Merging upstream version 256.4.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

17 files changed, 799 insertions, 0 deletions

diff --git a/mkosi.images/build/mkosi.conf b/mkosi.images/build/mkosi.conf
new file mode 100644
index 0000000..8a67c76
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf
@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Content]
+Packages=
+        clang
+        lld
+        llvm
+
+[Output]
+Format=none
diff --git a/mkosi.images/build/mkosi.conf.d/arch/mkosi.build.chroot b/mkosi.images/build/mkosi.conf.d/arch/mkosi.build.chroot
new file mode 100755
index 0000000..3ffde85
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/arch/mkosi.build.chroot
@@ -0,0 +1,95 @@
+#!/bin/bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -e
+
+if [[ ! -f "pkg/$PKG_SUBDIR/PKGBUILD" ]]; then
+    echo "PKGBUILD not found at pkg/$PKG_SUBDIR/PKGBUILD, run mkosi once with -ff to make sure the PKGBUILD is cloned" >&2
+    exit 1
+fi
+
+# We can't configure the source or build directory so we use symlinks instead to make sure they are in the
+# expected locations. Because we run with --noextract we are responsible for making sure the source files
+# appear in src/. This means not only the systemd source directory, but also the patches and configuration
+# files that are shipped in the packaging repository. To achieve this, instead of symlinking the systemd
+# sources and build directory directly into "pkg/$PKG_SUBDIR/src", we symlink them into "pkg/$PKG_SUBDIR" and
+# then symlink "pkg/$PKG_SUBDIR" to "pkg/$PKG_SUBDIR/src".
+ln --symbolic "$SRCDIR" "pkg/$PKG_SUBDIR/systemd"
+ln --symbolic "$BUILDDIR" "pkg/$PKG_SUBDIR/build"
+ln --symbolic . "pkg/$PKG_SUBDIR/src"
+
+MKOSI_CFLAGS="-O0 -Wp,-U_FORTIFY_SOURCE"
+if ((LLVM)); then
+    # TODO: Remove -fno-sanitize-function when https://github.com/systemd/systemd/issues/29972 is fixed.
+    MKOSI_CFLAGS="$MKOSI_CFLAGS -shared-libasan -fno-sanitize=function"
+fi
+
+MKOSI_LDFLAGS=""
+if ((LLVM)) && [[ -n "$SANITIZERS" ]]; then
+    MKOSI_LDFLAGS="$MKOSI_LDFLAGS -Wl,-rpath=$(realpath "$(clang --print-runtime-dir)")"
+fi
+
+MKOSI_MESON_OPTIONS="-D mode=developer -D b_sanitize=${SANITIZERS:-none}"
+if ((WIPE)) && [[ -d "$BUILDDIR/meson-private" ]]; then
+    MKOSI_MESON_OPTIONS="$MKOSI_MESON_OPTIONS --wipe"
+fi
+
+# Override the default options. We specifically disable "strip", "zipman" and "lto" as they slow down builds
+# significantly. OPTIONS= cannot be overridden on the makepkg command line so we append to /etc/makepkg.conf
+# instead. The rootfs is overlaid with a writable tmpfs during the build script so these changes don't end up
+# in the image itself.
+tee --append /etc/makepkg.conf >/dev/null <<EOF
+export CC="$( ((LLVM)) && echo clang || echo gcc)"
+export CXX="$( ((LLVM)) && echo clang++ || echo g++)"
+export CC_LD="$( ((LLVM)) && echo lld)"
+export CXX_LD="$( ((LLVM)) && echo lld)"
+export CFLAGS="\$CFLAGS $MKOSI_CFLAGS $CFLAGS"
+export CXXFLAGS="\$CXXFLAGS $MKOSI_CFLAGS $CFLAGS"
+export LDFLAGS="\$LDFLAGS $MKOSI_LDFLAGS $LDFLAGS"
+OPTIONS=(
+    docs
+    !libtool
+    !staticlibs
+    emptydirs
+    !zipman
+    purge
+    $( ((WITH_DEBUG)) && echo strip || echo !strip)
+    $( ((WITH_DEBUG)) && echo debug || echo !debug)
+    !lto
+)
+EOF
+
+# Linting the PKGBUILD takes multiple seconds every build so avoid that by nuking all the linting functions.
+rm /usr/share/makepkg/lint_pkgbuild/*
+
+if [[ -d .git/ ]] && [[ -z "$(git status --porcelain)" ]]; then
+    TS="$(git show --no-patch --format=%ct HEAD)"
+else
+    TS="${SOURCE_DATE_EPOCH:-$(date +%s)}"
+fi
+
+sed --in-place "pkg/$PKG_SUBDIR/PKGBUILD" \
+    --expression "s/^_tag=.*/_tag=$(cat meson.version)/" \
+    --expression "s/^pkgrel=.*/pkgrel=$(date "+%Y%m%d%H%M%S" --date "@$TS")/"
+
+# We get around makepkg's root check by setting EUID to something else.
