diff --git a/.github/workflows/build_test.sh b/.github/workflows/build_test.sh
deleted file mode 100755
index 4e6f6a1af1..0000000000
--- a/.github/workflows/build_test.sh
+++ /dev/null
@@ -1,163 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-set -ex
-
-info() { echo -e "\033[33;1m$1\033[0m"; }
-fatal() { echo >&2 -e "\033[31;1m$1\033[0m"; exit 1; }
-success() { echo >&2 -e "\033[32;1m$1\033[0m"; }
-
-ARGS=(
-    "--optimization=0"
-    "--optimization=s -Dgnu-efi=true -Defi-cflags=-m32 -Defi-libdir=/usr/lib32"
-    "--optimization=3 -Db_lto=true -Ddns-over-tls=false"
-    "--optimization=3 -Db_lto=false"
-    "--optimization=3 -Ddns-over-tls=openssl"
-    "--optimization=3 -Dfexecve=true -Dstandalone-binaries=true -Dstatic-libsystemd=true -Dstatic-libudev=true"
-    "-Db_ndebug=true"
-)
-PACKAGES=(
-    cryptsetup-bin
-    expect
-    fdisk
-    gettext
-    iputils-ping
-    isc-dhcp-client
-    itstool
-    kbd
-    libblkid-dev
-    libbpf-dev
-    libc6-dev-i386
-    libcap-dev
-    libcurl4-gnutls-dev
-    libfdisk-dev
-    libfido2-dev
-    libgpg-error-dev
-    liblz4-dev
-    liblzma-dev
-    libmicrohttpd-dev
-    libmount-dev
-    libp11-kit-dev
-    libpwquality-dev
-    libqrencode-dev
-    libssl-dev
-    libtss2-dev
-    libxkbcommon-dev
-    libxtables-dev
-    libzstd-dev
-    mount
-    net-tools
-    perl
-    python3-evdev
-    python3-jinja2
-    python3-lxml
-    python3-pip
-    python3-pyparsing
-    python3-setuptools
-    quota
-    strace
-    unifont
-    util-linux
-    zstd
-)
-COMPILER="${COMPILER:?}"
-COMPILER_VERSION="${COMPILER_VERSION:?}"
-LINKER="${LINKER:?}"
-CRYPTOLIB="${CRYPTOLIB:?}"
-RELEASE="$(lsb_release -cs)"
-
-bash -c "echo 'deb-src http://archive.ubuntu.com/ubuntu/ $RELEASE main restricted universe multiverse' >>/etc/apt/sources.list"
-
-# Note: As we use postfixed clang/gcc binaries, we need to override $AR
-#       as well, otherwise meson falls back to ar from binutils which
-#       doesn't work with LTO
-if [[ "$COMPILER" == clang ]]; then
-    CC="clang-$COMPILER_VERSION"
-    CXX="clang++-$COMPILER_VERSION"
-    AR="llvm-ar-$COMPILER_VERSION"
-
-    # Prefer the distro version if available
-    if ! apt install --dry-run "llvm-$COMPILER_VERSION" >/dev/null; then
-        # Latest LLVM stack deb packages provided by https://apt.llvm.org/
-        # Following snippet was partly borrowed from https://apt.llvm.org/llvm.sh
-        wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | gpg --yes --dearmor --output /usr/share/keyrings/apt-llvm-org.gpg
-        printf "deb [signed-by=/usr/share/keyrings/apt-llvm-org.gpg] http://apt.llvm.org/%s/   llvm-toolchain-%s-%s  main\n" \
-               "$RELEASE" "$RELEASE" "$COMPILER_VERSION" >/etc/apt/sources.list.d/llvm-toolchain.list
-    fi
-
-    PACKAGES+=("clang-$COMPILER_VERSION" "lldb-$COMPILER_VERSION" "lld-$COMPILER_VERSION" "clangd-$COMPILER_VERSION")
-elif [[ "$COMPILER" == gcc ]]; then
-    CC="gcc-$COMPILER_VERSION"
-    CXX="g++-$COMPILER_VERSION"
-    AR="gcc-ar-$COMPILER_VERSION"
-
-    if ! apt install --dry-run "gcc-$COMPILER_VERSION" >/dev/null; then
-        # Latest gcc stack deb packages provided by
-        # https://launchpad.net/~ubuntu-toolchain-r/+archive/ubuntu/test
-        add-apt-repository -y ppa:ubuntu-toolchain-r/test
-    fi
-
-    PACKAGES+=("gcc-$COMPILER_VERSION" "gcc-$COMPILER_VERSION-multilib")
-else
-    fatal "Unknown compiler: $COMPILER"
-fi
-
-# PPA with some newer build dependencies (like zstd)
-add-apt-repository -y ppa:upstream-systemd-ci/systemd-ci
-apt-get -y update
-apt-get -y build-dep systemd
-apt-get -y install "${PACKAGES[@]}"
-# Install more or less recent meson and ninja with pip, since the distro versions don't
-# always support all the features we need (like --optimization=). Since the build-dep
-# command above installs the distro versions, let's install the pip ones just
-# locally and add the local bin directory to the $PATH.
