Merge f4429e9753 into bf39626d61

Otherwise, `<variable>$BOOT</variable>` is rendered:

```
[2548/2992] Generating man/repart.d.5 with a custom command
Element variable in namespace '' encountered in para, but no template matches.
Element variable in namespace '' encountered in para, but no template matches.
```

.github/advanced-issue-labeler.yml

@@ -31,7 +31,7 @@ policy:
           - name: dissect
             keys: ['systemd-dissect']
 
-          - name: env
+          - name: env-generator
             keys: ['systemd-env-generator']
 
           - name: fsck

.github/labeler.yml

@@ -1,9 +1,21 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 # vi: sw=2 ts=2 et:
 
+analyze:
+  - changed-files:
+    - any-glob-to-any-file: 'src/analyze/*'
 apparmor:
   - changed-files:
     - any-glob-to-any-file: '**/*apparmor*'
+ask-password:
+  - changed-files:
+    - any-glob-to-any-file: '**/*ask-password*'
+backlight:
+  - changed-files:
+    - any-glob-to-any-file: '**/*backlight*'
+battery-check 🪫:
+  - changed-files:
+    - any-glob-to-any-file: '**/*battery*'
 binfmt:
   - changed-files:
     - any-glob-to-any-file: '**/*binfmt*'
@@ -15,13 +27,19 @@ btrfs:
     - any-glob-to-any-file: '**/*btrfs*'
 build-system:
   - changed-files:
-    - any-glob-to-any-file: ['meson_options.txt', '**/meson.build', 'Makefile', 'configure']
+    - any-glob-to-any-file: ['meson_options.txt', '**/meson.build']
 busctl:
   - changed-files:
     - any-glob-to-any-file: '**/*busctl*'
+catalog:
+  - changed-files:
+    - any-glob-to-any-file: 'catalog/*'
 cgls:
   - changed-files:
     - any-glob-to-any-file: '**/*cgls*'
+cgroups:
+  - changed-files:
+    - any-glob-to-any-file: ['src/basic/cgroup*', 'src/cgroups-agent/*', 'src/core/cgroup*', 'src/shared/cgroup*']
 cgtop:
   - changed-files:
     - any-glob-to-any-file: '**/*cgtop*'
@@ -34,6 +52,24 @@ coccinelle:
 coredump:
   - changed-files:
     - any-glob-to-any-file: '**/*coredump*'
+creds:
+  - changed-files:
+    - any-glob-to-any-file: ['src/core/*cred*', 'src/creds/*', 'src/shared/*cred*', 'units/*cred*']
+cryptsetup:
+  - changed-files:
+    - any-glob-to-any-file: ['src/cryptenroll/*', 'src/cryptsetup/*', 'units/*crypt*']
+debug-generator:
+  - changed-files:
+    - any-glob-to-any-file: '**/*debug-generator*'
+delta:
+  - changed-files:
+    - any-glob-to-any-file: '**/*delta*'
+detect-virt:
+  - changed-files:
+    - any-glob-to-any-file: '**/*virt*'
+dissect:
+  - changed-files:
+    - any-glob-to-any-file: '**/*dissect*'
 documentation:
   - changed-files:
     - any-glob-to-any-file: ['NEWS', 'README*', 'docs/*', 'man/*']
@@ -42,58 +78,106 @@ env-generator:
     - any-glob-to-any-file: '**/*environment*generator*'
 escape:
   - changed-files:
-    - any-glob-to-any-file: '**/*escape*'
+    - any-glob-to-any-file: 'src/escape/*'
-debug-generator:
+firstboot:
   - changed-files:
-    - any-glob-to-any-file: '**/debug-generator*'
+    - any-glob-to-any-file: '**/*firstboot*'
+fsck:
+  - changed-files:
+    - any-glob-to-any-file: '**/*fsck*'
 fstab-generator:
   - changed-files:
     - any-glob-to-any-file: '**/*fstab-generator*'
+gpt-auto:
+  - changed-files:
+    - any-glob-to-any-file: '**/*gpt-auto*'
 growfs:
   - changed-files:
     - any-glob-to-any-file: '**/*growfs*'
 hibernate-resume:
   - changed-files:
     - any-glob-to-any-file: '**/*hibernate-resume*'
+homed:
+  - changed-files:
+    - any-glob-to-any-file: ['src/home*', 'units/*home*']
+hostname:
+  - changed-files:
+    - any-glob-to-any-file: ['src/hostname/*', 'src/shared/*hostname*', 'units/*hostname*']
 hwdb:
   - changed-files:
-    - any-glob-to-any-file: 'hwdb.d/**/*'
+    - any-glob-to-any-file: '**/*hwdb*'
+import:
+  - changed-files:
+    - any-glob-to-any-file: '**/*import*'
+integritysetup:
+  - changed-files:
+    - any-glob-to-any-file: '**/*integrity*'
 journal:
   - changed-files:
-    - any-glob-to-any-file: ['src/journal/*', 'src/libsystemd/sd-journal/*']
+    - any-glob-to-any-file: ['src/journal/*', 'src/libsystemd/sd-journal/*', 'units/systemd-journal-catalog*', 'units/systemd-journal-flush*', 'units/systemd-journald*']
 journal-remote:
   - changed-files:
-    - any-glob-to-any-file: 'src/journal-remote/*'
+    - any-glob-to-any-file: ['src/journal-remote/*', 'units/systemd-journal-gateway*', 'units/systemd-journal-remote*']
+kernel-install:
+  - changed-files:
+    - any-glob-to-any-file: '**/*kernel-install*'
 l10n 🌍:
   - changed-files:
     - any-glob-to-any-file: 'po/*'
+locale:
+  - changed-files:
+    - any-glob-to-any-file: '**/*locale*'
 login:
   - changed-files:
     - any-glob-to-any-file: ['src/login/*', '**/sd-login*/**']
+machine:
+  - changed-files:
+    - any-glob-to-any-file: ['src/machine/*', 'units/*machine*']
 meson:
   - changed-files:
     - any-glob-to-any-file: ['meson_options.txt', '**/meson.build']
 mkosi:
   - changed-files:
-    - any-glob-to-any-file: ['.mkosi/*', 'mkosi.build']
+    - any-glob-to-any-file: '**/*mkosi*'
+modules-load:
+  - changed-files:
+    - any-glob-to-any-file: ['**/*modules-load*', 'modprobe.d/*']
+mount:
+  - changed-files:
+    - any-glob-to-any-file: ['src/basic/*mount*', 'src/core/*mount*', 'src/mount/*', 'src/shared/*mount*']
 mountfsd:
   - changed-files:
-    - any-glob-to-any-file: ['src/mountfsd/*']
+    - any-glob-to-any-file: '**/*mountfsd*'
 network:
   - changed-files:
-    - any-glob-to-any-file: ['src/libsystemd-network/**/*', 'src/network/**/*']
+    - any-glob-to-any-file: ['src/libsystemd-network/**/*', 'src/network/**/*', 'network/*', 'test/networkd-test.py', 'test/test-network*']
+notify:
+  - changed-files:
+    - any-glob-to-any-file: 'src/notify/*'
 nspawn:
   - changed-files:
     - any-glob-to-any-file: '**/*nspawn*'
 nsresource:
   - changed-files:
     - any-glob-to-any-file: '**/*nsresource*'
+nss-myhostname:
+  - changed-files:
+    - any-glob-to-any-file: '**/*nss-myhostname*'
 portable:
   - changed-files:
     - any-glob-to-any-file: 'src/portable/**/*'
+pstore:
+  - changed-files:
+    - any-glob-to-any-file: '**/*pstore*'
+random-seed:
+  - changed-files:
+    - any-glob-to-any-file: '**/*random-seed*'
 rc-local-generator:
   - changed-files:
     - any-glob-to-any-file: 'src/rc-local-generator/*'
+remount-fs:
+  - changed-files:
+    - any-glob-to-any-file: '**/*remount-fs*'
 repart:
   - changed-files:
     - any-glob-to-any-file: '**/*repart*'
@@ -145,6 +229,9 @@ selinux:
 shell-completion:
   - changed-files:
     - any-glob-to-any-file: 'shell-completion/*'
+shutdown:
+  - changed-files:
+    - any-glob-to-any-file: ['src/shutdown/*', 'units/**/*shutdown*']
 sleep:
   - changed-files:
     - any-glob-to-any-file: ['src/shared/*sleep*', 'src/sleep/*']
@@ -154,60 +241,95 @@ smack:
 socket-proxy:
   - changed-files:
     - any-glob-to-any-file: '**/*socket-proxy*'
-sysv-generator:
+ssh-generator:
   - changed-files:
-    - any-glob-to-any-file: '**/*sysv-generator*'
+    - any-glob-to-any-file: '**/*ssh-generator*'
-systemctl:
+storagetm:
   - changed-files:
-    - any-glob-to-any-file: '**/systemctl*'
+    - any-glob-to-any-file: '**/*storagetm*'
-sysupdate:
+sulogin:
   - changed-files:
-    - any-glob-to-any-file: '**/*sysupdate*'
+    - any-glob-to-any-file: '**/*sulogin*'
-sysvcompat:
-  - changed-files:
-    - any-glob-to-any-file: '**/*sysv*'
 sysctl:
   - changed-files:
     - any-glob-to-any-file: '**/*sysctl*'
+sysext:
+  - changed-files:
+    - any-glob-to-any-file: '**/*sysext*'
+systemctl:
+  - changed-files:
+    - any-glob-to-any-file: '**/*systemctl*'
+sysupdate:
+  - changed-files:
+    - any-glob-to-any-file: '**/*sysupdate*'
+sysusers:
+  - changed-files:
+    - any-glob-to-any-file: '**/*sysusers*'
+sysv-generator:
+  - changed-files:
+    - any-glob-to-any-file: '**/*sysv-generator*'
+sysvcompat:
+  - changed-files:
+    - any-glob-to-any-file: '**/*sysv*'
+tests:
+  - changed-files:
+    - any-glob-to-any-file: [
+      'src/shared/tests.*',
+      'src/test/**/*',
+      'src/fuzz/**/*',
+      'test/**/*',
+      '**/test-*',
+      '**/test_*',
+      '.github/workflows/*'
+  ]
 timedate:
   - changed-files:
     - any-glob-to-any-file: '**/*timedate*'
 timesync:
   - changed-files:
     - any-glob-to-any-file: '**/*timesync*'
-tests:
+tmpfiles:
   - changed-files:
-    - any-glob-to-any-file: [
+    - any-glob-to-any-file: '**/*tmpfiles*'
-      'src/test/**/*',
-      'src/fuzz/**/*',
-      'test/**/*',
-      '**/test-*',
-      '.github/workflows/*'
-  ]
 tpm2:
   - changed-files:
     - any-glob-to-any-file: ['**/*tpm2*', '**/*tpm-*']
 udev:
   - changed-files:
-    - any-glob-to-any-file: ['src/udev/**/*', 'src/libudev/*', 'man/*udev*']
+    - any-glob-to-any-file: ['src/udev/**/*', 'src/libudev/*', 'man/*udev*', 'rules.d/*']
 uki:
   - changed-files:
     - any-glob-to-any-file: '**/ukify*'
 units:
   - changed-files:
     - any-glob-to-any-file: 'units/**/*'
+user-session:
+  - changed-files:
+    - any-glob-to-any-file: '**/*user-session*'
 userdb:
   - changed-files:
     - any-glob-to-any-file: '**/*userdb*'
 util-lib:
   - changed-files:
     - any-glob-to-any-file: ['src/fundamental/**/*', 'src/basic/**/*', 'src/shared/**/*']
+utmp/wtmp:
+  - changed-files:
+    - any-glob-to-any-file: '**/*utmp*'
+varlink:
+  - changed-files:
+    - any-glob-to-any-file: ['src/varlink/*', 'src/libsystemd/sd-varlink/*', 'src/systemd/sd-varlink*']
 vconsole:
   - changed-files:
     - any-glob-to-any-file: '**/*vconsole*'
+veritysetup:
+  - changed-files:
+    - any-glob-to-any-file: '**/*veritysetup*'
 vmspawn:
   - changed-files:
     - any-glob-to-any-file: '**/*vmspawn*'
+volatile:
+  - changed-files:
+    - any-glob-to-any-file: '**/*volatile*'
 xdg-autostart:
   - changed-files:
     - any-glob-to-any-file: '**/**xdg-autostart-generator*'

.github/workflows/cifuzz.yml

@@ -68,7 +68,7 @@ jobs:
           path: ./out/artifacts
       - name: Upload Sarif
         if: always() && steps.build.outcome == 'success'
-        uses: github/codeql-action/upload-sarif@b611370bb5703a7efb587f9d136a52ea24c5c38c
+        uses: github/codeql-action/upload-sarif@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a
         with:
           # Path to SARIF file relative to the root of the repository
           sarif_file: cifuzz-sarif/results.sarif

.github/workflows/codeql.yml

@@ -45,7 +45,7 @@ jobs:
       uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@b611370bb5703a7efb587f9d136a52ea24c5c38c
+      uses: github/codeql-action/init@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a
       with:
         languages: ${{ matrix.language }}
         config-file: ./.github/codeql-config.yml
@@ -53,7 +53,7 @@ jobs:
     - run: sudo -E .github/workflows/unit_tests.sh SETUP
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@b611370bb5703a7efb587f9d136a52ea24c5c38c
+      uses: github/codeql-action/autobuild@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@b611370bb5703a7efb587f9d136a52ea24c5c38c
+      uses: github/codeql-action/analyze@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a

.github/workflows/differential-shellcheck.yml

@@ -28,7 +28,7 @@ jobs:
           fetch-depth: 0
 
       - name: Differential ShellCheck
-        uses: redhat-plumbers-in-action/differential-shellcheck@60c9f2b924a9c5a2ddbb25e7b23e8e11b56faab9
+        uses: redhat-plumbers-in-action/differential-shellcheck@cc6721c45a8800cc666de45493545a07a638d121
         with:
           # exclude all `.in` files because they may contain unsupported syntax, and they have to be preprocessed first
           # TEMPORARY: exclude bash completion files, they would generate too many defects in Code scanning dashboard (600+)

.github/workflows/labeler.yml

@@ -35,7 +35,7 @@ jobs:
 
     - name: Label PR based on policy in labeler.yml
       uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9
-      if: startsWith(github.event_name, 'pull_request') && github.event.action != 'closed'
+      if: startsWith(github.event_name, 'pull_request') && github.base_ref == 'main' && github.event.action != 'closed'
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         configuration-path: .github/labeler.yml

.github/workflows/linter.yml

@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Lint Code Base
-        uses: super-linter/super-linter/slim@88ea3923a7e1f89dd485d079f6eb5f5e8f937589
+        uses: super-linter/super-linter/slim@b92721f792f381cedc002ecdbb9847a15ece5bb8
         env:
           DEFAULT_BRANCH: main
           MULTI_STATUS: false

.github/workflows/make_release.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Release
-        uses: softprops/action-gh-release@69320dbe05506a9a39fc8ae11030b214ec2d1f87
+        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191
         with:
           prerelease: ${{ contains(github.ref_name, '-rc') }}
           draft: ${{ github.repository == 'systemd/systemd' }}

.github/workflows/mkosi.yml

@@ -10,36 +10,36 @@ on:
       - main
       - v[0-9]+-stable
     paths:
-      - '**'
+      - "**"
-      - '!README*'
+      - "!README*"
-      - '!LICENSE*'
+      - "!LICENSE*"
-      - '!LICENSES/**'
+      - "!LICENSES/**"
-      - '!TODO'
+      - "!TODO"
-      - '!docs/**'
+      - "!docs/**"
-      - '!man/**'
+      - "!man/**"
-      - '!catalog/**'
+      - "!catalog/**"
-      - '!shell-completion/**'
+      - "!shell-completion/**"
-      - '!po/**'
+      - "!po/**"
-      - '!.**'
+      - "!.**"
-      - '.github/**'
+      - ".github/**"
 
   pull_request:
     branches:
       - main
       - v[0-9]+-stable
     paths:
-      - '**'
+      - "**"
-      - '!README*'
+      - "!README*"
-      - '!LICENSE*'
+      - "!LICENSE*"
-      - '!LICENSES/**'
+      - "!LICENSES/**"
-      - '!TODO'
+      - "!TODO"
-      - '!docs/**'
+      - "!docs/**"
-      - '!man/**'
+      - "!man/**"
-      - '!catalog/**'
+      - "!catalog/**"
-      - '!shell-completion/**'
+      - "!shell-completion/**"
-      - '!po/**'
+      - "!po/**"
-      - '!.**'
+      - "!.**"
-      - '.github/**'
+      - ".github/**"
 
 permissions:
   contents: read
@@ -59,157 +59,171 @@ jobs:
             sanitizers: ""
             llvm: 0
             cflags: "-O2 -D_FORTIFY_SOURCE=3"
+            relabel: no
           - distro: debian
             release: testing
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
+            relabel: no
           - distro: ubuntu
             release: noble
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
+            relabel: no
           - distro: fedora
             release: "40"
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
+            relabel: yes
           - distro: fedora
             release: rawhide
             sanitizers: address,undefined
             llvm: 1
             cflags: "-Og"
+            relabel: yes
           - distro: opensuse
             release: tumbleweed
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
+            relabel: no
           - distro: centos
             release: "9"
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
+            relabel: yes
+          - distro: centos
+            release: "10"
+            sanitizers: ""
+            llvm: 0
+            cflags: "-Og"
+            relabel: yes
 
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
-    - uses: systemd/mkosi@70aa901697f12182ccaa24e2325867d275479b55
+      - uses: systemd/mkosi@2c9954fa51a3a995bbdc02db6ef51f5bd27bc1ba
 
-    # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
+      # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
-    # immediately, we remove the files in the background. However, we first move them to a different location
+      # immediately, we remove the files in the background. However, we first move them to a different location
-    # so that nothing tries to use anything in these directories anymore while we're busy deleting them.
+      # so that nothing tries to use anything in these directories anymore while we're busy deleting them.
-    - name: Free disk space
+      - name: Free disk space
-      run: |
+        run: |
-        sudo mv /usr/local /usr/local.trash
+          sudo mv /usr/local /usr/local.trash
-        sudo mv /opt/hostedtoolcache /opt/hostedtoolcache.trash
+          sudo mv /opt/hostedtoolcache /opt/hostedtoolcache.trash
-        sudo systemd-run rm -rf /usr/local.trash /opt/hostedtoolcache.trash
+          sudo systemd-run rm -rf /usr/local.trash /opt/hostedtoolcache.trash
 
-    - name: Btrfs
+      - name: Btrfs
-      run: |
+        run: |
-        truncate --size=100G btrfs.raw
+          truncate --size=100G btrfs.raw
-        mkfs.btrfs btrfs.raw
+          mkfs.btrfs btrfs.raw
-        sudo mkdir /mnt/mkosi
+          sudo mkdir /mnt/mkosi
-        LOOP="$(sudo losetup --find --show --direct-io=on btrfs.raw)"
+          LOOP="$(sudo losetup --find --show --direct-io=on btrfs.raw)"
-        sudo mount "$LOOP" /mnt/mkosi --options compress=zstd:1,user_subvol_rm_allowed,noatime,discard=async,space_cache=v2
+          sudo mount "$LOOP" /mnt/mkosi --options compress=zstd:1,user_subvol_rm_allowed,noatime,discard=async,space_cache=v2
-        sudo chown "$(id -u):$(id -g)" /mnt/mkosi
+          sudo chown "$(id -u):$(id -g)" /mnt/mkosi
-        mkdir /mnt/mkosi/tmp
+          mkdir /mnt/mkosi/tmp
-        echo "TMPDIR=/mnt/mkosi/tmp" >>"$GITHUB_ENV"
+          echo "TMPDIR=/mnt/mkosi/tmp" >>"$GITHUB_ENV"
-        ln -s /mnt/mkosi/build build
+          ln -s /mnt/mkosi/build build
 
-    - name: Configure
+      - name: Configure
-      run: |
+        run: |
-        # XXX: drop after the HyperV bug that breaks secure boot KVM guests is solved
+          # XXX: drop after the HyperV bug that breaks secure boot KVM guests is solved
-        sed -i "s/'firmware'\s*:\s*'auto'/'firmware' : 'uefi'/g" test/*/meson.build
+          sed -i "s/'firmware'\s*:\s*'auto'/'firmware' : 'uefi'/g" test/*/meson.build
-        tee mkosi.local.conf <<EOF
+          tee mkosi.local.conf <<EOF
-        [Distribution]
+          [Distribution]
-        Distribution=${{ matrix.distro }}
+          Distribution=${{ matrix.distro }}
-        Release=${{ matrix.release }}
+          Release=${{ matrix.release }}
 
-        [Output]
+          [Output]
-        # Build a disk image in CI as this logic is much more prone to breakage.
+          # Build a disk image in CI as this logic is much more prone to breakage.
-        Format=disk
+          Format=disk
-        UseSubvolumes=yes
+          UseSubvolumes=yes
 
-        WorkspaceDirectory=$TMPDIR
+          WorkspaceDirectory=$TMPDIR
-        PackageCacheDirectory=$TMPDIR/cache
+          PackageCacheDirectory=$TMPDIR/cache
 
-        [Content]
+          [Content]
-        Environment=
+          Environment=
-                # Build debuginfo packages since we'll be publishing the packages as artifacts.
+                  # Build debuginfo packages since we'll be publishing the packages as artifacts.
-                WITH_DEBUG=1
+                  WITH_DEBUG=1
-                CFLAGS="${{ matrix.cflags }}"
+                  CFLAGS="${{ matrix.cflags }}"
-                SANITIZERS=${{ matrix.sanitizers }}
+                  SANITIZERS=${{ matrix.sanitizers }}
-                MESON_OPTIONS=--werror
+                  MESON_OPTIONS=--werror
-                LLVM=${{ matrix.llvm }}
+                  LLVM=${{ matrix.llvm }}
+                  SYSEXT=1
 
-        [Host]
+          SELinuxRelabel=${{ matrix.relabel }}
-        QemuMem=4G
-        # We build with debuginfo so there's no point in mounting the sources into the machine.
-        RuntimeBuildSources=no
-        EOF
 
-    - name: Generate secure boot key
+          [Host]
-      run: mkosi --debug genkey
+          QemuMem=4G
+          EOF
 
-    - name: Show image summary
+      - name: Generate secure boot key
-      run: mkosi summary
+        run: mkosi --debug genkey
 
-    - name: Install dependencies
+      - name: Show image summary
-      run: |
+        run: mkosi summary
-        mkosi dependencies |
-        xargs -d '\n' sudo apt-get install \
-            gperf \
-            libblkid-dev \
-            libcap-dev \
-            libcryptsetup-dev \
-            libcurl4-openssl-dev \
-            libfdisk-dev \
-            libmicrohttpd-dev \
-            libmount-dev \
-            libtss2-dev \
-            meson
 
-    - name: Configure meson
+      - name: Install dependencies
-      run: |
+        run: |
-        meson setup build \
+          mkosi dependencies |
-            --buildtype=debugoptimized \
+          xargs -d '\n' sudo apt-get install \
-            -Dintegration-tests=true \
+              gperf \
-            -Dremote=enabled \
+              libblkid-dev \
-            -Dopenssl=enabled \
+              libcap-dev \
-            -Dblkid=enabled \
+              libcryptsetup-dev \
-            -Dtpm2=enabled \
+              libcurl4-openssl-dev \
-            -Dlibcryptsetup=enabled \
+              libfdisk-dev \
-            -Dlibcurl=enabled \
+              libmicrohttpd-dev \
-            -Drepart=enabled \
+              libmount-dev \
-            -Dfirstboot=true \
+              libtss2-dev \
-            -Dsysusers=true \
+              meson
-            -Dtmpfiles=true \
-            -Dhwdb=true \
-            -Dvmspawn=enabled
 
-    - name: Build image
+      - name: Configure meson
-      run: meson compile -C build mkosi
+        run: |
+          meson setup build \
+              --buildtype=debugoptimized \
+              -Dintegration-tests=true \
+              -Dremote=enabled \
+              -Dopenssl=enabled \
+              -Dblkid=enabled \
+              -Dtpm2=enabled \
+              -Dlibcryptsetup=enabled \
+              -Dlibcurl=enabled \
+              -Drepart=enabled \
+              -Dfirstboot=true \
+              -Dsysusers=true \
+              -Dtmpfiles=true \
+              -Dhwdb=true \
+              -Dvmspawn=enabled
 
-    - name: Run integration tests
+      - name: Build image
-      run: sudo --preserve-env meson test -C build --no-rebuild --suite integration-tests --print-errorlogs --no-stdsplit --num-processes "$(($(nproc) - 1))"
+        run: sudo meson compile -C build mkosi
 
-    - name: Archive failed test journals
+      - name: Run integration tests
-      uses: actions/upload-artifact@v4
+        run: sudo --preserve-env meson test -C build --no-rebuild --suite integration-tests --print-errorlogs --no-stdsplit --num-processes "$(($(nproc) - 1))"
-      if: failure() && (github.repository == 'systemd/systemd' || github.repository == 'systemd/systemd-stable')
-      with:
-        name: ci-mkosi-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.distro }}-${{ matrix.release }}-failed-test-journals
-        path: |
-          build/test/journal/*.journal
-          build/meson-logs/*
-        retention-days: 7
 
-    - name: Archive packages
+      - name: Archive failed test journals
-      uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4
-      if: (success() || failure()) && (github.repository == 'systemd/systemd' || github.repository == 'systemd/systemd-stable')
+        if: failure() && (github.repository == 'systemd/systemd' || github.repository == 'systemd/systemd-stable')
-      with:
+        with:
-        name: ci-mkosi-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.distro }}-${{ matrix.release }}-packages
+          name: ci-mkosi-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.distro }}-${{ matrix.release }}-failed-test-journals
-        path: |
+          path: |
-          build/mkosi.output/*.rpm
+            build/test/journal/*.journal
-          build/mkosi.output/*.deb
+            build/meson-logs/*
-          build/mkosi.output/*.ddeb
+          retention-days: 7
-          build/mkosi.output/*.pkg.tar
+
-        retention-days: 4
+      - name: Archive packages
+        uses: actions/upload-artifact@v4
+        if: (success() || failure()) && (github.repository == 'systemd/systemd' || github.repository == 'systemd/systemd-stable')
+        with:
+          name: ci-mkosi-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.distro }}-${{ matrix.release }}-packages
+          path: |
+            build/mkosi.output/*.rpm
+            build/mkosi.output/*.deb
+            build/mkosi.output/*.ddeb
+            build/mkosi.output/*.pkg.tar
+          retention-days: 4

.github/workflows/requirements.txt

@@ -1,6 +1,6 @@
-meson==1.4.1 \
+meson==1.5.1 \
-    --hash=sha256:1b8aad738a5f6ae64294cc8eaba9a82988c1c420204484ac02ef782e5bba5f49 \
+    --hash=sha256:5531e24e6cfd6000bf1c712793cf28dff032841370b1a3b941a894e4fde46e5a \
-    --hash=sha256:d5acc3abae2dad3c70ddcbd10acac92b78b144d34d43f40f5b8ac31dfd8a826a
+    --hash=sha256:567e533adf255de73a2de35049b99923caf872a455af9ce03e01077e0d384bed
 ninja==1.11.1.1 \
     --hash=sha256:18302d96a5467ea98b68e1cae1ae4b4fb2b2a56a82b955193c637557c7273dbd \
     --hash=sha256:185e0641bde601e53841525c4196278e9aaf4463758da6dd1e752c0a0f54136a \

.github/workflows/scorecards.yml

@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif

NEWS

@@ -2,6 +2,15 @@ systemd System and Service Manager
 
 CHANGES WITH 257 in spe:
 
+        Incompatible changes:
+
+        * The --purge switch of systemd-tmpfiles (which was added in v256) has
+          been reworked: it will now only apply to tmpfiles.d/ lines marked
+          with the new "$" flag. This is an incompatible change, and means any
+          tmpfiles.d/ files which shall be used together with --purge need to
+          be updated accordingly. This change has been made to make it harder
+          to accidentally delete too many files when using --purge incorrectly.
+
         Announcements of Future Feature Removals and Incompatible Changes:
 
         * Support for automatic flushing of the nscd user/group database caches
@@ -31,6 +40,261 @@ CHANGES WITH 257 in spe:
           by default when combined with --scope, will be changed in a future
           release to be enabled by default.
 
+        * The FileDescriptorName= setting for socket units is now honored by
+          Accept=yes sockets too, where it was previously silently ignored and
+          "connection" was used unconditionally.
+
+        * systemd-logind now always obeys inhibitor locks, where previously it
+          ignored locks taken by the caller or when the caller was root. A
+          privileged caller can always close the other sessions, remove the
+          inhibitor locks, or use --force or --check-inhibitors=no to ignore the
+          inhibitors. This change thus doesn't affect security, since everything
+          that was possible before at a given privilege level is still possible,
+          but it should make the inhibitor logic easier to use and understand,
+          and also help avoiding accidental reboots and shutdowns. New 'delay-weak'
+          and 'block-weak' inhibitor modes were added, if taken they will make
+          the inhibitor lock work as in the previous versions. Inhibitor locks
+          can also be taken by remote users (subject to polkit policy).
+
+        * systemd-nspawn will now mount the unified cgroup hierarchy into a
+          container if no systemd installation is found in a container's root
+          filesystem. `$SYSTEMD_NSPAWN_UNIFIED_HIERARCHY=0` can be used to override
+          this behavior.
+
+        libsystemd:
+
+        * New sd-json component is now available as part of libsystemd. The
+          goal of the library is to allow structures to be conveniently
+          created in C code and serialized to JSON, and for JSON to
+          conveniently deserialized into in-memory structures, using callbacks
+          to handle specific keys. Various data types like integers, floats,
+          booleans, strings, UUIDs, hex-encoded strings, and arrays are
+          supported natively.
+
+        Service and system management:
+
+        * Environment variable $REMOTE_ADDR is now set when using socket
+          activation for AF_UNIX sockets.
+
+        * Multipath TCP (MPTCP) is now supported as a socket protocol.
+
+        * New crypttab options fido2-pin=, fido2-up=, fido2-uv= can be used to
+          enable/disable the PIN query, User Presence check, and User
+          Verification.
+
+        * New crypttab option password-cache=yes|no|read-only can be used to
+          customize password caching.
+
+        * New fstab option x-systemd.wants= creates "Wants" dependencies.
+          (This is similar to the previously available x-systemd.requires=.)
+
+        * The initialization of the system clock during boot and updates has
+          been simplified: either pid1 or systemd-timesyncd will pick the
+          latest time as indicated by the compiled-in epoch,
+          /usr/lib/clock-epoch, and /var/lib/systemd/timesync/clock. See
+          systemd(1) for an detailed updated description.
+
+        * Ctrl-Alt-Delete is re-enabled during late shutdown, so that the user
+          can still initiate a reboot if the system freezes.
+
+        * Unit option PrivateUsers=identity can be used to request a user
+          namespace with an identity mapping for the first 65536 UIDs/GIDs.
+          This is analogous to the systemd-nspawn's --private-users=identity.
+
+        * Unit option PrivateTmp=disconnected can be used to specify that a
+          separate tmpfs instance should be used for /tmp/ and /var/tmp/ for
+          the unit.
+
+        * A new sleep.conf HibernateOnACPower= option has been added, which
+          when disabled would suppress hibernation in suspend-then-hibernate
+          mode until the system is disconnected from a power source.
+
+        * udev rules now set 'uaccess' for /dev/udmabuf, giving locally
+          logged-in users access to the hardware. This is necessary to support
+          IPMI cameras with libcamera.
+
+        * New RELEASE_TYPE= and EXPERIMENT= fields are documented for the
+          os-release file. For example, "RELEASE_TYPE=development|stable|lts"
+          can be used to indicate various stages of the release life cycle,
+          and "RELEASE_TYPE=experimental" can indicate experimental builds,
+          with the EXPERIMENT= field providing a human-readable description of
+          the nature of the experiment.
+
+        * The manager (and various other tools too) use pidfds in more places
+          to refer to processes.
+
+        * A bunch of patches to ease building against musl have been merged.
+
+        * A build option -D link-executor-shared=false can be used to build
+          the systemd-executor binary (added in the previous release) in a way
+          where it does not link to shared libsystemd-shared-….so library.
+          PID1 holds a reference to the executor binary that was on disk when
+          the manager was started or restarted, but the shared libraries it is
+          linked to are not loaded until the executor binary needs to be used.
+          This partial static linking is a workaround for the issue where,
+          during upgrades, the old libsystemd-shared-….so may have already
+          been removed and the pinned executor binary will just fail to
+          execute.
+
+        systemd-logind:
+
+        * New DesignatedMaintenanceTime= configuration option allows
+          shutdowns to be automatically scheduled at the specified time.
+
+        * logind now reacts to Ctrl-Alt-Shift-Esc being pressed. It will send
+          out a org.freedesktop.login1.SecureAttentionKey signal, indicating a
+          request by the user for the system to display a secure login dialog.
+          The handling of SAK can be suppressed in logind configuration.
+
+        systemd-machined:
+
+        * Unprivileged clients are now allowed to register VMs and containers.
+          Machines started via the systemd-vmspawn@.service unit will now be
+          registered with systemd-machined.
+
+        systemd-resolved:
+
+        * resolvconf command now supports '-p' switch. If specified, the
+          interface will not be used as the default route.
+
+        * resolvectl now allows interactive polkit authorization. It gained a
+          --no-ask-password option to suppress it.
+
+        systemd-networkd and networkctl:
+
+        * IPv6 address labels can be configured in a new [IPv6AddressLabel]
+          section with Prefix= and Label= settings.
+
+        * 'networkctl edit' can now read the new contents from standard input
+          with the new --stdin option.
+
+        * 'networkctl edit' and 'cat' now supports editing .netdev files by
+          link. 'networkctl cat' can also list all configuration files
+          associated with an interface at once with ':all'.
+
+        * networkctl gained a --no-ask-password option to suppress interactive
+          polkit authorization.
+
+        systemd-boot, systemd-stub, and related tools:
+
+        * The EFI stub now supports loading of .ucode sections with microcode
+          from addons.
+
+        * A new .profile PE section type is now documented and supported in
+          systemd-measure, ukify, systemd-stub and systemd-boot. Those new
+          sections allow multiple "profiles" to be stored together in the UKI,
+          with .profile sections creating groupings the UKI, allowing some
+          sections to be shared and other sections like .cmdline or .initrd
+          unique to the profile.
+
+        * ukify gained an --extend switch to import an existing UKI to
+          be extended, and a --measure-base= switch to support measurement
+          of multi-profile UKIs.
+
+        The journal:
+
+        * journalctl can now list invocations of a unit with the
+          --list-invocation options and show logs for a specific invocation
+          with the new --invocation/-I option. (This is analogous to the
+          --list-boots/--boot/-b options.)
+
+        systemd-sysupdate and related tools:
+
+        * systemd-sysupdate can be run as system service, allowing
+          unprivileged clients to update the system via D-Bus calls.
+
+          A new updatectl command-line tool can be used to control the
+          service.
+
+        * systemd-sysupdate gained a new --offline option to force it to
+          operate locally. This is useful when listing locally installed
+          versions.
+
+        * systemd-sysupdate gained a new --transfer-source= option to set the
+          directory to which transfer sources configured with
+          PathRelativeTo=explicit will be interpreted.
+
+        Miscellaneous:
+
+        * systemctl now supports the --now option with the 'reenable' verb.
+
+        * systemd-analyze will now show the SMBIOS #11 vendor strings set for
+          the machine with a new 'smbios11' verb.
+
+        * systemd-analyze gained a new --instance= option that can be used to
+          provide an instance name to analyze multiple templates instantiated
+          with the same instance name.
+
+        * The 'tpm2' verb which lists usable TPM2 devices has been moved from
+          systemd-creds to systemd-analyze.
+
+        * varlinkctl gained a new verb 'list-methods' to show a list of
+          methods implemented by a service.
+
+        * varlinkctl gained a --quiet/-q option to suppress method call
+          replies.
+
+        * varlinkctl gained a --graceful= option to suppress specified Varlink
+          errors.
+
+        * varlinkctl gained a --timeout= option to limit how long the
+          invocation can take.
+
+        * varlinkctl allows remote invocations over ssh, via the new
+          "ssh-exec:" address specification. It'll make an ssh connection,
+          start the specified executable on the remote, and communicate with
+          the remote process using the Varlink protocol.
+
+          "ssh:" address specification has been renamed to "ssh-unix:".
+          (The old syntax is still supported for backwards compatibility.)
+
+        * bootctl gained a --random-seed=yes|no option to control provisioning
+          of the random seed file in ESP. (This is useful when producing an
+          image that will be used multiple times.)
+
+        * systemd-cryptenroll gained new options -fido2-salt-file= and
+          --fido2-parameters-in-header= to simplify manual enrollment of FIDO2
+          tokens.
+
+        * systemd-cryptenroll, systemd-repart, and systemd-storagetm gained a
+          new --list-devices option to list appropriate candidate block
+          devices.
+
+        * systemd-repart's CopyBlocks= directive can now use a char device as
+          source (in addition to previously supported regular files and block
+          devices).
+
+        * systemd-repart gained a new Compression= and CompressionLevel=
+          settings to enable internal compression in filesystems created
+          offline.
+
+        * systemd-repart understands a new MakeSymlinks= option to create one
+          or more symlinks (each specified as a symlink name and target).
+
+        * systemd-mount can now output JSON with a new --json= switch.
+
+        * A new generator sytemd-import-generator has been added to
+          synthetisize image download jobs. This provides functionality
+          similar to importctl, but configured via the kernel command line and
+          system credentials.
+
+        * systemd-inhibit now allows interactive polkit authorization. It
+          gained a --no-ask-password option to suppress it.
+
+        * systemd-id128 gained a new 'var-partition-uuid' verb to calculate
+          the DPS UUID for /var/ keyed by the local machine-id.
+
+        * locatectl gained a -l/--full option to show output without
+          ellipsization.
+
+        * 'busctl monitor' gained new options --num-matches= and --timeout=
+          to set the number of matches or limit the runtime of the command.
+          This is intended to be used in scripts.
+
+        * systemd-run can output some data as  JSON via the new --json= option.
+
+        * timedatectl now supports interactive polkit authorization.
+
         — <place>, <date>
 
 CHANGES WITH 256:
@@ -366,6 +630,13 @@ CHANGES WITH 256:
         * A new unit systemd-udev-load-credentials.service has been added
           to pick up udev.conf drop-ins and udev rules from credentials.
 
+        * 'udevadm test' and 'udevadm test-builtin' commands now do not change
+          any settings; sysfs attributes, sysctls, udev database and so on.
+          E.g. 'udevadm test-builtin net_setup_link /sys/class/net/INTERFACE'
+          does not change any interface settings, but only prints which .link
+          file matches the interface. So, even privileged users can safely
+          invoke the commands.
+
         * An allowlist/denylist may be specified to filter which sysfs
           attributes are used when crafting network interface names. Those
           lists are stored as hwdb entries
@@ -498,9 +769,20 @@ CHANGES WITH 256:
 
         SSH Integration:
 
-        * An sshd config drop-in to allow ssh keys acquired via userdbctl (for
+        * An sshd_config drop-in to allow ssh keys acquired via userdbctl (for
           example expose by homed accounts) to be used for authorization of
-          incoming SSH connections.
+          incoming SSH connections. This uses the AuthorizedKeysCommand stanza
+          of sshd_config. Note that sshd only allows a single command to be
+          configured this way, hence this drop-in might conflict with other
+          uses of the logic. It is possible to chainload another, similar tool
+          of another subsystem via the --chain switch of userdbctl, to support
+          both in parallel. See the "INTEGRATION WITH SSH" section in
+          userdbctl(1) for details on this. Our recommendation how to combine
+          other subsystem's use of the SSH authorized keys logic with systemd's
+          userbctl functionality however is to implement the APIs described
+          here: https://systemd.io/USER_GROUP_API – in that case this newly
+          added sshd_config integration would just work and do the right thing
+          for all backends.
 
         * A small new unit generator "systemd-ssh-generator" has been added. It
           checks if the sshd binary is installed. If so, it binds it via

README

@@ -130,9 +130,10 @@ REQUIREMENTS:
 
         Required for signed Verity images support:
           CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
-        Required to verify signed Verity images using keys enrolled in the MoK
+        Required to verify signed Verity images using keys enrolled in the MOK
-        (Machine-Owner Key) keyring:
+        (Machine-Owner Key) and DB UEFI certificate stores:
           CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
+          CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_PLATFORM_KEYRING
           CONFIG_IMA_ARCH_POLICY
           CONFIG_INTEGRITY_MACHINE_KEYRING
 
@@ -168,6 +169,7 @@ REQUIREMENTS:
 
         Required for systemd-oomd:
           CONFIG_PSI
+          CONFIG_MEMCG
 
         Note that kernel auditing is broken when used with systemd's container
         code. When using systemd in conjunction with containers, please make

TODO

@@ -130,6 +130,71 @@ Deprecations and removals:
 
 Features:
 
+* find a nice way to opt-in into auto-masking SIGCHLD on first
+  sd_event_add_child(), and then get rid of many more explicit sigprocmask()
+  calls.
+
+* maybe set shell.prompt.prefix credential in run0 to some warning emoji,
+  i.e. ⚠️ or ☢️ or ⚡ or 👊 or 🧑‍🔧 or so.
+
+* introduce new structure Tpm2CombinedPolicy, that combines the various TPm2
+  policy bits into one structure, i.e. public key info, pcr masks, pcrlock
+  stuff, pin and so on. Then pass that around in tpm2_seal() and tpm2_unseal().
+
+* look at nsresourced, mountfsd, homed, importd, and try to come up with a way
+  how the forked off worker processes can be moved into transient services with
+  sandboxing, without breaking notify socket stuff and so on.
+
+* replace all \x1b, \x1B, \033 C string escape sequences in our codebase with a
+  more readable \e. It's a GNU extension, but a ton more readable than the
+  others, and most importantly it doesn't result in confusing errors if you
+  suffix the escape sequence with one more decimal digit, because compilers
+  think you might actually specify a value outside the 8bit range with that.
+
+* homed: allow login via username + realm on getty/login prompt. Then rewrite
+  the user name in the PAM stack
+
+* homed/userdb: add "aliases" field to user record, which can alternatively be
+  used for logging in. Rewrite user name in the PAM stack once acquired.
+
+* confext/sysext: instead of mounting the overlayfs directly on /etc/ + /usr/,
+  insert an intermediary bind mount on itself there. This has the benefit that
+  services where mount propagation from the root fs is off, an still have
+  confext/sysext propagated in.
+
+* support F_DUDFD_QUERY for comparing fds in same_fd (requires kernel 6.10)
+
+* generic interface for varlink for setting log level and stuff that all our daemons can implement
+
+* use pty ioctl to get peer wherever possible (TIOCGPTPEER)
+
+* maybe teach repart.d/ dropins a new setting MakeMountNodes= or so, which is
+  just like MakeDirectories=, but uses an access mode of 0000 and sets the +i
+  chattr bit. This is useful as protection against early uses of /var/ or /tmp/
+  before their contents is mounted.
+
+* go through all uses of table_new() in our codebase, and make sure we support
+  all three of:
+  1. --no-legend properly
+  2. --json= properly
+  3. --no-pager properly
+
+* go through all --help texts in our codebases, and make sure:
+  1. the one sentence description of the tool is highlighted via ANSI how we
+     usually do it
+  2. If more than one or two commands are supported (as opposed to switches),
+     separate commands + switches from each other, using underlined --help sections.
+  3. If there are many switches, consider adding additional --help sections.
+
+* go through our codebase, and convert "vertical tables" (i.e. things such as
+  "systemctl status") to use table_new_vertical() for output
+
+* pcrlock: add support for multi-profile UKIs
+
+* logind: when logging in use new tmpfs quota support to configure quota on
+  /tmp/ + /dev/shm/. But do so only in case of tmpfs, because otherwise quota
+  is persistent and any persistent settings mean we don#t have to reapply them.
+
 * initrd: when transitioning from initrd to host, validate that
   /lib/modules/`uname -r` exists, refuse otherwise
 
@@ -161,11 +226,6 @@ Features:
   set Slice=protected.sice, RefuseManualStart=yes, RefuseManualStop=yes and a
   couple of other things.
 