+# shellcheck disable=SC2046
+env --chdir="pkg/$PKG_SUBDIR" \
+    EUID=123 \
+    makepkg \
+    --noextract \
+    $( ((WITH_TESTS)) || echo --nocheck) \
+    --force \
+    _systemd_UPSTREAM=1 \
+    _systemd_QUIET=$( ((MESON_VERBOSE)); echo $? ) \
+    BUILDDIR="$PWD/pkg/$PKG_SUBDIR" \
+    PKGDEST="$OUTPUTDIR" \
+    PKGEXT=".pkg.tar" \
+    MESON_EXTRA_CONFIGURE_OPTIONS="$MKOSI_MESON_OPTIONS $MESON_OPTIONS"
+
+(
+    shopt -s nullglob
+    rm -f "$BUILDDIR"/*.pkg.tar
+)
+
+cp "$OUTPUTDIR"/*.pkg.tar "$PACKAGEDIR"
+cp "$OUTPUTDIR"/*.pkg.tar "$BUILDDIR"
diff --git a/mkosi.images/build/mkosi.conf.d/arch/mkosi.conf b/mkosi.images/build/mkosi.conf.d/arch/mkosi.conf
new file mode 100644
index 0000000..c071468
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/arch/mkosi.conf
@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=arch
+
+[Content]
+Environment=
+        GIT_URL=https://gitlab.archlinux.org/archlinux/packaging/packages/systemd.git
+        GIT_BRANCH=main
+        GIT_COMMIT=1d577a62688419ee4af01b847e55845cd9780301
+        PKG_SUBDIR=arch
+
+Packages=
+        base
+        base-devel
+        diffutils
+        erofs-utils
+        git
diff --git a/mkosi.images/build/mkosi.conf.d/arch/mkosi.prepare b/mkosi.images/build/mkosi.conf.d/arch/mkosi.prepare
new file mode 100755
index 0000000..d9e3221
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/arch/mkosi.prepare
@@ -0,0 +1,18 @@
+#!/bin/bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -e
+
+if [[ "$1" == "build" ]]; then
+    exit 0
+fi
+
+if [[ ! -f "pkg/$PKG_SUBDIR/PKGBUILD" ]]; then
+    echo "PKGBUILD not found at pkg/$PKG_SUBDIR/PKGBUILD, run mkosi once with -ff to make sure the PKGBUILD is cloned" >&2
+    exit 1
+fi
+
+# shellcheck source=/dev/null
+_systemd_UPSTREAM=1 . "pkg/$PKG_SUBDIR/PKGBUILD"
+
+# shellcheck disable=SC2154
+mkosi-install "${makedepends[@]}"
diff --git a/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.build.chroot b/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.build.chroot
new file mode 100755
index 0000000..466699c
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.build.chroot
@@ -0,0 +1,116 @@
+#!/bin/bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -e
+
+. mkosi.functions
+
+if [[ ! -f "pkg/$PKG_SUBDIR/systemd.spec" ]]; then
+    echo "spec not found at pkg/$PKG_SUBDIR/systemd.spec, run mkosi once with -ff to make sure the spec is cloned" >&2
+    exit 1
+fi
+
+if [[ -d .git/ ]] && [[ -z "$(git status --porcelain)" ]]; then
+    TS="$(git show --no-patch --format=%ct HEAD)"
+else
+    TS="${SOURCE_DATE_EPOCH:-$(date +%s)}"
+fi
+
+if [[ "$(rpm --eval "%{lua:print(rpm.vercmp('$(rpm --version | cut -d ' ' -f3)', '4.19.91'))}")" == "-1" ]]; then
+    # Fix the %install override so debuginfo packages are generated even when --build-in-place is used.
+    # See https://github.com/rpm-software-management/rpm/issues/3042.
+    tee --append /usr/lib/rpm/redhat/macros <<'EOF'
+%install %{?_enable_debug_packages:%{debug_package}}\
+%%install\
+%{nil}
+EOF
+fi
+
+VERSION="$(cat meson.version)"
+RELEASE="$(date "+%Y%m%d%H%M%S" --date "@$TS")"
+
+COMMON_MACRO_OVERRIDES=(
+    --define "toolchain $( ((LLVM)) && echo clang || echo gcc)"
+    --define "_fortify_level 0"
+    --undefine _lto_cflags
+    # TODO: Remove once redhat-rpm-config 292 is available everywhere.
+    --define "_hardening_clang_cflags --config=/usr/lib/rpm/redhat/redhat-hardened-clang.cfg"
+    --define "_hardening_clang_ldflags --config=/usr/lib/rpm/redhat/redhat-hardened-clang-ld.cfg"
+)
+
+# TODO: Drop -U_FORTIFY_SOURCE when we switch to CentOS Stream 10.
+MKOSI_CFLAGS="-O0 -Wp,-U_FORTIFY_SOURCE"
+if ((WITH_DEBUG)); then
+    MKOSI_CFLAGS="$MKOSI_CFLAGS -fdebug-prefix-map=../src=/usr/src/debug/systemd"
+fi
+if ((LLVM)); then
+    # TODO: Remove -fno-sanitize-function when https://github.com/systemd/systemd/issues/29972 is fixed.
