23 files changed, 577 insertions, 389 deletions

diff --git a/Makefile.am b/Makefile.am
index f8d6d62a6b..09beac93d3 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1209,7 +1209,7 @@ libsystemd_shared_la_LDFLAGS = \
 	$(AM_LDFLAGS) \
 	-release $(PACKAGE_VERSION)
 
-#@auto/libfirewall/Makefile ----------------------------------------------------
+#@src/libsystemd-firewall/src/Makefile -----------------------------------------
 if HAVE_LIBIPTC
 noinst_LTLIBRARIES += \
 	libfirewall.la
@@ -1235,7 +1235,7 @@ SYSINIT_TARGET_WANTS += \
 	ldconfig.service
 endif # ENABLE_LDCONFIG
 
-#@auto/libcore/Makefile --------------------------------------------------------
+#@src/grp-system/libcore/src/Makefile ------------------------------------------
 noinst_LTLIBRARIES += \
 	libcore.la
 
@@ -1418,9 +1418,7 @@ CLEANFILES += \
 	$(AM_V_at)$(MKDIR_P) $(dir $@)
 	$(AM_V_GPERF)$(GPERF) -L ANSI-C -t --ignore-case -N lookup_$(notdir $*) -H hash_$(notdir $*)_name -p -C <$< >$@
 
-#@src/libbasic/include/Makefile
-nested.subdirs += basic
-#@src/libbasic/include/systemd-basic/Makefile
+#@src/libbasic/src/Makefile
 src/basic/errno-list.txt:
 	$(AM_V_at)$(MKDIR_P) $(dir $@)
 	$(AM_V_GEN)$(CPP) $(CFLAGS) $(AM_CPPFLAGS) $(CPPFLAGS) -dM -include errno.h - </dev/null | $(AWK) '/^#define[ \t]+E[^ _]+[ \t]+/ { print $$2; }' >$@
@@ -1482,7 +1480,7 @@ src/journal/audit_type-to-name.h: src/journal/audit_type-list.txt
 	$(AM_V_at)$(MKDIR_P) $(dir $@)
 	$(AM_V_GEN)$(AWK) 'BEGIN{ print "const char *audit_type_to_string(int type) {\n\tswitch(type) {" } {printf "        case AUDIT_%s: return \"%s\";\n", $$1, $$1 } END{ print "        default: return NULL;\n\t}\n}\n" }' <$< >$@
 
-#@auto/libbasic-dns/Makefile
+#@src/grp-resolve/libbasic-dns/src/Makefile
 
 src/resolve/dns_type-list.txt: src/resolve/dns-type.h
 	$(AM_V_at)$(MKDIR_P) $(dir $@)
@@ -4380,7 +4378,7 @@ test_audit_type_SOURCES = \
 test_audit_type_LDADD = \
 	libjournal-core.la
 
-#@auto/libjournal-core/Makefile
+#@src/grp-journal/libjournal-core/src/Makefile
 libjournal_core_la_SOURCES = \
 	src/journal/journald-kmsg.c \
 	src/journal/journald-kmsg.h \
@@ -5215,6 +5213,7 @@ systemd_machined_LDADD = \
 rootlibexec_PROGRAMS += \
 	systemd-machined
 
+#@src/grp-machine/libmachine-core/src/Makefile
 libmachine_core_la_SOURCES = \
 	src/machine/machine.c \
 	src/machine/machine.h \
@@ -5242,7 +5241,7 @@ machinectl_LDADD = \
 rootbin_PROGRAMS += \
 	machinectl
 
-#@auto/systemd-machined/Makefile
+#@src/grp-machine/libmachine-core/test/Makefile
 test_machine_tables_SOURCES = \
 	src/machine/test-machine-tables.c
 
@@ -5252,6 +5251,7 @@ test_machine_tables_LDADD = \
 tests += \
 	test-machine-tables
 
+#@auto/systemd-machined/Makefile
 nodist_systemunit_DATA += \
 	units/systemd-machined.service
 
@@ -5650,7 +5650,7 @@ dist_bashcompletion_data += \
 dist_zshcompletion_data += \
 	shell-completion/zsh/_systemd-resolve
 
-#@auto/libbasic-dns/Makefile
+#@src/grp-resolve/libbasic-dns/test/Makefile
 tests += \
 	test-dns-packet \
 	test-resolve-tables \
@@ -5728,7 +5728,7 @@ test_dnssec_complex_LDADD = \
 
 #@auto/systemd-resolved/Makefile
 endif # ENABLE_RESOLVED
-#@auto/libbasic-dns/Makefile
+#@src/grp-resolve/libbasic-dns/src/Makefile
 
 gperf_txt_sources += \
 	src/resolve/dns_type-list.txt
@@ -6820,17 +6820,25 @@ sd.CPPFLAGS += $(libsystemd-network.CPPFLAGS)
 #@src/grp-initprogs/Makefile
 #@src/grp-initprogs/grp-sleep/Makefile
 #@src/grp-journal/grp-remote/Makefile
+#@src/grp-journal/grp-remote/libsystemd-microhttpd/Makefile
+#@src/grp-journal/grp-remote/libsystemd-microhttpd/src/Makefile
 #@src/grp-locale/Makefile
 #@src/grp-machine/Makefile
 #@src/grp-machine/grp-import/Makefile
 #@src/grp-machine/grp-import/libimport/Makefile
+#@src/grp-machine/libmachine-core/Makefile
 #@src/grp-resolve/Makefile
 #@src/grp-resolve/libbasic-dns/Makefile
 #@src/grp-system/Makefile
 #@src/grp-system/grp-utils/Makefile
+#@src/grp-system/libcore/Makefile
 #@src/grp-timedate/Makefile
 #@src/grp-utils/Makefile
-#@src/libudev/Makefile
+#@src/libsystemd-firewall/Makefile
+#@src/libsystemd-gcrypt/Makefile
+#@src/libsystemd-gcrypt/src/Makefile
+#@src/libsystemd/src/sd-bus/Makefile
+#@src/libsystemd/src/sd-hwdb/Makefile
 #@all
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/discard.mk b/discard.mk
index ffd9830d83..e2b5c90471 100644
--- a/discard.mk
+++ b/discard.mk
@@ -737,7 +737,7 @@ test_nss_SOURCES = \
 
 test_nss_LDADD = \
 	libsystemd-internal.la \
-	libbasic.la \
+	libsystemd-basic.la \
 	-ldl
 
 manual_tests += \
diff --git a/src/grp-journal/Makefile b/src/grp-journal/Makefile
index acd4b7a0a1..59ae3ee8b3 100644
--- a/src/grp-journal/Makefile
+++ b/src/grp-journal/Makefile
@@ -192,7 +192,6 @@ dist_systempreset_DATA = \
 
 nested.subdirs += grp-remote
 nested.subdirs += journalctl
-nested.subdirs += libjournal-core
 nested.subdirs += systemd-cat
 nested.subdirs += systemd-journald
 
diff --git a/src/grp-journal/grp-remote/libsystemd-microhttpd/Makefile b/src/grp-journal/grp-remote/libsystemd-microhttpd/Makefile
index 4a9896ee1c..ef8de68e3a 100644
--- a/src/grp-journal/grp-remote/libsystemd-microhttpd/Makefile
+++ b/src/grp-journal/grp-remote/libsystemd-microhttpd/Makefile
@@ -8,7 +8,7 @@
 #  Copyright 2013 David Strauss
 #  Copyright 2016 Luke Shumaker
 #
-#  systemd is free software; you can redistribute it anor modify it
+#  systemd is free software; you can redistribute it and/or modify it
 #  under the terms of the GNU Lesser General Public License as published by
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.
diff --git a/src/grp-journal/grp-remote/libsystemd-microhttpd/src/Makefile b/src/grp-journal/grp-remote/libsystemd-microhttpd/src/Makefile
index 7df638b778..b0eae79db5 100644
--- a/src/grp-journal/grp-remote/libsystemd-microhttpd/src/Makefile
+++ b/src/grp-journal/grp-remote/libsystemd-microhttpd/src/Makefile
@@ -8,7 +8,7 @@
 #  Copyright 2013 David Strauss
 #  Copyright 2016 Luke Shumaker
 #
-#  systemd is free software; you can redistribute it anor modify it
+#  systemd is free software; you can redistribute it and/or modify it
 #  under the terms of the GNU Lesser General Public License as published by
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.
diff --git a/src/grp-machine/libmachine-core/Makefile b/src/grp-machine/libmachine-core/Makefile
index 76e6e9ddee..7c64e6af5f 100644
--- a/src/grp-machine/libmachine-core/Makefile
+++ b/src/grp-machine/libmachine-core/Makefile
@@ -24,5 +24,6 @@ include $(dir $(lastword $(MAKEFILE_LIST)))/../../../config.mk
 include $(topsrcdir)/build-aux/Makefile.head.mk
 
 nested.subdirs += src
+nested.subdirs += test
 
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-machine/libmachine-core/src/Makefile b/src/grp-machine/libmachine-core/src/Makefile
index 75c196f199..a1e10f3cb4 100644
--- a/src/grp-machine/libmachine-core/src/Makefile
+++ b/src/grp-machine/libmachine-core/src/Makefile
@@ -41,13 +41,4 @@ libmachine_core_la_LIBADD = \
 noinst_LTLIBRARIES += \
 	libmachine-core.la
 
-test_machine_tables_SOURCES = \
-	src/machine/test-machine-tables.c
-
-test_machine_tables_LDADD = \
-	libmachine-core.la
-
-tests += \
-	test-machine-tables
-
 include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-machine/libmachine-core/test/Makefile b/src/grp-machine/libmachine-core/test/Makefile
new file mode 100644
index 0000000000..a75e11f3ac
--- /dev/null
+++ b/src/grp-machine/libmachine-core/test/Makefile
@@ -0,0 +1,35 @@
+#  -*- Mode: makefile; indent-tabs-mode: t -*-
+#
+#  This file is part of systemd.
+#
+#  Copyright 2010-2012 Lennart Poettering
+#  Copyright 2010-2012 Kay Sievers
+#  Copyright 2013 Zbigniew Jędrzejewski-Szmek
+#  Copyright 2013 David Strauss
+#  Copyright 2016 Luke Shumaker
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+#
+#  systemd is distributed in the hope that it will be useful, but
+#  WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+#  Lesser General Public License for more details.
+#
+#  You should have received a copy of the GNU Lesser General Public License
+#  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+include $(dir $(lastword $(MAKEFILE_LIST)))/../../../../config.mk
+include $(topsrcdir)/build-aux/Makefile.head.mk
+
+test_machine_tables_SOURCES = \
+	src/machine/test-machine-tables.c
+
+test_machine_tables_LDADD = \
+	libmachine-core.la
+
+tests += \
+	test-machine-tables
+
+include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/src/grp-resolve/libbasic-dns/src/Makefile b/src/grp-resolve/libbasic-dns/src/Makefile
index 75041cbc3d..93d4c59345 100644
--- a/src/grp-resolve/libbasic-dns/src/Makefile
+++ b/src/grp-resolve/libbasic-dns/src/Makefile
@@ -32,6 +32,9 @@ $(outdir)/dns_type-to-name.h: $(outdir)/dns_type-list.txt
 $(outdir)/dns_type-from-name.gperf: $(outdir)/dns_type-list.txt
 	$(AM_V_GEN)$(AWK) 'BEGIN{ print "struct dns_type_name { const char* name; int id; };"; print "%null-strings"; print "%%";} { s=$$1; sub(/_/, "-", s); printf "%s, ", $$s; printf "DNS_TYPE_%s\n", $$1 }' <$< >$@
 
+gperf_txt_sources += \
+	src/resolve/dns_type-list.txt
+
 libbasic_dns_la_SOURCES = \
 	src/resolve/resolved-dns-dnssec.c \
 	src/resolve/resolved-dns-dnssec.h \
diff --git a/src/grp-resolve/libbasic-dns/test/Makefile b/src/grp-resolve/libbasic-dns/test/Makefile
index a5028500df..4f4cbd42a3 100644
--- a/src/grp-resolve/libbasic-dns/test/Makefile
+++ b/src/grp-resolve/libbasic-dns/test/Makefile
@@ -42,7 +42,7 @@ test_resolve_tables_CFLAGS = \
 	$(GCRYPT_CFLAGS)
 
 test_resolve_tables_LDADD = \
-        libbasic-dns.la \
+	libbasic-dns.la \
 	libsystemd-shared.la \
 	$(GCRYPT_LIBS) \
 	-lm
@@ -58,7 +58,8 @@ test_dns_packet_CFLAGS = \
 	$(GCRYPT_CFLAGS)
 
 test_dns_packet_LDADD = \
-        libbasic-dns.la \
+	libbasic-dns.la \
+	libsystemd-shared.la \
 	$(GCRYPT_LIBS) \
 	-lm
 
@@ -83,7 +84,7 @@ test_dnssec_CFLAGS = \
 	$(GCRYPT_CFLAGS)
 
 test_dnssec_LDADD = \
-        libbasic-dns.la \
+	libbasic-dns.la \
 	libsystemd-shared.la \
 	$(GCRYPT_LIBS) \
 	-lm
diff --git a/src/grp-system/libcore/src/manager.c b/src/grp-system/libcore/src/manager.c
index efc002cf87..b769c33b20 100644
--- a/src/grp-system/libcore/src/manager.c
+++ b/src/grp-system/libcore/src/manager.c
@@ -1586,13 +1586,12 @@ static int manager_dispatch_cgroups_agent_fd(sd_event_source *source, int fd, ui
         return 0;
 }
 
-static void manager_invoke_notify_message(Manager *m, Unit *u, pid_t pid, const char *buf, size_t n, FDSet *fds) {
+static void manager_invoke_notify_message(Manager *m, Unit *u, pid_t pid, const char *buf, FDSet *fds) {
         _cleanup_strv_free_ char **tags = NULL;
 
         assert(m);
         assert(u);
         assert(buf);
-        assert(n > 0);
 
         tags = strv_split(buf, "\n\r");
         if (!tags) {
@@ -1645,10 +1644,14 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
 
         n = recvmsg(m->notify_fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
         if (n < 0) {
-                if (errno == EAGAIN || errno == EINTR)
-                        return 0;
+                if (!IN_SET(errno, EAGAIN, EINTR))
+                        log_error("Failed to receive notification message: %m");
 
-                return -errno;
+                /* It's not an option to return an error here since it
+                 * would disable the notification handler entirely. Services
+                 * wouldn't be able to send the WATCHDOG message for
+                 * example... */
+                return 0;
         }
 
         CMSG_FOREACH(cmsg, &msghdr) {
@@ -1671,7 +1674,8 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
                 r = fdset_new_array(&fds, fd_array, n_fds);
                 if (r < 0) {
                         close_many(fd_array, n_fds);
-                        return log_oom();
+                        log_oom();
+                        return 0;
                 }
         }
 
@@ -1685,25 +1689,27 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
                 return 0;
         }
 
+        /* The message should be a string. Here we make sure it's NUL-terminated,
+         * but only the part until first NUL will be used anyway. */
         buf[n] = 0;
 
         /* Notify every unit that might be interested, but try
          * to avoid notifying the same one multiple times. */
         u1 = manager_get_unit_by_pid_cgroup(m, ucred->pid);
         if (u1) {
-                manager_invoke_notify_message(m, u1, ucred->pid, buf, n, fds);
+                manager_invoke_notify_message(m, u1, ucred->pid, buf, fds);
                 found = true;
         }
 
         u2 = hashmap_get(m->watch_pids1, PID_TO_PTR(ucred->pid));
         if (u2 && u2 != u1) {
-                manager_invoke_notify_message(m, u2, ucred->pid, buf, n, fds);
+                manager_invoke_notify_message(m, u2, ucred->pid, buf, fds);
                 found = true;
         }
 
         u3 = hashmap_get(m->watch_pids2, PID_TO_PTR(ucred->pid));
         if (u3 && u3 != u2 && u3 != u1) {
-                manager_invoke_notify_message(m, u3, ucred->pid, buf, n, fds);
+                manager_invoke_notify_message(m, u3, ucred->pid, buf, fds);
                 found = true;
         }
 
diff --git a/src/grp-system/systemctl/systemctl.c b/src/grp-system/systemctl/systemctl.c
index 0c7349fc07..ab9fc4a427 100644
--- a/src/grp-system/systemctl/systemctl.c
+++ b/src/grp-system/systemctl/systemctl.c
@@ -4686,12 +4686,14 @@ static int show_one(
                         return log_error_errno(r, "Failed to map properties: %s", bus_error_message(&error, r));
 
                 if (streq_ptr(info.load_state, "not-found") && streq_ptr(info.active_state, "inactive")) {
-                        log_error("Unit %s could not be found.", unit);
+                        log_full(streq(verb, "status") ? LOG_ERR : LOG_DEBUG,
+                                 "Unit %s could not be found.", unit);
 
                         if (streq(verb, "status"))
                                 return EXIT_PROGRAM_OR_SERVICES_STATUS_UNKNOWN;
 
-                        return -ENOENT;
+                        if (!streq(verb, "show"))
+                                return -ENOENT;
                 }
 
                 r = sd_bus_message_rewind(reply, true);
@@ -4756,10 +4758,11 @@ static int show_one(
         r = 0;
         if (show_properties) {
                 char **pp;
+                int not_found_level = streq(verb, "show") ? LOG_DEBUG : LOG_WARNING;
 
                 STRV_FOREACH(pp, arg_properties)
                         if (!set_contains(found_properties, *pp)) {
-                                log_warning("Property %s does not exist.", *pp);
+                                log_full(not_found_level, "Property %s does not exist.", *pp);
                                 r = -ENXIO;
                         }
 
diff --git a/src/grp-system/systemd/main.c b/src/grp-system/systemd/main.c
index 43cf9a045c..1c53f9aad3 100644
--- a/src/grp-system/systemd/main.c
+++ b/src/grp-system/systemd/main.c
@@ -2016,9 +2016,6 @@ finish:
                                 log_error_errno(r, "Failed to switch root, trying to continue: %m");
                 }
 
-                /* Reopen the console */
-                (void) make_console_stdio();
-
                 args_size = MAX(6, argc+1);
                 args = newa(const char*, args_size);
 
@@ -2066,6 +2063,9 @@ finish:
                 arg_serialization = safe_fclose(arg_serialization);
                 fds = fdset_free(fds);
 
+                /* Reopen the console */
+                (void) make_console_stdio();
+
                 for (j = 1, i = 1; j < (unsigned) argc; j++)
                         args[i++] = argv[j];
                 args[i++] = NULL;
diff --git a/src/libsystemd-basic/src/Makefile b/src/libsystemd-basic/src/Makefile
index 56fa57e5a9..3c9f3246af 100644
--- a/src/libsystemd-basic/src/Makefile
+++ b/src/libsystemd-basic/src/Makefile
@@ -244,13 +244,13 @@ $(outdir)/errno-list.txt: | $(outdir)/.deps
 $(outdir)/errno-to-name.h: $(outdir)/errno-list.txt
 	$(AM_V_GEN)$(AWK) 'BEGIN{ print "static const char* const errno_names[] = { "} !/EDEADLOCK/ && !/EWOULDBLOCK/ && !/ENOTSUP/ { printf "[%s] = \"%s\",\n", $$1, $$1 } END{print "};"}' <$< >$@
 
-$(outdir)/af-list.txt:
+$(outdir)/af-list.txt: | $(outdir)/.deps
 	$(AM_V_GEN)$(CPP) $(sd.ALL_CPPFLAGS) -dM -include sys/socket.h - </dev/null | grep -v AF_UNSPEC | grep -v AF_MAX | $(AWK) '/^#define[ \t]+AF_[^ \t]+[ \t]+PF_[^ \t]/ { print $$2; }' >$@
 
 $(outdir)/af-to-name.h: $(outdir)/af-list.txt
 	$(AM_V_GEN)$(AWK) 'BEGIN{ print "static const char* const af_names[] = { "} !/AF_FILE/ && !/AF_ROUTE/ && !/AF_LOCAL/ { printf "[%s] = \"%s\",\n", $$1, $$1 } END{print "};"}' <$< >$@
 
-$(outdir)/arphrd-list.txt:
+$(outdir)/arphrd-list.txt: | $(outdir)/.deps
 	$(AM_V_GEN)$(CPP) $(sd.ALL_CPPFLAGS) -dM -include net/if_arp.h - </dev/null | $(AWK) '/^#define[ \t]+ARPHRD_[^ \t]+[ \t]+[^ \t]/ { print $$2; }' | sed -e 's/ARPHRD_//' >$@
 
 $(outdir)/arphrd-to-name.h: $(outdir)/arphrd-list.txt
@@ -259,8 +259,8 @@ $(outdir)/arphrd-to-name.h: $(outdir)/arphrd-list.txt
 $(outdir)/arphrd-from-name.gperf: $(outdir)/arphrd-list.txt
 	$(AM_V_GEN)$(AWK) 'BEGIN{ print "struct arphrd_name { const char* name; int id; };"; print "%null-strings"; print "%%";} { printf "%s, ARPHRD_%s\n", $$1, $$1 }' <$< >$@
 
-$(outdir)/cap-list.txt: $(call at.path,$(srcdir)/../include/systemd-basic/missing.h)
-	$(AM_V_GEN)$(CPP) $(sd.ALL_CPPFLAGS) -dM -include linux/capability.h -include $< - </dev/null | $(AWK) '/^#define[ \t]+CAP_[A-Z_]+[ \t]+/ { print $$2; }' | grep -v CAP_LAST_CAP >$@
+$(outdir)/cap-list.txt: | $(outdir)/.deps
+	$(AM_V_GEN)$(CPP) $(sd.ALL_CPPFLAGS) -dM -include linux/capability.h -include systemd-basic/missing.h - </dev/null | $(AWK) '/^#define[ \t]+CAP_[A-Z_]+[ \t]+/ { print $$2; }' | grep -v CAP_LAST_CAP >$@
 
 $(outdir)/cap-to-name.h: $(outdir)/cap-list.txt
 	$(AM_V_GEN)$(AWK) 'BEGIN{ print "static const char* const capability_names[] = { "} { printf "[%s] = \"%s\",\n", $$1, tolower($$1) } END{print "};"}' <$< >$@
diff --git a/src/libsystemd-shared/src/Makefile b/src/libsystemd-shared/src/Makefile
index 62fe215e3f..a8f08e8934 100644
--- a/src/libsystemd-shared/src/Makefile
+++ b/src/libsystemd-shared/src/Makefile
@@ -135,6 +135,8 @@ libsystemd_shared_la_CFLAGS = \
 
 libsystemd_shared_la_LIBADD = \
 	libsystemd-internal.la \
+	libsystemd-basic.la \
+	libsystemd-journal-internal.la \
 	libudev-internal.la \
 	$(ACL_LIBS) \
 	$(LIBIDN_LIBS) \
@@ -146,6 +148,15 @@ libsystemd_shared_la_CFLAGS = \
 	$(SECCOMP_CFLAGS) \
 	-fvisibility=default
 
+libsystemd_shared_la_LIBADD = \
+	$(libsystemd_basic_la_LIBADD) \
+	$(libsystemd_internal_la_LIBADD) \
+	$(libsystemd_journal_internal_la_LIBADD) \
+	$(libudev_internal_la_LIBADD) \
+	$(ACL_LIBS) \
+	$(LIBIDN_LIBS) \
+	$(SECCOMP_LIBS)
+
 libsystemd_shared_la_LDFLAGS = \
 	-release $(PACKAGE_VERSION)
 
diff --git a/src/systemd-nspawn/nspawn.c b/src/systemd-nspawn/nspawn.c
index 868f72eb87..f2cbae2ddb 100644
--- a/src/systemd-nspawn/nspawn.c
+++ b/src/systemd-nspawn/nspawn.c
@@ -75,9 +75,12 @@
 #include "systemd-basic/socket-util.h"
 #include "systemd-basic/stat-util.h"
 #include "systemd-basic/stdio-util.h"
+#include "systemd-basic/string-util.h"
+#include "systemd-basic/strv.h"
 #include "systemd-basic/terminal-util.h"
 #include "systemd-basic/umask-util.h"
 #include "systemd-basic/user-util.h"
+#include "systemd-basic/util.h"
 #include "systemd-blkid/blkid-util.h"
 #include "systemd-shared/base-filesystem.h"
 #include "systemd-shared/dev-setup.h"
diff --git a/test/Makefile b/test/Makefile
index cd08325711..1d82497508 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -367,7 +367,7 @@ test_copy_SOURCES = \
 
 # Link statically to ensure file is large
 test_copy_LDADD = \
-	libshared.la
+	libsystemd-shared.la
 
 test_sigbus_SOURCES = \
 	src/test/test-sigbus.c
@@ -737,7 +737,7 @@ test_firewall_util_CFLAGS = \
 	$(LIBIPTC_CFLAGS)
 
 test_firewall_util_LDADD = \
-	libfirewall.la \
+	libsystemd-firewall.la \
 	libsystemd-shared.la \
 	$(LIBIPTC_LIBS)
 endif # HAVE_LIBIPTC
diff --git a/tools/.gitignore b/tools/.gitignore
new file mode 100644
index 0000000000..4bba404d19
--- /dev/null
+++ b/tools/.gitignore
@@ -0,0 +1 @@
+/notsd-fixup--includes.cache
diff --git a/tools/notsd-find-renames b/tools/notsd-find-renames
new file mode 100755
index 0000000000..fe90e325f6
--- /dev/null
+++ b/tools/notsd-find-renames
@@ -0,0 +1,2 @@
+#!/bin/sh
+git diff --find-renames -l1000 --stat=300,290 "${1:-notsystemd/postmove}" "${2:-notsystemd/master}" |sed -n '/=>/s/\s*|.*//p'
\ No newline at end of file
diff --git a/tools/notsd-fixup b/tools/notsd-fixup
index 99ae0981a3..71b3bf4dfa 100755
--- a/tools/notsd-fixup
+++ b/tools/notsd-fixup
@@ -1,50 +1,25 @@
 #!/usr/bin/env bash
-
-# The reason we do `find`/`while read`-loops instead of `find -exec` commands
-# is that we want errors from the inner loop to bubble up.
-
-fixup_makefiles() (
-	find "$@" -type f -name Makefile | while read -r filename; do
-		{
-			<"$filename" sed -r \
-			 -e "s|(/\.\.)*/config.mk|/$(realpath -ms --relative-to="$(dirname -- "$filename")" config.mk)|" \
-			 -e '/^nested\.subdirs/d' \
-			 -e '/^include \$\(topsrcdir\)\/build-aux\/Makefile\.tail\.mk$/d'
-			echo
-			find "$(dirname "$filename")" -mindepth 2 -maxdepth 2 -name Makefile -print0 |
-			    xargs -r0 dirname -z -- |
-			    xargs -r0 basename -a -z |
-			    xargs -r0 printf 'nested.subdirs += %s\n' | sort
-			echo
-			echo 'include $(topsrcdir)/build-aux/Makefile.tail.mk'
-		} | cat -s | build-aux/write-ifchanged "$filename"
-	done
-)
-
-fixup_includes() (
-	dirs=($(find "$@" -type d -name include))
-	if [[ ${#dirs[@]} -gt 0 ]]; then
-		find "${dirs[@]}" -type d | while read -r dir; do
-			printf '=> libdir %q\n' "$dir"
-			lib="${dir##*/}"
-			find "$dir" -type f | while read -r filename; do
-				printf ' => sed -ir %q %q\n' "s|$lib/||" "$filename"
-				sed -r "s|$lib/||" < "$filename" | build-aux/write-ifchanged "$filename"
-			done
-		done
-	fi
-
-	find "$@" \( -name '*.h' -o -name '*.c' -o -name '*.gperf' \) -type f | while read -r filename; do
-		"$0"--includes "$filename"
-	done
-)
+# Copyright (C) 2015-2016  Luke Shumaker
 
 main() {
 	set -e
 	set -o pipefail
 	export LC_COLLATE=C
-	fixup_makefiles "$@"
-	fixup_includes "$@"
+
+	# We wrap the programs called by xargs with `sh` because xargs only exits early
+	# if the status is 255, but we want to exit early for all non-zero statuses.
+	# We use xargs instead of `find -exec` because `-exec` won't do much of
+	# anything useful with the exit status.
+
+	# Makefiles
+	find "$@" -type f -name Makefile -print0 |
+		xargs -r0 sh -c "$0--makefiles \"\$@\" || exit 255" --
+
+	# C includes
+	rm -rf -- "$0"--includes.cache
+	find "$@" \( -name '*.h' -o -name '*.c' -o -name '*.gperf' -o -name '*.gperf.m4' \) -type f -print0 |
+		xargs -r0 sh -c "$0--includes \"\$@\" || exit 255" --
+	rm -rf -- "$0"--includes.cache
 }
 
 main "$@"
diff --git a/tools/notsd-fixup--includes b/tools/notsd-fixup--includes
index 33218233d5..a636c78be6 100755
--- a/tools/notsd-fixup--includes
+++ b/tools/notsd-fixup--includes
@@ -1,235 +1,305 @@
-#!/usr/bin/env bash
-
-panic() {
-	>&2 echo panic
-	exit 2
-}
-
-out() {
-	printf '%q ' "$@"
-}
-
-# system
-# linux
-# public
-# protected
-# private
-classify() {
-	local path=$1
-	if [[ "$path" = linux/* ]]; then
-		out linux "$path"
-	elif [[ -f "${current_file%/*}/${path}" ]]; then
-		out private "$path"
-	elif [[ "$path" != systemd/* ]] &&
-	     [[ "$path" != libudev.h ]] &&
-	     cpp -include "$path" <<<'' &>/dev/null; then
-		out system "$path"
-	else
-		case "$path" in
-			*-to-name.h|*-from-name.h)
-				base="${path##*/}"
-				base="${base%-to-name.h}"
-				base="${base%-from-name.h}"
-				case "$base" in
-					dns_type)	     d=src/grp-resolve/systemd-resolved;;
-					keyboard-keys)	     d=src/grp-udev/libudev-core;;
-					af|arphrd|cap|errno) d=src/libsystemd-basic/src;;
-					audit_type)	     d=src/libsystemd/src/sd-journal;;
-					*)
-						>&2 printf 'Unknown gperf base: %q\n' "$base"
-						>&2 printf 'Cannot figure out: %q\n' "$path"
-						exit 2
-						;;
-				esac
-				file="$d/${path##*/}"
-				if [[ "$current_file" = "$d"/* ]]; then
-					out private "${file##*/}"
-				elif [[ "$file" = */include/* ]]; then
-					out protected "${file##*/include/}"
-				else
-					out protected "${file##*/}"
-				fi
-				;;
-			asm/sgidefs.h|dbus/dbus.h|efi.h|efilib.h|gio/gio.h|glib.h|libmount.h)
-				out system "$path"
-				;;
-			util.h|*/util.h)
-				if [[ "$current_file" = */systemd-boot/* ]]; then
-					out private util.h
-				else
-					out protected systemd-basic/util.h
-				fi
-				;;
-			*)
-				file=$(find src -type f -name "${path##*/}")
-				if [[ -f "$file" ]]; then
-					case "$file" in
-						*/src/*)
-							if [[ "${current_file%/*}" = "${file%/*}" ]]; then
-								out private "${file##*/}"
-							else
-								out protected "${file##*/src/}"
-							fi
-							;;
-						*/libsystemd/include/*|*/libudev/include/*)
-							out public "${file##*/include/}"
-							;;
-						*/include/*)
-							out protected "${file##*/include/}"
-							;;
-						*/include-staging/*)
-							out protected "${file##*/include-staging/}"
-							;;
-						*)
-							if [[ "${current_file%/*}" = "${file%/*}" ]]; then
-								out private "${file##*/}"
-							else
-								out protected "${file##*/}"
-							fi
-							;;
-					esac
-				else
-					>&2 printf 'Cannot figure out: %q\n' "$path"
-					exit 2
-				fi
-				;;
-		esac
-	fi
-}
-
-phase=phase0
-hook=:
-
-phase0() {
-	phase=phase0
-	hook=:
-	local line="$1"
-	case "$line" in
-		'#include'*|'typedef '*';')
-			phase1 "$line"
-			;;
-		*)
-			printf '%s\n' "$line"
-			;;
-	esac
-}
-
-phase1_init() {
-	phase1_tail=
-	system=()
-	linux=()
-	public=()
-	protected=()
-	typedef=(); typedef_last=true
-	private=()
-}
-phase1_init
-phase1_flush() {
-	local b=:
-	if [[ ${#system[@]} -gt 0 ]]; then
-		printf '%s\n' "${system[@]}" | sort -u
-		b=echo
-	fi
-	if [[ ${#linux[@]} -gt 0 ]]; then
-		$b
-		printf '%s\n' "${linux[@]}"
-		b=echo
-	fi
-	if [[ ${#public[@]} -gt 0 ]]; then
-		$b
-		printf '%s\n' "${public[@]}" | sort -u
-		b=echo
-	fi
-	if [[ ${#protected[@]} -gt 0 ]]; then
-		$b
-		printf '%s\n' "${protected[@]}" | sort -u
-		b=echo
-	fi
-	if [[ ${#typedef[@]} -gt 0 ]] && ! $typedef_last; then
-		$b
-		printf '%s\n' "${typedef[@]}" | sort -u
-		b=echo
-	fi
-	if [[ ${#private[@]} -gt 0 ]]; then
-		$b
-		printf '%s\n' "${private[@]}" | sort -u
-		b=echo
-	fi
-	if [[ ${#typedef[@]} -gt 0 ]] && $typedef_last; then
-		$b
-		printf '%s\n' "${typedef[@]}"
-	fi
-	printf '%s' "$phase1_tail"
-	phase1_init
-}
-phase1() {
-	phase=phase1
-	hook=phase1_flush
-	local line="$1"
-	case "$line" in
-		'')
-			phase1_tail+=$'\n'
-			;;
-		'#include'*)
-			phase1_tail=''
-			local re='^#include [<"]([^">]*)[">](.*)'
-			if [[ "$line" =~ $re ]]; then
-				IFS=' '
-				local buf
-				buf="$(classify "${BASH_REMATCH[1]}")" || panic
-				read -r class path <<<"$buf"
-				case "$class" in
-					system)
-						printf -v line '#include <%s>%s' "$path" "${BASH_REMATCH[2]}"
-						system+=("$line")
-						;;
-					linux)
-						printf -v line '#include <%s>%s' "$path" "${BASH_REMATCH[2]}"
-						linux+=("$line")
-						;;
-					public)
-						printf -v line '#include <%s>%s' "$path" "${BASH_REMATCH[2]}"
-						public+=("$line")
-						;;
-					protected)
-						printf -v line '#include "%s"%s' "$path" "${BASH_REMATCH[2]}"
-						protected+=("$line")
-						;;
-					private)
-						if [[ ${#typedef[@]} -gt 0 ]]; then
-							typedef_last=false
-						fi
-						printf -v line '#include "%s"%s' "$path" "${BASH_REMATCH[2]}"
-						private+=("$line")
-						;;
-				esac
-			else
-				panic
-			fi
-			;;
-		'typedef '*';')
-			phase1_tail=''
-			typedef+=("$line")
-			;;
-		*)
-			phase1_flush
-			phase0 "$line"
-			;;
-	esac
-}
-
-main() {
-	current_file="$1"
-	printf ' => %q %q\n' "$0" "$current_file"
-	set -o pipefail
-	{
-		IFS=''
-		while read -r line; do
-			"$phase" "$line"
-			IFS=''
-		done
-		"$hook"
-	} < "$current_file" | build-aux/write-ifchanged "$current_file"
-}
-
-main "$@"
+#!/usr/bin/env python3
+
+# If you are thinking "this file looks gross!", it is.  It
+# started out as a set of Bash one-liners.  Which got turned
+# into a script.  Which grew somewhat organically.  Not huge,
+# but given that it started as some one liners, that's not a
+# very pretty several hunderd lines.  Then got fairly litterally
+# translated into this, for speed.  So yes, it is gross.
+# Rewrites welcome; just don't introduce any behavioral changes
+# (easy since `tools/notsd-move` runs it on the entire repo and
+# puts the results in git history).
+
+import atexit
+import filecmp
+import json
+import os
+import re
+import shlex
+import subprocess
+import sys
+
+################################################################
+# Everything else in this program is just fluff and bookkeeping
+# around around calling classify().
+
+# Return a tuple of (class/group, path); which is a class that
+# the header path belongs to, and a normalized path for it.
+#
+# There are a fixed number of classes that it may put a header
+# in; in order of most-public to most-private:
+#
+#  system
+#  linux
+#  public
+#  protected
+#  private
+def classify(expensive, current_file, path):
+    if re.fullmatch('.*/include(-staging)?/.*/.*', current_file):
+        lib = os.path.basename(os.path.dirname(current_file))
+        if path.startswith(lib+'/'):
+            path = re.sub('^'+lib+'/', path)
+    if path.startswith('linux/'):
+        return 'linux', path
+    elif expensive.exists(os.path.join(os.path.dirname(current_file), path)):
+        return 'private', path
+    elif not path.startswith('systemd/') and path != 'libudev.h' and expensive.cpp(path):
+        return 'system', path
+    else:
+        if path.endswith('-to-name.h') or path.endswith('-from-name.h'):
+            base = re.fullmatch('(.*)-(to|from)-name\.h', os.path.basename(path)).group(1)
+            d={
+                'dns_type'      : 'src/grp-resolve/systemd-resolved',
+                'keyboard-keys' : 'src/grp-udev/libudev-core',
+                'af'            : 'src/libsystemd-basic/src',
+                'arphrd'        : 'src/libsystemd-basic/src',
+                'cap'           : 'src/libsystemd-basic/src',
+                'errno'         : 'src/libsystemd-basic/src',
+                'audit_type'    : 'src/libsystemd/src/sd-journal',
+            }
+            file = os.path.join(d[base], os.path.basename(path))
+            if current_file.startswith(d[base]):
+                return 'private', os.path.basename(file)
+            elif '/include/' in file:
+                return 'protected', re.sub('.*/include/', '', file)
+            else:
+                return 'protected', os.path.basename(file)
+        elif path in [ 'asm/sgidefs.h', 'dbus/dbus.h', 'efi.h', 'efilib.h', 'gio/gio.h', 'glib.h', 'libmount.h' ]:
+            return 'system', path
+        elif os.path.basename(path) == 'util.h':
+            if '/systemd-boot/' in current_file:
+                return 'private', 'util.h'
+            else:
+                return 'protected', 'systemd-basic/util.h'
+        else:
+            find = expensive.find(os.path.basename(path))
+            if len(find) == 1:
+                file = find[0]
+                if '/src/' in file:
+                    if os.path.dirname(current_file) == os.path.dirname(file):
+                        return 'private', os.path.basename(file)
+                    else:
+                        return 'protected', re.sub('.*/src/', '', file)
+                elif ('/libsystemd/include/' in file) or ('/libudev/include/' in file):
+                    return 'public', re.sub('.*/include/', '', file)
+                elif '/include/' in file:
+                    return 'protected', re.sub('.*/include/', '', file)
+                elif '/include-staging/' in file:
+                    return 'protected', re.sub('.*/include-staging/', '', file)
+                else:
+                    if os.path.dirname(current_file) == os.path.dirname(file):
+                        return 'private', os.path.basename(file)
+                    else:
+                        return 'protected', os.path.basename(file)
+            else:
+                sys.exit('Cannot figure out: {0}'.format(path))
+
+################################################################
+# Cache expensive things
+
+class Cache:
+    def __init__(self, filename):
+        self.cache = {
+            'find': None,
+            'cpp': {}
+        }
+        self.dirty = True
+
+        if os.path.isfile(filename):
+            with open(filename) as file:
+                self.cache = json.load(file)
+                self.dirty = False
+
+    def save(self, filename):
+        if self.dirty:
+            with open(filename, 'w') as file:
+                json.dump(self.cache, file)
+
+    def real_cpp(path):
+        # `cpp -include "$path" <<<'' &>/dev/null`
+        print('  -> cpp({0})'.format(path), file=sys.stderr)
+        with subprocess.Popen(['cpp', '-include', path],
+                                stdin=subprocess.PIPE,
+                                stdout=subprocess.DEVNULL,
+                                stderr=subprocess.DEVNULL) as proc:
+            proc.stdin.close()
+            return proc.wait() == 0
+
+    def real_find():
+        # This can probably be done with os.walk or something,
+        # but since it is only called once, it isn't a good
+        # place to start optimizing.
+        #
+        # `find src -name '*.h' \( -type l -printf 'l %p\n' -o -type f -printf 'f %p\n' \)`
+        print('  -> find()', file=sys.stderr)
+        ret = {}
+        with subprocess.Popen(['find', 'src', '-name', '*.h', '(', '-type', 'l', '-printf', 'l %p\n', '-o', '-type', 'f', '-printf', 'f %p\n', ')'],
+                              stdin=subprocess.DEVNULL,
+                              stdout=subprocess.PIPE, universal_newlines=True,
+                              stderr=subprocess.DEVNULL) as proc:
+            for line in proc.stdout:
+                t, p = line.rstrip('\n').split(' ', 1)
+                ret[p]=t
+        return ret
+
+    def cpp(self, path):
+        # `cpp -include "$path" <<<'' &>/dev/null`
+        if path not in self.cache['cpp']:
+            self.cache['cpp'][path] = Cache.real_cpp(path)
+            self.dirty = True
+        return self.cache['cpp'][path]
+
+    def exists(self, path):
+        # `test -f "$path"`
+        if not self.cache['find']:
+            self.cache['find'] = Cache.real_find()
+            self.dirty = True
+        return path in self.cache['find']
+
+    def find(self, name):
+        # `find src -type f -name "$name"`
+        if not self.cache['find']:
+            self.cache['find'] = Cache.real_find()
+            self.dirty = True
+        return [p for p in self.cache['find'].keys() if self.cache['find'][p]=='f' and os.path.basename(p) == name]
+
+################################################################
+# Data structure for storing a chunk of `#include` lines.
+
+class IncludeSection:
+    def __init__(self):
+        self.trailing_nl = ''
+        self.system = []
+        self.linux = []
+        self.public = []
+        self.protected = []
+        self.typedef = []
+        self.typedef_last = True
+        self.private = []
+    def print(self, file=sys.stdout):
+        b=''
+        if len(self.system) > 0:
+            for line in sorted(set(self.system)):
+                print(line, file=file)
+            b='\n'
+        if len(self.linux) > 0:
+            print(b, end='', file=file)
+            for line in self.linux:
+                print(line, file=file)
+            b='\n'
+        if len(self.public) > 0:
+            print(b, end='', file=file)
+            for line in sorted(set(self.public)):
+                print(line, file=file)
+            b='\n'
+        if len(self.protected) > 0:
+            print(b, end='', file=file)
+            for line in sorted(set(self.protected)):
+                print(line, file=file)
+            b='\n'
+        if len(self.typedef) > 0 and not self.typedef_last:
+            print(b, end='', file=file)
+            for line in sorted(set(self.typedef)):
+                print(line, file=file)
+            b='\n'
+        if len(self.private) > 0:
+            print(b, end='', file=file)
+            for line in sorted(set(self.private)):
+                print(line, file=file)
+            b='\n'
+        if len(self.typedef) > 0 and self.typedef_last:
+            print(b, end='', file=file)
+            for line in self.typedef:
+                print(line, file=file)
+        print(self.trailing_nl, end='', file=file)
+    def add(self, group, path, extra):
+        if group == 'system':
+            self.system.append('#include <{0}>{1}'.format(path, extra))
+        elif group == 'linux':
+            self.linux.append('#include <{0}>{1}'.format(path, extra))
+        elif group == 'public':
+            self.public.append('#include <{0}>{1}'.format(path, extra))
+        elif group == 'protected':
+            self.protected.append('#include "{0}"{1}'.format(path, extra))
+        elif group == 'private':
+            if len(self.typedef) > 0:
+                self.typedef_last = False
+            self.private.append('#include "{0}"{1}'.format(path, extra))
+        else:
+            sys.exit('panic: unrecognized line class: {0}'.format(group))
+
+################################################################
+# The main program loop
+
+class Parser:
+    def __init__(self, cache, ifilename, ofilename):
+        self.cache = cache
+        self.ifilename = os.path.normpath(ifilename)
+        self.ofilename = ofilename
+
+        self.includes = None
+        self.phase = self.phase0
+
+    def phase0(self, line, ofile):
+        self.phase = self.phase0
+
+        if re.fullmatch('#include.*|typedef .*;', line):
+            self.includes = IncludeSection()
+            self.phase1(line, ofile)
+        else:
+            print(line, file=ofile)
+
+    def phase1(self, line, ofile):
+        self.phase = self.phase1
+
+        if line == '':
+            self.includes.trailing_nl += '\n'
+        elif line.startswith('#include'):
+            self.includes.trailing_nl = ''
+            match = re.fullmatch('^#include [<"]([^">]*)[">](.*)', line)
+            if match:
+                group, path = classify(self.cache, self.ifilename, match.group(1))
+                self.includes.add(group, path, match.group(2))
+            else:
+                sys.exit('panic: malformed #include line')
+        elif re.fullmatch('typedef .*;', line):
+            self.includes.trailing_nl = ''
+            self.includes.typedef.append(line)
+        else:
+            self.includes.print(file=ofile)
+            self.includes = None
+            self.phase0(line, ofile)
+
+    def run(self):
+        print(' => {0} {1}'.format(
+            shlex.quote(__file__),
+            shlex.quote(self.ifilename),
+        ), file=sys.stderr)
+        with open(self.ofilename, 'w') as ofile:
+            with open(self.ifilename) as ifile:
+                for line in ifile:
+                    self.phase(line.rstrip('\n'), ofile)
+            if self.includes:
+                self.includes.print(file=ofile)
+
+def main(argv):
+    cache = Cache(__file__+'.cache')
+    tmpfilename = ''
+    def cleanup():
+        if tmpfilename != '':
+            try:
+                os.unlink(tmpfilename)
+            except FileNotFoundError:
+                pass
+    atexit.register(cleanup)
+    for filename in argv[1:]:
+        tmpfilename = os.path.join(os.path.dirname(filename), '.tmp.'+os.path.basename(filename)+'.tmp')
+        Parser(cache, filename, tmpfilename).run()
+        if not filecmp.cmp(filename, tmpfilename):
+            os.rename(tmpfilename, filename)
+        cleanup()
+        tmpfilename = ''
+    cache.save(__file__+'.cache')
+
+if __name__ == '__main__':
+    main(sys.argv)
diff --git a/tools/notsd-fixup--makefiles b/tools/notsd-fixup--makefiles
new file mode 100755
index 0000000000..f89e4b075b
--- /dev/null
+++ b/tools/notsd-fixup--makefiles
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+doit() {
+        local filename=$1
+	{
+		<"$filename" sed -r \
+		 -e "s|(/\.\.)*/config.mk|/$(realpath -ms --relative-to="$(dirname -- "$filename")" config.mk)|" \
+		 -e '/^nested\.subdirs/d' \
+		 -e '/^include \$\(topsrcdir\)\/build-aux\/Makefile\.tail\.mk$/d'
+		echo
+		find "$(dirname "$filename")" -mindepth 2 -maxdepth 2 -name Makefile -print0 |
+		    xargs -r0 dirname -z -- |
+		    xargs -r0 basename -a -z |
+		    xargs -r0 printf 'nested.subdirs += %s\n' | sort
+		echo
+		echo 'include $(topsrcdir)/build-aux/Makefile.tail.mk'
+	} | cat -s | build-aux/write-ifchanged "$filename"
+}
+
+main() {
+	set -e
+	set -o pipefail
+        local filename
+        for filename in "$@"; do
+		>&2 printf ' => %q %q\n' "$0" "$filename"
+                doit "$filename"
+        done
+}
+
+main "$@"
diff --git a/tools/notsd-move b/tools/notsd-move
index 2f6ad3f1b0..36ca546a63 100755
--- a/tools/notsd-move
+++ b/tools/notsd-move
@@ -10,23 +10,30 @@ in_array() (
 	return 1 # Not Found
 )
 
-split_lib() {
+split_lib() (
+	shopt -s nullglob
 	local d=$1
+	local t
 
-	local t=("$d"/test-*)
-	if [[ -f ${t[0]} ]]; then
+	if t=("$d"/test-*) && [[ ${#t[@]} -gt 0 ]]; then
 		mkdir "$d/test"
-		mv "$d"/test-* -t "$d/test"
+		mv -t "$d/test" -- "${t[@]}"
 	fi
 
-	mkdir "$d/src"
-	mv "$d"/*.c -t "$d/src"
+	if t=("$d"/*.c) && [[ ${#t[@]} -gt 0 ]]; then
+		mkdir "$d/src"
+		mv -t "$d/src" -- "${t[@]}"
+	fi
 
-	local h=${d##*/lib}
-	mkdir "$d/include"
-	mkdir "$d/include/$h"
-	mv "$d"/*.h -t "$d/include/$h"
-}
+	if t=("$d"/*.h) && [[ ${#t[@]} -gt 0 ]]; then
+		local h=${d##*/lib}
+		mkdir "$d/include"
+		mkdir "$d/include/$h"
+		mv -t "$d/include/$h" -- "${t[@]}"
+	else
+		return 1
+	fi
+)
 
 grp() {
 	local grp=$1
@@ -41,7 +48,6 @@ grp() {
 
 move_files() (
 	# first focus on getting directories to the right names.
-	mv -T src/{,systemd-}dbus1-generator
 	mv -T src/{,systemd-}debug-generator
 	mv -T src/{,systemd-}fstab-generator
 	mv -T src/{,systemd-}getty-generator
@@ -119,21 +125,49 @@ move_files() (
 	   src/core/umount*
 	mv -T src/{,lib}core
 
-	mv -T src/{,lib}basic
-	mv -T src/{,lib}shared
+	mv -T src/{,libsystemd-}basic
+	mv -T src/{,libsystemd-}shared
 
-	mv -T src/lib{shared,core}/linux
+	mv -T src/lib{systemd-shared,core}/linux
 
-	mkdir src/libfirewall
-	mv -T src/lib{shared,firewall}/firewall-util.c
-	mv -T src/lib{shared,firewall}/firewall-util.h
+	mkdir src/libsystemd-firewall
+	mv -T src/libsystemd-{shared,firewall}/firewall-util.c
+	mv -T src/libsystemd-{shared,firewall}/firewall-util.h
 
-	split_lib src/libbasic
-	split_lib src/libsystemd-network
+	mkdir src/libsystemd-gcrypt
+	mv -T src/libsystemd-{shared,gcrypt}/gcrypt-util.c
+	mv -T src/libsystemd-{shared,gcrypt}/gcrypt-util.h
+
+	mkdir src/libsystemd-blkid
+	mv -T src/libsystemd-{basic,blkid}/blkid-util.h
+
+	mkdir src/libsystemd-microhttpd
+	mv -t src/libsystemd-microhttpd \
+	   src/journal-remote/microhttpd*
 
-	split_lib src/libshared
-	mv src/libshared/{test,include/shared}/test-tables.h
-	rmdir src/libshared/test
+	split_lib src/libcore
+	split_lib src/libsystemd-basic
+	split_lib src/libsystemd-shared
+	split_lib src/libsystemd-network
+	split_lib src/libsystemd-firewall
+	split_lib src/libsystemd-gcrypt
+	split_lib src/libsystemd-blkid
+	split_lib src/libsystemd-microhttpd
+
+	mv -t src/libcore/src \
+	   src/libcore/linux \
+	   src/libcore/include/core/dbus*.h
+	mv -T src/libcore/{src,include/core}/dbus-manager.h
+	mv -T src/libcore/{include/core,src}/audit-fd.h
+	mv -T src/libcore/{include/core,src}/load-dropin.h
+	mv -T src/libcore/{include/core,src}/locale-setup.h
+	mv -T src/libcore/{include/core,src}/selinux-access.h
+	mv -T src/libcore/{include/core,src}/transaction.h
+	mv -T src/libcore/{include/core,src}/unit-printf.h
+	mv -T src/libcore/{,src}/load-fragment-gperf.gperf.m4
+
+	mv src/libsystemd-shared/{test,include/systemd-shared}/test-tables.h
+	rmdir src/libsystemd-shared/test
 
 	mkdir src/systemd-hibernate-resume-generator
 	mv -t src/systemd-hibernate-resume-generator \
@@ -153,6 +187,7 @@ move_files() (
 	   src/resolve/.gitignore \
 	   src/resolve/*
 	rmdir src/resolve
+	split_lib src/libbasic-dns
 
 	# src/import => src/{libimport,systemd-{export,importd,import}}
 	mkdir src/libimport
@@ -178,7 +213,7 @@ move_files() (
 	   src/import/curl-util*
 	rmdir src/import
 
-	# src/journal => src/..
+	# src/journal => src/...
 	mkdir src/libjournal-core
 	mv -t src/libjournal-core \
 	   src/journal/.gitignore \
@@ -221,6 +256,8 @@ move_files() (
 	   src/journal/mmap-cache.h \
 	   src/journal/sd-journal.c
 	rmdir src/journal
+	split_lib src/libjournal-core
+	mv -T src/libjournal-core/{,src/}journald-gperf.gperf
 
 	# src/network => src/...
 	mkdir src/systemd-networkd-wait-online
@@ -242,15 +279,17 @@ move_files() (
 	   src/network/test-*
 	rmdir src/network
 
-	# src/machine => src/{machinectl,systemd-machined}
-	mkdir src/machinectl
-	mv -t src/machinectl \
-	   src/machine/machinectl*
-	mkdir src/systemd-machined
+	# src/machine => src/{machinectl,systemd-machined,libmachine-core}
+	mkdir src/machinectl src/systemd-machined src/libmachine-core
+	mv -T src/{machine,machinectl}/machinectl.c
+	mv -T src/{machine,systemd-machined}/machined.c
 	mv -t src/systemd-machined \
 	   src/machine/.gitignore \
+	   src/machine/org.*
+	mv -t src/libmachine-core \
 	   src/machine/*
 	rmdir src/machine
+	split_lib src/libmachine-core
 
 	# src/coredump => src/{coredumpctl,systemd-coredump}
 	mkdir src/coredumpctl
@@ -285,8 +324,7 @@ move_files() (
 	mv -t src/grp-remote.d \
 	   src/journal-remote/.gitignore \
 	   src/journal-remote/browse.html \
-	   src/journal-remote/log-generator.py \
-	   src/journal-remote/microhttpd*
+	   src/journal-remote/log-generator.py
 	rmdir src/journal-remote
 
 	# src/locale => src/...
@@ -441,7 +479,7 @@ move_files() (
 	   units/machine.slice*
 
 	# muck
-	mv -t src/libbasic/include/basic src/libbasic/.gitignore
+	mv -t src/libsystemd-basic/src src/libsystemd-basic/.gitignore
 	mv -T {test,src/systemd-boot}/test-efi-create-disk.sh
 	mv -t src/systemd-tmpfiles units/systemd-tmpfiles*
 	mv -t src/systemd-tmpfiles \
@@ -460,7 +498,7 @@ move_files() (
 	mkdir src/libudev/include
 	mv -T src/libudev/{src,include}/libudev.h
 	mv -T src/{systemd-networkd,libnetworkd-core}/networkd.h
-	mv -T src/{systemd-resolved,libbasic-dns}/resolved-def.h
+	mv -T src/{systemd-resolved,libbasic-dns/include/basic-dns}/resolved-def.h
 	mv -t src/cdrom_id  rules/*cdrom*
 	mv -t src/mtd_probe rules/*mtd*
 	mv -t src/v4l_id    rules/*v4l*
@@ -469,9 +507,10 @@ move_files() (
 	   src/libsystemd/include/systemd/sd-ipv4* \
 	   src/libsystemd/include/systemd/sd-lldp* \
 	   src/libsystemd/include/systemd/sd-ndisc*
-	for l in device hwdb netlink network resolve; do
-		mv -T src/libsystemd/include/systemd/sd-$l.h src/libsystemd/src/sd-$l/sd-$l.h
-	done
+	mkdir src/libsystemd/include-staging{,/systemd-staging}
+	mv -t src/libsystemd/include-staging/systemd-staging \
+	   src/libsystemd/include/systemd/sd-{device,hwdb,netlink,network,resolve}.h
+
 	mkdir src/grp-journal.d
 	mv -t src/grp-journal.d tmpfiles.d/journal-nocow.*
 	mv -t src/grp-remote.d tmpfiles.d/systemd-remote.*
@@ -578,6 +617,7 @@ move_files() (
 	    src/systemd-hibernate-resume-generator \
 	    src/systemd-sleep
 	grp src/grp-remote \
+	    src/libsystemd-microhttpd \
 	    src/systemd-journal-gatewayd \
 	    src/systemd-journal-remote \
 	    src/systemd-journal-upload
@@ -597,6 +637,7 @@ move_files() (
 	    src/systemd-inhibit \
 	    src/systemd-logind
 	grp src/grp-machine \
+	    src/libmachine-core \
 	    src/machinectl \
 	    src/nss-mymachines \
 	    src/systemd-machined
@@ -648,6 +689,17 @@ move_files() (
 	    src/systemd-path \
 	    src/systemd-socket-activate
 
+	mv -t src/grp-udev \
+	   src/grp-udev/rules/*
+	cat src/grp-udev/rules/.gitignore >> src/grp-udev/.gitignore
+	rm src/grp-udev/rules/.gitignore
+	rmdir src/grp-udev/rules
+
+	mv -t src/grp-journal/systemd-journald \
+	   src/grp-journal/catalog/.gitignore \
+	   src/grp-journal/catalog/*
+	rmdir src/grp-journal/catalog
+
 	mv -t src/systemd-timesyncd system-preset/??-timesyncd.preset
 	for file in system-preset/??-*.preset; do
 		base="${file##*/??-}"
@@ -656,6 +708,16 @@ move_files() (
 		mv -t src/grp-"$base" "$file"
 	done
 	rmdir system-preset
+
+	mv -t src/libsystemd/src/sd-bus \
+	   src/libsystemd-shared/src/bus-util.c \
+	   src/libsystemd-shared/include/systemd-shared/bus-util.h
+
+	ln -srT src/libsystemd/include/systemd/_sd-common.h src/libsystemd-network/include/systemd-network/_sd-common.h
+	ln -srT src/libsystemd/include/systemd/_sd-common.h src/grp-utils/systemd-path/_sd-common.h
+	ln -srT src/grp-login/systemd-logind/logind-acl.h   src/grp-udev/libudev-core/logind-acl.h
+	ln -srT src/grp-login/systemd-logind/logind-acl.c   src/grp-udev/libudev-core/logind-acl.c
+	ln -srT src/libsystemd/src/sd-login/sd-login.c      src/grp-udev/libudev-core/sd-login.c
 )
 
 breakup_makefile() (
@@ -698,44 +760,18 @@ breakup_makefile() (
 
 	sed -ri \
 	    -e '/^[^#	]*:/ { s|\S+/|$(outdir)/|g }' \
-	    src/libbasic/include/basic/Makefile \
+	    src/libsystemd-basic/src/Makefile \
 	    src/libsystemd/src/Makefile \
 	    src/libsystemd/src/sd-journal/Makefile \
 	    src/grp-udev/libudev-core/Makefile
 
-	ln -sT ../grp-system/libcore/mount-setup.h src/systemd-remount-fs/mount-setup.h
-	ln -sT ../grp-system/libcore/mount-setup.c src/systemd-remount-fs/mount-setup.c
-	ln -sT ../libcore/mount-setup.h src/grp-system/systemd-shutdown/mount-setup.h
-	ln -sT ../libcore/mount-setup.c src/grp-system/systemd-shutdown/mount-setup.c
-	ln -sT ../libcore/killall.h src/grp-system/systemd-shutdown/killall.h
-	ln -sT ../libcore/killall.c src/grp-system/systemd-shutdown/killall.c
-	ln -sT ../../libcore/mount-setup.h src/grp-system/grp-utils/systemd-fstab-generator/mount-setup.h
-	ln -sT ../../libcore/mount-setup.c src/grp-system/grp-utils/systemd-fstab-generator/mount-setup.c
-	ln -sT ../grp-system/libcore/mount-setup.h src/systemd-nspawn/mount-setup.h
-	ln -sT ../grp-system/libcore/loopback-setup.h src/systemd-nspawn/loopback-setup.h
-	ln -sT ../grp-system/libcore/loopback-setup.c src/systemd-nspawn/loopback-setup.c
-	ln -sT ../grp-system/libcore/machine-id-setup.h src/systemd-nspawn/machine-id-setup.h
-	ln -sT ../grp-system/libcore/machine-id-setup.c src/systemd-nspawn/machine-id-setup.c
-	ln -sT ../grp-system/libcore/mount-setup.c src/systemd-nspawn/mount-setup.c
-	ln -sT ../../../libsystemd/include/systemd/_sd-common.h src/libsystemd-network/include/systemd-network/_sd-common.h
-	ln -sT ../../libsystemd/include/systemd/_sd-common.h src/grp-utils/systemd-path/_sd-common.h
-	ln -sT ../../grp-login/systemd-logind/logind-acl.h src/grp-udev/libudev-core/logind-acl.h
-	ln -sT ../../libsystemd/src/sd-login/sd-login.c src/grp-udev/libudev-core/sd-login.c
-	ln -sT ../../grp-login/systemd-logind/logind-acl.c src/grp-udev/libudev-core/logind-acl.c
-	ln -sT ../../../libshared/include/shared/gcrypt-util.h src/libsystemd/src/sd-journal/gcrypt-util.h
-	ln -sT ../../../libshared/src/gcrypt-util.c src/libsystemd/src/sd-journal/gcrypt-util.c
-	ln -sT ../grp-system/libcore/machine-id-setup.h src/systemd-machine-id-setup/machine-id-setup.h
-	ln -sT ../grp-system/libcore/machine-id-setup.c src/systemd-machine-id-setup/machine-id-setup.c
-
 	ln -sT ../subdir.mk src/libsystemd/src/sd-network/Makefile
-	ln -sT ../subdir.mk src/libsystemd/src/sd-bus/Makefile
 	ln -sT ../subdir.mk src/libsystemd/src/sd-event/Makefile
 	ln -sT ../subdir.mk src/libsystemd/src/sd-login/Makefile
 	ln -sT ../subdir.mk src/libsystemd/src/sd-resolve/Makefile
 	ln -sT ../subdir.mk src/libsystemd/src/sd-daemon/Makefile
 	ln -sT ../subdir.mk src/libsystemd/src/sd-netlink/Makefile
 	ln -sT ../subdir.mk src/libsystemd/src/sd-id128/Makefile
-	ln -sT ../subdir.mk src/libsystemd/src/sd-hwdb/Makefile
 	ln -sT ../subdir.mk src/libsystemd/src/sd-device/Makefile
 )
 
@@ -744,11 +780,23 @@ fixup_makefile() {
 	    -e '#### Specific complete strings #####' \
 	    -e 's|\$\(CPP\) \$\(CFLAGS\) \$\(AM_CPPFLAGS\) \$\(CPPFLAGS\)|$(CPP) $(sd.ALL_CPPFLAGS)|g' \
 	    -e '/^	\$\(AM_V_at\)\$\(MKDIR_P\) \$\(dir \$@\)/d' \
+	    \
 	    -e '#### General cases #################' \
 	    -e '/^[^#	]*:/ { s|^(\s*)\S+/|\1$(outdir)/| }' \
 	    -e 's|^if (.*)|ifneq ($(\1),)|' \
 	    -e '/^\s*\$\(AM_(C|CPP|LD)FLAGS\b/d' \
-	    -e 's|--version-script=.*/([^/]+)\.sym|--version-script=$(srcdir)/\1.sym|g'
+	    -e 's|--version-script=.*/([^/]+)\.sym|--version-script=$(srcdir)/\1.sym|g' \
+	    \
+	    -e '#### Rename helpers ################' \
+	    -e 's|libbasic_la|libsystemd_basic_la|g' \
+	    -e 's|libbasic|libsystemd-basic|g' \
+	    -e 's|libsystemd-basic-dns|libbasic-dns|g' \
+	    \
+	    -e 's|libshared_la|libsystemd_shared_la|g' \
+	    -e 's|libshared|libsystemd-shared|g' \
+	    \
+	    -e 's|libfirewall_la|libsystemd_firewall_la|g' \
+	    -e 's|libfirewall|libsystemd-firewall|g'
 }
 
 breakup_zshcompletion() (
@@ -784,6 +832,7 @@ run() (
 
 move() (
 	find . \( -name Makefile -o -name '*.mk' \) -delete
+	find src -type d -empty -exec rmdir -p --ignore-fail-on-non-empty -- {} +
 
 	>&2 echo ' => breakup_zshcompletion'
 	run breakup_zshcompletion
@@ -807,7 +856,7 @@ main() {
 
 	git add .
 	git commit -m './tools/notsd-move'
-	git merge -s ours notsystemd/postmove
+	git merge --no-edit -s ours notsystemd/postmove
 	git checkout notsystemd/postmove
 	git merge tmp/postmove
 	git branch -d tmp/postmove