From edea0c19a0f3ea22a845810dd2b6ec57547302b8 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Mon, 27 Feb 2023 18:47:38 -0800 Subject: [PATCH 01/29] Rebase to version 2.6.4 Related: rhbz#2168351 --- .gitignore | 1 + openldap.spec | 8 ++++++-- sources | 1 + 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 65b66b2..1284f15 100644 --- a/.gitignore +++ b/.gitignore @@ -35,3 +35,4 @@ /openldap-2.6.1.tgz /openldap-2.6.2.tgz /openldap-2.6.3.tgz +/openldap-2.6.4.tgz diff --git a/openldap.spec b/openldap.spec index 24c3568..29b4bdb 100644 --- a/openldap.spec +++ b/openldap.spec @@ -13,8 +13,8 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.3 -Release: 2%{?dist} +Version: 2.6.4 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,10 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Mon Feb 27 2023 Simon Pichugin - 2.6.4-1 +- Rebase to version 2.6.4 + Related: rhbz#2168351 + * Thu Jan 19 2023 Fedora Release Engineering - 2.6.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index 57593ff..502b716 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc SHA512 (openldap-2.6.3.tgz) = 56efbbfc68779ad635d2c25228eb9c4f1553b107b96e8a438029b1c5d2f2647cf4d437770554392b436718ea44a4813e17f5195049f67fc09d063a981096cd85 +SHA512 (openldap-2.6.4.tgz) = 4be49c4866e47e96677d0e1f7caa380791917c9df8d6bb343d032aba45031c87db3bd4f6b953e914a1f40044fa68f4886ae96929a410b7188c0ed9bb75073a30 From 0e7065eaf28b6a6e208a63e655b8c22983db333e Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Sat, 15 Apr 2023 19:27:26 +0200 Subject: [PATCH 02/29] Apply upstream patch to fix C99 compatibility issues Related to: --- openldap-configure-c99.patch | 906 +++++++++++++++++++++++++++++++++++ openldap.spec | 7 +- 2 files changed, 912 insertions(+), 1 deletion(-) create mode 100644 openldap-configure-c99.patch diff --git a/openldap-configure-c99.patch b/openldap-configure-c99.patch new file mode 100644 index 0000000..1a0931a --- /dev/null +++ b/openldap-configure-c99.patch @@ -0,0 +1,906 @@ +commit 14f81bc47a4c462ccc609fce74feb014185e2bf9 +Author: Sam James +Date: Thu Feb 9 23:17:53 2023 +0000 + + ITS#10011 build: fix compatibility with stricter C99 compilers + + Fix the following warnings: + - -Wimplicit-int (fatal with Clang 16) + - -Wimplicit-function-declaration (fatal with Clang 16) + - -Wincompatible-function-pointer-types (fatal with Clang 16) + - -Wint-conversion (fatal with Clang 15) + - Old style prototypes (K&R, removed from C23) + + These warnings-now-error led to misconfigurations and failure to build + OpenLDAP, as the tests used during configure caused the wrong results + to be emitted. + + For more information, see LWN.net [0] or LLVM's Discourse [1], the Gentoo wiki [2], + or the (new) c-std-porting mailing list [3]. + + [0] https://lwn.net/Articles/913505/ + [1] https://discourse.llvm.org/t/configure-script-breakage-with-the-new-werror-implicit-function-declaration/65213 + [2] https://wiki.gentoo.org/wiki/Modern_C_porting + [3] hosted at lists.linux.dev. + + Bug: https://bugs.gentoo.org/871288 + Signed-off-by: Sam James + +diff -ur openldap-2.6.4.orig/openldap-2.6.4/build/openldap.m4 openldap-2.6.4/openldap-2.6.4/build/openldap.m4 +--- openldap-2.6.4.orig/openldap-2.6.4/build/openldap.m4 2023-02-08 19:53:35.000000000 +0100 ++++ openldap-2.6.4/openldap-2.6.4/build/openldap.m4 2023-04-15 19:21:07.377380382 +0200 +@@ -154,6 +154,7 @@ + if test $ol_cv_header_stdc = yes; then + # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi. + AC_RUN_IFELSE([AC_LANG_SOURCE([[#include ++#include + #ifndef HAVE_EBCDIC + # define ISLOWER(c) ('a' <= (c) && (c) <= 'z') + # define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) +@@ -303,8 +304,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -360,9 +365,13 @@ + AC_DEFUN([OL_PTHREAD_TEST_PROGRAM], + [AC_LANG_SOURCE([OL_PTHREAD_TEST_INCLUDES + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + OL_PTHREAD_TEST_FUNCTION + } +@@ -484,7 +493,7 @@ + #include + #include + static char *pattern, *string; +-main() ++int main(void) + { + int rc; + regex_t re; +@@ -511,7 +520,8 @@ + [AC_CACHE_CHECK([if toupper() requires islower()],ol_cv_c_upper_lower,[ + AC_RUN_IFELSE([AC_LANG_SOURCE([[ + #include +-main() ++#include ++int main(void) + { + if ('C' == toupper('C')) + exit(0); +@@ -569,7 +579,7 @@ + ]])],[ol_cv_nonposix_strerror_r=yes],[ol_cv_nonposix_strerror_r=no]) + else + AC_RUN_IFELSE([AC_LANG_SOURCE([[ +- main() { ++ int main(void) { + char buf[100]; + buf[0] = 0; + strerror_r( 1, buf, sizeof buf ); +diff -ur openldap-2.6.4.orig/openldap-2.6.4/configure openldap-2.6.4/openldap-2.6.4/configure +--- openldap-2.6.4.orig/openldap-2.6.4/configure 2023-02-08 19:53:35.000000000 +0100 ++++ openldap-2.6.4/openldap-2.6.4/configure 2023-04-15 19:23:17.437078213 +0200 +@@ -14978,6 +14966,7 @@ + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + #include ++#include + #ifndef HAVE_EBCDIC + # define ISLOWER(c) ('a' <= (c) && (c) <= 'z') + # define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) +@@ -15946,6 +15935,10 @@ + else + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ ++#include ++#ifdef HAVE_SYS_POLL_H ++#include ++#endif + int main(int argc, char **argv) + { + int epfd = epoll_create(256); +@@ -16126,7 +16119,7 @@ + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + +- main() { ++ int main(void) { + char buf[100]; + buf[0] = 0; + strerror_r( 1, buf, sizeof buf ); +@@ -16326,7 +16319,7 @@ + #include + #include + static char *pattern, *string; +-main() ++int main(void) + { + int rc; + regex_t re; +@@ -17559,16 +17552,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -17664,8 +17665,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -17744,16 +17749,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -17854,8 +17867,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -17934,16 +17951,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18044,8 +18069,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18124,16 +18153,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18234,8 +18271,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18314,16 +18355,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18424,8 +18473,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18504,16 +18557,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18615,8 +18676,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18695,16 +18760,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18805,8 +18878,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18885,16 +18962,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18996,8 +19081,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19076,16 +19165,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19187,8 +19284,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19267,16 +19368,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19377,8 +19486,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19457,16 +19570,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19568,8 +19689,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19648,16 +19773,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19759,8 +19892,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19839,16 +19976,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19949,8 +20094,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -20029,16 +20178,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20139,8 +20296,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -20219,16 +20380,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20330,8 +20499,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -20410,16 +20583,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20631,14 +20812,12 @@ + /* end confdefs.h. */ + + #include +-#ifndef NULL +-#define NULL (void*)0 +-#endif ++pthread_t thread; + + int + main () + { +-pthread_detach(NULL); ++pthread_detach(thread); + ; + return 0; + } +@@ -20752,16 +20931,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20851,6 +21038,9 @@ + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + ++#define _XOPEN_SOURCE 500 /* For pthread_setconcurrency() on glibc */ ++#include ++#include + #include + #include + #include +@@ -20861,8 +21051,12 @@ + + static int fildes[2]; + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + int i; + struct timeval tv; +@@ -20886,9 +21080,13 @@ + exit(0); /* if we exit here, the select blocked the whole process */ + } + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + pthread_t t; + +@@ -23241,7 +23439,8 @@ + /* end confdefs.h. */ + + #include +-main() ++#include ++int main(void) + { + if ('C' == toupper('C')) + exit(0); +diff -ur openldap-2.6.4.orig/openldap-2.6.4/configure.ac openldap-2.6.4/openldap-2.6.4/configure.ac +--- openldap-2.6.4.orig/openldap-2.6.4/configure.ac 2023-02-08 19:53:35.000000000 +0100 ++++ openldap-2.6.4/openldap-2.6.4/configure.ac 2023-04-15 19:21:07.377380382 +0200 +@@ -1003,7 +1003,11 @@ + AC_CHECK_HEADERS( sys/epoll.h ) + if test "${ac_cv_header_sys_epoll_h}" = yes; then + AC_MSG_CHECKING(for epoll system call) +- AC_RUN_IFELSE([AC_LANG_SOURCE([[int main(int argc, char **argv) ++ AC_RUN_IFELSE([AC_LANG_SOURCE([[#include ++#ifdef HAVE_SYS_POLL_H ++#include ++#endif ++int main(int argc, char **argv) + { + int epfd = epoll_create(256); + exit (epfd == -1 ? 1 : 0); +@@ -1356,10 +1360,10 @@ + dnl pthread_create() in -lpthread (many) + dnl pthread_create() in -lc_r (FreeBSD) + dnl +- dnl Check pthread (draft4) flags (depreciated) ++ dnl Check pthread (draft4) flags (deprecated) + dnl pthread_create() with -threads (OSF/1) + dnl +- dnl Check pthread (draft4) libraries (depreciated) ++ dnl Check pthread (draft4) libraries (deprecated) + dnl pthread_mutex_unlock() in -lpthreads -lmach -lexc -lc_r (OSF/1) + dnl pthread_mutex_lock() in -lpthreads -lmach -lexc (OSF/1) + dnl pthread_mutex_trylock() in -lpthreads -lexc (OSF/1) +@@ -1378,7 +1382,7 @@ + ol_link_threads=posix + ol_link_pthreads="" + fi +- ++ + dnl OL_PTHREAD_TRY([-mt], [ol_cv_pthread_mt]) + OL_PTHREAD_TRY([-kthread], [ol_cv_pthread_kthread]) + OL_PTHREAD_TRY([-pthread], [ol_cv_pthread_pthread]) +@@ -1465,10 +1469,8 @@ + dnl save the flags + AC_LINK_IFELSE([AC_LANG_PROGRAM([[ + #include +-#ifndef NULL +-#define NULL (void*)0 +-#endif +-]], [[pthread_detach(NULL);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no]) ++pthread_t thread; ++]], [[pthread_detach(thread);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no]) + ]) + + if test $ol_cv_func_pthread_detach = no ; then +@@ -1523,6 +1525,9 @@ + AC_CACHE_CHECK([if select yields when using pthreads], + ol_cv_pthread_select_yields,[ + AC_RUN_IFELSE([AC_LANG_SOURCE([[ ++#define _XOPEN_SOURCE 500 /* For pthread_setconcurrency() on glibc */ ++#include ++#include + #include + #include + #include +@@ -1533,8 +1538,12 @@ + + static int fildes[2]; + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + int i; + struct timeval tv; +@@ -1558,9 +1567,13 @@ + exit(0); /* if we exit here, the select blocked the whole process */ + } + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + pthread_t t; + diff --git a/openldap.spec b/openldap.spec index 29b4bdb..5ffb911 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -46,6 +46,7 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # System-wide default for CA certs Patch7: openldap-openssl-manpage-defaultCA.patch Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch +Patch9: openldap-configure-c99.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -154,6 +155,7 @@ pushd openldap-%{version} %patch6 -p1 %patch7 -p1 %patch8 -p1 +%patch9 -p2 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -504,6 +506,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Sat Apr 15 2023 Florian Weimer - 2.6.4-2 +- Apply upstream patch to fix C99 compatibility issues + * Mon Feb 27 2023 Simon Pichugin - 2.6.4-1 - Rebase to version 2.6.4 Related: rhbz#2168351 From 14bec36c6ce93d53ae2a5223ef875488c9b94db9 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Tue, 11 Jul 2023 15:18:36 +0200 Subject: [PATCH 03/29] Perl 5.38 rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 5ffb911..96bbe5e 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.4 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -506,6 +506,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Tue Jul 11 2023 Jitka Plesnikova - 2.6.4-3 +- Perl 5.38 rebuild + * Sat Apr 15 2023 Florian Weimer - 2.6.4-2 - Apply upstream patch to fix C99 compatibility issues From 0ed61f2f8f4f87fe6b6d3cbadcc4da86375a7f83 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 18:06:25 +0000 Subject: [PATCH 04/29] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 96bbe5e..90171fc 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.4 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -506,6 +506,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 2.6.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Tue Jul 11 2023 Jitka Plesnikova - 2.6.4-3 - Perl 5.38 rebuild From e1d14a261f2801d35fa44263f99527369566c88a Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 26 Jul 2023 19:14:16 -0700 Subject: [PATCH 05/29] Rebase to version 2.6.5 Related: rhbz#2221798 --- .gitignore | 1 + openldap.spec | 10 ++++++---- sources | 3 +-- 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 1284f15..5076f63 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,4 @@ /openldap-2.6.2.tgz /openldap-2.6.3.tgz /openldap-2.6.4.tgz +/openldap-2.6.5.tgz diff --git a/openldap.spec b/openldap.spec index 90171fc..368c084 100644 --- a/openldap.spec +++ b/openldap.spec @@ -13,8 +13,8 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.4 -Release: 4%{?dist} +Version: 2.6.5 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -46,7 +46,6 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # System-wide default for CA certs Patch7: openldap-openssl-manpage-defaultCA.patch Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch -Patch9: openldap-configure-c99.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -155,7 +154,6 @@ pushd openldap-%{version} %patch6 -p1 %patch7 -p1 %patch8 -p1 -%patch9 -p2 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -506,6 +504,10 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Wed Jul 26 2023 Simon Pichugin - 2.6.5-1 +- Rebase to version 2.6.5 + Related: rhbz#2221798 + * Thu Jul 20 2023 Fedora Release Engineering - 2.6.4-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild diff --git a/sources b/sources index 502b716..21c997b 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc -SHA512 (openldap-2.6.3.tgz) = 56efbbfc68779ad635d2c25228eb9c4f1553b107b96e8a438029b1c5d2f2647cf4d437770554392b436718ea44a4813e17f5195049f67fc09d063a981096cd85 -SHA512 (openldap-2.6.4.tgz) = 4be49c4866e47e96677d0e1f7caa380791917c9df8d6bb343d032aba45031c87db3bd4f6b953e914a1f40044fa68f4886ae96929a410b7188c0ed9bb75073a30 +SHA512 (openldap-2.6.5.tgz) = 1babc2950382bc7c7da687bf60b798d4eb7d5543fc9bb321636302adfefa8b86b333ba734807bebd5100b23bfa9a3d534413268e462f95441ffdc4cdd3776961 From d0559e0c05c9ff027aa6cef536b3d6ae3246a21d Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Mon, 31 Jul 2023 17:30:54 -0700 Subject: [PATCH 06/29] Rebase to version 2.6.6 Related: rhbz#2227948 --- .gitignore | 1 + openldap.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 5076f63..64d058d 100644 --- a/.gitignore +++ b/.gitignore @@ -37,3 +37,4 @@ /openldap-2.6.3.tgz /openldap-2.6.4.tgz /openldap-2.6.5.tgz +/openldap-2.6.6.tgz diff --git a/openldap.spec b/openldap.spec index 368c084..fe70816 100644 --- a/openldap.spec +++ b/openldap.spec @@ -13,7 +13,7 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.5 +Version: 2.6.6 Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP @@ -504,6 +504,10 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Mon Jul 31 2023 Simon Pichugin - 2.6.6-1 +- Rebase to version 2.6.6 + Related: rhbz#2227948 + * Wed Jul 26 2023 Simon Pichugin - 2.6.5-1 - Rebase to version 2.6.5 Related: rhbz#2221798 diff --git a/sources b/sources index 21c997b..f38b7f6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc -SHA512 (openldap-2.6.5.tgz) = 1babc2950382bc7c7da687bf60b798d4eb7d5543fc9bb321636302adfefa8b86b333ba734807bebd5100b23bfa9a3d534413268e462f95441ffdc4cdd3776961 +SHA512 (openldap-2.6.6.tgz) = 0e800807b23f090b465dc18c2f0d342585f96768543b3298b85d17c18272d1c5576a66326d30b3520cac493cbd2ea70e309cd923bf19447c973a63d940619fa6 From 7f901dc8a93a5431cacb9ec1a021120e50607bed Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 21 Jan 2024 11:15:47 +0000 Subject: [PATCH 07/29] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index fe70816..a4b9206 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.6 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Sun Jan 21 2024 Fedora Release Engineering - 2.6.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Mon Jul 31 2023 Simon Pichugin - 2.6.6-1 - Rebase to version 2.6.6 Related: rhbz#2227948 From 0625ae77c6c7b3f4cfc1bf38ecee739ec9bbc5fd Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 25 Jan 2024 11:23:42 +0000 Subject: [PATCH 08/29] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index a4b9206..ddad919 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.6 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Thu Jan 25 2024 Fedora Release Engineering - 2.6.6-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sun Jan 21 2024 Fedora Release Engineering - 2.6.6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From dae8c83930ee9ba73dd3aa2c659cd044643b9360 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 7 Feb 2024 17:11:58 -0800 Subject: [PATCH 09/29] Rebase to version 2.6.7 Use systemd-sysusers for ldap user and group Fix compiler errors Replace License with SPDX identifier Resolves: rhbz#2261163, rhbz#2173965, rhbz#2261427 --- .gitignore | 1 + openldap-explicitly-cast-private-values.patch | 70 +++++++++++++++++++ ...i-fix-plugin-plugin_pblock_new-usage.patch | 23 ++++++ openldap.spec | 44 ++++++++---- openldap.sysusers | 3 + sources | 2 +- 6 files changed, 129 insertions(+), 14 deletions(-) create mode 100644 openldap-explicitly-cast-private-values.patch create mode 100644 openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch create mode 100644 openldap.sysusers diff --git a/.gitignore b/.gitignore index 64d058d..3feae2b 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ /openldap-2.6.4.tgz /openldap-2.6.5.tgz /openldap-2.6.6.tgz +/openldap-2.6.7.tgz diff --git a/openldap-explicitly-cast-private-values.patch b/openldap-explicitly-cast-private-values.patch new file mode 100644 index 0000000..80daad6 --- /dev/null +++ b/openldap-explicitly-cast-private-values.patch @@ -0,0 +1,70 @@ +From fb9e6a81bbee880549e7ec18f0a74ddddbd2d1ab Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Tue, 6 Feb 2024 21:38:24 -0500 +Subject: [PATCH] ITS#10171 - Explicitly cast private values + +Fixes issues with -Werror=incompatible-pointer-types + +Signed-off-by: Stephen Gallagher +--- + servers/slapd/config.c | 2 +- + servers/slapd/overlays/constraint.c | 2 +- + servers/slapd/overlays/dyngroup.c | 2 +- + servers/slapd/overlays/valsort.