meson: bump version to v259~rc1

meson: bump library sonames for v259~rc1
NEWS: finalize time and place
2026-03-30 19:54:51 +02:00 · 2025-11-17 18:36:12 +00:00 · 2025-11-17 18:36:12 +00:00 · 2025-11-17 18:36:12 +00:00 · 2025-11-17 18:36:12 +00:00 · 2025-11-17 18:36:12 +00:00
58 changed files with 506 additions and 338 deletions
--- a/.github/workflows/build-test-musl.sh
+++ b/.github/workflows/build-test-musl.sh
@ -20,75 +20,5 @@ cleanup() (

 trap cleanup EXIT ERR INT TERM

-mkdir -p "${TMPDIR}/build"
-mkdir -p "${TMPDIR}/usr/include"
-mkdir -p "${TMPDIR}/usr/lib64/pkgconfig"
-
-CFLAGS="-idirafter ${TMPDIR}/usr/include"
-export PKG_CONFIG_PATH="${TMPDIR}"/usr/lib64/pkgconfig
-
-LINKS=(
-    acl
-    archive.h
-    archive_entry.h
-    asm
-    asm-generic
-    audit-records.h
-    audit_logging.h
-    bpf
-    bzlib.h
-    curl
-    dwarf.h
-    elfutils
-    fido.h
-    gcrypt.h
-    gelf.h
-    gnutls
-    gpg-error.h
-    idn2.h
-    libaudit.h
-    libcryptsetup.h
-    libelf.h
-    libkmod.h
-    linux
-    lz4.h
-    lz4frame.h
-    lz4hc.h
-    lzma
-    lzma.h
-    microhttpd.h
-    mtd
-    openssl
-    pcre2.h
-    pwquality.h
-    qrencode.h
-    seccomp-syscalls.h
-    seccomp.h
-    security
-    selinux
-    sys/acl.h
-    sys/capability.h
-    tss2
-    xen
-    xkbcommon
-    zconf.h
-    zlib.h
-    zstd.h
-    zstd_errors.h
-)
-
-for t in "${LINKS[@]}"; do
-    [[ -e /usr/include/"$t" ]]
-    link="${TMPDIR}"/usr/include/"${t}"
-    mkdir -p "${link%/*}"
-    ln -s /usr/include/"$t" "$link"
-done
-
-env \
-    CC=musl-gcc \
-    CXX=musl-gcc \
-    CFLAGS="$CFLAGS" \
-    CXXFLAGS="$CFLAGS" \
-    meson setup --werror -Ddbus-interfaces-dir=no -Dlibc=musl "${TMPDIR}"/build
-
-ninja -v -C "${TMPDIR}"/build
+tools/setup-musl-build.sh "${TMPDIR}/build"
+ninja -v -C "${TMPDIR}/build"
--- a/.github/workflows/unit-tests-musl.sh
+++ b/.github/workflows/unit-tests-musl.sh
@ -37,7 +37,7 @@ for phase in "${PHASES[@]}"; do
            info "Run phase"

            # Create dummy machine ID.
-            echo '052e58f661f94bd080e258b96aea3f7b' > /etc/machine-id
+            echo '052e58f661f94bd080e258b96aea3f7b' >/etc/machine-id

            # Start dbus for several unit tests.
            mkdir -p /var/run/dbus
--- a/68
+++ b/68
@ -4,6 +4,31 @@ CHANGES WITH 259 in spe:

        Announcements of Future Feature Removals and Incompatible Changes:

+        * Support for System V service scripts is deprecated and will be
+          removed in v260. Please make sure to update your software *now* to
+          include a native systemd unit file instead of a legacy System V
+          script to retain compatibility with future systemd releases.
+          Following components will be removed:
+
+          * systemd-rc-local-generator,
+          * systemd-sysv-generator,
+          * systemd-sysv-install (hook for systemctl enable/disable/is-enabled).
+
+        * Required minimum versions of following components are planned to be
+          raised in v260:
+
+          * Linux kernel >= 5.10 (recommended >= 5.14),
+          * glibc >= 2.34,
+          * libxcrypt >= 4.4.0 (libcrypt in glibc will be no longer supported),
+          * util-linux >= 2.37,
+          * elfutils >= 0.177,
+          * openssl >= 3.0.0,
+          * cryptsetup >= 2.4.0,
+          * libseccomp >= 2.4.0,
+          * python >= 3.9.0.
+
+          Please provide feedback on systemd-devel if this would cause problems.
+
        * The parsing of RootImageOptions= and the mount image parameters of
          ExtensionImages= and MountImages= will be changed in the next version
          so that the last duplicated definition for a given partition wins and
@ -49,6 +74,15 @@ CHANGES WITH 259 in spe:
          image. Hence, effectively they were read-only already, and this is
          now official.

+        * The LUKS volume label string set by systemd-repart no longer defaults
+          to the literal same as the partition and file system label, but is
+          prefixed with "luks-". This is done so that on LUKS enabled images a
+          conflict between /dev/disk/by-label/ symlinks is removed, as this
+          symlink is generated both for file system and LUKS superblock
+          labels. There's a new VolumeLabel= setting for partitions that can be
+          used to expicitly choose a LUKS superblock label, which can be used
+          to explicitly revert to the old naming, if required.
+
        Service manager/PID1:

        * The service manager's Varlink IPC has been extended considerably. It
@ -508,16 +542,16 @@ CHANGES WITH 259 in spe:
        Contributions from: Alan Brady, Alberto Planas, Aleksandr Mezin,
        Allison Karlitskaya, Andreas Schneider, Anton Tiurin,
        Antonio Alvarez Feijoo, Arian van Putten, Armin Wolf,
-        Bastian Almendras, Chen Qi, Chris Down, Christian Hesse,
-        Christoph Anton Mitterer, Daan De Meyer, Daniel Brackenbury,
-        Daniel Foster, Daniel Hast, Danilo Spinella, David Tardon,
-        Dimitri John Ledkov, Dr. David Alan Gilbert, Duy Nguyen Van,
-        Emanuele Giuseppe Esposito, Eric Curtin, Erin Shepherd,
-        Evgeny Vereshchagin, Felix Pehla, Florian, Francesco Valla,
-        Franck Bui, Frantisek Sumsal, Gero Schwäricke,
-        Goffredo Baroncelli, Govind Venugopal, Guido Günther,
-        Hans de Goede, Igor Opaniuk, Ingo Franzki, Itxaka, Ivan Kruglov,
-        Jelle van der Waa, Jim Spentzos, Joshua Krusell,
+        Bastian Almendras, Charlie Le, Chen Qi, Chris Down,
+        Christian Hesse, Christoph Anton Mitterer, Daan De Meyer,
+        Daniel Brackenbury, Daniel Foster, Daniel Hast, Danilo Spinella,
+        David Tardon, Dimitri John Ledkov, Dr. David Alan Gilbert,
+        Duy Nguyen Van, Emanuele Giuseppe Esposito, Emil Renner Berthing,
+        Eric Curtin, Erin Shepherd, Evgeny Vereshchagin, Felix Pehla,
+        Florian, Francesco Valla, Franck Bui, Frantisek Sumsal,
+        Gero Schwäricke, Goffredo Baroncelli, Govind Venugopal,
+        Guido Günther, Hans de Goede, Igor Opaniuk, Ingo Franzki, Itxaka,
+        Ivan Kruglov, Jelle van der Waa, Jim Spentzos, Joshua Krusell,
        Justin Kromlinger, Jörg Behrmann, Kai Lueke, Kai Wohlfahrt,
        Le_Futuriste, Lennart Poettering, Luca Boccassi,
        Lucas Adriano Salles, Lukáš Nykrýn, Managor, Mantas Mikulėnas,
@ -533,6 +567,8 @@ CHANGES WITH 259 in spe:
        jouyouyun, jsks, kanitha chim, n0099, ners, nkraetzschmar, nl6720,
        theSillywhat, val4oss, 雪叶

+        — Edinburgh, 2025/11/17
+
 CHANGES WITH 258:

        Incompatible changes:
@ -709,10 +745,10 @@ CHANGES WITH 258:

        Announcements of Future Feature Removals:

-        * Support for System V service scripts is deprecated and will be
-          removed in v259. Please make sure to update your software *now* to
-          include a native systemd unit file instead of a legacy System V
-          script to retain compatibility with future systemd releases.
+        * (postponed to v260) Support for System V service scripts is deprecated
+          and will be removed in v259. Please make sure to update your software
+          *now* to include a native systemd unit file instead of a legacy System
+          V script to retain compatibility with future systemd releases.

        * Support for the legacy /run/lock/ directory is deprecated and will be
          removed in v259. Any software that still needs access to this legacy
@ -736,8 +772,8 @@ CHANGES WITH 258:
          Only nftables backend will be supported by systemd-networkd and
          systemd-nspawn since v259.

-        * Required minimum versions of following components are planned to be
-          raised in the next release:
+        * (postponed to v260) Required minimum versions of following components
+          are planned to be raised in the next release:

          * Linux kernel >= 5.10 (recommended >= 5.14),
          * glibc >= 2.34,
--- a/10
+++ b/10
@ -22,7 +22,10 @@ External:

 * fedora: update policy to declare access mode and ownership of unit files to root:root 0644, and add an rpmlint check for it

-* zsh shell completion:
+* missing shell completions:
+  - systemd-hwdb
+
+* zsh shell completions:
  - <command> <verb> -<TAB> should complete options, but currently does not
  - systemctl add-wants,add-requires
  - systemctl reboot --boot-loader-entry=
@ -778,6 +781,11 @@ Features:
 * credentials: add a flag to the scoped credentials that if set require PK
  reauthentication when unlocking a secret.

+* credentials: rework docs. The list in
+  https://systemd.io/CREDENTIALS/#well-known-credentials is very stale.
+  Document credentials in individual man pages, generate list as in
+  systemd.directives.
+
 * extend the smbios11 logic for passing credentials so that instead of passing
  the credential data literally it can also just reference an AF_VSOCK CID/port
  to read them from. This way the data doesn't remain in the SMBIOS blob during
--- a/docs/ENVIRONMENT.md
+++ b/docs/ENVIRONMENT.md
@ -578,8 +578,8 @@ disk images with `--image=` or similar:
  environment variable to the build directory and you are set. This variable
  is only supported when systemd is compiled in developer mode.

-Various tools that read passwords from the TTY, such as `systemd-cryptenroll`
-and `homectl`:
+Various tools that read passwords from the TTY, such as `systemd-cryptenroll`,
+`systemd-dissect` and `homectl`:

 * `$PASSWORD` — takes a string: the literal password to use. If this
  environment variable is set it is used as password instead of prompting the
--- a/docs/MEMORY_PRESSURE.md
+++ b/docs/MEMORY_PRESSURE.md
@ -227,12 +227,15 @@ handling, it's typically sufficient to add a line such as:

 Other programming environments might have native APIs to watch memory
 pressure/low memory events. Most notable is probably GLib's
-[GMemoryMonitor](https://docs.gtk.org/gio/iface.MemoryMonitor.html). It
-currently uses the per-system Linux PSI interface as the backend, but operates
-differently than the above: memory pressure events are picked up by a system
-service, which then propagates this through D-Bus to the applications. This is
-typically less than ideal, since this means each notification event has to
-traverse three processes before being handled. This traversal creates
+[GMemoryMonitor](https://docs.gtk.org/gio/iface.MemoryMonitor.html). As of GLib
+2.86.0, it uses the per-cgroup PSI kernel file to monitor for memory pressure,
+but does not yet read the environment variables recommended above.
+
+In older versions, it used the per-system Linux PSI interface as the backend, but operated
+differently than the above: memory pressure events were picked up by a system
+service, which then propagated this through D-Bus to the applications. This was
+typically less than ideal, since this means each notification event had to
+traverse three processes before being handled. This traversal created
 additional latencies at a time where the system is already experiencing adverse
-latencies. Moreover, it focuses on system-wide PSI events, even though
+latencies. Moreover, it focused on system-wide PSI events, even though
 service-local ones are generally the better approach.
--- a/hwdb.d/60-keyboard.hwdb
+++ b/hwdb.d/60-keyboard.hwdb
@ -237,6 +237,8 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnAcer*:pnNitro*AN*515-47:pvr*

 # Nitro AN515-58
 evdev:atkbd:dmi:bvn*:bvr*:bd*:svnAcer*:pnNitro*AN*515-58:pvr*
+ KEYBOARD_KEY_ef=kbdillumup                             # Fn+F10
+ KEYBOARD_KEY_f0=kbdillumdown                           # Fn+F9
 KEYBOARD_KEY_8a=micmute                                # Microphone mute button
 KEYBOARD_KEY_55=power

--- a/man/repart.d.xml
+++ b/man/repart.d.xml
@ -256,6 +256,17 @@
        <xi:include href="version-info.xml" xpointer="v245"/></listitem>
      </varlistentry>

+      <varlistentry>
+        <term><varname>VolumeLabel=</varname></term>
+
+        <listitem><para>The textual label to assign to the LUKS superblock if applicable. If not specified
+        defaults to the same string as the partition label (see <varname>Label=</varname> above), however
+        prefixed with <literal>luks-</literal>. This setting has no effect if encryption is not enabled for
+        this partition.</para>
+
+        <xi:include href="version-info.xml" xpointer="v259"/></listitem>
+      </varlistentry>
+
      <varlistentry>
        <term><varname>UUID=</varname></term>

--- a/meson.build
+++ b/meson.build
@ -26,8 +26,8 @@ else
        project_minor_version = '0'
 endif

-libsystemd_version = '0.41.0'
-libudev_version = '1.7.11'
+libsystemd_version = '0.42.0'
+libudev_version = '1.7.12'

 conf = configuration_data()
 conf.set_quoted('PROJECT_URL', 'https://systemd.io/')
@ -1028,7 +1028,6 @@ threads = dependency('threads')
 librt = cc.find_library('rt')
 libm = cc.find_library('m')
 libdl = cc.find_library('dl')
-libutmps = dependency('libutmps', required : false)

 # On some distributions that use musl (e.g. Alpine), libintl.h may be provided by gettext rather than musl.
 # In that case, we need to explicitly link with libintl.so.
@ -1688,7 +1687,7 @@ foreach tuple : [
                ['timesyncd'],
                ['tmpfiles'],
                ['tpm'],
-                ['utmp'],
+                ['utmp',            get_option('libc') != 'musl',     'musl does not support it'],
                ['userdb'],
                ['vconsole'],
                ['xdg-autostart'],
--- a/meson.version
+++ b/meson.version
@ -1 +1 @@
-259~devel
+259~rc1
--- a/src/basic/chase.c
+++ b/src/basic/chase.c
@ -412,11 +412,9 @@ int chaseat(int dir_fd, const char *path, ChaseFlags flags, char **ret_path, int
                                return r;

                        if (FLAGS_SET(flags, CHASE_MKDIR_0755) && (!isempty(todo) || !(flags & (CHASE_PARENT|CHASE_NONEXISTENT)))) {
-                                child = xopenat_full(fd,
+                                child = xopenat(fd,
                                                first,
-                                                     O_DIRECTORY|O_CREAT|O_EXCL|O_NOFOLLOW|O_PATH|O_CLOEXEC,
-                                                     /* xopen_flags = */ 0,
-                                                     0755);
+                                                O_DIRECTORY|O_CREAT|O_EXCL|O_NOFOLLOW|O_PATH|O_CLOEXEC);
                                if (child < 0)
                                        return child;
                        } else if (FLAGS_SET(flags, CHASE_PARENT) && isempty(todo)) {
--- a/src/basic/fs-util.h
+++ b/src/basic/fs-util.h
@ -128,7 +128,7 @@ int openat_report_new(int dirfd, const char *pathname, int flags, mode_t mode, b

 int xopenat_full(int dir_fd, const char *path, int open_flags, XOpenFlags xopen_flags, mode_t mode);
 static inline int xopenat(int dir_fd, const char *path, int open_flags) {
-        return xopenat_full(dir_fd, path, open_flags, 0, 0);
+        return xopenat_full(dir_fd, path, open_flags, 0, MODE_INVALID);
 }

 int xopenat_lock_full(int dir_fd, const char *path, int open_flags, XOpenFlags xopen_flags, mode_t mode, LockType locktype, int operation);
--- a/src/basic/log.c
+++ b/src/basic/log.c
@ -950,8 +950,6 @@ int log_format_iovec(
                const char *format,
                va_list ap) {

-        static const char nl = '\n';
-
        while (format && *n + 1 < iovec_len) {
                va_list aq;
                char *m;
@ -975,7 +973,7 @@ int log_format_iovec(

                iovec[(*n)++] = IOVEC_MAKE_STRING(m);
                if (newline_separator)
-                        iovec[(*n)++] = IOVEC_MAKE((char *)&nl, 1);
+                        iovec[(*n)++] = IOVEC_MAKE_STRING("\n");

                format = va_arg(ap, char *);
        }
--- a/src/basic/log.h
+++ b/src/basic/log.h
@ -287,17 +287,20 @@ bool log_on_console(void) _pure_;

 /* Helper to wrap the main message in structured logging. The macro doesn't do much,
 * except to provide visual grouping of the format string and its arguments. */
-#if LOG_MESSAGE_VERIFICATION || defined(__COVERITY__)
+#ifdef __COVERITY__
+/* Coverity does not like the concatenation of multiple formats and arguments. Let's replace each format
+ * string with a dummy string. The validity of the formats is hopefully checked by other CIs. */
+#  define LOG_ITEM(fmt, ...)    "dummy", NULL, ##__VA_ARGS__
+#elif LOG_MESSAGE_VERIFICATION
 /* Do a fake formatting of the message string to let the scanner verify the arguments against the format
 * message. The variable will never be set to true, but we don't tell the compiler that :) */
 extern bool _log_message_dummy;
 #  define LOG_ITEM(fmt, ...) "%.0d" fmt, (_log_message_dummy && printf(fmt, ##__VA_ARGS__)), ##__VA_ARGS__
-#  define LOG_MESSAGE(fmt, ...) LOG_ITEM("MESSAGE=" fmt, ##__VA_ARGS__)
 #else
 #  define LOG_ITEM(fmt, ...) fmt, ##__VA_ARGS__
-#  define LOG_MESSAGE(fmt, ...) "MESSAGE=" fmt, ##__VA_ARGS__
 #endif

+#define LOG_MESSAGE(fmt, ...) LOG_ITEM("MESSAGE=" fmt, ##__VA_ARGS__)
 #define LOG_MESSAGE_ID(id)    LOG_ITEM("MESSAGE_ID=" id)

 void log_received_signal(int level, const struct signalfd_siginfo *si);
--- a/src/basic/tmpfile-util.c
+++ b/src/basic/tmpfile-util.c
@ -447,7 +447,9 @@ void cleanup_tmpfile_data_done(struct cleanup_tmpfile_data *d) {
            !*d->filename)
                return;

-        (void) unlinkat(*d->dir_fd, *d->filename, 0);
+        PROTECT_ERRNO;
+
+        (void) unlinkat(*d->dir_fd, *d->filename, /* flags= */ 0);
        d->dir_fd = NULL;
        d->filename = NULL;
 }
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@ -136,8 +136,9 @@ static const BindMount bind_log_sockets_table[] = {
        { (char*) "/run/systemd/journal/dev-log", (char*) "/run/systemd/journal/dev-log", .read_only = true, .nosuid = true, .noexec = true, .nodev = true, .ignore_enoent = true },
 };

-/* If MountAPIVFS= is used, let's mount /sys, /proc, /dev and /run into the it, but only as a fallback if the user hasn't mounted
- * something there already. These mounts are hence overridden by any other explicitly configured mounts. */
+/* If MountAPIVFS= is used, let's mount /proc/, /dev/, /sys/, and /run/, but only as a fallback if the user
+ * hasn't mounted something already. These mounts are hence overridden by any other explicitly configured
+ * mounts. */
 static const MountEntry apivfs_table[] = {
        { "/proc",               MOUNT_PROCFS,       false },
        { "/dev",                MOUNT_BIND_DEV,     false },
@ -191,8 +192,8 @@ static const MountEntry protect_kernel_logs_dev_table[] = {
 };

 /*
- * ProtectHome=read-only table, protect $HOME and $XDG_RUNTIME_DIR and rest of
- * system should be protected by ProtectSystem=
+ * ProtectHome=read-only. Protect $HOME and $XDG_RUNTIME_DIR and rest of
+ * system should be protected by ProtectSystem=.
 */
 static const MountEntry protect_home_read_only_table[] = {
        { "/home",               MOUNT_READ_ONLY,     true  },
@ -200,37 +201,37 @@ static const MountEntry protect_home_read_only_table[] = {
        { "/root",               MOUNT_READ_ONLY,     true  },
 };

-/* ProtectHome=tmpfs table */
+/* ProtectHome=tmpfs */
 static const MountEntry protect_home_tmpfs_table[] = {
        { "/home",               MOUNT_TMPFS,        true, .read_only = true, .options_const = "mode=0755" TMPFS_LIMITS_EMPTY_OR_ALMOST, .flags = MS_NODEV|MS_STRICTATIME },
        { "/run/user",           MOUNT_TMPFS,        true, .read_only = true, .options_const = "mode=0755" TMPFS_LIMITS_EMPTY_OR_ALMOST, .flags = MS_NODEV|MS_STRICTATIME },
        { "/root",               MOUNT_TMPFS,        true, .read_only = true, .options_const = "mode=0700" TMPFS_LIMITS_EMPTY_OR_ALMOST, .flags = MS_NODEV|MS_STRICTATIME },
 };

-/* ProtectHome=yes table */
+/* ProtectHome=yes */
 static const MountEntry protect_home_yes_table[] = {
        { "/home",               MOUNT_INACCESSIBLE, true  },
        { "/run/user",           MOUNT_INACCESSIBLE, true  },
        { "/root",               MOUNT_INACCESSIBLE, true  },
 };

-/* ProtectControlGroups=yes table */
+/* ProtectControlGroups=yes */
 static const MountEntry protect_control_groups_yes_table[] = {
        { "/sys/fs/cgroup",      MOUNT_READ_ONLY,         false  },
 };

-/* ProtectControlGroups=private table. Note mount_private_apivfs() always use MS_NOSUID|MS_NOEXEC|MS_NODEV so
- * flags is not set here. */
+/* ProtectControlGroups=private. Note mount_private_apivfs() always use MS_NOSUID|MS_NOEXEC|MS_NODEV so
+ * flags are not set here. */
 static const MountEntry protect_control_groups_private_table[] = {
        { "/sys/fs/cgroup",      MOUNT_PRIVATE_CGROUP2FS, false, .read_only = false },
 };

-/* ProtectControlGroups=strict table */
+/* ProtectControlGroups=strict */
 static const MountEntry protect_control_groups_strict_table[] = {
        { "/sys/fs/cgroup",      MOUNT_PRIVATE_CGROUP2FS, false, .read_only = true },
 };

-/* ProtectSystem=yes table */
+/* ProtectSystem=yes */
 static const MountEntry protect_system_yes_table[] = {
        { "/usr",                MOUNT_READ_ONLY,     false },
        { "/boot",               MOUNT_READ_ONLY,     true  },
@ -245,8 +246,8 @@ static const MountEntry protect_system_full_table[] = {
        { "/etc",                MOUNT_READ_ONLY,     false },
 };

-/* ProtectSystem=strict table. In this strict mode, we mount everything read-only, except for /proc, /dev,
- * /sys which are the kernel API VFS, which are left writable, but PrivateDevices= + ProtectKernelTunables=
+/* ProtectSystem=strict. In this strict mode, we mount everything read-only, except for /proc, /dev, and
+ * /sys which are the kernel API VFS and left writable. PrivateDevices= + ProtectKernelTunables=
 * protect those, and these options should be fully orthogonal. (And of course /home and friends are also
 * left writable, as ProtectHome= shall manage those, orthogonally).
 */
@ -260,7 +261,7 @@ static const MountEntry protect_system_strict_table[] = {
        { "/root",               MOUNT_READ_WRITE_IMPLICIT, true  },      /* ProtectHome= */
 };

-/* ProtectHostname=yes able */
+/* ProtectHostname=yes */
 static const MountEntry protect_hostname_yes_table[] = {
        { "/proc/sys/kernel/hostname",   MOUNT_READ_ONLY, false },
        { "/proc/sys/kernel/domainname", MOUNT_READ_ONLY, false },
@ -1839,7 +1840,7 @@ static int apply_one_mount(
                        return 0;
                }

-                log_debug_errno(r, "Failed to mount new bpffs instance, fallback to making %s read-only, ignoring: %m", mount_entry_path(m));
+                log_debug_errno(r, "Failed to mount new bpffs instance at %s, will make read-only, ignoring: %m", mount_entry_path(m));
                m->mode = MOUNT_READ_ONLY;
                m->ignore = true;
        }
--- a/src/dissect/dissect.c
+++ b/src/dissect/dissect.c
@ -2152,8 +2152,15 @@ static int run(int argc, char *argv[]) {
                                        return log_error_errno(r, "Failed to guess verity root hash: %m");

                                if (arg_action != ACTION_DISSECT) {
+                                        _cleanup_(erase_and_freep) char *envpw = NULL;
+
+                                        r = getenv_steal_erase("PASSWORD", &envpw);
+                                        if (r < 0)
+                                                return log_error_errno(r, "Failed to acquire password from environment: %m");
+
                                        r = dissected_image_decrypt_interactively(
-                                                        m, NULL,
+                                                        m,
+                                                        envpw,
                                                        &arg_verity_settings,
                                                        arg_image_policy,
                                                        arg_flags);
--- a/src/include/musl/utmpx.h
+++ b/src/include/musl/utmpx.h
@ -1,16 +0,0 @@
-/* SPDX-License-Identifier: LGPL-2.1-or-later */
-#pragma once
-
-#include_next <utmpx.h>
-
-#ifndef UTMPX_FILE
-#define UTMPX_FILE "/run/utmp"
-#endif
-
-#ifndef WTMPX_FILE
-#define WTMPX_FILE "/var/log/wtmp"
-#endif
-
-#ifndef ACCOUNTING
-#define ACCOUNTING 9
-#endif
--- a/src/login/meson.build
+++ b/src/login/meson.build
@ -49,7 +49,6 @@ executables += [
                'include_directories' : [libexec_template['include_directories'], include_directories('.')],
                'extract' : systemd_logind_extract_sources,
                'dependencies' : [
-                        libutmps,
                        threads,
                ],
        },
--- a/src/nspawn/nspawn-oci.c
+++ b/src/nspawn/nspawn-oci.c
@ -139,32 +139,6 @@ static int oci_console_size(const char *name, sd_json_variant *v, sd_json_dispat
        return oci_dispatch(v, table, flags, s);
 }

-static int oci_env(const char *name, sd_json_variant *v, sd_json_dispatch_flags_t flags, void *userdata) {
-        char ***l = ASSERT_PTR(userdata);
-        sd_json_variant *e;
-        int r;
-
-        JSON_VARIANT_ARRAY_FOREACH(e, v) {
-                const char *n;
-
-                if (!sd_json_variant_is_string(e))
-                        return json_log(e, flags, SYNTHETIC_ERRNO(EINVAL),
-                                        "Environment array contains non-string.");
-
-                assert_se(n = sd_json_variant_string(e));
-
-                if (!env_assignment_is_valid(n))
-                        return json_log(e, flags, SYNTHETIC_ERRNO(EINVAL),
-                                        "Environment assignment not valid: %s", n);
-
-                r = strv_extend(l, n);
-                if (r < 0)
-                        return log_oom();
-        }
-
-        return 0;
-}
-
 static int oci_args(const char *name, sd_json_variant *v, sd_json_dispatch_flags_t flags, void *userdata) {
        _cleanup_strv_free_ char **l = NULL;
        char ***value = ASSERT_PTR(userdata);
@ -390,7 +364,7 @@ static int oci_process(const char *name, sd_json_variant *v, sd_json_dispatch_fl
                { "terminal",        SD_JSON_VARIANT_BOOLEAN, oci_terminal,                   0,                                     0                  },
                { "consoleSize",     SD_JSON_VARIANT_OBJECT,  oci_console_size,               0,                                     0                  },
                { "cwd",             SD_JSON_VARIANT_STRING,  json_dispatch_path,             offsetof(Settings, working_directory), 0                  },
-                { "env",             SD_JSON_VARIANT_ARRAY,   oci_env,                   offsetof(Settings, environment),       0                  },
+                { "env",             SD_JSON_VARIANT_ARRAY,   json_dispatch_strv_environment, offsetof(Settings, environment),       0                  },
                { "args",            SD_JSON_VARIANT_ARRAY,   oci_args,                       offsetof(Settings, parameters),        0                  },
                { "rlimits",         SD_JSON_VARIANT_ARRAY,   oci_rlimits,                    0,                                     0                  },
                { "apparmorProfile", SD_JSON_VARIANT_STRING,  oci_unsupported,                0,                                     SD_JSON_PERMISSIVE },
@ -2012,7 +1986,7 @@ static int oci_hooks_array(const char *name, sd_json_variant *v, sd_json_dispatc
                static const sd_json_dispatch_field table[] = {
                        { "path",    SD_JSON_VARIANT_STRING,   json_dispatch_path,             offsetof(OciHook, path),    SD_JSON_MANDATORY },
                        { "args",    SD_JSON_VARIANT_ARRAY,    oci_args,                       offsetof(OciHook, args),    0,                },
-                        { "env",     SD_JSON_VARIANT_ARRAY,    oci_env,            offsetof(OciHook, env),     0                 },
+                        { "env",     SD_JSON_VARIANT_ARRAY,    json_dispatch_strv_environment, offsetof(OciHook, env),     0                 },
                        { "timeout", SD_JSON_VARIANT_UNSIGNED, oci_hook_timeout,               offsetof(OciHook, timeout), 0                 },
                        {}
                };
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@ -3154,7 +3154,7 @@ static int determine_names(void) {
        return 0;
 }

-static int chase_and_update(char **p, unsigned flags) {
+static int chase_and_update(char **p, ChaseFlags flags) {
        char *chased;
        int r;

@ -3163,7 +3163,7 @@ static int chase_and_update(char **p, unsigned flags) {
        if (!*p)
                return 0;

-        r = chase(*p, NULL, flags, &chased, NULL);
+        r = chase(*p, /* root= */ NULL, flags, &chased, /* ret_fd= */ NULL);
        if (r < 0)
                return log_error_errno(r, "Failed to resolve path %s: %m", *p);

--- a/src/repart/repart.c
+++ b/src/repart/repart.c
@ -398,7 +398,8 @@ typedef struct Partition {
        GptPartitionType type;
        sd_id128_t current_uuid, new_uuid;
        bool new_uuid_is_set;
-        char *current_label, *new_label;
+        char *current_label, *new_label;      /* Used for the GPT partition label + fs superblock label */
+        char *new_volume_label;               /* used for LUKS superblock */
        sd_id128_t fs_uuid, luks_uuid, verity_uuid;
        uint8_t verity_salt[SHA256_DIGEST_SIZE];

@ -714,6 +715,7 @@ static Partition* partition_free(Partition *p) {

        free(p->current_label);
        free(p->new_label);
+        free(p->new_volume_label);
        free(p->definition_path);
        strv_free(p->drop_in_files);

@ -2750,6 +2752,7 @@ static int partition_read_definition(
        ConfigTableItem table[] = {
                { "Partition", "Type",                     config_parse_type,              0,                                  &p->type                    },
                { "Partition", "Label",                    config_parse_label,             0,                                  &p->new_label               },
+                { "Partition", "VolumeLabel",              config_parse_label,             0,                                  &p->new_volume_label        },
                { "Partition", "UUID",                     config_parse_uuid,              0,                                  p                           },
                { "Partition", "Priority",                 config_parse_int32,             0,                                  &p->priority                },
                { "Partition", "Weight",                   config_parse_weight,            0,                                  &p->weight                  },
@ -3976,6 +3979,27 @@ static const char *partition_label(const Partition *p) {
        return gpt_partition_type_uuid_to_string(p->type.uuid);
 }

+static int volume_label(const Partition *p, char **ret) {
+        assert(p);
+        assert(ret);
+
+        if (p->new_volume_label)
+                return strdup_to(ret, p->new_volume_label);
+
+        const char *e = partition_label(p);
+        if (!e)
+                return -ENODATA;
+
+        /* Let's prefix "luks-" for the label string used for LUKS superblocks. We do this so that the
+         * /dev/disk/by-label/ symlink to the LUKS volume and the file system inside it do not clash */
+        char *j = strjoin("luks-", e);
+        if (!j)
+                return -ENOMEM;
+
+        *ret = j;
+        return 0;
+}
+
 static int context_dump_partitions(Context *context) {
        _cleanup_(table_unrefp) Table *t = NULL;
        uint64_t sum_padding = 0, sum_size = 0;
@ -4966,21 +4990,6 @@ static int partition_target_sync(Context *context, Partition *p, PartitionTarget

 static int partition_encrypt(Context *context, Partition *p, PartitionTarget *target, bool offline) {
 #if HAVE_LIBCRYPTSETUP
-        const char *node = partition_target_path(target);
-        struct crypt_params_luks2 luks_params = {
-                .label = strempty(ASSERT_PTR(p)->new_label),
-                .sector_size = partition_fs_sector_size(context, p),
-                .data_device = offline ? node : NULL,
-        };
-        struct crypt_params_reencrypt reencrypt_params = {
-                .mode = CRYPT_REENCRYPT_ENCRYPT,
-                .direction = CRYPT_REENCRYPT_BACKWARD,
-                .resilience = "datashift",
-                .data_shift = LUKS2_METADATA_SIZE / 512,
-                .luks2 = &luks_params,
-                .flags = CRYPT_REENCRYPT_INITIALIZE_ONLY|CRYPT_REENCRYPT_MOVE_FIRST_SEGMENT,
-        };
-        _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
 #if HAVE_TPM2
        _cleanup_(erase_and_freep) char *base64_encoded = NULL;
 #endif
@ -5001,6 +5010,26 @@ static int partition_encrypt(Context *context, Partition *p, PartitionTarget *ta

        log_info("Encrypting future partition %" PRIu64 "...", p->partno);

+        _cleanup_free_ char *vl = NULL;
+        r = volume_label(p, &vl);
+        if (r < 0)
+                return log_error_errno(r, "Failed to generate volume label: %m");
+
+        const char *node = partition_target_path(target);
+        struct crypt_params_luks2 luks_params = {
+                .label = vl,
+                .sector_size = partition_fs_sector_size(context, p),
+                .data_device = offline ? node : NULL,
+        };
+        struct crypt_params_reencrypt reencrypt_params = {
+                .mode = CRYPT_REENCRYPT_ENCRYPT,
+                .direction = CRYPT_REENCRYPT_BACKWARD,
+                .resilience = "datashift",
+                .data_shift = LUKS2_METADATA_SIZE / 512,
+                .luks2 = &luks_params,
+                .flags = CRYPT_REENCRYPT_INITIALIZE_ONLY|CRYPT_REENCRYPT_MOVE_FIRST_SEGMENT,
+        };
+
        if (offline) {
                r = var_tmp_dir(&vt);
                if (r < 0)
@ -5023,6 +5052,7 @@ static int partition_encrypt(Context *context, Partition *p, PartitionTarget *ta
                        return log_oom();
        }

+        _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
        r = sym_crypt_init(&cd, offline ? hp : node);
        if (r < 0)
                return log_error_errno(r, "Failed to allocate libcryptsetup context for %s: %m", hp);
--- a/src/shared/discover-image.c
+++ b/src/shared/discover-image.c
@ -1997,6 +1997,7 @@ int image_read_metadata(Image *i, const ImagePolicy *image_policy, RuntimeScope

        case IMAGE_RAW:
        case IMAGE_BLOCK: {
+                _cleanup_(verity_settings_done) VeritySettings verity = VERITY_SETTINGS_DEFAULT;
                _cleanup_(loop_device_unrefp) LoopDevice *d = NULL;
                _cleanup_(dissected_image_unrefp) DissectedImage *m = NULL;
                DissectImageFlags flags =
@ -2019,25 +2020,47 @@ int image_read_metadata(Image *i, const ImagePolicy *image_policy, RuntimeScope
                                LOCK_SH,
                                &d);
                if (r < 0)
-                        return r;
+                        return log_debug_errno(r, "Failed to create loopback device of '%s': %m", i->path);

                r = dissect_loop_device(
                                d,
-                                /* verity= */ NULL,
+                                &verity,
                                /* mount_options= */ NULL,
                                image_policy,
                                /* image_filter= */ NULL,
                                flags,
                                &m);
                if (r < 0)
-                        return r;
+                        return log_debug_errno(r, "Failed to dissect image '%s': %m", i->path);
+
+                r = dissected_image_load_verity_sig_partition(
+                                m,
+                                d->fd,
+                                &verity);
+                if (r < 0)
+                        return log_debug_errno(r, "Failed to load Verity signature partition of '%s': %m", i->path);
+
+                r = dissected_image_guess_verity_roothash(
+                                m,
+                                &verity);
+                if (r < 0)
+                        return log_debug_errno(r, "Failed to guess Verity root hash of '%s': %m", i->path);
+
+                r = dissected_image_decrypt(
+                                m,
+                                /* passphrase= */ NULL,
+                                &verity,
+                                image_policy,
+                                flags);
+                if (r < 0)
+                        return log_debug_errno(r, "Failed to decrypt image '%s': %m", i->path);

                r = dissected_image_acquire_metadata(
                                m,
                                /* userns_fd= */ -EBADF,
                                flags);
                if (r < 0)
-                        return r;
+                        return log_debug_errno(r, "Failed to acquire medata from image '%s': %m", i->path);

                free_and_replace(i->hostname, m->hostname);
                i->machine_id = m->machine_id;
@ -2045,7 +2068,6 @@ int image_read_metadata(Image *i, const ImagePolicy *image_policy, RuntimeScope
                strv_free_and_replace(i->os_release, m->os_release);
                strv_free_and_replace(i->sysext_release, m->sysext_release);
                strv_free_and_replace(i->confext_release, m->confext_release);
-
                break;
        }

--- a/src/shared/meson.build
+++ b/src/shared/meson.build
@ -385,7 +385,6 @@ libshared_deps = [threads,
                  librt,
                  libseccomp_cflags,
                  libselinux_cflags,
-                  libutmps,
                  libxenctrl_cflags,
                  libxz_cflags,
                  libzstd_cflags,
--- a/src/ssh-generator/ssh-generator.c
+++ b/src/ssh-generator/ssh-generator.c
@ -85,7 +85,7 @@ static int make_sshd_template_unit(
        assert(sshd_binary);
        assert(generated_sshd_template_unit);

-        /* If the system has a suitable template already, symlink it to the name we want to reuse it */
+        /* If the system has a suitable template already, symlink it under the name we want to use */
        if (found_sshd_template_service)
                return generator_add_symlink(
                                dest,
@ -96,10 +96,11 @@ static int make_sshd_template_unit(
        if (!*generated_sshd_template_unit) {
                _cleanup_fclose_ FILE *f = NULL;

+                /* We use a generic name for the unit, since we'll use it for both AF_UNIX and AF_VSOCK  */
                r = generator_open_unit_file_full(
                                dest,
                                /* source= */ NULL,
-                                "sshd-generated@.service", /* Give this generated unit a generic name, since we want to use it for both AF_UNIX and AF_VSOCK */
+                                "sshd-generated@.service",
                                &f,
                                generated_sshd_template_unit,
                                /* ret_temp_path= */ NULL);
--- a/src/test/meson.build
+++ b/src/test/meson.build
@ -473,7 +473,6 @@ executables += [
        test_template + {
                'sources' : files('test-utmp.c'),
                'conditions' : ['ENABLE_UTMP'],
-                'dependencies' : libutmps,
        },
        test_template + {
                'sources' : files('test-varlink.c'),
--- a/src/test/test-log.c
+++ b/src/test/test-log.c
@ -14,32 +14,45 @@
 #define X100(x) X10(X10(x))
 #define X1000(x) X100(X10(x))

+TEST(synthetic_errno) {
+        ASSERT_TRUE(IS_SYNTHETIC_ERRNO(SYNTHETIC_ERRNO(EINVAL)));
+        ASSERT_TRUE(IS_SYNTHETIC_ERRNO(SYNTHETIC_ERRNO(-EINVAL)));
+        assert_cc(!IS_SYNTHETIC_ERRNO(EINVAL));
+        assert_cc(!IS_SYNTHETIC_ERRNO(-EINVAL));
+        ASSERT_TRUE(IS_SYNTHETIC_ERRNO(SYNTHETIC_ERRNO(0)));
+        assert_cc(!IS_SYNTHETIC_ERRNO(0));
+        ASSERT_EQ(ERRNO_VALUE(EINVAL), EINVAL);
+        ASSERT_EQ(ERRNO_VALUE(SYNTHETIC_ERRNO(-EINVAL)), EINVAL);
+
+        ASSERT_ERROR(log_info_errno(SYNTHETIC_ERRNO(EUCLEAN), "foo"), EUCLEAN);
+}
+
 static int fail_with_EINVAL(void) {
        assert_return(false, -EINVAL);
        return 0;
 }

-static void test_assert_return_is_critical(void) {
+TEST(assert_return_is_critical) {
        SAVE_ASSERT_RETURN_IS_CRITICAL;

        log_set_assert_return_is_critical(false);
-        assert_se(fail_with_EINVAL() == -EINVAL);
+        ASSERT_ERROR(fail_with_EINVAL(), EINVAL);

        log_set_assert_return_is_critical(true);
-        ASSERT_RETURN_IS_CRITICAL(false, assert_se(fail_with_EINVAL() == -EINVAL));
-        assert_se(log_get_assert_return_is_critical() == true);
-        ASSERT_RETURN_EXPECTED(assert_se(fail_with_EINVAL() == -EINVAL));
-        assert_se(log_get_assert_return_is_critical() == true);
+        ASSERT_RETURN_IS_CRITICAL(false, ASSERT_ERROR(fail_with_EINVAL(), EINVAL));
+        ASSERT_TRUE(log_get_assert_return_is_critical());
+        ASSERT_RETURN_EXPECTED(ASSERT_ERROR(fail_with_EINVAL(), EINVAL));
+        ASSERT_TRUE(log_get_assert_return_is_critical());
        ASSERT_RETURN_EXPECTED_SE(fail_with_EINVAL() == -EINVAL);
-        assert_se(log_get_assert_return_is_critical() == true);
+        ASSERT_TRUE(log_get_assert_return_is_critical());
 }

-static void test_file(void) {
+TEST(file) {
        log_info("__FILE__: %s", __FILE__);
        log_info("RELATIVE_SOURCE_PATH: %s", RELATIVE_SOURCE_PATH);
        log_info("PROJECT_FILE: %s", PROJECT_FILE);

-        assert_se(startswith(__FILE__, RELATIVE_SOURCE_PATH "/"));
+        ASSERT_NOT_NULL(startswith(__FILE__, RELATIVE_SOURCE_PATH "/"));
 }

 static void test_log_once_impl(void) {
@ -53,11 +66,85 @@ static void test_log_once_impl(void) {
                     EBADMSG);
 }

-static void test_log_once(void) {
+TEST(log_once) {
        for (unsigned i = 0; i < 4; i++)
                test_log_once_impl();
 }

+_sentinel_
+static void test_log_format_iovec_sentinel(
+                char * const *expected,
+                const char *format,
+                ...) {
+
+        size_t iovec_len = 20, n = 0;
+        struct iovec *iovec = newa(struct iovec, iovec_len);
+        va_list ap;
+
+        log_debug("/* %s(%s) */", __func__, strnull(format));
+
+        char **v = STRV_MAKE("SYSLOG_FACILITY=3",
+                             "SYSLOG_IDENTIFIER=systemd-journald",
+                             "_TRANSPORT=driver",
+                             "PRIORITY=6");
+        size_t m = strv_length(v);
+
+        STRV_FOREACH(s, v)
+                iovec[n++] = IOVEC_MAKE_STRING(*s);
+
+        ASSERT_EQ(n, m);
+
+        va_start(ap, format);
+        DISABLE_WARNING_FORMAT_NONLITERAL;
+        ASSERT_OK(log_format_iovec(iovec, iovec_len, &n, /* newline_separator = */ false, ENOANO, format, ap));
+        REENABLE_WARNING;
+        va_end(ap);
+
+        ASSERT_EQ(n, m + strv_length(expected));
+
+        for (size_t i = 0; i < n; i++)
+                if (i < m)
+                        ASSERT_EQ(iovec_memcmp(&iovec[i], &IOVEC_MAKE_STRING(v[i])), 0);
+                else {
+                        ASSERT_EQ(iovec_memcmp(&iovec[i], &IOVEC_MAKE_STRING(expected[i - m])), 0);
+                        free(iovec[i].iov_base);
+                }
+
+        n = m;
+
+        va_start(ap, format);
+        DISABLE_WARNING_FORMAT_NONLITERAL;
+        ASSERT_OK(log_format_iovec(iovec, iovec_len, &n, /* newline_separator = */ true, ENOANO, format, ap));
+        REENABLE_WARNING;
+        va_end(ap);
+
+        ASSERT_EQ(n, m + strv_length(expected) * 2);
+
+        for (size_t i = 0; i < n; i++)
+                if (i < m)
+                        ASSERT_EQ(iovec_memcmp(&iovec[i], &IOVEC_MAKE_STRING(v[i])), 0);
+                else if ((i - m) % 2 == 0) {
+                        ASSERT_EQ(iovec_memcmp(&iovec[i], &IOVEC_MAKE_STRING(expected[(i - m) / 2])), 0);
+                        free(iovec[i].iov_base);
+                } else
+                        ASSERT_EQ(iovec_memcmp(&iovec[i], &IOVEC_MAKE_STRING("\n")), 0);
+}
+
+#define test_log_format_iovec_one(...)                 \
+        test_log_format_iovec_sentinel(__VA_ARGS__, NULL)
+
+TEST(log_format_iovec) {
+        test_log_format_iovec_one(NULL, NULL);
+        test_log_format_iovec_one(STRV_MAKE("MESSAGE=hoge"),
+                                  LOG_MESSAGE("hoge"));
+        test_log_format_iovec_one(STRV_MAKE("MESSAGE=hoge: 10"),
+                                  LOG_MESSAGE("hoge: %i", 10));
+        test_log_format_iovec_one(STRV_MAKE("MESSAGE=hoge: 10-a", "HOGEHOGE=100-string", "FOOFOO=4-3"),
+                                  LOG_MESSAGE("hoge: %i-%c", 10, 'a'),
+                                  LOG_ITEM("HOGEHOGE=%zu-%s", (size_t) 100, "string"),
+                                  LOG_ITEM("FOOFOO=%hu-%llu", (unsigned short) 4, (long long unsigned) 3));
+}
+
 static void test_log_struct(void) {
        log_struct(LOG_INFO,
                   "MESSAGE=Waldo PID="PID_FMT" (no errno)", getpid_cached(),
@ -97,9 +184,9 @@ static void test_long_lines(void) {
 }

 static void test_log_syntax(void) {
-        assert_se(log_syntax("unit", LOG_ERR, "filename", 10, EINVAL, "EINVAL: %s: %m", "hogehoge") == -EINVAL);
-        assert_se(log_syntax("unit", LOG_ERR, "filename", 10, -ENOENT, "ENOENT: %s: %m", "hogehoge") == -ENOENT);
-        assert_se(log_syntax("unit", LOG_ERR, "filename", 10, SYNTHETIC_ERRNO(ENOTTY), "ENOTTY: %s: %m", "hogehoge") == -ENOTTY);
+        ASSERT_ERROR(log_syntax("unit", LOG_ERR, "filename", 10, EINVAL, "EINVAL: %s: %m", "hogehoge"), EINVAL);
+        ASSERT_ERROR(log_syntax("unit", LOG_ERR, "filename", 10, -ENOENT, "ENOENT: %s: %m", "hogehoge"), ENOENT);
+        ASSERT_ERROR(log_syntax("unit", LOG_ERR, "filename", 10, SYNTHETIC_ERRNO(ENOTTY), "ENOTTY: %s: %m", "hogehoge"), ENOTTY);
 }

 static void test_log_context(void) {
@ -113,8 +200,8 @@ static void test_log_context(void) {

                /* Test that the log context was set up correctly. The strv we pushed twice should only
                 * result in one log context which is reused. */
-                assert_se(log_context_num_contexts() == 3);
-                assert_se(log_context_num_fields() == 4);
+                ASSERT_EQ(log_context_num_contexts(), 3U);
+                ASSERT_EQ(log_context_num_fields(), 4U);

                /* Test that everything still works with modifications to the log context. */
                test_log_struct();
@ -126,8 +213,8 @@ static void test_log_context(void) {
                        LOG_CONTEXT_PUSH_STRV(strv);

                        /* Check that our nested fields got added correctly. */
-                        assert_se(log_context_num_contexts() == 4);
-                        assert_se(log_context_num_fields() == 5);
+                        ASSERT_EQ(log_context_num_contexts(), 4U);
+                        ASSERT_EQ(log_context_num_fields(), 5U);

                        /* Test that everything still works in a nested block. */
                        test_log_struct();
@ -136,21 +223,21 @@ static void test_log_context(void) {
                }

                /* Check that only the fields from the nested block got removed. */
-                assert_se(log_context_num_contexts() == 3);
-                assert_se(log_context_num_fields() == 4);
+                ASSERT_EQ(log_context_num_contexts(), 3U);
+                ASSERT_EQ(log_context_num_fields(), 4U);
        }

-        assert_se(log_context_num_contexts() == 0);
-        assert_se(log_context_num_fields() == 0);
+        ASSERT_EQ(log_context_num_contexts(), 0U);
+        ASSERT_EQ(log_context_num_fields(), 0U);

        {
                _cleanup_(log_context_unrefp) LogContext *ctx = NULL;

                char **strv = STRV_MAKE("SIXTH=ijn", "SEVENTH=PRP");
-                assert_se(ctx = log_context_new_strv(strv, /*owned=*/ false));
+                ASSERT_NOT_NULL(ctx = log_context_new_strv(strv, /*owned=*/ false));

-                assert_se(log_context_num_contexts() == 1);
-                assert_se(log_context_num_fields() == 2);
+                ASSERT_EQ(log_context_num_contexts(), 1U);
+                ASSERT_EQ(log_context_num_fields(), 2U);

                /* Test that everything still works with a manually configured log context. */
                test_log_struct();
@ -161,11 +248,11 @@ static void test_log_context(void) {
        {
                char **strv = NULL;

-                assert_se(strv = strv_new("ABC", "DEF"));
+                ASSERT_NOT_NULL(strv = strv_new("ABC", "DEF"));
                LOG_CONTEXT_CONSUME_STRV(strv);

-                assert_se(log_context_num_contexts() == 1);
-                assert_se(log_context_num_fields() == 2);
+                ASSERT_EQ(log_context_num_contexts(), 1U);
+                ASSERT_EQ(log_context_num_fields(), 2U);
        }

        {
@ -174,17 +261,17 @@ static void test_log_context(void) {
                        IOVEC_MAKE_STRING("ABC=def"),
                        IOVEC_MAKE_STRING("GHI=jkl"),
                };
-                _cleanup_free_ struct iovec_wrapper *iovw = iovw_new();
-                assert_se(iovw);
-                assert_se(iovw_consume(iovw, strdup("MNO=pqr"), STRLEN("MNO=pqr") + 1) == 0);
+                _cleanup_free_ struct iovec_wrapper *iovw = NULL;
+                ASSERT_NOT_NULL(iovw = iovw_new());
+                ASSERT_OK(iovw_consume(iovw, strdup("MNO=pqr"), STRLEN("MNO=pqr") + 1));

                LOG_CONTEXT_PUSH_IOV(iov, ELEMENTSOF(iov));
                LOG_CONTEXT_PUSH_IOV(iov, ELEMENTSOF(iov));
                LOG_CONTEXT_CONSUME_IOV(iovw->iovec, iovw->count);
                LOG_CONTEXT_PUSH("STU=vwx");

-                assert_se(log_context_num_contexts() == 3);
-                assert_se(log_context_num_fields() == 4);
+                ASSERT_EQ(log_context_num_contexts(), 3U);
+                ASSERT_EQ(log_context_num_fields(), 4U);

                test_log_struct();
                test_long_lines();
@ -194,16 +281,16 @@ static void test_log_context(void) {
        {
                LOG_CONTEXT_PUSH_KEY_VALUE("ABC=", "QED");
                LOG_CONTEXT_PUSH_KEY_VALUE("ABC=", "QED");
-                assert_se(log_context_num_contexts() == 1);
-                assert_se(log_context_num_fields() == 1);
+                ASSERT_EQ(log_context_num_contexts(), 1U);
+                ASSERT_EQ(log_context_num_fields(), 1U);

                test_log_struct();
                test_long_lines();
                test_log_syntax();
        }

-        assert_se(log_context_num_contexts() == 0);
-        assert_se(log_context_num_fields() == 0);
+        ASSERT_EQ(log_context_num_contexts(), 0U);
+        ASSERT_EQ(log_context_num_fields(), 0U);
 }

 static void test_log_prefix(void) {
@ -232,25 +319,7 @@ static void test_log_prefix(void) {
        test_log_syntax();
 }

-int main(int argc, char* argv[]) {
-        test_setup_logging(LOG_DEBUG);
-
-        ASSERT_TRUE(IS_SYNTHETIC_ERRNO(SYNTHETIC_ERRNO(EINVAL)));
-        ASSERT_TRUE(IS_SYNTHETIC_ERRNO(SYNTHETIC_ERRNO(-EINVAL)));
-        assert_cc(!IS_SYNTHETIC_ERRNO(EINVAL));
-        assert_cc(!IS_SYNTHETIC_ERRNO(-EINVAL));
-        ASSERT_TRUE(IS_SYNTHETIC_ERRNO(SYNTHETIC_ERRNO(0)));
-        assert_cc(!IS_SYNTHETIC_ERRNO(0));
-        ASSERT_EQ(ERRNO_VALUE(EINVAL), EINVAL);
-        ASSERT_EQ(ERRNO_VALUE(SYNTHETIC_ERRNO(-EINVAL)), EINVAL);
-
-        test_assert_return_is_critical();
-        test_file();
-
-        assert_se(log_info_errno(SYNTHETIC_ERRNO(EUCLEAN), "foo") == -EUCLEAN);
-
-        test_log_once();
-
+TEST(log_target) {
        for (int target = 0; target < _LOG_TARGET_MAX; target++) {
                log_set_target(target);
                log_open();
@ -261,6 +330,6 @@ int main(int argc, char* argv[]) {
                test_log_context();
                test_log_prefix();
        }
-
-        return 0;
 }
+
+DEFINE_TEST_MAIN(LOG_DEBUG);
--- a/test/integration-tests/TEST-80-NOTIFYACCESS/TEST-80-NOTIFYACCESS.units/reload-timeout.sh
+++ b/test/integration-tests/TEST-80-NOTIFYACCESS/TEST-80-NOTIFYACCESS.units/reload-timeout.sh
@ -17,7 +17,7 @@ wait_for_signal() {
 }

 sighup_handler() {
-    echo "hup$(( ++COUNTER ))" > /tmp/syncfifo1
+    echo "hup$(( ++COUNTER ))" >/tmp/syncfifo1
 }

 trap sighup_handler SIGHUP
--- a/test/integration-tests/TEST-80-NOTIFYACCESS/TEST-80-NOTIFYACCESS.units/test.sh
+++ b/test/integration-tests/TEST-80-NOTIFYACCESS/TEST-80-NOTIFYACCESS.units/test.sh
@ -10,7 +10,7 @@ sync_in() {
 }

 sync_out() {
-    echo "$1" > /tmp/syncfifo1
+    echo "$1" >/tmp/syncfifo1
 }

 export SYSTEMD_LOG_LEVEL=debug
--- a/test/test-bootctl-json.sh
+++ b/test/test-bootctl-json.sh
@ -37,7 +37,7 @@ if ret=$("bootctl" --print-boot-path); then
    test "$ret" = "/efi" -o "$ret" = "/boot" -o "$ret" = "/boot/efi"
 fi

-if "$bootctl" -R > /dev/null ; then
+if "$bootctl" -R >/dev/null ; then
    P=$("$bootctl" -R)
    PP=$("$bootctl" -RR)

--- a/test/units/TEST-07-PID1.issue-31752.sh
+++ b/test/units/TEST-07-PID1.issue-31752.sh
@ -21,7 +21,7 @@ cleanup() {

 trap cleanup EXIT

-cat > /run/systemd/system/"$UNIT" <<EOF
+cat >/run/systemd/system/"$UNIT" <<EOF
 [Service]
 ExecStart=true
 RemainAfterExit=yes
@ -32,7 +32,7 @@ systemctl start "$UNIT"
 assert_eq "$(systemctl show -P NeedDaemonReload "$UNIT")" no

 mkdir /run/systemd/system/"$UNIT".d
-cat > /run/systemd/system/"$UNIT".d/desc.conf <<EOF
+cat >/run/systemd/system/"$UNIT".d/desc.conf <<EOF
 [Unit]
 Description=Test NeedDaemonReload status after creating drop-in
 EOF
--- a/test/units/TEST-07-PID1.issue-33672.sh
+++ b/test/units/TEST-07-PID1.issue-33672.sh
@ -21,13 +21,13 @@ cleanup() {

 trap cleanup EXIT

-cat > /run/systemd/system/"$UNIT" <<EOF
+cat >/run/systemd/system/"$UNIT" <<EOF
 [Service]
 ExecStart=true
 EOF

 mkdir /run/systemd/system/"$UNIT".d
-cat > /run/systemd/system/"$UNIT".d/desc.conf <<EOF
+cat >/run/systemd/system/"$UNIT".d/desc.conf <<EOF
 [Unit]
 Description=Test NeedDaemonReload status of a masked unit with drop-ins
 EOF
--- a/test/units/TEST-07-PID1.mqueue-ownership.sh
+++ b/test/units/TEST-07-PID1.mqueue-ownership.sh
@ -19,7 +19,7 @@ at_exit() {
 }
 trap at_exit EXIT

-cat << EOF > /run/systemd/system/mqueue-ownership.socket
+cat <<EOF >/run/systemd/system/mqueue-ownership.socket
 [Unit]
 Description=Create a message queue with customized ownership
 [Socket]
@ -30,7 +30,7 @@ SocketGroup=$group
 SocketMode=$mode
 EOF

-cat << 'EOF' > /run/systemd/system/mqueue-ownership.service
+cat <<EOF >/run/systemd/system/mqueue-ownership.service
 [Unit]
 Description=Dummy service for the socket unit
 Requires=%N.socket
--- a/test/units/TEST-13-NSPAWN.machined.sh
+++ b/test/units/TEST-13-NSPAWN.machined.sh
@ -397,7 +397,7 @@ rm -f /tmp/none-existent-file
 # server side, to not generate early SIGHUP. Hence, let's just invoke "sleep
 # infinity" client side, once we acquired the fd (passing it to it), and kill
 # it once we verified everything worked.
-PID=$(systemd-notify --fork -- varlinkctl --exec call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.Open '{"name": ".host", "mode": "shell", "user": "root", "path": "/usr/bin/bash", "args": ["bash", "-c", "echo $FOO > /tmp/none-existent-file"], "environment": ["FOO=BAR"]}' -- sleep infinity)
+PID=$(systemd-notify --fork -- varlinkctl --exec call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.Open '{"name": ".host", "mode": "shell", "user": "root", "path": "/usr/bin/bash", "args": ["bash", "-c", "echo $FOO >/tmp/none-existent-file"], "environment": ["FOO=BAR"]}' -- sleep infinity)
 timeout 30 bash -c "until test -e /tmp/none-existent-file; do sleep .5; done"
 grep -q "BAR" /tmp/none-existent-file
 kill "$PID"
@ -424,7 +424,7 @@ diff /tmp/foo /var/lib/machines/long-running/root/foo
 (! varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.CopyTo '{"name": "long-running", "source": "/tmp/foo", "destination": "/root/foo"}') # FileExists
 varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.CopyTo '{"name": "long-running", "source": "/tmp/foo", "destination": "/root/foo", "replace": true}'

-echo "sample-test-output" > /tmp/foo
+echo "sample-test-output" >/tmp/foo
 varlinkctl call /run/systemd/machine/io.systemd.Machine io.systemd.Machine.CopyTo '{"name": "long-running", "source": "/tmp/foo", "destination": "/root/foo", "replace": true}'
 diff /tmp/foo /var/lib/machines/long-running/root/foo
 rm -f /tmp/foo /var/lib/machines/long-running/root/foo
--- a/test/units/TEST-13-NSPAWN.unpriv.sh
+++ b/test/units/TEST-13-NSPAWN.unpriv.sh
@ -164,7 +164,7 @@ assert_not_in 'nurps' "$(run0 --pipe -u testuser machinectl --user list-images)"
 assert_not_in 'kurps' "$(run0 --pipe -u testuser machinectl --user list-images)"

 mkdir /home/testuser/.local/state/machines/inodetest
-echo hallo > /home/testuser/.local/state/machines/inodetest/testfile
+echo hallo >/home/testuser/.local/state/machines/inodetest/testfile

 # Make the file sparse, set an xattr, set an ACL, set a chattr flag, and make it hardlink
 ln /home/testuser/.local/state/machines/inodetest/testfile /home/testuser/.local/state/machines/inodetest/testfile.hard
@ -176,7 +176,7 @@ chown foreign-0:foreign-0 /home/testuser/.local/state/machines/inodetest/testfil
 ls -al /home/testuser/.local/state/machines/inodetest

 # Verify UID squashing
-echo gaga > /home/testuser/.local/state/machines/inodetest/squashtest
+echo gaga >/home/testuser/.local/state/machines/inodetest/squashtest
 chown 1000:1000 /home/testuser/.local/state/machines/inodetest/squashtest

 # Ensure hardlinked symlinks work
@ -217,7 +217,7 @@ run0 -u testuser machinectl --user remove inodetest2

 # Test tree mangling (i.e. moving the root dir one level up on extract)
 mkdir -p /var/tmp/mangletest/mangletest-0.1/usr/lib
-echo "ID=brumm" > /var/tmp/mangletest/mangletest-0.1/usr/lib/os-release
+echo "ID=brumm" >/var/tmp/mangletest/mangletest-0.1/usr/lib/os-release
 tar -C /var/tmp/mangletest/ -cvzf /var/tmp/mangletest.tar.gz mangletest-0.1
 run0 --pipe -u testuser importctl -m --user import-tar /var/tmp/mangletest.tar.gz
 cmp /var/tmp/mangletest/mangletest-0.1/usr/lib/os-release /home/testuser/.local/state/machines/mangletest/usr/lib/os-release
--- a/test/units/TEST-16-EXTEND-TIMEOUT.sh
+++ b/test/units/TEST-16-EXTEND-TIMEOUT.sh
@ -86,7 +86,7 @@ systemd-run \
    -u runtime-max-sec-test-3.service \
    sh -c "while true; do sleep 1; done"
 mkdir -p /etc/systemd/system/runtime-max-sec-test-3.service.d/
-cat > /etc/systemd/system/runtime-max-sec-test-3.service.d/override.conf << EOF
+cat >/etc/systemd/system/runtime-max-sec-test-3.service.d/override.conf <<EOF
 [Service]
 RuntimeMaxSec=${runtime_max_sec}s
 EOF
@ -103,7 +103,7 @@ until systemctl is-active runtime-max-sec-test-4.scope; do
    sleep 1
 done
 mkdir -p /etc/systemd/system/runtime-max-sec-test-4.scope.d/
-cat > /etc/systemd/system/runtime-max-sec-test-4.scope.d/override.conf << EOF
+cat >/etc/systemd/system/runtime-max-sec-test-4.scope.d/override.conf <<EOF
 [Scope]
 RuntimeMaxSec=${runtime_max_sec}s
 EOF
--- a/test/units/TEST-17-UDEV.credentials.sh
+++ b/test/units/TEST-17-UDEV.credentials.sh
@ -19,10 +19,10 @@ at_exit() {
 trap at_exit EXIT

 mkdir -p /run/credstore
-cat > /run/credstore/udev.conf.50-testme <<EOF
+cat >/run/credstore/udev.conf.50-testme <<EOF
 udev_log=debug
 EOF
-cat > /run/credstore/udev.rules.50-testme <<EOF
+cat >/run/credstore/udev.rules.50-testme <<EOF
 SUBSYSTEM=="net", OPTIONS="log_level=debug"
 EOF

--- a/test/units/TEST-22-TMPFILES.02.sh
+++ b/test/units/TEST-22-TMPFILES.02.sh
@ -139,7 +139,7 @@ test "$(stat -c %U:%G:%a /tmp/C/3/f1)" = "root:root:644"
 test ! -e /tmp/C/4

 touch /tmp/C/3-origin/f{2,3,4}
-echo -n ABC > /tmp/C/3/f1
+echo -n ABC >/tmp/C/3/f1

 systemd-tmpfiles --create - <<EOF
 C+     /tmp/C/3    0755 daemon daemon - /tmp/C/3-origin
--- a/test/units/TEST-23-UNIT-FILE.ExtraFileDescriptors.sh
+++ b/test/units/TEST-23-UNIT-FILE.ExtraFileDescriptors.sh
@ -15,8 +15,8 @@ at_exit() {
 trap at_exit EXIT

 mkdir /tmp/test-extra-fd
-echo "Hello" > /tmp/test-extra-fd/1.txt
-echo "Extra" > /tmp/test-extra-fd/2.txt
+echo "Hello" >/tmp/test-extra-fd/1.txt
+echo "Extra" >/tmp/test-extra-fd/2.txt

 # Open files and assign FD to variables
 exec {TEST_FD1}</tmp/test-extra-fd/1.txt
--- a/test/units/TEST-29-PORTABLE.directory.sh
+++ b/test/units/TEST-29-PORTABLE.directory.sh
@ -138,7 +138,7 @@ portablectl detach --now --runtime --enable /tmp/rootdir minimal-app0
 # The wrong file should be ignored, given the right one has the xattr set
 trap 'rm -rf /var/cache/wrongext' EXIT
 mkdir -p /var/cache/wrongext/usr/lib/extension-release.d /var/cache/wrongext/usr/lib/systemd/system/
-echo "[Service]" > /var/cache/wrongext/usr/lib/systemd/system/app0.service
+echo "[Service]" >/var/cache/wrongext/usr/lib/systemd/system/app0.service
 touch /var/cache/wrongext/usr/lib/extension-release.d/extension-release.wrongext_somethingwrong.txt
 cp /tmp/rootdir/usr/lib/os-release /var/cache/wrongext/usr/lib/extension-release.d/extension-release.app0
 setfattr -n user.extension-release.strict -v "false" /var/cache/wrongext/usr/lib/extension-release.d/extension-release.app0
--- a/test/units/TEST-35-LOGIN.sh
+++ b/test/units/TEST-35-LOGIN.sh
@ -674,7 +674,7 @@ testcase_ambient_caps() {
    TRANSIENTUNIT="capwakealarm$RANDOM.service"
    SCRIPT="/tmp/capwakealarm$RANDOM.sh"

-    cat > /etc/pam.d/"$PAMSERVICE" <<EOF
+    cat >/etc/pam.d/"$PAMSERVICE" <<EOF
 auth sufficient    pam_unix.so
 auth required      pam_deny.so
 account sufficient pam_unix.so
@ -725,7 +725,7 @@ testcase_background() {

    trap background_at_return RETURN

-    cat > /etc/pam.d/"$PAMSERVICE" <<EOF
+    cat >/etc/pam.d/"$PAMSERVICE" <<EOF
 auth sufficient    pam_unix.so
 auth required      pam_deny.so
 account sufficient pam_unix.so
--- a/test/units/TEST-50-DISSECT.dissect.sh
+++ b/test/units/TEST-50-DISSECT.dissect.sh
@ -916,7 +916,7 @@ systemd-dissect --list /tmp/img >/dev/null
 read -r SHA256SUM1 _ < <(systemd-dissect --copy-from /tmp/img etc/os-release | sha256sum)
 test "$SHA256SUM1" != ""

-echo abc > abc
+echo abc >abc
 systemd-dissect --copy-to /tmp/img abc /abc
 test -f /tmp/img/abc

--- a/test/units/TEST-50-DISSECT.mountfsd.sh
+++ b/test/units/TEST-50-DISSECT.mountfsd.sh
@ -122,7 +122,7 @@ cmp /tmp/unpriv.raw.mtree /tmp/unpriv2.raw.mtree

 # Make sure nspawn works unpriv, too (for now do not nest)
 if ! systemd-detect-virt -c; then
-    systemd-nspawn --pipe -i /var/tmp/unpriv.raw --read-only echo thisisatest > /tmp/unpriv.out
+    systemd-nspawn --pipe -i /var/tmp/unpriv.raw --read-only echo thisisatest >/tmp/unpriv.out
    echo thisisatest | cmp /tmp/unpriv.out -

    # The unpriv user has no rights to lock the image or write to it. Let's
--- a/test/units/TEST-54-CREDS.sh
+++ b/test/units/TEST-54-CREDS.sh
@ -490,24 +490,24 @@ fi
 # Decrypt/encrypt via varlink

 DATA="Zm9vYmFyCg=="
-echo "{\"data\":\"$DATA\"}" > /tmp/vlcredsdata
+echo "{\"data\":\"$DATA\"}" >/tmp/vlcredsdata

 varlinkctl call /run/systemd/io.systemd.Credentials io.systemd.Credentials.Encrypt "$(cat /tmp/vlcredsdata)" | \
-    varlinkctl call --json=short /run/systemd/io.systemd.Credentials io.systemd.Credentials.Decrypt > /tmp/vlcredsdata2
+    varlinkctl call --json=short /run/systemd/io.systemd.Credentials io.systemd.Credentials.Decrypt >/tmp/vlcredsdata2

 cmp /tmp/vlcredsdata /tmp/vlcredsdata2
 rm /tmp/vlcredsdata2

 # Pick a key type explicitly
 varlinkctl call /run/systemd/io.systemd.Credentials io.systemd.Credentials.Encrypt "{\"data\":\"$DATA\",\"withKey\":\"host\"}" | \
-    varlinkctl call --json=short /run/systemd/io.systemd.Credentials io.systemd.Credentials.Decrypt > /tmp/vlcredsdata2
+    varlinkctl call --json=short /run/systemd/io.systemd.Credentials io.systemd.Credentials.Decrypt >/tmp/vlcredsdata2

 cmp /tmp/vlcredsdata /tmp/vlcredsdata2
 rm /tmp/vlcredsdata2

 varlinkctl call /run/systemd/io.systemd.Credentials io.systemd.Credentials.Encrypt "{\"data\":\"$DATA\",\"withKey\":\"null\"}" | \
    jq '.["allowNull"] = true' |
-    varlinkctl call --json=short /run/systemd/io.systemd.Credentials io.systemd.Credentials.Decrypt > /tmp/vlcredsdata2
+    varlinkctl call --json=short /run/systemd/io.systemd.Credentials io.systemd.Credentials.Decrypt >/tmp/vlcredsdata2

 cmp /tmp/vlcredsdata /tmp/vlcredsdata2
 rm /tmp/vlcredsdata /tmp/vlcredsdata2
--- a/test/units/TEST-58-REPART.sh
+++ b/test/units/TEST-58-REPART.sh
@ -123,6 +123,7 @@ last-lba: 2097118"
    tee "$defs/root.conf" <<EOF
 [Partition]
 Type=root
+Format=vfat
 EOF

    ln -s root.conf "$defs/root2.conf"
@ -132,6 +133,7 @@ EOF
 Type=home
 Label=home-first
 Label=home-always-too-long-xxxxxxxxxxxxxx-%v
+Format=vfat
 EOF

    tee "$defs/swap.conf" <<EOF
@ -341,13 +343,14 @@ $imgs/zzz6 : start=     4194264, size=     2097152, type=0FC63DAF-8483-4772-8E79

    tee "$defs/extra3.conf" <<EOF
 [Partition]
-Type=linux-generic
+Type=srv
 Label=luks-format-copy
 UUID=7b93d1f2-595d-4ce3-b0b9-837fbd9e63b0
 Format=ext4
 Encrypt=yes
 CopyFiles=$defs:/def
 SizeMinBytes=48M
+VolumeLabel=schrupfel
 EOF

    systemd-repart --offline="$OFFLINE" \
@ -371,7 +374,7 @@ $imgs/zzz3 : start=     1185760, size=      591864, type=${root_guid}, uuid=${ro
 $imgs/zzz4 : start=     1777624, size=      131072, type=0657FD6D-A4AB-43C4-84E5-0933C84B4F4F, uuid=78C92DB8-3D2B-4823-B0DC-792B78F66F1E, name=\"swap\"
 $imgs/zzz5 : start=     1908696, size=     2285568, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4, uuid=A0A1A2A3-A4A5-A6A7-A8A9-AAABACADAEAF, name=\"custom_label\"
 $imgs/zzz6 : start=     4194264, size=     2097152, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4, uuid=2A1D97E1-D0A3-46CC-A26E-ADC643926617, name=\"block-copy\"
-$imgs/zzz7 : start=     6291416, size=      131072, type=0FC63DAF-8483-4772-8E79-3D69D8477DE4, uuid=7B93D1F2-595D-4CE3-B0B9-837FBD9E63B0, name=\"luks-format-copy\""
+$imgs/zzz7 : start=     6291416, size=      131072, type=3B8F8425-20E0-4F3B-907F-1A25A76F98E8, uuid=7B93D1F2-595D-4CE3-B0B9-837FBD9E63B0, name=\"luks-format-copy\", attrs=\"GUID:59\""

    if systemd-detect-virt --quiet --container; then
        echo "Skipping encrypt mount tests in container."
@ -392,6 +395,11 @@ $imgs/zzz7 : start=     6291416, size=      131072, type=0FC63DAF-8483-4772-8E79
    losetup -d "$loop"
    diff -r "$imgs/mount/def" "$defs" >/dev/null
    umount "$imgs/mount"
+
+    # Validate that the VolumeLabel= had the desired effect
+    PASSWORD="" systemd-dissect "$imgs/zzz" -M "$imgs/mount"
+    udevadm info /dev/disk/by-label/schrupfel | grep -q ID_FS_TYPE=crypto_LUKS
+    systemd-dissect -U "$imgs/mount"
 }

 testcase_dropin() {
--- a/test/units/TEST-63-PATH.sh
+++ b/test/units/TEST-63-PATH.sh
@ -110,11 +110,11 @@ assert_in "test63-issue-24577-dep.service" "$output"
 systemctl start test63-pr-30768.path
 exec {lock}<>/tmp/noexit
 flock -e $lock
-echo test1 > /tmp/copyme
+echo test1 >/tmp/copyme
 # shellcheck disable=SC2016
 timeout 30 bash -c 'until test "$(systemctl show test63-pr-30768.service -P ActiveState)" = deactivating; do sleep .2; done'
 diff /tmp/copyme /tmp/copied
-echo test2 > /tmp/copyme
+echo test2 >/tmp/copyme
 exec {lock}<&-
 timeout 30 bash -c 'until diff /tmp/copyme /tmp/copied >/dev/null; do sleep .2; done'

--- a/test/units/TEST-70-TPM2.creds.sh
+++ b/test/units/TEST-70-TPM2.creds.sh
@ -6,7 +6,7 @@ set -o pipefail
 export SYSTEMD_LOG_LEVEL=debug

 # Ensure that sandboxing doesn't stop creds from being accessible
-echo "test" > /tmp/testdata
+echo "test" >/tmp/testdata
 systemd-creds encrypt /tmp/testdata /tmp/testdata.encrypted --with-key=tpm2
 # LoadCredentialEncrypted
 systemd-run -p PrivateDevices=yes -p LoadCredentialEncrypted=testdata.encrypted:/tmp/testdata.encrypted --pipe --wait systemd-creds cat testdata.encrypted | cmp - /tmp/testdata
--- a/test/units/TEST-70-TPM2.cryptsetup.sh
+++ b/test/units/TEST-70-TPM2.cryptsetup.sh
@ -135,7 +135,7 @@ if tpm_has_pcr sha256 12; then
    tpm2_pcrread -Q -o /tmp/pcr.dat sha256:12
    CURRENT_PCR_VALUE=$(cat /sys/class/tpm/tpm0/pcr-sha256/12)
    tpm2_readpublic -c 0x81000001 -o /tmp/srk.pub
-    systemd-analyze srk > /tmp/srk2.pub
+    systemd-analyze srk >/tmp/srk2.pub
    cmp /tmp/srk.pub /tmp/srk2.pub
    if [ -f /run/systemd/tpm2-srk-public-key.tpm2b_public ] ; then
        cmp /tmp/srk.pub /run/systemd/tpm2-srk-public-key.tpm2b_public
@ -203,7 +203,7 @@ if openssl_supports_kdf SSKDF; then
    # Make sure that --tpm2-device-key= also works with systemd-repart
    tpm2_readpublic -c 0x81000001 -o /tmp/srk.pub
    mkdir /tmp/dditest
-    cat > /tmp/dditest/50-root.conf <<EOF
+    cat >/tmp/dditest/50-root.conf <<EOF
 [Partition]
 Type=root
 Format=ext4
--- a/test/units/TEST-70-TPM2.pcrextend.sh
+++ b/test/units/TEST-70-TPM2.pcrextend.sh
@ -92,7 +92,7 @@ RECORD_COUNT=$((RECORD_COUNT + 1))
 tpm2_pcrread sha256:11 -Q -o /tmp/oldpcr11
 # Do the equivalent of 'SYSTEMD_FORCE_MEASURE=1 "$SD_PCREXTEND" foobar' via Varlink, just to test the Varlink logic (but first we need to patch out the conditionalization...)
 mkdir -p /run/systemd/system/systemd-pcrextend.socket.d
-cat > /run/systemd/system/systemd-pcrextend.socket.d/50-no-condition.conf <<EOF
+cat >/run/systemd/system/systemd-pcrextend.socket.d/50-no-condition.conf <<EOF
 [Unit]
 # Turn off all conditions */
 ConditionSecurity=
--- a/test/units/TEST-70-TPM2.pcrlock.sh
+++ b/test/units/TEST-70-TPM2.pcrlock.sh
@ -196,7 +196,7 @@ SYSTEMD_XBOOTLDR_PATH=/tmp/fakexbootldr SYSTEMD_RELAX_XBOOTLDR_CHECKS=1 "$SD_PCR
 # Exercise Varlink API a bit (but first turn off condition)

 mkdir -p /run/systemd/system/systemd-pcrlock.socket.d
-cat > /run/systemd/system/systemd-pcrlock.socket.d/50-no-condition.conf <<EOF
+cat >/run/systemd/system/systemd-pcrlock.socket.d/50-no-condition.conf <<EOF
 [Unit]
 # Turn off all conditions
 ConditionSecurity=
--- a/test/units/TEST-74-AUX-UTILS.firstboot.sh
+++ b/test/units/TEST-74-AUX-UTILS.firstboot.sh
@ -224,7 +224,7 @@ if [ -d "/usr/share/keymaps/" ] || [ -d "/usr/share/kbd/keymaps/" ] || [ -d "/us

   rm "$ROOT/etc/vconsole.conf"
   # this should be a NOP, given that stdout is connected to /dev/null, and hence not a VT
-   systemd-firstboot --root="$ROOT" --prompt-keymap-auto > /dev/null
+   systemd-firstboot --root="$ROOT" --prompt-keymap-auto >/dev/null
 fi
 echo -ne "Europe/Berlin\n" | systemd-firstboot --root="$ROOT" --prompt-timezone
 readlink "$ROOT/etc/localtime" | grep -q "Europe/Berlin$"
--- a/test/units/TEST-74-AUX-UTILS.keyutil.sh
+++ b/test/units/TEST-74-AUX-UTILS.keyutil.sh
@ -49,20 +49,20 @@ testcase_public() {

 verify_pkcs7() {
    # Verify using internal certificate
-    openssl smime -verify -binary -inform der -in /tmp/payload.p7s -content /tmp/payload -noverify > /dev/null
+    openssl smime -verify -binary -inform der -in /tmp/payload.p7s -content /tmp/payload -noverify >/dev/null
    # Verify using external (original) certificate
-    openssl smime -verify -binary -inform der -in /tmp/payload.p7s -content /tmp/payload -noverify -certfile /tmp/test.crt -nointern > /dev/null
+    openssl smime -verify -binary -inform der -in /tmp/payload.p7s -content /tmp/payload -noverify -certfile /tmp/test.crt -nointern >/dev/null
 }

 verify_pkcs7_fail() {
    # Verify using internal certificate
-    (! openssl smime -verify -binary -inform der -in /tmp/payload.p7s -content /tmp/payload -noverify > /dev/null)
+    (! openssl smime -verify -binary -inform der -in /tmp/payload.p7s -content /tmp/payload -noverify >/dev/null)
    # Verify using external (original) certificate
-    (! openssl smime -verify -binary -inform der -in /tmp/payload.p7s -content /tmp/payload -noverify -certfile /tmp/test.crt -nointern > /dev/null)
+    (! openssl smime -verify -binary -inform der -in /tmp/payload.p7s -content /tmp/payload -noverify -certfile /tmp/test.crt -nointern >/dev/null)
 }

 testcase_pkcs7() {
-    echo -n "test" > /tmp/payload
+    echo -n "test" >/tmp/payload

    for hashalg in sha256 sha384 sha512; do
        # shellcheck disable=SC2086
--- a/test/units/TEST-74-AUX-UTILS.network-generator.sh
+++ b/test/units/TEST-74-AUX-UTILS.network-generator.sh
@ -15,12 +15,12 @@ at_exit() {
 trap at_exit EXIT

 mkdir -p /run/credstore
-cat > /run/credstore/network.conf.50-testme <<EOF
+cat >/run/credstore/network.conf.50-testme <<EOF
 [Network]
 SpeedMeter=yes
 EOF

-cat > /run/credstore/network.network.50-testme <<EOF
+cat >/run/credstore/network.network.50-testme <<EOF
 [Match]
 Property=IDONTEXIST
 EOF
--- a/test/units/TEST-74-AUX-UTILS.varlinkctl.sh
+++ b/test/units/TEST-74-AUX-UTILS.varlinkctl.sh
@ -175,8 +175,8 @@ varlinkctl introspect /run/systemd/io.systemd.Hostname io.systemd.Hostname
 varlinkctl call /run/systemd/io.systemd.Hostname io.systemd.Hostname.Describe '{}'

 # Validate that --exec results in the very same values
-varlinkctl call /run/systemd/io.systemd.Hostname io.systemd.Hostname.Describe '{}' | jq > /tmp/describe1.json
-varlinkctl --exec call /run/systemd/io.systemd.Hostname io.systemd.Hostname.Describe '{}' -- jq > /tmp/describe2.json
+varlinkctl call /run/systemd/io.systemd.Hostname io.systemd.Hostname.Describe '{}' | jq >/tmp/describe1.json
+varlinkctl --exec call /run/systemd/io.systemd.Hostname io.systemd.Hostname.Describe '{}' -- jq >/tmp/describe2.json
 cmp /tmp/describe1.json /tmp/describe2.json
 rm /tmp/describe1.json /tmp/describe2.json

--- a/test/units/TEST-75-RESOLVED.sh
+++ b/test/units/TEST-75-RESOLVED.sh
@ -817,7 +817,7 @@ testcase_09_resolvectl_showcache() {
        echo "[NetDev]"
        echo "Name=dns2"
        echo "Kind=dummy"
-    } > /run/systemd/network/10-dns2.netdev
+    } >/run/systemd/network/10-dns2.netdev
    {
        echo "[Match]"
        echo "Name=dns2"
@ -825,7 +825,7 @@ testcase_09_resolvectl_showcache() {
        echo "IPv6AcceptRA=no"
        echo "Address=10.123.0.1/24"
        echo "DNS=10.0.0.1"
-    } > /run/systemd/network/10-dns2.network
+    } >/run/systemd/network/10-dns2.network
    networkctl reload
    networkctl reconfigure dns2
    /usr/lib/systemd/systemd-networkd-wait-online --timeout=60 --dns --interface=dns2
@ -835,7 +835,7 @@ testcase_09_resolvectl_showcache() {
        echo "[Resolve]"
        echo "DNSSEC=no"
        echo "DNSOverTLS=no"
-    } > /run/systemd/resolved.conf.d/90-resolved.conf
+    } >/run/systemd/resolved.conf.d/90-resolved.conf
    systemctl reload systemd-resolved.service

    test "$(resolvectl show-cache --json=short | jq -rc '.[] | select(.ifname == "dns2" and .protocol == "dns") | .dnssec')" == 'no'
@ -845,7 +845,7 @@ testcase_09_resolvectl_showcache() {
        echo "[Resolve]"
        echo "DNSSEC=allow-downgrade"
        echo "DNSOverTLS=opportunistic"
-    } > /run/systemd/resolved.conf.d/90-resolved.conf
+    } >/run/systemd/resolved.conf.d/90-resolved.conf
    systemctl reload systemd-resolved.service

    test "$(resolvectl show-cache --json=short | jq -rc '.[] | select(.ifname == "dns2" and .protocol == "dns") | .dnssec')" == 'allow-downgrade'
--- a/test/units/TEST-80-NOTIFYACCESS.sh
+++ b/test/units/TEST-80-NOTIFYACCESS.sh
@ -15,7 +15,7 @@ sync_in() {
 }

 sync_out() {
-    echo "$1" > /tmp/syncfifo2
+    echo "$1" >/tmp/syncfifo2
 }

 export SYSTEMD_LOG_LEVEL=debug
--- a/test/units/TEST-87-AUX-UTILS-VM.validatefs.sh
+++ b/test/units/TEST-87-AUX-UTILS-VM.validatefs.sh
@ -28,14 +28,14 @@ at_exit() {
 trap at_exit EXIT

 mkdir /tmp/validatefs-test
-cat > /tmp/validatefs-test/validatefs-root.conf <<EOF
+cat >/tmp/validatefs-test/validatefs-root.conf <<EOF
 [Partition]
 Type=root
 Label=kromm
 Format=ext4
 EOF

-cat > /tmp/validatefs-test/validatefs-usr.conf <<EOF
+cat >/tmp/validatefs-test/validatefs-usr.conf <<EOF
 [Partition]
 Type=usr
 Label=plisch
@ -44,7 +44,7 @@ Verity=data
 VerityMatchKey=mupf
 EOF

-cat > /tmp/validatefs-test/validatefs-usr-verity.conf <<EOF
+cat >/tmp/validatefs-test/validatefs-usr-verity.conf <<EOF
 [Partition]
 Type=usr-verity
 Label=plisch-verity
@ -52,21 +52,21 @@ Verity=hash
 VerityMatchKey=mupf
 EOF

-cat > /tmp/validatefs-test/validatefs-home.conf <<EOF
+cat >/tmp/validatefs-test/validatefs-home.conf <<EOF
 [Partition]
 Type=home
 Label=rupft
 Format=ext4
 EOF

-cat > /tmp/validatefs-test/validatefs-esp.conf <<EOF
+cat >/tmp/validatefs-test/validatefs-esp.conf <<EOF
 [Partition]
 Type=esp
 Label=fumm
 Format=vfat
 EOF

-cat > /tmp/validatefs-test/validatefs-generic.conf <<EOF
+cat >/tmp/validatefs-test/validatefs-generic.conf <<EOF
 [Partition]
 Label=qnurx
 Type=linux-generic
--- a/tools/setup-musl-build.sh
+++ b/tools/setup-musl-build.sh
@ -0,0 +1,85 @@
+#!/bin/bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+# Usage:
+#   tools/setup-musl-build.sh <build-directory> <options…>
+# E.g.
+#   tools/setup-musl-build.sh build-musl -Dbuildtype=debugoptimized && ninja -C build-musl
+
+set -eu
+
+BUILD_DIR="${1:?}"
+shift
+
+SETUP_DIR="${BUILD_DIR}/extra"
+
+LINKS=(
+    acl
+    archive.h
+    archive_entry.h
+    asm
+    asm-generic
+    audit-records.h
+    audit_logging.h
+    bpf
+    bzlib.h
+    curl
+    dwarf.h
+    elfutils
+    fido.h
+    gcrypt.h
+    gelf.h
+    gnutls
+    gpg-error.h
+    idn2.h
+    libaudit.h
+    libcryptsetup.h
+    libelf.h
+    libkmod.h
+    linux
+    lz4.h
+    lz4frame.h
+    lz4hc.h
+    lzma
+    lzma.h
+    microhttpd.h
+    mtd
+    openssl
+    pcre2.h
+    pwquality.h
+    qrencode.h
+    seccomp-syscalls.h
+    seccomp.h
+    security
+    selinux
+    sys/acl.h
+    sys/capability.h
+    tss2
+    xen
+    xkbcommon
+    zconf.h
+    zlib.h
+    zstd.h
+    zstd_errors.h
+)
+
+for t in "${LINKS[@]}"; do
+    [[ -e /usr/include/"$t" ]]
+    link="${SETUP_DIR}/usr/include/${t}"
+    mkdir -p "${link%/*}"
+    ln -s /usr/include/"$t" "$link"
+done
+
+# Use an absolute path so that when we chdir into the build directory,
+# the path still works. This is easier than figuring out the relative path.
+[[ "${SETUP_DIR}" =~ ^/ ]] || SETUP_DIR="${PWD}/${SETUP_DIR}"
+
+CFLAGS="-idirafter ${SETUP_DIR}/usr/include"
+
+set -x
+env \
+    CC=musl-gcc \
+    CXX=musl-gcc \
+    CFLAGS="$CFLAGS" \
+    CXXFLAGS="$CFLAGS" \
+    meson setup -Ddbus-interfaces-dir=no -Dlibc=musl "${BUILD_DIR}" "${@}"
Author	SHA1	Message	Date
Luca Boccassi	d810cfcc5a	meson: bump version to v259~rc1	2025-11-17 18:36:12 +00:00
Luca Boccassi	9ede3c125a	meson: bump library sonames for v259~rc1	2025-11-17 18:36:12 +00:00
Luca Boccassi	c076689342	NEWS: finalize time and place	2025-11-17 18:36:12 +00:00
Luca Boccassi	2389784079	NEWS: update contributors list	2025-11-17 18:36:12 +00:00
Luca Boccassi	8ca3935118	NEWS: copy yet again sysvinit scripts removal announcement Soon (TM)	2025-11-17 18:36:12 +00:00
Yu Watanabe	92a224c9b4	musl: gracefully disable utmp support (#39775 )	2025-11-18 03:29:34 +09:00
Yu Watanabe	bd3fc5c539	Revert "musl: utmpx: add several missing definitions" This reverts commit 3ae7d8fd8731c3412df878e8d1e8af9a8e644576. Now utmp support is always disabled when building with musl, and all definitions are unused in that case. Let's remove it.	2025-11-18 03:06:02 +09:00
Yu Watanabe	1a2ba82421	musl: meson: gracefully disable utmp support musl only provides fake utmp functions, and these are not usable. Let's disable the feature when building with musl.	2025-11-18 02:54:20 +09:00
Yu Watanabe	0ecff59065	Revert "musl: meson: add libutmps support" This reverts commit bf9bc5beb090bb35184caf34cc641e708615e83a. libutmps does not support utmpxname(), the function always fails with ENOSYS, and always uses their own file. However, our code relies on the funtion needs to succeed. Let's revert the change now, and revisit later when musl users request to support libutmps.	2025-11-18 02:54:20 +09:00
Luca Boccassi	00ed239a7b	repart: prefix LUKS superblock label with "luks-" by default, and add explicit VolumeLabel= setting to control it (#39713 ) Alternative-to: #39536	2025-11-17 17:46:39 +00:00
Yu Watanabe	1b9f3473c1	NEWS: menton future removal of SysV support and requirement bump	2025-11-18 02:40:22 +09:00
Yu Watanabe	43a1690e45	Split out script for musl builds (#39758 )	2025-11-18 02:17:05 +09:00
Philip Withnall	69f1a1d5ed	docs: Update MEMORY_PRESSURE to mention recent improvements in GLib See https://gitlab.gnome.org/GNOME/glib/-/issues/2931 for the changes in GLib upstream. Using `GMemoryMonitor` is now more compliant with the systemd recommended approach, but it needs further work to read the recommended environment variables rather than unconditionally accessing the per-cgroup PSI kernel file directly. Signed-off-by: Philip Withnall <pwithnall@gnome.org>	2025-11-17 18:05:41 +01:00
Lennart Poettering	0712316e8e	fs-util: enable automatic access mode logic in xopenat()	2025-11-18 01:31:49 +09:00
Yu Watanabe	07910c73b0	test: modernize test-log and add test cases for log_format_iovec() (#39750 )	2025-11-18 01:31:02 +09:00
Zbigniew Jędrzejewski-Szmek	18dcc08c65	ci: whitespace fix	2025-11-17 17:02:23 +01:00
Zbigniew Jędrzejewski-Szmek	31d3b96293	musl: split out script to setup build This makes it easier to set up a local build with musl: $ tools/setup-musl-build.sh build-meson $ ninja -C build-meson	2025-11-17 17:02:23 +01:00
Zbigniew Jędrzejewski-Szmek	6edbf6a2c7	musl: drop unused temporary pkgonfig directory	2025-11-17 16:56:51 +01:00
Lennart Poettering	1daf7b56bb	tmpfile-util: make sure errno is left untouched by CLEANUP_TMPFILE_AT() This mimics how rm_rf_physical_and_free() operate, and we should do the same here, and make clean-up error paths not touch errno needlessly.	2025-11-17 16:53:31 +01:00
Lennart Poettering	a5023c7a4b	nspawn: move oci code to use json_dispatch_strv_environment()	2025-11-17 16:53:13 +01:00
Zbigniew Jędrzejewski-Szmek	93470f0451	Various comment and whitespace cleanups (#39740 )	2025-11-17 16:52:38 +01:00
Zbigniew Jędrzejewski-Szmek	01100f15ad	tree-wide: drop space after shell redirection ops Those are all unary operators.	2025-11-17 16:50:50 +01:00
Zbigniew Jędrzejewski-Szmek	3a5e748f6b	core/namespace: tidy up comments and debug logs Saying "table" everywhere is not needed. Everybody can see that the table is a table is a table. Also tweak the grammar in various places to make reading nicer.	2025-11-17 16:50:50 +01:00
Lennart Poettering	0d24626631	test: add testcase for VolumeLabel=	2025-11-17 16:43:21 +01:00
Lennart Poettering	e30738c20c	dissect-tool: accept encryption password via $PASSWORD	2025-11-17 16:42:58 +01:00
Lennart Poettering	28fd2a66f4	nspawn: fix flags type for chase()	2025-11-18 00:36:58 +09:00
Lennart Poettering	d3c6a172a0	discover-image: support reading metadata from verity enabled DDI images, too	2025-11-18 00:35:49 +09:00
Pranay Pawar	7e8f6ece84	hwdb: Fix keyboard backlight keys on Acer Nitro 5 AN515-58 (#39769 ) Pressing Fn+F10 on Acer Nitro 5 AN515-58 incorrectly triggers display brightness down (scancode 0xef) instead of keyboard backlight control, causing the screen to go completely dark. Similarly, Fn+F9 (scancode 0xf0) has no function explictily stated in hwdb causing unknown keycode debug messages. Both keys should control the keyboard backlight as labeled on the keyboard. Map scancodes 0xef and 0xf0 to kbdillumup and kbdillumdown respectively to enable proper keyboard backlight control.	2025-11-18 00:33:42 +09:00
Lennart Poettering	d343a044a2	NEWS: mention the LUKS superblock default labelling change. This is a (weak) compat break, hence document it in NEWS.	2025-11-17 15:38:01 +01:00
Lennart Poettering	0a03092cb5	repart: avoid label string clashes between LUKS superblocks and the filesystems on them Let's make sure that by default /dev/disk/by-label/ symlinks avoid ambiguities, and the LUKS volume carries a different one than the file system inside it. Alternative-to: #39536	2025-11-17 15:37:14 +01:00
Yu Watanabe	f10444319e	test-log: add test cases for log_format_iovec()	2025-11-17 23:07:05 +09:00
Yu Watanabe	c1792c2005	test-log: migrate to use ASSERT_OK() and friends	2025-11-17 23:07:05 +09:00
Yu Watanabe	d753c0c658	log: replace format string in LOG_ITEM() to a dummy one when analyzed by Coverity Hopefully silence many false-positives.	2025-11-17 23:06:53 +09:00
Yu Watanabe	1f546ab779	log: make each string generated in log_format_iovec() NUL terminated Nowadays, we append an extra NUL for each data if possible for safety. We already do the same for example at write_to_kmsg(), log_do_context(), write_to_journal(), log_struct_iovec_internal(), and so on. This does not change any behavior, as the iov_len field is unchanged.	2025-11-17 22:38:38 +09:00
Zbigniew Jędrzejewski-Szmek	cd398158df	TODO: add two entries	2025-11-15 16:16:45 +01:00
Zbigniew Jędrzejewski-Szmek	6352ec2b67	ssh-generator: tweak comments	2025-11-14 13:05:11 +01:00
 @ -1 +1 @@
 ~devel
 ~rc1