libre/systemd: update to 233

15 files changed, 248 insertions, 283 deletions

diff --git a/libre/systemd/0001-FSDG-man-Refer-to-the-operating-system-as-GNU-Linux.patch b/libre/systemd/0001-FSDG-man-Refer-to-the-operating-system-as-GNU-Linux.patch
index e91d0afd8..5ee14d118 100644
--- a/libre/systemd/0001-FSDG-man-Refer-to-the-operating-system-as-GNU-Linux.patch
+++ b/libre/systemd/0001-FSDG-man-Refer-to-the-operating-system-as-GNU-Linux.patch
@@ -1,7 +1,7 @@
-From 64713f35b5a75b441ab300813ff5a48b0bffed92 Mon Sep 17 00:00:00 2001
-From: Luke Shumaker <lukeshu@sbcglobal.net>
+From d817ea1a39a1e5ae78d776708585878dc39f6ec6 Mon Sep 17 00:00:00 2001
+From: Luke Shumaker <lukeshu@parabola.nu>
 Date: Wed, 25 May 2016 12:19:20 -0400
-Subject: [PATCH 1/6] FSDG: man/: Refer to the operating system as GNU/Linux.
+Subject: [PATCH 1/7] FSDG: man/: Refer to the operating system as GNU/Linux
 
 This is not a blind replacement of "Linux" with "GNU/Linux".  In some
 cases, "Linux" is (correctly) used to refer to just the kernel.  In others,
@@ -15,7 +15,7 @@ are not included in this commit.
  4 files changed, 5 insertions(+), 5 deletions(-)
 
 diff --git a/man/daemon.xml b/man/daemon.xml
-index b6125cb..f74fd35 100644
+index 485c66225..a64974968 100644
 --- a/man/daemon.xml
 +++ b/man/daemon.xml
 @@ -168,7 +168,7 @@
@@ -27,7 +27,7 @@ index b6125cb..f74fd35 100644
        new-style daemons. This makes it easier to supervise and control
        them at runtime and simplifies their implementation.</para>
  
-@@ -311,7 +311,7 @@
+@@ -309,7 +309,7 @@
        as detailed in the <ulink
        url="http://refspecs.linuxbase.org/LSB_3.1.1/LSB-Core-generic/LSB-Core-generic/iniscrptact.html">LSB
        Linux Standard Base Core Specification</ulink>. This method of
@@ -37,7 +37,7 @@ index b6125cb..f74fd35 100644
        scripts have the disadvantage of involving shell scripts in the
        boot process. New-style init systems generally employ updated
 diff --git a/man/sd-bus-errors.xml b/man/sd-bus-errors.xml
-index 055af7a..d2b81f4 100644
+index 055af7a68..d2b81f4e4 100644
 --- a/man/sd-bus-errors.xml
 +++ b/man/sd-bus-errors.xml
 @@ -126,7 +126,7 @@
@@ -50,7 +50,7 @@ index 055af7a..d2b81f4 100644
      to D-Bus errors and back. For example, the error
      <constant>EUCLEAN</constant> is mapped to
 diff --git a/man/sd_bus_error_add_map.xml b/man/sd_bus_error_add_map.xml
-index 139bd77..7dc1ef6 100644
+index a1eda21ed..55402dfc2 100644
 --- a/man/sd_bus_error_add_map.xml
 +++ b/man/sd_bus_error_add_map.xml
 @@ -82,7 +82,7 @@
@@ -63,10 +63,10 @@ index 139bd77..7dc1ef6 100644
      <citerefentry><refentrytitle>sd_bus_error_set</refentrytitle><manvolnum>3</manvolnum></citerefentry>
      or
 diff --git a/man/systemd.xml b/man/systemd.xml
-index b8d91b8..e05a9d6 100644
+index e8178ca4b..ea7dad1ae 100644
 --- a/man/systemd.xml
 +++ b/man/systemd.xml
-@@ -61,7 +61,7 @@
+@@ -64,7 +64,7 @@
    <refsect1>
      <title>Description</title>
  
@@ -76,5 +76,5 @@ index b8d91b8..e05a9d6 100644
      init system that brings up and maintains userspace
      services.</para>
 -- 
-2.8.3
+2.13.2
 