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/servers/slapd/config.c b/servers/slapd/config.c +index 80333f359c..987c862d91 100644 +--- a/servers/slapd/config.c ++++ b/servers/slapd/config.c +@@ -151,7 +151,7 @@ int config_check_vals(ConfigTable *Conf, ConfigArgs *c, int check_only ) { + int rc, arg_user, arg_type, arg_syn, iarg; + unsigned uiarg; + long larg; +- size_t ularg; ++ unsigned long ularg; + ber_len_t barg; + + if(Conf->arg_type == ARG_IGNORED) { +diff --git a/servers/slapd/overlays/constraint.c b/servers/slapd/overlays/constraint.c +index f939b37762..0d6156af4d 100644 +--- a/servers/slapd/overlays/constraint.c ++++ b/servers/slapd/overlays/constraint.c +@@ -557,7 +557,7 @@ done:; + a2->restrict_filter = ap.restrict_filter; + a2->restrict_val = ap.restrict_val; + +- for ( app = &on->on_bi.bi_private; *app; app = &(*app)->ap_next ) ++ for ( app = (constraint **)&on->on_bi.bi_private; *app; app = &(*app)->ap_next ) + /* Get to the end */ ; + + a2->ap_next = *app; +diff --git a/servers/slapd/overlays/dyngroup.c b/servers/slapd/overlays/dyngroup.c +index 5d890d6650..e0e70af2d9 100644 +--- a/servers/slapd/overlays/dyngroup.c ++++ b/servers/slapd/overlays/dyngroup.c +@@ -111,7 +111,7 @@ static int dgroup_cf( ConfigArgs *c ) + */ + a2 = ch_malloc( sizeof(adpair) ); + +- for ( app = &on->on_bi.bi_private; *app; app = &(*app)->ap_next ) ++ for ( app = (adpair **)&on->on_bi.bi_private; *app; app = &(*app)->ap_next ) + /* Get to the end */ ; + + a2->ap_mem = ap.ap_mem; +diff --git a/servers/slapd/overlays/valsort.c b/servers/slapd/overlays/valsort.c +index 3d998e2fcb..e251500d0b 100644 +--- a/servers/slapd/overlays/valsort.c ++++ b/servers/slapd/overlays/valsort.c +@@ -201,7 +201,7 @@ valsort_cf_func(ConfigArgs *c) { + return(1); + } + +- for ( vip = &on->on_bi.bi_private; *vip; vip = &(*vip)->vi_next ) ++ for ( vip = (valsort_info **)&on->on_bi.bi_private; *vip; vip = &(*vip)->vi_next ) + /* Get to the end */ ; + + vi = ch_malloc( sizeof(valsort_info) ); +-- +GitLab + diff --git a/openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch b/openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch new file mode 100644 index 0000000..dda0f52 --- /dev/null +++ b/openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch @@ -0,0 +1,23 @@ +From c7a4bd27f5dcf93806972aab236001f1d4801e80 Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Wed, 31 Jan 2024 16:00:30 +0000 +Subject: [PATCH] ITS#10166 slapi: fix plugin.c plugin_pblock_new() usage + +Broken in 9142da8eaf691720f7d6288954250ef085bd3da0 +--- + servers/slapd/slapi/plugin.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/servers/slapd/slapi/plugin.c b/servers/slapd/slapi/plugin.c +index ca5dbead59..bfa5c10344 100644 +--- a/servers/slapd/slapi/plugin.c ++++ b/servers/slapd/slapi/plugin.c +@@ -694,7 +694,7 @@ slapi_int_read_config( + int rc; + Slapi_PBlock *pPlugin; + +- pPlugin = plugin_pblock_new( iType, numPluginArgc, c->argv ); ++ pPlugin = plugin_pblock_new( iType, numPluginArgc, c ); + if (pPlugin == NULL) { + return 1; + } diff --git a/openldap.spec b/openldap.spec index ddad919..9398229 100644 --- a/openldap.spec +++ b/openldap.spec @@ -13,10 +13,10 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.6 -Release: 3%{?dist} +Version: 2.6.7 +Release: 1%{?dist} Summary: LDAP support libraries -License: OpenLDAP +License: OLDAP-2.8 URL: http://www.openldap.org/ Source0: https://openldap.org/software/download/OpenLDAP/openldap-release/openldap-%{version}.tgz @@ -25,6 +25,7 @@ Source2: slapd.tmpfiles Source3: slapd.ldif Source4: ldap.conf Source5: UPGRADE_INSTRUCTIONS +Source6: openldap.sysusers Source10: https://github.com/ltb-project/openldap-ppolicy-check-password/archive/v%{check_password_version}/openldap-ppolicy-check-password-%{check_password_version}.tar.gz Source50: libexec-functions Source52: libexec-check-config.sh @@ -46,6 +47,8 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # System-wide default for CA certs Patch7: openldap-openssl-manpage-defaultCA.patch Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch +Patch9: openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch +Patch10: openldap-explicitly-cast-private-values.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -116,6 +119,8 @@ License: OpenLDAP Requires: openldap%{?_isa} = %{version}-%{release} Requires(pre): shadow-utils BuildRequires: systemd +BuildRequires: systemd-rpm-macros +%{?sysusers_requires_compat} BuildRequires: cracklib-devel # migrationtools (slapadd functionality): Provides: ldif2ldbm @@ -146,14 +151,16 @@ programs needed for accessing and modifying OpenLDAP directories. %setup -q -c -a 0 -a 10 pushd openldap-%{version} -%patch0 -p1 -%patch1 -p1 -%patch3 -p1 -%patch4 -p1 -%patch5 -p1 -%patch6 -p1 -%patch7 -p1 -%patch8 -p1 +%patch -P0 -p1 +%patch -P1 -p1 +%patch -P3 -p1 +%patch -P4 -p1 +%patch -P5 -p1 +%patch -P6 -p1 +%patch -P7 -p1 +%patch -P8 -p1 +%patch -P9 -p1 +%patch -P10 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -174,8 +181,8 @@ done popd pushd openldap-ppolicy-check-password-%{check_password_version} -%patch90 -p1 -%patch91 -p1 +%patch -P90 -p1 +%patch -P91 -p1 popd %build @@ -237,6 +244,7 @@ popd %install mkdir -p %{buildroot}%{_libdir}/ +install -p -D -m 0644 %{SOURCE6} %{buildroot}%{_sysusersdir}/openldap.conf pushd openldap-%{version} %make_install STRIP_OPTS="" @@ -368,6 +376,9 @@ rm %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/ope %pre servers # create ldap user and group +# sysusers.d format https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format +%sysusers_create_compat %{SOURCE6} + getent group ldap &>/dev/null || groupadd -r -g 55 ldap getent passwd ldap &>/dev/null || \ useradd -r -g ldap -u 55 -d %{_sharedstatedir}/ldap -s /sbin/nologin -c "OpenLDAP server" ldap @@ -480,6 +491,7 @@ exit 0 %{_mandir}/man5/slapd*.5* %{_mandir}/man5/slapo-*.5* %{_mandir}/man5/slappw-argon2.5* +%{_sysusersdir}/openldap.conf # obsolete configuration %ghost %config(noreplace,missingok) %attr(0640,ldap,ldap) %{_sysconfdir}/openldap/slapd.conf @@ -504,6 +516,12 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Fri Feb 9 2024 Simon Pichugin - 2.6.7-1 +- Rebase to version 2.6.7 (rhbz#2261163) +- Use systemd-sysusers for ldap user and group (rhbz#2173965) +- Fix compiler errors (rhbz#2261427) +- Replace License with SPDX identifier + * Thu Jan 25 2024 Fedora Release Engineering - 2.6.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/openldap.sysusers b/openldap.sysusers new file mode 100644 index 0000000..37ef083 --- /dev/null +++ b/openldap.sysusers @@ -0,0 +1,3 @@ +#Type Name ID GECOS Home directory Shell +g ldap 55 +u ldap 55:55 "OpenLDAP server" /var/lib/ldap /sbin/nologin diff --git a/sources b/sources index f38b7f6..d27ec13 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc -SHA512 (openldap-2.6.6.tgz) = 0e800807b23f090b465dc18c2f0d342585f96768543b3298b85d17c18272d1c5576a66326d30b3520cac493cbd2ea70e309cd923bf19447c973a63d940619fa6 +SHA512 (openldap-2.6.7.tgz) = ea207b84fdb7bc6cdff2bc1201fcdde6a907f5766f9637589d956ca86ecf61d4e732ab7d80f33b18b691644e1f5fa39b00ff2c7f4084c9b85760ee693a7c451e From ab6180a2bf698bcacb39872b976f8c1ac46a75f6 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 22 May 2024 16:18:32 -0700 Subject: [PATCH 10/29] Rebase to version 2.6.8 Resolves: rhbz#2282258 --- .gitignore | 1 + openldap.spec | 10 +++++----- sources | 2 +- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 3feae2b..eab66c2 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ /openldap-2.6.5.tgz /openldap-2.6.6.tgz /openldap-2.6.7.tgz +/openldap-2.6.8.tgz diff --git a/openldap.spec b/openldap.spec index 9398229..f2e3f8e 100644 --- a/openldap.spec +++ b/openldap.spec @@ -13,7 +13,7 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.7 +Version: 2.6.8 Release: 1%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 @@ -47,8 +47,6 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # System-wide default for CA certs Patch7: openldap-openssl-manpage-defaultCA.patch Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch -Patch9: openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch -Patch10: openldap-explicitly-cast-private-values.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -159,8 +157,6 @@ pushd openldap-%{version} %patch -P6 -p1 %patch -P7 -p1 %patch -P8 -p1 -%patch -P9 -p1 -%patch -P10 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -469,6 +465,7 @@ exit 0 %{_libdir}/openldap/home* %{_libdir}/openldap/lloadd* %{_libdir}/openldap/memberof* +%{_libdir}/openldap/nestgroup* %{_libdir}/openldap/otp* %{_libdir}/openldap/pcache* %{_libdir}/openldap/ppolicy* @@ -516,6 +513,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Wed May 22 2024 Simon Pichugin - 2.6.8-1 +- Rebase to version 2.6.8 (rhbz#2282258) + * Fri Feb 9 2024 Simon Pichugin - 2.6.7-1 - Rebase to version 2.6.7 (rhbz#2261163) - Use systemd-sysusers for ldap user and group (rhbz#2173965) diff --git a/sources b/sources index d27ec13..a2fd447 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc -SHA512 (openldap-2.6.7.tgz) = ea207b84fdb7bc6cdff2bc1201fcdde6a907f5766f9637589d956ca86ecf61d4e732ab7d80f33b18b691644e1f5fa39b00ff2c7f4084c9b85760ee693a7c451e +SHA512 (openldap-2.6.8.tgz) = c86bda8a0af2645e586d56a1494a5bd486ec5dd55c47859dbabcc2bb6ddc0a8307e23c6b58228d49ee3c8bc5e4d6ead305863442efdcee3dc2ab9953097b5a77 From 4b367ea030297d67a9b2331505d45979ef2c19e3 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Tue, 11 Jun 2024 06:11:22 +0200 Subject: [PATCH 11/29] Perl 5.40 rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index f2e3f8e..95c3909 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.8 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -513,6 +513,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Tue Jun 11 2024 Jitka Plesnikova - 2.6.8-2 +- Perl 5.40 rebuild + * Wed May 22 2024 Simon Pichugin - 2.6.8-1 - Rebase to version 2.6.8 (rhbz#2282258) From 4ca5a77fa5da246b02d92eb86bb1e5172772a0be Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Mon, 24 Jun 2024 13:47:39 -0400 Subject: [PATCH 12/29] Disable libslapi and servers in RHEL builds Based on c10s: https://gitlab.com/redhat/centos-stream/rpms/openldap/-/merge_requests/19 --- openldap.spec | 61 ++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 55 insertions(+), 6 deletions(-) diff --git a/openldap.spec b/openldap.spec index 95c3909..7feff4d 100644 --- a/openldap.spec +++ b/openldap.spec @@ -6,6 +6,9 @@ %global so_ver 2 %global so_ver_compat 2 +# Build openldap-servers package and its libslapi in openldap-devel and openldap-compat +%bcond servers %{undefined rhel} + # When you change "Version: " to the new major version, remember to change this value too %global major_version 2.6 @@ -14,7 +17,7 @@ Name: openldap Version: 2.6.8 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -52,6 +55,7 @@ Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch Patch90: check-password-makefile.patch Patch91: check-password.patch +BuildRequires: cracklib-devel BuildRequires: cyrus-sasl-devel BuildRequires: gcc BuildRequires: glibc-devel @@ -65,6 +69,8 @@ BuildRequires: perl(ExtUtils::Embed) BuildRequires: perl-devel BuildRequires: perl-generators BuildRequires: perl-interpreter +BuildRequires: systemd +BuildRequires: systemd-rpm-macros BuildRequires: unixODBC-devel %description @@ -97,29 +103,35 @@ Requires: openldap%{?_isa} = %{version}-%{release} Provides: libldap-2.4.so.%{so_ver_compat} Provides: libldap_r-2.4.so.%{so_ver_compat} Provides: liblber-2.4.so.%{so_ver_compat} +%if %{with servers} Provides: libslapi-2.4.so.%{so_ver_compat} +%endif %else Provides: libldap-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) Provides: libldap_r-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) Provides: liblber-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) +%if %{with servers} Provides: libslapi-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) %endif +%endif %description compat The openldap-compat package contains shared libraries named as libldap-2.4.so, +%if %{with servers} libldap_r-2.4.so, liblber-2.4.so and libslapi-2.4.so. +%else +libldap_r-2.4.so and liblber-2.4.so. +%endif The libraries are just links to the current version shared libraries, and are available for compatibility reasons. +%if %{with servers} %package servers Summary: LDAP server License: OpenLDAP Requires: openldap%{?_isa} = %{version}-%{release} Requires(pre): shadow-utils -BuildRequires: systemd -BuildRequires: systemd-rpm-macros %{?sysusers_requires_compat} -BuildRequires: cracklib-devel # migrationtools (slapadd functionality): Provides: ldif2ldbm %{?systemd_requires} @@ -131,6 +143,7 @@ protocols for accessing directory services (usually phone book style information, but other information is possible) over the Internet, similar to the way DNS (Domain Name System) information is propagated over the Internet. This package contains the slapd server and related files. +%endif %package clients Summary: LDAP client utilities @@ -202,7 +215,9 @@ pushd openldap-%{version} --enable-perl \ --enable-rewrite \ --enable-rlookups \ +%if %{with servers} --enable-slapi \ +%endif --disable-slp \ \ --enable-backends=mod \ @@ -240,7 +255,9 @@ popd %install mkdir -p %{buildroot}%{_libdir}/ +%if %{with servers} install -p -D -m 0644 %{SOURCE6} %{buildroot}%{_sysusersdir}/openldap.conf +%endif pushd openldap-%{version} %make_install STRIP_OPTS="" @@ -313,7 +330,7 @@ done pushd %{buildroot}%{_libdir} v=%{version} version=$(echo ${v%.[0-9]*}) -for lib in liblber libldap libslapi; do +for lib in liblber libldap %{?with_servers:libslapi}; do rm -f ${lib}.so ln -s ${lib}.so.%{so_ver} ${lib}.so done @@ -339,12 +356,14 @@ gcc -shared -o "%{buildroot}%{_libdir}/libldap_r-2.4.so.${so_ver_short_2_4}" -Wl -Wl,-soname -Wl,libldap_r-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -lldap gcc -shared -o "%{buildroot}%{_libdir}/liblber-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ -Wl,-soname -Wl,liblber-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -llber +%if %{with servers} gcc -shared -o "%{buildroot}%{_libdir}/libslapi-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ -Wl,-soname -Wl,libslapi-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -lslapi +ln -s libslapi-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} +%endif ln -s libldap-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} ln -s libldap_r-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} ln -s liblber-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} -ln -s libslapi-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} popd @@ -370,6 +389,8 @@ rm %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/ope %ldconfig_scriptlets +%if %{with servers} + %pre servers # create ldap user and group # sysusers.d format https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format @@ -411,6 +432,8 @@ exit 0 %postun servers %systemd_postun_with_restart slapd.service +%endif + %files %doc openldap-%{version}/ANNOUNCEMENT %doc openldap-%{version}/CHANGES @@ -423,10 +446,13 @@ exit 0 %dir %{_libexecdir}/openldap/ %{_libdir}/liblber.so.* %{_libdir}/libldap.so.* +%if %{with servers} %{_libdir}/libslapi.so.* +%endif %{_mandir}/man5/ldif.5* %{_mandir}/man5/ldap.conf.5* +%if %{with servers} %files servers %doc openldap-%{version}/contrib/slapd-modules/smbk5pwd/README.smbk5pwd %doc openldap-%{version}/doc/guide/admin/*.html @@ -491,6 +517,22 @@ exit 0 %{_sysusersdir}/openldap.conf # obsolete configuration %ghost %config(noreplace,missingok) %attr(0640,ldap,ldap) %{_sysconfdir}/openldap/slapd.conf +%else +%exclude %{_datadir}/openldap-servers/ +%exclude %{_libdir}/openldap/ +%exclude %{_libexecdir}/openldap/check-config.sh +%exclude %{_libexecdir}/openldap/functions +%exclude %{_mandir}/man5/slapd*.5* +%exclude %{_mandir}/man5/slapo-*.5* +%exclude %{_mandir}/man5/lloadd.conf.5* +%exclude %{_mandir}/man5/slappw-argon2.5* +%exclude %{_mandir}/man8/* +%exclude %{_sbindir}/sl* +%exclude %{_sysconfdir}/openldap/check_password.conf +%exclude %{_sysconfdir}/openldap/schema +%exclude %{_tmpfilesdir}/slapd.conf +%exclude %{_unitdir}/slapd.service +%endif %files clients %{_bindir}/* @@ -500,7 +542,9 @@ exit 0 %doc openldap-%{version}/doc/drafts openldap-%{version}/doc/rfc %{_libdir}/liblber.so %{_libdir}/libldap.so +%if %{with servers} %{_libdir}/libslapi.so +%endif %{_includedir}/* %{_libdir}/pkgconfig/lber.pc %{_libdir}/pkgconfig/ldap.pc @@ -510,9 +554,14 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %{_libdir}/libldap_r-2.4*.so.* %{_libdir}/liblber-2.4*.so.* +%if %{with servers} %{_libdir}/libslapi-2.4*.so.* +%endif %changelog +* Mon Jun 24 2024 Yaakov Selkowitz - 2.6.8-3 +- Disable libslapi and servers in RHEL builds + * Tue Jun 11 2024 Jitka Plesnikova - 2.6.8-2 - Perl 5.40 rebuild From 1f131f51e61c306c75a9cd07cee9239cb45d813e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 20:54:33 +0000 Subject: [PATCH 13/29] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 7feff4d..c3ed74e 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.8 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -559,6 +559,9 @@ exit 0 %endif %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 2.6.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Mon Jun 24 2024 Yaakov Selkowitz - 2.6.8-3 - Disable libslapi and servers in RHEL builds From 126d88e16b0e194111a70571223f392ad0d197f5 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 17 Jul 2024 11:02:43 -0700 Subject: [PATCH 14/29] Clean up spec file so it's aligned with c10s Remove UPGRADE_INSTRUCTIONS for openldap-server upgrade Resolves: rhbz#2133526 --- libexec-check-config.sh | 12 ----------- openldap.spec | 47 ++++++++++++++++++----------------------- 2 files changed, 21 insertions(+), 38 deletions(-) diff --git a/libexec-check-config.sh b/libexec-check-config.sh index de6f3a8..16f43ea 100755 --- a/libexec-check-config.sh +++ b/libexec-check-config.sh @@ -52,16 +52,6 @@ function check_db_perms() return $retcode } -function check_major_upgrade() -{ - retcode=0 - if [ -f "/usr/share/openldap-servers/UPGRADE_INSTRUCTIONS" ]; then - error "You have upgraded your openldap-servers package. There are actions that need to be performed. Please, read the /usr/share/openldap-servers/UPGRADE_INSTRUCTIONS file" - retcode=1 - fi - return $retcode -} - function check_everything() { retcode=0 @@ -76,8 +66,6 @@ if [ `id -u` -ne 0 ]; then exit 4 fi -check_major_upgrade || return 1 - load_sysconfig if [ -n "$SLAPD_CONFIG_DIR" ]; then diff --git a/openldap.spec b/openldap.spec index c3ed74e..a8c3b02 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ %global so_ver_compat 2 # Build openldap-servers package and its libslapi in openldap-devel and openldap-compat -%bcond servers %{undefined rhel} +%bcond servers 1 # When you change "Version: " to the new major version, remember to change this value too %global major_version 2.6 @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.8 -Release: 4%{?dist} +Release: 5%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -27,7 +27,6 @@ Source1: slapd.service Source2: slapd.tmpfiles Source3: slapd.ldif Source4: ldap.conf -Source5: UPGRADE_INSTRUCTIONS Source6: openldap.sysusers Source10: https://github.com/ltb-project/openldap-ppolicy-check-password/archive/v%{check_password_version}/openldap-ppolicy-check-password-%{check_password_version}.tar.gz Source50: libexec-functions @@ -55,7 +54,6 @@ Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch Patch90: check-password-makefile.patch Patch91: check-password.patch -BuildRequires: cracklib-devel BuildRequires: cyrus-sasl-devel BuildRequires: gcc BuildRequires: glibc-devel @@ -69,9 +67,11 @@ BuildRequires: perl(ExtUtils::Embed) BuildRequires: perl-devel BuildRequires: perl-generators BuildRequires: perl-interpreter +BuildRequires: unixODBC-devel +BuildRequires: cracklib-devel BuildRequires: systemd BuildRequires: systemd-rpm-macros -BuildRequires: unixODBC-devel +%{?sysusers_requires_compat} %description OpenLDAP is an open source suite of LDAP (Lightweight Directory Access @@ -120,7 +120,7 @@ The openldap-compat package contains shared libraries named as libldap-2.4.so, %if %{with servers} libldap_r-2.4.so, liblber-2.4.so and libslapi-2.4.so. %else -libldap_r-2.4.so and liblber-2.4.so. +libldap_r-2.4.so and liblber-2.4.so %endif The libraries are just links to the current version shared libraries, and are available for compatibility reasons. @@ -130,11 +130,10 @@ and are available for compatibility reasons. Summary: LDAP server License: OpenLDAP Requires: openldap%{?_isa} = %{version}-%{release} +%{?systemd_requires} Requires(pre): shadow-utils -%{?sysusers_requires_compat} # migrationtools (slapadd functionality): Provides: ldif2ldbm -%{?systemd_requires} %description servers OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access @@ -143,6 +142,7 @@ protocols for accessing directory services (usually phone book style information, but other information is possible) over the Internet, similar to the way DNS (Domain Name System) information is propagated over the Internet. This package contains the slapd server and related files. +# endif servers %endif %package clients @@ -198,7 +198,7 @@ popd %set_build_flags # enable experimental support for LDAP over UDP (LDAP_CONNECTIONLESS) -export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -DLDAP_CONNECTIONLESS" +export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -Wl,-z,now -DLDAP_CONNECTIONLESS" pushd openldap-%{version} %configure \ @@ -349,16 +349,16 @@ for lib in $(ls | grep libldap); do done # Provide only libldap and copy it to libldap_r for both 2.4 and 2.6+ versions, make a versioned lib link -# We increase it by 2 because libldap-2.4 has the 'so.2' major version on 2.4.59 (one of the last versions which is EOF) +# We increase it by 2 because libldap-2.4 has the 'so.2' major version on 2.4.59 (one of the last versions which is EOL) gcc -shared -o "%{buildroot}%{_libdir}/libldap-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ - -Wl,-soname -Wl,libldap-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -lldap + -Wl,-soname -Wl,libldap-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -lldap gcc -shared -o "%{buildroot}%{_libdir}/libldap_r-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ - -Wl,-soname -Wl,libldap_r-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -lldap + -Wl,-soname -Wl,libldap_r-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -lldap gcc -shared -o "%{buildroot}%{_libdir}/liblber-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ - -Wl,-soname -Wl,liblber-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -llber + -Wl,-soname -Wl,liblber-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -llber %if %{with servers} gcc -shared -o "%{buildroot}%{_libdir}/libslapi-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ - -Wl,-soname -Wl,libslapi-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -lslapi + -Wl,-soname -Wl,libslapi-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -lslapi ln -s libslapi-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} %endif ln -s libldap-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} @@ -376,7 +376,6 @@ chmod 0644 %{buildroot}%{_libdir}/openldap/*.la mkdir -p %{buildroot}%{_datadir} install -m 0755 -d %{buildroot}%{_datadir}/openldap-servers install -m 0644 %SOURCE3 %{buildroot}%{_datadir}/openldap-servers/slapd.ldif -install -m 0644 %SOURCE5 %{buildroot}%{_datadir}/openldap-servers/UPGRADE_INSTRUCTIONS install -m 0700 -d %{buildroot}%{_sysconfdir}/openldap/slapd.d rm %{buildroot}%{_sysconfdir}/openldap/slapd.conf rm %{buildroot}%{_sysconfdir}/openldap/slapd.ldif @@ -390,24 +389,14 @@ rm %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/ope %ldconfig_scriptlets %if %{with servers} - %pre servers # create ldap user and group # sysusers.d format https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format %sysusers_create_compat %{SOURCE6} -getent group ldap &>/dev/null || groupadd -r -g 55 ldap -getent passwd ldap &>/dev/null || \ - useradd -r -g ldap -u 55 -d %{_sharedstatedir}/ldap -s /sbin/nologin -c "OpenLDAP server" ldap -exit 0 - %post servers %systemd_post slapd.service -# If it's not upgrade - we remove the UPGRADE_INSTRUCTIONS -if [ $1 -lt 2 ] ; then - rm %{_datadir}/openldap-servers/UPGRADE_INSTRUCTIONS -fi # generate configuration if necessary if [[ ! -f %{_sysconfdir}/openldap/slapd.d/cn=config.ldif && \ ! -f %{_sysconfdir}/openldap/slapd.conf @@ -431,8 +420,8 @@ exit 0 %postun servers %systemd_postun_with_restart slapd.service - %endif +# endif servers %files %doc openldap-%{version}/ANNOUNCEMENT @@ -533,6 +522,8 @@ exit 0 %exclude %{_tmpfilesdir}/slapd.conf %exclude %{_unitdir}/slapd.service %endif +# endif servers + %files clients %{_bindir}/* @@ -559,6 +550,10 @@ exit 0 %endif %changelog +* Tue Jul 23 2024 Simon Pichugin - 2.6.8-5 +- Clean up spec file so it's aligned with c10s +- Remove UPGRADE_INSTRUCTIONS for openldap-server upgrade (rhbz#2133526) + * Thu Jul 18 2024 Fedora Release Engineering - 2.6.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 02f7821806558079ae326bbdd786838befe277b5 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 27 Nov 2024 16:41:40 -0800 Subject: [PATCH 15/29] Avoid SSL context cleanup during library destruction --- ...L-context-cleanup-during-library-des.patch | 92 +++++++++++++++++++ openldap.spec | 7 +- 2 files changed, 98 insertions(+), 1 deletion(-) create mode 100644 openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch diff --git a/openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch b/openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch new file mode 100644 index 0000000..3663f3f --- /dev/null +++ b/openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch @@ -0,0 +1,92 @@ +From 5f4569f0605a73eb1a282ee5251ead073ed3b26e Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Tue, 26 Nov 2024 12:32:07 -0800 +Subject: [PATCH] libldap: avoid SSL context cleanup during library destruction + +Given that libldap can be pulled into random applications and applications +are allowed to call OPENSSL_cleanup() before exiting, the only sane thing +to do is to avoid trying to touch SSL context in ldap destructors, and just +let them leak if the application does not explicitly free the ldap context. + +Add ldap_int_tls_destroy_safe() which skips SSL context cleanup while +maintaining all other cleanup operations, and use it in the library +destructor path. + +Fixes: https://bugs.openldap.org/show_bug.cgi?id=9952 +--- + libraries/libldap/init.c | 2 +- + libraries/libldap/ldap-int.h | 1 + + libraries/libldap/tls2.c | 25 +++++++++++++++++++++---- + 3 files changed, 23 insertions(+), 5 deletions(-) + +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 213276b4b5..aa017f4128 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -545,7 +545,7 @@ ldap_int_destroy_global_options(void) + } + #endif + #ifdef HAVE_TLS +- ldap_int_tls_destroy( gopts ); ++ ldap_int_tls_destroy_safe( gopts ); + #endif + } + +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 7e754775e8..b73097ccc7 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -914,6 +914,7 @@ LDAP_F (int) ldap_int_tls_start LDAP_P(( LDAP *ld, + LDAPConn *conn, LDAPURLDesc *srv )); + + LDAP_F (void) ldap_int_tls_destroy LDAP_P(( struct ldapoptions *lo )); ++LDAP_F (void) ldap_int_tls_destroy_safe LDAP_P(( struct ldapoptions *lo )); + + /* + * in getvalues.c +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 0841005a59..82f8573602 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -97,10 +97,14 @@ tls_ctx_ref( tls_ctx *ctx ) + static ldap_pvt_thread_mutex_t tls_def_ctx_mutex; + #endif + +-void +-ldap_int_tls_destroy( struct ldapoptions *lo ) +-{ +- if ( lo->ldo_tls_ctx ) { ++/* ++ * Implementation function that handles all cleanup. ++ * skip_ctx_cleanup: 1 when called from destructor, 0 for normal operation ++ */ ++static void ++ldap_int_tls_destroy_impl( struct ldapoptions *lo, int skip_ctx_cleanup ) ++ { ++ if ( lo->ldo_tls_ctx && !skip_ctx_cleanup ) { + ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx ); + lo->ldo_tls_ctx = NULL; + } +@@ -147,6 +151,19 @@ ldap_int_tls_destroy( struct ldapoptions *lo ) + BER_BVZERO( &lo->ldo_tls_pin ); + } + ++ ++void ++ldap_int_tls_destroy( struct ldapoptions *lo ) ++{ ++ ldap_int_tls_destroy_impl(lo, 0); ++} ++ ++/* Safe version for destructor use */ ++void ldap_int_tls_destroy_safe( struct ldapoptions *lo ) ++{ ++ ldap_int_tls_destroy_impl(lo, 1); ++} ++ + /* + * Tear down the TLS subsystem. Should only be called once. + */ +-- +2.47.0 + diff --git a/openldap.spec b/openldap.spec index a8c3b02..9da5369 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.8 -Release: 5%{?dist} +Release: 6%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -49,6 +49,7 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # System-wide default for CA certs Patch7: openldap-openssl-manpage-defaultCA.patch Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch +Patch9: openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -170,6 +171,7 @@ pushd openldap-%{version} %patch -P6 -p1 %patch -P7 -p1 %patch -P8 -p1 +%patch -P9 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -550,6 +552,9 @@ exit 0 %endif %changelog +* Tue Dec 3 2024 Simon Pichugin - 2.6.8-6 +- Avoid SSL context cleanup during library destruction + * Tue Jul 23 2024 Simon Pichugin - 2.6.8-5 - Clean up spec file so it's aligned with c10s - Remove UPGRADE_INSTRUCTIONS for openldap-server upgrade (rhbz#2133526) From eb3554276019edf9fc22f57e6b4d6984443db3a6 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Thu, 9 Jan 2025 19:35:57 -0800 Subject: [PATCH 16/29] Rebase to version 2.6.9 Resolves: rhbz#2329002 --- .gitignore | 1 + openldap.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index eab66c2..400752c 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,4 @@ /openldap-2.6.6.tgz /openldap-2.6.7.tgz /openldap-2.6.8.tgz +/openldap-2.6.9.tgz diff --git a/openldap.spec b/openldap.spec index 9da5369..e1506b8 100644 --- a/openldap.spec +++ b/openldap.spec @@ -16,8 +16,8 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.8 -Release: 6%{?dist} +Version: 2.6.9 +Release: 1%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -552,6 +552,9 @@ exit 0 %endif %changelog +* Thu Jan 9 2025 Simon Pichugin - 2.6.9-1 +- Rebase to version 2.6.9 (rhbz#2329002) + * Tue Dec 3 2024 Simon Pichugin - 2.6.8-6 - Avoid SSL context cleanup during library destruction diff --git a/sources b/sources index a2fd447..51594b5 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc -SHA512 (openldap-2.6.8.tgz) = c86bda8a0af2645e586d56a1494a5bd486ec5dd55c47859dbabcc2bb6ddc0a8307e23c6b58228d49ee3c8bc5e4d6ead305863442efdcee3dc2ab9953097b5a77 +SHA512 (openldap-2.6.9.tgz) = d3f839d3cf1030caa410e54f968e9c0caf3bc371c06ea0f64cf3a6ece6d31013c9dbfb08a3a63ea9137a2062aa6edc6e0bc542b365fe4ad66608df4cdbe94a4e From d9bd47979f15efb53dc317d5eb358c830d413e79 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Thu, 16 Jan 2025 15:46:54 -0800 Subject: [PATCH 17/29] Disable MD2 hash algorithm Resolves: rhbz#2338556 --- openldap.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index e1506b8..275c5f9 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.9 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -201,6 +201,8 @@ popd %set_build_flags # enable experimental support for LDAP over UDP (LDAP_CONNECTIONLESS) export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -Wl,-z,now -DLDAP_CONNECTIONLESS" +# disable legacy hash algorithm +export CFLAGS="${CFLAGS} -DOPENSSL_NO_MD2" pushd openldap-%{version} %configure \ @@ -552,6 +554,9 @@ exit 0 %endif %changelog +* Thu Jan 16 2025 Simon Pichugin - 2.6.9-2 +- Disable MD2 hash algorithm (rhbz#2338556) + * Thu Jan 9 2025 Simon Pichugin - 2.6.9-1 - Rebase to version 2.6.9 (rhbz#2329002) From 5aabe4c7d9c94c706ae5e9cae71c07f37478ad68 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Fri, 24 Jan 2025 06:53:11 +0000 Subject: [PATCH 18/29] Remove license of subpackage This license is not in SPDX format. But the license is the same as the main package and when the subpackage does not specify a license then the license is inherited from the main package. --- openldap.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 275c5f9..decc8f7 100644 --- a/openldap.spec +++ b/openldap.spec @@ -129,7 +129,6 @@ and are available for compatibility reasons. %if %{with servers} %package servers Summary: LDAP server -License: OpenLDAP Requires: openldap%{?_isa} = %{version}-%{release} %{?systemd_requires} Requires(pre): shadow-utils From 7fec13e914c2ee79a16818be9c416f81a235fbcc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 24 Jan 2025 14:13:23 +0100 Subject: [PATCH 19/29] Adjust file patterns for the sbin merge %{_sbindir}/* and %{_bindir}/* are now the same, so both subpackages would have the same set of binaries. Switch to narrower globs to avoid inadvertent matches. --- openldap.spec | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/openldap.spec b/openldap.spec index decc8f7..97ac50c 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.9 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -500,12 +500,13 @@ exit 0 %{_libdir}/openldap/valsort* %{_libexecdir}/openldap/functions %{_libexecdir}/openldap/check-config.sh -%{_sbindir}/sl* -%{_mandir}/man8/* +%{_sbindir}/slap* %{_mandir}/man5/lloadd.conf.5* +%{_mandir}/man8/lloadd.8* %{_mandir}/man5/slapd*.5* %{_mandir}/man5/slapo-*.5* %{_mandir}/man5/slappw-argon2.5* +%{_mandir}/man8/slap*.8* %{_sysusersdir}/openldap.conf # obsolete configuration %ghost %config(noreplace,missingok) %attr(0640,ldap,ldap) %{_sysconfdir}/openldap/slapd.conf @@ -519,7 +520,7 @@ exit 0 %exclude %{_mandir}/man5/lloadd.conf.5* %exclude %{_mandir}/man5/slappw-argon2.5* %exclude %{_mandir}/man8/* -%exclude %{_sbindir}/sl* +%exclude %{_sbindir}/slap* %exclude %{_sysconfdir}/openldap/check_password.conf %exclude %{_sysconfdir}/openldap/schema %exclude %{_tmpfilesdir}/slapd.conf @@ -529,8 +530,8 @@ exit 0 %files clients -%{_bindir}/* -%{_mandir}/man1/* +%{_bindir}/ldap* +%{_mandir}/man1/ldap*.1* %files devel %doc openldap-%{version}/doc/drafts openldap-%{version}/doc/rfc @@ -553,6 +554,9 @@ exit 0 %endif %changelog +* Fri Jan 24 2025 Zbigniew Jędrzejewski-Szmek - 2.6.9-3 +- Adjust file patterns for the sbin merge + * Thu Jan 16 2025 Simon Pichugin - 2.6.9-2 - Disable MD2 hash algorithm (rhbz#2338556) From e9b2e83facf02f5dbe1d54c98b5ad4a9f533a85c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 1 Feb 2025 19:56:12 +0100 Subject: [PATCH 20/29] Add explicit BR: libxcrypt-devel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- openldap.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 97ac50c..60c7adc 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.9 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -62,6 +62,7 @@ BuildRequires: groff BuildRequires: krb5-devel BuildRequires: libtool-ltdl-devel BuildRequires: libevent-devel +BuildRequires: libxcrypt-devel BuildRequires: make BuildRequires: openssl-devel BuildRequires: perl(ExtUtils::Embed) @@ -554,6 +555,9 @@ exit 0 %endif %changelog +* Sat Feb 01 2025 Björn Esser - 2.6.9-4 +- Add explicit BR: libxcrypt-devel + * Fri Jan 24 2025 Zbigniew Jędrzejewski-Szmek - 2.6.9-3 - Adjust file patterns for the sbin merge From 4335fd47456672761b3c0ca48e52a61a67d50051 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 11 Feb 2025 17:44:44 +0100 Subject: [PATCH 21/29] Drop call to %sysusers_create_compat After https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers, rpm will handle account creation automatically. --- openldap.spec | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/openldap.spec b/openldap.spec index 60c7adc..a137974 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.9 -Release: 4%{?dist} +Release: 5%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -73,7 +73,6 @@ BuildRequires: unixODBC-devel BuildRequires: cracklib-devel BuildRequires: systemd BuildRequires: systemd-rpm-macros -%{?sysusers_requires_compat} %description OpenLDAP is an open source suite of LDAP (Lightweight Directory Access @@ -132,7 +131,6 @@ and are available for compatibility reasons. Summary: LDAP server Requires: openldap%{?_isa} = %{version}-%{release} %{?systemd_requires} -Requires(pre): shadow-utils # migrationtools (slapadd functionality): Provides: ldif2ldbm @@ -393,10 +391,6 @@ rm %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/ope %ldconfig_scriptlets %if %{with servers} -%pre servers -# create ldap user and group -# sysusers.d format https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format -%sysusers_create_compat %{SOURCE6} %post servers %systemd_post slapd.service @@ -555,6 +549,9 @@ exit 0 %endif %changelog +* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 2.6.9-5 +- Drop call to %sysusers_create_compat + * Sat Feb 01 2025 Björn Esser - 2.6.9-4 - Add explicit BR: libxcrypt-devel From 51354adeb8958afd5039e8f6b4a2ea83c04b6769 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Tue, 10 Jun 2025 15:35:12 -0700 Subject: [PATCH 22/29] Rebase to version 2.6.10 Resolves: rhbz#2368103 --- .gitignore | 1 + openldap-manpages.patch | 31 ++++++++----------------------- openldap.spec | 7 +++++-- sources | 2 +- 4 files changed, 15 insertions(+), 26 deletions(-) diff --git a/.gitignore b/.gitignore index 400752c..50fa4b0 100644 --- a/.gitignore +++ b/.gitignore @@ -41,3 +41,4 @@ /openldap-2.6.7.tgz /openldap-2.6.8.tgz /openldap-2.6.9.tgz +/openldap-2.6.10.tgz diff --git a/openldap-manpages.patch b/openldap-manpages.patch index df0d879..2303570 100644 --- a/openldap-manpages.patch +++ b/openldap-manpages.patch @@ -1,35 +1,20 @@ Various manual pages changes: * removes LIBEXECDIR from slapd.8 -* removes references to non-existing manpages (bz 624616) -diff --git a/doc/man/man1/ldapmodify.1 b/doc/man/man1/ldapmodify.1 -index 353b075..cf37856 100644 ---- a/doc/man/man1/ldapmodify.1 -+++ b/doc/man/man1/ldapmodify.1 -@@ -382,8 +382,7 @@ exit status and a diagnostic message being written to standard error. - .BR ldap_add_ext (3), - .BR ldap_delete_ext (3), - .BR ldap_modify_ext (3), --.BR ldap_modrdn_ext (3), --.BR ldif (5). -+.BR ldif (5) - .SH AUTHOR - The OpenLDAP Project - .SH ACKNOWLEDGEMENTS diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 -index 17b7154..6084298 100644 +index d47481d6ed..ff86fc52ca 100644 --- a/doc/man/man5/ldap.conf.5 +++ b/doc/man/man5/ldap.conf.5 -@@ -338,6 +338,7 @@ certificates in separate individual files. The +@@ -341,6 +341,7 @@ be specified, separated by a semi-colon. The .B TLS_CACERT is always used before - .B TLS_CACERTDIR. + .BR TLS_CACERTDIR . +The specified directory must be managed with the OpenSSL c_rehash utility. .TP .B TLS_CERT Specifies the file that contains the client certificate. diff --git a/doc/man/man8/slapd.8 b/doc/man/man8/slapd.8 -index 8504b37..f02f1fa 100644 +index 807634e52d..a06110687b 100644 --- a/doc/man/man8/slapd.8 +++ b/doc/man/man8/slapd.8 @@ -5,7 +5,7 @@ @@ -41,16 +26,16 @@ index 8504b37..f02f1fa 100644 [\c .BR \-V [ V [ V ]] [\c -@@ -332,7 +332,7 @@ the LDAP databases defined in the default config file, just type: +@@ -333,7 +333,7 @@ the LDAP databases defined in the default config file, just type: .LP .nf .ft tt - LIBEXECDIR/slapd -+ slapd ++ slapd .ft .fi .LP -@@ -343,7 +343,7 @@ on voluminous debugging which will be printed on standard error, type: +@@ -344,7 +344,7 @@ on voluminous debugging which will be printed on standard error, type: .LP .nf .ft tt @@ -59,7 +44,7 @@ index 8504b37..f02f1fa 100644 .ft .fi .LP -@@ -351,7 +351,7 @@ To test whether the configuration file is correct or not, type: +@@ -352,7 +352,7 @@ To test whether the configuration file is correct or not, type: .LP .nf .ft tt diff --git a/openldap.spec b/openldap.spec index a137974..6ca9d24 100644 --- a/openldap.spec +++ b/openldap.spec @@ -16,8 +16,8 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.9 -Release: 5%{?dist} +Version: 2.6.10 +Release: 1%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -549,6 +549,9 @@ exit 0 %endif %changelog +* Tue Jun 10 2025 Simon Pichugin - 2.6.10-1 +- Rebase to version 2.6.10 (rhbz#2368103) + * Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 2.6.9-5 - Drop call to %sysusers_create_compat diff --git a/sources b/sources index 51594b5..0b0bd67 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc -SHA512 (openldap-2.6.9.tgz) = d3f839d3cf1030caa410e54f968e9c0caf3bc371c06ea0f64cf3a6ece6d31013c9dbfb08a3a63ea9137a2062aa6edc6e0bc542b365fe4ad66608df4cdbe94a4e +SHA512 (openldap-2.6.10.tgz) = 18129ad9a385457941e3203de5f130fe2571701abf24592c5beffb01361aae3182c196b2cd48ffeecb792b9b0e5f82c8d92445a7ec63819084757bdedba63b20 From 0b7f700e16e76c6e8ddcf68e4575ccbcd4daa578 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Mon, 7 Jul 2025 16:19:49 +0200 Subject: [PATCH 23/29] Perl 5.42 rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 6ca9d24..56bbbd9 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.10 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -549,6 +549,9 @@ exit 0 %endif %changelog +* Mon Jul 07 2025 Jitka Plesnikova - 2.6.10-2 +- Perl 5.42 rebuild + * Tue Jun 10 2025 Simon Pichugin - 2.6.10-1 - Rebase to version 2.6.10 (rhbz#2368103) From 529c3466fbfdf965e83ec949813e59faff45b368 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 23:37:09 +0000 Subject: [PATCH 24/29] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 56bbbd9..6fa90d4 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.10 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -549,6 +549,9 @@ exit 0 %endif %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 2.6.10-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Mon Jul 07 2025 Jitka Plesnikova - 2.6.10-2 - Perl 5.42 rebuild From b6036115c7fbb03d78675c42f2a252672f99e1bd Mon Sep 17 00:00:00 2001 From: Viktor Ashirov Date: Thu, 28 Aug 2025 13:23:00 +0200 Subject: [PATCH 25/29] Convert STI tests to FMF Resolves: rhbz#2382998 openldap: STI tests will no longer be run in F43 --- .fmf/version | 1 + plans/gating.fmf | 8 +++++++ tests/smoke-test/Makefile | 24 +++++++++---------- tests/smoke-test/main.fmf | 31 ++++++++++++++++++++++++ tests/smoke-test/runtest.sh | 48 +++++++++++++------------------------ tests/tests.yml | 34 -------------------------- 6 files changed, 68 insertions(+), 78 deletions(-) create mode 100644 .fmf/version create mode 100644 plans/gating.fmf create mode 100644 tests/smoke-test/main.fmf delete mode 100644 tests/tests.yml diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plans/gating.fmf b/plans/gating.fmf new file mode 100644 index 0000000..387b7bf --- /dev/null +++ b/plans/gating.fmf @@ -0,0 +1,8 @@ +summary: Test plan for openldap + +discover: + how: fmf + +execute: + how: tmt + diff --git a/tests/smoke-test/Makefile b/tests/smoke-test/Makefile index 5a549be..322f5a5 100644 --- a/tests/smoke-test/Makefile +++ b/tests/smoke-test/Makefile @@ -46,7 +46,7 @@ clean: include /usr/share/rhts/lib/rhts-make.include $(METADATA): Makefile - @echo "Owner: Ondrej Moris " > $(METADATA) + @echo "Owner: Viktor Ashirov " > $(METADATA) @echo "Name: $(TEST)" >> $(METADATA) @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) @echo "Path: $(TEST_DIR)" >> $(METADATA) @@ -57,25 +57,23 @@ $(METADATA): Makefile @echo "Requires: openldap" >> $(METADATA) @echo "Requires: openldap-clients" >> $(METADATA) @echo "Requires: openldap-servers" >> $(METADATA) + @echo "Requires: nss-devel" >> $(METADATA) + @echo "Requires: cracklib-devel" >> $(METADATA) @echo "Requires: cyrus-sasl-devel" >> $(METADATA) @echo "Requires: gdbm-devel" >> $(METADATA) - @echo "Requires: libtool" >> $(METADATA) + @echo "Requires: groff" >> $(METADATA) @echo "Requires: krb5-devel" >> $(METADATA) + @echo "Requires: libdb-devel" >> $(METADATA) + @echo "Requires: libtool" >> $(METADATA) + @echo "Requires: libtool-ltdl-devel" >> $(METADATA) + @echo "Requires: nfs-utils" >> $(METADATA) @echo "Requires: openssl-devel" >> $(METADATA) @echo "Requires: pam-devel" >> $(METADATA) @echo "Requires: perl" >> $(METADATA) - @echo "Requires: pkgconfig" >> $(METADATA) - @echo "Requires: tcp_wrappers-devel" >> $(METADATA) - @echo "Requires: bind-libbind-devel" >> $(METADATA) - @echo "Requires: unixODBC-devel" >> $(METADATA) - @echo "Requires: libtool-ltdl-devel" >> $(METADATA) - @echo "Requires: nfs-utils" >> $(METADATA) - @echo "Requires: rpm-build" >> $(METADATA) - @echo "Requires: nss-devel" >> $(METADATA) - @echo "Requires: libdb-devel" >> $(METADATA) - @echo "Requires: groff" >> $(METADATA) - @echo "Requires: cracklib-devel" >> $(METADATA) @echo "Requires: perl-ExtUtils-Embed" >> $(METADATA) + @echo "Requires: pkgconfig" >> $(METADATA) + @echo "Requires: rpm-build" >> $(METADATA) + @echo "Requires: unixODBC-devel" >> $(METADATA) @echo "Requires: yum-utils" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/tests/smoke-test/main.fmf b/tests/smoke-test/main.fmf new file mode 100644 index 0000000..cc59f6b --- /dev/null +++ b/tests/smoke-test/main.fmf @@ -0,0 +1,31 @@ +summary: Test calls upstream test suite +description: Test calls upstream test suite +contact: Viktor Ashirov +component: + - openldap +test: ./runtest.sh +framework: beakerlib +recommend: + - openldap + - openldap-clients + - openldap-servers + - cracklib-devel + - cyrus-sasl-devel + - gdbm-devel + - groff + - krb5-devel + - libdb-devel + - libtool + - libtool-ltdl-devel + - nfs-utils + - nss-devel + - openssl-devel + - pam-devel + - perl + - perl-ExtUtils-Embed + - pkgconf-pkg-config + - pkgconfig + - rpm-build + - unixODBC-devel + - yum-utils +duration: 3h diff --git a/tests/smoke-test/runtest.sh b/tests/smoke-test/runtest.sh index 63c8ccc..bd1ebe6 100755 --- a/tests/smoke-test/runtest.sh +++ b/tests/smoke-test/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="openldap" @@ -45,58 +44,46 @@ PACKAGES=("openldap" \ "unixODBC-devel" \ "libtool-ltdl-devel" \ "nfs-utils" \ - "rpm-build" ) + "rpm-build" \ + "nss-devel" \ + "libdb-devel" \ + "groff" \ + "cracklib-devel" \ + "perl-ExtUtils-Embed"\ + "pkgconf-pkg-config" ) -if rlIsRHEL 5; then - PACKAGES=( ${PACKAGES[@]} "bind-libbind-devel" ) -elif rlIsRHEL 6; then - PACKAGES=( ${PACKAGES[@]} "tcp_wrappers-devel" ) -else - PACKAGES=( ${PACKAGES[@]} "tcp_wrappers-devel" "nss-devel" "libdb-devel" "groff" "cracklib-devel" "perl-ExtUtils-Embed" ) -fi -if rlIsFedora; then - PACKAGES=( ${PACKAGES[@]} "pkgconf-pkg-config" ) -else - PACKAGES=( ${PACKAGES[@]} "pkgconfig" ) -fi - -if rlIsRHEL 5; then - LDAP_SERVICE='ldap' -else - LDAP_SERVICE='slapd' -fi +LDAP_SERVICE='slapd' rlJournalStart rlPhaseStartSetup "General Setup" - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "TmpDir=$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" - + for P in "${PACKAGES[@]}"; do rlCheckRpm $P || rlDie; done rlFetchSrcForInstalled $PACKAGE rlRun "yum-builddep -y openldap*src.rpm" 0 rlRun "rpm -ihv *.rpm" 0 - rlServiceStop $LDAP_SERVICE + rlServiceStop $LDAP_SERVICE rlPhaseEnd rlPhaseStartTest - TOPDIR=`rpm --eval %_topdir` + TOPDIR=$(rpm --eval %_topdir) rlRun "pushd $TOPDIR" 0 rlRun "rpmbuild -vv -bc SPECS/openldap.spec >build.log 2>&1" 0 [[ $? -ne 0 ]] && cat build.log - VERSION=`rpm -q --qf "%{VERSION}\n" openldap | tail -1` - rlRun "pushd BUILD/openldap-${VERSION}/openldap-${VERSION}" 0 + VERSION=$(rpm -q --qf "%{VERSION}\n" openldap | tail -1) + rlRun "pushd BUILD/openldap-${VERSION}-build/openldap-${VERSION}/openldap-${VERSION}" 0 # workaround for failing test, it tests unsupported configuration # see http://www.openldap.org/lists/openldap-technical/201204/msg00080.html for upstream reply # change of check after test is not enough because run of all tests with hdb is skipped if test058 fails with bdb - rm -f tests/scripts/test058-syncrepl-asymmetric - rlIsRHEL 5 6 && rlRun "pushd build-servers" 0 + #rm -f tests/scripts/test058-syncrepl-asymmetric rlRun "make check > make_check.out 2>&1" 0 @@ -107,15 +94,14 @@ rlJournalStart rlAssertNotGrep "failed" make_check.results - rlIsRHEL 5 6 && rlRun "popd" 0 rlRun "popd" 0 rlRun "popd" 0 rlPhaseEnd rlPhaseStartCleanup - rlServiceRestore $LDAP_SERVICE - rlRun "rm -rf BUILD/opendap-`rpm -q --qf "%{VERSION}" openldap`" 0 + rlServiceRestore $LDAP_SERVICE + rlRun "rm -rf BUILD/opendap-$(rpm -q --qf "%{VERSION}" openldap)" 0 rlRun "popd" rlRun "rm -r $TmpDir" 0 "Removing tmp directory" diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index b1b1905..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,34 +0,0 @@ ---- -# Tests that run in all contexts -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - tests: - - smoke-test - required_packages: - - openldap # Required for smoke-test - - openldap-clients # Required for smoke-test - - openldap-servers # Required for smoke-test - - cyrus-sasl-devel # Required for smoke-test - - gdbm-devel # Required for smoke-test - - libtool # Required for smoke-test - - krb5-devel # Required for smoke-test - - openssl-devel # Required for smoke-test - - pam-devel # Required for smoke-test - - perl # Required for smoke-test - - pkgconfig # Required for smoke-test - - tcp_wrappers-devel # Required for smoke-test - - bind-libbind-devel # Required for smoke-test - - unixODBC-devel # Required for smoke-test - - nfs-utils # Required for smoke-test - - rpm-build # Required for smoke-test - - nss-devel # Required for smoke-test - - libdb-devel # Required for smoke-test - - groff # Required for smoke-test - - cracklib-devel # Required for smoke-test - - perl-ExtUtils-Embed # Required for smoke-test - - yum-utils # Required for smoke-test - - libtool-ltdl-devel # Required for smoke-test - - wget # Required for smoke-test From 96644176b318cb597c26e0d4503c5f07f1687cbb Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Thu, 28 Aug 2025 19:01:02 -0700 Subject: [PATCH 26/29] Fix LDAP initialization does unnecessary resolution of hostname Resolves: rhbz#2331728 --- ...er-hostname-resolution-til-first-use.patch | 120 ++++++++++++++++++ openldap.spec | 8 +- 2 files changed, 127 insertions(+), 1 deletion(-) create mode 100644 openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch diff --git a/openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch b/openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch new file mode 100644 index 0000000..62f85f4 --- /dev/null +++ b/openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch @@ -0,0 +1,120 @@ +From 606349836109cfb201bc5b5b424dffb749150a68 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= +Date: Mon, 28 Apr 2025 14:36:24 +0100 +Subject: [PATCH] ITS#10297 Defer hostname resolution til first use + +--- + libraries/libldap/init.c | 33 +++++++++++++++++++-------------- + libraries/libldap/ldap-int.h | 1 + + libraries/libldap/os-ip.c | 2 ++ + libraries/libldap/tls_g.c | 3 +++ + libraries/libldap/tls_o.c | 3 +++ + 6 files changed, 28 insertions(+), 14 deletions(-) + +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 213276b4b5..90fc34c5a6 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -631,6 +631,25 @@ void ldap_int_initialize_global_options( struct ldapoptions *gopts, int *dbglvl + + #if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL) + char * ldap_int_hostname = NULL; ++ ++void ++ldap_int_resolve_hostname(void) ++{ ++ static int resolved = 0; ++ ++ LDAP_MUTEX_LOCK( &ldap_int_hostname_mutex ); ++ if ( !resolved ) { ++ char *name = ldap_int_hostname; ++ ++ ldap_int_hostname = ldap_pvt_get_fqdn( name ); ++ ++ if ( name != NULL && name != ldap_int_hostname ) { ++ LDAP_FREE( name ); ++ } ++ resolved = 1; ++ } ++ LDAP_MUTEX_UNLOCK( &ldap_int_hostname_mutex ); ++} + #endif + + #ifdef LDAP_R_COMPILE +@@ -688,20 +707,6 @@ void ldap_int_initialize( struct ldapoptions *gopts, int *dbglvl ) + } + #endif + +-#if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL) +- LDAP_MUTEX_LOCK( &ldap_int_hostname_mutex ); +- { +- char *name = ldap_int_hostname; +- +- ldap_int_hostname = ldap_pvt_get_fqdn( name ); +- +- if ( name != NULL && name != ldap_int_hostname ) { +- LDAP_FREE( name ); +- } +- } +- LDAP_MUTEX_UNLOCK( &ldap_int_hostname_mutex ); +-#endif +- + #ifndef HAVE_POLL + if ( ldap_int_tblsize == 0 ) ldap_int_ip_init(); + #endif +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 7e754775e8..435b859066 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -743,6 +743,7 @@ LDAP_F (int) ldap_int_poll( LDAP *ld, ber_socket_t s, + + #if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL) + LDAP_V (char *) ldap_int_hostname; ++LDAP_F (void) ldap_int_resolve_hostname(void); + LDAP_F (char *) ldap_host_connected_to( Sockbuf *sb, + const char *host ); + #endif +diff --git a/libraries/libldap/os-ip.c b/libraries/libldap/os-ip.c +index 6c86edd055..629b540352 100644 +--- a/libraries/libldap/os-ip.c ++++ b/libraries/libldap/os-ip.c +@@ -890,6 +890,8 @@ ldap_host_connected_to( Sockbuf *sb, const char *host ) + * this is necessary for kerberos to work right, since the official + * hostname is used as the kerberos instance. + */ ++ if ( !ldap_int_hostname ) ++ ldap_int_resolve_hostname(); + + switch (sa->sa_family) { + #ifdef LDAP_PF_LOCAL +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index de5b7f7c84..d4e7ee0bf7 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -597,6 +597,9 @@ tlsg_session_chkhost( LDAP *ld, tls_session *session, const char *name_in ) + int len1 = 0, len2 = 0; + int ntype = IS_DNS; + ++ if ( !ldap_int_hostname ) ++ ldap_int_resolve_hostname(); ++ + if( ldap_int_hostname && + ( !name_in || !strcasecmp( name_in, "localhost" ) ) ) + { +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 71677847a9..155f685c99 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -830,6 +830,9 @@ tlso_session_chkhost( LDAP *ld, tls_session *sess, const char *name_in ) + struct in_addr addr; + #endif + ++ if ( !ldap_int_hostname ) ++ ldap_int_resolve_hostname(); ++ + if( ldap_int_hostname && + ( !name_in || !strcasecmp( name_in, "localhost" ) ) ) + { +-- +GitLab + diff --git a/openldap.spec b/openldap.spec index 6fa90d4..62991fa 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.10 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -50,6 +50,7 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch Patch7: openldap-openssl-manpage-defaultCA.patch Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch Patch9: openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch +Patch10: openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -170,6 +171,7 @@ pushd openldap-%{version} %patch -P7 -p1 %patch -P8 -p1 %patch -P9 -p1 +%patch -P10 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -549,6 +551,10 @@ exit 0 %endif %changelog +* Fri Aug 29 2025 Simon Pichugin - 2.6.10-4 +- Fix LDAP initialization does unnecessary resolution of hostname (rhbz#2331728) +- Convert STI tests to FMF (rhbz#2382998) + * Thu Jul 24 2025 Fedora Release Engineering - 2.6.10-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From d2ffb525852e4517da4e0f6373302cc10e66cf01 Mon Sep 17 00:00:00 2001 From: Viktor Ashirov Date: Wed, 15 Oct 2025 13:17:44 +0200 Subject: [PATCH 27/29] Add support for argon2 Resolves: rhbz#2167213 --- openldap.spec | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 62991fa..1d3ef63 100644 --- a/openldap.spec +++ b/openldap.spec @@ -9,6 +9,9 @@ # Build openldap-servers package and its libslapi in openldap-devel and openldap-compat %bcond servers 1 +# Build with argon2 support +%bcond argon2 1 + # When you change "Version: " to the new major version, remember to change this value too %global major_version 2.6 @@ -74,6 +77,9 @@ BuildRequires: unixODBC-devel BuildRequires: cracklib-devel BuildRequires: systemd BuildRequires: systemd-rpm-macros +%if %{with argon2} +BuildRequires: libsodium-devel +%endif %description OpenLDAP is an open source suite of LDAP (Lightweight Directory Access @@ -221,6 +227,9 @@ pushd openldap-%{version} --enable-rlookups \ %if %{with servers} --enable-slapi \ +%if %{with argon2} + --enable-argon2 \ +%endif %endif --disable-slp \ \ @@ -460,6 +469,12 @@ exit 0 %{_datadir}/openldap-servers/ %{_libdir}/openldap/accesslog* %{_libdir}/openldap/allop* +%if %{with argon2} +%{_libdir}/openldap/argon2* +%{_mandir}/man5/slappw-argon2.5* +%else +%exclude %{_mandir}/man5/slappw-argon2.5* +%endif %{_libdir}/openldap/auditlog* %{_libdir}/openldap/autoca* %{_libdir}/openldap/back_asyncmeta* @@ -502,7 +517,6 @@ exit 0 %{_mandir}/man8/lloadd.8* %{_mandir}/man5/slapd*.5* %{_mandir}/man5/slapo-*.5* -%{_mandir}/man5/slappw-argon2.5* %{_mandir}/man8/slap*.8* %{_sysusersdir}/openldap.conf # obsolete configuration From 24f6f7ee20ba53a570fc1c7885b7abf077846ee9 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Mon, 12 Jan 2026 18:29:13 -0800 Subject: [PATCH 28/29] Bump version 2.6.10-5 Resolves: rhbz#2167213 Resolves: FC-2548 --- openldap.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 1d3ef63..83ad359 100644 --- a/openldap.spec +++ b/openldap.spec @@ -20,7 +20,7 @@ Name: openldap Version: 2.6.10 -Release: 4%{?dist} +Release: 5%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -565,6 +565,10 @@ exit 0 %endif %changelog +* Tue Jan 13 2026 Simon Pichugin - 2.6.10-5 +- Add support for argon2 (rhbz#2167213) +- Bump version 2.6.10-5 + * Fri Aug 29 2025 Simon Pichugin - 2.6.10-4 - Fix LDAP initialization does unnecessary resolution of hostname (rhbz#2331728) - Convert STI tests to FMF (rhbz#2382998) From a09115fad0d7eae5663008b68ba5548ad9be369b Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 14 Jan 2026 14:38:56 -0500 Subject: [PATCH 29/29] Enable argon2 only in Fedora libsodium is not included in RHEL, nor is openldap-servers shipped. --- openldap.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/openldap.spec b/openldap.spec index 83ad359..b8d3d66 100644 --- a/openldap.spec +++ b/openldap.spec @@ -10,7 +10,7 @@ %bcond servers 1 # Build with argon2 support -%bcond argon2 1 +%bcond argon2 %{undefined rhel} # When you change "Version: " to the new major version, remember to change this value too %global major_version 2.6 @@ -20,7 +20,7 @@ Name: openldap Version: 2.6.10 -Release: 5%{?dist} +Release: 6%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -565,8 +565,11 @@ exit 0 %endif %changelog +* Wed Jan 14 2026 Yaakov Selkowitz - 2.6.10-6 +- Enable argon2 only in Fedora + * Tue Jan 13 2026 Simon Pichugin - 2.6.10-5 -- Add support for argon2 (rhbz#2167213) +- Add support for argon2 (rhbz#2229405) - Bump version 2.6.10-5 * Fri Aug 29 2025 Simon Pichugin - 2.6.10-4