sys-apps/systemd: Sync with Gentoo to update to 258.2

From d45a090cf70ae75de9e22b54016b049a90f7abc8

Signed-off-by: Kai Lueke <kailuke@microsoft.com>

Author: pothos

changelog/updates/2025-12-08-update-systemd.md

@@ -0,0 +1 @@
+- systemd (258.2)

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0001-wait-online-set-any-by-default.patch

@@ -1,7 +1,7 @@
-From 83043596b6cc74b6f049999fa660afd983dc493a Mon Sep 17 00:00:00 2001
+From 61ae07bbf1d7032eef32137b1fe299647602e3de Mon Sep 17 00:00:00 2001
 From: David Michael <dm0@redhat.com>
 Date: Tue, 16 Apr 2019 02:44:51 +0000
-Subject: [PATCH 1/8] wait-online: set --any by default
+Subject: [PATCH] wait-online: set --any by default
 
 The systemd-networkd-wait-online command would normally continue
 waiting after a network interface is usable if other interfaces are
@@ -11,22 +11,22 @@ Preserve previous Container Linux behavior for compatibility by
 setting the --any flag by default.  See patches from v241 (or
 earlier) for the original implementation.
 ---
- src/network/wait-online/wait-online.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
+ src/network/wait-online/wait-online.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/network/wait-online/wait-online.c b/src/network/wait-online/wait-online.c
-index 6f5aef903a..0acb3e76b9 100644
+index b1d0b9cde2..e07c11d807 100644
 --- a/src/network/wait-online/wait-online.c
 +++ b/src/network/wait-online/wait-online.c
-@@ -21,7 +21,7 @@ static Hashmap *arg_interfaces = NULL;
+@@ -24,7 +24,7 @@ static Hashmap *arg_interfaces = NULL;
  static char **arg_ignore = NULL;
  static LinkOperationalStateRange arg_required_operstate = LINK_OPERSTATE_RANGE_INVALID;
  static AddressFamily arg_required_family = ADDRESS_FAMILY_NO;
 -static bool arg_any = false;
 +static bool arg_any = true;
+ static bool arg_requires_dns = false;
 
- STATIC_DESTRUCTOR_REGISTER(arg_interfaces, hashmap_free_free_freep);
- STATIC_DESTRUCTOR_REGISTER(arg_ignore, strv_freep);
+ STATIC_DESTRUCTOR_REGISTER(arg_interfaces, hashmap_freep);
 -- 
 2.51.0
 

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-Revert-getty-Pass-tty-to-use-by-agetty-via-stdin.patch

@@ -1,7 +1,7 @@
-From 8064e1544a2b89f8389c0469ed4879a287a045a7 Mon Sep 17 00:00:00 2001
+From 306da1d06e84a721ac34fbc303b4629b2c1c7257 Mon Sep 17 00:00:00 2001
 From: Sayan Chowdhury <schowdhury@microsoft.com>
 Date: Fri, 16 Dec 2022 16:28:26 +0530
-Subject: [PATCH 5/8] Revert "getty: Pass tty to use by agetty via stdin"
+Subject: [PATCH] Revert "getty: Pass tty to use by agetty via stdin"
 
 This reverts commit b4bf9007cbee7dc0b1356897344ae2a7890df84c.
 
@@ -17,15 +17,15 @@ Signed-off-by: Sayan Chowdhury <schowdhury@microsoft.com>
  4 files changed, 4 insertions(+), 12 deletions(-)
 
 diff --git a/units/console-getty.service.in b/units/console-getty.service.in
-index 33e6368db1..1f2d8b910f 100644
+index 967d8337ab..cde822afc8 100644
 --- a/units/console-getty.service.in
 +++ b/units/console-getty.service.in
-@@ -22,12 +22,10 @@ ConditionPathExists=/dev/console
+@@ -20,12 +20,10 @@ Before=getty.target
+ ConditionPathExists=/dev/console
+ 
  [Service]
- # The '-o' option value tells agetty to replace 'login' arguments with '--' for
- # safety, and then the entered username.
--ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear --keep-baud 115200,57600,38400,9600 - ${TERM}
-+ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear --keep-baud 115200,57600,38400,9600 console ${TERM}
+-ExecStart=-/sbin/agetty --noreset --noclear --issue-file=/etc/issue:/etc/issue.d:/run/issue.d:/usr/lib/issue.d --keep-baud 115200,57600,38400,9600 - ${TERM}
++ExecStart=-/sbin/agetty --noreset --noclear --issue-file=/etc/issue:/etc/issue.d:/run/issue.d:/usr/lib/issue.d --keep-baud 115200,57600,38400,9600 console ${TERM}
  Type=idle
  Restart=always
  UtmpIdentifier=cons
@@ -35,15 +35,15 @@ index 33e6368db1..1f2d8b910f 100644
  TTYReset=yes
  TTYVHangup=yes
 diff --git a/units/container-getty@.service.in b/units/container-getty@.service.in
-index 7573532d6d..5f27653d1f 100644
+index e0b27613df..2868d56ad0 100644
 --- a/units/container-getty@.service.in
 +++ b/units/container-getty@.service.in
-@@ -27,13 +27,11 @@ Before=rescue.service
+@@ -25,13 +25,11 @@ Conflicts=rescue.service
+ Before=rescue.service
+ 
  [Service]
- # The '-o' option value tells agetty to replace 'login' arguments with '--' for
- # safety, and then the entered username.
--ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear - ${TERM}
-+ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear pts/%I ${TERM}
+-ExecStart=-/sbin/agetty --noreset --noclear --issue-file=/etc/issue:/etc/issue.d:/run/issue.d:/usr/lib/issue.d - ${TERM}
++ExecStart=-/sbin/agetty --noreset --noclear --issue-file=/etc/issue:/etc/issue.d:/run/issue.d:/usr/lib/issue.d pts/%I ${TERM}
  Type=idle
  Restart=always
  RestartSec=0
@@ -54,15 +54,15 @@ index 7573532d6d..5f27653d1f 100644
  TTYReset=yes
  TTYVHangup=yes
 diff --git a/units/getty@.service.in b/units/getty@.service.in
-index f30bba406d..1819627d1c 100644
+index 104c4acc96..bedf0aae54 100644
 --- a/units/getty@.service.in
 +++ b/units/getty@.service.in
-@@ -36,13 +36,11 @@ ConditionPathExists=/dev/tty0
+@@ -34,13 +34,11 @@ Before=rescue.service
+ ConditionPathExists=/dev/tty0
+ 
  [Service]
- # The '-o' option value tells agetty to replace 'login' arguments with '--' for
- # safety, and then the entered username.
--ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear - ${TERM}
-+ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear %I ${TERM}
+-ExecStart=-/sbin/agetty --noreset --noclear --issue-file=/etc/issue:/etc/issue.d:/run/issue.d:/usr/lib/issue.d - ${TERM}
++ExecStart=-/sbin/agetty --noreset --noclear --issue-file=/etc/issue:/etc/issue.d:/run/issue.d:/usr/lib/issue.d %I ${TERM}
  Type=idle
  Restart=always
  RestartSec=0
@@ -73,15 +73,15 @@ index f30bba406d..1819627d1c 100644
  TTYReset=yes
  TTYVHangup=yes
 diff --git a/units/serial-getty@.service.in b/units/serial-getty@.service.in
-index 20a5eb2754..ba4cbc0edb 100644
+index 0134c83d48..7e5c8797ca 100644
 --- a/units/serial-getty@.service.in
 +++ b/units/serial-getty@.service.in
-@@ -32,12 +32,10 @@ Before=rescue.service
+@@ -30,12 +30,10 @@ Conflicts=rescue.service
+ Before=rescue.service
+ 
  [Service]
- # The '-o' option value tells agetty to replace 'login' arguments with '--' for
- # safety, and then the entered username.
--ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear --keep-baud 115200,57600,38400,9600 - ${TERM}
-+ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear --keep-baud 115200,57600,38400,9600 %I ${TERM}
+-ExecStart=-/sbin/agetty --noreset --noclear --issue-file=/etc/issue:/etc/issue.d:/run/issue.d:/usr/lib/issue.d --keep-baud 115200,57600,38400,9600 - ${TERM}
++ExecStart=-/sbin/agetty --noreset --noclear --issue-file=/etc/issue:/etc/issue.d:/run/issue.d:/usr/lib/issue.d --keep-baud 115200,57600,38400,9600 %I ${TERM}
  Type=idle
  Restart=always
  UtmpIdentifier=%I