-* improve inode_same_at() to use AT_HANDLE_FID flag in name_to_handle_at() to
-  compare inode identity, rather than .st_ino – where available. Kernel FS
-  folks gave up on idea that inode numbers are fs-wide unique, and suggest
-  using the file handle/AT_HANDLE_FID instead.
-
 * add feature to xopenat() that implements O_REGULAR in userspace: i.e. let's
   open the inode via O_PATH first, then validate its type, and then convert to
   proper fd via fd_reopen()
@@ -249,7 +309,7 @@ Features:
   which uses 32bit words).
 
 * In vmspawn/nspawn/machined wait for X_SYSTEMD_UNIT_ACTIVE=ssh-active.target
-  and X_SYSTEMD_SIGNAL_LEVEL=2 as indication whether/when SSH and the POSIX
+  and X_SYSTEMD_SIGNALS_LEVEL=2 as indication whether/when SSH and the POSIX
   signals are available. Similar for D-Bus (but just use sockets.target for
   that). Report as property for the machine.
 
@@ -269,12 +329,6 @@ Features:
   the bg via vmspawn/nspawn if not done so yet and then requests a shell inside
   it for the invoking user.
 
-* make varlink.h a public API, i.e. give all symbols an sd_ prefix, and rename
-  header file to sd-varlink.h. This of course also means we have to make json.h
-  public the same way. Convert the function param checks from assert() to
-  assert_ret(). Only export the stuff we are sure about, and keep some symbols
-  internally where things are not clear whether we want other projects to use.
-
 * importd/…: define per-user dirs for container/VM images too.
 
 * add a new specifier to unit files that figures out the DDI the unit file is
@@ -433,13 +487,9 @@ Features:
   nvme-oF
 
 * pcrlock:
-  - make signed PCR work together with pcrlock
   - add kernel-install plugin that automatically creates UKI .pcrlock file when
     UKI is installed, and removes it when it is removed again
   - automatically install PE measurement of sd-boot on "bootctl install"
-  - write generated pcrlock signature files to the ESP as credential, one for
-    each installed OS & pick up generated pcrlock signature file in sd-stub,
-    pass it via initrd to OS
   - pre-calc sysext + kernel cmdline measurements
   - pre-calc cryptsetup root key measurement
   - maybe make systemd-repart generate .pcrlock for old and new GPT header in
@@ -538,7 +588,6 @@ Features:
   - cg_pid_get_xyz()
   - pid_from_same_root_fs()
   - get_ctty_devnr()
-  - pid1: sd_notify() receiver should use SCM_PIDFD to authenticate client
   - actually wait for POLLIN on pidref's pidfd in service logic
   - openpt_allocate_in_namespace()
   - unit_attach_pid_to_cgroup_via_bus()
@@ -900,9 +949,6 @@ Features:
 * systemd-tmpfiles: add concept for conditionalizing lines on factory reset
   boot, or on first boot.
 
-* in UKIs: add way to define allowlist of additional words that can be added to
-  the kernel cmdline even in SecureBoot mode
-
 * we probably needs .pcrpkeyrd or so as additional PE section in UKIs,
   which contains a separate public key for PCR values that only apply in the
   initrd, i.e. in the boot phase "enter-initrd". Then, consumers in userspace
@@ -955,12 +1001,6 @@ Features:
 * in the initrd, once the rootfs encryption key has been measured to PCR 15,
   derive default machine ID to use from it, and pass it to host PID 1.
 
-* tree-wide: convert as much as possible over to use sd_event_set_signal_exit(), instead
-  of manually hooking into SIGINT/SIGTERM
-
-* tree-wide: convert as much as possible over to SD_EVENT_SIGNAL_PROCMASK
-  instead of manual blocking.
-
 * sd-boot: for each installed OS, grey out older entries (i.e. all but the
   newest), to indicate they are obsolete
 
@@ -1028,9 +1068,6 @@ Features:
 * in sd-boot: load EFI drivers from a new PE section. That way, one can have a
   "supercharged" sd-boot binary, that could carry ext4 drivers built-in.
 
-* sd-bus: document that sd_bus_process() only returns messages that non of the
-  filters/handlers installed on the connection took possession of.
-
 * sd-device: add an API for acquiring list of child devices, given a device
   objects (i.e. all child dirents that dirs or symlinks to dirs)
 
@@ -1210,9 +1247,6 @@ Features:
   appropriate qemu cmdline. That way qemu payloads could talk sd_notify()
   directly to host service manager.
 
-* sd-device has an API to create an sd_device object from a device id, but has
-  no api to query the device id
-
 * sd-device should return the devnum type (i.e. 'b' or 'c') via some API for an
   sd_device object, so that data passed into sd_device_new_from_devnum() can
   also be queried.
@@ -1257,14 +1291,6 @@ Features:
   multiple versions are around of the same resource, show which ones. (in other
   words: show partition labels).
 
-* maybe add a generator that reads /proc/cmdline, looks for
-  systemd.pull-raw-portable=, systemd-pull-raw-sysext= and similar switches
-  that take a URL as parameter. It then generates service units for
-  systemd-pull calls that download these URLs if not installed yet. Use case:
-  invoke a VM or nspawn container in a way it automatically deploys/runs these
-  images as OS payloads. i.e. have a generic OS image you can point to any
-  payload you like, which is then downloaded, securely verified and run.
-
 * systemd-dissect: add --cat switch for dumping files such as /etc/os-release
 
 * per-service sandboxing option: ProtectIds=. If used, will overmount
@@ -1475,6 +1501,8 @@ Features:
 
 * systemd-analyze netif that explains predictable interface (or networkctl)
 
+* systemd-analyze inspect-elf should show other notes too, at least build-id.
+
 * Figure out naming of verbs in systemd-analyze: we have (singular) capability,
   exit-status, but (plural) filesystems, architectures.
 
@@ -1659,7 +1687,8 @@ Features:
   zero and is not open anymore, while the latter happens when a file is
   unlinked from any dir.
 
-* port systemctl, busctl, … over to format-table.[ch]'s table formatters
+* systemctl, machinectl, loginctl: port "status" commands over to
+  format-table.c's vertical output logic.
 
 * pid1: lock image configured with RootDirectory=/RootImage= using the usual nspawn semantics while the unit is up
 
@@ -1685,9 +1714,6 @@ Features:
   the entire system, with the exception of one specific service. See:
   https://lists.freedesktop.org/archives/systemd-devel/2018-February/040369.html
 
-* maybe rework get_user_creds() to query the user database if $SHELL is used
-  for root, but only then.
-
 * calenderspec: add support for week numbers and day numbers within a
   year. This would allow us to define "bi-weekly" triggers safely.
 
@@ -1836,7 +1862,7 @@ Features:
 
 * fstab-generator: default to tmpfs-as-root if only usr= is specified on the kernel cmdline
 
-* docs: bring https://systemd.io/MY_SERVICE_CANT_GET_REATLIME up to date
+* docs: bring https://systemd.io/MY_SERVICE_CANT_GET_REALTIME up to date
 
 * add a job mode that will fail if a transaction would mean stopping
   running units. Use this in timedated to manage the NTP service
@@ -1992,6 +2018,8 @@ Features:
   - ExtensionImages= deduplication for services is currently only applied to disk images without GPT envelope.
     This should be extended to work with proper DDIs too, as well as directory confext/sysext. Moreover,
     system-wide confex/sysext should support this too.
+  - Pin the mount namespace via FD by sending it back from sd-exec to the manager, and use it
+    for live mounting, instead of doing it via PID
 
 * unit files:
   - allow port=0 in .socket units
@@ -2132,16 +2160,9 @@ Features:
   - follow PropertiesChanged state more closely, to deal with quick logouts and
     relogins
   - (optionally?) spawn seat-manager@$SEAT.service whenever a seat shows up that as CanGraphical set
-  - expose details of boot entries on the bus. In particular, it should be possible
-    to query the list of boot entry titles that bootctl / sd-boot would show.
-    Currently we only expose their identifiers.
 
 * move multiseat vid/pid matches from logind udev rule to hwdb
 
-* logind: rework pam_logind to also do a bus call in case of invocation from
-  user@.service, which returns the XDG_RUNTIME_DIR value, and make this
-  behaviour selectable via pam module option.
-
 * delay activation of logind until somebody logs in, or when /dev/tty0 pulls it
   in or lingering is on (so that containers don't bother with it until PAM is used). also exit-on-idle
 
@@ -2255,9 +2276,7 @@ Features:
   should probably honour that same limit (JOURNAL_FILES_MAX) when vacuuming to
   ensure we never generate more files than we can actually view.
 
-* maybe add a tool that displays most recent journal logs as QR code to scan
+* bsod: maybe use graphical mode. Use DRM APIs directly, see
-  off screen and run it automatically on boot failures, emergency logs and
-  such. Use DRM APIs directly, see
   https://github.com/dvdhrm/docs/blob/master/drm-howto/modeset.c for an example
   for doing that.
 
@@ -2311,7 +2330,7 @@ Features:
   - GNOME's side for forget key on suspend (requires rework so that lock screen runs outside of uid)
   - update LUKS password on login if we find there's a password that unlocks the JSON record but not the LUKS device.
   - create on activate?
-  - properties: icon url?, preferred session type?, administrator bool (which translates to 'wheel' membership)?, address?, telephone?, vcard?, samba stuff?, parental controls?
+  - properties: icon url?, administrator bool (which translates to 'wheel' membership)?, address?, telephone?, vcard?, samba stuff?, parental controls?
   - communicate clearly when usb stick is safe to remove. probably involves
     beefing up logind to make pam session close hook synchronous and wait until
     systemd --user is shut down.

catalog/systemd.catalog.in

@@ -788,9 +788,22 @@ Defined-By: systemd
 Support: %SUPPORT_URL%
 Documentation: man:systemd-tpm2-setup.service(8)
 
-An authorization failure occurred while attempting to enroll a Storage Root Key (SRK) on the Trusted Platform
+An authorization failure occurred while attempting to enroll a Storage Root Key
-Module (TPM). Most likely this means that a PIN/Password (authValue) has been set on the Owner hierarchy of
+(SRK) on the Trusted Platform Module (TPM). Most likely this means that a
-the TPM.
+PIN/Password (authValue) has been set on the Owner hierarchy of the TPM.
 
-Automatic SRK enrollment on TPMs in such scenarios is not supported. In order to unset the PIN/password
+Automatic SRK enrollment on TPMs in such scenarios is not supported. In order
-protection on the owner hierarchy issue a command like the following: 'tpm2_changeauth -c o -p <OLDPW> ""'.
+to unset the PIN/password protection on the owner hierarchy issue a command
+like the following: 'tpm2_changeauth -c o -p <OLDPW> ""'.
+
+-- 9cf56b8baf9546cf9478783a8de42113
+Subject: A foreign process changed a sysctl systemd-networkd manages
+Defined-By: systemd
+Support: %SUPPORT_URL%
+
+The sysctl configuration setting @SYSCTL@, which is managed by
+systemd-networkd, has been changed by another, unrelated process
+("@OBJECT_COMM@", PID @OBJECT_PID@). This represents a conflict of ownership
+and will likely result in problems later on.
+
+Value changed to "@NEWVALUE@", which should be "@OURVALUE@".

docs/APPSTREAM_BUNDLE.md

@@ -0,0 +1,118 @@
+---
+title: Appstream Bundle
+category: Interfaces
+layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
+---
+
+# Appstream Bundle
+
+NOTE: This document is a work-in-progress.
+
+NOTE: This isn't yet implemented in libappstream and the software centers.
+
+[Appstream catalogs](https://www.freedesktop.org/software/appstream/docs/chap-CatalogData.html)
+are a standardized way to expose metadata about system components, apps, and updates to software
+centers (i.e. GNOME Software and KDE Discover). The `<bundle/>` tag links an appstream component
+to a packaging format. This is used by the software centers to decide which code path (or plugin)
+should handle the component. For instance: components with a `<bundle type="package">...</bundle>`
+will be handled by [PackageKit](https://www.freedesktop.org/software/PackageKit/), and components
+with a `<bundle type="flatpak">...</bundle>` will be handled by [libflatpak](https://docs.flatpak.org/).
+This document will define how to format an appstream component's `<bundle>` tag such that software
+centers will know to manage it using systemd. The following syntax will be supported:
+
+A `type="systemd"` attribute. This tells the software center that it should treat the bundle tag
+as described in this document.
+
+A `class=""` attribute, with the following possible values: `sysupdate`, `extension`, `confext`,
+or `portable`. These correspond to sysupdate components, sysexts, confexts, and portable services
+respectively.
+
+The value of the tag will be used as the name of the image (corresponding to the `class=` attribute).
+So for instance, `<bundle type="systemd" class="extension">foobar</bundle>` corresponds to a sysext
+named "foobar". For `class="sysupdate"`, there is a special case: if the value is empty, then the
+bundle actually refers to the host system.
+
+## Examples
+
+```xml
+<component type="addon">
+	<id>com.example.Devel</id>
+	<extends>com.example.OS</extends>
+	<name>Development Tools</name>
+	<summary>Tools essential to develop Example OS</summary>
+	<provides>
+		<binary>gcc</binary>
+		<binary>g++</binary>
+		<binary>make</binary>
+		<binary>autoconf</binary>
+		<binary>cmake</binary>
+		<binary>meson</binary>
+		<binary>ninja</binary>
+	</provides>
+	<developer_name>Example, inc.</developer_name>
+	<releases>
+		<release version="45" date="2024-01-15" />
+		<release version="44" date="2023-12-08" />
+		<release version="43" date="2023-11-10" />
+	</releases>
+	<bundle type="systemd" class="extension">devel</bundle>
+</component>
+```
+
+defines a sysext named `devel` to be presented by the software center. It will be
+updated via `systemd-sysupdated`'s `extension:devel` target. It will be treated
+as a plugin for the operating system itself.
+
+```xml
+<component merge="append">
+	<id>com.example.OS</id>
+	<releases>
+		<release version="45" date="2024-01-15" urgency="high">
+			<description>
+				<p>This release includes various bug fixes and performance improvements</p>
+			</description>
+		</release>
+	</releases>
+	<bundle type="systemd" class="sysupdate" />
+</component>
+```
+
+extends existing appstream metadata for the host OS with a changelog. It also tells the software
+center that the host OS should be updated using the `host` target for `systemd-sysupdated`.
+
+```xml
+<component type="service">
+	<id>com.example.Foobar</id>
+	<name>Foobar Service</name>
+	<summary>Service that does foo to bar</summary>
+	<icon type="remote">https://example.com/products/foobar/logo.svg</icon>
+	<url type="homepage">https://example.com/products/foobar</url>
+	<provides>
+		<dbus type="system">com.example.Foobar</dbus>
+	</provides>
+	<developer_name>Example, inc.</developer_name>
+	<releases>
+		<release version="1.0.1" date="2024-02-16" urgency="critical">
+			<description>
+				<p>This release fixes a major security vulnerability. Please update ASAP.</p>
+			</description>
+			<issues>
+				<issue type="cve">CVE-2024-28153</issue>
+			</issues>
+		</release>
+		<release version="1.1-beta" date="2024-01-08" type="development" />
+		<release version="1.0" date="2023-11-23">
+			<description>
+				<p>Initial release!</p>
+			</description>
+		</release>
+	</releases>
+	<bundle type="systemd" class="portable">foobar</bundle>
+</component>
+```
+
+defines a portable service named `foobar` to be presented by the software center. It will be
+updated via `systemd-sysupdated`'s `portable:foobar` target. It will be marked as an
+urgent update. It will be presented to the user with a display name, a description, and
+a custom icon.

docs/BOOT.md

@@ -93,7 +93,7 @@ Hotkeys to select a specific entry in the menu, or when pressed during bootup to
 |--------|------------------------------------------------------------|
 | l | Linux |
 | w | Windows |
-| a | OS X |
+| a | macOS |
 | s | EFI Shell |
 | 1-9 | number of entry |
 

docs/CONTAINER_INTERFACE.md

@@ -237,7 +237,9 @@ care should be taken to avoid naming conflicts. `systemd` (and in particular
    directory: it's used by code outside the container to insert mounts inside
    it only, and is mostly an internal vehicle to achieve this. Other container
    managers that want to implement similar functionality might consider using
-   the same directory.
+   the same directory. Alternatively, the new mount API may be used by the
+   container manager to establish new mounts in the container without the need
+   for the `/run/host/incoming/` directory.
 
 2. The `/run/host/inaccessible/` directory may be set up by the container
    manager to include six file nodes: `reg`, `dir`, `fifo`, `sock`, `chr`,

docs/CONTROL_GROUP_INTERFACE.md

@@ -223,7 +223,7 @@ Use these APIs to register any kind of process workload with systemd to be place
 
 ### Reading Accounting Information
 
-Note that there's currently no systemd API to retrieve accounting information from cgroups. For now, if you need to retrieve this information use `/proc/$PID/cgroup` to determine the cgroup path for your process in the `cpuacct` controller (or whichever controller matters to you), and then read the attributes directly from the cgroup tree.
+Accounting information is available via the `MemoryCurrent`, `MemoryPeak`, `MemorySwapCurrent`, `MemorySwapPeak`, `MemoryZSwapCurrent`, `MemoryAvailable`, `EffectiveMemoryMax`, `EffectiveMemoryHigh`, `CPUUsageNSec`, `EffectiveCPUs`, `EffectiveMemoryNodes`, `TasksCurrent`, `EffectiveTasksMax`, `IPIngressBytes`, `IPIngressPackets`, `IPEgressBytes`, `IPEgressPackets`, `IOReadBytes`, `IOReadOperations`, `IOWriteBytes`, and `IOWriteOperations` D-Bus properties.  To read this and other information directly from the cgroup tree, get the unit's cgroup path (relative to `/sys/fs/cgroup`) from the `ControlGroup` property, by calling [`sd_pid_get_cgroup()`](https://www.freedesktop.org/software/systemd/man/latest/sd_pid_get_cgroup.html), or by parsing `/proc/$PID/cgroup`.
 
 If you want to collect the exit status and other runtime parameters of your transient scope or service unit after the processes in them ended set the `RemainAfterExit` boolean property when creating it. This will has the effect that the unit will stay around even after all processes in it died, in the `SubState="exited"` state. Simply watch for state changes until this state is reached, then read the status details from the various properties you need, and finally terminate the unit via `StopUnit()` on the `Manager` object or `Stop()` on the `Unit` object itself.
 
@@ -247,4 +247,4 @@ Note that scope units created by `machined`'s `CreateMachine()` call have this f
 
 ### Example
 
-Please see the [systemd-run sources](http://cgit.freedesktop.org/systemd/systemd/plain/src/run/run.c) for a relatively simple example how to create scope or service units transiently and pass properties to them.
+Please see the [systemd-run sources](https://github.com/systemd/systemd/blob/main/src/run/run.c) for a relatively simple example how to create scope or service units transiently and pass properties to them.

docs/ELF_DLOPEN_METADATA.md

@@ -87,3 +87,90 @@ of the libraries they specify in order to be enabled.
 | required    | Core functionality needs the dependency, the binary will not work if it cannot be found                                              |
 | recommended | Important functionality needs the dependency, the binary will work but in most cases the dependency should be provided               |
 | suggested   | Secondary functionality needs the dependency, the binary will work and the dependency is only needed for full-featured installations |
+
+### Displaying `dlopen()` notes
+
+The raw ELF section can be extracted using `objdump`:
+```console
+$ objdump -j .note.dlopen -s /usr/lib64/systemd/libsystemd-shared-257.so
+
+/usr/lib64/systemd/libsystemd-shared-257.so:     file format elf64-x86-64
+
+Contents of section .note.dlopen:
+ 0334 04000000 8e000000 0a0c7c40 46444f00  ..........|@FDO.
+ 0344 5b7b2266 65617475 7265223a 22627066  [{"feature":"bpf
+ 0354 222c2264 65736372 69707469 6f6e223a  ","description":
+ 0364 22537570 706f7274 20666972 6577616c  "Support firewal
+ 0374 6c696e67 20616e64 2073616e 64626f78  ling and sandbox
+ 0384 696e6720 77697468 20425046 222c2270  ing with BPF","p
+ 0394 72696f72 69747922 3a227375 67676573  riority":"sugges
+ 03a4 74656422 2c22736f 6e616d65 223a5b22  ted","soname":["
+ 03b4 6c696262 70662e73 6f2e3122 2c226c69  libbpf.so.1","li
+ 03c4 62627066 2e736f2e 30225d7d 5d000000  bbpf.so.0"]}]...
+ 03d4 04000000 9e000000 0a0c7c40 46444f00  ..........|@FDO.
+...
+```
+
+It is more convenient to use a higher level tool:
+```console
+$ dlopen-notes /usr/lib64/systemd/libsystemd-shared-257.so
+# /usr/lib64/systemd/libsystemd-shared-257.so
+[
+  {
+    "feature": "archive",
+    "description": "Support for decompressing archive files",
+    "priority": "suggested",
+    "soname": [
+      "libarchive.so.13"
+    ]
+  },
+  {
+    "feature": "bpf",
+    "description": "Support firewalling and sandboxing with BPF",
+    "priority": "suggested",
+    "soname": [
+      "libbpf.so.1",
+      "libbpf.so.0"
+    ]
+  },
+...
+```
+
+`dlopen-notes` can display the notes grouped in a few different ways.
+One option is to filter the libraries by "feature". This answers the
+question "what libraries are needed to provide specified features":
+
+```console
+$ dlopen-notes.py -f archive,bpf /usr/lib64/systemd/libsystemd-shared-257.so
+# grouped by feature
+{
+  "bpf": {
+    "description": "Support firewalling and sandboxing with BPF",
+    "sonames": {
+      "libbpf.so.1": "suggested",
+      "libbpf.so.0": "suggested"
+    }
+  },
+  "archive": {
+    "description": "Support for decompressing archive files",
+    "sonames": {
+      "libarchive.so.13": "suggested"
+    }
+  }
+}
+
+The format that is used when building `deb` packages:
+```console
+$ dlopen-notes -s /usr/lib64/systemd/libsystemd-shared-257.so
+libarchive.so.13 suggested
+libbpf.so.0 suggested
+libbpf.so.1 suggested
+...
+```
+
+The format that can be useful when building `rpm` packages:
+```console
+$ dlopen-notes --rpm-requires archive --rpm-recommends bpf  /usr/lib64/systemd/libsystemd-shared-257.so
+Requires: libarchive.so.13()(64bit)
+Recommends: libbpf.so.1()(64bit)
+```

docs/ELF_PACKAGE_METADATA.md

@@ -103,3 +103,97 @@ A set of well-known keys is defined here, and hopefully shared among all vendors
 | architecture | The binary package architecture                                          | arm32                                 |
 | osCpe        | A CPE name for the OS, typically corresponding to CPE_NAME in os-release | cpe:/o:fedoraproject:fedora:33        |
 | debugInfoUrl | The debuginfod server url, if available                                  | https://debuginfod.fedoraproject.org/ |
+
+### Displaying package notes
+
+The raw ELF section can be extracted using `objdump`:
+```console
+$ objdump -j .note.package -s /usr/bin/ls
+
+/usr/bin/ls:     file format elf64-x86-64
+
+Contents of section .note.package:
+ 03cc 04000000 7c000000 7e1afeca 46444f00  ....|...~...FDO.
+ 03dc 7b227479 7065223a 2272706d 222c226e  {"type":"rpm","n
+ 03ec 616d6522 3a22636f 72657574 696c7322  ame":"coreutils"
+ 03fc 2c227665 7273696f 6e223a22 392e342d  ,"version":"9.4-
+ 040c 372e6663 3430222c 22617263 68697465  7.fc40","archite
+ 041c 63747572 65223a22 7838365f 3634222c  cture":"x86_64",
+ 042c 226f7343 7065223a 22637065 3a2f6f3a  "osCpe":"cpe:/o:
+ 043c 6665646f 72617072 6f6a6563 743a6665  fedoraproject:fe
+ 044c 646f7261 3a343022 7d000000           dora:40"}...
+```
+
+It is more convenient to use a higher level tool:
+```console
+$ readelf --notes /usr/bin/ls
+...
+Displaying notes found in: .note.gnu.build-id
+  Owner                Data size 	Description
+  GNU                  0x00000014	NT_GNU_BUILD_ID (unique build ID bitstring)
+    Build ID: 40e5a1570a9d97fc48f5c61cfb7690fec0f872b2
+
+Displaying notes found in: .note.ABI-tag
+  Owner                Data size 	Description
+  GNU                  0x00000010	NT_GNU_ABI_TAG (ABI version tag)
+    OS: Linux, ABI: 3.2.0
+
+Displaying notes found in: .note.package
+  Owner                Data size 	Description
+  FDO                  0x0000007c	FDO_PACKAGING_METADATA
+    Packaging Metadata: {"type":"rpm","name":"coreutils","version":"9.4-7.fc40","architecture":"x86_64","osCpe":"cpe:/o:fedoraproject:fedora:40"}
+...
+
+$ systemd-analyze inspect-elf /usr/bin/ls
+           path: /usr/bin/ls
+        elfType: executable
+elfArchitecture: AMD x86-64
+
+           type: rpm
+           name: coreutils
+        version: 9.4-7.fc40
+   architecture: x86_64
+          osCpe: cpe:/o:fedoraproject:fedora:40
+        buildId: 40e5a1570a9d97fc48f5c61cfb7690fec0f872b2
+```
+
+If the binary crashes, `systemd-coredump` will display the combined information
+from the crashing binary and any shared libraries it links to:
+
+```console
+$  coredumpctl info
+           PID: 3987823 (ls)
+        Signal: 11 (SEGV)
+  Command Line: ls --color=tty -lR /
+    Executable: /usr/bin/ls
+...
+       Storage: /var/lib/systemd/coredump/core.ls.1000.88dea1b9831c420dbb398f9d2ad9b41e.3987823.1726230641000000.zst (present)
+  Size on Disk: 194.4K
+       Package: coreutils/9.4-7.fc40
+      build-id: 40e5a1570a9d97fc48f5c61cfb7690fec0f872b2
+       Message: Process 3987823 (ls) of user 1000 dumped core.
+
+                Module /usr/bin/ls from rpm coreutils-9.4-7.fc40.x86_64
+                Module libz.so.1 from rpm zlib-ng-2.1.7-1.fc40.x86_64
+                Module libcrypto.so.3 from rpm openssl-3.2.2-3.fc40.x86_64
+                Module libmount.so.1 from rpm util-linux-2.40.1-1.fc40.x86_64
+                Module libcrypt.so.2 from rpm libxcrypt-4.4.36-5.fc40.x86_64
+                Module libblkid.so.1 from rpm util-linux-2.40.1-1.fc40.x86_64
+                Module libnss_sss.so.2 from rpm sssd-2.9.5-1.fc40.x86_64
+                Module libpcre2-8.so.0 from rpm pcre2-10.44-1.fc40.x86_64
+                Module libcap.so.2 from rpm libcap-2.69-8.fc40.x86_64
+                Module libselinux.so.1 from rpm libselinux-3.6-4.fc40.x86_64
+                Stack trace of thread 3987823:
+                #0  0x00007f19331c3f7e lgetxattr (libc.so.6 + 0x116f7e)
+                #1  0x00007f19332be4c0 lgetfilecon_raw (libselinux.so.1 + 0x134c0)
+                #2  0x00007f19332c3bd9 lgetfilecon (libselinux.so.1 + 0x18bd9)
+                #3  0x000056038273ad55 gobble_file.constprop.0 (/usr/bin/ls + 0x17d55)
+                #4  0x0000560382733c55 print_dir (/usr/bin/ls + 0x10c55)
+                #5  0x0000560382727c35 main (/usr/bin/ls + 0x4c35)
+                #6  0x00007f19330d7088 __libc_start_call_main (libc.so.6 + 0x2a088)
+                #7  0x00007f19330d714b __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x2a14b)
+                #8  0x0000560382728f15 _start (/usr/bin/ls + 0x5f15)
+                ELF object binary architecture: AMD x86-64
+```
+
+(This is just a simulation. `ls` is not prone to crashing with a segmentation violation.)

docs/ENVIRONMENT.md

@@ -23,17 +23,17 @@ All tools:
 * `$SYSTEMD_OFFLINE=[0|1]` — if set to `1`, then `systemctl` will refrain from
   talking to PID 1; this has the same effect as the historical detection of
   `chroot()`. Setting this variable to `0` instead has a similar effect as
-  `$SYSTEMD_IGNORE_CHROOT=1`; i.e. tools will try to communicate with PID 1
+  `$SYSTEMD_IN_CHROOT=0`; i.e. tools will try to communicate with PID 1
   even if a `chroot()` environment is detected. You almost certainly want to
   set this to `1` if you maintain a package build system or similar and are
   trying to use a modern container system and not plain `chroot()`.
 
-* `$SYSTEMD_IGNORE_CHROOT=1` — if set, don't check whether being invoked in a
+* `$SYSTEMD_IN_CHROOT=0|1` — takes a boolean. If set, overrides chroot detection.
-  `chroot()` environment. This is particularly relevant for systemctl, as it
+  This is particularly relevant for systemctl, as it will not alter its behaviour
-  will not alter its behaviour for `chroot()` environments if set. Normally it
+  for `chroot()` environments if `SYSTEMD_IN_CHROOT=0`. Normally it refrains from
-  refrains from talking to PID 1 in such a case; turning most operations such
+  talking to PID 1 in such a case; turning most operations such as `start` into
-  as `start` into no-ops.  If that's what's explicitly desired, you might
+  no-ops. If that's what's explicitly desired, you might consider setting
-  consider setting `$SYSTEMD_OFFLINE=1`.
+  `$SYSTEMD_OFFLINE=1`.
 
 * `$SYSTEMD_FIRST_BOOT=0|1` — if set, assume "first boot" condition to be false
   or true, instead of checking the flag file created by PID 1.
@@ -634,6 +634,10 @@ SYSTEMD_HOME_DEBUG_SUFFIX=foo \
 
 * `$SYSTEMD_REPART_OVERRIDE_FSTYPE` – if set the value will override the file
   system type specified in Format= lines in partition definition files.
+  Additionally, the filesystem for all partitions with a specific designator can
+  be overridden via a correspondingly named environment variable. For example,
+  to override the filesystem type for all partitions with `Type=root`, you can
+  set `SYSTEMD_REPART_OVERRIDE_FSTYPE_ROOT=ext4`.
 
 `systemd-nspawn`, `systemd-networkd`:
 

docs/FAQ.md

@@ -104,7 +104,7 @@ A: Use:
 
 **Q: Whenever my service tries to acquire RT scheduling for one of its threads this is refused with EPERM even though my service is running with full privileges. This works fine on my non-systemd system!**
 
-A: By default, systemd places all systemd daemons in their own cgroup in the "cpu" hierarchy. Unfortunately, due to a kernel limitation, this has the effect of disallowing RT entirely for the service. See [My Service Can't Get Realtime!](/MY_SERVICE_CANT_GET_REATLIME) for a longer discussion and what to do about this.
+A: By default, systemd places all systemd daemons in their own cgroup in the "cpu" hierarchy. Unfortunately, due to a kernel limitation, this has the effect of disallowing RT entirely for the service. See [My Service Can't Get Realtime!](/MY_SERVICE_CANT_GET_REALTIME) for a longer discussion and what to do about this.
 
 **Q: My service is ordered after `network.target` but at boot it is still called before the network is up. What's going on?**
 

docs/HACKING.md

@@ -29,8 +29,7 @@ For some components (most importantly, systemd/PID 1 itself) this is not possibl
 In order to simplify testing for cases like this we provide a set of `mkosi` config files directly in the source tree.
 [mkosi](https://mkosi.systemd.io/)
 is a tool for building clean OS images from an upstream distribution in combination with a fresh build of the project in the local working directory.
-To make use of this, please install `mkosi` v19 or newer using your distribution's package manager or from the
+To make use of this, please install `mkosi` from the [GitHub repository](https://github.com/systemd/mkosi#running-mkosi-from-the-repository).
-[GitHub repository](https://github.com/systemd/mkosi).
 `mkosi` will build an image for the host distro by default.
 First, run `mkosi genkey` to generate a key and certificate to be used for secure boot and verity signing.
 After that is done, it is sufficient to type `mkosi` in the systemd project directory to generate a disk image you can boot either in `systemd-nspawn` or in a UEFI-capable VM:
@@ -45,71 +44,52 @@ or:
 $ mkosi qemu
 ```
 
-Every time you rerun the `mkosi` command a fresh image is built,
+By default, the tools from your host system are used to build the image. To have
-incorporating all current changes you made to the project tree.
+`mkosi` use the systemd tools from the `build/` directory, add the following to
-
+`mkosi.local.conf`:
-By default a directory image is built.
-This requires `virtiofsd` to be installed on the host.
-To build a disk image instead which does not require `virtiofsd`, add the following to `mkosi.local.conf`:
-
-```conf
-[Output]
-Format=disk
-```
-
-To boot in UEFI mode instead of using QEMU's direct kernel boot, add the following to `mkosi.local.conf`:
 
 ```conf
 [Host]
-QemuFirmware=uefi
+ExtraSearchPaths=build/
 ```
 
-To avoid having to build a new image all the time when iterating on a patch,
+And if you want `mkosi` to build a tools image and use the tools from there
-add the following to `mkosi.local.conf`:
+instead of looking for tools on the host, add the following to
+`mkosi.local.conf`:
 
 ```conf
 [Host]
-RuntimeBuildSources=yes
+ToolsTree=default
 ```
 
-After enabling this setting, the source and build directories will be mounted to
+Every time you rerun the `mkosi` command a fresh image is built, incorporating
-`/work/src` and `/work/build` respectively when booting the image as a container
+all current changes you made to the project tree. To build the latest changes
-or virtual machine. To build the latest changes and re-install, run
+and re-install after booting the image, run one of the following commands in
-`meson install -C /work/build --only-changed` in the container or virtual machine
+another terminal on your host (choose the right one depending on the
-and optionally restart the daemon(s) you're working on using
+distribution of the container or virtual machine):
-`systemctl restart <units>` or `systemctl daemon-reexec` if you're working on pid1
-or `systemctl soft-reboot` to restart everything.
-
-Aside from the image, the `mkosi.output` directory will also be populated with a
-set of distribution packages. Assuming you're running the same distribution and
-release as the mkosi image, you can install these rpms on your host or test
-system as well for any testing or debugging that cannot easily be performed in a
-VM or container.
-
-By default, no debuginfo packages are produced. To produce debuginfo packages,
-run mkosi with the `WITH_DEBUG` environment variable set to `1`:
 
 ```sh
-$ mkosi -E WITH_DEBUG=1 -f
+mkosi -t none && mkosi ssh dnf upgrade --disablerepo="*" --assumeyes "/work/build/*.rpm" # CentOS/Fedora
+mkosi -t none && mkosi ssh apt-get install "/work/build/*.deb" # Debian/Ubuntu
+mkosi -t none && mkosi ssh pacman --upgrade --needed --noconfirm "/work/build/*.pkg.tar" # Arch Linux
+mkosi -t none && mkosi ssh zypper --non-interactive install --allow-unsigned-rpm "/work/build/*.rpm" # OpenSUSE
 ```
 
-or configure it in `mkosi.local.conf`:
+and optionally restart the daemon(s) you're working on using
-
+`systemctl restart <units>` or `systemctl daemon-reexec` if you're working on
-```conf
+pid1 or `systemctl soft-reboot` to restart everything.
-[Content]
-Environment=WITH_DEBUG=1
-```
 
 Putting this all together, here's a series of commands for preparing a patch for systemd:
 
 ```sh
-$ git clone https://github.com/systemd/mkosi.git  # If mkosi v19 or newer is not packaged by your distribution
+$ git clone https://github.com/systemd/mkosi.git
-$ ln -s $PWD/mkosi/bin/mkosi /usr/local/bin/mkosi # If mkosi v19 or newer is not packaged by your distribution
+$ ln -s $PWD/mkosi/bin/mkosi /usr/local/bin/mkosi
 $ git clone https://github.com/systemd/systemd.git
 $ cd systemd
 $ git checkout -b <BRANCH>        # where BRANCH is the name of the branch
 $ vim src/core/main.c             # or wherever you'd like to make your changes
 $ mkosi -f qemu                   # (re-)build and boot up the test image in qemu
+$ mkosi -t none                   # Build new packages without rebuilding the image
 $ git add -p                      # interactively put together your patch
 $ git commit                      # commit it
 $ git push -u <REMOTE>            # where REMOTE is your "fork" on GitHub

docs/INHIBITOR_LOCKS.md

@@ -42,6 +42,9 @@ If such a lock is taken the operation will fail (but still may be overridden if
 The InhibitDelayMaxSec= setting in [logind.conf(5)](http://www.freedesktop.org/software/systemd/man/logind.conf.html) controls the timeout for this. This is intended to be used by applications which need a synchronous way to execute actions before system suspend but shall not be allowed to block suspend indefinitely.
 This mode is only available for _sleep_ and _shutdown_ locks.
 
