SYSUPDATE.D(5) sysupdate.d SYSUPDATE.D(5) sysupdate.d - /etc/sysupdate.d/*.transfer /run/sysupdate.d/*.transfer /usr/local/lib/sysupdate.d/*.transfer /usr/lib/sysupdate.d/*.transfer . : HTTP/HTTPS . -- . systemd-sysupdate(8) . HTTP/HTTPS A/B ( A/B/C A/B/C/D ...). *.transfer . ( ) Verity . . systemd-sysupdate(8) . " ": sysupdate.features(5). *.transfer : [Transfer] [Source] [Target]. Verity . ( EFI). "foobarOS" 47 : 1. "https://download.example.com/foobarOS_47.root.xz" UUID GPT 4f68bce3-e8cd-4db1-96e7-fbcaf984b709 x86-64 UAPI.2[1]. 2. "https://download.example.com/foobarOS_47.verity.xz" UUID GPT 2c7357ed-ebd2-46d9-aec1-23d437ec2bf5 ( Verity x86-64). 3. "https://download.example.com/foobarOS_47.efi" ( UAPI.1[2] #2) $BOOT EFI/Linux/foobarOS_47.efi ESP XBOOTLDR. ( "@v" ): 1. "https://download.example.com/foobarOS_@v.root.xz" <- GPT 4f68bce3-e8cd-4db1-96e7-fbcaf984b709 "foobarOS_@v". 2. "https://download.example.com/foobarOS_@v.verity.xz" <- GPT 2c7357ed-ebd2-46d9-aec1-23d437ec2bf5 "foobarOS_@v_verity". 3. "https://download.example.com/foobarOS_@v.efi" <- $BOOT/EFI/Linux/foobarOS_@v.efi. URL "@v". *.transfer sysupdate.d/ . *.transfer ( ). URL . : o : GPT UUID ( ). o : . o HTTP/HTTPS : SHA256SUMS sha256sum(1) SHA256 . .transfer . // . // MatchPattern= .transfer. . . . EFI . . . : 1. "url-file" URL HTTP HTTPS. . . SHA256SUMS SHA256SUMS.gpg. 2. "url-tar" .tar. btrfs. . "url-file" "url-tar" SHA256SUMS SHA256SUMS.gpg. 3. "regular-file" . . . . 4. "partition" "regular-file" GPT . GPT . GPT "_empty" . GPT . . 5. "tar" .tar . btrfs. "tar" "url-tar" . "tar" . 6. "directory" . . . 7. "subvolume" "directory" btrfs ( btrfs). : 1. +-------------------+-----------------------+-----------------------------+-----------------------------+-----------------------------+--------------------------+-----------------------------+-----------------------------+ | | | | | | | | | | | | | | | | | | | | | | : | : | : | | : | | | | | | + | | | | | | | | | | | | | +-------------------+-----------------------+-----------------------------+-----------------------------+-----------------------------+--------------------------+-----------------------------+-----------------------------+ |url-file | | | regular-file, partition | | | no | - | | | HTTP/HTTPS | | | | | | | +-------------------+-----------------------+-----------------------------+-----------------------------+-----------------------------+--------------------------+-----------------------------+-----------------------------+ |url-tar | | | directory, subvolume | | | no | - | | | .tar | | | | | | | | | HTTP/HTTPS | | | | | | | +-------------------+-----------------------+-----------------------------+-----------------------------+-----------------------------+--------------------------+-----------------------------+-----------------------------+ |regular-file | | | regular-file, partition | no | | | url-file, regular-file | | | | | | | | | | +-------------------+-----------------------+-----------------------------+-----------------------------+-----------------------------+--------------------------+-----------------------------+-----------------------------+ |partition | GPT | no | - | - | - | | url-file, regular-file | | | | | | | | | | +-------------------+-----------------------+-----------------------------+-----------------------------+-----------------------------+--------------------------+-----------------------------+-----------------------------+ |tar | | | directory, subvolume | no | | no | - | | | .tar | | | | | | | +-------------------+-----------------------+-----------------------------+-----------------------------+-----------------------------+--------------------------+-----------------------------+-----------------------------+ |directory | | | directory, subvolume | no | no | | url-tar, tar, directory, | | | | | | | | | subvolume | +-------------------+-----------------------+-----------------------------+-----------------------------+-----------------------------+--------------------------+-----------------------------+-----------------------------+ |subvolume | | | directory, subvolume | no | no | | url-tar, tar, directory, | | | btrfs | | | | | | subvolume | | | | | | | | | | +-------------------+-----------------------+-----------------------------+-----------------------------+-----------------------------+--------------------------+-----------------------------+-----------------------------+ SHA256SUMS url-file url-tar GNU sha256sum(1). --binary . ASCII ( ). SHA256SUMS BEST-BEFORE-YYYY-MM-DD ( ) . "" freshness . . . . ( ) MatchPattern= [Source] [Target]. . : 2. +-------------------+-----------------------------+--------------------------+------------------------------------+ | | | Format | | | | | | | +-------------------+-----------------------------+--------------------------+------------------------------------+ |"@v" | | | | | | | | | | | | | | +-------------------+-----------------------------+--------------------------+------------------------------------+ |"@u" | UUID | UUID | | | | GPT | | | | | | 128 | | | | | | | | | | | partition | +-------------------+-----------------------------+--------------------------+------------------------------------+ |"@f" | | | | | | GPT | | | | | | | | | | | | | | | | | partition | +-------------------+-----------------------------+--------------------------+------------------------------------+ |"@a" | GPT | "0" "1" | | | | NoAuto | | NoAuto | | | | | | | | | | GPT | | | | | | | | | | | | | | | | | | | | | | | | | UAPI.2[1] | | | | | | | | | | | | | | | | | | | | | | | | | partition | +-------------------+-----------------------------+--------------------------+------------------------------------+ |"@g" | GPT | "0" "1" | | | | GrowFileSystem | | GrowFileSystem | | | | | | | | | | GPT | | | | | | | | | | | | | | | | | | | | | | | | | UAPI.2[1] | | | | | | | | | | | | | | | | | | | | | | | | | partition | +-------------------+-----------------------------+--------------------------+------------------------------------+ |"@r" | | "0" "1" | | | | | | ReadOnly | | | | | GPT | | | | | UAPI.2 Discoverable | | | | | Partitions | | | | | Specification[1] | | | | | | | | | | | | | | | | | | | | ReadOnly= | | | | | | +-------------------+-----------------------------+--------------------------+------------------------------------+ |"@t" | | | | | | | | | | | | | | | | | | | | | | | regular-file | | | | | | | | | 1 | | | | | 1970 | | +-------------------+-----------------------------+--------------------------+------------------------------------+ |"@m" | | | | | | | | | | | | | | | | | | | | | | | regular-file | +-------------------+-----------------------------+--------------------------+------------------------------------+ |"@s" | | | | | | | | | | | | | | | | | | | | | | | | +-------------------+-----------------------------+--------------------------+------------------------------------+ |"@d" | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [3] | +-------------------+-----------------------------+--------------------------+------------------------------------+ |"@l" | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [3] | +-------------------+-----------------------------+--------------------------+------------------------------------+ |"@h" | SHA256 | 64 | SHA256 | | | | | | | | | | | | | | | | | | | | url-file url-tar | | | | | | | | | | SHA256 | | | | | | | | | | | | | | | | +-------------------+-----------------------------+--------------------------+------------------------------------+ "@v" . . "MatchPattern=foobar_@v.raw.xz" "foobar_" ".raw.xz". "@" "%". . . [TRANSFER] . MinVersion= . . 251. ProtectVersion= "". . / ( ) . . "%A" "%B" "%w" . . 251. Verify= . (: GPG SHA256SUMS SHA256SUMS.gpg /usr/lib/systemd/import-pubring.pgp /etc/systemd/import-pubring.pgp). . SHA256 . . url-file url-tar . 251. ChangeLog= URL . . URL. . . . "@v". . 257. AppStream= URL XML AppStream[4]. ( ) . . [5] systemd-sysupdate(8) . . . 257. Features= sysupdate.features(5) . . . : "Features=foo bar" "foo.feature" "bar.feature". . . . 257. RequisiteFeatures= Features= . : Features= . 257. [SOURCE] . Type= . : url-file url-tar tar regular-file directory subvolume. . . . 251. Path= . url-file url-tar HTTP/HTTPS URL. URL /SHA256SUMS /SHA256SUMS.gpg . . 251. MatchPattern= . . . "@v" . . regular-file directory . . "MatchPattern=foo_@v/bar.efi" "bar.efi" "foo_1". 251. [TARGET] . Type= . : partition regular-file directory subvolume. . . . 251. Path= . Type= partition () "auto" . Type= regular-file directory subvolume . Type= partition. "_empty" . systemd-repart(8). 251. PathRelativeTo= Path= . : root esp xbootldr boot explicit. root. root esp xbootldr Path= UAPI.1[2]. boot Path= $BOOT ( ESP XBOOTLDR) UAPI.1[2]. explicit Path= --transfer-source= systemd-sysupdate(8). esp xbootldr boot Type= regular-file directory. 254. MatchPattern= . . . "@v" . . . . regular-file directory (slash). . "MatchPattern=foo_@v/bar.efi" "bar.efi" "foo_1". . . 251. MatchPartitionType= Type= partition GPT . . GPT linux-generic. UUID . Type= repart.d(5). 251. PartitionUUID=, PartitionFlags=, PartitionNoAuto=, PartitionGrowFileSystem= Type= partition UUID GPT . UUID . (wildcards) ( "@u" "@f" "@a" "@g") . . PartitionFlags= PartitionNoAuto= PartitionGrowFileSystem= ( ) . UAPI.2 Discoverable Partitions Specification[1] . . 251. ReadOnly= . partition ReadOnly UAPI.2 Discoverable Partitions Specification[1] PartitionNoAuto= PartitionGrowFileSystem= . regular-file . subvolume . Type= directory " " chattr(1) . 251. Mode= UNIX regular-file. UNIX. ( "@t") . . 251. TriesDone=, TriesLeft= . Automatic Boot Assessment[3] "@d" "@l". 251. InstancesMax= 2 . . . ( Type= regular-file directory subvolume) ( Type= partition "_empty" ). . . . Type= partition . 2 . 251. RemoveTemporary= (boolean). ( ) . Type= regular-file directory subvolume. 251. CurrentSymlink= . / . . Type= regular-file directory subvolume. 251. MinVersion= ProtectVersion= Path= MatchPattern= CurrentSymlink=. : 3. +-------------------+-----------------------------+--------------------------------+ | | | | +-------------------+-----------------------------+--------------------------------+ |"%a" | | | | | | | | | | | | | | | | | | . | | | | x86 | | | | x86-64 arm64. | | | | | | | | | | | | | | | | ConditionArchitecture= | | | | systemd.unit(5) | | | | | | | | | | | | . | +-------------------+-----------------------------+--------------------------------+ |"%A" | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IMAGE_VERSION= | | | | /etc/os-release. | | | | | | | | | | | | | | | | . | | | | os-release(5) | | | | | | | | . | +-------------------+-----------------------------+--------------------------------+ |"%b" | | | | | | | | | | | | | | | | | | | | | | | | | | . | | | | random(4) | | | | | | | | . | +-------------------+-----------------------------+--------------------------------+ |"%B" | | | | | | | | | | | | | | | | | | | | | | | | | | BUILD_ID= | | | | /etc/os-release. | | | | | | | | | | | | | | | | | | | | . | | | | os-release(5) | | | | | | | | . | +-------------------+-----------------------------+--------------------------------+ |"%H" | | | | | | | | | | . | +-------------------+-----------------------------+--------------------------------+ |"%l" | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | . | +-------------------+-----------------------------+--------------------------------+ |"%m" | | | | | | | | | | | | | | | | | | | | | | | | | | . | | | | machine-id(5) | | | | | | | | . | +-------------------+-----------------------------+--------------------------------+ |"%M" | | | | | | | | | | | | | | | | | | | | | | | | | | IMAGE_ID= | | | | /etc/os-release. | | | | | | | | | | | | | | | | | | | | . | | | | os-release(5) | | | | | | | | . | +-------------------+-----------------------------+--------------------------------+ |"%o" | | | | | | | | | | | | | | | | | | | | | | ID= | | | | /etc/os-release. | | | | os-release(5) | | | | | | | | . | +-------------------+-----------------------------+--------------------------------+ |"%v" | | | | | | uname | | | | -r. | +-------------------+-----------------------------+--------------------------------+ |"%w" | | | | | | | | | | | | | | | | | | | | | | | | | | VERSION_ID= | | | | /etc/os-release. | | | | | | | | | | | | | | | | | | | | . | | | | os-release(5) | | | | | | | | . | +-------------------+-----------------------------+--------------------------------+ |"%W" | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | VARIANT_ID= | | | | /etc/os-release. | | | | | | | | | | | | | | | | | | | | . | | | | os-release(5) | | | | | | | | . | +-------------------+-----------------------------+--------------------------------+ |"%T" | | /tmp | | | | | | | | | | | | "$TMPDIR" | | | | "$TEMP" "$TMP". | | | | ( | | | | | | | | | | | | | | | | .) | +-------------------+-----------------------------+--------------------------------+ |"%V" | | /var/tmp | | | | | | | | | | | | "$TMPDIR" | | | | "$TEMP" "$TMP". | | | | ( | | | | | | | | | | | | | | | | .) | +-------------------+-----------------------------+--------------------------------+ |"%%" | | "%%" | | | | "%" | | | | | | | | | | | | | | | | . | +-------------------+-----------------------------+--------------------------------+ "%" "@". (drop-in files) . . 1. Verity Verity . . # /usr/lib/sysupdate.d/50-verity.transfer [Transfer] ProtectVersion=%A [Source] Type=url-file Path=https://download.example.com/ MatchPattern=foobarOS_@v_@u.verity.xz [Target] Type=partition Path=auto MatchPattern=foobarOS_@v_verity MatchPartitionType=root-verity PartitionFlags=0 ReadOnly=1 Verity . Verity "https://download.example.com/foobarOS_@v_@u.verity.xz" . ( "%A") . UUID . UUID "roothash=" Verity Verity ( UUID systemd-gpt-auto-generator(8)). # /usr/lib/sysupdate.d/60-root.transfer [Transfer] ProtectVersion=%A [Source] Type=url-file Path=https://download.example.com/ MatchPattern=foobarOS_@v_@u.root.xz [Target] Type=partition Path=auto MatchPattern=foobarOS_@v MatchPartitionType=root PartitionFlags=0 ReadOnly=1 . # /usr/lib/sysupdate.d/70-kernel.transfer [Transfer] ProtectVersion=%A [Source] Type=url-file Path=https://download.example.com/ MatchPattern=foobarOS_@v.efi [Target] Type=regular-file Path=/EFI/Linux PathRelativeTo=boot MatchPattern=foobarOS_@v+@l-@d.efi \ foobarOS_@v+@l.efi \ foobarOS_@v.efi Mode=0644 TriesLeft=3 TriesDone=0 InstancesMax=2 $BOOT UAPI.1 Boot Loader Specification[2] 2. Automatic Boot Assessment[3] 3 . . 7 : o SHA256SUMS - (manifest) SHA256 o SHA256SUMS.gpg - o foobarOS_7_8b8186b1-2b4e-4eb6-ad39-8d4d18d2a8fb.verity.xz - Verity 7 o foobarOS_7_f4d1234f-3ebf-47c4-b31d-4052982f9a2f.root.xz - 7 o foobarOS_7.efi - 7 . SHA256SUMS . 2. [Source] Type=url-tar Path=https://download.example.com/ MatchPattern=myContainer_@v.tar.gz [Target] Type=subvolume Path=/var/lib/machines MatchPattern=myContainer_@v CurrentSymlink=myContainer "https://download.example.com/myContainer_@v.tar.gz" / /var/lib/machines/myContainer_@v. / /var/lib/machines/myContainer . systemd(1), systemd-sysupdate(8), systemd-repart(8) 1. UAPI.2 https://uapi-group.org/specifications/specs/discoverable_partitions_specification 2. UAPI.1 https://uapi-group.org/specifications/specs/boot_loader_specification 3. https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT 4. AppStream https://www.freedesktop.org/software/appstream/docs/chap-CatalogData.html 5. https://systemd.io/APPSTREAM_BUNDLE 3 . . : . systemd 260.2 SYSUPDATE.D(5)