+    MKOSI_CFLAGS="$MKOSI_CFLAGS -shared-libasan -fno-sanitize=function"
+fi
+
+MKOSI_LDFLAGS=""
+if ((LLVM)) && [[ -n "$SANITIZERS" ]]; then
+    MKOSI_LDFLAGS="$MKOSI_LDFLAGS -Wl,-rpath=$(realpath "$(clang --print-runtime-dir)")"
+fi
+
+MKOSI_MESON_OPTIONS="-D mode=developer -D b_sanitize=${SANITIZERS:-none}"
+if ((WIPE)) && [[ -d "$BUILDDIR/meson-private" ]]; then
+    MKOSI_MESON_OPTIONS="$MKOSI_MESON_OPTIONS --wipe"
+fi
+
+IFS=
+# TODO: Replace meson_build and meson_install overrides with "--undefine __meson_verbose" once
+# https://github.com/mesonbuild/meson/pull/12835 is available.
+# shellcheck disable=SC2046
+env \
+--unset=CFLAGS \
+--unset=CXXFLAGS \
+--unset=LDFLAGS \
+ANNOBIN="no-active-checks" \
+CC_LD="$( ((LLVM)) && echo lld)" \
+CXX_LD="$( ((LLVM)) && echo lld)" \
+    rpmbuild \
+    -bb \
+    --build-in-place \
+    --with upstream \
+    $( ((WITH_TESTS)) || echo "--nocheck") \
+    $( ((WITH_DOCS))  || echo "--without=docs") \
+    --define "_topdir /var/tmp" \
+    --define "_sourcedir pkg/$PKG_SUBDIR" \
+    --define "_rpmdir $OUTPUTDIR" \
+    ${BUILDDIR:+"--define=_vpath_builddir $BUILDDIR"} \
+    --define "_build_name_fmt %%{NAME}-%%{VERSION}-%%{RELEASE}.%%{ARCH}.rpm" \
+    --define "_binary_payload w.ufdio" \
+    $( ((WITH_DEBUG)) || echo "--define=debug_package %{nil}") \
+    --define "version_override $VERSION" \
+    --define "release_override $RELEASE" \
+    "${COMMON_MACRO_OVERRIDES[@]}" \
+    --define "build_cflags $(rpm "${COMMON_MACRO_OVERRIDES[@]}" --eval "%{?build_cflags}") $MKOSI_CFLAGS $CFLAGS" \
+    --define "build_cxxflags $(rpm "${COMMON_MACRO_OVERRIDES[@]}" --eval "%{?build_cxxflags}") $MKOSI_CFLAGS $CFLAGS" \
+    --define "build_ldflags $(rpm "${COMMON_MACRO_OVERRIDES[@]}" --eval "%{?build_ldflags}") $MKOSI_LDFLAGS $LDFLAGS" \
+    --define "meson_build %{shrink:%{__meson} compile -C %{_vpath_builddir} -j %{_smp_build_ncpus} $( ((MESON_VERBOSE)) && echo --verbose) %{nil}}" \
+    --define "meson_install %{shrink:DESTDIR=%{buildroot} %{__meson} install -C %{_vpath_builddir} --no-rebuild --quiet %{nil}}" \
+    --define "meson_extra_configure_options $MKOSI_MESON_OPTIONS $MESON_OPTIONS" \
+    $( ((WITH_DEBUG)) || echo "--define=__brp_strip %{nil}") \
+    --define "__brp_compress %{nil}" \
+    --define "__brp_mangle_shebangs %{nil}" \
+    --define "__brp_strip_comment_note %{nil}" \
+    --define "__brp_strip_static_archive %{nil}" \
+    --define "__brp_check_rpaths %{nil}" \
+    --define "__elf_exclude_path ^/usr/lib/systemd/tests/unit-tests/.*$" \
+    --define "__script_requires %{nil}" \
+    --define "_find_debuginfo_opts --unique-debug-src-base \"%{name}\"" \
+    --define "_find_debuginfo_dwz_opts %{nil}" \
+    --define "_fixperms true" \
+    --undefine _package_note_flags \
+    --noclean \
+    "pkg/$PKG_SUBDIR/systemd.spec"
+
+(
+    shopt -s nullglob
+    rm -f "$BUILDDIR"/*.rpm
+)
+
+cp "$OUTPUTDIR"/*.rpm "$PACKAGEDIR"
+cp "$OUTPUTDIR"/*.rpm "$BUILDDIR"
+
+make_sysext_unsigned /var/tmp/BUILD/*/BUILDROOT
diff --git a/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.conf b/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.conf
new file mode 100644
index 0000000..f3afd55
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.conf
@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=|centos
+Distribution=|fedora
+
+[Content]
+Environment=
+        GIT_URL=https://src.fedoraproject.org/rpms/systemd.git
+        GIT_BRANCH=rawhide
+        GIT_COMMIT=00babccdea1576d96edfdb7ab12958564cc4f1b6
+        PKG_SUBDIR=fedora
+
+Packages=
+        compiler-rt
+        git-core
+        libasan
+        libubsan
+        rpm-build
diff --git a/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.prepare b/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.prepare
new file mode 100755
index 0000000..6028dc3
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.prepare
@@ -0,0 +1,60 @@
+#!/bin/bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -e
+
+if [[ "$1" == "build" ]]; then
+    exit 0
+fi
+
+if [[ ! -f "pkg/$PKG_SUBDIR/systemd.spec" ]]; then
+    echo "spec not found at pkg/$PKG_SUBDIR/systemd.spec, run mkosi with -ff to make sure the spec is cloned" >&2
+    exit 1
+fi
+
+mkosi-chroot \
+    rpmspec \
+    --with upstream \
+    --query \
+    --buildrequires \
+    --define "_topdir /var/tmp" \
+    --define "_sourcedir pkg/$PKG_SUBDIR" \
+    "pkg/$PKG_SUBDIR/systemd.spec" |
+        grep --invert-match --regexp systemd --regexp /bin/sh --regexp "rpmlib(" --regexp udev --regexp grubby --regexp sdubby |
+        sort --unique |
+        tee /tmp/buildrequires |
+        xargs --delimiter '\n' mkosi-install
+
+# rpmbuild -br tries to build a source package which means all source files have to exist which isn't the
+# case when using --build-in-place so we get rid of the source file that doesn't exist to make it happy.