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0008-units-Make-multi-user.target-the-default-target.patch

@@ -1,35 +1,38 @@
-From f0ab1c6c59056afe1650f749d1af6ecc6ee8f5ec Mon Sep 17 00:00:00 2001
+From 3c13363e4b3f2e5bcc762a71460d84b93452f53f Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
 Date: Fri, 24 Oct 2025 11:06:57 +0200
-Subject: [PATCH 8/8] units: Make multi-user.target the default target
+Subject: [PATCH] units: Make multi-user.target the default target
 
 Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
+Signed-off-by: Kai Lueke <kailuke@microsoft.com>
 ---
- units/meson.build | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
+ units/meson.build | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/units/meson.build b/units/meson.build
-index ef18dcae4a..887231840f 100644
+index 4f47a3b2bd..9663e21e0c 100644
 --- a/units/meson.build
 +++ b/units/meson.build
-@@ -46,7 +46,7 @@ units = [
+@@ -48,8 +48,7 @@ units = [
+           'symlinks' : ['autovt@.service'],
          },
          {
-           'file' : 'graphical.target',
--          'symlinks' : ['default.target'] + (with_runlevels ? ['runlevel5.target'] : []),
-+          'symlinks' : with_runlevels ? ['runlevel5.target'] : [],
+-          'file' : 'graphical.target',
+-          'symlinks' : ['default.target'],
++          'file' : 'graphical.target'
          },
          { 'file' : 'halt.target' },
          {
-@@ -140,7 +140,7 @@ units = [
-         { 'file' : 'modprobe@.service' },
-         {
-           'file' : 'multi-user.target',
--          'symlinks' : with_runlevels ? ['runlevel2.target', 'runlevel3.target', 'runlevel4.target'] : [],
-+          'symlinks' : ['default.target'] + (with_runlevels ? ['runlevel2.target', 'runlevel3.target', 'runlevel4.target'] : []),
+@@ -142,7 +141,9 @@ units = [
+           'conditions' : ['ENABLE_MACHINED'],
          },
+         { 'file' : 'modprobe@.service' },
+-        { 'file' : 'multi-user.target' },
++        { 'file' : 'multi-user.target' ,
++          'symlinks' : ['default.target']
++        },
          { 'file' : 'network-online.target' },
          { 'file' : 'network-pre.target' },
+         { 'file' : 'network.target' },
 -- 
 2.51.0
-

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -103,3 +103,6 @@ sys-apps/azure-vm-utils
 
 =app-containers/containerd-2.1* ~amd64 ~arm64
 =app-containers/runc-1.3* ~amd64 ~arm64
+
+# Use new systemd
+=sys-apps/systemd-258.2 ~amd64 ~arm64

