Merging debian version 255.5-1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

18 files changed, 212 insertions, 76 deletions

diff --git a/debian/changelog b/debian/changelog
index 726c20b..85a8dfe 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,55 @@
+systemd (255.5-1) sid; urgency=medium
+
+  [ Michael Biebl ]
+  * autopkgtest: depend on pkgconf rather than pkg-config
+  * Stop setting default-hierarchy to unified explicitly. It is already
+    the default and the meson option has been deprecated and is expected
+    to be removed in a future release. See https://github.com/systemd/syst
+    emd/commit/31323f21bb0ae7c712f43500c42997c91a6d20bf
+  * Replace Skip-flaky-test_resolved_domain_restricted_dns-in-
+    network.patch with a proper upstream fix.
+  * Remove myself from Uploaders
+
+  [ Luca Boccassi ]
+  * autopkgtest: add dhcpcd5 as alternative dependency to dhcpcd-base
+    dhcpcd-base is not available in Jammy
+  * d/e/checkout-upstream: stop overriding sshconfdir. It actually works
+    after some upstream test fixes, and it is necessary for TEST-46-HOMED
+    to work
+  * autopkgtest: install systemd-resolved for all suites. Necessary to
+    avoid breaking the network on Ubuntu, in the upstream jammy-based CI
+    jobs. Can be dropped once jammy is no longer tested.
+  * autopkgtest: add breaks-testbed to more tests. Given resolved is
+    installed, the testbed needs to be reset to switch back to the default
+    network stack, otherwise installing packages in the salsa-ci
+    autopkgtest job fails
+  * autopkgtest: restrict systemd-boot-efi to architectures where it's
+    built
+  * Enable libpwquality support. Suggest it from systemd (used by
+    firstboot and cryptenroll) and depend on it from homed (user creation
+    is a core part of it). It's a dlopen() dependency. (Closes: #1063391)
+  * d/e/checkout-upstream: do not initialize submodules. They are used by
+    mkosi, not needed for CI builds
+  * Autopkgtest: add dependency on libkmod-dev to upstream suite.
+  * Switch build-depend form liblz4-tool to lz4. The former is deprecated
+    and now dropped, the latter is available since buster. (Closes: #1068730)
+  * initramfs hooks: pull in libkmod manually udev now opens it with
+    dlopen, so the ldd-based resolver will not see it, pull it in the
+    initramfs manually
+  * New upstream version 255.5
+  * Drop resolve-skip-IP_UNICAST_IF-for-local-sockets.patch, merged
+    upstream
+  * Refresh patches for v255.5
+  * Bump Standards-Version to 4.7.0, no changes
+
+  [ Daan De Meyer ]
+  * Build in developer mode when building for upstream. Developer mode
+    enables some helpful debugging options and enables various
+    experimental components such as systemd-vmspawn which we want to be
+    enabled when testing upstream.
+
+ -- Luca Boccassi <bluca@debian.org>  Wed, 24 Apr 2024 16:34:40 +0100
+
 systemd (255.4-1~progress7.99u1) graograman-backports; urgency=medium
 
   * Initial reupload to graograman-backports.
diff --git a/debian/control b/debian/control
index 98b41f2..e0aedff 100644
--- a/debian/control
+++ b/debian/control
@@ -4,14 +4,13 @@ Priority: optional
 Maintainer: Progress Linux Maintainers <maintainers@lists.progress-linux.org>
 XSBC-Uploaders: Daniel Baumann <daniel.baumann@progress-linux.org>
 XSBC-Original-Maintainer: Debian systemd Maintainers <pkg-systemd-maintainers@lists.alioth.debian.org>
-XSBC-Original-Uploaders: Michael Biebl <biebl@debian.org>,
-           Marco d'Itri <md@linux.it>,
+XSBC-Original-Uploaders: Marco d'Itri <md@linux.it>,
            Sjoerd Simons <sjoerd@debian.org>,
            Martin Pitt <mpitt@debian.org>,
            Felipe Sateler <fsateler@debian.org>,
            Luca Boccassi <bluca@debian.org>,
 Bugs: mailto:maintainers@lists.progress-linux.org
-Standards-Version: 4.6.2
+Standards-Version: 4.7.0
 Rules-Requires-Root: no
 Vcs-Browser: https://git.progress-linux.org/packages/graograman-backports/systemd
 Vcs-Git: https://git.progress-linux.org/packages/graograman-backports/systemd
@@ -29,6 +28,10 @@ Build-Depends: debhelper-compat (= 13),
                docbook-xsl <!nodoc>,
                docbook-xml <!nodoc>,
                meson (>= 0.60.0),
+               clang <pkg.systemd.upstream !stage1>,
+               linux-headers-generic <pkg.systemd.upstream !stage1>,
+               libbpf-dev <pkg.systemd.upstream !stage1>,
+               linux-tools-generic <pkg.systemd.upstream> | bpftool <pkg.systemd.upstream>,
                gettext,
                gperf,
                libcap-dev,
@@ -44,7 +47,7 @@ Build-Depends: debhelper-compat (= 13),
                libacl1-dev,
                liblzma-dev,
                liblz4-dev (>= 1.3.0),
-               liblz4-tool <!nocheck>,
+               lz4 <!nocheck>,
                libbz2-dev <!stage1>,
                zlib1g-dev <!stage1> | libz-dev <!stage1>,
                libcurl4-openssl-dev <!stage1>,
@@ -65,6 +68,8 @@ Build-Depends: debhelper-compat (= 13),
                libssl-dev <!stage1>,
                libqrencode-dev <!stage1>,
                libxen-dev [amd64 arm64 armhf] <!stage1>,
+               libpwquality-dev <!stage1>,
+               libarchive-dev <pkg.systemd.upstream !stage1>,
                linux-base <!nocheck>,
                acl <!nocheck>,
                python3:native,
@@ -92,10 +97,12 @@ Suggests: systemd-container,
           systemd-userdbd,
           systemd-boot,
           systemd-resolved,
+          libbpf1,
           libfido2-1,
           libip4tc2,
           libkmod2,
           libp11-kit0,
+          libpwquality1,
           libqrencode4,
           libtss2-esys-3.0.2-0,
           libtss2-mu-4.0.1-0,
@@ -314,6 +321,7 @@ Multi-Arch: same
 Section: libs
 Depends: ${shlibs:Depends},
          ${misc:Depends}
+Recommends: libgcrypt20,
 Description: systemd utility library
  This library provides APIs to interface with various system components such as
  the system journal, the system service manager, D-Bus and more.
@@ -475,6 +483,7 @@ Depends: ${shlibs:Depends},
          systemd-userdbd (= ${binary:Version}),
          systemd (= ${binary:Version}),
          libpam-runtime,
+         libpwquality1,
 Description: home area manager
  systemd-homed is a system service designed to manage home directories. This
  package includes the homed service, a PAM module to automatically mount home
diff --git a/debian/extra/checkout-upstream b/debian/extra/checkout-upstream
index 1724fea..68afd43 100755
--- a/debian/extra/checkout-upstream
+++ b/debian/extra/checkout-upstream
@@ -86,7 +86,7 @@ mkdir -p debian/tmp
  if  [ -n "${UPSTREAM_PULL_REQUEST:-}" ] && [ "${UPSTREAM_REPO}" != "https://github.com/systemd/systemd-stable.git" ]; then
      git rebase main
  fi
- git submodule update --init --recursive)
+)
 UPSTREAM_VER=$(cd debian/tmp/upstream; git describe | sed 's/^v//;s/-/./g')
 