diff --git a/libre/systemd/0001-Revert-nspawn-try-to-bind-mount-resolved-s-resolv.co.patch b/libre/systemd/0001-Revert-nspawn-try-to-bind-mount-resolved-s-resolv.co.patch
deleted file mode 100644
index 5d47d01a4..000000000
--- a/libre/systemd/0001-Revert-nspawn-try-to-bind-mount-resolved-s-resolv.co.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 481712d9ee88395042f0640f272c1f87142bc0a8 Mon Sep 17 00:00:00 2001
-From: Dave Reisner <dreisner@archlinux.org>
-Date: Wed, 9 Nov 2016 11:14:03 -0500
-Subject: [PATCH] Revert "nspawn: try to bind mount resolved's resolv.conf
- snippet into the container"
-
-This reverts commit 3539724c26a1b2b00c4eb3c004b635a4b8647de6.
----
- src/nspawn/nspawn.c | 27 ++++++++-------------------
- 1 file changed, 8 insertions(+), 19 deletions(-)
-
-diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index c8b18bc..93df7c6 100644
---- a/src/nspawn/nspawn.c
-+++ b/src/nspawn/nspawn.c
-@@ -1309,35 +1309,24 @@ static int setup_resolv_conf(const char *dest) {
-         /* Fix resolv.conf, if possible */
-         where = prefix_roota(dest, "/etc/resolv.conf");
- 
--        if (access("/usr/lib/systemd/resolv.conf", F_OK) >= 0) {
--                /* resolved is enabled on the host. In this, case bind mount its static resolv.conf file into the
--                 * container, so that the container can use the host's resolver. Given that network namespacing is
--                 * disabled it's only natural of the container also uses the host's resolver. It also has the big
--                 * advantage that the container will be able to follow the host's DNS server configuration changes
--                 * transparently. */
--
--                r = mount_verbose(LOG_WARNING, "/usr/lib/systemd/resolv.conf", where, NULL, MS_BIND, NULL);
--                if (r >= 0)
--                        return mount_verbose(LOG_ERR, NULL, where, NULL,
--                                             MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
--        }
--
--        /* If that didn't work, let's copy the file */
-         r = copy_file("/etc/resolv.conf", where, O_TRUNC|O_NOFOLLOW, 0644, 0);
-         if (r < 0) {
--                /* If the file already exists as symlink, let's suppress the warning, under the assumption that
--                 * resolved or something similar runs inside and the symlink points there.
-+                /* If the file already exists as symlink, let's
-+                 * suppress the warning, under the assumption that
-+                 * resolved or something similar runs inside and the
-+                 * symlink points there.
-                  *
--                 * If the disk image is read-only, there's also no point in complaining.
-+                 * If the disk image is read-only, there's also no
-+                 * point in complaining.
-                  */
-                 log_full_errno(IN_SET(r, -ELOOP, -EROFS) ? LOG_DEBUG : LOG_WARNING, r,
--                               "Failed to copy /etc/resolv.conf to %s, ignoring: %m", where);
-+                               "Failed to copy /etc/resolv.conf to %s: %m", where);
-                 return 0;
-         }
- 
-         r = userns_lchown(where, 0, 0);
-         if (r < 0)
--                log_warning_errno(r, "Failed to chown /etc/resolv.conf, ignoring: %m");
-+                log_warning_errno(r, "Failed to chown /etc/resolv.conf: %m");
- 
-         return 0;
- }
--- 
-2.10.2
-
diff --git a/libre/systemd/0001-disable-RestrictAddressFamilies-on-i686.patch b/libre/systemd/0001-disable-RestrictAddressFamilies-on-i686.patch
deleted file mode 100644
index 27e6f4fb0..000000000
--- a/libre/systemd/0001-disable-RestrictAddressFamilies-on-i686.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From ff59e06f9423af0532aaeedf931474823f764875 Mon Sep 17 00:00:00 2001
-From: Dave Reisner <dreisner@archlinux.org>
-Date: Wed, 9 Nov 2016 08:00:26 -0500
-Subject: [PATCH] disable RestrictAddressFamilies on i686
-
-Shit's broke, yo.
-
-https://github.com/systemd/systemd/issues/4575
----
- src/core/execute.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/src/core/execute.c b/src/core/execute.c
-index f666f7c..7d09154 100644
---- a/src/core/execute.c
-+++ b/src/core/execute.c
-@@ -1254,6 +1254,10 @@ static int apply_address_families(const Unit* u, const ExecContext *c) {
-         Iterator i;
-         int r;
- 
-+#if defined(__i386__)
-+        return 0;
-+#endif
-+
-         assert(c);
- 
-         if (skip_seccomp_unavailable(u, "RestrictAddressFamilies="))
--- 
-2.10.2
-
diff --git a/libre/systemd/0001-nspawn-don-t-hide-bind-tmp-mounts.patch b/libre/systemd/0001-nspawn-don-t-hide-bind-tmp-mounts.patch
deleted file mode 100644
index a5336ece5..000000000
--- a/libre/systemd/0001-nspawn-don-t-hide-bind-tmp-mounts.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 7ec42a45410cb27140292d85ebb0e4b6dcea5555 Mon Sep 17 00:00:00 2001
-From: Dave Reisner <dreisner@archlinux.org>
-Date: Wed, 7 Dec 2016 13:45:48 -0500
-Subject: [PATCH] nspawn: don't hide --bind=/tmp/* mounts
-
-This is a v232-applicable version of upstream c9fd987279a462e.
----
- src/nspawn/nspawn-mount.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c
-index 115de64..2dabe2a 100644
---- a/src/nspawn/nspawn-mount.c
-+++ b/src/nspawn/nspawn-mount.c
-@@ -382,7 +382,7 @@ int mount_all(const char *dest,
-                 { "tmpfs",               "/dev",                "tmpfs", "mode=755",  MS_NOSUID|MS_STRICTATIME,                                  true,  false, false },
-                 { "tmpfs",               "/dev/shm",            "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,                         true,  false, false },
-                 { "tmpfs",               "/run",                "tmpfs", "mode=755",  MS_NOSUID|MS_NODEV|MS_STRICTATIME,                         true,  false, false },
--                { "tmpfs",               "/tmp",                "tmpfs", "mode=1777", MS_STRICTATIME,                                            true,  true,  false },
-+                { "tmpfs",               "/tmp",                "tmpfs", "mode=1777", MS_STRICTATIME,                                            true,  false,  false },
- #ifdef HAVE_SELINUX
-                 { "/sys/fs/selinux",     "/sys/fs/selinux",     NULL,     NULL,       MS_BIND,                                                   false, false, false },  /* Bind mount first */
-                 { NULL,                  "/sys/fs/selinux",     NULL,     NULL,       MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, false, false, false },  /* Then, make it r/o */
--- 
-2.10.2
-
diff --git a/libre/systemd/0002-FSDG-os-release-Default-to-PRETTY_NAME-GNU-Linux-ins.patch b/libre/systemd/0002-FSDG-os-release-Default-to-PRETTY_NAME-GNU-Linux-ins.patch
index 59ab5bee4..b9e94ee33 100644
--- a/libre/systemd/0002-FSDG-os-release-Default-to-PRETTY_NAME-GNU-Linux-ins.patch
+++ b/libre/systemd/0002-FSDG-os-release-Default-to-PRETTY_NAME-GNU-Linux-ins.patch
@@ -1,23 +1,23 @@
-From d6a67e5ff7d99af484a9ebf68d3fe2510bffd099 Mon Sep 17 00:00:00 2001
-From: Luke Shumaker <lukeshu@sbcglobal.net>
+From 10ccaa5d0fb340e61abc158238f939f4f7744396 Mon Sep 17 00:00:00 2001
+From: Luke Shumaker <lukeshu@parabola.nu>
 Date: Wed, 25 May 2016 12:23:40 -0400
-Subject: [PATCH 2/6] FSDG: os-release: Default to PRETTY_NAME "GNU/Linux"
- instead of "Linux".
+Subject: [PATCH 2/7] FSDG: os-release: Default to PRETTY_NAME "GNU/Linux"
+ instead of "Linux"
 
 ---
  man/kernel-install.xml                    | 2 +-
  man/os-release.xml                        | 2 +-
  src/analyze/analyze.c                     | 2 +-
- src/core/main.c                           | 4 +-
+ src/core/main.c                           | 4 ++--
  src/firstboot/firstboot.c                 | 2 +-
  src/kernel-install/90-loaderentry.install | 2 +-
  6 files changed, 7 insertions(+), 7 deletions(-)
 
