfs already
 autopkgtest [11:22:52]: test systemd-fsckd: -----------------------]

If it's always skipped in effect, maybe we can just drop the test entirely (and suggest that Debian does the same).

>
> === git diff pkg/ubuntu/devel -- debian/ ':(exclude)debian/patches/*'
>
> d/t/control:
> + unit-tests: libqrencode-dev dependency on i386 (well.. I guess i386 adt tests are failing anyways...)
> + upstream-{1,2}: libqrencode-dev dependency on i386 (well.. I guess i386 adt tests are failing anyways...)

Oh, yeah I didn't even notice. I will fix that for completenes...

[Nick Rosbrook (enr0n)]

I have addressed your comments so far in the latest push, and fixed the autopkgtests. Still waiting on a couple arches, but amd64 and ppc64el are passing:

systemd 252.1-1ubuntu1~ppa20 (amd64) -- Pass: https://autopkgtest.ubuntu.com/results/autopkgtest-lunar-enr0n-systemd/lunar/amd64/s/systemd/20221202_003224_d61ab@/log.gz
systemd 252.1-1ubuntu1~ppa20 (ppc64el) -- Pass: https://autopkgtest.ubuntu.com/results/autopkgtest-lunar-enr0n-systemd/lunar/ppc64el/s/systemd/20221201_232934_005ac@/log.gz

[Nick Rosbrook (enr0n)]

Here are the rest of the results:

systemd 252.1-1ubuntu1~ppa20 (arm64) -- Pass: https://autopkgtest.ubuntu.com/results/autopkgtest-lunar-enr0n-systemd/lunar/arm64/s/systemd/20221202_170155_b3f30@/log.gz
systemd 252.1-1ubuntu1~ppa20 (s390x) -- Fail: https://autopkgtest.ubuntu.com/results/autopkgtest-lunar-enr0n-systemd/lunar/s390x/s/systemd/20221202_154703_59391@/log.gz
systemd 252.1-1ubuntu1~ppa20 (armhf) -- Pass: https://autopkgtest.ubuntu.com/results/autopkgtest-lunar-enr0n-systemd/lunar/armhf/s/systemd/20221202_151651_7723b@/log.gz

The s390x failure looks flaky.

[Lukas Märdian (slyon)]

Thank you, autopkgtests are looking good now! I agree the s390x failure seems flaky.

The package LGTM mostly, now. I've added 3 small TODOs (see below), which I'd like you to have a look at before we upload and a bunch of "FUTURE WORK", which we should track somewhere for future investigations in our mission to reduce the delta.

> > d/control:
> > + systemd-sysv package => do we really need "Depends: systemd" if we have
> the pre-depends already? (well.. there's a versioned dependency..)
>
> Please see https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/c
> ommit/?id=d1ecf0c372f5212129c85ae60fddf26b2271a1fe.

ACK. Sorry for me not digging deep enough on some of my earlier comments (it was all a bit rushed) and thanks for providing the relevant links to git commits!

=== TODO ===

d/systemd-resolved.postinst:
+ Should we adapt to DPKG_ROOT now? (see 5664be0)

d/t/tests-in-lxd:
+ Please add a comment about not testing in privileged LXD containers anymore + reference to
bug #1950787 (especially @stgraber's comment) – I'm fine with only staging this for the next upload if we want to get the current version uploaded now.
+ How can we make sure systems still at least boot OK inside a privileged LXD container? IMO we should be adding a simple smoke test for privileged containers.

=== FUTURE WORK ===

(see some additional new comments for future work at the very bottom)

> > d/rules:
> > + do we have any reference for that "CET on ubuntu amd64" enablement
> compiler issue/fix? we should add it to the comment
>
> I am not sure, the commit does not explain much:
> https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=c
> c42a377e7e8c372124bcf43d9f4fb9c169f4292.

I feel like we should be creating a JIRA card about that, to investigate the situation in the future, would you mind creating such card? For now we'll keep the packaging as-is.

> > d/systemd.prerm:
> > + I don't think we support removing systemd at all... so I wonder why this
> file was dropped? Couldn't we just keep it, to reduce delta?
>
> Please see https://git.launchpad.net/~ubuntu-core-
> dev/ubuntu/+source/systemd/commit/?id=0244c4d56556317f14eecc2f51871969ef02ba7b
> and bug 1758438.

Thanks for providing the context (bug #1758438)! I feel like this is a workaround and we should rather try to get the chroot usecase properly fixed. Ideally in cooperation with Debian, as it might affect them as well. But let's but that burden on future-us (should we create a card about it, too? Maybe some "systemd technical-debt" card with a bunch of subtasks?).
We'll keep packaging as-is for now.

> > d/t/control:
> > + boot-and-services: the "gdm3 [amd64]" dependency looks suspicious, why do
> we need to diverge from Debian here?
>
> Please see https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/c
> ommit/?id=97cb13685dfb353045c449ec5d6d1df60f661079. It does not contain a lot
> of information or an LP, but I don't feel very strongly about removing that
> delta.

We should be striving to reduce delta whenever possible, so this is something for future investigation ("systemd technical-debt" card), too. Keeping it as-is for now.

> > d/t/systemd...

[Nick Rosbrook (enr0n)]

> d/systemd-resolved.postinst:
> + Should we adapt to DPKG_ROOT now? (see 5664be0)
>

Yes, good catch.

>
> d/t/tests-in-lxd:
> + Please add a comment about not testing in privileged LXD containers anymore + reference to
> bug #1950787 (especially @stgraber's comment) – I'm fine with only staging this for the next upload if we want to get the current version uploaded now.

I'll fix this (and the DPKG_ROOT in systemd-resolved.postinst) for this upload.

> + How can we make sure systems still at least boot OK inside a privileged LXD container? IMO we should be adding a simple smoke test for privileged containers.
>

The problem with that currently is that systemd-tmpfiles-*.service fail now in privileged LXD containers. One effect of this is that /var/run/utmp never gets created, and the runlevel command always returns "unknown". This breaks autopkgtest's logic for determining a test bed has "rebooted", which causes tests that run in privileged LXD containers to timeout "waiting for the test bed to reboot". I definitely don't want to override systemd-tmpfiles-*.service to remove the LoadCredential entries, so before we can add a smoke test like that back, I need to patch autopkgtest to use a non-sysvinit interface for accepting the reboot.

>
> === FUTURE WORK ===
>
> (see some additional new comments for future work at the very bottom)
>
> > > d/rules:
> > > + do we have any reference for that "CET on ubuntu amd64" enablement
> > compiler issue/fix? we should add it to the comment
> >
> > I am not sure, the commit does not explain much:
> > https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=c
> > c42a377e7e8c372124bcf43d9f4fb9c169f4292.
>
> I feel like we should be creating a JIRA card about that, to investigate the situation in the future, would you mind creating such card? For now we'll keep the packaging as-is.

Yes, I will create the JIRA card.

>
> > > d/systemd.prerm:
> > > + I don't think we support removing systemd at all... so I wonder why this
> > file was dropped? Couldn't we just keep it, to reduce delta?
> >
> > Please see https://git.launchpad.net/~ubuntu-core-
> > dev/ubuntu/+source/systemd/commit/?id=0244c4d56556317f14eecc2f51871969ef02ba7b
> > and bug 1758438.
>
> Thanks for providing the context (bug #1758438)! I feel like this is a workaround and we should rather try to get the chroot usecase properly fixed. Ideally in cooperation with Debian, as it might affect them as well. But let's but that burden on future-us (should we create a card about it, too? Maybe some "systemd technical-debt" card with a bunch of subtasks?).
> We'll keep packaging as-is for now.

Yes, I'll add this to JIRA as well.

>
> > > d/t/control:
> > > + boot-and-services: the "gdm3 [amd64]" dependency looks suspicious, why do
> > we need to diverge from Debian here?
> >
> > Please see https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/c
> > ommit/?id=97cb13685dfb353045c449ec5d6d1df60f661079. It does not contain a lot
> > of information or an LP, but I don't feel very strongly about removing that
> > delta.
>
> We should be striving to reduce delta whenever possible, so this is something for future inve...

[Lukas Märdian (slyon)]

Thank you LGTM! Let's get this uploaded.

review: Approve

diff --git a/.clang-format b/.clang-format
index 6aa4e6a..fe360a6 100644
--- a/.clang-format
+++ b/.clang-format
@@ -27,22 +27,22 @@
 AccessModifierOffset: -4
 AlignAfterOpenBracket: AlwaysBreak
 AlignEscapedNewlines: Left
-AlignOperands:   false
+AlignOperands: false
 AllowShortFunctionsOnASingleLine: None
 AlwaysBreakBeforeMultilineStrings: true
 AlwaysBreakTemplateDeclarations: Yes
 BinPackArguments: false
 BinPackParameters: false
 BraceWrapping:
-  AfterEnum:       false
+  AfterEnum: false
   SplitEmptyFunction: false
   SplitEmptyRecord: false
   SplitEmptyNamespace: false
 BreakBeforeBraces: Custom
-BreakInheritanceList: BeforeComma
 BreakBeforeTernaryOperators: false
+BreakInheritanceList: BeforeComma
 BreakStringLiterals: false
-ColumnLimit:     109
+ColumnLimit: 109
 CompactNamespaces: true
 ConstructorInitializerAllOnOneLineOrOnePerLine: true
 ConstructorInitializerIndentWidth: 8
@@ -107,7 +107,7 @@ ForEachMacros:
   - STRV_FOREACH_BACKWARDS
   - STRV_FOREACH_PAIR
 IndentPPDirectives: AfterHash
-IndentWidth:     8
+IndentWidth: 8
 IndentWrappedFunctionNames: true
 MaxEmptyLinesToKeep: 2
 PenaltyBreakAssignment: 65
@@ -117,8 +117,10 @@ PenaltyBreakFirstLessLess: 50
 PenaltyBreakString: 0
 PenaltyExcessCharacter: 10
 PenaltyReturnTypeOnItsOwnLine: 100
+PointerAlignment: Right
 SpaceAfterCStyleCast: true
+SpaceAroundPointerQualifiers: Both
 SpaceBeforeParens: ControlStatementsExceptForEachMacros
-SpacesInAngles:  true
-TabWidth:        8
-UseCRLF:         false
+SpacesInAngles: true
+TabWidth: 8
+UseCRLF: false
diff --git a/.github/ISSUE_TEMPLATE/Bug_report.md b/.github/ISSUE_TEMPLATE/Bug_report.md
deleted file mode 100644
index 592833e..0000000
--- a/.github/ISSUE_TEMPLATE/Bug_report.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-name: Bug report
-about: A report of an error in a recent systemd version
-SPDX-License-Identifier: LGPL-2.1-or-later
----
-
-**systemd version the issue has been seen with**
- > …
-
-<!-- **NOTE:** Do not submit bug reports about anything but the two most recently released *major* systemd versions upstream! -->
-<!--           If there have been multiple stable releases for that major version, please consider updating to a recent one before reporting an issue. -->
-<!--           When using a distro package, please make sure that the version reported is meaningful for upstream. -->
-<!-- See https://github.com/systemd/systemd-stable/tags for the list of most recent releases. -->
-<!-- For older version please use distribution trackers (see https://systemd.io/CONTRIBUTING#filing-issues). -->
-
-**Used distribution**
- > …
-
-**Linux kernel version used** (`uname -a`)
-<!-- Make sure to enclose the pasted kernel version in `backticks`, so that
-     GitHub doesn't convert the `#` character typically included in it into a
-     reference to old GitHub issues. -->
- > `…`
-
-**CPU architecture issue was seen on**
- > …
-
-**Expected behaviour you didn't see**
- > …
-
-**Unexpected behaviour you saw**
- > …
-
-**Steps to reproduce the problem**
- > …
-
-**Additional program output to the terminal or log subsystem illustrating the issue**
-
-<!-- Please paste relevant program terminal or journal output here, ideally
-     when generated in debug mode (try setting the SYSTEMD_LOG_LEVEL=debug
-     environment variable). For very long copy/pasted data consider using a
-     service like https://gist.github.com/. Where copy/paste is not possible
-     (for example early boot or late shutdown), a photo of the screen might do
-     too, but text is always much preferred. -->
-```text
-…
-```
diff --git a/.github/ISSUE_TEMPLATE/Feature_request.md b/.github/ISSUE_TEMPLATE/Feature_request.md
deleted file mode 100644
index ad9f447..0000000
--- a/.github/ISSUE_TEMPLATE/Feature_request.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-name: Feature request
-about: Suggest an improvement
-SPDX-License-Identifier: LGPL-2.1-or-later
----
-
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**The systemd version you checked that didn't have the feature you are asking for**
-<!-- If this is not the most recently released upstream version, then please check first if it has that feature already. -->
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..d25f5ea
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,183 @@
+name: Bug Report
+description: A report of an error in a recent systemd version
+labels: ["bug 🐛"]
+
+body:
+  - type: markdown
+    attributes:
+      value: Thanks for taking the time to fill out this bug report!
+
+  - type: input
+    id: version
+    attributes:
+      label: systemd version the issue has been seen with
+      description: |
+        Do not submit bug reports about anything but the two most recently released *major* systemd versions upstream!
+        If there have been multiple stable releases for that major version, please consider updating to a recent one before reporting an issue.
+        When using a distro package, please make sure that the version reported is meaningful for upstream.
+        If a distro build is used, please just paste the package version, e.g. `systemd-250.7-1.fc36.x86_64`.
+        See https://github.com/systemd/systemd-stable/tags for the list of most recent releases.
+        For older version please use distribution trackers (see https://systemd.io/CONTRIBUTING#filing-issues).
+      placeholder: '251'
+    validations:
+      required: true
+
+  - type: input
+    id: distro
+    attributes:
+      label: Used distribution
+      description: Used distribution and it's version
+      placeholder: Fedora 36
+    validations:
+      required: false
+
+  - type: input
+    id: kernel
+    attributes:
+      label: Linux kernel version used
+      description: |
+        Please use `uname -r` to get linux kernel version.
+      placeholder: 5.17.12-300.fc36.ppc64le
+    validations:
+      required: false
+
+  - type: dropdown
+    id: architecture
+    attributes:
+      label: CPU architectures issue was seen on
+      options:
+        - aarch64
+        - alpha
+        - arm
+        - i686
+        - ia64
+        - loongarch
+        - mips
+        - parisc
+        - ppc (big endian)
+        - ppc64 (big endian)
+        - ppc64le
+        - riscv64
+        - s390x
+        - sparc
+        - sparc64
+        - x86_64
+        - other
+    validations:
+      required: false
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      description: Please chose components related to this issue.
+      multiple: true
+      # When updating list of components please also update labeling policy
+      # policy: `.github/advanced-issue-labeler.yml`
+      options:
+        - 'bootctl'
+        - 'coredumpctl'
+        - 'homectl'
+        - 'hostnamectl'
+        - 'hardware database files'
+        - 'journalctl'
+        - 'kernel-install'
+        - 'loginctl'
+        - 'machinectl'
+        - 'networkctl'
+        - 'nss-resolve'
+        - 'oomctl'
+        - 'pam_systemd'
+        - 'pam_systemd_home'
+        - 'portablectl'
+        - 'resolvectl'
+        - 'rpm scriptlets'
+        - 'systemctl'
+        - 'systemd'
+        - 'systemd-analyze'
+        - 'systemd-ask-password'
+        - 'systemd-binfmt'
+        - 'systemd-boot'
+        - 'systemd-cgtop'
+        - 'systemd-coredump'
+        - 'systemd-cryptsetup'
+        - 'systemd-delta'
+        - 'systemd-env-generator'
+        - 'systemd-fsck'
+        - 'systemd-gpt-auto-generator'
+        - 'systemd-growfs'
+        - 'systemd-homed'
+        - 'systemd-hostnamed'
+        - 'systemd-hwdb'
+        - 'systemd-import'
+        - 'systemd-journal-gatewayd'
+        - 'systemd-journal-remote'
+        - 'systemd-journal-upload'
+        - 'systemd-journald'
+        - 'systemd-logind'
+        - 'systemd-machined'
+        - 'systemd-modules-load'
+        - 'systemd-network-generator'
+        - 'systemd-networkd'
+        - 'systemd-networkd-wait-online'
+        - 'systemd-nspawn'
+        - 'systemd-oomd'
+        - 'systemd-portabled'
+        - 'systemd-pstore'
+        - 'systemd-repart'
+        - 'systemd-resolved'
+        - 'systemd-rfkill'
+        - 'systemd-run'
+        - 'systemd-stub'
+        - 'systemd-sysctl'
+        - 'systemd-sysext'
+        - 'systemd-sysusers'
+        - 'systemd-sysv-generator'
+        - 'systemd-timedate'
+        - 'systemd-timesync'
+        - 'systemd-tmpfiles'
+        - 'systemd-udevd'
+        - 'systemd-userdb'
+        - 'systemd-veritysetup'
+        - 'systemd-xdg-autostart-generator'
+        - 'timedatectl'
+        - 'udevadm'
+        - 'udev rule files'
+        - 'userdbctl'
+        - 'tests'
+        - 'other'
+    validations:
+      required: false
+
+  - type: textarea
+    id: expected-behaviour
+    attributes:
+      label: Expected behaviour you didn't see
+    validations:
+      required: false
+
+  - type: textarea
+    id: unexpected-behaviour
+    attributes:
+      label: Unexpected behaviour you saw
+    validations:
+      required: false
+
+  - type: textarea
+    id: steps-to-reproduce
+    attributes:
+      label: Steps to reproduce the problem
+    validations:
+      required: false
+
+  - type: textarea
+    id: additional-information
+    attributes:
+      label: Additional program output to the terminal or log subsystem illustrating the issue
+      description: |
+        Please paste relevant program terminal or journal output here, ideally when generated in debug mode (try setting the `SYSTEMD_LOG_LEVEL=debug` environment variable).
+        For very long copy/pasted data consider using a service like https://gist.github.com/. Where copy/paste is not possible (for example early boot or late shutdown), a photo of the screen might do too, but text is always much preferred.
+      placeholder: This will be automatically formatted into code, so no need for backticks.
+      render: sh
+    validations:
+      required: false
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 0000000..1f24851
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,124 @@
+name: Feature request
+description: Suggest an improvement
+labels: ["RFE 🎁"]
+
+body:
+  - type: markdown
+    attributes:
+      value: Thanks for taking the time to fill out this feature request!
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      description: Please chose components related to this feature request.
+      multiple: true
+      # When updating list of components please also update labeling policy
+      # policy: `.github/advanced-issue-labeler.yml`
+      options:
+        - 'bootctl'
+        - 'coredumpctl'
+        - 'homectl'
+        - 'hostnamectl'
+        - 'hardware database files'
+        - 'journalctl'
+        - 'kernel-install'
+        - 'loginctl'
+        - 'machinectl'
+        - 'networkctl'
+        - 'nss-resolve'
+        - 'oomctl'
+        - 'pam_systemd'
+        - 'pam_systemd_home'
+        - 'portablectl'
+        - 'resolvectl'
+        - 'rpm scriptlets'
+        - 'systemctl'
+        - 'systemd'
+        - 'systemd-analyze'
+        - 'systemd-ask-password'
+        - 'systemd-binfmt'
+        - 'systemd-boot'
+        - 'systemd-cgtop'
+        - 'systemd-coredump'
+        - 'systemd-cryptsetup'
+        - 'systemd-delta'
+        - 'systemd-env-generator'
+        - 'systemd-fsck'
+        - 'systemd-gpt-auto-generator'
+        - 'systemd-growfs'
+        - 'systemd-homed'
+        - 'systemd-hostnamed'
+        - 'systemd-hwdb'
+        - 'systemd-import'
+        - 'systemd-journal-gatewayd'
+        - 'systemd-journal-remote'
+        - 'systemd-journal-upload'
+        - 'systemd-journald'
+        - 'systemd-logind'
+        - 'systemd-machined'
+        - 'systemd-modules-load'
+        - 'systemd-network-generator'
+        - 'systemd-networkd'
+        - 'systemd-networkd-wait-online'
+        - 'systemd-nspawn'
+        - 'systemd-oomd'
+        - 'systemd-portabled'
+        - 'systemd-pstore'
+        - 'systemd-repart'
+        - 'systemd-resolved'
+        - 'systemd-rfkill'
+        - 'systemd-run'
+        - 'systemd-stub'
+        - 'systemd-sysctl'
+        - 'systemd-sysext'
+        - 'systemd-sysusers'
+        - 'systemd-sysv-generator'
+        - 'systemd-timedate'
+        - 'systemd-timesync'
+        - 'systemd-tmpfiles'
+        - 'systemd-udevd'
+        - 'systemd-userdb'
+        - 'systemd-veritysetup'
+        - 'systemd-xdg-autostart-generator'
+        - 'timedatectl'
+        - 'udevadm'
+        - 'udev rule files'
+        - 'userdbctl'
+        - 'tests'
+        - 'other'
+    validations:
+      required: false
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Is your feature request related to a problem? Please describe
+      description: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+    validations:
+      required: false
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Describe the solution you'd like
+      description: A clear and concise description of what you want to happen.
+    validations:
+      required: false
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Describe alternatives you've considered
+      description: A clear and concise description of any alternative solutions or features you've considered.
+    validations:
+      required: false
+
+  - type: input
+    id: version
+    attributes:
+      label: The systemd version you checked that didn't have the feature you are asking for
+      description: If this is not the most recently released upstream version, then please check first if it has that feature already.
+      placeholder: '251'
+    validations:
+      required: false
diff --git a/.github/advanced-issue-labeler.yml b/.github/advanced-issue-labeler.yml
new file mode 100644
index 0000000..38388fb
--- /dev/null
+++ b/.github/advanced-issue-labeler.yml
@@ -0,0 +1,146 @@
+---
+# syntax - https://github.com/redhat-plumbers-in-action/advanced-issue-labeler#policy
+
+policy:
+  - template: [bug_report.yml, feature_request.yml]
+    section:
+      - id: [component]
+        block-list: [other]
+        label:
+          - name: analyze
+            keys: ['systemd-analyze']
+
+          - name: ask-password
+            keys: ['systemd-ask-password']
+
+          - name: binfmt
+            keys: ['systemd-binfmt']
+
+          - name: cgtop
+            keys: ['systemd-cgtop']
+
+          - name: coredump
+            keys: ['coredumpctl', 'systemd-coredump']
+
+          - name: cryptsetup
+            keys: ['systemd-cryptsetup']
+
+          - name: delta
+            keys: ['systemd-delta']
+
+          - name: env
+            keys: ['systemd-env-generator']
+
+          - name: fsck
+            keys: ['systemd-fsck']
+
+          - name: gpt-auto
+            keys: ['systemd-gpt-auto-generator']
+
+          - name: growfs
+            keys: ['systemd-growfs']
+
+          - name: homed
+            keys: ['systemd-homed', 'homectl', 'pam_systemd_home']
+
+          - name: hostname
+            keys: ['systemd-hostnamed', 'hostnamectl']
+
+          - name: hwdb
+            keys: ['systemd-hwdb', 'hardware database files']
+
+          - name: import
+            keys: ['systemd-import']
+
+          - name: journal
+            keys: ['systemd-journald', 'journalctl']
+
+          - name: journal-remote
+            keys: ['systemd-journal-remote', 'systemd-journal-upload', 'systemd-journal-gatewayd']
+
+          - name: kernel-install
+            keys: ['kernel-install']
+
+          - name: logind
+            keys: ['systemd-logind', 'loginctl', 'pam_systemd']
+
+          - name: machined
+            keys: ['systemd-machined', 'machinectl']
+
+          - name: modules-load
+            keys: ['systemd-modules-load']
+
+          - name: network
+            keys: ['systemd-networkd', 'networkctl', 'systemd-networkd-wait-online', 'systemd-network-generator']
+
+          - name: nspawn
+            keys: ['systemd-nspawn']
+
+          - name: oomd
+            keys: ['systemd-oomd', 'oomctl']
+
+          - name: pid1
+            keys: ['systemd']
+
+          - name: portabled
+            keys: ['systemd-portabled', 'portablectl']
+
+          - name: pstore
+            keys: ['systemd-pstore']
+
+          - name: repart
+            keys: ['systemd-repart']
+
+          - name: resolve
+            keys: ['systemd-resolved', 'resolvectl', 'nss-resolve']
+
+          - name: rfkill
+            keys: ['systemd-rfkill']
+
+          - name: rpm
+            keys: ['rpm scriptlets']
+
+          - name: run
+            keys: ['systemd-run']
+
+          - name: sd-boot/sd-stub/bootctl
+            keys: ['bootctl', 'systemd-boot', 'systemd-stub']
+
+          - name: sysctl
+            keys: ['systemd-sysctl']
+
+          - name: sysext
+            keys: ['systemd-sysext']
+
+          - name: systemctl
+            keys: ['systemctl']
+
+          - name: sysusers
+            keys: ['systemd-sysusers']
+
+          - name: sysv
+            keys: ['systemd-sysv-generator']
+
+          - name: tests
+            keys: ['tests']
+
+          - name: timedate
+            keys: ['systemd-timedate', 'timedatectl']
+
+          - name: timesync
+            keys: ['systemd-timesync']
+
+          - name: tmpfiles
+            keys: ['systemd-tmpfiles']
+
+          - name: udev
+            keys: ['systemd-udevd', 'udevadm', 'udev rule files']
+
+          - name: userdb
+            keys: ['systemd-userdb', 'userdbctl']
+
+          - name: veritysetup
+            keys: ['systemd-veritysetup']
+
+          - name: xdg-autostart
+            keys: ['systemd-xdg-autostart-generator']
diff --git a/.github/codeql-config.yml b/.github/codeql-config.yml
index 447e53b..7c01d32 100644
--- a/.github/codeql-config.yml
+++ b/.github/codeql-config.yml
@@ -9,4 +9,4 @@ queries:
   - name: Enable possibly useful queries which are disabled by default
     uses: ./.github/codeql-custom.qls
   - name: systemd-specific CodeQL queries
-    uses: ./.lgtm/cpp-queries/
+    uses: ./.github/codeql-queries/
diff --git a/.github/codeql-custom.qls b/.github/codeql-custom.qls
index 28a22d3..d35fbe3 100644
--- a/.github/codeql-custom.qls
+++ b/.github/codeql-custom.qls
@@ -10,12 +10,20 @@
 #   - https://github.com/github/codeql-action/issues/430#issuecomment-806092120
 #   - https://codeql.github.com/docs/codeql-cli/creating-codeql-query-suites/
 
+# Note: the codeql/<lang>-queries pack name can be found in the CodeQL repo[0]
+#       in <lang>/ql/src/qlpack.yml. The respective codeql-suites are then
+#       under <lang>/ql/src/codeql-suites/.
+#
+# [0] https://github.com/github/codeql
 - import: codeql-suites/cpp-lgtm.qls
   from: codeql/cpp-queries
+- import: codeql-suites/python-lgtm.qls
+  from: codeql/python-queries
 - include:
     id:
       - cpp/bad-strncpy-size
       - cpp/declaration-hides-variable
+      - cpp/include-non-header
       - cpp/inconsistent-null-check
       - cpp/mistyped-function-arguments
       - cpp/nested-loops-with-same-variable
diff --git a/.lgtm/cpp-queries/PotentiallyDangerousFunction.ql b/.github/codeql-queries/PotentiallyDangerousFunction.ql
similarity index 94%
rename from .lgtm/cpp-queries/PotentiallyDangerousFunction.ql
rename to .github/codeql-queries/PotentiallyDangerousFunction.ql
index 39e8ddd..d5a5635 100644
--- a/.lgtm/cpp-queries/PotentiallyDangerousFunction.ql
+++ b/.github/codeql-queries/PotentiallyDangerousFunction.ql
@@ -42,10 +42,13 @@ predicate potentiallyDangerousFunction(Function f, string message) {
     message = "Call to ntohs() is confusing. Use be16toh() instead."
   ) or (
     f.getQualifiedName() = "strerror" and
-    message = "Call to strerror() is not thread-safe. Use strerror_r() or printf()'s %m format string instead."
+    message = "Call to strerror() is not thread-safe. Use printf()'s %m format string or STRERROR() instead."
   ) or (
     f.getQualifiedName() = "accept" and
     message = "Call to accept() is not O_CLOEXEC-safe. Use accept4() instead."
+  ) or (
+    f.getQualifiedName() = "dirname" and
+    message = "Call dirname() is icky. Use path_extract_directory() instead."
   )
 }
 
diff --git a/.lgtm/cpp-queries/UninitializedVariableWithCleanup.ql b/.github/codeql-queries/UninitializedVariableWithCleanup.ql
similarity index 92%
rename from .lgtm/cpp-queries/UninitializedVariableWithCleanup.ql
rename to .github/codeql-queries/UninitializedVariableWithCleanup.ql
index 6b3b62f..e514111 100644
--- a/.lgtm/cpp-queries/UninitializedVariableWithCleanup.ql
+++ b/.github/codeql-queries/UninitializedVariableWithCleanup.ql
@@ -50,16 +50,16 @@ class UninitialisedLocalReachability extends StackVariableReachability {
    * fun(&x);
    * puts(x);
    *
-   * `useOfVarActual()` won't treat this an an uninitialized read even if the callee
+   * `useOfVarActual()` won't treat this as an uninitialized read even if the callee
    * doesn't modify the argument, however, `useOfVar()` will
    */
   override predicate isSink(ControlFlowNode node, StackVariable v) { useOfVar(v, node) }
 
   override predicate isBarrier(ControlFlowNode node, StackVariable v) {
-    // only report the _first_ possibly uninitialized use
+    /* only report the _first_ possibly uninitialized use */
     useOfVar(v, node) or
     (
-      /* If there's an return statement somewhere between the variable declaration
+      /* If there's a return statement somewhere between the variable declaration
        * and a possible definition, don't accept is as a valid initialization.
        *
        * E.g.:
@@ -71,7 +71,7 @@ class UninitialisedLocalReachability extends StackVariableReachability {
        * x = malloc(...);
        *
        * is not a valid initialization, since we might return from the function
-       * _before_ the actual iniitialization (emphasis on _might_, since we
+       * _before_ the actual initialization (emphasis on _might_, since we
        * don't know if the return statement might ever evaluate to true).
        */
       definitionBarrier(v, node) and
@@ -92,14 +92,14 @@ predicate containsInlineAssembly(Function f) { exists(AsmStmt s | s.getEnclosing
  * for this check to exclude them.
  */
 VariableAccess commonException() {
-  // If the uninitialized use we've found is in a macro expansion, it's
-  // typically something like va_start(), and we don't want to complain.
+  /* If the uninitialized use we've found is in a macro expansion, it's
+   * typically something like va_start(), and we don't want to complain. */
   result.getParent().isInMacroExpansion()
   or
   result.getParent() instanceof BuiltInOperation
   or
-  // Finally, exclude functions that contain assembly blocks. It's
-  // anyone's guess what happens in those.
+  /* Finally, exclude functions that contain assembly blocks. It's
+   * anyone's guess what happens in those. */
   containsInlineAssembly(result.getEnclosingFunction())
 }
 
diff --git a/.lgtm/cpp-queries/qlpack.yml b/.github/codeql-queries/qlpack.yml
similarity index 100%
rename from .lgtm/cpp-queries/qlpack.yml
rename to .github/codeql-queries/qlpack.yml
diff --git a/.github/pull_request_template.md.disabled b/.github/pull_request_template.md.disabled
new file mode 100644
index 0000000..a133346
--- /dev/null
+++ b/.github/pull_request_template.md.disabled
@@ -0,0 +1,5 @@
+# CODE FREEZE NOTICE
+
+An -rc1 tag has been created and a release is being prepared, so please note that
+PRs introducing new features and APIs will be held back until the new version
+has been released.
diff --git a/.github/workflows/build_test.sh b/.github/workflows/build_test.sh
index a43c343..b60db29 100755
--- a/.github/workflows/build_test.sh
+++ b/.github/workflows/build_test.sh
@@ -45,6 +45,7 @@ PACKAGES=(
     libxkbcommon-dev
     libxtables-dev
     libzstd-dev
+    mold
     mount
     net-tools
     perl
@@ -76,24 +77,27 @@ if [[ "$COMPILER" == clang ]]; then
     CXX="clang++-$COMPILER_VERSION"
     AR="llvm-ar-$COMPILER_VERSION"
 
-    # ATTOW llvm-11 got into focal-updates, which conflicts with llvm-11
-    # provided by the apt.llvm.org repositories. Let's use the system
-    # llvm package if available in such cases to avoid that.
+    # Prefer the distro version if available
     if ! apt install --dry-run "llvm-$COMPILER_VERSION" >/dev/null; then
         # Latest LLVM stack deb packages provided by https://apt.llvm.org/
         # Following snippet was partly borrowed from https://apt.llvm.org/llvm.sh
         wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | gpg --yes --dearmor --output /usr/share/keyrings/apt-llvm-org.gpg
         printf "deb [signed-by=/usr/share/keyrings/apt-llvm-org.gpg] http://apt.llvm.org/%s/   llvm-toolchain-%s-%s  main\n" \
                "$RELEASE" "$RELEASE" "$COMPILER_VERSION" >/etc/apt/sources.list.d/llvm-toolchain.list
-        PACKAGES+=("clang-$COMPILER_VERSION" "lldb-$COMPILER_VERSION" "lld-$COMPILER_VERSION" "clangd-$COMPILER_VERSION")
     fi
+
+    PACKAGES+=("clang-$COMPILER_VERSION" "lldb-$COMPILER_VERSION" "lld-$COMPILER_VERSION" "clangd-$COMPILER_VERSION")
 elif [[ "$COMPILER" == gcc ]]; then
     CC="gcc-$COMPILER_VERSION"
     CXX="g++-$COMPILER_VERSION"
     AR="gcc-ar-$COMPILER_VERSION"
-    # Latest gcc stack deb packages provided by
-    # https://launchpad.net/~ubuntu-toolchain-r/+archive/ubuntu/test
-    add-apt-repository -y ppa:ubuntu-toolchain-r/test
+
+    if ! apt install --dry-run "gcc-$COMPILER_VERSION" >/dev/null; then
+        # Latest gcc stack deb packages provided by
+        # https://launchpad.net/~ubuntu-toolchain-r/+archive/ubuntu/test
+        add-apt-repository -y ppa:ubuntu-toolchain-r/test
+    fi
+
     PACKAGES+=("gcc-$COMPILER_VERSION" "gcc-$COMPILER_VERSION-multilib")
 else
     fatal "Unknown compiler: $COMPILER"
@@ -118,27 +122,28 @@ ninja --version
 for args in "${ARGS[@]}"; do
     SECONDS=0
 
-    # meson fails with
-    #   src/boot/efi/meson.build:52: WARNING: Not using lld as efi-ld, falling back to bfd
-    #   src/boot/efi/meson.build:52:16: ERROR: Fatal warnings enabled, aborting
-    # when LINKER is set to lld so let's just not turn meson warnings into errors with lld
-    # to make sure that the build systemd can pick up the correct efi-ld linker automatically.
-
     # The install_tag feature introduced in 0.60 causes meson to fail with fatal-meson-warnings
     # "Project targeting '>= 0.53.2' but tried to use feature introduced in '0.60.0': install_tag arg in custom_target"
     # It can be safely removed from the CI since it isn't actually used anywhere to test anything.
     find . -type f -name meson.build -exec sed -i '/install_tag/d' '{}' '+'
-    if [[ "$LINKER" != lld ]]; then
-        additional_meson_args="--fatal-meson-warnings"
+
+    # mold < 1.1 does not support LTO.
+    if dpkg --compare-versions "$(dpkg-query --showformat='${Version}' --show mold)" ge 1.1; then
+        fatal "Newer mold version detected, please remove this workaround."
+    elif [[ "$args" == *"-Db_lto=true"* ]]; then
+        LD="gold"
+    else
+        LD="$LINKER"
     fi
+
     info "Checking build with $args"
     # shellcheck disable=SC2086
     if ! AR="$AR" \
-         CC="$CC" CC_LD="$LINKER" CFLAGS="-Werror" \
-         CXX="$CXX" CXX_LD="$LINKER" CXXFLAGS="-Werror" \
+         CC="$CC" CC_LD="$LD" CFLAGS="-Werror" \
+         CXX="$CXX" CXX_LD="$LD" CXXFLAGS="-Werror" \
          meson -Dtests=unsafe -Dslow-tests=true -Dfuzz-tests=true --werror \
-               -Dnobody-group=nogroup $additional_meson_args \
-               -Dcryptolib="${CRYPTOLIB:?}" $args build; then
+               -Dnobody-group=nogroup -Dcryptolib="${CRYPTOLIB:?}" \
+               $args build; then
 
         cat build/meson-logs/meson-log.txt
         fatal "meson failed with $args"
diff --git a/.github/workflows/build_test.yml b/.github/workflows/build_test.yml
index 94fb677..cd6937e 100644
--- a/.github/workflows/build_test.yml
+++ b/.github/workflows/build_test.yml
@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     concurrency:
       group: ${{ github.workflow }}-${{ toJSON(matrix.env) }}-${{ github.ref }}
       cancel-in-progress: true
@@ -25,11 +25,11 @@ jobs:
       fail-fast: false
       matrix:
         env:
-          - { COMPILER: "gcc",   COMPILER_VERSION: "10", LINKER: "bfd",  CRYPTOLIB: "gcrypt"  }
-          - { COMPILER: "gcc",   COMPILER_VERSION: "11", LINKER: "gold", CRYPTOLIB: "openssl" }
-          - { COMPILER: "clang", COMPILER_VERSION: "12", LINKER: "gold", CRYPTOLIB: "gcrypt"  }
-          - { COMPILER: "clang", COMPILER_VERSION: "13", LINKER: "lld",  CRYPTOLIB: "openssl" }
-          - { COMPILER: "clang", COMPILER_VERSION: "14", LINKER: "bfd",  CRYPTOLIB: "auto"    }
+          - { COMPILER: "gcc",   COMPILER_VERSION: "11", LINKER: "bfd",  CRYPTOLIB: "gcrypt"  }
+          - { COMPILER: "gcc",   COMPILER_VERSION: "12", LINKER: "gold", CRYPTOLIB: "openssl" }
+          - { COMPILER: "clang", COMPILER_VERSION: "13", LINKER: "mold", CRYPTOLIB: "gcrypt"  }
+          - { COMPILER: "clang", COMPILER_VERSION: "14", LINKER: "lld",  CRYPTOLIB: "openssl" }
+          - { COMPILER: "clang", COMPILER_VERSION: "15", LINKER: "bfd",  CRYPTOLIB: "auto"    }
     env: ${{ matrix.env }}
     steps:
       - name: Repository checkout
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index f674d43..25731ab 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -25,12 +25,16 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'systemd/systemd'
     concurrency:
-      group: ${{ github.workflow }}-${{ matrix.sanitizer }}-${{ github.ref }}
+      group: ${{ github.workflow }}-${{ matrix.sanitizer }}-${{ matrix.architecture }}-${{ github.ref }}
       cancel-in-progress: true
     strategy:
       fail-fast: false
       matrix:
         sanitizer: [address, undefined, memory]
+        architecture: [x86_64]
+        include:
+          - sanitizer: address
+            architecture: i386
     steps:
       - name: Build Fuzzers (${{ matrix.sanitizer }})
         id: build
@@ -42,6 +46,7 @@ jobs:
           # keep-unaffected-fuzz-targets should be removed once https://github.com/google/oss-fuzz/issues/7011 is fixed
           keep-unaffected-fuzz-targets: true
           sanitizer: ${{ matrix.sanitizer }}
+          architecture: ${{ matrix.architecture }}
       - name: Run Fuzzers (${{ matrix.sanitizer }})
         uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
         with:
@@ -50,8 +55,8 @@ jobs:
           dry-run: false
           sanitizer: ${{ matrix.sanitizer }}
       - name: Upload Crash
-        uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2
+        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8
         if: failure() && steps.build.outcome == 'success'
         with:
-          name: ${{ matrix.sanitizer }}-artifacts
+          name: ${{ matrix.sanitizer }}-${{ matrix.architecture }}-artifacts
           path: ./out/artifacts
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql.yml
similarity index 65%
rename from .github/workflows/codeql-analysis.yml
rename to .github/workflows/codeql.yml
index 4ee50ac..b531753 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql.yml
@@ -6,18 +6,19 @@ name: "CodeQL"
 
 on:
   pull_request:
-    branches: [main]
+    branches:
+      - main
+      - v[0-9]+-stable
     paths:
-      - .github/codeql-config.yml
-      - .github/codeql-custom.qls
-      - .github/workflows/codeql-analysis.yml
-      - .github/workflows/requirements.txt
-      - .github/workflows/unit_tests.sh
-  # It takes the workflow approximately 30 minutes to analyze the code base
-  # so it doesn't seem to make much sense to trigger it on every PR or commit.
-  # It runs daily at 01:00 to avoid colliding with the Coverity workflow.
-  schedule:
-    - cron: '0 1 * * *'
+      - '**/meson.build'
+      - '.github/**/codeql*'
+      - 'src/**'
+      - 'test/**'
+      - 'tools/**'
+  push:
+    branches:
+      - main
+      - v[0-9]+-stable
 
 permissions:
   contents: read
@@ -25,7 +26,7 @@ permissions:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     concurrency:
       group: ${{ github.workflow }}-${{ matrix.language }}-${{ github.ref }}
       cancel-in-progress: true
@@ -36,14 +37,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'cpp', 'python' ]
+        language: ['cpp', 'python']
 
     steps:
     - name: Checkout repository
       uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@28eead240834b314f7def40f6fcba65d100d99b1
+      uses: github/codeql-action/init@0c670bbf0414f39666df6ce8e718ec5662c21e03
       with:
         languages: ${{ matrix.language }}
         config-file: ./.github/codeql-config.yml
@@ -51,7 +52,7 @@ jobs:
     - run: sudo -E .github/workflows/unit_tests.sh SETUP
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@28eead240834b314f7def40f6fcba65d100d99b1
+      uses: github/codeql-action/autobuild@0c670bbf0414f39666df6ce8e718ec5662c21e03
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@28eead240834b314f7def40f6fcba65d100d99b1
+      uses: github/codeql-action/analyze@0c670bbf0414f39666df6ce8e718ec5662c21e03
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 1c29c8b..3fbebc6 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -14,30 +14,17 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     if: github.repository == 'systemd/systemd'
     env:
-      COVERITY_SCAN_BRANCH_PATTERN:     "${{ github.ref}}"
-      COVERITY_SCAN_NOTIFICATION_EMAIL: ""
-      COVERITY_SCAN_PROJECT_NAME:       "${{ github.repository }}"
-      # Set in repo settings -> secrets -> repository secrets
+      # Set in repo settings -> secrets -> actions
       COVERITY_SCAN_TOKEN:              "${{ secrets.COVERITY_SCAN_TOKEN }}"
-      CURRENT_REF:                      "${{ github.ref }}"
+      COVERITY_SCAN_NOTIFICATION_EMAIL: "${{ secrets.COVERITY_SCAN_NOTIFICATION_EMAIL }}"
     steps:
       - name: Repository checkout
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-      # https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
-      - name: Set the $COVERITY_SCAN_NOTIFICATION_EMAIL env variable
-        run: echo "COVERITY_SCAN_NOTIFICATION_EMAIL=$(git log -1 ${{ github.sha }} --pretty=\"%aE\")" >> "$GITHUB_ENV"
-      - name: Install Coverity tools
-        run: tools/get-coverity.sh
       # Reuse the setup phase of the unit test script to avoid code duplication
       - name: Install build dependencies
         run: sudo -E .github/workflows/unit_tests.sh SETUP
-      # Preconfigure with meson to prevent Coverity from capturing meson metadata
-      - name: Preconfigure the build directory
-        run: meson cov-build -Dman=false
-      - name: Build
-        run: tools/coverity.sh build
-      - name: Upload the results
-        run: tools/coverity.sh upload
+      - name: Build & upload the results
+        run: tools/coverity.sh
diff --git a/.github/workflows/differential-shellcheck.yml b/.github/workflows/differential-shellcheck.yml
new file mode 100644
index 0000000..20ce681
--- /dev/null
+++ b/.github/workflows/differential-shellcheck.yml
@@ -0,0 +1,31 @@
+---
+# https://github.com/redhat-plumbers-in-action/differential-shellcheck#readme
+
+name: Differential ShellCheck
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    if: github.event.repository.name != 'systemd-security'
+    runs-on: ubuntu-latest
+
+    permissions:
+      security-events: write
+      pull-requests: write
+
+    steps:
+      - name: Repository checkout
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        with:
+          fetch-depth: 0
+
+      - name: Differential ShellCheck
+        uses: redhat-plumbers-in-action/differential-shellcheck@1b1b75e42f0694c1012228513b21617a748c866e
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/issue_labeler.yml b/.github/workflows/issue_labeler.yml
new file mode 100644
index 0000000..0a97bf4
--- /dev/null
+++ b/.github/workflows/issue_labeler.yml
@@ -0,0 +1,36 @@
+---
+
+name: Issue labeler
+on:
+  issues:
+    types: [ opened ]
+
+permissions:
+  contents: read
+
+jobs:
+  label-component:
+    runs-on: ubuntu-22.04
+
+    permissions:
+      issues: write
+
+    strategy:
+      matrix:
+        template: [ bug_report.yml, feature_request.yml ]
+
+    steps:
+      - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+
+      - name: Parse issue form
+        uses: stefanbuck/github-issue-parser@f80b14f78892a66d7a35bba44f0a7d63bee03602
+        id: issue-parser
+        with:
+          template-path: .github/ISSUE_TEMPLATE/${{ matrix.template }}
+
+      - name: Set labels based on component field
+        uses: redhat-plumbers-in-action/advanced-issue-labeler@fe9c43b7d77bd8bd7fbe86c2c217e74ebeea71f2
+        with:
+          issue-form: ${{ steps.issue-parser.outputs.jsonString }}
+          template: ${{ matrix.template }}
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 680a2c1..35766df 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -12,11 +12,12 @@ permissions:
 
 jobs:
   triage:
+    if: github.event.repository.name != 'systemd-security'
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
     steps:
-    - uses: actions/labeler@9fd24f1f9d6ceb64ba34d181b329ee72f99978a0
+    - uses: actions/labeler@e54e5b338fbd6e6cdb5d60f51c22335fc57c401e
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         configuration-path: .github/labeler.yml
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index ecdd797..180cfbf 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Lint Code Base
-        uses: github/super-linter/slim@ae4e373c56efad95924d9cc6b89624fdb2333007
+        uses: github/super-linter/slim@01d3218744765b55c3b5ffbb27e50961e50c33c5
         env:
           DEFAULT_BRANCH: main
           MULTI_STATUS: false
@@ -37,8 +37,8 @@ jobs:
           #   - man/.* - all snippets in man pages (false positives due to
           #              missing shebangs)
           #   - .*\.(in|SKELETON) - all template/skeleton files
-          #   - tools/coverity\.sh - external file (with some modifications)
-          FILTER_REGEX_EXCLUDE: .*/(man/.*|.*\.(in|SKELETON)|tools/coverity\.sh)$
+          #                         except kernel-install
+          FILTER_REGEX_EXCLUDE: .*/(man/.*|([^k]|k(k|ek)*([^ek]|e[^kr]))*(k(k|ek)*e?)?\.(in|SKELETON))$
           VALIDATE_ALL_CODEBASE: false
           VALIDATE_BASH: true
           VALIDATE_GITHUB_ACTIONS: true
diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index 50dd50b..2a1163a 100644
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -20,11 +20,12 @@ permissions:
 env:
   # Enable debug logging in systemd, but keep udev's log level to info,
   # since it's _very_ verbose in the QEMU task
-  KERNEL_CMDLINE: "systemd.unit=mkosi-check-and-shutdown.service !quiet systemd.log_level=debug systemd.log_target=console udev.log_level=info systemd.default_standard_output=journal+console"
+  # Disable the ISC DHCP servers, as they are failing in Ubuntu
+  KERNEL_CMDLINE: "systemd.unit=mkosi-check-and-shutdown.service !quiet systemd.log_level=debug systemd.log_target=console udev.log_level=info systemd.default_standard_output=journal+console systemd.mask=isc-dhcp-server6.service systemd.mask=isc-dhcp-server.service"
 
 jobs:
   ci:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     concurrency:
       group: ${{ github.workflow }}-${{ matrix.distro }}-${{ matrix.release }}-${{ github.ref }}
       cancel-in-progress: true
@@ -37,19 +38,21 @@ jobs:
           - distro: debian
             release: testing
           - distro: ubuntu
-            release: focal
+            release: jammy
           - distro: fedora
-            release: "36"
+            release: "37"
+          - distro: fedora
+            release: rawhide
           - distro: opensuse
             release: tumbleweed
           - distro: centos_epel
-            release: 8-stream
-          - distro: centos_epel
             release: 9-stream
+          - distro: centos_epel
+            release: 8-stream
 
     steps:
     - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-    - uses: systemd/mkosi@93098e2406e12ea7f06f962d4808952b8a06d345
+    - uses: systemd/mkosi@792cbc60eb2dc4a58d66bb3c212bf92f8d50f6ea
 
     - name: Install
       run: sudo apt-get update && sudo apt-get install --no-install-recommends python3-pexpect python3-jinja2
@@ -69,25 +72,19 @@ jobs:
         EOF
 
     - name: Build ${{ matrix.distro }}
-      run: ./.github/workflows/run_mkosi.sh build
+      run: sudo python3 -m mkosi build
 
     - name: Show ${{ matrix.distro }} image summary
-      run: ./.github/workflows/run_mkosi.sh summary
+      run: sudo python3 -m mkosi summary
 
     - name: Boot ${{ matrix.distro }} systemd-nspawn
-      run: ./.github/workflows/run_mkosi.sh boot ${{ env.KERNEL_CMDLINE }}
+      run: sudo python3 -m mkosi boot ${{ env.KERNEL_CMDLINE }}
 
     - name: Check ${{ matrix.distro }} systemd-nspawn
-      run: ./.github/workflows/run_mkosi.sh shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"
-
-      # TODO: Remove CentOS exclusion once Ubuntu 22.04 is available in GA.
-      # See https://github.com/systemd/systemd/pull/22417 and https://github.com/systemd/mkosi/pull/907 for
-      # more information.
+      run: sudo python3 -m mkosi shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"
 
     - name: Boot ${{ matrix.distro }} QEMU
-      if: ${{ matrix.distro != 'centos_epel' }}
-      run: ./.github/workflows/run_mkosi.sh qemu
+      run: sudo timeout -k 30 10m python3 -m mkosi qemu
 
     - name: Check ${{ matrix.distro }} QEMU
-      if: ${{ matrix.distro != 'centos_epel' }}
-      run: ./.github/workflows/run_mkosi.sh shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"
+      run: sudo python3 -m mkosi shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"
diff --git a/.github/workflows/requirements.txt b/.github/workflows/requirements.txt
index d7b1365..edb1748 100644
--- a/.github/workflows/requirements.txt
+++ b/.github/workflows/requirements.txt
@@ -1,18 +1,18 @@
-meson==0.62.0 \
-    --hash=sha256:00e06dccac7d3b0568b5da82e70c2028c80c359aab6dc517bcbd1825511898c3 \
-    --hash=sha256:06f8c1cfa51bfdb533c82623ffa524cacdbea02ace6d709145e33aabdad6adcb
-ninja==1.10.2.3 \
-    --hash=sha256:0560eea57199e41e86ac2c1af0108b63ae77c3ca4d05a9425a750e908135935a \
-    --hash=sha256:21a1d84d4c7df5881bfd86c25cce4cf7af44ba2b8b255c57bc1c434ec30a2dfc \
-    --hash=sha256:279836285975e3519392c93c26e75755e8a8a7fafec9f4ecbb0293119ee0f9c6 \
-    --hash=sha256:29570a18d697fc84d361e7e6330f0021f34603ae0fcb0ef67ae781e9814aae8d \
-    --hash=sha256:5ea785bf6a15727040835256577239fa3cf5da0d60e618c307aa5efc31a1f0ce \
-    --hash=sha256:688167841b088b6802e006f911d911ffa925e078c73e8ef2f88286107d3204f8 \
-    --hash=sha256:6bd76a025f26b9ae507cf8b2b01bb25bb0031df54ed685d85fc559c411c86cf4 \
-    --hash=sha256:740d61fefb4ca13573704ee8fe89b973d40b8dc2a51aaa4e9e68367233743bb6 \
-    --hash=sha256:840a0b042d43a8552c4004966e18271ec726e5996578f28345d9ce78e225b67e \
-    --hash=sha256:84be6f9ec49f635dc40d4b871319a49fa49b8d55f1d9eae7cd50d8e57ddf7a85 \
-    --hash=sha256:9ca8dbece144366d5f575ffc657af03eb11c58251268405bc8519d11cf42f113 \
-    --hash=sha256:cc8b31b5509a2129e4d12a35fc21238c157038022560aaf22e49ef0a77039086 \
-    --hash=sha256:d5e0275d28997a750a4f445c00bdd357b35cc334c13cdff13edf30e544704fbd \
-    --hash=sha256:e1b86ad50d4e681a7dbdff05fc23bb52cb773edb90bc428efba33fa027738408
+meson==0.63.2 \
+    --hash=sha256:16222f17ef76be0542c91c07994f9676ae879f46fc21c0c786a21ef2cb518bbf \
+    --hash=sha256:64a83ef257b2962b52c8b07ad9ec536c2de1b72fd9f14bcd9c21fe45730edd46
+ninja==1.10.2.4 \
+    --hash=sha256:24e3bc4713667a9a1d15484ad2bb77bbaedb1e6d45254cb03f7964b8b497231a \
+    --hash=sha256:251fb21cd6691accd0d95e28721ad8a50a6ec0ace97f9a8de3976f39301686f6 \
+    --hash=sha256:327c319176c5a4af21908b727b776e9f5caf275680403da632821ba071fd6296 \
+    --hash=sha256:3300f3f37d62dcc7bdd19284dff9eaed7d629f4ed2725019a6ce3291c655fb83 \
+    --hash=sha256:34c8e44f6e2e35ff9444994bfc7bf451c8d4bf15e31ad1e3ef7b06f78647b35b \
+    --hash=sha256:3fa6e69838613815c80abcaca34681c5b7cf15bf921543e518f5c918d7098bb7 \
+    --hash=sha256:5b973b1ce7075e9091db290adbbf93ba9066a94f97c369d0ff631251c633e81b \
+    --hash=sha256:685daebd1bc21480256351000a01dfb520636832fa65efc9f121474ff640e3df \
+    --hash=sha256:b0350784b37c5080223ec1bedc507153cc714b502c17dd5a64552e930b0dca25 \
+    --hash=sha256:b12cfed6382e510a597b3d08d7eec96664f7c8b8ee436eef645736c453d1c135 \
+    --hash=sha256:b264085e409533aecb57040c5e90fbfb64db91a61575c7e637411780446412fa \
+    --hash=sha256:b86a4e4ba2ed999d8b10f2b3f2ed56d7457ff647268f4098dd0b63dd145ede32 \
+    --hash=sha256:da7a6d9b2ed2018165fbf90068e2c64da08f2568c700fdb8abea07a245dc4664 \
+    --hash=sha256:ea245943a9849e5b1ebd74c1a4c1edd2c9801b62c0386165c7ac47623e353627
diff --git a/.github/workflows/run_mkosi.sh b/.github/workflows/run_mkosi.sh
deleted file mode 100755
index 153ebe3..0000000
--- a/.github/workflows/run_mkosi.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: LGPL-2.1-or-later
-# shellcheck disable=SC2064
-
-set -eu
-set -o pipefail
-
-EC=0
-TEMPFILE="$(mktemp)"
-TEMP_EXTRA_TREE="$(mktemp --directory)"
-trap "rm -rf '$TEMPFILE' '$TEMP_EXTRA_TREE'" EXIT
-
-# We need isc-dhcp-server to be installed for the networkd unit tests, but we don't want to
-# run it by default. mktemp creates the directory as 700, so change it, otherwise it will
-# affect the image's root folder permissions.
-chmod 755 "$TEMP_EXTRA_TREE"
-mkdir -p "$TEMP_EXTRA_TREE/etc/systemd/system/"
-ln -s /dev/null "$TEMP_EXTRA_TREE/etc/systemd/system/isc-dhcp-server.service"
-ln -s /dev/null "$TEMP_EXTRA_TREE/etc/systemd/system/isc-dhcp-server6.service"
-
-for ((i = 0; i < 5; i++)); do
-    EC=0
-    (sudo python3 -m mkosi --extra-tree="$TEMP_EXTRA_TREE" "$@") |& tee "$TEMPFILE" || EC=$?
-    if [[ $EC -eq 0 ]]; then
-        # The command passed — let's return immediately
-        break
-    fi
-
-    if ! grep -E "Failed to dissect image .+: Connection timed out" "$TEMPFILE"; then
-        # The command failed for other reason than the dissect-related timeout -
-        # let's exit with the same EC
-        exit $EC
-    fi
-
-    # The command failed due to the dissect-related timeout — let's try again
-    sleep 1
-done
-
-exit $EC
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
new file mode 100644
index 0000000..911ac5a
--- /dev/null
+++ b/.github/workflows/scorecards.yml
@@ -0,0 +1,70 @@
+---
+# vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
+name: Scorecards supply-chain security
+on:
+  # Only the default branch is supported.
+  branch_protection_rule:
+  schedule:
+    - cron: '15 21 * * 6'
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+    paths:
+      - '.github/workflows/scorecards.yml'
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecards analysis
+    if: github.repository == 'systemd/systemd'
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Used to receive a badge.
+      id-token: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@e363bfca00e752f91de7b7d2a77340e2e523cb18 # tag=v2.0.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) Read-only PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecards on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
+
+          # Publish the results for public repositories to enable scorecard badges. For more details, see
+          # https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories, `publish_results` will automatically be set to `false`, regardless
+          # of the value entered here.
+          publish_results: ${{ github.event_name != 'pull_request' }}
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: Upload artifact
+        uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: Upload to code-scanning
+        if: github.event_name != 'pull_request'
+        uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26
+        with:
+          sarif_file: results.sarif
diff --git a/.github/workflows/unit_tests.sh b/.github/workflows/unit_tests.sh
index 442202f..9a9fbb3 100755
--- a/.github/workflows/unit_tests.sh
+++ b/.github/workflows/unit_tests.sh
@@ -53,12 +53,21 @@ for phase in "${PHASES[@]}"; do
             apt-get -y install "${ADDITIONAL_DEPS[@]}"
             pip3 install -r .github/workflows/requirements.txt --require-hashes
             ;;
-        RUN|RUN_GCC|RUN_CLANG)
-            if [[ "$phase" = "RUN_CLANG" ]]; then
+        RUN|RUN_GCC|RUN_CLANG|RUN_CLANG_RELEASE)
+            if [[ "$phase" =~ ^RUN_CLANG ]]; then
                 export CC=clang
                 export CXX=clang++
-                # The docs build is slow and is not affected by compiler/flags, so do it just once
-                MESON_ARGS+=(-Dman=true)
+                if [[ "$phase" == RUN_CLANG ]]; then
+                    # The docs build is slow and is not affected by compiler/flags, so do it just once
+                    MESON_ARGS+=(-Dman=true)
+                else
+                    MESON_ARGS+=(-Dmode=release --optimization=2)
+                fi
+
+                # Some variation: remove machine-id, like on Debian builders to ensure unit tests still work.
+                if [ -w /etc/machine-id ]; then
+                    mv /etc/machine-id /etc/machine-id.bak
+                fi
             fi
             # The install_tag feature introduced in 0.60 causes meson to fail with fatal-meson-warnings
             # "Project targeting '>= 0.53.2' but tried to use feature introduced in '0.60.0': install_tag arg in custom_target"
@@ -109,6 +118,9 @@ for phase in "${PHASES[@]}"; do
             ;;
         CLEANUP)
             info "Cleanup phase"
+            if [ ! -f /etc/machine-id ] && [ -w /etc/machine-id.bak ]; then
+                mv /etc/machine-id.bak /etc/machine-id
+            fi
             ;;
         *)
             echo >&2 "Unknown phase '$phase'"
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
index 7226a77..cd6c33e 100644
--- a/.github/workflows/unit_tests.yml
+++ b/.github/workflows/unit_tests.yml
@@ -14,14 +14,14 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     concurrency:
       group: ${{ github.workflow }}-${{ matrix.run_phase }}-${{ matrix.cryptolib }}-${{ github.ref }}
       cancel-in-progress: true
     strategy:
       fail-fast: false
       matrix:
-        run_phase: [GCC, GCC_ASAN_UBSAN, CLANG, CLANG_ASAN_UBSAN, CLANG_ASAN_UBSAN_NO_DEPS]
+        run_phase: [GCC, GCC_ASAN_UBSAN, CLANG, CLANG_RELEASE, CLANG_ASAN_UBSAN, CLANG_ASAN_UBSAN_NO_DEPS]
         cryptolib: [auto]
         include:
           - run_phase: GCC
@@ -32,8 +32,14 @@ jobs:
       - name: Repository checkout
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - name: Install build dependencies
-        run: sudo -E .github/workflows/unit_tests.sh SETUP
+        run: |
+          # Drop XDG_* stuff from /etc/environment, so we don't get the user
+          # XDG_* variables when running under sudo
+          sudo sed -i '/^XDG_/d' /etc/environment
+          # Pass only specific env variables through sudo, to avoid having
+          # the already existing XDG_* stuff on the "other side"
+          sudo --preserve-env=CRYPTOLIB,GITHUB_ACTIONS,CI .github/workflows/unit_tests.sh SETUP
       - name: Build & test (${{ matrix.run_phase }}-${{ matrix.cryptolib }})
-        run: sudo -E .github/workflows/unit_tests.sh RUN_${{ matrix.run_phase }}
+        run: sudo --preserve-env=CRYPTOLIB,GITHUB_ACTIONS,CI .github/workflows/unit_tests.sh RUN_${{ matrix.run_phase }}
         env:
           CRYPTOLIB: ${{ matrix.cryptolib }}
diff --git a/.gitignore b/.gitignore
index 7b6d0a3..8aa363e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -37,3 +37,4 @@ __pycache__/
 /mkosi.default.d/**/*local*.conf
 /tags
 .dir-locals-2.el
+.vscode/
diff --git a/.lgtm.yml b/.lgtm.yml
deleted file mode 100644
index 86fd0e7..0000000
--- a/.lgtm.yml
+++ /dev/null
@@ -1,40 +0,0 @@
----
-# vi: ts=2 sw=2 et:
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-# Explicitly enable certain checks which are hidden by default
-queries:
-  - include: cpp/bad-strncpy-size
-  - include: cpp/declaration-hides-variable
-  - include: cpp/inconsistent-null-check
-  - include: cpp/mistyped-function-arguments
-  - include: cpp/nested-loops-with-same-variable
-  - include: cpp/sizeof-side-effect
-  - include: cpp/suspicious-pointer-scaling
-  - include: cpp/suspicious-pointer-scaling-void
-  - include: cpp/suspicious-sizeof
-  - include: cpp/unsafe-strcat
-  - include: cpp/unsafe-strncat
-  - include: cpp/unsigned-difference-expression-compared-zero
-  - include: cpp/unused-local-variable
-  - include:
-      tags:
-        - "security"
-        - "correctness"
-      severity: "error"
-
-extraction:
-  cpp:
-    prepare:
-      packages:
-        - libpwquality-dev
-        - libfdisk-dev
-        - libp11-kit-dev
-        - libssl-dev
-        - python3-jinja2
-    after_prepare:
-      - pip3 install -r .github/workflows/requirements.txt --require-hashes
-      - export PATH="/opt/work/.local/bin:$PATH"
-  python:
-    python_setup:
-      version: 3
diff --git a/.semaphore/semaphore-runner.sh b/.semaphore/semaphore-runner.sh
index ba21811..b0d32bd 100755
--- a/.semaphore/semaphore-runner.sh
+++ b/.semaphore/semaphore-runner.sh
@@ -19,14 +19,7 @@ PHASES=(${@:-SETUP RUN})
 UBUNTU_RELEASE="$(lsb_release -cs)"
 