+3. _block-weak_ and _delay-weak_ that work as the non-weak counterparts, but that in addition may be ignored
+automatically and silently under certain circumstances, unlike the formers which are always respected.
+
 Inhibitor locks are taken via the Inhibit() D-Bus call on the logind Manager object:
 
 ```

docs/RELEASE.md

@@ -27,3 +27,9 @@ SPDX-License-Identifier: LGPL-2.1-or-later
 18. [FINAL] Build and upload the documentation (on the -stable branch): `ninja -C build doc-sync`
 20. [FINAL] Change the Github Pages branch to the newly created branch (https://github.com/systemd/systemd/settings/pages) and set the 'Custom domain' to 'systemd.io'
 21. [FINAL] Update version number in `meson.version` to the devel version of the next release (e.g. from `v256` to `v257~devel`)
+
+# Steps to a Successful Stable Release
+
+1. Backport at least the commits from all PRs tagged with `needs-stable-backport` on Github with `git cherry-pick -x`. Any other commits that fix bugs, change documentation, tests, CI or mkosi can generally be backported as well. Since 256 the stable branches live [here](https://github.com/systemd/systemd/). Stable branches for older releases are available [here](https://github.com/systemd/systemd-stable/). Check each commit to see if it makes sense to backport and check the comments on the PR to see if the author indicated that only specific commits should be backported.
+2. Update the version number in `meson.version` (e.g. from `256.2` to `256.3`) (only for 256-stable or newer)
+3. Tag the release: `version="v$(cat meson.version)" && git tag -s "${version}" -m "systemd-stable ${version}"` (Fill in the version manually on releases older than 256)

docs/TPM2_PCR_MEASUREMENTS.md

@@ -120,6 +120,16 @@ Devicetree addons are measured individually as a tagged event.
 
 → **Measured hash** covers the content of the Devicetree.
 
+### PCR 12, `EV_EVENT_TAG`, "Ucode addons"
+
+Ucode addons are measured individually as a tagged event.
+
+→ **Event Tag** `0xdac08e1a`
+
+→ **Description** the addon filename.
+
+→ **Measured hash** covers the contents of the ucode initrd.
+
 ### PCR 12, `EV_IPL`, "Per-UKI Credentials initrd"
 
 → **Description** in the event log record is the constant string "Credentials

docs/UIDS-GIDS.md

@@ -27,9 +27,6 @@ i.e. 0…4294967295. However, four UIDs are special on Linux:
    only supporting 16-bit UIDs, NFS or user namespacing.
    (The latter can be changed with a sysctl during runtime, but that's not supported on
    `systemd`. If you do change it you void your warranty.)
-   Because Fedora is a bit confused the `nobody` user is called `nfsnobody` there
-   (and they have a different `nobody` user at UID 99).
-   I hope this will be corrected eventually though.
    (Also, some distributions call the `nobody` group `nogroup`. I wish they didn't.)
 
 3. 4294967295, aka "32-bit `(uid_t) -1`" → This UID is not a valid user ID, as

hwdb.d/60-evdev.hwdb

@@ -255,6 +255,13 @@ evdev:input:b0003v0ED1p7821*
 # Dell
 #########################################
 
+# Dell AlpsPS/2 ALPS DualPoint TouchPad
+evdev:name:AlpsPS/2 ALPS DualPoint TouchPad:dmi:*:svnDellInc.*:pnLatitudeE7440*:
+ EVDEV_ABS_00=:::28
+ EVDEV_ABS_01=:::28
+ EVDEV_ABS_35=:::28
+ EVDEV_ABS_36=:::28
+
 # Dell Vostro 1510
 evdev:name:AlpsPS/2 ALPS GlidePoint*:dmi:bvn*:bvr*:bd*:svnDellInc.:pnVostro1510:*
  EVDEV_ABS_00=::14
@@ -623,6 +630,13 @@ evdev:name:SynPS/2 Synaptics TouchPad:dmi:*svnLENOVO:*pvrThinkPadL14Gen1**
  EVDEV_ABS_35=::44
  EVDEV_ABS_36=::50
 
+# Lenovo Thinkpad E16 Gen1 (Intel)
+evdev:name:SYNA801A:00 06CB:CEC6 Touchpad:dmi:*svnLENOVO:*pvrThinkPadE16Gen1**
+ EVDEV_ABS_00=::11
+ EVDEV_ABS_01=::11
+ EVDEV_ABS_35=::11
+ EVDEV_ABS_36=::11
+
 # Lenovo T460
 evdev:name:SynPS/2 Synaptics TouchPad:dmi:*svnLENOVO*:pn*ThinkPad*T460:*
  EVDEV_ABS_00=1266:5677:44

hwdb.d/60-keyboard.hwdb

@@ -223,7 +223,7 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnPackard*Bell*:pn*:*
 
 # Swift SF314-511
 evdev:atkbd:dmi:bvn*:bvr*:bd*:svnAcer*:pnSwiftSF314-511:pvr*
- KEYBOARD_KEY_8a=f20					# Fn+F12, microphone mute
+ KEYBOARD_KEY_8a=f20                                    # Fn+F12, microphone mute
 
 # Predator PHN16-71
 evdev:atkbd:dmi:bvn*:bvr*:bd*:svnAcer*:pnPredatorPHN16-71:*
@@ -231,6 +231,10 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnAcer*:pnPredatorPHN16-71:*
  KEYBOARD_KEY_f5=prog1                                  # "predator sense" button
  KEYBOARD_KEY_66=micmute                                # Microphone mute button
 
+# Predator PHN16-72
+evdev:atkbd:dmi:bvn*:bvr*:bd*:svnAcer*:pnPredatorPHN16-72:*
+ KEYBOARD_KEY_66=micmute                                # Microphone mute button
+
 # Nitro AN515-58
 evdev:atkbd:dmi:bvn*:bvr*:bd*:svnAcer*:pnNitro*AN*515-58:pvr*
  KEYBOARD_KEY_8a=f20                                    # Microphone mute button
@@ -252,6 +256,15 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnAlienware*:pn*:*
 evdev:atkbd:dmi:bvn*:bvr*:bd*:svnAlienware*:pnM17xR3:*
  KEYBOARD_KEY_89=ejectcd
 
+###########################################################
+# Aquarius
+###########################################################
+
+# Aquarius Cmp NS483
+evdev:atkbd:dmi:bvn*:bvr*:bd*:svnAquarius*:pnCmp*NS483*:*
+ KEYBOARD_KEY_56=backslash
+ KEYBOARD_KEY_76=f21                                    # Touchpad Toggle
+
 ###########################################################
 # Asus
 ###########################################################
@@ -327,10 +340,15 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnNotebook:pnW65_67SZ:*
 evdev:atkbd:dmi:bvn*:bvr*:svnNotebook:pnNS50_70MU:*
 evdev:atkbd:dmi:bvn*:bvr*:svnNotebook:pnNV4XMB,ME,MZ:*
 evdev:atkbd:dmi:bvn*:bvr*:svnNotebook:pnNS5x_NS7xPU:*
+ KEYBOARD_KEY_f7=f21                                    # Touchpad Toggle
+ KEYBOARD_KEY_f8=f21                                    # Touchpad Toggle
+
+evdev:atkbd:dmi:bvn*:bvr*:svnNotebook:pnV5xTNC_TND_TNE:*
 evdev:atkbd:dmi:bvn*:bvr*:svnNotebook:pnNV4xPZ:*
 evdev:atkbd:dmi:bvn*:bvr*:svnNotebook:pnV54x_6x_TU:*
  KEYBOARD_KEY_f7=f21                                    # Touchpad Toggle
  KEYBOARD_KEY_f8=f21                                    # Touchpad Toggle
+ KEYBOARD_KEY_81=f20                                    # Fn+4; Mic Mute
 
 ###########################################################
 # Compal
@@ -465,6 +483,8 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnDell*:pnXPS12-9Q33*:*
  KEYBOARD_KEY_88=wlan
  KEYBOARD_KEY_65=direction                              # Screen Rotate
 
+# Dell Pro Rugged microphone mute
+evdev:name:Dell WMI hotkeys:dmi:bvn*:bvr*:bd*:svnDell*:pnDellProRugged*:*
 # Dell G16 microphone mute
 evdev:name:Dell WMI hotkeys:dmi:bvn*:bvr*:bd*:svnDell*:pnDellG16*:*
 # Dell Latitude microphone mute
@@ -962,7 +982,7 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnJP-IK:pnLEAPW502:pvr*
 
 # LE14U/LE15U
 evdev:atkbd:dmi:bvn*:bvr*:bd*:svnKVADRA*:pn*LE1*U*:*
- KEYBOARD_KEY_76=f21					# Fn+F1 Toggle touchpad, sends meta+ctrl+toggle
+ KEYBOARD_KEY_76=f21                                    # Fn+F1 Toggle touchpad, sends meta+ctrl+toggle
 
 ###########################################################
 # Lenovo
@@ -1537,6 +1557,11 @@ evdev:name:MSI Laptop hotkeys:dmi:bvn*:bvr*:bd*:svn*:pnM[iI][cC][rR][oO]-S[tT][a
  KEYBOARD_KEY_0213=f22
  KEYBOARD_KEY_0214=f23
 
+# MSI Claw
+evdev:name:AT Translated Set 2 keyboard:dmi:*:svnMicro-StarInternationalCo.,Ltd.:pnClawA1M:*
+ KEYBOARD_KEY_b9=f15                                   # Right Face Button
+ KEYBOARD_KEY_ba=f16                                   # Left Face Button
+
 ##########################################
 # NEC
 ##########################################
@@ -1885,9 +1910,9 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svn[sS][aA][mM][sS][uU][nN][gG]*:pn*700T*:*
 # Galaxy Book (2021) NP750XDA-KD4SE
 evdev:atkbd:dmi:bvn*:bvr*:bd*:svn[sS][aA][mM][sS][uU][nN][gG]*:pn750XDA:pvr*
  KEYBOARD_KEY_81=!esc
- KEYBOARD_KEY_ce=!prog1 	# Fn+F1 launch settings
+ KEYBOARD_KEY_ce=!prog1         # Fn+F1 launch settings
- KEYBOARD_KEY_ae=!volumedown 	# Fn+F7 volume down
+ KEYBOARD_KEY_ae=!volumedown    # Fn+F7 volume down
- KEYBOARD_KEY_b0=!volumeup	# Fn+F8 volume up
+ KEYBOARD_KEY_b0=!volumeup      # Fn+F8 volume up
 
 
 ###########################################################
@@ -2012,13 +2037,13 @@ evdev:name:Toshiba*input*device:dmi:bvn*:bvr*:bd*:svnTOSHIBA*:pnSatellite*P75-A:
 
 # Portege Z830 ACPI quickstart buttons
 evdev:name:Quickstart Button 1:dmi:bvn*:bvr*:bd*:svnTOSHIBA*:pnPORTEGEZ830:*
- KEYBOARD_KEY_1=prog1					# TOSHIBA eco button
+ KEYBOARD_KEY_1=prog1                                   # TOSHIBA eco button
 
 evdev:name:Quickstart Button 2:dmi:bvn*:bvr*:bd*:svnTOSHIBA*:pnPORTEGEZ830:*
- KEYBOARD_KEY_1=prog2					# TOSHIBA Presentation button
+ KEYBOARD_KEY_1=prog2                                   # TOSHIBA Presentation button
 
 evdev:name:Quickstart Button 3:dmi:bvn*:bvr*:bd*:svnTOSHIBA*:pnPORTEGEZ830:*
- KEYBOARD_KEY_1=f21					# Touchpad toggle
+ KEYBOARD_KEY_1=f21                                     # Touchpad toggle
 
 ###########################################################
 # VIA
@@ -2051,11 +2076,11 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnINET:pnP325J:*
 # Home: LeftCtrl + Esc -> LeftMeta  (ignore LeftCtrl, map Esc to LeftMeta)
 # Back: Backspace      -> back      (map backspace to back)
 evdev:name:FTSC1000:00 2808:509C Keyboard:dmi:*:svnXiaomiInc:pnMipad2:*
- KEYBOARD_KEY_700e0=unknown	# LeftCtrl -> ignore
+ KEYBOARD_KEY_700e0=unknown                             # LeftCtrl -> ignore
- KEYBOARD_KEY_700e3=unknown	# LeftMeta -> ignore
+ KEYBOARD_KEY_700e3=unknown                             # LeftMeta -> ignore
- KEYBOARD_KEY_70016=menu	# S -> menu
+ KEYBOARD_KEY_70016=menu                                # S -> menu
- KEYBOARD_KEY_70029=leftmeta	# Esc -> LeftMeta (Windows key / Win8 tablets home)
+ KEYBOARD_KEY_70029=leftmeta                            # Esc -> LeftMeta (Windows key / Win8 tablets home)
- KEYBOARD_KEY_7002a=back	# Backspace -> back
+ KEYBOARD_KEY_7002a=back                                # Backspace -> back
 
 ###########################################################
 # Zepto
@@ -2167,7 +2192,7 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnViewSonic:pnVPAD10:*
 evdev:name:AT Translated Set 2 keyboard:dmi:bvn*:bvr*:bd*:svnPositivoBahia-VAIO:pnVJPW1[12]F11X*:pvr*:*
 # Vaio FE14 (VJFE41F11X, VJE42F11X, VJFE44F11X, VJFE54F11X)
 evdev:name:AT Translated Set 2 keyboard:dmi:bvn*:bvr*:bd*:svnPositivoBahia-VAIO:pnVJFE*:pvr*:*
- KEYBOARD_KEY_76=f21		                        # Fn+F1 toggle touchpad
+ KEYBOARD_KEY_76=f21                                    # Fn+F1 toggle touchpad
 
 ###########################################################
 # Positivo
@@ -2214,6 +2239,13 @@ evdev:name:SIPODEV USB Composite Device:dmi:bvn*:bvr*:svnPositivoTecnologiaSA:pn
  KEYBOARD_KEY_7006d=prog3                               # Programmable button
  KEYBOARD_KEY_7006e=prog4                               # Programmable button
 
+###########################################################
+# Multilaser
+###########################################################
+# Multilaser Ultra (UL154)
+evdev:name:AT Translated Set 2 keyboard:dmi:bvn*bvr*:svnMultilaserIndustrial:pn*:pvr*:rvn*:rnUL154*
+ KEYBOARD_KEY_76=f21                                    # Fn+f2 toggle touchpad
+
 ###########################################################
 # Other
 ###########################################################
@@ -2265,6 +2297,18 @@ evdev:input:b0003v05FEp1010*
 #
 # Presence of a LED is implicit when the property is absent.
 
+# Apple Wireless keyboards
+evdev:input:b0005v05aCp022C*
+evdev:input:b0005v05aCp022D*
+evdev:input:b0005v05aCp022E*
+evdev:input:b0005v05aCp0239*
+evdev:input:b0005v05aCp023A*
+evdev:input:b0005v05aCp023B*
+evdev:input:b0005v05aCp0255*
+evdev:input:b0005v05aCp0256*
+evdev:input:b0005v05aCp0257*
+ KEYBOARD_LED_NUMLOCK=0
+
 # Logitech K750
 evdev:input:b0003v046Dp4002*
  KEYBOARD_LED_NUMLOCK=0

hwdb.d/60-sensor.hwdb

@@ -116,6 +116,11 @@ sensor:modalias:acpi:BOSC0200*:dmi:*svnAcer*:*pnSpinSP111-34:*
 # Aquarius
 #########################################
 
+# Aquarius Cmp NS483
+sensor:modalias:acpi:MXC6655*:dmi:*:svnAquarius*:pnCmp*NS483:*
+ ACCEL_MOUNT_MATRIX=-1, 0, 0; 0, -1, 0; 0, 0, 1
+
+sensor:modalias:acpi:MXC4005*:dmi:*:svnAquarius*:pnCmp*NS483:*
 # Aquarius NS483
 sensor:modalias:acpi:MXC6655*:dmi:*:svnAquarius*:pnNS483:*
  ACCEL_MOUNT_MATRIX=-1, 0, 0; 0, 1, 0; 0, 0, 1
@@ -147,6 +152,7 @@ sensor:modalias:acpi:INVN6500*:dmi:*svnASUSTeK*:*pnM80TA:*
 sensor:modalias:acpi:INVN6500*:dmi:*svnASUSTeK*:*pnT100TA:*
 sensor:modalias:acpi:INVN6500*:dmi:*svnASUSTeK*:*pnT100TAF:*
 sensor:modalias:acpi:INVN6500*:dmi:*svnASUSTeK*:*pnT100TAM:*
+sensor:modalias:acpi:INVN6500*:dmi:*svnASUSTeK*:*pnT100TAS:*
 sensor:modalias:acpi:INVN6500*:dmi:*svnASUSTeK*:pnT200TA:*
  ACCEL_MOUNT_MATRIX=1, 0, 0; 0, -1, 0; 0, 0, 1
 
@@ -158,6 +164,7 @@ sensor:modalias:acpi:INVN6500*:dmi:*svn*ASUSTeK*:*pn*TP300LA:*
 sensor:modalias:acpi:INVN6500*:dmi:*svn*ASUSTeK*:*pn*TP300LD:*
  ACCEL_MOUNT_MATRIX=0, 1, 0; 1, 0, 0; 0, 0, 1
 
+sensor:modalias:acpi:INVN6500*:dmi:*svnASUSTeK*:*pn*Q551LB:*
 sensor:modalias:acpi:INVN6500*:dmi:*svnASUSTeK*:*pn*Q551LN:*
  ACCEL_MOUNT_MATRIX=0, 1, 0; -1, 0, 0; 0, 0, 1
 
@@ -195,13 +202,33 @@ sensor:modalias:acpi:SMO8500*:dmi:*:svnStandard:pnWCBT1011::*
 # AYANEO
 #########################################
 
-# AYANEO AIR
+# AYANEO 2021, 2021 Pro, 2021 Pro Retro Power
-sensor:modalias:acpi:BMI0160*:dmi:*:svnAYANEO:pnAIR*:*
+sensor:modalias:acpi:10EC5280*:dmi:*:svnAYANEO:pn*2021*:*
- ACCEL_MOUNT_MATRIX=-1, 0, 0; 0, 1, 0; 0, 0, 1
+ ACCEL_MOUNT_MATRIX=-0, -1, 0; 0, 0, -1; 1, 0, 0
 
-# AYANEO NEXT
+# AYANEO 2, 2S
+sensor:modalias:acpi:BMI0160*:dmi:*:svnAYANEO:pnAYANEO 2*:*
+ ACCEL_MOUNT_MATRIX=-0, -1, 0; 0, 0, -1; 1, 0, 0
+
+# AYANEO AIR, AIR Pro, and 1S
+sensor:modalias:acpi:BMI0160*:dmi:*:svnAYANEO:pnAIR*:*
+ ACCEL_MOUNT_MATRIX=-0, -1, 0; 0, 0, -1; 1, 0, 0
+
+# AYANEO AIR Plus AMD, Plus Mendocino, and Plus Intel
+sensor:modalias:acpi:BOSC0200*:dmi:*:svnAYANEO:pnAIR Plus*:*
+ ACCEL_MOUNT_MATRIX=-0, -1, 0; 0, 0, 1; -1, 0, 0
+
+# AYANEO FLIP DS, FLIP KB
+sensor:modalias:acpi:BMI0160*:dmi:*:svnAYANEO:pnFLIP**:*
+ ACCEL_MOUNT_MATRIX=-0, -1, 0; 0, 0, -1; 1, 0, 0
+
+# AYANEO GEEK, GEEK 1S
+sensor:modalias:acpi:BMI0160*:dmi:*:svnAYANEO:pnAYANEO GEEK*:*
+ ACCEL_MOUNT_MATRIX=-0, -1, 0; 0, 0, -1; 1, 0, 0
+
+# AYANEO NEXT, NEXT Lite, NEXT Advance, and NEXT Pro
 sensor:modalias:acpi:BMI0160*:dmi:*:svnAYANEO:pn*NEXT*:*
- ACCEL_MOUNT_MATRIX=1, 0, 0; 0, -1, 0; 0, 0, 1
+ ACCEL_MOUNT_MATRIX=-0, -1, 0; 0, 0, -1; 1, 0, 0
 
 #########################################
 # BMAX
@@ -272,6 +299,10 @@ sensor:modalias:acpi:KIOX000A*:dmi:*:svnCHUWIInnovationAndTechnology*:pnHi10X:*
 sensor:modalias:acpi:MXC6655*:dmi:*:svnCHUWIINNOVATIONLIMITED:pnHi10Go:*
  ACCEL_MOUNT_MATRIX=-1, 0, 0; 0,-1, 0; 0, 0, 1
 
+# Chuwi Hi10 Max
+sensor:modalias:acpi:MXC6655*:dmi:*:svnCHUWIInnovationAndTechnology*:pnHi10Max:*
+ ACCEL_MOUNT_MATRIX=0, 1, 0; 1, 0, 0; 0, 0, 1
+
 # Chuwi Hi12
 sensor:modalias:acpi:BOSC0200*:dmi:*:svnHampoo:pnP02BD6_HI-122LP:*
 sensor:modalias:acpi:BOSC0200*:dmi:*:svnDefaultstring:pnDefaultstring:*
@@ -316,6 +347,10 @@ sensor:modalias:acpi:BOSC0200*:dmi:*:svnHampoo*:pnC3W6_AP108_4GB:*
 sensor:modalias:acpi:MXC6655*:dmi:*:svnCHUWIInnovationAndTechnology*:pnUBookX:*
  ACCEL_MOUNT_MATRIX=0, -1, 0; -1, 0, 0; 0, 0, -1
 
+# Chuwi Freebook N100
+sensor:modalias:acpi:MDA6655*:dmi:*:svnCHUWI*:pnFreeBook:*
+ ACCEL_MOUNT_MATRIX=0, -1, 0;1, 0, 0;0, 0, 1
+
 #########################################
 # Connect
 #########################################
@@ -534,6 +569,10 @@ sensor:modalias:acpi:KIOX000A*:dmi:bvnAmericanMegatrendsInc.:bvr5.11:bd05/25/201
 sensor:modalias:acpi:MXC6655*:dmi:*:svnGPD:pnG1621-02:*
  ACCEL_MOUNT_MATRIX=-1, 0, 0; 0, 1, 0; 0, 0, 1
 
+# GPD WinMax2
+sensor:modalias:acpi:BMI0160*:dmi:*:svnGPD:pnG1619*:*
+ ACCEL_MOUNT_MATRIX=0, -1, 0; -1, 0, 0; 0, 0, 1
+
 #########################################
 # Hometech
 ########################################
@@ -568,6 +607,15 @@ sensor:modalias:i2c:bmc150_accel:dmi:*:svnHewlett-Packard:pnHPPavilionx2Detachab
 sensor:modalias:i2c:bmc150_accel:dmi:*:svnHewlett-Packard:pnHPProTablet408:*:rn8048:*
  ACCEL_MOUNT_MATRIX=0, 1, 0; -1, 0, 0; 0, 0, 1
 
+#########################################
+# HUAWEI
+#########################################
+
+# HUAWEI MateBook D 15 AMD
+sensor:modalias:acpi:SMO8840*:dmi:*:svnHUAWEI:pnBOHK-WAX9X:*
+ ACCEL_MOUNT_MATRIX=0, 1, 0; 1, 0, 0; 0, 0, 1
+ ACCEL_LOCATION=base
+
 #########################################
 # I.T.Works
 #########################################
@@ -712,8 +760,9 @@ sensor:modalias:i2c:bmc150_accel:dmi:*:svnLENOVO:*:pvrLenovoYoga300-11IBR:*
 sensor:modalias:acpi:ACCL0001*:dmi:*:svnLENOVO:pn60072:pvr851*:*
  ACCEL_MOUNT_MATRIX=0, 1, 0; -1, 0, 0; 0, 0, 1
 
-# IdeaPad Duet 3 10IGL5 (82AT)
+# IdeaPad Duet 3 10IGL5 (82AT) and 10IGL5-LTE (82HK)
 sensor:modalias:acpi:SMO8B30*:dmi:*:svnLENOVO*:pn82AT:*
+sensor:modalias:acpi:SMO8B30*:dmi:*:svnLENOVO*:pn82HK:*
  ACCEL_MOUNT_MATRIX=0, 1, 0; -1, 0, 0; 0, 0, 1
 
 #########################################
@@ -881,6 +930,14 @@ sensor:modalias:acpi:BOSC0200*:dmi:bvnAmericanMegatrendsInc.:bvr5.12:bd07/17/201
 sensor:modalias:acpi:BMI0160*:dmi:*:rnONEXPLAYER:rvrV01:*
  ACCEL_MOUNT_MATRIX=-1, 0, 0; 0, 1, 0; 0, 0, -1
 
+#########################################
+# OrangePi
+#########################################
+
+# OrangePi NEO
+sensor:modalias:acpi:BMI0260*:dmi:*:svnOrangePi:pnNEO-01:*
+ ACCEL_MOUNT_MATRIX=-1, 0, 0; 0, 0, -1; 0, -1, 0
+
 #########################################
 # Passion
 #########################################

hwdb.d/70-av-production.hwdb

@@ -18,6 +18,21 @@
 usb:v2982p1967*
  ID_AV_PRODUCTION_CONTROLLER=1
 
+################
+# Contour
+################
+# Shuttle Pro
+usb:v0B33p0011*
+ ID_AV_PRODUCTION_CONTROLLER=1
+
+# Shuttle Pro V2
+usb:v0B33p0030*
+ ID_AV_PRODUCTION_CONTROLLER=1
+
+# ShuttleXpress
+usb:v0B33p0020*
+ ID_AV_PRODUCTION_CONTROLLER=1
+
 ################
 # Eks
 ################
@@ -83,6 +98,13 @@ usb:v06F8pB100*
 usb:v06F8pB107*
  ID_AV_PRODUCTION_CONTROLLER=1
 
+####################
+# ICOM
+####################
+# RC-28 Remote Encoder
+usb:v0C26p001E*
+ ID_AV_PRODUCTION_CONTROLLER=1
+
 #####################
 # Native Instruments
 #####################
@@ -161,3 +183,17 @@ usb:v17CCp1130*
 # CDJ 2000 NXS 2
 usb:v2B73p0005*
  ID_AV_PRODUCTION_CONTROLLER=1
+
+####################
+# SunSDR
+####################
+# E-Coder 2 Controller
+usb:v1FC9p0003*
+ ID_AV_PRODUCTION_CONTROLLER=1
+
+####################
+# Xencelabs
+####################
+# Quick Keys
+usb:v28BDp5202*
+ ID_AV_PRODUCTION_CONTROLLER=1

hwdb.d/70-cameras.hwdb

@@ -12,6 +12,16 @@
 camera:usb:v*p*:name:*IR Camera*:
  ID_INFRARED_CAMERA=1
 
+###########################################################
+# Hewlett-Packard
+###########################################################
+
+# Chicony Electronics Co., Ltd HP Wide Vision FHD Camera (IR function)
+camera:usb:v04f2pb634:name:*I:
+# Realtek Semiconductor Corp. HP Wide Vision FHD Camera (IR function)
+camera:usb:v0bdap58e6:name:*I:
+ ID_INFRARED_CAMERA=1
+
 ###########################################################
 # Philips
 ###########################################################

hwdb.d/70-hardware-wallets.hwdb

@@ -0,0 +1,24 @@
+# This file is part of systemd.
+#
+# Database for Hardware Wallets that should be accessible to the seat owner.
+##
+# To add local entries, copy this file to
+#   /etc/udev/hwdb.d/
+# and add your rules there. To load the new rules execute (as root):
+#   systemd-hwdb update
+#   udevadm trigger
+
+################
+# Trezor Hardware Wallets
+################
+
+# Trezor v1
+usb:v534Cp0001*
+ ID_HARDWARE_WALLET=1
+
+# Trezor v2
+usb:v1209p53C0*
+ ID_HARDWARE_WALLET=1
+
+usb:v1209p53C1*
+ ID_HARDWARE_WALLET=1

hwdb.d/70-mouse.hwdb

@@ -248,6 +248,14 @@ mouse:usb:v1ea7p000b:name:2.4G RF Mouse:*
 mouse:usb:v04d9p0499:name:*:*
  MOUSE_DPI=800@125
 
+##########################################
+# Glorious
+##########################################
+
+# Glorious Model O Minus
+mouse:usb:v258ap0036:name:Glorious Model O:*
+ MOUSE_DPI=400@1000 800@1000 *1600@1000 3200@1000
+
 ##########################################
 # HandShoe Mouse
 ##########################################
@@ -302,6 +310,10 @@ mouse:bluetooth:v047dp8019:name:Expert Wireless TB Mouse:*
  ID_INPUT_TRACKBALL=1
  MOUSE_DPI=400@125
 
+# Kensington SlimBlade Pro trackball (via Bluetooth)
+mouse:bluetooth:v047dp80d4:name:SlimBlade Pro:*
+ ID_INPUT_TRACKBALL=1
+
 ##########################################
 # Lenovo
 ##########################################

hwdb.d/meson.build

@@ -29,6 +29,7 @@ hwdb_files_test = files(
         '70-analyzers.hwdb',
         '70-av-production.hwdb',
         '70-cameras.hwdb',
+        '70-hardware-wallets.hwdb',
         '70-joystick.hwdb',
         '70-mouse.hwdb',
         '70-pda.hwdb',

hwdb.d/parse_hwdb.py

@@ -174,6 +174,7 @@ def property_grammar():
              ('ID_INPUT_TOUCHSCREEN', id_input_setting),
              ('ID_INPUT_TRACKBALL', id_input_setting),
              ('ID_SIGNAL_ANALYZER', Or((Literal('0'), Literal('1')))),
+             ('ID_HARDWARE_WALLET', Or((Literal('0'), Literal('1')))),
              ('POINTINGSTICK_SENSITIVITY', INTEGER),
              ('ID_INPUT_JOYSTICK_INTEGRATION', Or(('internal', 'external'))),
              ('ID_INPUT_TOUCHPAD_INTEGRATION', Or(('internal', 'external'))),

man/bootctl.xml

@@ -267,7 +267,8 @@
         <term><option>kernel-identify</option> <replaceable>kernel</replaceable></term>
 
         <listitem><para>Takes a kernel image as argument. Checks what kind of kernel the image is. Returns
-        one of <literal>uki</literal>, <literal>pe</literal>, and <literal>unknown</literal>.
+        one of <literal>uki</literal>, <literal>addon</literal>, <literal>pe</literal>, and
+        <literal>unknown</literal>.
         </para>
 
         <xi:include href="version-info.xml" xpointer="v253"/></listitem>
@@ -360,6 +361,24 @@
         <xi:include href="version-info.xml" xpointer="v242"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--print-loader-path</option></term>
+        <listitem><para>This option modifies the behaviour of <command>status</command>: it shows the
+        absolute path to the boot loader EFI binary used for the current boot if this information is
+        available. Note that no attempt is made to verify whether the binary still exists.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--print-stub-path</option></term>
+        <listitem><para>This option modifies the behaviour of <command>status</command>: it shows the
+        absolute path to the UKI/stub EFI binary used for the current boot if this information is
+        available. Note that no attempt is made to verify whether the binary still exists.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><option>-R</option></term>
         <term><option>--print-root-device</option></term>

man/bootup.xml

@@ -46,11 +46,10 @@
     the root file system, which is then responsible for probing all remaining hardware, mounting all
     necessary file systems and spawning all configured services.</para>
 
-    <para>On shutdown, the system manager stops all services, unmounts
+    <para>On shutdown, the system manager stops all services, unmounts all non-busy file systems (detaching
-    all file systems (detaching the storage technologies backing
+    the storage technologies backing them), and then (optionally) jumps into the exitrd, which is backed by
-    them), and then (optionally) jumps back into the initrd code which
+    tmpfs, and unmounts/detaches the remaining file systems, including the real root. As a last step,
-    unmounts/detaches the root file system and the storage it resides
+    the system is powered down.</para>
-    on. As a last step, the system is powered down.</para>
 
     <para>Additional information about the system boot process may be
     found in

man/busctl.xml

@@ -392,20 +392,33 @@
         <term><option>--timeout=<replaceable>SECS</replaceable></option></term>
 
         <listitem>
-          <para>When used with the <command>call</command> command,
+          <para>When used with the <command>call</command> command, specifies the maximum time to wait for
-          specifies the maximum time to wait for method call
+          method call completion. When used with the <command>monitor</command> command, since version v257,
-          completion. If no time unit is specified, assumes
+          specifies the maximum time to wait for messages before automatically exiting. If no time unit is
-          seconds. The usual other units are understood, too (ms, us,
+          specified, assumes seconds. The usual other units are understood, too (ms, us, s, min, h, d, w,
-          s, min, h, d, w, month, y). Note that this timeout does not
+          month, y). Note that this timeout does not apply if <option>--expect-reply=no</option> is used,
-          apply if <option>--expect-reply=no</option> is used, as the
+          when combined with the <command>call</command> command, as the tool does not wait for any reply
-          tool does not wait for any reply message then. When not
+          message then. When not specified or when set to 0, the default of <literal>25s</literal> is
-          specified or when set to 0, the default of
+          assumed for the <command>call</command> command, and it is disabled for the
-          <literal>25s</literal> is assumed.</para>
+          <command>monitor</command> command.</para>
 
         <xi:include href="version-info.xml" xpointer="v218"/>
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--num-matches=<replaceable>NUMBER</replaceable></option></term>
+
+        <listitem>
+          <para>When used with the <command>monitor</command> command, if enabled will make
+          <command>busctl</command> exit when the specified number of messages have been received and
+          printed. This is useful in combination with <option>--match=</option>, to wait for the specified
+          number of occurrences of specific D-Bus messages.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><option>--augment-creds=<replaceable>BOOL</replaceable></option></term>
 

man/coredump.conf.xml

@@ -109,6 +109,21 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>AccessContainer=</varname></term>
+
+        <listitem><para>Controls whether <command>systemd-coredump</command> will attempt to use the mount tree of
+        a process that crashed within a container. Access to the container's filesystem might be necessary to generate
+        a fully symbolized backtrace. If set to <literal>yes</literal>, then <command>systemd-coredump</command> will
+        obtain the mount tree from corresponding mount namespace and will try to generate the stack trace using the
+        binary and libraries from the mount namespace. Note that the coredump of the containerized process might
+        still be saved in <filename>/var/lib/systemd/coredump/</filename> even if <varname>AccessContainer=</varname>
+        is set to <literal>no</literal>. Defaults to <literal>no</literal>.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>ExternalSizeMax=</varname></term>
         <term><varname>JournalSizeMax=</varname></term>

man/file-hierarchy.xml

@@ -48,93 +48,63 @@
     <variablelist>
       <varlistentry>
         <term><filename>/</filename></term>
-        <listitem><para>The file system root. Usually writable, but
+        <listitem><para>The file system root. Usually writable, but this is not required. Possibly a
-        this is not required. Possibly a temporary file system
+        temporary file system (<literal>tmpfs</literal>). Not shared with other hosts (unless
-        (<literal>tmpfs</literal>). Not shared with other hosts
+        read-only).</para></listitem>
-        (unless read-only). </para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/boot/</filename></term>
-        <listitem><para>The boot partition used for bringing up the
+        <listitem><para>The boot partition used for bringing up the system. On EFI systems, this is possibly
-        system. On EFI systems, this is possibly the EFI System
+        the EFI System Partition (ESP), also see
-        Partition (ESP), also see
         <citerefentry><refentrytitle>systemd-gpt-auto-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
-        This directory is usually strictly local to the host, and
+        This directory is usually strictly local to the host, and should be considered read-only, except when
-        should be considered read-only, except when a new kernel or
+        a new kernel or boot loader is installed. This directory only exists on systems that run on physical
-        boot loader is installed. This directory only exists on
+        or emulated hardware that requires boot loaders.</para></listitem>
-        systems that run on physical or emulated hardware that
-        requires boot loaders.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/efi/</filename></term>
-        <listitem><para>If the boot partition <filename>/boot/</filename> is maintained separately from the EFI System
+        <listitem><para>If the boot partition <filename>/boot/</filename> is maintained separately from the
-        Partition (ESP), the latter is mounted here. Tools that need to operate on the EFI system partition should look
+        EFI System Partition (ESP), the latter is mounted here. Tools that need to operate on the EFI system
-        for it at this mount point first, and fall back to <filename>/boot/</filename> — if the former doesn't qualify
+        partition should look for it at this mount point first, and fall back to <filename>/boot/</filename>
-        (for example if it is not a mount point or does not have the correct file system type
+        — if the former doesn't qualify (for example if it is not a mount point or does not have the correct
-        <constant>MSDOS_SUPER_MAGIC</constant>).</para>
+        file system type <constant>MSDOS_SUPER_MAGIC</constant>).</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v239"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/etc/</filename></term>
-        <listitem><para>System-specific configuration. This directory
+        <listitem><para>System-specific configuration. This directory may or may not be
-        may or may not be read-only. Frequently, this directory is
+        read-only. Frequently, this directory is pre-populated with vendor-supplied configuration files, but
-        pre-populated with vendor-supplied configuration files, but
+        applications should not make assumptions about this directory being fully populated or populated at
-        applications should not make assumptions about this directory
+        all, and should fall back to defaults if configuration is missing.</para></listitem>
-        being fully populated or populated at all, and should fall
-        back to defaults if configuration is
-        missing.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/home/</filename></term>
-        <listitem><para>The location for normal user's home
+        <listitem><para>The location for normal user's home directories. Possibly shared with other systems,
-        directories. Possibly shared with other systems, and never
+        and never read-only. This directory should only be used for normal users, never for system
-        read-only. This directory should only be used for normal
+        users. This directory and possibly the directories contained within it might only become available or
-        users, never for system users. This directory and possibly the
+        writable in late boot or even only after user authentication.  This directory might be placed on
-        directories contained within it might only become available or
+        limited-functionality network file systems, hence applications should not assume the full set of file
-        writable in late boot or even only after user authentication.
+        API is available on this directory.  Applications should generally not reference this directory
-        This directory might be placed on limited-functionality
+        directly, but via the per-user <varname>$HOME</varname> environment variable, or via the home
-        network file systems, hence applications should not assume the
+        directory field of the user database.</para></listitem>
-        full set of file API is available on this directory.
-        Applications should generally not reference this directory
-        directly, but via the per-user <varname>$HOME</varname>
-        environment variable, or via the home directory field of the
-        user database.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/root/</filename></term>
-        <listitem><para>The home directory of the root user. The root
+        <listitem><para>The home directory of the root user. The root user's home directory is located
-        user's home directory is located outside of
+        outside of <filename>/home/</filename> in order to make sure the root user may log in even without
-        <filename>/home/</filename> in order to make sure the root user
+        <filename>/home/</filename> being available and mounted.</para></listitem>
-        may log in even without <filename>/home/</filename> being
-        available and mounted.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/srv/</filename></term>
-        <listitem><para>The place to store general server payload,
+        <listitem><para>The place to store general server payload, managed by the administrator. No
-        managed by the administrator. No restrictions are made how
+        restrictions are made how this directory is organized internally. Generally writable, and possibly
-        this directory is organized internally. Generally writable,
+        shared among systems. This directory might become available or writable only very late during
-        and possibly shared among systems. This directory might become
+        boot.</para></listitem>
-        available or writable only very late during
-        boot.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -156,10 +126,7 @@
         <citerefentry
         project='man-pages'><refentrytitle>mkdtemp</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
         and similar calls. For more details, see <ulink url="https://systemd.io/TEMPORARY_DIRECTORIES">Using
-        /tmp/ and /var/tmp/ Safely</ulink>.</para>
+        /tmp/ and /var/tmp/ Safely</ulink>.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v215"/>
-        </listitem>
       </varlistentry>
 
     </variablelist>
@@ -173,34 +140,24 @@
         <term><filename>/run/</filename></term>
         <listitem><para>A <literal>tmpfs</literal> file system for system packages to place runtime data,
         socket files, and similar. This directory is flushed on boot, and generally writable for privileged
-        programs only. Always writable.</para>
+        programs only. Always writable.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/run/log/</filename></term>
-        <listitem><para>Runtime system logs. System components may
+        <listitem><para>Runtime system logs. System components may place private logs in this
-        place private logs in this directory. Always writable, even
+        directory. Always writable, even when <filename>/var/log/</filename> might not be accessible
-        when <filename>/var/log/</filename> might not be accessible
+        yet.</para></listitem>
-        yet.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/run/user/</filename></term>
-        <listitem><para>Contains per-user runtime directories, each
+        <listitem><para>Contains per-user runtime directories, each usually individually mounted
-        usually individually mounted <literal>tmpfs</literal>
+        <literal>tmpfs</literal> instances. Always writable, flushed at each reboot and when the user logs
-        instances. Always writable, flushed at each reboot and when
+        out. User code should not reference this directory directly, but via the
-        the user logs out. User code should not reference this
+        <varname>$XDG_RUNTIME_DIR</varname> environment variable, as documented in the <ulink
-        directory directly, but via the
+        url="https://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html">XDG Base Directory
-        <varname>$XDG_RUNTIME_DIR</varname> environment variable, as
+        Specification</ulink>.</para></listitem>
-        documented in the <ulink
-        url="https://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html">XDG
-        Base Directory Specification</ulink>.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
     </variablelist>
   </refsect1>
@@ -212,99 +169,68 @@
 
       <varlistentry>
         <term><filename>/usr/</filename></term>
-        <listitem><para>Vendor-supplied operating system resources.
+        <listitem><para>Vendor-supplied operating system resources.  Usually read-only, but this is not
-        Usually read-only, but this is not required. Possibly shared
+        required. Possibly shared between multiple hosts. This directory should not be modified by the
-        between multiple hosts. This directory should not be modified
+        administrator, except when installing or removing vendor-supplied packages.</para></listitem>
-        by the administrator, except when installing or removing
-        vendor-supplied packages.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/usr/bin/</filename></term>
-        <listitem><para>Binaries and executables for user commands
+        <listitem><para>Binaries and executables for user commands that shall appear in the
-        that shall appear in the <varname>$PATH</varname> search path.
+        <varname>$PATH</varname> search path.  It is recommended not to place binaries in this directory that
-        It is recommended not to place binaries in this directory that
+        are not useful for invocation from a shell (such as daemon binaries); these should be placed in a
-        are not useful for invocation from a shell (such as daemon
+        subdirectory of <filename>/usr/lib/</filename> instead.</para></listitem>
-        binaries); these should be placed in a subdirectory of
-        <filename>/usr/lib/</filename> instead.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/usr/include/</filename></term>
-        <listitem><para>C and C++ API header files of system
+        <listitem><para>C and C++ API header files of system libraries.</para></listitem>
-        libraries.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/usr/lib/</filename></term>
-        <listitem><para>Static, private vendor data that is compatible
+        <listitem><para>Static, private vendor data that is compatible with all architectures (though not
-        with all architectures (though not necessarily
+        necessarily architecture-independent). Note that this includes internal executables or other binaries
-        architecture-independent). Note that this includes internal
+        that are not regularly invoked from a shell. Such binaries may be for any architecture supported by
-        executables or other binaries that are not regularly invoked
+        the system. Do not place public libraries in this directory, use <varname>$libdir</varname> (see
-        from a shell. Such binaries may be for any architecture
+        below), instead.</para></listitem>
-        supported by the system. Do not place public libraries in this
-        directory, use <varname>$libdir</varname> (see below),
-        instead.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/usr/lib/<replaceable>arch-id</replaceable>/</filename></term>
-        <listitem><para>Location for placing dynamic libraries into, also
+        <listitem><para>Location for placing dynamic libraries into, also called
-        called <varname>$libdir</varname>. The architecture identifier
+        <varname>$libdir</varname>. The architecture identifier to use is defined on <ulink
-        to use is defined on <ulink
+        url="https://wiki.debian.org/Multiarch/Tuples">Multiarch Architecture Specifiers (Tuples)</ulink>
-        url="https://wiki.debian.org/Multiarch/Tuples">Multiarch
+        list. Legacy locations of <varname>$libdir</varname> are <filename>/usr/lib/</filename>,
-        Architecture Specifiers (Tuples)</ulink> list. Legacy
+        <filename>/usr/lib64/</filename>. This directory should not be used for package-specific data, unless
-        locations of <varname>$libdir</varname> are
+        this data is architecture-dependent, too. To query <varname>$libdir</varname> for the primary
-        <filename>/usr/lib/</filename>,
+        architecture of the system, invoke: <programlisting># systemd-path
-        <filename>/usr/lib64/</filename>. This directory should not be
+        system-library-arch</programlisting></para></listitem>
-        used for package-specific data, unless this data is
-        architecture-dependent, too. To query
-        <varname>$libdir</varname> for the primary architecture of the
-        system, invoke:
-        <programlisting># systemd-path system-library-arch</programlisting></para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
-
       </varlistentry>
 
       <varlistentry>
         <term><filename>/usr/share/</filename></term>
-        <listitem><para>Resources shared between multiple packages,
+        <listitem><para>Resources shared between multiple packages, such as documentation, man pages, time
-        such as documentation, man pages, time zone information, fonts
+        zone information, fonts and other resources. Usually, the precise location and format of files stored
-        and other resources. Usually, the precise location and format
+        below this directory is subject to specifications that ensure interoperability.</para>
-        of files stored below this directory is subject to
-        specifications that ensure interoperability.</para>
 
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
+        <para>Note that resources placed in this directory typically are under shared ownership,
+        i.e. multiple different packages have provide and consume these resources, on equal footing, without
+        any obvious primary owner. This makes makes things systematically different from
+        <filename>/usr/lib/</filename>, where ownership is generally not shared.</para></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/usr/share/doc/</filename></term>
-        <listitem><para>Documentation for the operating system or
+        <listitem><para>Documentation for the operating system or system packages.</para></listitem>
-        system packages.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/usr/share/factory/etc/</filename></term>
-        <listitem><para>Repository for vendor-supplied default
+        <listitem><para>Repository for vendor-supplied default configuration files. This directory should be
-        configuration files. This directory should be populated with
+        populated with pristine vendor versions of all configuration files that may be placed in
-        pristine vendor versions of all configuration files that may
+        <filename>/etc/</filename>. This is useful to compare the local configuration of a system with vendor
-        be placed in <filename>/etc/</filename>. This is useful to
+        defaults and to populate the local configuration with defaults.</para></listitem>
-        compare the local configuration of a system with vendor
-        defaults and to populate the local configuration with
-        defaults.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -313,10 +239,7 @@
         <listitem><para>Similar to
         <filename>/usr/share/factory/etc/</filename>, but for vendor
         versions of files in the variable, persistent data directory
-        <filename>/var/</filename>.</para>
+        <filename>/var/</filename>.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
-
       </varlistentry>
     </variablelist>
   </refsect1>
@@ -333,49 +256,34 @@
         system might start up without this directory being populated. Persistency is recommended, but
         optional, to support ephemeral systems. This directory might become available or writable only very
         late during boot. Components that are required to operate during early boot hence shall not
-        unconditionally rely on this directory.</para>
+        unconditionally rely on this directory.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/var/cache/</filename></term>
-        <listitem><para>Persistent system cache data. System
+        <listitem><para>Persistent system cache data. System components may place non-essential data in this
-        components may place non-essential data in this directory.
+        directory.  Flushing this directory should have no effect on operation of programs, except for
-        Flushing this directory should have no effect on operation of
+        increased runtimes necessary to rebuild these caches.</para></listitem>
-        programs, except for increased runtimes necessary to rebuild
-        these caches.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/var/lib/</filename></term>
-        <listitem><para>Persistent system data. System components may
+        <listitem><para>Persistent system data. System components may place private data in this
-        place private data in this directory.</para>
+        directory.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/var/log/</filename></term>
-        <listitem><para>Persistent system logs. System components may
+        <listitem><para>Persistent system logs. System components may place private logs in this directory,
-        place private logs in this directory, though it is recommended
+        though it is recommended to do most logging via the <citerefentry
-        to do most logging via the
+        project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry> and
-        <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
-        and
         <citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>3</manvolnum></citerefentry>
-        calls.</para>
+        calls.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/var/spool/</filename></term>
-        <listitem><para>Persistent system spool data, such as printer
+        <listitem><para>Persistent system spool data, such as printer or mail queues.</para></listitem>
-        or mail queues.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -396,10 +304,8 @@
         <citerefentry
         project='man-pages'><refentrytitle>mkdtemp</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
         and similar calls should be used. For further details about this directory, see <ulink
-        url="https://systemd.io/TEMPORARY_DIRECTORIES">Using /tmp/ and /var/tmp/ Safely</ulink>.</para>
+        url="https://systemd.io/TEMPORARY_DIRECTORIES">Using /tmp/ and /var/tmp/
-
+        Safely</ulink>.</para></listitem>
-        <xi:include href="version-info.xml" xpointer="v215"/>
-        </listitem>
       </varlistentry>
 
     </variablelist>
@@ -411,97 +317,67 @@
     <variablelist>
       <varlistentry>
         <term><filename>/dev/</filename></term>
-        <listitem><para>The root directory for device nodes. Usually,
+        <listitem><para>The root directory for device nodes. Usually, this directory is mounted as a
-        this directory is mounted as a <literal>devtmpfs</literal>
+        <literal>devtmpfs</literal> instance, but might be of a different type in sandboxed/containerized
-        instance, but might be of a different type in
+        setups. This directory is managed jointly by the kernel and
-        sandboxed/containerized setups. This directory is managed
-        jointly by the kernel and
         <citerefentry><refentrytitle>systemd-udevd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-        and should not be written to by other components. A number of
+        and should not be written to by other components. A number of special purpose virtual file systems
-        special purpose virtual file systems might be mounted below
+        might be mounted below this directory.</para></listitem>
-        this directory.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/dev/shm/</filename></term>
-        <listitem><para>Place for POSIX shared memory segments, as
+        <listitem><para>Place for POSIX shared memory segments, as created via <citerefentry
-        created via
+        project='die-net'><refentrytitle>shm_open</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
-        <citerefentry project='die-net'><refentrytitle>shm_open</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
+        This directory is flushed on boot, and is a <literal>tmpfs</literal> file system. Since all users
-        This directory is flushed on boot, and is a
+        have write access to this directory, special care should be taken to avoid name clashes and
-        <literal>tmpfs</literal> file system. Since all users have
+        vulnerabilities. For normal users, shared memory segments in this directory are usually deleted when
-        write access to this directory, special care should be taken
+        the user logs out. Usually, it is a better idea to use memory mapped files in
-        to avoid name clashes and vulnerabilities. For normal users,
+        <filename>/run/</filename> (for system programs) or <varname>$XDG_RUNTIME_DIR</varname> (for user
-        shared memory segments in this directory are usually deleted
+        programs) instead of POSIX shared memory segments, since these directories are not world-writable and
-        when the user logs out. Usually, it is a better idea to use
+        hence not vulnerable to security-sensitive name clashes.</para></listitem>
-        memory mapped files in <filename>/run/</filename> (for system
-        programs) or <varname>$XDG_RUNTIME_DIR</varname> (for user
-        programs) instead of POSIX shared memory segments, since these
-        directories are not world-writable and hence not vulnerable to
-        security-sensitive name clashes.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/proc/</filename></term>
-        <listitem><para>A virtual kernel file system exposing the
+        <listitem><para>A virtual kernel file system exposing the process list and other functionality. This
-        process list and other functionality. This file system is
+        file system is mostly an API to interface with the kernel and not a place where normal files may be
-        mostly an API to interface with the kernel and not a place
+        stored. For details, see <citerefentry
-        where normal files may be stored. For details, see
+        project='man-pages'><refentrytitle>proc</refentrytitle><manvolnum>5</manvolnum></citerefentry>.  A
