Merge c05d24e1fa into c8d45ebfd6

This section contains a predefined set of HWIDs and the corresponding compatibles to be used in dtb matching

NEWS

@@ -103,37 +103,37 @@ CHANGES WITH 257 in spe:
 
         libsystemd:
 
-        * systemd's JSON API is now available as public interface of libsystemd
-          under the name "sd-json". The purpose of the library is to allow
-          structures to be conveniently created in C code and serialized to
-          JSON, and for JSON to be conveniently deserialized into in-memory
-          structures, using callbacks to handle specific keys. Various data
-          types like integers, floats, booleans, strings, UUIDs, base64-encoded
-          and hex-encoded binary data, and arrays are supported natively. The
-          library has been part of systemd for a while as internal component,
-          and now being made publicly available, too. On major user of sd-json
-          is the JSON interface sd-varlink (see below). Note that documentation
-          on sd-json is very much incomplete for now, but the systemd codebase
-          should provide plenty code real-life code examples.
+        * systemd's JSON API is now available as public interface of
+          libsystemd, under the name "sd-json". The purpose of the library is
+          to allow structures to be conveniently created in C code and
+          serialized to JSON, and for JSON to be conveniently deserialized into
+          in-memory structures, using callbacks to handle specific
+          keys. Various data types like integers, floats, booleans, strings,
+          UUIDs, base64-encoded and hex-encoded binary data, and arrays are
+          supported natively. The library has been part of systemd for a while
+          as internal component, and is now made publicly available. One major
+          user of sd-json is sd-varlink (see below). Note that the
+          documentation of sd-json is very much incomplete for now, but the
+          systemd codebase provides plenty real-life code examples.
 
-        * libsystemd's Varlink IPC API is now available as part of libsystemd
+        * systemd's Varlink IPC API is now available as part of libsystemd,
           under the name "sd-varlink". This library is a C implementation of
           the Varlink IPC system (https://varlink.org/) that has been adopted
           by systemd for various interfaces. It relies on the sd-json JSON
-          component, see above. Note that documentation on sd-varlink is very
-          much incomplete for now, but the systemd codebase should provide
-          plenty code real-life code examples.
+          component, see above. Note that the documentation of sd-varlink is
+          very much incomplete for now, but the systemd codebase provides
+          plenty real-life code examples.
 
         * sd-bus gained a new call sd_bus_pending_method_calls() which returns
           the number of currently open asynchronous method calls initiated on
           this connection towards peers.
 
         * sd-device gained a new call sd_device_monitor_is_running() that
-          returns whener the specified monitor object is already running. It
+          returns whether the specified monitor object is already running. It
           also gained sd_device_monitor_get_fd(),
           sd_device_monitor_get_events(), sd_device_monitor_get_timeout() and
-          sd_device_monitor_receive() to permit sd-device to run on a foreign
-          event loop implementation. It also gained
+          sd_device_monitor_receive() to permit sd-device to run on top of a
+          foreign event loop implementation. It also gained
           sd_device_get_driver_subsystem() which returns the subsystem of
           driver objects. The new sd_device_get_device_id() call returns a
           short string identifying the device record.
@@ -148,8 +148,9 @@ CHANGES WITH 257 in spe:
         * Multipath TCP (MPTCP) is now supported as a socket protocol for
           .socket units.
 
-        * New /etc/fstab option x-systemd.wants= creates "Wants" dependencies.
-          (This is similar to the previously available x-systemd.requires=.)
+        * A new /etc/fstab option x-systemd.wants= creates "Wants="
+          dependencies.  (This is similar to the previously available
+          x-systemd.requires=.)
 
         * The initialization of the system clock during boot and updates has
           been simplified: both PID 1 or systemd-timesyncd will pick the latest
@@ -161,17 +162,17 @@ CHANGES WITH 257 in spe:
           shutdown, so that the user may use it to initiate a reboot if the
           system freezes otherwise.
 
-        * The new unit option PrivateUsers=identity can be used to request a
-          user namespace with an identity mapping for the first 65536
-          UIDs/GIDs.  This is analogous to the systemd-nspawn's
+        * The new value "identity" for the unit setting PrivateUsers= may be
+          used to request a user namespace with an identity mapping for the
+          first 65536 UIDs/GIDs.  This is analogous to the systemd-nspawn's
           --private-users=identity.
 
-        * The new unit option PrivateTmp=disconnected can be used to specify
-          that a separate tmpfs instance should be used for /tmp/ and /var/tmp/
-          for the unit.
+        * The new value "disconnected" for the unit setting PrivateTmp= may be
+          used to specify that a separate tmpfs instance should be used for
+          /tmp/ and /var/tmp/ for the unit.
 
-        * The manager (and various other tools too) use pidfds in more places
-          to refer to processes.
+        * The server manager (and various other tools too) use pidfds in more
+          places to refer to processes.
 
         * A build option -D link-executor-shared=false can be used to build
           the systemd-executor binary (added in a previous release) in a way
@@ -185,41 +186,41 @@ CHANGES WITH 257 in spe:
           execute.
 
         * The systemd.machine_id= kernel command line parameter interpreted by
-          PID 1 now supports an additional special value: if "firmware" is
-          specified the machine ID is initialized from the SMBIOS/Devicetree
-          system UUID. (Previously this was already done in VM environments,
-          this extends the concept to any system, but only on explicit request
-          via this option.)
+          PID 1 now supports an additional special value: if set to "firmware"
+          the machine ID is initialized from the SMBIOS/DeviceTree system
+          UUID. (Previously this was already done autmatically in VM
+          environments, this extends the concept to any system, but only on
+          explicit request via this option.)
 
         * The ImportCredential= setting in service unit files now permits
-          renaming credentials imported.
+          renaming of credentials as they are imported.
 
-        * The RestartMode= gained a new "debug" setting. If specified and the
-          service fails so that it shall be restarted it is invoked in
+        * The RestartMode= setting gained a new "debug" value. If specified and
+          the service fails so that it shall be restarted it is invoked in
           "debugging mode". Debugging mode means that the $DEBUG_INVOCATION
           environment variable will be set to "1" for the new
           invocation. Moreover, any setting LogLevelMax= will be temporarily
           changed to "debug" for the next invocation. This mode is useful to
-          repeat invocation of tools if they fail but with additional logging
-          or testing routines turned on.
+          automatically repeat invocation of tools in case they fail – but with
+          additional logging or testing routines enabled.
 
         * A new service setting BindLogSockets= has been added that
           controls whether the AF_UNIX sockets required for logging shall be
           bind mounted to the mount sandbox allocated for the service.
 
-        * PID 1 will now optionally load a policy for the new Linux IPE LSM at
-          boot.
+        * At early boot, PID 1 will now optionally load a policy for the new
+          Linux IPE LSM.
 
-        * Transient services (StartTransientUnit() D-Bus method) may now
-          receive additional, arbitrary file descriptors to pass to executed
-          service processes on activation using the new ExtraFileDescriptor=
-          unit property.
+        * Transient services (as invoked by the StartTransientUnit() D-Bus
+          method) may now receive additional, arbitrary file descriptors to
+          pass to executed service processes during activation using the new
+          ExtraFileDescriptor= unit property.
 
         * Calendar .timer units gained a new boolean DeferReactivation=
           option. If enabled and the repetitive calendar timer elapses again
           while the service the timer activates is still running, immediate
-          reactivation once it finishes is skipped, and the timer has to elapse
-          again before the service is reactivated.
+          reactivation of the service once it finishes is skipped, and the
+          timer has to elapse again before the service is reactivated.
 
         * Generator processes invoked by the service manager will now receive a
           new environment variable $SYSTEMD_SOFT_REBOOTS_COUNT that indicates
@@ -245,10 +246,10 @@ CHANGES WITH 257 in spe:
           "strict" a new cgroup namespace is allocated for the service, and
           cgroupfs is mounted read-only for the service.
 
-        * The StateDirectory=, RuntimeDirectory=, CacheDirectory=, LogsDirectory=,
-          and ConfigurationDirectory= settings gained support for configuring the
-          respective directories as read-only, via a ':ro' flag that can be
-          appended to each setting.
+        * The StateDirectory=, RuntimeDirectory=, CacheDirectory=,
+          LogsDirectory=, and ConfigurationDirectory= settings gained support
+          for configuring the respective directories as read-only, via a ':ro'
+          flag that can be appended to each setting's value.
 
         * When DynamicUser= is combined with
           StateDirectory=/RuntimeDirectory=/CacheDirectory=/LogsDirectory= and
@@ -258,15 +259,15 @@ CHANGES WITH 257 in spe:
           chown()ing.
 
         * A new service property PrivatePIDs= has been added that runs executed
-          processes as PID 1 - the init process - within their own PID namespace.
-          PrivatePIDs= also mounts /proc/ so only processes within the new PID
-          namespace are visible.
+          processes as PID 1 - the init process - within their own PID
+          namespace.  PrivatePIDs= also mounts /proc/ so only processes within
+          the new PID namespace are visible.
 
         systemd-udevd:
 
         * udev rules now set 'uaccess' for /dev/udmabuf, giving locally
-          logged-in users access to the hardware. This is necessary to support
-          IPMI cameras with libcamera.
+          logged-in users access to the hardware. This is useful in order to
+          support IPMI cameras with libcamera.
 
         * Serial port devices will no longer show up as systemd units, unless
           they have an IO port or memory assigned to them. This means that only
@@ -276,14 +277,14 @@ CHANGES WITH 257 in spe:
           show up as .device units in systemd.
 
         * The firmware_node/sun sysfs attribute will now be used (if available)
-          for naming slot-based network interfaces,
-          i.e. ID_NET_NAME_SLOT. Moreover the interface aliases specified in
-          Devicetree are now searched for both on the interfaces parent device
-          (as before) and the device itself (new).
+          for naming slot-based network interfaces, i.e. ID_NET_NAME_SLOT.
+          Moreover the interface aliases specified in DeviceTree are now
+          searched for both on the interface's parent device (as before) and
+          the device itself (new).
 
-        * Various USB hardware wallets have are now recognized by udev via a
-          .hwdb file, and get the ID_HARDWARE_WALLET= property set, which
-          enables "uaccess" for them, i.e. direct unprivileged access.
+        * Various USB hardware wallets are now recognized by udev via a .hwdb
+          file, and get the ID_HARDWARE_WALLET= property set, which enables
+          "uaccess" for them, i.e. direct unprivileged access.
 
         * udevadm info will now output the device ID string in lines prefixed
           with "J:", and the driver subsystem in lines prefixed with "B:".
@@ -293,8 +294,8 @@ CHANGES WITH 257 in spe:
 
         systemd-logind:
 
-        * New DesignatedMaintenanceTime= configuration option allows
-          shutdowns to be automatically scheduled at the specified time.
+        * New DesignatedMaintenanceTime= configuration option allows shutdowns
+          to be automatically scheduled at the specified time.
 
         * logind now reacts to Ctrl-Alt-Shift-Esc being pressed. It will send
           out a org.freedesktop.login1.SecureAttentionKey signal, indicating a
@@ -308,8 +309,8 @@ CHANGES WITH 257 in spe:
           session switches away.
 
         * systemd-logind now exposes two D-Bus properties CanLock and CanIdle
-          for all sessions that indicate whether the session's class supports
-          screen locking and idle detection.
+          for all sessions. These properties indicate whether the session's
+          class supports screen locking and idleness detection.
 
         * systemd-inhibit now allows interactive polkit authorization. It
           gained a --no-ask-password option to suppress it.
@@ -320,12 +321,13 @@ CHANGES WITH 257 in spe:
           Machines started via the systemd-vmspawn@.service unit will now be
           registered with systemd-machined.
 
-        * systemd-machined gained a pretty complete set of Varlink interfaces
-          to its functionality as alternative to the existing D-Bus interface.
+        * systemd-machined gained a pretty complete set of Varlink APIs
+          exposing its functionality. This is an alternative to the
+          pre-existing D-Bus interface.
 
         systemd-resolved:
 
-        * resolvconf command now supports '-p' switch. If specified, the
+        * The resolvconf command now supports '-p' switch. If specified, the
           interface will not be used as the default route for domain name
           lookups.
 
@@ -337,11 +339,11 @@ CHANGES WITH 257 in spe:
         * IPv6 address labels can be configured in a new [IPv6AddressLabel]
           section with Prefix= and Label= settings.
 
-        * 'networkctl edit' can now read the new contents from standard input
-          with the new --stdin option.
+        * 'networkctl edit' can now read the new file contents from standard
+          input with the new --stdin option.
 
-        * 'networkctl edit' and 'cat' now supports editing .netdev files by
-          link. 'networkctl cat' can also list all configuration files
+        * 'networkctl edit' and 'cat' now support editing/showing .netdev files
+          by link. 'networkctl cat' can also list all configuration files
           associated with an interface at once with ':all'.
 
         * networkctl gained a --no-ask-password option to suppress interactive
@@ -350,7 +352,7 @@ CHANGES WITH 257 in spe:
         * "mac" has been added to the default AlternativeNamesPolicy= setting
           for network links (via 99-default.link). This means "enx*" interface
           names will now be added to the list of alternative interface names by
-          default for all interfaces that have a MAC address assigned to them
+          default, for all interfaces that have a MAC address assigned
           by hardware.
 
         * networkd .netdev bridge devices gained a new setting FDBMaxLearned=
@@ -365,18 +367,18 @@ CHANGES WITH 257 in spe:
           thus highlighting conflict of ownership/management of these knobs.
 
         * systemd-networkd will now make RFC9463 DNR fields available to
-          systemd-resolved, for automatic DoT configuration, and similar.
+          systemd-resolved, for automatic DNS DoT configuration, and similar.
 
         systemd-boot, systemd-stub, and related tools:
 
         * The EFI stub now supports loading of .ucode sections with microcode
-          from PE add-on files. It now also supports loading .initrd sections
+          from PE add-on files. It also now supports loading .initrd sections
           from PE add-on files.
 
         * A new .profile PE section type is now documented and supported in
-          systemd-measure, ukify, systemd-stub and systemd-boot. Those new
+          systemd-measure, ukify, systemd-stub and systemd-boot. These new
           sections allow multiple "profiles" to be stored together in the UKI,
-          with .profile sections creating groupings of sections in the UKI,
+          where each .profile section creates groupings of sections in the UKI,
           allowing some sections to be shared and other sections like .cmdline
           or .initrd unique to the profile. This may be used to provide a
           single UKI that synthesizes multiple menu items in the boot menu (for
@@ -384,6 +386,16 @@ CHANGES WITH 257 in spe:
           reset one, and so on – which only differ in kernel command line, but
           nothing else).
 
+        * New .dtbauto and .hwids sections are now documented and supported in
+          systemd-measure, ukify, systemd-stub, and systemd-boot. A single UKI
+          can contain multiple .dtbauto sections, and the 'compatible' string
+          therein will be compared with the equivalent field in the DTB
+          provided by the firmware, if present. If absent, SMBIOS will be used
+          to calculate hardware IDs (CHIDs) and look them up in the content of
+          .hwids, hopefully revealing an fallback 'compatible' string. This
+          allows including multiple DTBs in a single UKI, with systemd-stub
+          automatically loading the correct one for the current hardware.
+
         * ukify gained an --extend switch to import an existing UKI to
           be extended, and a --measure-base= switch to support measurement
           of multi-profile UKIs.
@@ -395,31 +407,37 @@ CHANGES WITH 257 in spe:
 
         * systemd-stub will report the partition UUID and image identifier its
           UKI executable is placed on separately from the data systemd-boot
-          provides about where to find its own executable. This is useful when
-          systemd-boot and UKIs are placed on distinct partitions (i.e. ESP and
-          XBOOTLDR).
+          provides about where to find its own executable, via EFI
+          variables. This is useful when systemd-boot and UKIs are placed on
+          distinct partitions (i.e. ESP and XBOOTLDR).
 
-        * bootctl --print-loader-path and --print-stub-path that output the
-          path to the boot loader or UKI used for the current boot.
+        * bootctl gained new switches --print-loader-path and --print-stub-path
+          that output the path to the boot loader or UKI used for the current
+          boot.
 
-        * bootctl kernel-identify now supports identifying EFI add-ons.
+        * bootctl kernel-identify now recognizes EFI add-ons.
 
         * bootctl gained a --random-seed=yes|no option to control provisioning
-          of the random seed file in ESP. (This is useful when producing an
-          image that will be used multiple times.)
+          of the random seed file in the ESP. (This is useful when producing an
+          image that will be used in multiple instances.)
 
         * bootctl now optionally supports installing UEFI Secure Boot databases
-          (ESLs) for systemd-boot to pick up and automatically enroll if the
-          system is booted in Setup Mode. This is controlled via bootctl's new
-          --secure-boot-auto-enroll=yes switch (and some auxiliary ones). A
-          certificate can be provided in DER format, and it is automatically
-          converted into an ESL, as needed.
+          (i.e. db/dbx/…  databases in ESL format) for systemd-boot to pick up
+          and automatically enroll if the system is booted in Setup Mode. This
+          is controlled via bootctl's new --secure-boot-auto-enroll=yes switch
+          (and some auxiliary ones). A certificate can be provided in DER
+          format, and is automatically converted into an ESL, as needed.
 
         * bootctl, systemd-measure, systemd-repart when referencing signing
           keys on OpenSSL engines may now query for PINs and similar via
           systemd's native systemd-ask-password logic (and take benefit of its
           caching and UI).
 
+        * A new systemd-sbsign tool has been added, that can be used to sign
+          EFI binaries (PE) for Secure Boot. This tool supports OpenSSL engines
+          and providers, with pin caching support for PKCS11. ukify supports it
+          as an alternative to sbsigntool and pesign.
+
         The journal:
 
         * journalctl can now list invocations of a unit with the
@@ -453,22 +471,22 @@ CHANGES WITH 257 in spe:
           and AppStream metadata.
 
         * Transfer definitions for systemd-sysupdate are supposed to carry the
-          ".transfer" suffix now, changing from ".conf". The latter is
-          supported for compatibility too, but it's recommended to rename all
-          files reflecting this suffix change.
+          ".transfer" suffix now, changing from ".conf". The latter remains
+          supported for compatibility, but it's recommended to rename all files
+          reflecting this suffix change.
 
-        * systemd-sysupdate now supports a new ".feature" files that may be
+        * systemd-sysupdate now supports new ".feature" files that may be
           used in conjunction with ".transfer" files to group them together, and
           allow them to be turned off or on, individually per group.
 
         TPM & systemd-cryptsetup:
 
-        * The 'tpm2' verb which lists usable TPM2 devices has been moved from
-          systemd-creds to systemd-analyze.
+        * The 'has-tpm2' verb which reports whether TPM2 functionality is
+          available has been moved from systemd-creds to systemd-analyze.
 
         * systemd-tpm2-setup will gracefully handle TPMs that have a PIN set on
-          the TPM, and not automatically set up a Storage Root Key (SRK) in
-          that case.
+          the TPM, and not attempt to automatically set up a Storage Root Key
+          (SRK) in that case.
 
         * New crypttab option password-cache=yes|no|read-only can be used to
           customize password caching.
@@ -510,7 +528,7 @@ CHANGES WITH 257 in spe:
           start the specified executable on the remote side, and communicate
           with the remote process using the Varlink protocol.
 
-          "ssh:" address specification has been renamed to "ssh-unix:"
+          The "ssh:" address specification has been renamed to "ssh-unix:"
           (reflecting the fact it is used to connect to a remote AF_UNIX socket
           via SSH). The old syntax is still supported for backwards
           compatibility.
@@ -531,7 +549,8 @@ CHANGES WITH 257 in spe:
           to enable internal compression in filesystems created offline.
 
         * systemd-repart understands a new MakeSymlinks= option to create one
-          or more symlinks (each specified as a symlink name and target).
+          or more symlinks (each specified as a symlink name and target) within
+          a newly formatted file system.
 
         * systemd-repart gained a new SupplementFor= setting that allows
           allocating a partition only if some other existing partition cannot
@@ -544,15 +563,15 @@ CHANGES WITH 257 in spe:
 
         systemd-ssh-proxy:
 
-        * systemd-ssh-proxy now also supports the "VSOCK MUX" protocol used by
-          CloudHypervisor/Firecracker to expose AF_VSOCK sockets of the VM on
-          the host. Or in other words: it's now possible to directly connect to
-          ssh via AF_VSOCK from hosts to VMs of these two hypervisors
-          (previously this was only supported for hypervisors which expose
-          AF_VSOCK on the host as AF_VSOCK, such as qemu).
+        * systemd-ssh-proxy now also supports the AF_UNIX-based "VSOCK MUX"
+          protocol used by CloudHypervisor/Firecracker to expose AF_VSOCK
+          sockets of the VM on the host. Or in other words: it's now possible
+          to directly connect to ssh via AF_VSOCK from hosts to VMs of these
+          two hypervisors (previously this was only supported for hypervisors
+          which expose AF_VSOCK on the host as AF_VSOCK, such as qemu).
 
         * systemd-ssh-proxy can now reference local VMs by their name: connect
-          to any local VM "foobar" registered with machined via "ssh
+          to any local VM "foobar" registered with systemd-machined via "ssh
           machine/foobar" using the AF_VSOCK protocol.
 
         systemd-analyze:
@@ -576,7 +595,6 @@ CHANGES WITH 257 in spe:
 
         * 'busctl monitor' gained new options --limit-messages= and --timeout=
           to set the number of matches or limit the runtime of the command.
-          This is intended to be used in scripts.
 
         * busctl now supports doing method calls with embedded unix file
           descriptors.
@@ -594,9 +612,9 @@ CHANGES WITH 257 in spe:
 
         systemd-importd:
 
-        * A new generator sytemd-import-generator has been added to
-          synthetisize image download jobs. This provides functionality similar
-          to importctl, but configured via the kernel command line and system
+        * A new generator sytemd-import-generator has been added to synthesize
+          image download jobs. This provides functionality similar to
+          importctl, but is configured via the kernel command line and system
           credentials. It may be used to automatically download sysext,
           confext, portable service, nspawn container or vmspawn VM images at
           boot.
@@ -625,6 +643,32 @@ CHANGES WITH 257 in spe:
           systemd-homed to allow users to change selected properties of their
           own user records.
 
+        systemd-run & run0:
+
+        * run0 gained a new pair of settings --pty and --pipe that control
+          whether to invoke the specified binary on a freshly allocated pseudo
+          TTY, or whether to pass the client's STDIN/STDOUT/STDERR through
+          directly.
+
+        * run0 gained a new switch --shell-prompt-prefix= that permits passing
+          in a string to display on each shell prompt as prefix. If not
+          specified otherwise this will show a superhero emoji (🦸), in order
+          to visually communicate the temporarily elevated privileges a run0
+          session provides. This makes use of the $SHELL_PROMPT_PREFIX
+          environment variables mentioned below.
+
+        * systemd-run can output some of its runtime data in JSON format via
+          the new --json= option.
+
+        systemd-tmpfiles:
+
+        * systemd-tmpfiles --purge switch now requires specification of at
+          least one tmpfiles.d/ drop-in file.
+
+        * tmpfiles.d/ files gained a new '?' specifier for the 'L' line type to
+          create a symlink only if the source exists, and gracefully skip the
+          line otherwise.
+
         Miscellaneous:
 
         * systemctl now supports the --now option with the 'reenable' verb.
@@ -639,18 +683,13 @@ CHANGES WITH 257 in spe:
         * localectl gained a -l/--full option to show output without
           ellipsization.
 
-        * systemd-run can output some data as JSON via the new --json= option.
-
         * timedatectl now supports interactive polkit authorization.
 
-        * systemd-tmpfiles --purge switch now requires specification of at
-          least one tmpfiles.d/ drop-in file.
-
         * The new Linux mseal(), listmount(), statmount() syscalls have been
           added to relevant system call groups.
 
-        * The systemd-ask-password concept has been extended with a per-user
-          concept, i.e. user programs may now ask for passwords via the same
+        * The systemd-ask-password logic has been extended with a per-user
+          scope, i.e. user programs may now ask for passwords via the same
           mechanism and the previously system-wide only mechanism.
 
         * A new set of system/service credentials are added:
@@ -663,17 +702,8 @@ CHANGES WITH 257 in spe:
           useful to visually highlight the fact a specific shell prompt
           originates from a specific system, execution context or tool. These
           credentials and environment variables are supposed to be generically
-          useful within and outside of the immediate systemd context.
-
-        * run0 gained a new pair of settings --pty and --pipe that control
-          whether to invoke the specified binary on a freshly allocated pseudo
-          TTY, or whether to pass the client's STDIN/STDOUT/STDERR through
-          directly. run0 also gained a new switch --shell-prompt-prefix= that
-          permits passing in a string to display on each shell prompt as
-          prefix. If not specified otherwise this will show a superman emoji
-          (🦸), in order to visually communicate the temporarily elevated
-          privileges a run0 session provides. This makes use of the
-          $SHELL_PROMPT_PREFIX environment variables mentioned above.
+          useful within and outside of the immediate systemd context. It is
+          also used by 'run0', see above.
 
         * New RELEASE_TYPE=, EXPERIMENT=, EXPERIMENT_URL= fields have been
           defined for the /etc/os-release file. For example,
@@ -700,30 +730,82 @@ CHANGES WITH 257 in spe:
           https://github.com/microsoft/terminal/pull/8055
           https://conemu.github.io/en/AnsiEscapeCodes.html#ConEmu_specific_OSC
 
-        * systemd-sysusers is now able to create fully locked accounts. For
-          compatibility it so far created accounts with a locked (i.e. invalid)
-          password, but not marked locked as a whole. With the new "!" modifier
-          for "u" lines, it is now possible to create fully locked
-          accounts. The distinction between accounts with a locked password and
-          fully locked accounts is relevant when considering non-password forms
-          of authentication, i.e. SSH and such. It is strongly recommended to
-          make use of this new feature for almost all system accounts, since
-          they usually do not require (and should not permit) interactive
-          logins. All of systemd's own system users have been changed to be
-          marked as fully locked.
+        * systemd-sysusers is now able to create fully locked user
+          accounts. For compatibility it so far created accounts with a locked
+          (i.e. invalid) password, but not marked locked as a whole. With the
+          new "!" modifier for "u" lines, it is now possible to create fully
+          locked accounts. The distinction between accounts with a locked
+          password and fully locked accounts is relevant when considering
+          non-password forms of authentication, i.e. SSH and such. It is
+          strongly recommended to make use of this new feature for almost all
+          system accounts, since they usually do not require (and should not
+          permit) interactive logins. All of systemd's own system users have
+          been changed to be marked as fully locked.
 
         * systemd-coredump now supports a new EnterNamespace= option, which
           defaults to off. If enabled systemd-coredump will access the mount
           namespace of any crashed process to acquire debug symbol information,
-          in order to be able to symbolized backtraces. This option is useful
-          to improve backtraces of processes of containerized
-          applications. (Note that the host systemd-coredump preferably
-          dispatches coredump processing to the container itself, if it
-          supports that. Only full-OS containers which run systemd inside will
-          support this however, in which case EnterNamespace= might be an
-          alternative approach to acquire symbolized backtraces.)
+          in order to be able to symbolize backtraces. This option is useful to
+          improve backtraces of processes of containerized applications. (Note
+          that the host systemd-coredump preferably dispatches coredump
+          processing to the container itself, if it supports that. Only full-OS
+          containers which run systemd inside will support this however, in
+          other cases EnterNamespace= might be an suitable approach to acquire
+          symbolized backtraces.)
 
-        — <place>, <date>
+        Contributions from: A. Wilcox, Abderrahim Kitouni, Adrian Vovk,
+        Alain Greppin, Allison Karlitskaya, Alyssa Ross, Anders Jonsson,
+        Andika Triwidada, Andres Beltran, Anouk Ceyssens, Anton Golubev,
+        Antonio Alvarez Feijoo, Arian van Putten, Arnaud Patard,
+        Arthur Shau, Bastien Nocera, Benjamin ROBIN, Brenton Simpson,
+        Bryan Gurney, ButterflyOfFire, Carlo Teubner, Celeste Liu,
+        Chen Guanqiao, Chen Qi, Chengen Du, Christoph Anton Mitterer,
+        Colin Foster, Collin L, Cristian Rodríguez, Daan De Meyer,
+        Dan Nicholson, Daniel Dawson, Daniel Martinez,
+        Daniel P. Berrangé, Daniel Rusek, Darsey Litzenberger,
+        David Joaquín Shourabi Porcel, David Michael, David Rheinsberg,
+        David Tardon, Davide Cavalca, Derek J. Clark, Diego Viola,
+        Dimitrys Meliates, Diogo Ivo, DocNITE, Dominique Martinet,
+        Dr. David Alan Gilbert, Edson Juliano Drosdeck, Erik Sjölund,
+        Etienne Champetier, Etienne Cordonnier, Ettore Atalan,
+        Eugeny Shcheglov, Fabian Vogt, Filip Lewiński, Florian Schmaus,
+        Franck Bui, Frantisek Sumsal, Fábio Rodrigues Ribeiro,
+        Gabriel Elyas, Gaël PORTAY, Giovanni Baratta, Gregor Herburger,
+        Gregory Arenius, GwynBleidD, Göran Uddeborg, Hans de Goede,
+        Helmut Grohne, Henry Chen, Ian Abbott, Integral, Ivan Kruglov,
+        Ivan Shapovalov, James Coglan, James Hilliard, James Muir,
+        Jason Yundt, Jeffrey Bosboom, Johannes Schneider,
+        John A. Leuenhagen, Jose Ignacio Tornos Martinez, JoseskVolpe,
+        Joshua Grisham, Jörg Behrmann, Kai-Chuan Hsieh, Kamil Szczęk,
+        Karel Zak, Kornilios Kourtis, Kuntal Majumder, Lennart Poettering,
+        Luca Boccassi, Lucas Adriano Salles, Lucas Werkmeister,
+        Ludwig Nussel, Luke T. Shumaker, Lukáš Nykrýn, Léane GRASSER,
+        Maanya Goenka, Mantas Mikulėnas, Marc Reisner, Marcel Hellwig,
+        Marin Kresic, Marius Hoch, Martin Srebotnjak, Martin Wilck,
+        Mary Strodl, Matteo Croce, Matthias Lisin, Matthias Schiffer,
+        Matthieu Baerts (NGI0), Matthieu CHARETTE,
+        Mauri de Souza Meneguzzo, Maximilian Wilhelm, Merlin Jehli,
+        Michael Ferrari, Michal Koutný, Michal Sekletár,
+        Michele Dionisio, Michiel, Mickaël Salaün, Mike Gilbert,
+        Mike Yuan, MkKvcs, Nick Cao, Nick Rosbrook, Nils K, Nova840,
+        Oğuz Ersen, Pavel Borecki, PavlNekrasov, Peter Hutterer,
+        Peter Rajnoha, Piotr Drąg, Raphaël Mélotte, Renan Guilherme,
+        Renjaya Raga Zenta, Ricky Tigg, Riku, Robin Lee, Ronan Pigott,
+        Ryan Wilson, Sam James, Sascha Mester, Sean Rhodes, Sergey A,
+        ShreyasMahangade, Simon Pilkington, Skye Chappelle, Steve Traylen,
+        Stuart Hayhurst, Susant Sahani, Takeo Kondo, Temuri Doghonadze,
+        Thomas Blume, Thorsten Scherer, Tobias Fleig, Tom Coldrick,
+        Tom Yan, Tomas Bzatek, Topi Miettinen, Uday Shankar,
+        Vasiliy Kovalev, Vitaly Kuznetsov, Vito Caputo, Vladimir Panteleev,
+        Will Fancher, WilliButz, Xeonacid, Yanqing Jing, Yu Watanabe,
+        Yuri Chornoivan, ZHANG Yuntian, Zbigniew Jędrzejewski-Szmek,
+        Zhou Qiankang, anonymix007, bryango, chayleaf, chenjiayi, csp5me,
+        cvlc12, fwfy, hugo303, jan@neighbourhood.ie, jauge-technica, lumingzh,
+        maia x., marginaldev, migleeson, nerdopolis, oldherl, pyfisch, q66,
+        rajmohan r, reDBo0n, rhellstrom, rindeal, samuelvw01, sinus-x, tfg13,
+        vdovhanych, xujing, Łukasz Stelmach, Дамјан Георгиевски
+
+        — Edinburgh, 2024-11-06
 
 CHANGES WITH 256:
 
@@ -2012,7 +2094,7 @@ CHANGES WITH 255:
           respective SBAT sections, so that they can be revoked individually if
           needed.
 
-        * systemd-boot will no longer load unverified Devicetree blobs when UEFI
+        * systemd-boot will no longer load unverified DeviceTree blobs when UEFI
           SecureBoot is enabled. For more details see:
           https://github.com/systemd/systemd/security/advisories/GHSA-6m6p-rjcq-334c
 
@@ -2033,7 +2115,7 @@ CHANGES WITH 255:
           command-line addons before measuring them in TPM2 PCR 12, in a single
           measurement, instead of measuring them individually.
 
-        * systemd-stub will now measure and load Devicetree Blob addons, which
+        * systemd-stub will now measure and load DeviceTree Blob addons, which
           are searched and loaded following the same model as the existing
           kernel command-line addons.
 
@@ -2041,7 +2123,7 @@ CHANGES WITH 255:
           passed from systemd-boot when running inside Confidential VMs with UEFI
           SecureBoot enabled.
 
-        * systemd-stub will now load a Devicetree blob even if the firmware did
+        * systemd-stub will now load a DeviceTree blob even if the firmware did
           not load any beforehand (e.g.: for ACPI systems).
 
         * ukify is no longer considered experimental, and now ships in /usr/bin/.
@@ -2222,6 +2304,10 @@ CHANGES WITH 255:
           specific devices explicitly. NetworkManager will soon implement a
           similar logic.
 
+        * .network files gained a new MulticastIGMPVersion= setting in the
+          [Network] section, to control sysctl's
+          /proc/sys/net/ipv4/conf/INTERFACE/force_igmp_version setting.
+
         systemctl:
 
         * systemctl is-failed now checks the system state if no unit is
@@ -4355,7 +4441,7 @@ CHANGES WITH 252 🎃:
         * 'udevadm wait' will now listen to kernel uevents too when called with
           --initialized=no.
 
-        * When naming network devices udev will now consult the Devicetree
+        * When naming network devices udev will now consult the DeviceTree
           "alias" fields for the device.
 
