From 18de18ec9d391fdff899f29c78e1b34230bdecc0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 18 Aug 2023 15:27:59 +0200 Subject: [PATCH 01/24] Update to version 4.19.0rc3 resolves: #2232744 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 0b30322..e848165 100644 --- a/.gitignore +++ b/.gitignore @@ -341,3 +341,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0rc1.tar.asc /samba-4.19.0rc2.tar.xz /samba-4.19.0rc2.tar.asc +/samba-4.19.0rc3.tar.xz +/samba-4.19.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index 65cd11d..bdb65eb 100644 --- a/samba.spec +++ b/samba.spec @@ -138,9 +138,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4450,6 +4450,9 @@ fi %endif %changelog +* Fri Aug 18 2023 Guenther Deschner - 4.19.0-0.4.rc3 +- resolves: #2232744 - Update to version 4.19.0rc3 + * Wed Aug 16 2023 Yaakov Selkowitz - 2:4.19.0-0.3.rc2 - Move ad-claims and authn-policy-util to dc-libs diff --git a/sources b/sources index 66da186..4795247 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0rc2.tar.xz) = ef521a17a8d407432fe5b74fbbdeb6f61ade04488378591741603935154f975ea7f5ccdbfe11a6dc3a05f3e5e1d767d0cf7c9a82cfb6252d145845f7110ecca7 -SHA512 (samba-4.19.0rc2.tar.asc) = e8b2f909da5aefa65c03a02295638168adc9182d7ab930805ca83f03a3c5f5800c2ee7b4a66c3d1cee09fec3e78eb6df634e64ee945fb4b018780b19e3239170 +SHA512 (samba-4.19.0rc3.tar.xz) = 0304e09b7c6a1afab3d0e3a206a7204a784d9c82e3d77e5174c585b45b193165fa4ccaa7b931cd92210fcd8e4e58b16eb913e3cf507b4e28e646a6ff0dd9c83d +SHA512 (samba-4.19.0rc3.tar.asc) = 3ada9012744d63e41472e4683eef991e7565fec07116cf476f7cb8b573b6171bf68f8fe55127857c216db92ce1e8e5ba52dfb93ef66c927798b5495ba0ecc6f5 From b6e8bef5c90c082bbba426e0f5a7f680f9f003dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 28 Aug 2023 16:59:29 +0200 Subject: [PATCH 02/24] Update to version 4.19.0rc4 resolves: #2232744 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index e848165..8607d71 100644 --- a/.gitignore +++ b/.gitignore @@ -343,3 +343,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0rc2.tar.asc /samba-4.19.0rc3.tar.xz /samba-4.19.0rc3.tar.asc +/samba-4.19.0rc4.tar.xz +/samba-4.19.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index bdb65eb..a760de9 100644 --- a/samba.spec +++ b/samba.spec @@ -138,9 +138,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 4 +%global baserelease 5 # This should be rc1 or %%nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4450,6 +4450,9 @@ fi %endif %changelog +* Mon Aug 28 2023 Guenther Deschner - 4.19.0-0.5.rc4 +- resolves: #2232744 - Update to version 4.19.0rc4 + * Fri Aug 18 2023 Guenther Deschner - 4.19.0-0.4.rc3 - resolves: #2232744 - Update to version 4.19.0rc3 diff --git a/sources b/sources index 4795247..3a0c8fe 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0rc3.tar.xz) = 0304e09b7c6a1afab3d0e3a206a7204a784d9c82e3d77e5174c585b45b193165fa4ccaa7b931cd92210fcd8e4e58b16eb913e3cf507b4e28e646a6ff0dd9c83d -SHA512 (samba-4.19.0rc3.tar.asc) = 3ada9012744d63e41472e4683eef991e7565fec07116cf476f7cb8b573b6171bf68f8fe55127857c216db92ce1e8e5ba52dfb93ef66c927798b5495ba0ecc6f5 +SHA512 (samba-4.19.0rc4.tar.xz) = 5215127dab4f9a4a5cacfb1d6e236f37e6625552995690a20f1d01533d30858204a25bc4e9839e9f15f1585b3fc403e2bf6f1b4b1a89a1fd4d9f72b3026d5691 +SHA512 (samba-4.19.0rc4.tar.asc) = 9cc262fefae703d56740d3878ed3863c42d1c005c994adcbd4538ed3704cb89e882955869690c126089bffd3948e259f20382bee4ee8326d2c386c5843153aea From 112d37adc22451a4c7bd4d47103ae66a68d43978 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 4 Sep 2023 15:20:35 +0200 Subject: [PATCH 03/24] Update to version 4.19.0 resolves: #2237259 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 8607d71..279c4a2 100644 --- a/.gitignore +++ b/.gitignore @@ -345,3 +345,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0rc3.tar.asc /samba-4.19.0rc4.tar.xz /samba-4.19.0rc4.tar.asc +/samba-4.19.0.tar.xz +/samba-4.19.0.tar.asc diff --git a/samba.spec b/samba.spec index a760de9..1bef008 100644 --- a/samba.spec +++ b/samba.spec @@ -138,9 +138,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 5 +%global baserelease 1 # This should be rc1 or %%nil -%global pre_release rc4 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4450,6 +4450,9 @@ fi %endif %changelog +* Mon Sep 04 2023 Guenther Deschner - 4.19.0-1 +- resolves: #2237259 - Update to version 4.19.0 + * Mon Aug 28 2023 Guenther Deschner - 4.19.0-0.5.rc4 - resolves: #2232744 - Update to version 4.19.0rc4 diff --git a/sources b/sources index 3a0c8fe..a802550 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0rc4.tar.xz) = 5215127dab4f9a4a5cacfb1d6e236f37e6625552995690a20f1d01533d30858204a25bc4e9839e9f15f1585b3fc403e2bf6f1b4b1a89a1fd4d9f72b3026d5691 -SHA512 (samba-4.19.0rc4.tar.asc) = 9cc262fefae703d56740d3878ed3863c42d1c005c994adcbd4538ed3704cb89e882955869690c126089bffd3948e259f20382bee4ee8326d2c386c5843153aea +SHA512 (samba-4.19.0.tar.xz) = a82347b496bb092ced6e4a25e5405ce0c5da40b0a4363e1e5f0cc295c7693d863bcd8d30b0da6d2a99c5525dc01e3a65c524ca832dc6d7e055f2c0ab264f7ae6 +SHA512 (samba-4.19.0.tar.asc) = 75dda279cc07db2a3a79fd4abd99db9383ca5d008d586c3ef168ef317857218c69e2589dbc3f4fcec2f3237d8f6dc72b034ba96268bfdc31a742937a8d92c22d From 2712d93b8db04908e57299b0fec08d5ab4e907fe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 10 Oct 2023 17:18:12 +0200 Subject: [PATCH 04/24] Update to version 4.19.1 resolves: #2243073 resolves: #2241881, #2243228: Security fix for CVE-2023-3961 resolves: #2241882, #2243231: Security fix for CVE-2023-4091 resolves: #2241883, #2243230: Security fix for CVE-2023-4154 resolves: #2241884, #2243229: Security fix for CVE-2023-42669 resolves: #2241885, #2243232: Security fix for CVE-2023-42670 Guenther --- .gitignore | 2 ++ samba.spec | 11 +++++++++-- sources | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 279c4a2..56c8116 100644 --- a/.gitignore +++ b/.gitignore @@ -347,3 +347,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0rc4.tar.asc /samba-4.19.0.tar.xz /samba-4.19.0.tar.asc +/samba-4.19.1.tar.xz +/samba-4.19.1.tar.asc diff --git a/samba.spec b/samba.spec index 1bef008..fdc5e01 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.0 +%global samba_version 4.19.1 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -2032,7 +2032,6 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc -%{_libexecdir}/samba/rpcd_rpcecho %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_mandir}/man8/samba-dcerpcd.8* @@ -4450,6 +4449,14 @@ fi %endif %changelog +* Tue Oct 10 2023 Guenther Deschner - 4.19.1-1 +- resolves: #2243073 - Update to version 4.19.1 +- resolves: #2241881, #2243228: Security fix for CVE-2023-3961 +- resolves: #2241882, #2243231: Security fix for CVE-2023-4091 +- resolves: #2241883, #2243230: Security fix for CVE-2023-4154 +- resolves: #2241884, #2243229: Security fix for CVE-2023-42669 +- resolves: #2241885, #2243232: Security fix for CVE-2023-42670 + * Mon Sep 04 2023 Guenther Deschner - 4.19.0-1 - resolves: #2237259 - Update to version 4.19.0 diff --git a/sources b/sources index a802550..5b09a26 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0.tar.xz) = a82347b496bb092ced6e4a25e5405ce0c5da40b0a4363e1e5f0cc295c7693d863bcd8d30b0da6d2a99c5525dc01e3a65c524ca832dc6d7e055f2c0ab264f7ae6 -SHA512 (samba-4.19.0.tar.asc) = 75dda279cc07db2a3a79fd4abd99db9383ca5d008d586c3ef168ef317857218c69e2589dbc3f4fcec2f3237d8f6dc72b034ba96268bfdc31a742937a8d92c22d +SHA512 (samba-4.19.1.tar.xz) = a96dc8b0fc1b11b92a15c57a10982327f837e79e641e317a098809c4f9b7007d19efdaad307e8349f1dcdb1dc30d38053721dc59eccd6c238856933a27f59335 +SHA512 (samba-4.19.1.tar.asc) = 28ae534aca182f3bb3c0bd85d79af729f7b3fbde4efd6b86c1e5ddd91e3e45e3c3dde223fdede1d9e55e617c5d8309fc018d869e697323503f24edc0b5b5ca4e From 6d9c302780bdbe816f5be43f4ab59c9043779185 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 13 Oct 2023 11:43:02 +0200 Subject: [PATCH 05/24] When built with testsuite rpcd_echo is built as well Guenther --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index fdc5e01..803492a 100644 --- a/samba.spec +++ b/samba.spec @@ -2032,6 +2032,9 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc +%if %{with testsuite} +%{_libexecdir}/samba/rpcd_rpcecho +%endif %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_mandir}/man8/samba-dcerpcd.8* From d49e6b48d02655d5f401aa53b1270535df938df2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 16 Oct 2023 18:00:00 +0200 Subject: [PATCH 06/24] Update to version 4.19.2 resolves: #2244496 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 56c8116..3b6f4d1 100644 --- a/.gitignore +++ b/.gitignore @@ -349,3 +349,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0.tar.asc /samba-4.19.1.tar.xz /samba-4.19.1.tar.asc +/samba-4.19.2.tar.xz +/samba-4.19.2.tar.asc diff --git a/samba.spec b/samba.spec index 803492a..50aeb4b 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.1 +%global samba_version 4.19.2 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4452,6 +4452,9 @@ fi %endif %changelog +* Mon Oct 16 2023 Guenther Deschner - 4.19.2-1 +- resolves: #2244496 - Update to version 4.19.2 + * Tue Oct 10 2023 Guenther Deschner - 4.19.1-1 - resolves: #2243073 - Update to version 4.19.1 - resolves: #2241881, #2243228: Security fix for CVE-2023-3961 diff --git a/sources b/sources index 5b09a26..952ec2b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.1.tar.xz) = a96dc8b0fc1b11b92a15c57a10982327f837e79e641e317a098809c4f9b7007d19efdaad307e8349f1dcdb1dc30d38053721dc59eccd6c238856933a27f59335 -SHA512 (samba-4.19.1.tar.asc) = 28ae534aca182f3bb3c0bd85d79af729f7b3fbde4efd6b86c1e5ddd91e3e45e3c3dde223fdede1d9e55e617c5d8309fc018d869e697323503f24edc0b5b5ca4e +SHA512 (samba-4.19.2.tar.xz) = 5b959aa9b276a306ecde99aa8a9ad30e335a7de21d89148d45ccf85ab2027aed31471b379683e5add4436a26cd878a238c7a82df1e0ebf28fc62bcdbc8c5c3ec +SHA512 (samba-4.19.2.tar.asc) = 998985d0c0d64e5c0c8dea8ddc43be366a3f9f4d4720010d2cbc5a4b72d023aaad7c0c46b010a594404047101c82c2068d5ea04887287b2b8c57efd84b7803e6 From 0cc0e4442d85559f61b267a46adc26b4bc811a7d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 27 Nov 2023 15:15:58 +0100 Subject: [PATCH 07/24] Update to Samba 4.19.3 resolves: #2251766 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 3b6f4d1..ed08576 100644 --- a/.gitignore +++ b/.gitignore @@ -351,3 +351,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.1.tar.asc /samba-4.19.2.tar.xz /samba-4.19.2.tar.asc +/samba-4.19.3.tar.xz +/samba-4.19.3.tar.asc diff --git a/samba.spec b/samba.spec index 50aeb4b..5ef046b 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.2 +%global samba_version 4.19.3 