[wrynose][PATCH] systemd: Upgrade 259.5 -> 259.10

[wrynose][PATCH] systemd: Upgrade 259.5 -> 259.10

[Jaipaul Cheernam]

* Stable v259 release uplift
* CompareLog: https://github.com/systemd/systemd/compare/v259.5...v259.10
* Drop below patches which are part of upstream
  0001-Revert-resolve-refuse-traffic-from-the-local-host-only.patch, 0004-tpm2-util-fix-PCR-bank-guessing-without-EFI.patch

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 ...259.5.bb => systemd-boot-native_259.10.bb} |  0
 ...d-boot_259.5.bb => systemd-boot_259.10.bb} |  0
 ....bb => systemd-systemctl-native_259.10.bb} |  0
 meta/recipes-core/systemd/systemd.inc         |  2 +-
 ...use-traffic-from-the-local-host-only.patch | 61 ------------------
 ...il-fix-PCR-bank-guessing-without-EFI.patch | 62 -------------------
 .../{systemd_259.5.bb => systemd_259.10.bb}   |  2 -
 7 files changed, 1 insertion(+), 126 deletions(-)
 rename meta/recipes-core/systemd/{systemd-boot-native_259.5.bb => systemd-boot-native_259.10.bb} (100%)
 rename meta/recipes-core/systemd/{systemd-boot_259.5.bb => systemd-boot_259.10.bb} (100%)
 rename meta/recipes-core/systemd/{systemd-systemctl-native_259.5.bb => systemd-systemctl-native_259.10.bb} (100%)
 delete mode 100644 meta/recipes-core/systemd/systemd/0001-Revert-resolve-refuse-traffic-from-the-local-host-only.patch
 delete mode 100644 meta/recipes-core/systemd/systemd/0004-tpm2-util-fix-PCR-bank-guessing-without-EFI.patch
 rename meta/recipes-core/systemd/{systemd_259.5.bb => systemd_259.10.bb} (99%)

diff --git a/meta/recipes-core/systemd/systemd-boot-native_259.5.bb b/meta/recipes-core/systemd/systemd-boot-native_259.10.bb
similarity index 100%
rename from meta/recipes-core/systemd/systemd-boot-native_259.5.bb
rename to meta/recipes-core/systemd/systemd-boot-native_259.10.bb
diff --git a/meta/recipes-core/systemd/systemd-boot_259.5.bb b/meta/recipes-core/systemd/systemd-boot_259.10.bb
similarity index 100%
rename from meta/recipes-core/systemd/systemd-boot_259.5.bb
rename to meta/recipes-core/systemd/systemd-boot_259.10.bb
diff --git a/meta/recipes-core/systemd/systemd-systemctl-native_259.5.bb b/meta/recipes-core/systemd/systemd-systemctl-native_259.10.bb
similarity index 100%
rename from meta/recipes-core/systemd/systemd-systemctl-native_259.5.bb
rename to meta/recipes-core/systemd/systemd-systemctl-native_259.10.bb
diff --git a/meta/recipes-core/systemd/systemd.inc b/meta/recipes-core/systemd/systemd.inc
index bbcacf9deb..ae3a034ef3 100644
--- a/meta/recipes-core/systemd/systemd.inc
+++ b/meta/recipes-core/systemd/systemd.inc
@@ -15,7 +15,7 @@ LICENSE:libsystemd = "LGPL-2.1-or-later"
 LIC_FILES_CHKSUM = "file://LICENSE.GPL2;md5=c09786363500a9acc29b147e6e72d2c6 \
                     file://LICENSE.LGPL2.1;md5=be0aaf4a380f73f7e00b420a007368f2"
 