sdk_container/src/third_party/portage-stable/sys-apps/systemd/Manifest

@@ -1,2 +1,4 @@
+DIST systemd-257.10.tar.gz 16425661 BLAKE2B c8fef145933810110f5470f64dd41213864cc1cae889fb306c817d7a16cc300adbcab27e3a3be91428f0a7d354041f7f9ca431f7745bce9c7cc1e3bb065be84a SHA512 49a2c8cc1cd91363d90165a1145dcc417d524afd428917dad332e4b057ed9fc3ddb5b4beafab094b02a85d930c8aef9b63c8c9c1bc76ef3bdf0ce38a7d46466f
 DIST systemd-257.9.tar.gz 16401765 BLAKE2B c3ad528d37b89de8f82548807e950b59aab43f875a533ad983169eb539594e5e8230b6b562caee5297dcec4572e27df0e53ebee04f79e85f429f47862031592e SHA512 23b3d2764e0f990d8373068ccb41177793413bc193f7bd34e38b03d6fc3cd32d07c86e9dcbf07e32904075bb5eeca208f65beab04d628ac0e0b81ba87a975c1b
-DIST systemd-258.tar.gz 16976853 BLAKE2B c63bc09bff11ba4cf6e87bef689250a6b354bf8f5bfb5af6d2a173fa1e1838aa457a8a7db66f7aad20dae25b7a0defddcb052d53f18a688a2dd6d5f323d4692a SHA512 c488354da1c170ad02e10926f561d1985c3c3393fec878562f295ef764fdf3a1b2877c3b2549253f19bf23e357be6e443a50b937f60f4677f286d3402d611b85
+DIST systemd-258.2.tar.gz 16989522 BLAKE2B 55c8a134d2c80241ed654fab6bf2df0a2139313dbbb905f3abf07c9f86940ff03c8787fe7c4604c34bbb84088c15cd73ae5e013929b290b92808b5473550235e SHA512 1dc016a5a037aec2682e08d2add0dcf8d03db15b45ce8c6b677898f734aefd4694ce18e588d579e42514071fc4c167b2bf53808478b2bd3856b257c9fbcde45d
+DIST systemd-259-rc2.tar.gz 17219778 BLAKE2B 23e68a743d48e94d216ce31a4f758841280c603d2e44de1c180e8a1013fd740aae06d4e37b8e2351dfec0bf9bc504699b701b9645e66116f310f176c672ae071 SHA512 667fe1deff5020f751f3721472f2b3a1dfc32e3d10a78b5efd1673b7a42b3d445ab504687e6cd2f42dc5cbfc5c42ba3a435939ec5957c9e73833486112f9bd91

sdk_container/src/third_party/portage-stable/sys-apps/systemd/files/gentoo-journald-audit-r3.patch

@@ -0,0 +1,51 @@
+From 0f16422e52ef793407d1cbef0c38eff29d6e251c Mon Sep 17 00:00:00 2001
+From: Mike Gilbert <floppym@gentoo.org>
+Date: Wed, 17 Sep 2025 15:40:57 -0400
+Subject: [PATCH] journald: do not change the kernel audit setting by default
+
+Bug: https://bugs.gentoo.org/736910
+---
+ man/journald.conf.xml         | 2 +-
+ src/journal/journald-config.c | 2 +-
+ src/journal/journald.conf     | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/man/journald.conf.xml b/man/journald.conf.xml
+index 1d615b110d..4676d674a2 100644
+--- a/man/journald.conf.xml
++++ b/man/journald.conf.xml
+@@ -483,7 +483,7 @@
+         turn it off. When <literal>keep</literal> it will neither enable nor disable it, leaving the previous
+         state unchanged. This means if another tool turns on auditing even if
+         <command>systemd-journald</command> left it off, it will still collect the generated messages.
+-        Defaults to yes in the default journal namespace, and <literal>keep</literal> otherwise.</para>
++        Defaults to <literal>keep</literal>.</para>
+ 
+         <!-- Explicit assignment of an empty string is equivalent to 'keep', for backward compatibility. -->
+ 
+diff --git a/src/journal/journald-config.c b/src/journal/journald-config.c
+index 8cffec880b..ea3bb34a76 100644
+--- a/src/journal/journald-config.c
++++ b/src/journal/journald-config.c
+@@ -123,7 +123,7 @@ void manager_merge_configs(Manager *m) {
+         MERGE_NON_NEGATIVE(read_kmsg, !m->namespace);
+         /* By default, kernel auditing is enabled by the main namespace instance, and not controlled by
+          * non-default namespace instances. */
+-        MERGE_NON_NEGATIVE(set_audit, m->namespace ? AUDIT_KEEP : AUDIT_YES);
++        MERGE_NON_NEGATIVE(set_audit, AUDIT_KEEP);
+         MERGE_NON_ZERO(sync_interval_usec, DEFAULT_SYNC_INTERVAL_USEC);
+ 
+         /* TODO: also merge them when comdline or credentials support to configure them. */
+diff --git a/src/journal/journald.conf b/src/journal/journald.conf
+index 9a12ca7657..3be3ed7327 100644
+--- a/src/journal/journald.conf
++++ b/src/journal/journald.conf
+@@ -47,4 +47,4 @@
+ #MaxLevelSocket=debug
+ #LineMax=48K
+ #ReadKMsg=yes
+-#Audit=yes
++#Audit=keep
+-- 
+2.51.0
+