.github/workflows/coverage.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: systemd/mkosi@10544812b35a668d4aac9834c78ee8166e99bc78
+      - uses: systemd/mkosi@d45142e329550abc9c6fc63c1f1f86e5286d3d67
 
       # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
       # immediately, we remove the files in the background. However, we first move them to a different location

.github/workflows/linter.yml

@@ -38,7 +38,7 @@ jobs:
           LINTER_RULES_PATH: .github/linters
           GITHUB_ACTIONS_CONFIG_FILE: actionlint.yml
 
-      - uses: systemd/mkosi@10544812b35a668d4aac9834c78ee8166e99bc78
+      - uses: systemd/mkosi@d45142e329550abc9c6fc63c1f1f86e5286d3d67
 
       - name: Check that tabs are not used in Python code
         run: sh -c '! git grep -P "\\t" -- src/core/generate-bpf-delegate-configs.py src/boot/generate-hwids-section.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py'

.github/workflows/mkosi.yml

@@ -167,7 +167,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: systemd/mkosi@10544812b35a668d4aac9834c78ee8166e99bc78
+      - uses: systemd/mkosi@d45142e329550abc9c6fc63c1f1f86e5286d3d67
 
       # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
       # immediately, we remove the files in the background. However, we first move them to a different location

.packit.yml

@@ -19,7 +19,7 @@ actions:
   post-upstream-clone:
     # Use the Fedora Rawhide specfile
     - git clone https://src.fedoraproject.org/rpms/systemd .packit_rpm
-    - bash -c 'git -C .packit_rpm checkout "$(grep GIT_COMMIT= mkosi/mkosi.pkgenv/mkosi.conf.d/centos-fedora.conf | cut -d= -f2)"'
+    - bash -c 'git -C .packit_rpm checkout "$(grep GIT_COMMIT= mkosi/mkosi.conf.d/centos-fedora/mkosi.conf.d/pkgenv.conf | cut -d= -f2)"'
     - bash -c 'echo "%bcond upstream 1" > .packit_rpm/systemd.spec.new'
     - bash -c 'echo "%define meson_extra_configure_options --werror" >> .packit_rpm/systemd.spec.new'
     - bash -c 'cat .packit_rpm/systemd.spec >> .packit_rpm/systemd.spec.new'

docs/MOUNT_REQUIREMENTS.md

@@ -44,12 +44,12 @@ if a mount point is *not* split out,
 but a given subtree is part of the parent mount,
 the requirements for that subtree are trivially satisfied by the parent.
 
-A "mount point" in this document means the whole subtree of the hierarchy,
+A "mount point" in this document means the whole subtree of the hierachy,
 until a mountpoint lower in the hierarchy which is conceptually separate.
 For example, on a system with a custom mount point located below `/var/spool/`,
 most of `/var/` would be in category 2/early,
 but the additional mount would be in category 3/regular.
-Conversely, if some part of `/usr/` that is normally part of that subtree
+Conversly, if some part of `/usr/` that is normally part of that subtree
 was split out to a separate mount,
 this mount point would fall into category 1/initrd
 and configuration would need to be provided for it to be mounted in the initrd.

mkosi/mkosi.conf

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
 [Config]
-MinimumVersion=commit:10544812b35a668d4aac9834c78ee8166e99bc78
+MinimumVersion=commit:d45142e329550abc9c6fc63c1f1f86e5286d3d67
 Dependencies=
         exitrd
         initrd
@@ -156,4 +156,3 @@ KVM=yes
 [Include]
 Include=%D/mkosi/mkosi.sanitizers
         %D/mkosi/mkosi.coverage
-        %D/mkosi/mkosi.pkgenv

mkosi/mkosi.conf.d/arch/mkosi.conf.d/pkgenv.conf

@@ -1,8 +1,5 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-[Match]
-Distribution=arch
-
 [Build]
 Environment=
         GIT_URL=https://gitlab.archlinux.org/archlinux/packaging/packages/systemd.git

mkosi/mkosi.conf.d/centos-fedora/mkosi.conf.d/pkgenv.conf

@@ -1,10 +1,5 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-[Match]
-Distribution=|fedora
-Distribution=|centos
-Profiles=!hyperscale
-
 [Build]
 Environment=
         GIT_URL=https://src.fedoraproject.org/rpms/systemd.git

mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf

@@ -1,9 +1,5 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-[Match]
-Distribution=|debian
-Distribution=|ubuntu
-
 [Build]
 Environment=
         GIT_URL=https://salsa.debian.org/systemd-team/systemd.git

mkosi/mkosi.conf.d/opensuse/mkosi.conf.d/pkgenv.conf

@@ -1,8 +1,5 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-[Match]
-Distribution=opensuse
-
 [Build]
 Environment=
         GIT_URL=https://github.com/bmwiedemann/openSUSE

mkosi/mkosi.images/build/mkosi.conf

@@ -1,8 +1,5 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-[Include]
-Include=%D/mkosi/mkosi.pkgenv
-
 [Content]
 Packages=
         clang

mkosi/mkosi.images/build/mkosi.conf.d/arch/mkosi.conf

@@ -3,6 +3,9 @@
 [Match]
 Distribution=arch
 
+[Include]
+Include=%D/mkosi/mkosi.conf.d/arch/mkosi.conf.d/pkgenv.conf
+
 [Content]
 Packages=
         base

mkosi/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.conf

@@ -4,6 +4,9 @@
 Distribution=|centos
 Distribution=|fedora
 
+[Include]
+Include=%D/mkosi/mkosi.conf.d/centos-fedora/mkosi.conf.d/pkgenv.conf
+
 [Content]
 Packages=
         clang-devel

mkosi/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.conf

@@ -4,6 +4,9 @@
 Distribution=|debian
 Distribution=|ubuntu
 
+[Include]
+Include=%D/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf
+
 [Content]
 Packages=
         apt

mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.conf

@@ -3,6 +3,9 @@
 [Match]
 Distribution=opensuse
 
+[Include]
+Include=%D/mkosi/mkosi.conf.d/opensuse/mkosi.conf.d/pkgenv.conf
+
 [Content]
 Packages=
         clang

mkosi/mkosi.pkgenv/mkosi.conf.d/hyperscale.conf

@@ -1,14 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Match]
-Profiles=hyperscale
-
-[Assert]
-Distribution=centos
-
-[Build]
-Environment=
-        GIT_URL=https://gitlab.com/CentOS/Hyperscale/rpms/systemd.git
-        GIT_BRANCH=c10s-sig-hyperscale
-        GIT_COMMIT=417b671b173ea6271c00a3c605215b5f68795a3a
-        PKG_SUBDIR=hyperscale

mkosi/mkosi.profiles/hyperscale/mkosi.conf

@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Match]
-Distribution=centos
-
-[Distribution]
-Repositories=hyperscale-packages-main

mkosi/mkosi.tools.conf/mkosi.conf

@@ -1,8 +1,5 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-[Include]
-Include=%D/mkosi/mkosi.pkgenv
-
 [Content]
 SyncScripts=%D/mkosi/mkosi.sync
 Packages=

mkosi/mkosi.tools.conf/mkosi.conf.d/arch.conf

@@ -3,6 +3,9 @@
 [Match]
 Distribution=arch
 
+[Include]
+Include=%D/mkosi/mkosi.conf.d/arch/mkosi.conf.d/pkgenv.conf
+
 [Content]
 PrepareScripts=%D/mkosi/mkosi.images/build/mkosi.conf.d/arch/mkosi.prepare
 Packages=

mkosi/mkosi.tools.conf/mkosi.conf.d/centos-fedora.conf

@@ -4,6 +4,9 @@
 Distribution=|fedora
 Distribution=|centos
 
+[Include]
+Include=%D/mkosi/mkosi.conf.d/centos-fedora/mkosi.conf.d/pkgenv.conf
+
 [Content]
 PrepareScripts=%D/mkosi/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.prepare
 Packages=