-SRCREV = "b3d8fc43e9cb531d958c17ef2cd93b374bc14e8a"
+SRCREV = "cc6062f23cb595c172d9a007ed99d925852bfd60"
 SRCBRANCH = "v259-stable"
 SRC_URI = "git://github.com/systemd/systemd.git;protocol=https;branch=${SRCBRANCH};tag=v${PV}"
 
diff --git a/meta/recipes-core/systemd/systemd/0001-Revert-resolve-refuse-traffic-from-the-local-host-only.patch b/meta/recipes-core/systemd/systemd/0001-Revert-resolve-refuse-traffic-from-the-local-host-only.patch
deleted file mode 100644
index efdc2852f9..0000000000
--- a/meta/recipes-core/systemd/systemd/0001-Revert-resolve-refuse-traffic-from-the-local-host-only.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 658e5ac06f80ee2078b034f7cc483204d7f91c5e Mon Sep 17 00:00:00 2001
-From: Bret Comnes <bret@comnes.org>
-Date: Thu, 26 Mar 2026 05:59:09 +0000
-Subject: [PATCH] Revert "resolve: refuse traffic from the local host only for
- queries"
-
-This reverts commit 526f1594daec073269c3e70ee7914f6dd8740d5c.
-
-This revert is necessary because the change breaks mDNS hostname stability
-whenever a DNS-SD service calls UnregisterService. When a service
-unregisters (e.g. on process restart), manager_refresh_rrs() clears and
-re-adds all RRs in PROBING state, which sends a multicast announcement
-(QR=1). The kernel reflects this back to resolved's own socket. Because
-the local-address check was moved inside the query-only branch by the
-reverted commit, the reply path in on_mdns_packet() is now unguarded.
-The looped-back announcement matches the pending probe transaction and
-completes it with DNS_TRANSACTION_SUCCESS. Since the zone item is still
-in PROBING state (not ESTABLISHED), dns_zone_item_notify() sets
-we_lost=true and calls dns_zone_item_conflict(), which invokes
-manager_next_hostname() and renames the hostname (e.g. foo.local to
-foo4.local). This happens reliably on every restart of any service using
-RegisterService/UnregisterService (homebridge, avahi-compat wrappers,
-etc.).
-
-The top-level local-address check in on_mdns_packet() suppresses all
-looped-back multicast traffic before the reply/query split. Restoring it
-there is consistent with the overall design: dns_scope_check_conflicts()
-already has its own manager_packet_from_local_address() guard and is
-unaffected.
-
-A more targeted long-term fix (e.g. guarding dns_transaction_process_reply()
-for mDNS, or avoiding unnecessary re-probing of already-established records
-in manager_refresh_rrs()) can be pursued separately.
-
-Upstream-Status: Backport [https://github.com/systemd/systemd/commit/658e5ac06f80ee2078b034f7cc483204d7f91c5e]
-Signed-off-by: Peter Tatrai <peter.tatrai.ext@siemens.com>
----
- src/resolve/resolved-mdns.c | 16 ++++++++--------
- 1 file changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/src/resolve/resolved-mdns.c b/src/resolve/resolved-mdns.c
---- a/src/resolve/resolved-mdns.c
-+++ b/src/resolve/resolved-mdns.c
-@@ -415,0 +416,8 @@
-+        /* Refuse traffic from the local host, to avoid query loops. However, allow legacy mDNS
-+         * unicast queries through anyway (we never send those ourselves, hence no risk).
-+         * i.e. check for the source port nr. */
-+        if (p->sender_port == MDNS_PORT && manager_packet_from_local_address(m, p)) {
-+                log_debug("Got mDNS UDP packet from local host, ignoring.");
-+                return 0;
-+        }
-+
-@@ -532,8 +539,0 @@
--                /* Refuse traffic from the local host, to avoid query loops. However, allow legacy mDNS
--                 * unicast queries through anyway (we never send those ourselves, hence no risk).
--                 * i.e. check for the source port nr. */
--                if (p->sender_port == MDNS_PORT && manager_packet_from_local_address(m, p)) {
--                        log_debug("Got mDNS UDP packet from local host, ignoring.");
--                        return 0;
--                }
--
diff --git a/meta/recipes-core/systemd/systemd/0004-tpm2-util-fix-PCR-bank-guessing-without-EFI.patch b/meta/recipes-core/systemd/systemd/0004-tpm2-util-fix-PCR-bank-guessing-without-EFI.patch
deleted file mode 100644
index c590b01cd3..0000000000