-        <citerefentry project='man-pages'><refentrytitle>proc</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+        number of special purpose virtual file systems might be mounted below this
-        A number of special purpose virtual file systems might be
+        directory.</para></listitem>
-        mounted below this directory.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/proc/sys/</filename></term>
-        <listitem><para>A hierarchy below <filename>/proc/</filename>
+        <listitem><para>A hierarchy below <filename>/proc/</filename> that exposes a number of kernel
-        that exposes a number of kernel tunables. The primary way to
+        tunables. The primary way to configure the settings in this API file tree is via
-        configure the settings in this API file tree is via
         <citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-        files. In sandboxed/containerized setups, this directory is
+        files. In sandboxed/containerized setups, this directory is generally mounted
-        generally mounted read-only.</para>
+        read-only.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/sys/</filename></term>
-        <listitem><para>A virtual kernel file system exposing
+        <listitem><para>A virtual kernel file system exposing discovered devices and other
-        discovered devices and other functionality. This file system
+        functionality. This file system is mostly an API to interface with the kernel and not a place where
-        is mostly an API to interface with the kernel and not a place
+        normal files may be stored. In sandboxed/containerized setups, this directory is generally mounted
-        where normal files may be stored. In sandboxed/containerized
+        read-only. A number of special purpose virtual file systems might be mounted below this
-        setups, this directory is generally mounted read-only. A number
+        directory.</para></listitem>
-        of special purpose virtual file systems might be mounted below
-        this directory.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/sys/fs/cgroup/</filename></term>
-        <listitem><para>A virtual kernel file system exposing process
+        <listitem><para>A virtual kernel file system exposing process control groups (cgroups). This file
-        control groups (cgroups). This file system is an API to interface
+        system is an API to interface with the kernel and not a place where normal files may be stored. On
-        with the kernel and not a place where normal files may be stored. On
+        current systems running in the default "unified" mode, this directory serves as the mount point for
-        current systems running in the default "unified" mode,
+        the <literal>cgroup2</literal> filesystem, which provides a unified cgroup hierarchy for all resource
-        this directory serves as the mount point for the
+        controllers. On systems with non-default configurations, this directory may instead be a tmpfs
-        <literal>cgroup2</literal> filesystem, which provides a unified
+        filesystem containing mount points for various <literal>cgroup</literal> (v1) resource controllers;
-        cgroup hierarchy for all resource controllers. On systems with
+        in such configurations, if <literal>cgroup2</literal> is mounted it will be mounted on
-        non-default configurations, this directory may instead be a tmpfs
+        <filename>/sys/fs/cgroup/unified/</filename>, but cgroup2 will not have resource controllers
-        filesystem containing mount points for various
+        attached. In sandboxed/containerized setups, this directory may either not exist or may include a
-        <literal>cgroup</literal> (v1) resource controllers; in such
+        subset of functionality.</para></listitem>
-        configurations, if <literal>cgroup2</literal> is mounted it will be
-        mounted on <filename>/sys/fs/cgroup/unified/</filename>, but
-        cgroup2 will not have resource controllers attached. In
-        sandboxed/containerized setups, this directory may either not exist or
-        may include a subset of functionality.
-        </para>
-
-        <xi:include href="version-info.xml" xpointer="v251"/></listitem>
       </varlistentry>
     </variablelist>
   </refsect1>
@@ -515,47 +391,31 @@
         <term><filename>/sbin/</filename></term>
         <term><filename>/usr/sbin/</filename></term>
 
-        <listitem><para>These compatibility symlinks point to
+        <listitem><para>These compatibility symlinks point to <filename>/usr/bin/</filename>, ensuring that
-        <filename>/usr/bin/</filename>, ensuring that scripts and
+        scripts and binaries referencing these legacy paths correctly find their binaries.</para></listitem>
-        binaries referencing these legacy paths correctly find their
-        binaries.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/lib/</filename></term>
 
-        <listitem><para>This compatibility symlink points to
+        <listitem><para>This compatibility symlink points to <filename>/usr/lib/</filename>, ensuring that
-        <filename>/usr/lib/</filename>, ensuring that programs
+        programs referencing this legacy path correctly find their resources.</para></listitem>
-        referencing this legacy path correctly find their
-        resources.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/lib64/</filename></term>
 
-        <listitem><para>On some architecture ABIs, this compatibility
+        <listitem><para>On some architecture ABIs, this compatibility symlink points to
-        symlink points to <varname>$libdir</varname>, ensuring that
+        <varname>$libdir</varname>, ensuring that binaries referencing this legacy path correctly find their
-        binaries referencing this legacy path correctly find their
+        dynamic loader. This symlink only exists on architectures whose ABI places the dynamic loader in this
-        dynamic loader. This symlink only exists on architectures
+        path.</para></listitem>
-        whose ABI places the dynamic loader in this
-        path.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>/var/run/</filename></term>
 
-        <listitem><para>This compatibility symlink points to
+        <listitem><para>This compatibility symlink points to <filename>/run/</filename>, ensuring that
-        <filename>/run/</filename>, ensuring that programs referencing
+        programs referencing this legacy path correctly find their runtime data.</para></listitem>
-        this legacy path correctly find their runtime
-        data.</para>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
     </variablelist>
@@ -581,9 +441,7 @@
         directory. Flushing this directory should have no effect on operation of programs, except for
         increased runtimes necessary to rebuild these caches. If an application finds
         <varname>$XDG_CACHE_HOME</varname> set, it should use the directory specified in it instead of this
-        directory.</para>
+        directory.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -592,9 +450,7 @@
         <listitem><para>Application configuration. When a new user is created, this directory will be empty
         or not exist at all. Applications should fall back to defaults should their configuration in this
         directory be missing. If an application finds <varname>$XDG_CONFIG_HOME</varname> set, it should use
-        the directory specified in it instead of this directory.</para>
+        the directory specified in it instead of this directory.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -605,18 +461,14 @@
         shell; these should be placed in a subdirectory of <filename>~/.local/lib/</filename> instead. Care
         should be taken when placing architecture-dependent binaries in this place, which might be
         problematic if the home directory is shared between multiple hosts with different
-        architectures.</para>
+        architectures.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><filename>~/.local/lib/</filename></term>
 
         <listitem><para>Static, private vendor data that is compatible with all
-        architectures.</para>
+        architectures.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -624,9 +476,7 @@
 
         <listitem><para>Location for placing public dynamic libraries. The architecture identifier to use is
         defined on <ulink url="https://wiki.debian.org/Multiarch/Tuples">Multiarch Architecture Specifiers
-        (Tuples)</ulink> list.</para>
+        (Tuples)</ulink> list.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -635,9 +485,7 @@
         <listitem><para>Resources shared between multiple packages, such as fonts or artwork. Usually, the
         precise location and format of files stored below this directory is subject to specifications that
         ensure interoperability. If an application finds <varname>$XDG_DATA_HOME</varname> set, it should use
-        the directory specified in it instead of this directory.</para>
+        the directory specified in it instead of this directory.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -646,9 +494,7 @@
         <listitem><para>Application state. When a new user is created, this directory will be empty or not
         exist at all. Applications should fall back to defaults should their state in this directory be
         missing. If an application finds <varname>$XDG_STATE_HOME</varname> set, it should use the directory
-        specified in it instead of this directory.</para>
+        specified in it instead of this directory.</para></listitem>
-
-        <xi:include href="version-info.xml" xpointer="v254"/></listitem>
       </varlistentry>
 
     </variablelist>
@@ -777,9 +623,9 @@
       </tgroup>
     </table>
 
-    <para>Additional static vendor files may be installed in the
+    <para>Additional static vendor files with shared ownership may be installed in the
-    <filename>/usr/share/</filename> hierarchy to the locations
+    <filename>/usr/share/</filename> hierarchy to the locations defined by the various relevant
-    defined by the various relevant specifications.</para>
+    specifications.</para>
 
     <para>The following directories shall be used by the package for local configuration and files created
     during runtime:</para>
@@ -869,9 +715,9 @@
       </tgroup>
     </table>
 
-    <para>Additional static vendor files may be installed in the <filename>~/.local/share/</filename>
+    <para>Additional static vendor files with shared ownership may be installed in the
-    hierarchy, mirroring the subdirectories specified in the section "Vendor-supplied operating system
+    <filename>~/.local/share/</filename> hierarchy, mirroring the subdirectories specified in the section
-    resources" above.</para>
+    "Vendor-supplied operating system resources" above.</para>
 
     <para>The following directories shall be used by the package for per-user local configuration and files
     created during runtime:</para>
@@ -890,7 +736,7 @@
         <tbody>
           <row>
       <entry><filename>~/.config/<replaceable>package</replaceable>/</filename></entry>
-      <entry>User-specific configuration and state for the package. It is required to default to safe fallbacks if this configuration is missing.</entry>
+      <entry>User-specific configuration for the package. It is required to default to safe fallbacks if this configuration is missing.</entry>
           </row>
           <row>
       <entry><filename><varname>$XDG_RUNTIME_DIR</varname>/<replaceable>package</replaceable>/</filename></entry>
@@ -900,6 +746,10 @@
       <entry><filename>~/.cache/<replaceable>package</replaceable>/</filename></entry>
       <entry>Persistent cache data of the package. If this directory is flushed, the application should work correctly on next invocation, though possibly slowed down due to the need to rebuild any local cache files. The application must be capable of recreating this directory should it be missing and necessary.</entry>
           </row>
+          <row>
+      <entry><filename>~/.local/state/<replaceable>package</replaceable>/</filename></entry>
+      <entry>Persistent state data of the package.</entry>
+          </row>
         </tbody>
       </tgroup>
     </table>

man/hostnamectl.xml

@@ -172,15 +172,6 @@
     <para>The following options are understood:</para>
 
     <variablelist>
-      <varlistentry>
-        <term><option>--no-ask-password</option></term>
-
-        <listitem><para>Do not query the user for authentication for
-        privileged operations.</para>
-
-        <xi:include href="version-info.xml" xpointer="v195"/></listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><option>--static</option></term>
         <term><option>--transient</option></term>
@@ -198,6 +189,7 @@
       <xi:include href="user-system-options.xml" xpointer="host" />
       <xi:include href="user-system-options.xml" xpointer="machine" />
 
+      <xi:include href="standard-options.xml" xpointer="no-ask-password" />
       <xi:include href="standard-options.xml" xpointer="help" />
       <xi:include href="standard-options.xml" xpointer="version" />
       <xi:include href="standard-options.xml" xpointer="json" />

man/journalctl.xml

@@ -350,6 +350,42 @@
         <xi:include href="version-info.xml" xpointer="v198"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>-I</option></term>
+        <term><option>--invocation=<replaceable>ID</replaceable><optional><replaceable>±offset</replaceable></optional>|<replaceable>offset</replaceable></option></term>
+
+        <listitem>
+          <para>Show messages from a specific invocation of unit. This will add a match for
+          <literal>_SYSTEMD_INVOCATION_ID=</literal>, <literal>OBJECT_SYSTEMD_INVOCATION_ID=</literal>,
+          <literal>INVOCATION_ID=</literal>, <literal>USER_INVOCATION_ID=</literal>.</para>
+
+          <para>A positive <replaceable>offset</replaceable> will look up the invocations of a systemd unit
+          from the beginning of the journal, and zero or a negative offset will look up invocations starting
+          from the end of the journal. Thus, <constant>1</constant> means the first invocation found in the
+          journal in chronological order, <constant>2</constant> the second and so on; while
+          <constant>0</constant> is the latest invocation, <constant>-1</constant> the invocation before the
+          latest, and so on.</para>
+
+          <para>If the 32-character <replaceable>ID</replaceable> is specified, it may optionally be followed
+          by <replaceable>±offset</replaceable> which identifies the invocation relative to the one given by
+          invocation <replaceable>ID</replaceable>. Negative values mean earlier invocations and positive
+          values mean later invocations. If <replaceable>±offset</replaceable> is not specified, a value of
+          zero is assumed, and the logs for the invocation given by <replaceable>ID</replaceable> will be
+          shown.</para>
+
+          <para><option>-I</option> is equivalent to <option>--invocation=0</option>, and logs for the latest
+          invocation will be shown.</para>
+
+          <para>When an offset is specified, a unit name must be specified with <option>-u/--unit=</option>
+          or <option>--user-unit=</option> option.</para>
+
+          <para>When specified with <option>-b/--boot=</option>, then invocations are searched within the
+          specified boot.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><option>-t</option></term>
         <term><option>--identifier=<replaceable>SYSLOG_IDENTIFIER</replaceable></option></term>
@@ -862,6 +898,23 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--list-invocations</option></term>
+
+        <listitem>
+          <para>List invocation IDs of a unit. Requires a unit name with <option>-u/--unit=</option> or
+          <option>--user-unit=</option>. Show a tabular list of invocation numbers (relative to the current
+          or latest invocation), their IDs, and the timestamps of the first and last message pertaining to
+          the invocation. When <option>-b/-boot</option> is specified, invocations in the boot will be shown.
+          When specified with <option>-n/--lines=<optional>+</optional><replaceable>N</replaceable></option>
+          option, only the first (when the number prefixed with <literal>+</literal>) or the last (without
+          prefix) <replaceable>N</replaceable> entries will be shown. When specified with
+          <option>-r/--reverse</option>, the list will be shown in the reverse order.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><option>--disk-usage</option></term>
 

man/localectl.xml

@@ -167,12 +167,14 @@
 
     <variablelist>
       <varlistentry>
-        <term><option>--no-ask-password</option></term>
+        <term><option>-l</option></term>
+        <term><option>--full</option></term>
 
-        <listitem><para>Do not query the user for authentication for
+        <listitem>
-        privileged operations.</para>
+          <para>Do not ellipsize the output.</para>
 
-        <xi:include href="version-info.xml" xpointer="v195"/></listitem>
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
       </varlistentry>
 
       <varlistentry>
@@ -190,6 +192,7 @@
       <xi:include href="user-system-options.xml" xpointer="host" />
       <xi:include href="user-system-options.xml" xpointer="machine" />
 
+      <xi:include href="standard-options.xml" xpointer="no-ask-password" />
       <xi:include href="standard-options.xml" xpointer="help" />
       <xi:include href="standard-options.xml" xpointer="version" />
       <xi:include href="standard-options.xml" xpointer="no-pager" />

man/loginctl.xml

@@ -306,13 +306,6 @@
     <para>The following options are understood:</para>
 
     <variablelist>
-      <varlistentry>
-        <term><option>--no-ask-password</option></term>
-
-        <listitem><para>Do not query the user for authentication for
-        privileged operations.</para></listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><option>-p</option></term>
         <term><option>--property=</option></term>
@@ -410,6 +403,7 @@
       <xi:include href="user-system-options.xml" xpointer="host" />
       <xi:include href="user-system-options.xml" xpointer="machine" />
 
+      <xi:include href="standard-options.xml" xpointer="no-ask-password" />
       <xi:include href="standard-options.xml" xpointer="no-pager" />
       <xi:include href="standard-options.xml" xpointer="no-legend" />
       <xi:include href="standard-options.xml" xpointer="json" />

man/machine-id.xml

@@ -102,7 +102,8 @@
     value of the kernel command line option <varname>container_uuid</varname>, the KVM DMI
     <filename>product_uuid</filename> or the devicetree <filename>vm,uuid</filename>
     (on KVM systems), the Xen hypervisor <filename>uuid</filename>, and finally a randomly
-    generated UUID.</para>
+    generated UUID. <varname>systemd.machine_id=firmware</varname> can be set to generate the machine ID
+    from the firmware.</para>
 
     <para>After the machine ID is established,
     <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>

man/networkctl.xml

@@ -434,8 +434,9 @@ s - Service VLAN, m - Two-port MAC Relay (TPMR)
         <filename>/run/</filename>, depending on whether <option>--runtime</option> is specified.
         Specially, if the name is prefixed by <literal>@</literal>, it will be treated as
         a network interface, and editing will be performed on the network config files associated
-        with it. Additionally, the interface name can be suffixed with <literal>:network</literal> (default)
+        with it. Additionally, the interface name can be suffixed with <literal>:network</literal> (default),
-        or <literal>:link</literal>, in order to choose the type of network config to operate on.</para>
+        <literal>:link</literal>, or <literal>:netdev</literal>, in order to choose the type of network config
+        to operate on.</para>
 
         <para>If <option>--drop-in=</option> is specified, edit the drop-in file instead of
         the main configuration file. Unless <option>--no-reload</option> is specified,
@@ -448,6 +449,9 @@ s - Service VLAN, m - Two-port MAC Relay (TPMR)
         <citerefentry><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>
         for more information.</para>
 
+        <para>If <option>--stdin</option> is specified, the new content will be read from standard input.
+        In this mode, the old content of the file is discarded.</para>
+
         <xi:include href="version-info.xml" xpointer="v254"/></listitem>
       </varlistentry>
 
@@ -457,9 +461,10 @@ s - Service VLAN, m - Two-port MAC Relay (TPMR)
           <optional><replaceable>FILE</replaceable>|<replaceable>@DEVICE</replaceable>…</optional>
         </term>
         <listitem>
-          <para>Show network configuration files. This command honors the <literal>@</literal> prefix in the
+          <para>Show network configuration files. This command honors the <literal>@</literal> prefix in a
-          same way as <command>edit</command>. When no argument is specified,
+          similar way as <command>edit</command>, with support for an additional suffix <literal>:all</literal>
-          <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+          for showing all types of configuration files associated with the interface at once. When no argument
+          is specified, <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
           and its drop-in files will be shown.</para>
 
           <xi:include href="version-info.xml" xpointer="v254"/>
@@ -608,12 +613,29 @@ s - Service VLAN, m - Two-port MAC Relay (TPMR)
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--stdin</option></term>
+
+        <listitem>
+          <para>When used with <command>edit</command>, the contents of the file will be read from standard
+          input and the editor will not be launched. In this mode, the old contents of the file are
+          automatically replaced. This is useful to "edit" configuration from scripts, especially so that
+          drop-in directories are created and populated in one go.</para>
+
+          <para>Multiple drop-ins may be "edited" in this mode with <option>--drop-in=</option>, and
+          the same contents will be written to all of them. Otherwise exactly one main configuration file
+          is expected.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
+      <xi:include href="standard-options.xml" xpointer="no-ask-password" />
       <xi:include href="standard-options.xml" xpointer="json" />
       <xi:include href="standard-options.xml" xpointer="help" />
       <xi:include href="standard-options.xml" xpointer="version" />
       <xi:include href="standard-options.xml" xpointer="no-legend" />
       <xi:include href="standard-options.xml" xpointer="no-pager" />
-
     </variablelist>
   </refsect1>
 

man/networkd.conf.xml

@@ -131,6 +131,12 @@
           for more details about the sysctl options. Defaults to unset and the sysctl options will not be
           changed.</para>
 
+          <para>If an interface is configured with a .network file that enables <varname>IPMasquerade=</varname>
+          for IPv4 (that is, <literal>ipv4</literal> or <literal>both</literal>), this setting is implied
+          unless explicitly specified. See <varname>IPMasquerade=</varname> in
+          <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+          for more details.</para>
+
           <xi:include href="version-info.xml" xpointer="v256"/>
         </listitem>
       </varlistentry>
@@ -145,6 +151,12 @@
           for more details about the sysctl options. Defaults to unset and the sysctl options will not be
           changed.</para>
 
+          <para>If an interface is configured with a .network file that enables <varname>IPMasquerade=</varname>
+          for IPv6 (that is, <literal>ipv6</literal> or <literal>both</literal>), this setting is implied
+          unless explicitly specified. See <varname>IPMasquerade=</varname> in
+          <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+          for more details.</para>
+
           <xi:include href="version-info.xml" xpointer="v256"/>
         </listitem>
       </varlistentry>
@@ -201,6 +213,37 @@
     </variablelist>
   </refsect1>
 
+  <refsect1>
+    <title>[IPv6AddressLabel] Section Options</title>
+
+    <para>An [IPv6AddressLabel] section accepts the following keys. Specify multiple [IPv6AddressLabel]
+    sections to configure multiple address labels. IPv6 address labels are used for address selection.
+    See <ulink url="https://tools.ietf.org/html/rfc3484">RFC 3484</ulink>. Precedence is managed by
+    userspace, and only the label itself is stored in the kernel.</para>
+
+    <variablelist class='network-directives'>
+      <varlistentry>
+        <term><varname>Label=</varname></term>
+        <listitem>
+          <para>The label for the prefix, an unsigned integer in the range 0…4294967294. 0xffffffff is
+          reserved. This setting is mandatory.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>Prefix=</varname></term>
+        <listitem>
+          <para>IPv6 prefix is an address with a prefix length, separated by a slash
+          <literal>/</literal> character. This setting is mandatory.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
   <refsect1>
     <title>[DHCPv4] Section Options</title>
 

man/notify-selfcontained-example.c

@@ -15,6 +15,7 @@
 #include <stddef.h>
 #include <stdlib.h>
 #include <stdio.h>
+#include <string.h>
 #include <sys/socket.h>
 #include <sys/un.h>
 #include <time.h>

man/nss-systemd.xml

@@ -93,6 +93,17 @@ lrwxrwxrwx. 1 root root   19 May 10 4711.user-privileged -> foobar.user-privileg
     <filename>.user-privileged</filename> and <filename>.group-privileged</filename> suffixes) should
     contain this section, exclusively.</para>
 
+    <para>In addition to the two types of user record files and the two types of group record files there's a
+    fifth type of file that may be placed in the searched directories: files that indicate membership of
+    users in groups. Specifically, for every pair of user/group where the user shall be a member of a group a
+    file named
+    <literal><replaceable>username</replaceable>:<replaceable>groupname</replaceable>.membership</literal>
+    should be created, i.e. the textual UNIX user name, followed by a colon, followed by the textual UNIX
+    group name, suffixed by <literal>.membership</literal>. The contents of these files are currently not
+    read, and the files should be created empty. The mere existence of these files is enough to effect a
+    user/group membership. If a program provides user and/or group record files in the searched directories,
+    it should always also create such files, both for primary and auxiliary group memberships.</para>
+
     <para>Note that static user/group records generally do not override conflicting records in
     <filename>/etc/passwd</filename> or <filename>/etc/group</filename> or other account databases. In fact,
     before dropping in these files a reasonable level of care should be taken to avoid user/group name and

man/org.freedesktop.login1.xml

@@ -256,9 +256,11 @@ node /org/freedesktop/login1 {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("false")
       readonly b PreparingForShutdown = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("false")
+      readonly a{sv} PreparingForShutdownWithMetadata = [...];
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("false")
       readonly b PreparingForSleep = ...;
       readonly (st) ScheduledShutdown = ...;
-      @org.freedesktop.DBus.Property.EmitsChangedSignal("false")
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s DesignatedMaintenanceTime = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("false")
       readonly b Docked = ...;
@@ -526,6 +528,8 @@ node /org/freedesktop/login1 {
 
     <variablelist class="dbus-property" generated="True" extra-ref="PreparingForShutdown"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="PreparingForShutdownWithMetadata"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="PreparingForSleep"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="ScheduledShutdown"/>
@@ -665,15 +669,18 @@ node /org/freedesktop/login1 {
 #define SD_LOGIND_KEXEC_REBOOT                   (UINT64_C(1) &lt;&lt; 1)
 #define SD_LOGIND_SOFT_REBOOT                    (UINT64_C(1) &lt;&lt; 2)
 #define SD_LOGIND_SOFT_REBOOT_IF_NEXTROOT_SET_UP (UINT64_C(1) &lt;&lt; 3)
+#define SD_LOGIND_SKIP_INHIBITORS                (UINT64_C(1) &lt;&lt; 4)
       </programlisting>
       <para>When the <varname>flags</varname> is 0 then these methods behave just like the versions without
-      flags. When <constant>SD_LOGIND_ROOT_CHECK_INHIBITORS</constant> (0x01) is set, active inhibitors are
+      flags. Since systemd version 256 <constant>SD_LOGIND_ROOT_CHECK_INHIBITORS</constant> (0x01) is deprecated,
-      honoured for privileged users too. When <constant>SD_LOGIND_KEXEC_REBOOT</constant> (0x02) is set,
+      and active inhibitors are always honoured by default for privileged users too, and a new flag
-      then <function>RebootWithFlags()</function> performs a kexec reboot if kexec kernel is loaded. When
+      <constant>SD_LOGIND_SKIP_INHIBITORS</constant> (0x04) can be specified to bypass inhibitors. When
-      <constant>SD_LOGIND_SOFT_REBOOT</constant> (0x04) is set, or
+      <constant>SD_LOGIND_KEXEC_REBOOT</constant> (0x02) is set, then <function>RebootWithFlags()</function>
-      <constant>SD_LOGIND_SOFT_REBOOT_IF_NEXTROOT_SET_UP</constant> (0x08) is set and a new root file system
+      performs a kexec reboot if kexec kernel is loaded. When <constant>SD_LOGIND_SOFT_REBOOT</constant>
-      has been set up on <literal>/run/nextroot/</literal>, then <function>RebootWithFlags()</function>
+      (0x04) is set, or <constant>SD_LOGIND_SOFT_REBOOT_IF_NEXTROOT_SET_UP</constant> (0x08) is set and a
-      performs a userspace reboot only. <constant>SD_LOGIND_SOFT_REBOOT_IF_NEXTROOT_SET_UP</constant> and
+      new root file system has been set up on <literal>/run/nextroot/</literal>, then
+      <function>RebootWithFlags()</function> performs a userspace reboot only.
+      <constant>SD_LOGIND_SOFT_REBOOT_IF_NEXTROOT_SET_UP</constant> and
       <constant>SD_LOGIND_KEXEC_REBOOT</constant> can be combined, with soft-reboot having precedence.</para>
 
       <para><function>SetRebootParameter()</function> sets a parameter for a subsequent reboot operation.
@@ -731,8 +738,10 @@ node /org/freedesktop/login1 {
       should be a short human readable string identifying the reason why the lock is taken. Finally,
       <varname>mode</varname> is either <literal>block</literal> or <literal>delay</literal> which encodes
       whether the inhibit shall be consider mandatory or whether it should just delay the operation to a
-      certain maximum time. The method returns a file descriptor. The lock is released the moment this file
+      certain maximum time, while the <literal>block-weak</literal> and <literal>delay-weak</literal>
-      descriptor and all its duplicates are closed. For more information on the inhibition logic see
+      variants will create an inhibitor that is automatically ignored in some circumstances. The method
+      returns a file descriptor. The lock is released the moment this file descriptor and all its duplicates
+      are closed. For more information on the inhibition logic see
       <ulink url="https://systemd.io/INHIBITOR_LOCKS">Inhibitor Locks</ulink>.
       </para>
     </refsect2>
@@ -810,8 +819,14 @@ node /org/freedesktop/login1 {
 
       <para>The <varname>PreparingForShutdown</varname> and <varname>PreparingForSleep</varname> boolean
       properties are true during the interval between the two <function>PrepareForShutdown()</function> and
-      <function>PrepareForSleep()</function> signals respectively. Note that these properties do not
+      <function>PrepareForSleep()</function> signals respectively. The
-      send out <function>PropertyChanged</function> signals.</para>
+      <varname>PreparingForShutdownWithMetadata</varname> property provides a list of key/value pair
+      metadata fields. Currently it lists a <varname>preparing</varname> boolean that corresponds to the
+      <varname>PreparingForShutdown</varname> property, and, if a shutdown is being prepared, it will also
+      contain a <varname>type</varname> string which defines the type of shutdown. The type can be one of
+      <literal>power-off</literal>, <literal>reboot</literal>, <literal>halt</literal>,
+      <literal>kexec</literal> or <literal>soft-reboot</literal>. Note that these properties do not send out
+      <function>PropertyChanged</function> signals.</para>
 
       <para>The <varname>RebootParameter</varname> property shows the value set with the
       <function>SetRebootParameter()</function> method described above.</para>
@@ -1501,8 +1516,9 @@ node /org/freedesktop/login1/session/1 {
       available.</para>
 
       <para><varname>Type</varname> encodes the session type. It's one of <literal>unspecified</literal> (for
-      cron PAM sessions and suchlike), <literal>tty</literal> (for text logins) or
+      cron PAM sessions and suchlike), <literal>tty</literal> (for text logins), <literal>web</literal> (for
-      <literal>x11</literal>/<literal>mir</literal>/<literal>wayland</literal> (for graphical logins).</para>
+      web-based logins), or <literal>x11</literal>/<literal>mir</literal>/<literal>wayland</literal> (for
+      graphical logins).</para>
 
       <para><varname>Class</varname> encodes the session class. It's one of <literal>user</literal> (for
       normal user sessions), <literal>greeter</literal> (for display manager pseudo-sessions), or
@@ -1601,11 +1617,12 @@ node /org/freedesktop/login1/session/1 {
       <function>CreateSessionWithPIDFD()</function> were added in version 255.</para>
       <para><function>Sleep()</function>,
       <function>CanSleep()</function>,
-      <varname>SleepOperation</varname>,
+      <varname>SleepOperation</varname>, and
-      <varname>DesignatedMaintenanceTime</varname>, and
       <function>ListSessionsEx()</function> were added in version 256.</para>
-      <para><varname>HandleSecureAttentionKey</varname>, and
+      <para><varname>HandleSecureAttentionKey</varname>,
-      <function>SecureAttentionKey()</function> were added in version 257.</para>
+      <function>SecureAttentionKey()</function>,
+      <varname>PreparingForShutdownWithMetadata</varname>, and
+      <varname>DesignatedMaintenanceTime</varname> were added in version 257.</para>
     </refsect2>
     <refsect2>
       <title>Session Objects</title>

man/org.freedesktop.systemd1.xml

@@ -593,8 +593,6 @@ node /org/freedesktop/systemd1 {
 
     <!--method GetJobBefore is not documented!-->
 
-    <!--method SetShowStatus is not documented!-->
-
     <!--method ListUnitsFiltered is not documented!-->
 
     <!--method ListUnitsByPatterns is not documented!-->
@@ -673,8 +671,6 @@ node /org/freedesktop/systemd1 {
 
     <!--property ConfirmSpawn is not documented!-->
 
-    <!--property ShowStatus is not documented!-->
-
     <!--property DefaultStandardOutput is not documented!-->
 
     <!--property DefaultStandardError is not documented!-->
@@ -1362,6 +1358,24 @@ node /org/freedesktop/systemd1 {
 
       <para><function>ResetFailedUnit()</function> resets the "failed" state of a specific unit.</para>
 
+      <para><function>SetShowStatus()</function> configures the display of status messages during bootup and
+      shutdown. The <varname>mode</varname> parameter can be set to any value that's valid for the
+      <varname>systemd.show_status</varname> kernel parameter. For more information about
+      <varname>systemd.show_status</varname>, see
+      <citerefentry project="man-pages"><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
+      The <varname>mode</varname> parameter can also be set to an empty string. When <varname>mode</varname>
+      is set to an empty string, <function>SetShowStatus()</function> will reset
+      <varname>ShowStatus</varname> back to its original value. You can use
+      <function>SetShowStatus()</function> create a service that does something like this:
+      <orderedlist>
+        <listitem><para>Send a D-Bus message that will turn off status messages.</para></listitem>
+        <listitem><para>Block until a reply to that message is received.</para></listitem>
+        <listitem><para>Print multiples lines without being interrupted by status messages.</para></listitem>
+        <listitem><para>Send a D-Bus message that will reset <varname>ShowStatus</varname> back to its
+        original value.</para></listitem>
+      </orderedlist>
+      </para>
+
       <para><function>ResetFailed()</function> resets the "failed" state of all units.</para>
 
       <para><function>ListUnits()</function> returns an array of all currently loaded units. Note that
@@ -1788,6 +1802,12 @@ node /org/freedesktop/systemd1 {
       <para><varname>Environment</varname> encodes the environment block passed to all executed services. It
       may be altered with bus calls such as <function>SetEnvironment()</function> (see above).</para>
 
+      <para><varname>ShowStatus</varname> encodes systemd's current policy for displaying status messages
+      during bootup and shutdown. Its value can be any valid value for the
+      <varname>systemd.show_status</varname> kernel parameter (see
+      <citerefentry project="man-pages"><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>).
+      It may be altered using <function>SetShowStatus()</function> (see above).</para>
+
       <para><varname>UnitPath</varname> encodes the currently active unit file search path. It is an array of
       file system paths encoded as strings.</para>
 
@@ -2046,6 +2066,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
       readonly as CanClean = ['...', ...];
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b CanFreeze = ...;
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly b CanLiveMount = ...;
       readonly (uo) Job = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b StopWhenUnneeded = ...;
@@ -2115,6 +2137,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("false")
       readonly as Refs = ['...', ...];
       readonly a(ss) ActivationDetails = [...];
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("false")
+      readonly b DebugInvocation = ...;
   };
   interface org.freedesktop.DBus.Peer { ... };
   interface org.freedesktop.DBus.Introspectable { ... };
@@ -2176,6 +2200,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <!--property CanFreeze is not documented!-->
 
+    <!--property CanLiveMount is not documented!-->
+
     <!--property SurviveFinalKillSignal is not documented!-->
 
     <!--property OnSuccessJobMode is not documented!-->
@@ -2380,6 +2406,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <variablelist class="dbus-property" generated="True" extra-ref="CanFreeze"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="CanLiveMount"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="Job"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="StopWhenUnneeded"/>
@@ -2458,6 +2486,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <variablelist class="dbus-property" generated="True" extra-ref="ActivationDetails"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="DebugInvocation"/>
+
     <!--End of Autogenerated section-->
 
     <refsect2>
@@ -2644,14 +2674,20 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
       <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>. Note
       that new key value pair may be added at any time in future versions. Existing entries will not be
       removed.</para>
+
+      <para><varname>DebugInvocation</varname> contains a boolean that will change to
+      <constant>true</constant> when the unit is restarted with log level set to debug due to an earlier
+      failure, and will change back to <constant>false</constant> when either the unit successfully starts
+      or the restart rate limit is reached. See the <literal>RestartMode=</literal> section in
+      <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      for more details.</para>
     </refsect2>
 
     <refsect2>
       <title>Security</title>
 
       <para>Similarly to methods on the <interfacename>Manager</interfacename> object, read-only access is
-      allowed for everyone. All operations are allowed for clients with the
+      allowed for everyone. All operations are allowed for clients when the
-      <constant>CAP_SYS_ADMIN</constant> capability or when the
       <interfacename>org.freedesktop.systemd1.manage-units</interfacename> privilege is granted by
       polkit.</para>
     </refsect2>
@@ -2750,6 +2786,7 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
       readonly s Result = '...';
       readonly s ReloadResult = '...';
       readonly s CleanResult = '...';
+      readonly s LiveMountResult = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s USBFunctionDescriptors = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
@@ -3187,6 +3224,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly as ImportCredential = ['...', ...];
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly a(ss) ImportCredentialEx = [...];
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly as SupplementaryGroups = ['...', ...];
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s PAMName = '...';
@@ -3225,6 +3264,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateUsers = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s PrivateUsersEx = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateMounts = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateIPC = ...;
@@ -3313,6 +3354,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b MountAPIVFS = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly b BindLogSockets = ...;
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s KeyringMode = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s ProtectProc = '...';
@@ -3412,6 +3455,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <!--property CleanResult is not documented!-->
 
+    <!--property LiveMountResult is not documented!-->
+
     <!--property USBFunctionDescriptors is not documented!-->
 
     <!--property USBFunctionStrings is not documented!-->
@@ -3800,6 +3845,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <!--property ImportCredential is not documented!-->
 
+    <!--property ImportCredentialEx is not documented!-->
+
     <!--property SupplementaryGroups is not documented!-->
 
     <!--property PAMName is not documented!-->
@@ -3836,6 +3883,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <!--property PrivateUsers is not documented!-->
 
+    <!--property PrivateUsersEx is not documented!-->
+
     <!--property PrivateMounts is not documented!-->
 
     <!--property PrivateIPC is not documented!-->
@@ -3908,6 +3957,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <!--property MountAPIVFS is not documented!-->
 
+    <!--property BindLogSockets is not documented!-->
+
     <!--property KeyringMode is not documented!-->
 
     <!--property ProtectProc is not documented!-->
@@ -4040,6 +4091,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <variablelist class="dbus-property" generated="True" extra-ref="CleanResult"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="LiveMountResult"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="USBFunctionDescriptors"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="USBFunctionStrings"/>
@@ -4488,6 +4541,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <variablelist class="dbus-property" generated="True" extra-ref="ImportCredential"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="ImportCredentialEx"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="SupplementaryGroups"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="PAMName"/>
@@ -4526,6 +4581,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateUsers"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="PrivateUsersEx"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateMounts"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateIPC"/>
@@ -4614,6 +4671,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
 
     <variablelist class="dbus-property" generated="True" extra-ref="MountAPIVFS"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="BindLogSockets"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="KeyringMode"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectProc"/>
@@ -5312,6 +5371,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly as ImportCredential = ['...', ...];
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly a(ss) ImportCredentialEx = [...];
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly as SupplementaryGroups = ['...', ...];
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s PAMName = '...';
@@ -5350,6 +5411,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateUsers = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s PrivateUsersEx = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateMounts = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateIPC = ...;
@@ -5438,6 +5501,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b MountAPIVFS = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly b BindLogSockets = ...;
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s KeyringMode = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s ProtectProc = '...';
@@ -5939,6 +6004,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
 
     <!--property ImportCredential is not documented!-->
 
+    <!--property ImportCredentialEx is not documented!-->
+
     <!--property SupplementaryGroups is not documented!-->
 
     <!--property PAMName is not documented!-->
@@ -5975,6 +6042,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
 
     <!--property PrivateUsers is not documented!-->
 
+    <!--property PrivateUsersEx is not documented!-->
+
     <!--property PrivateMounts is not documented!-->
 
     <!--property PrivateIPC is not documented!-->
@@ -6047,6 +6116,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
 
     <!--property MountAPIVFS is not documented!-->
 
+    <!--property BindLogSockets is not documented!-->
+
     <!--property KeyringMode is not documented!-->
 
     <!--property ProtectProc is not documented!-->
@@ -6603,6 +6674,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
 
     <variablelist class="dbus-property" generated="True" extra-ref="ImportCredential"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="ImportCredentialEx"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="SupplementaryGroups"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="PAMName"/>
@@ -6641,6 +6714,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateUsers"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="PrivateUsersEx"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateMounts"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateIPC"/>
@@ -6729,6 +6804,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
 
     <variablelist class="dbus-property" generated="True" extra-ref="MountAPIVFS"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="BindLogSockets"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="KeyringMode"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectProc"/>
@@ -7291,6 +7368,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly as ImportCredential = ['...', ...];
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly a(ss) ImportCredentialEx = [...];
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly as SupplementaryGroups = ['...', ...];
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s PAMName = '...';
@@ -7329,6 +7408,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateUsers = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s PrivateUsersEx = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateMounts = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateIPC = ...;
@@ -7417,6 +7498,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b MountAPIVFS = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly b BindLogSockets = ...;
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s KeyringMode = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s ProtectProc = '...';
@@ -7844,6 +7927,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
 
     <!--property ImportCredential is not documented!-->
 
+    <!--property ImportCredentialEx is not documented!-->
+
     <!--property SupplementaryGroups is not documented!-->
 
     <!--property PAMName is not documented!-->
@@ -7880,6 +7965,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
 
     <!--property PrivateUsers is not documented!-->
 
+    <!--property PrivateUsersEx is not documented!-->
+
     <!--property PrivateMounts is not documented!-->
 
     <!--property PrivateIPC is not documented!-->
@@ -7952,6 +8039,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
 
     <!--property MountAPIVFS is not documented!-->
 
+    <!--property BindLogSockets is not documented!-->
+
     <!--property KeyringMode is not documented!-->
 
     <!--property ProtectProc is not documented!-->
@@ -8420,6 +8509,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
 
     <variablelist class="dbus-property" generated="True" extra-ref="ImportCredential"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="ImportCredentialEx"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="SupplementaryGroups"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="PAMName"/>
@@ -8458,6 +8549,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateUsers"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="PrivateUsersEx"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateMounts"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateIPC"/>
@@ -8546,6 +8639,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
 
     <variablelist class="dbus-property" generated="True" extra-ref="MountAPIVFS"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="BindLogSockets"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="KeyringMode"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectProc"/>
@@ -9231,6 +9326,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly as ImportCredential = ['...', ...];
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly a(ss) ImportCredentialEx = [...];
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly as SupplementaryGroups = ['...', ...];
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s PAMName = '...';
@@ -9269,6 +9366,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateUsers = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s PrivateUsersEx = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateMounts = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b PrivateIPC = ...;