mkosi/mkosi.tools.conf/mkosi.conf.d/debian-ubuntu.conf

@@ -4,6 +4,9 @@
 Distribution=|debian
 Distribution=|ubuntu
 
+[Include]
+Include=%D/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf
+
 [Content]
 PrepareScripts=%D/mkosi/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.prepare
 Packages=

mkosi/mkosi.tools.conf/mkosi.conf.d/opensuse.conf

@@ -3,6 +3,9 @@
 [Match]
 Distribution=opensuse
 
+[Include]
+Include=%D/mkosi/mkosi.conf.d/opensuse/mkosi.conf.d/pkgenv.conf
+
 [Content]
 PrepareScripts=%D/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.prepare
 Packages=

mkosi/mkosi.tools.conf/mkosi.sandbox/etc/apt/sources.list.d/qemu.sources

@@ -1,34 +0,0 @@
-Types: deb
-URIs: https://ppa.launchpadcontent.net/enr0n/qemu/ubuntu/
-Suites: noble
-Components: main
-Signed-By:
- -----BEGIN PGP PUBLIC KEY BLOCK-----
- .
- mQINBGH5cH0BEADThqBQWZiPv6UdXe5FkAH6ju24sO6eYzUlVWkpJZcMjr3WBgIN
- I69C2OHhwZDB3NkScPZejl1cSiMNkXN64B0lAxsahL1DxlSNkKP3mdbiuyslG89b
- 2fyhnIq8wLb7b7taZs8bE++CHjaua16qdlgUrbq37waOoA/UO8DiudP8L//qRWwj
- j8RuELkDiUU+dwuJnJp3v3hsaDCl9PeUYnmFyfNtfh6xFQgCkZyQQaSnnfl1Ba89
- V0uQ0D4LuW2e0uMSXhkG774X9kJX2vg5gMR5RWwaftMQh2Fxt6mqe00dPl+SMp95
- 9hpNc2ZL/VTwq/TPL+P4FU1/n/6R7fnkyh7zDw++VCn5s2Lqq/uV/mheiFbDNdsp
- YYPoF4S+2iMYHMlqpmPQF4obSSr066Hq74WsuJM+fntYcgnK/Sjwt6CYcdmq+AvC
- x3ZFJgsxYJPBLtPyqPmqBfBVH5F5vBiJibJq+5Ny9HVYWIcQuMwa02RcJbMdFG2/
- If9TVQYysvdR3TKjk4gVmfS76dBrR1lZjbWx3Ynz5lMqfYnesbocZbrd5LFvXdRl
- 1uUmbLkUdyII11ZfgXveycFKnRXYUgmnj3NRI5IlYKqH5iPBd/iHneeI2l2e/NVN
- 6YPcC17dQVhWUKM3D5XdkjZBUFnTyf7QlqUiRnu3eomzcPypDsilMTqJXQARAQAB
- tB9MYXVuY2hwYWQgUFBBIGZvciBOaWNrIFJvc2Jyb29riQJOBBMBCgA4FiEEwH5l
- MEnRbPBOQRqIJhaTwJngVOUFAmH5cH0CGwMFCwkIBwIGFQoJCAsCBBYCAwECHgEC
- F4AACgkQJhaTwJngVOXjtxAAxhrizeyhu3hPDqgmk4qtenEEYcLtJGdMq8DXTQZu
- vKAZ7OvQiyZw456oRUHSe5gyT2tFWDz/DxJ7VU9657WupO9a2YmUlbYpoYK/npA0
- 6+307KssyK7g6DU63mugqjKvTKhJK3hSganYEyovhJsZUlXwPcJ4szUH5BiR0nQh
- f1mKIWD9ktSd2Eywp8PtDyraX1I7h6H8OrMwPSXxKlk5BtrhLg5xh7FJOVLFw9vT
- xqCziywxi3mJgGEOLZPUs13l24wiHmQpP1eG/LadPsE0Lkqurzj/eyKHjziqynz+
- MTpOr7IhvUhXqnMmxNzJF76e16e5MoxEekAelagF2KzXtnmHRLWqkjU/k2cbeU5n
- /T+g+eVKH5ALCRMgYS5ZFsDYD5KivGeEE6BypyTqpqge3BN8rZJs3uRji/IPRhA8
- N6t030lB5z2WldBADRZB0w61Uz7v6aTr4zjafjygIvVWcgRj0plsndwYwEIddw1v
- ut6ZO9XudWiNExawuyAMSTbQh3xhfltWFRIuOp6taQRqP0hPzjbyeaDBz3JXM2gj
- rKS2lh3HVnEBtRKurk8+/fUXjY9zTu1xzA0AslMX3WecAexECd9QRI3U+M6ak8GJ
- O8vcL5svM8nqDb7z6DWeBU6+Ejtn3fJ13oit9+fN+NQUUkHCaWMUuI6yVkgLWymb
- I/U=
- =JGzV
- -----END PGP PUBLIC KEY BLOCK-----