 # clean out original upstream sources
@@ -100,10 +100,6 @@ fi
 if grep -q log-trace debian/tmp/upstream/meson_options.txt; then
     sed -i "s/option('log-trace', type : 'boolean', value : false/option('log-trace', type : 'boolean', value : true/" debian/tmp/upstream/meson_options.txt
 fi
-# TODO: drop when Jammy is no longer used
-if grep -q sshdconfdir debian/tmp/upstream/meson_options.txt; then
-    sed -i "s/option('sshdconfdir',/option('sshdconfdir', value : 'no',/" debian/tmp/upstream/meson_options.txt
-fi
 
 # replace with checkout
 mv debian/tmp/upstream/* .
diff --git a/debian/extra/initramfs-tools/hooks/udev b/debian/extra/initramfs-tools/hooks/udev
index 4da5b28..d45a287 100755
--- a/debian/extra/initramfs-tools/hooks/udev
+++ b/debian/extra/initramfs-tools/hooks/udev
@@ -16,6 +16,12 @@ esac
 mkdir -p "$DESTDIR/usr/lib/systemd"
 copy_exec /usr/lib/systemd/systemd-udevd      /usr/lib/systemd
 copy_exec /usr/bin/udevadm    /usr/bin
+# libkmod is loaded via dlopen() since v256 so pull it in manually
+for library in usr/lib/*/libkmod.so.*; do
+  if [ -f "${library}" ]; then
+    copy_exec "${library}"
+  fi
+done
 
 mkdir -p "$DESTDIR/etc/udev"
 cp -p /etc/udev/udev.conf "$DESTDIR/etc/udev/"
diff --git a/debian/patches/debian/Downgrade-a-couple-of-warnings-to-debug.patch b/debian/patches/debian/Downgrade-a-couple-of-warnings-to-debug.patch
index 1c839bd..39166cb 100644
--- a/debian/patches/debian/Downgrade-a-couple-of-warnings-to-debug.patch
+++ b/debian/patches/debian/Downgrade-a-couple-of-warnings-to-debug.patch
@@ -16,7 +16,7 @@ Closes: #981407
  3 files changed, 7 insertions(+), 3 deletions(-)
 
 diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
-index f442bd8..a92f683 100644
+index 0baf08e..8eec584 100644
 --- a/src/core/load-fragment.c
 +++ b/src/core/load-fragment.c
 @@ -544,6 +544,7 @@ static int patch_var_run(
@@ -51,10 +51,10 @@ index 4485e2e..d0e8ed8 100644
                                                 "%s Automatically generating a unit file for compatibility. Please update package to include a native systemd unit file, in order to make it safe, robust and future-proof. "
                                                 "%s This compatibility logic is deprecated, expect removal soon. %s",
 diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
-index 230ec09..d513d40 100644
+index 4919cb7..be24b04 100644
 --- a/src/tmpfiles/tmpfiles.c
 +++ b/src/tmpfiles/tmpfiles.c
-@@ -3266,6 +3266,7 @@ static int specifier_expansion_from_arg(const Specifier *specifier_table, Item *
+@@ -3257,6 +3257,7 @@ static int specifier_expansion_from_arg(const Specifier *specifier_table, Item *
  static int patch_var_run(const char *fname, unsigned line, char **path) {
          const char *k;
          char *n;
@@ -62,7 +62,7 @@ index 230ec09..d513d40 100644
  