 create_container() {
-    # Create autopkgtest LXC image; this sometimes fails with "Unable to fetch
-    # GPG key from keyserver", so retry a few times with different keyservers.
-    for keyserver in "keys.openpgp.org" "" "keyserver.ubuntu.com" "keys.gnupg.net"; do
-        for retry in {1..5}; do
-            sudo lxc-create -n "$CONTAINER" -t download -- -d "$DISTRO" -r "$RELEASE" -a "$ARCH" ${keyserver:+--keyserver "$keyserver"} && break 2
-            sleep $((retry*retry))
-        done
-    done
+    sudo lxc-create -n "$CONTAINER" -t download -- -d "$DISTRO" -r "$RELEASE" -a "$ARCH"
 
     # unconfine the container, otherwise some tests fail
     echo 'lxc.apparmor.profile = unconfined' | sudo tee -a "/var/lib/lxc/$CONTAINER/config"
@@ -62,7 +55,7 @@ for phase in "${PHASES[@]}"; do
     case "$phase" in
         SETUP)
             # remove semaphore repos, some of them don't work and cause error messages
-            sudo rm -f /etc/apt/sources.list.d/*
+            sudo rm -rf /etc/apt/sources.list.d/*
 
             # enable backports for latest LXC
             echo "deb http://archive.ubuntu.com/ubuntu $UBUNTU_RELEASE-backports main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list.d/backports.list
@@ -107,10 +100,10 @@ EOF
             # now build the package and run the tests
             rm -rf "$ARTIFACTS_DIR"
             # autopkgtest exits with 2 for "some tests skipped", accept that
-            "$AUTOPKGTEST_DIR/runner/autopkgtest" --env DEB_BUILD_OPTIONS=noudeb \
-                                                  --env TEST_UPSTREAM=1 ../systemd_*.dsc \
-                                                  -o "$ARTIFACTS_DIR" \
-                                                  -- lxc -s "$CONTAINER" \
+            sudo "$AUTOPKGTEST_DIR/runner/autopkgtest" --env DEB_BUILD_OPTIONS=noudeb \
+                                                       --env TEST_UPSTREAM=1 ../systemd_*.dsc \
+                                                       -o "$ARTIFACTS_DIR" \
+                                                       -- lxc -s "$CONTAINER" \
                 || [ $? -eq 2 ]
         ;;
         *)
diff --git a/LICENSES/MIT-0.txt b/LICENSES/MIT-0.txt
new file mode 100644
index 0000000..396fc00
--- /dev/null
+++ b/LICENSES/MIT-0.txt
@@ -0,0 +1,7 @@
+MIT No Attribution
+
+Copyright <YEAR> <COPYRIGHT HOLDER>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/LICENSES/README.md b/LICENSES/README.md
index 69ef2d6..d235b31 100644
--- a/LICENSES/README.md
+++ b/LICENSES/README.md
@@ -45,9 +45,10 @@ The following exceptions apply:
  * the following sources are licensed under the **CC0-1.0** license:
    - src/basic/siphash24.c
    - src/basic/siphash24.h
-   - src/systemctl/systemd-sysv-install.SKELETON
    - tools/check-includes.pl
+  * the following sources are licensed under the **MIT-0** license:
    - all examples under man/
+   - src/systemctl/systemd-sysv-install.SKELETON
    - config files and examples under /network
  * the following sources are under **Public Domain** (LicenseRef-murmurhash2-public-domain):
    - src/basic/MurmurHash2.c
diff --git a/NEWS b/NEWS
index 5fc0033..86a9938 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,611 @@
 systemd System and Service Manager
 
+CHANGES WITH 252 🎃:
+
+        Announcements of Future Feature Removals:
+
+        * We intend to remove cgroup v1 support from systemd release after the
+          end of 2023. If you run services that make explicit use of cgroup v1
+          features (i.e. the "legacy hierarchy" with separate hierarchies for
+          each controller), please implement compatibility with cgroup v2 (i.e.
+          the "unified hierarchy") sooner rather than later. Most of Linux
+          userspace has been ported over already.
+
+        * We intend to remove support for split-usr (/usr mounted separately
+          during boot) and unmerged-usr (parallel directories /bin and
+          /usr/bin, /lib and /usr/lib, etc). This will happen in the second
+          half of 2023, in the first release that falls into that time window.
+          For more details, see:
+          https://lists.freedesktop.org/archives/systemd-devel/2022-September/048352.html
+
+        Compatibility Breaks:
+
+        * ConditionKernelVersion= checks that use the '=' or '!=' operators
+          will now do simple string comparisons (instead of version comparisons
+          á la stverscmp()). Version comparisons are still done for the
+          ordering operators '<', '>', '<=', '>='. Moreover, if no operator is
+          specified, a shell-style glob match is now done. This creates a minor
+          incompatibility compared to older systemd versions when the '*', '?',
+          '[', ']' characters are used, as these will now match as shell globs
+          instead of literally. Given that kernel version strings typically do
+          not include these characters we expect little breakage through this
+          change.
+
+        * The service manager will now read the SELinux label used for SELinux
+          access checks from the unit file at the time it loads the file.
+          Previously, the label would be read at the moment of the access
+          check, which was problematic since at that time the unit file might
+          already have been updated or removed.
+
+        New Features:
+
+        * systemd-measure is a new tool for calculating and signing expected
+          TPM2 PCR values for a given unified kernel image (UKI) booted via
+          sd-stub. The public key used for the signature and the signed
+          expected PCR information can be embedded inside the UKI. This
+          information can be extracted from the UKI by external tools and code
+          in the image itself and is made available to userspace in the booted
+          kernel.
+
+          systemd-cryptsetup, systemd-cryptenroll, and systemd-creds have been
+          updated to make use of this information if available in the booted
+          kernel: when locking an encrypted volume/credential to the TPM
+          systemd-cryptenroll/systemd-creds will use the public key to bind the
+          volume/credential to any kernel that carries PCR information signed
+          by the same key pair. When unlocking such volumes/credentials
+          systemd-cryptsetup/systemd-creds will use the signature embedded in
+          the booted UKI to gain access.
+
+          Binding TPM-based disk encryption to public keys/signatures of PCR
+          values — instead of literal PCR values — addresses the inherent
+          "brittleness" of traditional PCR-bound TPM disk encryption schemes:
+          disks remain accessible even if the UKI is updated, without any TPM
+          specific preparation during the OS update — as long as each UKI
+          carries the necessary PCR signature information.
+
+          Net effect: if you boot a properly prepared kernel, TPM-bound disk
+          encryption now defaults to be locked to kernels which carry PCR
+          signatures from the same key pair. Example: if a hypothetical distro
+          FooOS prepares its UKIs like this, TPM-based disk encryption is now –
+          by default – bound to only FooOS kernels, and encrypted volumes bound
+          to the TPM cannot be unlocked on kernels from other sources. (But do
+          note this behaviour requires preparation/enabling in the UKI, and of
+          course users can always enroll non-TPM ways to unlock the volume.)
+
+        * systemd-pcrphase is a new tool that is invoked at six places during
+          system runtime, and measures additional words into TPM2 PCR 11, to
+          mark milestones of the boot process. This allows binding access to
+          specific TPM2-encrypted secrets to specific phases of the boot
+          process. (Example: LUKS2 disk encryption key only accessible in the
+          initrd, but not later.)
+
+        Changes in systemd itself, i.e. the manager and units
+
+        * The cpu controller is delegated to user manager units by default, and
+          CPUWeight= settings are applied to the top-level user slice units
+          (app.slice, background.slice, session.slice). This provides a degree
+          of resource isolation between different user services competing for
+          the CPU.
+
+        * Systemd can optionally do a full preset in the "first boot" condition
+          (instead of just enable-only). This behaviour is controlled by the
+          compile-time option -Dfirst-boot-full-preset. Right now it defaults
+          to 'false', but the plan is to switch it to 'true' for the subsequent
+          release.
+
+        * Drop-ins are now allowed for transient units too.
+
+        * Systemd will set the taint flag 'support-ended' if it detects that
+          the OS image is past its end-of-support date. This date is declared
+          in a new /etc/os-release field SUPPORT_END= described below.
+
+        * Two new settings ConditionCredential= and AssertCredential= can be
+          used to skip or fail units if a certain system credential is not
+          provided.
+
+        * ConditionMemory= accepts size suffixes (K, M, G, T, …).
+
+        * DefaultSmackProcessLabel= can be used in system.conf and user.conf to
+          specify the SMACK security label to use when not specified in a unit
+          file.
+
+        * DefaultDeviceTimeoutSec= can be used in system.conf and user.conf to
+          specify the default timeout when waiting for device units to
+          activate.
+
+        * C.UTF-8 is used as the default locale if nothing else has been
+          configured.
+
+        * [Condition|Assert]Firmware= have been extended to support certain
+          SMBIOS fields. For example
+
+            ConditionFirmware=smbios-field(board_name = "Custom Board")
+
+          conditionalizes the unit to run only when
+          /sys/class/dmi/id/board_name contains "Custom Board" (without the
+          quotes).
+
+        * ConditionFirstBoot= now correctly evaluates as true only during the
+          boot phase of the first boot. A unit executed later, after booting
+          has completed, will no longer evaluate this condition as true.
+
+        * Socket units will now create sockets in the SELinuxContext= of the
+          associated service unit, if any.
+
+        * Boot phase transitions (start initrd → exit initrd → boot complete →
+          shutdown) will be measured into TPM2 PCR 11, so that secrets can be
+          bound to a specific runtime phase. E.g.: a LUKS encryption key can be
+          unsealed only in the initrd.
+
+        * Service credentials (i.e. SetCredential=/LoadCredential=/…) will now
+          also be provided to ExecStartPre= processes.
+
+        * Various units are now correctly ordered against
+          initrd-switch-root.target where previously a conflict without
+          ordering was configured. A stop job for those units would be queued,
+          but without the ordering it could be executed only after
+          initrd-switch-root.service, leading to units not being restarted in
+          the host system as expected.
+
+        * In order to fully support the IPMI watchdog driver, which has not yet
+          been ported to the new common watchdog device interface,
+          /dev/watchdog0 will be tried first and systemd will silently fallback
+          to /dev/watchdog if it is not found.
+
+        * New watchdog-related D-Bus properties are now published by systemd:
+          WatchdogDevice, WatchdogLastPingTimestamp,
+          WatchdogLastPingTimestampMonotonic.
+
+        * At shutdown, API virtual files systems (proc, sys, etc.) will be
+          unmounted lazily.
+
+        * At shutdown, systemd will now log about processes blocking unmounting
+          of file systems.
+
+        * A new meson build option 'clock-valid-range-usec-max' was added to
+          allow disabling system time correction if RTC returns a timestamp far
+          in the future.
+
+        * Propagated restart jobs will no longer be discarded while a unit is
+          activating.
+
+        * PID 1 will now import system credentials from SMBIOS Type 11 fields
+          ("OEM vendor strings"), in addition to qemu_fwcfg. This provides a
+          simple, fast and generic path for supplying credentials to a VM,
+          without involving external tools such as cloud-init/ignition.
+
+        * The CPUWeight= setting of unit files now accepts a new special value
+          "idle", which configures "idle" level scheduling for the unit.
+
+        * Service processes that are activated due to a .timer or .path unit
+          triggering will now receive information about this via environment
+          variables. Note that this is information is lossy, as activation
+          might be coalesced and only one of the activating triggers will be
+          reported. This is hence more suited for debugging or tracing rather
+          than for behaviour decisions.
+
+        * The riscv_flush_icache(2) system call has been added to the list of
+          system calls allowed by default when SystemCallFilter= is used.
+
+        * The selinux context derived from the target executable, instead of
+          'init_t' used for the manager itself, is now used when creating
+          listening sockets for units that specify SELinuxContextFromNet=yes.
+
+        Changes in sd-boot, bootctl, and the Boot Loader Specification:
+
+        * The Boot Loader Specification has been cleaned up and clarified.
+          Various corner cases in version string comparisons have been fixed
+          (e.g. comparisons for empty strings). Boot counting is now part of
+          the main specification.
+
+        * New PCRs measurements are performed during boot: PCR 11 for the the
+          kernel+initrd combo, PCR 13 for any sysext images. If a measurement
+          took place this is now reported to userspace via the new
+          StubPcrKernelImage and StubPcrInitRDSysExts EFI variables.
+
+        * As before, systemd-stub will measure kernel parameters and system
+          credentials into PCR 12. It will now report this fact via the
+          StubPcrKernelParameters EFI variable to userspace.
+
+        * The UEFI monotonic boot counter is now included in the updated random
+          seed file maintained by sd-boot, providing some additional entropy.
+
+        * sd-stub will use LoadImage/StartImage to execute the kernel, instead
+          of arranging the image manually and jumping to the kernel entry
+          point. sd-stub also installs a temporary UEFI SecurityOverride to
+          allow the (unsigned) nested image to be booted. This is safe because
+          the outer (signed) stub+kernel binary must have been verified before
+          the stub was executed.
+
+        * Booting in EFI mixed mode (a 64-bit kernel over 32-bit UEFI firmware)
+          is now supported by sd-boot.
+
+        * bootctl gained a bunch of new options: --all-architectures to install
+          binaries for all supported EFI architectures, --root= and --image=
+          options to operate on a directory or disk image, and
+          --install-source= to specify the source for binaries to install,
+          --efi-boot-option-description= to control the name of the boot entry.
+
+        * The sd-boot stub exports a StubFeatures flag, which is used by
+          bootctl to show features supported by the stub that was used to boot.
+
+        * The PE section offsets that are used by tools that assemble unified
+          kernel images have historically been hard-coded. This may lead to
+          overlapping PE sections which may break on boot. The UKI will now try
+          to detect and warn about this.
+
+          Any tools that assemble UKIs must update to calculate these offsets
+          dynamically. Future sd-stub versions may use offsets that will not
+          work with the currently used set of hard-coded offsets!
+
+        * sd-stub now accepts (and passes to the initrd and then to the full
+          OS) new PE sections '.pcrsig' and '.pcrkey' that can be used to embed
+          signatures of expected PCR values, to allow sealing secrets via the
+          TPM2 against pre-calculated PCR measurements.
+
+        Changes in the hardware database:
+
+        * 'systemd-hwdb query' now supports the --root= option.
+
+        Changes in systemctl:
+
+        * systemctl now supports --state= and --type= options for the 'show'
+          and 'status' verbs.
+
+        * systemctl gained a new verb 'list-automounts' to list automount
+          points.
+
+        * systemctl gained support for a new --image= switch to be able to
+          operate on the specified disk image (similar to the existing --root=
+          which operates relative to some directory).
+
+        Changes in systemd-networkd:
+
+        * networkd can set Linux NetLabel labels for integration with the
+          network control in security modules via a new NetLabel= option.
+
+        * The RapidCommit= is (re-)introduced to enable faster configuration
+          via DHCPv6 (RFC 3315).
+
+        * networkd gained a new option TCPCongestionControlAlgorithm= that
+          allows setting a per-route TCP algorithm.
+
+        * networkd gained a new option KeepFileDescriptor= to allow keeping a
+          reference (file descriptor) open on TUN/TAP interfaces, which is
+          useful to avoid link flaps while the underlying service providing the
+          interface is being serviced.
+
+        * RouteTable= now also accepts route table names.
+
+        Changes in systemd-nspawn:
+
+        * The --bind= and --overlay= options now support relative paths.
+
+        * The --bind= option now supports a 'rootidmap' value, which will
+          use id-mapped mounts to map the root user inside the container to the
+          owner of the mounted directory on the host.
+
+        Changes in systemd-resolved:
+
+        * systemd-resolved now persists DNSOverTLS in its state file too. This
+          fixes a problem when used in combination with NetworkManager, which
+          sends the setting only once, causing it to be lost if resolved was
+          restarted at any point.
+
+        * systemd-resolved now exposes a varlink socket at
+          /run/systemd/resolve/io.systemd.Resolve.Monitor, accessible only for
+          root. Processed DNS requests in a JSON format will be published to
+          any clients connected to this socket.
+
+          resolvectl gained a 'monitor' verb to make use of this.
+
+        * systemd-resolved now treats unsupported DNSSEC algorithms as INSECURE
+          instead of returning SERVFAIL, as per RFC:
+          https://datatracker.ietf.org/doc/html/rfc6840#section-5.2
+
+        * OpenSSL is the default crypto backend for systemd-resolved. (gnutls
+          is still supported.)
+
+        Changes in libsystemd and other libraries:
+
+        * libsystemd now exports sd_bus_error_setfv() (a convenience function
+          for setting bus errors), sd_id128_string_equal (a convenience
+          function for 128bit ID string comparisons), and
+          sd_bus_message_read_strv_extend() (a function to incrementally read
+          string arrays).
+
+        * libsystemd now exports sd_device_get_child_first()/_next() as a
+          high-level interface for enumerating child devices. It also supports
+          sd_device_new_child() for opening a child device given a device
+          object.
+
+        * libsystemd now exports sd_device_monitor_set()/get_description()
+          which allow setting a custom description that will be used in log
+          messages by sd_device_monitor*.
+
+        * Private shared libraries (libsystemd-shared-nnn.so,
+          libsystemd-core-nnn.so) are now installed into arch-specific
+          directories to allow multi-arch installs.
+
+        * A new sd-gpt.h header is now published, listing GUIDs from the
+          Discoverable Partitions specification. For more details see:
+          https://systemd.io/DISCOVERABLE_PARTITIONS/
+
+        * A new function sd_hwdb_new_from_path() has been added to open a hwdb
+          database given an explicit path to the file.
+
+        * The signal number argument to sd_event_add_signal() now can now be
+          ORed with the SD_EVENT_SIGNAL_PROCMASK flag, causing sigprocmask() to
+          be automatically invoked to block the specified signal. This is
+          useful to simplify invocations as the caller doesn't have to do this
+          manually.
+
+        * A new convenience call sd_event_set_signal_exit() has been added to
+          sd-event to set up signal handling so that the event loop
+          automatically terminates cleanly on SIGTERM/SIGINT.
+
+        Changes in other components:
+
+        * systemd-sysusers, systemd-tmpfiles, and systemd-sysctl configuration
+          can now be provided via the credential mechanism.
+
+        * systemd-analyze gained a new verb 'compare-versions' that implements
+          comparisons for versions strings (similarly to 'rpmdev-vercmp' and
+          'dpkg --compare-versions').
+
+        * 'systemd-analyze dump' is extended to accept glob patterns for unit
+          names to limit the output to matching units.
+
+        * tmpfiles.d/ lines can read file contents to write from a credential.
+          The new modifier char '^' is used to specify that the argument is a
+          credential name. This mechanism is used to automatically populate
+          /etc/motd, /etc/issue, and /etc/hosts from credentials.
+
+        * tmpfiles.d/ may now be configured to avoid changing uid/gid/mode of
+          an inode if the specification is prefixed with ':' and the inode
+          already exists.
+
+        * Default tmpfiles.d/ configuration now carries a line to automatically
+          use an 'ssh.authorized_keys.root' credential if provided to set up
+          the SSH authorized_keys file for the root user.
+
+        * systemd-tmpfiles will now gracefully handle absent source of "C" copy
+          lines.
+
+        * tmpfiles.d/ F/w lines now optionally permit encoding of the payload
+          in base64. This is useful to write arbitrary binary data into files.
+
+        * The pkgconfig and rpm macros files now export the directory for user
+          units as 'user_tmpfiles_dir' and '%_user_tmpfilesdir'.
+
+        * Detection of Apple Virtualization and detection of Parallels and
+          KubeVirt virtualization on non-x86 archs have been added.
+
+        * os-release gained a new field SUPPORT_END=YYYY-MM-DD to inform the
+          user when their system will become unsupported.
+
+        * When performing suspend-then-hibernate, the system will estimate the
+          discharge rate and use that to set the delay until hibernation and
+          hibernate immediately instead of suspending when running from a
+          battery and the capacity is below 5%.
+
+        * systemd-sysctl gained a --strict option to fail when a sysctl
+          setting is unknown to the kernel.
+
+        * machinectl supports --force for the 'copy-to' and 'copy-from'
+          verbs.
+
+        * coredumpctl gained the --root and --image options to look for journal
+          files under the specified root directory, image, or block device.
+
+        * 'journalctl -o' and similar commands now implement a new output mode
+          "short-delta". It is similar to "short-monotonic", but also shows the
+          time delta between subsequent messages.
+
+        * journalctl now respects the --quiet flag when verifying consistency
+          of journal files.
+
+        * Journal log messages gained a new implicit field _RUNTIME_SCOPE= that
+          will indicate whether a message was logged in the 'initrd' phase or
+          in the 'system' phase of the boot process.
+
+        * Journal files gained a new compatibility flag
+          'HEADER_INCOMPATIBLE_COMPACT'. Files with this flag implement changes
+          to the storage format that allow reducing size on disk. As with other
+          compatibility flags, older journalctl versions will not be able to
+          read journal files using this new format. The environment variable
+          'SYSTEMD_JOURNAL_COMPACT=0' can be passed to systemd-journald to
+          disable this functionality. It is enabled by default.
+
+        * systemd-run's --working-directory= switch now works when used in
+          combination with --scope.
+
+        * portablectl gained a --force flag to skip certain sanity checks. This
+          is implemented using new flags accepted by systemd-portabled for the
+          *WithExtensions() D-Bus methods: SD_SYSTEMD_PORTABLE_FORCE_ATTACH
+          flag now means that the attach/detach checks whether the units are
+          already present and running will be skipped. Similarly,
+          SD_SYSTEMD_PORTABLE_FORCE_SYSEXT flag means that the check whether
+          image name matches the name declared inside of the image will be
+          skipped. Callers must be sure to do those checks themselves if
+          appropriate.
+
+        * systemd-portabled will now use the original filename to check
+          extension-release.NAME for correctness, in case it is passed a
+          symlink.
+
+        * systemd-portabled now uses PrivateTmp=yes in the 'trusted' profile
+          too.
+
+        * sysext's extension-release files now support '_any' as a special
+          value for the ID= field, to allow distribution-independent extensions
+          (e.g.: fully statically compiled binaries, scripts). It also gained
+          support for a new ARCHITECTURE= field that may be used to explicitly
+          restrict an image to hosts of a specific architecture.
+
+        * systemd-repart now supports creating squashfs partitions. This
+          requires mksquashfs from squashfs-tools.
+
+        * systemd-repart gained a --split flag to also generate split
+          artifacts, i.e. a separate file for each partition. This is useful in
+          conjunction with systemd-sysupdate or other tools, or to generate
+          split dm-verity artifacts.
+
+        * systemd-repart is now able to generate dm-verity partitions, including
+          signatures.
+
+        * systemd-repart can now set a partition UUID to zero, allowing it to
+          be filled in later, such as when using verity partitions.
+
+        * systemd-repart now supports drop-ins for its configuration files.
+
+        * Package metadata logged by systemd-coredump in the system journal is
+          now more compact.
+
+        * xdg-autostart-service now expands 'tilde' characters in Exec lines.
+
+        * systemd-oomd now automatically links against libatomic, if available.
+
+        * systemd-oomd now sends out a 'Killed' D-Bus signal when a cgroup is
+          killed.
+
+        * scope units now also provide oom-kill status.
+
+        * systemd-pstore will now try to load only the efi_pstore kernel module
+          before running, ensuring that pstore can be used.
+
+        * systemd-logind gained a new StopIdleSessionSec= option to stop an idle
+          session after a preconfigure timeout.
+
+        * systemd-homed will now wait up to 30 seconds for workers to terminate,
+          rather than indefinitely.
+
+        * homectl gained a new '--luks-sector-size=' flag that allows users to
+          select the preferred LUKS sector size. Must be a power of 2 between 512
+          and 4096. systemd-userdbd records gained a corresponding field.
+
+        * systemd-sysusers will now respect the 'SOURCE_DATE_EPOCH' environment
+          variable when generating the 'sp_lstchg' field, to ensure an image
+          build can be reproducible.
+
+        * 'udevadm wait' will now listen to kernel uevents too when called with
+          --initialized=no.
+
+        * When naming network devices udev will now consult the Devicetree
+          "alias" fields for the device.
+
+        * systemd-udev will now create infiniband/by-path and
+          infiniband/by-ibdev links for Infiniband verbs devices.
+
+        * systemd-udev-trigger.service will now also prioritize input devices.
+
+        * ConditionACPower= and systemd-ac-power will now assume the system is
+          running on AC power if no battery can be found.
+
+        * All features and tools using the TPM2 will now communicate with it
+          using a bind key. Beforehand, the tpm2 support used encrypted sessions
+          by creating a primary key that was used to encrypt traffic. This
+          creates a problem as the key created for encrypting the traffic could
+          be faked by an active interposer on the bus. In cases when a pin is
+          used, a bind key will be used. The pin is used as the auth value for
+          the seal key, aka the disk encryption key, and that auth value will be
+          used in the session establishment. An attacker would need the pin
+          value to create the secure session and thus an active interposer
+          without the pin cannot interpose on TPM2 traffic.
+
+        * systemd-growfs no longer requires udev to run.
+
+        * systemd-backlight now will better support systems with multiple
+          graphic cards.
+
+        * systemd-cryptsetup's keyfile-timeout= option now also works when a
+          device is used as a keyfile.
+
+        * systemd-cryptenroll gained a new --unlock-key-file= option to get the
+          unlocking key from a key file (instead of prompting the user). Note
+          that this is the key for unlocking the volume in order to be able to
+          enroll a new key, but it is not the key that is enrolled.
+
+        * systemd-dissect gained a new --umount switch that will safely and
+          synchronously unmount all partitions of an image previously mounted
+          with 'systemd-dissect --mount'.
+
+        * When using gcrypt, all systemd tools and services will now configure
+          it to prefer the OS random number generator if present.
+
+        * All example code shipped with documentation has been relicensed from CC0
+          to MIT-0.
+
+        * Unit tests will no longer fail when running on a system without
+          /etc/machine-id.
+
+        Experimental features:
+
+        * BPF programs can now be compiled with bpf-gcc (requires libbpf >= 1.0
+          and bpftool >= 7.0).
+
+        * sd-boot can automatically enroll SecureBoot keys from files found on
+          the ESP. This enrollment can be either automatic ('force' mode) or
+          controlled by the user ('manual' mode). It is sufficient to place the
+          SecureBoot keys in the right place in the ESP and they will be picked
+          up by sd-boot and shown in the boot menu.
+
+        * The mkosi config in systemd gained support for automatically
+          compiling a kernel with the configuration appropriate for testing
+          systemd. This may be useful when developing or testing systemd in
+          tandem with the kernel.
+
+        Contributions from: 김인수, Adam Williamson, adrian5, Aidan Dang,
+        Akihiko Odaki, Alban Bedel, Albert Mikaelyan, Aleksey Vasenev,
+        Alexander Graf, Alexander Shopov, Alexander Wilson,
+        Alper Nebi Yasak, anarcat, Anders Jonsson, Andre Kalb,
+        Andrew Stone, Andrey Albershteyn, Anita Zhang, Ansgar Burchardt,
+        Antonio Alvarez Feijoo, Arnaud Ferraris, Aryan singh, asavah,
+        Avamander, Avram Lubkin, Balázs Meskó, Bastien Nocera,
+        Benjamin Franzke, BerndAdameit, bin456789, Celeste Liu,
+        Chih-Hsuan Yen, Christian Brauner, Christian Göttsche,
+        Christian Hesse, Clyde Byrd III, codefiles, Colin Walters,
+        Cristian Rodríguez, Daan De Meyer, Daniel Braunwarth,
+        Daniel Rusek, Dan Streetman, Darsey Litzenberger, David Edmundson,
+        David Jaša, David Rheinsberg, David Seifert, David Tardon,
+        dependabot[bot], Devendra Tewari, Dominique Martinet, drosdeck,
+        Edson Juliano Drosdeck, Eduard Tolosa, eggfly, Einsler Lee,
+        Elias Probst, Eli Schwartz, Evgeny Vereshchagin, exploide, Fei Li,
+        Foster Snowhill, Franck Bui, Frank Dana, Frantisek Sumsal,
+        Gerd Hoffmann, Gio, Goffredo Baroncelli, gtwang01,
+        Guillaume W. Bres, H A, Hans de Goede, Heinrich Schuchardt,
+        Hugo Carvalho, i-do-cpp, igo95862, j00512545, Jacek Migacz,
+        Jade Bilkey, James Hilliard, Jan B, Janis Goldschmidt,
+        Jan Janssen, Jan Kuparinen, Jan Luebbe, Jan Macku,
+        Jason A. Donenfeld, Javkhlanbayar Khongorzul, Jeremy Soller,
+        JeroenHD, jiangchuangang, João Loureiro,
+        Joaquín Ignacio Aramendía, Jochen Sprickerhof,
+        Johannes Schauer Marin Rodrigues, Jonas Kümmerlin,
+        Jonas Witschel, Jonathan Kang, Jonathan Lebon, Joost Heitbrink,
+        Jörg Thalheim, josh-gordon-fb, Joyce, Kai Lueke, lastkrick,
+        Lennart Poettering, Leon M. George, licunlong, Li kunyu,
+        LockBlock-dev, Loïc Collignon, Lubomir Rintel, Luca Boccassi,
+        Luca BRUNO, Ludwig Nussel, Łukasz Stelmach, Maccraft123,
+        Marc Kleine-Budde, Marius Vollmer, Martin Wilck, matoro,
+        Matthias Lisin, Max Gautier, Maxim Mikityanskiy, Michael Biebl,
+        Michal Koutný, Michal Sekletár, Michal Stanke, Mike Gilbert,
+        Mitchell Freiderich, msizanoen1, Nick Rosbrook, nl6720, Oğuz Ersen,
+        Oleg Solovyov, Olga Smirnova, Pablo Ceballos, Pavel Zhukov,
+        Phaedrus Leeds, Philipp Gortan, Piotr Drąg, Pyfisch,
+        Quentin Deslandes, Rahil Bhimjiani, Rene Hollander, Richard Huang,
+        Richard Phibel, Rudi Heitbaum, Sam James, Sarah Brofeldt,
+        Sean Anderson, Sebastian Scheibner, Shreenidhi Shedi,
+        Sonali Srivastava, Steve Ramage, Suraj Krishnan, Swapnil Devesh,
+        Takashi Sakamoto, Ted X. Toth, Temuri Doghonadze, Thomas Blume,
+        Thomas Haller, Thomas Hebb, Tomáš Hnyk, Tomasz Paweł Gajc,
+        Topi Miettinen, Ulrich Ölmann, undef, Uriel Corfa,
+        Victor Westerhuis, Vincent Dagonneau, Vishal Chillara Srinivas,
+        Vito Caputo, Weblate, Wenchao Hao, William Roberts, williamsumendap,
+        wineway, xiaoyang, Yuri Chornoivan, Yu Watanabe,
+        Zbigniew Jędrzejewski-Szmek, Zhaofeng Li, наб
+
+        – The Great Beyond, 2022-10-31 👻
+
 CHANGES WITH 251:
 