         * systemd-udev will now create infiniband/by-path and

TODO

@@ -129,6 +129,12 @@ Deprecations and removals:
 
 Features:
 
+* machined: when registering a machine, also take a relative cgroup path,
+  relative to the machine's unit. This is useful when registering unpriv
+  machines, as they might sit down the cgroup tree, below a cgroup delegation
+  boundary. Then, install an inotify watch on that cgroup to track when the
+  machine's local cgroup goes down.
+
 * resolved: report ttl in resolution replies if we know it. This data is useful
   for tools such as wireguard which want to periodically re-resolve DNS names,
   and might want to use the TTL has hint for that.

docs/RELEASE.md

@@ -15,18 +15,19 @@ SPDX-License-Identifier: LGPL-2.1-or-later
 6. [RC1] Update library numbers in `meson.build`
 7. Update version number in `meson.version` (e.g. from `256~devel` to `256~rc1` or from `256~rc3` to `256`). Note that this uses a tilde (\~) instead of a hyphen (-) because tildes sort lower in version comparisons according to the [version format specification](https://uapi-group.org/specifications/specs/version_format_specification/), and we want `255~rc1` to sort lower than `255`.
 8. Check dbus docs with `ninja -C build update-dbus-docs`
-9. Update translation strings (`ninja -C build systemd-pot`, `ninja -C build systemd-update-po`) - drop the header comments from `systemd.pot` + re-add SPDX before committing. If the only change in a file is the 'POT-Creation-Date' field, then ignore that file.
-10. Tag the release: `version="v$(sed 's/~/-/g' meson.version)" && git tag -s "${version}" -m "systemd ${version}"` (tildes are replaced with hyphens, because git doesn't accept the former).
-11. Do `ninja -C build`
-12. Make sure that the version string and package string match: `build/systemctl --version`
-13. [FINAL] Close the github milestone and open a new one (https://github.com/systemd/systemd/milestones)
-14. "Draft" a new release on github (https://github.com/systemd/systemd/releases/new), mark "This is a pre-release" if appropriate.
-15. Check that announcement to systemd-devel, with a copy&paste from NEWS, was sent. This should happen automatically.
-16. Update IRC topic (`/msg chanserv TOPIC #systemd Version NNN released | Online resources https://systemd.io/`)
-17. [FINAL] Create an empty -stable branch: `git push systemd origin/main:refs/heads/v${version}-stable`.
-18. [FINAL] Build and upload the documentation (on the -stable branch): `ninja -C build doc-sync`
+9. Check manpages list with `ninja -C build update-man-rules`
+10. Update translation strings (`ninja -C build systemd-pot`, `ninja -C build systemd-update-po`) - drop the header comments from `systemd.pot` + re-add SPDX before committing. If the only change in a file is the 'POT-Creation-Date' field, then ignore that file.
+11. Tag the release: `version="v$(sed 's/~/-/g' meson.version)" && git tag -s "${version}" -m "systemd ${version}"` (tildes are replaced with hyphens, because git doesn't accept the former).
+12. Do `ninja -C build`
+13. Make sure that the version string and package string match: `build/systemctl --version`
+14. [FINAL] Close the github milestone and open a new one (https://github.com/systemd/systemd/milestones)
+15. "Draft" a new release on github (https://github.com/systemd/systemd/releases/new), mark "This is a pre-release" if appropriate.
+16. Check that announcement to systemd-devel, with a copy&paste from NEWS, was sent. This should happen automatically.
+17. Update IRC topic (`/msg chanserv TOPIC #systemd Version NNN released | Online resources https://systemd.io/`)
+18. [FINAL] Create an empty -stable branch: `git push systemd origin/main:refs/heads/v${version}-stable`.
+19. [FINAL] Build and upload the documentation (on the -stable branch): `ninja -C build doc-sync`
 20. [FINAL] Change the Github Pages branch to the newly created branch (https://github.com/systemd/systemd/settings/pages) and set the 'Custom domain' to 'systemd.io'
-21. [FINAL] Update version number in `meson.version` to the devel version of the next release (e.g. from `v256` to `v257~devel`)
+21. [FINAL] Update version number in `meson.version` to the devel version of the next release (e.g. from `256` to `257~devel`)
 
 # Steps to a Successful Stable Release
 

docs/TPM2_PCR_MEASUREMENTS.md

@@ -41,7 +41,7 @@ used for new, additional measurements.
 
 ## PCR Measurements Made by `systemd-boot` (UEFI)
 
-### PCS 5, `EV_EVENT_TAG`, "loader.conf"
+### PCS 5, `EV_EVENT_TAG`, `loader.conf`
 
 The content of `systemd-boot`'s configuration file, `loader/loader.conf`, is
 measured as a tagged event.
@@ -52,7 +52,7 @@ measured as a tagged event.
 
 → **Measured hash** covers the content of `loader.conf` as it is read from the ESP.
 
-### PCR 12, `EV_IPL`, "Kernel Command Line"
+### PCR 12, `EV_IPL`, kernel command line
 
 If the kernel command line was specified explicitly (by the user or in a Boot
 Loader Specification Type #1 file), the kernel command line passed to the
@@ -70,7 +70,7 @@ trailing NUL bytes).
 
 ## PCR Measurements Made by `systemd-stub` (UEFI)
 
-### PCR 11, `EV_IPL`, "PE Section Name"
+### PCR 11, `EV_IPL`, PE section name
 
 A measurement is made for each PE section of the UKI that is defined by the
 [UKI
@@ -87,7 +87,7 @@ both types of records appear interleaved in the event log.
 
 → **Measured hash** covers the PE section name in ASCII (*including* a trailing NUL byte!).
 
-### PCR 11, `EV_IPL`, "PE Section Data"
+### PCR 11, `EV_IPL`, PE section data
 
 Happens once for each UKI-defined PE section of the UKI, in the canonical UKI
 PE section order, as per the UKI specification, see above.
@@ -96,7 +96,7 @@ PE section order, as per the UKI specification, see above.
 
 → **Measured hash** covers the (binary) PE section contents.
 
-### PCR 12, `EV_IPL`, "Kernel Command Line"
+### PCR 12, `EV_IPL`, kernel command line
 
 Might happen up to three times, for kernel command lines from:
 
@@ -110,37 +110,37 @@ UTF-16.
 → **Measured hash** covers the literal kernel command line in UTF-16 (without any
 trailing NUL bytes).
 
-### PCR 12, `EV_EVENT_TAG`, "Devicetrees"
+### PCR 12, `EV_EVENT_TAG`, DeviceTrees
 
-Devicetree addons are measured individually as a tagged event.
+DeviceTree addons are measured individually as a tagged event.
 
 → **Event Tag** `0x6c46f751`
 
-→ **Description** the addon filename.
+→ **Description** is the addon filename.
 
-→ **Measured hash** covers the content of the Devicetree.
+→ **Measured hash** covers the content of the DeviceTree.
 
-### PCR 12, `EV_EVENT_TAG`, "Initrd addons"
+### PCR 12, `EV_EVENT_TAG`, initrd addons
 
 Initrd addons are measured individually as a tagged event.
 
 → **Event Tag** `0x49dffe0f`
 
-→ **Description** the addon filename.
+→ **Description** is the addon filename.
 
 → **Measured hash** covers the contents of the initrd.
 
-### PCR 12, `EV_EVENT_TAG`, "Ucode addons"
+### PCR 12, `EV_EVENT_TAG`, ucode addons
 
 Ucode addons are measured individually as a tagged event.
 
 → **Event Tag** `0xdac08e1a`
 
-→ **Description** the addon filename.
+→ **Description** is the addon filename.
 
 → **Measured hash** covers the contents of the ucode initrd.
 
-### PCR 12, `EV_IPL`, "Per-UKI Credentials initrd"
+### PCR 12, `EV_IPL`, per-uki credentials initrd
 
 → **Description** in the event log record is the constant string "Credentials
 initrd" in UTF-16.
@@ -148,7 +148,7 @@ initrd" in UTF-16.
 → **Measured hash** covers the per-UKI credentials cpio archive (which is generated
  on-the-fly by `systemd-stub`).
 
-### PCR 12, `EV_IPL`, "Global Credentials initrd"
+### PCR 12, `EV_IPL`, global credentials initrd
 
 → **Description** in the event log record is the constant string "Global
 credentials initrd" in UTF-16.
@@ -156,7 +156,7 @@ credentials initrd" in UTF-16.
 → **Measured hash** covers the global credentials cpio archive (which is generated
 on-the-fly by `systemd-stub`).
 
-### PCR 13, `EV_IPL`, "sysext initrd"
+### PCR 13, `EV_IPL`, sysext initrd
 
 → **Description** in the event log record is the constant string "System extension
 initrd" in UTF-16.
@@ -166,7 +166,7 @@ on-the-fly by `systemd-stub`).
 
 ## PCR Measurements Made by `systemd-pcrextend` (Userspace)
 
-### PCR 11, "Boot Phases"
+### PCR 11, boot phases
 
 The `systemd-pcrphase.service`, `systemd-pcrphase-initrd.service`,
 `systemd-pcrphase-sysinit.service` services will measure the boot phase reached
@@ -178,7 +178,7 @@ choose to define additional/different phases.)
 → **Measured hash** covers the phase string (in UTF-8, without trailing NUL
 bytes).
 
-### PCR 15, "Machine ID"
+### PCR 15, machine ID
 
 The `systemd-pcrmachine.service` service will measure the machine ID (as read
 from `/etc/machine-id`) during boot.
@@ -187,7 +187,7 @@ from `/etc/machine-id`) during boot.
 formatted in hexadecimal lowercase characters (in UTF-8, without trailing NUL
 bytes).
 
-### PCR 15, "File System"
+### PCR 15, file system
 
 The `systemd-pcrfs-root.service` and `systemd-pcrfs@.service` services will
 measure a string identifying a specific file system, typically covering the
@@ -200,7 +200,7 @@ without trailing NUL bytes).
 
 ## PCR Measurements Made by `systemd-cryptsetup` (Userspace)
 
-### PCR 15, "Volume Key"
+### PCR 15, volume key
 
 The `systemd-cryptsetup@.service` service will measure a key derived from the
 LUKS volume key of a specific encrypted volume, typically covering the backing

hwdb.d/20-OUI.hwdb

@@ -43040,6 +43040,9 @@ OUI:0C4314*
 OUI:0C43F9*
  ID_OUI_FROM_DATABASE=Amazon Technologies Inc.
 
+OUI:0C44C0*
+ ID_OUI_FROM_DATABASE=zte corporation
+
 OUI:0C45BA*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
@@ -43061,6 +43064,15 @@ OUI:0C47A94*
 OUI:0C47A97*
  ID_OUI_FROM_DATABASE=Annapurna labs
 
+OUI:0C47A9A*
+ ID_OUI_FROM_DATABASE=Lens Technology (Xiangtan) Co.,Ltd
+
+OUI:0C47A9B*
+ ID_OUI_FROM_DATABASE=Shenzhen Hebang Electronic Co., Ltd
+
+OUI:0C47A9C*
+ ID_OUI_FROM_DATABASE=Annapurna labs
+
 OUI:0C47A9D*
  ID_OUI_FROM_DATABASE=DIG_LINK
 
@@ -46658,6 +46670,9 @@ OUI:14E7C8*
 OUI:14E9B2*
  ID_OUI_FROM_DATABASE=Fiberhome Telecommunication Technologies Co.,LTD
 
+OUI:14EAA1*
+ ID_OUI_FROM_DATABASE=Micronet union Technology (chengdu) co., Ltd
+
 OUI:14EB08*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
@@ -48185,6 +48200,9 @@ OUI:1C08C1*
 OUI:1C0B52*
  ID_OUI_FROM_DATABASE=EPICOM S.A
 
+OUI:1C0B8B*
+ ID_OUI_FROM_DATABASE=Ubiquiti Inc
+
 OUI:1C0D7D*
  ID_OUI_FROM_DATABASE=Apple, Inc.
 
@@ -50186,6 +50204,9 @@ OUI:2050E7*
 OUI:205383*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
+OUI:20538D*
+ ID_OUI_FROM_DATABASE=Hon Hai Precision Industry Co., Ltd.
+
 OUI:2053CA*
  ID_OUI_FROM_DATABASE=Risk Technology Ltd
 
@@ -51474,7 +51495,7 @@ OUI:245DFCB*
  ID_OUI_FROM_DATABASE=ONLY
 
 OUI:245DFCC*
- ID_OUI_FROM_DATABASE=Senix Corporation
+ ID_OUI_FROM_DATABASE=Senix
 
 OUI:245DFCD*
  ID_OUI_FROM_DATABASE=Hunan Honestone lntelligence Technology Co.,Ltd
@@ -54347,6 +54368,9 @@ OUI:2C64F6*
 OUI:2C66AD*
  ID_OUI_FROM_DATABASE=NimbleTech Digital Inc.
 
+OUI:2C66F5*
+ ID_OUI_FROM_DATABASE=SHENZHEN ELECTRICAL APPLIANCES CO.
+
 OUI:2C6798*
  ID_OUI_FROM_DATABASE=InTalTech Ltd.
 
@@ -55022,6 +55046,9 @@ OUI:2CDDA3*
 OUI:2CDDE9*
  ID_OUI_FROM_DATABASE=Arista Networks
 
+OUI:2CDFE6*
+ ID_OUI_FROM_DATABASE=Raisecom Technology CO., LTD
+
 OUI:2CE032*
  ID_OUI_FROM_DATABASE=TCL King Electrical Appliances(Huizhou)Co.,Ltd
 
@@ -58142,6 +58169,9 @@ OUI:382187*
 OUI:3821C7*
  ID_OUI_FROM_DATABASE=Hewlett Packard Enterprise
 
+OUI:382228*
+ ID_OUI_FROM_DATABASE=Telink Micro LLC
+
 OUI:38229D*
  ID_OUI_FROM_DATABASE=ADB Broadband Italia
 
@@ -68906,6 +68936,9 @@ OUI:580A20*
 OUI:580AD4*
  ID_OUI_FROM_DATABASE=Apple, Inc.
 
+OUI:580D0D*
+ ID_OUI_FROM_DATABASE=GREE ELECTRIC APPLIANCES, INC. OF ZHUHAI
+
 OUI:581031*
  ID_OUI_FROM_DATABASE=Hon Hai Precision IND.CO.,LTD
 
@@ -69872,6 +69905,9 @@ OUI:58D50A*
 OUI:58D56E*
  ID_OUI_FROM_DATABASE=D-Link International
 
+OUI:58D61F*
+ ID_OUI_FROM_DATABASE=Ubiquiti Inc
+
 OUI:58D67A*
  ID_OUI_FROM_DATABASE=TCPlink
 
@@ -74780,6 +74816,9 @@ OUI:689423*
 OUI:68944A*
  ID_OUI_FROM_DATABASE=zte corporation
 
+OUI:689575*
+ ID_OUI_FROM_DATABASE=Zhejiang Bodyguard Electronic Co., Ltd
+
 OUI:68962E*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 
@@ -75857,6 +75896,9 @@ OUI:6C62FE*
 OUI:6C639C*
  ID_OUI_FROM_DATABASE=Commscope
 
+OUI:6C63F8*
+ ID_OUI_FROM_DATABASE=Ubiquiti Inc
+
 OUI:6C641A*
  ID_OUI_FROM_DATABASE=Penguin Computing
 
@@ -91961,6 +92003,9 @@ OUI:78257A*
 OUI:7825AD*
  ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
 
+OUI:7826A6*
+ ID_OUI_FROM_DATABASE=zte corporation
+
 OUI:7828CA*
  ID_OUI_FROM_DATABASE=Sonos, Inc.
 
@@ -99560,6 +99605,9 @@ OUI:8C1F6416E*
 OUI:8C1F64170*
  ID_OUI_FROM_DATABASE=Fracarro Radioindustrie Srl
 
+OUI:8C1F64175*
+ ID_OUI_FROM_DATABASE=Wuhan YiValley Opto-electric technology Co.,Ltd
+
 OUI:8C1F64177*
  ID_OUI_FROM_DATABASE=Emcom Systems
 
@@ -100382,6 +100430,9 @@ OUI:8C1F643B7*
 OUI:8C1F643B8*
  ID_OUI_FROM_DATABASE=HUBRIS TECHNOLOGIES PRIVATE LIMITED
 
+OUI:8C1F643BA*
+ ID_OUI_FROM_DATABASE=MITSUBISHI ELECTRIC INDIA PVT. LTD.
+
 OUI:8C1F643BB*
  ID_OUI_FROM_DATABASE=Clausal Computing Oy
 
@@ -101690,6 +101741,9 @@ OUI:8C1F6474B*
 OUI:8C1F6474E*
  ID_OUI_FROM_DATABASE=OpenPark Technologies Kft
 
+OUI:8C1F64751*
+ ID_OUI_FROM_DATABASE=CITSA Technologies Private Limited
+
 OUI:8C1F64755*
  ID_OUI_FROM_DATABASE=Flextronics International Kft
 
@@ -101711,6 +101765,9 @@ OUI:8C1F64760*
 OUI:8C1F64762*
  ID_OUI_FROM_DATABASE=Support Professionals B.V.
 
+OUI:8C1F64763*
+ ID_OUI_FROM_DATABASE=Anduril Imaging
+
 OUI:8C1F64764*
  ID_OUI_FROM_DATABASE=nanoTRONIX Computing Inc.
 
@@ -103556,6 +103613,9 @@ OUI:8C1F64C5D*
 OUI:8C1F64C5E*
  ID_OUI_FROM_DATABASE=YUYAMA MFG Co.,Ltd
 
+OUI:8C1F64C60*
+ ID_OUI_FROM_DATABASE=Intelligent Security Systems (ISS)
+
 OUI:8C1F64C61*
  ID_OUI_FROM_DATABASE=Beijing Ceresdate Technology Co.,LTD
 
@@ -104471,6 +104531,9 @@ OUI:8C1F64F13*
 OUI:8C1F64F14*
  ID_OUI_FROM_DATABASE=Elektrosil GmbH
 
+OUI:8C1F64F19*
+ ID_OUI_FROM_DATABASE=Hurry-tech
+
 OUI:8C1F64F1B*
  ID_OUI_FROM_DATABASE=Nextep Co.,Ltd.
 
@@ -112361,6 +112424,9 @@ OUI:A08966*
 OUI:A089E4*
  ID_OUI_FROM_DATABASE=Skyworth Digital Technology(Shenzhen) Co.,Ltd
 
+OUI:A08A06*
+ ID_OUI_FROM_DATABASE=ASKEY COMPUTER CORP
+
 OUI:A08A87*
  ID_OUI_FROM_DATABASE=HuiZhou KaiYue Electronic Co.,Ltd
 
@@ -114656,6 +114722,9 @@ OUI:A84041*
 OUI:A8407D*
  ID_OUI_FROM_DATABASE=GD Midea Air-Conditioning Equipment Co.,Ltd.
 
+OUI:A840F8*
+ ID_OUI_FROM_DATABASE=HUMAX NETWORKS
+
 OUI:A84122*
  ID_OUI_FROM_DATABASE=China Mobile (Hangzhou) Information Technology Co.,Ltd.
 
@@ -121592,6 +121661,9 @@ OUI:BCBD84*
 OUI:BCBD9E*
  ID_OUI_FROM_DATABASE=ITEL MOBILE LIMITED
 
+OUI:BCBEFB*
+ ID_OUI_FROM_DATABASE=ASL Xiamen Technology CO., LTD
+
 OUI:BCC00F*
  ID_OUI_FROM_DATABASE=Fiberhome Telecommunication Technologies Co.,LTD
 
@@ -126158,6 +126230,9 @@ OUI:C8FAE1*
 OUI:C8FB26*
  ID_OUI_FROM_DATABASE=Cisco SPVTG
 
+OUI:C8FB54*
+ ID_OUI_FROM_DATABASE=iMin Technology Pte. Ltd.
+
 OUI:C8FD19*
  ID_OUI_FROM_DATABASE=Texas Instruments
 
@@ -130412,6 +130487,9 @@ OUI:D4E32C*
 OUI:D4E33F*
  ID_OUI_FROM_DATABASE=Nokia
 
+OUI:D4E3C5*
+ ID_OUI_FROM_DATABASE=zte corporation
+
 OUI:D4E6B7*
  ID_OUI_FROM_DATABASE=Samsung Electronics Co.,Ltd
 
@@ -137237,6 +137315,9 @@ OUI:EC74BA*
 OUI:EC74D7*
  ID_OUI_FROM_DATABASE=Grandstream Networks Inc
 
+OUI:EC750C*
+ ID_OUI_FROM_DATABASE=TP-Link Systems Inc.
+
 OUI:EC753E*
  ID_OUI_FROM_DATABASE=HUAWEI TECHNOLOGIES CO.,LTD
 

hwdb.d/20-acpi-vendor.hwdb.patch

@@ -1,5 +1,5 @@
---- 20-acpi-vendor.hwdb.base	2024-11-01 10:15:52.858625476 +0100
-+++ 20-acpi-vendor.hwdb	2024-11-01 10:15:52.863625568 +0100
+--- 20-acpi-vendor.hwdb.base	2024-11-06 10:40:14.734611315 +0000
++++ 20-acpi-vendor.hwdb	2024-11-06 10:40:14.738611667 +0000
 @@ -3,6 +3,8 @@
  # Data imported from:
  #     https://uefi.org/uefi-pnp-export

hwdb.d/ma-medium.txt

@@ -13067,6 +13067,12 @@ D00000-DFFFFF     (base 16)		DIG_LINK
 				Uttar Pradesh    201301
 				IN
 
+0C-47-A9   (hex)		Lens Technology (Xiangtan) Co.,Ltd
+A00000-AFFFFF     (base 16)		Lens Technology (Xiangtan) Co.,Ltd
+				16 Baishi West Road, Xiangtan Economic and Technological Development Zone
+				Xiangtan  Hunan  411100
+				CN
+
 B8-4C-87   (hex)		Altronix , Corp
 A00000-AFFFFF     (base 16)		Altronix , Corp
 				140 58th St. Bldg A, Ste 2N
@@ -21617,12 +21623,6 @@ E8-6C-C7   (hex)		KLAB
 				Yuseong-gu  Daejeon  34014
 				KR
 
-24-5D-FC   (hex)		Senix Corporation
-C00000-CFFFFF     (base 16)		Senix Corporation
-				10516 Route 116, Suite 300
-				Hinesburg  VT  05461
-				US
-
 24-5D-FC   (hex)		Hunan Honestone lntelligence Technology Co.,Ltd
 D00000-DFFFFF     (base 16)		Hunan Honestone lntelligence Technology Co.,Ltd
 				705, Building 1, Fortune Plaza, Wankuntu, Xiangzhang Road, Yuhua District, Changsha City,
@@ -26450,6 +26450,12 @@ E00000-EFFFFF     (base 16)		JET OPTOELECTRONICS CO., LTD.
 				Mail box 15123  Haifa  3508409
 				IL
 
+24-5D-FC   (hex)		Senix 
+C00000-CFFFFF     (base 16)		Senix 
+				10516 Route 116, Suite 300
+				Hinesburg  VT  05461
+				US
+
 0C-47-A9   (hex)		Private
 400000-4FFFFF     (base 16)		Private
 
@@ -33193,3 +33199,15 @@ AC-EF-92   (hex)		LIFT CONTROLS PRIVATE LIMITED
 				Survey no 39/1, Murdi, Khandepar, Ponda
 				Ponda  Goa  403406
 				IN
+
+0C-47-A9   (hex)		Annapurna labs
+C00000-CFFFFF     (base 16)		Annapurna labs
+				Matam Scientific Industries Center,   Building 8.2
+				Mail box 15123  Haifa  3508409
+				IL
+
+0C-47-A9   (hex)		Shenzhen Hebang Electronic Co., Ltd
+B00000-BFFFFF     (base 16)		Shenzhen Hebang Electronic Co., Ltd
+				2nd Floor West, Bldg B, Kelunte Low Carbon Industry Park, Huarong Road, Dalang, Longhua District
+				Shenzhen    518000
+				CN

man/rules/meson.build

@@ -1069,6 +1069,7 @@ manpages = [
   'ENABLE_RFKILL'],
  ['systemd-run-generator', '8', [], ''],
  ['systemd-run', '1', [], ''],
+ ['systemd-sbsign', '1', [], ''],
  ['systemd-sleep.conf', '5', ['sleep.conf.d'], ''],
  ['systemd-socket-activate', '1', [], ''],
  ['systemd-socket-proxyd', '8', [], ''],

man/systemd-sbsign.xml

@@ -0,0 +1,111 @@
+<?xml version='1.0'?> <!--*-nxml-*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
+<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
+
+<refentry id="systemd-sbsign"
+    xmlns:xi="http://www.w3.org/2001/XInclude">
+  <refentryinfo>
+    <title>systemd-sbsign</title>
+    <productname>systemd</productname>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>systemd-sbsign</refentrytitle>
+    <manvolnum>1</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>systemd-sbsign</refname>
+    <refpurpose>Sign PE binaries for EFI Secure Boot</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <cmdsynopsis>
+      <command>systemd-sbsign</command>
+      <arg choice="opt" rep="repeat">OPTIONS</arg>
+      <arg choice="req">COMMAND</arg>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para><command>systemd-sbsign</command> can be used to sign PE binaries for EFI Secure Boot.</para>
+  </refsect1>
+
+  <refsect1>
+    <title>Commands</title>
+
+    <variablelist>
+      <varlistentry>
+        <term><option>sign</option></term>
+
+        <listitem><para>Signs the given PE binary for EFI Secure Boot. Takes a path to a PE binary as its
+        argument. If the PE binary already has a certificate table, the new signature will be added to it.
+        Otherwise a new certificate table will be created. The signed PE binary will be written to the path
+        specified with <option>--output=</option>.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>validate-key</option></term>
+
+        <listitem><para>Checks that we can load the private key specified with
+        <option>--private-key=</option>. </para>
+
+        <para>As a side effect, if the private key is loaded from a PIN-protected hardware token, this
+        command can be used to cache the PIN in the kernel keyring. The
+        <varname>$SYSTEMD_ASK_PASSWORD_KEYRING_TIMEOUT_SEC</varname> and
+        <varname>$SYSTEMD_ASK_PASSWORD_KEYRING_TYPE</varname> environment variables can be used to control
+        how long and in which kernel keyring the PIN is cached.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
+    <title>Options</title>
+    <para>The following options are understood:</para>
+
+    <variablelist>
+      <varlistentry>
+        <term><option>--output=<replaceable>PATH</replaceable></option></term>
+
+        <listitem><para>Specifies the path where to write the signed PE binary.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--private-key=<replaceable>PATH/URI</replaceable></option></term>
+        <term><option>--private-key-source=<replaceable>TYPE</replaceable>[:<replaceable>NAME</replaceable>]</option></term>
+        <term><option>--certificate=<replaceable>PATH</replaceable></option></term>
+
+        <listitem><para>Set the Secure Boot private key and certificate for use with the
+        <command>sign</command>. The <option>--certificate=</option> option takes a path to a PEM encoded
+        X.509 certificate. The <option>--private-key=</option> option can take a path or a URI that will be
+        passed to the OpenSSL engine or provider, as specified by <option>--private-key-source=</option> as a
+        <literal>type:name</literal> tuple, such as <literal>engine:pkcs11</literal>. The specified OpenSSL
+        signing engine or provider will be used to sign the PE binary.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
+      <xi:include href="standard-options.xml" xpointer="no-pager"/>
+      <xi:include href="standard-options.xml" xpointer="help"/>
+      <xi:include href="standard-options.xml" xpointer="version"/>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
+</refentry>

man/systemd-stub.xml

@@ -59,58 +59,66 @@
       <!-- Let's keep this in the canonical order we also measure the sections by, i.e. as in
            src/fundamental/uki.h's UnifiedSection enum -->
 
-      <listitem><para>A <literal>.linux</literal> section with the ELF Linux kernel
-      image. (Required)</para></listitem>
+      <listitem><para>A <literal>.linux</literal> section with the ELF Linux kernel image.
+      This section is required.</para></listitem>
 
-      <listitem><para>An <literal>.osrel</literal> section with OS release information, i.e. the contents of
-      the <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry> file
-      of the OS the kernel belongs to.</para></listitem>
+      <listitem><para>An optional <literal>.osrel</literal> section with OS release information, i.e. the
+      contents of the
+      <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry> file of
+      the OS the kernel belongs to.</para></listitem>
 
-      <listitem><para>A <literal>.cmdline</literal> section with the kernel command line to pass to the
-      invoked kernel.</para></listitem>
+      <listitem><para>An optional <literal>.cmdline</literal> section with the kernel command line to pass to
+      the invoked kernel.</para></listitem>
 
-      <listitem><para>An <literal>.initrd</literal> section with the initrd.</para></listitem>
+      <listitem><para>An optional <literal>.initrd</literal> section with the initrd.</para></listitem>
 
-      <listitem><para>A <literal>.ucode</literal> section with an initrd containing microcode, to be handed
-      to the kernel before any other initrd. This initrd must not be compressed.</para></listitem>
+      <listitem><para>An optional <literal>.ucode</literal> section with an initrd containing microcode, to
+      be handed to the kernel before any other initrd. This initrd must not be compressed.</para></listitem>
 
-      <listitem><para>A <literal>.splash</literal> section with an image (in the Windows
+      <listitem><para>An optional <literal>.splash</literal> section with an image (in the Windows
       <filename>.BMP</filename> format) to show on screen before invoking the kernel.</para></listitem>
 
-      <listitem><para>A <literal>.dtb</literal> section with a compiled binary DeviceTree.</para></listitem>
+      <listitem><para>An optional <literal>.dtb</literal> section with a compiled binary DeviceTree.
+      </para></listitem>
 
-      <listitem><para>Zero or more <literal>.dtbauto</literal> sections. Stub will always try to find first matching one.
-      Matching process extracts first <varname>compatible</varname> string from <literal>.dtbauto</literal>
-      section and compares it with the first Devicetree's <varname>compatible</varname> string supplied by
-      the firmware in configuration tables. If firmware does not provide Devicetree, matching with
-      <varname>.hwids</varname>  section will be used instead. Stub will use SMBIOS data to calculate hardware
-      IDs of the machine (as per <ulink url="https://learn.microsoft.com/en-us/windows-hardware/drivers/install/specifying-hardware-ids-for-a-computer">specification</ulink>),
-      then it will proceed to trying to find any of them in <literal>.hwids</literal> section and will use first
-      matching entry's <varname>compatible</varname>  as a search key among the <literal>.dtbauto</literal>
-      entries, in a similar fashion as the use of <varname>compatible</varname> string read from the firmware
-      provided Devicetree was described before. First matching <literal>.dtbauto</literal> section will be
+      <listitem><para>Zero or more <literal>.dtbauto</literal> sections. <filename>systemd-stub</filename>
+      will always use the first matching one. The match is performed by taking the first DeviceTree's
+      <varname>compatible</varname> string supplied by the firmware in configuration tables and comparing it
+      with the first <varname>compatible</varname> string from each of the <literal>.dtbauto</literal>
+      sections. If the firmware does not provide a DeviceTree, the match is done using the
+      <varname>.hwids</varname> section instead. After selecting a <literal>.hwids</literal> section (see the
+      description below), the <varname>compatible</varname> string from that section will be used to perform
+      the same matching procedure. If a match is found, that <literal>.dtbauto</literal> section will be
       loaded and will override <varname>.dtb</varname> if present.</para></listitem>
 
-      <listitem><para>A <literal>.hwids</literal> section with hardware IDs of the machines to match Devicetrees (refer to <literal>.dtbauto</literal> section description).</para></listitem>
+      <listitem><para>Zero or more <literal>.hwids</literal> sections with hardware IDs of the machines to
+      match DeviceTrees. <filename>systemd-stub</filename> will use the SMBIOS data to calculate hardware IDs
+      of the machine (as per <ulink
+      url="https://learn.microsoft.com/en-us/windows-hardware/drivers/install/specifying-hardware-ids-for-a-computer">specification</ulink>),
+      and then it will try to find any of them in each of the <literal>.hwids</literal> sections. The first
+      matching section will be used.</para></listitem>
 
-      <listitem><para>A <literal>.uname</literal> section with the kernel version information, i.e. the
-      output of <command>uname -r</command> for the kernel included in the <literal>.linux</literal>
+      <listitem><para>An optional <literal>.uname</literal> section with the kernel version information, i.e.
+      the output of <command>uname -r</command> for the kernel included in the <literal>.linux</literal>
       section.</para></listitem>
 
-      <listitem><para>An <literal>.sbat</literal> section with
-      <ulink url="https://github.com/rhboot/shim/blob/main/SBAT.md">SBAT</ulink> revocation
-      metadata.</para></listitem>
+      <listitem><para>An optional <literal>.sbat</literal> section with
+      <ulink url="https://github.com/rhboot/shim/blob/main/SBAT.md">SBAT</ulink> revocation metadata.
+      </para></listitem>
 
-      <listitem><para>A <literal>.pcrsig</literal> section with a set of cryptographic signatures for the
-      expected TPM2 PCR values after the kernel has been booted, in JSON format. This is useful for
+      <listitem><para>An optional <literal>.pcrsig</literal> section with a set of cryptographic signatures
+      for the expected TPM2 PCR values after the kernel has been booted, in JSON format. This is useful for
       implementing TPM2 policies that bind disk encryption and similar to kernels that are signed by a
       specific key.</para></listitem>
 
-      <listitem><para>A <literal>.pcrpkey</literal> section with a public key in the PEM format matching the
-      signature data in the <literal>.pcrsig</literal> section.</para></listitem>
+      <listitem><para>An optional <literal>.pcrpkey</literal> section with a public key in the PEM format
+      matching the signature data in the <literal>.pcrsig</literal> section.</para></listitem>
     </itemizedlist>
 
-    <para>In a basic UKI, the sections listed above appear at most once. In a multi-profile UKI,
+    <!-- FIXME: how does .dtauto/.hwids matching interact with profiles? -->
+
+    <para>In a basic UKI, the sections listed above appear at most once, with the exception of
+    <literal>.dtbauto</literal> and <literal>.hwids</literal> sections. In a multi-profile UKI,
     multiple sets of these sections are present in a single file and form "profiles",
     one of which can be selected at boot. For this, the PE section <literal>.profile</literal> is
     defined to be used as the separator between sets of sections. The
@@ -206,7 +214,7 @@
       <listitem><para>Similarly, files
       <filename><replaceable>foo</replaceable>.efi.extra.d/*.addon.efi</filename> are loaded and verified as
       PE binaries and specific sections are loaded from them. Addons are used to pass additional kernel
-      command line parameters (<literal>.cmdline</literal> section), or Devicetree blobs
+      command line parameters (<literal>.cmdline</literal> section), or DeviceTree blobs
       (<literal>.dtb</literal> section), additional initrds (<literal>.initrd</literal> section),
       and microcode updates (<literal>.ucode</literal> section). Addons allow those resources to be passed
       regardless of the kernel version being booted, for example allowing platform vendors to ship

man/systemd.net-naming-scheme.xml

@@ -123,7 +123,7 @@
 
                   <row>
                     <entry><replaceable>prefix</replaceable><constant>d</constant><replaceable>number</replaceable></entry>
-                    <entry>Devicetree alias index</entry>
+                    <entry>DeviceTree alias index</entry>
                   </row>
 
                 </tbody>

man/systemd.network.xml

@@ -1004,6 +1004,27 @@ DuplicateAddressDetection=none</programlisting></para>
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>MulticastIGMPVersion=</varname></term>
+        <listitem>
+          <para>Configures IPv4 Multicast IGMP Version to be used, and controls the value of
+          <filename>/proc/sys/net/ipv4/conf/<replaceable>INTERFACE</replaceable>/force_igmp_version</filename>.
+          Takes one of <literal>no</literal>,
+          <literal>v1</literal>, <literal>v2</literal>, or <literal>v3</literal>.
+          When <literal>no</literal>, no enforcement of an IGMP version will be applied, IGMPv1/v2 fallback are allowed, will back to
+          IGMPv3 mode again if all IGMPv1/v2 Querier Present timer expire.
+          When <literal>v1</literal>, use of IGMP version 1 will be enforced, and IGMPv1 report will be replied even if IGMPv2/v3
+          queries are received.
+          When <literal>v2</literal>, use of IGMP version 2 will be enforced, and IGMPv2 report will be replied if an IGMPv2/v3 query
+          is received, but fallback to IGMPv1 if an IGMPv1 query is received.
+          When <literal>v3</literal>, use of IGMP version 3 will be enforced, and the same reaction will be done as <literal>no</literal>.
+          Defaults to unset, and the sysctl value will be unchanged.
+          </para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>IPv4AcceptLocal=</varname></term>
         <listitem>

man/ukify.xml

@@ -100,10 +100,12 @@
       the n-th boot phase path set will be signed by the n-th key. This can be used to build different trust
       policies for different phases of the boot. In the config file, <varname>PCRPrivateKey=</varname>,
       <varname>PCRPublicKey=</varname>, and <varname>Phases=</varname> are grouped into separate sections,
-      describing separate boot phases. If <varname>SigningEngine=</varname>/<option>--signing-engine=</option>
-      is specified, then the private keys arguments will be passed verbatim to OpenSSL as URIs, and the public
-      key arguments will be loaded as X.509 certificates, so that signing can be performed with an OpenSSL
-      engine.</para>
+      describing separate boot phases. If one of
+      <varname>SigningEngine=</varname>/<option>--signing-engine=</option> or
+      <varname>SigningProvider=</varname>/<option>--signing-provider=</option> is specified, then the private
+      key arguments will be passed verbatim to OpenSSL as URIs, and the public key arguments will be loaded
+      as X.509 certificates, so that signing can be performed with an OpenSSL engine or provider
+      respectively.</para>
 
       <para>If a SecureBoot signing key is provided via the
       <varname>SecureBootPrivateKey=</varname>/<option>--secureboot-private-key=</option> option, the resulting
@@ -440,9 +442,9 @@
           <term><varname>SecureBootSigningTool=<replaceable>SIGNER</replaceable></varname></term>
           <term><option>--signtool=<replaceable>SIGNER</replaceable></option></term>
 
-          <listitem><para>Whether to use <literal>sbsign</literal> or <literal>pesign</literal>.
-          Depending on this choice, different parameters are required in order to sign an image.
-          Defaults to <literal>sbsign</literal>.</para>
+          <listitem><para>Whether to use <literal>sbsign</literal>, <literal>pesign</literal>, or
+          <literal>systemd-sbsign</literal>. Depending on this choice, different parameters are required in
+          order to sign an image. Defaults to <literal>sbsign</literal>.</para>
 
           <xi:include href="version-info.xml" xpointer="v254"/></listitem>
         </varlistentry>
@@ -452,8 +454,9 @@
           <term><option>--secureboot-private-key=<replaceable>SB_KEY</replaceable></option></term>
 
           <listitem><para>A path to a private key to use for signing of the resulting binary. If the
-          <varname>SigningEngine=</varname>/<option>--signing-engine=</option> option is used, this may also be
-          an engine-specific designation. This option is required by
+          <varname>SigningEngine=</varname>/<option>--signing-engine=</option> or
+          <varname>SigningProvider=</varname>/<option>--signing-provider=</option> option is used, this may
+          also be an engine or provider specific designation. This option is required by
           <varname>SecureBootSigningTool=sbsign</varname>/<option>--signtool=sbsign</option>. </para>
 
           <xi:include href="version-info.xml" xpointer="v253"/></listitem>
@@ -464,8 +467,9 @@
           <term><option>--secureboot-certificate=<replaceable>SB_CERT</replaceable></option></term>
 
           <listitem><para>A path to a certificate to use for signing of the resulting binary. If the
-          <varname>SigningEngine=</varname>/<option>--signing-engine=</option> option is used, this may also
-          be an engine-specific designation. This option is required by
+          <varname>SigningEngine=</varname>/<option>--signing-engine=</option> or
+          <varname>SigningProvider=</varname>/<option>--signing-provider=</option> option is used, this may
+          also be an engine or provider specific designation. This option is required by
           <varname>SecureBootSigningTool=sbsign</varname>/<option>--signtool=sbsign</option>. </para>
 
           <xi:include href="version-info.xml" xpointer="v253"/></listitem>
@@ -506,14 +510,23 @@
           <term><varname>SigningEngine=<replaceable>ENGINE</replaceable></varname></term>
           <term><option>--signing-engine=<replaceable>ENGINE</replaceable></option></term>
 
-          <listitem><para>An "engine" for signing of the resulting binary. This option is currently passed
-          verbatim to the <option>--engine=</option> option of
-          <citerefentry project='archlinux'><refentrytitle>sbsign</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
+          <listitem><para>An OpenSSL engine to be used for signing the resulting binary and PCR measurements.
           </para>
 
           <xi:include href="version-info.xml" xpointer="v253"/></listitem>
         </varlistentry>
 
+        <varlistentry>
+          <term><varname>SigningProvider=<replaceable>PROVIDER</replaceable></varname></term>
+          <term><option>--signing-provider=<replaceable>PROVIDER</replaceable></option></term>
+
+          <listitem><para>An OpenSSL provider to be used for signing the resulting binary and PCR
+          measurements. This option can only be used when using <command>systemd-sbsign</command> as the
+          signing tool.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+        </varlistentry>
+
         <varlistentry>
           <term><varname>SignKernel=<replaceable>BOOL</replaceable></varname></term>
           <term><option>--sign-kernel</option></term>

meson.build

@@ -20,8 +20,8 @@ else
         project_minor_version = '0'
 endif
 
-libsystemd_version = '0.39.0'
-libudev_version = '1.7.9'
+libsystemd_version = '0.40.0'
+libudev_version = '1.7.10'
 
 conf = configuration_data()
 conf.set_quoted('PROJECT_URL', 'https://systemd.io/')

meson.version

@@ -1 +1 @@
-257~devel
+257~rc1

mkosi.conf.d/05-tools/mkosi.conf

@@ -2,7 +2,9 @@
 
 [Build]
 ToolsTreePackages=
-        meson
         gcc
         gperf
+        meson
+        mypy
         pkgconf
+        ruff

po/be.po

@@ -9,7 +9,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2023-05-13 19:20+0000\n"
 "Last-Translator: Maksim Kliazovich <maxklezovich@gmail.com>\n"
 "Language-Team: Belarusian <https://translate.fedoraproject.org/projects/"
@@ -116,28 +116,38 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Для абнаўлення хатняй прасторы патрабуецца аўтэнтыфікацыя."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Абнавіць хатнюю прастору"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Для абнаўлення хатняй прасторы патрабуецца аўтэнтыфікацыя."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Змяніць памер хатняй прасторы"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "Для змены памеру хатняй прасторы патрабуецца аўтэнтыфікацыя."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Змяніць пароль для хатняй прасторы"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "Для змены пароля для хатняй прасторы патрабуецца аўтэнтыфікацыя."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "Стварыць хатнюю прастору"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Для стварэння хатняй прасторы патрабуецца аўтэнтыфікацыя."
@@ -1185,6 +1195,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Для наладкі сістэмнага часу патрабуецца аўтэнтыфікацыя."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Для кіравання актыўнымі сеансамі, карыстальнікамі і працоўнымі месцамі "
+"патрабуецца аўтэнтыфікацыя."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Наладзіць сістэмны час"
@@ -1223,23 +1244,23 @@ msgstr ""
 "Для ўключэння або выключэння сінхранізацыі часу па сетцы патрабуецца "
 "аўтэнтыфікацыя."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Для запуску \"$(unit)\" патрабуецца аўтэнтыфікацыя."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Для спынення \"$(unit)\" патрабуецца аўтэнтыфікацыя."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Для перачытання стану \"$(unit)\" патрабуецца аўтэнтыфікацыя."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Для перазапуску \"$(unit)\" патрабуецца аўтэнтыфікацыя."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1247,17 +1268,17 @@ msgstr ""
 "Для адпраўкі сігналу UNIX працэсам адзінкі \"$(unit)\" патрабуецца "
 "аўтэнтыфікацыя."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Для таго, каб скінуць стан \"failed\" у \"$(unit)\", патрабуецца "
 "аўтэнтыфікацыя."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Для змены ўласцівасцей \"$(unit)\" патрабуецца аўтэнтыфікацыя."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1265,7 +1286,7 @@ msgstr ""
 "Для выдалення файлаў і каталогаў, якія звязаныя з \"$(unit)\", патрабуецца "
 "аўтэнтыфікацыя."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/be@latin.po

@@ -7,7 +7,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2016-06-09 19:50+0300\n"
 "Last-Translator: Viktar Vaŭčkievič <victorenator@gmail.com>\n"
 "Language-Team: \n"
@@ -119,20 +119,30 @@ msgstr ""
 "Nieabchodna aŭtentyfikacyja dlia dalučennia prylad da pracoŭnych miescaŭ."
 
 #: src/home/org.freedesktop.home1.policy:53
-msgid "Resize a home area"
+msgid "Update your home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:54
 #, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr ""
+"Nieabchodna aŭtentyfikacyja dlia dalučennia prylad da pracoŭnych miescaŭ."
+
+#: src/home/org.freedesktop.home1.policy:63
+msgid "Resize a home area"
+msgstr ""
+
+#: src/home/org.freedesktop.home1.policy:64
+#, fuzzy
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Nieabchodna aŭtentyfikacyja dlia ŭstaliavannia ŭsieahuĺnaha paviedamliennia"
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 #, fuzzy
 msgid ""
 "Authentication is required to change the password of a user's home area."
@@ -140,11 +150,11 @@ msgstr ""
 "Nieabchodna aŭtentyfikacyja dlia kiravannia aktyŭnymi siesijami, "
 "karystaĺnikami i miescami."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Nieabchodna aŭtentyfikacyja dlia pieračytannia stanu systemd."
@@ -1231,6 +1241,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Nieabchodna aŭtentyfikacyja dlia ŭstaliavannia sistemnaha času."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Nieabchodna aŭtentyfikacyja dlia kiravannia aktyŭnymi siesijami, "
+"karystaĺnikami i miescami."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Ustaliavać sistemny čas"
@@ -1272,23 +1293,23 @@ msgstr ""
 "Nieabchodna aŭtentyfikacyja dlia ŭkliučennia abo vykliučennia sinchranizacyi "
 "času pa sietcy."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Nieabchodna aŭtentyfikacyja dlia zapusku '$(unit)'."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Nieabchodna aŭtentyfikacyja dlia spyniennia '$(unit)'."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Nieabchodna aŭtentyfikacyja dlia pieračytannia stanu '$(unit)'."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Nieabchodna aŭtentyfikacyja dlia pierazapusku '$(unit)'."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 #, fuzzy
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
@@ -1296,17 +1317,17 @@ msgid ""
 msgstr ""
 "Nieabchodna aŭtentyfikacyja dlia ŭstaliavannia ŭlascivasciej '$(unit)'."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Nieabchodna aŭtentyfikacyja dlia anuliavannia pamylkovaha stanu '$(unit)'."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 "Nieabchodna aŭtentyfikacyja dlia ŭstaliavannia ŭlascivasciej '$(unit)'."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 #, fuzzy
 msgid ""
 "Authentication is required to delete files and directories associated with "
@@ -1314,7 +1335,7 @@ msgid ""
 msgstr ""
 "Nieabchodna aŭtentyfikacyja dlia anuliavannia pamylkovaha stanu '$(unit)'."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 #, fuzzy
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."

po/bg.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: systemd master\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2023-03-17 15:20+0000\n"
 "Last-Translator: Velislav Ivanov <velislav.bg@gmail.com>\n"
 "Language-Team: Bulgarian <https://translate.fedoraproject.org/projects/"
@@ -116,29 +116,39 @@ msgid "Authentication is required to update a user's home area."
 msgstr "За обновяване на място за потребител е необходима идентификация."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Обновяване на място за потребител"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "За обновяване на място за потребител е необходима идентификация."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Преоразмеряване на място за потребител"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "За преоразмеряване на място за потребител е необходима идентификация."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Промяна на парола на място за потребител"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "За промяна на парола на място за потребител е необходима идентификация."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "Създаване на място за потребител"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "За създаване на място за потребител е необходима идентификация."
@@ -1207,6 +1217,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "За задаване на времето на системата е необходима идентификация."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"За управление на работещите сесии, потребители и работни места е необходима "
+"идентификация."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Задаване на времето на системата"
@@ -1247,23 +1268,23 @@ msgstr ""
 "За превключване на синхронизацията на времето по мрежата е необходима "
 "идентификация."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "За стартиране на „$(unit)“ е необходима идентификация."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "За спиране на „$(unit)“ е необходима идентификация."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "За презареждане на „$(unit)“ е необходима идентификация."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "За рестартиране на „$(unit)“ е необходима идентификация."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1271,17 +1292,17 @@ msgstr ""
 "За изпращането на сигнал на UNIX на процесите на „$(unit)“ е необходима "
 "идентификация."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "За премахване на състоянието за неуспех на „$(unit)“ е необходима "
 "идентификация."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "За задаване на свойствата на „$(unit)“ е необходима идентификация."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1289,7 +1310,7 @@ msgstr ""
 "За изтриването на файловете и директориите на „$(unit)“ е необходима "
 "идентификация."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/ca.po

@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2018-02-27 04:18-0500\n"
 "Last-Translator: Robert Antoni Buj Gelonch <rbuj@fedoraproject.org>\n"
 "Language-Team: Català <ubuntu-l10n-ca@lists.ubuntu.com>\n"
@@ -120,31 +120,41 @@ msgstr ""
 "Es requereix autenticació per annexar un dispositiu a un lloc de treball."
 
 #: src/home/org.freedesktop.home1.policy:53
-msgid "Resize a home area"
+msgid "Update your home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:54
 #, fuzzy
-msgid "Authentication is required to resize a user's home area."
-msgstr "Es requereix autenticació per establir un missatge de mur"
+msgid "Authentication is required to update your home area."
+msgstr ""
+"Es requereix autenticació per annexar un dispositiu a un lloc de treball."
 
 #: src/home/org.freedesktop.home1.policy:63
-msgid "Change password of a home area"
+msgid "Resize a home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:64
 #, fuzzy
+msgid "Authentication is required to resize a user's home area."
+msgstr "Es requereix autenticació per establir un missatge de mur"
+
+#: src/home/org.freedesktop.home1.policy:73
+msgid "Change password of a home area"
+msgstr ""
+
+#: src/home/org.freedesktop.home1.policy:74
+#, fuzzy
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Es requereix autenticació per gestionar les sessions, usuaris i llocs de "
 "treball actius."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Es requereix autenticació per tornar a carregar l'estat de systemd."
@@ -1236,6 +1246,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Es requereix autenticació per establir l'hora del sistema."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Es requereix autenticació per gestionar les sessions, usuaris i llocs de "
+"treball actius."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Estableix l'hora del sistema"
@@ -1276,45 +1297,45 @@ msgstr ""
 "Es requereix autenticació per controlar si s'ha d'activar la sincronització "
 "de l'hora de xarxa."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Es requereix autenticació per iniciar «$(unit)»."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Es requereix autenticació per aturar «$(unit)»."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Es requereix autenticació per tornar a carregar «$(unit)»."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Es requereix autenticació per reiniciar «$(unit)»."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 #, fuzzy
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr "Es requereix autenticació per establir les propietats a «$(unit)»."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr "Es requereix autenticació per restablir l'estat «failed» de «$(unit)»."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Es requereix autenticació per establir les propietats a «$(unit)»."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 #, fuzzy
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr "Es requereix autenticació per restablir l'estat «failed» de «$(unit)»."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 #, fuzzy
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."

po/cs.po

@@ -7,7 +7,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-10-28 15:47+0000\n"
 "Last-Translator: Pavel Borecki <pavel.borecki@gmail.com>\n"
 "Language-Team: Czech <https://translate.fedoraproject.org/projects/systemd/"
@@ -114,28 +114,38 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Pro aktualizaci domovského adresáře uživatele je vyžadováno ověření."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Aktualizovat domovský adresář"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Pro aktualizaci domovského adresáře uživatele je vyžadováno ověření."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Změnit velikost domovského adresáře"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Pro změnu velikosti domovského adresáře uživatele je vyžadováno ověření."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Změnit heslo domovského adresáře"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "Pro změnu hesla domovského adresáře uživatele je vyžadováno ověření."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "Aktivovat domovskou složku"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Pro vytvoření domovského adresáře uživatele je vyžadováno ověření."
@@ -1171,6 +1181,16 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Pro nastavení systémového času je vyžadováno ověření."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Pro správu aktivních sezení, uživatelů a stanovišť je vyžadováno ověření."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Nastavit systémový čas"
@@ -1209,37 +1229,37 @@ msgid ""
 "shall be enabled."
 msgstr "Pro kontrolu synchronizace času ze sítě je vyžadováno ověření."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Pro spuštění „$(unit)” je vyžadováno ověření."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Pro vypnutí „$(unit)” je vyžadováno ověření."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Pro opětovné načtení „$(unit)” je vyžadováno ověření."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Pro restart „$(unit)” je vyžadováno ověření."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr "Pro odeslání UNIX signálu procesům „$(unit)” je vyžadováno ověření."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr "Pro resetování chybného stavu „$(unit)” je vyžadováno ověření."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Pro nastavení vlastností na „$(unit)” je vyžadováno ověření."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1247,7 +1267,7 @@ msgstr ""
 "Pro odstranění souborů nebo adresářů souvisejících s „$(unit)” je vyžadováno "
 "ověření."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/da.po

@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2021-06-02 16:03+0000\n"
 "Last-Translator: scootergrisen <scootergrisen@gmail.com>\n"
 "Language-Team: Danish <https://translate.fedoraproject.org/projects/systemd/"
@@ -113,32 +113,43 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Der kræves godkendelse for at opdatere en brugers hjemmeområde."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Opdater et hjemmeområde"
+
+# https://www.freedesktop.org/software/systemd/man/sd-login.html
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Der kræves godkendelse for at opdatere en brugers hjemmeområde."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Tilpas størrelsen på et hjemmeområde"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Der kræves godkendelse for at tilpasse størrelsen på en brugers hjemmeområde."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Skift adgangskode for et hjemmeområde"
 
 # https://www.freedesktop.org/software/systemd/man/sd-login.html
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Der kræves godkendelse for at skifte adgangskoden for en brugers "
 "hjemmeområde."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "Opret et hjemmeområde"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Der kræves godkendelse for at oprette en brugers hjemmeområde."
@@ -1178,6 +1189,18 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Der kræves godkendelse for at indstille tiden for systemet."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+# https://www.freedesktop.org/software/systemd/man/sd-login.html
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Der kræves godkendelse for at håndtere aktive sessioner, brugere og "
+"arbejdsstationer."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Indstil tiden for systemet"
@@ -1218,45 +1241,45 @@ msgstr ""
 "Der kræves godkendelse for at kontrollere hvorvidt synkronisering af "
 "netværkstid skal aktiveres."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Der kræves godkendelse for at starte '$(unit)'."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Der kræves godkendelse for at stoppe '$(unit)'."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Der kræves godkendelse for at genindlæse '$(unit)'."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Der kræves godkendelse for at genstarte '$(unit)'."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr "Der kræves godkendelse for at indstille egenskaber på '$(unit)'."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Der kræves godkendelse for at nulstille \"fejl\"-tilstanden på '$(unit)'."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Der kræves godkendelse for at indstille egenskaber på '$(unit)'."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr ""
 "Der kræves godkendelse for at nulstille \"fejl\"-tilstanden på '$(unit)'."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/de.po

@@ -13,7 +13,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-11-05 13:46+0000\n"
 "Last-Translator: Weblate Translation Memory <noreply-mt-weblate-translation-"
 "memory@weblate.org>\n"
@@ -131,33 +131,46 @@ msgstr ""
 "Benutzers notwendig."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Einen persönlichen Bereich aktualisieren"
+
+# https://www.freedesktop.org/software/systemd/man/sd-login.html
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr ""
+"Legitimierung ist zum Aktualisieren des persönlichen Bereichs eines "
+"Benutzers notwendig."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Größe eines persönlichen Bereichs ändern"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Legitimierung ist für die Größenänderung des persönlichen Bereichs eines "
 "Benutzers notwendig."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Passwort eines persönlichen Bereichs ändern"
 
 # https://www.freedesktop.org/software/systemd/man/sd-login.html
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Legitimierung ist zum Ändern des Passworts eines persönlichen Bereichs eines "
 "Benutzers notwendig."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "Einen persönlichen Bereich anlegen"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr ""
@@ -1253,6 +1266,18 @@ msgstr "Alte Systemaktualisierungen bereinigen"
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Legitimierung ist zum Festlegen der Systemzeit notwendig."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+# https://www.freedesktop.org/software/systemd/man/sd-login.html
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Legitimierung ist zur Verwaltung aktiver Sitzungen, Benutzern und "
+"Arbeitsstationen notwendig."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Die Systemzeit festlegen"
@@ -1293,23 +1318,23 @@ msgstr ""
 "Legitimierung ist zum Festlegen, ob Netzwerkzeitabgeich eingeschaltet sein "
 "soll, erforderlich."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Legitimierung ist zum Starten von »$(unit)« notwendig."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Legitimierung ist zum Stoppen von »$(unit)« notwendig."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Legitimierung ist zum erneuten Laden von »$(unit)« notwendig."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Legitimierung ist zum Neustarten von »$(unit)« notwendig."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1317,18 +1342,18 @@ msgstr ""
 "Legitimierung ist zum Senden eines UNIX-Signals an die Prozesse von "
 "»$(unit)« notwendig."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Legitimierung ist zum Zurücksetzen des Status »fehlgeschlagen« von »$(unit)« "
 "notwendig"
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 "Legitimierung ist zum Festlegen der Eigenschaften von »$(unit)« notwendig."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1336,7 +1361,7 @@ msgstr ""
 "Legitimierung ist zum Löschen von Dateien und Verzeichnissen, die zu "
 "»$(unit)« gehören, erforderlich."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/el.po

@@ -7,7 +7,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-08-04 03:41+0000\n"
 "Last-Translator: Dimitrys Meliates <demetresmeliates+fedora@gmail.com>\n"
 "Language-Team: Greek <https://translate.fedoraproject.org/projects/systemd/"
@@ -118,31 +118,41 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Απαιτείται ταυτοποίηση για την ενημέρωση αρχικής περιοχής ενός χρήστη."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Ενημέρωση αρχικής περιοχής"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Απαιτείται ταυτοποίηση για την ενημέρωση αρχικής περιοχής ενός χρήστη."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Αλλαγή μεγέθους αρχικής περιοχής"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Απαιτείται ταυτοποίηση για την αλλαγή του μεγέθους αρχικής περιοχής ενός "
 "χρήστη."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 #, fuzzy
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Απαιτείται πιστοποίηση για προσάρτηση μιας συσκευής σε έναν σταθμό εργασίας."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Απαιτείται πιστοποίηση για να ορίσετε την ώρα του συστήματος."
@@ -1222,6 +1232,16 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Απαιτείται πιστοποίηση για να ορίσετε την ώρα του συστήματος."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Απαιτείται πιστοποίηση για προσάρτηση μιας συσκευής σε έναν σταθμό εργασίας."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Ορισμός ώρας συστήματος"
@@ -1262,51 +1282,51 @@ msgstr ""
 "Απαιτείται πιστοποίηση για να ελέγξετε αν ο συγχρονισμός ώρας δικτύου θα "
 "ενεργοποιηθεί."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 #, fuzzy
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Απαιτείται πιστοποίηση για να ορίσετε την ώρα του συστήματος."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 #, fuzzy
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Απαιτείται πιστοποίηση για να ορίσετε την ώρα του συστήματος."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 #, fuzzy
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Απαιτείται πιστοποίηση για να ορίσετε την ώρα του συστήματος."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 #, fuzzy
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Απαιτείται πιστοποίηση για να ορίσετε την ώρα του συστήματος."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 #, fuzzy
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr "Απαιτείται πιστοποίηση για να ορίσετε την ώρα του συστήματος."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 #, fuzzy
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr "Απαιτείται πιστοποίηση για να ορίσετε τοπικά όνομα οικοδεσπότη."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 #, fuzzy
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Απαιτείται πιστοποίηση για να ορίσετε την ώρα του συστήματος."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 #, fuzzy
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr "Απαιτείται πιστοποίηση για να ορίσετε τοπικά όνομα οικοδεσπότη."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 #, fuzzy
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."

po/es.po

@@ -9,7 +9,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2021-08-26 18:05+0000\n"
 "Last-Translator: Adolfo Jayme Barrientos <fitoschido@gmail.com>\n"
 "Language-Team: Spanish <https://translate.fedoraproject.org/projects/systemd/"
@@ -118,31 +118,42 @@ msgstr ""
 "Necesita autenticarse para actualizar el espacio personal de un usuario."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Actualizar un espacio personal"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr ""
+"Necesita autenticarse para actualizar el espacio personal de un usuario."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Redimensionar un espacio personal"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Necesita autenticarse para redimensionar el espacio personal de un usuario."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Cambiar contraseña de un espacio personal"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Necesita autenticarse para cambiar la contraseña del espacio personal de un "
 "usuario."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "Crear un área home"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Se requiere autenticación para crear un área home de usuario."
@@ -1215,6 +1226,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Necesita autenticarse para establecer la fecha y hora del sistema."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Necesita autenticarse para administrar las sesiones activas, usuarios y "
+"puestos de trabajo."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Establecer fecha y hora del sistema"
@@ -1255,23 +1277,23 @@ msgstr ""
 "Necesita autenticarse para activar/desactivar la sincronización de hora por "
 "red."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Necesita autenticarse para iniciar «$(unit)»."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Necesita autenticarse para detener «$(unit)»."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Necesita autenticarse para recargar «$(unit)»."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Necesita autenticarse para reiniciar «$(unit)»."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 #, fuzzy
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
@@ -1279,16 +1301,16 @@ msgid ""
 msgstr ""
 "Se requiere autenticación para establecer las propiedades de '$(unit)'."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Necesita autenticarse para reiniciar el estado de «fallido» de «$(unit)»."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Necesita autenticarse para establecer las propiedades de «$(unit)»."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 #, fuzzy
 msgid ""
 "Authentication is required to delete files and directories associated with "
@@ -1296,7 +1318,7 @@ msgid ""
 msgstr ""
 "Se requiere autenticación para reiniciar el estado de «fallido» de '$(unit)'."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 #, fuzzy
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."

po/et.po

@@ -4,7 +4,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2022-10-24 15:23+0000\n"
 "Last-Translator: H A <contact+fedora@hen.ee>\n"
 "Language-Team: Estonian <https://translate.fedoraproject.org/projects/"
@@ -106,28 +106,38 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Autentmine on vajalik, et uuendada kasutaja koduala."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Uuenda koduala"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Autentmine on vajalik, et uuendada kasutaja koduala."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Muuda koduala suurust"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "Autentmine on vajalik, et muuta kasutaja koduala suurust."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Muuda koduala parooli"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "Autentimine on vajalik, et muuta kasutaja koduala parooli."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "Loo koduala"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Autentimine on vajalik, et luua kasutaja koduala."
@@ -1114,6 +1124,16 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Autentimine on vajalik, et määrata süsteemi aega."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Autentimine on vajalik, et hallata aktiivseid seansse, kasutajaid ning kohti."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Määra süsteemi aeg"
@@ -1153,45 +1173,45 @@ msgstr ""
 "Autentimine on vajalik, et kontrollida kas võrgu ajasünkroneerimine peaks "
 "olema lubatud."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Autentimine on vajalik, et käivitada '$(unit)'."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Autentimine on vajalik, et peatada '$(unit)'."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Autentimine on vajalik, et laadida '$(unit)' uuesti."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Autentimine on vajalik, et restartida '$(unit)'."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr ""
 "Autentimine on vajalik, et saata UNIX signaali '$(unit)' protsessidele."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Autentimine on vajalik, et lähtestada '$(unit)' \"ebaõnnestunud\" olekut."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Autentimine on vajalik, et määrata '$(unit)' omadusi."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr "Autentimine on vajalik, et kustutada '$(unit)' faile ja kauste."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/eu.po

@@ -5,7 +5,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: systemd\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2023-06-03 15:48+0000\n"
 "Last-Translator: Asier Sarasua Garmendia <asier.sarasua@gmail.com>\n"
 "Language-Team: Basque <https://translate.fedoraproject.org/projects/systemd/"
@@ -113,27 +113,36 @@ msgid "Authentication is required to update a user's home area."
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:53
-msgid "Resize a home area"
+msgid "Update your home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:54
-msgid "Authentication is required to resize a user's home area."
-msgstr ""
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Autentifikazioa behar da sistemaren eskualde-ezarpenak ezartzeko."
 
 #: src/home/org.freedesktop.home1.policy:63
-msgid "Change password of a home area"
+msgid "Resize a home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:64
+msgid "Authentication is required to resize a user's home area."
+msgstr ""
+
+#: src/home/org.freedesktop.home1.policy:73
+msgid "Change password of a home area"
+msgstr ""
+
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Autentifikazioa behar da sistemaren eskualde-ezarpenak ezartzeko."
@@ -1094,6 +1103,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Autentifikazioa behar da systemd egoera birkargatzeko."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Autentifikazioa behar da sistema-zerbitzua edo unitate-fitxategiak "
+"kudeatzeko."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr ""
@@ -1130,43 +1150,43 @@ msgid ""
 "shall be enabled."
 msgstr ""
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/fi.po

@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-09-12 13:43+0000\n"
 "Last-Translator: Ricky Tigg <ricky.tigg@gmail.com>\n"
 "Language-Team: Finnish <https://translate.fedoraproject.org/projects/systemd/"
@@ -112,27 +112,37 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Todennus vaaditaan käyttäjän kotialueen päivittämiseksi."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Päivitä kotialue"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Todennus vaaditaan käyttäjän kotialueen päivittämiseksi."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Muuta kotialueen kokoa"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "Todennus vaaditaan käyttäjän kotialueen koon muuttamiseksi."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Muuta kotialueen salasana"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "Todennus vaaditaan käyttäjän kotialueen salasanan vaihtamiseksi."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "Aktivoi kotialue"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr "Todennus vaaditaan käyttäjän kotialueen aktivoimiseksi."
 
@@ -392,7 +402,8 @@ msgstr "Peruuta levykuvan siirto"
 #: src/import/org.freedesktop.import1.policy:53
 msgid ""
 "Authentication is required to cancel the ongoing transfer of a disk image."
-msgstr "Todennus vaaditaan meneillään olevan levykuvan siirron peruuttamiseksi."
+msgstr ""
+"Todennus vaaditaan meneillään olevan levykuvan siirron peruuttamiseksi."
 