+# TODO: Use -bd instead of -br and get rid of this once we don't need to build on CentOS Stream 9 anymore.
+sed '/Source0/d' --in-place "pkg/$PKG_SUBDIR/systemd.spec"
+
+until mkosi-chroot \
+    rpmbuild \
+    -br \
+    --build-in-place \
+    --with upstream \
+    --define "_topdir /var/tmp" \
+    --define "_sourcedir pkg/$PKG_SUBDIR" \
+    --define "_build_name_fmt %%{NAME}-%%{VERSION}-%%{RELEASE}.%%{ARCH}.rpm" \
+    "pkg/$PKG_SUBDIR/systemd.spec"
+do
+    EXIT_STATUS=$?
+    if [[ $EXIT_STATUS -ne 11 ]]; then
+        exit $EXIT_STATUS
+    fi
+
+    mkosi-chroot \
+        rpm \
+        --query \
+        --package \
+        --requires \
+        /var/tmp/SRPMS/systemd-*.buildreqs.nosrc.rpm |
+            grep --invert-match '^rpmlib(' |
+            sort --unique >/tmp/dynamic-buildrequires
+
+    sort /tmp/buildrequires /tmp/dynamic-buildrequires |
+        uniq --unique |
+        tee --append /tmp/buildrequires |
+        xargs --delimiter '\n' mkosi-install
+done
diff --git a/mkosi.images/build/mkosi.conf.d/centos/mkosi.conf b/mkosi.images/build/mkosi.conf.d/centos/mkosi.conf
new file mode 100644
index 0000000..f3d19e3
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/centos/mkosi.conf
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=centos
+
+[Content]
+Packages=
+        rsync # TODO: Drop when CentOS Stream 9 CI is removed.
+        squashfs-tools
diff --git a/mkosi.images/build/mkosi.conf.d/centos/mkosi.conf.d/epel-packages.conf b/mkosi.images/build/mkosi.conf.d/centos/mkosi.conf.d/epel-packages.conf
new file mode 100644
index 0000000..15849c5
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/centos/mkosi.conf.d/epel-packages.conf
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Repositories=epel
+
+[Content]
+Packages=
+        erofs-utils
+        rpmautospec-rpm-macros
diff --git a/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.build.chroot b/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.build.chroot
new file mode 100755
index 0000000..2d50afb
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.build.chroot
@@ -0,0 +1,140 @@
+#!/bin/bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -e
+
+if [[ ! -d "pkg/$PKG_SUBDIR/debian" ]]; then
+    echo "deb rules not found at pkg/$PKG_SUBDIR/debian, run mkosi once with -ff to make sure the rules are cloned" >&2
+    exit 1
+fi
+
+# We transplant the debian/ folder from the deb package sources into the upstream sources.
+mount --mkdir --bind "$SRCDIR/pkg/$PKG_SUBDIR/debian" "$SRCDIR"/debian
+
+# We remove the patches so they don't get applied.
+rm -rf "$SRCDIR"/debian/patches/*
+
+# While the build directory can be specified through DH_OPTIONS, the default one is hardcoded everywhere so
+# we have to use that. Because it is architecture dependent, we query it using dpkg-architecture first.
+DEB_HOST_GNU_TYPE="$(dpkg-architecture --query DEB_HOST_GNU_TYPE)"
+mount --mkdir --bind "$BUILDDIR" "$SRCDIR/obj-$DEB_HOST_GNU_TYPE"
+
+if [[ -d .git/ ]] && [[ -z "$(git status --porcelain)" ]]; then
+    TS="$(git show --no-patch --format=%ct HEAD)"
+else
+    TS="${SOURCE_DATE_EPOCH:-$(date +%s)}"
+fi
+
+# Add a new changelog entry to update the version. We use a fixed date since a dynamic one causes a full
+# rebuild every time.