         Backwards-incompatible changes:
@@ -29,19 +635,19 @@ CHANGES WITH 251:
           and backward compatibility broken instead on the assumption that
           nobody can be affected given the current state of this interface.
 
-        * All kernels supported by systemd mix RDRAND (or similar) into the
-          entropy pool at early boot. This means that on those systems, even if
-          /dev/urandom is not yet initialized, it still returns bytes that that
-          are at least as high quality as RDRAND. For that reason, we no longer
-          have reason to invoke RDRAND from systemd itself, which has
-          historically been a source of bugs. Furthermore, kernels ≥5.6 provide
-          the getrandom(GRND_INSECURE) interface for returning random bytes
-          before the entropy pool is initialized without warning into kmsg,
-          which is what we attempt to use if available. systemd's direct usage
-          of RDRAND has been removed. x86 systems ≥Broadwell that are running
-          an older kernel may experience kmsg warnings that were not seen with
-          250. For newer kernels, non-x86 systems, or older x86 systems, there
-          should be no visible changes.
+        * All kernels supported by systemd mix bytes returned by RDRAND (or
+          similar) into the entropy pool at early boot. This means that on
+          those systems, even if /dev/urandom is not yet initialized, it still
+          returns bytes that are of at least RDRAND quality. For that reason,
+          we no longer have reason to invoke RDRAND from systemd itself, which
+          has historically been a source of bugs. Furthermore, kernels ≥5.6
+          provide the getrandom(GRND_INSECURE) interface for returning random
+          bytes before the entropy pool is initialized without warning into
+          kmsg, which is what we attempt to use if available. systemd's direct
+          usage of RDRAND has been removed. x86 systems ≥Broadwell that are
+          running an older kernel may experience kmsg warnings that were not
+          seen with 250. For newer kernels, non-x86 systems, or older x86
+          systems, there should be no visible changes.
 
         * sd-boot will now measure the kernel command line into TPM PCR 12
           rather than PCR 8. This improves usefulness of the measurements on
@@ -54,16 +660,15 @@ CHANGES WITH 251:
           If enabled, the measurement is done twice: into the new-style PCR 12
           *and* the old-style PCR 8. It's strongly advised to migrate all users
           to PCR 12 for this purpose in the long run, as we intend to remove
-          this compatibility feature in two year's time.
+          this compatibility feature in two years' time.
 
         * busctl capture now writes output in the newer pcapng format instead
           of pcap.
 
-        * An udev rule that imported hwdb matches for USB devices with
-          lowercase hexadecimal vendor/product ID digits was added in systemd
-          250. This has been reverted, since uppercase hexadecimal digits are
-          supposed to be used, and we already had a rule that with the
-          appropriate match.
+        * A udev rule that imported hwdb matches for USB devices with lowercase
+          hexadecimal vendor/product ID digits was added in systemd 250. This
+          has been reverted, since uppercase hexadecimal digits are supposed to
+          be used, and we already had a rule with the appropriate match.
 
           Users might need to adjust their local hwdb entries.
 
@@ -216,7 +821,7 @@ CHANGES WITH 251:
 
         * The sd-id128 API gained a new call sd_id128_to_uuid_string() that is
           similar to sd_id128_to_string() but formats the ID in RFC 4122 UUID
-          format instead of simple series of hex characters.
+          format instead of as a simple series of hex characters.
 
         * The sd-device API gained two new calls sd_device_new_from_devname()
           and sd_device_new_from_path() which permit allocating an sd_device
@@ -311,8 +916,8 @@ CHANGES WITH 251:
 
         * A new "unmerged-usr" taint flag has been added that is set whenever
           running on systems where /bin/ + /sbin/ are *not* symlinks to their
-          counterparts in /usr/, i.e. on systems where the /usr/-merge has been
-          completed.
+          counterparts in /usr/, i.e. on systems where the /usr/-merge has not
+          been completed.
 
         * Generators invoked by PID 1 will now have a couple of useful
           environment variables set describing the execution context a
@@ -738,7 +1343,7 @@ CHANGES WITH 250:
           unit skip/fail activation if the system's (or a slice's) memory/cpu/io
           pressure is above the configured threshold, using the kernel PSI
           feature. For more details see systemd.unit(5) and
-          https://www.kernel.org/doc/html/latest/accounting/psi.html
+          https://docs.kernel.org/accounting/psi.html
 
         * The combination of ProcSubset=pid and ProtectKernelTunables=yes and/or
           ProtectKernelLogs=yes can now be used.
@@ -1929,9 +2534,9 @@ CHANGES WITH 249:
           unit, which will be instantiated using the same instance name.
 
         * A new MemoryAvailable property is available for units. If the unit,
-          or the slice(s) it is part of, have a memory limit set via MemoryMax=/
+          or the slices it is part of, have a memory limit set via MemoryMax=/
           MemoryHigh=, MemoryAvailable will indicate how much more memory the
-          unit can claim before hitting the limit(s).
+          unit can claim before hitting the limits.
 
         * systemd-coredump will now try to stay below the cgroup memory limit
           placed on itself or one of the slices it runs under, if the storage
@@ -2332,7 +2937,7 @@ CHANGES WITH 248:
           units.
 
           systemd-oomd is now considered fully supported (the usual
-          backwards-compatiblity promises apply). Swap is not required for
+          backwards-compatibility promises apply). Swap is not required for
           operation, but it is still recommended.
 
         * systemd-timesyncd gained a new ConnectionRetrySec= setting which
@@ -5333,7 +5938,7 @@ CHANGES WITH 240:
           a client with a Wi-Fi and Ethernet both connected to the internet).
 
           Consult the kernel documentation for details on this sysctl:
-          https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt
+          https://docs.kernel.org/networking/ip-sysctl.html
 
         * The v239 change to turn on "net.ipv4.tcp_ecn" by default has been
           reverted.
diff --git a/README b/README
index 3b104c2..92e3ca0 100644
--- a/README
+++ b/README
@@ -17,7 +17,6 @@ BUG REPORTS:
         https://github.com/systemd/systemd/issues
 
 OLDER DOCUMENTATION:
-
         http://0pointer.de/blog/projects/systemd.html
         https://www.freedesktop.org/wiki/Software/systemd
 
@@ -43,10 +42,15 @@ REQUIREMENTS:
                      ≥ 5.4 for signed Verity images
                      ≥ 5.7 for BPF links and the BPF LSM hook
 
-        Kernel versions below 4.15 have significant gaps in functionality and
-        are not recommended for use with this version of systemd. Taint flag
-        'old-kernel' will be set. Systemd will most likely still function, but
-        upstream support and testing are limited.
+        ⛔ Kernel versions below 3.15 ("minimum baseline") are not supported at
+        all, and are missing required functionality (e.g. CLOCK_BOOTTIME
+        support for timerfd_create()).
+
+        ⚠️ Kernel versions below 4.15 ("recommended baseline") have significant
+        gaps in functionality and are not recommended for use with this version
+        of systemd (e.g. lack sufficiently comprehensive and working cgroupv2
+        support). Taint flag 'old-kernel' will be set. systemd will most likely
+        still function, but upstream support and testing are limited.
 
         Kernel Config Options:
           CONFIG_DEVTMPFS
@@ -60,11 +64,6 @@ REQUIREMENTS:
           CONFIG_PROC_FS
           CONFIG_FHANDLE (libudev, mount and bind mount handling)
 
-        Kernel crypto/hash API:
-          CONFIG_CRYPTO_USER_API_HASH
-          CONFIG_CRYPTO_HMAC
-          CONFIG_CRYPTO_SHA256
-
         udev will fail to work with the legacy sysfs layout:
           CONFIG_SYSFS_DEPRECATED=n
 
@@ -182,7 +181,7 @@ REQUIREMENTS:
         libcryptsetup (optional), >= 2.3.0 required for signed Verity images support
         libaudit (optional)
         libacl (optional)
-        libbpf >= 0.2.0 (optional)
+        libbpf >= 0.1.0 (optional)
         libfdisk >= 2.32 (from util-linux) (optional)
         libselinux (optional)
         liblzma (optional)
@@ -207,7 +206,8 @@ REQUIREMENTS:
         python >= 3.5
         meson >= 0.53.2
         ninja
-        gcc, awk, sed, grep, and similar tools
+        gcc >= 4.7
+        awk, sed, grep, and similar tools
         clang >= 10.0, llvm >= 10.0 (optional, required to build BPF programs
                 from source code in C)
         gnu-efi >= 3.0.5 (optional, required for systemd-boot)
@@ -268,7 +268,6 @@ REQUIREMENTS:
         - capsh              (optional, used by test-execute)
 
 POLICY FOR SUPPORT OF DISTRIBUTIONS AND ARCHITECTURES:
-
         systemd main branch and latest major or stable releases are generally
         expected to compile on current versions of popular distributions (at
         least all non-EOL versions of Fedora, Debian unstable/testing/stable,
@@ -313,7 +312,7 @@ USERS AND GROUPS:
         Similarly, the coredump support requires the "systemd-coredump" system
         user and group to exist.
 
-NSS:
+GLIBC NSS:
         systemd ships with four glibc NSS modules:
 
         nss-myhostname resolves the local hostname to locally configured IP
@@ -359,7 +358,7 @@ WARNINGS and TAINT FLAGS:
         will break if /usr is on a separate late-mounted partition, many of its
         dependencies very likely will break sooner or later in one form or
         another. For example, udev rules tend to refer to binaries in /usr,
-        binaries that link to libraries in /usr or binaries that refer to data
+        binaries that link to libraries in /usr, or binaries that refer to data
         files in /usr. Since these breakages are not always directly visible,
         systemd will warn about this. Such setups are not really supported by
         the basic set of Linux OS components. Taint flag 'split-usr' will be
@@ -393,6 +392,8 @@ WARNINGS and TAINT FLAGS:
 
           busctl get-property org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager Tainted
 
+        See org.freedesktop.systemd1(5) for more information.
+
 VALGRIND:
         To run systemd under valgrind, compile with meson option
         -Dvalgrind=true and have valgrind development headers installed
@@ -408,5 +409,5 @@ STABLE BRANCHES AND BACKPORTS:
         Stable branches are started for certain releases of systemd and named
         after them, e.g. v238-stable. Stable branches are managed by
         distribution maintainers on an as needed basis. See
-        https://www.freedesktop.org/wiki/Software/systemd/Backports/ for some
+        https://www.freedesktop.org/wiki/Software/systemd/Backports for some
         more information and examples.
diff --git a/README.md b/README.md
index f0ed551..e507c4c 100644
--- a/README.md
+++ b/README.md
@@ -2,21 +2,19 @@
 
 System and Service Manager
 
-<a href="http://in.waw.pl/systemd-github-state/systemd-systemd-issues.svg"><img align="right" src="http://in.waw.pl/systemd-github-state/systemd-systemd-issues-small.svg" alt="Count of open issues over time"></a>
-<a href="http://in.waw.pl/systemd-github-state/systemd-systemd-pull-requests.svg"><img align="right" src="http://in.waw.pl/systemd-github-state/systemd-systemd-pull-requests-small.svg" alt="Count of open pull requests over time"></a>
 [![Semaphore CI 2.0 Build Status](https://the-real-systemd.semaphoreci.com/badges/systemd/branches/main.svg?style=shields)](https://the-real-systemd.semaphoreci.com/projects/systemd)<br/>
 [![Coverity Scan Status](https://scan.coverity.com/projects/350/badge.svg)](https://scan.coverity.com/projects/350)<br/>
 [![OSS-Fuzz Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/systemd.svg)](https://oss-fuzz-build-logs.storage.googleapis.com/index.html#systemd)<br/>
 [![CIFuzz](https://github.com/systemd/systemd/workflows/CIFuzz/badge.svg)](https://github.com/systemd/systemd/actions)<br/>
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1369/badge)](https://bestpractices.coreinfrastructure.org/projects/1369)<br/>
-[![Language Grade: C/C++](https://img.shields.io/lgtm/grade/cpp/g/systemd/systemd.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/systemd/systemd/context:cpp)<br/>
 [![CentOS CI - CentOS 8](https://jenkins-systemd.apps.ocp.ci.centos.org/buildStatus/icon?subject=CentOS%20CI%20-%20CentOS%208&job=upstream-centos8)](https://jenkins-systemd.apps.ocp.ci.centos.org/job/upstream-centos8/)<br/>
 [![CentOS CI - Arch](https://jenkins-systemd.apps.ocp.ci.centos.org/buildStatus/icon?subject=CentOS%20CI%20-%20Arch&job=upstream-vagrant-archlinux)](https://jenkins-systemd.apps.ocp.ci.centos.org/job/upstream-vagrant-archlinux/)<br/>
 [![CentOS CI - Arch (sanitizers)](https://jenkins-systemd.apps.ocp.ci.centos.org/buildStatus/icon?subject=CentOS%20CI%20-%20Arch%20(sanitizers)&job=upstream-vagrant-archlinux-sanitizers)](https://jenkins-systemd.apps.ocp.ci.centos.org/job/upstream-vagrant-archlinux-sanitizers/)<br/>
 [![CentOS CI - Rawhide (SELinux)](https://jenkins-systemd.apps.ocp.ci.centos.org/buildStatus/icon?subject=CentOS%20CI%20-%20Rawhide%20(SELinux)&job=upstream-vagrant-rawhide-selinux)](https://jenkins-systemd.apps.ocp.ci.centos.org/view/Upstream/job/upstream-vagrant-rawhide-selinux/)<br/>
 [![Fossies codespell report](https://fossies.org/linux/test/systemd-main.tar.gz/codespell.svg)](https://fossies.org/linux/test/systemd-main.tar.gz/codespell.html)</br>
 [![Coverage Status](https://coveralls.io/repos/github/systemd/systemd/badge.svg?branch=main)](https://coveralls.io/github/systemd/systemd?branch=main)</br>
-[![Packaging status](https://repology.org/badge/tiny-repos/systemd.svg)](https://repology.org/project/systemd/versions)
+[![Packaging status](https://repology.org/badge/tiny-repos/systemd.svg)](https://repology.org/project/systemd/versions)</br>
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/systemd/systemd/badge)](https://api.securityscorecards.dev/projects/github.com/systemd/systemd)
 
 ## Details
 
diff --git a/TODO b/TODO
index 2ae9aae..560ec4b 100644
--- a/TODO
+++ b/TODO
@@ -77,8 +77,546 @@ Janitorial Clean-ups:
 * rework mount.c and swap.c to follow proper state enumeration/deserialization
   semantics, like we do for device.c now
 
+* get rid of prefix_roota() and similar, only use chase_symlinks() and related
+  calls instead.
+
+* get rid of basename() and replace by path_extract_filename()
+
+Deprecations and removals:
+
+* Remove any support for booting without /usr pre-mounted in the initrd entirely.
+  Update INITRD_INTERFACE.md accordingly.
+
+* 2019-10 – Remove POINTINGSTICK_CONST_ACCEL references from the hwdb, see #9573
+
+* remove cgrouspv1 support EOY 2023. As per
+  https://lists.freedesktop.org/archives/systemd-devel/2022-July/048120.html
+  and then rework cgroupsv2 support around fds, i.e. keep one fd per active
+  unit around, and always operate on that, instead of cgroup fs paths.
+
+* drop support for kernels that lack ambient capabilities support (i.e. make
+  4.3 new baseline). Then drop support for "!!" modifier for ExecStart= which
+  is only supported for such old kernels.
+
+* drop support for getrandom()-less kernels. (GRND_INSECURE means once kernel
+  5.6 becomes our baseline). See
+  https://github.com/systemd/systemd/pull/24101#issuecomment-1193966468 for
+  details. Maybe before that: at taint-flags/warn about kernels that lack
+  getrandom()/environments where it is blocked.
+
+* drop support for LOOP_CONFIGURE-less loopback block devices, once kernel
+  baseline is 5.8.
+
+* drop fd_is_mount_point() fallback mess once we can rely on
+  STATX_ATTR_MOUNT_ROOT to exist i.e. kernel baseline 5.8
+
+* rework our PID tracking in services and so on, to be strictly based on pidfd,
+  once kernel baseline is 5.13.
+
+* ~2023: remove support for TPM_PCR_INDEX_KERNEL_PARAMETERS_COMPAT
+
+* H2 2023: remove support for unmerged-usr
+
 Features:
 