 #: src/locale/org.freedesktop.locale1.policy:22
 msgid "Set system locale"
@@ -1161,6 +1172,17 @@ msgstr "Puhdista vanhat järjestelmäpäivitykset"
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Todennus vaaditaan vanhojen järjestelmäpäivitysten puhdistamiseen."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Todennus vaaditaan aktiivisten istuntojen, käyttäjien ja paikkojen "
+"hallintaan."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Aseta järjestelmän aika"
@@ -1202,38 +1224,38 @@ msgstr ""
 "Todennus vaaditaan sen hallitsemiseksi, onko verkkoajan synkronointi "
 "käytössä."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Todennus vaaditaan $(unit):n aloittamiseksi."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Todennus vaaditaan $(unit):n lopettamiseksi."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Todennus vaaditaan $(unit):n uudelleen lataamiseksi."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Todennus vaaditaan $(unit):n uudelleen käynnistämiseksi."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr ""
 "Todennus vaaditaan UNIX-signaalin lähettämiseen '$(unit)'-prosesseihin."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr "Todennus vaaditaan \"epäonnistuneen\" tilan \"$(unit)\" nollaamiseksi."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Todennus vaaditaan, jotta ominaisuudet asetetaan arvoon '$(unit)'."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1241,7 +1263,7 @@ msgstr ""
 "Todennus vaaditaan tiedostojen ja hakemistojen poistamiseen, jotka liittyvät "
 "'$(unit)':iin."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/fr.po

@@ -11,7 +11,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-11-06 12:46+0000\n"
 "Last-Translator: Léane GRASSER <leane.grasser@proton.me>\n"
 "Language-Team: French <https://translate.fedoraproject.org/projects/systemd/"
@@ -128,31 +128,43 @@ msgstr ""
 "utilisateur."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Mettre à jour un espace personnel"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr ""
+"Une authentification est requise pour mettre à jour l'espace personnel d'un "
+"utilisateur."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Redimensionner un espace personnel"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Une authentification est requise pour redimensionner l'espace personnel d'un "
 "utilisateur."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Changer le mot de passe d'un espace personnel"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Une authentification est requise pour changer le mot de passe de l'espace "
 "personnel d'un utilisateur."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "Activer un espace personnel"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr ""
 "Une authentification est requise pour activer l'espace personnel d'un "
@@ -1247,6 +1259,17 @@ msgstr ""
 "Une authentification est requise pour nettoyer les anciennes mises à jour du "
 "système."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Une authentification est requise pour gérer les sessions actives, les "
+"utilisateurs et les postes (seats)."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Définir l'heure du système"
@@ -1288,23 +1311,23 @@ msgstr ""
 "Une authentification est requise pour activer ou désactiver la "
 "synchronisation de l'heure avec le réseau."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Une authentification est requise pour démarrer '$(unit)'."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Une authentification est requise pour arrêter '$(unit)'."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Une authentification est requise pour recharger '$(unit)'."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Une authentification est requise pour redémarrer '$(unit)'."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1312,18 +1335,18 @@ msgstr ""
 "Une authentification est requise pour envoyer un signal UNIX aux processus "
 "de '$(unit)'."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Une authentification est requise pour réinitialiser l'état \"failed\" de "
 "'$(unit)'."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 "Une authentification est requise pour définir des propriétés de '$(unit)'."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1331,7 +1354,7 @@ msgstr ""
 "Une authentification est requise pour supprimer les fichiers et les dossiers "
 "associés à '$(unit)'."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/gl.po

@@ -5,7 +5,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2023-04-14 18:20+0000\n"
 "Last-Translator: Fran Diéguez <frandieguez@gnome.org>\n"
 "Language-Team: Galician <https://translate.fedoraproject.org/projects/"
@@ -116,31 +116,41 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Requírese autenticación para actualizar o espazo persoal dun usuario."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Actualizar un espazo persoal"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Requírese autenticación para actualizar o espazo persoal dun usuario."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Redimensionar un espazo persoal"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Requírese autenticación para redimensionar o espazo persoal dun usuario."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Cambiar contrasinal dun espazo persoal"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Requírese autenticación para cambiar o contrasinal dun espazo persoal dun "
 "usuario."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "Crear un área persoal"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Requírese autenticación para crear un área persoal."
@@ -1190,6 +1200,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Requírese autenticación para estabelecer a hora do sistema."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Requírese autenticación para xestionar as sesións, usuarios e asentos "
+"activos."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Estabelecer a hora do sistema"
@@ -1230,23 +1251,23 @@ msgstr ""
 "Requírese autenticación para controlar se a sincronización de hora por rede "
 "debería activarse."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Requírese autenticación para inciar '$(unit)'."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Requírese autenticación para deter '$(unit)'."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Requírese autenticación para recargar '$(unit)'."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Requírese autenticación para reiniciar '$(unit)'."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1254,16 +1275,16 @@ msgstr ""
 "Requírese autenticación para enviarlle un sinal UNIX aos procesos de "
 "'$(unit)'."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Requírese autenticación para reinicair o estado «fallido» de '$(unit)'."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Requírese autenticación para estabelecer as propiedades en '$(unit)'."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1271,7 +1292,7 @@ msgstr ""
 "Requírese autenticación para eliminar ficheiros ou directorios asociados con "
 "'$(unit)'."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr "Requírese autenticación para conxelar o proceso da unidade '$(unit)'."

po/he.po

@@ -5,7 +5,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: systemd\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2023-11-22 00:01+0000\n"
 "Last-Translator: Yaron Shahrabani <sh.yaron@gmail.com>\n"
 "Language-Team: Hebrew <https://translate.fedoraproject.org/projects/systemd/"
@@ -106,28 +106,38 @@ msgid "Authentication is required to update a user's home area."
 msgstr "נדרש אימות כדי לעדכן אזור בית למשתמש."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "עדכון אזור בית"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "נדרש אימות כדי לעדכן אזור בית למשתמש."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "שינוי גודל אזור בית"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "נדרש אימות כדי לשנות גודל אזור בית למשתמש."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "החלפת סיסמה של אזור בית"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "נדרש אימות כדי להחליף סיסמה של אזור בית למשתמש."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "יצירת אזור בית"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "נדרש אימות כדי ליצור אזור בית למשתמש."
@@ -1098,6 +1108,15 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "נדרש אימות כדי להגדיר את שעון המערכת."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr "נדרש אימות כדי לנהל הפעלות, משתמשים ומושבים פעילים."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "הגדרת שעון המערכת"
@@ -1137,43 +1156,43 @@ msgid ""
 "shall be enabled."
 msgstr "נדרש אימות כדי להפעיל או לכבות סנכרון שעון מהרשת."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "נדרש אימות כדי להפעיל את ‚$(unit)’."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "נדרש אימות כדי לעצור את ‚$(unit)’."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "נדרש אימות כדי לרענן את ‚$(unit)’."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "נדרש אימות כדי להפעיל את ‚$(unit)’ מחדש."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr "נדרש אימות כדי לשלוח אות יוניקס לתהליכים של ‚$(unit)’."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr "נדרש אימות כדי לאפס את המצב „נכשל” של ‚$(unit)’."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "נדרש אימות כדי להגדיר מאפיינים על ‚$(unit)’."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr "נדרש אימות כדי למחוק קבצים ותיקיות שמשויכים אל ‚$(unit)’."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr "נדרש אימות כדי להפשיר או להקפיא את התהליכים של ‚$(unit)’."

po/hi.po

@@ -5,7 +5,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: systemd\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-06-03 00:35+0000\n"
 "Last-Translator: Scrambled 777 <weblate.scrambled777@simplelogin.com>\n"
 "Language-Team: Hindi <https://translate.fedoraproject.org/projects/systemd/"
@@ -106,27 +106,37 @@ msgid "Authentication is required to update a user's home area."
 msgstr "उपयोक्ता के गृह क्षेत्र का अद्यतन करने के लिए प्रमाणीकरण आवश्यक है।"
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "गृह क्षेत्र का अद्यतन करें"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "उपयोक्ता के गृह क्षेत्र का अद्यतन करने के लिए प्रमाणीकरण आवश्यक है।"
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "गृह क्षेत्र का आकार बदलें"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "उपयोक्ता के गृह क्षेत्र का आकार बदलने के लिए प्रमाणीकरण आवश्यक है।"
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "गृह क्षेत्र का पासवर्ड बदलें"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "उपयोक्ता के गृह क्षेत्र का पासवर्ड बदलने के लिए प्रमाणीकरण आवश्यक है।"
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "गृह क्षेत्र सक्रिय करें"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr "उपयोक्ता के गृह क्षेत्र को सक्रिय करने के लिए प्रमाणीकरण आवश्यक है।"
 
@@ -1126,6 +1136,15 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "सिस्टम समय निर्धारित करने के लिए प्रमाणीकरण आवश्यक है।"
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr "सक्रिय सत्रों, उपयोक्ताओं और सीटों को प्रबंधित करने के लिए प्रमाणीकरण आवश्यक है।"
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "सिस्टम समय निर्धारित करें"
@@ -1166,43 +1185,43 @@ msgstr ""
 "यह नियंत्रित करने के लिए प्रमाणीकरण आवश्यक है कि नेटवर्क समय समन्वयन सक्षम किया जाएगा "
 "या नहीं।"
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "'$(unit)' शुरू करने के लिए प्रमाणीकरण आवश्यक है।"
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "'$(unit)' को रोकने के लिए प्रमाणीकरण आवश्यक है।"
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "'$(unit)' को पुनः लोड करने के लिए प्रमाणीकरण आवश्यक है।"
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "'$(unit)' को पुनः आरंभ करने के लिए प्रमाणीकरण आवश्यक है।"
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr "'$(unit)' की प्रक्रियाओं में UNIX सिग्नल भेजने के लिए प्रमाणीकरण आवश्यक है।"
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr "'$(unit)' की \"विफल\" स्थिति को रीसेट करने के लिए प्रमाणीकरण आवश्यक है।"
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "'$(unit)' पर गुण निर्धारित करने के लिए प्रमाणीकरण आवश्यक है।"
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr "'$(unit)' से जुड़ी फाइलों और निर्देशिकाओं को हटाने के लिए प्रमाणीकरण आवश्यक है।"
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr "'$(unit)' यूनिट की प्रक्रियाओं को जमाने या पिघलाने के लिए प्रमाणीकरण आवश्यक है।"

po/hr.po

@@ -8,7 +8,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-08-04 03:41+0000\n"
 "Last-Translator: Marin Kresic <marinjurekresic@gmail.com>\n"
 "Language-Team: Croatian <https://translate.fedoraproject.org/projects/"
@@ -112,28 +112,38 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Potrebna je ovjera za nadopunu osobnog prostora korisnika."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Nadopuni osobni prostor"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Potrebna je ovjera za nadopunu osobnog prostora korisnika."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Promjeni veličinu osobnog prostora korisnika"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "Potrebna je ovjera za promjenu veličine osobnog prostora korisnika."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Promijeni lozinku osobnog prostora"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "Potrebna je ovjera za promjenu lozinke osobnog prostora korisnika."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "Stvori osobni prostor"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Potrebna je ovjera za stvaranje osobnog prostora korisnika."
@@ -1170,6 +1180,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Potrebna je ovjera za postavljanje vremena sustava."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Potrebna je ovjera za upravljanje aktivnim sesijama, korisnicima i skupovima "
+"sesija i hardvera."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Postavi vrijeme sustava"
@@ -1209,37 +1230,37 @@ msgstr ""
 "Potrebna je ovjera za uključivanje ili isključivanje mrežnog usklađivanja "
 "vremena."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Potrebna je ovjera za pokretanje '$(unit)'."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Potrebna je ovjera za zaustavljanje '$(unit)'."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Potrebna je ovjera za ponovno učitavnje '$(unit)'."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Potrebna je ovjera za ponovno pokretanje'$(unit)'."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr "Potrebna je ovjera za slanje UNIX signala u procese '$(unit)'."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr "Potrebna je ovjera za vraćanje \"neuspjelog\" stanja '$(unit)'."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Potrebna je ovjera za postavljanje svojstava na '$(unit)'."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1247,7 +1268,7 @@ msgstr ""
 "Potrebna je ovjera za brisanje datoteka i direktorija pridruženih sa "
 "'$(unit)'."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/hu.po

@@ -10,7 +10,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2023-09-27 01:36+0000\n"
 "Last-Translator: Balázs Úr <balazs@urbalazs.hu>\n"
 "Language-Team: Hungarian <https://translate.fedoraproject.org/projects/"
@@ -120,30 +120,40 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Hitelesítés szükséges a felhasználó saját területének frissítéséhez."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Saját terület frissítése"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Hitelesítés szükséges a felhasználó saját területének frissítéséhez."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Saját terület átméretezése"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "Hitelesítés szükséges a felhasználó saját területének átméretezéséhez."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Saját terület jelszavának megváltoztatása"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Hitelesítés szükséges a felhasználó saját területe jelszavának "
 "megváltoztatásához."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "Saját terület létrehozása"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Hitelesítés szükséges a felhasználó saját területének létrehozásához."
@@ -1213,6 +1223,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Hitelesítés szükséges a rendszeridő beállításához."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Hitelesítés szükséges az aktív munkamenetek, felhasználók és munkaállomások "
+"kezeléséhez."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Rendszeridő beállítása"
@@ -1253,23 +1274,23 @@ msgstr ""
 "Hitelesítés szükséges annak vezérléséhez, hogy a hálózati időszinkronizáció "
 "engedélyezve legyen."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Hitelesítés szükséges a(z) „$(unit)” elindításához."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Hitelesítés szükséges a(z) „$(unit)” leállításához."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Hitelesítés szükséges a(z) „$(unit)” újratöltéséhez."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Hitelesítés szükséges a(z) „$(unit)” újraindításához."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1277,18 +1298,18 @@ msgstr ""
 "Hitelesítés szükséges a(z) „$(unit)” folyamatainak történő UNIX szignál "
 "küldéséhez."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Hitelesítés szükséges a(z) „$(unit)” „failed” állapotának visszaállításához."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 "Hitelesítés szükséges a(z) „$(unit)” egységen lévő tulajdonságok "
 "beállításához."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1296,7 +1317,7 @@ msgstr ""
 "Hitelesítés szükséges a(z) „$(unit)” egységhez hozzárendelt fájlok és "
 "könyvtárak törléséhez."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/id.po

@@ -5,7 +5,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-10-27 05:38+0000\n"
 "Last-Translator: Andika Triwidada <andika@gmail.com>\n"
 "Language-Team: Indonesian <https://translate.fedoraproject.org/projects/"
@@ -112,29 +112,39 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Otentikasi diperlukan untuk memperbarui suatu area rumah pengguna."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Memperbarui suatu area rumah"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Otentikasi diperlukan untuk memperbarui suatu area rumah pengguna."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Mengubah ukuran area rumah"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "Otentikasi diperlukan untuk mengubah ukuran area rumah pengguna."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Ubah kata sandi dari suatu area rumah"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Otentikasi diperlukan untuk mengubah kata sandi dari suatu area rumah "
 "pengguna."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "Aktifkan suatu area home"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr "Otentikasi diperlukan untuk mengaktifkan suatu area home pengguna."
 
@@ -1154,6 +1164,15 @@ msgstr "Bersihkan pembaruan sistem lama"
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Otentikasi diperlukan untuk membersihkan pembaruan sistem lama."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr "Otentikasi diperlukan untuk mengelola seat, pengguna, dan sesi aktif."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Setel waktu sistem"
@@ -1194,23 +1213,23 @@ msgstr ""
 "Otentikasi diperlukan untuk mengendalikan apakah sinkronisasi waktu jaringan "
 "mesti difungsikan."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Otentikasi diperlukan untuk memulai '$(unit)'."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Otentikasi diperlukan untuk menghentikan '$(unit)'."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Otentikasi diperlukan untuk memuat ulang '$(unit)'."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Otentikasi diperlukan untuk memulai ulang '$(unit)'."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1218,16 +1237,16 @@ msgstr ""
 "Otentikasi diperlukan untuk megirim suatu sinyal UNIX ke proses dari "
 "'$(unit)'."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Otentikasi diperlukan untuk me-reset keadaan \"failed\" dari '$(unit)'."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Otentikasi diperlukan untuk menata properti pada '$(unit)'."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1235,7 +1254,7 @@ msgstr ""
 "Otentikasi diperlukan untuk menghapus berkas dan direktori yang terkait "
 "dengan '$(unit)'."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/it.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-05-02 04:40+0200\n"
 "Last-Translator: Daniele Medri <dmedri@gmail.com>\n"
 "Language-Team: italian\n"
@@ -116,29 +116,39 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Autenticazione richiesta per aggiornare l'area home di un utente."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Aggiorna un'area home"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Autenticazione richiesta per aggiornare l'area home di un utente."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Ridimensiona un'area home"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "Autenticazione richiesta per ridimensionare l'area home di un utente."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Modifica password di un'area home"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Autenticazione richiesta per modificare la password dell'area home di un "
 "utente."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "Attiva un'area home"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr "Autenticazione richiesta per attivare l'area home di un utente."
 
@@ -1210,6 +1220,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Autenticazione richiesta per impostare l'orario di sistema."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Autenticazione richiesta per gestire le sessioni attive, gli utenti e le "
+"postazioni."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Imposta l'orario di sistema"
@@ -1252,23 +1273,23 @@ msgstr ""
 "Autenticazione richiesta per verificare se la sincronizzazione dell'orario "
 "in rete deve essere attivata."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Autenticazione richiesta per avviare '$(unit)'."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Autenticazione richiesta per fermare '$(unit)'."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Autenticazione richiesta per ricaricare '$(unit)'."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Autenticazione richiesta per riavviare '$(unit)'."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1276,16 +1297,16 @@ msgstr ""
 "Autenticazione richiesta per inviare un segnale UNIX ai processi di "
 "'$(unit)'."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Autenticazione richiesta per riconfigurare lo stato \"fallito\" di '$(unit)'."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Autenticazione richiesta per configurare le proprietà di '$(unit)'."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1293,7 +1314,7 @@ msgstr ""
 "Autenticazione richiesta per eliminare i file e le directory associate a "
 "'$(unit)'."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/ja.po

@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2021-09-09 03:04+0000\n"
 "Last-Translator: Takuro Onoue <kusanaginoturugi@gmail.com>\n"
 "Language-Team: Japanese <https://translate.fedoraproject.org/projects/"
@@ -106,27 +106,37 @@ msgid "Authentication is required to update a user's home area."
 msgstr "ユーザのホーム領域の更新には認証が必要です。"
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "ホーム領域の更新"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "ユーザのホーム領域の更新には認証が必要です。"
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "ホーム領域のサイズ変更"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "ユーザのホーム領域のサイズ変更には認証が必要です。"
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "ホーム領域のパスワード変更"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "ユーザのホーム領域のパスワードを変更するには認証が必要です。"
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "ホーム領域の有効化"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr "ユーザのホーム領域を有効化するには認証が必要です。"
 
@@ -1108,6 +1118,15 @@ msgstr "過去のシステム更新を削除"
 msgid "Authentication is required to cleanup old system updates."
 msgstr "過去のシステム更新を削除するには認証が必要です。"
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr "アクティブなセッションやユーザ，シートを管理するには認証が必要です。"
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "システムの時刻設定"
@@ -1146,44 +1165,44 @@ msgid ""
 "shall be enabled."
 msgstr "ネットワーク経由の時刻同期を有効もしくは無効にするには認証が必要です。"
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "'$(unit)'を開始するには認証が必要です。"
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "'$(unit)'を停止するには認証が必要です。"
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "'$(unit)'を再読込するには認証が必要です。"
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "'$(unit)'を再起動するには認証が必要です。"
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr "'$(unit)'のプロセスにUNIXシグナルを送るには認証が必要です。"
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr "'$(unit)'の「失敗」状態をリセットするには認証が必要です。"
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "'$(unit)'のプロパティを設定するには認証が必要です。"
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr ""
 "'$(unit)'に関連付けられたファイルやディレクトリの削除には認証が必要です。"
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr "'$(unit)'のプロセスを凍結もしくは凍結解除するには認証が必要です。"

po/ka.po

@@ -4,7 +4,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-08-24 10:36+0000\n"
 "Last-Translator: Temuri Doghonadze <temuri.doghonadze@gmail.com>\n"
 "Language-Team: Georgian <https://translate.fedoraproject.org/projects/"
@@ -108,27 +108,37 @@ msgid "Authentication is required to update a user's home area."
 msgstr "სახლის ტერიტორიის განახლებისთვის საჭიროა ავთენტიკაცია."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "სახლის ტერიტორიის განახლება"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "სახლის ტერიტორიის განახლებისთვის საჭიროა ავთენტიკაცია."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "სახლის ტერიტორიის ზომის შეცვლა"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "სახლის ტერიტორიის ზომის შეცვლისთვის საჭიროა ავთენტიკაცია."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "სახლის ტერიტორიის პაროლის შეცვლა"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "სახლის ტერიტორიის პაროლის შეცვლისთვის საჭიროა ავთენტიკაცია."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "საწყისი ადგილის აქტივაცია"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr "მომხმარებლის საწყისი ადგილის აქტივაციისთვის აუცილებელია ავთენტიკაცია."
 
@@ -1152,6 +1162,17 @@ msgstr "ძველი სისტემის განახლებებ
 msgid "Authentication is required to cleanup old system updates."
 msgstr "ძველი სისტემური განახლებების გასუფთავებას ავთენტიკაცია სჭირდება."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"აქტიური სესიების, მომხმარებლებისა და სამუშაო მაგიდების მართვას ავთენტიკაცია "
+"სჭირდება."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "სისტემური დროის დაყენება"
@@ -1189,40 +1210,40 @@ msgid ""
 "shall be enabled."
 msgstr "დროის ქსელური სინქრონიზაციის ჩართ/გამორთ-თვის საჭიროა ავთენტიკაცია."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "'$(unit)'-ის გასაშვებად საჭიროა ავთენტიკაცია."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "'$(unit)'-ის გასაჩერებლად საჭიროა ავთენტიკაცია."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "'$(unit)'-ის გადასატვირთად საჭიროა ავთენტიკაცია."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "'$(unit)'-ის გადასატვირთად საჭიროა ავთენტიკაცია."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr ""
 "'$(unit)'-ის პროცესებისთვის UNIX სიგნალის გასაგზავნად საჭიროა ავთნტიკაცია."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "'$(unit)'-ის შეცდომით გაშვების მდგომარეობის გასასუფთავებლად საჭიროა "
 "ავთენტიკაცია."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "'$(unit)'-ის თვისებების დასაყენებლად საჭიროა ავთენტიკაცია."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1230,7 +1251,7 @@ msgstr ""
 "'$(unit)'-თან ასოცირებული ფაილების და საქაღალდეების წასაშლელად საჭიროა "
 "ავთენტიკაცია."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr "'$(unit)'-ის პროცესების გასაყინად საჭიროა ავთენტიკაცია."

po/kab.po

@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-10-07 04:52+0000\n"
 "Last-Translator: ButterflyOfFire <butterflyoffire@protonmail.com>\n"
 "Language-Team: Kabyle <https://translate.fedoraproject.org/projects/systemd/"
@@ -104,28 +104,37 @@ msgid "Authentication is required to update a user's home area."
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:53
-msgid "Resize a home area"
-msgstr ""
+#, fuzzy
+msgid "Update your home area"
+msgstr "Rnu tmennaḍt agejdan"
 
 #: src/home/org.freedesktop.home1.policy:54
-msgid "Authentication is required to resize a user's home area."
+msgid "Authentication is required to update your home area."
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:63
-msgid "Change password of a home area"
+msgid "Resize a home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:64
+msgid "Authentication is required to resize a user's home area."
+msgstr ""
+
+#: src/home/org.freedesktop.home1.policy:73
+msgid "Change password of a home area"
+msgstr ""
+
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "Rnu tmennaḍt agejdan"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr ""
 
@@ -1063,6 +1072,14 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr ""
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+msgid "Authentication is required to manage optional features"
+msgstr ""
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr ""
@@ -1099,43 +1116,43 @@ msgid ""
 "shall be enabled."
 msgstr ""
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/ko.po

@@ -8,7 +8,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-08-24 10:36+0000\n"
 "Last-Translator: 김인수 <simmon@nplob.com>\n"
 "Language-Team: Korean <https://translate.fedoraproject.org/projects/systemd/"
@@ -109,27 +109,37 @@ msgid "Authentication is required to update a user's home area."
 msgstr "사용자 홈 영역을 최신화 하려면 인증이 필요합니다."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "홈 영역을 최신화"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "사용자 홈 영역을 최신화 하려면 인증이 필요합니다."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "홈 영역을 조정"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "사용자 홈 영역을 조정하려면 인증이 필요합니다."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "홈 영역 비밀번호 변경"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "사용자 홈 영역의 비밀번호를 변경하려면 인증이 필요합니다."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "홈 영역 활성화"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr "사용자의 홈 영역을 활성화에 인증이 필요합니다."
 
@@ -1094,7 +1104,8 @@ msgstr "지정된 시스템 버전 설치"
 msgid ""
 "Authentication is required to update the system to a specific (possibly old) "
 "version."
-msgstr "지정된 (아마도 오래된) 버전으로 시스템을 최신화하려면 인증이 필요합니다."
+msgstr ""
+"지정된 (아마도 오래된) 버전으로 시스템을 최신화하려면 인증이 필요합니다."
 
 #: src/sysupdate/org.freedesktop.sysupdate1.policy:65
 msgid "Cleanup old system updates"
@@ -1104,6 +1115,15 @@ msgstr "오래된 시스템 최신화 정리"
 msgid "Authentication is required to cleanup old system updates."
 msgstr "오래된 시스템 최신화를 정리하려면 인증이 필요합니다."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr "활성 세션, 사용자 시트를 관리하려면 인증이 필요합니다."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "시스템 시간 설정"
@@ -1142,43 +1162,43 @@ msgid ""
 "shall be enabled."
 msgstr "네트워크 시간 동기화의 활성화 여부를 제어하려면 인증이 필요합니다."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "인증은 '$(unit)'을 시작하는데 필요합니다."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "인증은 '$(unit)'을 멈추는데 필요합니다."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "인증은 '$(unit)'을 다시 불러오는데 필요합니다."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "인증은 '$(unit)'을 다시 시작하는데 필요합니다."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr "'$(unit)'의 처리에 유닉스 신호를 전송하려면 인증이 필요합니다."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr "인증은 '$(unit)'의 \"실패\"를 되돌리는데 필요합니다."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "인증은 '$(unit)'의 속성을 설정하는데 필요합니다."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr "인증은 '$(unit)'과 관련된 파일과 디렉토리를 삭제하는데 필요합니다."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr "'$(unit)'단위의 처리를 동결 또는 해제하려면 인증이 필요합니다."

po/lt.po

@@ -5,7 +5,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-02-15 23:36+0000\n"
 "Last-Translator: mooo <hazap@hotmail.com>\n"
 "Language-Team: Lithuanian <https://translate.fedoraproject.org/projects/"
@@ -122,31 +122,41 @@ msgstr ""
 "Norint prijungti įrenginį prie darbo vietos, reikia nustatyti tapatybę."
 
 #: src/home/org.freedesktop.home1.policy:53
-msgid "Resize a home area"
+msgid "Update your home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:54
 #, fuzzy
-msgid "Authentication is required to resize a user's home area."
-msgstr "Norint nustatyti sienos pranešimą, reikia nustatyti tapatybę"
+msgid "Authentication is required to update your home area."
+msgstr ""
+"Norint prijungti įrenginį prie darbo vietos, reikia nustatyti tapatybę."
 
 #: src/home/org.freedesktop.home1.policy:63
-msgid "Change password of a home area"
+msgid "Resize a home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:64
 #, fuzzy
+msgid "Authentication is required to resize a user's home area."
+msgstr "Norint nustatyti sienos pranešimą, reikia nustatyti tapatybę"
+
+#: src/home/org.freedesktop.home1.policy:73
+msgid "Change password of a home area"
+msgstr ""
+
+#: src/home/org.freedesktop.home1.policy:74
+#, fuzzy
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Norint tvarkyti aktyvius seansus, naudotojus ir darbo vietas, reikia "
 "nustatyti tapatybę."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Norint iš naujo įkelti systemd būseną, reikia patvirtinti tapatybę."
@@ -1205,6 +1215,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Norint nustatyti sistemos laiką, reikia nustatyti tapatybę."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Norint tvarkyti aktyvius seansus, naudotojus ir darbo vietas, reikia "
+"nustatyti tapatybę."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Nustatyti sistemos laiką"
@@ -1247,40 +1268,40 @@ msgstr ""
 "Norint valdyti ar tinklo laiko sinchronizavimas turėtų būti įjungtas, reikia "
 "nustatyti tapatybę."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Norint paleisti \"$(unit)\", reikia nustatyti tapatybę."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Norint stabdyti \"$(unit)\", reikia nustatyti tapatybę."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Norint įkelti \"$(unit)\" iš naujo, reikia nustatyti tapatybę."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Norint paleisti \"$(unit)\" iš naujo, reikia nustatyti tapatybę."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr ""
 "Norint siųsti UNIX signalą į \"$(unit)\" procesus, reikia nustatyti tapatybę."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Norint atstatyti \"$(unit)\" įtaiso \"failed\" būseną, reikia nustatyti "
 "tapatybę."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Norint nustatyti \"$(unit)\" savybes, reikia nustatyti tapatybę."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 #, fuzzy
 msgid ""
 "Authentication is required to delete files and directories associated with "
@@ -1289,7 +1310,7 @@ msgstr ""
 "Norint atstatyti \"$(unit)\" įtaiso \"failed\" būseną, reikia nustatyti "
 "tapatybę."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 #, fuzzy
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."

po/nl.po

@@ -7,7 +7,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2023-08-21 17:21+0000\n"
 "Last-Translator: Maarten <maarten@posteo.de>\n"
 "Language-Team: Dutch <https://translate.fedoraproject.org/projects/systemd/"
@@ -121,32 +121,43 @@ msgstr ""
 "Authenticatie is vereist voor het bijwerken van een persoonlijke ruimte."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Werk een persoonlijke ruimte bij"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr ""
+"Authenticatie is vereist voor het bijwerken van een persoonlijke ruimte."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Verander de grootte van een persoonlijke ruimte"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Authenticatie is vereist voor het veranderen van de grootte van een "
 "persoonlijke ruimte."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Wijzig het wachtwoord van een persoonlijke ruimte"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Authenticatie is vereist voor het wijzigen van het wachtwoord van een "
 "persoonlijke ruimte."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "Maak een persoonlijke ruimte"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "Authenticatie is vereist voor het maken van een persoonlijke ruimte."
@@ -1317,6 +1328,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Authenticatie is vereist voor het instellen van de systeemtijd."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Authenticatie is vereist voor het beheren van de actieve sessies, van de "
+"gebruikers en van de apparaten die zijn toegewezen aan de werkplekken."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Stel de systeemtijd in"
@@ -1359,23 +1381,23 @@ msgstr ""
 "Authenticatie is vereist voor het in- of uitschakelen van synchronisatie van "
 "de systeemtijd met een tijdserver."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Authenticatie is vereist voor het starten van '$(unit)'."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Authenticatie is vereist voor het stoppen van '$(unit)'."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Authenticatie is vereist voor het opnieuw laden van '$(unit)'."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Authenticatie is vereist voor het opnieuw starten van '$(unit)'."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1383,19 +1405,19 @@ msgstr ""
 "Authenticatie is vereist voor het zenden van een UNIX-signaal naar de "
 "processen van '$(unit)'."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Authenticatie is vereist voor het terugzetten van de toestand \"failed\" van "
 "'$(unit)'."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 "Authenticatie is vereist voor het instellen van de eigenschappen van "
 "'$(unit)'."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1403,7 +1425,7 @@ msgstr ""
 "Authenticatie is vereist voor het verwijderen van bestanden en mappen die "
 "gerelateerd zijn aan '$(unit)'."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/pa.po

@@ -5,7 +5,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-01-16 14:35+0000\n"
 "Last-Translator: A S Alam <aalam@users.noreply.translate.fedoraproject.org>\n"
 "Language-Team: Punjabi <https://translate.fedoraproject.org/projects/systemd/"
@@ -104,28 +104,38 @@ msgid "Authentication is required to update a user's home area."
 msgstr "ਵਰਤੋਂਕਾਰ ਦੇ ਹੋਮ ਖੇਤਰ ਨੂੰ ਅੱਪਡੇਟ ਕਰਨ ਲਈ ਪਰਮਾਣਿਕਤਾ ਚਾਹੀਦੀ ਹੈ।"
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "ਹੋਮ ਖੇਤਰ ਨੂੰ ਅੱਪਡੇਟ ਕਰੋ"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "ਵਰਤੋਂਕਾਰ ਦੇ ਹੋਮ ਖੇਤਰ ਨੂੰ ਅੱਪਡੇਟ ਕਰਨ ਲਈ ਪਰਮਾਣਿਕਤਾ ਚਾਹੀਦੀ ਹੈ।"
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "ਹੋਮ ਖੇਤਰ ਦਾ ਆਕਾਰ ਬਦਲੋ"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "ਵਰਤੋਂਕਾਰ ਦੇ ਹੋਮ ਖੇਤਰ ਦੇ ਆਕਰ ਨੂੰ ਬਦਲਣ ਲਈ ਪਰਮਾਣਿਕਤਾ ਚਾਹੀਦੀ ਹੈ।"
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "ਹੋਮ ਖੇਤਰ ਲਈ ਪਾਸਵਰਡ ਬਦਲੋ"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "ਵਰਤੋਂਕਾਰ ਦੇ ਹੋਮ ਖੇਤਰ ਲਈ ਪਾਸਵਰਡ ਨੂੰ ਬਦਲਣ ਲਈ ਪਰਮਾਣਿਕਤਾ ਚਾਹੀਦੀ ਹੈ।"
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "ਹੋਮ ਖੇਤਰ ਬਣਾਓ"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "ਵਰਤੋਂਕਾਰ ਦੇ ਹੋਮ ਖੇਤਰ ਨੂੰ ਬਣਾਉਣ ਲਈ ਪਰਮਾਣਿਕਤਾ ਚਾਹੀਦੀ ਹੈ।"
@@ -1083,6 +1093,15 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "ਸਿਸਟਮ ਟਾਈਮ ਸੈੱਟ ਕਰਨ ਲਈ ਪਰਮਾਣਕਿਤਾ ਚਾਹੀਦੀ ਹੈ।"
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr "ਸਿਸਟਮ ਸੇਵਾਵਾਂ ਜਾਂ ਯੂਨਿਟ ਫ਼ਾਇਲਾਂ ਦਾ ਇੰਤਜ਼ਾਮ ਕਰਨ ਲਈ ਪਰਮਾਣਕਿਤਾ ਚਾਹੀਦੀ ਹੈ।"
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "ਸਿਸਟਮ ਸਮਾੰ ਸੈੱਟ ਕਰੋ"
@@ -1119,43 +1138,43 @@ msgid ""
 "shall be enabled."
 msgstr ""
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "'$(unit)' ਨੂੰ ਸ਼ੁਰੂ ਕਰਨ ਲਈ ਪਰਮਾਣਕਿਤਾ ਚਾਹੀਦੀ ਹੈ।"
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "'$(unit)' ਨੂੰ ਰੋਕਣ ਕਰਨ ਲਈ ਪਰਮਾਣਕਿਤਾ ਚਾਹੀਦੀ ਹੈ।"
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "'$(unit)' ਨੂੰ ਮੁੜ-ਲੋਡ (reload) ਕਰਨ ਲਈ ਪਰਮਾਣਕਿਤਾ ਚਾਹੀਦੀ ਹੈ।"
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "'$(unit)' ਨੂੰ ਮੁੜ-ਸ਼ੁਰੂ (restart) ਕਰਨ ਲਈ ਪਰਮਾਣਕਿਤਾ ਚਾਹੀਦੀ ਹੈ।"
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/pl.po

@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-08-24 10:36+0000\n"
 "Last-Translator: Piotr Drąg <piotrdrag@gmail.com>\n"
 "Language-Team: Polish <https://translate.fedoraproject.org/projects/systemd/"
@@ -122,31 +122,43 @@ msgstr ""
 "użytkownika."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Aktualizacja przestrzeni domowej"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr ""
+"Wymagane jest uwierzytelnienie, aby zaktualizować przestrzeń domową "
+"użytkownika."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Zmiana rozmiaru przestrzeni domowej"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Wymagane jest uwierzytelnienie, aby zmienić rozmiar przestrzeni domowej "
 "użytkownika."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Zmiana hasła przestrzeni domowej"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Wymagane jest uwierzytelnienie, aby zmienić hasło przestrzeni domowej "
 "użytkownika."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "Aktywowanie przestrzeni domowej"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr ""
 "Wymagane jest uwierzytelnienie, aby aktywować przestrzeń domową użytkownika."
@@ -1185,8 +1197,8 @@ msgid ""
 "Authentication is required to update the system to a specific (possibly old) "
 "version."
 msgstr ""
-"Wymagane jest uwierzytelnienie, aby zaktualizować system do konkretnej ("
-"możliwie, że poprzedniej) wersji."
+"Wymagane jest uwierzytelnienie, aby zaktualizować system do konkretnej "
+"(możliwie, że poprzedniej) wersji."
 
 #: src/sysupdate/org.freedesktop.sysupdate1.policy:65
 msgid "Cleanup old system updates"
@@ -1198,6 +1210,17 @@ msgstr ""
 "Wymagane jest uwierzytelnienie, aby wyczyścić poprzednie aktualizacje "
 "systemu."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Wymagane jest uwierzytelnienie, aby zarządzać aktywnymi sesjami, "
+"użytkownikami i stanowiskami."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Ustawienie czasu systemu"
@@ -1238,25 +1261,25 @@ msgstr ""
 "Wymagane jest uwierzytelnienie, aby kontrolować, czy włączyć synchronizację "
 "czasu przez sieć."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Wymagane jest uwierzytelnienie, aby uruchomić jednostkę „$(unit)”."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Wymagane jest uwierzytelnienie, aby zatrzymać jednostkę „$(unit)”."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr ""
 "Wymagane jest uwierzytelnienie, aby ponownie wczytać jednostkę „$(unit)”."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr ""
 "Wymagane jest uwierzytelnienie, aby ponownie uruchomić jednostkę „$(unit)”."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1264,18 +1287,18 @@ msgstr ""
 "Wymagane jest uwierzytelnienie, aby wysłać sygnał uniksowy do procesów "
 "jednostki „$(unit)”."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Wymagane jest uwierzytelnienie, aby przywrócić stan „failed” (niepowodzenia) "
 "jednostki „$(unit)”."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 "Wymagane jest uwierzytelnienie, aby ustawić właściwości jednostki „$(unit)”."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1283,7 +1306,7 @@ msgstr ""
 "Wymagane jest uwierzytelnienie, aby usunąć pliki i katalogi powiązane "
 "z jednostką „$(unit)”."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/pt.po

@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-05-31 07:36+0000\n"
 "Last-Translator: Tiago Rocha Cunha <tiagocunha.me@gmail.com>\n"
 "Language-Team: Portuguese <https://translate.fedoraproject.org/projects/"
@@ -117,30 +117,40 @@ msgid "Authentication is required to update a user's home area."
 msgstr "É necessária autenticação para atualizar a área home de um utilizador."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Atualizar uma área home"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "É necessária autenticação para atualizar a área home de um utilizador."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Redimensionar uma área home"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "É necessária autenticação para redimensionar a área home de um utilizador."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Alterar palavra-passe de uma área home"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "É necessária autenticação para alterar a palavra-passe da área home de um "
 "utilizador."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "Ativar uma área home"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr "É necessária autenticação para ativar a área home de um usuário."
 