+cat >debian/changelog.new <<EOF
+systemd ($(cat meson.version)-$(date "+%Y%m%d%H%M%S" --date "@$TS")) UNRELEASED; urgency=low
+
+  * Automatic build from mkosi
+
+ -- systemd test <systemd-devel@lists.freedesktop.org>  $(date --rfc-email --date "@$TS")
+
+EOF
+cat debian/changelog >>debian/changelog.new
+mv debian/changelog.new debian/changelog
+
+MKOSI_CFLAGS="-O0"
+if ((LLVM)); then
+    # TODO: Remove -fno-sanitize-function when https://github.com/systemd/systemd/issues/29972 is fixed.
+    MKOSI_CFLAGS="$MKOSI_CFLAGS -shared-libasan -fno-sanitize=function"
+fi
+
+MKOSI_LDFLAGS=""
+if ((LLVM)) && [[ -n "$SANITIZERS" ]]; then
+    MKOSI_LDFLAGS="$MKOSI_LDFLAGS -Wl,-rpath=$(realpath "$(clang --print-runtime-dir)")"
+fi
+
+MKOSI_MESON_OPTIONS="-D mode=developer -D b_sanitize=${SANITIZERS:-none}"
+if ((WIPE)) && [[ -d "$BUILDDIR/meson-private" ]]; then
+    MKOSI_MESON_OPTIONS="$MKOSI_MESON_OPTIONS --wipe"
+fi
+
+# TODO: Drop GENSYMBOLS_LEVEL once https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=986746 is fixed.
+build() {
+    env \
+    CC="$( ((LLVM)) && echo clang || echo gcc)" \
+    CXX="$( ((LLVM)) && echo clang++ || echo g++)" \
+    CC_LD="$( ((LLVM)) && echo lld)" \
+    CXX_LD="$( ((LLVM)) && echo lld)" \
+    DEB_BUILD_OPTIONS="$(awk '$1=$1' <<<"\
+        $( ((WITH_TESTS)) || echo nocheck) \
+        $( ((WITH_DOCS)) || echo nodoc) \
+        $( ((WITH_DEBUG)) && echo debug || echo nostrip) \
+        $( ! ((MESON_VERBOSE)) && echo terse) \
+        optimize=-lto \
+        hardening=-fortify \
+    ")" \
+    DEB_BUILD_PROFILES="$(awk '$1=$1' <<<"\
+        $( ((WITH_TESTS)) || echo nocheck) \
+        $( ((WITH_DOCS)) || echo nodoc) \
+        pkg.systemd.upstream \
+    ")" \
+    DEB_CFLAGS_APPEND="$MKOSI_CFLAGS $CFLAGS" \
+    DEB_CXXFLAGS_APPEND="$MKOSI_CFLAGS $CFLAGS" \
+    DEB_LDFLAGS_APPEND="$MKOSI_LDFLAGS $LDFLAGS" \
+    DPKG_FORCE="unsafe-io" \
+    DPKG_DEB_COMPRESSOR_TYPE="none" \
+    DH_MISSING="--fail-missing" \
+    CONFFLAGS_UPSTREAM="$MKOSI_MESON_OPTIONS $MESON_OPTIONS" \
+    GENSYMBOLS_LEVEL="$( ((LLVM)) && echo 0 || echo 1)" \
+        dpkg-buildpackage \
+        --no-pre-clean \
+        --unsigned-changes \
+        --build=binary
+
+    EXIT_STATUS=$?
+
+    # Make sure we don't reconfigure twice.
+    MKOSI_MESON_OPTIONS="${MKOSI_MESON_OPTIONS//"--wipe"/}"
+
+    return $EXIT_STATUS
+}
+
+if ! build; then
+    # debhelper installs files for each package to debian/<package> so we figure out which files were
+    # packaged by querying all the package names from debian/control and running find on each of the
+    # corresponding package directory in debian/.
+    grep "Package:" debian/control |
+        sed "s/Package: //" |
+        xargs -d '\n' -I {} sh -c "[ -d debian/{} ] && (cd debian/{} && find . ! -type d ! -path "*dh-exec*" -printf '%P\n')" |
+        # Remove compression suffix from compressed manpages as the manpages in debian/tmp will be uncompressed.
+        sed --regexp-extended 's/([0-9])\.gz$/\1/' |
+        sort --unique >/tmp/packaged-files
+
+    # We figure out the installed files by running find on debian/tmp/ which contains the files installed
+    # by meson install.
+    (cd debian/tmp/ && find . ! -type d ! -path "*dh-exec*" -printf '%P\n') >/tmp/installed-files
+
+    if [[ -f debian/not-installed ]]; then
+        grep --invert-match "^#" debian/not-installed >>/tmp/installed-files
+    fi
+
+    sort --unique --output /tmp/installed-files /tmp/installed-files
+
+    # We get all the installed files that were not packaged by finding entries in the installed file that are
+    # not in the packaged file.
+    comm -23 /tmp/installed-files /tmp/packaged-files > /tmp/unpackaged-files
+    # If there are no unpackaged files something else went wrong.
+    if [[ ! -s /tmp/unpackaged-files ]]; then
+        exit 1
+    fi
+
+    # Otherwise, we append the unpackaged files to the filelist for the systemd package and retry the build.