+* sd-stub: add ".bootcfg" section for kernel bootconfig data (as per
+
+* tpm2: add (optional) support for generating a local signing key from PCR 15
+  state. use private key part to sign PCR 7+14 policies. stash signatures for
+  expected PCR7+14 policies in EFI var. use public key part in disk encryption.
+  generate new sigs whenever db/dbx/mok/mokx gets updated. that way we can
+  securely bind against SecureBoot/shim state, without having to renroll
+  everything on each update (but we still have to generate one sig on each
+  update, but that should be robust/idempotent). needs rollback protection, as
+  usual.
+
+* Lennart: big blog story about DDIs
+
+* Lennart: big blog story about building initrds
+
+* Lennart: big blog story about "why systemd-boot"
+
+* bpf: see if we can use BPF to solve the syslog message cgroup source problem:
+  one idea would be to patch source sockaddr of all AF_UNIX/SOCK_DGRAM to
+  implicitly contain the source cgroup id. Another idea would be to patch
+  sendto()/connect()/sendmsg() sockaddr on-the-fly to use a different target
+  sockaddr.
+
+* bpf: see if we can address opportunistic inode sharing of immutable fs images
+  with BPF. i.e. if bpf gives us power to hook into openat() and return a
+  different inode than is requested for which we however it has same contents
+  then we can use that to implement opportunistic inode sharing among DDIs:
+  make all DDIs ship xattr on all reg files with a SHA256 hash. Then, also
+  dictate that DDIs should come with a top-level subdir where all reg files are
+  linked into by their SHA256 sum. Then, whenever an inode is opened with the
+  xattr set, check bpf table to find dirs with hashes for other prior DDIs and
+  try to use inode from there.
+
+* dissect too: add --with switch that will invoke a command with the image
+  mounted, and as current working directory. Terminate once done.
+
+* extend the verity signature partition to permit multiple signatures for the
+  same root hash, so that people can sign a single image with multiple keys.
+
+* consider adding a new partition type, just for /opt/ for usage in system
+  extensions
+
+* gpt-auto-discovery: also use the pkcs7 signature stuff, and pass signature to
+  kernel. So far we only did this for the various --image= switches, but not
+  for the root fs or /usr/.
+
+* extend systemd-measure with an --append= mode when signing expected PCR
+  measurements. In this mode the tool should read an existing signature JSON
+  object (which primarily contains an array with the actual signature data),
+  and then append the new signature to it instead of writing out an entirely
+  JSON object. Usecase: it might make sense to to sign a UKI's expected PCRs
+  with different keys for different boot phases. i.e. use keypair X for signing
+  the expected PCR in the initrd boot phase and keypair Y for signing the
+  expected PCR in the main boot phase. Via the --append logic we could merge
+  these signatures into one object, and then include the result in the UKI.
+  Then, if you bind a LUKS volume to public key X it really only can be
+  unlocked during early boot, and you bind a LUKS volume to public key Y it
+  really only can be unlocked during later boot, and so on.
+
+* dissection policy should enforce that unlocking can only take place by
+  certain means, i.e. only via pw, only via tpm2, or only via fido, or a
+  combination thereof.
+
+* make the systemd-repart "seed" value provisionable via credentials, so that
+  confidential computing environments can set it and deterministically
+  enforce the uuids for partitions created, so that they can calculate PCR 15
+  ahead of time.
+
+* systemd-repart: also derive the volume key from the seed value, for the
+  aforementioned purpose.
+
+* in the initrd: derive the default machine ID to pass to the host PID 1 via
+  $machine_id from the same seed credential.
+
+* Add systemd-sysupdate-initrd.service or so that runs systemd-sysupdate in the
+  initrd to bootstrap the initrd to populate the initial partitions. Some things
+  to figure out:
+  - Should it run on firstboot or on every boot?
+  - If run on every boot, should it use the sysupdate config from the host on
+    subsequent boots?
+
+* hook up journald with TPMs? measure new journal records to the TPM in regular
+  intervals, validate the journal against current TPM state with that. (taking
+  inspiration from IMA log)
+
+* provide an API to apps to encrypt/decrypt credentials. usecase: allow
+  bluez bluetooth daemon to pass pairings to initrd that way, without shelling
+  out to our tools.
+
+* revisit default PCR bindings in cryptenroll and systemd-creds. Currently they
+  use PCR 7 which should contain secureboot state db/dbx. Which sounded like a
+  safe bet, given that it should change only on policy changes, and not
+  software updates. But that's wrong. Recent fwupd (rightfully) contains code
+  for updating the dbx denylist. This means even without any active policy
+  change PCR 7 might change. Hence, better idea might be in systemd-creds to
+  default to PCR 15 at least if sd-stub is used (i.e. bind to system identity),
+  and in cryptsetup simply the empty list? Also, PCR 14 almost certainly should
+  be included as much as PCR 7 (as it contains shim's policy, which is
+  certainly as relevant as PCR 7 on many systems)
+
+* move discoverable partition spec and boot loader spec over to uapi group
+
+* maybe measure UUIDs of important mounted file systems (after mount, via the
+  new ioctls to query them) into PCR 15? Add "x-systemd.measure-pcr=" or so for
+  this that pulls in a per mount service?
+
+* measure /etc/machine-id during early boot into PCR 15?
+
+* To mimic the new tpm2-measure-pcr= crypttab option add the same to veritytab
+  (measuring the root hash) and integritytab (measuring the HMAC key if one is
+  used)
+
+* We should start measuring all services, containers, and system extensions we
+  activate. probably into PCR 13. i.e. add --tpm2-measure-pcr= or so to
+  systemd-nspawn, and MeasurePCR= to unit files. Should contain a measurement
+  of the activated configuration and the image that is being activated (in case
+  verity is used, hash of the root hash).
+
+* whenever we measure something into a TPM PCR from userspace, write a record in
+  TCG's "Canonical Event Log" format to some file, so that we can reason about
+  how PCR values we manage came to
+  be. https://trustedcomputinggroup.org/resource/canonical-event-log-format/
+
+* bootspec: permit graceful "update" from type #2 to type #1. If both a type #1
+  and a type #2 entry exist under otherwise the exact same name, then use the
+  type #1 entry, and ignore the type #2 entry. This way, people can "upgrade"
+  from the UKI with all parameters baked in to a Type #1 .conf file with manual
+  parametrization, if needed. This matches our usual rule that admin config
+  should win over vendor defaults.
+
+* sd-stub: optionally allow users to configure manual kernel command line even
+  in SecureBoot by authenticating it via shim's APIs, integrating with MOK and
+  similar: instead of authenticating just PE code shim should be capable of
+  authenticating any kind of data for us, including files containing kernel
+  command lines.
+
+* write a "search path" spec, that documents the prefixes to search in
+  (i.e. the usual /etc/, /run/, /usr/lib/ dance, potentially /usr/etc/), how to
+  sort found entries, how masking works and overriding.
+
+* automatic boot assessment: add one more default success check that just waits
+  for a bit after boot, and blesses the boot if the system stayed up that long.
+
+* implement concept of "versioned" resources inside a dir, and write a spec for
+  it. Make all tools in systemd, in particular
+  RootImage=/RootDirectory=/--image=/--directory= implement this. Idea:
+  directories ending in ".v/" indicate a directory with versioned resources in
+  them. Versioned resources inside a .v dir are always named in the pattern
+  <prefix>_<version>[+<tries-left>[-<tries-done>]].<suffix>
+
+* add support for using this .v/ logic on the root fs itself: in the initrd,
+  after mounting the rootfs, look for root-<arch>.v/ in the root fs, and then
+  apply the logic, moving the switch root logic there.
+
+* systemd-repart: add support for generating ISO9660 images
+
+* systemd-repart: in addition to the existing "factory reset" mode (which
+  simply empties existing partitions marked for that). add a mode where
+  partitions marked for it are entirely removed. Usecase: remove secondary OS
+  copy, and redundant partitions entirely, and recreate them anew.
+
+* systemd-boot: maybe add support for collapsing menu entries of the same OS
+  into one item that can be opened (like in a "tree view" UI element) or
+  collapsed. If only a single OS is installed, disable this mode, but if
+  multiple OSes are installed might make sense to default to it, so that user
+  is not immediately bombarded with a multitude of Linux kernel versions but
+  only one for each OS.
+
+* systemd-repart: if the GPT *disk* UUID (i.e. the one global for the entire
+  disk) is set to all FFFFF then use this as trigger for factory reset, in
+  addition to the existing mechanisms via EFI variables and kernel command
+  line. Benefit: works also on non-EFI systems, and can be requested on one
+  boot, for the next.
+
+* figure out a sane way when building UKIs how to extract SBAT data from inner
+  kernel, extend it with component info, and add to outer kernel.
+
+* systemd-sysupdate: make transport pluggable, so people can plug casync or
+  similar behind it, instead of http.
+
+* systemd-tmpfiles: add concept for conditionalizing lines on factory reset
+  boot, or on first boot.
+
+* in UKIs: add way to define allowlist of additional words that can be added to
+  the kernel cmdline even in SecureBoot mode
+
+* we probably needs .pcrpkeyrd or so as additional PE section in UKIs,
+  which contains a separate public key for PCR values that only apply in the
+  initrd, i.e. in the boot phase "enter-initrd". Then, consumers in userspace
+  can easily bind resources to just the initrd. Similar, maybe one more for
+  "enter-initrd:leave-initrd" for resources that shall be accessible only
+  before unprivileged user code is allowed. (we only need this for .pcrpkey,
+  not for .pcrsig, since the latter is a list of signatures anyway). With that,
+  when you enroll a LUKS volume or similar, pick either the .pcrkey (for
+  coverage through all phases of the boot, but excluding shutdown), the
+  .pcrpkeyrd (for coverage in the initrd only) and .pcrpkeybt (for coverage
+  until users are allowed to log in).
+
+* Once the root fs LUKS volume key is measured into PCR 15, default to binding
+  credentials to PCR 15 in "systemd-creds"
+
+* add support for asymmetric LUKS2 TPM based encryption. i.e. allow preparing
+  an encrypted image on some host given a public key belonging to a specific
+  other host, so that only hosts possessing the private key in the TPM2 chip
+  can decrypt the volume key and activate the volume. Usecase: systemd-syscfg
+  for a central orchestrator to generate syscfg images securely that can only
+  be activated on one specific host (which can be used for installing a bunch
+  of creds in /etc/credstore/ for example). Extending on this: allow binding
+  LUKS2 TPM based encryption also to the TPM2 internal clock. Net result:
+  prepare a syscfg image that can only be activated on a specific host that
+  runs a specific software in a specific time window. syscfg would be
+  automatically invalidated outside of it.
+
+* maybe add a "systemd-report" tool, that generates a TPM2-backed "report" of
+  current system state, i.e. a combination of PCR information, local system
+  time and TPM clock, running services, recent high-priority log
+  messages/coredumps, system load/PSI, signed by the local TPM chip, to form an
+  enhanced remote attestation quote. Usecase: a simple orchestrator could use
+  this: have the report tool upload these reports every 3min somewhere. Then
+  have the orchestrator collect these reports centrally over a 3min time
+  window, and use them to determine what which node should now start/stop what,
+  and generate a small syscfg for each node, that uses Uphold= to pin services
+  on each node.  The syscfg would be encrypted using the asymmetric encryption
+  proposed above, so that it can only be activated on the specific host, if the
+  software is in a good state, and within a specific time frame. Then run a
+  loop on each node that sends report to orchestrator and then sysupdate to
+  update syscfg.  Orchestrator would be stateless, i.e. operate on desired
+  config and collected reports in the last 3min time window only, and thus can
+  be trivially scaled up since all instances of the orchestrator should come to
+  the same conclusions given the same inputs of reports/desired workload info.
+  Could also be used to deliver Wireguard secrets and thus to clients, thus
+  permitting zero-trust networking: secrets are rolled over via syscfg updates,
+  and via the time window TPM logic invalidated if node doesn't keep itself
+  updated, or becomes corrupted in some way.
+
+* Always measure the LUKS rootfs volume key into PCR 15, and derive the machine
+  ID from it securely. This would then allow us to bind secrets a specific
+  system securely.
+
+* nspawn: maybe allow TPM passthrough, backed by swtpm, and measure --image=
+  hash into its PCR 11, so that nspawn instances can be TPM enabled, and
+  partake in measurements/remote attestation and such. swtpm would run outside
+  of control of container, and ideally would itself bind its encryption keys to
+  host TPM.
+
+* tree-wide: convert as much as possible over to use sd_event_set_signal_exit(), instead
+  of manually hooking into SIGINT/SIGTERM
+
+* tree-wide: convert as much as possible over to SD_EVENT_SIGNAL_PROCMASK
+  instead of manual blocking.
+
+* sd-boot: for each installed OS, grey out older entries (i.e. all but the
+  newest), to indicate they are obsolete
+
+* automatically propagate LUKS password credential into cryptsetup from host
+  (i.e. SMBIOS type #11, …), so that one can unlock LUKS via VM hypervisor
+  supplied password.
+
+* add ability to path_is_valid() to classify paths that refer to a dir from
+  those which may refer to anything, and use that in various places to filter
+  early. i.e. stuff ending in "/", "/." and "/.." definitely refers to a
+  directory, and paths ending that way can be refused early in many contexts.
+
+* systemd-measure: allow operating with PEM certificates in addition to PEM
+  public keys when signing PCR values. SecureBoot and our Verity signatures
+  operate with certificates already, hence I guess we should also just deal for
+  convencience with certificates for the PCR stuff too.
+
+* systemd-measure: add --pcrpkey-auto as an alternative to --pcrpkey=, where it
+  would just use the same public key specified with --public-key= (or the one
+  automatically derived from --private-key=).
+
+* tmpfiles: add new line type for setting btrfs subvolume attributes (i.e. rw/ro)
+
+* tmpfiles: add new line type for setting fcaps
+
+* push people to use ".sysext.raw" as suffix for sysext DDIs (DDI =
+  discoverable disk images, i.e. the new name for gpt disk images following the
+  discoverable disk spec). [Also: just ".sysext/" for directory-based sysext]
+
+* Add "purpose" flag to partition flags in discoverable partition spec that
+  indicate if partition is intended for sysext, for portable service, for
+  booting and so on. Then, when dissecting DDI allow specifying a purpose to
+  use as additional search condition. Usecase: images that combined a sysext
+  partition with a portable service partition in one.
+
+* On boot, auto-generate an asymmetric key pair from the TPM,
+  and use it for validating DDIs and credentials. Maybe upload it to the kernel
+  keyring, so that the kernel does this validation for us for verity and kernel
+  modules
+
+* for systemd-syscfg: add a tool that can generate suitable DDIs with verity +
+  sig using squashfs-tools-ng's library. Maybe just systemd-repart called under
+  a new name with a built-in config?
+
+* gpt-auto: generate mount units that reference partitions via
+  /dev/disk/by-diskseq/… so that they can't be swapped out behind our back.
+
+* lock down acceptable encrypted credentials at boot, via simple allowlist,
+  maybe on kernel command line:
+  systemd.import_encrypted_creds=foobar.waldo,tmpfiles.extra to protect locked
+  down kernels from credentials generated on the host with a weak kernel
+
+* Add support for extra verity configuration options to systemd-repart (FEC,
+  hash type, etc)
+
+* chase_symlinks(): take inspiraton from path_extract_filename() and return
+  O_DIRECTORY if input path contains trailing slash.
+
+* chase_symlinks(): refuse resolution if trailing slash is specified on input,
+  but final node is not a directory
+
+* chase_symlinks(): add new flag that simply refuses all symlink use in a path,
+  then use that for accessing XBOOTLDR/ESP
+
+* document in boot loader spec that symlinks in XBOOTLDR/ESP are not OK even if
+  non-VFAT fs is used.
+
+* measure credentials picked up from SMBIOS to some suitable PCR
+
+* measure GPT and LUKS headers somewhere when we use them (i.e. in
+  systemd-gpt-auto-generator/systemd-repart and in systemd-cryptsetup?)
+
+* pick up creds from EFI vars
+
+* sd-stub/sd-boot: write RNG seed to LINUX_EFI_RANDOM_SEED_TABLE_GUID config
+  table as well. (and possibly drop our efi var). Current kernels will pick up
+  the seed from there already, if EFI_RNG_PROTOCOL is not implemented by
+  firmware.
+
+* sd-boot: include domain specific hash string in hash function for random seed
+  plus sizes of everything. also include DMI/SMBIOS blob
+
+* sd-stub: invoke random seed logic the same way as in sd-boot, except if
+  random seed EFI variable is already set. That way, the variable set will be
+  set in all cases: if you just use sd-stub, or just sd-boot, or both.
+
+* sd-boot: we probably should include all BootXY EFI variable defined boot
+  entries in our menu, and then suppress ourselves. Benefit: instant
+  compatibility with all other OSes which register things there, in particular
+  on other disks. Always boot into them via NextBoot EFI variable, to not
+  affect PCR values.
+
+* systemd-measure tool:
+  - pre-calculate PCR 12 (command line) + PCR 13 (sysext) the same way we can precalculate PCR 11
+
+* in sd-boot: load EFI drivers from a new PE section. That way, one can have a
+  "supercharged" sd-boot binary, that could carry ext4 drivers built-in.
+
+* sd-bus: document that sd_bus_process() only returns messages that non of the
+  filters/handlers installed on the connection took possession of.
+
+* sd-device: add an API for acquiring list of child devices, given a device
+  objects (i.e. all child dirents that dirs or symlinks to dirs)
+
+* sd-device: maybe pin the sysfs dir with an fd, during the entire runtime of
+  an sd_device, then always work based on that.
+
+* add small wrapper around qemu that implements sd_notify/AF_VSOCK + machined and
+  maybe some other stuff and boots it
+
+* maybe add new flags to gpt partition tables for rootfs and usrfs indicating
+  purpose, i.e. whether something is supposed to be bootable in a VM, on
+  baremetal, on an nspawn-style container, if it is a portable service image,
+  or a sysext for initrd, for host os, or for portable container. Then hook
+  portabled/… up to udev to watch block devices coming up with the flags set, and
+  use it.
+
+* sd-boot should look for information what to boot in SMBIOS, too, so that VM
+  managers can tell sd-boot what to boot into and suchlike
+
+* PID 1 should look for an SMBIOS variable that encodes an AF_VSOCK address it
+  should send sd_notify() ready notifications to. That way a VMM can boot up a
+  system, and generically know when it finished booting.
+
+* add "systemd-sysext identify" verb, that you can point on any file in /usr/
+  and that determines from which overlayfs layer it originates, which image, and with
+  what it was signed.
+
+* journald: generate recognizable log events whenever we shutdown journald
+  cleanly, and when we migrate run → var. This way tools can verify that a
+  previous boot terminated cleanly, because either of these two messages must
+  be safely written to disk, then.
+
+* systemd-creds: extend encryption logic to support asymmetric
+  encryption/authentication. Idea: add new verb "systemd-creds public-key"
+  which generates a priv/pub key pair on the TPM2 and stores the priv key
+  locally in /var. It then outputs a certificate for the pub part to stdout.
+  This can then be copied/taken elsewhere, and can be used for encrypting creds
+  that only the host on its specific hw can decrypt. Then, support a drop-in
+  dir with certificates that can be used to authenticate credentials. Flow of
+  operations is then this: build image with owner certificate, then after
+  boot up issue "systemd-creds public-key" to acquire pubkey of the machine.
+  Then, when passing data to the machine, sign with privkey belonging to one of
+  the dropped in certs and encrypted with machine pubkey, and pass to machine.
+  Machine is then able to authenticate you, and confidentiality is guaranteed.
+
+* building on top of the above, the pub/priv key pair generated on the TPM2
+  should probably also one you can use to get a remote attestation quote.
+
+* bootctl: add "gc" verb that loads all type #1 .conf files, and then removes
+  all files from the set of files from the ESP/XBOOTLDR matching the entry
+  token that are not referenced by any. Then, change kernel-install to use only
+  this to remove auxiliary files, and never remove them explicitly. Benefit:
+  resources such as initrds/kernels/dtb can be shared between entries.
+
+* Process credentials in:
+  • networkd/udevd: add a way to define additional .link, .network, .netdev files
+    via the credentials logic.
+  • fstab-generator: allow defining additional fstab-like mounts via
+    credentials (similar: crypttab-generator, verity-generator,
+    integrity-generator)
+  • getty-generator: allow defining additional getty instances via a credential
+  • run-generator: allow defining additional commands to run via a credential
+  • resolved: allow defining additional /etc/hosts entries via a credential (it
+    might make sense to then synthesize a new combined /etc/hosts file in /run
+    and bind mount it on /etc/hosts for other clients that want to read it.
+    Similar, allow picking up DNS server IP addresses from credential.
+  • repart: allow defining additional partitions via credential
+  • timesyncd: pick NTP server info from credential
+  • portabled: read a credential "portable.extra" or so, that takes a list of
+    file system paths to enable on start.
+  • make systemd-fstab-generator look for a system credential encoding root= or
+    usr=
+  • systemd-homed: when initializing, look for a credential
+    systemd.homed.register or so with JSON user records to automatically
+    register if not registered yet.  Usecase: deploy a system, and add an
+    account one can directly log into.
+  • initialize machine ID from systemd credential picked up from the ESP via
+    sd-stub, so that machine ID is stable even on systems where unified kernels
+    are used, and hence kernel cmdline cannot be modified locally
+  • in gpt-auto-generator: check partition uuids against such uuids supplied via
+    sd-stub credentials. That way, we can support parallel OS installations with
+    pre-built kernels.
+
+* define a JSON format for units, separating out unit definitions from unit
+  runtime state. Then, expose it:
+
+  1. Add Describe() method to Unit D-Bus object that returns a JSON object
+     about the unit.
+  2. Expose this natively via Varlink, in similar style
+  3. Use it when invoking binaries (i.e. make PID 1 fork off systemd-executor
+     binary which reads the JSON definition and runs it), to address the cow
+     trap issue and the fact that NSS is actually forbidden in
+     forked-but-not-exec'ed children
+  4. Add varlink API to run transient units based on provided JSON definitions
+
+* show SUPPORT_END= data in "hostnamectl" output (and thus also expose a prop
+  for this on dbus)
+
+* Add SUPPORT_END_URL= field to os-release with more *actionable* information
+  what to do if support ended
+
+* pam_systemd: on interactive logins, maybe show SUPPORT_END information at
+  login time, á la motd
+
+* sd-boot: instead of unconditionally deriving the ESP to search boot loader
+  spec entries in from the paths of sd-boot binary, let's optionally allow it
+  to be configured on sd-boot cmdline + efi var. Usecase: embed sd-boot in the
+  UEFI firmware (for example, ovmf supports that via qemu cmdline option), and
+  use it to load stuff from the ESP.
+
+* mount /var/ from initrd, so that we can apply sysext and stuff before the
+  initrd transition. Specifically:
+  1. There should be a var= kernel cmdline option, matching root= and usr=
+  2. systemd-gpt-auto-generator should auto-mount /var if it finds it on disk
+  3. mount.x-initrd mount option in fstab should be implied for /var
+
+* implement varlink introspection
+
+* we should probably drop all use of prefix_roota() and friends, and use
+  chase_symlinks() instead
+
+* make persistent restarts easier by adding a new setting OpenPersistentFile=
+  or so, which allows opening one or more files that is "persistent" across
+  service restarts, hot reboot, cold reboots (depending on configuration): the
+  files are created empty on first invocation, and on subsequent invocations
+  the files are reboot. The files would be backed by tmpfs, pmem or /var
+  depending on desired level of persistency.
+
+* sd-event: add ability to "chain" event sources. Specifically, add a call
+  sd_event_source_chain(x, y), which will automatically enable event source y
+  in oneshit mode once x is triggered. Use case: in src/core/mount.c implement
+  the /proc/self/mountinfo rescan on SIGCHLD with this: whenever a SIGCHLD is
+  seen, trigger the rescan defer event source automatically, and allow it to be
+  dispatched *before* the SIGCHLD is handled (based on priorities). Benefit:
+  dispatch order is strictly controlled by priorities again. (next step: chain
+  event sources to the ratelimit being over)
+
+* if we fork of a service with StandardOutput=journal, and it forks off a
+  subprocess that quickly dies, we might not be able to identify the cgroup it
+  comes from, but we can still derive that from the stdin socket its output
+  came from. We apparently don't do that right now.
+
+* add ability to set hostname with suffix derived from machine id at boot
+
+* add PR_SET_DUMPABLE service setting
+
 * homed/userdb: maybe define a "companion" dir for home directories where apps
   can safely put privileged stuff in. Would not be writable by the user, but
   still conceptually belong to the user. Would be included in user's quota if
@@ -96,54 +634,11 @@ Features:
 * given that /etc/ssh/ssh_config.d/ is a thing now, ship a drop-in for that
   that hooks up userbdctl ssh-key stuff.
 
-* allow embedding a signature blob for PCR hashes into separate section in
-  unified kernel binaries. This section should be picked up by sd-stub, and
-  passed in a file to the booted kernel (via initrd cpio, as usual). Usecase:
-  this way we can implement disk encryption policies that bind to specific
-  kernel PCR state, without breaking things on every kernel update. As long as
-  the kernel includes the PCR signature blob we should be good, as disk
-  encryption can then pass the signature to the TPM to unlock their secrets.
-  Why do this via a separate PE section? That's because the PCR state depends
-  on the measured kernel/initrd of course, thus we cannot put the signature
-  into the kernel/initrd itself, because that would require a time machine.
-  Hence we have to find a separate place. A simple solution is a PE section
-  of its own, because then it is next to the kernel and initrd which after all
-  are stored in PE sections of their own too. Building a unified kernel would
-  thus mean, calculating PCR values for the raw kernel image, and raw initrd
-  image, then signing those PCR values with a vendor key, and then combining
-  sd-stub, raw kernel image, raw initrd, and PCR signature into a unified
-  kernel image.
-
-* a new tool "systemd-trust" or so, that can calculate PCR hashes offline, and
-  optionally sign them. for that we should extend our syntax for specifying pcr
-  policies (e.g. the string like "4+7+9") so that it can also include explicit
-  hash values, i.e.
-  4=sha256:0ef149998289474e4bb31813edda6ad7f3c991b2d8dec6e8fe4db7a1f039f2d1+7=sha256:87428fc522803d31065e7bce3cf03fe475096631e5e07bbd7a0fde60c4cf25c7+9=sha256:0263829989b6fd954f72baaf2fc64bc2e2f01d692d4de72986ea808f6e99813f
-  and file names to calculate hashes from, i.e.
-  4=file:/boot/vmlinuz+7=file:/boot/initrd/+9=file:/etc/fstab"
-  The systemd-trust tool should then be able to resolve any "underspecifed"
-  form into the form with explicit hash values.
-
 * maybe add support for binding and connecting AF_UNIX sockets in the file
   system outside of the 108ch limit. When connecting, open O_PATH fd to socket
   inode first, then connect to /proc/self/fd/XYZ. When binding, create symlink
   to target dir in /tmp, and bind through it.
 
-* tmpfiles: for f/F/w lines, if the argument columns is left unspecified, look
-  for a service credential named after the file path to write to, and load
-  contents to write from there. Usecase: provision arbitrary files from
-  credentials. Example use: with a line like "f /root/.ssh/authorized-keys
-  0644 root root" in a tmpfiles.d/ snippet add
-  LoadCredential=root.ssh.authorized-keys via drop-in to
-  systemd-tmpfiles.service, and then provision an SSH access key through
-  nspawn's --load-credential=, through qemu's fw_cfg, or via systemd-stub's
-  credntial pick-up. The latter is particularly interesting to implement SSH
-  access to an initrd.
-
-* systemd-homed: when initializing, look for a credential sysemd.homed.register
-  or so with JSON user records to automatically register if not registered yet.
-  Usecase: deploy a system, and add an account one can directly log into.
-
 * add a proper concept of a "developer" mode, i.e. where cryptographic
   protections of the root OS are weakened after interactive confirmation, to
   allow hackers to allow their own stuff. idea: allow entering developer mode
@@ -159,14 +654,11 @@ Features:
   set up the directory so that it can only be accessed if host and app are in
   order.
 
-* TPM2: add auth policy for signed PCR values to make updates easy. i.e. do
-  what tpm2_policyauthorize tool does.  To be truly useful scheme needs to be a
-  bit more elaborate though: policy probably must take some nvram based
-  generation counter into account that can only monotonically increase and can
-  be used to invalidate old PCR signatures. Otherwise people could downgrade to
-  old signed PCR sets whenever they want. Usecase: encrypt the rootfs with LUKS
-  with a key that can only be unlocked via a pristine pre-built Fedora
-  kernel+initrd.
+* TPM2: extend unlock policy to protect against version downgrades in signed
+  policies: policy probably must take some nvram based generation counter into
+  account that can only monotonically increase and can be used to invalidate
+  old PCR signatures. Otherwise people could downgrade to old signed PCR sets
+  whenever they want.
 
 * update HACKING.md to suggest developing systemd with the ideas from:
   https://0pointer.net/blog/testing-my-system-code-in-usr-without-modifying-usr.html
@@ -177,15 +669,6 @@ Features:
   cloud-init/ignitation and similar can parameterize the host with data they
   acquire.
 
-* Add ConditionCredentialExists= or so, that allows conditionalizing services
-  depending on whether a specific system credential is set. Usecase: a service
-  similar to the ssh keygen service that installs any SSH host key supplied via
-  system credentials into /etc/ssh.
-
-* drop support for kernels that lack ambient capabilities support (i.e. make
-  4.3 new baseline). Then drop support for "!!" modifier for ExecStart= which
-  is only supported for such old kernels
-
 * sd-event: compat wd reuse in inotify code: keep a set of removed watch
   descriptors, and clear this set piecemeal when we see the IN_IGNORED event
   for it, or when read() returns EAGAIN or on IN_Q_OVERFLOW. Then, whenever we
@@ -194,12 +677,6 @@ Features:
   case the same wd is reused multiple times before we start processing
   IN_IGNORED again)
 
-* sd-stub: set efi var indicating stub features, i.e. whether they pick up
-  creds, sysexts and so on. similar to existing variable of sd-boot
-
-* sd-stub: set efi vars declaring TPM PCRs we measured creds/cmdline + sysext
-  into (even if we hardcode them)
-
 * systemd-fstab-generator: support addition mount specifications via kernel
   cmdline. Usecase: invoke a VM, and mount a host homedir into it via
   virtio-fs.
@@ -222,10 +699,6 @@ Features:
   - sd-stub: automatically pick up microcode from ESP (/loader/microcode/*)
     and synthesize initrd from it, and measure it. Signing is not necessary, as
     microcode does that on its own. Pass as first initrd to kernel.
-  - sd-stub should measure the kernel/initrd/… into a separate PCR, so that we
-    have one PCR we can bind the encrypted creds to that is not effected by
-    anything else but what we drop in via kernel-install, i.e. by earlier EFI
-    code running (i.e. like PCR 4)
 
 * Add a new service type very similar to Type=notify, that goes one step
   further and extends the protocol to cover reloads. Specifically, SIGHUP will
@@ -263,10 +736,6 @@ Features:
 * sd-boot: rework random seed handling following recent kernel changes: always
   pass seed to kernel, but credit only if secure boot is used
 
-* sd-boot: hash data from GetNextHighMonotonicCount() into updated random seed,
-  so that we might even open up up the random seed logic to non-SecureBoot
-  systems?
-
 * sd-boot: also include the hyperv "vm generation id" in the random seed hash,
   to cover nicely for machine clones. It's found in the ACPI tables, which
   should be easily accessible from UEFI.
@@ -314,14 +783,6 @@ Features:
   the real kernel. benefit: downloading these stubs would be tiny and quick,
   hence cheap for enumeration.
 
-* initialize machine ID from systemd credential picked up from the ESP via
-  sd-stub, so that machine ID is stable even on systems where unified kernels
-  are used, and hence kernel cmdline cannot be modified locally
-
-* in gpt-auto-generator: check partition uuids against such uuids supplied via
-  sd-stub credentials. That way, we can support parallel OS installations with
-  pre-built kernels.
-
 * sysext: measure all activated sysext into a TPM PCR
 
 * maybe add a "syscfg" concept, that is almost entirely identical to "sysext",
@@ -386,10 +847,9 @@ Features:
 * doc: prep a document explaining PID 1's internal logic, i.e. transactions,
   jobs, units
 
-* bootspec: remove tries counter from boot entry ids
-
 * bootspec: bring UEFI and userspace enumeration of bootspec entries back into
-  sync, i.e. parse out tries in both
+  sync, i.e. parse out architecture field in sd-boot (currently only done in
+  userspace)
 
 * automatically ignore threaded cgroups in cg_xyz().
 
@@ -398,7 +858,7 @@ Features:
 
 * systemd-dissect: show GPT disk UUID in output
 
-* Enable RestricFileSystems= for all our long-running services (similar:
+* Enable RestrictFileSystems= for all our long-running services (similar:
   RestrictNetworkInterfaces=)
 
 * Add systemd-analyze security checks for RestrictFileSystems= and
@@ -418,9 +878,6 @@ Features:
   such as masking out /usr/lib/ or so. We should probably refuse if existing
   inodes are replaced by other types of inodes or so.
 
-* sysext: ensure one can build a sysext that can safely apply to *any* system
-  (because it contains only static go binaries in /opt/ or so)
-
 * userdb: when synthesizing NSS records, pick "best" password from defined
   passwords, not just the first. i.e. if there are multiple defined, prefer
   unlocked over locked and prefer non-empty over empty.
@@ -473,7 +930,7 @@ Features:
   dep in the base OS image)
 
 * sysext: automatically activate sysext images dropped in via new sd-stub
-  sysext pickup logic.
+  sysext pickup logic. (must insist on verity + signature on those though)
 
 * add concept for "exitrd" as inverse of "initrd", that we can transition to at
   shutdown, and has similar security semantics. This should then take the place
@@ -509,21 +966,36 @@ Features:
   images, to configure this. Also, add a kernel cmdline option for this, to be
   honoured by the gpt auto generator.
 
+  Alternative idea: add "systemd.gpt_auto_policy=rhvs" to allow gpt-auto to
+  only mount root dir, /home/ dir, /var/ and /srv/, but nothing else. And then
+  minor extension to this, insisting on encryption, for example
+  "systemd.gpt_auto_policy=r+v+h" to require encryption for root and var but not
+  for /home/, and similar. Similar add --image-dissect-policy= to tools that
+  take --image= that take the same short string.
+
 * nspawn: maybe optionally insert .nspawn file as GPT partition into images, so
   that such container images are entirely stand-alone and can be updated as
   one.
 