@@ -1206,6 +1216,16 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "É necessária autenticação para definir o horário do sistema."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"É necessária autenticação para gerir estações, utilizadores e sessões ativas."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Definir horário do sistema"
@@ -1246,23 +1266,23 @@ msgstr ""
 "É necessária autenticação para controlar se deve ser habilitada, ou não, a "
 "sincronização de horário através de rede."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "É necessária autenticação para iniciar '$(unit)'."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "É necessária autenticação para parar '$(unit)'."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "É necessária autenticação para recarregar '$(unit)'."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "É necessária autenticação para reiniciar '$(unit)'."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1270,16 +1290,16 @@ msgstr ""
 "É necessária autenticação para enviar um sinal UNIX para os processos de "
 "'$(unit)'."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "É necessária autenticação para reiniciar o estado “failed” de '$(unit)'."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "É necessária autenticação para definir propriedades em '$(unit)'."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1287,7 +1307,7 @@ msgstr ""
 "É necessária autenticação para eliminar ficheiros e diretórios associados "
 "com '$(unit)'."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/pt_BR.po

@@ -11,7 +11,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-09-25 01:07+0000\n"
 "Last-Translator: Fábio Rodrigues Ribeiro <farribeiro@gmail.com>\n"
 "Language-Team: Portuguese (Brazil) <https://translate.fedoraproject.org/"
@@ -124,29 +124,39 @@ msgid "Authentication is required to update a user's home area."
 msgstr "É necessária autenticação para atualizar a área home de um usuário."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Atualizar uma área home"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "É necessária autenticação para atualizar a área home de um usuário."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Redimensionar uma área home"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "É necessária autenticação para redimensionar a área home de um usuário."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Alterar senha de uma área home"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "É necessária autenticação para alterar a senha da área home de um usuário."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "Ativar uma área home"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "É necessária autenticação para criar a área home de um usuário."
@@ -1199,6 +1209,17 @@ msgstr "Limpar velhas atualizações do sistema"
 msgid "Authentication is required to cleanup old system updates."
 msgstr "É necessária autenticação para definir o horário do sistema."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"A autenticação é necessária para gerenciar sessões ativas, usuários e "
+"estações."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Definir horário do sistema"
@@ -1239,23 +1260,23 @@ msgstr ""
 "É necessária autenticação para controlar se deve ser habilitada, ou não, a "
 "sincronização de horário através de rede."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "É necessária autenticação para iniciar “$(unit)”."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "É necessária autenticação para parar “$(unit)”."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "É necessária autenticação para recarregar “$(unit)”."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "É necessária autenticação para reiniciar “$(unit)”."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1263,16 +1284,16 @@ msgstr ""
 "É necessária autenticação para enviar um sinal UNIX para os processos de "
 "“$(unit)”."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "É necessária autenticação para reiniciar o estado “failed” de “$(unit)”."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "É necessária autenticação para definir propriedades em “$(unit)”."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1280,7 +1301,7 @@ msgstr ""
 "É necessária autenticação para excluir arquivos e diretórios associados com "
 "“$(unit)”."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/ro.po

@@ -7,7 +7,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2021-01-12 17:36+0000\n"
 "Last-Translator: Vlad <milovlad@outlook.com>\n"
 "Language-Team: Romanian <https://translate.fedoraproject.org/projects/"
@@ -125,32 +125,44 @@ msgstr ""
 "utilizator."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Actualizează un spațiu personal"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr ""
+"Autentificarea este necesară pentru a actualiza spațiul personal al unui "
+"utilizator."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Redimensionează un spațiu personal"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Autentificarea este necesară pentru a redimensiona spațiul personal al unui "
 "utilizator."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Schimbă parola pentru un spațiu personal"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Autentificarea este necesară pentru schimbarea parolei unui spațiu personal "
 "al unui utilizator."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "Crează un spațiu personal"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr ""
@@ -1228,6 +1240,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Autentificarea este necesară pentru a seta ora sistemului."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Autentificarea este necesară pentru gestionarea sesiunilor active, "
+"utilizatorilor și stațiilor."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Setare oră sistem"
@@ -1268,23 +1291,23 @@ msgstr ""
 "Autentificarea este necesară pentru a controla dacă sincronizarea cu ora "
 "rețelei ar trebui activată."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Autentificarea este necesară pentru a porni „$(unit)”."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Autentificarea este necesară pentru a opri „$(unit)”."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Autentificarea este necesară pentru a reîncărca „$(unit)”."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Autentificarea este necesară pentru a reporni „$(unit)”."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1292,17 +1315,17 @@ msgstr ""
 "Autentificarea este necesară pentru a trimite un semnal UNIX către procesele "
 "unui „$(unit)”."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Autentificarea este necesară pentru a reseta starea „eșuată” a „$(unit)”."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 "Autentificarea este necesară pentru a seta proprietățile lui „$(unit)”."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1310,7 +1333,7 @@ msgstr ""
 "Autentificarea este necesară pentru a șterge fișierele și directoarele "
 "asociate lui „$(unit)”."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/ru.po

@@ -13,7 +13,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-08-25 11:38+0000\n"
 "Last-Translator: \"Sergey A.\" <Ser82-png@yandex.ru>\n"
 "Language-Team: Russian <https://translate.fedoraproject.org/projects/systemd/"
@@ -130,31 +130,43 @@ msgstr ""
 "аутентификацию."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Обновить домашнее пространство"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr ""
+"Чтобы обновить домашнее пространство пользователя, необходимо пройти "
+"аутентификацию."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Изменить размер домашнего пространства"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Чтобы изменить размер домашнего пространства пользователя, необходимо пройти "
 "аутентификацию."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Изменить пароль для домашнего пространства"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Чтобы изменить пароль для домашнего пространства пользователя, необходимо "
 "пройти аутентификацию."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "Активация домашнего пространства"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr ""
 "Чтобы активировать домашнее пространство пользователя, необходимо пройти "
@@ -1206,7 +1218,8 @@ msgstr "Дамп состояние сервера"
 
 #: src/resolve/org.freedesktop.resolve1.policy:166
 msgid "Authentication is required to dump server state."
-msgstr "Чтобы создать дамп состояние сервера, необходимо пройти аутентификацию."
+msgstr ""
+"Чтобы создать дамп состояние сервера, необходимо пройти аутентификацию."
 
 #: src/resolve/org.freedesktop.resolve1.policy:176
 msgid "Dump statistics"
@@ -1263,6 +1276,17 @@ msgstr ""
 "Чтобы удалить устаревшие обновления системы, необходимо пройти "
 "аутентификацию."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Для управления текущими сеансами, пользователями и рабочими местами, "
+"необходимо пройти аутентификацию."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Настроить системное время"
@@ -1303,25 +1327,25 @@ msgstr ""
 "Чтобы включить или отключить синхронизацию времени по сети, необходимо "
 "пройти аутентификацию."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Чтобы запустить «$(unit)», необходимо пройти аутентификацию."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Чтобы остановить «$(unit)», необходимо пройти аутентификацию."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr ""
 "Чтобы заставить «$(unit)» перечитать конфигурацию, необходимо пройти "
 "аутентификацию."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Чтобы перезапустить «$(unit)», необходимо пройти аутентификацию."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1329,18 +1353,18 @@ msgstr ""
 "Чтобы отправить сигнал UNIX процессам юнита «$(unit)», необходимо пройти "
 "аутентификацию."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Чтобы сбросить состояние «failed» у юнита «$(unit)», необходимо пройти "
 "аутентификацию."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 "Чтобы изменить параметры юнита «$(unit)», необходимо пройти аутентификацию."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1348,7 +1372,7 @@ msgstr ""
 "Чтобы удалить файлы и директории, относящиеся к юниту «$(unit)», необходимо "
 "пройти аутентификацию."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/si.po

@@ -5,7 +5,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2021-08-19 07:04+0000\n"
 "Last-Translator: Hela Basa <r45xveza@pm.me>\n"
 "Language-Team: Sinhala <https://translate.fedoraproject.org/projects/systemd/"
@@ -103,27 +103,35 @@ msgid "Authentication is required to update a user's home area."
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:53
-msgid "Resize a home area"
+msgid "Update your home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:54
-msgid "Authentication is required to resize a user's home area."
+msgid "Authentication is required to update your home area."
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:63
-msgid "Change password of a home area"
+msgid "Resize a home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:64
+msgid "Authentication is required to resize a user's home area."
+msgstr ""
+
+#: src/home/org.freedesktop.home1.policy:73
+msgid "Change password of a home area"
+msgstr ""
+
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr ""
 
@@ -1062,6 +1070,14 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr ""
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+msgid "Authentication is required to manage optional features"
+msgstr ""
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "පද්ධතියේ වේලාව සකසන්න"
@@ -1098,43 +1114,43 @@ msgid ""
 "shall be enabled."
 msgstr ""
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/sk.po

@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2021-02-22 20:21+0000\n"
 "Last-Translator: Frantisek Sumsal <frantisek@sumsal.cz>\n"
 "Language-Team: Slovak <https://translate.fedoraproject.org/projects/systemd/"
@@ -122,29 +122,38 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Vyžaduje sa overenie totožnosti na uspanie systému."
 
 #: src/home/org.freedesktop.home1.policy:53
-msgid "Resize a home area"
+msgid "Update your home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:54
 #, fuzzy
-msgid "Authentication is required to resize a user's home area."
+msgid "Authentication is required to update your home area."
 msgstr "Vyžaduje sa overenie totožnosti na uspanie systému."
 
 #: src/home/org.freedesktop.home1.policy:63
-msgid "Change password of a home area"
+msgid "Resize a home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:64
 #, fuzzy
+msgid "Authentication is required to resize a user's home area."
+msgstr "Vyžaduje sa overenie totožnosti na uspanie systému."
+
+#: src/home/org.freedesktop.home1.policy:73
+msgid "Change password of a home area"
+msgstr ""
+
+#: src/home/org.freedesktop.home1.policy:74
+#, fuzzy
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "Vyžaduje sa overenie totožnosti na nastavenie miestnych nastavení."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr ""
@@ -1181,6 +1190,17 @@ msgid "Authentication is required to cleanup old system updates."
 msgstr ""
 "Vyžaduje sa overenie totožnosti na znovu načítanie stavu systému systemd."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Vyžaduje sa overenie totožnosti na správu systémovej služby alebo súborov "
+"jednotky."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr ""
@@ -1219,38 +1239,38 @@ msgstr ""
 "Vyžaduje sa overenie totožnosti na ovládanie, či má byť povolená "
 "synchronizácia času cez sieť."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 #, fuzzy
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr "Vyžaduje sa overenie totožnosti na uspanie systému."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 #, fuzzy
 msgid ""
 "Authentication is required to delete files and directories associated with "
@@ -1258,7 +1278,7 @@ msgid ""
 msgstr ""
 "Vyžaduje sa overenie totožnosti na znovu načítanie stavu systému systemd."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 #, fuzzy
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."

po/sl.po

@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: systemd\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-08-26 19:38+0000\n"
 "Last-Translator: Martin Srebotnjak <miles@filmsi.net>\n"
 "Language-Team: Slovenian <https://translate.fedoraproject.org/projects/"
@@ -125,31 +125,43 @@ msgstr ""
 "območja."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Posodobite domače območje"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr ""
+"Preverjanje pristnosti je potrebno za posodobitev uporabnikovega domačega "
+"območja."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Spreminite velikost domačega območja"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Preverjanje pristnosti je potrebno za spreminjanje velikosti uporabnikovega "
 "domačega območja."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Spremenite geslo domačega območja"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Preverjanje pristnosti je potrebno za spremembo gesla uporabnikovega "
 "domačega območja."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "Aktiviraj domače območje"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr ""
 "Preverjanje pristnosti je potrebno za aktiviranje uporabnikovega domačega "
@@ -1145,7 +1157,8 @@ msgstr "Naroči se na rezultate poizvedbe"
 
 #: src/resolve/org.freedesktop.resolve1.policy:144
 msgid "Authentication is required to subscribe query results."
-msgstr "Za naročanje na rezultate poizvedbe je potrebno preverjanje pristnosti."
+msgstr ""
+"Za naročanje na rezultate poizvedbe je potrebno preverjanje pristnosti."
 
 #: src/resolve/org.freedesktop.resolve1.policy:154
 msgid "Dump cache"
@@ -1219,6 +1232,17 @@ msgid "Authentication is required to cleanup old system updates."
 msgstr ""
 "Za čiščenje starih posodobitev sistema je potrebno preverjanje pristnosti."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Preverjanje pristnosti je potrebno za upravljanje aktivnih sej, uporabnikov "
+"in delovišč."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Določi sistemski čas"
@@ -1260,23 +1284,23 @@ msgstr ""
 "Preverjanje pristnosti je potrebno za nadzor, ali naj bo omogočena "
 "sinhronizacija časa v omrežju."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Preverjanje pristnosti je potrebno za zagon »$(unit)«."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Preverjanje pristnosti je potrebno, če želite ustaviti »$(unit)«."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Preverjanje pristnosti je potrebno za ponovno nalaganje »$(unit)«."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Preverjanje pristnosti je potrebno za vnovični zagon »$(unit)«."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1284,19 +1308,19 @@ msgstr ""
 "Preverjanje pristnosti je potrebno za pošiljanje signala UNIX procesom "
 "»$(unit)«."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Preverjanje pristnosti je potrebno za ponastavitev stanja »ni uspelo« za "
 "»$(unit)«."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 "Preverjanje pristnosti je potrebno, če želite lastnosti nastaviti na "
 "»$(unit)«."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1304,7 +1328,7 @@ msgstr ""
 "Preverjanje pristnosti je potrebno za brisanje datotek in map, povezanih s/z "
 "»$(unit)«."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/sr.po

@@ -5,7 +5,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2021-02-23 22:40+0000\n"
 "Last-Translator: Frantisek Sumsal <frantisek@sumsal.cz>\n"
 "Language-Team: Serbian <https://translate.fedoraproject.org/projects/systemd/"
@@ -122,31 +122,40 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Потребно је да се идентификујете да бисте  закачили уређај на седиште."
 
 #: src/home/org.freedesktop.home1.policy:53
-msgid "Resize a home area"
+msgid "Update your home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:54
 #, fuzzy
-msgid "Authentication is required to resize a user's home area."
-msgstr "Потребно је да се идентификујете да бисте поставили зидну поруку"
+msgid "Authentication is required to update your home area."
+msgstr "Потребно је да се идентификујете да бисте  закачили уређај на седиште."
 
 #: src/home/org.freedesktop.home1.policy:63
-msgid "Change password of a home area"
+msgid "Resize a home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:64
 #, fuzzy
+msgid "Authentication is required to resize a user's home area."
+msgstr "Потребно је да се идентификујете да бисте поставили зидну поруку"
+
+#: src/home/org.freedesktop.home1.policy:73
+msgid "Change password of a home area"
+msgstr ""
+
+#: src/home/org.freedesktop.home1.policy:74
+#, fuzzy
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Потребно је да се идентификујете да бисте управљали покренутим сесијама, "
 "корисницима и седиштима."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr ""
@@ -1239,6 +1248,17 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Потребно је да се идентификујете да бисте поставили системско време."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Потребно је да се идентификујете да бисте управљали покренутим сесијама, "
+"корисницима и седиштима."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Постави системско време"
@@ -1281,23 +1301,23 @@ msgstr ""
 "Потребно је да се идентификујете да бисте подесили да ли се време усклађује "
 "са мреже."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Потребно је да се идентификујете да бисте покренули „$(unit)“."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Потребно је да се идентификујете да бисте зауставили „$(unit)“."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Потребно је да се идентификујете да бисте поново учитали „$(unit)“."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Потребно је да се идентификујете да бисте поново покренули „$(unit)“."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 #, fuzzy
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
@@ -1305,18 +1325,18 @@ msgid ""
 msgstr ""
 "Потребно је да се идентификујете да бисте поставили својства за „$(unit)“."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Потребно је да се идентификујете да бисте поново поставили „неуспешно“ стање "
 "за „$(unit)“."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 "Потребно је да се идентификујете да бисте поставили својства за „$(unit)“."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 #, fuzzy
 msgid ""
 "Authentication is required to delete files and directories associated with "
@@ -1325,7 +1345,7 @@ msgstr ""
 "Потребно је да се идентификујете да бисте поново поставили „неуспешно“ стање "
 "за „$(unit)“."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 #, fuzzy
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."

po/sv.po

@@ -11,7 +11,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-10-24 00:56+0000\n"
 "Last-Translator: Anders Jonsson <anders.jonsson@norsjovallen.se>\n"
 "Language-Team: Swedish <https://translate.fedoraproject.org/projects/systemd/"
@@ -117,28 +117,38 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Autentisering krävs för att uppdatera en användares hemarea."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Uppdatera en hemarea"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Autentisering krävs för att uppdatera en användares hemarea."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Ändra storlek på en hemarea"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "Autentisering krävs för att ändra storlek på en hemarea."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Ändra lösenord för en hemarea"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Autentisering krävs för att ändra lösenordet för en användares hemarea."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "Aktivera en hemarea"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr "Autentisering krävs för att aktivera en användares hemarea."
 
@@ -1160,6 +1170,16 @@ msgstr "Rensa gamla systemuppdateringar"
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Autentisering krävs för att rensa gamla systemuppdateringar."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Autentisering krävs för att hantera aktiva sessioner, användare och platser."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Ange systemtid"
@@ -1202,23 +1222,23 @@ msgstr ""
 "Autentisering krävs för att kontrollera huruvida synkronisering av "
 "nätverkstid ska vara aktiverat."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Autentisering krävs för att starta \"$(unit)\"."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Autentisering krävs för att stoppa \"$(unit)\"."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Autentisering krävs för att läsa om \"$(unit)\"."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Autentisering krävs för att starta om \"$(unit)\"."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1226,17 +1246,17 @@ msgstr ""
 "Autentisering krävs för att skicka en UNIX-signal till processerna i "
 "”$(unit)”."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Autentisering krävs för att återställa det \"fallerade\" tillståndet för "
 "\"$(unit)\"."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Autentisering krävs för att ställa in egenskaper på \"$(unit)\"."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1244,7 +1264,7 @@ msgstr ""
 "Autentisering krävs för att radera filer och kataloger associerade med "
 "”$(unit)”."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/systemd.pot

@@ -1,11 +1,14 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the systemd package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
 #
 #, fuzzy
 msgid ""
 msgstr ""
 "Project-Id-Version: systemd\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -100,27 +103,35 @@ msgid "Authentication is required to update a user's home area."
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:53
-msgid "Resize a home area"
+msgid "Update your home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:54
-msgid "Authentication is required to resize a user's home area."
+msgid "Authentication is required to update your home area."
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:63
-msgid "Change password of a home area"
+msgid "Resize a home area"
 msgstr ""
 
 #: src/home/org.freedesktop.home1.policy:64
+msgid "Authentication is required to resize a user's home area."
+msgstr ""
+
+#: src/home/org.freedesktop.home1.policy:73
+msgid "Change password of a home area"
+msgstr ""
+
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr ""
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr ""
 
@@ -1058,6 +1069,14 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr ""
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+msgid "Authentication is required to manage optional features"
+msgstr ""
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr ""
@@ -1094,43 +1113,43 @@ msgid ""
 "shall be enabled."
 msgstr ""
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr ""
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/tr.po

@@ -9,7 +9,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-08-25 11:38+0000\n"
 "Last-Translator: Oğuz Ersen <oguz@ersen.moe>\n"
 "Language-Team: Turkish <https://translate.fedoraproject.org/projects/systemd/"
@@ -117,31 +117,41 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Bir kullanıcının ev alanını güncellemek kimlik doğrulaması gerektirir."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Ev alanını güncelle"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Bir kullanıcının ev alanını güncellemek kimlik doğrulaması gerektirir."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Ev alanını yeniden boyutlandır"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Bir kullanıcının ev alanını yeniden boyutlandırmak kimlik doğrulaması "
 "gerektirir."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Ev alanının parolasını değiştir"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Bir kullanıcının ev alanının parolasını değiştirmek kimlik doğrulaması "
 "gerektirir."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "Bir ev alanını etkinleştir"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr ""
 "Bir kullanıcının ev alanını etkinleştirmek kimlik doğrulaması gerektirir."
@@ -1209,6 +1219,17 @@ msgid "Authentication is required to cleanup old system updates."
 msgstr ""
 "Eski sistem güncellemelerini temizlemek için kimlik doğrulaması gereklidir."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Aktif oturumları, kullanıcıları ve yuvaları yönetmek için kimlik doğrulaması "
+"gereklidir."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Sistem zamanını ayarla"
@@ -1248,23 +1269,23 @@ msgid ""
 msgstr ""
 "Ağ zaman eş zamanlamasını denetlemek için kimlik doğrulaması gereklidir."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "'$(unit)' başlatmak için kimlik doğrulaması gereklidir."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "'$(unit)' durdurmak için kimlik doğrulaması gereklidir."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "'$(unit)' yeniden yüklemek için kimlik doğrulaması gereklidir."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "'$(unit)' yeniden başlatmak için kimlik doğrulaması gereklidir."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
@@ -1272,19 +1293,19 @@ msgstr ""
 "'$(unit)' süreçlerine bir UNIX sinyali göndermek için kimlik doğrulaması "
 "gereklidir."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "'$(unit)'in \"failed\" (başarısız) durumunu sıfırlamak için kimlik "
 "doğrulaması gereklidir."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr ""
 "'$(unit)' üzerindeki özellikleri ayarlamak için kimlik doğrulaması "
 "gereklidir."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1292,7 +1313,7 @@ msgstr ""
 "'$(unit)' ile ilişkili dosyaları ve dizinleri silmek için kimlik doğrulaması "
 "gereklidir."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/uk.po

@@ -7,7 +7,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-08-24 10:36+0000\n"
 "Last-Translator: Yuri Chornoivan <yurchor@ukr.net>\n"
 "Language-Team: Ukrainian <https://translate.fedoraproject.org/projects/"
@@ -118,30 +118,40 @@ msgid "Authentication is required to update a user's home area."
 msgstr "Для оновлення домашньої теки користувача слід пройти розпізнавання."
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "Оновлення домашньої теки"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "Для оновлення домашньої теки користувача слід пройти розпізнавання."
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "Зміна розмірів домашньої теки"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr ""
 "Для зміни розмірів домашньої теки користувача слід пройти розпізнавання."
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "Зміна пароля до домашньої теки"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr ""
 "Для зміни пароля для доступу до домашньої теки користувача слід пройти "
 "розпізнавання."
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "Активація області домівки"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr "Для активації області домівки користувача слід пройти розпізнавання."
 
@@ -1200,6 +1210,17 @@ msgstr "Вилучення застарілих оновлень системи"
 msgid "Authentication is required to cleanup old system updates."
 msgstr "Для вилучення застарілих оновлень системи слід пройти розпізнавання."
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr ""
+"Для того, щоб керувати сеансами, користувачами і робочими місцями, слід "
+"пройти розпізнавання."
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "Встановлення загальносистемного часу"
@@ -1241,39 +1262,39 @@ msgstr ""
 "Для керування тим, чи слід вмикати синхронізацію часу за допомогою мережі, "
 "слід пройти розпізнавання."
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "Для запуску «$(unit)» слід пройти розпізнавання."
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "Для зупинення «$(unit)» слід пройти розпізнавання."
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "Для перезавантаження «$(unit)» слід пройти розпізнавання."
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "Для перезапуску «$(unit)» слід пройти розпізнавання."
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr ""
 "Для надсилання сигналу UNIX до процесів «$(unit)» слід пройти розпізнавання."
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr ""
 "Для скидання «пошкодженого» стану з «$(unit)» слід пройти розпізнавання."
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "Для визначення властивостей на «$(unit)» слід пройти розпізнавання."
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
@@ -1281,7 +1302,7 @@ msgstr ""
 "Для вилучення файлів і каталогів, які пов'язано із «$(unit)», слід пройти "
 "розпізнавання."
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr ""

po/zh_CN.po

@@ -11,7 +11,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-10-13 00:38+0000\n"
 "Last-Translator: lumingzh <lumingzh@qq.com>\n"
 "Language-Team: Chinese (Simplified) <https://translate.fedoraproject.org/"
@@ -112,27 +112,40 @@ msgid "Authentication is required to update a user's home area."
 msgstr "更新用户家区域需要认证。"
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "更新一个家区域"
+
+# Pay attention to the concept of "seat".
+#
+# To fully understand the meaning, please refer to session management in old ConsoleKit and new systemd-logind.
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "更新用户家区域需要认证。"
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "调整家区域大小"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "调整家区域大小需要认证。"
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "更改家区域的密码"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "更改家区域密码需要认证。"
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 msgid "Activate a home area"
 msgstr "创建一个家区域"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 msgid "Authentication is required to activate a user's home area."
 msgstr "创建用户家区域需要认证。"
 
@@ -1080,6 +1093,15 @@ msgstr "清理旧的系统更新"
 msgid "Authentication is required to cleanup old system updates."
 msgstr "清理旧的系统更新需要认证。"
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr "管理活动会话、用户与会话座位需要认证。"
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "设置系统时间"
@@ -1116,43 +1138,43 @@ msgid ""
 "shall be enabled."
 msgstr "打开或关闭网络时间同步需要认证。"
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "启动“$(unit)”需要认证。"
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "停止“$(unit)”需要认证。"
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "重新载入“$(unit)”需要认证。"
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "重新启动“$(unit)”需要认证。"
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr "发送 UNIX 信号给 '$(unit)' 进程需要认证。"
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr "重置“$(unit)”的失败（\"failed\"）状态需要认证。"
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "设置“$(unit)”的属性需要认证。"
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr "删除与 '$(unit)' 关联的文件和目录需要认证。"
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr "冻结或解冻 '$(unit)' 单元进程需要认证。"

po/zh_TW.po

@@ -8,7 +8,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-08-23 15:33+0200\n"
+"POT-Creation-Date: 2024-11-06 14:42+0000\n"
 "PO-Revision-Date: 2024-06-06 00:50+0000\n"
 "Last-Translator: hanjinpeng <hanjinpeng@kylinos.cn>\n"
 "Language-Team: Chinese (Traditional) <https://translate.fedoraproject.org/"
@@ -107,28 +107,38 @@ msgid "Authentication is required to update a user's home area."
 msgstr "更新用戶家區域需要認證。"
 
 #: src/home/org.freedesktop.home1.policy:53
+#, fuzzy
+msgid "Update your home area"
+msgstr "更新一個家區域"
+
+#: src/home/org.freedesktop.home1.policy:54
+#, fuzzy
+msgid "Authentication is required to update your home area."
+msgstr "更新用戶家區域需要認證。"
+
+#: src/home/org.freedesktop.home1.policy:63
 msgid "Resize a home area"
 msgstr "調整家區域大小"
 
-#: src/home/org.freedesktop.home1.policy:54
+#: src/home/org.freedesktop.home1.policy:64
 msgid "Authentication is required to resize a user's home area."
 msgstr "調整家區域大小需要認證。"
 
-#: src/home/org.freedesktop.home1.policy:63
+#: src/home/org.freedesktop.home1.policy:73
 msgid "Change password of a home area"
 msgstr "更改家區域的密碼"
 
-#: src/home/org.freedesktop.home1.policy:64
+#: src/home/org.freedesktop.home1.policy:74
 msgid ""
 "Authentication is required to change the password of a user's home area."
 msgstr "更改家區域密碼需要認證。"
 
-#: src/home/org.freedesktop.home1.policy:73
+#: src/home/org.freedesktop.home1.policy:83
 #, fuzzy
 msgid "Activate a home area"
 msgstr "創建一個家區域"
 
-#: src/home/org.freedesktop.home1.policy:74
+#: src/home/org.freedesktop.home1.policy:84
 #, fuzzy
 msgid "Authentication is required to activate a user's home area."
 msgstr "創建用戶家區域需要身份驗證。"
@@ -1091,6 +1101,15 @@ msgstr ""
 msgid "Authentication is required to cleanup old system updates."
 msgstr "設定系統時間需要驗證。"
 
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:75
+msgid "Manage optional features"
+msgstr ""
+
+#: src/sysupdate/org.freedesktop.sysupdate1.policy:76
+#, fuzzy
+msgid "Authentication is required to manage optional features"
+msgstr "管理活躍的工作階段、使用者與座位需要驗證。"
+
 #: src/timedate/org.freedesktop.timedate1.policy:22
 msgid "Set system time"
 msgstr "設定系統時間"
@@ -1127,43 +1146,43 @@ msgid ""
 "shall be enabled."
 msgstr "控制網路時間同步是否啟用需要驗證。"
 
-#: src/core/dbus-unit.c:353
+#: src/core/dbus-unit.c:370
 msgid "Authentication is required to start '$(unit)'."
 msgstr "啟動 '$(unit)' 需要驗證。"
 
-#: src/core/dbus-unit.c:354
+#: src/core/dbus-unit.c:371
 msgid "Authentication is required to stop '$(unit)'."
 msgstr "停止 '$(unit)' 需要驗證。"
 
-#: src/core/dbus-unit.c:355
+#: src/core/dbus-unit.c:372
 msgid "Authentication is required to reload '$(unit)'."
 msgstr "重新載入 '$(unit)' 需要驗證。"
 
-#: src/core/dbus-unit.c:356 src/core/dbus-unit.c:357
+#: src/core/dbus-unit.c:373 src/core/dbus-unit.c:374
 msgid "Authentication is required to restart '$(unit)'."
 msgstr "重新啟動 '$(unit)' 需要驗證。"
 
-#: src/core/dbus-unit.c:549
+#: src/core/dbus-unit.c:566
 msgid ""
 "Authentication is required to send a UNIX signal to the processes of "
 "'$(unit)'."
 msgstr "傳送 UNIX 信號至「$(unit)」的程序需要身份驗證。"
 
-#: src/core/dbus-unit.c:577
+#: src/core/dbus-unit.c:594
 msgid "Authentication is required to reset the \"failed\" state of '$(unit)'."
 msgstr "重置 '$(unit)' 的「失敗」狀態需要驗證。"
 
-#: src/core/dbus-unit.c:607
+#: src/core/dbus-unit.c:624
 msgid "Authentication is required to set properties on '$(unit)'."
 msgstr "在 '$(unit)' 上設定屬性需要驗證。"
 
-#: src/core/dbus-unit.c:704
+#: src/core/dbus-unit.c:721
 msgid ""
 "Authentication is required to delete files and directories associated with "
 "'$(unit)'."
 msgstr "刪除與 '$(unit)' 相關的檔案及目錄需要身份驗證。"
 
-#: src/core/dbus-unit.c:741
+#: src/core/dbus-unit.c:758
 msgid ""
 "Authentication is required to freeze or thaw the processes of '$(unit)' unit."
 msgstr "凍結或解凍「$(unit)」的程序需要身份驗證。"

src/boot/authenticode.h

@@ -0,0 +1,135 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include <openssl/asn1t.h>
+
+#include "macro.h"
+
+#define SPC_INDIRECT_DATA_OBJID "1.3.6.1.4.1.311.2.1.4"
+#define SPC_PE_IMAGE_DATA_OBJID "1.3.6.1.4.1.311.2.1.15"
+
+typedef struct {
+        ASN1_OBJECT *type;
+        ASN1_TYPE *value;
+} SpcAttributeTypeAndOptionalValue;
+
+DECLARE_ASN1_FUNCTIONS(SpcAttributeTypeAndOptionalValue);
+
+ASN1_SEQUENCE(SpcAttributeTypeAndOptionalValue) = {
+        ASN1_SIMPLE(SpcAttributeTypeAndOptionalValue, type, ASN1_OBJECT),
+        ASN1_OPT(SpcAttributeTypeAndOptionalValue, value, ASN1_ANY)
+} ASN1_SEQUENCE_END(SpcAttributeTypeAndOptionalValue);
+
+IMPLEMENT_ASN1_FUNCTIONS(SpcAttributeTypeAndOptionalValue);
+
+typedef struct {
+        ASN1_OBJECT *algorithm;
+        ASN1_TYPE *parameters;
+} AlgorithmIdentifier;
+
+DECLARE_ASN1_FUNCTIONS(AlgorithmIdentifier);
+
+ASN1_SEQUENCE(AlgorithmIdentifier) = {
+        ASN1_SIMPLE(AlgorithmIdentifier, algorithm, ASN1_OBJECT),
+        ASN1_OPT(AlgorithmIdentifier, parameters, ASN1_ANY)
+} ASN1_SEQUENCE_END(AlgorithmIdentifier)
+
+IMPLEMENT_ASN1_FUNCTIONS(AlgorithmIdentifier);
+
+typedef struct {
+        AlgorithmIdentifier *digestAlgorithm;
+        ASN1_OCTET_STRING *digest;
+} DigestInfo;
+
+DECLARE_ASN1_FUNCTIONS(DigestInfo);
+
+ASN1_SEQUENCE(DigestInfo) = {
+        ASN1_SIMPLE(DigestInfo, digestAlgorithm, AlgorithmIdentifier),
+        ASN1_SIMPLE(DigestInfo, digest, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END(DigestInfo);
+
+IMPLEMENT_ASN1_FUNCTIONS(DigestInfo);
+
+typedef struct {
+        SpcAttributeTypeAndOptionalValue *data;
+        DigestInfo *messageDigest;
+} SpcIndirectDataContent;
+
+DECLARE_ASN1_FUNCTIONS(SpcIndirectDataContent);
+
+ASN1_SEQUENCE(SpcIndirectDataContent) = {
+        ASN1_SIMPLE(SpcIndirectDataContent, data, SpcAttributeTypeAndOptionalValue),
+        ASN1_SIMPLE(SpcIndirectDataContent, messageDigest, DigestInfo)
+} ASN1_SEQUENCE_END(SpcIndirectDataContent);
+
+IMPLEMENT_ASN1_FUNCTIONS(SpcIndirectDataContent);
+
+DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(SpcIndirectDataContent*, SpcIndirectDataContent_free, NULL);
+
+typedef struct {
+        int type;
+        union {
+                ASN1_BMPSTRING *unicode;
+                ASN1_IA5STRING *ascii;
+        } value;
+} SpcString;
+
+DECLARE_ASN1_FUNCTIONS(SpcString);
+
+ASN1_CHOICE(SpcString) = {
+        ASN1_IMP_OPT(SpcString, value.unicode, ASN1_BMPSTRING, 0),
+        ASN1_IMP_OPT(SpcString, value.ascii, ASN1_IA5STRING, 1)
+} ASN1_CHOICE_END(SpcString);
+
+IMPLEMENT_ASN1_FUNCTIONS(SpcString);
+
+typedef struct {
+        ASN1_OCTET_STRING *classId;
+        ASN1_OCTET_STRING *serializedData;
+} SpcSerializedObject;
+
+DECLARE_ASN1_FUNCTIONS(SpcSerializedObject);
+
+ASN1_SEQUENCE(SpcSerializedObject) = {
+        ASN1_SIMPLE(SpcSerializedObject, classId, ASN1_OCTET_STRING),
+        ASN1_SIMPLE(SpcSerializedObject, serializedData, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END(SpcSerializedObject);
+
+IMPLEMENT_ASN1_FUNCTIONS(SpcSerializedObject);
+
+typedef struct {
+        int type;
+        union {
+                ASN1_IA5STRING *url;
+                SpcSerializedObject *moniker;
+                SpcString *file;
+        } value;
+} SpcLink;
+
+DECLARE_ASN1_FUNCTIONS(SpcLink);
+
+ASN1_CHOICE(SpcLink) = {
+        ASN1_IMP_OPT(SpcLink, value.url, ASN1_IA5STRING, 0),
+        ASN1_IMP_OPT(SpcLink, value.moniker, SpcSerializedObject, 1),
+        ASN1_EXP_OPT(SpcLink, value.file, SpcString, 2)
+} ASN1_CHOICE_END(SpcLink);
+
+IMPLEMENT_ASN1_FUNCTIONS(SpcLink);
+
+DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(SpcLink*, SpcLink_free, NULL);
+
+typedef struct {
+        ASN1_BIT_STRING *flags;
+        SpcLink *file;
+} SpcPeImageData;
+
+DECLARE_ASN1_FUNCTIONS(SpcPeImageData);
+
+ASN1_SEQUENCE(SpcPeImageData) = {
+        ASN1_SIMPLE(SpcPeImageData, flags, ASN1_BIT_STRING),
+        ASN1_EXP_OPT(SpcPeImageData, file, SpcLink, 0)
+} ASN1_SEQUENCE_END(SpcPeImageData)
+
+IMPLEMENT_ASN1_FUNCTIONS(SpcPeImageData);
+
+DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(SpcPeImageData*, SpcPeImageData_free, NULL);

src/boot/efi/UEFI_SECURITY.md

@@ -54,7 +54,7 @@ libraries (such as OpenSSL or gnu-efi) are linked, embedded, or used.
 