+    cat /tmp/unpackaged-files >>debian/systemd.install
+    build
+fi
+
+(
+    shopt -s nullglob
+    rm -f "$BUILDDIR"/*.deb "$BUILDDIR"/*.ddeb
+
+    cp ../*.deb ../*.ddeb "$PACKAGEDIR"
+    cp ../*.deb ../*.ddeb "$OUTPUTDIR"
+    cp ../*.deb ../*.ddeb "$BUILDDIR"
+    # These conflict with the packages that we actually want to install, so remove them
+    rm -f "$BUILDDIR"/systemd-standalone-*.deb "$BUILDDIR"/systemd-standalone-*.ddeb
+)
diff --git a/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.conf b/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.conf
new file mode 100644
index 0000000..132ee1b
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.conf
@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=|debian
+Distribution=|ubuntu
+
+[Content]
+Environment=
+        GIT_URL=https://salsa.debian.org/systemd-team/systemd.git
+        GIT_SUBDIR=debian
+        GIT_BRANCH=ci/v256-stable
+        GIT_COMMIT=c004a150e78c0453848480485b2e3eb0ac7dff8b
+        PKG_SUBDIR=debian
+
+Packages=
+        apt
+        erofs-utils
+        git-core
+        libclang-rt-dev
+        dpkg-dev
diff --git a/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.prepare b/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.prepare
new file mode 100755
index 0000000..cec81ec
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.prepare
@@ -0,0 +1,15 @@
+#!/bin/bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -e
+
+if [[ "$1" == "build" ]]; then
+    exit 0
+fi
+
+if [[ ! -d "pkg/$PKG_SUBDIR/debian" ]]; then
+    echo "deb rules not found at pkg/$PKG_SUBDIR/debian, run mkosi once with -ff to make sure the rules are cloned" >&2
+    exit 1
+fi
+
+cd "pkg/$PKG_SUBDIR"
+DEB_BUILD_PROFILES="pkg.systemd.upstream" apt-get build-dep .
diff --git a/mkosi.images/build/mkosi.conf.d/fedora/mkosi.conf b/mkosi.images/build/mkosi.conf.d/fedora/mkosi.conf
new file mode 100644
index 0000000..0e02dcb
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/fedora/mkosi.conf
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=fedora
+
+[Content]
+Packages=
+        erofs-utils
+        rpmautospec
diff --git a/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot b/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot
new file mode 100755
index 0000000..a1fb83c
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot
@@ -0,0 +1,134 @@
+#!/bin/bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -e
+
+. mkosi.functions
+
+if [[ ! -f "pkg/$PKG_SUBDIR/systemd.spec" ]]; then
+    echo "spec not found at pkg/$PKG_SUBDIR/systemd.spec, run mkosi once with -ff to make sure the spec is cloned" >&2
+    exit 1
+fi
+
+if [[ -d .git/ ]] && [[ -z "$(git status --porcelain)" ]]; then
+    TS="$(git show --no-patch --format=%ct HEAD)"
+else
+    TS="${SOURCE_DATE_EPOCH:-$(date +%s)}"
+fi
+
+# The openSUSE filelists hardcode the manpage compression extension. This causes rpmbuild errors since we
+# disable manpage compression as the files cannot be found. Fix the issue by removing the compression
+# extension.
+find "pkg/$PKG_SUBDIR" -name "files.*" -exec sed --in-place 's/\.gz$//' {} \;
+
+if [[ "$(rpm --eval "%{lua:print(rpm.vercmp('$(rpm --version | cut -d ' ' -f3)', '4.20'))}")" == "-1" ]]; then
+    # Fix the %install override so debuginfo packages are generated.
+    tee --append /usr/lib/rpm/suse/macros <<'EOF'
+%install %{debug_package}\
+%%install\
+%{nil}
+EOF
+fi
+
+VERSION="$(cat meson.version)"
+RELEASE="$(date "+%Y%m%d%H%M%S" --date "@$TS")"
+
+MKOSI_CFLAGS="-O0 -Wp,-U_FORTIFY_SOURCE"
+if ((WITH_DEBUG)); then
+    MKOSI_CFLAGS="$MKOSI_CFLAGS -fdebug-prefix-map=../src=/usr/src/debug/systemd"
+fi
+if ((LLVM)); then
+    # TODO: Remove -fno-sanitize-function when https://github.com/systemd/systemd/issues/29972 is fixed.
+    MKOSI_CFLAGS="$MKOSI_CFLAGS -shared-libasan -fno-sanitize=function"
+fi
+
+MKOSI_LDFLAGS="$(rpm --eval "%{?build_ldflags}")"
+if ((LLVM)) && [[ -n "$SANITIZERS" ]]; then
+    MKOSI_LDFLAGS="$MKOSI_LDFLAGS -Wl,-rpath=$(realpath "$(clang --print-runtime-dir)")"
+fi
+
+# A macro can't have an empty body and currently opensuse does not specify any of its own linker flags so
+# set LDFLAGS to %{nil} if there are no linker flags.