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4452,6 +4452,9 @@ fi %endif %changelog +* Mon Nov 27 2023 Guenther Deschner - 4.19.3-1 +- resolves: #2251766 - Update to version 4.19.3 + * Mon Oct 16 2023 Guenther Deschner - 4.19.2-1 - resolves: #2244496 - Update to version 4.19.2 diff --git a/sources b/sources index 952ec2b..a0453a0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.2.tar.xz) = 5b959aa9b276a306ecde99aa8a9ad30e335a7de21d89148d45ccf85ab2027aed31471b379683e5add4436a26cd878a238c7a82df1e0ebf28fc62bcdbc8c5c3ec -SHA512 (samba-4.19.2.tar.asc) = 998985d0c0d64e5c0c8dea8ddc43be366a3f9f4d4720010d2cbc5a4b72d023aaad7c0c46b010a594404047101c82c2068d5ea04887287b2b8c57efd84b7803e6 +SHA512 (samba-4.19.3.tar.xz) = c222d11c2b196c02ce99a5d6b806df5b9dbfdc50f0d5de43723cf75af69e0fb8ec06d9fbd9a4ca8be03f3ff39a8e5422464afb9279816d3350308045350245a3 +SHA512 (samba-4.19.3.tar.asc) = 76692b6eced6ecbbb49dea21e895ee4486aa09118a53b9a113ba0679063c6052333789156abe30b9d4ee11527743c2334eb49c055421c2cf6b347df18f6afb03 From 8bf974c26fa7347584cd4ff51a0580b532429158 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 13 Dec 2023 10:01:58 +0100 Subject: [PATCH 08/24] Add missing BuildRequires for cepces We should install for building what we require during runtime. --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index 5ef046b..1880d15 100644 --- a/samba.spec +++ b/samba.spec @@ -357,6 +357,10 @@ BuildRequires: librados-devel BuildRequires: python3-etcd %endif +%if %{with gpupdate} +BuildRequires: cepces +%endif + # pidl requirements BuildRequires: perl(ExtUtils::MakeMaker) BuildRequires: perl(FindBin) From 1e51cf5acb34619d3a17dc6f11f00883b20e4d59 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 8 Jan 2024 16:34:43 +0100 Subject: [PATCH 09/24] Update to version 4.19.4 resolves: #2257287 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index ed08576..347f3eb 100644 --- a/.gitignore +++ b/.gitignore @@ -353,3 +353,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.2.tar.asc /samba-4.19.3.tar.xz /samba-4.19.3.tar.asc +/samba-4.19.4.tar.xz +/samba-4.19.4.tar.asc diff --git a/samba.spec b/samba.spec index 1880d15..765e720 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.3 +%global samba_version 4.19.4 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4456,6 +4456,9 @@ fi %endif %changelog +* Mon Jan 08 2024 Guenther Deschner - 4.19.4-1 +- resolves: #2257287 - Update to version 4.19.4 + * Mon Nov 27 2023 Guenther Deschner - 4.19.3-1 - resolves: #2251766 - Update to version 4.19.3 diff --git a/sources b/sources index a0453a0..ed14bdd 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.3.tar.xz) = c222d11c2b196c02ce99a5d6b806df5b9dbfdc50f0d5de43723cf75af69e0fb8ec06d9fbd9a4ca8be03f3ff39a8e5422464afb9279816d3350308045350245a3 -SHA512 (samba-4.19.3.tar.asc) = 76692b6eced6ecbbb49dea21e895ee4486aa09118a53b9a113ba0679063c6052333789156abe30b9d4ee11527743c2334eb49c055421c2cf6b347df18f6afb03 +SHA512 (samba-4.19.4.tar.xz) = 3d2899e4a3b8bcb77befc29c4af66d3ac858b7f7a0dbbb66a8bc210cd88d9cde3e11361334a5cce650318473134ec8b134148bfa4af4d51f555de33eff395029 +SHA512 (samba-4.19.4.tar.asc) = 11bc51407d1464339817d7568f5d5bb059c19a05b49c6a1307d7425d289acb617ecd3e633e3736bdaa94947a7b3630d6cdb7ed6fe59d52556234c549eca8172a From f44254fcd9676d9e8ff0a33bddfc947f644a8aec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 15 Nov 2023 10:37:35 +0100 Subject: [PATCH 10/24] Package samba-gpupdate also for RHEL9 (cherry picked from commit 4f9b4790325bc1b889412c073716f46ebc4d7bb0) --- samba.spec | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/samba.spec b/samba.spec index 765e720..52db826 100644 --- a/samba.spec +++ b/samba.spec @@ -135,6 +135,12 @@ %bcond_with etcd_mutex %endif +%if 0%{?fedora} || 0%{?rhel} >= 9 +%bcond_without gpupdate +%else +%bcond_with gpupdate +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.4 @@ -725,7 +731,7 @@ Samba VFS module for GlusterFS integration. %endif ### GPUPDATE -%if %{with dc} +%if %{with gpupdate} %package gpupdate Summary: Samba GPO support for clients Requires: cepces @@ -737,7 +743,7 @@ Requires: python3-%{name} = %{samba_depver} This package provides the samba-gpupdate tool to apply Group Policy Objects (GPO) on Samba clients. -# /with dc +#endif with gpupdate %endif ### KRB5-PRINTING @@ -1428,14 +1434,17 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so for i in \ %{_mandir}/man8/samba.8 \ %{_mandir}/man8/samba_downgrade_db.8 \ - %{_mandir}/man8/samba-gpupdate.8 \ %{_unitdir}/samba.service \ - %{_sbindir}/samba-gpupdate \ ; do rm -f %{buildroot}$i done %endif +%if %{without gpupdate} +rm -f %{_sbindir}/samba-gpupdate +rm -f %{_mandir}/man8/samba-gpupdate.8 +%endif + %if %{without vfs_glusterfs} rm -f %{buildroot}%{_mandir}/man8/vfs_glusterfs.8* %endif @@ -2331,10 +2340,11 @@ fi %endif ### GPUPDATE -%if %{with dc} +%if %{with gpupdate} %files gpupdate %{_mandir}/man8/samba-gpupdate.8* %{_sbindir}/samba-gpupdate +#endif with gpupdate %endif ### KRB5-PRINTING From a4ea47c07728afa95920dbbc8de769be7e38b237 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 15 Nov 2023 14:38:09 +0100 Subject: [PATCH 11/24] Do not use mold on i686, support for it has been dropped (cherry picked from commit c92b2eb22b4b71488a8619cbe9d8a5b73b9b8be2) --- samba.spec | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 52db826..2b4870f 100644 --- a/samba.spec +++ b/samba.spec @@ -336,9 +336,11 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) +%ifnarch i686 %if 0%{?fedora} >= 37 BuildRequires: mold %endif +%endif %if %{with vfs_glusterfs} BuildRequires: glusterfs-api-devel >= 3.4.0.16 @@ -1271,12 +1273,16 @@ rm -f lib/crypto/{aes,rijndael}*.c # TODO: resolve underlinked python modules export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -# Use the mold linker +# Use the mold linker if possible +export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" + +%ifnarch i686 %if 0%{?fedora} >= 37 export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" -%else -export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" +#endif fedora >= 37 +%endif +#endif narch i686 %endif # Add support for mock ccache plugin From 662f04d9705ca8d5c98b70aabbe3790886697234 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Sun, 19 Nov 2023 12:47:18 +0100 Subject: [PATCH 12/24] Fix the 'without gpupdate' uninstalled file removal (cherry picked from commit 601c5e7cbbaccce1a8c88322dad8b6edb03785ed) --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 2b4870f..c440958 100644 --- a/samba.spec +++ b/samba.spec @@ -1447,8 +1447,8 @@ done %endif %if %{without gpupdate} -rm -f %{_sbindir}/samba-gpupdate -rm -f %{_mandir}/man8/samba-gpupdate.8 +rm -f %{buildroot}%{_sbindir}/samba-gpupdate +rm -f %{buildroot}%{_mandir}/man8/samba-gpupdate.8* %endif %if %{without vfs_glusterfs} From 1e97ccda7ae0aa06890fc9a3c5ee3e6a67012b76 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 8 Jan 2024 17:30:42 +0100 Subject: [PATCH 13/24] Add missing dependencies for samba-gpupdate (cherry picked from commit 6a716d5e7ee5135f67c81d086cb2acde6833c28f) --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index c440958..3818413 100644 --- a/samba.spec +++ b/samba.spec @@ -737,9 +737,12 @@ Samba VFS module for GlusterFS integration. %package gpupdate Summary: Samba GPO support for clients Requires: cepces +Requires: cepces-certmonger Requires: certmonger Requires: %{name}-ldb-ldap-modules = %{samba_depver} Requires: python3-%{name} = %{samba_depver} +# samba-tool needs python3-samba-dc also on non-dc build +Requires: python3-%{name}-dc = %{samba_depver} %description gpupdate This package provides the samba-gpupdate tool to apply Group Policy Objects From bbb0588547a10a85ac32104f868f36dca40a3aa0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 9 Jan 2024 09:51:38 +0100 Subject: [PATCH 14/24] Create winbind groups using systemd Also drop creating groups with groupadd entirely. resolves: rhbz#2256326 (cherry picked from commit f245ed7ba22cd3c5fbe9c3a603e182c5ff2baaa5) --- samba-winbind-systemd-sysusers.conf | 2 ++ samba.spec | 21 ++++++++++----------- 2 files changed, 12 insertions(+), 11 deletions(-) create mode 100644 samba-winbind-systemd-sysusers.conf diff --git a/samba-winbind-systemd-sysusers.conf b/samba-winbind-systemd-sysusers.conf new file mode 100644 index 0000000..7ccc216 --- /dev/null +++ b/samba-winbind-systemd-sysusers.conf @@ -0,0 +1,2 @@ +#Type Name ID +g wbpriv 88 diff --git a/samba.spec b/samba.spec index 3818413..414954a 100644 --- a/samba.spec +++ b/samba.spec @@ -236,12 +236,11 @@ Source14: samba.pamd Source15: usershares.conf.vendor Source16: samba-systemd-sysusers.conf Source17: samba-usershares-systemd-sysusers.conf +Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Requires(pre): /usr/sbin/groupadd - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -1416,6 +1415,7 @@ echo "d /run/ctdb 755 root root" > %{buildroot}%{_tmpfilesdir}/ctdb.conf install -d -m 0755 %{buildroot}%{_sysusersdir} install -m 0644 %{SOURCE16} %{buildroot}%{_sysusersdir}/samba.conf install -m 0644 %{SOURCE17} %{buildroot}%{_sysusersdir}/samba-usershares.conf +install -m 0644 %{SOURCE18} %{buildroot}%{_sysusersdir}/samba-winbind.conf install -d -m 0755 %{buildroot}%{_sysconfdir}/sysconfig install -m 0644 packaging/systemd/samba.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/samba @@ -1530,11 +1530,8 @@ export WINBINDD_DONT_LOG_STDOUT=1 %systemd_postun_with_restart nmb.service %pre common -%if 0%{?fedora} || 0%{?rhel} > 8 +# This creates the group 'printadmin' %sysusers_create_compat %{SOURCE16} -%else -getent group printadmin >/dev/null || groupadd -r printadmin || : -%endif %post common %{?ldconfig} @@ -1604,14 +1601,12 @@ fi %ldconfig_scriptlets test %pre usershares -%if 0%{?fedora} || 0%{?rhel} > 8 +# This creates the group 'usershares' %sysusers_create_compat %{SOURCE17} -%else -getent group usershares >/dev/null || groupadd -r usershares || : -%endif %pre winbind -/usr/sbin/groupadd -g 88 wbpriv >/dev/null 2>&1 || : +# This creates the group 'wbpriv' +%sysusers_create_compat %{SOURCE18} %post winbind %systemd_post winbind.service @@ -3487,6 +3482,7 @@ fi %{_libdir}/samba/libnss-info-samba4.so %{_libdir}/samba/libidmap-samba4.so %{_sbindir}/winbindd +%{_sysusersdir}/samba-winbind.conf %attr(750,root,wbpriv) %dir /var/lib/samba/winbindd_privileged %{_unitdir}/winbind.service %{_prefix}/lib/NetworkManager @@ -4475,6 +4471,9 @@ fi %endif %changelog +* Tue Jan 09 2024 Andreas Schneider - 4.19.4-2 +- resolves: rhbz#2256326 - Create all groups using systemd + * Mon Jan 08 2024 Guenther Deschner - 4.19.4-1 - resolves: #2257287 - Update to version 4.19.4 From 034b47954ec7f394587448acb3395a211ce06ef9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 9 Jan 2024 13:07:37 +0100 Subject: [PATCH 15/24] Bump release number (cherry picked from commit 368799d573a8948346d3ab4d397a2ac0cb3fe2cf) --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 414954a..332a6eb 100644 --- a/samba.spec +++ b/samba.spec @@ -144,7 +144,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.4 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil From 287cb3b869da8f31f8e3fe0922b978abf9697d31 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 16 Jan 2024 12:22:50 +0100 Subject: [PATCH 16/24] Fix samba-gpupdate on Fedora/RHEL --- samba-4.19-fix-gpupdate-rhel-fedora.patch | 638 ++++++++++++++++++++++ samba-4.19-fix-gpupdate-site-aware.patch | 61 +++ samba.spec | 8 +- 3 files changed, 706 insertions(+), 1 deletion(-) create mode 100644 samba-4.19-fix-gpupdate-rhel-fedora.patch create mode 100644 samba-4.19-fix-gpupdate-site-aware.patch diff --git a/samba-4.19-fix-gpupdate-rhel-fedora.patch b/samba-4.19-fix-gpupdate-rhel-fedora.patch new file mode 100644 index 0000000..6381e0a --- /dev/null +++ b/samba-4.19-fix-gpupdate-rhel-fedora.patch @@ -0,0 +1,638 @@ +From 549b5fe579fc15d63b71b1cc8a0ebf4e4869171b Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Thu, 17 Aug 2023 01:05:54 +0300 +Subject: [PATCH 1/9] gp: Support more global trust directories + +In addition to the SUSE global trust directory, add support for RHEL and +Debian-based distributions (including Ubuntu). + +To determine the correct directory to use, we iterate over the variants +and stop at the first which is a directory. + +In case none is found, fallback to the first option which will produce a +warning as it did previously. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit a1b285e485c0b5a8747499bdbbb9f3f4fc025b2f) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index 312c8ddf467..1b90ab46e90 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -45,10 +45,12 @@ cert_wrap = b""" + -----BEGIN CERTIFICATE----- + %s + -----END CERTIFICATE-----""" +-global_trust_dir = '/etc/pki/trust/anchors' + endpoint_re = '(https|HTTPS)://(?P[a-zA-Z0-9.-]+)/ADPolicyProvider' + \ + '_CEP_(?P[a-zA-Z]+)/service.svc/CEP' + ++global_trust_dirs = ['/etc/pki/trust/anchors', # SUSE ++ '/etc/pki/ca-trust/source/anchors', # RHEL/Fedora ++ '/usr/local/share/ca-certificates'] # Debian/Ubuntu + + def octet_string_to_objectGUID(data): + """Convert an octet string to an objectGUID.""" +@@ -249,12 +251,20 @@ def getca(ca, url, trust_dir): + return root_certs + + ++def find_global_trust_dir(): ++ """Return the global trust dir using known paths from various Linux distros.""" ++ for trust_dir in global_trust_dirs: ++ if os.path.isdir(trust_dir): ++ return trust_dir ++ return global_trust_dirs[0] ++ + def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): + """Install the root certificate chain.""" + data = dict({'files': [], 'templates': []}, **ca) + url = 'http://%s/CertSrv/mscep/mscep.dll/pkiclient.exe?' % ca['hostname'] + root_certs = getca(ca, url, trust_dir) + data['files'].extend(root_certs) ++ global_trust_dir = find_global_trust_dir() + for src in root_certs: + # Symlink the certs to global trust dir + dst = os.path.join(global_trust_dir, os.path.basename(src)) +-- +2.43.0 + + +From c624a1e9b1d09fe2bb3f9778cb616230e57168a8 Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Thu, 17 Aug 2023 01:09:28 +0300 +Subject: [PATCH 2/9] gp: Support update-ca-trust helper + +This is used on RHEL/Fedora instead of update-ca-certificates. They +behave similarly so it's enough to change the command name. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit fa80d1d86439749c44e60cf9075e84dc9ed3c268) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index 1b90ab46e90..cefdafa21b2 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -258,6 +258,10 @@ def find_global_trust_dir(): + return trust_dir + return global_trust_dirs[0] + ++def update_ca_command(): ++ """Return the command to update the CA trust store.""" ++ return which('update-ca-certificates') or which('update-ca-trust') ++ + def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): + """Install the root certificate chain.""" + data = dict({'files': [], 'templates': []}, **ca) +@@ -283,7 +287,7 @@ def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): + # already exists. Ignore the FileExistsError. Preserve the + # existing symlink in the unapply data. + data['files'].append(dst) +- update = which('update-ca-certificates') ++ update = update_ca_command() + if update is not None: + Popen([update]).wait() + # Setup Certificate Auto Enrollment +-- +2.43.0 + + +From 086406ca457cc17e15001fb44802276ada068679 Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Fri, 11 Aug 2023 18:46:42 +0300 +Subject: [PATCH 3/9] gp: Change root cert extension suffix + +On Ubuntu, certificates must end in '.crt' in order to be considered by +the `update-ca-certificates` helper. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit bce3a89204545dcab5fb39a712590f6e166f997b) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index cefdafa21b2..c562722906b 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -241,7 +241,8 @@ def getca(ca, url, trust_dir): + certs = load_der_pkcs7_certificates(r.content) + for i in range(0, len(certs)): + cert = certs[i].public_bytes(Encoding.PEM) +- dest = '%s.%d' % (root_cert, i) ++ filename, extension = root_cert.rsplit('.', 1) ++ dest = '%s.%d.%s' % (filename, i, extension) + with open(dest, 'wb') as w: + w.write(cert) + root_certs.append(dest) +-- +2.43.0 + + +From c57c32020cc9017191b8c8657ebabe00d552a6e3 Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Fri, 18 Aug 2023 17:06:43 +0300 +Subject: [PATCH 4/9] gp: Test with binary content for certificate data + +This fails all GPO-related tests that call `gpupdate --rsop`. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit 1ef722cf66f9ec99f52939f1cfca031c5fe1ad70) +--- + python/samba/tests/gpo.py | 8 ++++---- + selftest/knownfail.d/gpo | 13 +++++++++++++ + 2 files changed, 17 insertions(+), 4 deletions(-) + create mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py +index e4b75cc62a4..963f873f755 100644 +--- a/python/samba/tests/gpo.py ++++ b/python/samba/tests/gpo.py +@@ -6783,14 +6783,14 @@ class GPOTests(tests.TestCase): + ldb.add({'dn': certa_dn, + 'objectClass': 'certificationAuthority', + 'authorityRevocationList': ['XXX'], +- 'cACertificate': 'XXX', ++ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', + 'certificateRevocationList': ['XXX'], + }) + # Write the dummy pKIEnrollmentService + enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn) + ldb.add({'dn': enroll_dn, + 'objectClass': 'pKIEnrollmentService', +- 'cACertificate': 'XXXX', ++ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', + 'certificateTemplates': ['Machine'], + 'dNSHostName': hostname, + }) +@@ -7201,14 +7201,14 @@ class GPOTests(tests.TestCase): + ldb.add({'dn': certa_dn, + 'objectClass': 'certificationAuthority', + 'authorityRevocationList': ['XXX'], +- 'cACertificate': 'XXX', ++ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', + 'certificateRevocationList': ['XXX'], + }) + # Write the dummy pKIEnrollmentService + enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn) + ldb.add({'dn': enroll_dn, + 'objectClass': 'pKIEnrollmentService', +- 'cACertificate': 'XXXX', ++ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', + 'certificateTemplates': ['Machine'], + 'dNSHostName': hostname, + }) +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +new file mode 100644 +index 00000000000..0aad59607c2 +--- /dev/null ++++ b/selftest/knownfail.d/gpo +@@ -0,0 +1,13 @@ ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_centrify_crontab_ext ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_scripts_ext ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_rsop ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_access ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_files ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_issue ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_motd ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_openssh ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_startup_scripts ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_sudoers ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_symlink ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From c53b2994fd13f4c74cee891e725a4558cdb06b2d Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Wed, 16 Aug 2023 12:20:11 +0300 +Subject: [PATCH 5/9] gp: Convert CA certificates to base64 + +I don't know whether this applies universally, but in our case the +contents of `es['cACertificate'][0]` are binary, so cleanly converting +to a string fails with the following: + +'utf-8' codec can't decode byte 0x82 in position 1: invalid start byte + +We found a fix to be encoding the certificate to base64 when +constructing the CA list. + +Section 4.4.5.2 of MS-CAESO also suggests that the content of +`cACertificate` is binary (OCTET string). + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit 157335ee93eb866f9b6a47486a5668d6e76aced5) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 5 ++--- + selftest/knownfail.d/gpo | 13 ------------- + 2 files changed, 2 insertions(+), 16 deletions(-) + delete mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index c562722906b..c8b5368c16a 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -158,7 +158,7 @@ def fetch_certification_authorities(ldb): + for es in res: + data = { 'name': get_string(es['cn'][0]), + 'hostname': get_string(es['dNSHostName'][0]), +- 'cACertificate': get_string(es['cACertificate'][0]) ++ 'cACertificate': get_string(base64.b64encode(es['cACertificate'][0])) + } + result.append(data) + return result +@@ -176,8 +176,7 @@ def fetch_template_attrs(ldb, name, attrs=None): + return {'msPKI-Minimal-Key-Size': ['2048']} + + def format_root_cert(cert): +- cert = base64.b64encode(cert.encode()) +- return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert, 0, re.DOTALL) ++ return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert.encode(), 0, re.DOTALL) + + def find_cepces_submit(): + certmonger_dirs = [os.environ.get("PATH"), '/usr/lib/certmonger', +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +deleted file mode 100644 +index 0aad59607c2..00000000000 +--- a/selftest/knownfail.d/gpo ++++ /dev/null +@@ -1,13 +0,0 @@ +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_centrify_crontab_ext +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_scripts_ext +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_rsop +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_access +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_files +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_issue +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_motd +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_openssh +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_startup_scripts +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_sudoers +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_symlink +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From fd13702a9cd6475a14113de87ccad6588d2d443b Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Fri, 18 Aug 2023 17:16:23 +0300 +Subject: [PATCH 6/9] gp: Test adding new cert templates enforces changes + +Ensure that cepces-submit reporting additional templates and re-applying +will enforce the updated policy. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit 2d6943a864405f324c467e8c3464c31ac08457b0) +--- + python/samba/tests/bin/cepces-submit | 3 +- + python/samba/tests/gpo.py | 48 ++++++++++++++++++++++++++++ + selftest/knownfail.d/gpo | 2 ++ + 3 files changed, 52 insertions(+), 1 deletion(-) + create mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/tests/bin/cepces-submit b/python/samba/tests/bin/cepces-submit +index 668682a9f58..de63164692b 100755 +--- a/python/samba/tests/bin/cepces-submit ++++ b/python/samba/tests/bin/cepces-submit +@@ -14,4 +14,5 @@ if __name__ == "__main__": + assert opts.auth == 'Kerberos' + if 'CERTMONGER_OPERATION' in os.environ and \ + os.environ['CERTMONGER_OPERATION'] == 'GET-SUPPORTED-TEMPLATES': +- print('Machine') # Report a Machine template ++ templates = os.environ.get('CEPCES_SUBMIT_SUPPORTED_TEMPLATES', 'Machine').split(',') ++ print('\n'.join(templates)) # Report the requested templates +diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py +index 963f873f755..e75c411bde7 100644 +--- a/python/samba/tests/gpo.py ++++ b/python/samba/tests/gpo.py +@@ -6812,6 +6812,23 @@ class GPOTests(tests.TestCase): + self.assertTrue(os.path.exists(machine_crt), + 'Machine key was not generated') + ++ # Subsequent apply should react to new certificate templates ++ os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation' ++ self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES') ++ ext.process_group_policy([], gpos, dname, dname) ++ self.assertTrue(os.path.exists(ca_crt), ++ 'Root CA certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine key was not generated') ++ workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca_cn) ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation certificate was not requested') ++ workstation_key = os.path.join(dname, '%s.Workstation.key' % ca_cn) ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation key was not generated') ++ + # Verify RSOP does not fail + ext.rsop([g for g in gpos if g.name == guid][0]) + +@@ -6829,11 +6846,17 @@ class GPOTests(tests.TestCase): + 'Machine certificate was not removed') + self.assertFalse(os.path.exists(machine_crt), + 'Machine key was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation certificate was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation key was not removed') + out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate() + self.assertNotIn(get_bytes(ca_cn), out, 'CA was not removed') + out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate() + self.assertNotIn(b'Machine', out, + 'Machine certificate not removed') ++ self.assertNotIn(b'Workstation', out, ++ 'Workstation certificate not removed') + + # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate + ldb.delete(certa_dn) +@@ -7233,6 +7256,25 @@ class GPOTests(tests.TestCase): + self.assertTrue(os.path.exists(machine_crt), + 'Machine key was not generated') + ++ # Subsequent apply should react to new certificate templates ++ os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation' ++ self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES') ++ ext.process_group_policy([], gpos, dname, dname) ++ for ca in ca_list: ++ self.assertTrue(os.path.exists(ca_crt), ++ 'Root CA certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine key was not generated') ++ ++ workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca) ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation certificate was not requested') ++ workstation_key = os.path.join(dname, '%s.Workstation.key' % ca) ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation key was not generated') ++ + # Verify RSOP does not fail + ext.rsop([g for g in gpos if g.name == guid][0]) + +@@ -7250,12 +7292,18 @@ class GPOTests(tests.TestCase): + 'Machine certificate was not removed') + self.assertFalse(os.path.exists(machine_crt), + 'Machine key was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation certificate was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation key was not removed') + out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate() + for ca in ca_list: + self.assertNotIn(get_bytes(ca), out, 'CA was not removed') + out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate() + self.assertNotIn(b'Machine', out, + 'Machine certificate not removed') ++ self.assertNotIn(b'Workstation', out, ++ 'Workstation certificate not removed') + + # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate + ldb.delete(certa_dn) +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +new file mode 100644 +index 00000000000..4edc1dce730 +--- /dev/null ++++ b/selftest/knownfail.d/gpo +@@ -0,0 +1,2 @@ ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From 4578c6664ab6eac476ee10afae4a1a95b3b63272 Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Wed, 16 Aug 2023 12:37:17 +0300 +Subject: [PATCH 7/9] gp: Template changes should invalidate cache + +If certificate templates are added or removed, the autoenroll extension +should react to this and reapply the policy. Previously this wasn't +taken into account. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit 2a6ae997f2464b12b72b5314fa80d9784fb0f6c1) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 15 ++++++++++----- + selftest/knownfail.d/gpo | 2 -- + 2 files changed, 10 insertions(+), 7 deletions(-) + delete mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index c8b5368c16a..8233713e8ad 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -262,6 +262,11 @@ def update_ca_command(): + """Return the command to update the CA trust store.""" + return which('update-ca-certificates') or which('update-ca-trust') + ++def changed(new_data, old_data): ++ """Return True if any key present in both dicts has changed.""" ++ return any((new_data[k] != old_data[k] if k in old_data else False) \ ++ for k in new_data.keys()) ++ + def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): + """Install the root certificate chain.""" + data = dict({'files': [], 'templates': []}, **ca) +@@ -351,12 +356,12 @@ class gp_cert_auto_enroll_ext(gp_pol_ext, gp_applier): + # If the policy has changed, unapply, then apply new policy + old_val = self.cache_get_attribute_value(guid, attribute) + old_data = json.loads(old_val) if old_val is not None else {} +- if all([(ca[k] == old_data[k] if k in old_data else False) \ +- for k in ca.keys()]) or \ +- self.cache_get_apply_state() == GPOSTATE.ENFORCE: ++ templates = ['%s.%s' % (ca['name'], t.decode()) for t in get_supported_templates(ca['hostname'])] ++ new_data = { 'templates': templates, **ca } ++ if changed(new_data, old_data) or self.cache_get_apply_state() == GPOSTATE.ENFORCE: + self.unapply(guid, attribute, old_val) +- # If policy is already applied, skip application +- if old_val is not None and \ ++ # If policy is already applied and unchanged, skip application ++ if old_val is not None and not changed(new_data, old_data) and \ + self.cache_get_apply_state() != GPOSTATE.ENFORCE: + return + +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +deleted file mode 100644 +index 4edc1dce730..00000000000 +--- a/selftest/knownfail.d/gpo ++++ /dev/null +@@ -1,2 +0,0 @@ +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From 2d641b736b42f7623955f251ad354439b954159d Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Fri, 18 Aug 2023 17:26:59 +0300 +Subject: [PATCH 8/9] gp: Test disabled enrollment unapplies policy + +For this we need to stage a Registry.pol file with certificate +autoenrollment enabled, but with checkboxes unticked. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit ee814f7707a8ddef2657212cd6d31799501b7bb3) +--- + python/samba/tests/gpo.py | 54 +++++++++++++++++++++++++++++++++++++++ + selftest/knownfail.d/gpo | 1 + + 2 files changed, 55 insertions(+) + create mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py +index e75c411bde7..580f3568de8 100644 +--- a/python/samba/tests/gpo.py ++++ b/python/samba/tests/gpo.py +@@ -281,6 +281,28 @@ b""" + + """ + ++auto_enroll_unchecked_reg_pol = \ ++b""" ++ ++ ++ ++ Software\Policies\Microsoft\Cryptography\AutoEnrollment ++ AEPolicy ++ 0 ++ ++ ++ Software\Policies\Microsoft\Cryptography\AutoEnrollment ++ OfflineExpirationPercent ++ 10 ++ ++ ++ Software\Policies\Microsoft\Cryptography\AutoEnrollment ++ OfflineExpirationStoreNames ++ MY ++ ++ ++""" ++ + advanced_enroll_reg_pol = \ + b""" + +@@ -6836,6 +6858,38 @@ class GPOTests(tests.TestCase): + ret = rsop(self.lp) + self.assertEqual(ret, 0, 'gpupdate --rsop failed!') + ++ # Remove policy by staging pol file with auto-enroll unchecked ++ parser.load_xml(etree.fromstring(auto_enroll_unchecked_reg_pol.strip())) ++ ret = stage_file(reg_pol, ndr_pack(parser.pol_file)) ++ self.assertTrue(ret, 'Could not create the target %s' % reg_pol) ++ ext.process_group_policy([], gpos, dname, dname) ++ self.assertFalse(os.path.exists(ca_crt), ++ 'Root CA certificate was not removed') ++ self.assertFalse(os.path.exists(machine_crt), ++ 'Machine certificate was not removed') ++ self.assertFalse(os.path.exists(machine_crt), ++ 'Machine key was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation certificate was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation key was not removed') ++ ++ # Reapply policy by staging the enabled pol file ++ parser.load_xml(etree.fromstring(auto_enroll_reg_pol.strip())) ++ ret = stage_file(reg_pol, ndr_pack(parser.pol_file)) ++ self.assertTrue(ret, 'Could not create the target %s' % reg_pol) ++ ext.process_group_policy([], gpos, dname, dname) ++ self.assertTrue(os.path.exists(ca_crt), ++ 'Root CA certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine key was not generated') ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation certificate was not requested') ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation key was not generated') ++ + # Remove policy + gp_db = store.get_gplog(machine_creds.get_username()) + del_gpos = get_deleted_gpos_list(gp_db, []) +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +new file mode 100644 +index 00000000000..83bc9f0ac1f +--- /dev/null ++++ b/selftest/knownfail.d/gpo +@@ -0,0 +1 @@ ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From e5588f8800899894388284468b9e25463d3c3e6c Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Wed, 16 Aug 2023 12:33:59 +0300 +Subject: [PATCH 9/9] gp: Send list of keys instead of dict to remove + +`cache_get_all_attribute_values` returns a dict whereas we need to pass +a list of keys to `remove`. These will be interpolated in the gpdb search. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder + +Autobuild-User(master): Andrew Bartlett +Autobuild-Date(master): Mon Aug 28 03:01:22 UTC 2023 on atb-devel-224 + +(cherry picked from commit 7dc181757c76b881ceaf1915ebb0bfbcf5aca83a) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 2 +- + selftest/knownfail.d/gpo | 1 - + 2 files changed, 1 insertion(+), 2 deletions(-) + delete mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index 8233713e8ad..64c35782ae8 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -415,7 +415,7 @@ class gp_cert_auto_enroll_ext(gp_pol_ext, gp_applier): + # remove any existing policy + ca_attrs = \ + self.cache_get_all_attribute_values(gpo.name) +- self.clean(gpo.name, remove=ca_attrs) ++ self.clean(gpo.name, remove=list(ca_attrs.keys())) + + def __read_cep_data(self, guid, ldb, end_point_information, + trust_dir, private_dir): +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +deleted file mode 100644 +index 83bc9f0ac1f..00000000000 +--- a/selftest/knownfail.d/gpo ++++ /dev/null +@@ -1 +0,0 @@ +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + diff --git a/samba-4.19-fix-gpupdate-site-aware.patch b/samba-4.19-fix-gpupdate-site-aware.patch new file mode 100644 index 0000000..3354bb0 --- /dev/null +++ b/samba-4.19-fix-gpupdate-site-aware.patch @@ -0,0 +1,61 @@ +From 372b8f15ccf37c491f43ec7ab81be692ff0fcfed Mon Sep 17 00:00:00 2001 +From: David Mulder +Date: Fri, 5 Jan 2024 08:47:07 -0700 +Subject: [PATCH] WIP: gp: Skip site GP list if no site is found + +[MS-GPOL] 3.2.5.1.4 Site Search says if the site +search returns ERROR_NO_SITENAME, the GP site +search should be skipped. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15548 + +Signed-off-by: David Mulder +--- + python/samba/gp/gpclass.py | 30 ++++++++++++++++++------------ + 1 file changed, 18 insertions(+), 12 deletions(-) + +diff --git a/python/samba/gp/gpclass.py b/python/samba/gp/gpclass.py +index b7a0dcb0ed5..26c2386847e 100644 +--- a/python/samba/gp/gpclass.py ++++ b/python/samba/gp/gpclass.py +@@ -896,19 +896,25 @@ def get_gpo_list(dc_hostname, creds, lp, username): + + # (S)ite + if gpo_list_machine: +- site_dn = site_dn_for_machine(samdb, dc_hostname, lp, creds, username) +- + try: +- log.debug("get_gpo_list: query SITE: [%s] for GPOs" % site_dn) +- gp_link = get_gpo_link(samdb, site_dn) +- except ldb.LdbError as e: +- (enum, estr) = e.args +- log.debug(estr) +- else: +- add_gplink_to_gpo_list(samdb, gpo_list, forced_gpo_list, +- site_dn, gp_link, +- gpo.GP_LINK_SITE, +- add_only_forced_gpos, token) ++ site_dn = site_dn_for_machine(samdb, dc_hostname, lp, creds, username) ++ ++ try: ++ log.debug("get_gpo_list: query SITE: [%s] for GPOs" % site_dn) ++ gp_link = get_gpo_link(samdb, site_dn) ++ except ldb.LdbError as e: ++ (enum, estr) = e.args ++ log.debug(estr) ++ else: ++ add_gplink_to_gpo_list(samdb, gpo_list, forced_gpo_list, ++ site_dn, gp_link, ++ gpo.GP_LINK_SITE, ++ add_only_forced_gpos, token) ++ except ldb.LdbError: ++ # [MS-GPOL] 3.2.5.1.4 Site Search: If the method returns ++ # ERROR_NO_SITENAME, the remainder of this message MUST be skipped ++ # and the protocol sequence MUST continue at GPO Search ++ pass + + # (L)ocal + gpo_list.insert(0, gpo.GROUP_POLICY_OBJECT("Local Policy", +-- +GitLab + diff --git a/samba.spec b/samba.spec index 332a6eb..ac11b9a 100644 --- a/samba.spec +++ b/samba.spec @@ -144,7 +144,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.4 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release %nil @@ -241,6 +241,9 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.19-fix-gpupdate-rhel-fedora.patch +Patch1: samba-4.19-fix-gpupdate-site-aware.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -4471,6 +4474,9 @@ fi %endif %changelog +* Tue Jan 16 2024 Andreas Schneider - 4.29.4-3 +- Fix samba-gpupdate on Fedora/RHEL + * Tue Jan 09 2024 Andreas Schneider - 4.19.4-2 - resolves: rhbz#2256326 - Create all groups using systemd From 10a937072859710849fa0cb38985f8c3a0015dab Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 9 Feb 2024 09:27:06 +0100 Subject: [PATCH 17/24] Require cepces >= 0.3.8 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index ac11b9a..bdb1377 100644 --- a/samba.spec +++ b/samba.spec @@ -368,7 +368,7 @@ BuildRequires: python3-etcd %endif %if %{with gpupdate} -BuildRequires: cepces +BuildRequires: cepces >= 0.3.8 %endif # pidl requirements From ca16c697155b648bd665c8fa04e1f7efd6329441 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 9 Feb 2024 16:32:58 +0100 Subject: [PATCH 18/24] Require cepces-certmonger This is the package providing cepces-submit required by samba-gpupdate. It will install all the other required packages. --- samba.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index bdb1377..ef63973 100644 --- a/samba.spec +++ b/samba.spec @@ -368,7 +368,7 @@ BuildRequires: python3-etcd %endif %if %{with gpupdate} -BuildRequires: cepces >= 0.3.8 +BuildRequires: cepces-certmonger >= 0.3.8 %endif # pidl requirements @@ -738,7 +738,6 @@ Samba VFS module for GlusterFS integration. %if %{with gpupdate} %package gpupdate Summary: Samba GPO support for clients -Requires: cepces Requires: cepces-certmonger Requires: certmonger Requires: %{name}-ldb-ldap-modules = %{samba_depver} From 98ceb307afb5964366e7704af4ef441e173f0d84 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 19 Feb 2024 14:48:56 +0100 Subject: [PATCH 19/24] Update to version 4.19.5 Guenther --- .gitignore | 2 + samba-4.19-fix-gpupdate-rhel-fedora.patch | 638 ---------------------- samba-4.19-fix-gpupdate-site-aware.patch | 61 --- samba.spec | 13 +- sources | 4 +- 5 files changed, 11 insertions(+), 707 deletions(-) delete mode 100644 samba-4.19-fix-gpupdate-rhel-fedora.patch delete mode 100644 samba-4.19-fix-gpupdate-site-aware.patch diff --git a/.gitignore b/.gitignore index 347f3eb..3ff7881 100644 --- a/.gitignore +++ b/.gitignore @@ -355,3 +355,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.3.tar.asc /samba-4.19.4.tar.xz /samba-4.19.4.tar.asc +/samba-4.19.5.tar.xz +/samba-4.19.5.tar.asc diff --git a/samba-4.19-fix-gpupdate-rhel-fedora.patch b/samba-4.19-fix-gpupdate-rhel-fedora.patch deleted file mode 100644 index 6381e0a..0000000 --- a/samba-4.19-fix-gpupdate-rhel-fedora.patch +++ /dev/null @@ -1,638 +0,0 @@ -From 549b5fe579fc15d63b71b1cc8a0ebf4e4869171b Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Thu, 17 Aug 2023 01:05:54 +0300 -Subject: [PATCH 1/9] gp: Support more global trust directories - -In addition to the SUSE global trust directory, add support for RHEL and -Debian-based distributions (including Ubuntu). - -To determine the correct directory to use, we iterate over the variants -and stop at the first which is a directory. - -In case none is found, fallback to the first option which will produce a -warning as it did previously. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit a1b285e485c0b5a8747499bdbbb9f3f4fc025b2f) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 12 +++++++++++- - 1 file changed, 11 insertions(+), 1 deletion(-) - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index 312c8ddf467..1b90ab46e90 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -45,10 +45,12 @@ cert_wrap = b""" - -----BEGIN CERTIFICATE----- - %s - -----END CERTIFICATE-----""" --global_trust_dir = '/etc/pki/trust/anchors' - endpoint_re = '(https|HTTPS)://(?P[a-zA-Z0-9.-]+)/ADPolicyProvider' + \ - '_CEP_(?P[a-zA-Z]+)/service.svc/CEP' - -+global_trust_dirs = ['/etc/pki/trust/anchors', # SUSE -+ '/etc/pki/ca-trust/source/anchors', # RHEL/Fedora -+ '/usr/local/share/ca-certificates'] # Debian/Ubuntu - - def octet_string_to_objectGUID(data): - """Convert an octet string to an objectGUID.""" -@@ -249,12 +251,20 @@ def getca(ca, url, trust_dir): - return root_certs - - -+def find_global_trust_dir(): -+ """Return the global trust dir using known paths from various Linux distros.""" -+ for trust_dir in global_trust_dirs: -+ if os.path.isdir(trust_dir): -+ return trust_dir -+ return global_trust_dirs[0] -+ - def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): - """Install the root certificate chain.""" - data = dict({'files': [], 'templates': []}, **ca) - url = 'http://%s/CertSrv/mscep/mscep.dll/pkiclient.exe?' % ca['hostname'] - root_certs = getca(ca, url, trust_dir) - data['files'].extend(root_certs) -+ global_trust_dir = find_global_trust_dir() - for src in root_certs: - # Symlink the certs to global trust dir - dst = os.path.join(global_trust_dir, os.path.basename(src)) --- -2.43.0 - - -From c624a1e9b1d09fe2bb3f9778cb616230e57168a8 Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Thu, 17 Aug 2023 01:09:28 +0300 -Subject: [PATCH 2/9] gp: Support update-ca-trust helper - -This is used on RHEL/Fedora instead of update-ca-certificates. They -behave similarly so it's enough to change the command name. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit fa80d1d86439749c44e60cf9075e84dc9ed3c268) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index 1b90ab46e90..cefdafa21b2 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -258,6 +258,10 @@ def find_global_trust_dir(): - return trust_dir - return global_trust_dirs[0] - -+def update_ca_command(): -+ """Return the command to update the CA trust store.""" -+ return which('update-ca-certificates') or which('update-ca-trust') -+ - def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): - """Install the root certificate chain.""" - data = dict({'files': [], 'templates': []}, **ca) -@@ -283,7 +287,7 @@ def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): - # already exists. Ignore the FileExistsError. Preserve the - # existing symlink in the unapply data. - data['files'].append(dst) -- update = which('update-ca-certificates') -+ update = update_ca_command() - if update is not None: - Popen([update]).wait() - # Setup Certificate Auto Enrollment --- -2.43.0 - - -From 086406ca457cc17e15001fb44802276ada068679 Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Fri, 11 Aug 2023 18:46:42 +0300 -Subject: [PATCH 3/9] gp: Change root cert extension suffix - -On Ubuntu, certificates must end in '.crt' in order to be considered by -the `update-ca-certificates` helper. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit bce3a89204545dcab5fb39a712590f6e166f997b) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index cefdafa21b2..c562722906b 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -241,7 +241,8 @@ def getca(ca, url, trust_dir): - certs = load_der_pkcs7_certificates(r.content) - for i in range(0, len(certs)): - cert = certs[i].public_bytes(Encoding.PEM) -- dest = '%s.%d' % (root_cert, i) -+ filename, extension = root_cert.rsplit('.', 1) -+ dest = '%s.%d.%s' % (filename, i, extension) - with open(dest, 'wb') as w: - w.write(cert) - root_certs.append(dest) --- -2.43.0 - - -From c57c32020cc9017191b8c8657ebabe00d552a6e3 Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Fri, 18 Aug 2023 17:06:43 +0300 -Subject: [PATCH 4/9] gp: Test with binary content for certificate data - -This fails all GPO-related tests that call `gpupdate --rsop`. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit 1ef722cf66f9ec99f52939f1cfca031c5fe1ad70) ---- - python/samba/tests/gpo.py | 8 ++++---- - selftest/knownfail.d/gpo | 13 +++++++++++++ - 2 files changed, 17 insertions(+), 4 deletions(-) - create mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py -index e4b75cc62a4..963f873f755 100644 ---- a/python/samba/tests/gpo.py -+++ b/python/samba/tests/gpo.py -@@ -6783,14 +6783,14 @@ class GPOTests(tests.TestCase): - ldb.add({'dn': certa_dn, - 'objectClass': 'certificationAuthority', - 'authorityRevocationList': ['XXX'], -- 'cACertificate': 'XXX', -+ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', - 'certificateRevocationList': ['XXX'], - }) - # Write the dummy pKIEnrollmentService - enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn) - ldb.add({'dn': enroll_dn, - 'objectClass': 'pKIEnrollmentService', -- 'cACertificate': 'XXXX', -+ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', - 'certificateTemplates': ['Machine'], - 'dNSHostName': hostname, - }) -@@ -7201,14 +7201,14 @@ class GPOTests(tests.TestCase): - ldb.add({'dn': certa_dn, - 'objectClass': 'certificationAuthority', - 'authorityRevocationList': ['XXX'], -- 'cACertificate': 'XXX', -+ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', - 'certificateRevocationList': ['XXX'], - }) - # Write the dummy pKIEnrollmentService - enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn) - ldb.add({'dn': enroll_dn, - 'objectClass': 'pKIEnrollmentService', -- 'cACertificate': 'XXXX', -+ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', - 'certificateTemplates': ['Machine'], - 'dNSHostName': hostname, - }) -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -new file mode 100644 -index 00000000000..0aad59607c2 ---- /dev/null -+++ b/selftest/knownfail.d/gpo -@@ -0,0 +1,13 @@ -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_centrify_crontab_ext -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_scripts_ext -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_rsop -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_access -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_files -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_issue -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_motd -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_openssh -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_startup_scripts -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_sudoers -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_symlink -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From c53b2994fd13f4c74cee891e725a4558cdb06b2d Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Wed, 16 Aug 2023 12:20:11 +0300 -Subject: [PATCH 5/9] gp: Convert CA certificates to base64 - -I don't know whether this applies universally, but in our case the -contents of `es['cACertificate'][0]` are binary, so cleanly converting -to a string fails with the following: - -'utf-8' codec can't decode byte 0x82 in position 1: invalid start byte - -We found a fix to be encoding the certificate to base64 when -constructing the CA list. - -Section 4.4.5.2 of MS-CAESO also suggests that the content of -`cACertificate` is binary (OCTET string). - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit 157335ee93eb866f9b6a47486a5668d6e76aced5) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 5 ++--- - selftest/knownfail.d/gpo | 13 ------------- - 2 files changed, 2 insertions(+), 16 deletions(-) - delete mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index c562722906b..c8b5368c16a 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -158,7 +158,7 @@ def fetch_certification_authorities(ldb): - for es in res: - data = { 'name': get_string(es['cn'][0]), - 'hostname': get_string(es['dNSHostName'][0]), -- 'cACertificate': get_string(es['cACertificate'][0]) -+ 'cACertificate': get_string(base64.b64encode(es['cACertificate'][0])) - } - result.append(data) - return result -@@ -176,8 +176,7 @@ def fetch_template_attrs(ldb, name, attrs=None): - return {'msPKI-Minimal-Key-Size': ['2048']} - - def format_root_cert(cert): -- cert = base64.b64encode(cert.encode()) -- return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert, 0, re.DOTALL) -+ return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert.encode(), 0, re.DOTALL) - - def find_cepces_submit(): - certmonger_dirs = [os.environ.get("PATH"), '/usr/lib/certmonger', -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -deleted file mode 100644 -index 0aad59607c2..00000000000 ---- a/selftest/knownfail.d/gpo -+++ /dev/null -@@ -1,13 +0,0 @@ --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_centrify_crontab_ext --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_scripts_ext --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_rsop --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_access --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_files --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_issue --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_motd --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_openssh --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_startup_scripts --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_sudoers --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_symlink --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From fd13702a9cd6475a14113de87ccad6588d2d443b Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Fri, 18 Aug 2023 17:16:23 +0300 -Subject: [PATCH 6/9] gp: Test adding new cert templates enforces changes - -Ensure that cepces-submit reporting additional templates and re-applying -will enforce the updated policy. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit 2d6943a864405f324c467e8c3464c31ac08457b0) ---- - python/samba/tests/bin/cepces-submit | 3 +- - python/samba/tests/gpo.py | 48 ++++++++++++++++++++++++++++ - selftest/knownfail.d/gpo | 2 ++ - 3 files changed, 52 insertions(+), 1 deletion(-) - create mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/tests/bin/cepces-submit b/python/samba/tests/bin/cepces-submit -index 668682a9f58..de63164692b 100755 ---- a/python/samba/tests/bin/cepces-submit -+++ b/python/samba/tests/bin/cepces-submit -@@ -14,4 +14,5 @@ if __name__ == "__main__": - assert opts.auth == 'Kerberos' - if 'CERTMONGER_OPERATION' in os.environ and \ - os.environ['CERTMONGER_OPERATION'] == 'GET-SUPPORTED-TEMPLATES': -- print('Machine') # Report a Machine template -+ templates = os.environ.get('CEPCES_SUBMIT_SUPPORTED_TEMPLATES', 'Machine').split(',') -+ print('\n'.join(templates)) # Report the requested templates -diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py -index 963f873f755..e75c411bde7 100644 ---- a/python/samba/tests/gpo.py -+++ b/python/samba/tests/gpo.py -@@ -6812,6 +6812,23 @@ class GPOTests(tests.TestCase): - self.assertTrue(os.path.exists(machine_crt), - 'Machine key was not generated') - -+ # Subsequent apply should react to new certificate templates -+ os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation' -+ self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES') -+ ext.process_group_policy([], gpos, dname, dname) -+ self.assertTrue(os.path.exists(ca_crt), -+ 'Root CA certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine key was not generated') -+ workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca_cn) -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation certificate was not requested') -+ workstation_key = os.path.join(dname, '%s.Workstation.key' % ca_cn) -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation key was not generated') -+ - # Verify RSOP does not fail - ext.rsop([g for g in gpos if g.name == guid][0]) - -@@ -6829,11 +6846,17 @@ class GPOTests(tests.TestCase): - 'Machine certificate was not removed') - self.assertFalse(os.path.exists(machine_crt), - 'Machine key was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation certificate was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation key was not removed') - out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate() - self.assertNotIn(get_bytes(ca_cn), out, 'CA was not removed') - out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate() - self.assertNotIn(b'Machine', out, - 'Machine certificate not removed') -+ self.assertNotIn(b'Workstation', out, -+ 'Workstation certificate not removed') - - # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate - ldb.delete(certa_dn) -@@ -7233,6 +7256,25 @@ class GPOTests(tests.TestCase): - self.assertTrue(os.path.exists(machine_crt), - 'Machine key was not generated') - -+ # Subsequent apply should react to new certificate templates -+ os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation' -+ self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES') -+ ext.process_group_policy([], gpos, dname, dname) -+ for ca in ca_list: -+ self.assertTrue(os.path.exists(ca_crt), -+ 'Root CA certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine key was not generated') -+ -+ workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca) -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation certificate was not requested') -+ workstation_key = os.path.join(dname, '%s.Workstation.key' % ca) -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation key was not generated') -+ - # Verify RSOP does not fail - ext.rsop([g for g in gpos if g.name == guid][0]) - -@@ -7250,12 +7292,18 @@ class GPOTests(tests.TestCase): - 'Machine certificate was not removed') - self.assertFalse(os.path.exists(machine_crt), - 'Machine key was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation certificate was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation key was not removed') - out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate() - for ca in ca_list: - self.assertNotIn(get_bytes(ca), out, 'CA was not removed') - out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate() - self.assertNotIn(b'Machine', out, - 'Machine certificate not removed') -+ self.assertNotIn(b'Workstation', out, -+ 'Workstation certificate not removed') - - # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate - ldb.delete(certa_dn) -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -new file mode 100644 -index 00000000000..4edc1dce730 ---- /dev/null -+++ b/selftest/knownfail.d/gpo -@@ -0,0 +1,2 @@ -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From 4578c6664ab6eac476ee10afae4a1a95b3b63272 Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Wed, 16 Aug 2023 12:37:17 +0300 -Subject: [PATCH 7/9] gp: Template changes should invalidate cache - -If certificate templates are added or removed, the autoenroll extension -should react to this and reapply the policy. Previously this wasn't -taken into account. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit 2a6ae997f2464b12b72b5314fa80d9784fb0f6c1) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 15 ++++++++++----- - selftest/knownfail.d/gpo | 2 -- - 2 files changed, 10 insertions(+), 7 deletions(-) - delete mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index c8b5368c16a..8233713e8ad 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -262,6 +262,11 @@ def update_ca_command(): - """Return the command to update the CA trust store.""" - return which('update-ca-certificates') or which('update-ca-trust') - -+def changed(new_data, old_data): -+ """Return True if any key present in both dicts has changed.""" -+ return any((new_data[k] != old_data[k] if k in old_data else False) \ -+ for k in new_data.keys()) -+ - def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): - """Install the root certificate chain.""" - data = dict({'files': [], 'templates': []}, **ca) -@@ -351,12 +356,12 @@ class gp_cert_auto_enroll_ext(gp_pol_ext, gp_applier): - # If the policy has changed, unapply, then apply new policy - old_val = self.cache_get_attribute_value(guid, attribute) - old_data = json.loads(old_val) if old_val is not None else {} -- if all([(ca[k] == old_data[k] if k in old_data else False) \ -- for k in ca.keys()]) or \ -- self.cache_get_apply_state() == GPOSTATE.ENFORCE: -+ templates = ['%s.%s' % (ca['name'], t.decode()) for t in get_supported_templates(ca['hostname'])] -+ new_data = { 'templates': templates, **ca } -+ if changed(new_data, old_data) or self.cache_get_apply_state() == GPOSTATE.ENFORCE: - self.unapply(guid, attribute, old_val) -- # If policy is already applied, skip application -- if old_val is not None and \ -+ # If policy is already applied and unchanged, skip application -+ if old_val is not None and not changed(new_data, old_data) and \ - self.cache_get_apply_state() != GPOSTATE.ENFORCE: - return - -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -deleted file mode 100644 -index 4edc1dce730..00000000000 ---- a/selftest/knownfail.d/gpo -+++ /dev/null -@@ -1,2 +0,0 @@ --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From 2d641b736b42f7623955f251ad354439b954159d Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Fri, 18 Aug 2023 17:26:59 +0300 -Subject: [PATCH 8/9] gp: Test disabled enrollment unapplies policy - -For this we need to stage a Registry.pol file with certificate -autoenrollment enabled, but with checkboxes unticked. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit ee814f7707a8ddef2657212cd6d31799501b7bb3) ---- - python/samba/tests/gpo.py | 54 +++++++++++++++++++++++++++++++++++++++ - selftest/knownfail.d/gpo | 1 + - 2 files changed, 55 insertions(+) - create mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py -index e75c411bde7..580f3568de8 100644 ---- a/python/samba/tests/gpo.py -+++ b/python/samba/tests/gpo.py -@@ -281,6 +281,28 @@ b""" - - """ - -+auto_enroll_unchecked_reg_pol = \ -+b""" -+ -+ -+ -+ Software\Policies\Microsoft\Cryptography\AutoEnrollment -+ AEPolicy -+ 0 -+ -+ -+ Software\Policies\Microsoft\Cryptography\AutoEnrollment -+ OfflineExpirationPercent -+ 10 -+ -+ -+ Software\Policies\Microsoft\Cryptography\AutoEnrollment -+ OfflineExpirationStoreNames -+ MY -+ -+ -+""" -+ - advanced_enroll_reg_pol = \ - b""" - -@@ -6836,6 +6858,38 @@ class GPOTests(tests.TestCase): - ret = rsop(self.lp) - self.assertEqual(ret, 0, 'gpupdate --rsop failed!') - -+ # Remove policy by staging pol file with auto-enroll unchecked -+ parser.load_xml(etree.fromstring(auto_enroll_unchecked_reg_pol.strip())) -+ ret = stage_file(reg_pol, ndr_pack(parser.pol_file)) -+ self.assertTrue(ret, 'Could not create the target %s' % reg_pol) -+ ext.process_group_policy([], gpos, dname, dname) -+ self.assertFalse(os.path.exists(ca_crt), -+ 'Root CA certificate was not removed') -+ self.assertFalse(os.path.exists(machine_crt), -+ 'Machine certificate was not removed') -+ self.assertFalse(os.path.exists(machine_crt), -+ 'Machine key was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation certificate was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation key was not removed') -+ -+ # Reapply policy by staging the enabled pol file -+ parser.load_xml(etree.fromstring(auto_enroll_reg_pol.strip())) -+ ret = stage_file(reg_pol, ndr_pack(parser.pol_file)) -+ self.assertTrue(ret, 'Could not create the target %s' % reg_pol) -+ ext.process_group_policy([], gpos, dname, dname) -+ self.assertTrue(os.path.exists(ca_crt), -+ 'Root CA certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine key was not generated') -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation certificate was not requested') -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation key was not generated') -+ - # Remove policy - gp_db = store.get_gplog(machine_creds.get_username()) - del_gpos = get_deleted_gpos_list(gp_db, []) -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -new file mode 100644 -index 00000000000..83bc9f0ac1f ---- /dev/null -+++ b/selftest/knownfail.d/gpo -@@ -0,0 +1 @@ -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From e5588f8800899894388284468b9e25463d3c3e6c Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Wed, 16 Aug 2023 12:33:59 +0300 -Subject: [PATCH 9/9] gp: Send list of keys instead of dict to remove - -`cache_get_all_attribute_values` returns a dict whereas we need to pass -a list of keys to `remove`. These will be interpolated in the gpdb search. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder - -Autobuild-User(master): Andrew Bartlett -Autobuild-Date(master): Mon Aug 28 03:01:22 UTC 2023 on atb-devel-224 - -(cherry picked from commit 7dc181757c76b881ceaf1915ebb0bfbcf5aca83a) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 2 +- - selftest/knownfail.d/gpo | 1 - - 2 files changed, 1 insertion(+), 2 deletions(-) - delete mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index 8233713e8ad..64c35782ae8 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -415,7 +415,7 @@ class gp_cert_auto_enroll_ext(gp_pol_ext, gp_applier): - # remove any existing policy - ca_attrs = \ - self.cache_get_all_attribute_values(gpo.name) -- self.clean(gpo.name, remove=ca_attrs) -+ self.clean(gpo.name, remove=list(ca_attrs.keys())) - - def __read_cep_data(self, guid, ldb, end_point_information, - trust_dir, private_dir): -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -deleted file mode 100644 -index 83bc9f0ac1f..00000000000 ---- a/selftest/knownfail.d/gpo -+++ /dev/null -@@ -1 +0,0 @@ --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - diff --git a/samba-4.19-fix-gpupdate-site-aware.patch b/samba-4.19-fix-gpupdate-site-aware.patch deleted file mode 100644 index 3354bb0..0000000 --- a/samba-4.19-fix-gpupdate-site-aware.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 372b8f15ccf37c491f43ec7ab81be692ff0fcfed Mon Sep 17 00:00:00 2001 -From: David Mulder -Date: Fri, 5 Jan 2024 08:47:07 -0700 -Subject: [PATCH] WIP: gp: Skip site GP list if no site is found - -[MS-GPOL] 3.2.5.1.4 Site Search says if the site -search returns ERROR_NO_SITENAME, the GP site -search should be skipped. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15548 - -Signed-off-by: David Mulder ---- - python/samba/gp/gpclass.py | 30 ++++++++++++++++++------------ - 1 file changed, 18 insertions(+), 12 deletions(-) - -diff --git a/python/samba/gp/gpclass.py b/python/samba/gp/gpclass.py -index b7a0dcb0ed5..26c2386847e 100644 ---- a/python/samba/gp/gpclass.py -+++ b/python/samba/gp/gpclass.py -@@ -896,19 +896,25 @@ def get_gpo_list(dc_hostname, creds, lp, username): - - # (S)ite - if gpo_list_machine: -- site_dn = site_dn_for_machine(samdb, dc_hostname, lp, creds, username) -- - try: -- log.debug("get_gpo_list: query SITE: [%s] for GPOs" % site_dn) -- gp_link = get_gpo_link(samdb, site_dn) -- except ldb.LdbError as e: -- (enum, estr) = e.args -- log.debug(estr) -- else: -- add_gplink_to_gpo_list(samdb, gpo_list, forced_gpo_list, -- site_dn, gp_link, -- gpo.GP_LINK_SITE, -- add_only_forced_gpos, token) -+ site_dn = site_dn_for_machine(samdb, dc_hostname, lp, creds, username) -+ -+ try: -+ log.debug("get_gpo_list: query SITE: [%s] for GPOs" % site_dn) -+ gp_link = get_gpo_link(samdb, site_dn) -+ except ldb.LdbError as e: -+ (enum, estr) = e.args -+ log.debug(estr) -+ else: -+ add_gplink_to_gpo_list(samdb, gpo_list, forced_gpo_list, -+ site_dn, gp_link, -+ gpo.GP_LINK_SITE, -+ add_only_forced_gpos, token) -+ except ldb.LdbError: -+ # [MS-GPOL] 3.2.5.1.4 Site Search: If the method returns -+ # ERROR_NO_SITENAME, the remainder of this message MUST be skipped -+ # and the protocol sequence MUST continue at GPO Search -+ pass - - # (L)ocal - gpo_list.insert(0, gpo.GROUP_POLICY_OBJECT("Local Policy", --- -GitLab - diff --git a/samba.spec b/samba.spec index ef63973..b994f6e 100644 --- a/samba.spec +++ b/samba.spec @@ -143,8 +143,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.4 -%global baserelease 3 +%global samba_version 4.19.5 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -241,9 +241,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.19-fix-gpupdate-rhel-fedora.patch -Patch1: samba-4.19-fix-gpupdate-site-aware.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -4473,7 +4470,11 @@ fi %endif %changelog -* Tue Jan 16 2024 Andreas Schneider - 4.29.4-3 + +* Mon Feb 19 2024 Guenther Deschner - 4.19.5-1 +- Update to version 4.19.5 + +* Tue Jan 16 2024 Andreas Schneider - 4.19.4-3 - Fix samba-gpupdate on Fedora/RHEL * Tue Jan 09 2024 Andreas Schneider - 4.19.4-2 diff --git a/sources b/sources index ed14bdd..ece82e1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.4.tar.xz) = 3d2899e4a3b8bcb77befc29c4af66d3ac858b7f7a0dbbb66a8bc210cd88d9cde3e11361334a5cce650318473134ec8b134148bfa4af4d51f555de33eff395029 -SHA512 (samba-4.19.4.tar.asc) = 11bc51407d1464339817d7568f5d5bb059c19a05b49c6a1307d7425d289acb617ecd3e633e3736bdaa94947a7b3630d6cdb7ed6fe59d52556234c549eca8172a +SHA512 (samba-4.19.5.tar.xz) = 721ee671ffd097d53f3c162b452fcbfd424dd69a50c168b2433eb7d2e12dfdd7af7c2a537c30bceae29062148fdb19d76a385fe974d65e9e529ed8d615d69bb0 +SHA512 (samba-4.19.5.tar.asc) = cc5c666fb1015e4a64d866d21fc45119b7b7773dcf404ac09d7119051a0dfd53704691d32e5afdf3e2cf6e5af86b35376d78e5b890e361ad765d68e0387f4cf3 From eec53817612999b62fa7c80e31eb000033b8b713 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 5 Mar 2024 13:54:33 +0100 Subject: [PATCH 20/24] Silence warnings when upgrading libwbclient --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index b994f6e..1e4c1cd 100644 --- a/samba.spec +++ b/samba.spec @@ -1589,9 +1589,9 @@ fi %if %{with libwbclient} %pre -n libwbclient if [ $1 -gt 1 ] ; then - rm -rf %{_libdir}/samba/wbclient/ - rm -f /etc/alternatives/libwbclient.so* - rm -f /var/lib/alternatives/libwbclient.so* + rm -rf %{_libdir}/samba/wbclient/ 2>/dev/null + rm -f /etc/alternatives/libwbclient.so* 2>/dev/null + rm -f /var/lib/alternatives/libwbclient.so* 2>/dev/null fi %{?ldconfig} #endif {with libwbclient} From bc1a769cee91e686818348f36b24a7dc4bb93fa8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 8 Apr 2024 20:13:49 +0200 Subject: [PATCH 21/24] Update to version 4.19.6 Guenther --- .gitignore | 2 ++ samba.spec | 4 +++- sources | 4 ++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 3ff7881..22bfaf8 100644 --- a/.gitignore +++ b/.gitignore @@ -357,3 +357,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.4.tar.asc /samba-4.19.5.tar.xz /samba-4.19.5.tar.asc +/samba-4.19.6.tar.xz +/samba-4.19.6.tar.asc diff --git a/samba.spec b/samba.spec index 1e4c1cd..6a48470 100644 --- a/samba.spec +++ b/samba.spec @@ -143,7 +143,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.5 +%global samba_version 4.19.6 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4470,6 +4470,8 @@ fi %endif %changelog +* Mon Apr 08 2024 Guenther Deschner - 4.19.6-1 +- Update to version 4.19.6 * Mon Feb 19 2024 Guenther Deschner - 4.19.5-1 - Update to version 4.19.5 diff --git a/sources b/sources index ece82e1..35b70f6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.5.tar.xz) = 721ee671ffd097d53f3c162b452fcbfd424dd69a50c168b2433eb7d2e12dfdd7af7c2a537c30bceae29062148fdb19d76a385fe974d65e9e529ed8d615d69bb0 -SHA512 (samba-4.19.5.tar.asc) = cc5c666fb1015e4a64d866d21fc45119b7b7773dcf404ac09d7119051a0dfd53704691d32e5afdf3e2cf6e5af86b35376d78e5b890e361ad765d68e0387f4cf3 +SHA512 (samba-4.19.6.tar.xz) = 9c454204940d2cddfd04bf4969b5e44e990e283c1db8301ac619ab4dea7dfa59d3467273e44a76a1b50635bdc8d2d64d9e8d00005adb92f5a1763a6a05176f55 +SHA512 (samba-4.19.6.tar.asc) = 5c89d9cb7c8334c7d373279080c6784b756b3208c99b22ccf48d3c081b2775f5e4cf204026068cfa66a25a50d95ac925bc5f83d1ee31c426dd913c0aaa0743a6 From 25d2443519f513ad9cb6afbb2b4ba0d111d79e09 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 11 Jun 2024 13:17:44 +0200 Subject: [PATCH 22/24] Update to version 4.19.7 Guenther --- .gitignore | 2 ++ samba.spec | 11 +++++++++-- sources | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 22bfaf8..7953d96 100644 --- a/.gitignore +++ b/.gitignore @@ -359,3 +359,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.5.tar.asc /samba-4.19.6.tar.xz /samba-4.19.6.tar.asc +/samba-4.19.7.tar.xz +/samba-4.19.7.tar.asc diff --git a/samba.spec b/samba.spec index 6a48470..9c685e4 100644 --- a/samba.spec +++ b/samba.spec @@ -143,7 +143,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.6 +%global samba_version 4.19.7 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -180,7 +180,7 @@ %global talloc_version 2.4.1 %global tdb_version 1.4.9 %global tevent_version 0.15.0 -%global ldb_version 2.8.0 +%global ldb_version 2.8.1 %global required_mit_krb5 1.20.1 @@ -3062,6 +3062,8 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/bug13653.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/check_output.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/http_chunk.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/http_content.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_dns.*.pyc @@ -3079,6 +3081,8 @@ fi %{python3_sitearch}/samba/tests/blackbox/bug13653.py %{python3_sitearch}/samba/tests/blackbox/check_output.py %{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py +%{python3_sitearch}/samba/tests/blackbox/http_chunk.py +%{python3_sitearch}/samba/tests/blackbox/http_content.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py %{python3_sitearch}/samba/tests/blackbox/ndrdump.py %{python3_sitearch}/samba/tests/blackbox/netads_dns.py @@ -4470,6 +4474,9 @@ fi %endif %changelog +* Tue Jun 11 2024 Guenther Deschner - 4.19.7-1 +- Update to version 4.19.7 + * Mon Apr 08 2024 Guenther Deschner - 4.19.6-1 - Update to version 4.19.6 diff --git a/sources b/sources index 35b70f6..b258b14 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.6.tar.xz) = 9c454204940d2cddfd04bf4969b5e44e990e283c1db8301ac619ab4dea7dfa59d3467273e44a76a1b50635bdc8d2d64d9e8d00005adb92f5a1763a6a05176f55 -SHA512 (samba-4.19.6.tar.asc) = 5c89d9cb7c8334c7d373279080c6784b756b3208c99b22ccf48d3c081b2775f5e4cf204026068cfa66a25a50d95ac925bc5f83d1ee31c426dd913c0aaa0743a6 +SHA512 (samba-4.19.7.tar.xz) = 83c3b9e922f24d7594b92f3a0ede55405e370899f23e3cad678cadbad608f500986ba7ec140c5ae24782bc1d15969c32d4665cd1d00866e364b6dd819e0c5e05 +SHA512 (samba-4.19.7.tar.asc) = faf03c169f3eab836038e18690cc6f1e1a82387dbc2474d7fef50a8fea54db0f88eae9a55f82e180d5ecf4e70bb0f6773c8d2ad0a4d8aaf0e23f69073935bf71 From e2c526069f481dd56b901fccca5a97515cfaa863 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 15 Aug 2024 15:55:10 +0200 Subject: [PATCH 23/24] Update to version 4.19.9 Guenther --- .gitignore | 2 ++ samba.spec | 7 ++++++- sources | 4 ++-- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 7953d96..a736a2f 100644 --- a/.gitignore +++ b/.gitignore @@ -361,3 +361,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.6.tar.asc /samba-4.19.7.tar.xz /samba-4.19.7.tar.asc +/samba-4.19.8.tar.xz +/samba-4.19.8.tar.asc diff --git a/samba.spec b/samba.spec index 9c685e4..644c315 100644 --- a/samba.spec +++ b/samba.spec @@ -143,7 +143,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.7 +%global samba_version 4.19.8 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -3065,6 +3065,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_chunk.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_content.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/misc_dfs_widelink.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_dns.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_json.*.pyc @@ -3084,6 +3085,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/http_chunk.py %{python3_sitearch}/samba/tests/blackbox/http_content.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py +%{python3_sitearch}/samba/tests/blackbox/misc_dfs_widelink.py %{python3_sitearch}/samba/tests/blackbox/ndrdump.py %{python3_sitearch}/samba/tests/blackbox/netads_dns.py %{python3_sitearch}/samba/tests/blackbox/netads_json.py @@ -4474,6 +4476,9 @@ fi %endif %changelog +* Thu Aug 15 2024 Guenther Deschner - 4.19.8-1 +- Update to version 4.19.8 + * Tue Jun 11 2024 Guenther Deschner - 4.19.7-1 - Update to version 4.19.7 diff --git a/sources b/sources index b258b14..c631faa 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.7.tar.xz) = 83c3b9e922f24d7594b92f3a0ede55405e370899f23e3cad678cadbad608f500986ba7ec140c5ae24782bc1d15969c32d4665cd1d00866e364b6dd819e0c5e05 -SHA512 (samba-4.19.7.tar.asc) = faf03c169f3eab836038e18690cc6f1e1a82387dbc2474d7fef50a8fea54db0f88eae9a55f82e180d5ecf4e70bb0f6773c8d2ad0a4d8aaf0e23f69073935bf71 +SHA512 (samba-4.19.8.tar.xz) = 4cdc5cb4e88695c8eab636243940bcf7a90e55b179f89c3049a2603281cb878bfab605e045b5c808dbef49eb74e03545389446c5edda2142c607366bac6a7b19 +SHA512 (samba-4.19.8.tar.asc) = c6ca4e776bfdf3d92cedcd50b9b9a522786a09871388a4a810719d47f55975196e02f515c4912ff38f5316be485c228d6cde3fa860dc2d2529f718b2ebaac2dd From 77b08991121505a8d3ac19a6a74cafd8a43be8c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 17 Oct 2024 15:38:39 +0200 Subject: [PATCH 24/24] Update to version 4.19.9 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index a736a2f..2a49fcd 100644 --- a/.gitignore +++ b/.gitignore @@ -363,3 +363,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.7.tar.asc /samba-4.19.8.tar.xz /samba-4.19.8.tar.asc +/samba-4.19.9.tar.xz +/samba-4.19.9.tar.asc diff --git a/samba.spec b/samba.spec index 644c315..5c81e39 100644 --- a/samba.spec +++ b/samba.spec @@ -143,7 +143,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.8 +%global samba_version 4.19.9 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -180,7 +180,7 @@ %global talloc_version 2.4.1 %global tdb_version 1.4.9 %global tevent_version 0.15.0 -%global ldb_version 2.8.1 +%global ldb_version 2.8.2 %global required_mit_krb5 1.20.1 @@ -4476,6 +4476,9 @@ fi %endif %changelog +* Thu Oct 17 2024 Guenther Deschner - 4.19.9-1 +- Update to version 4.19.9 + * Thu Aug 15 2024 Guenther Deschner - 4.19.8-1 - Update to version 4.19.8 diff --git a/sources b/sources index c631faa..3f3064d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.8.tar.xz) = 4cdc5cb4e88695c8eab636243940bcf7a90e55b179f89c3049a2603281cb878bfab605e045b5c808dbef49eb74e03545389446c5edda2142c607366bac6a7b19 -SHA512 (samba-4.19.8.tar.asc) = c6ca4e776bfdf3d92cedcd50b9b9a522786a09871388a4a810719d47f55975196e02f515c4912ff38f5316be485c228d6cde3fa860dc2d2529f718b2ebaac2dd +SHA512 (samba-4.19.9.tar.xz) = 63612f80d70f67ffa42e43108103a1747b83858be01e6d4ed24a6d1bfcf7ec2f9e739b16d32c5205fec2ffbca845df6e6597c5d99d8f2683d6c5f3ef4c807532 +SHA512 (samba-4.19.9.tar.asc) = fdbc8573a543ec3b9e7eaac4346e95c1410efdc3274ae5d8f3b6d8e8c2c07fa5d14c55713b057163adae26a3bf9c5092928455a59364eec2024b6876ba5df281