@@ -9357,6 +9456,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly b MountAPIVFS = ...;
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly b BindLogSockets = ...;
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s KeyringMode = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s ProtectProc = '...';
@@ -9770,6 +9871,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
 
     <!--property ImportCredential is not documented!-->
 
+    <!--property ImportCredentialEx is not documented!-->
+
     <!--property SupplementaryGroups is not documented!-->
 
     <!--property PAMName is not documented!-->
@@ -9806,6 +9909,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
 
     <!--property PrivateUsers is not documented!-->
 
+    <!--property PrivateUsersEx is not documented!-->
+
     <!--property PrivateMounts is not documented!-->
 
     <!--property PrivateIPC is not documented!-->
@@ -9878,6 +9983,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
 
     <!--property MountAPIVFS is not documented!-->
 
+    <!--property BindLogSockets is not documented!-->
+
     <!--property KeyringMode is not documented!-->
 
     <!--property ProtectProc is not documented!-->
@@ -10332,6 +10439,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
 
     <variablelist class="dbus-property" generated="True" extra-ref="ImportCredential"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="ImportCredentialEx"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="SupplementaryGroups"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="PAMName"/>
@@ -10370,6 +10479,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateUsers"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="PrivateUsersEx"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateMounts"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="PrivateIPC"/>
@@ -10458,6 +10569,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
 
     <variablelist class="dbus-property" generated="True" extra-ref="MountAPIVFS"/>
 
+    <variablelist class="dbus-property" generated="True" extra-ref="BindLogSockets"/>
+
     <variablelist class="dbus-property" generated="True" extra-ref="KeyringMode"/>
 
     <variablelist class="dbus-property" generated="True" extra-ref="ProtectProc"/>
@@ -12055,6 +12168,8 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
       <para><function>QueueSignal()</function> was added in version 254.</para>
       <para><varname>SurviveFinalKillSignal</varname> was added in version 255.</para>
       <para><varname>WantsMountsFor</varname> was added in version 256.</para>
+      <para><varname>DebugInvocation</varname>, and
+      <varname>CanLiveMount</varname> were added in version 257.</para>
     </refsect2>
     <refsect2>
       <title>Service Unit Objects</title>
@@ -12099,8 +12214,12 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
       <varname>ExecMainHandoffTimestampMonotonic</varname>, and
       <varname>ExecMainHandoffTimestamp</varname> were added in version 256.</para>
       <para><varname>StatusBusError</varname>,
-      <varname>StatusVarlinkError</varname>, and
+      <varname>StatusVarlinkError</varname>,
-      <varname>PrivateTmpEx</varname> were added in version 257.</para>
+      <varname>LiveMountResult</varname>,
+      <varname>PrivateTmpEx</varname>,
+      <varname>ImportCredentialEx</varname>,
+      <varname>BindLogSockets</varname>, and
+      <varname>PrivateUsersEx</varname> were added in version 257.</para>
     </refsect2>
     <refsect2>
       <title>Socket Unit Objects</title>
@@ -12137,7 +12256,10 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
       <varname>EffectiveTasksMax</varname>,
       <varname>MemoryZSwapWriteback</varname>, and
       <varname>PassFileDescriptorsToExec</varname> were added in version 256.</para>
-      <para><varname>PrivateTmpEx</varname> was added in version 257.</para>
+      <para><varname>PrivateTmpEx</varname>,
+      <varname>ImportCredentialEx</varname>,
+      <varname>BindLogSockets</varname>, and
+      <varname>PrivateUsersEx</varname> were added in version 257.</para>
     </refsect2>
     <refsect2>
       <title>Mount Unit Objects</title>
@@ -12171,7 +12293,10 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
       <varname>EffectiveMemoryMax</varname>,
       <varname>EffectiveTasksMax</varname>, and
       <varname>MemoryZSwapWriteback</varname> were added in version 256.</para>
-      <para><varname>PrivateTmpEx</varname> was added in version 257.</para>
+      <para><varname>PrivateTmpEx</varname>,
+      <varname>ImportCredentialEx</varname>,
+      <varname>BindLogSockets</varname>, and
+      <varname>PrivateUsersEx</varname> were added in version 257.</para>
     </refsect2>
     <refsect2>
       <title>Swap Unit Objects</title>
@@ -12205,7 +12330,10 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
       <varname>EffectiveMemoryMax</varname>,
       <varname>EffectiveTasksMax</varname>, and
       <varname>MemoryZSwapWriteback</varname> were added in version 256.</para>
-      <para><varname>PrivateTmpEx</varname> was added in version 257.</para>
+      <para><varname>PrivateTmpEx</varname>,
+      <varname>ImportCredentialEx</varname>,
+      <varname>BindLogSockets</varname>, and
+      <varname>PrivateUsersEx</varname> were added in version 257.</para>
     </refsect2>
     <refsect2>
       <title>Slice Unit Objects</title>

man/org.freedesktop.sysupdate1.xml

@@ -0,0 +1,497 @@
+<?xml version='1.0'?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" >
+<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
+
+<refentry id="org.freedesktop.sysupdate1" conditional='ENABLE_SYSUPDATE'
+    xmlns:xi="http://www.w3.org/2001/XInclude">
+  <refentryinfo>
+    <title>org.freedesktop.sysupdate1</title>
+    <productname>systemd</productname>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>org.freedesktop.sysupdate1</refentrytitle>
+    <manvolnum>5</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>org.freedesktop.sysupdate1</refname>
+    <refpurpose>The D-Bus interface of systemd-sysupdated</refpurpose>
+  </refnamediv>
+
+  <refsect1>
+    <title>Introduction</title>
+
+    <para>
+    <citerefentry><refentrytitle>systemd-sysupdated.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    is a system service that allows unprivileged clients to update the system. This page describes the D-Bus
+    interface.</para>
+  </refsect1>
+
+  <refsect1>
+    <title>The Manager Object</title>
+
+    <para>The service exposes the following interfaces on the Manager object on the bus:</para>
+
+    <programlisting executable="systemd-sysupdated" node="/org/freedesktop/sysupdate1" interface="org.freedesktop.sysupdate1.Manager">
+node /org/freedesktop/sysupdate1 {
+  interface org.freedesktop.sysupdate1.Manager {
+    methods:
+      ListTargets(out a(sso) targets);
+      ListJobs(out a(tsuo) jobs);
+      ListAppStream(out as urls);
+    signals:
+      JobRemoved(t id,
+                 o path,
+                 i status);
+  };
+  interface org.freedesktop.DBus.Peer { ... };
+  interface org.freedesktop.DBus.Introspectable { ... };
+  interface org.freedesktop.DBus.Properties { ... };
+};
+    </programlisting>
+
+    <!--Autogenerated cross-references for systemd.directives, do not edit-->
+
+    <variablelist class="dbus-interface" generated="True" extra-ref="org.freedesktop.sysupdate1.Manager"/>
+
+    <variablelist class="dbus-interface" generated="True" extra-ref="org.freedesktop.sysupdate1.Manager"/>
+
+    <variablelist class="dbus-method" generated="True" extra-ref="ListTargets()"/>
+
+    <variablelist class="dbus-method" generated="True" extra-ref="ListJobs()"/>
+
+    <variablelist class="dbus-method" generated="True" extra-ref="ListAppStream()"/>
+
+    <variablelist class="dbus-signal" generated="True" extra-ref="JobRemoved()"/>
+
+    <!--End of Autogenerated section-->
+
+    <refsect2>
+      <title>Methods</title>
+
+      <para><function>ListTargets()</function> returns a list all known update targets. It returns
+      an array of structures which consist of a string indicating the target's class (see Target's
+      <varname>Class</varname> property below for an explanation of the possible values), a string
+      with the name of the target, and the target object path.</para>
+
+      <para><function>ListJobs()</function> returns a list all ongoing jobs. It returns
+      an array of structures which consist of a numeric job ID, a string indicating the job type (see Job's
+      <varname>Type</varname> property below for an explanation of the possible values), the job's progress,
+      and the job's object path.</para>
+
+      <para><function>ListAppStream()</function> returns an array of all the appstream catalog URLs that this
+      service knows about. See Target's <varname>GetAppStream()</varname> method below for more
+      details.</para>
+    </refsect2>
+
+    <refsect2>
+      <title>Signals</title>
+
+      <para>The <function>JobRemoved()</function> signal is sent each time a job finishes,
+      is canceled or fails. It also carries the job ID and object path, followed by a numeric status
+      code. If the status is zero, the job has succeed. A positive status should be treated as an
+      exit code (i.e. <literal>EXIT_FAILURE</literal>), and a negative status should be treated as a
+      negative errno-style error code (i.e. <literal>-EINVAL</literal>).</para>
+    </refsect2>
+  </refsect1>
+
+  <refsect1>
+    <title>The Target Object</title>
+
+    <para>A target is a component of the system (i.e. the host itself, a sysext, a confext, etc.) that
+    can be updated by
+    <citerefentry><refentrytitle>systemd-sysupdate</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
+    </para>
+
+    <para>The service exposes the following interfaces on Target objects on the bus:</para>
+
+    <programlisting executable="systemd-sysupdated" node="/org/freedesktop/sysupdate1/target/host" interface="org.freedesktop.sysupdate1.Target">
+node /org/freedesktop/sysupdate1/target/host {
+  interface org.freedesktop.sysupdate1.Target {
+    methods:
+      List(in  t flags,
+           out as versions);
+      Describe(in  s version,
+               in  t flags,
+               out s json);
+      CheckNew(out s new_version);
+      Update(in  s new_version,
+             in  t flags,
+             out s new_version,
+             out t job_id,
+             out o job_path);
+      Vacuum(out u count);
+      GetAppStream(out as appstream);
+      GetVersion(out s version);
+    properties:
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s Class = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s Name = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s Path = '...';
+  };
+  interface org.freedesktop.DBus.Peer { ... };
+  interface org.freedesktop.DBus.Introspectable { ... };
+  interface org.freedesktop.DBus.Properties { ... };
+};
+    </programlisting>
+
+    <!--Autogenerated cross-references for systemd.directives, do not edit-->
+
+    <variablelist class="dbus-interface" generated="True" extra-ref="org.freedesktop.sysupdate1.Target"/>
+
+    <variablelist class="dbus-interface" generated="True" extra-ref="org.freedesktop.sysupdate1.Target"/>
+
+    <variablelist class="dbus-method" generated="True" extra-ref="List()"/>
+
+    <variablelist class="dbus-method" generated="True" extra-ref="Describe()"/>
+
+    <variablelist class="dbus-method" generated="True" extra-ref="CheckNew()"/>
+
+    <variablelist class="dbus-method" generated="True" extra-ref="Update()"/>
+
+    <variablelist class="dbus-method" generated="True" extra-ref="Vacuum()"/>
+
+    <variablelist class="dbus-method" generated="True" extra-ref="GetAppStream()"/>
+
+    <variablelist class="dbus-method" generated="True" extra-ref="GetVersion()"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="Class"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="Name"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="Path"/>
+
+    <!--End of Autogenerated section-->
+
+    <refsect2>
+      <title>Methods</title>
+
+      <para><function>List()</function> returns a list of versions available for this target. Additional
+      options may be passed through the <varname>flags</varname> argument. Valid flags are defined as follows:
+      </para>
+
+      <programlisting>
+#define SD_SYSUPDATE_OFFLINE    (UINT64_C(1) &lt;&lt; 0)
+      </programlisting>
+
+      <para>When <constant>SD_SYSUPDATE_OFFLINE</constant> is set, this method returns only the versions
+      installed locally. Otherwise, this method pulls metadata from the network and returns all versions
+      available for this target. Use <function>Describe()</function> to query more information about each
+      version returned by this method.</para>
+
+      <para><function>Describe()</function> returns all known information about a given version as a JSON
+      object. The <varname>version</varname> argument is used to pass the version to be described. Additional
+      options may be passed through the <varname>flags</varname> argument. This method supports the same flags
+      as <function>List()</function>. The returned JSON object contains several known keys. More keys may be
+      added in the future. The currently known keys are as follows:</para>
+
+      <variablelist>
+        <varlistentry>
+          <term><literal>version</literal></term>
+          <listitem><para>A string containing the version number.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><literal>newest</literal></term>
+          <listitem><para>A boolean indicating whether this version is the latest available for the target.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><literal>available</literal></term>
+          <listitem><para>A boolean indicating whether this version is available for download.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><literal>installed</literal></term>
+          <listitem><para>A boolean indicating whether this version is installed locally.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><literal>obsolete</literal></term>
+          <listitem><para>A boolean indicating whether this version is considered obsolete by the service,
+          and is therefore disallowed from being installed.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><literal>protected</literal></term>
+          <listitem><para>A boolean indicating whether this version is exempt from deletion by a
+          <function>Vacuum()</function> operation.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><literal>incomplete</literal></term>
+          <listitem><para>A boolean indicating whether this version is incomplete, which means that it is
+          missing some file. Note that only installed incomplete versions will be offered by the service;
+          versions that are incomplete on the server-side are completely ignored. Incomplete versions can
+          be repaired in-place by calling <function>Update()</function> on that version.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><literal>changelog_urls</literal></term>
+          <listitem><para>A list of strings that contain user-presentable URLs to ChangeLogs associated with
+          this version.</para></listitem>
+        </varlistentry>
+      </variablelist>
+      
+      <para><function>CheckNew()</function> checks if a newer version is available for this target. This
+      method pulls metadata from the network. If a newer version is found, this method returns the
+      version number. If no newer version is found, this method returns an empty string. Use
+      <function>Describe()</function> to query more information about the version returned by this method.
+      </para>
+
+      <para><function>Update()</function> installs an update for this target. If a
+      <varname>new_version</varname> is specified, that is the version that gets installed. Otherwise, the
+      latest version is installed. The <varname>flags</varname> argument is added for future
+      extensibility. No flags are currently defined, and the argument is required to be set to
+      <literal>0</literal>. Unlike all the other methods in this interface, <function>Update()</function>
+      does not wait for its job to complete. Instead, it returns the job's numeric ID and object path as soon
+      as the job begins, so that the caller can listen for progress updates or cancel the operation. This
+      method also returns the version the target will be updated to, for cases where no version was specified
+      by the caller. This method pulls both metadata and payload data from the network. Listen for the
+      Manager's <function>JobRemoved()</function> signal to detect when the job is complete.</para>
+
+      <para><function>Vacuum()</function> deletes old installed versions of this target to free up space.
+      It returns the number of instances that have been deleted.</para>
+
+      <para><function>GetAppStream()</function> returns a list of HTTP/HTTPS URLs to this target's
+      <ulink url="https://wwww.freedesktop.org/software/appstream/docs/chap-CatalogData.html">appstream catalog</ulink>
+      XML files. If this target has no appstream catalogs, the method will return an empty list. These
+      catalog files can be used by software centers (such as GNOME Software or KDE Discover) to present rich
+      metadata about the target, including a display name, changelog, icon, and more. The returned catalogs
+      will include <ulink url="https://systemd.io/APPSTREAM_BUNDLE">special metadata</ulink> to allow the
+      software center to correctly associate the catalogs with this target.</para>
+
+      <para><function>GetVersion()</function> returns the current version of this target, if any. The current
+      version is the newest version that is installed. Note that this isn't necessarily the same thing as the
+      booted or currently-in-use version of the target.  For example, on the host system the booted version
+      is the current version most of the time, but if an update is installed and pending a reboot it will
+      become the current version instead.  You can query the booted version of the host system via
+      <varname>IMAGE_VERSION</varname> in <filename>/etc/os-release</filename>. If the target has no current
+      version, the function will return an empty string.</para>
+
+    </refsect2>
+
+    <refsect2>
+      <title>Properties</title>
+
+      <para>The <varname>Class</varname> property exposes the class of this target, which describes
+      where it was enumerated. Possible values include: <literal>machine</literal> for containers and
+      virtual machines managed by
+      <citerefentry><refentrytitle>systemd-machined.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+      <literal>portable</literal> for <ulink url="https://systemd.io/PORTABLE_SERVICES">portable services</ulink>,
+      <literal>sysext</literal> for system extensions managed by
+      <citerefentry><refentrytitle>systemd-sysext</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+      <literal>confext</literal> for configuration extensions managed by
+      <citerefentry><refentrytitle>systemd-confext</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+      <literal>component</literal> for components accepted by the <option>--component=</option> option of
+      <citerefentry><refentrytitle>systemd-sysupdate</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+      and <literal>host</literal> for the host system itself. At most one target will have a class of
+      <literal>host</literal>.</para>
+
+      <para>The <varname>Path</varname> property exposes more detail about where this target was found.
+      For <literal>machine</literal>, <literal>portable</literal>, <literal>extension</literal>, and
+      <literal>confext</literal> targets, this is the file path to the image. For <literal>component</literal>
+      and <literal>host</literal> targets, this is the name of a
+      <citerefentry><refentrytitle>sysupdate.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      directory.</para>
+
+      <para>The <varname>Name</varname> property exposes the name of this target. Note that the name is
+      unique within a class but is not necessarily unique between classes. For instance, it is possible
+      to have both a <literal>portable</literal> target named <literal>foobar</literal> and an
+      <literal>extension</literal> target named <literal>foobar</literal>, but it is not possible to have
+      two <literal>portable</literal> targets named <literal>foobar</literal>.</para>
+
+    </refsect2>
+
+    <refsect2>
+      <title>Security</title>
+
+      <para>Method calls on this service are authenticated via
+      <ulink url="https://www.freedesktop.org/software/polkit/docs/latest/">polkit</ulink>.</para>
+
+      <para><function>List()</function>, <function>Describe()</function>, and <function>CheckNew()</function>
+      use the polkit action <interfacename>org.freedesktop.sysupdate1.check</interfacename>.
+      By default, this action is permitted without administrator authentication.</para>
+
+      <para><function>Update()</function> uses the polkit action
+      <interfacename>org.freedesktop.sysupdate1.update</interfacename> when no version is specified.
+      By default, this action is permitted without administrator authentication. When a version is
+      specified, <interfacename>org.freedesktop.sysupdate1.update-to-version</interfacename> is
+      used instead. By default, this alternate action requires administrator authentication.</para>
+
+      <para><function>Vacuum()</function> uses the polkit action
+      <interfacename>org.freedesktop.sysupdate1.vacuum</interfacename>. By default, this action requires
+      administrator authentication.</para>
+
+      <para><function>GetAppStream()</function> and <function>GetVersion()</function> are unauthenticated and
+      may be called by anybody.</para>
+
+      <para>All methods called on this interface expose additional variables to the polkit rules.
+      <literal>class</literal> contains the class of the Target being acted upon, and <literal>name</literal>
+      contains the name of the same Target. Additionally, each method exposes its arguments to the
+      rule. Flags are mapped as follows:</para>
+
+      <itemizedlist>
+        <listitem><para><constant>SD_SYSUPDATE_OFFLINE</constant> → <literal>update</literal></para></listitem>
+      </itemizedlist>
+
+    </refsect2>
+  </refsect1>
+
+  <refsect1>
+    <title>The Job Object</title>
+
+    <para>A job is an ongoing operation, started by one of the methods on a Target object.</para>
+
+    <para>The service exposes the following interfaces on Job objects on the bus:</para>
+
+    <programlisting executable="systemd-sysupdated" node="/org/freedesktop/sysupdate1/job/_1" interface="org.freedesktop.sysupdate1.Job">
+node /org/freedesktop/sysupdate1/job/_1 {
+  interface org.freedesktop.sysupdate1.Job {
+    methods:
+      Cancel();
+    properties:
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly t Id = ...;
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly s Type = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly b Offline = ...;
+      readonly u Progress = ...;
+  };
+  interface org.freedesktop.DBus.Peer { ... };
+  interface org.freedesktop.DBus.Introspectable { ... };
+  interface org.freedesktop.DBus.Properties { ... };
+};
+    </programlisting>
+
+
+    <!--Autogenerated cross-references for systemd.directives, do not edit-->
+
+
+    <variablelist class="dbus-interface" generated="True" extra-ref="org.freedesktop.sysupdate1.Job"/>
+
+
+    <variablelist class="dbus-interface" generated="True" extra-ref="org.freedesktop.sysupdate1.Job"/>
+
+
+    <variablelist class="dbus-method" generated="True" extra-ref="Cancel()"/>
+
+
+    <variablelist class="dbus-property" generated="True" extra-ref="Id"/>
+
+
+    <variablelist class="dbus-property" generated="True" extra-ref="Type"/>
+
+
+    <variablelist class="dbus-property" generated="True" extra-ref="Offline"/>
+
+
+    <variablelist class="dbus-property" generated="True" extra-ref="Progress"/>
+
+
+    <!--End of Autogenerated section-->
+
+
+    <refsect2>
+      <title>Methods</title>
+
+      <para>The <function>Cancel()</function> method may be used to cancel the job. It takes no
+      parameters.</para>
+    </refsect2>
+
+    <refsect2>
+      <title>Properties</title>
+
+      <para>The <varname>Id</varname> property exposes the numeric job ID of the job object.</para>
+
+      <para>The <varname>Type</varname> property exposes the type of operation (one of: <literal>list</literal>,
+      <literal>describe</literal>, <literal>check-new</literal>, <literal>update</literal>, or <literal>vacuum</literal>).
+      </para>
+
+      <para>The <varname>Offline</varname> property exposes whether the job is permitted to access
+      the network or not.</para>
+
+      <para>The <varname>Progress</varname> property exposes the current progress of the job as a value
+      between 0 and 100. It is only available for <literal>update</literal> jobs; for all other jobs
+      it is always 0.</para>
+    </refsect2>
+
+    <refsect2>
+      <title>Security</title>
+
+      <para><function>Cancel()</function> uses the polkit action that corresponds to the method
+      that started this job. For instance, trying to cancel a <literal>list</literal> job will
+      require polkit to permit the <interfacename>org.freedesktop.sysupdate1.check</interfacename>
+      action.</para>
+    </refsect2>
+  </refsect1>
+
+  <refsect1>
+    <title>Examples</title>
+
+    <example>
+      <title>Introspect <interfacename>org.freedesktop.sysupdate1.Manager</interfacename> on the bus</title>
+
+      <programlisting>$ gdbus introspect --system \
+  --dest org.freedesktop.sysupdate1 \
+  --object-path /org/freedesktop/sysupdate1
+      </programlisting>
+    </example>
+
+    <example>
+      <title>Introspect <interfacename>org.freedesktop.sysupdate1.Target</interfacename> on the bus</title>
+
+      <programlisting>$ gdbus introspect --system \
+  --dest org.freedesktop.sysupdate1 \
+  --object-path /org/freedesktop/sysupdate1/target/host
+      </programlisting>
+    </example>
+
+    <example>
+      <title>Introspect <interfacename>org.freedesktop.sysupdate1.Job</interfacename> on the bus</title>
+
+      <programlisting>$ gdbus introspect --system \
+  --dest org.freedesktop.sysupdate1 \
+  --object-path /org/freedesktop/sysupdate1/job/_1
+      </programlisting>
+    </example>
+  </refsect1>
+
+  <xi:include href="org.freedesktop.locale1.xml" xpointer="versioning"/>
+  <refsect1>
+    <title>History</title>
+    <refsect2>
+      <title>The Manager Object</title>
+      <para><function>ListTargets()</function>,
+      <function>ListJobs()</function>,
+      <function>ListAppStream()</function>, and
+      <function>JobRemoved()</function> were added in version 257.</para>
+    </refsect2>
+    <refsect2>
+      <title>The Target Object</title>
+      <para><function>List()</function>,
+      <function>Describe()</function>,
+      <function>CheckNew()</function>,
+      <function>Update()</function>,
+      <function>Vacuum()</function>,
+      <function>GetAppStream()</function>,
+      <function>GetVersion()</function>,
+      <varname>Class</varname>,
+      <varname>Name</varname>, and
+      <varname>Path</varname> were added in version 257.</para>
+    </refsect2>
+    <refsect2>
+      <title>The Job Object</title>
+      <para><function>Cancel()</function>,
+      <varname>Id</varname>,
+      <varname>Type</varname>,
+      <varname>Offline</varname>, and
+      <varname>Progress</varname> were added in version 257.</para>
+    </refsect2>
+  </refsect1>
+</refentry>

man/org.freedesktop.timesync1.xml

@@ -0,0 +1,156 @@
+<?xml version="1.0"?>
+<!--*-nxml-*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+<!ENTITY % entities SYSTEM "custom-entities.ent" >
+%entities;
+]>
+<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
+
+<refentry id="org.freedesktop.timesync1" conditional='ENABLE_TIMESYNCD'
+    xmlns:xi="http://www.w3.org/2001/XInclude">
+  <refentryinfo>
+    <title>org.freedesktop.timesync1</title>
+    <productname>systemd</productname>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>org.freedesktop.timesync1</refentrytitle>
+    <manvolnum>5</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>org.freedesktop.timesync1</refname>
+    <refpurpose>The D-Bus interface of systemd-timesyncd</refpurpose>
+  </refnamediv>
+
+  <refsect1>
+    <title>Introduction</title>
+
+    <para>
+    <citerefentry><refentrytitle>systemd-timesyncd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    is a system service that may be used to synchronize the local system clock with a remote Network Time
+    Protocol (NTP) server. This page describes the D-Bus interface.</para>
+  </refsect1>
+
+  <refsect1>
+    <title>The Manager Object</title>
+
+    <para>The service exposes the following interfaces on the Manager object on the bus:</para>
+
+    <programlisting executable="systemd-timesyncd" node="/org/freedesktop/timesync1" interface="org.freedesktop.timesync1.Manager">
+node /org/freedesktop/timesync1 {
+  interface org.freedesktop.timesync1.Manager {
+    methods:
+      SetRuntimeNTPServers(in  as runtime_servers);
+    properties:
+      readonly as LinkNTPServers = ['...', ...];
+      readonly as SystemNTPServers = ['...', ...];
+      readonly as RuntimeNTPServers = ['...', ...];
+      readonly as FallbackNTPServers = ['...', ...];
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("false")
+      readonly s ServerName = '...';
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("false")
+      readonly (iay) ServerAddress = ...;
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly t RootDistanceMaxUSec = ...;
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly t PollIntervalMinUSec = ...;
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
+      readonly t PollIntervalMaxUSec = ...;
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("false")
+      readonly t PollIntervalUSec = ...;
+      readonly (uuuuittayttttbtt) NTPMessage = ...;
+      @org.freedesktop.DBus.Property.EmitsChangedSignal("false")
+      readonly x Frequency = ...;
+  };
+  interface org.freedesktop.DBus.Peer { ... };
+  interface org.freedesktop.DBus.Introspectable { ... };
+  interface org.freedesktop.DBus.Properties { ... };
+};
+    </programlisting>
+
+    <!--method SetRuntimeNTPServers is not documented!-->
+
+    <!--property LinkNTPServers is not documented!-->
+
+    <!--property SystemNTPServers is not documented!-->
+
+    <!--property RuntimeNTPServers is not documented!-->
+
+    <!--property FallbackNTPServers is not documented!-->
+
+    <!--property ServerName is not documented!-->
+
+    <!--property ServerAddress is not documented!-->
+
+    <!--property RootDistanceMaxUSec is not documented!-->
+
+    <!--property PollIntervalMinUSec is not documented!-->
+
+    <!--property PollIntervalMaxUSec is not documented!-->
+
+    <!--property PollIntervalUSec is not documented!-->
+
+    <!--property NTPMessage is not documented!-->
+
+    <!--property Frequency is not documented!-->
+
+    <!--Autogenerated cross-references for systemd.directives, do not edit-->
+
+    <variablelist class="dbus-interface" generated="True" extra-ref="org.freedesktop.timesync1.Manager"/>
+
+    <variablelist class="dbus-interface" generated="True" extra-ref="org.freedesktop.timesync1.Manager"/>
+
+    <variablelist class="dbus-method" generated="True" extra-ref="SetRuntimeNTPServers()"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="LinkNTPServers"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="SystemNTPServers"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="RuntimeNTPServers"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="FallbackNTPServers"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="ServerName"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="ServerAddress"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="RootDistanceMaxUSec"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="PollIntervalMinUSec"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="PollIntervalMaxUSec"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="PollIntervalUSec"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="NTPMessage"/>
+
+    <variablelist class="dbus-property" generated="True" extra-ref="Frequency"/>
+
+    <!--End of Autogenerated section-->
+
+    <para>
+      Provides information about the manager.
+    </para>
+
+  </refsect1>
+
+  <refsect1>
+    <title>Examples</title>
+
+    <example>
+      <title>Introspect <interfacename>org.freedesktop.timesync1.Manager</interfacename> on the bus</title>
+
+      <programlisting>
+$ gdbus introspect --system \
+  --dest org.freedesktop.timesync1 \
+  --object-path /org/freedesktop/timesync1
+      </programlisting>
+    </example>
+
+  </refsect1>
+
+  <xi:include href="org.freedesktop.locale1.xml" xpointer="versioning"/>
+
+</refentry>

man/os-release.xml

@@ -325,6 +325,42 @@
 
           <xi:include href="version-info.xml" xpointer="v249"/></listitem>
         </varlistentry>
+
+        <varlistentry>
+          <term><varname>RELEASE_TYPE=</varname></term>
+
+          <listitem><para>A lower-case string (no spaces or other characters outside of 0-9, a-z, ".",
+          "_", and "-"), describing what kind of release this version of the OS is. Known values follow:
+          </para>
+
+          <itemizedlist>
+            <listitem><para><literal>stable</literal> is for normal releases of the system, suitable for
+            production use. Generally, stable releases become end-of-life soon after the next major stable
+            release is out, although this might not be the case if, for example, a distribution adopts a
+            rolling release model and still be production ready. Examples include Fedora 40, Ubuntu 23.10,
+            OpenSUSE Tumbleweed, and Arch Linux.</para></listitem>
+
+            <listitem><para><literal>lts</literal> is for long term support releases of the system, suitable
+            for production use and supported for an extended period of time. Generally, LTS releases
+            continue to receive support even if newer major releases of the distribution are available.
+            Examples include Ubuntu 24.04, Debian 12 Bookworm and RHEL 9.4.</para></listitem>
+
+            <listitem><para><literal>development</literal> is for unstable versions of the system,
+            unsuitable for production use, such as alpha, beta, or rolling unstable releases. Examples
+            include Fedora Rawhide, Debian Testing, Fedora 40 Beta, and GNOME OS Nightly.</para></listitem>
+
+            <listitem><para><literal>experiment</literal> is for experimental builds of the system, created
+            specifically to test some work-in-progress feature. This is meant to be used in combination with
+            <varname>EXPERIMENT=</varname>.</para></listitem>
+          </itemizedlist>
+
+          <para>If unset, or an unknown value, assume that the release is <literal>stable</literal>.</para>
+
+          <para>Examples: <literal>RELEASE_TYPE=development</literal>, <literal>RELEASE_TYPE=lts</literal>.
+          </para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+        </varlistentry>
       </variablelist>
 
       <para>To summarize: if the image updates are built and shipped as comprehensive units,
@@ -443,6 +479,47 @@
 
           <xi:include href="version-info.xml" xpointer="v254"/></listitem>
         </varlistentry>
+        <varlistentry>
+          <term><varname>EXPERIMENT=</varname></term>
+
+          <listitem><para>A human-presentable description of what makes this build of the OS experimental.
+          This field is optional. The <varname>RELEASE_TYPE</varname> field should be set to <literal>experiment</literal>
+          if this field is set, otherwise clients should ignore this field.</para>
+
+          <para>This description is intended to be exposed at system installation time, or in "About this system" UIs,
+          to warn the user that they're installing/running an experimental build of the OS. If <varname>RELEASE_TYPE</varname>
+          is <literal>experiment</literal> but this field is unset, the UI should still warn the user, but it
+          will be unable to explain what exactly is experimental about the current build of the OS.</para>
+
+          <para>Examples: <literal>EXPERIMENT="Switch to DNF5"</literal> for an experimental build of Fedora
+          Linux made to test DNF5, <literal>EXPERIMENT="Port to Apple M3 chip"</literal> for experimental
+          builds of Asahi Linux ported to the Apple M3 SoC,
+          <literal>EXPERIMENT="Mutter !1441: Dynamic triple/double buffering (v4)"</literal> for builds of GNOME
+          OS created by Mutter's CI for merge request !1441.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><varname>EXPERIMENT_URL=</varname></term>
+
+          <listitem><para>The main informational page about what makes the current OS build experimental, where users
+          can learn more about the experiment's status and potentially leave feedback. This field is optional. The
+          <varname>EXPERIMENT=</varname> field should be set if this one is, although clients must be robust against
+          either field not being set.</para>
+
+          <para>The value should be in <ulink
+          url="https://tools.ietf.org/html/rfc3986">RFC3986 format</ulink>, and should be
+          <literal>http:</literal> or <literal>https:</literal> URLs. Only one URL shall be listed in the
+          setting.</para>
+
+          <para>Examples, corresponding to the examples above in <varname>EXPERIMENT=</varname>:
+          <literal>EXPERIMENT_URL="https://fedoraproject.org/wiki/Changes/SwitchToDnf5"</literal>,
+          <literal>EXPERIMENT_URL="https://github.com/AsahiLinux/docs/wiki/M3-Series-Feature-Support"</literal>,
+          <literal>EXPERIMENT_URL="https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/1441"</literal>.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+        </varlistentry>
       </variablelist>
     </refsect2>
 

man/pam_systemd.xml

@@ -155,7 +155,8 @@
 
         <listitem><para>Takes a string argument which sets the session type. The <varname>XDG_SESSION_TYPE</varname>
         environment variable (see below) takes precedence. One of <literal>unspecified</literal>,
-        <literal>tty</literal>, <literal>x11</literal>, <literal>wayland</literal> or <literal>mir</literal>. See
+        <literal>tty</literal>, <literal>x11</literal>, <literal>wayland</literal>, <literal>mir</literal>, or
+        <literal>web</literal>. See
         <citerefentry><refentrytitle>sd_session_get_type</refentrytitle><manvolnum>3</manvolnum></citerefentry> for
         details about the session type.</para>
 
@@ -267,6 +268,21 @@
         <xi:include href="version-info.xml" xpointer="v245"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>$SHELL_PROMPT_PREFIX</varname></term>
+        <term><varname>$SHELL_PROMPT_SUFFIX</varname></term>
+        <term><varname>$SHELL_WELCOME</varname></term>
+
+        <listitem><para>These environment variables are initialized from the service credentials
+        <literal>shell.prompt.prefix</literal>, <literal>shell.prompt.suffix</literal> and
+        <literal>shell.welcome</literal> if set. They are passed to the invoked session processes, where they
+        are imported into any shell prompt (specifically <varname>$SHELL_PROMPT_PREFIX</varname> is added as
+        prefix to <varname>$PS1</varname>, and <varname>$SHELL_PROMPT_SUFFIX</varname> as suffix) or printed
+        on screen when a shell first initializes.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
     </variablelist>
 
     <para>The following environment variables are read by the module and may be used by the PAM service to pass

man/repart.d.xml

@@ -76,16 +76,7 @@
         <term><varname>Type=</varname></term>
 
         <listitem><para>The GPT partition type UUID to match. This may be a GPT partition type UUID such as
-        <constant>4f68bce3-e8cd-4db1-96e7-fbcaf984b709</constant>, or an identifier.
+        <constant>4f68bce3-e8cd-4db1-96e7-fbcaf984b709</constant>, or an identifier.</para>
-        Architecture specific partition types can use one of these architecture identifiers:
-        <constant>alpha</constant>, <constant>arc</constant>, <constant>arm</constant> (32-bit),
-        <constant>arm64</constant> (64-bit, aka aarch64), <constant>ia64</constant>,
-        <constant>loongarch64</constant>, <constant>mips-le</constant>, <constant>mips64-le</constant>,
-        <constant>parisc</constant>, <constant>ppc</constant>, <constant>ppc64</constant>,
-        <constant>ppc64-le</constant>, <constant>riscv32</constant>, <constant>riscv64</constant>,
-        <constant>s390</constant>, <constant>s390x</constant>, <constant>tilegx</constant>,
-        <constant>x86</constant> (32-bit, aka i386) and <constant>x86-64</constant> (64-bit, aka amd64).
-        </para>
 
         <para>The supported identifiers are:</para>
 
@@ -237,7 +228,14 @@
           </tgroup>
         </table>
 
-        <para>This setting defaults to <constant>linux-generic</constant>.</para>
+        <para>Architecture specific partition types can use one of these architecture identifiers:
+        <constant>alpha</constant>, <constant>arc</constant>, <constant>arm</constant> (32-bit),
+        <constant>arm64</constant> (64-bit, aka aarch64), <constant>ia64</constant>,
+        <constant>loongarch64</constant>, <constant>mips-le</constant>, <constant>mips64-le</constant>,
+        <constant>parisc</constant>, <constant>ppc</constant>, <constant>ppc64</constant>,
+        <constant>ppc64-le</constant>, <constant>riscv32</constant>, <constant>riscv64</constant>,
+        <constant>s390</constant>, <constant>s390x</constant>, <constant>tilegx</constant>,
+        <constant>x86</constant> (32-bit, aka i386) and <constant>x86-64</constant> (64-bit, aka amd64).</para>
 
         <para>Most of the partition type UUIDs listed above are defined in the <ulink
         url="https://uapi-group.org/specifications/specs/discoverable_partitions_specification">Discoverable Partitions
@@ -485,18 +483,18 @@
         <term><varname>ExcludeFiles=</varname></term>
         <term><varname>ExcludeFilesTarget=</varname></term>
 
-        <listitem><para>Takes an absolute file system path referring to a source file or directory on the
+        <listitem><para>Takes one or more absolute paths, separated by whitespace, each referring to a
-        host. This setting may be used to exclude files or directories from the host from being copied into
+        source file or directory on the host. This setting may be used to exclude files or directories from
-        the file system when <varname>CopyFiles=</varname> is used. This option may be used multiple times to
+        the host from being copied into the file system when <varname>CopyFiles=</varname> is used. This
-        exclude multiple files or directories from host from being copied into the newly formatted file
+        option may be used multiple times to exclude multiple files or directories from host from being
-        system.</para>
+        copied into the newly formatted file system.</para>
 
         <para>If the path is a directory and ends with <literal>/</literal>, only the directory's
         contents are excluded but not the directory itself. If the path is a directory and does not end with
         <literal>/</literal>, both the directory and its contents are excluded.</para>
 
         <para><varname>ExcludeFilesTarget=</varname> is like <varname>ExcludeFiles=</varname> except that
-        instead of excluding the path on the host from being copied into the partition, we exclude any files
+        instead of excluding the path on the host from being copied into the partition, it exclude any files
         and directories from being copied into the given path in the partition.</para>
 
         <para>When
@@ -537,19 +535,65 @@
         <xi:include href="version-info.xml" xpointer="v249"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>MakeSymlinks=</varname></term>
+
+        <listitem><para>Takes one or more arguments, separated by whitespace, each declaring a symlink to
+        create within the new file system. Each argument is a pair of symlink source and target paths,
+        separated by a colon. This option may be used more than once to create multiple symlinks. When
+        <varname>CopyFiles=</varname> and <varname>MakeSymlinks=</varname> are used together the former is
+        applied first.</para>
+
+        <para>The primary use case for this option is to create symlinks that need to exist before
+        <citerefentry><refentrytitle>systemd-tmpfiles</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+        is executed. For example, when using
+        <citerefentry><refentrytitle>systemd-confext</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+        this setting can be used to create symlinks in <filename>/var/lib/extensions.mutable</filename> to
+        redirect writes to mutable confexts to a custom location.</para>
+
+        <para>Consider using
+        <citerefentry><refentrytitle>systemd-tmpfiles</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+        with its <option>--image=</option> option to pre-create other symlinks (as well as other inodes) with
+        fine-grained control of ownership, access modes and other file attributes.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>Subvolumes=</varname></term>
 
         <listitem><para>Takes one or more absolute paths, separated by whitespace, each declaring a directory
-        that should be a subvolume within the new file system. This option may be used more than once to
+        that should be a subvolume within the new file system. Each path may optionally be followed by a
-        specify multiple directories. Note that this setting does not create the directories themselves, that
+        colon and a list of comma-separated subvolume flags. The following flags are understood:</para>
-        can be configured with <varname>MakeDirectories=</varname> and <varname>CopyFiles=</varname>.</para>
+
+        <table class='flags'>
+          <title>Subvolume Flags</title>
+          <tgroup cols='2' align='left' colsep='1' rowsep='1'>
+            <colspec colname="spec" />
+            <colspec colname="purpose" />
+            <thead>
+              <row>
+                <entry>Flag</entry>
+                <entry>Purpose</entry>
+              </row>
+            </thead>
+            <tbody>
+              <row id='R'>
+                <entry><literal>ro</literal></entry>
+                <entry>Make this subvolume read-only.</entry>
+              </row>
+            </tbody>
+          </tgroup>
+        </table>
+
+        <para>Note that this option does not create the directories themselves, that can be configured with
+        <varname>MakeDirectories=</varname> and <varname>CopyFiles=</varname>.</para>
 
         <para>Note that this option only takes effect if the target filesystem supports subvolumes, such as
         <literal>btrfs</literal>.</para>
 
-        <para>Note that due to limitations of <literal>mkfs.btrfs</literal>, this option is only supported
+        <para>Note that this option is only supported in combination with <option>--offline=yes</option>
-        when running with <option>--offline=no</option>.</para>
+        since btrfs-progs 6.11 or newer.</para>
 
         <xi:include href="version-info.xml" xpointer="v255"/></listitem>
       </varlistentry>
@@ -564,8 +608,8 @@
         <para>Note that this option only takes effect if the target filesystem supports subvolumes, such as
         <literal>btrfs</literal>.</para>
 
-        <para>Note that due to limitations of <literal>mkfs.btrfs</literal>, this option is only supported
+        <para>Note that this option is only supported in combination with <option>--offline=yes</option>
-        when running with <option>--offline=no</option>.</para>
+        since btrfs-progs 6.11 or newer.</para>
 
         <xi:include href="version-info.xml" xpointer="v256"/></listitem>
       </varlistentry>
@@ -710,7 +754,7 @@
         <citerefentry
         project='man-pages'><refentrytitle>fstab</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
 
-        <para>If both bit 50 and 59 are set for a partition (i.e. the partition is marked both read-only and
+        <para>If both bit 60 and 59 are set for a partition (i.e. the partition is marked both read-only and
         marked for file system growing) the latter is typically without effect: the read-only flag takes
         precedence in most tools reading these flags, and since growing the file system involves writing to
         the partition it is consequently ignored.</para>
@@ -789,6 +833,121 @@
 
         <xi:include href="version-info.xml" xpointer="v256"/></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><varname>Compression=</varname></term>
+
+        <listitem><para>Specify the compression algorithm to use for the filesystem configured with
+        <varname>Format=</varname>. Takes a single argument specifying the compression algorithm.</para>
+
+        <para>Note that this setting is only taken into account when the filesystem configured with
+        <varname>Format=</varname> supports compression (btrfs, squashfs, erofs). Here's an incomplete list
+        of compression algorithms supported by the filesystems known to
+        <command>systemd-repart</command>:</para>
+
+        <table>
+          <title>File System Compression Algorithms</title>
+
+          <tgroup cols='3' align='left' colsep='1' rowsep='1'>
+            <colspec colname="filesystem" />
+            <colspec colname="algorithms" />
+            <colspec colname="manpage" />
+
+            <thead>
+              <row>
+                <entry>File System</entry>
+                <entry>Compression Algorithms</entry>
+                <entry>Documentation</entry>
+              </row>
+            </thead>
+
+            <tbody>
+              <row>
+                <entry><constant>squashfs</constant></entry>
+                <entry>gzip, lzo, lz4, xz, zstd, lzma</entry>
+                <entry><member><citerefentry project='man-pages'><refentrytitle>mksquashfs</refentrytitle><manvolnum>1</manvolnum></citerefentry></member></entry>
+              </row>
+
+              <row>
+                <entry><constant>erofs</constant></entry>
+                <entry>lz4, lz4hc, lzma, deflate, libdeflate, zstd</entry>
+                <entry><member><citerefentry project='man-pages'><refentrytitle>mkfs.erofs</refentrytitle><manvolnum>1</manvolnum></citerefentry></member></entry>
+              </row>
+            </tbody>
