diff --git a/SPECS-SIGNED/systemd-boot-signed/systemd-boot-signed.spec b/SPECS-SIGNED/systemd-boot-signed/systemd-boot-signed.spec index 73238100e8d..36b0416ffdf 100644 --- a/SPECS-SIGNED/systemd-boot-signed/systemd-boot-signed.spec +++ b/SPECS-SIGNED/systemd-boot-signed/systemd-boot-signed.spec @@ -20,7 +20,7 @@ Version: 255 # determine the build information from local checkout Version: %(tools/meson-vcs-tag.sh . error | sed -r 's/-([0-9])/.^\1/; s/-g/_g/') %endif -Release: 34%{?dist} +Release: 35%{?dist} License: LGPL-2.1-or-later AND MIT AND GPL-2.0-or-later Vendor: Microsoft Corporation Distribution: Azure Linux @@ -98,6 +98,9 @@ popd /boot/efi/EFI/BOOT/%{grubefiname} %changelog +* Thu Sep 10 2026 Pawel Winogrodzki - 255-35 +- Bump release to match the systemd spec. + * Mon Aug 17 2026 Aditya Singh - 255-34 - Bump release to match systemd spec. diff --git a/SPECS/systemd/systemd-fsck-wants-device.patch b/SPECS/systemd/systemd-fsck-wants-device.patch new file mode 100644 index 00000000000..9a36f64d6e4 --- /dev/null +++ b/SPECS/systemd/systemd-fsck-wants-device.patch @@ -0,0 +1,49 @@ +Use Wants instead of BindsTo for the generated initrd root filesystem +checker and the static systemd-fsck@ template. Keep their After ordering +so initial device discovery still precedes the filesystem check. + +This experimental alternative avoids stopping the checker solely because +udev temporarily withdraws its filesystem UUID alias. It adds no device +locks and leaves sysroot.mount dependencies and its UUID-based source +unchanged. The generated systemd-fsck-usr.service retains BindsTo. + +Wants does not propagate device activation failure or automatically stop +the checker on device removal. This change also does not restore a +missing UUID link or retry a failed root mount. + +Related issue: https://github.com/systemd/systemd/issues/43695 + +diff --git a/src/shared/generator.c b/src/shared/generator.c +--- a/src/shared/generator.c ++++ b/src/shared/generator.c +@@ -225,7 +225,7 @@ static int write_fsck_sysroot_service( + "Documentation=man:%2$s(8)\n" + "\n" + "DefaultDependencies=no\n" +- "BindsTo=%3$s\n" ++ "%7$s=%3$s\n" + "Conflicts=shutdown.target\n" + "After=%4$s%5$slocal-fs-pre.target %3$s\n" + "Before=shutdown.target\n" +@@ -240,7 +240,8 @@ static int write_fsck_sysroot_service( + device, + strempty(extra_after), + isempty(extra_after) ? "" : " ", +- escaped2); ++ escaped2, ++ streq(unit, SPECIAL_FSCK_ROOT_SERVICE) ? "Wants" : "BindsTo"); + + r = fflush_and_check(f); + if (r < 0) +diff --git a/units/systemd-fsck@.service.in b/units/systemd-fsck@.service.in +--- a/units/systemd-fsck@.service.in ++++ b/units/systemd-fsck@.service.in +@@ -11,7 +11,7 @@ + Description=File System Check on %f + Documentation=man:systemd-fsck@.service(8) + DefaultDependencies=no +-BindsTo=%i.device ++Wants=%i.device + Conflicts=shutdown.target + After=%i.device systemd-fsck-root.service local-fs-pre.target + Before=systemd-quotacheck.service shutdown.target diff --git a/SPECS/systemd/systemd.spec b/SPECS/systemd/systemd.spec index bc46e768f95..86282e416da 100644 --- a/SPECS/systemd/systemd.spec +++ b/SPECS/systemd/systemd.spec @@ -50,7 +50,7 @@ Version: 255 # determine the build information from local checkout Version: %(tools/meson-vcs-tag.sh . error | sed -r 's/-([0-9])/.^\1/; s/-g/_g/') %endif -Release: 34%{?dist} +Release: 35%{?dist} # FIXME - hardcode to 'stable' for now as that's what we have in our blobstore %global stable 1 @@ -161,6 +161,7 @@ Patch0913: network-also-check-ID_NET_MANAGED_BY-property-on-rec.patch Patch0914: Prevent-corruption-from-stale-alias-state-on-daemon-reload.patch Patch0915: CVE-2026-15059.patch Patch0916: CVE-2026-16742.patch +Patch0917: systemd-fsck-wants-device.patch %ifarch %{ix86} x86_64 aarch64 %global want_bootloader 1 @@ -1259,6 +1260,10 @@ rm -f %{name}.lang # %autochangelog. So we need to continue manually maintaining the # changelog here. %changelog +* Thu Sep 10 2026 Pawel Winogrodzki - 255-35 +- Use Wants for the generated root filesystem checker and the fsck service + template device dependencies. + * Thu Aug 13 2026 Azure Linux Security Servicing Account - 255-34 - Patch for CVE-2026-16742, CVE-2026-15059