 * we probably should extend the root verity hash of the root fs into some PCR
-  on boot. (i.e. maybe add a crypttab option tpm2-measure=8 or so to measure it
-  into PCR 8)
+  on boot. (i.e. maybe add a veritytab option tpm2-measure=12 or so to measure
+  it into PCR 12); Similar: we probably should extend the LUKS volume key of
+  the root fs into some PCR on boot. (i.e. maybe add a crypttab option
+  tpm2-measure=15 or so to measure it into PCR 15); once both are in place
+  update gpt-auto-discovery to generate these by default for the partitions it
+  discovers. Static vendor stuff should probably end up in PCR 12 (i.e. the
+  verity hash), with local keys in PCR 15 (i.e. the encryption volume
+  key). That way, we nicely distinguish resources supplied by the OS vendor
+  (i.e. sysext, root verity) from those inherently local (i.e. encryption key),
+  which is useful if they shall be signed separately.
 
 * add a "policy" to the dissection logic. i.e. a bit mask what is OK to mount,
   what must be read-only, what requires encryption, and what requires
   authentication.
 
-* in uefi stub: query firmware regarding which PCRs are being used, store that
-  in EFI var. then use this when enrolling TPM2 in cryptsetup to verify that
-  the selected PCRs actually are used by firmware.
+* in uefi stub: query firmware regarding which PCR banks are being used, store
+  that in EFI var. then use this when enrolling TPM2 in cryptsetup to verify
+  that the selected PCRs actually are used by firmware.
 
 * rework recursive read-only remount to use new mount API
 
@@ -542,7 +1014,6 @@ Features:
 * sysupdate:
   - add fuzzing to the pattern parser
   - support casync as download mechanism
-  - direct TPM2 PCR change handling, possible renrolling LUKS2 media if needed.
   - "systemd-sysupdate update --all" support, that iterates through all components
     defined on the host, plus all images installed into /var/lib/machines/,
     /var/lib/portable/ and so on.
@@ -624,18 +1095,11 @@ Features:
 * add tpm.target or so which is delayed until TPM2 device showed up in case
   firmware indicates there is one.
 
-* Add concept for upgrading TPM2 enrollments, maybe a new switch
-  --pcrs=4:<hash> or so, i.e. select a PCR to include in the hash, and then
-  override its hash
-
 * TPM2: auto-reenroll in cryptsetup, as fallback for hosed firmware upgrades
   and such
 
 * introduce a new group to own TPM devices
 
-* cryptsetup: if only recovery keys are registered and no regular passphrases,
-  ask user for "recovery key", not "passphrase"
-
 * cyptsetup: add option for automatically removing empty password slot on boot
 
 * cryptsetup: optionally, when run during boot-up and password is never
@@ -690,9 +1154,6 @@ Features:
 
 * if /usr/bin/swapoff fails due to OOM, log a friendly explanatory message about it
 
-* Remove any support for booting without /usr pre-mounted in the initrd entirely.
-  Update INITRD_INTERFACE.md accordingly.
-
 * pid1: Move to tracking of main pid/control pid of units per pidfd
 
 * pid1: support new clone3() fork-into-cgroup feature
@@ -719,8 +1180,8 @@ Features:
   mapping to $RUNTIME_DIRECTORY, $STATE_DIRECTORY and such
 
 * All tools that support --root= should also learn --image= so that they can
-  operate on disk images directly. Specifically: bootctl, systemctl,
-  coredumpctl. (Already done: systemd-nspawn, systemd-firstboot,
+  operate on disk images directly. Specifically: systemctl, coredumpctl.
+  (Already done: bootctl, systemd-nspawn, systemd-firstboot,
   systemd-repart, systemd-tmpfiles, systemd-sysusers, journalctl)
 
 * seccomp: by default mask x32 ABI system wide on x86-64. it's on its way out
@@ -1040,7 +1501,8 @@ Features:
   "systemd-gdb" for attaching to the start-up of any system service in its
   natural habitat.
 
-* gpt-auto logic: support encrypted swap, add kernel cmdline option to force it, and honour a gpt bit about it, plus maybe a configuration file
+* gpt-auto logic: support encrypted swap, add kernel cmdline option to force
+  it, and honour a gpt bit about it, plus maybe a configuration file
 
 * add a percentage syntax for TimeoutStopSec=, e.g. TimeoutStopSec=150%, and
   then use that for the setting used in user@.service. It should be understood
@@ -1106,20 +1568,16 @@ Features:
 * there's probably something wrong with having user mounts below /sys,
   as we have for debugfs. for example, src/core/mount.c handles mounts
   prefixed with /sys generally special.
-  http://lists.freedesktop.org/archives/systemd-devel/2015-June/032962.html
+  https://lists.freedesktop.org/archives/systemd-devel/2015-June/032962.html
 
 * fstab-generator: default to tmpfs-as-root if only usr= is specified on the kernel cmdline
 
-* initrd-parse-etc.service: can we skip daemon-reload if /sysroot/etc/fstab is missing?
-  Note that we start initrd-fs.target and initrd-cleanup.target there, so a straightforward
-  ConditionPathExists= is not enough.
-
 * docs: bring https://www.freedesktop.org/wiki/Software/systemd/MyServiceCantGetRealtime up to date
 
 * add a job mode that will fail if a transaction would mean stopping
   running units. Use this in timedated to manage the NTP service
   state.
-  http://lists.freedesktop.org/archives/systemd-devel/2015-April/030229.html
+  https://lists.freedesktop.org/archives/systemd-devel/2015-April/030229.html
 
 * The udev blkid built-in should expose a property that reflects
   whether media was sensed in USB CF/SD card readers. This should then
@@ -1130,13 +1588,13 @@ Features:
 * hostnamectl: show root image uuid
 
 * Find a solution for SMACK capabilities stuff:
-  http://lists.freedesktop.org/archives/systemd-devel/2014-December/026188.html
+  https://lists.freedesktop.org/archives/systemd-devel/2014-December/026188.html
 
 * synchronize console access with BSD locks:
-  http://lists.freedesktop.org/archives/systemd-devel/2014-October/024582.html
+  https://lists.freedesktop.org/archives/systemd-devel/2014-October/024582.html
 
 * as soon as we have sender timestamps, revisit coalescing multiple parallel daemon reloads:
-  http://lists.freedesktop.org/archives/systemd-devel/2014-December/025862.html
+  https://lists.freedesktop.org/archives/systemd-devel/2014-December/025862.html
 
 * figure out when we can use the coarse timers
 
@@ -1204,6 +1662,8 @@ Features:
   - when reloading configuration, apply new cgroup configuration
   - when recursively showing the cgroup hierarchy, optionally also show
     the hierarchies of child processes
+- add settings for cgroup.max.descendants and cgroup.max.depth,
+  maybe use them for user@.service
 
 * transient units:
   - add field to transient units that indicate whether systemd or somebody else saves/restores its settings, for integration with libvirt
@@ -1255,9 +1715,9 @@ Features:
     log both units as UNIT=, so that journalctl -u triggers on both.
   - generate better errors when people try to set transient properties
     that are not supported...
-    http://lists.freedesktop.org/archives/systemd-devel/2015-February/028076.html
+    https://lists.freedesktop.org/archives/systemd-devel/2015-February/028076.html
   - maybe introduce WantsMountsFor=? Usecase:
-    http://lists.freedesktop.org/archives/systemd-devel/2015-January/027729.html
+    https://lists.freedesktop.org/archives/systemd-devel/2015-January/027729.html
   - recreate systemd's D-Bus private socket file on SIGUSR2
   - move PAM code into its own binary
   - when we automatically restart a service, ensure we restart its rdeps, too.
@@ -1360,7 +1820,6 @@ Features:
   - longer term: priority inheritance
   - dbus spec updates:
        - NameLost/NameAcquired obsolete
-       - GVariant
        - path escaping
   - update systemd.special(7) to mention that dbus.socket is only about the compatibility socket now
 
@@ -1382,32 +1841,11 @@ Features:
 
 * mount: turn dependency information from /proc/self/mountinfo into dependency information between systemd units.
 
-* firstboot: allow provisioning of /etc/hosts entries, so that we can via the
-  credentials logic insert host name to resolve into containers/hosts. Usecase:
-  fork a container, and make it ping some specific address which is defined by
-  the host on invocation
-
 * systemd-firstboot: make sure to always use chase_symlinks() before
   reading/writing files
 
 * firstboot: make it useful to be run immediately after yum --installroot to set up a machine. (most specifically, make --copy-root-password work even if /etc/passwd already exists
 
-* sd-boot: define a drop-in dir in the ESP that may contain X.509
-  certificates. If the firmware is detected to be in setup mode, automatically
-  enroll them as PK/KEK/db, turn off setup mode and proceed. Optionally,
-  instead of auto-enrolling them add them to the sd-boot menu, giving the user
-  the option to manually enroll them, after selecting the menu entry. This way,
-  installer images can just drop the certfiicates in the ESP, and on first boot
-  can easily enroll the keys without ever booting up.
-
-* efi stub: optionally, load initrd from disk as a separate file, HMAC check it
-  with key from TPM, bound to PCR, refusing if failing. This would then allow
-  traditional distros that generate initrds locally to secure them with TPM:
-  after generating the initrd, do the HMAC calculation, put result in initrd
-  filename, done. This would then bind the validity of the initrd to the local
-  host, and used kernel, and means people cannot change initrd or kernel
-  without booting the kernel + initrd.
-
 * EFI:
   - honor language efi variables for default language selection (if there are any?)
   - honor timezone efi variables for default timezone selection (if there are any?)
@@ -1421,9 +1859,6 @@ Features:
   - show whether UEFI audit mode is available
   - teach it to prepare an ESP wholesale, i.e. with mkfs.vfat invocation
   - teach it to copy in unified kernel images and maybe type #1 boot loader spec entries from host
-  - make it operate on loopback files, dissecting enough to find ESP to operate on
-  - bootspec: properly support boot attempt counters when parsing entry file names
-  - support --quiet in is-installed, update
 
 * kernel-install:
   - optionally, support generating type #2 entries instead of type #1, including signing them
@@ -1668,10 +2103,17 @@ Features:
 
 * systemd-repart: allow disabling growing of specific partitions, or making
   them (think ESP: we don't ever want to grow it, since we cannot resize vfat)
+  Also add option to disable operation via kernel command line.
 
 * systemd-repart: make it a static checker during early boot for existence and
   absence of other partitions for trusted boot environments
 
+* systemd-repart: add support for SD_GPT_FLAG_GROWFS also on real systems, i.e.
+  generate some unit to actually enlarge the fs after growing the partition
+  during boot.
+
+* systemd-repart: do not print "Successfully resized …" when no change was done.
+
 * document:
   - document that deps in [Unit] sections ignore Alias= fields in
     [Install] units of other units, unless those units are disabled
@@ -1802,10 +2244,13 @@ Features:
   - kill scsi_id
   - add trigger --subsystem-match=usb/usb_device device
   - reimport udev db after MOVE events for devices without dev_t
+  - re-enable ProtectClock= once only cgroupsv2 is supported.
+    See f562abe2963bad241d34e0b308e48cf114672c84.
 
 * coredump:
   - save coredump in Windows/Mozilla minidump format
   - when truncating coredumps, also log the full size that the process had, and make a metadata field so we can report truncated coredumps
+  - add examples for other distros in ELF_PACKAGE_METADATA
 
 * support crash reporting operation modes (https://live.gnome.org/GnomeOS/Design/Whiteboards/ProblemReporting)
 
@@ -1818,6 +2263,7 @@ Features:
   - add --test mode
   - teach tmpfiles.d q/Q logic something sensible in the context of XFS/ext4
     project quota
+  - teach tmpfiles.d m/M to move / atomic move + symlink old -> new
 
 * udev-link-config:
    - Make sure ID_PATH is always exported and complete for
diff --git a/catalog/systemd.bg.catalog.in b/catalog/systemd.bg.catalog.in
index 65e0833..34645dc 100644
--- a/catalog/systemd.bg.catalog.in
+++ b/catalog/systemd.bg.catalog.in
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 #
-#  Copyright © 2016 Alexander Shopov <[e-mail]>
+#  Copyright © 2016, 2022 Alexander Shopov <[e-mail]>
 
 # Message catalog for systemd's own messages
 
@@ -26,7 +26,7 @@ Support: %SUPPORT_URL%
 журнални файлове.
 
 -- ec387f577b844b8fa948f33cad9a75e6
-Subject: Пространството върху диска заето от журналните файлове
+Subject: Пространство върху диска заето от журналните файлове
 Defined-By: systemd
 Support: %SUPPORT_URL%
 
@@ -42,13 +42,13 @@ Support: %SUPPORT_URL%
 За повече информация прегледайте „journald.conf(5)“ от ръководството.
 
 -- a596d6fe7bfa4994828e72309e95d61e
-Subject: Съобщенията от някоя услуга не са допуснати
+Subject: Съобщенията от някоя услуга са отхвърлени
 Defined-By: systemd
 Support: %SUPPORT_URL%
 Documentation: man:journald.conf(5)
 
 Някоя услуга генерира прекалено много съобщения за кратък период.
-Част само от нейните съобщения са отхвърляни.
+Част от нейните съобщения са отхвърляни.
 
 Съобщенията от другите услуги не са засегнати.
 
@@ -66,50 +66,62 @@ Support: %SUPPORT_URL%
 смогваше да ги обработи достатъчно бързо.
 
 -- fc2e22bc6ee647b6b90729ab34a250b1
-Subject: Процес № @COREDUMP_PID@ (@COREDUMP_COMM@) запази освободената памет
+Subject: Процес @COREDUMP_PID@ (@COREDUMP_COMM@) запази освободената памет
 Defined-By: systemd
 Support: %SUPPORT_URL%
 Documentation: man:core(5)
 
-Процес № @COREDUMP_PID@ (@COREDUMP_COMM@) заби, представянето му в паметта
+Процес @COREDUMP_PID@ (@COREDUMP_COMM@) заби, представянето му в паметта
 бе запазено.
 
 Най-често това се дължи на грешка в забилата програма и следва да я
 докладвате на създателите на програмата.
 
+-- 5aadd8e954dc4b1a8c954d63fd9e1137
+Subject: Файлът с представяне в паметта е отрязан до @SIZE_LIMIT@ байта
+Defined-By: systemd
+Support: %SUPPORT_URL%
+Documentation: man:coredump.conf(5)
+
+Заделената памет за процеса надвишава настроения максимум за обработка и
+съхранение от systemd-coredump(8). Запазени са само първите @SIZE_LIMIT@ байта.
+Този файл (core) може да се окаже полезен, въпреки че е отсечен. Част от
+инструментите за работа като gdb(1) може да изведат предупреждение за
+отсичането.
+
 -- 8d45620c1a4348dbb17410da57c60c66
-Subject: Създадена е нова сесия № @SESSION_ID@ за потребителя „@USER_ID@“
+Subject: Създадена е нова сесия @SESSION_ID@ за потребителя @USER_ID@
 Defined-By: systemd
 Support: %SUPPORT_URL%
 Documentation: sd-login(3)
 
-За потребителя „@USER_ID@“ е създадена нова сесия № @SESSION_ID@.
+За потребителя „@USER_ID@“ е създадена нова сесия @SESSION_ID@.
 
-Водещият процес на сесията е: @LEADER@
+Водещият процес на сесията е @LEADER@
 
 -- 3354939424b4456d9802ca8333ed424a
-Subject: Сесия № @SESSION_ID@ приключи
+Subject: Сесия @SESSION_ID@ приключи
 Defined-By: systemd
 Support: %SUPPORT_URL%
 Documentation: sd-login(3)
 
-Сесия № @SESSION_ID@ приключи работа.
+Сесия @SESSION_ID@ приключи работа.
 
 -- fcbefc5da23d428093f97c82a9290f7b
-Subject: Налично е ново работно място № @SEAT_ID@
+Subject: Налично е ново работно място @SEAT_ID@
 Defined-By: systemd
 Support: %SUPPORT_URL%
 Documentation: sd-login(3)
 
-Новото работно място № @SEAT_ID@ е настроено и готово за работа.
+Новото работно място @SEAT_ID@ е настроено и готово за работа.
 
 -- e7852bfe46784ed0accde04bc864c2d5
-Subject: Работното място № @SEAT_ID@ е премахнато
+Subject: Работното място @SEAT_ID@ е премахнато
 Defined-By: systemd
 Support: %SUPPORT_URL%
 Documentation: sd-login(3)
 
-Работното място № @SEAT_ID@ вече не е налично.
+Работното място @SEAT_ID@ вече не е налично.
 
 -- c7a787079b354eaaa9e77b371893cd27
 Subject: Смяна на системното време
@@ -120,7 +132,7 @@ Support: %SUPPORT_URL%
 1 януари 1970.
 
 -- 45f82f4aef7a4bbf942ce861d1f20990
-Subject: Смяна на часовия пояс да е „@TIMEZONE@“
+Subject: Смяна на часовия пояс да е @TIMEZONE@
 Defined-By: systemd
 Support: %SUPPORT_URL%
 
@@ -142,15 +154,26 @@ Support: %SUPPORT_URL%
 
 Стартирането на потребителските програми отне @USERSPACE_USEC@ микросекунди.
 
+-- eed00a68ffd84e31882105fd973abdd1
+Subject: Стартирането на управлението на потребител завърши
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Процесът за управлението на потребител @_UID@  завърши. Всички услуги насрочени
+за това са стартиране, но може да има други услуги, които да предстои да се
+стартират.
+
+Стартирането на управлението на потребител отне @USERSPACE_USEC@ микросекунди.
+
 -- 6bbd95ee977941e497c48be27c254128
-Subject: Системата е приспана на ниво „@SLEEP@“
+Subject: Системата е приспана на ниво @SLEEP@
 Defined-By: systemd
 Support: %SUPPORT_URL%
 
 Системата премина в състояние на приспиване „@SLEEP@“.
 
 -- 8811e6df2a8e40f58a94cea26f8ebf14
-Subject: Системата се събуди след приспиване на ниво„@SLEEP@“
+Subject: Системата се събуди след приспиване на ниво @SLEEP@
 Defined-By: systemd
 Support: %SUPPORT_URL%
 
@@ -164,54 +187,71 @@ Support: %SUPPORT_URL%
 Започна процедурата на Systemd за спиране на системата. Всички процеси и
 услуги се спират, всички файлови системи се демонтират.
 
+-- c14aaf76ec284a5fa1f105f88dfb061c
+Subject: Започна процедура за връщане на заводските настройки на системата
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Започна процедура за връщане на заводските настройки на системата. Самото
+действие е изцяло определено от имплементацията. Типично се връщат заводското
+състояние и настройки от производителя.
+
 -- 7d4958e842da4a758f6c1cdc7b36dcc5
-Subject: Модул „@UNIT@“ се стартира
+Subject: Модул @UNIT@ се стартира
 Defined-By: systemd
 Support: %SUPPORT_URL%
 
-Модулът „@UNIT@“ се стартира в момента
+Модулът „@UNIT@“ се стартира в момента.
+
+Идентификаторът на задача е @JOB_ID@.
 
 -- 39f53479d3a045ac8e11786248231fbf
-Subject: Модул „@UNIT@“ вече е стартиран
+Subject: Модул @UNIT@ вече е стартиран
 Defined-By: systemd
 Support: %SUPPORT_URL%
 
 Стартирането на модул „@UNIT@“ завърши.
 
-Резултатът е: @JOB_RESULT@
+Идентификаторът на задача е @JOB_ID@.
 
--- de5b426a63be47a7b6ac3eaac82e2f6f
-Subject: Модул „@UNIT@“ се спира
+-- be02cf6855d2428ba40df7e9d022f03d
+Subject: Модул @UNIT@ не успя да стартира
 Defined-By: systemd
 Support: %SUPPORT_URL%
 
-Модулът „@UNIT@“ се спира в момента.
+Модулът „@UNIT@“ не успя да стартира.
 
--- 9d1aaa27d60140bd96365438aad20286
-Subject: Модул „@UNIT@“ вече е спрян
+Идентификаторът на задача е @JOB_ID@, а резултатът от нея е @JOB_RESULT@.
+
+-- de5b426a63be47a7b6ac3eaac82e2f6f
+Subject: Модул @UNIT@ се спира
 Defined-By: systemd
 Support: %SUPPORT_URL%
 
-Спирането на модул „@UNIT@“ завърши.
+Модулът „@UNIT@“ се спира в момента.
 
--- be02cf6855d2428ba40df7e9d022f03d
-Subject: Модулът „@UNIT@“ не успя да стартира
+Идентификаторът на задача е @JOB_ID@.
+
+-- 9d1aaa27d60140bd96365438aad20286
+Subject: Модул @UNIT@ вече е спрян
 Defined-By: systemd
 Support: %SUPPORT_URL%
 
-Модулът „@UNIT@“ не успя да стартира.
+Спирането на модул „@UNIT@“ завърши.
 
-Резултатът е: @JOB_RESULT@
+Идентификаторът на задача е @JOB_ID@, а резултатът от нея е @JOB_RESULT@.
 
 -- d34d037fff1847e6ae669a370e694725
-Subject: Модулът „@UNIT@“ започна презареждане на настройките си
+Subject: Модул @UNIT@ започна презареждане на настройките си
 Defined-By: systemd
 Support: %SUPPORT_URL%
 
-Модулът „@UNIT@“ започна презареждане на настройките си.
+Модулът „@UNIT@“ започна презареждане на настройките си.(
+
+Идентификаторът на задача е @JOB_ID@.)
 
 -- 7b05ebc668384222baa8881179cfda54
-Subject: Модулът „@UNIT@“ завърши презареждането на настройките си
+Subject: Модулът @UNIT@ завърши презареждането на настройките си
 Defined-By: systemd
 Support: %SUPPORT_URL%
 
@@ -220,13 +260,13 @@ Support: %SUPPORT_URL%
 Резултатът e: @JOB_RESULT@
 
 -- 641257651c1b4ec9a8624d7a40a9e1e7
-Subject: Програмата „@EXECUTABLE@“ не успя да се стартира
+Subject: Програмата @EXECUTABLE@ не успя да се стартира
 Defined-By: systemd
 Support: %SUPPORT_URL%
 
 Програмата „@EXECUTABLE@“ не успя да се стартира.
 
-Върнатият номер на грешка е: @ERRNO@
+Върнатият номер на грешка е: @ERRNO@.
 
 -- 0027229ca0644181a76c4e92458afa2e
 Subject: Поне едно съобщение не бе препратено към syslog
@@ -234,22 +274,17 @@ Defined-By: systemd
 Support: %SUPPORT_URL%
 
 Поне едно съобщение не бе препратено към журналната услуга syslog, която
-работи успоредно с journald.
-
-Най-често това указва, че тази реализация на syslog не може да поеме текущия
-обем съобщения.
+работи успоредно с journald. Най-често това указва, че тази реализация на
+syslog не може да поеме текущия обем съобщения.
 
 -- 1dee0369c7fc4736b7099b38ecb46ee7
 Subject: Точката за монтиране не е празна
 Defined-By: systemd
 Support: %SUPPORT_URL%
 
-Директорията „@WHERE@“ не е празна.
-
-Тя е указана като точка за монтиране — или като второ поле във файла
-„/etc/fstab“, или чрез директивата „Where=“ в някой от файловете за
-модул на Systemd.
-
+Директорията „@WHERE@“ не е празна. Тя е указана като точка
+за монтиране — или като второ поле във файла „/etc/fstab“, или чрез
+директивата „Where=“ в някой от файловете за модул на Systemd.
 Това не пречи на самото монтиране, но вече съществуващите там файлове и
 директории няма да се виждат повече, освен ако ръчно не монтирате тази
 непразна директория някъде другаде.
@@ -274,14 +309,14 @@ Support: %SUPPORT_URL%
 Subject: Режимът DNSSEC е изключен, защото сървърът не го поддържа
 Defined-By: systemd
 Support: %SUPPORT_URL%
-Documentation: man:systemd-resolved.service(8) resolved.conf(5)
+Documentation: man:systemd-resolved.service(8)
+Documentation: man:resolved.conf(5)
 
 Локалната услуга за имена (systemd-resolved.service) установи, че
-настроения сървър за DNS не поддържа DNSSEC, затова този режим е изключен.
+настроеният сървър за DNS не поддържа DNSSEC, затова този режим е изключен.
 
 Това се случва, когато директивата „DNSSEC=allow-downgrade“ е включена във
 файла „resolved.conf“ и зададеният сървър за DNS не е съвместим с DNSSEC.
-
 Внимавайте, защото това може да позволи атака, при която трета страна ви
 връща отговори, които да предизвикат понижаването на сигурността от DNSSEC
 до DNS.
@@ -295,8 +330,7 @@ Defined-By: systemd
 Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
-Заявка или запис в DNS не издържа проверка с DNSSEC.
-
+Заявка или запис в DNS не издържа̀ проверка с DNSSEC.
 Това обикновено показва вмешателство на трета страна в канала ви за връзка.
 
 -- 4d4408cfd0d144859184d1e65d7c8a65
@@ -306,5 +340,191 @@ Support: %SUPPORT_URL%
 Documentation: man:systemd-resolved.service(8)
 
 Анулирана е доверена котва за DNSSEC и трябва да настроите нова.
-
 Понякога новата идва с обновяване на системата.
+
+-- 5eb03494b6584870a536b337290809b3
+Subject: Насрочено е автоматично рестартиране на модул
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Насрочено е автоматично рестартиране на модула „@UNIT@“
+в следствие на директивата „Restart=“.
+
+-- ae8f7b866b0347b9af31fe1c80b127c0
+Subject: Модулът консумира ресурсите
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Модулът „@UNIT@“ завърши работа и изконсумира указаните ресурси.
+
+-- 7ad2d189f7e94e70a38c781354912448
+Subject: Успешен модул
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Модулът „@UNIT@“ успешно премина в „мъртво“ състояние (dead).
+
+-- 0e4284a0caca4bfc81c0bb6786972673
+Subject: Прескочен модул
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Модулът „@UNIT@“ е прескочен поради неуспешно изпълнение на командата в
+директивата „ExecCondition=“ и премина в „мъртво“ състояние (dead) с резултат
+„@UNIT_RESULT@“.
+
+-- d9b373ed55a64feb8242e02dbe79a49c
+Subject: Неуспешен модул
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Модулът „@UNIT@“ премина в състояние за неуспех „failed“ с резултат „@UNIT_RESULT@“.
+
+-- 98e322203f7a4ed290d09fe03c09fe15
+Subject: Завършил модул
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Процесът, настроен за „@COMMAND@=“ към модула „@UNIT@“ завърши работа.
+
+Изходният код е „@EXIT_CODE@“, а изходното състояние — „@EXIT_STATUS@“.
+
+-- 50876a9db00f4c40bde1a2ad381c3a1b
+Subject: Настройките на системата може да доведат до проблеми
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Възможни са следните етикети:
+⁃ „split-usr“ — „/usr“ е отделна файлова система, която не е била монтирана при
+  стартирането на systemd
+⁃ „cgroups-missing“ — ядрото е компилирано без поддръжка на „cgroup“ или е
+  ограничен достъпът до тази подсистема
+⁃ „var-run-bad“ — „/var/run“ не е символна връзка към „/run“
+⁃ "overflowuid-not-65534“ — идентификаторът на непознатия потребител („unknown“)
+   за NFS или пространство за имена на потребители не е е 65534
+⁃ „overflowgid-not-65534“ — идентификаторът на непознатата група („unknown“)
+   за NFS или пространство за имена на групи не е е 65534
+Текущо системата е отбелязана като „@TAINT@“.
+
+-- fe6faa94e7774663a0da52717891d8ef
+Subject: Процес от модула „@UNIT@“ е убит поради липса на памет
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Процес от модула „@UNIT@“ е убит от подсистемата на Linux за
+работа при недостиг на памет (OOM killer). Това обикновено означава, че
+системата е имала  малко памет и се е наложило аварийното ѝ освобождаване.
+Някой процес от модула „@UNIT@“ е бил набелязан като най-добрия
+кандидат и е бил убит от ядрото.
+
+Note that the memory pressure might or might not have been caused by @UNIT@.
+
+-- b61fdac612e94b9182285b998843061f
+Subject: Позволено име на потребител/група @USER_GROUP_NAME@ не съответства на строгите правила за именоване
+Defined-By: systemd
+Support: %SUPPORT_URL%
+Documentation: https://systemd.io/USER_NAMES
+
+Указано е име на потребител/група „@USER_GROUP_NAME@“. То е прието, защото
+отговаря на облекчените. Въпреки това то не отговаря на строгите правила.
+
+Те съответстват на регулярния израз:
+
+^[a-zA-Z_][a-zA-Z0-9_-]{0,30}$
+
+Облекчените правила приемат всички имена без празния низ; имената съдържащи
+нулев байт, контролни знаци, „:“ или „/“; имена, които не са в UTF-8;
+имена които почват или завършват с празни знаци; които са  „.“ или „..“;
+които съдържат само цифри; които започват с „-“ и продължават само с цифри.
+
+-- 1b3bb94037f04bbf81028e135a12d293
+Subject: Не може да се избере име за модул на базата на пътя @MOUNT_POINT@
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Следната точка за монтиране не може да се преобразува в име на монтиращ модул
+(.mount):
+
+    @MOUNT_POINT@
+
+Най-често това се дължи на факта, че пътят за монтиране е по-дълъг от максимума
+за име на модул.
+
+systemd динамично задава модули „.mount“ за всички монтирани ресурси в системата.
+Затова се ползва прост алгоритъм за екраниране на знаци — взема се абсолютния
+път, всички знаци „/“ се заменят с „-“ (с изключение на водещия, който се
+пропуска). Всички знаци извън буквите и числата (вкл. „:“, „-“, „_“, „.“, „\“)
+се заменят с „\xNN“, където NN е шестнадесетичният код на знака. Добавя се и
+суфиксът „.mount“. Полученият низ трябва да е по-къс от 256 знака, за да се
+ползва за име на модул. Ограничението цели всички имена на модули да може да са
+и имена на файлове. Ако низът за име е по-дълъг, той не може да се ползва за име
+на модул. В такъв случай systemd няма да създаде модул и няма да може да се ползва
+за управление на точката на монтиране. Тя няма да се появява в таблицата с модули
+на мениджъра на системата и съответно няма да се извършва безопасно изключване
+при изключването на системата.
+
+Препоръчваме да не ползвате толкова дълги имена като точки за монтиране. Ако все
+пак ги ползвате, ще трябва да ги управлявате независимо от systemd, т.е. сами
+администрирайте монтирането и изключването.
+
+-- b480325f9c394a7b802c231e51a2752c
+Subject: Настроен е специален потребител @OFFENDING_USER@ — това е опасно!
+Defined-By: systemd
+Support: %SUPPORT_URL%
+Documentation: https://systemd.io/UIDS-GIDS
+
+Модулът „@UNIT@“ е настроен да ползва директивата „User=@OFFENDING_USER@“.
+
+Това е опасно. Основното предназначение на „@OFFENDING_USER@“ на системите на
+база Linux е да е собственик на файловете със собственик, който не е известен
+на локалната система. Този потребител се ползва най-вече от клиента за NFS и
+пространствата за имена за потребители. Ако този модул стартира процеси от
+името на този потребител, те може да получат достъп до файловете, които са с
+неизвестен собственик.
+
+Силно препоръчване да стартирате процеси с този потребител, особено на системи
+ползващи NFS или контейнери. Вместо това създайте потребител и негов идентификатор
+специфичен за тази услуга или статично с „systemd-sysusers“, или динамично чрез
+директивата на модула „DynamicUser=“.
+
+-- 1c0454c1bd2241e0ac6fefb4bc631433
+Subject: Модулът systemd-udev-settle.service е остарял
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Препоръчва се да не ползвате остарелия модул на systemd —
+„systemd-udev-settle.service“. Той нарочно забавя процеса на стартиране, но
+всъщност не предоставя гаранциите, които другите системи очакват от него.
+Като цяло е грешка да го ползвате или разчитате на него поради проблеми с
+паралелността.
+
+Традиционно задачата на този модул е да изчака проверката и инициализацията на
+всички устройства на системата, като завършването на стартирането се отлага до
+приключването на тази фаза. Днешните системи не работят така — хардуерните
+устройства се появяват в произволен момент, а проверката и инициализацията им
+може да отнеме много време. В общия случай стартирането не може да се забави
+до инициализацията на всички устройства, защото не е добре дефинирано кои са
+всички устройства и кога се открити. Това се отнася с особено значение за
+устройствата през USB или тези, които се ползват през мрежата.
+
+Програмите, които изискват определен хардуер (напр. мрежово или блоково
+устройство), трябва изрично да чакат конкретния хардуер да стартира, а останалата
+работа трябва да е асинхронна, така че инициализацията на всяко устройство да
+позволява на модулите, зависещи от него, да продължат работа, без да се забавя
+процеса на стартиране.
+
+Ако въпросният софтуер не работи така, а изрично изчаква
+„systemd-udev-settle.service“, това е грешка и трябва да се поправи.
+
+Изпратете доклад на грешка до авторите на следните модули, като поискате да не
+зависят от „systemd-udev-settle.service“, а само от съответното устройство:
+
+    @OFFENDING_UNITS@
+
+-- 7c8a41f37b764941a0e1780b1be2f037
+Subject: Първоначална синхронизация на часовника
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+За първи път след текущото стартиране е извършена синхронизация
+със сървър за NTP — системният часовник е настроен.
diff --git a/catalog/systemd.catalog.in b/catalog/systemd.catalog.in
index a3f05c0..4c29128 100644
--- a/catalog/systemd.catalog.in
+++ b/catalog/systemd.catalog.in
@@ -126,13 +126,6 @@ Support: %SUPPORT_URL%
 
 The system clock has been changed to @REALTIME@ microseconds after January 1st, 1970.
 
