From 25f505f0ec053c82edf0e608aa9e55afa88cac2c Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 24 Oct 2026 10:39:50 +0100 Subject: [PATCH] meson: add feature flag for integritysetup integritysetup builds and installs binaries, docs, units, etc. Add a feature flag to make it easier to avoid shipping it. --- man/integritytab.xml | 2 +- man/rules/meson.build | 6 +++--- man/systemd-integritysetup-generator.xml | 2 +- man/systemd-integritysetup@.service.xml | 2 +- meson.build | 6 ++++++ meson_options.txt | 2 ++ src/integritysetup/meson.build | 2 +- test/units/TEST-67-INTEGRITY.sh | 5 +++++ units/meson.build | 6 +++--- 9 files changed, 23 insertions(+), 10 deletions(-) diff --git a/man/integritytab.xml b/man/integritytab.xml index 8b2aea70f72..74efcc951d1 100644 --- a/man/integritytab.xml +++ b/man/integritytab.xml @@ -6,7 +6,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later --> - + integritytab diff --git a/man/rules/meson.build b/man/rules/meson.build index b44ff758b35..f8c8bd0b76f 100644 --- a/man/rules/meson.build +++ b/man/rules/meson.build @@ -32,7 +32,7 @@ manpages = [ ['hostnamectl', '1', [], 'ENABLE_HOSTNAMED'], ['hwdb', '7', [], 'ENABLE_HWDB'], ['importctl', '1', [], 'ENABLE_MACHINED'], - ['integritytab', '5', [], 'HAVE_LIBCRYPTSETUP'], + ['integritytab', '5', [], 'ENABLE_INTEGRITYSETUP'], ['iocost.conf', '5', [], ''], ['journal-remote.conf', '5', ['journal-remote.conf.d'], 'HAVE_MICROHTTPD'], ['journal-upload.conf', '5', ['journal-upload.conf.d'], 'HAVE_MICROHTTPD'], @@ -1115,11 +1115,11 @@ manpages = [ ['systemd-import-generator', '8', [], ''], ['systemd-importd.service', '8', ['systemd-importd'], 'ENABLE_IMPORTD'], ['systemd-inhibit', '1', [], ''], - ['systemd-integritysetup-generator', '8', [], 'HAVE_LIBCRYPTSETUP'], + ['systemd-integritysetup-generator', '8', [], 'ENABLE_INTEGRITYSETUP'], ['systemd-integritysetup@.service', '8', ['systemd-integritysetup'], - 'HAVE_LIBCRYPTSETUP'], + 'ENABLE_INTEGRITYSETUP'], ['systemd-journal-gatewayd.service', '8', ['systemd-journal-gatewayd', 'systemd-journal-gatewayd.socket'], diff --git a/man/systemd-integritysetup-generator.xml b/man/systemd-integritysetup-generator.xml index e7cc5a32935..2f526eba0ce 100644 --- a/man/systemd-integritysetup-generator.xml +++ b/man/systemd-integritysetup-generator.xml @@ -3,7 +3,7 @@ - + systemd-integritysetup-generator diff --git a/man/systemd-integritysetup@.service.xml b/man/systemd-integritysetup@.service.xml index dc188b55ab7..8a700ed94e4 100644 --- a/man/systemd-integritysetup@.service.xml +++ b/man/systemd-integritysetup@.service.xml @@ -3,7 +3,7 @@ - diff --git a/meson.build b/meson.build index 5d54b3c46b3..25f064a8e46 100644 --- a/meson.build +++ b/meson.build @@ -1797,6 +1797,11 @@ conf.set10('ENABLE_BATTERY_CHECK', get_option('battery-check').allowed()) conf.set10('ENABLE_CLONESETUP', get_option('clonesetup').allowed()) conf.set10('ENABLE_GROWFS', get_option('growfs').allowed()) +have = get_option('integritysetup').require( + conf.get('HAVE_LIBCRYPTSETUP') == 1, + error_message : 'libcryptsetup required for systemd-integritysetup').allowed() +conf.set10('ENABLE_INTEGRITYSETUP', have) + foreach tuple : [ ['analyze'], ['backlight'], @@ -3455,6 +3460,7 @@ foreach tuple : [ ['imds'], ['importd'], ['initrd'], + ['integritysetup'], ['kernel-install'], ['localed'], ['logind'], diff --git a/meson_options.txt b/meson_options.txt index 96aa5140c28..7fe9cbd834d 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -199,6 +199,8 @@ option('importd', type : 'feature', deprecated : { 'true' : 'enabled', 'false' : description : 'install the systemd-importd daemon') option('install-sysconfdir', type : 'combo', choices : ['true', 'no-samples', 'false'], value : 'true', description : 'install configuration files and directories') +option('integritysetup', type : 'feature', + description : 'install systemd-integritysetup and associated files') option('kernel-install', type: 'boolean', value: true, description : 'install kernel-install and associated files') option('ldconfig', type : 'boolean', diff --git a/src/integritysetup/meson.build b/src/integritysetup/meson.build index 7f29c031b8d..e30b424f027 100644 --- a/src/integritysetup/meson.build +++ b/src/integritysetup/meson.build @@ -1,6 +1,6 @@ # SPDX-License-Identifier: LGPL-2.1-or-later -if conf.get('HAVE_LIBCRYPTSETUP') != 1 +if conf.get('ENABLE_INTEGRITYSETUP') != 1 subdir_done() endif diff --git a/test/units/TEST-67-INTEGRITY.sh b/test/units/TEST-67-INTEGRITY.sh index 30c0ce2abf5..7b65651d62a 100755 --- a/test/units/TEST-67-INTEGRITY.sh +++ b/test/units/TEST-67-INTEGRITY.sh @@ -2,6 +2,11 @@ # SPDX-License-Identifier: LGPL-2.1-or-later set -euxo pipefail +if [[ ! -x /usr/lib/systemd/systemd-integritysetup ]]; then + echo "systemd-integritysetup is not installed, skipping test." >/skipped + exit 77 +fi + DM_NAME="integrity_test" DM_NODE="/dev/mapper/${DM_NAME}" DM_SERVICE="systemd-integritysetup@${DM_NAME}.service" diff --git a/units/meson.build b/units/meson.build index cd583f133e1..b6a38ea83c5 100644 --- a/units/meson.build +++ b/units/meson.build @@ -117,11 +117,11 @@ units = [ }, { 'file' : 'integritysetup-pre.target', - 'conditions' : ['HAVE_LIBCRYPTSETUP'], + 'conditions' : ['ENABLE_INTEGRITYSETUP'], }, { 'file' : 'integritysetup.target', - 'conditions' : ['HAVE_LIBCRYPTSETUP'], + 'conditions' : ['ENABLE_INTEGRITYSETUP'], 'symlinks' : ['sysinit.target.wants/'], }, { 'file' : 'kexec.target' }, @@ -200,7 +200,7 @@ units = [ { 'file' : 'remote-fs.target' }, { 'file' : 'remote-integritysetup.target', - 'conditions' : ['HAVE_LIBCRYPTSETUP'], + 'conditions' : ['ENABLE_INTEGRITYSETUP'], 'symlinks' : ['initrd-root-device.target.wants/'], }, {