          assert(path);
          assert(*path);
-@@ -3291,7 +3292,8 @@ static int patch_var_run(const char *fname, unsigned line, char **path) {
+@@ -3282,7 +3283,8 @@ static int patch_var_run(const char *fname, unsigned line, char **path) {
          /* Also log about this briefly. We do so at LOG_NOTICE level, as we fixed up the situation automatically, hence
           * there's no immediate need for action by the user. However, in the interest of making things less confusing
           * to the user, let's still inform the user that these snippets should really be updated. */
diff --git a/debian/patches/debian/Revert-core-set-RLIMIT_CORE-to-unlimited-by-default.patch b/debian/patches/debian/Revert-core-set-RLIMIT_CORE-to-unlimited-by-default.patch
index 267c2b4..3378f82 100644
--- a/debian/patches/debian/Revert-core-set-RLIMIT_CORE-to-unlimited-by-default.patch
+++ b/debian/patches/debian/Revert-core-set-RLIMIT_CORE-to-unlimited-by-default.patch
@@ -19,7 +19,7 @@ Bug-Debian: https://bugs.debian.org/815020
  2 files changed, 1 insertion(+), 19 deletions(-)
 
 diff --git a/src/core/main.c b/src/core/main.c
-index 3f71cc0..876c7d5 100644
+index 1ed968d..758325d 100644
 --- a/src/core/main.c
 +++ b/src/core/main.c
 @@ -1653,22 +1653,6 @@ static void cmdline_take_random_seed(void) {
diff --git a/debian/patches/debian/Skip-flaky-test_resolved_domain_restricted_dns-in-network.patch b/debian/patches/debian/Skip-flaky-test_resolved_domain_restricted_dns-in-network.patch
deleted file mode 100644
index a57191d..0000000
--- a/debian/patches/debian/Skip-flaky-test_resolved_domain_restricted_dns-in-network.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From: Michael Biebl <biebl@debian.org>
-Date: Tue, 13 Dec 2022 00:32:17 +0100
-Subject: Skip flaky test_resolved_domain_restricted_dns in networkd-test.py
-
-This test is part of DnsmasqClientTest and does not work reliably under
-LXC/debci, so skip it for the time being.
-
-Closes: #1025908
----
- test/networkd-test.py | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/test/networkd-test.py b/test/networkd-test.py
-index 512137c..1bf1538 100755
---- a/test/networkd-test.py
-+++ b/test/networkd-test.py
-@@ -639,6 +639,7 @@ class DnsmasqClientTest(ClientTestBase, unittest.TestCase):
-         with open(path) as f:
-             sys.stdout.write('\n\n---- {} ----\n{}\n------\n\n'.format(os.path.basename(path), f.read()))
- 
-+    @unittest.skip("test is flaky:  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1025908")
-     def test_resolved_domain_restricted_dns(self):
-         '''resolved: domain-restricted DNS servers'''
- 
diff --git a/debian/patches/debian/fsckd-daemon-for-inter-fsckd-communication.patch b/debian/patches/debian/fsckd-daemon-for-inter-fsckd-communication.patch
index 7ec4439..655dd27 100644
--- a/debian/patches/debian/fsckd-daemon-for-inter-fsckd-communication.patch
+++ b/debian/patches/debian/fsckd-daemon-for-inter-fsckd-communication.patch
@@ -241,10 +241,10 @@ index 0000000..b7ad58d
 +
 +</refentry>
 diff --git a/meson.build b/meson.build
-index f1f4e7e..24f5bd2 100644
+index 554765b..0fce0fd 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2152,6 +2152,7 @@ subdir('src/environment-d-generator')
+@@ -2154,6 +2154,7 @@ subdir('src/environment-d-generator')
  subdir('src/escape')
  subdir('src/firstboot')
  subdir('src/fsck')
diff --git a/debian/patches/series b/debian/patches/series
index 8d381dd..4616402 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -5,7 +5,6 @@ debian/Skip-filesystem-check-if-already-done-by-the-initram.patch
 debian/Revert-core-set-RLIMIT_CORE-to-unlimited-by-default.patch
 debian/systemctl-do-not-shutdown-immediately-on-scheduled-shutdo.patch
 debian/Downgrade-a-couple-of-warnings-to-debug.patch
-debian/Skip-flaky-test_resolved_domain_restricted_dns-in-network.patch
 debian/localectl-disable-keymap-support.patch
 progress-linux/0001-agetty-nohostname.patch
 progress-linux/0002-proc-hidepid.patch
diff --git a/debian/rules b/debian/rules
index bea3eae..93c387b 100755
--- a/debian/rules
+++ b/debian/rules
@@ -61,7 +61,6 @@ CONFFLAGS = \
 	-Ddbuspolicydir=/usr/share/dbus-1/system.d/ \
 	-Dsupport-url=$(SUPPORT_URL) \
 	-Ddefault-kill-user-processes=false \
-	-Ddefault-hierarchy=unified \
 	-Ddefault-dnssec=no \
 	-Dpamconfdir=no \
 	-Dpamlibdir=/usr/lib/$(DEB_HOST_MULTIARCH)/security \
@@ -70,7 +69,6 @@ CONFFLAGS = \
 	-Dfirstboot=true \
 	-Dxkbcommon=disabled \
 	-Dwheel-group=false \
-	-Dpwquality=disabled \
 	-Doomd=true \
 	-Durlify=true \
 	-Dgnutls=disabled \
@@ -101,7 +99,8 @@ CONFFLAGS = \
 	-Dnss-systemd=true \
 	-Dresolve=true \
 	-Dstatus-unit-format-default=combined \
-	-Dstandalone-binaries=true
+	-Dstandalone-binaries=true \
+	-Dmode=$(if $(filter pkg.systemd.upstream,$(DEB_BUILD_PROFILES)),developer,release)
 
 ifeq ($(filter nocheck,$(DEB_BUILD_PROFILES))$(filter noinsttest,$(DEB_BUILD_PROFILES)),nochecknoinsttest)
 CONFFLAGS += -Dtests=false
@@ -129,6 +128,7 @@ CONFFLAGS += \
 	-Dtpm2=enabled \
 	-Dp11kit=enabled \
 	-Dqrencode=enabled \
+	-Dpwquality=enabled \
 	-Dhomed=enabled \
 	-Duserdb=true \
 	-Dpcre2=enabled \
@@ -153,6 +153,7 @@ CONFFLAGS += \
 	-Dtpm2=disabled \
 	-Dp11kit=disabled \
 	-Dqrencode=disabled \
+	-Dpwquality=disabled \
 	-Dhomed=disabled \
 	-Duserdb=false \
 	-Dpcre2=disabled \
@@ -161,6 +162,44 @@ CONFFLAGS += \
 	-Dsysupdate=disabled
 endif
 
+ifneq (, $(filter pkg.systemd.upstream, $(DEB_BUILD_PROFILES)))
+CONFFLAGS += \
+	-Dbpf-framework=enabled \
+	-Dbpf-compiler=clang
+
+# Ubuntu does not yet ship vmlinux.h, generate it at build time for now, until
+# https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2050083 is solved
+ifeq ($(DEB_VENDOR),Ubuntu)
+# Source: https://git.launchpad.net/ubuntu/+source/xdp-tools/tree/debian/rules
+# On Ubuntu, the `bpftool` in path is a shell wrapper pointing at
+# the binary corresponding to runtime kernel version.
+#
+# We do not know the kernel version being used on the system building
+# this package, and in sbuild/container environments uname might not
+# even match anything available to the build.
+# Gladly for the build we only need the tool to generate skeleton code.
+#
+# If any /usr/lib/linux-tools/*/bpftool exists, locate the most recent
+# version and point to that, otherwise `bpftool` from PATH will be
+# used.
+bpftool_binary := $(shell find /usr/lib/linux-tools/ -name 'bpftool' -perm /u=x 2>/dev/null | sort | head -n1)
+ifneq ($(bpftool_binary),)
+export PATH := $(shell dirname $(bpftool_binary)):$(PATH)
+endif
+CONFFLAGS += -Dvmlinux-h=auto
+else
+# The vmlinux.h we want is in the headers package that linux-headers-ARCH depends on,
+# which itself is the package that provides linux-headers-generic that we build depend on.
+# This is available since Trixie.
+HEADERS_PACKAGE = $(shell dpkg-query --showformat='$${Depends}' --show linux-headers-$(DEB_HOST_ARCH) | sed "s/.*\(linux-headers-.*-$(DEB_HOST_ARCH)\).*/\1/")
+ifneq ("$(wildcard /usr/src/$(HEADERS_PACKAGE)/vmlinux.h)","")
+CONFFLAGS += -Dvmlinux-h=provided -Dvmlinux-h-path=/usr/src/$(HEADERS_PACKAGE)/vmlinux.h
+else
+CONFFLAGS += -Dvmlinux-h=auto
+endif
+endif
+endif
+
 override_dh_auto_configure:
 	dh_auto_configure \
 		-- $(CONFFLAGS) $(CONFFLAGS_DISTRO) $(CONFFLAGS_UPSTREAM)
@@ -238,6 +277,15 @@ endif
 	# accidential directory removal by dpkg on merged-/usr systems.
 	find debian/systemd/usr/lib -type d -empty -print -delete
 
+	# Can be dropped once upstream CI stops running on Jammy, which needs
+	# the old pkla config files, which are created only when building with
+	# old polkit versions.
+ifneq (, $(filter pkg.systemd.upstream, $(DEB_BUILD_PROFILES)))
+	if [ -f debian/tmp/var/lib/polkit-1/localauthority/10-vendor.d/systemd-networkd.pkla ]; then \
+		dh_install -psystemd var/lib/polkit-1/localauthority/10-vendor.d/systemd-networkd.pkla; \
+	fi
+endif
+
 override_dh_missing:
 	dh_missing $(DH_MISSING)
 
diff --git a/debian/systemd-boot.install b/debian/systemd-boot.install
index 3724ddd..82947a3 100644..100755
--- a/debian/systemd-boot.install
+++ b/debian/systemd-boot.install
@@ -1,8 +1,12 @@
+#!/usr/bin/dh-exec
 usr/bin/bootctl
 usr/lib/systemd/systemd-bless-boot
 usr/lib/systemd/system-generators/systemd-bless-boot-generator
+<pkg.systemd.upstream> usr/lib/systemd/system/sockets.target.wants/systemd-bootctl.socket
 usr/lib/systemd/system/sysinit.target.wants/systemd-boot-random-seed.service
 usr/lib/systemd/system/systemd-bless-boot.service
+<pkg.systemd.upstream> usr/lib/systemd/system/systemd-bootctl.socket
+<pkg.systemd.upstream> usr/lib/systemd/system/systemd-bootctl@.service
 usr/lib/systemd/system/systemd-boot-random-seed.service
 usr/lib/systemd/system/systemd-boot-update.service
 usr/share/bash-completion/completions/bootctl
diff --git a/debian/systemd-container.install b/debian/systemd-container.install
index a612729..2c0f1ed 100644..100755
--- a/debian/systemd-container.install
+++ b/debian/systemd-container.install
@@ -1,15 +1,26 @@
+#!/usr/bin/dh-exec
+<pkg.systemd.upstream> usr/bin/importctl
+<pkg.systemd.upstream> usr/bin/systemd-vmspawn
+<pkg.systemd.upstream> usr/lib/systemd/system/systemd-vmspawn@.service
 usr/bin/machinectl
 usr/bin/portablectl
 usr/lib/systemd/import-pubring.gpg
+<pkg.systemd.upstream> usr/lib/systemd/network/80-namespace-ns.*
 usr/lib/systemd/portable
 usr/lib/systemd/systemd-machined
 usr/lib/systemd/systemd-export
 usr/lib/systemd/systemd-import*
+<pkg.systemd.upstream> usr/lib/systemd/systemd-mountfsd
+<pkg.systemd.upstream> usr/lib/systemd/systemd-mountwork
+<pkg.systemd.upstream> usr/lib/systemd/systemd-nsresourced
+<pkg.systemd.upstream> usr/lib/systemd/systemd-nsresourcework
 usr/lib/systemd/systemd-portabled
 usr/lib/systemd/systemd-pull
 usr/lib/systemd/system/systemd-nspawn@.service
 usr/lib/systemd/system/systemd-importd.service
 usr/lib/systemd/system/systemd-machined.service
+<pkg.systemd.upstream> usr/lib/systemd/system/systemd-mountfsd*
+<pkg.systemd.upstream> usr/lib/systemd/system/systemd-nsresourced*
 usr/lib/systemd/system/systemd-portabled.service
 usr/lib/systemd/system/var-lib-machines.mount
 usr/lib/systemd/system/machines.target
@@ -28,6 +39,7 @@ usr/share/dbus-1/system.d/org.freedesktop.portable1.conf
 usr/share/dbus-1/system-services/org.freedesktop.import1.service
 usr/share/dbus-1/system-services/org.freedesktop.machine1.service
 usr/share/dbus-1/system-services/org.freedesktop.portable1.service
+<pkg.systemd.upstream> usr/share/polkit-1/actions/io.systemd.mount-file-system.policy
 usr/share/polkit-1/actions/org.freedesktop.import1.policy
 usr/share/polkit-1/actions/org.freedesktop.machine1.policy
 usr/share/polkit-1/actions/org.freedesktop.portable1.policy
diff --git a/debian/systemd-container.manpages b/debian/systemd-container.manpages
index f5427ac..5a74dd2 100644..100755
--- a/debian/systemd-container.manpages
+++ b/debian/systemd-container.manpages
@@ -1,7 +1,17 @@
-usr/share/man/man*/mount.ddi*
-usr/share/man/man*/*nspawn*
-usr/share/man/man*/machinectl*
-usr/share/man/man*/portablectl*
-usr/share/man/man*/systemd-dissect*
-usr/share/man/man*/systemd-machined*
-usr/share/man/man*/systemd-portabled*
+#!/usr/bin/dh-exec
+<pkg.systemd.upstream> debian/tmp/usr/share/man/man1/importctl.1
+<pkg.systemd.upstream> debian/tmp/usr/share/man/man1/systemd-vmspawn.1
+debian/tmp/usr/share/man/man1/mount.ddi.1
+debian/tmp/usr/share/man/man1/systemd-nspawn.1
+debian/tmp/usr/share/man/man5/systemd.nspawn.5
+debian/tmp/usr/share/man/man1/machinectl.1
+debian/tmp/usr/share/man/man1/portablectl.1
+debian/tmp/usr/share/man/man1/systemd-dissect.1
+debian/tmp/usr/share/man/man8/systemd-machined.8
+debian/tmp/usr/share/man/man8/systemd-machined.service.8
+<pkg.systemd.upstream> debian/tmp/usr/share/man/man8/systemd-mountfsd.8
+<pkg.systemd.upstream> debian/tmp/usr/share/man/man8/systemd-mountfsd.service.8
+<pkg.systemd.upstream> debian/tmp/usr/share/man/man8/systemd-nsresourced.8
+<pkg.systemd.upstream> debian/tmp/usr/share/man/man8/systemd-nsresourced.service.8
+debian/tmp/usr/share/man/man8/systemd-portabled.8
+debian/tmp/usr/share/man/man8/systemd-portabled.service.8
diff --git a/debian/systemd-userdbd.install b/debian/systemd-userdbd.install
index d262f0c..4a5be38 100644..100755
--- a/debian/systemd-userdbd.install
+++ b/debian/systemd-userdbd.install
@@ -1,5 +1,9 @@
+#!/usr/bin/dh-exec
+<pkg.systemd.upstream> etc/ssh/sshd_config.d/20-systemd-userdb.conf
 usr/bin/userdbctl
 usr/lib/systemd/systemd-userdbd
 usr/lib/systemd/systemd-userwork
 usr/lib/systemd/system/systemd-userdbd.service
 usr/lib/systemd/system/systemd-userdbd.socket
+<pkg.systemd.upstream> usr/lib/systemd/sshd_config.d/20-systemd-userdb.conf
+<pkg.systemd.upstream> usr/lib/tmpfiles.d/20-systemd-userdb.conf
diff --git a/debian/systemd.install b/debian/systemd.install
index a795a86..608257c 100755
--- a/debian/systemd.install
+++ b/debian/systemd.install
@@ -54,9 +54,9 @@ usr/bin/systemd-sysusers
 usr/bin/systemd-tmpfiles
 usr/bin/systemd-tty-ask-password-agent
 usr/bin/systemd-umount
+<pkg.systemd.upstream> usr/bin/run0
 <pkg.systemd.upstream> usr/bin/systemd-vpick
 usr/bin/timedatectl
-<pkg.systemd.upstream> usr/bin/uid0
 usr/bin/varlinkctl
 usr/lib/environment.d/99-environment.conf
 usr/lib/kernel/install.conf
@@ -91,6 +91,8 @@ usr/lib/systemd/system/basic.target
 usr/lib/systemd/system/blockdev@.target
 usr/lib/systemd/system/bluetooth.target
 usr/lib/systemd/system/boot-complete.target
+<pkg.systemd.upstream> usr/lib/systemd/system/capsule.slice
+<pkg.systemd.upstream> usr/lib/systemd/system/capsule@.service
 usr/lib/systemd/system/console-getty.service
 usr/lib/systemd/system/container-getty@.service
 <!stage1> usr/lib/systemd/system/cryptsetup-pre.target
@@ -226,7 +228,7 @@ usr/lib/systemd/system-preset/90-systemd.preset
 usr/lib/systemd/system/printer.target
 usr/lib/systemd/system/proc-sys-fs-binfmt_misc.automount
 usr/lib/systemd/system/proc-sys-fs-binfmt_misc.mount
-usr/lib/systemd/system/quotaon.service
+usr/lib/systemd/system/quotaon*.service
 usr/lib/systemd/system/rc-local.service
 usr/lib/systemd/system/reboot.target
 <!stage1> usr/lib/systemd/system/remote-cryptsetup.target
@@ -251,7 +253,6 @@ usr/lib/systemd/system/sleep.target
 usr/lib/systemd/system/slices.target
 usr/lib/systemd/system/smartcard.target
 usr/lib/systemd/system/sockets.target
-[amd64 i386 arm64 armhf riscv64] <pkg.systemd.upstream> usr/lib/systemd/system/sockets.target.wants/systemd-bootctl.socket
 <pkg.systemd.upstream> usr/lib/systemd/system/sockets.target.wants/systemd-creds.socket
 usr/lib/systemd/system/sockets.target.wants/systemd-initctl.socket
 <pkg.systemd.upstream> usr/lib/systemd/system/sockets.target.wants/systemd-hostnamed.socket
@@ -262,6 +263,7 @@ usr/lib/systemd/system/sockets.target.wants/systemd-journald.socket
 usr/lib/systemd/system/sockets.target.wants/systemd-sysext.socket
 usr/lib/systemd/system/soft-reboot.target
 usr/lib/systemd/system/sound.target
+<pkg.systemd.upstream> usr/lib/systemd/system/ssh-access.target
 usr/lib/systemd/system/storage-target-mode.target
 usr/lib/systemd/system/suspend.target
 usr/lib/systemd/system/suspend-then-hibernate.target
@@ -269,6 +271,7 @@ usr/lib/systemd/system/swap.target
 usr/lib/systemd/system/sys-fs-fuse-connections.mount
 usr/lib/systemd/system/sysinit.target
 <!stage1> usr/lib/systemd/system/sysinit.target.wants/cryptsetup.target
+<pkg.systemd.upstream> usr/lib/systemd/system/sysinit.target.wants/systemd-hibernate-clear.service
 usr/lib/systemd/system/sysinit.target.wants/dev-hugepages.mount
 usr/lib/systemd/system/sysinit.target.wants/dev-mqueue.mount
 <!stage1> usr/lib/systemd/system/sysinit.target.wants/integritysetup.target
@@ -313,8 +316,6 @@ usr/lib/systemd/system/systemd-ask-password-wall.service
 usr/lib/systemd/system/systemd-backlight@.service
 usr/lib/systemd/system/systemd-battery-check.service
 usr/lib/systemd/system/systemd-binfmt.service
-[amd64 i386 arm64 armhf riscv64] <pkg.systemd.upstream> usr/lib/systemd/system/systemd-bootctl.socket
-[amd64 i386 arm64 armhf riscv64] <pkg.systemd.upstream> usr/lib/systemd/system/systemd-bootctl@.service
 usr/lib/systemd/system/systemd-boot-check-no-failures.service
 <!stage1> usr/lib/systemd/system/systemd-bsod.service
 usr/lib/systemd/system/systemd-confext.service
@@ -329,6 +330,7 @@ usr/lib/systemd/system/systemd-fsck@.service
 usr/lib/systemd/system/systemd-growfs-root.service
 usr/lib/systemd/system/systemd-growfs@.service
 usr/lib/systemd/system/systemd-halt.service
+<pkg.systemd.upstream> usr/lib/systemd/system/systemd-hibernate-clear.service
 usr/lib/systemd/system/systemd-hibernate-resume.service
 usr/lib/systemd/system/systemd-hibernate.service
 usr/lib/systemd/system/systemd-hostnamed.service
@@ -350,10 +352,8 @@ usr/lib/systemd/system/systemd-localed.service
 usr/lib/systemd/system/systemd-logind.service
 usr/lib/systemd/system/systemd-machine-id-commit.service
 usr/lib/systemd/system/systemd-modules-load.service
-usr/lib/systemd/system/systemd-networkd.service
+usr/lib/systemd/system/systemd-networkd*.service
 usr/lib/systemd/system/systemd-networkd.socket
-usr/lib/systemd/system/systemd-networkd-wait-online.service
-usr/lib/systemd/system/systemd-networkd-wait-online@.service
 usr/lib/systemd/system/systemd-network-generator.service
 [amd64 i386 arm64 armhf riscv64] <!stage1> usr/lib/systemd/system/systemd-pcrextend@.service
 [amd64 i386 arm64 armhf riscv64] <!stage1> usr/lib/systemd/system/systemd-pcrextend.socket
@@ -374,7 +374,7 @@ usr/lib/systemd/system/systemd-network-generator.service
 [amd64 i386 arm64 armhf riscv64] <!stage1> usr/lib/systemd/system/systemd-pcrphase-sysinit.service
 usr/lib/systemd/system/systemd-poweroff.service
 usr/lib/systemd/system/systemd-pstore.service
-usr/lib/systemd/system/systemd-quotacheck.service
+usr/lib/systemd/system/systemd-quotacheck*.service
 usr/lib/systemd/system/systemd-random-seed.service
 usr/lib/systemd/system/systemd-reboot.service
 usr/lib/systemd/system/systemd-remount-fs.service
@@ -432,6 +432,7 @@ usr/lib/systemd/user/app.slice
 usr/lib/systemd/user/background.slice
 usr/lib/systemd/user/basic.target
 usr/lib/systemd/user/bluetooth.target
+<pkg.systemd.upstream> usr/lib/systemd/user/capsule@.target
 usr/lib/systemd/user/default.target
 usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
 usr/lib/systemd/user/exit.target
diff --git a/debian/systemd.manpages b/debian/systemd.manpages
index caccf5a..66104de 100755
--- a/debian/systemd.manpages
+++ b/debian/systemd.manpages
@@ -5,6 +5,7 @@ debian/tmp/usr/share/man/man1/journalctl.1
 debian/tmp/usr/share/man/man1/localectl.1
 debian/tmp/usr/share/man/man1/loginctl.1
 debian/tmp/usr/share/man/man1/networkctl.1
+<pkg.systemd.upstream> debian/tmp/usr/share/man/man1/run0.1
 debian/tmp/usr/share/man/man1/systemctl.1
 debian/tmp/usr/share/man/man1/systemd.1
 debian/tmp/usr/share/man/man1/systemd-ac-power.1
@@ -23,7 +24,8 @@ debian/tmp/usr/share/man/man1/systemd-firstboot.service.1
 debian/tmp/usr/share/man/man1/systemd-id128.1
 debian/tmp/usr/share/man/man1/systemd-inhibit.1
 debian/tmp/usr/share/man/man1/systemd-machine-id-setup.1
-[amd64 i386 arm64 armhf riscv64] <!stage1> debian/tmp/usr/share/man/man1/systemd-measure.1
+[amd64 i386 arm64 armhf riscv64] <!stage1 !pkg.systemd.upstream> debian/tmp/usr/share/man/man1/systemd-measure.1
+<pkg.systemd.upstream> debian/tmp/usr/share/man/man1/systemd-measure.1
 debian/tmp/usr/share/man/man1/systemd-mount.1
 debian/tmp/usr/share/man/man1/systemd-notify.1
 debian/tmp/usr/share/man/man1/systemd-path.1
@@ -35,9 +37,9 @@ debian/tmp/usr/share/man/man1/systemd-tty-ask-password-agent.1
 debian/tmp/usr/share/man/man1/systemd-umount.1
 <pkg.systemd.upstream> debian/tmp/usr/share/man/man1/systemd-vpick.1
 debian/tmp/usr/share/man/man1/timedatectl.1
-<pkg.systemd.upstream> debian/tmp/usr/share/man/man1/uid0.1
 debian/tmp/usr/share/man/man1/varlinkctl.1
 debian/tmp/usr/share/man/man5/binfmt.d.5
+<pkg.systemd.upstream> debian/tmp/usr/share/man/man5/capsule@.service.5
 debian/tmp/usr/share/man/man5/dnssec-trust-anchors.d.5
 debian/tmp/usr/share/man/man5/environment.d.5
 debian/tmp/usr/share/man/man5/extension-release.5
@@ -167,6 +169,7 @@ debian/tmp/usr/share/man/man8/systemd-growfs.8
 debian/tmp/usr/share/man/man8/systemd-growfs-root.service.8
 debian/tmp/usr/share/man/man8/systemd-growfs@.service.8
 debian/tmp/usr/share/man/man8/systemd-halt.service.8
+<pkg.systemd.upstream> debian/tmp/usr/share/man/man8/systemd-hibernate-clear.service.8
 debian/tmp/usr/share/man/man8/systemd-hibernate-resume.8
 debian/tmp/usr/share/man/man8/systemd-hibernate-resume-generator.8
 debian/tmp/usr/share/man/man8/systemd-hibernate-resume.service.8
diff --git a/debian/tests/control b/debian/tests/control
index 3b2390f..a68437f 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -1,35 +1,38 @@
 Tests: timedated, hostnamed, localed-locale, localed-x11-keymap, logind
 Depends: systemd,
+  systemd-resolved,
   systemd-timesyncd,
   libpam-systemd,
   libnss-systemd,
   acl,
   locales,
   evemu-tools,
-Restrictions: needs-root, isolation-container, skippable
+Restrictions: needs-root, isolation-container, skippable, breaks-testbed
 