 ## Additional Resources
 BLS Type #1 entries allow the user to load two types of additional resources that can affect the system
-before `ExitBootServices()` has been called — kernel command line arguments and Devicetree blobs — that are
+before `ExitBootServices()` has been called — kernel command line arguments and DeviceTree blobs — that are
 not validated before use, as they do not carry signatures. For this reason, when SecureBoot is enabled,
 loading these resources is automatically disabled. There is no override for this security mechanism, neither
 at build time nor at runtime. Note that initrds are also not verified in BLS Type #1 configurations, for
@@ -62,7 +62,7 @@ compatibility with how SecureBoot has been traditionally handled on Linux-based
 only load them after `ExitBootServices()` has been called.
 
 Another mechanism is supported by `systemd-boot` and `systemd-stub` to add additional payloads to the boot
-process: "addons". Addons are PE signed binaries that can carry kernel command line arguments or Devicetree
+process: "addons". Addons are PE signed binaries that can carry kernel command line arguments or DeviceTree
 blobs (more payload types might be added in the future).
 In contrast to the user-specified additions in the Type #1 case
 described above, these addons are loaded through the UEFI image loading protocol, and thus are subject to

src/boot/efi/chid.c

@@ -49,7 +49,7 @@ static char16_t *smbios_to_hashable_string(const char *str) {
 
 /* This has to be in a struct due to _cleanup_ in populate_board_chids */
 typedef struct SmbiosInfo {
-        const char16_t *smbios_fields[_CHID_SMBIOS_FIELDS_MAX];
+        char16_t *smbios_fields[_CHID_SMBIOS_FIELDS_MAX];
 } SmbiosInfo;
 
 static void smbios_info_populate(SmbiosInfo *ret_info) {
@@ -71,7 +71,7 @@ static void smbios_info_populate(SmbiosInfo *ret_info) {
 
 static void smbios_info_done(SmbiosInfo *info) {
         FOREACH_ELEMENT(i, info->smbios_fields)
-                free(i);
+                free(*i);
 }
 
 static EFI_STATUS populate_board_chids(EFI_GUID ret_chids[static CHID_TYPES_MAX]) {
@@ -81,7 +81,7 @@ static EFI_STATUS populate_board_chids(EFI_GUID ret_chids[static CHID_TYPES_MAX]
                 return EFI_INVALID_PARAMETER;
 
         smbios_info_populate(&info);
-        chid_calculate(info.smbios_fields, ret_chids);
+        chid_calculate((const char16_t *const *) info.smbios_fields, ret_chids);
 
         return EFI_SUCCESS;
 }

src/boot/efi/devicetree.c

@@ -131,6 +131,7 @@ static const char* devicetree_get_compatible(const void *dtb) {
 
         if (struct_off % sizeof(uint32_t) != 0)
                 return NULL;
+
         if (struct_size % sizeof(uint32_t) != 0 ||
             !ADD_SAFE(&end, struct_off, struct_size) ||
             end > strings_off)
@@ -150,7 +151,7 @@ static const char* devicetree_get_compatible(const void *dtb) {
                         break;
                 case FDT_PROP:
                         /* At least 3 words should present: len, name_off, c (nul-terminated string always has non-zero length) */
-                        if (i + 3 >= size_words || cursor[++i] != 0)
+                        if (i + 3 >= size_words)
                                 return NULL;
                         len = be32toh(cursor[++i]);
                         name_off = be32toh(cursor[++i]);
@@ -178,8 +179,8 @@ bool firmware_devicetree_exists(void) {
         return !!find_configuration_table(MAKE_GUID_PTR(EFI_DTB_TABLE));
 }
 
-/* This function checks if the firmware provided Devicetree
- * and a UKI provided Devicetree contain the same first entry
+/* This function checks if the firmware provided DeviceTree
+ * and a UKI provided DeviceTree contain the same first entry
  * on their respective "compatible" fields (which usually defines
  * the actual device model). More specifically, given the FW/UKI
  * "compatible" property pair:

src/boot/efi/pe.c

@@ -253,7 +253,7 @@ static void pe_locate_sections_internal(
                                                   j->VirtualSize,
                                                   device_table,
                                                   device,
-                                                  i))
+                                                  (PTR_TO_SIZE(j) - PTR_TO_SIZE(section_table)) / sizeof(*j)))
                                         continue;
                         }
 

src/boot/measure.c

@@ -98,7 +98,7 @@ static int help(int argc, char *argv[], void *userdata) {
                "     --initrd=PATH       Path to initrd image file              %7$s .initrd\n"
                "     --ucode=PATH        Path to microcode image file           %7$s .ucode\n"
                "     --splash=PATH       Path to splash bitmap file             %7$s .splash\n"
-               "     --dtb=PATH          Path to Devicetree file                %7$s .dtb\n"
+               "     --dtb=PATH          Path to DeviceTree file                %7$s .dtb\n"
                "     --uname=PATH        Path to 'uname -r' file                %7$s .uname\n"
                "     --sbat=PATH         Path to SBAT file                      %7$s .sbat\n"
                "     --pcrpkey=PATH      Path to public key for PCR signatures  %7$s .pcrpkey\n"
@@ -839,7 +839,7 @@ static int verb_sign(int argc, char *argv[], void *userdata) {
         /* When signing we only support JSON output */
         arg_json_format_flags &= ~SD_JSON_FORMAT_OFF;
 
-        /* This must be done before openssl_load_key_from_token() otherwise it will get stuck */
+        /* This must be done before openssl_load_private_key() otherwise it will get stuck */
         if (arg_certificate) {
                 r = openssl_load_x509_certificate(arg_certificate, &certificate);
                 if (r < 0)

src/boot/meson.build

@@ -62,6 +62,14 @@ executables += [
                 'sources' : files('measure.c'),
                 'dependencies' : libopenssl,
         },
+        libexec_template + {
+                'name' : 'systemd-sbsign',
+                'conditions' : [
+                        'HAVE_OPENSSL',
+                ],
+                'sources' : files('sbsign.c'),
+                'dependencies' : libopenssl,
+        },
         libexec_template + {
                 'name' : 'systemd-boot-check-no-failures',
                 'sources' : files('boot-check-no-failures.c'),

src/boot/sbsign.c

@@ -0,0 +1,523 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include <getopt.h>
+
+#include "ansi-color.h"
+#include "authenticode.h"
+#include "build.h"
+#include "copy.h"
+#include "efi-fundamental.h"
+#include "fd-util.h"
+#include "log.h"
+#include "main-func.h"
+#include "openssl-util.h"
+#include "parse-argument.h"
+#include "pe-binary.h"
+#include "pretty-print.h"
+#include "stat-util.h"
+#include "tmpfile-util.h"
+#include "verbs.h"
+
+static PagerFlags arg_pager_flags = 0;
+static char *arg_output = NULL;
+static char *arg_certificate = NULL;
+static char *arg_private_key = NULL;
+static KeySourceType arg_private_key_source_type = OPENSSL_KEY_SOURCE_FILE;
+static char *arg_private_key_source = NULL;
+
+STATIC_DESTRUCTOR_REGISTER(arg_output, freep);
+STATIC_DESTRUCTOR_REGISTER(arg_certificate, freep);
+STATIC_DESTRUCTOR_REGISTER(arg_private_key, freep);
+STATIC_DESTRUCTOR_REGISTER(arg_private_key_source, freep);
+
+static int help(int argc, char *argv[], void *userdata) {
+        _cleanup_free_ char *link = NULL;
+        int r;
+
+        r = terminal_urlify_man("systemd-sbsign", "1", &link);
+        if (r < 0)
+                return log_oom();
+
+        printf("%1$s  [OPTIONS...] COMMAND ...\n"
+               "\n%5$sSign binaries for EFI Secure Boot%6$s\n"
+               "\n%3$sCommands:%4$s\n"
+               "  sign EXEFILE           Sign the given binary for EFI Secure Boot\n"
+               "  validate-key           Load and validate the given private key\n"
+               "\n%3$sOptions:%4$s\n"
+               "  -h --help              Show this help\n"
+               "     --version           Print version\n"
+               "     --no-pager          Do not pipe output into a pager\n"
+               "     --output            Where to write the signed PE binary\n"
+               "     --certificate=PATH  PEM certificate to use when signing with a URI\n"
+               "     --private-key=KEY   Private key (PEM) to sign with\n"
+               "     --private-key-source=file|provider:PROVIDER|engine:ENGINE\n"
+               "                         Specify how to use KEY for --private-key=. Allows\n"
+               "                         an OpenSSL engine/provider to be used for signing\n"
+               "\nSee the %2$s for details.\n",
+               program_invocation_short_name,
+               link,
+               ansi_underline(),
+               ansi_normal(),
+               ansi_highlight(),
+               ansi_normal());
+
+        return 0;
+}
+
+static int parse_argv(int argc, char *argv[]) {
+        enum {
+                ARG_VERSION = 0x100,
+                ARG_NO_PAGER,
+                ARG_OUTPUT,
+                ARG_CERTIFICATE,
+                ARG_PRIVATE_KEY,
+                ARG_PRIVATE_KEY_SOURCE,
+        };
+
+        static const struct option options[] = {
+                { "help",               no_argument,       NULL, 'h'                    },
+                { "no-pager",           no_argument,       NULL, ARG_NO_PAGER           },
+                { "version",            no_argument,       NULL, ARG_VERSION            },
+                { "output",             required_argument, NULL, ARG_OUTPUT             },
+                { "certificate",        required_argument, NULL, ARG_CERTIFICATE        },
+                { "private-key",        required_argument, NULL, ARG_PRIVATE_KEY        },
+                { "private-key-source", required_argument, NULL, ARG_PRIVATE_KEY_SOURCE },
+                {}
+        };
+
+        int c, r;
+
+        assert(argc >= 0);
+        assert(argv);
+
+        while ((c = getopt_long(argc, argv, "hjc", options, NULL)) >= 0)
+                switch (c) {
+
+                case 'h':
+                        help(0, NULL, NULL);
+                        return 0;
+
+                case ARG_VERSION:
+                        return version();
+
+                case ARG_NO_PAGER:
+                        arg_pager_flags |= PAGER_DISABLE;
+                        break;
+
+                case ARG_OUTPUT:
+                        r = parse_path_argument(optarg, /*suppress_root=*/ false, &arg_output);
+                        if (r < 0)
+                                return r;
+
+                        break;
+
+                case ARG_CERTIFICATE:
+                        r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_certificate);
+                        if (r < 0)
+                                return r;
+
+                        break;
+
+                case ARG_PRIVATE_KEY:
+                        r = free_and_strdup_warn(&arg_private_key, optarg);
+                        if (r < 0)
+                                return r;
+
+                        break;
+
+                case ARG_PRIVATE_KEY_SOURCE:
+                        r = parse_openssl_key_source_argument(
+                                        optarg,
+                                        &arg_private_key_source,
+                                        &arg_private_key_source_type);
+                        if (r < 0)
+                                return r;
+
+                        break;
+
+                case '?':
+                        return -EINVAL;
+
+                default:
+                        assert_not_reached();
+                }
+
+        if (arg_private_key_source && !arg_certificate)
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "When using --private-key-source=, --certificate= must be specified.");
+
+        return 1;
+}
+
+static int verb_sign(int argc, char *argv[], void *userdata) {
+        _cleanup_(openssl_ask_password_ui_freep) OpenSSLAskPasswordUI *ui = NULL;
+        _cleanup_(EVP_PKEY_freep) EVP_PKEY *private_key = NULL;
+        _cleanup_(X509_freep) X509 *certificate = NULL;
+        int r;
+
+        if (argc < 2)
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "No input file specified");
+
+        if (!arg_certificate)
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+                                       "No certificate specified, use --certificate=");
+
+        if (!arg_private_key)
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+                                       "No private key specified, use --private-key=.");
+
+        if (!arg_output)
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "No output specified, use --output=");
+
+        r = openssl_load_x509_certificate(arg_certificate, &certificate);
+        if (r < 0)
+                return log_error_errno(r, "Failed to load X.509 certificate from %s: %m", arg_certificate);
+
+        if (arg_private_key_source_type == OPENSSL_KEY_SOURCE_FILE) {
+                r = parse_path_argument(arg_private_key, /* suppress_root= */ false, &arg_private_key);
+                if (r < 0)
+                        return log_error_errno(r, "Failed to parse private key path %s: %m", arg_private_key);
+        }
+
+        r = openssl_load_private_key(
+                        arg_private_key_source_type,
+                        arg_private_key_source,
+                        arg_private_key,
+                        &(AskPasswordRequest) {
+                                .id = "sbsign-private-key-pin",
+                                .keyring = arg_private_key,
+                                .credential = "sbsign.private-key-pin",
+                        },
+                        &private_key,
+                        &ui);
+        if (r < 0)
+                return log_error_errno(r, "Failed to load private key from %s: %m", arg_private_key);
+
+        _cleanup_(PKCS7_freep) PKCS7 *p7 = NULL;
+        p7 = PKCS7_sign(certificate, private_key, /*certs=*/ NULL, /*data=*/ NULL, PKCS7_BINARY|PKCS7_PARTIAL);
+        if (!p7)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to allocate pkcs7 signing context: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        STACK_OF(PKCS7_SIGNER_INFO) *si_stack = PKCS7_get_signer_info(p7);
+        if (!si_stack)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get pkcs7 signer info stack: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        PKCS7_SIGNER_INFO *si = sk_PKCS7_SIGNER_INFO_value(si_stack, 0);
+        if (!si)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get pkcs7 signer info: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        int idcnid = OBJ_create(SPC_INDIRECT_DATA_OBJID, "spcIndirectDataContext", "Indirect Data Context");
+
+        if (PKCS7_add_signed_attribute(si, NID_pkcs9_contentType, V_ASN1_OBJECT, OBJ_nid2obj(idcnid)) == 0)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to add signed attribute to pkcs7 signer info: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        _cleanup_close_ int srcfd = open(argv[1], O_RDONLY|O_CLOEXEC);
+        if (srcfd < 0)
+                return log_error_errno(errno, "Failed to open %s: %m", argv[1]);
+
+        struct stat st;
+        if (fstat(srcfd, &st) < 0)
+                return log_debug_errno(errno, "Failed to stat %s: %m", argv[1]);
+
+        r = stat_verify_regular(&st);
+        if (r < 0)
+                return log_debug_errno(r, "%s is not a regular file: %m", argv[1]);
+
+        _cleanup_(unlink_and_freep) char *tmp = NULL;
+        _cleanup_close_ int dstfd = open_tmpfile_linkable(arg_output, O_RDWR|O_CLOEXEC, &tmp);
+        if (dstfd < 0)
+                return log_error_errno(r, "Failed to open temporary file: %m");
+
+        r = copy_bytes(srcfd, dstfd, UINT64_MAX, COPY_REFLINK);
+        if (r < 0)
+                return log_error_errno(r, "Failed to copy %s to %s: %m", argv[1], tmp);
+
+        _cleanup_free_ void *hash = NULL;
+        size_t hashsz;
+        r = pe_hash(dstfd, EVP_sha256(), &hash, &hashsz);
+        if (r < 0)
+                return log_error_errno(r, "Failed to hash PE binary %s: %m", argv[0]);
+
+        /* <<<Obsolete>>> in unicode bytes. */
+        static const uint8_t obsolete[] = {
+                0x00, 0x3c, 0x00, 0x3c, 0x00, 0x3c, 0x00, 0x4f,
+                0x00, 0x62, 0x00, 0x73, 0x00, 0x6f, 0x00, 0x6c,
+                0x00, 0x65, 0x00, 0x74, 0x00, 0x65, 0x00, 0x3e,
+                0x00, 0x3e, 0x00, 0x3e
+        };
+
+        _cleanup_(SpcLink_freep) SpcLink *link = SpcLink_new();
+        if (!link)
+                return log_oom();
+
+        link->type = 2;
+        link->value.file = SpcString_new();
+        if (!link->value.file)
+                return log_oom();
+
+        link->value.file->type = 0;
+        link->value.file->value.unicode = ASN1_BMPSTRING_new();
+        if (!link->value.file->value.unicode)
+                return log_oom();
+
+        if (ASN1_STRING_set(link->value.file->value.unicode, obsolete, sizeof(obsolete)) == 0)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to set ASN1 string: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        _cleanup_(SpcPeImageData_freep) SpcPeImageData *peid = SpcPeImageData_new();
+        if (!peid)
+                return log_oom();
+
+        if (ASN1_BIT_STRING_set_bit(peid->flags, 0, 1) == 0)
+                return log_oom();
+
+        peid->file = TAKE_PTR(link);
+
+        _cleanup_free_ uint8_t *peidraw = NULL;
+        int peidrawsz = i2d_SpcPeImageData(peid, &peidraw);
+        if (peidrawsz < 0)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to convert SpcPeImageData to BER: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        _cleanup_(SpcIndirectDataContent_freep) SpcIndirectDataContent *idc = SpcIndirectDataContent_new();
+        idc->data->value = ASN1_TYPE_new();
+        if (!idc->data->value)
+                return log_oom();
+
+        idc->data->value->type = V_ASN1_SEQUENCE;
+        idc->data->value->value.sequence = ASN1_STRING_new();
+        if (!idc->data->value->value.sequence)
+                return log_oom();
+
+        idc->data->type = OBJ_txt2obj(SPC_PE_IMAGE_DATA_OBJID, /*no_name=*/ 1);
+        if (!idc->data->type)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get SpcPeImageData object: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        idc->data->value->value.sequence->data = TAKE_PTR(peidraw);
+        idc->data->value->value.sequence->length = peidrawsz;
+        idc->messageDigest->digestAlgorithm->algorithm = OBJ_nid2obj(NID_sha256);
+        if (!idc->messageDigest->digestAlgorithm->algorithm)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get SHA256 object: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        idc->messageDigest->digestAlgorithm->parameters = ASN1_TYPE_new();
+        if (!idc->messageDigest->digestAlgorithm->parameters)
+                return log_oom();
+
+        idc->messageDigest->digestAlgorithm->parameters->type = V_ASN1_NULL;
+
+        if (ASN1_OCTET_STRING_set(idc->messageDigest->digest, hash, hashsz) == 0)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to set digest: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        _cleanup_free_ uint8_t *idcraw = NULL;
+        int idcrawsz = i2d_SpcIndirectDataContent(idc, &idcraw);
+        if (idcrawsz < 0)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to convert SpcIndirectDataContent to BER: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        _cleanup_(BIO_free_allp) BIO *bio = PKCS7_dataInit(p7, NULL);
+        if (!bio)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to create PKCS7 data bio: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        int tag, class;
+        long psz;
+        const uint8_t *p = idcraw;
+
+        /* This function weirdly enough reports errors by setting the 0x80 bit in its return value. */
+        if (ASN1_get_object(&p, &psz, &tag, &class, idcrawsz) & 0x80)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to parse ASN.1 object: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        if (BIO_write(bio, p, psz) < 0)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to write to PKCS7 data bio: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        if (PKCS7_final(p7, bio, PKCS7_BINARY) == 0)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to sign data: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        _cleanup_(PKCS7_freep) PKCS7 *p7c = PKCS7_new();
+        if (!p7c)
+                return log_oom();
+
+        p7c->type = OBJ_nid2obj(idcnid);
+        if (!p7c->type)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get SpcIndirectDataContent object: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        p7c->d.other = ASN1_TYPE_new();
+        if (!p7c->d.other)
+                return log_oom();
+
+        p7c->d.other->type = V_ASN1_SEQUENCE;
+        p7c->d.other->value.sequence = ASN1_STRING_new();
+        if (!p7c->d.other->value.sequence)
+                return log_oom();
+
+        if (ASN1_STRING_set(p7c->d.other->value.sequence, idcraw, idcrawsz) == 0)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to set ASN1 string: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        if (PKCS7_set_content(p7, p7c) == 0)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to set PKCS7 data: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        TAKE_PTR(p7c);
+
+        _cleanup_free_ uint8_t *sig = NULL;
+        int sigsz = i2d_PKCS7(p7, &sig);
+        if (sigsz < 0)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to convert PKCS7 signature to DER: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        _cleanup_free_ IMAGE_DOS_HEADER *dos_header = NULL;
+        _cleanup_free_ PeHeader *pe_header = NULL;
+        r = pe_load_headers(srcfd, &dos_header, &pe_header);
+        if (r < 0)
+                return log_error_errno(r, "Failed to load headers from PE file: %m");
+
+        const IMAGE_DATA_DIRECTORY *certificate_table;
+        certificate_table = pe_header_get_data_directory(pe_header, IMAGE_DATA_DIRECTORY_INDEX_CERTIFICATION_TABLE);
+        if (!certificate_table)
+                return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "File lacks certificate table.");
+
+        off_t end = st.st_size;
+        ssize_t n;
+
+        if (st.st_size % 8 != 0) {
+                if (certificate_table->VirtualAddress != 0)
+                        return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Certificate table is not aligned to 8 bytes");
+
+                n = pwrite(dstfd, (const uint8_t[8]) {}, 8 - (st.st_size % 8), st.st_size);
+                if (n < 0)
+                        return log_error_errno(errno, "Failed to write zero padding: %m");
+                if (n != 8 - (st.st_size % 8))
+                        return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing zero padding.");
+
+                end += n;
+        }
+
+        uint32_t certsz = offsetof(WIN_CERTIFICATE, bCertificate) + sigsz;
+        n = pwrite(dstfd,
+                   &(WIN_CERTIFICATE) {
+                           .wRevision = htole16(0x200),
+                           .wCertificateType = htole16(0x0002), /* PKCS7 signedData */
+                           .dwLength = htole32(ROUND_UP(certsz, 8)),
+                   },
+                   sizeof(WIN_CERTIFICATE),
+                   end);
+        if (n < 0)
+                return log_error_errno(errno, "Failed to write certificate header: %m");
+        if (n != sizeof(WIN_CERTIFICATE))
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing certificate header.");
+
+        end += n;
+
+        n = pwrite(dstfd, sig, sigsz, end);
+        if (n < 0)
+                return log_error_errno(errno, "Failed to write signature: %m");
+        if (n != sigsz)
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing signature.");
+
+        end += n;
+
+        if (certsz % 8 != 0) {
+                n = pwrite(dstfd, (const uint8_t[8]) {}, 8 - (certsz % 8), end);
+                if (n < 0)
+                        return log_error_errno(errno, "Failed to write zero padding: %m");
+                if ((size_t) n != 8 - (certsz % 8))
+                        return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing zero padding.");
+        }
+
+        n = pwrite(dstfd,
+                   &(IMAGE_DATA_DIRECTORY) {
+                           .VirtualAddress = certificate_table->VirtualAddress ?: htole32(ROUND_UP(st.st_size, 8)),
+                           .Size = htole32(le32toh(certificate_table->Size) + ROUND_UP(certsz, 8)),
+                   },
+                   sizeof(IMAGE_DATA_DIRECTORY),
+                   le32toh(dos_header->e_lfanew) + PE_HEADER_OPTIONAL_FIELD_OFFSET(pe_header, DataDirectory[IMAGE_DATA_DIRECTORY_INDEX_CERTIFICATION_TABLE]));
+        if (n < 0)
+                return log_error_errno(errno, "Failed to update PE certificate table: %m");
+        if ((size_t) n != sizeof(IMAGE_DATA_DIRECTORY))
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while updating PE certificate table.");
+
+        uint32_t checksum;
+        r = pe_checksum(dstfd, &checksum);
+        if (r < 0)
+                return log_error_errno(r, "Failed to calculate PE file checksum: %m");
+
+        n = pwrite(dstfd,
+                   &(le32_t) { htole32(checksum) },
+                   sizeof(le32_t),
+                   le32toh(dos_header->e_lfanew) + offsetof(PeHeader, optional.CheckSum));
+        if (n < 0)
+                return log_error_errno(errno, "Failed to update PE checksum: %m");
+        if ((size_t) n != sizeof(le32_t))
+                return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while updating PE checksum.");
+
+        r = link_tmpfile(dstfd, tmp, arg_output, LINK_TMPFILE_REPLACE|LINK_TMPFILE_SYNC);
+        if (r < 0)
+                return log_error_errno(r, "Failed to link temporary file to %s: %m", arg_output);
+
+        log_info("Wrote signed PE binary to %s", arg_output);
+        return 0;
+}
+
+static int verb_validate_key(int argc, char *argv[], void *userdata) {
+        _cleanup_(openssl_ask_password_ui_freep) OpenSSLAskPasswordUI *ui = NULL;
+        _cleanup_(EVP_PKEY_freep) EVP_PKEY *private_key = NULL;
+        int r;
+
+        if (!arg_private_key)
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+                                       "No private key specified, use --private-key=.");
+
+        if (arg_private_key_source_type == OPENSSL_KEY_SOURCE_FILE) {
+                r = parse_path_argument(arg_private_key, /* suppress_root= */ false, &arg_private_key);
+                if (r < 0)
+                        return log_error_errno(r, "Failed to parse private key path %s: %m", arg_private_key);
+        }
+
+        r = openssl_load_private_key(
+                        arg_private_key_source_type,
+                        arg_private_key_source,
+                        arg_private_key,
+                        &(AskPasswordRequest) {
+                                .id = "sbsign-private-key-pin",
+                                .keyring = arg_private_key,
+                                .credential = "sbsign.private-key-pin",
+                        },
+                        &private_key,
+                        &ui);
+        if (r < 0)
+                return log_error_errno(r, "Failed to load private key from %s: %m", arg_private_key);
+
+        puts("OK");
+        return 0;
+}
+
+static int run(int argc, char *argv[]) {
+        static const Verb verbs[] = {
+                { "help",         VERB_ANY, VERB_ANY, 0,    help              },
+                { "sign",         2,        2,        0,    verb_sign         },
+                { "validate-key", VERB_ANY, 1,        0,    verb_validate_key },
+                {}
+        };
+        int r;
+
+        log_setup();
+
+        r = parse_argv(argc, argv);
+        if (r <= 0)
+                return r;
+
+        return dispatch_verb(argc, argv, verbs, NULL);
+}
+
+DEFINE_MAIN_FUNCTION(run);

src/fundamental/chid-fundamental.c

@@ -15,14 +15,12 @@
  */
 
 #if SD_BOOT
-#  include "efi-string.h"
 #  include "util.h"
 #else
 #  include <byteswap.h>
 #  include <string.h>
-#  include <uchar.h>
 #  include <utf8.h>
-#define strsize16(str) ((char16_strlen(str) + 1) * sizeof(char16_t))
+#define strlen16 char16_strlen
 #endif
 
 #include "chid-fundamental.h"
@@ -44,7 +42,7 @@ static void get_chid(const char16_t *const smbios_fields[static _CHID_SMBIOS_FIE
                 if ((mask >> i) & 1) {
                         if (i > 0)
                                 sha1_process_bytes(L"&", 2, &ctx);
-                        sha1_process_bytes(smbios_fields[i], strsize16(smbios_fields[i]), &ctx);
+                        sha1_process_bytes(smbios_fields[i], strlen16(smbios_fields[i]) * sizeof(char16_t), &ctx);
                 }
 
         uint8_t hash[SHA1_DIGEST_SIZE];
@@ -112,7 +110,8 @@ static const uint32_t chid_smbios_table[CHID_TYPES_MAX] = {
 void chid_calculate(const char16_t *const smbios_fields[static _CHID_SMBIOS_FIELDS_MAX], EFI_GUID ret_chids[static CHID_TYPES_MAX]) {
         assert(smbios_fields);
         assert(ret_chids);
-        for (size_t i = 0; i < _CHID_SMBIOS_FIELDS_MAX; i++)
+
+        for (size_t i = 0; i < CHID_TYPES_MAX; i++)
                 if (chid_smbios_table[i] != 0)
                         get_chid(smbios_fields, chid_smbios_table[i], &ret_chids[i]);
                 else

src/fundamental/chid-fundamental.h

@@ -2,6 +2,12 @@
 
 #pragma once
 
+#if SD_BOOT
+#  include "efi-string.h"
+#else
+#  include <uchar.h>
+#endif
+
 #include "efi-fundamental.h"
 #include "string-util-fundamental.h"
 

src/fundamental/efi-fundamental.h

@@ -2,7 +2,10 @@
 #pragma once
 
 #if !SD_BOOT
+#  include <stdbool.h>
 #  include <stdint.h>
+#  include <string.h>
+
 /* Matches EFI API definition of the same structure for userspace */
 typedef struct {
         uint32_t Data1;
@@ -11,6 +14,10 @@ typedef struct {
         uint8_t Data4[8];
 } EFI_GUID;
 
+static inline bool efi_guid_equal(const EFI_GUID *a, const EFI_GUID *b) {
+        return memcmp(a, b, sizeof(EFI_GUID)) == 0;
+}
+
 typedef struct {
         EFI_GUID SignatureOwner;
         uint8_t	SignatureData[];

src/fundamental/tpm2-pcr.h

@@ -47,7 +47,7 @@ enum {
 /* The tag used for EV_EVENT_TAG event log records covering the boot loader config */
 #define LOADER_CONF_EVENT_TAG_ID UINT32_C(0xf5bc582a)
 
-/* The tag used for EV_EVENT_TAG event log records covering Devicetree blobs */
+/* The tag used for EV_EVENT_TAG event log records covering DeviceTree blobs */
 #define DEVICETREE_ADDON_EVENT_TAG_ID UINT32_C(0x6c46f751)
 
 /* The tag used for EV_EVENT_TAG event log records covering initrd addons */

src/hostname/hostnamed.c

@@ -502,7 +502,7 @@ try_devicetree:
                 return NULL;
         }
 
-        /* Note that the Devicetree specification uses the very same vocabulary
+        /* Note that the DeviceTree specification uses the very same vocabulary
          * of chassis types as we do, hence we do not need to translate these types:
          *
          * https://github.com/devicetree-org/devicetree-specification/blob/master/source/chapter3-devicenodes.rst */

src/network/networkd-network-gperf.gperf

@@ -150,6 +150,7 @@ Network.IPv4ProxyARPPrivateVLAN,             config_parse_tristate,
 Network.ProxyARP,                            config_parse_tristate,                                    0,                             offsetof(Network, proxy_arp)
 Network.IPv6ProxyNDPAddress,                 config_parse_ipv6_proxy_ndp_address,                      0,                             0
 Network.IPv4ReversePathFilter,               config_parse_ip_reverse_path_filter,                      0,                             offsetof(Network, ipv4_rp_filter)
+Network.MulticastIGMPVersion,                config_parse_ipv4_force_igmp_version,                     0,                             offsetof(Network, ipv4_force_igmp_version)
 Network.BindCarrier,                         config_parse_strv,                                        0,                             offsetof(Network, bind_carrier)
 Network.ConfigureWithoutCarrier,             config_parse_bool,                                        0,                             offsetof(Network, configure_without_carrier)
 Network.IgnoreCarrierLoss,                   config_parse_ignore_carrier_loss,                         0,                             0

src/network/networkd-network.c

@@ -481,6 +481,7 @@ int network_load_one(Manager *manager, OrderedHashmap **networks, const char *fi
                 .proxy_arp = -1,
                 .proxy_arp_pvlan = -1,
                 .ipv4_rp_filter = _IP_REVERSE_PATH_FILTER_INVALID,
+                .ipv4_force_igmp_version = _IPV4_FORCE_IGMP_VERSION_INVALID,
 
                 .ndisc = -1,
                 .ndisc_use_redirect = true,

src/network/networkd-network.h

@@ -340,6 +340,7 @@ struct Network {
         uint32_t ipv6_mtu;
         IPv6PrivacyExtensions ipv6_privacy_extensions;
         IPReversePathFilter ipv4_rp_filter;
+        IPv4ForceIgmpVersion ipv4_force_igmp_version;
         int ipv6_proxy_ndp;
         Set *ipv6_proxy_ndp_addresses;
 

src/network/networkd-sysctl.c

@@ -408,6 +408,18 @@ static int link_set_ipv4_rp_filter(Link *link) {
         return sysctl_write_ip_property_int(AF_INET, link->ifname, "rp_filter", link->network->ipv4_rp_filter, manager_get_sysctl_shadow(link->manager));
 }
 
+static int link_set_ipv4_force_igmp_version(Link *link) {
+        assert(link);
+
+        if (!link_is_configured_for_family(link, AF_INET))
+                return 0;
+
+        if (link->network->ipv4_force_igmp_version < 0)
+                return 0;
+
+        return sysctl_write_ip_property_int(AF_INET, link->ifname, "force_igmp_version", link->network->ipv4_force_igmp_version, manager_get_sysctl_shadow(link->manager));
+}
+
 static int link_set_ipv6_privacy_extensions(Link *link) {
         IPv6PrivacyExtensions val;
 
@@ -723,6 +735,10 @@ int link_set_sysctl(Link *link) {
         if (r < 0)
                 log_link_warning_errno(link, r, "Cannot set IPv4 reverse path filtering for interface, ignoring: %m");
 