src/basic/glyph-util.c

@@ -82,12 +82,10 @@ const char* glyph_full(Glyph code, bool force_utf) {
                         [GLYPH_COMPUTER_DISK]           = "o",
                         [GLYPH_WORLD]                   = "W",
                         [GLYPH_RED_CIRCLE]              = "o",
-                        [GLYPH_ORANGE_CIRCLE]           = "o",
                         [GLYPH_YELLOW_CIRCLE]           = "o",
                         [GLYPH_BLUE_CIRCLE]             = "o",
                         [GLYPH_GREEN_CIRCLE]            = "o",
                         [GLYPH_SUPERHERO]               = "S",
-                        [GLYPH_PUMPKIN]                 = "P",
                         [GLYPH_IDCARD]                  = "@",
                         [GLYPH_HOME]                    = "^",
                         [GLYPH_ROCKET]                  = "^",
@@ -164,12 +162,10 @@ const char* glyph_full(Glyph code, bool force_utf) {
                         [GLYPH_COMPUTER_DISK]           = UTF8("💽"),
                         [GLYPH_WORLD]                   = UTF8("🌍"),
                         [GLYPH_RED_CIRCLE]              = UTF8("🔴"),
-                        [GLYPH_ORANGE_CIRCLE]           = UTF8("🟠"),
                         [GLYPH_YELLOW_CIRCLE]           = UTF8("🟡"),
                         [GLYPH_BLUE_CIRCLE]             = UTF8("🔵"),
                         [GLYPH_GREEN_CIRCLE]            = UTF8("🟢"),
                         [GLYPH_SUPERHERO]               = UTF8("🦸"),
-                        [GLYPH_PUMPKIN]                 = UTF8("🎃"),
                         [GLYPH_IDCARD]                  = UTF8("🪪"),
                         [GLYPH_HOME]                    = UTF8("🏠"),
                         [GLYPH_ROCKET]                  = UTF8("🚀"),

src/basic/glyph-util.h

@@ -50,12 +50,10 @@ typedef enum Glyph {
         GLYPH_COMPUTER_DISK,
         GLYPH_WORLD,
         GLYPH_RED_CIRCLE,
-        GLYPH_ORANGE_CIRCLE,
         GLYPH_YELLOW_CIRCLE,
         GLYPH_BLUE_CIRCLE,
         GLYPH_GREEN_CIRCLE,
         GLYPH_SUPERHERO,
-        GLYPH_PUMPKIN,
         GLYPH_IDCARD,
         GLYPH_HOME,
         GLYPH_ROCKET,

src/basic/process-util.c

@@ -1698,7 +1698,7 @@ int pidref_safe_fork_full(
 
         /* let's disable dlopen() in the child, as a paranoia safety precaution: children should not live for
          * long and only do minimal work before exiting or exec()ing. Doing dlopen() is not either. If people
-         * want dlopen() they should do it before forking. This is a safety precaution in particular for
+         * want dlopen() they should do it before forking. This is a safety precuation in particular for
          * cases where the child does namespace shenanigans: we should never end up loading a module from a
          * foreign environment. Note that this has no effect on NSS! (i.e. it only has effect on uses of our
          * dlopen_safe(), which we use comprehensively in our codebase, but glibc NSS doesn't bother, of

src/basic/time-util.c

@@ -1805,6 +1805,8 @@ int time_change_fd(void) {
 
         _cleanup_close_ int fd = -EBADF;
 