 diff --git a/man/kernel-install.xml b/man/kernel-install.xml
-index d7e27de..eb51918 100644
+index 94b6b1110..2f42d49d9 100644
 --- a/man/kernel-install.xml
 +++ b/man/kernel-install.xml
-@@ -106,7 +106,7 @@
+@@ -110,7 +110,7 @@
            <replaceable>PRETTY_NAME</replaceable> parameter specified
            in <filename>/etc/os-release</filename> or
            <filename>/usr/lib/os-release</filename> (if the former is
@@ -27,10 +27,10 @@ index d7e27de..eb51918 100644
            the file <filename>initrd</filename> is found next to the
            <filename>linux</filename> file, the initrd will be added to
 diff --git a/man/os-release.xml b/man/os-release.xml
-index 4557abc..767a1c7 100644
+index 99bbb6100..27d18749d 100644
 --- a/man/os-release.xml
 +++ b/man/os-release.xml
-@@ -194,7 +194,7 @@
+@@ -210,7 +210,7 @@
          suitable for presentation to the user. May or may not contain
          a release code name or OS version of some kind, as suitable.
          If not set, defaults to
@@ -40,10 +40,10 @@ index 4557abc..767a1c7 100644
          Miracle)"</literal>.</para></listitem>
        </varlistentry>
 diff --git a/src/analyze/analyze.c b/src/analyze/analyze.c
-index d621f66..53c97f9 100644
+index ac0470b20..36b01500c 100644
 --- a/src/analyze/analyze.c
 +++ b/src/analyze/analyze.c
-@@ -653,7 +653,7 @@ static int analyze_plot(sd_bus *bus) {
+@@ -658,7 +658,7 @@ static int analyze_plot(sd_bus *bus) {
          svg("<rect class=\"background\" width=\"100%%\" height=\"100%%\" />\n");
          svg("<text x=\"20\" y=\"50\">%s</text>", pretty_times);
          svg("<text x=\"20\" y=\"30\">%s %s (%s %s %s) %s %s</text>",
@@ -53,10 +53,10 @@ index d621f66..53c97f9 100644
              strempty(host->kernel_name),
              strempty(host->kernel_release),
 diff --git a/src/core/main.c b/src/core/main.c
-index 93098da..b9cac92 100644
+index bcf9ea5f2..b66093827 100644
 --- a/src/core/main.c
 +++ b/src/core/main.c
-@@ -1238,11 +1238,11 @@ static int status_welcome(void) {
+@@ -1264,11 +1264,11 @@ static int status_welcome(void) {
                  return status_printf(NULL, false, false,
                                       "\nWelcome to \x1B[%sm%s\x1B[0m!\n",
                                       isempty(ansi_color) ? "1" : ansi_color,
@@ -71,10 +71,10 @@ index 93098da..b9cac92 100644
  
  static int write_container_id(void) {
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index 3df7246..1e1a592 100644
+index bc16290c7..f7574223a 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -96,7 +96,7 @@ static void print_welcome(void) {
+@@ -97,7 +97,7 @@ static void print_welcome(void) {
                  log_warning_errno(r, "Failed to read os-release file: %m");
  
          printf("\nWelcome to your new installation of %s!\nPlease configure a few basic system settings:\n\n",
@@ -84,10 +84,10 @@ index 3df7246..1e1a592 100644
          press_any_key();
  
 diff --git a/src/kernel-install/90-loaderentry.install b/src/kernel-install/90-loaderentry.install
-index 4c9b1f0..6e94e12 100644
+index a0bca05c9..af9f0f9cc 100644
 --- a/src/kernel-install/90-loaderentry.install
 +++ b/src/kernel-install/90-loaderentry.install
-@@ -37,7 +37,7 @@ elif [[ -f /usr/lib/os-release ]]; then
+@@ -38,7 +38,7 @@ elif [[ -f /usr/lib/os-release ]]; then
  fi
  
  if ! [[ $PRETTY_NAME ]]; then
@@ -97,5 +97,5 @@ index 4c9b1f0..6e94e12 100644
  
  declare -a BOOT_OPTIONS
 -- 
-2.8.3
+2.13.2
 
diff --git a/libre/systemd/0003-FSDG-os-release-Default-to-NAME-GNU-Linux-instead-of.patch b/libre/systemd/0003-FSDG-os-release-Default-to-NAME-GNU-Linux-instead-of.patch
index d6c40587d..40761d4ef 100644
--- a/libre/systemd/0003-FSDG-os-release-Default-to-NAME-GNU-Linux-instead-of.patch
+++ b/libre/systemd/0003-FSDG-os-release-Default-to-NAME-GNU-Linux-instead-of.patch
@@ -1,8 +1,8 @@
-From 20c90fb1a90a1702ce5e7d79dd16ee160640a1ee Mon Sep 17 00:00:00 2001
-From: Luke Shumaker <lukeshu@sbcglobal.net>
+From d13b518038bfcdeae9c58bce183751f835cb18d4 Mon Sep 17 00:00:00 2001
+From: Luke Shumaker <lukeshu@parabola.nu>
 Date: Wed, 25 May 2016 12:24:56 -0400
-Subject: [PATCH 3/6] FSDG: os-release: Default to NAME "GNU/Linux" instead of
- "Linux".
+Subject: [PATCH 3/7] FSDG: os-release: Default to NAME "GNU/Linux" instead of
+ "Linux"
 
 ---
  man/os-release.xml                    | 2 +-
@@ -10,7 +10,7 @@ Subject: [PATCH 3/6] FSDG: os-release: Default to NAME "GNU/Linux" instead of
  2 files changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/man/os-release.xml b/man/os-release.xml
-index 767a1c7..f6787f9 100644
+index 27d18749d..a88d16b17 100644
 --- a/man/os-release.xml
 +++ b/man/os-release.xml
 @@ -121,7 +121,7 @@
@@ -23,10 +23,10 @@ index 767a1c7..f6787f9 100644
          GNU/Linux"</literal>.</para></listitem>
        </varlistentry>
 diff --git a/src/journal-remote/journal-gatewayd.c b/src/journal-remote/journal-gatewayd.c
-index 60d8977..3b9adb5 100644
+index 9a1c5b76c..93e5f1ae7 100644
 --- a/src/journal-remote/journal-gatewayd.c
 +++ b/src/journal-remote/journal-gatewayd.c
-@@ -799,7 +799,7 @@ static int request_handler_machine(
+@@ -805,7 +805,7 @@ static int request_handler_machine(
                       SD_ID128_FORMAT_VAL(mid),
                       SD_ID128_FORMAT_VAL(bid),
                       hostname_cleanup(hostname),
@@ -36,5 +36,5 @@ index 60d8977..3b9adb5 100644
                       usage,
                       cutoff_from,
 -- 
-2.8.3
+2.13.2
 
diff --git a/libre/systemd/0004-FSDG-os-release-Default-ID-to-gnu-linux-instead-of-l.patch b/libre/systemd/0004-FSDG-os-release-Default-ID-to-gnu-linux-instead-of-l.patch
index 8a130ab78..aadcc8a80 100644
--- a/libre/systemd/0004-FSDG-os-release-Default-ID-to-gnu-linux-instead-of-l.patch
+++ b/libre/systemd/0004-FSDG-os-release-Default-ID-to-gnu-linux-instead-of-l.patch
@@ -1,8 +1,8 @@
-From 6f4e352372876053efb168e6dc9e74a57c8d6c2e Mon Sep 17 00:00:00 2001
-From: Luke Shumaker <lukeshu@sbcglobal.net>
+From 97ace109bae3bd426f8578b7c606004be8234758 Mon Sep 17 00:00:00 2001
+From: Luke Shumaker <lukeshu@parabola.nu>
 Date: Wed, 25 May 2016 12:28:30 -0400
-Subject: [PATCH 4/6] FSDG: os-release: Default ID to "gnu-linux" instead of
- "linux".
+Subject: [PATCH 4/7] FSDG: os-release: Default ID to "gnu-linux" instead of
+ "linux"
 
 As far as I can tell, no code in this repository actually uses the ID
 field, so this is just a man page change.
@@ -11,7 +11,7 @@ field, so this is just a man page change.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/man/os-release.xml b/man/os-release.xml
-index f6787f9..79eb402 100644
+index a88d16b17..caf60f41a 100644
 --- a/man/os-release.xml
 +++ b/man/os-release.xml
 @@ -145,7 +145,7 @@
@@ -24,5 +24,5 @@ index f6787f9..79eb402 100644
          <literal>ID=debian</literal>.</para></listitem>
        </varlistentry>
 -- 
-2.8.3
+2.13.2
 
diff --git a/libre/systemd/0005-FSDG-systemd-resolved-Default-to-hostname-gnu-linux-.patch b/libre/systemd/0005-FSDG-systemd-resolved-Default-to-hostname-gnu-linux-.patch
deleted file mode 100644
index f5e9de8fc..000000000
--- a/libre/systemd/0005-FSDG-systemd-resolved-Default-to-hostname-gnu-linux-.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 71b8c10050db1a16402e0600c9921b012c908b44 Mon Sep 17 00:00:00 2001
-From: Luke Shumaker <lukeshu@sbcglobal.net>
-Date: Wed, 25 May 2016 12:31:20 -0400
-Subject: [PATCH 5/6] FSDG: systemd-resolved: Default to hostname "gnu-linux"
- instead of "linux"
-
----
- src/resolve/resolved-manager.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/resolve/resolved-manager.c b/src/resolve/resolved-manager.c
-index 7f90734..e82c6ec 100644
---- a/src/resolve/resolved-manager.c
-+++ b/src/resolve/resolved-manager.c
-@@ -429,12 +429,12 @@ static int manager_watch_hostname(Manager *m) {
- 
-         r = determine_hostname(&m->llmnr_hostname, &m->mdns_hostname);
-         if (r < 0) {
--                log_info("Defaulting to hostname 'linux'.");
--                m->llmnr_hostname = strdup("linux");
-+                log_info("Defaulting to hostname 'gnu-linux'.");
-+                m->llmnr_hostname = strdup("gnu-linux");
-                 if (!m->llmnr_hostname)
-                         return log_oom();
- 
--                m->mdns_hostname = strdup("linux.local");
-+                m->mdns_hostname = strdup("gnu-linux.local");
-                 if (!m->mdns_hostname)
-                         return log_oom();
-         } else
--- 
-2.8.3
-
diff --git a/libre/systemd/0005-FSDG-systemd-resolved-Fallback-hostname-to-gnu-linux.patch b/libre/systemd/0005-FSDG-systemd-resolved-Fallback-hostname-to-gnu-linux.patch
new file mode 100644
index 000000000..475a368be
--- /dev/null
+++ b/libre/systemd/0005-FSDG-systemd-resolved-Fallback-hostname-to-gnu-linux.patch
@@ -0,0 +1,30 @@
+From b98fdc685b819dca6f6b3fd9ef49ff4b0ec645af Mon Sep 17 00:00:00 2001
+From: Luke Shumaker <lukeshu@parabola.nu>
+Date: Wed, 25 May 2016 12:31:20 -0400
+Subject: [PATCH 5/7] FSDG: systemd-resolved: Fallback hostname to "gnu-linux"
+ instead of "linux"
+
+---
+ src/resolve/resolved-manager.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/resolve/resolved-manager.c b/src/resolve/resolved-manager.c
+index 9db8b8f61..bcfe3d381 100644
+--- a/src/resolve/resolved-manager.c
++++ b/src/resolve/resolved-manager.c
+@@ -383,10 +383,10 @@ static int determine_hostname(char **full_hostname, char **llmnr_hostname, char
+ static const char *fallback_hostname(void) {
+ 
+         /* Determine the fall back hostname. For exposing this system to the outside world, we cannot have it to be
+-         * "localhost" even if that's the compiled in hostname. In this case, let's revert to "linux" instead. */
++         * "localhost" even if that's the compiled in hostname. In this case, let's revert to "gnu-linux" instead. */
+ 
+         if (is_localhost(FALLBACK_HOSTNAME))
+-                return "linux";
++                return "gnu-linux";
+ 
+         return FALLBACK_HOSTNAME;
+ }
+-- 
+2.13.2
+
diff --git a/libre/systemd/0006-FSDG-man-Use-FSDG-operating-systems-as-examples.patch b/libre/systemd/0006-FSDG-man-Use-FSDG-operating-systems-as-examples.patch
index 9a8ce15ea..145e45d4b 100644
--- a/libre/systemd/0006-FSDG-man-Use-FSDG-operating-systems-as-examples.patch
+++ b/libre/systemd/0006-FSDG-man-Use-FSDG-operating-systems-as-examples.patch
@@ -1,15 +1,15 @@
-From 566cac15ed36506e2bb766313a5d4e0825bc6499 Mon Sep 17 00:00:00 2001
-From: Luke Shumaker <lukeshu@sbcglobal.net>
+From 888c40a593c053c4af053fbe6ecd31c8c51f70c8 Mon Sep 17 00:00:00 2001
+From: Luke Shumaker <lukeshu@parabola.nu>
 Date: Wed, 25 May 2016 12:32:21 -0400
-Subject: [PATCH 6/6] FSDG: man/: Use FSDG operating systems as examples.
+Subject: [PATCH 6/7] FSDG: man/: Use FSDG operating systems as examples
 
 ---
  man/os-release.xml     | 49 +++++++++++++++++++++++++------------------------
- man/systemd-nspawn.xml | 37 +++++++++++++------------------------
- 2 files changed, 38 insertions(+), 48 deletions(-)
+ man/systemd-nspawn.xml | 34 ++++++++++++++++++----------------
+ 2 files changed, 43 insertions(+), 40 deletions(-)
 
 diff --git a/man/os-release.xml b/man/os-release.xml
-index caf60f4..2811f43 100644
+index caf60f41a..2811f434c 100644
 --- a/man/os-release.xml
 +++ b/man/os-release.xml
 @@ -122,7 +122,7 @@
@@ -131,29 +131,38 @@ index caf60f4..2811f43 100644
  
    <refsect1>
 diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
-index cd0a90d..ab35580 100644
+index ae7082776..ef80d90ba 100644
 --- a/man/systemd-nspawn.xml
 +++ b/man/systemd-nspawn.xml
-@@ -1004,46 +1004,35 @@
+@@ -1048,10 +1048,11 @@
+   <refsect1>
      <title>Examples</title>
  
++<!-- TODO: This example needs switched to an FSDG OS; but I'm not sure of a good machinectl-compatible image to use.
      <example>
--      <title>Download a Fedora image and start a shell in it</title>
-+      <title>Build and boot a minimal BLAG distribution in a container</title>
+       <title>Download a Fedora image and start a shell in it</title>
+ 
+-      <programlisting># machinectl pull-raw --verify=no \
++      <programlisting># machinectl pull-raw -&2D;verify=no \
+       https://download.fedoraproject.org/pub/fedora/linux/releases/25/CloudImages/x86_64/images/Fedora-Cloud-Base-25-1.3.x86_64.raw.xz
+ # systemd-nspawn -M Fedora-Cloud-Base-25-1.3.x86_64.raw</programlisting>
+ 
+@@ -1059,39 +1060,40 @@
+       <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+       and opens a shell in it.</para>
+     </example>
++-->
  
--      <programlisting># machinectl pull-raw --verify=no http://ftp.halifax.rwth-aachen.de/fedora/linux/releases/24/CloudImages/x86_64/images/Fedora-Cloud-Base-24-1.2.x86_64.raw.xz
--# systemd-nspawn -M Fedora-Cloud-Base-24-1.2.x86_64.raw</programlisting>
--
--      <para>This downloads an image using
--      <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
--      and opens a shell in it.</para>
--    </example>
--
--    <example>
+     <example>
 -      <title>Build and boot a minimal Fedora distribution in a container</title>
--
--      <programlisting># dnf -y --releasever=23 --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora --enablerepo=updates install systemd passwd dnf fedora-release vim-minimal
-+      <programlisting># dnf -y --releasever=210k --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=blag --enablerepo=updates install systemd passwd dnf blag-release vim-minimal
++      <title>Build and boot a minimal BLAG distribution in a container</title>
+ 
+-      <programlisting># dnf -y --releasever=25 --installroot=/srv/mycontainer \
+-      --disablerepo='*' --enablerepo=fedora --enablerepo=updates install \
+-      systemd passwd dnf fedora-release vim-minimal
++      <programlisting># dnf -y --releasever=210k --installroot=/srv/mycontainer \
++      --disablerepo='*' --enablerepo=blag --enablerepo=updates install \
++      systemd passwd dnf blag-release vim-minimal
  # systemd-nspawn -bD /srv/mycontainer</programlisting>
  
 -      <para>This installs a minimal Fedora distribution into the
@@ -195,5 +204,5 @@ index cd0a90d..ab35580 100644
      </example>
  
 -- 
-2.8.3
+2.13.2
 
diff --git a/libre/systemd/0007-FSDG-bootctl-Say-Systemd-Boot-Manager-instead-of-Lin.patch b/libre/systemd/0007-FSDG-bootctl-Say-Systemd-Boot-Manager-instead-of-Lin.patch
new file mode 100644
index 000000000..2ca860d87
--- /dev/null
+++ b/libre/systemd/0007-FSDG-bootctl-Say-Systemd-Boot-Manager-instead-of-Lin.patch
@@ -0,0 +1,33 @@
+From c2357a5265d49410d3aacef1ccacb9b0caf761a5 Mon Sep 17 00:00:00 2001
+From: Luke Shumaker <lukeshu@parabola.nu>
+Date: Sat, 17 Dec 2016 00:56:43 -0500
+Subject: [PATCH 7/7] FSDG: bootctl: Say "Systemd Boot Manager" instead of
+ "Linux Boot Manager"
+
+---
+ src/boot/bootctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/boot/bootctl.c b/src/boot/bootctl.c
+index 155bf278b..297dcb535 100644
+--- a/src/boot/bootctl.c
++++ b/src/boot/bootctl.c
+@@ -778,13 +778,13 @@ static int install_variables(const char *esp_path,
+                                        "Failed to determine current boot order: %m");
+ 
+         if (first || r == 0) {
+-                r = efi_add_boot_option(slot, "Linux Boot Manager",
++                r = efi_add_boot_option(slot, "Systemd Boot Manager",
+                                         part, pstart, psize,
+                                         uuid, path);
+                 if (r < 0)
+                         return log_error_errno(r, "Failed to create EFI Boot variable entry: %m");
+ 
+-                log_info("Created EFI boot entry \"Linux Boot Manager\".");
++                log_info("Created EFI boot entry \"Systemd Boot Manager\".");
+         }
+ 
+         return insert_into_order(slot, first);
+-- 
+2.13.2
+
diff --git a/libre/systemd/PKGBUILD b/libre/systemd/PKGBUILD
index d25f533ce..03b4355d0 100644
--- a/libre/systemd/PKGBUILD
+++ b/libre/systemd/PKGBUILD
@@ -3,20 +3,27 @@
 # Maintainer: Luke Shumaker <lukeshu@sbcglobal.net>
 
 pkgbase=systemd
-pkgname=('systemd' 'libsystemd' 'systemd-sysvcompat'
-         'libsystemd-standalone' 'libudev' 'nss-myhostname' 'nss-mymachines' 'nss-resolve')
-pkgver=232
-pkgrel=8.parabola2
-arch=('i686' 'x86_64' 'armv7h')
+pkgname=('systemd' 'libsystemd' 'systemd-sysvcompat')
+pkgname+=('libsystemd-standalone' 'libudev' 'nss-myhostname' 'nss-mymachines' 'nss-resolve')
+# latest commit on stable branch
+_commit='27c7bc970d9e7ffe060688a8dd77b7747503a564'
+# Bump this to latest major release for signed tag verification,
+# the commit count is handled by pkgver() function.
+pkgver=233.75
+pkgrel=3
+pkgrel+=.parabola1
+arch=('i686' 'x86_64')
+arch+=('armv7h')
 url="https://www.github.com/systemd/systemd"
-makedepends=('acl' 'cryptsetup' 'docbook-xsl' 'gperf>=3.1' 'lz4' 'xz' 'pam' 'libelf'
+makedepends=('acl' 'cryptsetup' 'docbook-xsl' 'gperf' 'lz4' 'xz' 'pam' 'libelf'
              'intltool' 'iptables' 'kmod' 'libcap' 'libidn' 'libgcrypt'
-             'libmicrohttpd' 'libxslt' 'util-linux' 'linux-libre-api-headers'
+             'libmicrohttpd' 'libxslt' 'util-linux' 'linux-api-headers'
              'python-lxml' 'quota-tools' 'shadow' 'git')
 makedepends_i686=('gnu-efi-libs')
 makedepends_x86_64=('gnu-efi-libs')
 options=('strip')
-source=("git://github.com/systemd/systemd.git#tag=v$pkgver"
+source=("git://github.com/systemd/systemd-stable.git#commit=${_commit}"
+        'git://github.com/systemd/systemd.git' # pull in for tags
         'initcpio-hook-udev'
         'initcpio-install-systemd'
         'initcpio-install-udev'
@@ -28,19 +35,18 @@ source=("git://github.com/systemd/systemd.git#tag=v$pkgver"
         'systemd-sysusers.hook'
         'systemd-tmpfiles.hook'
         'systemd-update.hook'
-        '0001-disable-RestrictAddressFamilies-on-i686.patch'
-        '0001-Revert-nspawn-try-to-bind-mount-resolved-s-resolv.co.patch'
-        '0001-nspawn-don-t-hide-bind-tmp-mounts.patch'
         '0001-FSDG-man-Refer-to-the-operating-system-as-GNU-Linux.patch'
         '0002-FSDG-os-release-Default-to-PRETTY_NAME-GNU-Linux-ins.patch'
         '0003-FSDG-os-release-Default-to-NAME-GNU-Linux-instead-of.patch'
         '0004-FSDG-os-release-Default-ID-to-gnu-linux-instead-of-l.patch'
-        '0005-FSDG-systemd-resolved-Default-to-hostname-gnu-linux-.patch'
-        '0006-FSDG-man-Use-FSDG-operating-systems-as-examples.patch')
+        '0005-FSDG-systemd-resolved-Fallback-hostname-to-gnu-linux.patch'
+        '0006-FSDG-man-Use-FSDG-operating-systems-as-examples.patch'
+        '0007-FSDG-bootctl-Say-Systemd-Boot-Manager-instead-of-Lin.patch')
 sha512sums=('SKIP'
+            'SKIP'
             'f0d933e8c6064ed830dec54049b0a01e27be87203208f6ae982f10fb4eddc7258cb2919d594cbfb9a33e74c3510cfd682f3416ba8e804387ab87d1a217eb4b73'
-            '52af734947a768758d5eb3f18e31a1cfec6699eca6fa10e40b90c7f11991509186c0a696e3490af3eaba80064ea4cb93e041579abf05addf072d294300aa4b28'
-            'fec639de0d99967ed3e67289eff5ff78fff0c5829d350e73bed536a8391f1daa1d118d72dbdc1f480ffd33fc22b72f4817d0973bd09ec7f182fd26ad87b24355'
+            '691acebb243b9cd7fb63272662f34bdb9aead710c69aee9361ab2322f9f108600ad5b0214fc00b7cb2d9c95db8abd748030625d60d6567efd98663c56ba28c65'
+            'a25b28af2e8c516c3a2eec4e64b8c7f70c21f974af4a955a4a9d45fd3e3ff0d2a98b4419fe425d47152d5acae77d64e69d8d014a7209524b75a81b0edb10bf3a'
             '70b3f1d6aaa9cd4b6b34055a587554770c34194100b17b2ef3aaf4f16f68da0865f6b3ae443b3252d395e80efabd412b763259ffb76c902b60e23b6b522e3cc8'
             '6c6f579644ea2ebb6b46ee274ab15110718b0de40def8c30173ba8480b045d403f2aedd15b50ad9b96453f4ad56920d1350ff76563755bb9a80b10fa7f64f1d9'
             'a50bc85061a9a16d776235099867bc1a17c17dddb74c1ecf5614c849735a9779c5e34e5ddca8ca6af4b59a40f57c08ecf219b98cab09476ddb0f110e6a35e45c'
@@ -49,32 +55,37 @@ sha512sums=('SKIP'
             '9d27d97f172a503f5b7044480a0b9ccc0c4ed5dbb2eb3b2b1aa929332c3bcfe38ef0c0310b6566f23b34f9c05b77035221164a7ab7677784c4a54664f12fca22'
             '0f4efddd25256e09c42b953caeee4b93eb49ecc6eaebf02e616b4dcbfdac9860c3d8a3d1a106325b2ebc4dbc6e08ac46702abcb67a06737227ccb052aaa2a067'
             '10190fba9f39a8f4b620a0829e0ba8ed63bb4dbeca712966011ee7807880d01ab2abff1a80baafeb6674db70526a473fe585db8190e864f318fc4d6068552618'
-            '89f9b2d3918c679ce4f76c2b10dc7fcb7e04f1925a5f92542f06891de2a123a91df7eb67fd4ce71506a8132f5440b3560b7bb667e1c1813944b115c1dfe35e3f'
-            'b993a42c5534582631f7b379d54f6abc37e3aaa56ecf869a6d86ff14ae5a52628f4e447b6a30751bc1c14c30cec63a5c6d0aa268362d235ed477b639cac3a219'
-            '68478403433aafc91a03fda5d83813d2ed1dfc6ab7416b2927a803314ecf826edcb6c659587e74df65de3ccb1edf958522f56ff9ac461a1f696b6dede1d4dd35'
-            '50888d94636427ca97bfa5355226163fb6458f2a60303967cf74a8fd085f3c450d276b7c556fea93da387c6bb6f5ecbdb6d9b2a571b6723f27a41c8fb612d27b'
-            'fc8b874279db428a342387147ef6a849c0621eb0326ad5c4eb12c2ceb98b46477ed1e07c076a8b0abae6b323d4d7f4c70d45998c3338fb89903f51b3f653458b'
-            'fd928f5d10a5f95bdbab7720b465cbea8b47cf1a376e1ba292c4759d3f1473c80bd4444729dc5b6f6d884e342db7d07a5dad093d345ccccf2c5fb22dfcdacbd8'
-            '723db0e4980727594c88d2fc92ffde10cf7c5cd05fbd88a31dadb813a3c839c3a92b3e5789f936de356b9f5e2d43d67e95fd02627be53ffa46b3d86dfabc4e5b'
-            '77161e2f57237ca589d576924ec0877f379047c6fd90ca47cb6686e4f22cc9e2171ae4306bd5a9fd8e707e297b826e0f7df52dcdcb04e99df7ebd0eb45ac89eb'
-            'caa5eb7e52b83549bc7d00e343bbb204334b49f2d14005ac1fb592c6f17c6c860edafd88abe619fe54cb0086725385c1f48fd437670a31a08abdac8485ed2073')
+            'e85c5564348253e1bc49d943f0456c38ebef0c50a5a7782ea6ebb1f45bd624a69430d79693fe1223b0adace9f07c167b84133a003a09a8b61ae48d1b70610277'
+            '0ad718e9441798a4479600ffce364c2f0e582fd0ccf7762dde90f99755dee4569bcee8299ea2ccbf3a010966c8d48c59fcd0b1f93c9b8a479332c2c128fc2b2a'
+            '03ec8cfde36a0a7413993118707e32b0d8b693d366da8cb22a6e71e1c10178d1df05b2e2d1d5a2a298d49af005f3cdf80bfd8d40959d3e53310491b6ada39fed'
+            '9c13df718d4db2592c50c348c7b6340bbd7dd6ee6951da0f2bbd9c1878e0f034b975dfa9b28081b57e76f91c49f0bbcce314d0baaf1c5916dcff11e98d426372'
+            'b45c4e40f626a02951a852ea4cd2304f00a172dc64b5c38a97f5c68e4a89ceb4f4164cc9221533c4a5c52662e0b9629a82c521514bfcc21f0c11ce517643c2c1'
+            'f5c4cbeecac8f9d8f009deb4ac1d0b797210bcd1a91fcc6bf8ec110320ad6ceb8fd2a28b184ca037d73078d09a22f224ad3fc46f4bbf972432cce23263b2e1dc'
+            'e276fd1aedd7718333324fa9d99493fe99d951f446e3b590a99e2cc9562a0bd0e29693907997cb52096c39168c5be62ded3feedf93bacd3c9659d58775b6ca8d')
 validpgpkeys=(
   '63CDA1E5D3FC22B998D20DD6327F26951A015CC4'  # Lennart Poettering
 )
 
 _backports=(
-  '843d5baf6aad6c53fc00ea8d95d83209a4f92de1'  # core: don't use the unified hierarchy for the systemd cgroup yet (#4628)
-  'abd67ce74858491565cde157c7b08fda43d3279c'  # basic/virt: fix userns check on CONFIG_USER_NS=n kernel (#4651)
-  '4318abe8d26e969ebdb97744a63ab900233a0185'  # build-sys: do not install ctrl-alt-del.target symlink twice
-  'd112eae7da77899be245ab52aa1747d4675549f1'  # device: Avoid calling unit_free(NULL) in device setup logic (#4748)
-  'cfed63f60dd7412c199652825ed172c319b02b3c'  # nspawn: fix exit code for --help and --version (#4609)
-  '3099caf2b5bb9498b1d0227c40926435ca81f26f'  # journal: make sure to initially populate the space info cache (#4807)
-  '3d4cf7de48a74726694abbaa09f9804b845ff3ba'  # build-sys: check for lz4 in the old and new numbering scheme (#4717)
-  'c9f7b4d356a453a01aa77a6bb74ca7ef49732c08'  # build-sys: add check for gperf lookup function signature (#5055)
+  # build-sys: make RPM macros installation path configurable
+  'ff2e33db54719bfe8feea833571652318c6d197c'
+  # resolved: do not start LLMNR or mDNS stack when no network enables them
+  '2c7ef56459bf6fe7761595585aa4eed5cd183f27^..2c7ef56459bf6fe7761595585aa4eed5cd183f27^2'
+  # networkd: RFC compliant autonomous prefix handling (#5636)
+  '6554550f35a7976f9110aff94743d3576d5f02dd'
+  # core: do not print color console message about gc-ed jobs
+  '047d7219fde661698d3487fc49e9878c61eefd77'
+)
+
+_reverts=(
+  # core: store the invocation ID in the per-service keyring
+  'b3415f5daef49642be3d5f417b8880c078420ff7'
+  # core: run each system service with a fresh session keyring
+  '74dd6b515fa968c5710b396a7664cac335e25ca8'
 )
 
 _validate_tag() {
-  local success fingerprint trusted status tag=v$pkgver
+  local success fingerprint trusted status tag=v${pkgver%.*}
 
   parse_gpg_statusfile /dev/stdin < <(git verify-tag --raw "$tag" 2>&1)
 
@@ -100,41 +111,54 @@ _validate_tag() {
   return 0
 }
 
-prepare() {
-  cd "$pkgbase"
+pkgver() {
+  local version count
 
-  _validate_tag || return
+  cd "$pkgbase-stable"
 
-  if (( ${#_backports[*]} > 0 )); then
-    git cherry-pick -n "${_backports[@]}"
-  fi
+  version="$(git describe --abbrev=0 --tags)"
+  count="$(git rev-list --count ${version}..)"
+  printf '%s.%s' "${version#v}" "${count}"
+}
 
-  # https://github.com/systemd/systemd/issues/4789
-  patch -Np1 <../0001-nspawn-don-t-hide-bind-tmp-mounts.patch
+prepare() {
+  cd "$pkgbase-stable"
+  
+  git remote add upstream ../systemd/
+  git fetch --all
 
-  # these patches aren't upstream, but they make v232 more useable.
+  _validate_tag || return
 
-  # https://github.com/systemd/systemd/issues/4575
-  patch -Np1 <../0001-disable-RestrictAddressFamilies-on-i686.patch
+  local _commit
+  for _commit in "${_backports[@]}"; do
+    git cherry-pick -n "$_commit"
+  done
+  for _commit in "${_reverts[@]}"; do
+    git revert -n "$_commit"
+  done
 
-  # https://github.com/systemd/systemd/issues/4595
-  # https://github.com/systemd/systemd/issues/3826
-  patch -Np1 <../0001-Revert-nspawn-try-to-bind-mount-resolved-s-resolv.co.patch
+  # nss-resolve: drop the internal fallback to libnss_dns
+  git show '5486a31d287f26bcd7c0a4eb2abfa4c074b985f1' -- \
+    'Makefile.am' 'src/nss-resolve/nss-resolve.c' | git apply --index
+  
+  # Resolved packet size (#6214) (FS#54619, CVE-2017-9445)
+  git show '751ca3f1de316ca79b60001334dbdf54077e1d01' \
+    'db848813bae4d28c524b3b6a7dad135e426659ce' \
+    '88795538726a5bbfd9efc13d441cb05e1d7fc139' \
+    '64a21fdaca7c93f1c30b21f6fdbd2261798b161a' \
+    -- . ':!src/resolve/meson.build'  | git apply --index
 
   # apply FSDG patches
-  local patchfile
-  for patchfile in "$srcdir"/????-FSDG-*.patch; do
-    patch -Np1 -i "$patchfile"
+  local _patch
+  for _patch in "$srcdir"/????-FSDG-*.patch; do
+    patch -Np1 -i "$_patch"
   done
 
-  # Rename "Linux Boot Manager" -> "Systemd Boot Manager"
-  sed -i 's|Linux Boot Manager|Systemd Boot Manager|' src/boot/bootctl.c
-
   ./autogen.sh
 }
 
 build() {
-  cd "$pkgbase"
+  cd "$pkgbase-stable"
 
   local timeservers=({0..3}.arch.pool.ntp.org)
 
@@ -159,6 +183,9 @@ build() {
     --with-default-dnssec=no
     --with-dbuspolicydir=/usr/share/dbus-1/system.d
     --without-kill-user-processes
+    --with-rpmmacrosdir=no
+    # TODO(dreisner): consider changing this to unified
+    --with-default-hierarchy=hybrid
   )
   if [ "$CARCH" != "armv7h" ]; then
     configure_options+=(--enable-gnuefi)
@@ -204,14 +231,13 @@ build() {
 package_systemd() {
   pkgdesc="system and service manager"
   license=('GPL2' 'LGPL2.1')
-  depends=('acl' 'bash' 'dbus' 'iptables' 'kbd' 'kmod' 'hwids' 'libcap'
+  depends=('acl' 'bash' 'cryptsetup' 'dbus' 'iptables' 'kbd' 'kmod' 'hwids' 'libcap'
            'libgcrypt' 'libsystemd' 'libidn' 'lz4' 'pam' 'libelf' 'libseccomp'
            'util-linux' 'xz')
   provides=("systemd-tools=$pkgver" "udev=$pkgver")
   replaces=('systemd-tools' 'udev')
   conflicts=('systemd-tools' 'udev')
-  optdepends=('cryptsetup: required for encrypted block devices'
-              'libmicrohttpd: remote journald capabilities'
+  optdepends=('libmicrohttpd: remote journald capabilities'
               'quota-tools: kernel-level quota management'
               'systemd-sysvcompat: symlink package to provide sysvinit binaries'
               'polkit: allow administration as unprivileged user')
@@ -233,12 +259,10 @@ package_systemd() {
   # don't write units to /etc by default. some of these will be re-enabled on
   # post_install.
   rm -r "$pkgdir/etc/systemd/system/"*.wants
-
-  # get rid of RPM macros
-  rm -r "$pkgdir/usr/lib/rpm"
+  rm -r "$pkgdir/etc/systemd/system/"*.service
 
   # add back tmpfiles.d/legacy.conf
-  install -m644 "$pkgbase/tmpfiles.d/legacy.conf" "$pkgdir/usr/lib/tmpfiles.d"
+  install -m644 "$pkgbase-stable/tmpfiles.d/legacy.conf" "$pkgdir/usr/lib/tmpfiles.d"
 
   # Replace dialout/tape/cdrom group in rules with uucp/storage/optical group
   sed -i 's#GROUP="dialout"#GROUP="uucp"#g;
@@ -257,12 +281,20 @@ package_systemd() {
   chown root:systemd-journal "$pkgdir/var/log/journal"
   chmod 2755 "$pkgdir/var/log/journal"
 
+  # match directory owner/group and mode from extra/polkit
+  chown root:102 "$pkgdir/usr/share/polkit-1/rules.d"
+  chmod 0750     "$pkgdir/usr/share/polkit-1/rules.d"
+
   # we'll create this on installation
   rmdir "$pkgdir/var/log/journal/remote"
 
   # ship default policy to leave services disabled
   echo 'disable *' >"$pkgdir"/usr/lib/systemd/system-preset/99-default.preset
 
+  # allow core/filesystem to pristine nsswitch.conf
+  rm "$pkgdir/usr/share/factory/etc/nsswitch.conf"
+  sed -i '/^C \/etc\/nsswitch\.conf/d' "$pkgdir/usr/lib/tmpfiles.d/etc.conf"
+
   # add example bootctl configuration
   install -Dm644 "$srcdir/parabola.conf" "$pkgdir"/usr/share/systemd/bootctl/parabola.conf
   install -Dm644 "$srcdir/loader.conf" "$pkgdir"/usr/share/systemd/bootctl/loader.conf
diff --git a/libre/systemd/initcpio-install-systemd b/libre/systemd/initcpio-install-systemd
index f6d0afdb8..e53376ab4 100644
--- a/libre/systemd/initcpio-install-systemd
+++ b/libre/systemd/initcpio-install-systemd
@@ -160,9 +160,11 @@ build() {
     add_symlink "/usr/lib/systemd/system/default.target" "initrd.target"
     add_symlink "/usr/lib/systemd/system/ctrl-alt-del.target" "reboot.target"
 
-    # udev wants /etc/group since it doesn't launch with --resolve-names=never
-    add_file "/etc/nsswitch.conf"
     add_binary "$(readlink -f /usr/lib/libnss_files.so)"
+    printf '%s\n' >"$BUILDROOT/etc/nsswitch.conf" \
+        'passwd: files' \
+        'group: files' \
+        'shadow: files'
 
     echo "root:x:0:0:root:/:/bin/sh" >"$BUILDROOT/etc/passwd"
     echo "root:x:0:root" >"$BUILDROOT/etc/group"
diff --git a/libre/systemd/initcpio-install-udev b/libre/systemd/initcpio-install-udev
index 7f0301a48..31d982712 100644
--- a/libre/systemd/initcpio-install-udev
+++ b/libre/systemd/initcpio-install-udev
@@ -19,9 +19,10 @@ build() {
 
 help() {
     cat <<HELPEOF
-This hook will use udev to create your root device node and detect the needed
-modules for your root device. It is also required for firmware loading in
-initramfs. It is recommended to use this hook.
+This hook adds the udev daemon to the initramfs, allowing for dynamic loading
+of modules and reliable detection of the root device via tags (e.g. UUID or
+LABEL). Do not remove this hook unless you are using the systemd hook, or you
+know what you're doing.
 HELPEOF
 }
 
diff --git a/libre/systemd/systemd.install b/libre/systemd/systemd.install
index f799c882d..fedc747ea 100644
--- a/libre/systemd/systemd.install
+++ b/libre/systemd/systemd.install
@@ -45,6 +45,14 @@ _232_8_changes() {
   fi
 }
 
+_233_75_3_changes() {
+  # upstream installs services to /etc, which we remove
+  # to keep bus activation we re-enable systemd-resolved
+  if systemctl is-enabled -q systemd-resolved.service; then
+    systemctl reenable systemd-resolved.service 2>/dev/null
+  fi
+}
+
 post_install() {
   systemd-machine-id-setup
 
@@ -78,11 +86,12 @@ post_upgrade() {
     219-4
     230-1
     232-8
+    233.75-3
   )
 
   for v in "${upgrades[@]}"; do
     if [[ $(vercmp "$v" "$2") -eq 1 ]]; then
-      "_${v//-/_}_changes"
+      "_${v//[.-]/_}_changes"
     fi
   done
 }