+          </tgroup>
+        </table>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>CompressionLevel=</varname></term>
+
+        <listitem><para>Specify the compression level to use for the filesystem configured with
+        <varname>Format=</varname>. Takes a single argument specifying the compression level to use for the
+        configured compression algorithm. The possible compression levels and their meaning are filesystem
+        specific (refer to the filesystem's documentation for the exact meaning of a particular compression
+        level).</para>
+
+        <para>Note that this setting is only taken into account when the filesystem configured with
+        <varname>Format=</varname> supports compression and the <varname>Compression=</varname> setting is
+        configured explicitly.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>SupplementFor=</varname></term>
+
+        <listitem><para>Takes a partition definition name, such as <literal>10-esp</literal>. If specified,
+        <command>systemd-repart</command> will avoid creating this partition and instead prefer to partially
+        merge the two definitions. However, depending on the existing layout of partitions on disk,
+        <command>systemd-repart</command> may be forced to fall back onto un-merging the definitions and
+        using them as originally written, potentially creating this partition. Specifically,
+        <command>systemd-repart</command> will fall back if this partition is found to already exist on disk,
+        or if the target partition already exists on disk but is too small, or if it cannot allocate space
+        for the merged partition for some other reason.</para>
+
+        <para>The following fields are merged into the target definition in the specified ways:
+        <varname>Weight=</varname> and <varname>PaddingWeight=</varname> are simply overwritten;
+        <varname>SizeMinBytes=</varname> and <varname>PaddingMinBytes=</varname> use the larger of the two
+        values; <varname>SizeMaxBytes=</varname> and <varname>PaddingMaxBytes=</varname> use the smaller
+        value; and <varname>CopyFiles=</varname>, <varname>ExcludeFiles=</varname>,
+        <varname>ExcludeFilesTarget=</varname>, <varname>MakeDirectories=</varname>, and
+        <varname>Subvolumes=</varname> are concatenated.</para>
+
+        <para>Usage of this option in combination with <varname>CopyBlocks=</varname>,
+        <varname>Encrypt=</varname>, or <varname>Verity=</varname> is not supported. The target definition
+        cannot set these settings either. A definition cannot simultaneously be a supplement and act as a
+        target for some other supplement definition. A target cannot have more than one supplement partition
+        associated with it.</para>
+
+        <para>For example, distributions can use this to implement <varname>$BOOT</varname> as defined in
+        the <ulink url="https://uapi-group.org/specifications/specs/boot_loader_specification/">Boot Loader
+        Specification</ulink>. Distributions may prefer to use the ESP as <varname>$BOOT</varname> whenever
+        possible, but to adhere to the spec XBOOTLDR must sometimes be used instead. So, they should create
+        two definitions: the first defining an ESP big enough to hold just the bootloader, and a second for
+        the XBOOTLDR that's sufficiently large to hold kernels and configured as a supplement for the ESP.
+        Whenever possible, <command>systemd-repart</command> will try to merge the two definitions to create
+        one large ESP, but if that's not allowable due to the existing conditions on disk a small ESP and a
+        large XBOOTLDR will be created instead.</para>
+
+        <para>As another example, distributions can also use this to seamlessly share a single
+        <filename>/home</filename> partition in a multi-boot scenario, while preferring to keep
+        <filename>/home</filename> on the root partition by default. Having a <filename>/home</filename>
+        partition separated from the root partition entails some extra complexity: someone has to decide how
+        to split the space between the two partitions. On the other hand, it allows a user to share their
+        home area between multiple installed OSs (i.e. via <citerefentry><refentrytitle>systemd-homed.service
+        </refentrytitle><manvolnum>8</manvolnum></citerefentry>). Distributions should create two definitions:
+        the first for a root partition that takes up some relatively small percentage of the disk, and the
+        second as a supplement for the first to create a <filename>/home</filename> partition that takes up
+        all the remaining free space. On first boot, if <command>systemd-repart</command> finds an existing
+        <filename>/home</filename> partition on disk, it'll un-merge the definitions and create just a small
+        root partition. Otherwise, the definitions will be merged and a single large root partition will be
+        created.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 

man/resolvectl.xml

@@ -495,6 +495,7 @@
         <xi:include href="version-info.xml" xpointer="v256"/></listitem>
       </varlistentry>
 
+      <xi:include href="standard-options.xml" xpointer="no-ask-password" />
       <xi:include href="standard-options.xml" xpointer="json" />
       <xi:include href="standard-options.xml" xpointer="j" />
       <xi:include href="standard-options.xml" xpointer="no-pager" />
@@ -569,10 +570,19 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>-m</option></term>
         <term><option>-p</option></term>
 
-        <listitem><para>These switches are not supported and are silently ignored.</para>
+        <listitem><para>When specified, the interface will not be used as the default route. See also
+        <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+        about the default route.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>-m</option></term>
+
+        <listitem><para>The switch is not supported and is silently ignored.</para>
 
         <xi:include href="version-info.xml" xpointer="v239"/></listitem>
       </varlistentry>

man/rules/meson.build

@@ -65,7 +65,9 @@ manpages = [
  ['org.freedesktop.portable1', '5', [], 'ENABLE_PORTABLED'],
  ['org.freedesktop.resolve1', '5', [], 'ENABLE_RESOLVE'],
  ['org.freedesktop.systemd1', '5', [], ''],
+ ['org.freedesktop.sysupdate1', '5', [], 'ENABLE_SYSUPDATE'],
  ['org.freedesktop.timedate1', '5', [], 'ENABLE_TIMEDATED'],
+ ['org.freedesktop.timesync1', '5', [], 'ENABLE_TIMESYNCD'],
  ['os-release', '5', ['extension-release', 'initrd-release'], ''],
  ['pam_systemd', '8', [], 'HAVE_PAM'],
  ['pam_systemd_home', '8', [], 'ENABLE_PAM_HOME'],
@@ -523,12 +525,14 @@ manpages = [
  ['sd_bus_wait', '3', [], ''],
  ['sd_device_get_syspath',
   '3',
-  ['sd_device_get_devname',
+  ['sd_device_get_device_id',
+   'sd_device_get_devname',
    'sd_device_get_devnum',
    'sd_device_get_devpath',
    'sd_device_get_devtype',
    'sd_device_get_diskseq',
    'sd_device_get_driver',
+   'sd_device_get_driver_subsystem',
    'sd_device_get_ifindex',
    'sd_device_get_subsystem',
    'sd_device_get_sysname',
@@ -1100,6 +1104,10 @@ manpages = [
    'systemd-sysupdate.service',
    'systemd-sysupdate.timer'],
   'ENABLE_SYSUPDATE'],
+ ['systemd-sysupdated.service',
+  '8',
+  ['systemd-sysupdated'],
+  'ENABLE_SYSUPDATE'],
  ['systemd-sysusers', '8', ['systemd-sysusers.service'], ''],
  ['systemd-sysv-generator', '8', [], 'HAVE_SYSV_COMPAT'],
  ['systemd-time-wait-sync.service',
@@ -1277,6 +1285,7 @@ manpages = [
  ['udev_new', '3', ['udev_ref', 'udev_unref'], ''],
  ['udevadm', '8', [], ''],
  ['ukify', '1', [], 'ENABLE_UKIFY'],
+ ['updatectl', '1', [], 'ENABLE_SYSUPDATE'],
  ['user@.service',
   '5',
   ['systemd-user-runtime-dir', 'user-runtime-dir@.service'],

man/run0.xml

@@ -70,14 +70,6 @@
     <para>The following options are understood:</para>
 
     <variablelist>
-      <varlistentry>
-        <term><option>--no-ask-password</option></term>
-
-        <listitem><para>Do not query the user for authentication for privileged operations.</para>
-
-        <xi:include href="version-info.xml" xpointer="v256"/></listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><option>--unit=</option></term>
 
@@ -210,6 +202,7 @@
         </listitem>
       </varlistentry>
 
+      <xi:include href="standard-options.xml" xpointer="no-ask-password" />
       <xi:include href="standard-options.xml" xpointer="help" />
       <xi:include href="standard-options.xml" xpointer="version" />
     </variablelist>

man/sd_bus_message_read_strv.xml

@@ -49,7 +49,9 @@
     signatures (D-Bus type <literal>ag</literal>). On success, a pointer to a
     <constant>NULL</constant>-terminated array of strings (strv) is returned in the output parameter
     <parameter>l</parameter>. Note that ownership of this array is transferred to the caller. Hence, the
-    caller is responsible for freeing this array and its contents.</para>
+    caller is responsible for freeing this array and its contents. Also note that as a matter of
+    optimization, if an empty array is encountered a <constant>NULL</constant> pointer might be returned
+    here, and should be considered equivalent to an array with zero entries.</para>
 
     <para><function>sd_bus_message_read_strv_extend()</function> is similar, but the second parameter is an
     input-output parameter. If <parameter>*l</parameter> is <constant>NULL</constant>, if behaves identically

man/sd_bus_process.xml

@@ -52,12 +52,24 @@
     <citerefentry><refentrytitle>sd_bus_get_fd</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
     </para>
 
-    <para><function>sd_bus_process()</function> processes at most one incoming message per call.  If the parameter
+    <para><function>sd_bus_process()</function> processes at most one incoming message per call.  If the
-    <parameter>ret</parameter> is not <constant>NULL</constant> and the call processed a message,
+    parameter <parameter>ret</parameter> is not <constant>NULL</constant> and the call processed a message,
-    <parameter>*ret</parameter> is set to this message.  The caller owns a reference to this message and should call
+    <parameter>*ret</parameter> is set to this message. The caller owns a reference to this message and
-    <citerefentry><refentrytitle>sd_bus_message_unref</refentrytitle><manvolnum>3</manvolnum></citerefentry> when the
+    should call
-    message is no longer needed. If <parameter>ret</parameter> is not <constant>NULL</constant>, progress was made, but no message was
+    <citerefentry><refentrytitle>sd_bus_message_unref</refentrytitle><manvolnum>3</manvolnum></citerefentry>
-    processed, <parameter>*ret</parameter> is set to <constant>NULL</constant>.</para>
+    when the message is no longer needed. If <parameter>ret</parameter> is not <constant>NULL</constant> and
+    progress was made, but no message was processed, <parameter>*ret</parameter> is set to
+    <constant>NULL</constant>. Note that only messages not already handled by the various types of registered
+    message handlers (i.e. by filters registered via
+    <citerefentry><refentrytitle>sd_bus_add_filter</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+    object handlers registered via
+    <citerefentry><refentrytitle>sd_bus_add_object</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+    matches registered via
+    <citerefentry><refentrytitle>sd_bus_add_match</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+    and related) will be returned through this parameter. Also note that if such a message handler returns a
+    zero return value (as opposed to some value &gt; 0) an incoming message will not be considered handled,
+    and be passed to other suitable handlers (until one returns &gt; > 0), or returned by
+    <function>sd_bus_process()</function> (in case none returns &gt; 0).</para>
 
     <para>If the bus object is connected to an
     <citerefentry><refentrytitle>sd-event</refentrytitle><manvolnum>3</manvolnum></citerefentry> event loop (with

man/sd_device_get_syspath.xml

@@ -22,12 +22,14 @@
     <refname>sd_device_get_sysname</refname>
     <refname>sd_device_get_sysnum</refname>
     <refname>sd_device_get_subsystem</refname>
+    <refname>sd_device_get_driver_subsystem</refname>
     <refname>sd_device_get_devtype</refname>
     <refname>sd_device_get_devname</refname>
     <refname>sd_device_get_devnum</refname>
     <refname>sd_device_get_ifindex</refname>
     <refname>sd_device_get_driver</refname>
     <refname>sd_device_get_diskseq</refname>
+    <refname>sd_device_get_device_id</refname>
 
     <refpurpose>Returns various fields of device objects</refpurpose>
   </refnamediv>
@@ -66,6 +68,12 @@
         <paramdef>const char **<parameter>ret</parameter></paramdef>
       </funcprototype>
 
+      <funcprototype>
+        <funcdef>int <function>sd_device_get_driver_subsystem</function></funcdef>
+        <paramdef>sd_device *<parameter>device</parameter></paramdef>
+        <paramdef>const char **<parameter>ret</parameter></paramdef>
+      </funcprototype>
+
       <funcprototype>
         <funcdef>int <function>sd_device_get_devtype</function></funcdef>
         <paramdef>sd_device *<parameter>device</parameter></paramdef>
@@ -102,6 +110,12 @@
         <paramdef>uint64_t *<parameter>ret</parameter></paramdef>
       </funcprototype>
 
+      <funcprototype>
+        <funcdef>int <function>sd_device_get_device_id</function></funcdef>
+        <paramdef>sd_device *<parameter>device</parameter></paramdef>
+        <paramdef>uint64_t *<parameter>ret</parameter></paramdef>
+      </funcprototype>
+
     </funcsynopsis>
   </refsynopsisdiv>
 
@@ -126,6 +140,13 @@
     record. This is a short string fitting into a filename, and thus does not contain a slash and cannot be
     empty. Example: <literal>tty</literal>, <literal>block</literal> or <literal>net</literal>.</para>
 
+    <para><function>sd_device_get_driver_subsystem()</function> returns the connected bus type of the devices
+    loaded by the specified driver device record. For example, when <literal>iwlwifi</literal> driver device
+    is specified, which is used by the wireless network interfaces connected to PCI bus, this function returns
+    <literal>pci</literal>. This function only succeeds when <function>sd_device_get_subsystem()</function>
+    returns <literal>drivers</literal>. Example: <literal>pci</literal>, <literal>i2c</literal>, or
+    <literal>hid</literal>.</para>
+
     <para><function>sd_device_get_devtype()</function> returns the device type of the specified device
     record, if the subsystem manages multiple types of devices. Example: for devices of the
     <literal>block</literal> subsystem this can be <literal>disk</literal> or <literal>partition</literal>
@@ -157,6 +178,22 @@
     the device name changing, and is relevant for block devices encapsulating devices with changing media
     (e.g. floppy or CD-ROM), or loopback block devices. Only defined for block devices, i.e. those of
     subsystem <literal>block</literal>.</para>
+
+    <para><function>sd_device_get_device_id()</function> returns the short string that identifies the device
+    record. When the device ID obtained by the function for a specified device record is passed to
+    <function>sd_device_new_from_device_id()</function>, a new instance of the same device record will be
+    gained. When a block or character device is specified, which has corresponding device node, this returns
+    <literal>b</literal> or <literal>c</literal>, respectively, followed by the device node major and minor
+    numbers separated with a colon. Example: <literal>b259:1</literal> or <literal>c10:121</literal>. When a
+    network interface device is specified, this returns <literal>n</literal> followed by the interface index,
+    which can be obtained by <function>sd_device_get_ifindex()</function>. Example: <literal>n1</literal>.
+    When a device in the <literal>driver</literal> subsystem is specified, this returns
+    <literal>+drivers:</literal> followed by its driver subsystem and sysfs name separated with a colon.
+    Example: <literal>+drivers:pci:iwlwifi</literal> for a driver device record whose driver subsystem is
+    <literal>pci</literal> and sysfs name is <literal>iwlwifi</literal>,
+    When an other type of device is specified, this function returns <literal>+</literal> followed by its
+    subsystem and sysfs name separated with a colon. Example: <literal>+acpi:ACPI0003:00</literal>,
+    <literal>+input:input16</literal>, or <literal>+pci:0000:00:1f.6</literal>.</para>
   </refsect1>
 
   <refsect1>
@@ -206,6 +243,8 @@
     <function>sd_device_get_ifindex()</function>,
     <function>sd_device_get_driver()</function>, and
     <function>sd_device_get_diskseq()</function> were added in version 251.</para>
+    <para><function>sd_device_get_driver_subsystem()</function> and
+    <function>sd_device_get_device_id()</function> were added in version 257.</para>
   </refsect1>
 
   <refsect1>

man/systemctl.xml

@@ -291,7 +291,8 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
             <literal>inactive</literal> or <literal>maintenance</literal> is a white circle ("○"),
             <literal>active</literal> is a green dot ("●"), <literal>deactivating</literal> is a white dot,
             <literal>failed</literal> or <literal>error</literal> is a red cross ("×"), and
-            <literal>reloading</literal> is a green clockwise circle arrow ("↻").</para>
+            <literal>reloading</literal> or <literal>refreshing</literal> is a green clockwise circle arrow
+            ("↻").</para>
 
             <para>The "Loaded:" line in the output will show <literal>loaded</literal> if the unit has been
             loaded into memory. Other possible values for "Loaded:" include: <literal>error</literal> if
@@ -973,6 +974,11 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
             enabled with to the defaults configured in its [Install] section. This command expects
             a unit name only, it does not accept paths to unit files.</para>
 
+            <para>This command implicitly reloads the system manager configuration after completing the operation.
+            Note that this command does not implicitly restart the units that are being disabled. If this is
+            desired, either combine this command with the <option>--now</option> switch, or invoke
+            the <command>try-restart</command> command with appropriate arguments later.</para>
+
             <xi:include href="version-info.xml" xpointer="v238"/>
           </listitem>
         </varlistentry>
@@ -2283,17 +2289,15 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
         <listitem>
           <para>When system shutdown or sleep state is requested, this option controls checking of inhibitor
           locks. It takes one of <literal>auto</literal>, <literal>yes</literal> or
-          <literal>no</literal>. Defaults to <literal>auto</literal>, which will behave like
+          <literal>no</literal>. Defaults to <literal>auto</literal>, which means logind will perform the
-          <literal>yes</literal> for interactive invocations (i.e. from a TTY) and <literal>no</literal> for
+          check and respect active inhibitor locks, but systemctl will only do a client-side check for
-          non-interactive invocations. <literal>yes</literal> lets the request respect inhibitor locks.
+          interactive invocations (i.e. from a TTY), so that a more friendly and informative error can be
-          <literal>no</literal> lets the request ignore inhibitor locks.</para>
+          returned to users. <literal>no</literal> disables both the systemctl and logind checks.</para>
 
           <para>Applications can establish inhibitor locks to prevent certain important operations (such as
           CD burning) from being interrupted by system shutdown or sleep. Any user may take these locks and
           privileged users may override these locks. If any locks are taken, shutdown and sleep state
-          requests will normally fail (unless privileged). However, if <literal>no</literal> is specified or
+          requests will normally fail (unless explicitly overridden with <literal>no</literal>).</para>
-          <literal>auto</literal> is specified on a non-interactive requests, the operation will be
-          attempted. If locks are present, the operation may require additional privileges.</para>
 
           <para>Option <option>--force</option> provides another way to override inhibitors.</para>
 
@@ -2440,29 +2444,9 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
         <term><option>--no-reload</option></term>
 
         <listitem>
-          <para>When used with <command>enable</command> and
+          <para>When used with <command>enable</command>, <command>disable</command>, <command>preset</command>,
-          <command>disable</command>, do not implicitly reload daemon
+          <command>mask</command>, or <command>unmask</command>, do not implicitly reload daemon configuration
-          configuration after executing the changes.</para>
+          after executing the changes.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>--no-ask-password</option></term>
-
-        <listitem>
-          <para>When used with <command>start</command> and related
-          commands, disables asking for passwords. Background services
-          may require input of a password or passphrase string, for
-          example to unlock system hard disks or cryptographic
-          certificates. Unless this option is specified and the
-          command is invoked from a terminal,
-          <command>systemctl</command> will query the user on the
-          terminal for the necessary secrets. Use this option to
-          switch this behavior off. In this case, the password must be
-          supplied by some other means (for example graphical password
-          agents) or the service might fail. This also disables
-          querying the user for authentication for privileged
-          operations.</para>
         </listitem>
       </varlistentry>
 
@@ -2583,11 +2567,9 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
         <term><option>--now</option></term>
 
         <listitem>
-          <para>When used with <command>enable</command>, the units
+          <para>When used with <command>enable</command>, <command>disable</command>, <command>mask</command>,
-          will also be started. When used with <command>disable</command> or
+          or <command>reenable</command>, also start/stop/try-restart the units after the specified
-          <command>mask</command>, the units will also be stopped. The start
+          unit file operations succeed.</para>
-          or stop operation is only carried out when the respective enable or
-          disable operation has been successful.</para>
 
           <xi:include href="version-info.xml" xpointer="v220"/>
         </listitem>
@@ -2895,6 +2877,7 @@ EOF
       <xi:include href="user-system-options.xml" xpointer="machine" />
       <xi:include href="user-system-options.xml" xpointer="capsule" />
 
+      <xi:include href="standard-options.xml" xpointer="no-ask-password" />
       <xi:include href="standard-options.xml" xpointer="no-pager" />
       <xi:include href="standard-options.xml" xpointer="legend" />
       <xi:include href="standard-options.xml" xpointer="help" />

man/systemd-analyze.xml

@@ -80,7 +80,16 @@
       <command>systemd-analyze</command>
       <arg choice="opt" rep="repeat">OPTIONS</arg>
       <arg choice="plain">capability</arg>
-      <arg choice="opt" rep="repeat"><replaceable>CAPABILITY</replaceable></arg>
+      <group choice="opt">
+        <arg choice="plain" rep="repeat"><replaceable>CAPABILITY</replaceable></arg>
+        <arg choice="plain">
+          <group choice="req">
+            <arg choice="plain">-m</arg>
+            <arg choice="plain">--mask</arg>
+          </group>
+          <replaceable>MASK</replaceable>
+        </arg>
+      </group>
     </cmdsynopsis>
     <cmdsynopsis>
       <command>systemd-analyze</command>
@@ -168,6 +177,11 @@
       <arg choice="plain">image-policy</arg>
       <arg choice="plain" rep="repeat"><replaceable>POLICY</replaceable></arg>
     </cmdsynopsis>
+    <cmdsynopsis>
+      <command>systemd-analyze</command>
+      <arg choice="opt" rep="repeat">OPTIONS</arg>
+      <arg choice="plain">has-tpm2</arg>
+    </cmdsynopsis>
     <cmdsynopsis>
       <command>systemd-analyze</command>
       <arg choice="opt" rep="repeat">OPTIONS</arg>
@@ -441,7 +455,20 @@ DATAERR 65     BSD
     </refsect2>
 
     <refsect2>
-      <title><command>systemd-analyze capability <optional><replaceable>CAPABILITY</replaceable>...</optional></command></title>
+      <title>
+        <command>systemd-analyze capability
+          <group choice="opt">
+            <arg choice="plain" rep="repeat"><replaceable>CAPABILITY</replaceable></arg>
+            <arg choice="plain">
+              <group choice="req">
+                <arg choice="plain">-m</arg>
+                <arg choice="plain">--mask</arg>
+              </group>
+              <replaceable>MASK</replaceable>
+            </arg>
+          </group>
+        </command>
+      </title>
 
       <para>This command prints a list of Linux capabilities along with their numeric IDs. See <citerefentry
       project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
@@ -451,6 +478,11 @@ DATAERR 65     BSD
       cabilities by name or numeric ID, in which case only the indicated capabilities are shown in the
       table.</para>
 
+      <para>Alternatively, if <option>--mask</option> is passed, a single numeric argument must be specified,
+      which is interpreted as a hexadecimal capability mask. In this case, only the capabilities present in
+      the mask are shown in the table. This mode is intended to aid in decoding capability sets available
+      via various debugging interfaces (e.g. <literal>/proc/PID/status</literal>).</para>
+
       <example>
         <title><command>Show some example capability names</command></title>
 
@@ -462,6 +494,18 @@ cap_audit_control     30
 cap_setfcap           31
 cap_mac_override      32</programlisting>
       </example>
+
+      <example>
+        <title><command>Decode a capability mask extracted from /proc</command></title>
+
+        <programlisting>$ systemd-analyze capability -m 0000000000003c00
+NAME                 NUMBER
+cap_net_bind_service     10
+cap_net_broadcast        11
+cap_net_admin            12
+cap_net_raw              13
+</programlisting>
+      </example>
     </refsect2>
 
     <refsect2>
@@ -687,7 +731,9 @@ $ systemd-analyze compare-versions 1 ge 2; echo $?
       augment the compiled in set of unit load paths; see
       <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>. All
       units files present in the directories containing the command line arguments will be used in preference
-      to the other paths.</para>
+      to the other paths. If a template unit without an instance name is specified (e.g.
+      <filename>foo@.service</filename>), <literal>test_instance</literal> will be used as the instance
+      name, which can be controlled by <option>--instance=</option> option.</para>
 
       <para>The following errors are currently detected:</para>
       <itemizedlist>
@@ -907,6 +953,35 @@ default         ignore      -         -</programlisting>
       </example>
     </refsect2>
 
+    <refsect2>
+      <title><command>systemd-analyze has-tpm2</command></title>
+
+      <para>Reports whether the system is equipped with a usable TPM2 device. If a TPM2 device has been
+      discovered, is supported, and is being used by firmware, by the OS kernel drivers and by userspace
+      (i.e. systemd) this prints <literal>yes</literal> and exits with exit status zero. If no such device is
+      discovered/supported/used, prints <literal>no</literal>. Otherwise prints
+      <literal>partial</literal>. In either of these two cases exits with non-zero exit status. It also shows
+      five lines indicating separately whether firmware, drivers, the system, the kernel and libraries
+      discovered/support/use TPM2.</para>
+
+      <para>Note, this checks for TPM 2.0 devices only, and does not consider TPM 1.2 at all.</para>
+
+      <para>Combine with <option>--quiet</option> to suppress the output.</para>
+
+      <example>
+        <title>Example Output</title>
+
+        <programlisting>yes
++firmware
++driver
++system
++subsystem
++libraries</programlisting>
+      </example>
+
+      <xi:include href="version-info.xml" xpointer="v257"/>
+    </refsect2>
+
     <refsect2>
       <title><command>systemd-analyze pcrs <optional><replaceable>PCR</replaceable>…</optional></command></title>
 
@@ -1115,6 +1190,20 @@ io.systemd.credential:vmm.notify_socket=vsock-stream:2:254570042
         <xi:include href="version-info.xml" xpointer="v235"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--instance=NAME</option></term>
+
+        <listitem>
+          <para>Specifies fallback instance name for template units. This will be used when one or more
+          template units without an instance name (e.g. <filename>foo@.service</filename>) specified for
+          <command>systemd-analyze condition</command> with <option>--unit=</option>,
+          <command>systemd-analyze security</command>, and <command>systemd-analyze verify</command>.
+          If unspecified, <literal>test_instance</literal> will be used.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><option>--recursive-errors=<replaceable>MODE</replaceable></option></term>
 
@@ -1516,7 +1605,9 @@ io.systemd.credential:vmm.notify_socket=vsock-stream:2:254570042
         compiled in set of unit load paths; see
         <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>. All
         units files present in the directory containing the specified unit will be used in preference to the
-        other paths.</para>
+        other paths. If a template unit without an instance name is specified (e.g.
+        <filename>foo@.service</filename>), <literal>test_instance</literal> will be used as the instance
+        name, which can be controlled by <option>--instance=</option> option.</para>
 
         <xi:include href="version-info.xml" xpointer="v250"/></listitem>
       </varlistentry>
@@ -1562,6 +1653,24 @@ io.systemd.credential:vmm.notify_socket=vsock-stream:2:254570042
         <xi:include href="version-info.xml" xpointer="v255"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--scale-svg=<replaceable>FACTOR</replaceable></option></term>
+
+        <listitem><para>When used with the <command>plot</command> command, the x-axis of the plot
+        can be stretched by FACTOR (default: 1.0).</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--detailed</option></term>
+
+        <listitem><para>When used with the <command>plot</command> command, activation timestamps
+        details can be seen in SVG plot.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
       <xi:include href="standard-options.xml" xpointer="help" />
       <xi:include href="standard-options.xml" xpointer="version" />
       <xi:include href="standard-options.xml" xpointer="no-pager" />
@@ -1578,6 +1687,12 @@ io.systemd.credential:vmm.notify_socket=vsock-stream:2:254570042
     <constant>12</constant>, <constant>0</constant>, <constant>11</constant> is returned if the second
     version string is respectively larger, equal, or smaller to the first. In the three-argument form,
     <constant>0</constant> or <constant>1</constant> if the condition is respectively true or false.</para>
+
+    <para>In case of the <command>has-tpm2</command> command returns 0 if a TPM2 device is discovered,
+    supported and used by firmware, driver, and userspace (i.e. systemd). Otherwise returns the OR
+    combination of the value 1 (in case firmware support is missing), 2 (in case driver support is missing)
+    and 4 (in case userspace support is missing). If no TPM2 support is available at all, value 7 is hence
+    returned.</para>
   </refsect1>
 
   <xi:include href="common-variables.xml" />

man/systemd-boot.xml

@@ -429,13 +429,15 @@
       <varlistentry>
         <term><varname>LoaderDevicePartUUID</varname></term>
 
-        <listitem><para>Contains the partition UUID of the EFI System Partition the boot loader was run from. Set by
+        <listitem><para>Contains the partition UUID of the partition the boot loader has been started from on
-        the boot
+        the current boot (usually a EFI System Partition). Set by the boot loader. (Note that
-        loader. <citerefentry><refentrytitle>systemd-gpt-auto-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+        <command>systemd-stub</command> will set this too, if not set yet, to support systems that directly
-        uses this information to automatically find the disk booted from, in order to discover various other partitions
+        boot into a unified kernel image, bypassing any boot loader.)
-        on the same disk automatically.</para>
+        <citerefentry><refentrytitle>systemd-gpt-auto-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+        uses this information to automatically find the disk booted from, in order to discover various other
+        partitions on the same disk automatically.</para>
 
-        <xi:include href="version-info.xml" xpointer="v240"/></listitem>
+        <xi:include href="version-info.xml" xpointer="v220"/></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -516,12 +518,15 @@
       <varlistentry>
         <term><varname>LoaderImageIdentifier</varname></term>
 
-        <listitem><para>The path of executable of the boot loader used for the current boot, relative to the EFI System
+        <listitem><para>The file system path to the EFI executable of the boot loader for the current boot,
-        Partition's root directory. Set by the boot loader. Use
+        relative to the partition's root directory (i.e. relative to the partition indicated by
-        <citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> to view this
+        <varname>LoaderDevicePartUUID</varname>, see above). Set by the boot loader. (Note that
-        data.</para>
+        <command>systemd-stub</command> will set this too, if not set yet, to support systems that directly
+        boot into a unified kernel image, bypassing any boot loader.) Use
+        <citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> to view
+        this data.</para>
 
-        <xi:include href="version-info.xml" xpointer="v240"/></listitem>
+        <xi:include href="version-info.xml" xpointer="v220"/></listitem>
       </varlistentry>
 
       <varlistentry>

man/systemd-cat.xml

@@ -63,7 +63,10 @@
 
         <listitem><para>Specify a short string that is used to
         identify the logging tool. If not specified, no identification
-        string is written to the journal.</para></listitem>
+        string is set for the journal entry, and the executable name
+        (or <literal>cat</literal> if the input is read from a pipe)
+        will be used to describe the log source instead.
+        </para></listitem>
       </varlistentry>
 
       <varlistentry>

man/systemd-creds.xml

@@ -177,22 +177,6 @@
         <xi:include href="version-info.xml" xpointer="v250"/></listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term><command>has-tpm2</command></term>
-
-        <listitem><para>Reports whether the system is equipped with a TPM2 device usable for protecting
-        credentials. If a TPM2 device has been discovered, is supported, and is being used by firmware,
-        by the OS kernel drivers and by userspace (i.e. systemd) this prints <literal>yes</literal> and exits
-        with exit status zero. If no such device is discovered/supported/used, prints
-        <literal>no</literal>. Otherwise prints <literal>partial</literal>. In either of these two cases
-        exits with non-zero exit status. It also shows four lines indicating separately whether firmware,
-        drivers, the system and the kernel discovered/support/use TPM2.</para>
-
-        <para>Combine with <option>--quiet</option> to suppress the output.</para>
-
-        <xi:include href="version-info.xml" xpointer="v251"/></listitem>
-      </varlistentry>
-
       <xi:include href="standard-options.xml" xpointer="help" />
       <xi:include href="standard-options.xml" xpointer="version" />
     </variablelist>
@@ -445,8 +429,7 @@
         <term><option>--quiet</option></term>
         <term><option>-q</option></term>
 
-        <listitem><para>When used with <command>has-tpm2</command> suppresses the output, and only returns an
+        <listitem><para>Suppress additional output.</para>
-        exit status indicating support for TPM2.</para>
 
         <xi:include href="version-info.xml" xpointer="v251"/></listitem>
       </varlistentry>
@@ -461,12 +444,6 @@
     <title>Exit status</title>
 
     <para>On success, 0 is returned.</para>
-
-    <para>In case of the <command>has-tpm2</command> command returns 0 if a TPM2 device is discovered,
-    supported and used by firmware, driver, and userspace (i.e. systemd). Otherwise returns the OR
-    combination of the value 1 (in case firmware support is missing), 2 (in case driver support is missing)
-    and 4 (in case userspace support is missing). If no TPM2 support is available at all, value 7 is hence
-    returned.</para>
   </refsect1>
 
   <refsect1>

man/systemd-detect-virt.xml

@@ -62,7 +62,7 @@
         </thead>
         <tbody>
           <row>
-            <entry valign="top" morerows="16">VM</entry>
+            <entry valign="top" morerows="17">VM</entry>
             <entry><varname>qemu</varname></entry>
             <entry>QEMU software virtualization, without KVM</entry>
           </row>
@@ -217,6 +217,50 @@
     WSL is categorized as a container for practical purposes.
     Multiple WSL environments share the same kernel and services
     should generally behave like when being run in a container.</para>
+
+    <para>When executed with <option>--cvm</option>, instead of
+    printing the virtualization technology, it will display the
+    confidential virtual machine technology, if any. The
+    following technologies are currently identified:</para>
+
+    <table>
+      <title>Known confidential virtualization technologies</title>
+      <tgroup cols='2' align='left' colsep='1' rowsep='1'>
+        <colspec colname="id" />
+        <colspec colname="product" />
+        <thead>
+          <row>
+            <entry>Arch</entry>
+            <entry>ID</entry>
+            <entry>Technology</entry>
+          </row>
+        </thead>
+        <tbody>
+          <row>
+            <entry valign="top" morerows="3">x86_64</entry>
+            <entry><varname>sev</varname></entry>
+            <entry>AMD Secure Encrypted Virtualization</entry>
+          </row>
+          <row>
+            <entry><varname>sev-es</varname></entry>
+            <entry>AMD Secure Encrypted Virtualization - Encrypted State</entry>
+          </row>
+          <row>
+            <entry><varname>sev-snp</varname></entry>
+            <entry>AMD Secure Encrypted Virtualization - Secure Nested Paging</entry>
+          </row>
+          <row>
+            <entry><varname>tdx</varname></entry>
+            <entry>Intel Trust Domain Extensions</entry>
+          </row>
+          <row>
+            <entry>s390x</entry>
+            <entry><varname>protvirt</varname></entry>
+            <entry>IBM Protected Virtualization (Secure Execution)</entry>
+          </row>
+        </tbody>
+      </tgroup>
+    </table>
   </refsect1>
 
   <refsect1>

man/systemd-gpt-auto-generator.xml

@@ -129,7 +129,12 @@
             <entry><constant>4d21b016-b534-45c2-a9fb-5c16e091fd2d</constant></entry>
             <entry>Variable Data Partition</entry>
             <entry><filename>/var/</filename></entry>
-            <entry>The first partition with this type UUID on the same disk as the root partition is mounted to <filename>/var/</filename> — under the condition its partition UUID matches the first 128 bit of the HMAC-SHA256 of the GPT type uuid of this partition keyed by the machine ID of the installation stored in <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</entry>
+            <entry>The first partition with this type UUID on the same disk as the root partition is mounted
+            to <filename>/var/</filename> — under the condition its partition UUID matches the first 128 bit
+            of the HMAC-SHA256 of the GPT type uuid of this partition keyed by the machine ID of the
+            installation stored in
+            <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+            This can be generated using <citerefentry><refentrytitle>systemd-id128</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</entry>
           </row>
           <row>
             <entry><constant>SD_GPT_TMP</constant></entry>

man/systemd-id128.xml

@@ -45,6 +45,12 @@
       <arg choice="plain">invocation-id</arg>
     </cmdsynopsis>
 
+    <cmdsynopsis>
+      <command>systemd-id128</command>
+      <arg choice="opt" rep="repeat">OPTIONS</arg>
+      <arg choice="plain">var-partition-uuid</arg>
+    </cmdsynopsis>
+
     <cmdsynopsis>
       <command>systemd-id128</command>
       <arg choice="opt" rep="repeat">OPTIONS</arg>
@@ -88,6 +94,12 @@
     <citerefentry><refentrytitle>sd_id128_get_machine</refentrytitle><manvolnum>3</manvolnum></citerefentry>
     for the discussion when this is useful. Support for <command>show --app-specific=</command> was added in
     version 255.</para>
+
+    <para><command>var-partition-uuid</command> prints a UUID which, following the <ulink
+    url="https://uapi-group.org/specifications/specs/discoverable_partitions_specification">Discoverable
+    Partitions Specification</ulink>, should be used as the GPT partition UUID for
+    <filename>/var/</filename>, being derived from the GPT partition type, keyed by the local
+    <filename>/etc/machine-id</filename>. Added in version 257.</para>
   </refsect1>
 
   <refsect1>

man/systemd-inhibit.xml

@@ -92,19 +92,17 @@
       <varlistentry>
         <term><option>--mode=</option></term>
 
-        <listitem><para>Takes either <literal>block</literal> or
+        <listitem><para>Takes <literal>block</literal>, <literal>delay</literal>,
-        <literal>delay</literal> and describes how the lock is
+        <literal>block-weak</literal> or <literal>delay-weak</literal> and describes how the lock is
-        applied. If <literal>block</literal> is used (the default),
+        applied. If <literal>block</literal> is used (the default), the lock prohibits any of the requested
-        the lock prohibits any of the requested operations without
+        operations without time limit, and only privileged users may override it. If
-        time limit, and only privileged users may override it. If
+        <literal>delay</literal> is used, the lock can only delay the requested operations for a limited
-        <literal>delay</literal> is used, the lock can only delay the
+        time. If the time elapses, the lock is ignored and the operation executed. The time limit may be
-        requested operations for a limited time. If the time elapses,
+        specified in
-        the lock is ignored and the operation executed. The time limit
-        may be specified in
         <citerefentry><refentrytitle>logind.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
-        Note that <literal>delay</literal> is only available for
+        Note that <literal>delay</literal> is only available for <literal>sleep</literal> and
-        <literal>sleep</literal> and
+        <literal>shutdown</literal>. In addition, the weak variants will automatically and silently be
-        <literal>shutdown</literal>.</para></listitem>
+        bypassed under some circumstances.</para></listitem>
       </varlistentry>
 
       <varlistentry>

man/systemd-measure.xml

@@ -17,7 +17,7 @@
 
   <refnamediv>
     <refname>systemd-measure</refname>
-    <refpurpose>Pre-calculate and sign expected TPM2 PCR values for booted unified kernel images</refpurpose>
+    <refpurpose>Pre-calculate and sign expected TPM2 PCR 11 values for booted unified kernel images</refpurpose>
   </refnamediv>
 
   <refsynopsisdiv>
@@ -62,7 +62,7 @@
         <term><command>status</command></term>
 
         <listitem><para>This is the default command if none is specified. This queries the local system's
-        TPM2 PCR 11+12+13 values and displays them. The data is written in a similar format as the
+        TPM2 PCR 11 values and displays them. The data is written in a similar format as the
         <command>calculate</command> command below, and may be used to quickly compare expectation with
         reality.</para>
 
@@ -76,9 +76,9 @@
         kernel image consisting of the components specified with <option>--linux=</option>,
         <option>--osrel=</option>, <option>--cmdline=</option>, <option>--initrd=</option>,
         <option>--ucode=</option>, <option>--splash=</option>, <option>--dtb=</option>,
-        <option>--uname=</option>, <option>--sbat=</option>, <option>--pcrpkey=</option> see below.
+        <option>--uname=</option>, <option>--sbat=</option>, <option>--pcrpkey=</option>,
-        Only <option>--linux=</option> is mandatory. (Alternatively, specify <option>--current</option> to use the current values of PCR
+        <option>--profile=</option>, see below.  Only <option>--linux=</option> is mandatory. (Alternatively,
-        register 11 instead.)</para>
+        specify <option>--current</option> to use the current values of PCR register 11 instead.)</para>
 
         <xi:include href="version-info.xml" xpointer="v252"/>
         </listitem>
@@ -124,6 +124,7 @@
         <term><option>--uname=<replaceable>PATH</replaceable></option></term>
         <term><option>--sbat=<replaceable>PATH</replaceable></option></term>
         <term><option>--pcrpkey=<replaceable>PATH</replaceable></option></term>
+        <term><option>--profile=<replaceable>PATH</replaceable></option></term>
 
         <listitem><para>When used with the <command>calculate</command> or <command>sign</command> verb,
         configures the files to read the unified kernel image components from. Each option corresponds with
@@ -131,7 +132,10 @@
         the path to the ELF kernel file that the unified PE kernel will wrap. All switches except
         <option>--linux=</option> are optional. Each option may be used at most once.</para>
 
-        <xi:include href="version-info.xml" xpointer="v252"/></listitem>
+        <xi:include href="version-info.xml" xpointer="v252"/>
+
+        <para id="v257">With the exception of <option>--profile=</option>, which has been added in version
+        257.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -282,9 +286,9 @@
       <title>Generate a private/public key pair, a unified kernel image, and a TPM PCR 11 signature for
       it, and embed the signature and the public key in the image</title>
 
-      <programlisting>$ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out tpm2-pcr-private.pem
+      <programlisting>$ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out tpm2-pcr-private-key.pem
 ..+.+++++++++......+.........+......+.......+....+.....+.+...+..........
-$ openssl rsa -pubout -in tpm2-pcr-private.pem -out tpm2-pcr-public.pem
+$ openssl rsa -pubout -in tpm2-pcr-private-key.pem -out tpm2-pcr-public-key.pem
 # systemd-measure sign \
      --linux=vmlinux \
      --osrel=os-release.txt \
@@ -292,25 +296,25 @@ $ openssl rsa -pubout -in tpm2-pcr-private.pem -out tpm2-pcr-public.pem
      --initrd=initrd.cpio \
      --splash=splash.bmp \
      --dtb=devicetree.dtb \
-     --pcrpkey=tpm2-pcr-public.pem \
+     --pcrpkey=tpm2-pcr-public-key.pem \
      --bank=sha1 \
      --bank=sha256 \
-     --private-key=tpm2-pcr-private.pem \
+     --private-key=tpm2-pcr-private-key.pem \
-     --public-key=tpm2-pcr-public.pem >tpm2-pcr-signature.json
+     --public-key=tpm2-pcr-public-key.pem >tpm2-pcr-signature.json
 # ukify --output=vmlinuz.efi \
      --os-release=@os-release.txt \
      --cmdline=@cmdline.txt \
      --splash=splash.bmp \
      --devicetree=devicetree.dtb \
-     --pcr-private-key=tpm2-pcr-private.pem \
+     --pcr-private-key=tpm2-pcr-private-key.pem \
-     --pcr-public-key=tpm2-pcr-public.pem \
+     --pcr-public-key=tpm2-pcr-public-key.pem \
      --pcr-banks=sha1,sha256 \
      vmlinux initrd.cpio</programlisting>
 
      <para>Later on, enroll the signed PCR policy on a LUKS volume:</para>
 
      <programlisting># systemd-cryptenroll --tpm2-device=auto \
-     --tpm2-public-key=tpm2-pcr-public.pem \
+     --tpm2-public-key=tpm2-pcr-public-key.pem \
      --tpm2-signature=tpm2-pcr-signature.json \
      /dev/sda5</programlisting>
 
@@ -335,38 +339,38 @@ $ openssl rsa -pubout -in tpm2-pcr-private.pem -out tpm2-pcr-public.pem
       two classes of secrets or credentials: one that can be unlocked during the entire runtime, and the
       other that can only be used in the initrd.</para>
 
-      <programlisting>$ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out tpm2-pcr-private.pem
+      <programlisting>$ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out tpm2-pcr-private-key.pem
 .+........+.+........+.......+...+...+........+....+......+..+..........
-$ openssl rsa -pubout -in tpm2-pcr-private.pem -out tpm2-pcr-public.pem
+$ openssl rsa -pubout -in tpm2-pcr-private-key.pem -out tpm2-pcr-public-key.pem
-$ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out tpm2-pcr-initrd-private.pem
+$ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out tpm2-pcr-private-key-initrd.pem
 ..+.......++........+........+......+........+....+.....+.+..+..........
-$ openssl rsa -pubout -in tpm2-pcr-initrd-private.pem -out tpm2-pcr-initrd-public.pem
+$ openssl rsa -pubout -in tpm2-pcr-private-key-initrd.pem -out tpm2-pcr-public-key-initrd.pem
 # ukify --output vmlinux-1.2.3.efi \
      --os-release=@os-release.txt \
      --cmdline=@cmdline.txt \
      --splash=splash.bmp \
      --devicetree=devicetree.dtb \
-     --pcr-private-key=tpm2-pcr-private.pem \
+     --pcr-private-key=tpm2-pcr-private-key.pem \
-     --pcr-public-key=tpm2-pcr-public.pem \
+     --pcr-public-key=tpm2-pcr-public-key.pem \
      --phases=enter-initrd,enter-initrd:leave-initrd,enter-initrd:leave-initrd:sysinit,enter-initrd:leave-initrd:sysinit:ready \
      --pcr-banks=sha1,sha256 \
-     --pcr-private-key=tpm2-pcr-initrd-private.pem \
+     --pcr-private-key=tpm2-pcr-private-key-initrd.pem \
-     --pcr-public-key=tpm2-pcr-initrd-public.pem \
+     --pcr-public-key=tpm2-pcr-public-key-initrd.pem \
      --phases=enter-initrd \
      vmlinux-1.2.3 initrd.cpio \
      --uname=1.2.3
 + /usr/lib/systemd/systemd-measure sign --linux=vmlinux-1.2.3 \
 --osrel=os-release.txt --cmdline=cmdline.txt --dtb=devicetree.dtb \
 --splash=splash.bmp --initrd=initrd.cpio --bank=sha1 --bank=sha256 \