-pip3 install --user -r .github/workflows/requirements.txt --require-hashes
-export PATH="$HOME/.local/bin:$PATH"
-
-$CC --version
-meson --version
-ninja --version
-
-for args in "${ARGS[@]}"; do
-    SECONDS=0
-
-    # meson fails with
-    #   src/boot/efi/meson.build:52: WARNING: Not using lld as efi-ld, falling back to bfd
-    #   src/boot/efi/meson.build:52:16: ERROR: Fatal warnings enabled, aborting
-    # when LINKER is set to lld so let's just not turn meson warnings into errors with lld
-    # to make sure that the build systemd can pick up the correct efi-ld linker automatically.
-
-    # The install_tag feature introduced in 0.60 causes meson to fail with fatal-meson-warnings
-    # "Project targeting '>= 0.53.2' but tried to use feature introduced in '0.60.0': install_tag arg in custom_target"
-    # It can be safely removed from the CI since it isn't actually used anywhere to test anything.
-    find . -type f -name meson.build -exec sed -i '/install_tag/d' '{}' '+'
-    if [[ "$LINKER" != lld ]]; then
-        additional_meson_args="--fatal-meson-warnings"
-    fi
-    info "Checking build with $args"
-    # shellcheck disable=SC2086
-    if ! AR="$AR" \
-         CC="$CC" CC_LD="$LINKER" CFLAGS="-Werror" \
-         CXX="$CXX" CXX_LD="$LINKER" CXXFLAGS="-Werror" \
-         meson -Dtests=unsafe -Dslow-tests=true -Dfuzz-tests=true --werror \
-               -Dnobody-group=nogroup $additional_meson_args \
-               -Dcryptolib="${CRYPTOLIB:?}" $args build; then
-
-        cat build/meson-logs/meson-log.txt
-        fatal "meson failed with $args"
-    fi
-
-    if ! meson compile -C build -v; then
-        fatal "'meson compile' failed with $args"
-    fi
-
-    for loader in build/src/boot/efi/*.efi; do
-        if sbverify --list "$loader" |& grep -q "gap in section table"; then
-            fatal "$loader: Gaps found in section table"
-        fi
-    done
-
-    git clean -dxf
-
-    success "Build with $args passed in $SECONDS seconds"
-done
diff --git a/.github/workflows/build_test.yml b/.github/workflows/build_test.yml
deleted file mode 100644
index 8a19d5a937..0000000000
--- a/.github/workflows/build_test.yml
+++ /dev/null
@@ -1,38 +0,0 @@
----
-# vi: ts=2 sw=2 et:
-# SPDX-License-Identifier: LGPL-2.1-or-later
-#
-name: Build test
-on:
-  pull_request:
-    paths:
-      - '**/meson.build'
-      - '.github/workflows/**'
-      - 'meson_options.txt'
-      - 'src/**'
-      - 'test/fuzz/**'
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: ubuntu-22.04
-    concurrency:
-      group: ${{ github.workflow }}-${{ toJSON(matrix.env) }}-${{ github.ref }}
-      cancel-in-progress: true
-    strategy:
-      fail-fast: false
-      matrix:
-        env:
-          - { COMPILER: "gcc",   COMPILER_VERSION: "11", LINKER: "bfd",  CRYPTOLIB: "gcrypt"  }
-          - { COMPILER: "gcc",   COMPILER_VERSION: "12", LINKER: "gold", CRYPTOLIB: "openssl" }
-          - { COMPILER: "clang", COMPILER_VERSION: "12", LINKER: "gold", CRYPTOLIB: "gcrypt"  }
-          - { COMPILER: "clang", COMPILER_VERSION: "13", LINKER: "lld",  CRYPTOLIB: "openssl" }
-          - { COMPILER: "clang", COMPILER_VERSION: "14", LINKER: "bfd",  CRYPTOLIB: "auto"    }
-    env: ${{ matrix.env }}
-    steps:
-      - name: Repository checkout
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-      - name: ${{ format('Build check ({0}-{1}-{2}-{3})', env.COMPILER, env.COMPILER_VERSION, env.LINKER, env.CRYPTOLIB) }}
-        run: sudo -E .github/workflows/build_test.sh
diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml
deleted file mode 100644
index a35a97f046..0000000000
--- a/.github/workflows/cflite_pr.yml
+++ /dev/null
@@ -1,39 +0,0 @@
----
-# vi: ts=2 sw=2 et:
-# SPDX-License-Identifier: LGPL-2.1-or-later
-#
-name: ClusterFuzzLite PR fuzzing
-on:
-  pull_request:
-    branches:
-      - main
-      - v[0-9]+-stable
-
-permissions: read-all
-
-jobs:
-  PR:
-    runs-on: ubuntu-latest
-    if: github.repository != 'systemd/systemd' || github.event.pull_request.user.login == 'dependabot[bot]'
-    concurrency:
-      group: ${{ github.workflow }}-${{ matrix.sanitizer }}-${{ github.ref }}
-      cancel-in-progress: true
-    strategy:
-      fail-fast: false
-      matrix:
-        sanitizer: [address, undefined, memory]
-    steps:
-    - name: Build Fuzzers (${{ matrix.sanitizer }})
-      id: build
-      uses: google/clusterfuzzlite/actions/build_fuzzers@v1
-      with:
-        sanitizer: ${{ matrix.sanitizer }}
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Run Fuzzers (${{ matrix.sanitizer }})
-      id: run
-      uses: google/clusterfuzzlite/actions/run_fuzzers@v1
-      with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-        fuzz-seconds: 1200
-        mode: 'code-change'
-        sanitizer: ${{ matrix.sanitizer }}
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
deleted file mode 100644
index 25731abc5a..0000000000
--- a/.github/workflows/cifuzz.yml
+++ /dev/null
@@ -1,62 +0,0 @@
----
-# vi: ts=2 sw=2 et:
-# SPDX-License-Identifier: LGPL-2.1-or-later
-# See: https://google.github.io/oss-fuzz/getting-started/continuous-integration/
-
-name: CIFuzz
-
-permissions:
-  contents: read
-
-on:
-  pull_request:
-    paths:
-      - '**/meson.build'
-      - '.github/workflows/**'
-      - 'meson_options.txt'
-      - 'src/**'
-      - 'test/fuzz/**'
-      - 'tools/oss-fuzz.sh'
-  push:
-    branches:
-      - main
-jobs:
-  Fuzzing:
-    runs-on: ubuntu-latest
-    if: github.repository == 'systemd/systemd'
-    concurrency:
-      group: ${{ github.workflow }}-${{ matrix.sanitizer }}-${{ matrix.architecture }}-${{ github.ref }}
-      cancel-in-progress: true
-    strategy:
-      fail-fast: false
-      matrix:
-        sanitizer: [address, undefined, memory]
-        architecture: [x86_64]
-        include:
-          - sanitizer: address
-            architecture: i386
-    steps:
-      - name: Build Fuzzers (${{ matrix.sanitizer }})
-        id: build
-        uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
-        with:
-          oss-fuzz-project-name: 'systemd'
-          dry-run: false
-          allowed-broken-targets-percentage: 0
-          # keep-unaffected-fuzz-targets should be removed once https://github.com/google/oss-fuzz/issues/7011 is fixed
-          keep-unaffected-fuzz-targets: true
-          sanitizer: ${{ matrix.sanitizer }}
-          architecture: ${{ matrix.architecture }}
-      - name: Run Fuzzers (${{ matrix.sanitizer }})
-        uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
-        with:
-          oss-fuzz-project-name: 'systemd'
-          fuzz-seconds: 600
-          dry-run: false
-          sanitizer: ${{ matrix.sanitizer }}
-      - name: Upload Crash
-        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8
-        if: failure() && steps.build.outcome == 'success'
-        with:
-          name: ${{ matrix.sanitizer }}-${{ matrix.architecture }}-artifacts
-          path: ./out/artifacts
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
deleted file mode 100644
index 73bea19b13..0000000000
--- a/.github/workflows/codeql-analysis.yml
+++ /dev/null
@@ -1,57 +0,0 @@
----
-# vi: ts=2 sw=2 et:
-# SPDX-License-Identifier: LGPL-2.1-or-later
-#
-name: "CodeQL"
-
-on:
-  pull_request:
-    branches: [main]
-    paths:
-      - .github/codeql-config.yml
-      - .github/codeql-custom.qls
-      - .github/workflows/codeql-analysis.yml
-      - .github/workflows/requirements.txt
-      - .github/workflows/unit_tests.sh
-  # It takes the workflow approximately 30 minutes to analyze the code base
-  # so it doesn't seem to make much sense to trigger it on every PR or commit.
-  # It runs daily at 01:00 to avoid colliding with the Coverity workflow.
-  schedule:
-    - cron: '0 1 * * *'
-
-permissions:
-  contents: read
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-22.04
-    concurrency:
-      group: ${{ github.workflow }}-${{ matrix.language }}-${{ github.ref }}
-      cancel-in-progress: true
-    permissions:
-      actions: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'cpp', 'python' ]
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@0c670bbf0414f39666df6ce8e718ec5662c21e03
-      with:
-        languages: ${{ matrix.language }}
-        config-file: ./.github/codeql-config.yml
-
-    - run: sudo -E .github/workflows/unit_tests.sh SETUP
-
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@0c670bbf0414f39666df6ce8e718ec5662c21e03
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@0c670bbf0414f39666df6ce8e718ec5662c21e03
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 904a6895fd..586924f60f 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -5,6 +5,10 @@
 name: Coverity
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/coverity.yml
+      - tools/coverity.sh
   schedule:
     # Run Coverity daily at midnight
     - cron:  '0 0 * * *'
@@ -15,29 +19,15 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-22.04
-    if: github.repository == 'systemd/systemd'
     env:
-      COVERITY_SCAN_BRANCH_PATTERN:     "${{ github.ref}}"
-      COVERITY_SCAN_NOTIFICATION_EMAIL: ""
-      COVERITY_SCAN_PROJECT_NAME:       "${{ github.repository }}"
-      # Set in repo settings -> secrets -> repository secrets
+      # Set in repo settings -> secrets -> actions
       COVERITY_SCAN_TOKEN:              "${{ secrets.COVERITY_SCAN_TOKEN }}"
-      CURRENT_REF:                      "${{ github.ref }}"
+      COVERITY_SCAN_NOTIFICATION_EMAIL: "${{ secrets.COVERITY_SCAN_NOTIFICATION_EMAIL }}"
     steps:
       - name: Repository checkout
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-      # https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
-      - name: Set the $COVERITY_SCAN_NOTIFICATION_EMAIL env variable
-        run: echo "COVERITY_SCAN_NOTIFICATION_EMAIL=$(git log -1 ${{ github.sha }} --pretty=\"%aE\")" >> "$GITHUB_ENV"
-      - name: Install Coverity tools
-        run: tools/get-coverity.sh
       # Reuse the setup phase of the unit test script to avoid code duplication
       - name: Install build dependencies
         run: sudo -E .github/workflows/unit_tests.sh SETUP
-      # Preconfigure with meson to prevent Coverity from capturing meson metadata
-      - name: Preconfigure the build directory
-        run: meson cov-build -Dman=false
-      - name: Build
-        run: tools/coverity.sh build
-      - name: Upload the results
-        run: tools/coverity.sh upload
+      - name: Build & upload the results
+        run: tools/coverity.sh
diff --git a/.github/workflows/issue_labeler.yml b/.github/workflows/issue_labeler.yml
deleted file mode 100644
index 094f72c4b9..0000000000
--- a/.github/workflows/issue_labeler.yml
+++ /dev/null
@@ -1,42 +0,0 @@
----
-
-name: Issue labeler
-on:
-  issues:
-    types: [ opened ]
-
-permissions:
-  contents: read
-
-jobs:
-  label-component:
-    runs-on: ubuntu-22.04
-
-    permissions:
-      issues: write
-
-    strategy:
-      matrix:
-        template: [ bug_report.yml, feature_request.yml ]
-
-    steps:
-      - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-
-      - uses: actions/setup-node@2fddd8803e2f5c9604345a0b591c3020ee971a93
-        with:
-          node-version: '16'
-
-      - name: Parse issue form
-        uses: stefanbuck/github-issue-parser@fc06b2a0adc5ccb7702ab6b641fd8a742a5e9cc0
-        id: issue-parser
-        with:
-          template-path: .github/ISSUE_TEMPLATE/${{ matrix.template }}
-
-      - name: Set labels based on component field
-        uses: redhat-plumbers-in-action/advanced-issue-labeler@b89eb39b97529bb7596cb4e716485a6d6f7dd74a
-        with:
-          issue-form: ${{ steps.issue-parser.outputs.jsonString }}
-          section: component
-          block-list: |
-            other
-          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
deleted file mode 100644
index 680a2c17a7..0000000000
--- a/.github/workflows/labeler.yml
+++ /dev/null
@@ -1,23 +0,0 @@
----
-# vi: ts=2 sw=2 et:
-# SPDX-License-Identifier: LGPL-2.1-or-later
-#
-name: "Pull Request Labeler"
-
-on:
-- pull_request_target
-
-permissions:
-  contents: read
-
-jobs:
-  triage:
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-    steps:
-    - uses: actions/labeler@9fd24f1f9d6ceb64ba34d181b329ee72f99978a0
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
-        configuration-path: .github/labeler.yml
-        sync-labels: "" # This is a workaround for issue 18671
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
deleted file mode 100644
index 0612a709ce..0000000000
--- a/.github/workflows/linter.yml
+++ /dev/null
@@ -1,45 +0,0 @@
----
-# vi: ts=2 sw=2 et:
-# SPDX-License-Identifier: LGPL-2.1-or-later
-# https://github.com/marketplace/actions/super-linter
-name: Lint Code Base
-
-on:
-  pull_request:
-    branches:
-      - main
-      - v[0-9]+-stable
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Lint Code Base
-    runs-on: ubuntu-latest
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: true
-
-    steps:
-      - name: Repo checkout
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-        with:
-          # We need a full repo clone
-          fetch-depth: 0
-
-      - name: Lint Code Base
-        uses: github/super-linter/slim@2d64ac1c067c34beaf7d24cc12733cd46236f76e
-        env:
-          DEFAULT_BRANCH: main
-          MULTI_STATUS: false
-          # Excludes:
-          #   - man/.* - all snippets in man pages (false positives due to
-          #              missing shebangs)
-          #   - .*\.(in|SKELETON) - all template/skeleton files
-          #                         except kernel-install
-          #   - tools/coverity\.sh - external file (with some modifications)
-          FILTER_REGEX_EXCLUDE: .*/(man/.*|([^k]|k(k|ek)*([^ek]|e[^kr]))*(k(k|ek)*e?)?\.(in|SKELETON)|tools/coverity\.sh)$
-          VALIDATE_ALL_CODEBASE: false
-          VALIDATE_BASH: true
-          VALIDATE_GITHUB_ACTIONS: true
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
deleted file mode 100644
index cd6c33eb64..0000000000
--- a/.github/workflows/unit_tests.yml
+++ /dev/null
@@ -1,45 +0,0 @@
----
-# vi: ts=2 sw=2 et:
-# SPDX-License-Identifier: LGPL-2.1-or-later
-#
-name: Unit tests
-on:
-  pull_request:
-    branches:
-      - main
-      - v[0-9]+-stable
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: ubuntu-22.04
-    concurrency:
-      group: ${{ github.workflow }}-${{ matrix.run_phase }}-${{ matrix.cryptolib }}-${{ github.ref }}
-      cancel-in-progress: true
-    strategy:
-      fail-fast: false
-      matrix:
-        run_phase: [GCC, GCC_ASAN_UBSAN, CLANG, CLANG_RELEASE, CLANG_ASAN_UBSAN, CLANG_ASAN_UBSAN_NO_DEPS]
-        cryptolib: [auto]
-        include:
-          - run_phase: GCC
-            cryptolib: openssl
-          - run_phase: CLANG
-            cryptolib: gcrypt
-    steps:
-      - name: Repository checkout
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-      - name: Install build dependencies
-        run: |
-          # Drop XDG_* stuff from /etc/environment, so we don't get the user
-          # XDG_* variables when running under sudo
-          sudo sed -i '/^XDG_/d' /etc/environment
-          # Pass only specific env variables through sudo, to avoid having
-          # the already existing XDG_* stuff on the "other side"
-          sudo --preserve-env=CRYPTOLIB,GITHUB_ACTIONS,CI .github/workflows/unit_tests.sh SETUP
-      - name: Build & test (${{ matrix.run_phase }}-${{ matrix.cryptolib }})
-        run: sudo --preserve-env=CRYPTOLIB,GITHUB_ACTIONS,CI .github/workflows/unit_tests.sh RUN_${{ matrix.run_phase }}
-        env:
-          CRYPTOLIB: ${{ matrix.cryptolib }}
diff --git a/tools/coverity.sh b/tools/coverity.sh
index f140b78174..a76fe0aac7 100755
--- a/tools/coverity.sh
+++ b/tools/coverity.sh
@@ -1,228 +1,61 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: LGPL-2.1-or-later
+#!/bin/bash
 
-# The official unmodified version of the script can be found at
-# https://scan.coverity.com/scripts/travisci_build_coverity_scan.sh
+set -eux
 
-set -e
+COVERITY_SCAN_TOOL_BASE="/tmp/coverity-scan-analysis"
+COVERITY_SCAN_PROJECT_NAME="systemd/systemd"
 
-# Declare build command
-COVERITY_SCAN_BUILD_COMMAND="ninja -C cov-build"
+function coverity_install_script {
+    local platform tool_url tool_archive
 
-# Environment check
-# Use default values if not set
-SCAN_URL=${SCAN_URL:="https://scan.coverity.com"}
-TOOL_BASE=${TOOL_BASE:="/tmp/coverity-scan-analysis"}
-UPLOAD_URL=${UPLOAD_URL:="https://scan.coverity.com/builds"}
+    platform=$(uname)
+    tool_url="https://scan.coverity.com/download/${platform}"
+    tool_archive="/tmp/cov-analysis-${platform}.tgz"
 
-# These must be set by environment
-echo -e "\033[33;1mNote: COVERITY_SCAN_PROJECT_NAME and COVERITY_SCAN_TOKEN are available on Project Settings page on scan.coverity.com\033[0m"
-[ -z "$COVERITY_SCAN_PROJECT_NAME" ] && echo "ERROR: COVERITY_SCAN_PROJECT_NAME must be set" && exit 1
-[ -z "$COVERITY_SCAN_NOTIFICATION_EMAIL" ] && echo "ERROR: COVERITY_SCAN_NOTIFICATION_EMAIL must be set" && exit 1
-[ -z "$COVERITY_SCAN_BRANCH_PATTERN" ] && echo "ERROR: COVERITY_SCAN_BRANCH_PATTERN must be set" && exit 1
-[ -z "$COVERITY_SCAN_BUILD_COMMAND" ] && echo "ERROR: COVERITY_SCAN_BUILD_COMMAND must be set" && exit 1
-[ -z "$COVERITY_SCAN_TOKEN" ] && echo "ERROR: COVERITY_SCAN_TOKEN must be set" && exit 1
+    set +x # this is supposed to hide COVERITY_SCAN_TOKEN
+    echo -e "\033[33;1mDownloading Coverity Scan Analysis Tool...\033[0m"
+    wget -nv -O "$tool_archive" "$tool_url" --post-data "project=$COVERITY_SCAN_PROJECT_NAME&token=${COVERITY_SCAN_TOKEN:?}"
+    set -x
 
-# Verify this branch should run
-if [[ "${CURRENT_REF^^}" =~ "${COVERITY_SCAN_BRANCH_PATTERN^^}" ]]; then
-    echo -e "\033[33;1mCoverity Scan configured to run on branch ${CURRENT_REF}\033[0m"
-else
-    echo -e "\033[33;1mCoverity Scan NOT configured to run on branch ${CURRENT_REF}\033[0m"
-    exit 1
-fi
-
-# Verify upload is permitted
-AUTH_RES=`curl -s --form project="$COVERITY_SCAN_PROJECT_NAME" --form token="$COVERITY_SCAN_TOKEN" $SCAN_URL/api/upload_permitted`
-if [ "$AUTH_RES" = "Access denied" ]; then
-    echo -e "\033[33;1mCoverity Scan API access denied. Check COVERITY_SCAN_PROJECT_NAME and COVERITY_SCAN_TOKEN.\033[0m"
-    exit 1
-else
-    AUTH=`echo $AUTH_RES | jq .upload_permitted`
-    if [ "$AUTH" = "true" ]; then
-        echo -e "\033[33;1mCoverity Scan analysis authorized per quota.\033[0m"
-    else
-        WHEN=`echo $AUTH_RES | jq .next_upload_permitted_at`
-        echo -e "\033[33;1mCoverity Scan analysis NOT authorized until $WHEN.\033[0m"
-        exit 1
-    fi
-fi
-
-TOOL_DIR=`find $TOOL_BASE -type d -name 'cov-analysis*'`
-export PATH="$TOOL_DIR/bin:$PATH"
-
-# Disable CCACHE for cov-build to compilation units correctly
-export CCACHE_DISABLE=1
-
-# FUNCTION DEFINITIONS
-# --------------------
-_help()
-{
-    # displays help and exits
-    cat <<-EOF
-		USAGE: $0 [CMD] [OPTIONS]
-
-		CMD
-		  build   Issue Coverity build
-		  upload  Upload coverity archive for analysis
-              Note: By default, archive is created from default results directory.
-                    To provide custom archive or results directory, see --result-dir
-                    and --tar options below.
-
-		OPTIONS
-		  -h,--help     Display this menu and exits
-
-		  Applicable to build command
-		  ---------------------------
-		  -o,--out-dir  Specify Coverity intermediate directory (defaults to 'cov-int')
-		  -t,--tar      bool, archive the output to .tgz file (defaults to false)
-
-		  Applicable to upload command
-		  ----------------------------
-		  -d, --result-dir   Specify result directory if different from default ('cov-int')
-		  -t, --tar ARCHIVE  Use custom .tgz archive instead of intermediate directory or pre-archived .tgz
-                         (by default 'analysis-result.tgz'
-	EOF
-    return;
-}
-
-_pack()
-{
-    RESULTS_ARCHIVE=${RESULTS_ARCHIVE:-'analysis-results.tgz'}
-
-    echo -e "\033[33;1mTarring Coverity Scan Analysis results...\033[0m"
-    tar czf $RESULTS_ARCHIVE $RESULTS_DIR
-    SHA=`git rev-parse --short HEAD`
-
-    PACKED=true
+    mkdir -p "$COVERITY_SCAN_TOOL_BASE"
+    pushd "$COVERITY_SCAN_TOOL_BASE"
+    tar xzf "$tool_archive"
+    popd
 }
 
+function run_coverity {
+    local results_dir tool_dir results_archive sha author_email response status_code
 
-_build()
-{
-    echo -e "\033[33;1mRunning Coverity Scan Analysis Tool...\033[0m"
-    local _cov_build_options=""
-    #local _cov_build_options="--return-emit-failures 8 --parse-error-threshold 85"
-    eval "${COVERITY_SCAN_BUILD_COMMAND_PREPEND}"
-    COVERITY_UNSUPPORTED=1 cov-build --dir $RESULTS_DIR $_cov_build_options sh -c "$COVERITY_SCAN_BUILD_COMMAND"
-    cov-import-scm --dir $RESULTS_DIR --scm git --log $RESULTS_DIR/scm_log.txt
+    results_dir="cov-int"
+    tool_dir=$(find "$COVERITY_SCAN_TOOL_BASE" -type d -name 'cov-analysis*')
+    results_archive="analysis-results.tgz"
+    sha=$(git rev-parse --short HEAD)
 
-    if [ $? != 0 ]; then
-	echo -e "\033[33;1mCoverity Scan Build failed: $TEXT.\033[0m"
-	return 1
-    fi
-
-    [ -z $TAR ] || [ $TAR = false ] && return 0
+    meson -Dman=false build
+    COVERITY_UNSUPPORTED=1 "$tool_dir/bin/cov-build" --dir "$results_dir" sh -c "ninja -C ./build -v"
+    "$tool_dir/bin/cov-import-scm" --dir "$results_dir" --scm git --log "$results_dir/scm_log.txt"
 
-    if [ "$TAR" = true ]; then
-	_pack
-    fi
-}
+    tar czf "$results_archive" "$results_dir"
 
-
-_upload()
-{
-    # pack results
-    [ -z $PACKED ] || [ $PACKED = false ] && _pack
-
-    # Upload results
+    set +x # this is supposed to hide COVERITY_SCAN_TOKEN
     echo -e "\033[33;1mUploading Coverity Scan Analysis results...\033[0m"
     response=$(curl \
-	           --silent --write-out "\n%{http_code}\n" \
-	           --form project=$COVERITY_SCAN_PROJECT_NAME \
-	           --form token=$COVERITY_SCAN_TOKEN \
-	           --form email=$COVERITY_SCAN_NOTIFICATION_EMAIL \
-	           --form file=@$RESULTS_ARCHIVE \
-	           --form version=$SHA \
-	           --form description="Travis CI build" \
-	           $UPLOAD_URL)
+               --silent --write-out "\n%{http_code}\n" \
+               --form project="$COVERITY_SCAN_PROJECT_NAME" \
+               --form token="${COVERITY_SCAN_TOKEN:?}" \
+               --form email="${COVERITY_SCAN_NOTIFICATION_EMAIL:?}" \
+               --form file="@$results_archive" \
+               --form version="$sha" \
+               --form description="Daily build" \
+               https://scan.coverity.com/builds)
     printf "\033[33;1mThe response is\033[0m\n%s\n" "$response"
     status_code=$(echo "$response" | sed -n '$p')
-    # Coverity Scan used to respond with 201 on successfully receiving analysis results.
-    # Now for some reason it sends 200 and may change back in the foreseeable future.
-    # See https://github.com/pmem/pmdk/commit/7b103fd2dd54b2e5974f71fb65c81ab3713c12c5
     if [ "$status_code" != "200" ]; then
-	TEXT=$(echo "$response" | sed '$d')
-	echo -e "\033[33;1mCoverity Scan upload failed: $TEXT.\033[0m"
-	exit 1
+        echo -e "\033[33;1mCoverity Scan upload failed: $(echo "$response" | sed '$d').\033[0m"
+        return 1
     fi
-
-    echo -e "\n\033[33;1mCoverity Scan Analysis completed successfully.\033[0m"
-    exit 0
+    set -x
 }
 
-# PARSE COMMAND LINE OPTIONS
-# --------------------------
-
-case $1 in
-    -h|--help)
-	_help
-	exit 0
-	;;
-    build)
-	CMD='build'
-	TEMP=`getopt -o ho:t --long help,out-dir:,tar -n '$0' -- "$@"`
-	_ec=$?
-	[[ $_ec -gt 0 ]] && _help && exit $_ec
-	shift
-	;;
-    upload)
-	CMD='upload'
-	TEMP=`getopt -o hd:t: --long help,result-dir:tar: -n '$0' -- "$@"`
-	_ec=$?
-	[[ $_ec -gt 0 ]] && _help && exit $_ec
-	shift
-	;;
-    *)
-	_help && exit 1 ;;
-esac
-
-RESULTS_DIR='cov-int'
-
-eval set -- "$TEMP"
-if [ $? != 0 ] ; then exit 1 ; fi
-
-# extract options and their arguments into variables.
-if [[ $CMD == 'build' ]]; then
-    TAR=false
-    while true ; do
-	case $1 in
-	    -h|--help)
-		_help
-		exit 0
-		;;
-	    -o|--out-dir)
-		RESULTS_DIR="$2"
-		shift 2
-		;;
-	    -t|--tar)
-		TAR=true
-		shift
-		;;
-	    --) _build; shift ; break ;;
-	    *) echo "Internal error" ; _help && exit 6 ;;
-	esac
-    done
-
-elif [[ $CMD == 'upload' ]]; then
-    while true ; do
-	case $1 in
-	    -h|--help)
-		_help
-		exit 0
-		;;
-	    -d|--result-dir)
-		CHANGE_DEFAULT_DIR=true
-		RESULTS_DIR="$2"
-		shift 2
-		;;
-	    -t|--tar)
-		RESULTS_ARCHIVE="$2"
-		[ -z $CHANGE_DEFAULT_DIR ] || [ $CHANGE_DEFAULT_DIR = false ] && PACKED=true
-		shift 2
-		;;
-	    --) _upload; shift ; break ;;
-	    *) echo "Internal error" ; _help && exit 6 ;;
-	esac
-    done
-
-fi
+coverity_install_script
+run_coverity
diff --git a/tools/get-coverity.sh b/tools/get-coverity.sh
deleted file mode 100755
index b067ed23eb..0000000000
--- a/tools/get-coverity.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-# Download and extract coverity tool
-
-set -e
-set -o pipefail
-
-# Environment check
-if [ -z "$COVERITY_SCAN_TOKEN" ]; then
-    echo >&2 'ERROR: COVERITY_SCAN_TOKEN must be set'
-    exit 1
-fi
-
-# Use default values if not set
-PLATFORM="$(uname)"
-TOOL_BASE="${TOOL_BASE:-/tmp/coverity-scan-analysis}"
-TOOL_ARCHIVE="${TOOL_ARCHIVE:-/tmp/cov-analysis-${PLATFORM}.tgz}"
-TOOL_URL="https://scan.coverity.com/download/${PLATFORM}"
-
-# Make sure wget is installed
-sudo apt-get update && sudo apt-get -y install wget
-
-# Get coverity tool
-if [ ! -d "$TOOL_BASE" ]; then
-    # Download Coverity Scan Analysis Tool
-    if [ ! -e "$TOOL_ARCHIVE" ]; then
-        echo -e "\033[33;1mDownloading Coverity Scan Analysis Tool...\033[0m"
-        wget -nv -O "$TOOL_ARCHIVE" "$TOOL_URL" --post-data "project=$COVERITY_SCAN_PROJECT_NAME&token=$COVERITY_SCAN_TOKEN"
-    fi
-
-    # Extract Coverity Scan Analysis Tool
-    echo -e "\033[33;1mExtracting Coverity Scan Analysis Tool...\033[0m"
-    mkdir -p "$TOOL_BASE"
-    pushd "$TOOL_BASE"
-    tar xzf "$TOOL_ARCHIVE"
-    popd
-fi
-
-echo -e "\033[33;1mCoverity Scan Analysis Tool can be found at $TOOL_BASE ...\033[0m"