--- c7a787079b354eaaa9e77b371893cd27 de
-Subject: Zeitänderung
-Defined-By: systemd
-Support: %SUPPORT_URL%
-
-Die System-Zeit wurde geändert auf @REALTIME@ Mikrosekunden nach dem 1. Januar 1970.
-
 -- 45f82f4aef7a4bbf942ce861d1f20990
 Subject: Time zone change to @TIMEZONE@
 Defined-By: systemd
@@ -151,7 +144,7 @@ might still be busy with completing start-up.
 
 Kernel start-up required @KERNEL_USEC@ microseconds.
 
-Initial RAM disk start-up required @INITRD_USEC@ microseconds.
+Initrd start-up required @INITRD_USEC@ microseconds.
 
 Userspace start-up required @USERSPACE_USEC@ microseconds.
 
@@ -534,3 +527,15 @@ Support: %SUPPORT_URL%
 
 For the first time during the current boot an NTP synchronization has been
 acquired and the local system clock adjustment has been initiated.
+
+-- 3f7d5ef3e54f4302b4f0b143bb270cab
+Subject: TPM PCR Extended
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+The string '@MEASURING@' has been extended into Trusted Platform Module's (TPM)
+Platform Configuration Register (PCR) @PCR@, on banks @BANKS@.
+
+Whenever the system transitions to a new runtime phase, a different string is
+extended into the specified PCR, to ensure that security policies for TPM-bound
+secrets and other resources are limited to specific phases of the runtime.
diff --git a/catalog/systemd.de.catalog.in b/catalog/systemd.de.catalog.in
index 97b16d0..17c8b78 100644
--- a/catalog/systemd.de.catalog.in
+++ b/catalog/systemd.de.catalog.in
@@ -11,3 +11,10 @@ ein Speicherabbild wurde generiert.
 
 Üblicherweise ist dies ein Hinweis auf einen Programmfehler und sollte
 als Fehler dem jeweiligen Hersteller gemeldet werden.
+
+-- c7a787079b354eaaa9e77b371893cd27
+Subject: Zeitänderung
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+Die System-Zeit wurde geändert auf @REALTIME@ Mikrosekunden nach dem 1. Januar 1970.
diff --git a/coccinelle/in_set.cocci b/coccinelle/in_set.cocci
index 8be786d..a3b02f9 100644
--- a/coccinelle/in_set.cocci
+++ b/coccinelle/in_set.cocci
@@ -1,26 +1,38 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 /* Limit the number of expressions to 6 for performance reasons */
+
+@ is_in_assert_cc @
+identifier id = assert_cc;
+position p1;
+expression e;
+constant n0;
+@@
+
+ id(e@p1 == n0 || ...);
+
 @@
 expression e;
+position p2 != is_in_assert_cc.p1;
 /* Exclude JsonVariant * from the transformation, as it can't work with the
  * current version of the IN_SET macro */
 typedef JsonVariant;
 type T != JsonVariant*;
 constant T n0, n1, n2, n3, n4, n5;
 @@
+
 (
-- e == n0 || e == n1 || e == n2 || e == n3 || e == n4 || e == n5
+- e@p2 == n0 || e == n1 || e == n2 || e == n3 || e == n4 || e == n5
 + IN_SET(e, n0, n1, n2, n3, n4, n5)
 |
-- e == n0 || e == n1 || e == n2 || e == n3 || e == n4
+- e@p2 == n0 || e == n1 || e == n2 || e == n3 || e == n4
 + IN_SET(e, n0, n1, n2, n3, n4)
 |
-- e == n0 || e == n1 || e == n2 || e == n3
+- e@p2 == n0 || e == n1 || e == n2 || e == n3
 + IN_SET(e, n0, n1, n2, n3)
 |
-- e == n0 || e == n1 || e == n2
+- e@p2 == n0 || e == n1 || e == n2
 + IN_SET(e, n0, n1, n2)
 |
-- e == n0 || e == n1
+- e@p2 == n0 || e == n1
 + IN_SET(e, n0, n1)
 )
diff --git a/coccinelle/macros.h b/coccinelle/macros.h
index 6a0a64b..f44b3f2 100644
--- a/coccinelle/macros.h
+++ b/coccinelle/macros.h
@@ -189,8 +189,6 @@
              (i) != (p);                                                \
              (i) = (i)->name##_next ? (i)->name##_next : (head))
 
-#define LIST_IS_EMPTY(head)                                             \
-        (!(head))
 #define LIST_JOIN(name,a,b)                                             \
         do {                                                            \
                 assert(b);                                              \
diff --git a/debian/systemd.NEWS b/debian/NEWS
similarity index 100%
rename from debian/systemd.NEWS
rename to debian/NEWS
diff --git a/debian/changelog b/debian/changelog
index c7ddcfc..de27414 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,287 @@
+systemd (252.1-1ubuntu1) lunar; urgency=medium
+
+  [ Nick Rosbrook ]
+  * Merge 252.1-1 from Debian unstable
+    - Resolve merge conflicts:
+      + debian/patches: Do not take back Add-support-for-TuxOnIce-hibernation.patch.
+      + debian/libsystemd0.symbols: Increment sd_hwdb_new_from_path min version
+        to reduce delta with Debian.
+      + debian/control: Keep Ubuntu systemd-repart delta for now.
+      + debian/rules: Keep our diff for TPM2 build on i386
+      + debian/systemd-resolved.postrm: Take Debian DPKG_ROOT changes, removing
+        the Ubuntu delta.
+    - Drop patches:
+      + Drop sd-hwdb-add-sd_hwdb_new_from_path.patch:
+        Applied upstream: https://github.com/systemd/systemd-stable/commit/60f0ba7556
+      + Drop test-copy-libgcc_s.so.1-to-TPM2-test-image-on-Debian-like.patch:
+        Applied upstream: https://github.com/systemd/systemd-stable/commit/ddbc88188c
+      + Drop lp1991829-add-CAP_LINUX_IMMUTABLE-to-systemd-machined-so-it-ca.patch:
+        Applied upstream: https://github.com/systemd/systemd-stable/commit/137d162c42
+      + Drop hwdb-implement-root-option-for-systemd-hwdb-query.patch:
+        Applied upstream: https://github.com/systemd/systemd-stable/commit/beff73f94e
+      + Drop lp1978079-pstore-Run-after-modules-are-loaded.patch:
+        Applied upstream: https://github.com/systemd/systemd-stable/commit/70e74a5997
+      + Drop debian/UBUNTU-deny-list-TEST-10-ISSUE-2467.patch:
+        It looks like this has not been a problem upstream. Let's try it again
+        in autopkgtest.
+      + Drop debian/deny-list-upstream-test-02-ppc64el.patch:
+        There was never any movement on the upstream issue. Since it has been a
+        while, let's re-enable for now to see if it is still a problem.
+      + Drop debian/deny-list-upstream-test-25.patch:
+        It's been a while, let's see if this still presents a problem.
+      + Drop lp1989969-test-deny-list-TEST-36-NUMAPOLICY-on-ppc64el.patch:
+        This is likely due to [1], and is not specific to TEST-36-NUMAPOLICY.
+        [1] https://github.com/systemd/systemd/issues/25091
+      + Drop lp1950794-Revert-sd-dhcp-do-not-use-detect_container-to-guess-.patch:
+        This patch no longer applies, see:
+        https://github.com/systemd/systemd/commit/14805b1468
+    - Refresh patches
+    - debian/gbp.conf: Update debian-branch to ubuntu-lunar
+      File: debian/gbp.conf
+      https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=aa7b7c457ce90478b38fc73e628f8b5a4874614f
+    - debian/rules: do not enable libqrencode on i386
+      Files:
+      - debian/control
+      - debian/rules
+      - debian/tests/control
+      https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=3ed5e1433e2ee05e2941f0e16ebc482933a382fd
+    - Add handling for /etc/default/locale to firstboot.
+      The TEST-74-AUX-UTILS upstream test revealed that firstboot does not
+      currently handle Debian's /etc/default/locale.
+      File: debian/patches/debian/Use-Debian-specific-config-files.patch
+      https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=9dc07337354155b100ea0423ed090f3dc6040a7a
+    - test: remove no-longer-needed quirk for set-locale on Debian/Ubuntu
+      File: debian/patches/test-remove-no-longer-needed-quirk-for-set-locale-on-Debi.patch
+      https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=e14e582fe158c7e63d6146386ec901fededa2e78
+    - oomd: always allow root-owned cgroups to set ManagedOOMPreference
+      File: debian/patches/oomd-always-allow-root-owned-cgroups-to-set-ManagedOOMPre.patch
+      https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=e2fc04c5a6dfbe4bada17f117b957febcc5356d7
+    - oomd: fix unreachable test case in test-oomd-util
+      File: debian/patches/oomd-fix-unreachable-test-case-in-test-oomd-util.patch
+      https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=a9ad5284e2730c777fbc4dd7919be1631b788c44
+    - test: make sure mount point exists in testsuite-64.sh
+      File: debian/patches/test-make-sure-mount-point-exists-in-testsuite-64.sh.patch
+      https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=1a6bae6133ebe11108b1b8515da7371e5567a189
+    - test: handle Debian's /etc/default/locale in testsuite-74.firstboot.sh
+      File: debian/patches/test-handle-Debian-s-etc-default-locale-in-testsuite-74.f.patch
+      https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=5e80690a112fb579070d99d6cbd3623f3cea790c
+    - test: skip some tests when machine-id is not initialized
+      File: debian/patches/test-skip-some-tests-when-machine-id-is-not-initialized.patch
+      https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=362c58ae565eefc172f085dc22f5058c5d3adb85
+    - debian/tests: stop testing in privileged LXD containers
+      File: debian/tests/tests-in-lxd
+      https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=a74c46945722f9bb8d925543a0fabe64d38f7c8f
+    - debian/systemd.postinst: drop our v234-specific delta.
+      Upgrades from systems this old are not supported to Lunar and newer.
+      File: debian/systemd.postinst
+      https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=a3f79c2d259da6d0537cb4a31e0eb7bf0c2aaeff
+    - debian/tests: stop skipping test_service in boot-and-services.
+      The linked github issue has been resolved and is included in this
+      release.
+      File: debian/tests/boot-and-services
+      https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=bdb12cb08e0f959ff875713a78cb2a3beadae87e
+    - debian/systemd-resolved.postinst: consolidate Ubuntu delta
+      File: debian/systemd-resolved.postinst
+      https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=7f6c0a62320ce5670ba9a0648ae54af24ae3dc1c
+
+  [ Luca Boccassi ]
+  * Build depend on dh-package-notes, sequence was removed.
+    Only the makefile is in use now, no files are generated at build time
+    as --package-metadata from the linkers is used now
+    Author: Luca Boccassi
+    File: debian/control
+    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=5501f9d2629d4e22dc45e6569946aefd9c78d3c6
+
+ -- Nick Rosbrook <[e-mail]>  Tue, 06 Dec 2022 11:00:38 -0500
+
+systemd (252.1-1) unstable; urgency=medium
+
+  * d/watch: switch back to stable repository
+  * New upstream version 252.1 (Closes: #1023607 #1023515)
+  * Drop patches merged upstream
+  * Refresh patches
+  * Suggest polkitd instead of policykit-1 (deprecated)
+
+ -- Luca Boccassi <[e-mail]>  Tue, 08 Nov 2022 14:23:22 +0000
+
+systemd (252-3) unstable; urgency=medium
+
+  * Backport patches to fix tmpfiles error and missing /dev/serial/by-
+    id/usb-* (Closes: #1023311)
+  * Drop :native suffix from python3-pyparsing build dependency (Closes:
+    #1023442)
+  * Enable support for libqrencode. dlopen() feature so no additional cost.
+    Allows printing out recovery keys in QR format.
+
+ -- Luca Boccassi <[e-mail]>  Sun, 06 Nov 2022 14:16:52 +0000
+
+systemd (252-2) unstable; urgency=medium
+
+  [ Jochen Sprickerhof ]
+  * Let dh_installsysusers fix the /var/log/journal permissions.
+    dh_installsysusers adds a systemd-sysusers in #DEBHELPER#. Otherwise
+    it fails with: /usr/lib/tmpfiles.d/systemd.conf:28: Failed to resolve
+    group 'systemd-journal'. Regression of fa0aade329. (Closes: #1023248)
+  * Move restarting units after #DEBHELPER#. This makes sure that systemd-
+    sysusers was executed as well as systemd-tmpfiles to setup proper
+    permissions for /var/log/journal before systemd-journald is being
+    restarted.
+
+ -- Luca Boccassi <[e-mail]>  Tue, 01 Nov 2022 12:06:18 +0000
+
+systemd (252-1) unstable; urgency=medium
+
+  * Use systemd-sysusers to setup systemd users and groups
+  * New upstream version 252
+  * Drop patches merged upstream
+  * libsystemd0: set symbols version to 252
+  * Drop unused lintian override
+
+ -- Luca Boccassi <[e-mail]>  Mon, 31 Oct 2022 22:02:43 +0000
+
+systemd (252~rc3-2) unstable; urgency=medium
+
+  * Upload to unstable.
+
+ -- Luca Boccassi <[e-mail]>  Thu, 27 Oct 2022 15:24:32 +0100
+
+systemd (252~rc3-1) experimental; urgency=medium
+
+  * New upstream version 252~rc3
+  * Refresh patches
+  * Backport patches to fix tests without machine-id. Drop out-of-tree
+    patch and backport upstream fixes.
+
+ -- Luca Boccassi <[e-mail]>  Tue, 25 Oct 2022 01:30:02 +0100
+
+systemd (252~rc2-1) experimental; urgency=medium
+
+  [ Jan Kiszka ]
+  * Enable systemd-boot for riscv64. Tested against U-Boot 2022.10 as UEFI
+    provider on the RZ/Five. Signed-off-by: Jan Kiszka
+    <[e-mail]>
+
+  [ Helmut Grohne ]
+  * Conditionalize installation of cryptsetup plugins in stage1 using dh-
+    exec (Closes: #1021821)
+
+  [ Michael Biebl ]
+  * Install sysusers.d and tmpfiles.d man pages in standalone packages
+    (Closes: #1021933)
+
+  [ Luca Boccassi ]
+  * d/watch: switch to non-stable repo
+  * New upstream version 252~rc2
+  * Drop patches merged upstream
+  * Refresh patches
+  * Update symbols file
+  * Update Lintian overrides
+  * autopkgtest: update expected output of localectl
+
+ -- Luca Boccassi <[e-mail]>  Sat, 22 Oct 2022 01:10:00 +0100
+
+systemd (251.6-1) unstable; urgency=medium
+
+  * New upstream version 251.6
+  * Rebase patches
+  * Use dh_installsystemd to enable machines.target in systemd-container
+
+ -- Michael Biebl <[e-mail]>  Fri, 14 Oct 2022 16:34:00 +0200
+
+systemd (251.5-3) unstable; urgency=medium
+
+  * Update symbol versions for the v251 release
+  * ata_id: fix getting Response Code from SCSI Sense Data (Closes: #1021579)
+  * logind: do not emit beep in wall messages (Closes: #1019510)
+  * logind: remember our idle state and use it to detect idle level
+    transitions (Closes: #963135)
+  * logind: fix getting property OnExternalPower via D-Bus (Closes: #1021644)
+
+ -- Michael Biebl <[e-mail]>  Wed, 12 Oct 2022 17:01:05 +0200
+
+systemd (251.5-2) unstable; urgency=medium
+
+  [ Luca Boccassi ]
+  * Build and install libcryptsetup token plugins.
+    The interfaces are now mature and enabled in Debian/Ubuntu in
+    libcryptsetup, so enable and ship the plugins
+
+  [ Michael Biebl ]
+  * salsa-ci: drop no longer needed workaround for lintian false positives
+  * udev: fix regression in udev-builtin path_id when processing NVME devices
+    (Closes: #1021547)
+
+  [ наб ]
+  * systemd-sysv.postinst: which -> command -v
+
+ -- Michael Biebl <[e-mail]>  Tue, 11 Oct 2022 00:51:55 +0200
+
+systemd (251.5-1) unstable; urgency=medium
+
+  [ Michael Biebl ]
+  * New upstream version 251.5
+  * Install NEWS.Debian file into all binary packages.
+    While it increases the disk footprint a little, it ensures that NEWS
+    entries are reliably shown by apt-listchanges.
+  * Handle removal of /var/log/README.
+    Remove /var/log/README symlink when the systemd package is purged.
+    This symlink is created via tmpfiles and documents that /var/log no
+    longer contains the traditional syslog text files. (Closes: #877414)
+  * Rebase patches
+
+  [ наб ]
+  * debian/extra/kernel/postinst.d/systemd-boot: prefix with zz-
+    Since we explicitly (though this is hidden by indirection through
+    85-initrd.install) depend on /boot/initrd.img-$1 existing or not existing,
+    hard-order ourselves at the end. The zz- prefix matches grub.
+  * debian/extra/kernel-install.d/85-initrd.install: install default initrd
+    with versioned basename.
+    This fixes #1020396 in a superior way by using
+    $KERNEL_INSTALL_STAGING_AREA, available since systemd v251.
+    By just copying the file we both simplify our code, but defer to
+    90-loaderentry to correctly permission it, and simply never generate an
+    unversioned initrd in the first place! (Closes: #1020396)
+  * debian/extra/kernel-install.d/85-initrd.install: explicitly ignore unknown
+    verbs
+  * debian/extra/kernel/postrm.d/systemd-boot: prefix with zz-
+    Doesn't actually matter, but the kernel handbook says we must and we
+    already renamed postinst. (Closes: #1014581)
+
+  [ Luca Boccassi ]
+  * Enable firstboot, disabled by default on Debian.
+    Currently the first-boot conditions are not met by any Debian
+    image (/etc/machine-id with content uninitialized, so we can
+    just enable the build and ship it in the main package.
+    This lets image builders (eg: cloud images) tinker with it.
+    https://www.freedesktop.org/software/systemd/man/machine-id.html#First%20Boot%20Semantics
+    (Closes: #844528)
+
+ -- Michael Biebl <[e-mail]>  Sun, 02 Oct 2022 21:23:49 +0200
+
+systemd (251.4-3) unstable; urgency=medium
+
+  * resolv.conf: take backup as a fallback in case resolved/resolv.conf
+    is not available, and restore on uninstall, which is necessary for
+    piuparts checks.
+
+ -- Luca Boccassi <[e-mail]>  Sat, 27 Aug 2022 22:39:04 +0100
+
+systemd (251.4-2) unstable; urgency=medium
+
+  [ Johannes Schauer Marin Rodrigues ]
+  * use systemd-sysusers instead of adduser. This allows dropping the
+    dependency on adduser (reducing the dependency set) and in turn allows
+    for DPKG_ROOT support of systemd.
+  * debian/systemd.postinst: add --root argument to systemctl and
+    systemd-* calls for DPKG_ROOT support
+
+  [ Luca Boccassi ]
+  * resolved: use DPKG_ROOT and make postinst shellcheck-happy
+  * resolved: switch from .links to postinst/rm
+  * Update Lintian overrides for new incompatible syntax
+
+ -- Luca Boccassi <[e-mail]>  Fri, 26 Aug 2022 23:16:23 +0100
+
 systemd (251.4-1ubuntu7) kinetic; urgency=medium
 
   [ Nick Rosbrook ]
diff --git a/debian/control b/debian/control
index 43ded98..d78dfb8 100644
--- a/debian/control
+++ b/debian/control
@@ -15,8 +15,10 @@ Vcs-Git: https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd
 Vcs-Browser:  https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd
 Homepage: https://www.freedesktop.org/wiki/Software/systemd
 Build-Depends: debhelper-compat (= 13),
+               dh-exec,
+               dh-package-notes,
                dh-sequence-installnss,
-               dh-sequence-package-notes,
+               dh-sequence-installsysusers,
                pkg-config,
                xsltproc <!nodoc>,
                docbook-xsl <!nodoc>,
@@ -32,7 +34,7 @@ Build-Depends: debhelper-compat (= 13),
                libiptc-dev <!stage1>,
                libaudit-dev <!stage1>,
                libdbus-1-dev (>= 1.3.2) <!nocheck> <!noinsttest>,
-               libcryptsetup-dev (>= 2:1.6.0) <!stage1>,
+               libcryptsetup-dev (>= 2:2.4) <!stage1>,
                libselinux1-dev (>= 2.1.9),
                libacl1-dev,
                liblzma-dev,
@@ -55,12 +57,13 @@ Build-Depends: debhelper-compat (= 13),
                libtss2-dev [!i386] <!stage1>,
                libfido2-dev <!stage1>,
                libssl-dev <!stage1>,
+               libqrencode-dev [!i386] <!stage1>,
                linux-base <!nocheck>,
                acl <!nocheck>,
                python3:native,
                python3-jinja2:native,
                python3-lxml:native,
-               python3-pyparsing:native <!nocheck>,
+               python3-pyparsing <!nocheck>,
                python3-evdev:native <!nocheck>,
                tzdata <!nocheck>,
                libcap2-bin <!nocheck>,
@@ -82,17 +85,17 @@ Suggests: systemd-container,
           systemd-userdbd,
           systemd-boot,
           libfido2-1,
+          libqrencode4,
           libtss2-esys-3.0.2-0,
           libtss2-mu0,
           libtss2-rc0,
-          policykit-1
+          polkitd,
 Pre-Depends: ${shlibs:Pre-Depends},
              ${misc:Pre-Depends}
 Depends: ${shlibs:Depends},
          ${misc:Depends},
          libsystemd0 (= ${binary:Version}),
          mount,
-         adduser,
 Replaces: systemd-repart (<< 250.2-3~)
 Conflicts: consolekit,
            libpam-ck-connector,
@@ -168,7 +171,6 @@ Multi-Arch: foreign
 Depends: ${shlibs:Depends},
          ${misc:Depends},
          systemd,
-         adduser
 Description: tools for sending and receiving remote journal logs
  This package provides tools for sending and receiving remote journal logs:
   * systemd-journal-remote
@@ -181,7 +183,6 @@ Architecture: linux-any
 Multi-Arch: foreign
 Depends: ${shlibs:Depends},
          ${misc:Depends},
-         adduser,
          systemd
 Recommends: libdw1
 Conflicts: core-dump-handler
@@ -198,7 +199,6 @@ Multi-Arch: foreign
 Priority: standard
 Depends: ${shlibs:Depends},
          ${misc:Depends},
-         adduser,
          systemd
 Breaks: systemd (<< 245.4-2~),
 Conflicts: time-daemon
@@ -440,7 +440,6 @@ Package: systemd-oomd
 Architecture: linux-any
 Depends: ${shlibs:Depends},
          ${misc:Depends},
-         adduser,
 Breaks: systemd (<< 250.2-2~)
 Replaces: systemd (<< 250.2-2~)
 Description: userspace out-of-memory (OOM) killer
@@ -515,7 +514,6 @@ Architecture: linux-any
 Pre-Depends: ${misc:Pre-Depends}
 Depends: ${shlibs:Depends},
          ${misc:Depends},
-         adduser,
          systemd (= ${binary:Version}),
          default-dbus-system-bus | dbus-system-bus
 Suggests: policykit-1,
diff --git a/debian/extra/kernel-install.d/85-initrd.install b/debian/extra/kernel-install.d/85-initrd.install
index 4f8b101..ecbed87 100755
--- a/debian/extra/kernel-install.d/85-initrd.install
+++ b/debian/extra/kernel-install.d/85-initrd.install
@@ -5,32 +5,20 @@ set -eu
 
 COMMAND="$1"
 KERNEL_VERSION="$2"
-BOOT_DIR_ABS="$3"
 
 INITRD_SRC="/boot/initrd.img-$KERNEL_VERSION"
-INITRD_DEST="$BOOT_DIR_ABS/initrd"
 
