Merge remote-tracking branch 'origin/apertis/v2022dev3' into...

Merge remote-tracking branch 'origin/apertis/v2022dev3' into proposed-updates/debian/bullseye/8d2817af

debian/apertis/component

+target

debian/apertis/copyright

+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+
+Files: debian/*
+Copyright: 2010-2013 Tollef Fog Heen <tfheen@debian.org>
+           2013-2018 Michael Biebl <biebl@debian.org>
+           2013 Michael Stapelberg <stapelberg@debian.org>
+License: LGPL-2.1+
+
+Files: debian/extra/systemd.py
+ debian/extra/udev.py
+Copyright: 2009, 2014-2016, Canonical Ltd.
+License: LGPL-2.1+
+
+Files: debian/extra/tmpfiles.d/*
+Copyright: 2010-2013 Tollef Fog Heen <tfheen@debian.org>
+           2013-2018 Michael Biebl <biebl@debian.org>
+           2013 Michael Stapelberg <stapelberg@debian.org>
+License: GPL-2+
+
+Files: debian/lib.systemd.systemd-logind
+Copyright: 2015-2017, Collabora Ltd.
+License: MPL-2.0
+
+Files: debian/tests/boot-and-services
+ debian/tests/build-login
+ debian/tests/storage
+ debian/tests/systemd-fsckd
+ debian/tests/udev
+ debian/tests/unit-config
+Copyright: 2009, 2014-2016, Canonical Ltd.
+License: LGPL-2.1+
+
+Files: hwdb/*
+Copyright: no-info-found
+License: Expat
+
+Files: man/systemd-fsckd.service.xml
+Copyright: 2015, Canonical
+License: LGPL-2.1+
+
+Files: modprobe.d/*
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: network/*
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: presets/*
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: rules/*
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: shell-completion/*
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: shell-completion/bash/coredumpctl
+ shell-completion/bash/hostnamectl
+ shell-completion/bash/journalctl
+ shell-completion/bash/localectl
+ shell-completion/bash/loginctl
+ shell-completion/bash/systemd-analyze
+ shell-completion/bash/timedatectl
+ shell-completion/bash/udevadm
+Copyright: 2010, Ran Benita
+License: LGPL-2.1+
+
+Files: src/*
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: src/basic/sparse-endian.h
+Copyright: 2012, Josh Triplett <josh@joshtriplett.org>
+License: Expat
+
+Files: src/basic/utf8.c
+Copyright: 2000, Red Hat, Inc.
+ 1999, Tom Tromey
+License: LGPL-2+
+
+Files: src/fsckd/*
+Copyright: 2015, Canonical
+License: LGPL-2.1+
+
+Files: src/journal/*
+Copyright: 2012, B. Poettering
+License: LGPL-2.1+
+
+Files: src/journal/journald.conf
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: src/network/networkd.conf
+ src/network/org.freedesktop.network1.conf
+ src/network/org.freedesktop.network1.service
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: src/shared/initreq.h
+Copyright: 1995-2004, Miquel van Smoorenburg
+License: LGPL-2+
+
+Files: src/shared/linux-3.13/*
+Copyright: 2004-2009, Red Hat, Inc.
+ 2001-2003, Sistina Software (UK) Limited.
+License: LGPL
+
+Files: src/shared/linux/*
+Copyright: 2008, Red Hat, Inc.
+ 2008, Ian Kent <raven@themaw.net>
+License: GPL-2
+
+Files: src/shared/linux/bpf.h
+Copyright: 2011-2014, PLUMgrid, http:plumgrid.com
+License: GPL-2
+
+Files: src/systemd/sd-dhcp-client.h
+ src/systemd/sd-dhcp-lease.h
+ src/systemd/sd-dhcp-server.h
+ src/systemd/sd-dhcp6-client.h
+ src/systemd/sd-dhcp6-lease.h
+ src/systemd/sd-ndisc.h
+ src/systemd/sd-radv.h
+Copyright: 2013-2015, 2017, Intel Corporation.
+License: LGPL-2.1+
+
+Files: src/systemd/sd-ipv4acd.h
+ src/systemd/sd-ipv4ll.h
+Copyright: 2014, Axis Communications AB.
+License: LGPL-2.1+
+
+Files: src/test/test-systemd-tmpfiles.py
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: src/udev/mtd_probe/*
+Copyright: 2010, - Maxim Levitsky
+License: GPL-2+
+
+Files: src/udev/scsi_id/scsi.h
+Copyright: IBM Corp. 2003
+License: GPL-2
+
+Files: src/udev/udev-ctrl.c
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: src/udev/udevadm-control.c
+Copyright: no-info-found
+License: GPL-2+
+
+Files: src/udev/v4l_id/*
+Copyright: 2009, Filippo Argiolas <filippo.argiolas@gmail.com>
+License: GPL-2+
+
+Files: sysctl.d/*
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: sysusers.d/*
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: test/fuzz/*
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: tmpfiles.d/*
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: tools/*
+Copyright: no-info-found
+License: Expat
+
+Files: units/*
+Copyright: no-info-found
+License: LGPL-2.1+
+
+Files: * .mkosi/* .ycm_extra_conf.py catalog/* catalog/systemd.bg.catalog.in catalog/systemd.fr.catalog.in catalog/systemd.hu.catalog.in catalog/systemd.it.catalog.in catalog/systemd.pt_BR.catalog.in catalog/systemd.zh_CN.catalog.in catalog/systemd.zh_TW.catalog.in man/* man/environment.d.xml man/journal-remote.conf.xml man/networkd.conf.xml man/sd_journal_has_runtime_files.xml man/standard-conf.xml man/systemd-machine-id-commit.service.xml man/tmpfiles.d.xml man/udev.xml shell-completion/bash/systemctl.in src/analyze/* src/basic/* src/basic/raw-clone.h src/basic/smack-util.c src/basic/smack-util.h src/basic/smack-util.c src/basic/smack-util.h src/boot/* src/boot/efi/shim.c src/boot/efi/shim.h src/boot/efi/shim.c src/boot/efi/shim.h src/core/dbus-swap.c src/core/dbus-swap.h src/core/swap.h src/core/dbus-swap.c src/core/dbus-swap.h src/core/swap.h src/core/dbus-swap.c src/core/dbus-swap.h src/core/swap.h src/core/ima-setup.c src/core/ima-setup.h src/core/ima-setup.c src/core/ima-setup.h src/core/killall.c src/core/shutdown.c src/core/umount.c src/core/umount.h src/core/killall.c src/core/shutdown.c src/core/umount.c src/core/umount.h src/core/killall.c src/core/shutdown.c src/core/umount.c src/core/umount.h src/core/killall.c src/core/shutdown.c src/core/umount.c src/core/umount.h src/core/load-fragment.c src/core/namespace.h src/core/smack-setup.c src/core/smack-setup.h src/core/smack-setup.c src/core/smack-setup.h src/core/triggers.systemd.in src/fsck/* src/import/import-pubring.gpg src/libsystemd-network/* src/libsystemd-network/arp-util.c src/libsystemd-network/arp-util.h src/libsystemd-network/sd-ipv4acd.c src/libsystemd-network/sd-ipv4ll.c src/libsystemd-network/test-ipv4ll.c src/libsystemd-network/arp-util.c src/libsystemd-network/arp-util.h src/libsystemd-network/sd-ipv4acd.c src/libsystemd-network/sd-ipv4ll.c src/libsystemd-network/test-ipv4ll.c src/libsystemd-network/arp-util.c src/libsystemd-network/arp-util.h src/libsystemd-network/sd-ipv4acd.c src/libsystemd-network/sd-ipv4ll.c src/libsystemd-network/test-ipv4ll.c src/libsystemd-network/arp-util.c src/libsystemd-network/arp-util.h src/libsystemd-network/sd-ipv4acd.c src/libsystemd-network/sd-ipv4ll.c src/libsystemd-network/test-ipv4ll.c src/libsystemd-network/arp-util.c src/libsystemd-network/arp-util.h src/libsystemd-network/sd-ipv4acd.c src/libsystemd-network/sd-ipv4ll.c src/libsystemd-network/test-ipv4ll.c src/libsystemd/sd-hwdb/* src/libudev/libudev-queue.c src/network/* src/network/netdev/* src/network/networkd-brvlan.c src/network/networkd-brvlan.h src/network/networkd-brvlan.c src/network/networkd-brvlan.h src/network/networkd-conf.c src/network/networkd-conf.h src/network/networkd-conf.c src/network/networkd-conf.h src/shared/* src/shared/sleep-config.c src/sleep/sleep.c src/sulogin-shell/* src/test/* src/test/test-clock.c src/test/test-conf-files.c src/test/test-list.c src/test/test-udev.c src/tty-ask-password-agent/* src/vconsole/vconsole-setup.c test/* test/splash.bmp test/test-exec-deserialization.py test/test-resolve/* test/test-resolve/fedoraproject.org.pkts test/test-resolve/kyhwana.org.pkts test/test-resolve/zbyszek@fedoraproject.org.pkts test/udev-test.pl
+Copyright: 2008-2015 Kay Sievers <kay@vrfy.org>
+ 2010-2015 Lennart Poettering
+ 2012-2015 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
+ 2013-2015 Tom Gundersen <teg@jklm.no>
+ 2013-2015 Daniel Mack
+ 2010-2015 Harald Hoyer
+ 2013-2015 David Herrmann
+ 2013, 2014 Thomas H.P. Andersen
+ 2013, 2014 Daniel Buch
+ 2014 Susant Sahani
+ 2009-2015 Intel Corporation
+ 2000, 2005 Red Hat, Inc.
+ 2009 Alan Jenkins <alan-jenkins@tuffmail.co.uk>
+ 2010 ProFUSION embedded systems
+ 2010 Maarten Lankhorst
+ 1995-2004 Miquel van Smoorenburg
+ 1999 Tom Tromey
+ 2011 Michal Schmidt
+ 2012 B. Poettering
+ 2012 Holger Hans Peter Freyther
+ 2012 Dan Walsh
+ 2012 Roberto Sassu
+ 2013 David Strauss
+ 2013 Marius Vollmer
+ 2013 Jan Janssen
+ 2013 Simon Peeters
+License: LGPL-2.1+
+
+Files: src/udev/* src/udev/ata_id/* src/udev/scsi_id/* src/udev/scsi_id/scsi_id.c src/udev/udev-builtin-blkid.c src/udev/udev-builtin-input_id.c src/udev/udev-builtin-kmod.c src/udev/udev-builtin-usb_id.c src/udev/udev-watch.c src/udev/udevadm-settle.c src/udev/udev-watch.c src/udev/udevadm-settle.c src/udev/udevd.c
+Copyright: 2003-2012 Kay Sievers <kay@vrfy.org>
+ 2003-2004 Greg Kroah-Hartman <greg@kroah.com>
+ 2004 Chris Friesen <chris_friesen@sympatico.ca>
+ 2004, 2009, 2010 David Zeuthen <david@fubar.dk>
+ 2005, 2006 SUSE Linux Products GmbH
+ 2003 IBM Corp.
+ 2007 Hannes Reinecke <hare@suse.de>
+ 2009 Canonical Ltd.
+ 2009 Scott James Remnant <scott@netsplit.com>
+ 2009 Martin Pitt <martin.pitt@ubuntu.com>
+ 2009 Piter Punk <piterpunk@slackware.com>
+ 2009, 2010 Lennart Poettering
+ 2009 Filippo Argiolas <filippo.argiolas@gmail.com>
+ 2010 Maxim Levitsky
+ 2011 ProFUSION embedded systems
+ 2011 Karel Zak <kzak@redhat.com>
+ 2014 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
+ 2014 David Herrmann <dh.herrmann@gmail.com>
+ 2014 Carlos Garnacho <carlosg@gnome.org>
+License: GPL-2+