+if [[ -z "${MKOSI_LDFLAGS// }" ]]; then
+    MKOSI_LDFLAGS="%{nil}"
+fi
+
+MKOSI_MESON_OPTIONS="-D mode=developer -D b_sanitize=${SANITIZERS:-none}"
+if ((WIPE)) && [[ -d "$BUILDDIR/meson-private" ]]; then
+    MKOSI_MESON_OPTIONS="$MKOSI_MESON_OPTIONS --wipe"
+fi
+
+# TODO: Drop when the spec is fixed (either the patch is adapted or not applied when building for upstream).
+sed --in-place '/0009-pid1-handle-console-specificities-weirdness-for-s390.patch/d' "pkg/$PKG_SUBDIR/systemd.spec"
+
+build() {
+    IFS=
+    # shellcheck disable=SC2046
+    env \
+    --unset CFLAGS \
+    --unset CXXFLAGS \
+    --unset LDFLAGS \
+    CC="$( ((LLVM)) && echo clang || echo gcc)" \
+    CXX="$( ((LLVM)) && echo clang++ || echo g++)" \
+    CC_LD="$( ((LLVM)) && echo lld)" \
+    CXX_LD="$( ((LLVM)) && echo lld)" \
+    rpmbuild \
+        -bb \
+        --build-in-place \
+        --with upstream \
+        $( ((WITH_TESTS)) || echo "--nocheck") \
+        --define "_topdir /var/tmp" \
+        --define "_sourcedir pkg/$PKG_SUBDIR" \
+        --define "_rpmdir $OUTPUTDIR" \
+        ${BUILDDIR:+"--define=_vpath_builddir $BUILDDIR"} \
+        --define "_build_name_fmt %%{NAME}-%%{VERSION}-%%{RELEASE}.%%{ARCH}.rpm" \
+        --define "_binary_payload w.ufdio" \
+        $( ((WITH_DEBUG)) || echo "--define=debug_package %{nil}") \
+        --define "vendor openSUSE" \
+        --define "version_override $VERSION" \
+        --define "release_override $RELEASE" \
+        --define "__check_files sh -c '$(rpm --define "_topdir /var/tmp" --eval %__check_files) | tee /tmp/unpackaged-files'" \
+        --define "build_cflags $(rpm --eval "%{?build_cflags}") $MKOSI_CFLAGS $CFLAGS" \
+        --define "build_cxxflags $(rpm --eval "%{?build_cxxflags}") $MKOSI_CFLAGS $CFLAGS" \
+        --define "build_ldflags $MKOSI_LDFLAGS $LDFLAGS" \
+        $( ((MESON_VERBOSE)) || echo "--undefine=__meson_verbose") \
+        --define "meson_extra_configure_options $MKOSI_MESON_OPTIONS $MESON_OPTIONS" \
+        --define "__os_install_post /usr/lib/rpm/brp-suse %{nil}" \
+        --define "__elf_exclude_path ^/usr/lib/systemd/tests/unit-tests/.*$" \
+        --define "__script_requires %{nil}" \
+        --define "_find_debuginfo_dwz_opts %{nil}" \
+        --define "_find_debuginfo_opts --unique-debug-src-base \"%{name}\"" \
+        --define "_fixperms true" \
+        --noclean \
+        "$@" \
+        "pkg/$PKG_SUBDIR/systemd.spec"
+
+    EXIT_STATUS=$?
+
+    # Make sure we don't reconfigure twice.
+    MKOSI_MESON_OPTIONS="${MKOSI_MESON_OPTIONS//"--wipe"/}"
+
+    return $EXIT_STATUS
+}
+
+if ! build; then
+    if [[ ! -s /tmp/unpackaged-files ]]; then
+        exit 1
+    fi
+
+    # rpm will append to any existing systemd.lang so delete it explicitly so we don't get duplicate file
+    # warnings.
+    rm systemd.lang
+
+    grep -v ".debug" /tmp/unpackaged-files >>"pkg/$PKG_SUBDIR/files.systemd"
+    build --noprep --nocheck
+fi
+
+(
+    shopt -s nullglob
+    rm -f "$BUILDDIR"/*.rpm
+)
+
+cp "$OUTPUTDIR"/*.rpm "$PACKAGEDIR"
+cp "$OUTPUTDIR"/*.rpm "$BUILDDIR"
+
+make_sysext_unsigned /var/tmp/BUILD/*/BUILDROOT
diff --git a/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.conf b/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.conf
new file mode 100644
index 0000000..1d55a91
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.conf
@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=opensuse
+
+[Content]
+Environment=
+        GIT_URL=https://code.opensuse.org/package/systemd
+        GIT_BRANCH=master
+        GIT_COMMIT=6812406e52a474568744c267e7bade1496bb26a5
+        PKG_SUBDIR=opensuse
+
+Packages=
+        gcc-c++
+        erofs-utils
+        git-core
+        patterns-base-minimal_base
+        rpm-build
diff --git a/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.prepare b/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.prepare
new file mode 100755
index 0000000..24f07fd
--- /dev/null
+++ b/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.prepare
@@ -0,0 +1,58 @@
+#!/bin/bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -e
+
+if [[ "$1" == "build" ]]; then
+    exit 0
+fi
+
+if [[ ! -f "pkg/$PKG_SUBDIR/systemd.spec" ]]; then
+    echo "spec not found at pkg/$PKG_SUBDIR/systemd.spec, run mkosi once with -ff to make sure the spec is cloned" >&2
+    exit 1
+fi
+
+# TODO: Drop when the spec is fixed (either the patch is adapted or not applied when building for upstream).
+sed --in-place '/0009-pid1-handle-console-specificities-weirdness-for-s390.patch/d' "pkg/$PKG_SUBDIR/systemd.spec"
+
+mkosi-chroot \
+    rpmspec \
+    --with upstream \
+    --query \
+    --buildrequires \
+    --define "_topdir /var/tmp" \
+    --define "_sourcedir pkg/$PKG_SUBDIR" \
+    "pkg/$PKG_SUBDIR/systemd.spec" |
+        grep --invert-match --regexp systemd --regexp /bin/sh --regexp "rpmlib(" --regexp udev |
+        sort --unique |
+        tee /tmp/buildrequires |
+        xargs --delimiter '\n' mkosi-install
+
+until mkosi-chroot \
+    rpmbuild \
+    -bd \
+    --build-in-place \
+    --with upstream \
+    --define "_topdir /var/tmp" \
+    --define "_sourcedir pkg/$PKG_SUBDIR" \
+    --define "_build_name_fmt %%{NAME}-%%{VERSION}-%%{RELEASE}.%%{ARCH}.rpm" \
+    "pkg/$PKG_SUBDIR/systemd.spec"
+do
+    EXIT_STATUS=$?
+    if [[ $EXIT_STATUS -ne 11 ]]; then
+        exit $EXIT_STATUS
+    fi
+
+    mkosi-chroot \
+        rpm \
+        --query \
+        --package \
+        --requires \
+        /var/tmp/SRPMS/systemd-*.buildreqs.nosrc.rpm |
+            grep --invert-match '^rpmlib(' |
+            sort --unique >/tmp/dynamic-buildrequires
+
+    sort /tmp/buildrequires /tmp/dynamic-buildrequires |
+        uniq --unique |
+        tee --append /tmp/buildrequires |
+        xargs --delimiter '\n' mkosi-install
+done
diff --git a/mkosi.images/build/mkosi.sync b/mkosi.images/build/mkosi.sync
new file mode 100755
index 0000000..febe893
--- /dev/null
+++ b/mkosi.images/build/mkosi.sync
@@ -0,0 +1,51 @@
+#!/bin/bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -e
+set -o nounset
+
+if ((${NO_SYNC:-0})) || ((${NO_BUILD:-0})); then
+    exit 0
+fi
+
+if [[ -d "pkg/$PKG_SUBDIR/.git" ]]; then
+    if [[ "$(git -C "pkg/$PKG_SUBDIR" rev-parse HEAD)" == "$GIT_COMMIT" ]]; then
+        exit 0
+    fi
+
+    if ! git -C "pkg/$PKG_SUBDIR" show-ref --quiet "origin/$GIT_BRANCH"; then
+        git -C "pkg/$PKG_SUBDIR" remote set-url origin "$GIT_URL"
+        git -C "pkg/$PKG_SUBDIR" fetch origin "$GIT_BRANCH"
+    fi
+
+    # If work is being done on the packaging rules in a separate branch, don't touch the checkout.
+    if ! git -C "pkg/$PKG_SUBDIR" merge-base --is-ancestor HEAD "origin/$GIT_BRANCH"; then
+        EXIT_STATUS=$?
+        if [[ $EXIT_STATUS -eq 1 ]]; then
+            exit 0
+        else
+            exit $EXIT_STATUS
+        fi
+    fi
+fi
+
+if [[ ! -e "pkg/$PKG_SUBDIR" ]] || [[ -z "$(ls --almost-all "pkg/$PKG_SUBDIR")" ]]; then
+    # The repository on Salsa has the full upstream sources, so it's a waste of
+    # space to redownload and duplicate everything, so do a sparse checkout as
+    # we only need the packaging directory anyway.
+    if [[ -n "${GIT_SUBDIR:-}" ]]; then
+        sparse=(--no-checkout --filter=tree:0)
+    else
+        sparse=()
+    fi
+
+    git clone "$GIT_URL" --branch "$GIT_BRANCH" "${sparse[@]}" "pkg/$PKG_SUBDIR"
+    if [[ -n "${GIT_SUBDIR:-}" ]]; then
+        # --no-cone is needed to check out only one top-level directory
+        git -C "pkg/$PKG_SUBDIR" sparse-checkout set --no-cone "${GIT_SUBDIR:-}"
+    fi
+else
+    git -C "pkg/$PKG_SUBDIR" remote set-url origin "$GIT_URL"
+    git -C "pkg/$PKG_SUBDIR" fetch origin "$GIT_BRANCH"
+fi
+
+git -C "pkg/$PKG_SUBDIR" -c advice.detachedHead=false checkout "$GIT_COMMIT"