 Tests: unit-config
 Depends: systemd,
+  systemd-resolved,
   libpam-systemd,
   libnss-systemd,
   acl,
   locales,
   evemu-tools,
   python3,
-  pkg-config,
-Restrictions: needs-root, allow-stderr
+  pkgconf,
+Restrictions: needs-root, allow-stderr, breaks-testbed
 
 Tests: storage
 Depends: systemd,
+  systemd-resolved,
   libpam-systemd,
   libnss-systemd,
   acl,
   locales,
   evemu-tools,
   python3,
-  pkg-config,
+  pkgconf,
   cryptsetup-bin,
-Restrictions: needs-root, isolation-machine
+Restrictions: needs-root, isolation-machine, breaks-testbed
 
 Tests: networkd-test.py
 Tests-Directory: test
@@ -41,7 +44,7 @@ Depends: systemd,
   locales,
   evemu-tools,
   python3,
-  pkg-config,
+  pkgconf,
   cryptsetup-bin,
   systemd-sysv,
   polkitd,
@@ -51,13 +54,14 @@ Restrictions: needs-root, isolation-container, breaks-testbed
 
 Tests: build-login
 Depends: systemd,
+  systemd-resolved,
   libpam-systemd,
   libnss-systemd,
   acl,
   locales,
   evemu-tools,
   python3,
-  pkg-config,
+  pkgconf,
   cryptsetup-bin,
   systemd-sysv,
   polkitd,
@@ -70,6 +74,7 @@ Tests: boot-and-services
 Depends: systemd-sysv,
   systemd-container,
   systemd-coredump,
+  systemd-resolved,
   libpam-systemd,
   libdw-dev,
   libelf-dev,
@@ -81,14 +86,15 @@ Depends: systemd-sysv,
   busybox-static,
   rsyslog,
   apparmor,
-  pkg-config,
+  pkgconf,
   python3,
   python3-pefile,
-  dhcpcd-base,
+  dhcpcd-base | dhcpcd5,
 Restrictions: needs-root, isolation-container, breaks-testbed, allow-stderr
 
 Tests: unit-tests
 Depends: systemd-tests,
+  systemd-resolved,
   libpam-systemd,
   libnss-myhostname,
   libnss-mymachines,
@@ -103,7 +109,7 @@ Depends: systemd-tests,
   xz-utils,
   libcap2-bin,
   iproute2,
-  liblz4-tool,
+  lz4,
   acl,
   iputils-ping,
   dbus-user-session,
@@ -112,6 +118,9 @@ Depends: systemd-tests,
   libfido2-dev,
   libdw-dev,
   libqrencode-dev,
+  libpwquality-dev,
+  libarchive-dev,
+  libgcrypt20-dev,
   tzdata-legacy | tzdata (<< 2024a-1),
 Restrictions: needs-root, isolation-container, breaks-testbed
 
@@ -124,7 +133,7 @@ Depends: systemd-tests,
   systemd-oomd,
   systemd-homed,
   systemd-resolved,
-  systemd-boot-efi,
+  systemd-boot-efi [amd64 arm64 armhf i386 riscv64],
   libnss-myhostname,
   libnss-mymachines,
   libnss-resolve,
@@ -135,7 +144,7 @@ Depends: systemd-tests,
   xz-utils,
   libcap2-bin,
   iproute2,
-  liblz4-tool,
+  lz4,
   acl,
   dmeventd,
   kbd,
@@ -151,7 +160,7 @@ Depends: systemd-tests,
   qemu-system-s390x [s390x],
   seabios,
   less,
-  pkg-config,
+  pkgconf,
   gcc,
   libc6-dev | libc-dev,
   make,
@@ -174,8 +183,12 @@ Depends: systemd-tests,
   libtss2-dev,
   libfido2-dev,
   libqrencode-dev,
+  libpwquality-dev,
+  libarchive-dev,
   libp11-kit-dev,
   libssl-dev,
+  libgcrypt20-dev,
+  libkmod-dev,
   python3-pexpect,
   screen,
   swtpm,
@@ -211,6 +224,7 @@ Restrictions: needs-root, allow-stderr, isolation-machine
 
 Tests: boot-smoke
 Depends: systemd-sysv,
+  systemd-resolved,
   network-manager,
   gdm3 [!s390x],
   xserver-xorg-video-dummy,
@@ -218,7 +232,8 @@ Restrictions: needs-root, isolation-container, allow-stderr, breaks-testbed
 
 Tests: build-with-static-libsystemd
 Depends: systemd,
-  pkg-config,
+  systemd-resolved,
+  pkgconf,
   build-essential,
   libsystemd-dev,
   libcap-dev,
diff --git a/debian/udev.install b/debian/udev.install
index 99a99a6..32c943d 100755
--- a/debian/udev.install
+++ b/debian/udev.install
@@ -12,6 +12,7 @@ usr/lib/systemd/system/sysinit.target.wants/systemd-udev-trigger.service
 usr/lib/systemd/system/systemd-hwdb-update.service
 usr/lib/systemd/system/systemd-udevd-control.socket
 usr/lib/systemd/system/systemd-udevd-kernel.socket
+<pkg.systemd.upstream> usr/lib/systemd/system/systemd-udev-load-credentials.service
 usr/lib/systemd/system/systemd-udevd.service
 usr/lib/systemd/system/systemd-udev-settle.service
 usr/lib/systemd/system/systemd-udev-trigger.service