diff --git a/meta/recipes-core/systemd/systemd-boot-native_259.5.bb b/meta/recipes-core/systemd/systemd-boot-native_259.10.bb similarity index 100% rename from meta/recipes-core/systemd/systemd-boot-native_259.5.bb rename to meta/recipes-core/systemd/systemd-boot-native_259.10.bb diff --git a/meta/recipes-core/systemd/systemd-boot_259.5.bb b/meta/recipes-core/systemd/systemd-boot_259.10.bb similarity index 100% rename from meta/recipes-core/systemd/systemd-boot_259.5.bb rename to meta/recipes-core/systemd/systemd-boot_259.10.bb diff --git a/meta/recipes-core/systemd/systemd-tools-native_259.5.bb b/meta/recipes-core/systemd/systemd-tools-native_259.10.bb similarity index 95% rename from meta/recipes-core/systemd/systemd-tools-native_259.5.bb rename to meta/recipes-core/systemd/systemd-tools-native_259.10.bb index d8d0eae009..81d37c5b75 100644 --- a/meta/recipes-core/systemd/systemd-tools-native_259.5.bb +++ b/meta/recipes-core/systemd/systemd-tools-native_259.10.bb @@ -4,8 +4,6 @@ require systemd.inc SUMMARY = "native tools from systemd" -SRC_URI += "file://0001-hwdb-strip-the-root-from-filenames-when-generating-h.patch" - # We don't actually need jinja to generate code, but it's checked for at configure time DEPENDS = "gperf-native python3-jinja2-native" diff --git a/meta/recipes-core/systemd/systemd.inc b/meta/recipes-core/systemd/systemd.inc index bbcacf9deb..ae3a034ef3 100644 --- a/meta/recipes-core/systemd/systemd.inc +++ b/meta/recipes-core/systemd/systemd.inc @@ -15,7 +15,7 @@ LICENSE:libsystemd = "LGPL-2.1-or-later" LIC_FILES_CHKSUM = "file://LICENSE.GPL2;md5=c09786363500a9acc29b147e6e72d2c6 \ file://LICENSE.LGPL2.1;md5=be0aaf4a380f73f7e00b420a007368f2" -SRCREV = "b3d8fc43e9cb531d958c17ef2cd93b374bc14e8a" +SRCREV = "cc6062f23cb595c172d9a007ed99d925852bfd60" SRCBRANCH = "v259-stable" SRC_URI = "git://github.com/systemd/systemd.git;protocol=https;branch=${SRCBRANCH};tag=v${PV}" diff --git a/meta/recipes-core/systemd/systemd/0001-Revert-resolve-refuse-traffic-from-the-local-host-only.patch b/meta/recipes-core/systemd/systemd/0001-Revert-resolve-refuse-traffic-from-the-local-host-only.patch deleted file mode 100644 index efdc2852f9..0000000000 --- a/meta/recipes-core/systemd/systemd/0001-Revert-resolve-refuse-traffic-from-the-local-host-only.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 658e5ac06f80ee2078b034f7cc483204d7f91c5e Mon Sep 17 00:00:00 2001 -From: Bret Comnes -Date: Thu, 26 Mar 2026 05:59:09 +0000 -Subject: [PATCH] Revert "resolve: refuse traffic from the local host only for - queries" - -This reverts commit 526f1594daec073269c3e70ee7914f6dd8740d5c. - -This revert is necessary because the change breaks mDNS hostname stability -whenever a DNS-SD service calls UnregisterService. When a service -unregisters (e.g. on process restart), manager_refresh_rrs() clears and -re-adds all RRs in PROBING state, which sends a multicast announcement -(QR=1). The kernel reflects this back to resolved's own socket. Because -the local-address check was moved inside the query-only branch by the -reverted commit, the reply path in on_mdns_packet() is now unguarded. -The looped-back announcement matches the pending probe transaction and -completes it with DNS_TRANSACTION_SUCCESS. Since the zone item is still -in PROBING state (not ESTABLISHED), dns_zone_item_notify() sets -we_lost=true and calls dns_zone_item_conflict(), which invokes -manager_next_hostname() and renames the hostname (e.g. foo.local to -foo4.local). This happens reliably on every restart of any service using -RegisterService/UnregisterService (homebridge, avahi-compat wrappers, -etc.). - -The top-level local-address check in on_mdns_packet() suppresses all -looped-back multicast traffic before the reply/query split. Restoring it -there is consistent with the overall design: dns_scope_check_conflicts() -already has its own manager_packet_from_local_address() guard and is -unaffected. - -A more targeted long-term fix (e.g. guarding dns_transaction_process_reply() -for mDNS, or avoiding unnecessary re-probing of already-established records -in manager_refresh_rrs()) can be pursued separately. - -Upstream-Status: Backport [https://github.com/systemd/systemd/commit/658e5ac06f80ee2078b034f7cc483204d7f91c5e] -Signed-off-by: Peter Tatrai ---- - src/resolve/resolved-mdns.c | 16 ++++++++-------- - 1 file changed, 8 insertions(+), 8 deletions(-) - -diff --git a/src/resolve/resolved-mdns.c b/src/resolve/resolved-mdns.c ---- a/src/resolve/resolved-mdns.c -+++ b/src/resolve/resolved-mdns.c -@@ -415,0 +416,8 @@ -+ /* Refuse traffic from the local host, to avoid query loops. However, allow legacy mDNS -+ * unicast queries through anyway (we never send those ourselves, hence no risk). -+ * i.e. check for the source port nr. */ -+ if (p->sender_port == MDNS_PORT && manager_packet_from_local_address(m, p)) { -+ log_debug("Got mDNS UDP packet from local host, ignoring."); -+ return 0; -+ } -+ -@@ -532,8 +539,0 @@ -- /* Refuse traffic from the local host, to avoid query loops. However, allow legacy mDNS -- * unicast queries through anyway (we never send those ourselves, hence no risk). -- * i.e. check for the source port nr. */ -- if (p->sender_port == MDNS_PORT && manager_packet_from_local_address(m, p)) { -- log_debug("Got mDNS UDP packet from local host, ignoring."); -- return 0; -- } -- diff --git a/meta/recipes-core/systemd/systemd/0001-hwdb-strip-the-root-from-filenames-when-generating-h.patch b/meta/recipes-core/systemd/systemd/0001-hwdb-strip-the-root-from-filenames-when-generating-h.patch deleted file mode 100644 index f11199c553..0000000000 --- a/meta/recipes-core/systemd/systemd/0001-hwdb-strip-the-root-from-filenames-when-generating-h.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 0031715c560e8138cc320f017a0a2c7160b1f7fe Mon Sep 17 00:00:00 2001 -From: Ross Burton -Date: Fri, 17 Jul 2026 17:25:31 +0100 -Subject: [PATCH] hwdb: strip the root from filenames when generating hwdb.bin - -The modern hwdb.bin format contains the filenames of the input data that -makes up the database. This is useful but in offline builds where ---root is used, the filenames are the full build paths including the -specified root. This introduces build paths and thus information -leakage and non-reproducible data. - -Solve this by stripping the root prefix off the original path when -passing to import_file. - -Upstream-Status: Backport [https://github.com/systemd/systemd/pull/43062] -Signed-off-by: Ross Burton ---- - src/shared/hwdb-util.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/src/shared/hwdb-util.c b/src/shared/hwdb-util.c -index b42681a289..5386b4e9f4 100644 ---- a/src/shared/hwdb-util.c -+++ b/src/shared/hwdb-util.c -@@ -632,9 +632,11 @@ int hwdb_update(const char *root, const char *hwdb_bin_dir, bool strict, bool co - - FOREACH_ARRAY(i, files, n_files) { - ConfFile *c = *i; -+ char *path_in_root; - - log_debug("Reading file \"%s\" -> \"%s\"", c->original_path, c->resolved_path); -- RET_GATHER(ret, import_file(trie, c->fd, c->original_path, file_priority++, compat)); -+ path_in_root = path_startswith_full(c->original_path, empty_to_root(root), PATH_STARTSWITH_RETURN_LEADING_SLASH); -+ RET_GATHER(ret, import_file(trie, c->fd, path_in_root, file_priority++, compat)); - } - - strbuf_complete(trie->strings); --- -2.43.0 - diff --git a/meta/recipes-core/systemd/systemd/0004-tpm2-util-fix-PCR-bank-guessing-without-EFI.patch b/meta/recipes-core/systemd/systemd/0004-tpm2-util-fix-PCR-bank-guessing-without-EFI.patch deleted file mode 100644 index c590b01cd3..0000000000 --- a/meta/recipes-core/systemd/systemd/0004-tpm2-util-fix-PCR-bank-guessing-without-EFI.