debian/changelog

@@ -66,6 +66,82 @@ systemd (247.3-2) unstable; urgency=medium
 
  -- Michael Biebl <biebl@debian.org>  Sat, 06 Mar 2021 22:32:14 +0100
 
+systemd (247.3-1apertis5) apertis; urgency=medium
+
+  * Fix access to run/systemd/notify for systemd-logind in apparmor rule
+
+ -- Frédéric Danis <frederic.danis@collabora.com>  Mon, 14 Jun 2021 15:06:35 +0200
+
+systemd (247.3-1apertis4) apertis; urgency=medium
+
+  * Fix bashisms in kernel-install scripts.
+    Remove negotiation from `-z` to test for non-emptiness instead of
+    previously added version reversing those tests logic.
+  * kernel-install: allow to create $BOOT/$MACHINE_ID.
+    Commit [cf73f650890](https://github.com/systemd/systemd/commit/cf73f650890)
+    provides script `00-entry-directory.install` which creates the entry
+    directory only if `$BOOT/$MACHINE_ID` folder exists.
+    This part was moved out of `kernel-install` script and may introduce
+    the problem during upgrade since before Apertis v2022dev2 we do kernel
+    install with `$MACHINE_ID` generated in a build time. Later we remove
+    `/etc/machine-id` file allowing to generate an unique machine ID during
+    first boot, so there will be no directory `$BOOT/$MACHINE_ID` with a new
+    ID preventing from new entry generation during kernel upgrade in runtime.
+    Hence remove the part checking the `$BOOT/$MACHINE_ID` existence and
+    allow to create the proper entry in any case, returning the previous
+    `kernel-install` behaviour.
+  * Fix kernel-install call from update-initramfs.
+    Fix parameters assignment in `kernel-install` while calling
+    from `update-initramfs` or any package update except kernel.
+  * 85-initrd: fix the args number
+    `kernel-install` pass 5 args to modules anyway, so empty argument
+    do not allow to install the initrd file into boot entry directory.
+    Since we do not pass the initrd name via options module
+    `90-loaderentry.install` also skip the initrd copying and setup.
+  * Refresh patch for UEFI entries generator.
+    Update names for entry directories variables and fix options count.
+  * Fix the path to bootable binaries in efi entry
+    `stat` doesn't work well inside of the systemd-nspawn container
+    created by Debos returning "?" instead of mountpoint.
+    Fall back to the provided directory, since we have separate
+    partition for "/boot/efi".
+    This change allow to use correct paths for kernel and initrd
+    for entry generation.
+
+ -- Denis Pynkin <denis.pynkin@collabora.com>  Mon, 03 May 2021 23:16:58 +0000
+
+systemd (247.3-1apertis3) apertis; urgency=medium
+
+  * Fix syntax in kernel-install.
+    Fixed syntax of kernel-install script introduced during
+    the merge with newer version from bullseye.
+  * Remove bashisms from the entry directory plugin
+    - Use [ not [[ and -n to test for non-emptiness
+
+ -- Denis Pynkin <denis.pynkin@collabora.com>  Mon, 26 Apr 2021 23:21:30 +0300
+
+systemd (247.3-1apertis2) apertis; urgency=medium
+
+  [ Sjoerd Simons ]
+  * Fix debian/control syntax.
+
+  [ Walter Lozano ]
+  * Switch to OpenSSL, drop systemd-journal-remote and its dependency on
+    libmicrohttpd-dev
+
+ -- Emanuele Aina <emanuele.aina@collabora.com>  Wed, 24 Mar 2021 10:11:04 +0000
+
+systemd (247.3-1apertis1) apertis; urgency=medium
+
+  * Merge from Debian Bullseye. Remaining changes:
+    + Fix bashisms in various scripts
+    + Add systemd-boot package
+    + AppArmor: Add systemd-logind profile
+    + Don’t build against libdw, since 0.158 isn’t available in target.
+    * Add /usr to non-unmountable list.
+
+ -- Sjoerd Simons <sjoerd@collabora.com>  Tue, 16 Mar 2021 21:06:54 +0100
+
 systemd (247.3-1) unstable; urgency=medium
 
   [ Michael Biebl ]
@@ -1069,6 +1145,155 @@ systemd (242-1) experimental; urgency=medium
 
