Clayton Craft
98e7cc36f0
With DNSSEC on, resolved can't validate anything until the clock is right, and without an RTC the only thing that fixes the clock is talking to the NTP servers we're trying to resolve. On glibc the timesyncd unit sets SYSTEMD_NSS_RESOLVE_VALIDATE=0 and nss-resolve turns that into a per-query flag, which breaks the chicken/egg. musl (and other systems not using nss-resolve) have no NSS, so nothing reads it there and we're stuck. So talk to resolved directly when it's there, and pass SD_RESOLVED_NO_VALIDATE until we've synced the clock ourselves. NTP-related lookups after that are validated normally, which is better than what we get from nss. If resolved isn't around we just keep using getaddrinfo(). The reply handler duplicates the tail of the getaddrinfo handler, since the two differ in how they report failures. Varlink discards what the callback returns, so it has to move on to the next host itself. This also drops SYSTEMD_NSS_RESOLVE_VALIDATE=0 from the unit because nss-resolve talks to resolved over the same socket we do, so the getaddrinfo() path is only ever taken when resolved is unreachable, and then nothing validates anyway.
System and Service Manager
Details
Most documentation is available on systemd's website.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release