--- a/meta/recipes-core/systemd/systemd/0004-tpm2-util-fix-PCR-bank-guessing-without-EFI.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 3cef11c710e95bb5f891181e9b2a6d8f174712c3 Mon Sep 17 00:00:00 2001
-From: Patrick Wicki <patrick.wicki@subset.ch>
-Date: Fri, 20 Mar 2026 15:56:56 +0100
-Subject: [PATCH] tpm2-util: fix PCR bank guessing without EFI
-
-Since 7643e4a89 efi_get_active_pcr_banks() is used to determine the
-active PCR banks. Without EFI support, this returns -EOPNOTSUPP. This in
-turns leads to cryptenroll and cryptsetup attach failures unless the PCR
-bank is explicitly set, i.e.
-
-$ systemd-cryptenroll $LUKS_PART --tpm2-device=auto --tpm2-pcrs='7'
-[...]
-Could not read pcr values: Operation not supported
-
-But it works fine with --tpm2-pcrs='7:sha256'.
-
-Similarly, unsealing during cryptsetup attach also fails if the bank
-needs to be determined:
-
-Failed to unseal secret using TPM2: Operation not supported
-
-Catch the -EOPNOTSUPP and fallback to the guessing strategy.
-
-Upstream-Status: Backport [https://github.com/systemd/systemd/pull/41231]
-
-Signed-off-by: Patrick Wicki <patrick.wicki@siemens.com>
----
- src/shared/tpm2-util.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
-index cf11b50695..c0590fe575 100644
---- a/src/shared/tpm2-util.c
-+++ b/src/shared/tpm2-util.c
-@@ -2702,11 +2702,11 @@ int tpm2_get_best_pcr_bank(
-         uint32_t efi_banks;
-         r = efi_get_active_pcr_banks(&efi_banks);
-         if (r < 0) {
--                if (r != -ENOENT)
-+                if (!IN_SET(r, -ENOENT, -EOPNOTSUPP))
-                         return r;
- 
-                 /* If variable is not set use guesswork below */
--                log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable, we have to guess the used PCR banks.");
-+                log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable or EFI support is unavailable, we have to guess the used PCR banks.");
-         } else if (efi_banks == UINT32_MAX)
-                 log_debug("Boot loader set the LoaderTpm2ActivePcrBanks EFI variable to indicate that the GetActivePcrBanks() API is not available in the firmware. We have to guess the used PCR banks.");
-         else {
-@@ -2811,11 +2811,11 @@ int tpm2_get_good_pcr_banks(
-         uint32_t efi_banks;
-         r = efi_get_active_pcr_banks(&efi_banks);
-         if (r < 0) {
--                if (r != -ENOENT)
-+                if (!IN_SET(r, -ENOENT, -EOPNOTSUPP))
-                         return r;
- 
-                 /* If the variable is not set we have to guess via the code below */
--                log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable, we have to guess the used PCR banks.");
-+                log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable or EFI support is unavailable, we have to guess the used PCR banks.");
-         } else if (efi_banks == UINT32_MAX)
-                 log_debug("Boot loader set the LoaderTpm2ActivePcrBanks EFI variable to indicate that the GetActivePcrBanks() API is not available in the firmware. We have to guess the used PCR banks.");
-         else {
diff --git a/meta/recipes-core/systemd/systemd_259.5.bb b/meta/recipes-core/systemd/systemd_259.10.bb
similarity index 99%
rename from meta/recipes-core/systemd/systemd_259.5.bb
rename to meta/recipes-core/systemd/systemd_259.10.bb
index e924884bf9..f7c16a045d 100644
--- a/meta/recipes-core/systemd/systemd_259.5.bb
+++ b/meta/recipes-core/systemd/systemd_259.10.bb
@@ -34,8 +34,6 @@ SRC_URI += " \
            file://0003-Do-not-create-var-log-README.patch \
            file://0001-meson-use-libfido2_cflags-dependency.patch \
            file://0018-shared-fdset-add-detailed-debug-logging-to-fdset_new.patch \
-           file://0004-tpm2-util-fix-PCR-bank-guessing-without-EFI.patch \
-           file://0001-Revert-resolve-refuse-traffic-from-the-local-host-only.patch \
            "
 
 PAM_PLUGINS = " \

Re: [wrynose][PATCH] systemd: Upgrade 259.5 -> 259.10

[Jaipaul Cheernam]

[-- Attachment #1: Type: text/plain, Size: 122 bytes --]

Hi Yoann,

My local test shows regression failures and I will get back .
So please hold on this.

Regards,
Jaipaul

[-- Attachment #2: Type: text/html, Size: 229 bytes --]