  -- Michael Biebl <biebl@debian.org>  Wed, 08 May 2019 01:33:56 +0200
 
+systemd (241-7~deb10u6co2) apertis; urgency=medium
+
+  * Add /usr to non-unmountable list.
+    For Apertis we don't support `/usr` being a seperate partition, the only time
+    `/usr` is on a mountpoint is when using ostree images (where it is a bind mount
+    and which use a merged-usr layout). So also add `/usr` to the list of paths that
+    are considered unmountable even with split-usr support enabled in systemd.
+
+ -- Denis Pynkin <denis.pynkin@collabora.com>  Wed, 10 Mar 2021 02:09:16 +0300
+
+systemd (241-7~deb10u6co1) apertis; urgency=medium
+
+  [ Ritesh Raj Sarraf ]
+  * Merge changes from Debian Buster. Remaining changes:
+    + Fix syntax error in shell script
+    + Fix new bashisms introduced on update.
+    + AppArmor: Fix conflict with chaiwala-apparmor-profiles
+    + AppArmor: Add systemd-logind profile
+    + Don’t build against libdw, since 0.158 isn’t available in target.
+    + Drop patch apertis/0101-basic-cap-list-parse-print-numerical-capabilities.patch
+    + Drop patch apertis/0102-basic-capability-util-let-cap_last_cap-return-unsign.patch
+    + Drop patch apertis/0103-basic-cap-list-reduce-scope-of-variables.patch
+
+  [ Denis Pynkin ]
+  * Force the call of systemd-journal-flush before `/var` unmount.
+    The problem with failed `/var` unmount placed on separate partition
+    have a long story: https://github.com/systemd/systemd/issues/867
+    According messages after the fix integrated into upstream -- there are
+    some corner cases which aren't fully fixed by patches adding [relinquish
+    options](https://gitlab.apertis.org/pkg/systemd/-/merge_requests/26)
+    In case of ostree-based images we have a similar issue since `/var` is
+    bind-mounted in initramfs. Systemd is trying to unmount `/var` on
+    shutdown, however `ExecStop=` command from `systemd-journal-flush`
+    service is not executed during shutdown.
+    By adding `PartOf=var.mount` into service file we force the
+    `systemd-journal-flush.service` to be called prior the `/var` unmount.
+    This allow to unlock the bind-mount, since `journald` have a chance to
+    re-link it's journal into `/run` with `journalctl
+    --smart-relinquish-var` call.
+  * Handle new capabilities gracefully (PR 16424)
+    Backported PR 16424 to avoid message
+    'Failed to parse bus message: Invalid argument'
+    with an updated kernel using new capabilities.
+
+  [ Frédéric Danis ]
+  * systemd-boot: backport fix of menu ordering with boot counting
+    systemd-boot selects the last valid entry by default, not the first, which
+    prevent correct rollback.
+
+  [ Martyn Welch ]
+  * journald: Backport support for --relinquish and --smart-relinquish options.
+    Newer version of systemd-journald support the --relinquish and
+    --smart-relinquish options that enable cleaner handling of mounts at
+    shutdown as journald can be told to close any logging under
+    /var/log/journal so that the /var filesystem can be unmounted should it be
+    on a separate partition.
+    Backport this feature as it enables shutdown without failures, a highly
+    desirable trait in embedded products using systemd.
+
+ -- Ritesh Raj Sarraf <ritesh.sarraf@collabora.com>  Tue, 09 Mar 2021 15:58:45 +0530
+
+systemd (241-7~deb10u4co5) apertis; urgency=medium
+
+  * Force the call of systemd-journal-flush before `/var` unmount.
+    The problem with failed `/var` unmount placed on separate partition
+    have a long story: https://github.com/systemd/systemd/issues/867
+    According messages after the fix integrated into upstream -- there are
+    some corner cases which aren't fully fixed by patches adding [relinquish
+    options](https://gitlab.apertis.org/pkg/systemd/-/merge_requests/26)
+    In case of ostree-based images we have a similar issue since `/var` is
+    bind-mounted in initramfs. Systemd is trying to unmount `/var` on
+    shutdown, however `ExecStop=` command from `systemd-journal-flush`
+    service is not executed during shutdown.
+    By adding `PartOf=var.mount` into service file we force the
+    `systemd-journal-flush.service` to be called prior the `/var` unmount.
+    This allow to unlock the bind-mount, since `journald` have a chance to
+    re-link it's journal into `/run` with `journalctl
+    --smart-relinquish-var` call.
+
+ -- Denis Pynkin <denis.pynkin@collabora.com>  Tue, 17 Nov 2020 23:54:02 +0300
+
+systemd (241-7~deb10u4co4) apertis; urgency=medium
+
+  * Handle new capabilities gracefully (PR 16424)
+    Backported PR 16424 to avoid message
+    'Failed to parse bus message: Invalid argument'
+    with an updated kernel using new capabilities.
+
+ -- Denis Pynkin <denis.pynkin@collabora.com>  Sun, 01 Nov 2020 17:54:06 +0300
+
+systemd (241-7~deb10u4co3) apertis; urgency=medium
+
+  * systemd-boot: backport fix of menu ordering with boot counting
+    systemd-boot selects the last valid entry by default, not the first, which
+    prevent correct rollback.
+
+ -- Frédéric Danis <frederic.danis@collabora.com>  Wed, 23 Sep 2020 17:32:23 +0200
+
+systemd (241-7~deb10u4co2) apertis; urgency=medium
+
+  * journald: Backport support for --relinquish and --smart-relinquish options.
+    Newer version of systemd-journald support the --relinquish and
+    --smart-relinquish options that enable cleaner handling of mounts at
+    shutdown as journald can be told to close any logging under
+    /var/log/journal so that the /var filesystem can be unmounted should it be
+    on a separate partition.
+    Backport this feature as it enables shutdown without failures, a highly
+    desirable trait in embedded products using systemd.
+
+ -- Martyn Welch <martyn@hades.welchs.me.uk>  Fri, 21 Aug 2020 14:16:45 +0100
+
+systemd (241-7~deb10u4co1) apertis; urgency=medium
+
+  * Merge changes from Debian Buster. Remaining changes:
+    + Fix syntax error in shell script
+    + Fix new bashisms introduced on update.
+    + AppArmor: Fix conflict with chaiwala-apparmor-profiles
+    + AppArmor: Add systemd-logind profile
+    + Don’t build against libdw, since 0.158 isn’t available in target.
+
+ -- Ritesh Raj Sarraf <ritesh.sarraf@collabora.com>  Tue, 26 May 2020 11:41:53 +0000
+
+systemd (241-7~deb10u1co4) apertis; urgency=medium
+
+  * AppArmor: Fix conflict with chaiwala-apparmor-profiles
+
+ -- Frédéric Danis <frederic.danis@collabora.com>  Thu, 19 Dec 2019 11:15:14 +0100
+
+systemd (241-7~deb10u1co3) apertis; urgency=medium
+
+  * AppArmor: Add systemd-logind profile
+
+ -- Frédéric Danis <frederic.danis@collabora.com>  Mon, 16 Dec 2019 11:35:22 +0100
+
+systemd (241-7~deb10u1co2) apertis; urgency=medium
+
+  * Don’t build against libdw, since 0.158 isn’t available in target.
+
+ -- Andrej Shadura <andrewsh@debian.org>  Thu, 12 Sep 2019 12:50:38 +0200
+
+systemd (241-7~deb10u1co1) apertis; urgency=medium
+
+  * Merge from Debian. Remaining changes:
+    + Sync changes from Debian Buster
+    + Fix syntax error in shell script
+    + Fix new bashisms introduced on update.
+
+ -- Andrej Shadura <andrewsh@debian.org>  Thu, 12 Sep 2019 12:00:35 +0200
+
 systemd (241-7) unstable; urgency=medium
 
   [ Michael Biebl ]
@@ -1105,6 +1330,26 @@ systemd (241-6) unstable; urgency=medium
 
  -- Michael Biebl <biebl@debian.org>  Mon, 08 Jul 2019 11:27:51 +0200
 
+systemd (241-5co3) apertis; urgency=medium
+
+  * Fix new bashisms introduced on update.
+
+ -- Frederic Dalleau <frederic.dalleau@collabora.com>  Thu, 15 Aug 2019 15:47:38 +0000
+
+systemd (241-5co2) apertis; urgency=medium
+
+  * Fix syntax error in shell script
+
+ -- Ritesh Raj Sarraf <ritesh.sarraf@collabora.com>  Mon, 12 Aug 2019 20:34:33 +0530
+
+systemd (241-5co1) apertis; urgency=medium
+
+  [ Ritesh Raj Sarraf ]
+  * Refresh patches
+  * Sync changes from Debian Buster
+
+ -- Ritesh Raj Sarraf <ritesh.sarraf@collabora.com>  Thu, 08 Aug 2019 04:20:28 +0000
+
 systemd (241-5) unstable; urgency=medium
 
   * Revert "Add check to switch VTs only between K_XLATE or K_UNICODE"
@@ -1291,6 +1536,36 @@ systemd (240-6) unstable; urgency=high
 
  -- Martin Pitt <mpitt@debian.org>  Mon, 18 Feb 2019 13:54:04 +0000
 
+systemd (240-5co3) apertis; urgency=medium
+
+  * d/patches/disable-failing-tests.patch
+    - Disable tests failing in Bosch's build environment (APERTIS-6048)
+    - test-netlink, test-stat-util
+
+ -- Ritesh Raj Sarraf <ritesh.sarraf@collabora.com>  Tue, 21 May 2019 09:43:06 +0530
+
+systemd (240-5co2) apertis; urgency=medium
+
+  * Uncomment code for initramfs compatibility.
+    Forgot to uncomment this code by occasion.
+
+ -- Denis Pynkin <denis.pynkin@collabora.com>  Thu, 14 Feb 2019 13:58:11 +0000
+
+systemd (240-5co1) apertis; urgency=medium
+
+  * Add patches removing bashisms from kernel-install.
+    Adapt kernel-install and parts for /bin/sh.
+  * Call `kernel-install` on kernel install and remove.
+    Set appropriate symlinks for kernel-install script to copy the kernel
+    and initramfs to EFI partition with generation of EFI loader entry
+    during kernel package install anr remove them on deinstallation.
+  * Add systemd-boot binary package.
+    Move all stuff related to EFI boot into separate package.
+  * Call `kernel-install` on changes in initramfs.
+    Allow to update the EFI loader entry on changes in initramfs.
+
+ -- Denis Pynkin <denis.pynkin@collabora.com>  Wed, 13 Feb 2019 16:43:19 +0000
+
 systemd (240-5) unstable; urgency=medium
 
   [ Felipe Sateler ]

debian/control

@@ -13,6 +13,7 @@ Vcs-Git: https://salsa.debian.org/systemd-team/systemd.git
 Vcs-Browser: https://salsa.debian.org/systemd-team/systemd
 Homepage: https://www.freedesktop.org/wiki/Software/systemd
 Build-Depends: debhelper-compat (= 13),
+               dh-apparmor,
                pkg-config,
                xsltproc,
                docbook-xsl,
@@ -37,16 +38,15 @@ Build-Depends: debhelper-compat (= 13),
                liblz4-tool <!nocheck>,
                libbz2-dev <!stage1>,
                zlib1g-dev <!stage1> | libz-dev <!stage1>,
-               libcurl4-gnutls-dev <!stage1> | libcurl-dev <!stage1>,
-               libmicrohttpd-dev <!stage1>,
-               libgnutls28-dev <!stage1>,
+               libcurl4-openssl-dev <!stage1>,
+               libssl-dev <!stage1>,
                libpcre2-dev <!stage1>,
                libgcrypt20-dev,
                libkmod-dev (>= 15),
                libblkid-dev (>= 2.24),
                libmount-dev (>= 2.30),
                libseccomp-dev (>= 2.3.1) [amd64 arm64 armel armhf i386 mips mipsel mips64 mips64el x32 powerpc ppc64 ppc64el riscv64 s390x],
-               libdw-dev (>= 0.158) <!stage1>,
+#              libdw-dev (>= 0.158) <!stage1>,
                libpolkit-gobject-1-dev <!stage1>,
                libzstd-dev (>= 1.4.0),
                linux-base <!nocheck>,
@@ -67,6 +67,7 @@ Section: admin
 Priority: important
 Recommends: dbus
 Suggests: systemd-container,
+          systemd-boot [amd64 arm64],
           policykit-1
 Pre-Depends: ${shlibs:Pre-Depends},
              ${misc:Pre-Depends}
@@ -400,3 +401,17 @@ Description: libudev shared library
  This library provides access to udev device information.
  .
  This is a minimal version, only for use in the installation system.
+
+Package: systemd-boot
+Architecture: amd64 arm64
+Multi-Arch: foreign
+Section: admin
+Priority: optional
+Depends: ${shlibs:Depends},
+         ${misc:Depends}
+Breaks: systemd (<< 232-25co4),
+        gummiboot
+Replaces: systemd (<< 232-25co4),
+          gummiboot
+Description: systemd EFI boot management
+ This package provides systemd's tools and binaries for EFI boot management.

debian/extra/kernel-install.d/85-initrd.install

@@ -19,7 +19,7 @@ if [ "$COMMAND" != add ]; then
     exit 1
 fi
 
-if [ "$#" -ge 5 ]; then
+if [ "$#" -gt 5 ]; then
     # An explicit initrd path was passed, 90-loaderentry.install knows how to handle this;
     # copying here would just duplicate the file, since the basename is very likely different
     exit 0

debian/extra/zz_kernel-install

+#!/bin/sh
+
+case "$DPKG_MAINTSCRIPT_PACKAGE" in
+    linux-image-*)
+        exit 0
+        ;;
+    *)
+        kernel-install add "$1"
+        ;;
+esac

debian/lib.systemd.systemd-logind

+# vim:syntax=apparmor
+#
+# Copyright (C) 2015-2017 Collabora Ltd.
+#
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# This profile is fairly permissive: systemd-logind is very much a trusted
+# process anyway (it has CAP_MAC_ADMIN and CAP_SYS_ADMIN) so there's
+# little point in trying to restrict it extensively: it's mainly here so
+# we can identify logind as a D-Bus peer in other profiles.
+#
+# We put it in enforcing mode so that we have a consistent story (saying
+# everything is enforcing is simpler than listing exceptions), and
+# it could potentially also mitigate attacks in which logind could be
+# tricked into reading and trusting files that it shouldn't.
+
+#include <tunables/global>
+
+/lib/systemd/systemd-logind flags=(attach_disconnected) {
+  #include <abstractions/base>
+  #include <abstractions/dbus-strict>
+  #include <abstractions/nameservice>
+
+  capability sys_admin,
+  capability mac_admin,
+  capability audit_control,
+  capability chown,
+  capability kill,
+  capability dac_read_search,
+  capability dac_override,
+  capability fowner,
+  capability sys_tty_config,
+
+  /lib/systemd/systemd-logind mr,
+
+  dbus bind bus=system name=org.freedesktop.login1,
+  dbus (send, receive) bus=system,
+
+  network netlink,
+
+  mount fstype=tmpfs -> /run/user/*/,
+
+  /dev/dri/* rw,
+  /dev/input/* rw,
+  /dev/tty* rw,
+  /etc/systemd/** r,
+  /etc/udev/** r,
+  /proc/** r,
+  /run/systemd/notify w,
+  /run/systemd/seats/{,*} rw,
+  /run/systemd/sessions/{,*} rw,
+  /run/systemd/users/{,*} rw,
+  /run/systemd/inhibit/{,*} rw,
+  /run/nologin rw,
+  "/run/.#nologin*" rw,
+  /run/utmp rwk,
+  /run/systemd/shutdown/scheduled rw,
+  "/run/systemd/shutdown/.#scheduled*" rw,
+  /run/udev/** r,
+  /run/user/*/ w,
+  /var/lib/systemd/linger/{,**} r,
+  /sys/** r,
+}

debian/patches/apertis/Add-usr-to-non-unmountable-list.patch

+From: Denis Pynkin <denis.pynkin@collabora.com>
+Date: Wed, 10 Mar 2021 01:58:37 +0300
+Subject: [PATCH] Add /usr to non-unmountable list
+
+Debians systemd has split-usr enabled as both Debian and in principle Apertis
+support both a split and a merged-usr setup. This mostly adds search paths to
+system (e.g. to look at both `/bin/` and `/usr/bin`) however it also means that 
+if `/usr` is a mountpoint system will try to unmount it.  Unfortunately this causes
+issues at shutdown for systems with a merged-usr layout as basic libraries (e.g. libc)
+are located in `/usr` making it impossible to unmount.
+
+For Apertis we don't support `/usr` being a seperate partition, the only time 
+`/usr` is on a mountpoint is when using ostree images (where it is a bind mount
+and which use a merged-usr layout). So also add `/usr` to the list of paths that
+are considered unmountable even with split-usr support enabled in systemd.
+
+Adding `/usr` to the non-unmountable list allows to avoid problems with
+unmounting it for Apertis images.
+
+Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>
+---
+ src/shutdown/umount.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
+index 3a72a13..970c055 100644
+--- a/src/shutdown/umount.c
++++ b/src/shutdown/umount.c
+@@ -500,9 +500,7 @@ static int delete_md(MountPoint *m) {
+ 
+ static bool nonunmountable_path(const char *path) {
+         return path_equal(path, "/")
+-#if ! HAVE_SPLIT_USR
+                 || path_equal(path, "/usr")
+-#endif
+                 || path_startswith(path, "/run/initramfs");
+ }
+ 

debian/patches/apertis/Fix-the-path-to-bootable-binaries-in-efi-entry.patch

+From eddc14ee54896149a9b6293255352185669abcd6 Mon Sep 17 00:00:00 2001
+From: Denis Pynkin <denis.pynkin@collabora.com>
+Date: Mon, 3 May 2021 23:04:26 +0000
+Subject: Fix the path to bootable binaries in efi entry
+
+`stat` doesn't work well due `coreutils-gplv2`
+created by Debos returning "?" instead of mount point.
+Fall back to the provided directory, since we have separate
+partition for "/boot/efi".
+This change allow to use correct paths for kernel and initrd
+for entry generation.
+
+Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>
+---
+ src/kernel-install/90-loaderentry.install | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/kernel-install/90-loaderentry.install b/src/kernel-install/90-loaderentry.install
+index 0c73007..c61bf2b 100644
+--- a/src/kernel-install/90-loaderentry.install
++++ b/src/kernel-install/90-loaderentry.install
+@@ -20,6 +20,11 @@ MACHINE_ID=$KERNEL_INSTALL_MACHINE_ID
+ 
+ BOOT_ROOT=${ENTRY_DIR_ABS%/$MACHINE_ID/$KERNEL_VERSION}
+ BOOT_MNT=$(stat -c %m $BOOT_ROOT)
++# stat doesn't work well due `coreutils-gplv2`
++# returning "?" instead of mount point.
++# Fall back to the provided directory, since we have separate
++# partition for "/boot/efi"
++mountpoint "$BOOT_MNT" || BOOT_MNT="$BOOT_ROOT"
+ ENTRY_DIR=${ENTRY_DIR_ABS#$BOOT_MNT}
+ 
+ if [ $COMMAND = "remove" ]; then
+-- 
+2.20.1
+

debian/patches/apertis/Remove-bashisms-from-the-UEFI-entries-generator.patch

+From 48877ecd94ff71c03e3d880601fb0ba067f11a35 Mon Sep 17 00:00:00 2001
+From: Denis Pynkin <denis.pynkin@collabora.com>
+Date: Mon, 3 May 2021 02:28:43 +0300
+Subject: Remove bashisms from the UEFI entries generator
+
+- Use [ not [[ and -z to test for non-emptiness
+- Use shell lists instead of arrays
+
+Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>
+Signed-off-by: Frederic Dalleau <frederic.dalleau@collabora.com>
+---
+ src/kernel-install/90-loaderentry.install | 75 +++++++++++++----------
+ 1 file changed, 42 insertions(+), 33 deletions(-)
+
+diff --git a/src/kernel-install/90-loaderentry.install b/src/kernel-install/90-loaderentry.install
+index d096745..12d7b6e 100644
+--- a/src/kernel-install/90-loaderentry.install
++++ b/src/kernel-install/90-loaderentry.install
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
++#!/bin/sh
+ # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
+ # ex: ts=8 sw=4 sts=4 et filetype=sh
+ 
+@@ -8,11 +8,11 @@ ENTRY_DIR_ABS="$3"
+ KERNEL_IMAGE="$4"
+ INITRD_OPTIONS_START="5"
+ 
+-if ! [[ $KERNEL_INSTALL_MACHINE_ID ]]; then
++if [ -z "$KERNEL_INSTALL_MACHINE_ID" ]; then
+     exit 0
+ fi
+ 
+-if ! [[ -d "$ENTRY_DIR_ABS" ]]; then
++if ! [ -d "$ENTRY_DIR_ABS" ]; then
+     exit 0
+ fi
+ 
+@@ -22,48 +22,47 @@ BOOT_ROOT=${ENTRY_DIR_ABS%/$MACHINE_ID/$KERNEL_VERSION}
+ BOOT_MNT=$(stat -c %m $BOOT_ROOT)
+ ENTRY_DIR=${ENTRY_DIR_ABS#$BOOT_MNT}
+ 
+-if [[ $COMMAND == remove ]]; then
++if [ $COMMAND = "remove" ]; then
+     rm -f "$BOOT_ROOT/loader/entries/$MACHINE_ID-$KERNEL_VERSION.conf"
+     rm -f "$BOOT_ROOT/loader/entries/$MACHINE_ID-$KERNEL_VERSION+"*".conf"
+     exit 0
+ fi
+ 
+-if ! [[ $COMMAND == add ]]; then
++if ! [ $COMMAND = "add" ]; then
+     exit 1
+ fi
+ 
+-if ! [[ $KERNEL_IMAGE ]]; then
++if [ -z "$KERNEL_IMAGE" ]; then
+     exit 1
+ fi
+ 
+-if [[ -f /etc/os-release ]]; then
++if [ -f /etc/os-release ]; then
+     . /etc/os-release
+-elif [[ -f /usr/lib/os-release ]]; then
++elif [ -f /usr/lib/os-release ]; then
+     . /usr/lib/os-release
+ fi
+ 
+-if ! [[ $PRETTY_NAME ]]; then
++if [ -z "$PRETTY_NAME" ]; then
+     PRETTY_NAME="Linux $KERNEL_VERSION"
+ fi
+ 
+-if [[ -f /etc/kernel/cmdline ]]; then
+-    read -r -d '' -a BOOT_OPTIONS < /etc/kernel/cmdline
+-elif [[ -f /usr/lib/kernel/cmdline ]]; then
+-    read -r -d '' -a BOOT_OPTIONS < /usr/lib/kernel/cmdline
+-else
+-    declare -a BOOT_OPTIONS
+-
+-    read -r -d '' -a line < /proc/cmdline
+-    for i in "${line[@]}"; do
+-        [[ "${i#initrd=*}" != "$i" ]] && continue
+-        [[ "${i#BOOT_IMAGE=*}" != "$i" ]] && continue
+-        BOOT_OPTIONS+=("$i")
+-    done
++if [ -f /etc/kernel/cmdline ]; then
++    read -r BOOT_OPTIONS < /etc/kernel/cmdline
++elif [ -f /usr/lib/kernel/cmdline ]; then
++    read -r BOOT_OPTIONS < /usr/lib/kernel/cmdline
++elif [ -f "/proc/cmdline" ]; then
++    BOOT_OPTIONS=$(
++        cat /proc/cmdline | tr ' ' '\n' | \
++        while read -r i; do
++            [ "${i#initrd=*}" != "$i" ] && continue
++            echo -n " $i"
++        done
++     )
+ fi
+ 
+-if [[ -f /etc/kernel/tries ]]; then
++if [ -f /etc/kernel/tries ]; then
+     read -r TRIES </etc/kernel/tries
+-    if ! [[ "$TRIES" =~ ^[0-9]+$ ]] ; then
++    if [ -z "${TRIES##*[!0-9]*}" ] ; then
+         echo "/etc/kernel/tries does not contain an integer." >&2
+         exit 1
+     fi
+@@ -79,11 +78,20 @@ cp "$KERNEL_IMAGE" "$ENTRY_DIR_ABS/linux" &&
+     exit 1
+ }
+ 
+-INITRD_OPTIONS=( "${@:${INITRD_OPTIONS_START}}" )
++shift $INITRD_OPTIONS_START
++INITRD_OPTIONS=""
++while [ $# -gt 0 ] ; do
++ if [ -z "$INITRD_OPTIONS" ] ; then
++   INITRD_OPTIONS="$1"
++ else
++   INITRD_OPTIONS="$INITRD_OPTIONS\n$1"
++ fi
++ shift
++done
+ 
+-for initrd in "${INITRD_OPTIONS[@]}"; do
+-    if [[ -f "${initrd}" ]]; then
+-        initrd_basename="$(basename ${initrd})"
++echo "${INITRD_OPTIONS}" | while read initrd; do
++    if [ -f "${initrd}" ]; then
++        initrd_basename=$(basename "${initrd}")
+         [ "$KERNEL_INSTALL_VERBOSE" -gt 0 ] && \
+             echo "Installing $ENTRY_DIR_ABS/${initrd_basename}"
+         cp "${initrd}" "$ENTRY_DIR_ABS/${initrd_basename}" &&
+@@ -97,7 +105,7 @@ done
+ 
+ # If no initrd option is supplied, fall back to "initrd" which is
+ # the name used by dracut when generating it in its kernel-install hook
+-[[ ${#INITRD_OPTIONS[@]} == 0 ]] && INITRD_OPTIONS=( initrd )
++[ -z "${INITRD_OPTIONS}" ] && INITRD_OPTIONS=initrd
+ 
+ mkdir -p "${LOADER_ENTRY%/*}" || {
+     echo "Could not create loader entry directory '${LOADER_ENTRY%/*}'." >&2
+@@ -110,11 +118,12 @@ mkdir -p "${LOADER_ENTRY%/*}" || {
+     echo "title      $PRETTY_NAME"
+     echo "version    $KERNEL_VERSION"
+     echo "machine-id $MACHINE_ID"
+-    echo "options    ${BOOT_OPTIONS[*]}"
++    echo "options    ${BOOT_OPTIONS}"
+     echo "linux      $ENTRY_DIR/linux"
+-    for initrd in "${INITRD_OPTIONS[@]}"; do
+-        [[ -f $ENTRY_DIR_ABS/$(basename ${initrd}) ]] && \
+-            echo "initrd     $ENTRY_DIR/$(basename ${initrd})"
++    echo "${INITRD_OPTIONS}" | while read initrd; do
++        initrd_basename=$(basename "${initrd}")
++        [ -f "$ENTRY_DIR_ABS/${initrd_basename}" ] && \
++            echo "initrd     $ENTRY_DIR/${initrd_basename}"
+     done
+     :
+ } > "$LOADER_ENTRY" || {
+-- 
+2.29.3
+