+        assert_cc(sizeof(time_t) == sizeof(TIME_T_MAX));
+
         /* Uses TFD_TIMER_CANCEL_ON_SET to get notifications whenever CLOCK_REALTIME makes a jump relative to
          * CLOCK_MONOTONIC. */
 

src/run/run.c

@@ -270,7 +270,7 @@ static bool privileged_execution(void) {
         if (arg_runtime_scope != RUNTIME_SCOPE_SYSTEM)
                 return false;
 
-        return become_root();
+        return become_root() || arg_empower;
 }
 
 static int add_timer_property(const char *name, const char *val) {
@@ -883,36 +883,6 @@ static int parse_argv(int argc, char *argv[]) {
         return 1;
 }
 
-static double shell_prompt_hue(void) {
-        if (privileged_execution())
-                return 0; /* red */
-
-        if (arg_empower)
-                return 30; /* orange */
-
-        return 60; /* yellow */
-}
-
-static Glyph shell_prompt_glyph(void) {
-        if (privileged_execution())
-                return GLYPH_SUPERHERO;
-
-        if (arg_empower)
-                return GLYPH_PUMPKIN;
-
-        return GLYPH_IDCARD;
-}
-
-static Glyph pty_window_glyph(void) {
-        if (privileged_execution())
-                return GLYPH_RED_CIRCLE;
-
-        if (arg_empower)
-                return GLYPH_ORANGE_CIRCLE;
-
-        return GLYPH_YELLOW_CIRCLE;
-}
-
 static int parse_argv_sudo_mode(int argc, char *argv[]) {
 
         enum {
@@ -1266,7 +1236,14 @@ static int parse_argv_sudo_mode(int argc, char *argv[]) {
                 return log_oom();
 
         if (!arg_background && arg_stdio == ARG_STDIO_PTY) {
-                r = terminal_tint_color(shell_prompt_hue(), &arg_background);
+                double hue;
+
+                if (privileged_execution())
+                        hue = 0; /* red */
+                else
+                        hue = 60 /* yellow */;
+
+                r = terminal_tint_color(hue, &arg_background);
                 if (r < 0)
                         log_debug_errno(r, "Unable to get terminal background color, not tinting background: %m");
         }
@@ -1278,7 +1255,7 @@ static int parse_argv_sudo_mode(int argc, char *argv[]) {
                         if (!arg_shell_prompt_prefix)
                                 return log_oom();
                 } else if (emoji_enabled()) {
-                        arg_shell_prompt_prefix = strjoin(glyph(shell_prompt_glyph()), " ");
+                        arg_shell_prompt_prefix = strjoin(glyph(privileged_execution() ? GLYPH_SUPERHERO : GLYPH_IDCARD), " ");
                         if (!arg_shell_prompt_prefix)
                                 return log_oom();
                 }
@@ -1303,7 +1280,7 @@ static int parse_argv_sudo_mode(int argc, char *argv[]) {
                  * this for root though, under the assumption that if a regular user temporarily transitions into
                  * another regular user it's a better default that the full user environment is uniformly
                  * available. */
-                if (arg_lightweight < 0 && (privileged_execution() || arg_empower))
+                if (arg_lightweight < 0 && privileged_execution())
                         arg_lightweight = true;
 
                 if (arg_lightweight >= 0) {
@@ -2313,7 +2290,9 @@ static int run_context_setup_ptyfwd(RunContext *c) {
         if (!isempty(arg_background))
                 (void) pty_forward_set_background_color(c->forward, arg_background);
 
-        (void) pty_forward_set_window_title(c->forward, pty_window_glyph(), arg_host, arg_cmdline);
+        (void) pty_forward_set_window_title(c->forward,
+                                            privileged_execution() ? GLYPH_RED_CIRCLE : GLYPH_YELLOW_CIRCLE,
+                                            arg_host, arg_cmdline);
         return 0;
 }
 

src/shared/openssl-util.c

@@ -1108,7 +1108,7 @@ int digest_and_sign(
                 bool invalid_digest = ERR_GET_REASON(ERR_peek_last_error()) == EVP_R_INVALID_DIGEST;
                 r = log_openssl_errors("Failed to initialize signature context");
                 return invalid_digest ? -EADDRNOTAVAIL : r;
-        }
+}
 
         /* Determine signature size */
         size_t ss;

src/shared/quota-util.c

@@ -42,7 +42,7 @@ int quota_query_proj_id(int fd, uint32_t proj_id, struct dqblk *ret_req) {
 
         r = quotactl_fd_with_fallback(fd, QCMD_FIXED(Q_GETQUOTA, PRJQUOTA), proj_id, ret_req);
         if (r == -ESRCH || ERRNO_IS_NEG_NOT_SUPPORTED(r) || ERRNO_IS_NEG_PRIVILEGE(r)) {
-                *ret_req = (struct dqblk) {};
+                zero(ret_req);
                 return false;
         }
         if (r < 0)

src/shared/smbios11.c

@@ -40,7 +40,7 @@ int read_smbios11_field(unsigned i, size_t max_size, char **ret_data, size_t *re
                         AT_FDCWD, p,
                         /* offset = */ UINT64_MAX,
                         max_size >= SIZE_MAX - offsetof(struct dmi_field_header, contents) ? SIZE_MAX :
-                        sizeof(struct dmi_field_header) + max_size,
+                        sizeof(dmi_field_header) + max_size,
                         /* flags = */ 0,
                         /* bind_name = */ NULL,
                         (char**) &data, &size);

test/units/TEST-02-UNITTESTS.sh

@@ -40,6 +40,7 @@ systemctl disable --now ip6tables.service || :
 # Check & report test results
 # Arguments:
 #   $1: test path
+#   $2: test exit code
 run_test() {
     if [[ $# -ne 1 ]]; then
         echo >&2 "run_test: missing arguments"

test/units/TEST-88-UPGRADE.sh

@@ -81,11 +81,11 @@ systemd-run --on-calendar="@$after_2h" -u upgrade_timer_test date
 timer1=$(systemctl show -P TimersCalendar upgrade_timer_test.timer)
 timer2=$(systemctl show -P NextElapseUSecRealtime upgrade_timer_test.timer)
 
+dnf downgrade -y --allowerasing --disablerepo '*' "$pkgdir"/distro/*.rpm
+
 # FIXME: See https://github.com/systemd/systemd/pull/39293
 systemctl stop systemd-networkd-resolve-hook.socket || true
 
-dnf downgrade -y --allowerasing --disablerepo '*' "$pkgdir"/distro/*.rpm
-
 # Some distros don't ship networkd, so the test will always fail
 if command -v networkctl >/dev/null; then
     networkd=1

tools/fetch-distro.py

@@ -31,13 +31,10 @@ def parse_args():
         action='store_true',
         default=False,
     )
-    p.add_argument('--profile')
     return p.parse_args()
 
 def read_config(distro: str):
     cmd = ['mkosi', '--json', '-d', distro, 'summary']
-    if args.profile:
-        cmd += ['--profile', args.profile]
     print(f"+ {shlex.join(cmd)}")
     text = subprocess.check_output(cmd, text=True)
 
@@ -56,16 +53,15 @@ def commit_file(distro: str, files: list[Path], commit: str, changes: str):
     subprocess.check_call(cmd)
 
 def checkout_distro(args, distro: str, config: dict):
-    url = config['Environment']['GIT_URL']
-    branch = config['Environment']['GIT_BRANCH']
-    subdir = config['Environment'].get('GIT_SUBDIR')
-    pkg_subdir = config['Environment']['PKG_SUBDIR']
-
-    dest = Path(f'pkg/{pkg_subdir}')
+    dest = Path(f'pkg/{distro}')
     if dest.exists():
         print(f'{dest} already exists.')
         return
 