+        r = link_set_ipv4_force_igmp_version(link);
+        if (r < 0)
+                log_link_warning_errno(link, r, "Cannot set IPv4 force igmp version, ignoring: %m");
+
         r = link_set_ipv4_promote_secondaries(link);
         if (r < 0)
                 log_link_warning_errno(link, r, "Cannot enable promote_secondaries for interface, ignoring: %m");
@@ -770,3 +786,13 @@ int config_parse_ip_forward_deprecated(
                    "and the same settings in .network files for per-interface setting.");
         return 0;
 }
+
+static const char* const ipv4_force_igmp_version_table[_IPV4_FORCE_IGMP_VERSION_MAX] = {
+        [IPV4_FORCE_IGMP_VERSION_NO] = "no",
+        [IPV4_FORCE_IGMP_VERSION_1]  = "v1",
+        [IPV4_FORCE_IGMP_VERSION_2]  = "v2",
+        [IPV4_FORCE_IGMP_VERSION_3]  = "v3",
+};
+
+DEFINE_STRING_TABLE_LOOKUP(ipv4_force_igmp_version, IPv4ForceIgmpVersion);
+DEFINE_CONFIG_PARSE_ENUM(config_parse_ipv4_force_igmp_version, ipv4_force_igmp_version, IPv4ForceIgmpVersion);

src/network/networkd-sysctl.h

@@ -53,3 +53,18 @@ IPReversePathFilter ip_reverse_path_filter_from_string(const char *s) _pure_;
 CONFIG_PARSER_PROTOTYPE(config_parse_ipv6_privacy_extensions);
 CONFIG_PARSER_PROTOTYPE(config_parse_ip_reverse_path_filter);
 CONFIG_PARSER_PROTOTYPE(config_parse_ip_forward_deprecated);
+
+typedef enum IPv4ForceIgmpVersion {
+        /* These values map to the kernel's /proc/sys/net/ipv4/conf/INTERFACE/force_igmp_version values. Do not reorder! */
+        IPV4_FORCE_IGMP_VERSION_NO = 0,
+        IPV4_FORCE_IGMP_VERSION_1  = 1,
+        IPV4_FORCE_IGMP_VERSION_2  = 2,
+        IPV4_FORCE_IGMP_VERSION_3  = 3,
+        _IPV4_FORCE_IGMP_VERSION_MAX,
+        _IPV4_FORCE_IGMP_VERSION_INVALID = -EINVAL,
+} IPv4ForceIgmpVersion;
+
+const char* ipv4_force_igmp_version_to_string(IPv4ForceIgmpVersion i) _const_;
+IPv4ForceIgmpVersion ipv4_force_igmp_version_from_string(const char *s) _pure_;
+
+CONFIG_PARSER_PROTOTYPE(config_parse_ipv4_force_igmp_version);

src/pcrlock/meson.build

@@ -10,7 +10,6 @@ executables += [
                 'sources' : files(
                         'pcrlock.c',
                         'pcrlock-firmware.c',
-                        'pehash.c',
                 ),
                 'dependencies' : [
                         libm,

src/pcrlock/pcrlock.c

@@ -40,7 +40,7 @@
 #include "path-util.h"
 #include "pcrextend-util.h"
 #include "pcrlock-firmware.h"
-#include "pehash.h"
+#include "pe-binary.h"
 #include "pretty-print.h"
 #include "proc-cmdline.h"
 #include "random-util.h"

src/pcrlock/pehash.c

@@ -1,264 +0,0 @@
-/* SPDX-License-Identifier: LGPL-2.1-or-later */
-
-#include <sys/stat.h>
-#include <unistd.h>
-
-#include "alloc-util.h"
-#include "hexdecoct.h"
-#include "pe-binary.h"
-#include "pehash.h"
-#include "sort-util.h"
-#include "stat-util.h"
-#include "string-table.h"
-
-/* Implements:
- *
- * https://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/authenticode_pe.docx
- * → Section "Calculating the PE Image Hash"
- */
-
-#define IMAGE_DATA_DIRECTORY_INDEX_CERTIFICATION_TABLE 4U
-
-static int hash_file(int fd, EVP_MD_CTX *md_ctx, uint64_t offset, uint64_t size) {
-        uint8_t buffer[64*1024];
-
-        log_debug("Hashing %" PRIu64 " @ %" PRIu64 " → %" PRIu64, size, offset, offset + size);
-
-        while (size > 0) {
-                size_t m = MIN(size, sizeof(buffer));
-                ssize_t n;
-
-                n = pread(fd, buffer, m, offset);
-                if (n < 0)
-                        return log_debug_errno(errno, "Failed to read file for hashing: %m");
-                if ((size_t) n != m)
-                        return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "Short read while hashing.");
-
-                if (EVP_DigestUpdate(md_ctx, buffer, m) != 1)
-                        return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Unable to hash data.");
-
-                offset += m;
-                size -= m;
-        }
-
-        return 0;
-}
-
-static int section_offset_cmp(const IMAGE_SECTION_HEADER *a, const IMAGE_SECTION_HEADER *b) {
-        return CMP(ASSERT_PTR(a)->PointerToRawData, ASSERT_PTR(b)->PointerToRawData);
-}
-
-int pe_hash(int fd,
-            const EVP_MD *md,
-            void **ret_hash,
-            size_t *ret_hash_size) {
-
-        _cleanup_(EVP_MD_CTX_freep) EVP_MD_CTX *mdctx = NULL;
-        _cleanup_free_ IMAGE_SECTION_HEADER *sections = NULL;
-        _cleanup_free_ IMAGE_DOS_HEADER *dos_header = NULL;
-        _cleanup_free_ PeHeader *pe_header = NULL;
-        const IMAGE_DATA_DIRECTORY *certificate_table;
-        struct stat st;
-        uint64_t p, q;
-        int r;
-
-        assert(fd >= 0);
-        assert(md);
-        assert(ret_hash_size);
-        assert(ret_hash);
-
-        if (fstat(fd, &st) < 0)
-                return log_debug_errno(errno, "Failed to stat file: %m");
-        r = stat_verify_regular(&st);
-        if (r < 0)
-                return log_debug_errno(r, "Not a regular file: %m");
-
-        r = pe_load_headers(fd, &dos_header, &pe_header);
-        if (r < 0)
-                return r;
-
-        r = pe_load_sections(fd, dos_header, pe_header, &sections);
-        if (r < 0)
-                return r;
-
-        certificate_table = pe_header_get_data_directory(pe_header, IMAGE_DATA_DIRECTORY_INDEX_CERTIFICATION_TABLE);
-        if (!certificate_table)
-                return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "File lacks certificate table.");
-
-        mdctx = EVP_MD_CTX_new();
-        if (!mdctx)
-                return log_oom_debug();
-
-        if (EVP_DigestInit_ex(mdctx, md, NULL) != 1)
-                return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to allocate message digest.");
-
-        /* Everything from beginning of file to CheckSum field in PE header */
-        p = (uint64_t) dos_header->e_lfanew +
-                offsetof(PeHeader, optional.CheckSum);
-        r = hash_file(fd, mdctx, 0, p);
-        if (r < 0)
-                return r;
-        p += sizeof(le32_t);
-
-        /* Everything between the CheckSum field and the Image Data Directory Entry for the Certification Table */
-        q = (uint64_t) dos_header->e_lfanew +
-                PE_HEADER_OPTIONAL_FIELD_OFFSET(pe_header, DataDirectory[IMAGE_DATA_DIRECTORY_INDEX_CERTIFICATION_TABLE]);
-        r = hash_file(fd, mdctx, p, q - p);
-        if (r < 0)
-                return r;
-        q += sizeof(IMAGE_DATA_DIRECTORY);
-
-        /* The rest of the header + the section table */
-        p = pe_header->optional.SizeOfHeaders;
-        if (p < q)
-                return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "SizeOfHeaders too short.");
-        r = hash_file(fd, mdctx, q, p - q);
-        if (r < 0)
-                return r;
-
-        /* Sort by location in file */
-        typesafe_qsort(sections, pe_header->pe.NumberOfSections, section_offset_cmp);
-
-        FOREACH_ARRAY(section, sections, pe_header->pe.NumberOfSections) {
-                r = hash_file(fd, mdctx, section->PointerToRawData, section->SizeOfRawData);
-                if (r < 0)
-                        return r;
-
-                p += section->SizeOfRawData;
-        }
-
-        if ((uint64_t) st.st_size > p) {
-
-                if (st.st_size - p < certificate_table->Size)
-                        return log_debug_errno(errno, "No space for certificate table, refusing.");
-
-                r = hash_file(fd, mdctx, p, st.st_size - p - certificate_table->Size);
-                if (r < 0)
-                        return r;
-
-                /* If the file size is not a multiple of 8 bytes, pad the hash with zero bytes. */
-                if (st.st_size % 8 != 0 && EVP_DigestUpdate(mdctx, (const uint8_t[8]) {}, 8 - (st.st_size % 8)) != 1)
-                        return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Unable to hash data.");
-        }
-
-        int hsz = EVP_MD_CTX_size(mdctx);
-        if (hsz < 0)
-                return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to get hash size.");
-
-        unsigned hash_size = (unsigned) hsz;
-        _cleanup_free_ void *hash = malloc(hsz);
-        if (!hash)
-                return log_oom_debug();
-
-        if (EVP_DigestFinal_ex(mdctx, hash, &hash_size) != 1)
-                return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to finalize hash function.");
-
-        assert(hash_size == (unsigned) hsz);
-
-        *ret_hash = TAKE_PTR(hash);
-        *ret_hash_size = hash_size;
-
-        return 0;
-}
-
-typedef void* SectionHashArray[_UNIFIED_SECTION_MAX];
-
-static void section_hash_array_done(SectionHashArray *array) {
-        assert(array);
-
-        for (size_t i = 0; i < _UNIFIED_SECTION_MAX; i++)
-                free((*array)[i]);
-}
-
-int uki_hash(int fd,
-             const EVP_MD *md,
-             void* ret_hashes[static _UNIFIED_SECTION_MAX],
-             size_t *ret_hash_size) {
-
-        _cleanup_(section_hash_array_done) SectionHashArray hashes = {};
-        _cleanup_free_ IMAGE_SECTION_HEADER *sections = NULL;
-        _cleanup_free_ IMAGE_DOS_HEADER *dos_header = NULL;
-        _cleanup_free_ PeHeader *pe_header = NULL;
-        int r;
-
-        assert(fd >= 0);
-        assert(ret_hashes);
-        assert(ret_hash_size);
-
-        r = pe_load_headers(fd, &dos_header, &pe_header);
-        if (r < 0)
-                return r;
-
-        r = pe_load_sections(fd, dos_header, pe_header, &sections);
-        if (r < 0)
-                return r;
-
-        int hsz = EVP_MD_size(md);
-        if (hsz < 0)
-                return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to get hash size.");
-
-        FOREACH_ARRAY(section, sections, pe_header->pe.NumberOfSections) {
-                _cleanup_(EVP_MD_CTX_freep) EVP_MD_CTX *mdctx = NULL;
-                _cleanup_free_ char *n = NULL;
-                ssize_t i;
-
-                n = memdup_suffix0(section->Name, sizeof(section->Name));
-                if (!n)
-                        return log_oom_debug();
-
-                i = string_table_lookup(unified_sections, _UNIFIED_SECTION_MAX, n);
-                if (i < 0)
-                        continue;
-
-                if (hashes[i])
-                        return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "Duplicate section");
-
-                mdctx = EVP_MD_CTX_new();
-                if (!mdctx)
-                        return log_oom_debug();
-
-                if (EVP_DigestInit_ex(mdctx, md, NULL) != 1)
-                        return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to allocate message digest.");
-
-                r = hash_file(fd, mdctx, section->PointerToRawData, MIN(section->VirtualSize, section->SizeOfRawData));
-                if (r < 0)
-                        return r;
-
-                if (section->SizeOfRawData < section->VirtualSize) {
-                        uint8_t zeroes[1024] = {};
-                        size_t remaining = section->VirtualSize - section->SizeOfRawData;
-
-                        while (remaining > 0) {
-                                size_t sz = MIN(sizeof(zeroes), remaining);
-
-                                if (EVP_DigestUpdate(mdctx, zeroes, sz) != 1)
-                                        return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Unable to hash data.");
-
-                                remaining -= sz;
-                        }
-                }
-
-                hashes[i] = malloc(hsz);
-                if (!hashes[i])
-                        return log_oom_debug();
-
-                unsigned hash_size = (unsigned) hsz;
-                if (EVP_DigestFinal_ex(mdctx, hashes[i], &hash_size) != 1)
-                        return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to finalize hash function.");
-
-                assert(hash_size == (unsigned) hsz);
-
-                if (DEBUG_LOGGING) {
-                        _cleanup_free_ char *hs = NULL;
-
-                        hs = hexmem(hashes[i], hsz);
-                        log_debug("Section %s with %s is %s.", n, EVP_MD_name(md), strna(hs));
-                }
-        }
-
-        memcpy(ret_hashes, hashes, sizeof(hashes));
-        zero(hashes);
-        *ret_hash_size = (unsigned) hsz;
-
-        return 0;
-}

src/pcrlock/pehash.h

@@ -1,11 +0,0 @@
-/* SPDX-License-Identifier: LGPL-2.1-or-later */
-#pragma once
-
-#include <sys/types.h>
-
-#include "openssl-util.h"
-#include "uki.h"
-
-int pe_hash(int fd, const EVP_MD *md, void **ret_hash, size_t *ret_hash_size);
-
-int uki_hash(int fd, const EVP_MD *md, void *ret_hashes[static _UNIFIED_SECTION_MAX], size_t *ret_hash_size);

src/shared/openssl-util.c

@@ -24,6 +24,8 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(ENGINE*, ENGINE_free, NULL);
 REENABLE_WARNING;
 #  endif
 
+DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(UI_METHOD*, UI_destroy_method, NULL);
+
 /* For each error in the OpenSSL thread error queue, log the provided message and the OpenSSL error
  * string. If there are no errors in the OpenSSL thread queue, this logs the message with "No OpenSSL
  * errors." This logs at level debug. Returns -EIO (or -ENOMEM). */
@@ -1315,12 +1317,10 @@ int pkey_generate_volume_keys(
 static int load_key_from_provider(
                 const char *provider,
                 const char *private_key_uri,
-                OpenSSLAskPasswordUI *ui,
                 EVP_PKEY **ret) {
 
         assert(provider);
         assert(private_key_uri);
-        assert(ui);
         assert(ret);
 
 #if OPENSSL_VERSION_MAJOR >= 3
@@ -1333,8 +1333,8 @@ static int load_key_from_provider(
 
         _cleanup_(OSSL_STORE_closep) OSSL_STORE_CTX *store = OSSL_STORE_open(
                         private_key_uri,
-                        ui->method,
-                        &ui->request,
+                        /*ui_method=*/ NULL,
+                        /*ui_method=*/ NULL,
                         /* post_process= */ NULL,
                         /* post_process_data= */ NULL);
         if (!store)
@@ -1356,10 +1356,9 @@ static int load_key_from_provider(
 #endif
 }
 
-static int load_key_from_engine(const char *engine, const char *private_key_uri, OpenSSLAskPasswordUI *ui, EVP_PKEY **ret) {
+static int load_key_from_engine(const char *engine, const char *private_key_uri, EVP_PKEY **ret) {
         assert(engine);
         assert(private_key_uri);
-        assert(ui);
         assert(ret);
 
 #if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
@@ -1371,13 +1370,7 @@ static int load_key_from_engine(const char *engine, const char *private_key_uri,
         if (ENGINE_init(e) == 0)
                 return log_openssl_errors("Failed to initialize signing engine '%s'", engine);
 
-        if (ENGINE_ctrl(e, ENGINE_CTRL_SET_USER_INTERFACE, /*i=*/ 0, ui->method, /*f=*/ NULL) <= 0)
-                return log_openssl_errors("Failed to set engine user interface");
-
-        if (ENGINE_ctrl(e, ENGINE_CTRL_SET_CALLBACK_DATA, /*i=*/ 0, &ui->request, /*f=*/ NULL) <= 0)
-                return log_openssl_errors("Failed to set engine user interface data");
-
-        _cleanup_(EVP_PKEY_freep) EVP_PKEY *private_key = ENGINE_load_private_key(e, private_key_uri, ui->method, &ui->request);
+        _cleanup_(EVP_PKEY_freep) EVP_PKEY *private_key = ENGINE_load_private_key(e, private_key_uri, /*ui_method=*/ NULL, /*callback_data=*/ NULL);
         if (!private_key)
                 return log_openssl_errors("Failed to load private key from '%s'", private_key_uri);
         REENABLE_WARNING;
@@ -1390,36 +1383,13 @@ static int load_key_from_engine(const char *engine, const char *private_key_uri,
 #endif
 }
 
-int openssl_load_key_from_token(
-                KeySourceType private_key_source_type,
-                const char *private_key_source,
-                const char *private_key,
-                OpenSSLAskPasswordUI *ui,
-                EVP_PKEY **ret_private_key) {
-
-        assert(IN_SET(private_key_source_type, OPENSSL_KEY_SOURCE_ENGINE, OPENSSL_KEY_SOURCE_PROVIDER));
-        assert(private_key_source);
-        assert(ui);
-        assert(private_key);
-
-        switch (private_key_source_type) {
-
-        case OPENSSL_KEY_SOURCE_ENGINE:
-                return load_key_from_engine(private_key_source, private_key, ui, ret_private_key);
-        case OPENSSL_KEY_SOURCE_PROVIDER:
-                return load_key_from_provider(private_key_source, private_key, ui, ret_private_key);
-        default:
-                assert_not_reached();
-        }
-}
-
 static int openssl_ask_password_ui_read(UI *ui, UI_STRING *uis) {
         int r;
 
         switch(UI_get_string_type(uis)) {
         case UIT_PROMPT: {
                 /* If no ask password request was configured use the default openssl UI. */
-                AskPasswordRequest *req = UI_get0_user_data(ui);
+                AskPasswordRequest *req = (AskPasswordRequest*) UI_method_get_ex_data(UI_get_method(ui), 0);
                 if (!req)
                         return (UI_method_get_reader(UI_OpenSSL()))(ui, uis);
 
@@ -1448,10 +1418,41 @@ static int openssl_ask_password_ui_read(UI *ui, UI_STRING *uis) {
                 return (UI_method_get_reader(UI_OpenSSL()))(ui, uis);
         }
 }
-#endif
 
-int openssl_ask_password_ui_new(OpenSSLAskPasswordUI **ret) {
-#if HAVE_OPENSSL
+static int openssl_load_private_key_from_file(const char *path, EVP_PKEY **ret) {
+        _cleanup_(erase_and_freep) char *rawkey = NULL;
+        _cleanup_(BIO_freep) BIO *kb = NULL;
+        _cleanup_(EVP_PKEY_freep) EVP_PKEY *pk = NULL;
+        size_t rawkeysz;
+        int r;
+
+        assert(path);
+        assert(ret);
+
+        r = read_full_file_full(
+                        AT_FDCWD, path, UINT64_MAX, SIZE_MAX,
+                        READ_FULL_FILE_SECURE|READ_FULL_FILE_WARN_WORLD_READABLE|READ_FULL_FILE_CONNECT_SOCKET,
+                        NULL,
+                        &rawkey, &rawkeysz);
+        if (r < 0)
+                return log_debug_errno(r, "Failed to read key file '%s': %m", path);
+
+        kb = BIO_new_mem_buf(rawkey, rawkeysz);
+        if (!kb)
+                return log_oom_debug();
+
+        pk = PEM_read_bio_PrivateKey(kb, NULL, NULL, NULL);
+        if (!pk)
+                return log_debug_errno(SYNTHETIC_ERRNO(EIO), "Failed to parse PEM private key: %s",
+                                       ERR_error_string(ERR_get_error(), NULL));
+
+        if (ret)
+                *ret = TAKE_PTR(pk);
+
+        return 0;
+}
+
+static int openssl_ask_password_ui_new(const AskPasswordRequest *request, OpenSSLAskPasswordUI **ret) {
         assert(ret);
 
         _cleanup_(UI_destroy_methodp) UI_METHOD *method = UI_create_method("systemd-ask-password");
@@ -1467,12 +1468,31 @@ int openssl_ask_password_ui_new(OpenSSLAskPasswordUI **ret) {
 
         *ui = (OpenSSLAskPasswordUI) {
                 .method = TAKE_PTR(method),
+                .request = *request,
         };
 
+        UI_set_default_method(ui->method);
+
+        if (UI_method_set_ex_data(ui->method, 0, &ui->request) == 0)
+                return log_openssl_errors("Failed to set extra data for UI method");
+
         *ret = TAKE_PTR(ui);
         return 0;
+}
+#endif
+
+OpenSSLAskPasswordUI* openssl_ask_password_ui_free(OpenSSLAskPasswordUI *ui) {
+#if HAVE_OPENSSL
+        if (!ui)
+                return NULL;
+
+        assert(UI_get_default_method() == ui->method);
+        UI_set_default_method(UI_OpenSSL());
+        UI_destroy_method(ui->method);
+        return mfree(ui);
 #else
-        return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL is not supported, cannot create ask-password user interface.");
+        assert(ui == NULL);
+        return NULL;
 #endif
 }
 
@@ -1531,43 +1551,6 @@ int openssl_load_x509_certificate(const char *path, X509 **ret) {
 #endif
 }
 
-static int openssl_load_private_key_from_file(const char *path, EVP_PKEY **ret) {
-#if HAVE_OPENSSL
-        _cleanup_(erase_and_freep) char *rawkey = NULL;
-        _cleanup_(BIO_freep) BIO *kb = NULL;
-        _cleanup_(EVP_PKEY_freep) EVP_PKEY *pk = NULL;
-        size_t rawkeysz;
-        int r;
-
-        assert(path);
-        assert(ret);
-
-        r = read_full_file_full(
-                        AT_FDCWD, path, UINT64_MAX, SIZE_MAX,
-                        READ_FULL_FILE_SECURE|READ_FULL_FILE_WARN_WORLD_READABLE|READ_FULL_FILE_CONNECT_SOCKET,
-                        NULL,
-                        &rawkey, &rawkeysz);
-        if (r < 0)
-                return log_debug_errno(r, "Failed to read key file '%s': %m", path);
-
-        kb = BIO_new_mem_buf(rawkey, rawkeysz);
-        if (!kb)
-                return log_oom_debug();
-
-        pk = PEM_read_bio_PrivateKey(kb, NULL, NULL, NULL);
-        if (!pk)
-                return log_debug_errno(SYNTHETIC_ERRNO(EIO), "Failed to parse PEM private key: %s",
-                                       ERR_error_string(ERR_get_error(), NULL));
-
-        if (ret)
-                *ret = TAKE_PTR(pk);
-
-        return 0;
-#else
-        return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL is not supported, cannot load private key.");
-#endif
-}
-
 int openssl_load_private_key(
                 KeySourceType private_key_source_type,
                 const char *private_key_source,
@@ -1575,7 +1558,7 @@ int openssl_load_private_key(
                 const AskPasswordRequest *request,
                 EVP_PKEY **ret_private_key,
                 OpenSSLAskPasswordUI **ret_user_interface) {
-
+#if HAVE_OPENSSL
         int r;
 
         assert(private_key);
@@ -1589,18 +1572,21 @@ int openssl_load_private_key(
                 *ret_user_interface = NULL;
         } else {
                 _cleanup_(openssl_ask_password_ui_freep) OpenSSLAskPasswordUI *ui = NULL;
-                r = openssl_ask_password_ui_new(&ui);
+                r = openssl_ask_password_ui_new(request, &ui);
                 if (r < 0)
                         return log_debug_errno(r, "Failed to allocate ask-password user interface: %m");
 
-                ui->request = *request;
+                switch (private_key_source_type) {
 
-                r = openssl_load_key_from_token(
-                                private_key_source_type,
-                                private_key_source,
-                                private_key,
-                                ui,
-                                ret_private_key);
+                case OPENSSL_KEY_SOURCE_ENGINE:
+                        r = load_key_from_engine(private_key_source, private_key, ret_private_key);
+                        break;
+                case OPENSSL_KEY_SOURCE_PROVIDER:
+                        r = load_key_from_provider(private_key_source, private_key, ret_private_key);
+                        break;
+                default:
+                        assert_not_reached();
+                }
                 if (r < 0)
                         return log_debug_errno(
                                         r,
@@ -1612,6 +1598,9 @@ int openssl_load_private_key(
         }
 
         return 0;
+#else
+        return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL is not supported, cannot load private key.");
+#endif
 }
 
 int parse_openssl_key_source_argument(

src/shared/openssl-util.h

@@ -55,6 +55,7 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(ECDSA_SIG*, ECDSA_SIG_free, NULL);
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(PKCS7*, PKCS7_free, NULL);
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(SSL*, SSL_free, NULL);
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(BIO*, BIO_free, NULL);
+DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(BIO*, BIO_free_all, NULL);
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EVP_MD_CTX*, EVP_MD_CTX_free, NULL);
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(ASN1_OCTET_STRING*, ASN1_OCTET_STRING_free, NULL);
 
@@ -134,59 +135,48 @@ int pubkey_fingerprint(EVP_PKEY *pk, const EVP_MD *md, void **ret, size_t *ret_s
 
 int digest_and_sign(const EVP_MD *md, EVP_PKEY *privkey, const void *data, size_t size, void **ret, size_t *ret_size);
 
-int openssl_load_key_from_token(KeySourceType private_key_source_type, const char *private_key_source, const char *private_key, OpenSSLAskPasswordUI *ui, EVP_PKEY **ret_private_key);
-
 #else
 
 typedef struct X509 X509;
 typedef struct EVP_PKEY EVP_PKEY;
+typedef struct EVP_MD EVP_MD;
 typedef struct UI_METHOD UI_METHOD;
+typedef struct ASN1_TYPE ASN1_TYPE;
+typedef struct ASN1_STRING ASN1_STRING;
 
-static inline void *X509_free(X509 *p) {
+static inline void* X509_free(X509 *p) {
         assert(p == NULL);
         return NULL;
 }
 
-static inline void *EVP_PKEY_free(EVP_PKEY *p) {
+static inline void* EVP_PKEY_free(EVP_PKEY *p) {
         assert(p == NULL);
         return NULL;
 }
 
-static inline void* UI_destroy_method(UI_METHOD *p) {
+static inline void* ASN1_TYPE_free(ASN1_TYPE *p) {
         assert(p == NULL);
         return NULL;
 }
 
-static inline int openssl_load_key_from_token(
-                KeySourceType private_key_source_type,
-                const char *private_key_source,
-                const char *private_key,
-                OpenSSLAskPasswordUI *ui,
-                EVP_PKEY **ret_private_key) {
-
-        return -EOPNOTSUPP;
+static inline void* ASN1_STRING_free(ASN1_STRING *p) {
+        assert(p == NULL);
+        return NULL;
 }
 
 #endif
 
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(X509*, X509_free, NULL);
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(EVP_PKEY*, EVP_PKEY_free, NULL);
-DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(UI_METHOD*, UI_destroy_method, NULL);
+DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(ASN1_TYPE*, ASN1_TYPE_free, NULL);
+DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(ASN1_STRING*, ASN1_STRING_free, NULL);
 
 struct OpenSSLAskPasswordUI {
         AskPasswordRequest request;
         UI_METHOD *method;
 };
 
-int openssl_ask_password_ui_new(OpenSSLAskPasswordUI **ret);
-
-static inline OpenSSLAskPasswordUI* openssl_ask_password_ui_free(OpenSSLAskPasswordUI *ui) {
-        if (!ui)
-                return NULL;
-
-        UI_destroy_method(ui->method);
-        return mfree(ui);
-}
+OpenSSLAskPasswordUI* openssl_ask_password_ui_free(OpenSSLAskPasswordUI *ui);
 
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(OpenSSLAskPasswordUI*, openssl_ask_password_ui_free, NULL);
 

src/shared/pe-binary.c

@@ -1,12 +1,16 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <sys/stat.h>
 #include <unistd.h>
 
 #include "alloc-util.h"
+#include "hexdecoct.h"
 #include "log.h"
 #include "pe-binary.h"
+#include "sort-util.h"
+#include "stat-util.h"
+#include "string-table.h"
 #include "string-util.h"
-#include "uki.h"
 
 bool pe_header_is_64bit(const PeHeader *h) {
         assert(h);
@@ -284,3 +288,312 @@ bool pe_is_native(const PeHeader *pe_header) {
         return false;
 #endif
 }
+
+/* Implements:
+ *
+ * https://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/authenticode_pe.docx
+ * → Section "Calculating the PE Image Hash"
+ */
+
+#if HAVE_OPENSSL
+static int hash_file(int fd, EVP_MD_CTX *md_ctx, uint64_t offset, uint64_t size) {
+        uint8_t buffer[64*1024];
+
+        log_debug("Hashing %" PRIu64 " @ %" PRIu64 " → %" PRIu64, size, offset, offset + size);
+
+        while (size > 0) {
+                size_t m = MIN(size, sizeof(buffer));
+                ssize_t n;
+
+                n = pread(fd, buffer, m, offset);
+                if (n < 0)
+                        return log_debug_errno(errno, "Failed to read file for hashing: %m");
+                if ((size_t) n != m)
+                        return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "Short read while hashing.");
+
+                if (EVP_DigestUpdate(md_ctx, buffer, m) != 1)
+                        return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Unable to hash data.");
+
+                offset += m;
+                size -= m;
+        }
+
+        return 0;
+}
+
+static int section_offset_cmp(const IMAGE_SECTION_HEADER *a, const IMAGE_SECTION_HEADER *b) {
+        return CMP(ASSERT_PTR(a)->PointerToRawData, ASSERT_PTR(b)->PointerToRawData);
+}
+#endif
+
+int pe_hash(int fd,
+            const EVP_MD *md,
+            void **ret_hash,
+            size_t *ret_hash_size) {
+#if HAVE_OPENSSL
+        _cleanup_(EVP_MD_CTX_freep) EVP_MD_CTX *mdctx = NULL;
+        _cleanup_free_ IMAGE_SECTION_HEADER *sections = NULL;
+        _cleanup_free_ IMAGE_DOS_HEADER *dos_header = NULL;
+        _cleanup_free_ PeHeader *pe_header = NULL;
+        const IMAGE_DATA_DIRECTORY *certificate_table;
+        struct stat st;
+        uint64_t p, q;
+        int r;
+
+        assert(fd >= 0);
+        assert(md);
+        assert(ret_hash_size);
+        assert(ret_hash);
+
+        if (fstat(fd, &st) < 0)
+                return log_debug_errno(errno, "Failed to stat file: %m");
+        r = stat_verify_regular(&st);
+        if (r < 0)
+                return log_debug_errno(r, "Not a regular file: %m");
+
+        r = pe_load_headers(fd, &dos_header, &pe_header);
+        if (r < 0)
+                return r;
+
+        r = pe_load_sections(fd, dos_header, pe_header, &sections);
+        if (r < 0)
+                return r;
+
+        certificate_table = pe_header_get_data_directory(pe_header, IMAGE_DATA_DIRECTORY_INDEX_CERTIFICATION_TABLE);
+        if (!certificate_table)
+                return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "File lacks certificate table.");
+
+        mdctx = EVP_MD_CTX_new();
+        if (!mdctx)
+                return log_oom_debug();
+
+        if (EVP_DigestInit_ex(mdctx, md, NULL) != 1)
+                return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to allocate message digest.");
+
+        /* Everything from beginning of file to CheckSum field in PE header */
+        p = (uint64_t) dos_header->e_lfanew +
+                offsetof(PeHeader, optional.CheckSum);
+        r = hash_file(fd, mdctx, 0, p);
+        if (r < 0)
+                return r;
+        p += sizeof(le32_t);
+
+        /* Everything between the CheckSum field and the Image Data Directory Entry for the Certification Table */
+        q = (uint64_t) dos_header->e_lfanew +
+                PE_HEADER_OPTIONAL_FIELD_OFFSET(pe_header, DataDirectory[IMAGE_DATA_DIRECTORY_INDEX_CERTIFICATION_TABLE]);
+        r = hash_file(fd, mdctx, p, q - p);
+        if (r < 0)
+                return r;
+        q += sizeof(IMAGE_DATA_DIRECTORY);
+
+        /* The rest of the header + the section table */
+        p = pe_header->optional.SizeOfHeaders;
+        if (p < q)
+                return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "SizeOfHeaders too short.");
+        r = hash_file(fd, mdctx, q, p - q);
+        if (r < 0)
+                return r;
+
+        /* Sort by location in file */
+        typesafe_qsort(sections, pe_header->pe.NumberOfSections, section_offset_cmp);
+
+        FOREACH_ARRAY(section, sections, pe_header->pe.NumberOfSections) {
+                r = hash_file(fd, mdctx, section->PointerToRawData, section->SizeOfRawData);
+                if (r < 0)
+                        return r;
+
+                p += section->SizeOfRawData;
+        }
+
+        if ((uint64_t) st.st_size > p) {
+
+                if (st.st_size - p < certificate_table->Size)
+                        return log_debug_errno(errno, "No space for certificate table, refusing.");
+
+                r = hash_file(fd, mdctx, p, st.st_size - p - certificate_table->Size);
+                if (r < 0)
+                        return r;
+
+                /* If the file size is not a multiple of 8 bytes, pad the hash with zero bytes. */
+                if (st.st_size % 8 != 0 && EVP_DigestUpdate(mdctx, (const uint8_t[8]) {}, 8 - (st.st_size % 8)) != 1)
+                        return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Unable to hash data.");
+        }
+
+        int hsz = EVP_MD_CTX_size(mdctx);
+        if (hsz < 0)
+                return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to get hash size.");
+
+        unsigned hash_size = (unsigned) hsz;
+        _cleanup_free_ void *hash = malloc(hsz);
+        if (!hash)
+                return log_oom_debug();
+
+        if (EVP_DigestFinal_ex(mdctx, hash, &hash_size) != 1)
+                return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to finalize hash function.");
+
+        assert(hash_size == (unsigned) hsz);
+
+        *ret_hash = TAKE_PTR(hash);
+        *ret_hash_size = hash_size;
+
+        return 0;
+#else
+        return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL is not supported, cannot calculate PE hash.");
+#endif
+}
+
+int pe_checksum(int fd, uint32_t *ret) {
+        _cleanup_free_ IMAGE_DOS_HEADER *dos_header = NULL;
+        _cleanup_free_ PeHeader *pe_header = NULL;
+        struct stat st;
+        int r;
+
+        assert(fd >= 0);
+        assert(ret);
+
+        if (fstat(fd, &st) < 0)
+                return log_debug_errno(errno, "Failed to stat file: %m");
+
+        r = pe_load_headers(fd, &dos_header, &pe_header);
+        if (r < 0)
+                return r;
+
+        uint32_t checksum = 0, checksum_offset = le32toh(dos_header->e_lfanew) + offsetof(PeHeader, optional.CheckSum);
+        size_t off = 0;
+        for (;;) {
+                uint16_t buf[32*1024];
+
+                ssize_t n = pread(fd, buf, sizeof(buf), off);
+                if (n == 0)
+                        break;
+                if (n < 0)
+                        return log_debug_errno(errno, "Failed to read from PE file: %m");
+                if (n % sizeof(uint16_t) != 0)
+                        return log_debug_errno(SYNTHETIC_ERRNO(EIO), "Short read from PE file");
+
+                for (size_t i = 0; i < (size_t) n / 2; i++) {
+                        if (off + i >= checksum_offset && off + i < checksum_offset + sizeof(pe_header->optional.CheckSum))
+                                continue;
+
+                        uint16_t val = le16toh(buf[i]);
+
+                        checksum += val;
+                        checksum = (checksum >> 16) + (checksum & 0xffff);
+                }
+
+                off += n;
+        }
+
+        checksum = (checksum >> 16) + (checksum & 0xffff);
+        checksum += off;
+
+        *ret = checksum;
+        return 0;
+}
+
+#if HAVE_OPENSSL
+typedef void* SectionHashArray[_UNIFIED_SECTION_MAX];
+
+static void section_hash_array_done(SectionHashArray *array) {
+        assert(array);
+
+        for (size_t i = 0; i < _UNIFIED_SECTION_MAX; i++)
+                free((*array)[i]);
+}
+#endif
+
+int uki_hash(int fd,
+             const EVP_MD *md,
+             void* ret_hashes[static _UNIFIED_SECTION_MAX],
+             size_t *ret_hash_size) {
+#if HAVE_OPENSSL
+        _cleanup_(section_hash_array_done) SectionHashArray hashes = {};
+        _cleanup_free_ IMAGE_SECTION_HEADER *sections = NULL;
+        _cleanup_free_ IMAGE_DOS_HEADER *dos_header = NULL;
+        _cleanup_free_ PeHeader *pe_header = NULL;
+        int r;
+
+        assert(fd >= 0);
+        assert(ret_hashes);
+        assert(ret_hash_size);
+
+        r = pe_load_headers(fd, &dos_header, &pe_header);
+        if (r < 0)
+                return r;
+
+        r = pe_load_sections(fd, dos_header, pe_header, &sections);
+        if (r < 0)
+                return r;
+
+        int hsz = EVP_MD_size(md);
+        if (hsz < 0)
+                return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to get hash size.");
+
+        FOREACH_ARRAY(section, sections, pe_header->pe.NumberOfSections) {
+                _cleanup_(EVP_MD_CTX_freep) EVP_MD_CTX *mdctx = NULL;
+                _cleanup_free_ char *n = NULL;
+                ssize_t i;
+
+                n = memdup_suffix0(section->Name, sizeof(section->Name));
+                if (!n)
+                        return log_oom_debug();
+
+                i = string_table_lookup(unified_sections, _UNIFIED_SECTION_MAX, n);
+                if (i < 0)
+                        continue;
+
+                if (hashes[i])
+                        return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "Duplicate section");
+
+                mdctx = EVP_MD_CTX_new();
+                if (!mdctx)
+                        return log_oom_debug();
+
+                if (EVP_DigestInit_ex(mdctx, md, NULL) != 1)
+                        return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to allocate message digest.");
+
+                r = hash_file(fd, mdctx, section->PointerToRawData, MIN(section->VirtualSize, section->SizeOfRawData));
+                if (r < 0)
+                        return r;
+
+                if (section->SizeOfRawData < section->VirtualSize) {
+                        uint8_t zeroes[1024] = {};
+                        size_t remaining = section->VirtualSize - section->SizeOfRawData;
+
+                        while (remaining > 0) {
+                                size_t sz = MIN(sizeof(zeroes), remaining);
+
+                                if (EVP_DigestUpdate(mdctx, zeroes, sz) != 1)
+                                        return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Unable to hash data.");
+
+                                remaining -= sz;
+                        }
+                }
+
+                hashes[i] = malloc(hsz);
+                if (!hashes[i])
+                        return log_oom_debug();
+
+                unsigned hash_size = (unsigned) hsz;
+                if (EVP_DigestFinal_ex(mdctx, hashes[i], &hash_size) != 1)
+                        return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to finalize hash function.");
+
+                assert(hash_size == (unsigned) hsz);
+
+                if (DEBUG_LOGGING) {
+                        _cleanup_free_ char *hs = NULL;
+
+                        hs = hexmem(hashes[i], hsz);
+                        log_debug("Section %s with %s is %s.", n, EVP_MD_name(md), strna(hs));
+                }
+        }
+
+        memcpy(ret_hashes, hashes, sizeof(hashes));
+        zero(hashes);
+        *ret_hash_size = (unsigned) hsz;
+
+        return 0;
+#else
+        return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL is not supported, cannot calculate UKI hash.");
+#endif
+}

src/shared/pe-binary.h

@@ -3,7 +3,12 @@
 
 #include <sys/types.h>
 
+#include "openssl-util.h"
+#include "macro-fundamental.h"
 #include "sparse-endian.h"
+#include "uki.h"
+
+#define IMAGE_DATA_DIRECTORY_INDEX_CERTIFICATION_TABLE 4U
 