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 3cef11c710e95bb5f891181e9b2a6d8f174712c3 Mon Sep 17 00:00:00 2001 -From: Patrick Wicki -Date: Fri, 20 Mar 2026 15:56:56 +0100 -Subject: [PATCH] tpm2-util: fix PCR bank guessing without EFI - -Since 7643e4a89 efi_get_active_pcr_banks() is used to determine the -active PCR banks. Without EFI support, this returns -EOPNOTSUPP. This in -turns leads to cryptenroll and cryptsetup attach failures unless the PCR -bank is explicitly set, i.e. - -$ systemd-cryptenroll $LUKS_PART --tpm2-device=auto --tpm2-pcrs='7' -[...] -Could not read pcr values: Operation not supported - -But it works fine with --tpm2-pcrs='7:sha256'. - -Similarly, unsealing during cryptsetup attach also fails if the bank -needs to be determined: - -Failed to unseal secret using TPM2: Operation not supported - -Catch the -EOPNOTSUPP and fallback to the guessing strategy. - -Upstream-Status: Backport [https://github.com/systemd/systemd/pull/41231] - -Signed-off-by: Patrick Wicki ---- - src/shared/tpm2-util.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c -index cf11b50695..c0590fe575 100644 ---- a/src/shared/tpm2-util.c -+++ b/src/shared/tpm2-util.c -@@ -2702,11 +2702,11 @@ int tpm2_get_best_pcr_bank( - uint32_t efi_banks; - r = efi_get_active_pcr_banks(&efi_banks); - if (r < 0) { -- if (r != -ENOENT) -+ if (!IN_SET(r, -ENOENT, -EOPNOTSUPP)) - return r; - - /* If variable is not set use guesswork below */ -- log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable, we have to guess the used PCR banks."); -+ log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable or EFI support is unavailable, we have to guess the used PCR banks."); - } else if (efi_banks == UINT32_MAX) - log_debug("Boot loader set the LoaderTpm2ActivePcrBanks EFI variable to indicate that the GetActivePcrBanks() API is not available in the firmware. We have to guess the used PCR banks."); - else { -@@ -2811,11 +2811,11 @@ int tpm2_get_good_pcr_banks( - uint32_t efi_banks; - r = efi_get_active_pcr_banks(&efi_banks); - if (r < 0) { -- if (r != -ENOENT) -+ if (!IN_SET(r, -ENOENT, -EOPNOTSUPP)) - return r; - - /* If the variable is not set we have to guess via the code below */ -- log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable, we have to guess the used PCR banks."); -+ log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable or EFI support is unavailable, we have to guess the used PCR banks."); - } else if (efi_banks == UINT32_MAX) - log_debug("Boot loader set the LoaderTpm2ActivePcrBanks EFI variable to indicate that the GetActivePcrBanks() API is not available in the firmware. We have to guess the used PCR banks."); - else { diff --git a/meta/recipes-core/systemd/systemd_259.5.bb b/meta/recipes-core/systemd/systemd_259.10.bb similarity index 99% rename from meta/recipes-core/systemd/systemd_259.5.bb rename to meta/recipes-core/systemd/systemd_259.10.bb index 32fc04352f..95032bf13f 100644 --- a/meta/recipes-core/systemd/systemd_259.5.bb +++ b/meta/recipes-core/systemd/systemd_259.10.bb @@ -38,8 +38,6 @@ SRC_URI += " \ file://0003-Do-not-create-var-log-README.patch \ file://0001-meson-use-libfido2_cflags-dependency.patch \ file://0018-shared-fdset-add-detailed-debug-logging-to-fdset_new.patch \ - file://0004-tpm2-util-fix-PCR-bank-guessing-without-EFI.patch \ - file://0001-Revert-resolve-refuse-traffic-from-the-local-host-only.patch \ " PAM_PLUGINS = " \