---private-key=tpm2-pcr-private.pem --public-key=tpm2-pcr-public.pem \
+--private-key=tpm2-pcr-private-key.pem --public-key=tpm2-pcr-public-key.pem \
 --phase=enter-initrd --phase=enter-initrd:leave-initrd \
 --phase=enter-initrd:leave-initrd:sysinit \
 --phase=enter-initrd:leave-initrd:sysinit:ready
 + /usr/lib/systemd/systemd-measure sign --linux=vmlinux-1.2.3 \
 --osrel=os-release.txt --cmdline=cmdline.txt --dtb=devicetree.dtb \
 --splash=splash.bmp --initrd=initrd.cpio --bank=sha1 --bank=sha256 \
---private-key=tpm2-pcr-initrd-private.pem \
+--private-key=tpm2-pcr-private-key-initrd.pem \
---public-key=tpm2-pcr-initrd-public.pem \
+--public-key=tpm2-pcr-public-key-initrd.pem \
 --phase=enter-initrd
 Wrote unsigned vmlinux-1.2.3.efi
       </programlisting>
@@ -381,8 +385,8 @@ Wrote unsigned vmlinux-1.2.3.efi
       by the first <option>--pcr-private-key=</option> option, covering all boot phases. The
       <literal>.pcrpkey</literal> section is used in the default policies of
       <command>systemd-cryptenroll</command> and <command>systemd-creds</command>. To use the stricter policy
-      bound to <filename>tpm-pcr-initrd-public.pem</filename>, specify <option>--tpm2-public-key=</option> on
+      bound to <filename>tpm2-pcr-public-key-initrd.pem</filename>, specify
-      the command line of those tools.</para>
+      <option>--tpm2-public-key=</option> on the command line of those tools.</para>
     </example>
   </refsect1>
 

man/systemd-mount.xml

@@ -121,6 +121,7 @@
       <xi:include href="standard-options.xml" xpointer="no-pager"/>
       <xi:include href="standard-options.xml" xpointer="no-legend" />
       <xi:include href="standard-options.xml" xpointer="no-ask-password"/>
+      <xi:include href="standard-options.xml" xpointer="json"/>
 
       <varlistentry>
         <term><option>--quiet</option></term>

man/systemd-path.xml

@@ -43,6 +43,12 @@
     The variables whose name begins with <literal>search-</literal>
     do not refer to individual paths, but instead to a list of
     colon-separated search paths, in their order of precedence.</para>
+
+    <para>Note that paths which depend on environment variables are
+    computed with <command>systemd-path</command>'s invoked
+    environment, and not the system or user manager's environment. As
+    such, the output of <command>systemd-path</command> may not
+    reflect the behavior of manager processes.</para>
   </refsect1>
 
   <refsect1>

man/systemd-repart.xml

@@ -35,31 +35,34 @@
   <refsect1>
     <title>Description</title>
 
-    <para><command>systemd-repart</command> grows and adds partitions to a partition table, based on the
+    <para><command>systemd-repart</command> creates partition tables, and adds or grows partitions,
-    configuration files described in
+    based on the configuration files described in
     <citerefentry><refentrytitle>repart.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
     </para>
 
-    <para>If invoked with no arguments, it operates on the block device backing the root file system
+    <para><command>systemd-repart</command> is used when <emphasis>building</emphasis> OS images, and also
-    partition of the running OS, thus growing and adding partitions of the booted OS image itself. If
+    when <emphasis>deploying</emphasis> images to automatically adjust them, during boot, to the system they
-    <varname>--image=</varname> is used it will operate on the specified image file. When called in the
+    are running on. This way the image can be minimal in size and may be augmented automatically at boot,
-    initrd it operates on the block device backing <filename>/sysroot/</filename> instead, i.e. on the block
+    taking possession of the disk space available.</para>
-    device the system will soon transition into. The <filename>systemd-repart.service</filename> service is
-    generally run at boot in the initrd, in order to augment the partition table of the OS before its
-    partitions are mounted. <command>systemd-repart</command> (mostly) operates in a purely incremental mode:
-    it only grows existing and adds new partitions; it does not shrink, delete or move existing partitions.
-    The service is intended to be run on every boot, but when it detects that the partition table already
-    matches the installed <filename>repart.d/*.conf</filename> configuration files, it executes no
-    operation.</para>
 
-    <para><command>systemd-repart</command> is intended to be used when deploying OS images, to automatically
+    <para>If invoked with no arguments, <command>systemd-repart</command> operates on the block device
-    adjust them to the system they are running on, during first boot. This way the deployed image can be
+    backing the root file system partition of the running OS, thus adding and growing partitions of the
-    minimal in size and may be augmented automatically at boot when needed, taking possession of disk space
+    booted OS itself. When called in the initrd, it operates on the block device backing
-    available but not yet used. Specifically the following use cases are among those covered:</para>
+    <filename>/sysroot/</filename> instead, i.e. on the block device the system will soon transition into. If
+    <varname>--image=</varname> is used, it will operate on the specified device or image file. The
+    <filename>systemd-repart.service</filename> service is generally run at boot in the initrd, in order to
+    augment the partition table of the OS before its partitions are mounted.</para>
+
+    <para><command>systemd-repart</command> operations are mostly incremental: it grows existing partitions
+    or adds new ones, but does not shrink, delete, or move existing partitions. The service is intended to be
+    run on every boot, but when it detects that the partition table already matches the installed
+    <filename>repart.d/*.conf</filename> configuration files, it executes no operation.</para>
+
+    <para>The following use cases are among those covered:</para>
 
     <itemizedlist>
       <listitem><para>The root partition may be grown to cover the whole available disk space.</para></listitem>
-      <listitem><para>A <filename>/home/</filename>, swap or <filename>/srv/</filename> partition can be
+      <listitem><para>A <filename>/home/</filename>, swap, or <filename>/srv/</filename> partition can be
       added.</para></listitem>
       <listitem><para>A second (or third, …) root partition may be added, to cover A/B style setups
       where a second version of the root file system is alternatingly used for implementing update
@@ -70,23 +73,22 @@
     <para>The algorithm executed by <command>systemd-repart</command> is roughly as follows:</para>
 
     <orderedlist>
-      <listitem><para>The <filename>repart.d/*.conf</filename> configuration files are loaded and parsed,
+      <listitem><para>The <filename>repart.d/*.conf</filename> configuration files are loaded and parsed, and
-      and ordered by filename (without the directory prefix). For each configuration file,
+      ordered by filename (without the directory prefix). For each configuration file, drop-in files are
-      drop-in files are looked for in directories with same name as the configuration file
+      loaded from directories with same name as the configuration file with the suffix ".d" added.
-      with a suffix ".d" added.</para></listitem>
-
-      <listitem><para>The partition table already existing on the block device is loaded and
-      parsed.</para></listitem>
-
-      <listitem><para>The existing partitions in the partition table are matched up with the
-      <filename>repart.d/*.conf</filename> files by GPT partition type UUID. The first existing partition
-      of a specific type is assigned the first configuration file declaring the same type. The second
-      existing partition of a specific type is then assigned the second configuration file declaring the same
-      type, and so on. After this iterative assigning is complete any left-over existing partitions that have
-      no matching configuration file are considered "foreign" and left as they are. And any configuration
-      files for which no partition currently exists are understood as a request to create such a partition.
       </para></listitem>
 
+      <listitem><para>The partition table on the block device is loaded and parsed, if present.
+      </para></listitem>
+
+      <listitem><para>The existing partitions in the partition table are matched with the
+      <filename>repart.d/*.conf</filename> files by GPT partition type UUID. The first existing partition of
+      a specific type is assigned the first configuration file declaring the same type. The second existing
+      partition of a specific type is then assigned the second configuration file declaring the same type,
+      and so on. After this iterative assigning is complete, any existing partitions that have no matching
+      configuration file are considered "foreign" and left as they are. And any configuration files for which
+      no partition was matched are treated as requests to create a partition.</para></listitem>
+
       <listitem><para>Partitions that shall be created are now allocated on the disk, taking the size
       constraints and weights declared in the configuration files into account. Free space is used within the
       limits set by size and padding requests. In addition, existing partitions that should be grown are
@@ -124,12 +126,11 @@
       partition table.</para></listitem>
     </orderedlist>
 
-    <para>As exception to the normally strictly incremental operation, when called in a special "factory
+    <para>As an exception to the normal incremental operation, when called in a special "factory reset" mode,
-    reset" mode, <command>systemd-repart</command> may also be used to erase existing partitions to
+    <command>systemd-repart</command> may be used to erase existing partitions to reset an installation back
-    reset an installation back to vendor defaults. This mode of operation is used when either the
+    to vendor defaults. This mode of operation is used when either the <option>--factory-reset=yes</option>
-    <option>--factory-reset=yes</option> switch is passed on the tool's command line, or the
+    switch is passed on the tool's command line, or the <option>systemd.factory_reset=yes</option> option is
-    <option>systemd.factory_reset=yes</option> option specified on the kernel command line, or the
+    specified on the kernel command line, or the <varname>FactoryReset</varname> EFI variable (vendor UUID
-    <varname>FactoryReset</varname> EFI variable (vendor UUID
     <constant>8cf2644b-4b0b-428f-9387-6d876050dc67</constant>) is set to "yes". It alters the algorithm above
     slightly: between the 3rd and the 4th step above any partition marked explicitly via the
     <varname>FactoryReset=</varname> boolean is deleted, and the algorithm restarted, thus immediately
@@ -153,11 +154,9 @@
     from a common seed images prepared with this tool become reproducible and the result of the algorithm
     above deterministic.</para>
 
-    <para>The positional argument should specify the block device to operate on. Instead of a block device
+    <para>The positional argument should specify the block device or a regular file to operate on. If
-    node path a regular file may be specified too, in which case the command operates on it like it would if
+    <option>--empty=create</option> is specified, the specified path is created as regular file, which is
-    a loopback block device node was specified with the file attached. If <option>--empty=create</option> is
+    useful for generating disk images from scratch.</para>
-    specified the specified path is created as regular file, which is useful for generating disk images from
-    scratch.</para>
   </refsect1>
 
   <refsect1>
@@ -168,6 +167,7 @@
     <variablelist>
       <varlistentry>
         <term><option>--dry-run=</option></term>
+
         <listitem><para>Takes a boolean. If this switch is not specified <option>--dry-run=yes</option> is
         the implied default. Controls whether <filename>systemd-repart</filename> executes the requested
         re-partition operations or whether it should only show what it would do. Unless
@@ -179,6 +179,7 @@
 
       <varlistentry>
         <term><option>--empty=</option></term>
+
         <listitem><para>Takes one of <literal>refuse</literal>, <literal>allow</literal>,
         <literal>require</literal>, <literal>force</literal> or <literal>create</literal>. Controls how to
         operate on block devices that are entirely empty, i.e. carry no partition table/disk label yet. If
@@ -633,7 +634,7 @@
   <refsect1>
     <title>Exit status</title>
 
-    <para>On success, 0 is returned, a non-zero failure code otherwise.</para>
+    <para>On success, 0 is returned, and a non-zero failure code otherwise.</para>
   </refsect1>
 
   <refsect1>
@@ -645,15 +646,19 @@
       <para>The following creates a configuration extension DDI (confext) for an
       <filename>/etc/motd</filename> update:</para>
 
-      <programlisting>mkdir tree tree/etc tree/etc/extension-release.d
+      <programlisting>mkdir -p tree/etc/extension-release.d
-echo "Hello World" > tree/etc/motd
+echo "Hello World" >tree/etc/motd
-cat > tree/etc/extension-release.d/extension-release.my-motd &lt;&lt;EOF
+cat >tree/etc/extension-release.d/extension-release.my-motd &lt;&lt;EOF
 ID=fedora
 VERSION_ID=38
 IMAGE_ID=my-motd
 IMAGE_VERSION=7
 EOF
-systemd-repart -C --private-key=privkey.pem --certificate=cert.crt -s tree/ /var/lib/confexts/my-motd.confext.raw
+systemd-repart -C \
+  --private-key=privkey.pem \
+  --certificate=cert.crt \
+  -s tree/ \
+  /var/lib/confexts/my-motd.confext.raw
 systemd-confext refresh</programlisting>
 
       <para>The DDI generated that way may be applied to the system with
@@ -666,15 +671,20 @@ systemd-confext refresh</programlisting>
       <para>The following creates a system extension DDI (sysext) for an
       <filename>/usr/foo</filename> update and signs it with a hardware token via PKCS11.</para>
 
-      <programlisting>mkdir tree tree/usr tree/usr/lib/extension-release.d
+      <programlisting>mkdir -p tree/usr/lib/extension-release.d
-echo "Hello World" > tree/usr/foo
+echo "Hello World" >tree/usr/foo
-cat > tree/usr/lib/extension-release.d/extension-release.my-foo &lt;&lt;EOF
+cat >tree/usr/lib/extension-release.d/extension-release.my-foo &lt;&lt;EOF
 ID=fedora
 VERSION_ID=38
 IMAGE_ID=my-foo
 IMAGE_VERSION=7
 EOF
-systemd-repart --make-ddi=sysext --private-key-source=engine:pkcs11 --private-key="pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=0123456789abcdef;token=Some%20Cert" --certificate=cert.crt -s tree/ /var/lib/extensions/my-foo.sysext.raw
+systemd-repart --make-ddi=sysext \
+  --private-key-source=engine:pkcs11 \
+  --private-key="pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=0123456789abcdef;token=Some%20Cert" \
+  --certificate=cert.crt \
+  -s tree/ \
+  /var/lib/extensions/my-foo.sysext.raw
 systemd-sysext refresh</programlisting>
 
       <para>The DDI generated that way may be applied to the system with

man/systemd-resolved.service.xml

@@ -216,34 +216,35 @@
       the traditional glibc resolver below.</para></listitem>
 
       <listitem><para>If a query does not match any configured routing domain (either per-link or global), it
-      is sent to all DNS servers that are configured on links with the <varname>DefaultRoute=</varname>
+      is sent to all DNS servers that are configured on links configured as the default route, as well as the
-      option set, as well as the globally configured DNS server.</para></listitem>
+      globally configured DNS server.</para></listitem>
 
-      <listitem><para>If there is no link configured as <varname>DefaultRoute=</varname> and no global DNS
+      <listitem><para>If there are no DNS servers configured on any link also configured as the default route
-      server configured, one of the compiled-in fallback DNS servers is used.</para></listitem>
+      and no global DNS server configured, one of the compiled-in fallback DNS servers is used.</para>
+      </listitem>
 
       <listitem><para>Otherwise the unicast DNS query fails, as no suitable DNS servers can be determined.
       </para></listitem>
     </itemizedlist>
 
-    <para>The <varname>DefaultRoute=</varname> option is a boolean setting configurable with
+    <para>Whether a link is the default route or not can be configured with
-    <command>resolvectl</command> or in <filename>.network</filename> files. If not set, it is implicitly
+    <command>resolvectl default-route</command> command or <varname>DNSDefaultRoute=</varname> setting in
-    determined based on the configured DNS domains for a link: if there's a route-only domain other than
+    <filename>.network</filename> files. If not configured explicitly, it is implicitly determined based on
-    <literal>~.</literal>, it defaults to false, otherwise to true.</para>
+    the configured DNS domains for a link: if there's a route-only domain other than <literal>~.</literal>,
+    it defaults to false, otherwise to true.</para>
 
     <para>Effectively this means: in order to support single-label non-synthesized names, define appropriate
     search domains. In order to preferably route all DNS queries not explicitly matched by routing domain
     configuration to a specific link, configure a <literal>~.</literal> route-only domain on it. This will
     ensure that other links will not be considered for these queries (unless they too carry such a routing
     domain). In order to route all such DNS queries to a specific link only if no other link is preferred,
-    set the <varname>DefaultRoute=</varname> option for the link to true and do not configure a
+    configure the link as the default route and do not configure a <literal>~.</literal> route-only domain on
-    <literal>~.</literal> route-only domain on it. Finally, in order to ensure that a specific link never
+    it. Finally, in order to ensure that a specific link never receives any DNS traffic not matching any of
-    receives any DNS traffic not matching any of its configured routing domains, set the
+    its configured routing domains, make it not the default route.</para>
-    <varname>DefaultRoute=</varname> option for it to false.</para>
 
     <para>See
     <citerefentry><refentrytitle>org.freedesktop.resolve1</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-    for information about the D-Bus APIs <filename>systemd-resolved</filename> provides.</para>
+    for information about the D-Bus APIs <command>systemd-resolved</command> provides.</para>
   </refsect1>
 
   <refsect1>

man/systemd-run.xml

@@ -105,15 +105,6 @@
     <para>The following options are understood:</para>
 
     <variablelist>
-      <varlistentry>
-        <term><option>--no-ask-password</option></term>
-
-        <listitem><para>Do not query the user for authentication for
-        privileged operations.</para>
-
-        <xi:include href="version-info.xml" xpointer="v226"/></listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><option>--scope</option></term>
 
@@ -528,8 +519,10 @@
       <xi:include href="user-system-options.xml" xpointer="machine" />
       <xi:include href="user-system-options.xml" xpointer="capsule" />
 
+      <xi:include href="standard-options.xml" xpointer="no-ask-password" />
       <xi:include href="standard-options.xml" xpointer="help" />
       <xi:include href="standard-options.xml" xpointer="version" />
+      <xi:include href="standard-options.xml" xpointer="json" />
     </variablelist>
 
     <para>All command line arguments after the first non-option argument become part of the command line of

man/systemd-sleep.conf.xml

@@ -227,6 +227,23 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>HibernateOnACPower=</varname></term>
+
+        <listitem>
+          <para>Whether to allow hibernation when the system has AC power. Only used by
+          <citerefentry><refentrytitle>systemd-suspend-then-hibernate.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+          when <varname>HibernateDelaySec=</varname> is set.</para>
+
+          <para>If this option is disabled, the countdown of <varname>HibernateDelaySec=</varname> starts only
+          after AC power is disconnected, keeping the system in the suspend state otherwise.</para>
+
+          <para>This option is only effective on systems with a battery.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>SuspendEstimationSec=</varname></term>
 

man/systemd-ssh-generator.xml

@@ -65,7 +65,7 @@
 
     <para>The <varname>ssh.authorized_keys.root</varname> credential can be used to allow specific public keys
     to log in over SSH. See
-    <citerefentry><refentrytitle>systemd.systemd-credentials</refentrytitle><manvolnum>7</manvolnum></citerefentry>
+    <citerefentry><refentrytitle>systemd.system-credentials</refentrytitle><manvolnum>7</manvolnum></citerefentry>
     for more information.</para>
 
     <para>The generator will use a packaged <filename>sshd@.service</filename> service template file if one

man/systemd-ssh-proxy.xml

@@ -58,7 +58,7 @@ Host .host
 </programlisting>
 
     <para>A configuration fragment along these lines is by default installed into
-    <filename>/etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf.in</filename>.</para>
+    <filename>/etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf</filename>.</para>
 
     <para>With this in place, SSH connections to host string <literal>unix/</literal> followed by an absolute
     <constant>AF_UNIX</constant> file system path to a socket will be directed to the specified socket, which

man/systemd-stub.xml

@@ -53,13 +53,14 @@
     <para>The UEFI boot stub looks for various resources for the kernel invocation inside the UEFI PE binary
     itself. This allows combining various resources inside a single PE binary image (usually called "Unified
     Kernel Image", or "UKI" for short), which may then be signed via UEFI SecureBoot as a whole, covering all
-    individual resources at once. Specifically it may include:</para>
+    individual resources at once. Specifically it may include the following PE sections:</para>
 
     <itemizedlist>
       <!-- Let's keep this in the canonical order we also measure the sections by, i.e. as in
            src/fundamental/uki.h's UnifiedSection enum -->
 
-      <listitem><para>A <literal>.linux</literal> section with the ELF Linux kernel image.</para></listitem>
+      <listitem><para>A <literal>.linux</literal> section with the ELF Linux kernel
+      image. (Required)</para></listitem>
 
       <listitem><para>An <literal>.osrel</literal> section with OS release information, i.e. the contents of
       the <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry> file
@@ -95,21 +96,29 @@
       signature data in the <literal>.pcrsig</literal> section.</para></listitem>
     </itemizedlist>
 
-    <para>If UEFI SecureBoot is enabled and the <literal>.cmdline</literal> section is present in the executed
+    <para>Generally, the sections above should appear at most once in a UKI. That said, a concept of
-    image, any attempts to override the kernel command line by passing one as invocation parameters to the
+    "profiles" is defined, that allows multiple sets of these sections to exist in a single UKI file, of
-    EFI binary are ignored. Thus, in order to allow overriding the kernel command line, either disable UEFI
+    which one can be selected at boot. For this an additional PE section <literal>.profile</literal> is
-    SecureBoot, or don't include a kernel command line PE section in the kernel image file. If a command line
+    defined which can be used as separator between multiple sets of these settings. The
-    is accepted via EFI invocation parameters to the EFI binary it is measured into TPM PCR 12 (if a TPM is
+    <literal>.profile</literal> section itself may contain meta-information about the section, and follows a
-    present).</para>
+    similar structure as the contents of the <literal>.osrel</literal> section. For further details about
+    multi-profile UKIs, see below.</para> <para>If UEFI SecureBoot is enabled and the
+    <literal>.cmdline</literal> section is present in the executed image, any attempts to override the kernel
+    command line by passing one as invocation parameters to the EFI binary are ignored. Thus, in order to
+    allow overriding the kernel command line, either disable UEFI SecureBoot, or don't include a kernel
+    command line PE section in the kernel image file. If a command line is accepted via EFI invocation
+    parameters to the EFI binary it is measured into TPM PCR 12 (if a TPM is present).</para> <para>If a
+    DeviceTree is embedded in the <literal>.dtb</literal> section, it replaces an existing DeviceTree in the
+    corresponding EFI configuration table. systemd-stub will ask the firmware via the
+    <literal>EFI_DT_FIXUP_PROTOCOL</literal> for hardware specific fixups to the DeviceTree.</para> <para>The
+    contents of 11 of these 12 sections are measured into TPM PCR 11. It is otherwise not used and thus the
+    result can be pre-calculated without too much effort. The <literal>.pcrsig</literal> section is not
+    included in this PCR measurement, since it is supposed to contain signatures for the output of the
+    measurement operation, and thus cannot also be input to it. If an UKI contains multiple profiles, only
+    the PE sections of the selected profile (and those of the base profile, except if overridden) are
+    measured.</para>
 
-    <para>If a DeviceTree is embedded in the <literal>.dtb</literal> section, it replaces an existing
+    <para>If non-zero, the selected numeric profile is measured into PCR 12.</para>
-    DeviceTree in the corresponding EFI configuration table. systemd-stub will ask the firmware via the
-    <literal>EFI_DT_FIXUP_PROTOCOL</literal> for hardware specific fixups to the DeviceTree.</para>
-
-    <para>The contents of eight of these nine sections are measured into TPM PCR 11. It is otherwise not used
-    and thus the result can be pre-calculated without too much effort. The <literal>.pcrsig</literal> section
-    is not included in this PCR measurement, since it is supposed to contain signatures for the output of the
-    measurement operation, and thus cannot also be input to it.</para>
 
     <para>When <literal>.pcrsig</literal> and/or <literal>.pcrpkey</literal> sections are present in a
     unified kernel image their contents are passed to the booted kernel in an synthetic initrd cpio archive
@@ -182,10 +191,10 @@
 
       <listitem><para>Similarly, files
       <filename><replaceable>foo</replaceable>.efi.extra.d/*.addon.efi</filename> are loaded and verified as
-      PE binaries, and a <literal>.cmdline</literal> section is parsed from them. Addons are supposed to be
+      PE binaries, and a <literal>.cmdline</literal> or <literal>.ucode</literal> section is parsed from them.
-      used to pass additional kernel command line parameters or Devicetree blobs, regardless of the kernel
+      Addons are supposed to be used to pass additional kernel command line parameters, or Devicetree blobs,
-      image being booted, for example to allow platform vendors to ship platform-specific
+      and microcode updates, regardless of the kernel image being booted, for example to allow platform vendors
-      configuration.</para>
+      to ship platform-specific configuration.</para>
 
       <para>In case Secure Boot is enabled, these files will be validated using keys in UEFI DB, Shim's DB or
       Shim's MOK, and will be rejected otherwise. Additionally, if both the addon and the UKI contain a
@@ -199,7 +208,9 @@
       <para>Addon files are sorted, loaded, and measured into TPM PCR 12 (if a TPM is present) and appended
       to the kernel command line. UKI command line options are listed first, then options from addons in
       <filename>/loader/addons/*.addon.efi</filename>, and finally UKI-specific addons. Device tree blobs are
-      loaded and measured following the same algorithm. Addons are always loaded in the same order based on
+      loaded and measured following the same algorithm. Microcode addons are passed to the kernel in inverse
+      order (UKI specific addons, global addons, UKI embedded section). This is because the microcode update
+      driver stops on the first matching filename. Addons are always loaded in the same order based on
       the filename, so that, given the same set of addons, the same set of measurements can be expected in
       PCR12. However, note that the filename is not protected by the PE signature, and as such an attacker
       with write access to the ESP could potentially rename these files to change the order in which they are
@@ -215,9 +226,10 @@
       measured into TPM PCR 12 (if a TPM is present).</para></listitem>
 
       <listitem><para>Additionally, files <filename>/loader/addons/*.addon.efi</filename> are loaded and
-      verified as PE binaries, and <literal>.cmdline</literal> and/or <literal>.dtb</literal> sections are
+      verified as PE binaries, and <literal>.cmdline</literal>, <literal>.dtb</literal> and/or
-      parsed from them. This is supposed to be used to pass additional command line parameters or Devicetree
+      <literal>.ucode</literal>sections are parsed from them. This is supposed to be used to pass additional
-      blobs to the kernel, regardless of the kernel being booted.</para></listitem>
+      command line parameters, Devicetree blobs and microcode updates to the kernel, regardless of the
+      kernel being booted.</para></listitem>
     </itemizedlist>
 
     <para>These mechanisms may be used to parameterize and extend trusted (i.e. signed), immutable initrd
@@ -228,19 +240,124 @@
     details); in case of the system extension images by using signed Verity images.</para>
   </refsect1>
 
+  <refsect1>
+    <title>Multi-Profile UKIs</title>
+
+    <para>In many contexts it is useful to allow invocation of a single UKI in multiple different modes (or
+    "profiles") without compromising the cryptographic integrity, measurements and so on of the boot
+    process. For example, a single UKI might provide three distinct profiles: a regular boot one, one that
+    invokes a "factory reset" operation, and one that boots into a storage target mode (as in
+    <citerefentry><refentrytitle>systemd-storagetm.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>). Each
+    profile would then use the same <literal>.linux</literal> and <literal>.initrd</literal> sections, but would
+    have a separate <literal>.cmdline</literal> section. For example the latter two profiles would extend the
+    regular kernel command line with <literal>systemd.unit=factory-reset.target</literal> or
+    <literal>rd.systemd.unit=storagetm.target</literal>.</para>
+
+    <para>A single UKI may support multiple profiles by means of the special <literal>.profile</literal> PE
+    section. This section acts as separator between the PE sections of the individual
+    profiles. <literal>.profile</literal> PE sections hence may appear multiple times in a single UKI, and
+    the other PE sections listed above may appear multiple times too, if <literal>.profile</literal> are
+    used, but only once before the first <literal>.profile</literal> section, once between each subsequent
+    pair, and once after the last appearance of <literal>.profile</literal>. The sections listed before the
+    first <literal>.profile</literal> are considered the "base" profile of the UKI. Each
+    <literal>.profile</literal> section then introduces a new profile, which are numbered starting from
+    zero. The PE sections following each <literal>.profile</literal> are specific to that profile. When
+    booting into a specific profile the base section's profiles are used in combination with the specific
+    profile's sections: if the same section is defined in both, the per-profile section overrides the base
+    profile's version, otherwise the per-profile sections is used together with the base profile
+    sections.</para> <para>A UKI that contains no <literal>.profile</literal> is consider equivalent to one
+    that just contains a single <literal>.profile</literal>, as having only a single profile @0.</para>
+
+    <para>Here's a simple example for a multi-profile UKI's sections, inspired by the setup suggested above:</para>
+
+    <table>
+      <title>Multi-Profile UKI Example</title>
+
+      <tgroup cols='2' align='left' colsep='1' rowsep='1'>
+        <colspec colname="section" />
+        <colspec colname="profile" />
+
+        <thead>
+          <row>
+            <entry>Section</entry>
+            <entry>Profile</entry>
+          </row>
+        </thead>
+
+        <tbody>
+          <row>
+            <entry><literal>.linux</literal></entry>
+            <entry morerows="3" valign="middle">Base profile</entry>
+          </row>
+          <row>
+            <entry><literal>.osrel</literal></entry>
+          </row>
+          <row>
+            <entry><literal>.cmdline</literal></entry>
+          </row>
+          <row>
+            <entry><literal>.initrd</literal></entry>
+          </row>
+          <row>
+            <entry><literal>.profile</literal></entry>
+            <entry>Profile @0</entry>
+          </row>
+          <row>
+            <entry><literal>.profile</literal></entry>
+            <entry morerows="1" valign="middle">Profile @1</entry>
+          </row>
+          <row>
+            <entry><literal>.cmdline</literal></entry>
+          </row>
+          <row>
+            <entry><literal>.profile</literal></entry>
+            <entry morerows="1" valign="middle">Profile @2</entry>
+          </row>
+          <row>
+            <entry><literal>.cmdline</literal></entry>
+          </row>
+        </tbody>
+      </tgroup>
+    </table>
+
+    <para>The section list above would define three profiles. The first four sections make up the base
+    profile. A <literal>.profile</literal> section then introduces profile @0. It doesn't override any
+    sections (or add any) from the base section, hence it is immediately followed by another
+    <literal>.profile</literal> section that then introduces section @1. This profile overrides the kernel
+    command line. Finally, the last two sections define section @2, again overriding the command line. (Note
+    that in this example the first <literal>.cmdline</literal> could also moved behind the first
+    <literal>.profile</literal> with equivalent effect. To keep things nicely extensible, it's probably a
+    good idea to keep the generic command line in the base section instead of profile 0, in case later added
+    profiles might want to reuse it.)</para>
+
+    <para>The profile to boot may be controlled via the UKI's own command line: if the first argument starts
+    with <literal>@</literal>, followed by a positive integer number in decimal, it selects the profile to
+    boot into. If the first argument is not specified like that, the UKI will automatically boot into profile
+    0.</para>
+
+    <para>A <literal>.profile</literal> section may contain meta-information about the profile. It follows a
+    similar format as <literal>.osrel</literal> (i.e. an environment-variable-assignment-block-like list of
+    newline separated strings). Currently two fields are defined: <literal>ID=</literal> is supposed to carry
+    a short identifying string that identifies the profile
+    (e.g. <literal>ID=factory-reset</literal>). <literal>TITLE=</literal> should contain a human readable
+    string that may appear in the boot menu entry for this profile (e.g. <literal>TITLE='Factory Reset this
+    Device'</literal>).</para>
+  </refsect1>
+
   <refsect1>
     <title>TPM PCR Notes</title>
 
     <para>Note that when a unified kernel using <command>systemd-stub</command> is invoked the firmware will
     measure it as a whole to TPM PCR 4, covering all embedded resources, such as the stub code itself, the
-    core kernel, the embedded initrd and kernel command line (see above for a full list).</para>
+    core kernel, the embedded initrd and kernel command line (see above for a full list), including all UKI
+    profiles.</para>
 
     <para>Also note that the Linux kernel will measure all initrds it receives into TPM PCR 9. This means
-    every type of initrd will be measured two or three times: the initrds embedded in the kernel image will be
+    every type of initrd (of the selected UKI profile) will possibly be measured two or three times: the
-    measured to PCR 4, PCR 9 and PCR 11; the initrd synthesized from credentials (and the one synthesized
+    initrds embedded in the kernel image will be measured to PCR 4, PCR 9 and PCR 11; the initrd synthesized
-    from configuration extensions) will be measured to both PCR 9 and PCR 12; the initrd synthesized from
+    from credentials (and the one synthesized from configuration extensions) will be measured to both PCR 9
-    system extensions will be measured to both PCR 4 and PCR 9. Let's summarize the OS resources and the PCRs
+    and PCR 12; the initrd synthesized from system extensions will be measured to both PCR 4 and PCR 9. Let's
-    they are measured to:</para>
+    summarize the OS resources and the PCRs they are measured to:</para>
 
     <table>
       <title>OS Resource PCR Summary</title>
@@ -321,6 +438,11 @@
             <entry>Configuration Extensions (synthesized initrd from companion files)</entry>
             <entry>9 + 12</entry>
           </row>
+
+          <row>
+            <entry>Selected profile unless zero</entry>
+            <entry>12</entry>
+          </row>
         </tbody>
       </tgroup>
     </table>
@@ -337,12 +459,16 @@
       <varlistentry>
         <term><varname>LoaderDevicePartUUID</varname></term>
 
-        <listitem><para>Contains the partition UUID of the EFI System Partition the EFI image was run
+        <listitem><para>Contains the partition UUID of the partition the boot loader has been started from on
-        from. <citerefentry><refentrytitle>systemd-gpt-auto-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+        the current boot (usually a EFI System Partition). If already set by the boot loader, this will
+        remain untouched by <command>systemd-stub</command>. If not set yet, this will be set to the
+        partition UUID of the partition the unified kernel is started from, in order to support systems that
+        directly boot into a unified kernel image, bypassing any boot loader.
+        <citerefentry><refentrytitle>systemd-gpt-auto-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>
         uses this information to automatically find the disk booted from, in order to discover various other
         partitions on the same disk automatically.</para>
 
-        <xi:include href="version-info.xml" xpointer="v250"/></listitem>
+        <xi:include href="version-info.xml" xpointer="v224"/></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -359,12 +485,27 @@
       <varlistentry>
         <term><varname>LoaderImageIdentifier</varname></term>
 
-        <listitem><para>The path of EFI executable, relative to the EFI System Partition's root
+        <listitem><para>The file system path to the EFI executable of the boot loader for the current boot,
-        directory. Use
+        relative to the partition's root directory (i.e. relative to the partition indicated by
+        <varname>LoaderDevicePartUUID</varname>, see above). If not set yet, this will be set to the file
+        system path of the EFI executable of the booted unified kernel, in order to support systems that
+        directly boot into a unified kernel image, bypassing any boot loader.  Use
         <citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> to view
         this data.</para>
 
-        <xi:include href="version-info.xml" xpointer="v250"/></listitem>
+        <xi:include href="version-info.xml" xpointer="v237"/></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>StubDevicePartUUID</varname></term>
+        <term><varname>StubImageIdentifier</varname></term>
+
+        <listitem><para>Similar to <varname>LoaderDevicePartUUID</varname> and
+        <varname>StubImageIdentifier</varname>, but indicates the location of the unified kernel image EFI
+        binary rather than the location of the boot loader binary, regardless if booted via a boot loader
+        or not.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -419,6 +560,16 @@
 
         <xi:include href="version-info.xml" xpointer="v255"/></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><varname>StubProfile</varname></term>
+
+        <listitem><para>The numeric index of the selected profile, without the <literal>@</literal>,
+        formatted as decimal string. Set both on single-profile and multi-profile UKIs. (In the former case
+        this variable will be set to <literal>0</literal> unconditionally.)</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
     </variablelist>
 
     <para>Note that some of the variables above may also be set by the boot loader. The stub will only set
@@ -490,13 +641,22 @@
       </varlistentry>
 
       <varlistentry>
-        <term><filename>/.extra/tpm2-pcr-pkey.pem</filename></term>
+        <term><filename>/.extra/tpm2-pcr-public-key.pem</filename></term>
         <listitem><para>The PEM public key included in the <literal>.pcrpkey</literal> PE section of the
         unified kernel image is copied into the <filename>/.extra/tpm2-pcr-public-key.pem</filename> file in
         the initrd execution environment.</para>
 
         <xi:include href="version-info.xml" xpointer="v252"/></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><filename>/.extra/profile</filename></term>
+        <term><filename>/.extra/os-release</filename></term>
+        <listitem><para>The contents of the <literal>.profile</literal> and <literal>.osrel</literal>
+        sections of the selected profile, if any.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
     </variablelist>
 
     <para>Note that all these files are located in the <literal>tmpfs</literal> file system the kernel sets

man/systemd-system.conf.xml

@@ -474,10 +474,12 @@
         <term><varname>ManagerEnvironment=</varname></term>
 
         <listitem><para>Takes the same arguments as <varname>DefaultEnvironment=</varname>, see above. Sets
-        environment variables just for the manager process itself. In contrast to user managers, these variables
+        environment variables for the manager process itself. These variables are inherited by processes
-        are not inherited by processes spawned by the system manager, use <varname>DefaultEnvironment=</varname>
+        spawned by user managers, but not the system manager - use <varname>DefaultEnvironment=</varname>
         for that. Note that these variables are merged into the existing environment block. In particular, in
-        case of the system manager, this includes variables set by the kernel based on the kernel command line.</para>
+        case of the system manager, this includes variables set by the kernel based on the kernel command line.
+        As with <varname>DefaultEnvironment=</varname>, this environment block is internal, and changes are not
+        reflected in the manager's <filename>/proc/PID/environ</filename>.</para>
 
         <para>Setting environment variables for the manager process may be useful to modify its behaviour.
         See <ulink url="https://systemd.io/ENVIRONMENT">Known Environment Variables</ulink> for a

man/systemd-sysupdate.xml

@@ -257,9 +257,9 @@
         <term><option>--instances-max=</option></term>
         <term><option>-m</option></term>
 
-        <listitem><para>Takes a decimal integer greater than or equal to 2. Controls how many versions to
+        <listitem><para>Takes a decimal integer greater than or equal to 2 while updating or 1 while vacuuming.
-        keep at any time. This option may also be configured inside the transfer files, via the
+        Controls how many versions to keep at any time. This option may also be configured inside the transfer
-        <varname>InstancesMax=</varname> setting, see
+        files, via the <varname>InstancesMax=</varname> setting, see
         <citerefentry><refentrytitle>sysupdate.d</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
         details.</para>
 
@@ -295,6 +295,25 @@
         <xi:include href="version-info.xml" xpointer="v251"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--offline</option></term>
+
+        <listitem><para>Prevents fetching metadata from the network (i.e. <filename>SHA256SUMS</filename>).
+        This is most useful when used in combination with the <command>list</command> command, to query
+        locally installed versions.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--transfer-source=</option></term>
+
+        <listitem><para>Takes a path as its argument. When specified, all transfer sources configured with
+        <varname>PathRelativeTo=explicit</varname> will be interpreted relative to the specified path.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
       <xi:include href="standard-options.xml" xpointer="no-pager" />
       <xi:include href="standard-options.xml" xpointer="no-legend" />
       <xi:include href="standard-options.xml" xpointer="json" />
@@ -312,6 +331,7 @@
     <para><simplelist type="inline">
       <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>sysupdate.d</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-sysupdated.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>systemd-repart</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
     </simplelist></para>
   </refsect1>

man/systemd-sysupdated.service.xml

@@ -0,0 +1,55 @@
+<?xml version='1.0'?> <!--*-nxml-*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
+
+<refentry id="systemd-sysupdated.service" conditional='ENABLE_SYSUPDATE'>
+
+  <refentryinfo>
+    <title>systemd-sysupdated.service</title>
+    <productname>systemd</productname>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>systemd-sysupdated.service</refentrytitle>
+    <manvolnum>8</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>systemd-sysupdated.service</refname>
+    <refname>systemd-sysupdated</refname>
+    <refpurpose>System Update Service</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <para><filename>systemd-sysupdated.service</filename></para>
+    <para><filename>/usr/lib/systemd/systemd-sysupdated</filename></para>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para><command>systemd-sysupdated</command> is a system service that allows unprivileged
+    clients to update the system. It works by scanning the system for updateable "targets" (i.e.
+    portable services, sysexts, sysupdate components, etc.) and exposing them on the bus. Each
+    target then has methods that translate directly into invocations of
+    <citerefentry><refentrytitle>systemd-sysupdate</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
+    </para>
+
+    <para>See
+    <citerefentry><refentrytitle>org.freedesktop.sysupdate1</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+    and
+    <citerefentry><refentrytitle>org.freedesktop.LogControl1</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+    for a description of the D-Bus API.</para>
+  </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para>
+      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>systemd-sysupdate</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+      <citerefentry><refentrytitle>updatectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+    </para>
+  </refsect1>
+
+</refentry>

man/systemd-sysusers.xml

@@ -42,15 +42,15 @@
 
     <para>If invoked with no arguments, directives from the configuration files found in the directories
     specified by
-    <citerefentry><refentrytitle>sysusers.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>. When
+    <citerefentry><refentrytitle>sysusers.d</refentrytitle><manvolnum>5</manvolnum></citerefentry> are
-    invoked with positional arguments, if option <option>--replace=<replaceable>PATH</replaceable></option>
+    executed. When invoked with positional arguments, if option
-    is specified, arguments specified on the command line are used instead of the configuration file
+    <option>--replace=<replaceable>PATH</replaceable></option> is specified, arguments specified on the
-    <replaceable>PATH</replaceable>. Otherwise, just the configuration specified by the command line
+    command line are used instead of the configuration file <replaceable>PATH</replaceable>. Otherwise, just
-    arguments is executed. If the string <literal>-</literal> is specified instead of a filename, the
+    the configuration specified by the command line arguments is executed. If the string <literal>-</literal>
-    configuration is read from standard input. If the argument is a file name (without any slashes), all
+    is specified instead of a filename, the configuration is read from standard input. If the argument is a
-    configuration directories are searched for a matching file and the file found that has the highest
+    file name (without any slashes), all configuration directories are searched for a matching file and the
-    priority is executed. If the argument is a path, that file is used directly without searching the
+    file found that has the highest priority is executed. If the argument is a path, that file is used
-    configuration directories for any other matching file.</para>
+    directly without searching the configuration directories for any other matching file.</para>
   </refsect1>
 
   <refsect1>

man/systemd-tmpfiles.xml

@@ -65,15 +65,15 @@
 
     <para>If invoked with no arguments, directives from the configuration files found in the directories
     specified by
-    <citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>. When
+    <citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry> are
-    invoked with positional arguments, if option <option>--replace=<replaceable>PATH</replaceable></option>
+    executed. When invoked with positional arguments, if option
-    is specified, arguments specified on the command line are used instead of the configuration file
+    <option>--replace=<replaceable>PATH</replaceable></option> is specified, arguments specified on the
-    <replaceable>PATH</replaceable>. Otherwise, just the configuration specified by the command line
+    command line are used instead of the configuration file <replaceable>PATH</replaceable>. Otherwise, just
-    arguments is executed. If the string <literal>-</literal> is specified instead of a filename, the
+    the configuration specified by the command line arguments is executed. If the string <literal>-</literal>
-    configuration is read from standard input. If the argument is a file name (without any slashes), all
+    is specified instead of a filename, the configuration is read from standard input. If the argument is a
-    configuration directories are searched for a matching file and the file found that has the highest
+    file name (without any slashes), all configuration directories are searched for a matching file and the
-    priority is executed. If the argument is a path, that file is used directly without searching the
+    file found that has the highest priority is executed. If the argument is a path, that file is used
-    configuration directories for any other matching file.</para>
+    directly without searching the configuration directories for any other matching file.</para>
 
     <para>System services (<filename>systemd-tmpfiles-setup.service</filename>,
     <filename>systemd-tmpfiles-setup-dev-early.service</filename>,
@@ -152,10 +152,11 @@
       <varlistentry>
         <term><option>--purge</option></term>
 
-        <listitem><para>If this option is passed, all files and directories marked for
+        <listitem><para>If this option is passed, all files and directories declared for
-        <emphasis>creation</emphasis> by the <filename>tmpfiles.d/</filename> files specified on the command
+        <emphasis>creation</emphasis> and marked with the <literal>$</literal> character by the
-        line will be <emphasis>deleted</emphasis>. Specifically, this acts on all files and directories
+        <filename>tmpfiles.d/</filename> files specified on the command line will be
-        marked with <varname>f</varname>, <varname>F</varname>, <varname>d</varname>, <varname>D</varname>,
+        <emphasis>deleted</emphasis>. Specifically, this acts on all files and directories marked with
+        <varname>f</varname>, <varname>F</varname>, <varname>d</varname>, <varname>D</varname>,
         <varname>v</varname>, <varname>q</varname>, <varname>Q</varname>, <varname>p</varname>,
         <varname>L</varname>, <varname>c</varname>, <varname>b</varname>, <varname>C</varname>,
         <varname>w</varname>, <varname>e</varname>. If this switch is used at least one

man/systemd.exec.xml

@@ -366,6 +366,23 @@
         <xi:include href="version-info.xml" xpointer="v233"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>BindLogSockets=</varname></term>
+
+        <listitem><para>Takes a boolean argument. If true, sockets from <citerefentry>
+        <refentrytitle>systemd-journald.socket</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+        will be bind mounted into the mount namespace. This is particularly useful when a different instance
+        of <filename>/run/</filename> is employed, to make sure processes running in the namespace
+        can still make use of <citerefentry><refentrytitle>sd-journal</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
+        </para>
+
+        <para>This option is implied when <varname>LogNamespace=</varname> is used,
+        when <varname>MountAPIVFS=yes</varname>, or when <varname>PrivateDevices=yes</varname> is used
+        in conjunction with either <varname>RootDirectory=</varname> or <varname>RootImage=</varname>.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>ProtectProc=</varname></term>
 
@@ -1949,18 +1966,29 @@ BindReadOnlyPaths=/var/lib/systemd</programlisting>
       <varlistentry>
         <term><varname>PrivateUsers=</varname></term>
 
-        <listitem><para>Takes a boolean argument. If true, sets up a new user namespace for the executed processes and
+        <listitem><para>Takes a boolean argument or one of <literal>self</literal> or
-        configures a minimal user and group mapping, that maps the <literal>root</literal> user and group as well as
+        <literal>identity</literal>. Defaults to off. If enabled, sets up a new user namespace for the
-        the unit's own user and group to themselves and everything else to the <literal>nobody</literal> user and
+        executed processes and configures a user and group mapping. If set to a true value or
-        group. This is useful to securely detach the user and group databases used by the unit from the rest of the
+        <literal>self</literal>, a minimal user and group mapping is configured that maps the
-        system, and thus to create an effective sandbox environment. All files, directories, processes, IPC objects and
+        <literal>root</literal> user and group as well as the unit's own user and group to themselves and
-        other resources owned by users/groups not equaling <literal>root</literal> or the unit's own will stay visible
+        everything else to the <literal>nobody</literal> user and group. This is useful to securely detach
-        from within the unit but appear owned by the <literal>nobody</literal> user and group. If this mode is enabled,
+        the user and group databases used by the unit from the rest of the system, and thus to create an
-        all unit processes are run without privileges in the host user namespace (regardless if the unit's own
+        effective sandbox environment. All files, directories, processes, IPC objects and other resources
-        user/group is <literal>root</literal> or not). Specifically this means that the process will have zero process
+        owned by users/groups not equaling <literal>root</literal> or the unit's own will stay visible from
-        capabilities on the host's user namespace, but full capabilities within the service's user namespace. Settings
+        within the unit but appear owned by the <literal>nobody</literal> user and group. </para>
-        such as <varname>CapabilityBoundingSet=</varname> will affect only the latter, and there's no way to acquire
+
-        additional capabilities in the host's user namespace. Defaults to off.</para>
+        <para>If the parameter is <literal>identity</literal>, user namespacing is set up with an identity
+        mapping for the first 65536 UIDs/GIDs. Any UIDs/GIDs above 65536 will be mapped to the
+        <literal>nobody</literal> user and group, respectively. While this does not provide UID/GID isolation,
+        since all UIDs/GIDs are chosen identically it does provide process capability isolation, and hence is
+        often a good choice if proper user namespacing with distinct UID maps is not appropriate.</para>
+
+        <para>If this mode is enabled, all unit processes are run without privileges in the host user
+        namespace (regardless if the unit's own user/group is <literal>root</literal> or not). Specifically
+        this means that the process will have zero process capabilities on the host's user namespace, but
+        full capabilities within the service's user namespace. Settings such as
+        <varname>CapabilityBoundingSet=</varname> will affect only the latter, and there's no way to acquire
+        additional capabilities in the host's user namespace.</para>
 
         <para>When this setting is set up by a per-user instance of the service manager, the mapping of the
         <literal>root</literal> user and group to itself is omitted (unless the user manager is root).
@@ -2973,7 +3001,12 @@ SystemCallErrorNumber=EPERM</programlisting>
 
         <para><option>tty</option> connects standard output to a tty (as configured via <varname>TTYPath=</varname>,
         see below). If the TTY is used for output only, the executed process will not become the controlling process of
-        the terminal, and will not fail or wait for other processes to release the terminal.</para>
+        the terminal, and will not fail or wait for other processes to release the terminal. Note: if a unit
+        tries to print multiple lines to a TTY during bootup or shutdown, then there's a chance that those
+        lines will be broken up by status messages. <function>SetShowStatus()</function> can be used to
+        prevent this problem. See
+        <citerefentry project="man-pages"><refentrytitle>org.freedesktop.systemd1</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+        for details.</para>
 
         <para><option>journal</option> connects standard output with the journal, which is accessible via
         <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>. Note
@@ -3322,7 +3355,8 @@ StandardInputData=V2XigLJyZSBubyBzdHJhbmdlcnMgdG8gbG92ZQpZb3Uga25vdyB0aGUgcnVsZX
         <term><varname>TTYReset=</varname></term>
 
         <listitem><para>Reset the terminal device specified with <varname>TTYPath=</varname> before and after
-        execution. Defaults to <literal>no</literal>.</para></listitem>
+        execution. This does not erase the screen (see <varname>TTYVTDisallocate=</varname> below for
+        that). Defaults to <literal>no</literal>.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -3333,11 +3367,12 @@ StandardInputData=V2XigLJyZSBubyBzdHJhbmdlcnMgdG8gbG92ZQpZb3Uga25vdyB0aGUgcnVsZX
       </varlistentry>
 
       <varlistentry>
-        <term><varname>TTYRows=</varname></term>
         <term><varname>TTYColumns=</varname></term>
+        <term><varname>TTYRows=</varname></term>
 
         <listitem><para>Configure the size of the TTY specified with <varname>TTYPath=</varname>. If unset or
-        set to the empty string, the kernel default is used.</para>
+        set to the empty string, it is attempted to retrieve the dimensions of the terminal screen via ANSI
+        sequences, and if that fails the kernel defaults (typically 80x24) are used.</para>
 
         <xi:include href="version-info.xml" xpointer="v250"/></listitem>
       </varlistentry>
@@ -3345,9 +3380,10 @@ StandardInputData=V2XigLJyZSBubyBzdHJhbmdlcnMgdG8gbG92ZQpZb3Uga25vdyB0aGUgcnVsZX
       <varlistentry>
         <term><varname>TTYVTDisallocate=</varname></term>
 
-        <listitem><para>If the terminal device specified with <varname>TTYPath=</varname> is a virtual console
+        <listitem><para>If the terminal device specified with <varname>TTYPath=</varname> is a virtual
-        terminal, try to deallocate the TTY before and after execution. This ensures that the screen and scrollback
+        console terminal, try to deallocate the TTY before and after execution. This ensures that the screen
-        buffer is cleared. Defaults to <literal>no</literal>.</para></listitem>
+        and scrollback buffer is cleared. If the terminal device is of any other type of TTY an attempt is
+        made to clear the screen via ANSI sequences. Defaults to <literal>no</literal>.</para></listitem>
       </varlistentry>
     </variablelist>
   </refsect1>
@@ -3517,6 +3553,18 @@ StandardInputData=V2XigLJyZSBubyBzdHJhbmdlcnMgdG8gbG92ZQpZb3Uga25vdyB0aGUgcnVsZX
         <literal>[]</literal> wildcards are not permitted, nor are <literal>*</literal> wildcards anywhere
         except at the end of the glob expression.</para>
 
+        <para>Optionally, the credential name or glob may be followed by a colon followed by a rename pattern.
+        If specified, all credentials matching the credential name or glob are renamed according to the given
+        pattern. For example, if <literal>ImportCredential=my.original.cred:my.renamed.cred</literal> is
+        specified, the service manager will read the <literal>my.original.cred</literal> credential and make
+        it available as the <literal>my.renamed.cred</literal> credential to the service. Similarly, if
+        <literal>ImportCredential=my.original.*:my.renamed.</literal> is specified, the service manager will
+        read all credentials starting with <literal>my.original.</literal> and make them available as
+        <literal>my.renamed.xxx</literal> to the service.</para>
+
+        <para>If <varname>ImportCredential=</varname> is specified multiple times and multiple credentials
+        end up with the same name after renaming, the first one is kept and later ones are dropped.</para>.
+
         <para>When multiple credentials of the same name are found, credentials found by
         <varname>LoadCredential=</varname> and <varname>LoadCredentialEncrypted=</varname> take priority over
         credentials found by <varname>ImportCredential=</varname>.</para>
@@ -4169,6 +4217,18 @@ StandardInputData=V2XigLJyZSBubyBzdHJhbmdlcnMgdG8gbG92ZQpZb3Uga25vdyB0aGUgcnVsZX
           <xi:include href="version-info.xml" xpointer="v254"/></listitem>
         </varlistentry>
 
+        <varlistentry>
+          <term><varname>$DEBUG_INVOCATION</varname></term>
+
+          <listitem><para>If <varname>RestartMode=debug</varname> is set, and a previous attempt at starting
+          the unit failed, this variable will be passed to the service to indicate that additional logging
+          should be enabled at startup. See
+          <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+          for more details.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+        </varlistentry>
+
       </variablelist>
 
       <para>For system services, when <varname>PAMName=</varname> is enabled and <command>pam_systemd</command> is part

man/systemd.mount.xml

@@ -216,6 +216,17 @@
         <xi:include href="version-info.xml" xpointer="v220"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>x-systemd.wants=</option></term>
+
+        <listitem><para>Configures a <varname>Wants=</varname> and
+        an <varname>After=</varname> dependency between the created
+        mount unit and another systemd unit, similar to the
+        <varname>x-systemd.requires=</varname> option.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><option>x-systemd.before=</option></term>
         <term><option>x-systemd.after=</option></term>

man/systemd.net-naming-scheme.xml

@@ -135,12 +135,10 @@
         </varlistentry>
 
         <varlistentry>
-          <term><varname>ID_NET_LABEL_ONBOARD=</varname><replaceable>prefix</replaceable> <replaceable>label</replaceable></term>
+          <term><varname>ID_NET_LABEL_ONBOARD=</varname><replaceable>label</replaceable></term>
 
           <listitem><para>This property is set based on textual label given by the firmware for on-board
-          devices. The name consists of the prefix concatenated with the label. This is only available for
+          devices. This is only available for PCI devices.</para>
-          PCI devices.
-          </para>
 
           <xi:include href="version-info.xml" xpointer="v243"/>
           </listitem>
@@ -478,7 +476,8 @@
           bridge as that would create naming conflict when there are more child devices on that bridge. Now,
           this is relaxed and we will use slot information to generate the name based on it but only if
           the PCI device has multiple functions. This is safe because distinct function number is a part of
-          the device name for multifunction devices.</para>
+          the device name for multifunction devices. Note, this is reverted in <constant>v255</constant>.
+          See below.</para>
 
           <xi:include href="version-info.xml" xpointer="v251"/>
           </listitem>
@@ -521,10 +520,24 @@
           <listitem><para>Naming was changed for SR-IOV virtual device representors to enable the
           change introduced in <constant>v254</constant> by default.</para>
 
+          <para>If we detect that a PCI device associated with a slot is a PCI bridge, we no longer set
+          <varname>ID_NET_NAME_SLOT</varname>, reverting a change that was introduced in v251.</para>
+
           <xi:include href="version-info.xml" xpointer="v255"/>
           </listitem>
         </varlistentry>
 
+        <varlistentry>
+          <term><constant>v257</constant></term>
+
+          <listitem><para>PCI slot number is now read from <constant>firmware_node/sun</constant> sysfs file.</para>
+
+          <para>The naming scheme based on devicetree aliases was extended to support aliases for individual
+          interfaces of controllers with multiple ports.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+          </listitem>
+        </varlistentry>
       </variablelist>
 
     <para>Note that <constant>latest</constant> may be used to denote the latest scheme known (to this
@@ -597,7 +610,7 @@ ID_NET_NAME_ONBOARD_LABEL=Ethernet Port 1
     </example>
 
     <example>
-      <title>PCI Ethernet card in hotplug slot with firmware index number</title>
+      <title>PCI Ethernet card in slot with firmware index number</title>
 
       <programlisting># /sys/devices/pci0000:00/0000:00:1c.3/0000:05:00.0/net/ens1
 ID_NET_NAME_MAC=enx000000000466

man/systemd.netdev.xml

@@ -440,6 +440,16 @@
           <xi:include href="version-info.xml" xpointer="v243"/>
         </listitem>
       </varlistentry>
+      <varlistentry>
+        <term><varname>FDBMaxLearned=</varname></term>
+        <listitem>
+          <para>Specifies the maximum number of learned Ethernet addresses for the bridge. When the limit is
+          reached, no more addresses are learned. When unset, the kernel's default will be used. 0 disables the limit.
+          </para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 
@@ -1007,6 +1017,17 @@
         <xi:include href="version-info.xml" xpointer="v247"/>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><varname>MinSourcePort=</varname></term>
+        <listitem>
+          <para>Specifies the lowest value of the UDP tunnel source UDP port (in range 1…65535).
+          Defaults to unset.</para>
+
+        <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
     </variablelist>
   </refsect1>
 
@@ -2005,6 +2026,19 @@
         <xi:include href="version-info.xml" xpointer="v237"/>
         </listitem>
       </varlistentry>
+      <varlistentry>
+        <term><varname>PublicKeyFile=</varname></term>
+        <listitem>
+          <para>Takes an absolute path to a file which contains the Base64 encoded public key for the peer.
+          When this option is specified, then <varname>PublicKey=</varname> will be ignored. Note that the
+          file must be readable by the user <literal>systemd-network</literal>, so it should be, e.g., owned
+          by <literal>root:systemd-network</literal> with a <literal>0640</literal> file mode. If the path
+          refers to an <constant>AF_UNIX</constant> stream socket in the file system a connection is made to
+          it and the key read from it.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
       <varlistentry>
         <term><varname>PresharedKey=</varname></term>
         <listitem>

man/systemd.network.xml

@@ -188,8 +188,9 @@
       <varlistentry>
         <term><varname>ARP=</varname></term>
         <listitem>
-          <para>Takes a boolean. If set to true, the ARP (low-level Address Resolution Protocol)
+          <para>Takes a boolean. If set to true, the IPv4 ARP (low-level Address Resolution Protocol)
-          for this interface is enabled. When unset, the kernel's default will be used.</para>
+          and IPv6 NDP (Neighbor Discovery Protocol) for this interface are enabled. When unset, the
+          kernel's default will be used.</para>
           <para> For example, disabling ARP is useful when creating multiple MACVLAN or VLAN virtual
           interfaces atop a single lower-level physical interface, which will then only serve as a
           link/"bridge" device aggregating traffic to the same physical link and not participate in
@@ -708,6 +709,14 @@ Table=1234</programlisting></para>
           number of dynamically created network interfaces with the same network configuration and
           automatic address range assignment.</para>
 
+          <para>If an IPv4 link-local address (169.254.0.0/16) is specified, IPv4 Address Conflict
+          Detection (<ulink url="https://tools.ietf.org/html/rfc5227">RFC 5227</ulink>) is enabled for the
+          address. To assign an IPv4 link-local address without IPv4 Address Conflict Detection, please use
+          [Address] section to configure the address and disable <varname>DuplicateAddressDetection=</varname>.
+          <programlisting>[Address]
+Address=169.254.10.1/24
+DuplicateAddressDetection=none</programlisting></para>
+
           <para>If an empty string is specified, then the all previous assignments in both [Network] and
           [Address] sections are cleared.</para>
 
@@ -845,7 +854,7 @@ Table=1234</programlisting></para>
       <varlistentry>
         <term><varname>IPv6Forwarding=</varname></term>
         <listitem>
-          <para>Configures IPv6 packet forwarding for the interface. Takes a boolean value. This controls the
+          <para>Configures interface-specific host/router behaviour. Takes a boolean value. This controls the
           <filename>net.ipv6.conf.<replaceable>INTERFACE</replaceable>.forwarding</filename> sysctl option of
           the network interface. See
           <ulink url="https://docs.kernel.org/networking/ip-sysctl.html">IP Sysctl</ulink>
@@ -859,6 +868,14 @@ Table=1234</programlisting></para>
           <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
           </para>
 
+          <para>Note, unlike <varname>IPv4Forwarding=</varname>, enabling per-interface
+          <varname>IPv6Forwarding=</varname> on two or more interfaces <emphasis>DOES NOT</emphasis> make IPv6
+          packets forwarded within the interfaces. This setting just controls the per-interface sysctl value,
+          and the sysctl value is not directly correlated to whether packets are forwarded. To ensure IPv6
+          packets forwarded, the global setting in
+          <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+          needs to be enabled.</para>
+
           <xi:include href="version-info.xml" xpointer="v256"/>
         </listitem>
       </varlistentry>
@@ -872,15 +889,15 @@ Table=1234</programlisting></para>
           <literal>ipv6</literal>, <literal>both</literal>, or <literal>no</literal>. Defaults to
           <literal>no</literal>. Note. Any positive boolean values such as <literal>yes</literal> or
           <literal>true</literal> are now deprecated. Please use one of the values above. Specifying
-          <literal>ipv4</literal> or <literal>both</literal> implies <varname>IPv4Forwarding=</varname>,
+          <literal>ipv4</literal> or <literal>both</literal> implies <varname>IPv4Forwarding=</varname>
-          unless it is explicitly specified. Similarly for <varname>IPv6Forwarding=</varname> when
+          settings in both .network file for this interface and the global
-          <literal>ipv6</literal> or <literal>both</literal> is specified. These implications are only on
+          <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-          this interface. Hence, to make the IP packet forwarding works,
+          unless they are explicitly specified. Similarly for <varname>IPv6Forwarding=</varname> when
-          <varname>IPv4Forwarding=</varname>/<varname>IPv6Forwarding=</varname> need to be enabled on an
+          <literal>ipv6</literal> or <literal>both</literal> is specified. See
-          upstream interface, or globally enabled by specifying them in
+          <varname>IPv4Forwarding=</varname>/<varname>IPv6Forwarding=</varname> in the above for the per-link
-          <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+          settings, and
-          See <varname>IPv4Forwarding=</varname>/<varname>IPv6Forwarding=</varname> in the above for more
+          <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-          details.</para>
+          for the global settings.</para>
 
           <xi:include href="version-info.xml" xpointer="v219"/>
         </listitem>
@@ -1191,6 +1208,18 @@ Table=1234</programlisting></para>
           carrier. Defaults to false. If enabled, and the <varname>IgnoreCarrierLoss=</varname> setting
           is not explicitly set, then it is enabled as well.</para>
 
+          <para>With this enabled, to make the interface enter the <literal>configured</literal> state,
+          which is required to make <command>systemd-networkd-wait-online</command> work properly for the
+          interface, all dynamic address configuration mechanisms like <varname>DHCP=</varname> and
+          <varname>IPv6AcceptRA=</varname> (which is enabled by default in most cases) need to be disabled.
+          Also, <varname>DuplicateAddressDetection=</varname> (which is enabled by default for IPv4
+          link-local addresses and all IPv6 addresses) needs to be disabled for all static address
+          configurations. Otherwise, without carrier, the interface will be stuck in the
+          <literal>configuring</literal> state, and <command>systemd-networkd-wait-online</command> for the
+          interface will timeout. Also, it is recommended to set
+          <varname>RequiredForOnline=no-carrier</varname> to make
+          <command>systemd-networkd-wait-online</command> work for the interface.</para>
+
           <xi:include href="version-info.xml" xpointer="v235"/>
         </listitem>
       </varlistentry>
@@ -1366,10 +1395,10 @@ Table=1234</programlisting></para>
           Detection. See <ulink url="https://tools.ietf.org/html/rfc5227">RFC 5227</ulink>.
           When <literal>ipv6</literal>, performs IPv6 Duplicate Address Detection. See
           <ulink url="https://tools.ietf.org/html/rfc4862">RFC 4862</ulink>. Defaults to
-          <literal>ipv4</literal> for IPv4 link-local addresses, <literal>ipv6</literal> for IPv6
+          <literal>ipv4</literal> for IPv4 link-local addresses (169.254.0.0/16), <literal>ipv6</literal>
-          addresses, and <literal>none</literal> otherwise.</para>
+          for IPv6 addresses, and <literal>none</literal> otherwise.</para>
 
-        <xi:include href="version-info.xml" xpointer="v232"/>
+          <xi:include href="version-info.xml" xpointer="v232"/>
         </listitem>
       </varlistentry>
 
@@ -1600,8 +1629,8 @@ NFTSet=prefix:netdev:filter:eth_ipv4_prefix</programlisting>
       <varlistentry>
         <term><varname>Label=</varname></term>
         <listitem>
-          <para>The label for the prefix, an unsigned integer in the range 0…4294967294. 0xffffffff is
+          <para>The label for the prefix. Takes an unsigned integer in the range 0…4294967294 (0xfffffffe).
-          reserved. This setting is mandatory.</para>
+          4294967295 (0xffffffff) is reserved. This setting is mandatory.</para>
 
           <xi:include href="version-info.xml" xpointer="v234"/>
         </listitem>
@@ -1610,8 +1639,8 @@ NFTSet=prefix:netdev:filter:eth_ipv4_prefix</programlisting>
       <varlistentry>
         <term><varname>Prefix=</varname></term>
         <listitem>
-          <para>IPv6 prefix is an address with a prefix length, separated by a slash
+          <para>Takes an IPv6 address with a prefix length, separated by a slash
-          <literal>/</literal> character. This setting is mandatory. </para>
+          <literal>/</literal> character. This setting is mandatory.</para>
 
           <xi:include href="version-info.xml" xpointer="v234"/>
         </listitem>
@@ -1682,7 +1711,8 @@ NFTSet=prefix:netdev:filter:eth_ipv4_prefix</programlisting>
           one of predefined names <literal>default</literal>, <literal>main</literal>, and
           <literal>local</literal>, and names defined in <varname>RouteTable=</varname> in
           <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-          or a number between 1 and 4294967295. Defaults to <literal>main</literal>.</para>
+          or a number between 1 and 4294967295. Defaults to <literal>main</literal>.
+          Ignored if <varname>L3MasterDevice=</varname> is true.</para>
 
           <xi:include href="version-info.xml" xpointer="v235"/>
         </listitem>
@@ -1699,6 +1729,18 @@ NFTSet=prefix:netdev:filter:eth_ipv4_prefix</programlisting>
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>GoTo=</varname></term>
+        <listitem>
+          <para>Specifies the target priority used by <literal>goto</literal> type of rule. Takes an integer
+          in the range 1…4294967295. This must be larger than the priority of this rule specified in
+          <varname>Priority=</varname>. When specified, <varname>Type=goto</varname> is implied. This is
+          mandatory when <varname>Type=goto</varname>.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>IncomingInterface=</varname></term>
         <listitem>
@@ -1824,8 +1866,10 @@ NFTSet=prefix:netdev:filter:eth_ipv4_prefix</programlisting>
         <term><varname>Type=</varname></term>
         <listitem>
           <para>Specifies Routing Policy Database (RPDB) rule type. Takes one of
-          <literal>blackhole</literal>, <literal>unreachable</literal> or <literal>prohibit</literal>.
+          <literal>table</literal>, <literal>goto</literal>, <literal>nop</literal>,
-          </para>
+          <literal>blackhole</literal>, <literal>unreachable</literal>, or <literal>prohibit</literal>.
+          When <literal>goto</literal>, the target priority must be specified in <varname>GoTo=</varname>.
+          Defaults to <literal>table</literal>.</para>
 
           <xi:include href="version-info.xml" xpointer="v248"/>
         </listitem>
@@ -2053,7 +2097,7 @@ NFTSet=prefix:netdev:filter:eth_ipv4_prefix</programlisting>
           <command>ip route show table <replaceable>num</replaceable></command>. If unset and
           <varname>Type=</varname> is <literal>local</literal>, <literal>broadcast</literal>,
           <literal>anycast</literal>, or <literal>nat</literal>, then <literal>local</literal> is used.
-          In other cases, defaults to <literal>main</literal>. Ignored if <varname>L3MasterDevice=</varname> is true.</para>
+          In other cases, defaults to <literal>main</literal>.</para>
 
           <xi:include href="version-info.xml" xpointer="v230"/>
         </listitem>
@@ -2733,6 +2777,23 @@ NFTSet=prefix:netdev:filter:eth_ipv4_prefix</programlisting>
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>UnassignedSubnetPolicy=</varname></term>
+        <listitem>
+          <para>Takes <literal>none</literal>, or one of the reject types: <literal>unreachable</literal>,
+          <literal>prohibit</literal>, <literal>blackhole</literal>, or <literal>throw</literal>. If a reject
+          type is specified, the reject route corresponding to the acquired 6RD prefix will be configured.
+          For example, when <literal>unreachable</literal>,
+          <programlisting>unreachable 2001:db8::/56 dev lo proto dhcp metric 1024 pref medium</programlisting>
+          will be configured. See <ulink url="https://datatracker.ietf.org/doc/html/rfc7084">RFC 7084</ulink>.
+          If <literal>none</literal> is specified, such route will not be configured. This may be useful when
+          custom firewall rules that handle packets for unassigned subnets will be configured.
+          Defaults to <literal>unreachable</literal>.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>IPv6OnlyMode=</varname></term>
         <listitem>
@@ -2973,6 +3034,23 @@ NFTSet=prefix:netdev:filter:eth_ipv4_prefix</programlisting>
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>UnassignedSubnetPolicy=</varname></term>
+        <listitem>
+          <para>Takes <literal>none</literal> or one of the reject types: <literal>unreachable</literal>,
+          <literal>prohibit</literal>, <literal>blackhole</literal>, or <literal>throw</literal>. If a reject
+          type is specified, the reject route corresponding to the delegated prefix will be configured.
+          For example, when <literal>unreachable</literal>,
+          <programlisting>unreachable 2001:db8::/56 dev lo proto dhcp metric 1024 pref medium</programlisting>
+          will be configured. See <ulink url="https://datatracker.ietf.org/doc/html/rfc7084">RFC 7084</ulink>.
+          If <literal>none</literal> is specified, such route will not be configured. This may be useful when
+          custom firewall rules that handle packets for unassigned subnets will be configured.
+          Defaults to <literal>unreachable</literal>.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>RapidCommit=</varname></term>
         <listitem>
@@ -4553,7 +4631,7 @@ ServerAddress=192.168.0.1/24</programlisting>
       <varlistentry>
         <term><varname>MulticastGroupAddress=</varname></term>
         <listitem>
-          <para>Specifies the IPv4 or IPv6 multicast group address to add. This setting is mandatory.</para>
+          <para>Specifies the IPv4, IPv6, or L2 MAC multicast group address to add. This setting is mandatory.</para>
 
           <xi:include href="version-info.xml" xpointer="v247"/>
         </listitem>
@@ -5987,6 +6065,26 @@ ServerAddress=192.168.0.1/24</programlisting>
     </variablelist>
   </refsect1>
 
+  <refsect1>
+    <title>[ClassfulMultiQueueing] Section Options</title>
+    <para>The [ClassfulMultiQueueing] section manages the queueing discipline (qdisc) of Classful Multi Queueing (mq).</para>
+
+    <variablelist class='network-directives'>
+      <xi:include href="tc.xml" xpointer="qdisc-parent" />
+      <xi:include href="tc.xml" xpointer="qdisc-handle" />
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
+    <title>[BandMultiQueueing] Section Options</title>
+    <para>The [BandMultiQueueing] section manages the queueing discipline (qdisc) of Band Multi Queueing (multiq).</para>
+
+    <variablelist class='network-directives'>
+      <xi:include href="tc.xml" xpointer="qdisc-parent" />
+      <xi:include href="tc.xml" xpointer="qdisc-handle" />
+    </variablelist>
+  </refsect1>
+
   <refsect1>
     <title>[HeavyHitterFilter] Section Options</title>
     <para>The [HeavyHitterFilter] section manages the queueing discipline (qdisc) of Heavy Hitter Filter

man/systemd.resource-control.xml

@@ -462,7 +462,8 @@ CPUWeight=20   DisableControllers=cpu              /          \
           <para>Specify the absolute limit on swap usage of the executed processes in this unit.</para>
 
           <para>Takes a swap size in bytes. If the value is suffixed with K, M, G or T, the specified swap size is
-          parsed as Kilobytes, Megabytes, Gigabytes, or Terabytes (with the base 1024), respectively. If assigned the
+          parsed as Kilobytes, Megabytes, Gigabytes, or Terabytes (with the base 1024), respectively. Alternatively, a
+          percentage value may be specified, which is taken relative to the specified swap size on the system. If assigned the
           special value <literal>infinity</literal>, no swap limit is applied. These settings control the
           <literal>memory.swap.max</literal> control group attribute. For details about this control group attribute,
           see <ulink url="https://docs.kernel.org/admin-guide/cgroup-v2.html#memory-interface-files">Memory Interface Files</ulink>.</para>

man/systemd.service.xml

@@ -162,11 +162,11 @@
 
           <itemizedlist>
             <listitem><para>If set to <option>simple</option> (the default if <varname>ExecStart=</varname>
-            is specified but neither <varname>Type=</varname> nor <varname>BusName=</varname> are), the
+            is specified but neither <varname>Type=</varname> nor <varname>BusName=</varname> are, and
-            service manager will consider the unit started immediately after the main service process has
+            credentials are not used), the service manager will consider the unit started immediately after
-            been forked off (i.e. immediately after <function>fork()</function>, and before various process
+            the main service process has been forked off (i.e. immediately after <function>fork()</function>,
-            attributes have been configured and in particular before the new process has called
+            and before various process attributes have been configured and in particular before the new process
-            <function>execve()</function> to invoke the actual service binary). Typically,
+            has called <function>execve()</function> to invoke the actual service binary). Typically,
             <varname>Type=</varname><option>exec</option> is the better choice, see below.</para>
 
             <para>It is expected that the process configured with <varname>ExecStart=</varname> is the main
@@ -188,7 +188,9 @@
             Note that this means <command>systemctl start</command> command lines for <option>exec</option>
             services will report failure when the service's binary cannot be invoked successfully (for
             example because the selected <varname>User=</varname> doesn't exist, or the service binary is
-            missing).</para></listitem>
+            missing). This type is implied if credentials are used (refer to <varname>LoadCredential=</varname>
+            in <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+            for details).</para></listitem>
 
             <listitem><para>If set to <option>forking</option>, the manager will consider the unit started
             immediately after the binary that forked off by the manager exits. <emphasis>The use of this type
@@ -622,6 +624,12 @@
         <citerefentry><refentrytitle>sd_notify</refentrytitle><manvolnum>3</manvolnum></citerefentry>).
         </para>
 
+        <para>Note that the start timeout is also applied to service reloads, regardless if implemented
+        through <varname>ExecReload=</varname> or via the reload logic enabled via <varname>Type=notify-reload</varname>.
+        If the reload does not complete within the configured time, the reload will be considered failed and
+        the service will continue running with the old configuration. This will not affect the running service,
+        but will be logged and will cause e.g. <command>systemctl reload</command> to fail.</para>
+
         <xi:include href="version-info.xml" xpointer="v188"/></listitem>
       </varlistentry>
 
@@ -727,8 +735,8 @@
         <listitem><para>Configures a maximum time for the service to run. If this is used and the service has been
         active for longer than the specified time it is terminated and put into a failure state. Note that this setting
         does not have any effect on <varname>Type=oneshot</varname> services, as they terminate immediately after
-        activation completed. Pass <literal>infinity</literal> (the default) to configure no runtime
+        activation completed (use <varname>TimeoutStartSec=</varname> to limit their activation).
-        limit.</para>
+        Pass <literal>infinity</literal> (the default) to configure no runtime limit.</para>
 
         <para>If a service of <varname>Type=notify</varname>/<varname>Type=notify-reload</varname> sends
         <literal>EXTEND_TIMEOUT_USEC=…</literal>, this may cause the runtime to be extended beyond
@@ -928,20 +936,40 @@
         <listitem>
           <para>Takes a string value that specifies how a service should restart:
             <itemizedlist>
-              <listitem><para>If set to <option>normal</option> (the default), the service restarts by
+              <listitem>
-              going through a failed/inactive state.</para></listitem>
+                <para>If set to <option>normal</option> (the default), the service restarts by going through
+                a failed/inactive state.</para>
 
-              <listitem><para>If set to <option>direct</option>, the service transitions to the activating
+                <xi:include href="version-info.xml" xpointer="v254"/>
-              state directly during auto-restart, skipping failed/inactive state.
+              </listitem>
-              <varname>ExecStopPost=</varname> is invoked.
+
-              <varname>OnSuccess=</varname> and <varname>OnFailure=</varname> are skipped.</para></listitem>
+              <listitem>
+                <para>If set to <option>direct</option>, the service transitions to the activating
+                state directly during auto-restart, skipping failed/inactive state.
+                <varname>ExecStopPost=</varname> is invoked.
+                <varname>OnSuccess=</varname> and <varname>OnFailure=</varname> are skipped.</para>
+
+                <para>This option is useful in cases where a dependency can fail temporarily but we don't
+                want these temporary failures to make the dependent units fail. Dependent units are not
+                notified of these temporary failures.</para>
+
+                <xi:include href="version-info.xml" xpointer="v254"/>
+              </listitem>
+
+              <listitem>
+                <para>If set to <option>debug</option>, the service manager will log messages that are
+                related to this unit at debug level while automated restarts are attempted, until either the
+                service hits the rate limit or it succeeds, and the <varname>$DEBUG_INVOCATION=1</varname>
+                environment variable will be set for the unit. This is useful to be able to get additional
+                information when a service fails to start, without needing to proactively or permanently
+                enable debug level logging in systemd, which is very verbose. This is otherwise equivalent
+                to <option>normal</option> mode.</para>
+
+                <xi:include href="version-info.xml" xpointer="v257"/>
+              </listitem>
             </itemizedlist>
           </para>
 
-          <para>This option is useful in cases where a dependency can fail temporarily
-          but we don't want these temporary failures to make the dependent units fail.
-          When this option is set to <option>direct</option>, dependent units are not notified of these temporary failures.</para>
-
           <xi:include href="version-info.xml" xpointer="v254"/>
         </listitem>
       </varlistentry>

man/systemd.socket.xml

@@ -853,18 +853,15 @@
 
       <varlistentry>
         <term><varname>FileDescriptorName=</varname></term>
-        <listitem><para>Assigns a name to all file descriptors this
+        <listitem><para>Assigns a name to all file descriptors this socket unit encapsulates.
-        socket unit encapsulates. This is useful to help activated
+        This is useful to help activated services identify specific file descriptors, if multiple fds are passed.
-        services identify specific file descriptors, if multiple fds
+        Services may use the
-        are passed. Services may use the
         <citerefentry><refentrytitle>sd_listen_fds_with_names</refentrytitle><manvolnum>3</manvolnum></citerefentry>
-        call to acquire the names configured for the received file
+        call to acquire the names configured for the received file descriptors. Names may contain any ASCII character,
-        descriptors. Names may contain any ASCII character, but must
+        but must exclude control characters and <literal>:</literal>, and must be at most 255 characters in length.
-        exclude control characters and <literal>:</literal>, and must
+        If this setting is not used, the file descriptor name defaults to the name of the socket unit
-        be at most 255 characters in length. If this setting is not
+        (including its <filename>.socket</filename> suffix) when <varname>Accept=no</varname>,
-        used, the file descriptor name defaults to the name of the
+        <literal>connection</literal> otherwise.</para>
-        socket unit, including its <filename>.socket</filename>
-        suffix.</para>
 
         <xi:include href="version-info.xml" xpointer="v227"/></listitem>
       </varlistentry>

man/systemd.system-credentials.xml

@@ -334,6 +334,27 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>shell.prompt.prefix</varname></term>
+        <term><varname>shell.prompt.suffix</varname></term>
+        <listitem>
+          <para>Defines strings to prefix and suffix any interactive UNIX shell prompt with. For details see
+          <citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>shell.welcome</varname></term>
+        <listitem>
+          <para>Define a string to print when an interactive UNIX shell initializes. For details see
+          <citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>system.machine_id</varname></term>
         <listitem>

man/systemd.unit.xml

@@ -173,13 +173,13 @@
     section. When the unit is enabled, symlinks will be created for those names, and removed when the unit is
     disabled. For example, <filename>reboot.target</filename> specifies
     <varname>Alias=ctrl-alt-del.target</varname>, so when enabled, the symlink
-    <filename>/etc/systemd/system/ctrl-alt-del.service</filename> pointing to the
+    <filename>/etc/systemd/system/ctrl-alt-del.target</filename> pointing to the
     <filename>reboot.target</filename> file will be created, and when
     <keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>Del</keycap></keycombo> is invoked,
-    <command>systemd</command> will look for the <filename>ctrl-alt-del.service</filename> and execute
+    <command>systemd</command> will look for <filename>ctrl-alt-del.target</filename>, follow the symlink to
-    <filename>reboot.service</filename>. <command>systemd</command> does not look at the [Install] section at
+    <filename>reboot.target</filename>, and execute <filename>reboot.service</filename> as part of that target.
-    all during normal operation, so any directives in that section only have an effect through the symlinks
+    <command>systemd</command> does not look at the [Install] section at all during normal operation, so any
-    created during enablement.</para>
+    directives in that section only have an effect through the symlinks created during enablement.</para>
 
     <para>Along with a unit file <filename>foo.service</filename>, the directory
     <filename>foo.service.wants/</filename> may exist. All unit files symlinked from such a directory are
@@ -832,7 +832,7 @@
         type when precisely a unit has finished starting up. Most importantly, for service units start-up is
         considered completed for the purpose of <varname>Before=</varname>/<varname>After=</varname> when all
         its configured start-up commands have been invoked and they either failed or reported start-up
-        success. Note that this does includes <varname>ExecStartPost=</varname> (or
+        success. Note that this includes <varname>ExecStartPost=</varname> (or
         <varname>ExecStopPost=</varname> for the shutdown case).</para>
 
         <para>Note that those settings are independent of and orthogonal to the requirement dependencies as

man/systemd.xml

@@ -89,28 +89,22 @@
   <refsect1>
     <title>Units</title>
 
-    <para>systemd provides a dependency system between various
+    <para>systemd provides a dependency system between various entities called "units" of 11 different
-    entities called "units" of 11 different types. Units encapsulate
+    types. Units encapsulate various objects that are relevant for system boot-up and maintenance. The
-    various objects that are relevant for system boot-up and
+    majority of units are configured in unit configuration files, whose syntax and basic set of options is
-    maintenance. The majority of units are configured in unit
-    configuration files, whose syntax and basic set of options is
     described in
     <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-    however some are created automatically from other configuration
+    however some are created automatically from other configuration files, dynamically from system state or
-    files, dynamically from system state or programmatically at runtime.
+    programmatically at runtime. Units may be "active" (meaning started, bound, plugged in, …, depending on
-    Units may be "active" (meaning started, bound, plugged in, …,
+    the unit type, see below), or "inactive" (meaning stopped, unbound, unplugged, …), as well as in the
-    depending on the unit type, see below), or "inactive" (meaning
+    process of being activated or deactivated, i.e. between the two states (these states are called
-    stopped, unbound, unplugged, …), as well as in the process of
+    "activating", "deactivating"). A special "failed" state is available as well, which is very similar to
-    being activated or deactivated, i.e. between the two states (these
+    "inactive" and is entered when the service failed in some way (process returned error code on exit, or
-    states are called "activating", "deactivating"). A special
+    crashed, an operation timed out, or after too many restarts). If this state is entered, the cause will
-    "failed" state is available as well, which is very similar to
+    be logged, for later reference. Units may also be in a special transient state for a time, to indicate
-    "inactive" and is entered when the service failed in some way
+    that some operation is being performed on them, before reverting to the previous state, such as
-    (process returned error code on exit, or crashed, an operation
+    "maintenance", "reloading" or "refreshing". Note that the various unit types may have a number of
-    timed out, or after too many restarts). If this state is entered,
+    additional substates, which are mapped to the five generalized unit states described here.</para>
-    the cause will be logged, for later reference. Note that the
-    various unit types may have a number of additional substates,
-    which are mapped to the five generalized unit states described
-    here.</para>
 
     <para>The following unit types are available:</para>
 
@@ -574,7 +568,11 @@
         <listitem><para>Enables display of status messages on the
         console, as controlled via
         <varname>systemd.show_status=1</varname> on the kernel command
-        line.</para></listitem>
+        line.</para>
+        <para>You may want to use <function>SetShowStatus()</function> instead of
+        <constant>SIGRTMIN+20</constant> in order to prevent race conditions. See
+        <citerefentry project="man-pages"><refentrytitle>org.freedesktop.systemd1</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+        </para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -585,7 +583,11 @@
         controlled via
         <varname>systemd.show_status=0</varname>
         on the kernel command
-        line.</para></listitem>
+        line.</para>
+        <para>You may want to use <function>SetShowStatus()</function> instead of
+        <constant>SIGRTMIN+21</constant> in order to prevent race conditions. See
+        <citerefentry project="man-pages"><refentrytitle>org.freedesktop.systemd1</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+        </para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -843,9 +845,8 @@
 
         <listitem><para>Takes a boolean argument or enables the option if specified
         without an argument. If enabled, the system manager (PID 1) spawns a shell
-        when it crashes, after a 10s delay. Otherwise, no shell is spawned. Defaults
+        when it crashes. Otherwise, no shell is spawned. Defaults to disabled, for
-        to disabled, for security reasons, as the shell is not protected by password
+        security reasons, as the shell is not protected by password authentication.</para>
-        authentication.</para>
 
         <xi:include href="version-info.xml" xpointer="v233"/></listitem>
       </varlistentry>