 /* When naming things we try to stay close to the official Windows APIs as per:
  * → https://learn.microsoft.com/en-us/windows/win32/debug/pe-format  */
@@ -147,3 +152,9 @@ bool pe_is_uki(const PeHeader *pe_header, const IMAGE_SECTION_HEADER *sections);
 bool pe_is_addon(const PeHeader *pe_header, const IMAGE_SECTION_HEADER *sections);
 
 bool pe_is_native(const PeHeader *pe_header);
+
+int pe_hash(int fd, const EVP_MD *md, void **ret_hash, size_t *ret_hash_size);
+
+int pe_checksum(int fd, uint32_t *ret);
+
+int uki_hash(int fd, const EVP_MD *md, void *ret_hashes[static _UNIFIED_SECTION_MAX], size_t *ret_hash_size);

src/shared/tests.h

@@ -559,3 +559,22 @@ static inline int run_test_table(void) {
                         abort();                                                                                \
                 }                                                                                               \
         })
+
+#define EFI_GUID_Fmt "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x"
+#define EFI_GUID_Arg(guid) (guid).Data1, (guid).Data2, (guid).Data3,                           \
+                           (guid).Data4[0], (guid).Data4[1], (guid).Data4[2], (guid).Data4[3], \
+                           (guid).Data4[4], (guid).Data4[5], (guid).Data4[6], (guid).Data4[7]  \
+
+#define ASSERT_EQ_EFI_GUID(expr1, expr2)                                                                        \
+        ({                                                                                                      \
+                typeof(expr1) _expr1 = (expr1);                                                                 \
+                typeof(expr2) _expr2 = (expr2);                                                                 \
+                if (!efi_guid_equal(_expr1, _expr2)) {                                                          \
+                        log_error("%s:%i: Assertion failed: expected \"%s == %s\", but " EFI_GUID_Fmt           \
+                                  " != " EFI_GUID_Fmt,                                                          \
+                                  PROJECT_FILE, __LINE__,                                                       \
+                                  #expr1, #expr2,                                                               \
+                                  EFI_GUID_Arg(*_expr1), EFI_GUID_Arg(*_expr2));                                \
+                        abort();                                                                                \
+                }                                                                                               \
+        })

src/test/meson.build

@@ -58,6 +58,7 @@ simple_tests += files(
         'test-cgroup-util.c',
         'test-cgroup.c',
         'test-chase.c',
+        'test-chid.c',
         'test-clock.c',
         'test-color-util.c',
         'test-compare-operator.c',

src/test/test-chid.c

@@ -0,0 +1,82 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "chid-fundamental.h"
+#include "string-util.h"
+#include "tests.h"
+
+const char16_t *const test_fields[_CHID_SMBIOS_FIELDS_MAX] = {
+        [CHID_SMBIOS_MANUFACTURER] = u"Micro-Star International Co., Ltd.",
+        [CHID_SMBIOS_PRODUCT_NAME] = u"MS-7D70",
+        [CHID_SMBIOS_PRODUCT_SKU] = u"To be filled by O.E.M.",
+        [CHID_SMBIOS_FAMILY] = u"To be filled by O.E.M.",
+        [CHID_SMBIOS_BASEBOARD_PRODUCT] = u"MPG X670E CARBON WIFI (MS-7D70)",
+        [CHID_SMBIOS_BASEBOARD_MANUFACTURER] = u"Micro-Star International Co., Ltd.",
+};
+
+/* Actual output of `fwupdtool hwids`:
+BiosVendor: American Megatrends International, LLC.
+BiosVersion: 1.E5
+BiosMajorRelease: 5
+BiosMinorRelease: 32
+FirmwareMajorRelease: ff
+FirmwareMinorRelease: ff
+Manufacturer: Micro-Star International Co., Ltd.
+Family: To be filled by O.E.M.
+ProductName: MS-7D70
+ProductSku: To be filled by O.E.M.
+EnclosureKind: 3
+BaseboardManufacturer: Micro-Star International Co., Ltd.
+BaseboardProduct: MPG X670E CARBON WIFI (MS-7D70)
+Hardware IDs
+------------
+{f59668ca-22bc-52a0-b6b5-1f6ce81b08e0}   <- Manufacturer + Family + ProductName + ProductSku + BiosVendor + BiosVersion + BiosMajorRelease + BiosMinorRelease
+{f735f7a0-40da-5bfe-8ac2-0090532ee6d0}   <- Manufacturer + Family + ProductName + BiosVendor + BiosVersion + BiosMajorRelease + BiosMinorRelease
+{25880e68-e005-5ca7-88b6-650de596604f}   <- Manufacturer + ProductName + BiosVendor + BiosVersion + BiosMajorRelease + BiosMinorRelease
+{01e09b32-de05-56ca-b9d1-9486ad5f381d}   <- Manufacturer + Family + ProductName + ProductSku + BaseboardManufacturer + BaseboardProduct
+{cad87a11-1813-507b-9aab-9a5f457b649c}   <- Manufacturer + Family + ProductName + ProductSku
+{377c823d-60d1-55b0-9678-76cd2af9d086}   <- Manufacturer + Family + ProductName
+{28ac9cf2-5bde-59f7-aebe-4b3d008090fe}   <- Manufacturer + ProductSku + BaseboardManufacturer + BaseboardProduct
+{e821e0e2-e11a-5e94-bf5d-ffe53c5e5048}   <- Manufacturer + ProductSku
+{1c092f1d-dc7b-564f-8a3d-128d7292fab8}   <- Manufacturer + ProductName + BaseboardManufacturer + BaseboardProduct
+{c12c1f4a-332d-5d72-aa36-7a3d413b479a}   <- Manufacturer + ProductName
+{28ac9cf2-5bde-59f7-aebe-4b3d008090fe}   <- Manufacturer + Family + BaseboardManufacturer + BaseboardProduct
+{e821e0e2-e11a-5e94-bf5d-ffe53c5e5048}   <- Manufacturer + Family
+{bdd76d3e-147f-58a9-a0b2-42136454ed07}   <- Manufacturer + EnclosureKind
+{b2e58e8b-fb10-5cd0-8fb0-5bd931f1871a}   <- Manufacturer + BaseboardManufacturer + BaseboardProduct
+{50af5797-a2f2-58b1-9a1a-453bcbb2e025}   <- Manufacturer
+Extra Hardware IDs
+------------------
+{e6ff1b45-1955-5701-89ab-04fe2280cb4a}   <- Manufacturer + Family + ProductName + ProductSku + BiosVendor
+{8c4a76b9-e29e-5a3c-9072-9664898ecae6}   <- Manufacturer + Family + ProductName + BiosVendor
+{7b3d90ce-ed79-5951-a48a-764ea9f11146}   <- Manufacturer + BiosVendor
+*/
+
+static const EFI_GUID actual_chids[] = {
+        {0x00000000, 0x0000, 0x0000, {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
+        {0x00000000, 0x0000, 0x0000, {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
+        {0x00000000, 0x0000, 0x0000, {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
+        {0x01e09b32, 0xde05, 0x56ca, {0xb9, 0xd1, 0x94, 0x86, 0xad, 0x5f, 0x38, 0x1d}},
+        {0xcad87a11, 0x1813, 0x507b, {0x9a, 0xab, 0x9a, 0x5f, 0x45, 0x7b, 0x64, 0x9c}},
+        {0x377c823d, 0x60d1, 0x55b0, {0x96, 0x78, 0x76, 0xcd, 0x2a, 0xf9, 0xd0, 0x86}},
+        {0x28ac9cf2, 0x5bde, 0x59f7, {0xae, 0xbe, 0x4b, 0x3d, 0x00, 0x80, 0x90, 0xfe}},
+        {0xe821e0e2, 0xe11a, 0x5e94, {0xbf, 0x5d, 0xff, 0xe5, 0x3c, 0x5e, 0x50, 0x48}},
+        {0x1c092f1d, 0xdc7b, 0x564f, {0x8a, 0x3d, 0x12, 0x8d, 0x72, 0x92, 0xfa, 0xb8}},
+        {0xc12c1f4a, 0x332d, 0x5d72, {0xaa, 0x36, 0x7a, 0x3d, 0x41, 0x3b, 0x47, 0x9a}},
+        {0x28ac9cf2, 0x5bde, 0x59f7, {0xae, 0xbe, 0x4b, 0x3d, 0x00, 0x80, 0x90, 0xfe}},
+        {0xe821e0e2, 0xe11a, 0x5e94, {0xbf, 0x5d, 0xff, 0xe5, 0x3c, 0x5e, 0x50, 0x48}},
+        {0x00000000, 0x0000, 0x0000, {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
+        {0xb2e58e8b, 0xfb10, 0x5cd0, {0x8f, 0xb0, 0x5b, 0xd9, 0x31, 0xf1, 0x87, 0x1a}},
+        {0x00000000, 0x0000, 0x0000, {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
+};
+
+
+TEST(chid) {
+        /* Results compared with output of 'fwupdtool hwids' */
+        EFI_GUID chids[CHID_TYPES_MAX];
+        chid_calculate(test_fields, chids);
+        for (size_t i = 0; i < ELEMENTSOF(chids); i++) {
+                ASSERT_EQ_EFI_GUID(&chids[i], &actual_chids[i]);
+        }
+}
+
+DEFINE_TEST_MAIN(LOG_INFO);

src/udev/udev-builtin-net_id.c

@@ -924,7 +924,7 @@ static int names_devicetree(sd_device *dev, const char *prefix, EventMode mode)
                 char str[ALTIFNAMSIZ];
                 if (snprintf_ok(str, sizeof str, "%sd%u", prefix, i))
                         udev_builtin_add_property(dev, mode, "ID_NET_NAME_ONBOARD", str);
-                log_device_debug(dev, "Devicetree identifier: alias_index=%u %s \"%s\"",
+                log_device_debug(dev, "DeviceTree identifier: alias_index=%u %s \"%s\"",
                                  i, special_glyph(SPECIAL_GLYPH_ARROW_RIGHT), str + strlen(prefix));
                 return 0;
         }

src/ukify/ukify.py

@@ -238,7 +238,9 @@ class UkifyConfig:
     all: bool
     cmdline: Union[str, Path, None]
     devicetree: Path
+    devicetree_auto: list[Path]
     efi_arch: str
+    hwids: Path
     initrd: list[Path]
     join_profiles: list[Path]
     json: Union[Literal['pretty'], Literal['short'], Literal['off']]
@@ -263,6 +265,7 @@ class UkifyConfig:
     sections_by_name: dict[str, 'Section']
     sign_kernel: bool
     signing_engine: Optional[str]
+    signing_provider: Optional[str]
     signtool: Optional[type['SignTool']]
     splash: Optional[Path]
     stub: Path
@@ -363,6 +366,8 @@ DEFAULT_SECTIONS_TO_SHOW = {
     '.ucode':   'binary',
     '.splash':  'binary',
     '.dtb':     'binary',
+    '.dtbauto': 'binary',
+    '.hwids':   'binary',
     '.cmdline': 'text',
     '.osrel':   'text',
     '.uname':   'text',
@@ -445,7 +450,7 @@ class UKI:
             if s.name == '.profile':
                 start = i + 1
 
-        if any(section.name == s.name for s in self.sections[start:]):
+        if any(section.name == s.name for s in self.sections[start:] if s.name != '.dtbauto'):
             raise ValueError(f'Duplicate section {section.name}')
 
         self.sections += [section]
@@ -526,6 +531,45 @@ class SbSign(SignTool):
         return 'No signature table present' in info
 
 
+class SystemdSbSign(SignTool):
+    @staticmethod
+    def sign(input_f: str, output_f: str, opts: UkifyConfig) -> None:
+        assert opts.sb_key is not None
+        assert opts.sb_cert is not None
+
+        tool = find_tool(
+            'systemd-sbsign',
+            '/usr/lib/systemd/systemd-sbsign',
+            opts=opts,
+            msg='systemd-sbsign, required for signing, is not installed',
+        )
+        cmd = [
+            tool,
+            "sign",
+            '--private-key', opts.sb_key,
+            '--certificate', opts.sb_cert,
+            *(
+                ['--private-key-source', f'engine:{opts.signing_engine}']
+                if opts.signing_engine is not None
+                else []
+            ),
+            *(
+                ['--private-key-source', f'provider:{opts.signing_provider}']
+                if opts.signing_provider is not None
+                else []
+            ),
+            input_f,
+            '--output', output_f,
+        ]  # fmt: skip
+
+        print('+', shell_join(cmd))
+        subprocess.check_call(cmd)
+
+    @staticmethod
+    def verify(opts: UkifyConfig) -> bool:
+        raise NotImplementedError('systemd-sbsign cannot yet verify if existing PE binaries are signed')
+
+
 def parse_banks(s: str) -> list[str]:
     banks = re.split(r',|\s+', s)
     # TODO: do some sanity checking here
@@ -574,8 +618,11 @@ def check_inputs(opts: UkifyConfig) -> None:
             continue
 
         if isinstance(value, Path):
-            # Open file to check that we can read it, or generate an exception
-            value.open().close()
+            # Check that we can open the directory or file, or generate and exception
+            if value.is_dir():
+                value.iterdir()
+            else:
+                value.open().close()
         elif isinstance(value, list):
             for item in value:
                 if isinstance(item, Path):
@@ -658,7 +705,16 @@ def call_systemd_measure(uki: UKI, opts: UkifyConfig, profile_start: int = 0) ->
     # PCR measurement
 
     # First, pick up either the base sections or the profile specific sections we shall measure now
-    to_measure = {s.name: s for s in uki.sections[profile_start:] if s.measure}
+    unique_to_measure = {
+        s.name: s for s in uki.sections[profile_start:] if s.measure and s.name != '.dtbauto'
+    }
+
+    dtbauto_to_measure: list[Optional[Section]] = [
+        s for s in uki.sections[profile_start:] if s.measure and s.name == '.dtbauto'
+    ]
+
+    if len(dtbauto_to_measure) == 0:
+        dtbauto_to_measure = [None]
 
     # Then, if we're measuring a profile, lookup the missing sections from the base image.
     if profile_start != 0:
@@ -672,53 +728,68 @@ def call_systemd_measure(uki: UKI, opts: UkifyConfig, profile_start: int = 0) ->
                 continue
 
             # Check if this is a section we already covered above
-            if section.name in to_measure:
+            if section.name in unique_to_measure:
                 continue
 
-            to_measure[section.name] = section
+            unique_to_measure[section.name] = section
 
     if opts.measure:
-        pp_groups = opts.phase_path_groups or []
+        to_measure = unique_to_measure.copy()
 
-        cmd = [
-            measure_tool,
-            'calculate',
-            *(f"--{s.name.removeprefix('.')}={s.content}" for s in to_measure.values()),
-            *(f'--bank={bank}' for bank in banks),
-            # For measurement, the keys are not relevant, so we can lump all the phase paths
-            # into one call to systemd-measure calculate.
-            *(f'--phase={phase_path}' for phase_path in itertools.chain.from_iterable(pp_groups)),
-        ]
+        for dtbauto in dtbauto_to_measure:
+            if dtbauto is not None:
+                to_measure[dtbauto.name] = dtbauto
 
-        print('+', shell_join(cmd))
-        subprocess.check_call(cmd)
+            pp_groups = opts.phase_path_groups or []
+
+            cmd = [
+                measure_tool,
+                'calculate',
+                *(f"--{s.name.removeprefix('.')}={s.content}" for s in to_measure.values()),
+                *(f'--bank={bank}' for bank in banks),
+                # For measurement, the keys are not relevant, so we can lump all the phase paths
+                # into one call to systemd-measure calculate.
+                *(f'--phase={phase_path}' for phase_path in itertools.chain.from_iterable(pp_groups)),
+            ]
+
+            print('+', shell_join(cmd))
+            subprocess.check_call(cmd)
 
     # PCR signing
 
     if opts.pcr_private_keys:
         pcrsigs = []
+        to_measure = dict((k, v) for k, v in unique_to_measure.items())
 
-        cmd = [
-            measure_tool,
-            'sign',
-            *(f"--{s.name.removeprefix('.')}={s.content}" for s in to_measure.values()),
-            *(f'--bank={bank}' for bank in banks),
-        ]
+        for dtbauto in dtbauto_to_measure:
+            if dtbauto is not None:
+                to_measure[dtbauto.name] = dtbauto
 
-        for priv_key, pub_key, group in key_path_groups(opts):
-            extra = [f'--private-key={priv_key}']
-            if opts.signing_engine is not None:
-                assert pub_key
-                extra += [f'--private-key-source=engine:{opts.signing_engine}']
-                extra += [f'--certificate={pub_key}']
-            elif pub_key:
-                extra += [f'--public-key={pub_key}']
-            extra += [f'--phase={phase_path}' for phase_path in group or ()]
+            cmd = [
+                measure_tool,
+                'sign',
+                *(f"--{s.name.removeprefix('.')}={s.content}" for s in to_measure.values()),
+                *(f'--bank={bank}' for bank in banks),
+            ]
 
-            print('+', shell_join(cmd + extra))  # type: ignore
-            pcrsig = subprocess.check_output(cmd + extra, text=True)  # type: ignore
-            pcrsig = json.loads(pcrsig)
-            pcrsigs += [pcrsig]
+            for priv_key, pub_key, group in key_path_groups(opts):
+                extra = [f'--private-key={priv_key}']
+                if opts.signing_engine is not None:
+                    assert pub_key
+                    extra += [f'--private-key-source=engine:{opts.signing_engine}']
+                    extra += [f'--certificate={pub_key}']
+                elif opts.signing_provider is not None:
+                    assert pub_key
+                    extra += [f'--private-key-source=provider:{opts.signing_provider}']
+                    extra += [f'--certificate={pub_key}']
+                elif pub_key:
+                    extra += [f'--public-key={pub_key}']
+                extra += [f'--phase={phase_path}' for phase_path in group or ()]
+
+                print('+', shell_join(cmd + extra))  # type: ignore
+                pcrsig = subprocess.check_output(cmd + extra, text=True)  # type: ignore
+                pcrsig = json.loads(pcrsig)
+                pcrsigs += [pcrsig]
 
         combined = combine_signatures(pcrsigs)
         uki.add_section(Section.create('.pcrsig', combined))
@@ -849,7 +920,7 @@ def pe_add_sections(uki: UKI, output: str) -> None:
         # the one from the kernel to it. It should be small enough to fit in the existing section, so just
         # swap the data.
         for i, s in enumerate(pe.sections[:n_original_sections]):
-            if pe_strip_section_name(s.Name) == section.name:
+            if pe_strip_section_name(s.Name) == section.name and section.name != '.dtbauto':
                 if new_section.Misc_VirtualSize > s.SizeOfRawData:
                     raise PEError(f'Not enough space in existing section {section.name} to append new data.')
 
@@ -921,6 +992,111 @@ def merge_sbat(input_pe: list[Path], input_text: list[str]) -> str:
     )
 
 
+# Keep in sync with EFI_GUID (src/boot/efi/efi.h)
+# uint32_t Data1, uint16_t Data2, uint16_t Data3, uint8_t Data4[8]
+EFI_GUID = tuple[int, int, int, tuple[int, int, int, int, int, int, int, int]]
+EFI_GUID_STRUCT_SIZE = 4 + 2 + 2 + 1 * 8
+
+# Keep in sync with Device (src/boot/efi/chid.h)
+# uint32_t struct_size, uint32_t name_offset, uint32_t compatible_offset, EFI_GUID chid
+DEVICE_STRUCT_SIZE = 4 + 4 + 4 + EFI_GUID_STRUCT_SIZE
+NULL_DEVICE = b'\0' * DEVICE_STRUCT_SIZE
+
+
+def pack_device(offsets: dict[str, int], name: str, compatible: str, chids: list[EFI_GUID]) -> bytes:
+    data = b''
+
+    for data1, data2, data3, data4 in chids:
+        data += struct.pack(
+            '<IIIIHH8B', DEVICE_STRUCT_SIZE, offsets[name], offsets[compatible], data1, data2, data3, *data4
+        )
+
+    assert len(data) == DEVICE_STRUCT_SIZE * len(chids)
+    return data
+
+
+def hex_pairs_list(string: str) -> list[int]:
+    return [int(string[i : i + 2], 16) for i in range(0, len(string), 2)]
+
+
+def pack_strings(strings: set[str], base: int) -> tuple[bytes, dict[str, int]]:
+    blob = b''
+    offsets = {}
+
+    for string in sorted(strings):
+        offsets[string] = base + len(blob)
+        blob += string.encode('utf-8') + b'\00'
+
+    return (blob, offsets)
+
+
+def parse_hwid_dir(path: Path) -> bytes:
+    hwid_files = path.rglob('*.txt')
+
+    strings: set[str] = set()
+    devices: collections.defaultdict[tuple[str, str], list[EFI_GUID]] = collections.defaultdict(list)
+
+    uuid_regexp = re.compile(
+        r'\{[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}\}', re.I
+    )
+
+    for hwid_file in hwid_files:
+        content = hwid_file.open().readlines()
+
+        data: dict[str, str] = {
+            'Manufacturer': '',
+            'Family': '',
+            'Compatible': '',
+        }
+        uuids: list[EFI_GUID] = []
+
+        for line in content:
+            for k in data:
+                if line.startswith(k):
+                    data[k] = line.split(':')[1].strip()
+                    break
+            else:
+                uuid = uuid_regexp.match(line)
+                if uuid is not None:
+                    d1, d2, d3, d4, d5 = uuid.group(0)[1:-1].split('-')
+
+                    data1 = int(d1, 16)
+                    data2 = int(d2, 16)
+                    data3 = int(d3, 16)
+                    data4 = cast(
+                        tuple[int, int, int, int, int, int, int, int],
+                        tuple(hex_pairs_list(d4) + hex_pairs_list(d5)),
+                    )
+
+                    uuids.append((data1, data2, data3, data4))
+
+        for k, v in data.items():
+            if not v:
+                raise ValueError(f'hwid description file "{hwid_file}" does not contain "{k}"')
+
+        name = data['Manufacturer'] + ' ' + data['Family']
+        compatible = data['Compatible']
+
+        strings |= set([name, compatible])
+
+        # (compatible, name) pair uniquely identifies the device
+        devices[(compatible, name)] += uuids
+
+    total_device_structs = 1
+    for dev, uuids in devices.items():
+        total_device_structs += len(uuids)
+
+    strings_blob, offsets = pack_strings(strings, total_device_structs * DEVICE_STRUCT_SIZE)
+
+    devices_blob = b''
+    for (compatible, name), uuids in devices.items():
+        devices_blob += pack_device(offsets, name, compatible, uuids)
+
+    devices_blob += NULL_DEVICE
+
+    return devices_blob + strings_blob
+
+
 STUB_SBAT = """\
 sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
 uki,1,UKI,uki,1,https://uapi-group.org/specifications/specs/unified_kernel_image/
@@ -965,9 +1141,9 @@ def make_uki(opts: UkifyConfig) -> None:
     if pcrpkey is None:
         if opts.pcr_public_keys and len(opts.pcr_public_keys) == 1:
             pcrpkey = opts.pcr_public_keys[0]
-            # If we are getting a certificate when using an engine, we need to convert it to public key
-            # format
-            if opts.signing_engine is not None and Path(pcrpkey).exists():
+            # If we are getting a certificate when using an engine or provider, we need to convert it to
+            # public key format.
+            if (opts.signing_engine or opts.signing_provider) and Path(pcrpkey).exists():
                 from cryptography.hazmat.primitives import serialization
                 from cryptography.x509 import load_pem_x509_certificate
 
@@ -992,11 +1168,18 @@ def make_uki(opts: UkifyConfig) -> None:
                 format=serialization.PublicFormat.SubjectPublicKeyInfo,
             )
 
+    hwids = None
+
+    if opts.hwids is not None:
+        hwids = parse_hwid_dir(opts.hwids)
+
     sections = [
         # name,      content,         measure?
         ('.osrel',   opts.os_release, True),
         ('.cmdline', opts.cmdline,    True),
         ('.dtb',     opts.devicetree, True),
+        *(('.dtbauto', dtb, True) for dtb in opts.devicetree_auto),
+        ('.hwids',   hwids,           True),
         ('.uname',   opts.uname,      True),
         ('.splash',  opts.splash,     True),
         ('.pcrpkey', pcrpkey,         True),
@@ -1440,10 +1623,10 @@ class ConfigItem:
         else:
             conv = lambda s: s  # noqa: E731
 
-        # This is a bit ugly, but --initrd is the only option which is specified
+        # This is a bit ugly, but --initrd and --devicetree-auto are the only options
         # with multiple args on the command line and a space-separated list in the
         # config file.
-        if self.name == '--initrd':
+        if self.name in ['--initrd', '--devicetree-auto']:
             value = [conv(v) for v in value.split()]
         else:
             value = conv(value)
@@ -1477,6 +1660,8 @@ class SignToolAction(argparse.Action):
             setattr(namespace, 'signtool', SbSign)
         elif values == 'pesign':
             setattr(namespace, 'signtool', PeSign)
+        elif values == 'systemd-sbsign':
+            setattr(namespace, 'signtool', SystemdSbSign)
         else:
             raise ValueError(f"Unknown signtool '{values}' (this is unreachable)")
 
@@ -1554,6 +1739,23 @@ CONFIG_ITEMS = [
         help='Device Tree file [.dtb section]',
         config_key='UKI/DeviceTree',
     ),
+    ConfigItem(
+        '--devicetree-auto',
+        metavar='PATH',
+        type=Path,
+        action='append',
+        help='DeviceTree file for automatic selection [.dtbauto section]',
+        default=[],
+        config_key='UKI/DeviceTreeAuto',
+        config_push=ConfigItem.config_list_prepend,
+    ),
+    ConfigItem(
+        '--hwids',
+        metavar='DIR',
+        type=Path,
+        help='Directory with HWID text files [.hwids section]',
+        config_key='UKI/HWIDs',
+    ),
     ConfigItem(
         '--uname',
         metavar='VERSION',
@@ -1622,9 +1824,15 @@ CONFIG_ITEMS = [
         help='OpenSSL engine to use for signing',
         config_key='UKI/SigningEngine',
     ),
+    ConfigItem(
+        '--signing-provider',
+        metavar='PROVIDER',
+        help='OpenSSL provider to use for signing',
+        config_key='UKI/SigningProvider',
+    ),
     ConfigItem(
         '--signtool',
-        choices=('sbsign', 'pesign'),
+        choices=('sbsign', 'pesign', 'systemd-sbsign'),
         action=SignToolAction,
         dest='signtool',
         help=(
@@ -1637,7 +1845,7 @@ CONFIG_ITEMS = [
     ConfigItem(
         '--secureboot-private-key',
         dest='sb_key',
-        help='required by --signtool=sbsign. Path to key file or engine-specific designation for SB signing',
+        help='required by --signtool=sbsign|systemd-sbsign. Path to key file or engine/provider designation for SB signing',  # noqa: E501
         config_key='UKI/SecureBootPrivateKey',
     ),
     ConfigItem(
@@ -1686,7 +1894,7 @@ CONFIG_ITEMS = [
         '--pcr-private-key',
         dest='pcr_private_keys',
         action='append',
-        help='private part of the keypair or engine-specific designation for signing PCR signatures',
+        help='private part of the keypair or engine/provider designation for signing PCR signatures',
         config_key='PCRSignature:/PCRPrivateKey',
         config_push=ConfigItem.config_set_group,
     ),
@@ -1696,7 +1904,7 @@ CONFIG_ITEMS = [
         metavar='PATH',
         type=Path,
         action='append',
-        help='public part of the keypair or engine-specific designation for signing PCR signatures',
+        help='public part of the keypair or engine/provider designation for signing PCR signatures',
         config_key='PCRSignature:/PCRPublicKey',
         config_push=ConfigItem.config_set_group,
     ),
@@ -1927,7 +2135,10 @@ def finalize_options(opts: argparse.Namespace) -> None:
         else:
             opts.stub = Path(f'/usr/lib/systemd/boot/efi/addon{opts.efi_arch}.efi.stub')
 
-    if opts.signing_engine is None:
+    if opts.signing_engine and opts.signing_provider:
+        raise ValueError('Only one of --signing-engine= and --signing-provider= may be specified')
+
+    if opts.signing_engine is None and opts.signing_provider is None:
         if opts.sb_key:
             opts.sb_key = Path(opts.sb_key)
         if opts.sb_cert:
@@ -1940,11 +2151,12 @@ def finalize_options(opts: argparse.Namespace) -> None:
         )
     elif bool(opts.sb_key) and bool(opts.sb_cert):
         # both param given, infer sbsign and in case it was given, ensure signtool=sbsign
-        if opts.signtool and opts.signtool != SbSign:
+        if opts.signtool and opts.signtool not in (SbSign, SystemdSbSign):
             raise ValueError(
                 f'Cannot provide --signtool={opts.signtool} with --secureboot-private-key= and --secureboot-certificate='  # noqa: E501
             )
-        opts.signtool = SbSign
+        if not opts.signtool:
+            opts.signtool = SbSign
     elif bool(opts.sb_cert_name):
         # sb_cert_name given, infer pesign and in case it was given, ensure signtool=pesign
         if opts.signtool and opts.signtool != PeSign:
@@ -1953,6 +2165,9 @@ def finalize_options(opts: argparse.Namespace) -> None:
             )
         opts.signtool = PeSign
 
+    if opts.signing_provider and opts.signtool != SystemdSbSign:
+        raise ValueError('--signing-provider= can only be used with--signtool=systemd-sbsign')
+
     if opts.sign_kernel and not opts.sb_key and not opts.sb_cert_name:
         raise ValueError(
             '--sign-kernel requires either --secureboot-private-key= and --secureboot-certificate= (for sbsign) or --secureboot-certificate-name= (for pesign) to be specified'  # noqa: E501

test/test-network/conf/25-sysctl.network

@@ -13,3 +13,4 @@ IPv6ProxyNDP=yes
 IPv6AcceptRA=no
 IPv4AcceptLocal=yes
 IPv4ReversePathFilter=no
+MulticastIGMPVersion=v1

test/test-network/systemd-networkd-tests.py

@@ -4381,6 +4381,7 @@ class NetworkdNetworkTests(unittest.TestCase, Utilities):
         self.check_ipv4_sysctl_attr('dummy98', 'proxy_arp_pvlan', '1')
         self.check_ipv4_sysctl_attr('dummy98', 'accept_local', '1')
         self.check_ipv4_sysctl_attr('dummy98', 'rp_filter', '0')
+        self.check_ipv4_sysctl_attr('dummy98', 'force_igmp_version', '1')
 
         copy_network_unit('25-sysctl.network.d/25-ipv6-privacy-extensions.conf')
         networkctl_reload()

test/units/TEST-74-AUX-UTILS.sbsign.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# shellcheck disable=SC2016
+set -eux
+set -o pipefail
+
+# shellcheck source=test/units/test-control.sh
+. "$(dirname "$0")"/test-control.sh
+
+if ! command -v /usr/lib/systemd/systemd-sbsign >/dev/null; then
+    echo "systemd-sbsign not found, skipping."
+    exit 0
+fi
+
+if [[ ! -d /usr/lib/systemd/boot/efi ]]; then
+    echo "systemd-boot is not installed, skipping."
+    exit 0
+fi
+
+cat >/tmp/openssl.conf <<EOF
+[ req ]
+prompt = no
+distinguished_name = req_distinguished_name
+
+[ req_distinguished_name ]
+C = DE
+ST = Test State
+L = Test Locality
+O = Org Name
+OU = Org Unit Name
+CN = Common Name
+emailAddress = test@email.com
+EOF
+
+openssl req -config /tmp/openssl.conf -subj="/CN=waldo" \
+        -x509 -sha256 -nodes -days 365 -newkey rsa:4096 \
+        -keyout /tmp/sb.key -out /tmp/sb.crt
+
+testcase_sign_systemd_boot() {
+    if ! command -v sbverify >/dev/null; then
+        echo "sbverify not found, skipping."
+        exit 0
+    fi
+
+    SD_BOOT="$(find /usr/lib/systemd/boot/efi/ -name "systemd-boot*.efi" | head -n1)"
+
+    (! sbverify --cert /tmp/sb.crt "$SD_BOOT")
+    /usr/lib/systemd/systemd-sbsign sign --certificate /tmp/sb.crt --private-key /tmp/sb.key --output /tmp/sdboot "$SD_BOOT"
+    sbverify --cert /tmp/sb.crt /tmp/sdboot
+
+    # Make sure appending signatures to an existing certificate table works as well.
+    /usr/lib/systemd/systemd-sbsign sign --certificate /tmp/sb.crt --private-key /tmp/sb.key --output /tmp/sdboot /tmp/sdboot
+    sbverify --cert /tmp/sb.crt /tmp/sdboot
+}
+
+testcase_validate_key() {
+    /usr/lib/systemd/systemd-sbsign validate-key --certificate /tmp/sb.crt --private-key /tmp/sb.key
+}
+
+run_testcases