-if [ "$COMMAND" = remove ]; then
-    exec rm -f "$INITRD_DEST"
-fi
-
-if [ "$COMMAND" != add ]; then
-    echo "Invalid command $COMMAND" >&2
-    exit 1
-fi
+[ "$COMMAND" = add ] || exit 0
 
 if [ "$#" -ge 5 ]; then
-    # An explicit initrd path was passed, 90-loaderentry.install knows how to handle this;
-    # copying here would just duplicate the file, since the basename is very likely different
+    # Explicit initrd paths were passed, fall through to default 90-loaderentry.install handling;
+    # we'd be either injecting an unwanted image or, worse, overriding a user-provided one
     exit 0
 fi
 
 if [ -e "$INITRD_SRC" ]; then
-    [ "$KERNEL_INSTALL_VERBOSE" -gt 0 ] && echo "Installing '$INITRD_SRC' as '$INITRD_DEST'"
-    install -m 0644 -o root -g root "$INITRD_SRC" "$INITRD_DEST" || {
-        echo "Could not copy '$INITRD_SRC' to '$INITRD_DEST'." >&2
-        exit 1
-    }
+    [ "$KERNEL_INSTALL_VERBOSE" -gt 0 ] && echo "Installing '$INITRD_SRC'"
+    ln -fs "$INITRD_SRC" "$KERNEL_INSTALL_STAGING_AREA"
 else
     echo "$INITRD_SRC does not exist, not installing an initrd"
 fi
diff --git a/debian/extra/kernel/postinst.d/systemd-boot b/debian/extra/kernel/postinst.d/zz-systemd-boot
similarity index 100%
rename from debian/extra/kernel/postinst.d/systemd-boot
rename to debian/extra/kernel/postinst.d/zz-systemd-boot
diff --git a/debian/extra/kernel/postrm.d/systemd-boot b/debian/extra/kernel/postrm.d/zz-systemd-boot
similarity index 100%
rename from debian/extra/kernel/postrm.d/systemd-boot
rename to debian/extra/kernel/postrm.d/zz-systemd-boot
diff --git a/debian/gbp.conf b/debian/gbp.conf
index 2b16095..aeb0817 100644
--- a/debian/gbp.conf
+++ b/debian/gbp.conf
@@ -1,7 +1,7 @@
 [DEFAULT]
 pristine-tar = True
 patch-numbers = False
-debian-branch = ubuntu-kinetic
+debian-branch = ubuntu-lunar
 debian-tag = ubuntu/%(version)s
 upstream-branch = upstream/latest
 
diff --git a/debian/libsystemd-shared.lintian-overrides b/debian/libsystemd-shared.lintian-overrides
index 065ba9b..0b9cfd3 100644
--- a/debian/libsystemd-shared.lintian-overrides
+++ b/debian/libsystemd-shared.lintian-overrides
@@ -1,2 +1,2 @@
 # Intentional: value of config got in a release by mistake, needs to be kept
-libsystemd-shared: spelling-error-in-binary usr/lib/*/systemd/libsystemd-shared-251.so anually annually
+libsystemd-shared: spelling-error-in-binary anually annually [usr/lib/*/systemd/libsystemd-shared-252.so]
diff --git a/debian/libsystemd0.symbols b/debian/libsystemd0.symbols
index fd63168..5a6b959 100644
--- a/debian/libsystemd0.symbols
+++ b/debian/libsystemd0.symbols
@@ -31,8 +31,8 @@ libsystemd.so.0 libsystemd0 #MINVER#
  LIBSYSTEMD_248@LIBSYSTEMD_248 248
  LIBSYSTEMD_249@LIBSYSTEMD_249 249
  LIBSYSTEMD_250@LIBSYSTEMD_250 250
- LIBSYSTEMD_251@LIBSYSTEMD_251 251~rc1
- LIBSYSTEMD_252@LIBSYSTEMD_252 251.4-1ubuntu3~
+ LIBSYSTEMD_251@LIBSYSTEMD_251 251
+ LIBSYSTEMD_252@LIBSYSTEMD_252 252
  sd_booted@LIBSYSTEMD_209 0
  sd_bus_add_fallback@LIBSYSTEMD_221 221
  sd_bus_add_fallback_vtable@LIBSYSTEMD_221 221
@@ -122,6 +122,7 @@ libsystemd.so.0 libsystemd0 #MINVER#
  sd_bus_error_set_errnof@LIBSYSTEMD_221 221
  sd_bus_error_set_errnofv@LIBSYSTEMD_221 221
  sd_bus_error_setf@LIBSYSTEMD_221 221
+ sd_bus_error_setfv@LIBSYSTEMD_252 252
  sd_bus_flush@LIBSYSTEMD_221 221
  sd_bus_flush_close_unref@LIBSYSTEMD_222 222
  sd_bus_get_address@LIBSYSTEMD_221 221
@@ -223,6 +224,7 @@ libsystemd.so.0 libsystemd0 #MINVER#
  sd_bus_message_read_array@LIBSYSTEMD_221 221
  sd_bus_message_read_basic@LIBSYSTEMD_221 221
  sd_bus_message_read_strv@LIBSYSTEMD_221 221
+ sd_bus_message_read_strv_extend@LIBSYSTEMD_252 252
  sd_bus_message_readv@LIBSYSTEMD_240 240
  sd_bus_message_ref@LIBSYSTEMD_221 221
  sd_bus_message_rewind@LIBSYSTEMD_221 221
@@ -339,7 +341,7 @@ libsystemd.so.0 libsystemd0 #MINVER#
  sd_device_enumerator_add_match_sysattr@LIBSYSTEMD_240 240
  sd_device_enumerator_add_match_sysname@LIBSYSTEMD_240 240
  sd_device_enumerator_add_match_tag@LIBSYSTEMD_240 240
- sd_device_enumerator_add_nomatch_sysname@LIBSYSTEMD_251 251~rc2
+ sd_device_enumerator_add_nomatch_sysname@LIBSYSTEMD_251 251
  sd_device_enumerator_allow_uninitialized@LIBSYSTEMD_240 240
  sd_device_enumerator_get_device_first@LIBSYSTEMD_240 240
  sd_device_enumerator_get_device_next@LIBSYSTEMD_240 240
@@ -349,6 +351,8 @@ libsystemd.so.0 libsystemd0 #MINVER#
  sd_device_enumerator_ref@LIBSYSTEMD_240 240
  sd_device_enumerator_unref@LIBSYSTEMD_240 240
  sd_device_get_action@LIBSYSTEMD_248 248
+ sd_device_get_child_first@LIBSYSTEMD_252 252
+ sd_device_get_child_next@LIBSYSTEMD_252 252
  sd_device_get_current_tag_first@LIBSYSTEMD_247 247
  sd_device_get_current_tag_next@LIBSYSTEMD_247 247
  sd_device_get_devlink_first@LIBSYSTEMD_240 240
@@ -389,24 +393,27 @@ libsystemd.so.0 libsystemd0 #MINVER#
  sd_device_monitor_filter_add_match_tag@LIBSYSTEMD_240 240
  sd_device_monitor_filter_remove@LIBSYSTEMD_240 240
  sd_device_monitor_filter_update@LIBSYSTEMD_240 240
+ sd_device_monitor_get_description@LIBSYSTEMD_252 252
  sd_device_monitor_get_event@LIBSYSTEMD_240 240
  sd_device_monitor_get_event_source@LIBSYSTEMD_240 240
  sd_device_monitor_new@LIBSYSTEMD_240 240
  sd_device_monitor_ref@LIBSYSTEMD_240 240
+ sd_device_monitor_set_description@LIBSYSTEMD_252 252
  sd_device_monitor_set_receive_buffer_size@LIBSYSTEMD_240 240
  sd_device_monitor_start@LIBSYSTEMD_240 240
  sd_device_monitor_stop@LIBSYSTEMD_240 240
  sd_device_monitor_unref@LIBSYSTEMD_240 240
+ sd_device_new_child@LIBSYSTEMD_252 252
  sd_device_new_from_device_id@LIBSYSTEMD_240 240
- sd_device_new_from_devname@LIBSYSTEMD_251 251~rc2
+ sd_device_new_from_devname@LIBSYSTEMD_251 251
  sd_device_new_from_devnum@LIBSYSTEMD_240 240
  sd_device_new_from_ifindex@LIBSYSTEMD_249 249
  sd_device_new_from_ifname@LIBSYSTEMD_249 249
- sd_device_new_from_path@LIBSYSTEMD_251 251~rc2
+ sd_device_new_from_path@LIBSYSTEMD_251 251
  sd_device_new_from_stat_rdev@LIBSYSTEMD_248 248
  sd_device_new_from_subsystem_sysname@LIBSYSTEMD_240 240
  sd_device_new_from_syspath@LIBSYSTEMD_240 240
- sd_device_open@LIBSYSTEMD_251 251~rc2
+ sd_device_open@LIBSYSTEMD_251 251
  sd_device_ref@LIBSYSTEMD_240 240
  sd_device_set_sysattr_value@LIBSYSTEMD_240 240
  sd_device_set_sysattr_valuef@LIBSYSTEMD_247 247
@@ -439,6 +446,7 @@ libsystemd.so.0 libsystemd0 #MINVER#
  sd_event_prepare@LIBSYSTEMD_221 221
  sd_event_ref@LIBSYSTEMD_221 221
  sd_event_run@LIBSYSTEMD_221 221
+ sd_event_set_signal_exit@LIBSYSTEMD_252 252
  sd_event_set_watchdog@LIBSYSTEMD_221 221
  sd_event_source_disable_unref@LIBSYSTEMD_243 243
  sd_event_source_get_child_pid@LIBSYSTEMD_221 221
@@ -495,7 +503,7 @@ libsystemd.so.0 libsystemd0 #MINVER#
  sd_hwdb_enumerate@LIBSYSTEMD_240 240
  sd_hwdb_get@LIBSYSTEMD_240 240
  sd_hwdb_new@LIBSYSTEMD_240 240
- sd_hwdb_new_from_path@LIBSYSTEMD_252 251.4-1ubuntu3~
+ sd_hwdb_new_from_path@LIBSYSTEMD_252 252
  sd_hwdb_ref@LIBSYSTEMD_240 240
  sd_hwdb_seek@LIBSYSTEMD_240 240
  sd_hwdb_unref@LIBSYSTEMD_240 240
@@ -506,8 +514,9 @@ libsystemd.so.0 libsystemd0 #MINVER#
  sd_id128_get_machine@LIBSYSTEMD_209 0
  sd_id128_get_machine_app_specific@LIBSYSTEMD_233 233
  sd_id128_randomize@LIBSYSTEMD_209 0
+ sd_id128_string_equal@LIBSYSTEMD_252 252
  sd_id128_to_string@LIBSYSTEMD_209 0
- sd_id128_to_uuid_string@LIBSYSTEMD_251 251~rc1
+ sd_id128_to_uuid_string@LIBSYSTEMD_251 251
  sd_is_fifo@LIBSYSTEMD_209 0
  sd_is_mq@LIBSYSTEMD_209 0
  sd_is_socket@LIBSYSTEMD_209 0
diff --git a/debian/patches/0001-Revert-tests-add-test-case-for-UMask-BindPaths-combi.patch b/debian/patches/0001-Revert-tests-add-test-case-for-UMask-BindPaths-combi.patch
index e085ebc..6076be4 100644
--- a/debian/patches/0001-Revert-tests-add-test-case-for-UMask-BindPaths-combi.patch
+++ b/debian/patches/0001-Revert-tests-add-test-case-for-UMask-BindPaths-combi.patch
@@ -15,7 +15,7 @@ This reverts commit ae53f4b5e48860b473c4d05958486a77f84ecc6d.
 
 --- a/src/test/test-execute.c
 +++ b/src/test/test-execute.c
-@@ -1142,16 +1142,6 @@
+@@ -1147,16 +1147,6 @@
          test_service(m, "exec-condition-skip.service", SERVICE_SKIP_CONDITION);
  }
  
@@ -32,7 +32,7 @@ This reverts commit ae53f4b5e48860b473c4d05958486a77f84ecc6d.
  typedef struct test_entry {
          test_function_t f;
          const char *name;
-@@ -1234,7 +1224,6 @@
+@@ -1239,7 +1229,6 @@
                  entry(test_exec_specifier),
                  entry(test_exec_execsearchpath_specifier),
                  entry(test_exec_systemcallfilter_system),
diff --git a/debian/patches/Do-not-require-a-valid-version-when-parsing-sd-boot-loade.patch b/debian/patches/Do-not-require-a-valid-version-when-parsing-sd-boot-loade.patch
deleted file mode 100644
index 7e128f4..0000000
--- a/debian/patches/Do-not-require-a-valid-version-when-parsing-sd-boot-loade.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From: Victor Westerhuis <[e-mail]>
-Date: Sun, 14 Nov 2021 16:26:03 +0100
-Subject: Do not require a valid version when parsing sd-boot loader entries
-
-This fixes #20820
-
-(cherry picked from commit 87c7779599ade84df7934c563adb7fe550c871f7)
----
- src/fundamental/bootspec-fundamental.c | 2 +-
- src/shared/bootspec.c                  | 8 +++++---
- 2 files changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/src/fundamental/bootspec-fundamental.c b/src/fundamental/bootspec-fundamental.c
-index 89e29f5..c013892 100644
---- a/src/fundamental/bootspec-fundamental.c
-+++ b/src/fundamental/bootspec-fundamental.c
-@@ -46,7 +46,7 @@ sd_bool bootspec_pick_name_version_sort_key(
-         good_version = os_image_version ?: (os_version ?: (os_version_id ? : os_build_id));
-         good_sort_key = os_image_id ?: os_id;
- 
--        if (!good_name || !good_version)
-+        if (!good_name)
-                 return sd_false;
- 
-         if (ret_name)
-diff --git a/src/shared/bootspec.c b/src/shared/bootspec.c
-index 09eb36e..123db59 100644
---- a/src/shared/bootspec.c
-+++ b/src/shared/bootspec.c
-@@ -530,9 +530,11 @@ static int boot_entry_load_unified(
-         if (!tmp.sort_key)
-                 return log_oom();
- 
--        tmp.version = strdup(good_version);
--        if (!tmp.version)
--                return log_oom();
-+        if (good_version) {
-+                tmp.version = strdup(good_version);
-+                if (!tmp.version)
-+                        return log_oom();
-+        }
- 
-         *ret = tmp;
-         tmp = (BootEntry) {};
diff --git a/debian/patches/Move-homectl-and-userdbctl-to-bindir.patch b/debian/patches/Move-homectl-and-userdbctl-to-bindir.patch
deleted file mode 100644
index a07e5cd..0000000
--- a/debian/patches/Move-homectl-and-userdbctl-to-bindir.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From: Michael Biebl <[e-mail]>
-Date: Sat, 28 May 2022 12:00:08 +0200
-Subject: Move homectl and userdbctl to bindir
-
-Those binaries aren't needed during early boot.
-
-(cherry picked from commit 003a67616148a8c2b94aa0c87595465f5dcac508)
----
- meson.build | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index dbba108..ecc5533 100644
---- a/meson.build
-+++ b/meson.build
-@@ -2577,8 +2577,7 @@ if conf.get('ENABLE_USERDB') == 1
-                 link_with : [libshared],
-                 dependencies : [threads],
-                 install_rpath : rootlibexecdir,
--                install : true,
--                install_dir : rootbindir)
-+                install : true)
- endif
- 
- if conf.get('ENABLE_HOMED') == 1
-@@ -2621,8 +2620,7 @@ if conf.get('ENABLE_HOMED') == 1
-                                 libp11kit,
-                                 libdl],
-                 install_rpath : rootlibexecdir,
--                install : true,
--                install_dir : rootbindir)
-+                install : true)
- 
-         if conf.get('HAVE_PAM') == 1
-                 version_script_arg = project_source_root / pam_systemd_home_sym
diff --git a/debian/patches/Revert-network-if-sys-is-rw-then-udev-should-be-around.patch b/debian/patches/Revert-network-if-sys-is-rw-then-udev-should-be-around.patch
index d2b9eff..10cc082 100644
--- a/debian/patches/Revert-network-if-sys-is-rw-then-udev-should-be-around.patch
+++ b/debian/patches/Revert-network-if-sys-is-rw-then-udev-should-be-around.patch
@@ -13,15 +13,15 @@ LP: #1857123
 
 --- a/src/network/networkd-link.c
 +++ b/src/network/networkd-link.c
-@@ -66,6 +66,7 @@
- #include "tmpfile-util.h"
+@@ -67,6 +67,7 @@
+ #include "tuntap.h"
  #include "udev-util.h"
  #include "util.h"
 +#include "virt.h"
  #include "vrf.h"
  
- bool link_ipv4ll_enabled(Link *link) {
-@@ -1456,7 +1457,7 @@
+ bool link_ipv6_enabled(Link *link) {
+@@ -1437,7 +1438,7 @@
  
          assert(link);
  
diff --git a/debian/patches/debian/Add-env-variable-for-machine-ID-path.patch b/debian/patches/debian/Add-env-variable-for-machine-ID-path.patch
deleted file mode 100644
index d5e3fa4..0000000
--- a/debian/patches/debian/Add-env-variable-for-machine-ID-path.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From: Martin Pitt <[e-mail]>
-Date: Wed, 18 Jan 2017 11:21:35 +0100
-Subject: Add env variable for machine ID path
-
-During package build, in minimal chroots, or other systems which do not already
-have an /etc/machine-id we get six test failures. Introduce a
-$SYSTEMD_MACHINE_ID_PATH environment variable which can specify a location
-other than /etc/machine-id, so that the unit tests are independent from the
-environment.
-
-Also adjust test-fs-util to not assume that /etc/machine-id exists. Use
-/etc/passwd instead which is created by base-files.
-
-Closes: #851445
-
-Bug: https://bugs.freedesktop.org/show_bug.cgi?id=62344
----
- src/libsystemd/sd-id128/sd-id128.c |  2 +-
- src/test/test-fs-util.c            | 11 +++++++----
- 2 files changed, 8 insertions(+), 5 deletions(-)
-
-diff --git a/src/libsystemd/sd-id128/sd-id128.c b/src/libsystemd/sd-id128/sd-id128.c
-index 09c3401..2d4b117 100644
---- a/src/libsystemd/sd-id128/sd-id128.c
-+++ b/src/libsystemd/sd-id128/sd-id128.c
-@@ -108,7 +108,7 @@ _public_ int sd_id128_get_machine(sd_id128_t *ret) {
-         assert_return(ret, -EINVAL);
- 
-         if (sd_id128_is_null(saved_machine_id)) {
--                r = id128_read("/etc/machine-id", ID128_PLAIN, &saved_machine_id);
-+                r = id128_read(getenv("SYSTEMD_MACHINE_ID_PATH") ?: "/etc/machine-id", ID128_PLAIN, &saved_machine_id);
-                 if (r < 0)
-                         return r;
- 
-diff --git a/src/test/test-fs-util.c b/src/test/test-fs-util.c
-index 5d9d99e..9466db6 100644
---- a/src/test/test-fs-util.c
-+++ b/src/test/test-fs-util.c
-@@ -215,7 +215,7 @@ TEST(chase_symlinks) {
-         assert_se(streq(result, "/test-chase.fsldajfl"));
-         result = mfree(result);
- 
--        r = chase_symlinks("/etc/machine-id/foo", NULL, 0, &result, NULL);
-+        r = chase_symlinks("/etc/passwd/foo", NULL, 0, &result, NULL);
-         assert_se(r == -ENOTDIR);
-         result = mfree(result);
- 
-@@ -288,23 +288,26 @@ TEST(chase_symlinks) {
-                 assert_se(chase_symlinks(q, NULL, CHASE_SAFE, NULL, NULL) >= 0);
-         }
- 
--        p = strjoina(temp, "/machine-id-test");
--        assert_se(symlink("/usr/../etc/./machine-id", p) >= 0);
-+        p = strjoina(temp, "/passwd-test");
-+        assert_se(symlink("/usr/../etc/./passwd", p) >= 0);
- 
-         r = chase_symlinks(p, NULL, 0, NULL, &pfd);
-         if (r != -ENOENT) {
-                 _cleanup_close_ int fd = -1;
-+/*
-                 sd_id128_t a, b;
-+*/
- 
-                 assert_se(pfd >= 0);
- 
-                 fd = fd_reopen(pfd, O_RDONLY|O_CLOEXEC);
-                 assert_se(fd >= 0);
-                 safe_close(pfd);
--
-+/*
-                 assert_se(id128_read_fd(fd, ID128_PLAIN, &a) >= 0);
-                 assert_se(sd_id128_get_machine(&b) >= 0);
-                 assert_se(sd_id128_equal(a, b));
-+*/
-         }
- 
-         /* Test CHASE_NOFOLLOW */
diff --git a/debian/patches/debian/Bring-tmpfiles.d-tmp.conf-in-line-with-Debian-defaul.patch b/debian/patches/debian/Bring-tmpfiles.d-tmp.conf-in-line-with-Debian-defaul.patch
index d99ea42..5fd678f 100644
--- a/debian/patches/debian/Bring-tmpfiles.d-tmp.conf-in-line-with-Debian-defaul.patch
+++ b/debian/patches/debian/Bring-tmpfiles.d-tmp.conf-in-line-with-Debian-defaul.patch
@@ -7,8 +7,6 @@ Closes: #675422
  tmpfiles.d/tmp.conf | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
 
-diff --git a/tmpfiles.d/tmp.conf b/tmpfiles.d/tmp.conf
-index fe5225d..39cb5cc 100644
 --- a/tmpfiles.d/tmp.conf
 +++ b/tmpfiles.d/tmp.conf
 @@ -8,5 +8,5 @@
diff --git a/debian/patches/debian/Don-t-enable-audit-by-default.patch b/debian/patches/debian/Don-t-enable-audit-by-default.patch
index b2b88f1..9bae8a2 100644
--- a/debian/patches/debian/Don-t-enable-audit-by-default.patch
+++ b/debian/patches/debian/Don-t-enable-audit-by-default.patch
@@ -15,11 +15,9 @@ Bug-Debian: https://bugs.debian.org/773528
  src/journal/journald.conf     | 2 +-
  3 files changed, 3 insertions(+), 3 deletions(-)
 
-diff --git a/man/journald.conf.xml b/man/journald.conf.xml
-index ed7e428..0abed9c 100644
 --- a/man/journald.conf.xml
 +++ b/man/journald.conf.xml
-@@ -426,7 +426,7 @@
+@@ -429,7 +429,7 @@
          <command>systemd-journald</command> collects generated audit records, it just controls whether it
          tells the kernel to generate them. This means if another tool turns on auditing even if
          <command>systemd-journald</command> left it off, it will still collect the generated
@@ -28,11 +26,9 @@ index ed7e428..0abed9c 100644
        </varlistentry>
  
        <varlistentry>
-diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
-index 3ed8b80..5d373f4 100644
 --- a/src/journal/journald-server.c
 +++ b/src/journal/journald-server.c
-@@ -2293,7 +2293,7 @@ int server_init(Server *s, const char *namespace) {
+@@ -2267,7 +2267,7 @@
                  .compress.threshold_bytes = UINT64_MAX,
                  .seal = true,
  
@@ -41,8 +37,6 @@ index 3ed8b80..5d373f4 100644
  
                  .watchdog_usec = USEC_INFINITY,
  
-diff --git a/src/journal/journald.conf b/src/journal/journald.conf
-index 64f4d4b..a690681 100644
 --- a/src/journal/journald.conf
 +++ b/src/journal/journald.conf
 @@ -44,4 +44,4 @@
diff --git a/debian/patches/debian/Downgrade-a-couple-of-warnings-to-debug.patch b/debian/patches/debian/Downgrade-a-couple-of-warnings-to-debug.patch
index 1c4762c..9cd11ab 100644
--- a/debian/patches/debian/Downgrade-a-couple-of-warnings-to-debug.patch
+++ b/debian/patches/debian/Downgrade-a-couple-of-warnings-to-debug.patch
@@ -15,11 +15,9 @@ Closes: #981407
  src/tmpfiles/tmpfiles.c             | 4 +++-
  3 files changed, 7 insertions(+), 3 deletions(-)
 
-diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
-index 11991ec..76893db 100644
 --- a/src/core/load-fragment.c
 +++ b/src/core/load-fragment.c
-@@ -522,6 +522,7 @@ static int patch_var_run(
+@@ -543,6 +543,7 @@
  
          const char *e;
          char *z;
@@ -27,7 +25,7 @@ index 11991ec..76893db 100644
  
          e = path_startswith(*path, "/var/run/");
          if (!e)
-@@ -531,7 +532,8 @@ static int patch_var_run(
+@@ -552,7 +553,8 @@
          if (!z)
                  return log_oom();
  
@@ -37,11 +35,9 @@ index 11991ec..76893db 100644
                     "%s= references a path below legacy directory /var/run/, updating %s → %s; "
                     "please update the unit file accordingly.", lvalue, *path, z);
  
-diff --git a/src/sysv-generator/sysv-generator.c b/src/sysv-generator/sysv-generator.c
-index 14ae873..aa9e94b 100644
 --- a/src/sysv-generator/sysv-generator.c
 +++ b/src/sysv-generator/sysv-generator.c
-@@ -760,7 +760,7 @@ static int enumerate_sysv(const LookupPaths *lp, Hashmap *all_services) {
+@@ -761,7 +761,7 @@
                          if (!fpath)
                                  return log_oom();
  
@@ -50,11 +46,9 @@ index 14ae873..aa9e94b 100644
                                      "Automatically generating a unit file for compatibility. "
                                      "Please update package to include a native systemd unit file, in order to make it more safe and robust.", fpath);
  
-diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
-index 53cd570..7d71edd 100644
 --- a/src/tmpfiles/tmpfiles.c
 +++ b/src/tmpfiles/tmpfiles.c
-@@ -2757,6 +2757,7 @@ static int specifier_expansion_from_arg(const Specifier *specifier_table, Item *
+@@ -2970,6 +2970,7 @@
  static int patch_var_run(const char *fname, unsigned line, char **path) {
          const char *k;
          char *n;
@@ -62,7 +56,7 @@ index 53cd570..7d71edd 100644
  
          assert(path);
          assert(*path);
-@@ -2782,7 +2783,8 @@ static int patch_var_run(const char *fname, unsigned line, char **path) {
+@@ -2995,7 +2996,8 @@
          /* Also log about this briefly. We do so at LOG_NOTICE level, as we fixed up the situation automatically, hence
           * there's no immediate need for action by the user. However, in the interest of making things less confusing
           * to the user, let's still inform the user that these snippets should really be updated. */
diff --git a/debian/patches/debian/Let-graphical-session-pre.target-be-manually-started.patch b/debian/patches/debian/Let-graphical-session-pre.target-be-manually-started.patch
index cf8db56..8b07a18 100644
--- a/debian/patches/debian/Let-graphical-session-pre.target-be-manually-started.patch
+++ b/debian/patches/debian/Let-graphical-session-pre.target-be-manually-started.patch
@@ -10,11 +10,9 @@ Bug-Ubuntu: https://launchpad.net/bugs/1615341
  units/user/graphical-session-pre.target | 1 -
  1 file changed, 1 deletion(-)
 
-diff --git a/units/user/graphical-session-pre.target b/units/user/graphical-session-pre.target
-index 4b9e3dc..dffaf85 100644
 --- a/units/user/graphical-session-pre.target
 +++ b/units/user/graphical-session-pre.target
-@@ -12,5 +12,4 @@ Description=Session services which should run early before the graphical session
+@@ -12,5 +12,4 @@
  Documentation=man:systemd.special(7)
  Requires=basic.target
  Before=graphical-session.target
diff --git a/debian/patches/debian/Make-run-lock-tmpfs-an-API-fs.patch b/debian/patches/debian/Make-run-lock-tmpfs-an-API-fs.patch
index c65a253..6f4d2ac 100644
--- a/debian/patches/debian/Make-run-lock-tmpfs-an-API-fs.patch
+++ b/debian/patches/debian/Make-run-lock-tmpfs-an-API-fs.patch
@@ -15,11 +15,9 @@ Closes: #751392
  tmpfiles.d/legacy.conf.in | 1 -
  2 files changed, 2 insertions(+), 1 deletion(-)
 
-diff --git a/src/shared/mount-setup.c b/src/shared/mount-setup.c
-index 975c027..cb975e3 100644
 --- a/src/shared/mount-setup.c
 +++ b/src/shared/mount-setup.c
-@@ -86,6 +86,8 @@ static const MountPoint mount_table[] = {
+@@ -86,6 +86,8 @@
  #endif
          { "tmpfs",       "/run",                      "tmpfs",      "mode=755" TMPFS_LIMITS_RUN,               MS_NOSUID|MS_NODEV|MS_STRICTATIME,
            NULL,          MNT_FATAL|MNT_IN_CONTAINER },
@@ -28,8 +26,6 @@ index 975c027..cb975e3 100644
          { "cgroup2",     "/sys/fs/cgroup",            "cgroup2",    "nsdelegate,memory_recursiveprot",         MS_NOSUID|MS_NOEXEC|MS_NODEV,
            cg_is_unified_wanted, MNT_IN_CONTAINER|MNT_CHECK_WRITABLE },
          { "cgroup2",     "/sys/fs/cgroup",            "cgroup2",    "nsdelegate",                              MS_NOSUID|MS_NOEXEC|MS_NODEV,
-diff --git a/tmpfiles.d/legacy.conf.in b/tmpfiles.d/legacy.conf.in
-index 4f2c0d7..fb1d6bf 100644
 --- a/tmpfiles.d/legacy.conf.in
 +++ b/tmpfiles.d/legacy.conf.in
 @@ -10,7 +10,6 @@
diff --git a/debian/patches/debian/Move-sysusers.d-sysctl.d-binfmt.d-modules-load.d-back-to-.patch b/debian/patches/debian/Move-sysusers.d-sysctl.d-binfmt.d-modules-load.d-back-to-.patch
index 9a39629..137ffd4 100644
--- a/debian/patches/debian/Move-sysusers.d-sysctl.d-binfmt.d-modules-load.d-back-to-.patch
+++ b/debian/patches/debian/Move-sysusers.d-sysctl.d-binfmt.d-modules-load.d-back-to-.patch
@@ -13,11 +13,9 @@ Closes: #971282
  src/libsystemd/sd-path/sd-path.c | 8 ++++----
  2 files changed, 8 insertions(+), 8 deletions(-)
 
-diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index 693433b..8368a3f 100644
 --- a/src/core/systemd.pc.in