ukify PE section padding broken on 24.04

[Nick Rosbrook]

[Impact]

The version of ukify shipped in 24.04 is missing a patch that fixes PE section padding logic[1]. Without this patch, UKIs built with ukify may fail to boot.

[1] https://github.com/systemd/systemd/commit/ec1d031f3de02f84beca89e2b402d085fba62be4

[Test Plan]

One way to observe this is using mkosi to build a UKI, where Ubuntu 24.04 is used as the tools tree. I.e. the tools from Ubuntu 24.04 (namely ukify) will be used to build the UKI itself.

$ mkdir build workspace
$ cd build
$ mkosi --workspace-directory=../workspace --tools-tree=default --tools-tree-distribution=ubuntu --tools-tree-release=noble -d fedora -r rawhide --include=mkosi-vm -f vm

If successful, that command should result in the just-built image being booted with QEMU. Currently, without the patch, the UKI fails to boot.

[Where problems could occur]

The patch is restricted to ukify itself, and does not impact other parts of the systemd codebase. The patch changes the PE section padding logic in ukify. Hence, if further issues did occur, it would most likely arise when trying to use UKIs built with ukify.

[Other info]

This commit was first included in v258, and was backported to v257.9. Hence, it is fixed in questing and newer. Plucky will not be fixed.

[Timo Aaltonen (tjaalton)]

Hello Nick, or anyone else affected,

Accepted systemd into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/systemd/255.4-1ubuntu8.12 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted systemd (255.4-1ubuntu8.12) for noble have finished running.
The following regressions have been reported in tests triggered by the package:

apport/2.28.1-0ubuntu3.8 (armhf, s390x)
apt/2.8.3 (amd64)
asterisk/1:20.6.0~dfsg+~cs6.13.40431414-2build5 (armhf)
at-spi2-core/2.52.0-1build1 (s390x)
casper/1.498 (amd64)
cron/3.0pl1-184ubuntu2 (amd64)
debci/3.9 (armhf)
debos/1.1.3-1ubuntu0.3 (amd64)
docker.io-app/28.2.2-0ubuntu1~24.04.1 (amd64, arm64, s390x)
fwupd/1.9.31-0ubuntu1~24.04.1 (arm64)
initramfs-tools/0.142ubuntu25.5 (armhf, s390x)
jami/unknown (armhf)
libei/1.2.1-1 (armhf)
linux-azure-6.11/6.11.0-1018.18~24.04.1 (amd64)
linux-azure-nvidia/6.8.0-1028.31 (arm64)
linux-azure-nvidia-6.14/6.14.0-1009.9 (arm64)
linux-lowlatency/6.8.0-88.89.1 (arm64)
linux-lowlatency-hwe-6.11/6.11.0-1016.17~24.04.1 (amd64, arm64)
linux-nvidia/6.8.0-1043.46 (amd64)
linux-nvidia-6.11/6.11.0-1016.16 (amd64, arm64)
linux-oem-6.14/6.14.0-1016.16 (amd64)
linux-oem-6.8/6.8.0-1032.32 (amd64)
linux-oracle-6.14/6.14.0-1017.17~24.04.1 (arm64)
logiops/unknown (armhf)
mediawiki/unknown (armhf)
munin/2.0.75-1ubuntu1 (armhf)
netplan.io/1.1.2-8ubuntu1~24.04.1 (amd64, arm64, s390x)
netplan.io/unknown (armhf)
ovn/24.03.6-0ubuntu0.24.04.1 (s390x)
puppet-agent/8.4.0-1 (armhf)
pystemd/0.13.2-1build2 (armhf)
rsyslog/8.2312.0-3ubuntu9.1 (armhf)
systemd/255.4-1ubuntu8.12 (arm64)
tinyssh/20240101-2 (armhf)
upower/1.90.3-1 (s390x)
wireshark/unknown (armhf)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/noble/update_excuses.html#systemd

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Nick Rosbrook (enr0n)]

I verified this using systemd 255.4-1ubuntu8.12 from noble-proposed. To enable noble-proposed in the mkosi tools tree, I added these configs to my build dir:

$ cat mkosi.tools.conf/mkosi.sandbox/etc/apt/preferences.d/proposed.pref
Package: src:systemd:any
Pin: release a=noble-proposed
Pin-Priority: 550
$ cat mkosi.tools.conf/mkosi.sandbox/etc/apt/sources.list.d/proposed.sources
Types: deb deb-src
URIs: http://us.archive.ubuntu.com/ubuntu/
Suites: noble-proposed
Components: main restricted universe multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

Then I ran:

$ mkosi --workspace-directory=../workspace --tools-tree=default --tools-tree-distribution=ubuntu --tools-tree-release=noble -d fedora -r rawhide --include=mkosi-vm -f vm

and it successfully boots the VM now. During the build, I could see that systemd-ukify 255.4-1ubuntu8.12 was installed from noble-proposed. Also, I could check this with:

$ ./mkosi.tools/usr/bin/ukify --version
ukify 255 (255.4-1ubuntu8.12)

[Launchpad Janitor (janitor)]

This bug was fixed in the package systemd - 255.4-1ubuntu8.12

---------------
systemd (255.4-1ubuntu8.12) noble; urgency=medium

  * basic: validate timezones in get_timezones() (LP: #2125405)
  * ukify: fix insertion of padding in merged sections (LP: #2132666)
  * core: downgrade a log message from warning to debug (LP: #2130554)
  * test: skip testcase_multipath_basic_failover.
    This test has been failing on Ubuntu infrastructure for a long time.
    Leaving this alone at the moment allows other failures to potentially go
    unnoticed, because the migration reference baseline has been reset to
    fail. Skip the test to try and reset the baseline to pass.
  * d/gbp.conf: stop using wrap_cl.py

 -- Nick Rosbrook <email address hidden> Tue, 25 Nov 2025 13:16:31 -0500

[Julian Andres Klode (juliank)]

The verification of the Stable Release Update for systemd has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.