debian/patches/apertis/Remove-bashisms-from-the-depmod-wrapper.patch

+From: Denis Pynkin <denis.pynkin@collabora.com>
+Date: Thu, 24 Jan 2019 22:40:46 +0300
+Subject: Remove bashisms from the depmod wrapper
+
+- Use [ not [[ and -n to test for non-emptiness
+- Use for loop instead of comma expansion
+
+Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>
+[ Rebased to the latest master, amended the rm call ]
+Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>
+---
+ src/kernel-install/50-depmod.install | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/src/kernel-install/50-depmod.install b/src/kernel-install/50-depmod.install
+index 3850eac..2b026da 100644
+--- a/src/kernel-install/50-depmod.install
++++ b/src/kernel-install/50-depmod.install
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
++#!/bin/sh
+ # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
+ # ex: ts=8 sw=4 sts=4 et filetype=sh
+ 
+@@ -8,11 +8,11 @@ ENTRY_DIR_ABS="$3"
+ KERNEL_IMAGE="$4"
+ INITRD_OPTIONS_START="5"
+ 
+-[[ $KERNEL_VERSION ]] || exit 1
++[ -n $KERNEL_VERSION ] || exit 1
+ 
+ case "$COMMAND" in
+     add)
+-        [[ -d "/lib/modules/${KERNEL_VERSION}/kernel" ]] || exit 0
++        [ -d "/lib/modules/${KERNEL_VERSION}/kernel" ] || exit 0
+         [ "$KERNEL_INSTALL_VERBOSE" -gt 0 ] && \
+             echo "Running depmod -a ${KERNEL_VERSION}"
+         exec depmod -a "${KERNEL_VERSION}"
+@@ -20,8 +20,19 @@ case "$COMMAND" in
+     remove)
+         [ "$KERNEL_INSTALL_VERBOSE" -gt 0 ] && \
+             echo "Removing /lib/modules/${KERNEL_VERSION}/modules.dep and associated files"
+-        exec rm -f /lib/modules/"${KERNEL_VERSION}"/modules.{alias{,.bin},builtin.bin,dep{,.bin},devname,softdep,symbols{,.bin}}
+-        ;;
++        for d in alias \
++             alias.bin \
++             builtin.bin \
++             dep \
++             dep.bin \
++             devname \
++             softdep \
++             symbols \
++             symbols.bin
++        do
++            rm -f "/lib/modules/$2/modules.$d"
++        done
++         ;;
+     *)
+         exit 0
+ esac

debian/patches/apertis/Remove-bashisms-from-the-entry-directory-plugin.patch

+From 2b89d2fe0193b36fa892ccc368e81efa8e854bb9 Mon Sep 17 00:00:00 2001
+From: Denis Pynkin <denis.pynkin@collabora.com>
+Date: Mon, 26 Apr 2021 23:00:48 +0300
+Subject: Remove bashisms from the entry directory plugin
+
+- Use [ not [[ and -z to test for non-emptiness
+
+Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>
+---
+ src/kernel-install/00-entry-directory.install | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/kernel-install/00-entry-directory.install b/src/kernel-install/00-entry-directory.install
+index 21c09fa..e2fc396 100644
+--- a/src/kernel-install/00-entry-directory.install
++++ b/src/kernel-install/00-entry-directory.install
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
++#/bin/sh
+ # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
+ # ex: ts=8 sw=4 sts=4 et filetype=sh
+ 
+@@ -8,11 +8,11 @@ ENTRY_DIR_ABS="$3"
+ KERNEL_IMAGE="$4"
+ INITRD_OPTIONS_START="5"
+ 
+-if ! [[ $KERNEL_INSTALL_MACHINE_ID ]]; then
++if [ -z "$KERNEL_INSTALL_MACHINE_ID" ]; then
+     exit 0
+ fi
+ 
+-if [[ $COMMAND != add ]]; then
++if [ "$COMMAND" != "add" ]; then
+      exit 0
+ fi
+ 
+-- 
+2.20.1
+

debian/patches/apertis/Reworked-kernel-install-script.patch

+From 2b3c1bccc61217f9800fa6b6f7af1007dd6c27e3 Mon Sep 17 00:00:00 2001
+From: Denis Pynkin <denis.pynkin@collabora.com>
+Date: Mon, 3 May 2021 03:12:29 +0300
+Subject: Reworked kernel-install script
+
+- Removed bashisms -- script is adapted for running with `/bin/sh`
+- Add support of calling the script without passing the kernel image.
+- Allow to use name prefix while detecting the action.
+  If the name of (sym)link to 'kernel-install' script ends with
+  'installkernel' or 'removekernel' -- the action 'add' or 'remove' is
+  assumed. This change allow to use file names like `zz_installkernel`
+  to force it to run last during the kernel installing or removing.
+
+Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>
+Signed-off-by: Frederic Dalleau <frederic.dalleau@collabora.com>
+---
+ src/kernel-install/kernel-install | 100 +++++++++++++++++-------------
+ 1 file changed, 56 insertions(+), 44 deletions(-)
+
+diff --git a/src/kernel-install/kernel-install b/src/kernel-install/kernel-install
+index e7457e9..6729168 100755
+--- a/src/kernel-install/kernel-install
++++ b/src/kernel-install/kernel-install
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
++#!/bin/sh
+ # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
+ # ex: ts=8 sw=4 sts=4 et filetype=sh
+ # SPDX-License-Identifier: LGPL-2.1-or-later
+@@ -33,22 +33,18 @@ usage()
+ dropindirs_sort()
+ {
+     local suffix=$1; shift
+-    local -a files
+     local f d i
+ 
+-    readarray -t files <<<"$(
+-        for d in "$@"; do
+-            for i in "$d/"*"$suffix"; do
+-                if [[ -e "$i" ]]; then
+-                    echo "${i##*/}"
+-                fi
+-            done
+-        done | sort -Vu
+-    )"
+-
+-    for f in "${files[@]}"; do
++    for d in "$@"; do
++        for i in "$d/"*"$suffix"; do
++            if [ -e "$i" ]; then
++                echo "${i##*/}"
++            fi
++        done
++    done | sort -u | \
++    while read f; do
+         for d in "$@"; do
+-            if [[ -e "$d/$f" ]]; then
++            if [ -e "$d/$f" ]; then
+                 echo "$d/$f"
+                 continue 2
+             fi
+@@ -59,51 +55,64 @@ dropindirs_sort()
+ export LC_COLLATE=C
+ 
+ for i in "$@"; do
+-    if [ "$i" == "--help" -o "$i" == "-h" ]; then
++    if [ "$i" = "--help" -o "$i" = "-h" ]; then
+         usage
+         exit 0
+     fi
+ done
+ 
+ KERNEL_INSTALL_VERBOSE=0
+-if [ "$1" == "--verbose" -o "$1" == "-v" ]; then
++if [ "$1" = "--verbose" -o "$1" = "-v" ]; then
+     shift
+     KERNEL_INSTALL_VERBOSE=1
+ fi
+ export KERNEL_INSTALL_VERBOSE
+ 
+-if [[ "${0##*/}" == 'installkernel' ]]; then
++INITRD_OPTIONS=""
++if [ "${0%installkernel}" != "${0}" ]; then
+     COMMAND='add'
+     # make install doesn't pass any parameter wrt initrd handling
+-    INITRD_OPTIONS=()
++    KERNEL_VERSION="$1"
++    KERNEL_IMAGE="$2"
++elif [ "${0%removekernel}" != "${0}" ]; then
++    COMMAND='remove'
++    KERNEL_VERSION="$1"
++    KERNEL_IMAGE="$2"
+ else
+     COMMAND="$1"
+     shift
+-    INITRD_OPTIONS=( "${@:3}" )
++    KERNEL_VERSION="$1"
++    KERNEL_IMAGE="$2"
++    while [ $# -gt 2 ] ; do
++        if [ -z "$INITRD_OPTIONS" ] ; then
++            INITRD_OPTIONS="$3"
++        else
++            INITRD_OPTIONS="$INITRD_OPTIONS\n$3"
++        fi
++        shift
++    done
+ fi
+ 
+-KERNEL_VERSION="$1"
+-KERNEL_IMAGE="$2"
+ 
+ # Reuse directory created without a machine ID present if it exists.
+-if [[ -d /efi/Default ]] || [[ -d /boot/Default ]] || [[ -d /boot/efi/Default ]]; then
++if [ -d /efi/Default ] || [ -d /boot/Default ] || [ -d /boot/efi/Default ]; then
+     MACHINE_ID="Default"
+-elif [[ -f /etc/machine-id ]]; then
++elif [ -f /etc/machine-id ]; then
+     read MACHINE_ID < /etc/machine-id
+ else
+     MACHINE_ID="Default"
+ fi
+ 
+-if [[ ! $COMMAND ]] || [[ ! $KERNEL_VERSION ]]; then
++if [ -z "$COMMAND" ] || [ -z "$KERNEL_VERSION" ]; then
+     echo "Not enough arguments" >&2
+     exit 1
+ fi
+ 
+-if [[ -d /efi/loader/entries ]] || [[ -d /efi/$MACHINE_ID ]]; then
++if [ -d /efi/loader/entries ] || [ -d /efi/$MACHINE_ID ]; then
+     ENTRY_DIR_ABS="/efi/$MACHINE_ID/$KERNEL_VERSION"
+-elif [[ -d /boot/loader/entries ]] || [[ -d /boot/$MACHINE_ID ]]; then
++elif [ -d /boot/loader/entries ] || [ -d /boot/$MACHINE_ID ]; then
+     ENTRY_DIR_ABS="/boot/$MACHINE_ID/$KERNEL_VERSION"
+-elif [[ -d /boot/efi/loader/entries ]] || [[ -d /boot/efi/$MACHINE_ID ]]; then
++elif [ -d /boot/efi/loader/entries ] || [ -d /boot/efi/$MACHINE_ID ]; then
+     ENTRY_DIR_ABS="/boot/efi/$MACHINE_ID/$KERNEL_VERSION"
+ elif mountpoint -q /efi; then
+     ENTRY_DIR_ABS="/efi/$MACHINE_ID/$KERNEL_VERSION"
+@@ -117,51 +126,53 @@ export KERNEL_INSTALL_MACHINE_ID=$MACHINE_ID
+ 
+ ret=0
+ 
+-readarray -t PLUGINS <<<"$(
++
++plugins_list(){
+     dropindirs_sort ".install" \
+         "/etc/kernel/install.d" \
+         "/usr/lib/kernel/install.d"
+-)"
++}
+ 
+ case $COMMAND in
+     add)
+-        if [[ ! "$KERNEL_IMAGE" ]]; then
+-            echo "Command 'add' requires an argument" >&2
+-            exit 1
++        # According to man page 2-nd parameter could be skipped
++        if [ -z "$KERNEL_IMAGE" ]; then
++            KERNEL_IMAGE="/boot/vmlinuz-$KERNEL_VERSION"
+         fi
+ 
+-        if [[ ! -f "$KERNEL_IMAGE" ]]; then
++        if [ ! -f "$KERNEL_IMAGE" ]; then
+             echo "Kernel image argument ${KERNEL_IMAGE} not a file" >&2
+             exit 1
+         fi
+ 
+-        for f in "${PLUGINS[@]}"; do
+-            if [[ -x $f ]]; then
++        plugins_list | while read f; do
++            if [ -x "$f" ]; then
++
+                 [ "$KERNEL_INSTALL_VERBOSE" -gt 0 ] && \
+-                    echo "+$f add $KERNEL_VERSION $ENTRY_DIR_ABS $KERNEL_IMAGE ${INITRD_OPTIONS[@]}"
+-                "$f" add "$KERNEL_VERSION" "$ENTRY_DIR_ABS" "$KERNEL_IMAGE" "${INITRD_OPTIONS[@]}"
++                    echo "+$f add $KERNEL_VERSION $ENTRY_DIR_ABS $KERNEL_IMAGE ${INITRD_OPTIONS}"
++                "$f" add "$KERNEL_VERSION" "$ENTRY_DIR_ABS" "$KERNEL_IMAGE" "${INITRD_OPTIONS}"
+                 x=$?
+-                if [[ $x == $SKIP_REMAINING ]]; then
++                if [ $x = $SKIP_REMAINING ]; then
+                     ret=0
+                     break
+                 fi
+-                ((ret+=$x))
++                ret=`expr $ret + $?`
+             fi
+         done
+         ;;
+ 
+     remove)
+-        for f in "${PLUGINS[@]}"; do
+-            if [[ -x $f ]]; then
++        plugins_list | while read f; do
++            if [ -x "$f" ]; then
+                 [ "$KERNEL_INSTALL_VERBOSE" -gt 0 ] && \
+                     echo "+$f remove $KERNEL_VERSION $ENTRY_DIR_ABS"
+                 "$f" remove "$KERNEL_VERSION" "$ENTRY_DIR_ABS"
+                 x=$?
+-                if [[ $x == $SKIP_REMAINING ]]; then
++                if [ $x = $SKIP_REMAINING ]; then
+                     ret=0
+                     break
+                 fi
+-                ((ret+=$x))
++                ret=`expr $ret + $x`
+             fi
+         done
+ 
+@@ -169,7 +180,7 @@ case $COMMAND in
+             echo "Removing $ENTRY_DIR_ABS"
+ 
+         rm -rf "$ENTRY_DIR_ABS"
+-        ((ret+=$?))
++        ret=`expr $ret + $?`
+         ;;
+ 
+     *)
+@@ -179,3 +190,4 @@ case $COMMAND in
+ esac
+ 
+ exit $ret
++
+-- 
+2.29.3
+

debian/patches/apertis/kernel-install-allow-to-create-BOOT-MACHINE_ID.patch

+From f462882b9f851adb9bd0a420f2b3e5912bbfb712 Mon Sep 17 00:00:00 2001
+From: Denis Pynkin <denis.pynkin@collabora.com>
+Date: Sun, 2 May 2021 21:47:16 +0300
+Subject: kernel-install: allow to create $BOOT/$MACHINE_ID
+
+Commit cf73f650890 provides script `00-entry-directory.install` which
+creates the entry directory only if `$BOOT/$MACHINE_ID` folder exists.
+This part was moved out of `kernel-install` script and may introduce
+the problem during upgrade since before Apertis v2022dev2 we do kernel
+install with `$MACHINE_ID` generated in a build time. Later we remove
+`/etc/machine-id` file allowing to generate an unique machine ID during
+first boot, so there will be no directory `$BOOT/$MACHINE_ID` with a new
+ID preventing from new entry generation during kernel upgrade in runtime.
+Hence remove the part checking the `$BOOT/$MACHINE_ID` existence and
+allow to create the proper entry in any case, returning the previous
+`kernel-install` behaviour.
+
+Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>
+---
+ src/kernel-install/00-entry-directory.install | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/src/kernel-install/00-entry-directory.install b/src/kernel-install/00-entry-directory.install
+index e2fc396..f753794 100644
+--- a/src/kernel-install/00-entry-directory.install
++++ b/src/kernel-install/00-entry-directory.install
+@@ -16,14 +16,6 @@ if [ "$COMMAND" != "add" ]; then
+      exit 0
+ fi
+ 
+-# If the boot dir exists (e.g. $ESP/<machine-id>),
+-# create the entry directory ($ESP/<machine-id>/<kernel-version>).
+-# This is the only function of this plugin.
+-MACHINE_ID_DIR="${ENTRY_DIR_ABS%/*}"
+-if ! [ -d "$MACHINE_ID_DIR" ]; then
+-    exit 0
+-fi
+-
+ if [ "$KERNEL_INSTALL_VERBOSE" -gt 0 ]; then
+     echo "+mkdir -v -p $ENTRY_DIR_ABS"
+     exec mkdir -v -p "$ENTRY_DIR_ABS"
+-- 
+2.29.3
+

debian/patches/series

@@ -32,3 +32,10 @@ debian/Move-sysusers.d-sysctl.d-binfmt.d-modules-load.d-back-to-.patch
 debian/systemctl-do-not-shutdown-immediately-on-scheduled-shutdo.patch
 debian/test-disable-DnsmasqClientTest.test_resolved_etc_hosts-in.patch
 debian/Downgrade-a-couple-of-warnings-to-debug.patch
+apertis/Add-usr-to-non-unmountable-list.patch
+apertis/Remove-bashisms-from-the-depmod-wrapper.patch
+apertis/Remove-bashisms-from-the-UEFI-entries-generator.patch
+apertis/Reworked-kernel-install-script.patch
+apertis/Remove-bashisms-from-the-entry-directory-plugin.patch
+apertis/kernel-install-allow-to-create-BOOT-MACHINE_ID.patch
+apertis/Fix-the-path-to-bootable-binaries-in-efi-entry.patch

debian/rules

@@ -107,15 +107,14 @@ CONFFLAGS_deb += \
 	-Daudit=true \
 	-Dlibcryptsetup=true \
 	-Dcoredump=true \
-	-Delfutils=true \
+	-Delfutils=false \
 	-Dapparmor=true \
 	-Dlibidn2=true \
 	-Dlibiptc=true \
 	-Dlibcurl=true \
 	-Dimportd=true \
-	-Dmicrohttpd=true \
-	-Dgnutls=true \
 	-Dpcre2=true
+	-Dopenssl=true
 else
 CONFFLAGS_deb += \
 	-Daudit=false \
@@ -127,9 +126,8 @@ CONFFLAGS_deb += \
 	-Dlibiptc=false \
 	-Dlibcurl=false \
 	-Dimportd=false \
-	-Dmicrohttpd=false \
-	-Dgnutls=false \
 	-Dpcre2=false
+	-Dopenssl=false
 endif
 
 CONFFLAGS_udeb = \
@@ -153,8 +151,7 @@ CONFFLAGS_udeb = \
 	-Dmachined=false \
 	-Dlibcurl=false \
 	-Dimportd=false \
-	-Dmicrohttpd=false \
-	-Dgnutls=false \
+	-Dopenssl=false \
 	-Dhostnamed=false \
 	-Dtimedated=false \
 	-Dnetworkd=false \
@@ -276,6 +273,8 @@ ifeq ($(DEB_VENDOR),Ubuntu)
 	cp -a debian/extra/units-ubuntu/* debian/systemd/lib/systemd/system/
 endif
 
+	dh_apparmor -psystemd --profile-name=lib.systemd.systemd-logind
+
 override_dh_missing:
 	dh_missing --sourcedir debian/install/deb $(DH_MISSING)
 
@@ -312,4 +311,4 @@ ifeq (, $(filter nocheck, $(DEB_BUILD_OPTIONS)))
 endif
 
 %:
-	dh $@ --without autoreconf --buildsystem=meson
+	dh $@ --without autoreconf --buildsystem=meson -Nsystemd-journal-remote

debian/systemd-boot.install

+etc/kernel
+usr/bin/bootctl
+usr/bin/kernel-install
+usr/lib/systemd/boot
+usr/share/man/man1/bootctl*
+usr/share/man/man8/kernel-install*
+usr/share/bash-completion/completions/bootctl
+usr/share/bash-completion/completions/kernel-install
+usr/share/zsh/vendor-completions/_bootctl
+usr/share/zsh/vendor-completions/_kernel-install
+usr/lib/kernel
+../../extra/kernel-install.d/* usr/lib/kernel/install.d
+../../extra/zz_kernel-install etc/initramfs/post-update.d

debian/systemd-boot.links

+# Links for adding/removing kernel and initramfs
+/usr/bin/kernel-install /etc/kernel/postinst.d/zz_installkernel
+/usr/bin/kernel-install /etc/kernel/postrm.d/zz_removekernel
\ No newline at end of file

debian/systemd.install

@@ -32,8 +32,6 @@ usr/bin/systemd-socket-activate
 usr/bin/systemd-mount
 usr/bin/systemd-umount
 usr/bin/systemd-id128
-usr/bin/kernel-install
-usr/bin/bootctl
 usr/bin/busctl
 usr/bin/timedatectl
 usr/bin/localectl
@@ -60,7 +58,6 @@ usr/lib/sysusers.d/basic.conf
 usr/lib/sysusers.d/systemd.conf
 usr/lib/systemd/
 usr/lib/tmpfiles.d/
-usr/lib/kernel
 usr/share/locale/
 var/lib
 ../../extra/init-functions.d lib/lsb/
@@ -69,3 +66,4 @@ var/lib
 ../../extra/units/* lib/systemd/system/
 ../../extra/kernel-install.d/* usr/lib/kernel/install.d
 ../../extra/pam.d/* usr/lib/pam.d/
+../../lib.systemd.systemd-logind etc/apparmor.d/