+    url = config['Environment']['GIT_URL']
+    branch = config['Environment']['GIT_BRANCH']
+    subdir = config['Environment'].get('GIT_SUBDIR')
+
     # Do not checkout the full sources if the package is in a subdirectory,
     # a sparse checkout will be done after
     sparse = ['--no-checkout', '--filter=blob:none'] if subdir is not None else []
@@ -85,12 +81,12 @@ def checkout_distro(args, distro: str, config: dict):
 
     # Sparse checkout if the package is in a subdirectory
     if subdir is not None:
-        cmd = ['git', '-C', f'pkg/{pkg_subdir}', 'sparse-checkout', 'set',
+        cmd = ['git', '-C', f'pkg/{distro}', 'sparse-checkout', 'set',
                '--no-cone', f'{subdir}']
         print(f"+ {shlex.join(cmd)}")
         subprocess.check_call(cmd)
 
-        cmd = ['git', '-C', f'pkg/{pkg_subdir}', 'checkout', 'HEAD']
+        cmd = ['git', '-C', f'pkg/{distro}', 'checkout', 'HEAD']
         print(f"+ {shlex.join(cmd)}")
         subprocess.check_call(cmd)
 
@@ -100,19 +96,18 @@ def update_distro(args, distro: str, config: dict):
     branch = config['Environment']['GIT_BRANCH']
     subdir = config['Environment'].get('GIT_SUBDIR')
     old_commit = config['Environment']['GIT_COMMIT']
-    pkg_subdir = config['Environment']['PKG_SUBDIR']
 
     if args.fetch:
-        cmd = ['git', '-C', f'pkg/{pkg_subdir}', 'fetch', 'origin', '-v',
+        cmd = ['git', '-C', f'pkg/{distro}', 'fetch', 'origin', '-v',
                f'{branch}:remotes/origin/{branch}']
         print(f"+ {shlex.join(cmd)}")
         subprocess.check_call(cmd)
 
-    cmd = ['git', '-C', f'pkg/{pkg_subdir}', 'switch', branch]
+    cmd = ['git', '-C', f'pkg/{distro}', 'switch', branch]
     print(f"+ {shlex.join(cmd)}")
     subprocess.check_call(cmd)
 
-    cmd = ['git', '-C', f'pkg/{pkg_subdir}', 'log', '-n1', '--format=%H',
+    cmd = ['git', '-C', f'pkg/{distro}', 'log', '-n1', '--format=%H',
            f'refs/remotes/origin/{branch}']
     if subdir is not None:
         cmd += [f'{subdir}']
@@ -120,10 +115,10 @@ def update_distro(args, distro: str, config: dict):
     new_commit = subprocess.check_output(cmd, text=True).strip()
 
     if old_commit == new_commit:
-        print(f'{pkg_subdir}: commit {new_commit!s} is still fresh')
+        print(f'{distro}: commit {new_commit!s} is still fresh')
         return
 
-    cmd = ['git', '-C', f'pkg/{pkg_subdir}', 'log', '--graph', '--first-parent',
+    cmd = ['git', '-C', f'pkg/{distro}', 'log', '--graph', '--first-parent',
            '--pretty=oneline', '--no-decorate', '--abbrev-commit', '--abbrev=10',
            f'{old_commit}..{new_commit}']
     if subdir is not None:
@@ -131,8 +126,8 @@ def update_distro(args, distro: str, config: dict):
     print(f"+ {shlex.join(cmd)}")
     changes = subprocess.check_output(cmd, text=True).strip()
 
-    conf_dir = Path('mkosi/mkosi.pkgenv/mkosi.conf.d')
-    files = conf_dir.glob('*.conf')
+    conf_dir = Path('mkosi/mkosi.conf.d')
+    files = conf_dir.glob('**/pkgenv.conf')
     for file in files:
         s = file.read_text()
         if old_commit in s: