sysusers: document u! version support

Document at which version the exclamation mark suffix is supported.
Version 215 at the end of the list item is a bit misleading.

NEWS

@@ -4635,7 +4635,7 @@ CHANGES WITH 255:
         * A new component "systemd-storagetm" has been added, which exposes all
           local block devices as NVMe-TCP devices, fully automatically. It's
           hooked into a new target unit storage-target-mode.target that is
-          suppsoed to be booted into via
+          supposed to be booted into via
           rd.systemd.unit=storage-target-mode.target on the kernel command
           line. This is intended to be used for installers and debugging to
           quickly get access to the local disk. It's inspired by MacOS "target

man/sysusers.d.xml

@@ -119,13 +119,15 @@ r     -        500-900
           bearing the same name unless the ID field specifies it. The account will be
           created disabled, so that logins are not allowed.</para>
 
+          <xi:include href="version-info.xml" xpointer="v215"/>
+
           <para>Type <varname>u</varname> may be suffixed with an exclamation mark (<literal>u!</literal>) to
           create a fully locked account. This is recommended, since logins should typically not be allowed
           for system users. With or without the exclamation mark an invalid password is set. For
           <literal>u!</literal>, the account is also locked, which makes a difference for non-password forms
           of authentication, such as SSH or similar.</para>
 
-          <xi:include href="version-info.xml" xpointer="v215"/></listitem>
+          <xi:include href="version-info.xml" xpointer="v257"/></listitem>
         </varlistentry>
 
         <varlistentry>

man/ukify.xml

@@ -365,7 +365,10 @@
           <listitem><para>The os-release description (the <literal>.osrel</literal> section). The argument
           may be a literal string, or <literal>@</literal> followed by a path name. If not specified, the
           <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry> file
-          will be picked up from the host system.</para>
+          will be picked up from the host system. If explicitly set to an empty string, the ".osrel" section
+          is omitted from the UKI (this is not recommended in most cases, and causes the resulting artifact
+          to not be recognized as a UKI by other tools like <command>kernel-install</command>
+          and <command>bootctl</command>).</para>
 
           <xi:include href="version-info.xml" xpointer="v253"/></listitem>
         </varlistentry>

mkosi/mkosi.tools.conf/mkosi.conf.d/ubuntu/mkosi.sandbox/etc/apt/preferences.d/qemu-noble-proposed.pref

@@ -1,3 +0,0 @@
-Package: src:qemu:any
-Pin: release a=noble-proposed
-Pin-Priority: 550

mkosi/mkosi.tools.conf/mkosi.conf.d/ubuntu/mkosi.sandbox/etc/apt/sources.list.d/noble-proposed.sources

@@ -1,5 +0,0 @@
-Types: deb deb-src
-URIs: http://archive.ubuntu.com/ubuntu/
-Suites: noble-proposed
-Components: main universe
-Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

src/ukify/test/test_ukify.py

@@ -641,7 +641,7 @@ def test_efi_signing_pesign(kernel_initrd, tmp_path):
 
     shutil.rmtree(tmp_path)
 
-def test_inspect(kernel_initrd, tmp_path, capsys):
+def test_inspect(kernel_initrd, tmp_path, capsys, osrel=True):
     if kernel_initrd is None:
         pytest.skip('linux+initrd not found')
     if not shutil.which('sbsign'):
@@ -653,7 +653,7 @@ def test_inspect(kernel_initrd, tmp_path, capsys):
 
     output = f'{tmp_path}/signed2.efi'
     uname_arg='1.2.3'
-    osrel_arg='Linux'
+    osrel_arg='Linux' if osrel else ''
     cmdline_arg='ARG1 ARG2 ARG3'
 
     args = [
@@ -680,8 +680,12 @@ def test_inspect(kernel_initrd, tmp_path, capsys):
 
     text = capsys.readouterr().out
 
+    if osrel:
         expected_osrel = f'.osrel:\n  size: {len(osrel_arg)}'
         assert expected_osrel in text
+    else:
+        assert '.osrel:' not in text
+
     expected_cmdline = f'.cmdline:\n  size: {len(cmdline_arg)}'
     assert expected_cmdline in text
     expected_uname = f'.uname:\n  size: {len(uname_arg)}'
@@ -694,6 +698,9 @@ def test_inspect(kernel_initrd, tmp_path, capsys):
 
     shutil.rmtree(tmp_path)
 
+def test_inspect_no_osrel(kernel_initrd, tmp_path, capsys):
+    test_inspect(kernel_initrd, tmp_path, capsys, osrel=False)
+
 @pytest.mark.skipif(not slow_tests, reason='slow')
 def test_pcr_signing(kernel_initrd, tmp_path):
     if kernel_initrd is None:

src/ukify/ukify.py

@@ -1477,6 +1477,9 @@ def make_uki(opts: UkifyConfig) -> None:
         '.profile',
     }
 
+    if not opts.os_release:
+        to_import.remove('.osrel')
+
     for profile in opts.join_profiles:
         pe = pefile.PE(profile, fast_load=True)
         prev_len = len(uki.sections)
@@ -2412,7 +2415,12 @@ def finalize_options(opts: argparse.Namespace) -> None:
 
     opts.os_release = resolve_at_path(opts.os_release)
 
-    if not opts.os_release and opts.linux:
+    if opts.os_release == '':
+        # If --os-release= with an empty string was passed, treat that as
+        # explicitly disabling the .osrel section, and do not fallback to the
+        # system's os-release files.
+        pass
+    elif opts.os_release is None and opts.linux:
         p = Path('/etc/os-release')
         if not p.exists():
             p = Path('/usr/lib/os-release')

test/units/TEST-04-JOURNAL.journal-remote.sh

@@ -61,7 +61,7 @@ openssl req -x509 -nodes -newkey rsa:2048 -sha256 -days 7 \
 chown -R systemd-journal-remote /run/systemd/journal-remote-tls
 
 # Configure journal-upload to upload journals to journal-remote without client certificates
-mkdir -p /run/systemd/journal-{remote,upload}.conf.d
+mkdir -pZ /run/systemd/journal-{remote,upload}.conf.d
 cat >/run/systemd/journal-remote.conf.d/99-test.conf <<EOF
 [Remote]
 SplitMode=host

test/units/TEST-13-NSPAWN.unpriv.sh

@@ -13,6 +13,7 @@ if ! can_do_rootless_nspawn; then
 fi
 
 at_exit() {
+    rm -rf /home/testuser/.local/state/machines/.tar-file* ||:
     rm -rf /home/testuser/.local/state/machines/zurps ||:
     rm -rf /home/testuser/.local/state/machines/nurps ||:
     rm -rf /home/testuser/.local/state/machines/kurps ||: