From f24bbdaf786f2f75a82df28ddffb5491d7db6b35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 8 Feb 2025 23:02:27 +0100 Subject: [PATCH 01/93] Update to version 4.22.0rc1 - resolves: rhbz#2344189 Guenther --- samba-4-21-fix-smbreadline.patch | 112 ---- samba-4-21-pycrypt.patch | 943 ------------------------------- samba-4.21.0-s3-notifyd.patch | 513 ----------------- samba.spec | 36 +- sources | 4 +- 5 files changed, 23 insertions(+), 1585 deletions(-) delete mode 100644 samba-4-21-fix-smbreadline.patch delete mode 100644 samba-4-21-pycrypt.patch delete mode 100644 samba-4.21.0-s3-notifyd.patch diff --git a/samba-4-21-fix-smbreadline.patch b/samba-4-21-fix-smbreadline.patch deleted file mode 100644 index 9fd288d..0000000 --- a/samba-4-21-fix-smbreadline.patch +++ /dev/null @@ -1,112 +0,0 @@ -From 36e3944418789f5d2018063fa3988c318baa0a35 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Jan 2025 17:59:12 +0100 -Subject: [PATCH 1/2] lib:replace: Remove trailing spaces from readline.h - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit dbff53f77680f0ccd022f2d864ba6ae7585a34b7) ---- - lib/replace/system/readline.h | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h -index 29379626e0d..9a9af266ca6 100644 ---- a/lib/replace/system/readline.h -+++ b/lib/replace/system/readline.h -@@ -1,14 +1,14 @@ - #ifndef _system_readline_h - #define _system_readline_h --/* -+/* - Unix SMB/CIFS implementation. - - Readline wrappers -- -+ - ** NOTE! The following LGPL license applies to the replace - ** library. This does NOT imply that all of Samba is released - ** under the LGPL -- -+ - This library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either --- -2.48.1 - - -From 6944f700dcd4ad795652070dfb04135d602622a2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Jan 2025 17:59:27 +0100 -Subject: [PATCH 2/2] lib:replace: Don't use deprecated readline CPPFunction - cast -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -HAVE_RL_COMPLETION_FUNC_T was unused and not checking for the right -function. - -libcli/smbreadline/smbreadline.c: In function ‘smb_readline’: -libcli/smbreadline/smbreadline.c:139:17: warning: ‘CPPFunction’ is deprecated [-Wdeprecated-declarations] - 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -libcli/smbreadline/smbreadline.c:139:50: error: assignment to ‘char ** (*)(const char *, int, int)’ from incompatible pointer type ‘char ** (*)(void)’ [-Wincompatible-pointer-types] - 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; - | ^ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Tue Jan 21 19:38:37 UTC 2025 on atb-devel-224 - -(cherry picked from commit 9aa5c43315d83c19514251a11c4fba5a137f2821) ---- - lib/replace/system/readline.h | 4 +++- - libcli/smbreadline/wscript_configure | 8 +++++--- - 2 files changed, 8 insertions(+), 4 deletions(-) - -diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h -index 9a9af266ca6..ac3604fc12e 100644 ---- a/lib/replace/system/readline.h -+++ b/lib/replace/system/readline.h -@@ -46,7 +46,9 @@ - #endif - - #ifdef HAVE_NEW_LIBREADLINE --#ifdef HAVE_CPPFUNCTION -+#if defined(HAVE_RL_COMPLETION_FUNC_T) -+# define RL_COMPLETION_CAST (rl_completion_func_t *) -+#elif defined(HAVE_CPPFUNCTION) - # define RL_COMPLETION_CAST (CPPFunction *) - #elif defined(HAVE_RL_COMPLETION_T) - # define RL_COMPLETION_CAST (rl_completion_t *) -diff --git a/libcli/smbreadline/wscript_configure b/libcli/smbreadline/wscript_configure -index 912ff53a150..f5a401ebae0 100644 ---- a/libcli/smbreadline/wscript_configure -+++ b/libcli/smbreadline/wscript_configure -@@ -51,10 +51,12 @@ conf.CHECK_CODE(''' - # endif - # endif - #endif --int main(void) {rl_completion_t f; return 0;} -+int main(void) {rl_completion_func_t f; return 0;} - ''', --'HAVE_RL_COMPLETION_FUNC_T', execute=False, addmain=False, --msg='Checking for rl_completion_t') -+ 'HAVE_RL_COMPLETION_FUNC_T', -+ execute=False, -+ addmain=False, -+ msg='Checking for rl_completion_func_t') - - conf.CHECK_CODE(''' - #ifdef HAVE_READLINE_READLINE_H --- -2.48.1 - diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch deleted file mode 100644 index bf4c1e5..0000000 --- a/samba-4-21-pycrypt.patch +++ /dev/null @@ -1,943 +0,0 @@ -From 07fe7b437c695c7a715418d4414c930b72758dab Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 5 Dec 2024 16:35:51 +1300 -Subject: [PATCH 01/11] util: add a crypt wrapper, derived from - dsdb:password_hash - -This is going to be used by the dsdb password_hash module, and exposed -to Python via pyglue. - -We're doing this because Python 3.13 has dropped crypt from the Python -standard library. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Reviewed-by: Andreas Schneider -(cherry picked from commit 833455c7f9f71583d567e3a53e854567cd8c3b0b) ---- - lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ - lib/util/util_crypt.h | 5 +++ - lib/util/wscript_build | 6 +++ - 3 files changed, 101 insertions(+) - create mode 100644 lib/util/util_crypt.c - create mode 100644 lib/util/util_crypt.h - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -new file mode 100644 -index 00000000000..0f7b2d0fd31 ---- /dev/null -+++ b/lib/util/util_crypt.c -@@ -0,0 +1,90 @@ -+#include -+#include "data_blob.h" -+#include -+#include -+#include "util_crypt.h" -+ -+ -+static int crypt_as_best_we_can(const char *phrase, -+ const char *setting, -+ const char **hashp) -+{ -+ int ret = 0; -+ const char *hash = NULL; -+ -+#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) -+ struct crypt_data crypt_data = { -+ .initialized = 0 /* working storage used by crypt */ -+ }; -+#endif -+ -+ /* -+ * crypt_r() and crypt() may return a null pointer upon error -+ * depending on how libcrypt was configured, so we prefer -+ * crypt_rn() from libcrypt / libxcrypt which always returns -+ * NULL on error. -+ * -+ * POSIX specifies returning a null pointer and setting -+ * errno. -+ * -+ * RHEL 7 (which does not use libcrypt / libxcrypt) returns a -+ * non-NULL pointer from crypt_r() on success but (always?) -+ * sets errno during internal processing in the NSS crypto -+ * subsystem. -+ * -+ * By preferring crypt_rn we avoid the 'return non-NULL but -+ * set-errno' that we otherwise cannot tell apart from the -+ * RHEL 7 behaviour. -+ */ -+ errno = 0; -+ -+#ifdef HAVE_CRYPT_RN -+ hash = crypt_rn(phrase, setting, -+ &crypt_data, -+ sizeof(crypt_data)); -+#elif HAVE_CRYPT_R -+ hash = crypt_r(phrase, setting, &crypt_data); -+#else -+ /* -+ * No crypt_r falling back to crypt, which is NOT thread safe -+ * Thread safety MT-Unsafe race:crypt -+ */ -+ hash = crypt(phrase, setting); -+#endif -+ /* -+ * On error, crypt() and crypt_r() may return a null pointer, -+ * or a pointer to an invalid hash beginning with a '*'. -+ */ -+ ret = errno; -+ errno = 0; -+ if (hash == NULL || hash[0] == '*') { -+ if (ret == 0) { -+ /* this is annoying */ -+ ret = ENOTRECOVERABLE; -+ } -+ } -+ -+ *hashp = hash; -+ return ret; -+} -+ -+ -+int talloc_crypt_blob(TALLOC_CTX *mem_ctx, -+ const char *phrase, -+ const char *setting, -+ DATA_BLOB *blob) -+{ -+ const char *hash = NULL; -+ int ret = crypt_as_best_we_can(phrase, setting, &hash); -+ if (ret != 0) { -+ blob->data = NULL; -+ blob->length = 0; -+ return ret; -+ } -+ blob->length = strlen(hash); -+ blob->data = talloc_memdup(mem_ctx, hash, blob->length); -+ if (blob->data == NULL) { -+ return ENOMEM; -+ } -+ return 0; -+} -diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h -new file mode 100644 -index 00000000000..8c289e489e8 ---- /dev/null -+++ b/lib/util/util_crypt.h -@@ -0,0 +1,5 @@ -+ -+int talloc_crypt_blob(TALLOC_CTX *mem_ctx, -+ const char *phrase, -+ const char *cmd, -+ DATA_BLOB *blob); -diff --git a/lib/util/wscript_build b/lib/util/wscript_build -index b4fcfeaba07..7de9c0b7b17 100644 ---- a/lib/util/wscript_build -+++ b/lib/util/wscript_build -@@ -253,6 +253,12 @@ else: - private_library=True, - local_include=False) - -+ bld.SAMBA_LIBRARY('util_crypt', -+ source='util_crypt.c', -+ deps='talloc crypt', -+ private_library=True, -+ local_include=False) -+ - - bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', - source='unix_privs.c', --- -2.48.1 - - -From adf180613e4172292090d4c3573a439388a09788 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:29:21 +1300 -Subject: [PATCH 02/11] dsdb:password_hash: move hash_blob allocation up - -This will make the next patch simpler. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 1edb12f79593d0b2aac36d5acdaaae6f495772f6) ---- - source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ - 1 file changed, 8 insertions(+), 6 deletions(-) - -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index 1d1267624e2..c1902126a72 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -1649,6 +1649,13 @@ static int setup_primary_userPassword_hash( - } - } - -+ hash_blob = talloc_zero(ctx, DATA_BLOB); -+ -+ if (hash_blob == NULL) { -+ TALLOC_FREE(frame); -+ return ldb_oom(ldb); -+ } -+ - /* - * Relies on the assertion that cleartext_utf8->data is a zero - * terminated UTF-8 string -@@ -1712,15 +1719,10 @@ static int setup_primary_userPassword_hash( - scheme, - reason); - TALLOC_FREE(frame); -+ TALLOC_FREE(hash_blob); - return LDB_ERR_OPERATIONS_ERROR; - } - -- hash_blob = talloc_zero(ctx, DATA_BLOB); -- -- if (hash_blob == NULL) { -- TALLOC_FREE(frame); -- return ldb_oom(ldb); -- } - - *hash_blob = data_blob_talloc(hash_blob, - (const uint8_t *)hash, --- -2.48.1 - - -From 9d43e4d649db23549bbb230ed60426fa286b7ab7 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 11:16:22 +1300 -Subject: [PATCH 03/11] dsdb:password_hash: use talloc_crypt_blob() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit c7597380b479208e33a403211cec9b3c7bd3f034) ---- - .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- - .../samdb/ldb_modules/wscript_build_server | 2 +- - 2 files changed, 13 insertions(+), 57 deletions(-) - -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index c1902126a72..7a7114c1caa 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -51,6 +51,7 @@ - #include "auth/common_auth.h" - #include "lib/messaging/messaging.h" - #include "lib/param/loadparm.h" -+#include "lib/util/util_crypt.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -@@ -1592,16 +1593,11 @@ static int setup_primary_userPassword_hash( - struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module); - const char *salt = NULL; /* Randomly generated salt */ - const char *cmd = NULL; /* command passed to crypt */ -- const char *hash = NULL; /* password hash generated by crypt */ - int algorithm = 0; /* crypt hash algorithm number */ - int rounds = 0; /* The number of hash rounds */ -+ int ret; - DATA_BLOB *hash_blob = NULL; - TALLOC_CTX *frame = talloc_stackframe(); --#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) -- struct crypt_data crypt_data = { -- .initialized = 0 /* working storage used by crypt */ -- }; --#endif - - /* Generate a random password salt */ - salt = generate_random_str_list(frame, -@@ -1660,52 +1656,20 @@ static int setup_primary_userPassword_hash( - * Relies on the assertion that cleartext_utf8->data is a zero - * terminated UTF-8 string - */ -- -- /* -- * crypt_r() and crypt() may return a null pointer upon error -- * depending on how libcrypt was configured, so we prefer -- * crypt_rn() from libcrypt / libxcrypt which always returns -- * NULL on error. -- * -- * POSIX specifies returning a null pointer and setting -- * errno. -- * -- * RHEL 7 (which does not use libcrypt / libxcrypt) returns a -- * non-NULL pointer from crypt_r() on success but (always?) -- * sets errno during internal processing in the NSS crypto -- * subsystem. -- * -- * By preferring crypt_rn we avoid the 'return non-NULL but -- * set-errno' that we otherwise cannot tell apart from the -- * RHEL 7 behaviour. -- */ -- errno = 0; -- --#ifdef HAVE_CRYPT_RN -- hash = crypt_rn((char *)io->n.cleartext_utf8->data, -- cmd, -- &crypt_data, -- sizeof(crypt_data)); --#elif HAVE_CRYPT_R -- hash = crypt_r((char *)io->n.cleartext_utf8->data, cmd, &crypt_data); --#else -- /* -- * No crypt_r falling back to crypt, which is NOT thread safe -- * Thread safety MT-Unsafe race:crypt -- */ -- hash = crypt((char *)io->n.cleartext_utf8->data, cmd); --#endif -- /* -- * On error, crypt() and crypt_r() may return a null pointer, -- * or a pointer to an invalid hash beginning with a '*'. -- */ -- if (hash == NULL || hash[0] == '*') { -+ ret = talloc_crypt_blob(hash_blob, -+ (char *)io->n.cleartext_utf8->data, -+ cmd, -+ hash_blob); -+ if (ret != 0) { - char buf[1024]; - const char *reason = NULL; -- if (errno == ERANGE) { -+ if (ret == ERANGE) { - reason = "Password exceeds maximum length allowed for crypt() hashing"; -+ } else if (ret == ENOTRECOVERABLE) { -+ /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ -+ reason = "Unknown error"; - } else { -- int err = strerror_r(errno, buf, sizeof(buf)); -+ int err = strerror_r(ret, buf, sizeof(buf)); - if (err == 0) { - reason = buf; - } else { -@@ -1723,14 +1687,6 @@ static int setup_primary_userPassword_hash( - return LDB_ERR_OPERATIONS_ERROR; - } - -- -- *hash_blob = data_blob_talloc(hash_blob, -- (const uint8_t *)hash, -- strlen(hash)); -- if (hash_blob->data == NULL) { -- TALLOC_FREE(frame); -- return ldb_oom(ldb); -- } - hash_value->value = hash_blob; - TALLOC_FREE(frame); - return LDB_SUCCESS; -diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server -index 9c1eb12a7c2..16d9b31a982 100644 ---- a/source4/dsdb/samdb/ldb_modules/wscript_build_server -+++ b/source4/dsdb/samdb/ldb_modules/wscript_build_server -@@ -195,7 +195,7 @@ bld.SAMBA_MODULE('ldb_password_hash', - init_function='ldb_password_hash_module_init', - module_init_name='ldb_init_module', - internal_module=False, -- deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS crypt db-glue' -+ deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS util_crypt db-glue' - ) - - --- -2.48.1 - - -From 1c94645881bd5130c67bfee96aa463f360df300a Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:30:04 +1300 -Subject: [PATCH 04/11] util: add a crypt strerror helper - -This will be used by Python also. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 5f365e71c1fa8cdc533159283a5977164b5d39f2) ---- - lib/util/util_crypt.c | 24 +++++++++++++++++++ - lib/util/util_crypt.h | 2 ++ - .../dsdb/samdb/ldb_modules/password_hash.c | 16 +------------ - 3 files changed, 27 insertions(+), 15 deletions(-) - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -index 0f7b2d0fd31..09cd47597d1 100644 ---- a/lib/util/util_crypt.c -+++ b/lib/util/util_crypt.c -@@ -88,3 +88,27 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - } - return 0; - } -+ -+ -+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error) -+{ -+ char buf[1024]; -+ int err; -+ if (error == ERANGE) { -+ return talloc_strdup( -+ mem_ctx, -+ "Password exceeds maximum length allowed for crypt() hashing"); -+ } -+ if (error == ENOTRECOVERABLE) { -+ /* probably weird RHEL7 crypt, see crypt_as_best_we_can() */ -+ goto unknown; -+ } -+ -+ err = strerror_r(error, buf, sizeof(buf)); -+ if (err != 0) { -+ goto unknown; -+ } -+ return talloc_strndup(mem_ctx, buf, sizeof(buf)); -+unknown: -+ return talloc_strdup(mem_ctx, "Unknown error"); -+} -diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h -index 8c289e489e8..ca1a58e922c 100644 ---- a/lib/util/util_crypt.h -+++ b/lib/util/util_crypt.h -@@ -3,3 +3,5 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - const char *phrase, - const char *cmd, - DATA_BLOB *blob); -+ -+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error); -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index 7a7114c1caa..6949a92fc3e 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -1661,21 +1661,7 @@ static int setup_primary_userPassword_hash( - cmd, - hash_blob); - if (ret != 0) { -- char buf[1024]; -- const char *reason = NULL; -- if (ret == ERANGE) { -- reason = "Password exceeds maximum length allowed for crypt() hashing"; -- } else if (ret == ENOTRECOVERABLE) { -- /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ -- reason = "Unknown error"; -- } else { -- int err = strerror_r(ret, buf, sizeof(buf)); -- if (err == 0) { -- reason = buf; -- } else { -- reason = "Unknown error"; -- } -- } -+ const char *reason = talloc_crypt_errstring(frame, ret); - ldb_asprintf_errstring( - ldb, - "setup_primary_userPassword: generation of a %s " --- -2.48.1 - - -From ce70e852783ec69104d274def931e7d39f17576a Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:30:15 +1300 -Subject: [PATCH 05/11] pyglue: add crypt() function - -This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in -turn wraps the system crypt[_r[n]]. - -We want this because the Python standard library crypt module is going -away. That one also wrapped the system crypt or crypt_r, so there -should be no change. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(backported from commit 88e3c82d88a68cf972f8189e1c3718698b49974a) ---- - python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ - python/wscript | 1 + - 2 files changed, 42 insertions(+) - -diff --git a/python/pyglue.c b/python/pyglue.c -index 042bf9e14f3..fcccb849f5e 100644 ---- a/python/pyglue.c -+++ b/python/pyglue.c -@@ -18,6 +18,7 @@ - */ - - #include "lib/replace/system/python.h" -+#include "pyerrors.h" - #include "python/py3compat.h" - #include "includes.h" - #include "python/modules.h" -@@ -25,6 +26,7 @@ - #include "param/pyparam.h" - #include "lib/socket/netif.h" - #include "lib/util/debug.h" -+#include "lib/util/util_crypt.h" - #include "librpc/ndr/ndr_private.h" - #include "lib/cmdline/cmdline.h" - #include "lib/crypto/gkdi.h" -@@ -519,6 +521,42 @@ static PyObject *py_get_burnt_commandline(PyObject *self, PyObject *args) - return ret; - } - -+static PyObject *py_crypt(PyObject *self, PyObject *args) -+{ -+ PyObject *py_hash = NULL; -+ char *phrase = NULL; -+ char *setting = NULL; -+ TALLOC_CTX *frame = NULL; -+ int ret; -+ DATA_BLOB hash = {}; -+ -+ if (!PyArg_ParseTuple(args, "ss", &phrase, &setting)) { -+ TALLOC_FREE(frame); -+ return NULL; -+ } -+ frame = talloc_stackframe(); -+ ret = talloc_crypt_blob(frame, phrase, setting, &hash); -+ if (ret != 0) { -+ const char *errstr = talloc_crypt_errstring(frame, ret); -+ if (ret == EINVAL || ret == ERANGE || ret == ENOTRECOVERABLE) { -+ PyErr_Format(PyExc_ValueError, -+ "could not crypt(): %s", -+ errstr); -+ } else { -+ PyErr_Format(PyExc_OSError, -+ "could not crypt(): %s", -+ errstr); -+ } -+ TALLOC_FREE(frame); -+ return NULL; -+ } -+ -+ py_hash = PyUnicode_FromStringAndSize((char *)hash.data, hash.length); -+ TALLOC_FREE(frame); -+ return py_hash; -+} -+ -+ - static PyMethodDef py_misc_methods[] = { - { "generate_random_str", (PyCFunction)py_generate_random_str, METH_VARARGS, - "generate_random_str(len) -> string\n" -@@ -580,6 +618,9 @@ static PyMethodDef py_misc_methods[] = { - METH_NOARGS, "How many NDR internal tokens is too many for this build?" }, - { "get_burnt_commandline", (PyCFunction)py_get_burnt_commandline, - METH_VARARGS, "Return a redacted commandline to feed to setproctitle (None if no redaction required)" }, -+ { "crypt", (PyCFunction)py_crypt, -+ METH_VARARGS, -+ "encrypt as phrase, per crypt(3), as determined by setting." }, - {0} - }; - -diff --git a/python/wscript b/python/wscript -index 3e6439930e9..7c17e390dc7 100644 ---- a/python/wscript -+++ b/python/wscript -@@ -119,6 +119,7 @@ def build(bld): - ndr - cmdline - gkdi -+ util_crypt - %s - ''' % (pyparam_util, pytalloc_util), - realname='samba/_glue.so') --- -2.48.1 - - -From 9a0dc2db7cde22f36583159c0d697a3de6640990 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 10:44:07 +1300 -Subject: [PATCH 06/11] pytest: test that _glue.crypt works - -The test vectors were generated via Python 3.10 crypt module, which -directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. - -We mainly test the sha256 and sha512 vectors, which seems to be all we -use, and which are said to be widely supported. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 5636d30c0959fd4a211ee7b8d1b267dcdbf0b963) ---- - python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ - 1 file changed, 65 insertions(+) - -diff --git a/python/samba/tests/glue.py b/python/samba/tests/glue.py -index ac504b3f366..824f5ca0c81 100644 ---- a/python/samba/tests/glue.py -+++ b/python/samba/tests/glue.py -@@ -88,3 +88,68 @@ class GlueTests(samba.tests.TestCase): - self.assertEqual(_glue.strstr_m(string, '_'), '_string_num__one') - self.assertEqual(_glue.strstr_m(string, '__'), '__one') - self.assertEqual(_glue.strstr_m(string, 'ring'), 'ring_num__one') -+ -+ def test_crypt(self): -+ # We hopefully only use schemes 5 and 6 (sha256 and sha512), -+ # which are OK and also quite widely supported according to -+ # https://en.wikipedia.org/wiki/Crypt_(C) -+ for phrase, setting, expected in [ -+ ("a", "$5$aaaaaa", -+ "$5$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6"), -+ # with scheme 5, 5000 rounds is default, so hash is the same as above -+ ('a', '$5$rounds=5000$aaaaaa', -+ '$5$rounds=5000$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6'), -+ ('a', -+ '$5$rounds=4999$aaaaaa', -+ '$5$rounds=4999$aaaaaa$FiP70gtxOJUFLokUJvET06E7jbL6aNmF6Wtv2ddzjY8'), -+ ('a', '$5$aaaaab', -+ '$5$aaaaab$e9qR2F833/JyuMu.nkQc9kn184vBWLo0ODqnCe./mj0'), -+ -+ ('', '$5$aaaaaa', '$5$aaaaaa$5B4WTdWp5n/v/aNUw2N8RsEitqvlZJEaAKhH/pOkGg4'), -+ -+ ("a", "$6$aaaaaa", -+ "$6$aaaaaa$KHs/Ez7X/I5/K.V8FR7kEsx9rOvjXnEDUmGC.dLBWP87XWy.oUEAM7QYcZQRVhiDwGepOF2pKrCVETYLyASh60"), -+ -+ ('', '$5$', '$5$$3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.'), -+ -+ # scheme 1 (md5) should be supported if not used -+ ('a', '$1$aaaaaa', -+ '$1$aaaaaa$MUMWPbGfzrHFCNm7ZHg31.'), -+ -+ ('', '$6$', -+ '$6$$/chiBau24cE26QQVW3IfIe68Xu5.JQ4E8Ie7lcRLwqxO5cxGuBhqF2HmTL.zWJ9zjChg3yJYFXeGBQ2y3Ba1d1'), -+ (' ', -+ '$6$6', -+ '$6$6$asLnbxf0obyuv3ybNvDE9ZcdwGFkDhLe7uW.wzdOdKCm4/M3vGFKq4Ttk1tBQrOn4wALZ3tj1L8IarIu5i8hR/'), -+ -+ # original DES scheme, 12 bits of salt -+ ("a", "lalala", "laKGbFzgh./R2"), -+ ("a", "lalalaLALALAla", "laKGbFzgh./R2"), -+ ("a", "arrgh", "ar7VUiUvDhX2c"), -+ ("a", "arrggghhh", "ar7VUiUvDhX2c"), -+ ]: -+ hash = _glue.crypt(phrase, setting) -+ self.assertEqual(hash, expected) -+ -+ def test_crypt_bad(self): -+ # We can't be too strident in our assertions, because every -+ # system allows a different set of algorithms, and some have -+ # different ideas of how to parse. -+ for phrase, setting, exception in [ -+ ("a", "$5", ValueError), -+ ("a", "$0$", ValueError), -+ ("a", None, TypeError), -+ (None, "", TypeError), -+ ('a', '$66$', ValueError), -+ ('a', '$$', ValueError), -+ ('a', '*0', ValueError), -+ ('a', '*', ValueError), -+ ('a', '++', ValueError), -+ # this next one is too long, except on Rocky Linux 8. -+ #('a' * 10000, '$5$5', ValueError), -+ # this is invalid, except on Debian 11. -+ # (' ', '$6$ ', ValueError), -+ ]: -+ with self.assertRaises(exception, -+ msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): -+ _glue.crypt(phrase, setting) --- -2.48.1 - - -From 6425e2514052027ee2269e15e0e0dff1686fa34e Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 15:54:48 +1300 -Subject: [PATCH 07/11] samba-tool user: use _glue.crypt, not crypt.crypt - -Because we know we have _glue.crypt, and we know it raises exceptions -rather than returning None, we can simplify the checks. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 405187d2ef4920a9a284649c9c3287f5844d5180) ---- - .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- - 1 file changed, 6 insertions(+), 15 deletions(-) - -diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py -index 7944d4e1682..68befb3f356 100644 ---- a/python/samba/netcmd/user/readpasswords/common.py -+++ b/python/samba/netcmd/user/readpasswords/common.py -@@ -37,6 +37,7 @@ from samba.netcmd import Command, CommandError - from samba.samdb import SamDB - from samba.nt_time import timedelta_from_nt_time_delta, nt_time_from_datetime - from samba.gkdi import MAX_CLOCK_SKEW -+from samba._glue import crypt - - # python[3]-gpgme is abandoned since ubuntu 1804 and debian 9 - # have to use python[3]-gpg instead -@@ -132,9 +133,7 @@ def get_crypt_value(alg, utf8pw, rounds=0): - else: - crypt_salt = "$%s$%s$" % (alg, b64salt) - -- crypt_value = crypt.crypt(utf8pw, crypt_salt) -- if crypt_value is None: -- raise NotImplementedError("crypt.crypt(%s) returned None" % (crypt_salt)) -+ crypt_value = crypt(utf8pw, crypt_salt) - expected_len = len(crypt_salt) + algs[alg]["length"] - if len(crypt_value) != expected_len: - raise NotImplementedError("crypt.crypt(%s) returned a value with length %d, expected length is %d" % ( -@@ -156,21 +155,13 @@ except ImportError as e: - - for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: - try: -- import crypt - get_crypt_value(alg, "") -- virtual_attributes[attr] = { -- } -- except ImportError as e: -- reason = "crypt" -- reason += " required" -- disabled_virtual_attributes[attr] = { -- "reason": reason, -- } -- except NotImplementedError as e: -- reason = "modern '$%s$' salt in crypt(3) required" % (alg) -+ except (ValueError, OSError): - disabled_virtual_attributes[attr] = { -- "reason": reason, -+ "reason": f"modern '${alg}$' salt in crypt(3) required" - } -+ continue -+ virtual_attributes[attr] = {} - - # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 - for x in range(1, 30): --- -2.48.1 - - -From a2a04286e13676177c952e67363fc7502f544861 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 15:56:20 +1300 -Subject: [PATCH 08/11] samba-tool user: hashlib.sha1 is always present - -We maybe thought we were checking that sha1 was in hashlib, but we were -only checking that hashlib is in the Python library (`hashlib.sha1()` -would not raise ImportError). - -The documentation says hashlib always contains sha1 -- if that -changes, it is better we know by failing noisily with the import error -at the top of the file. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 4af4dd8135e8edbe2a16cfdfc7ded8c145c82e98) ---- - python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ - 1 file changed, 4 insertions(+), 12 deletions(-) - -diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py -index 68befb3f356..3043525874e 100644 ---- a/python/samba/netcmd/user/readpasswords/common.py -+++ b/python/samba/netcmd/user/readpasswords/common.py -@@ -26,6 +26,7 @@ import datetime - import errno - import io - import os -+from hashlib import sha1 - - import ldb - from samba import credentials, nttime2float -@@ -141,17 +142,8 @@ def get_crypt_value(alg, utf8pw, rounds=0): - return crypt_value - - --try: -- import hashlib -- hashlib.sha1() -- virtual_attributes["virtualSSHA"] = { -- } --except ImportError as e: -- reason = "hashlib.sha1()" -- reason += " required" -- disabled_virtual_attributes["virtualSSHA"] = { -- "reason": reason, -- } -+ -+virtual_attributes["virtualSSHA"] = {} - - for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: - try: -@@ -736,7 +728,7 @@ class GetPasswordCommand(Command): - if u8 is None: - continue - salt = os.urandom(4) -- h = hashlib.sha1() -+ h = sha1() - h.update(u8) - h.update(salt) - bv = h.digest() + salt --- -2.48.1 - - -From e9a8748f3cc4ba74f8b0d75e7a01866e7c12a0a4 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 10:46:16 +1300 -Subject: [PATCH 09/11] pytest: password_hash uses internal _glue.crypt - -This will remove an external dependency. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 552053b6445611ecef6ac4c11c55ebf92f03571d) ---- - python/samba/tests/password_hash.py | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/python/samba/tests/password_hash.py b/python/samba/tests/password_hash.py -index 1b7af7de7b8..39ef13fd7b2 100644 ---- a/python/samba/tests/password_hash.py -+++ b/python/samba/tests/password_hash.py -@@ -30,11 +30,11 @@ from samba.dcerpc.samr import DOMAIN_PASSWORD_STORE_CLEARTEXT - from samba.dsdb import UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED - from samba.tests import delete_force - from samba.tests.password_test import PasswordCommon -+from samba._glue import crypt - import ldb - import samba - import binascii - from hashlib import md5 --import crypt - - - USER_NAME = "PasswordHashTestUser" -@@ -321,7 +321,7 @@ class PassWordHashTests(TestCase): - cmd = "$%s$rounds=%d$%s" % (alg, rounds, data[3]) - - # Calculate the expected hash value -- expected = crypt.crypt(USER_PASS, cmd) -+ expected = crypt(USER_PASS, cmd) - self.assertEqual(expected, up.hashes[i].value.decode('utf8')) - i += 1 - --- -2.48.1 - - -From 0e01dc4f1fabfd2c3f21f724c05d94227a278b20 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:31:18 +1300 -Subject: [PATCH 10/11] util:datablob: data_blob_pad checks its alignment - assumption - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 - -(cherry picked from commit 8b84282008dc372d67ba01c8fe256ef756c3dcfb) ---- - lib/util/data_blob.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/util/data_blob.c b/lib/util/data_blob.c -index b5b78bc7a8a..0522e7755af 100644 ---- a/lib/util/data_blob.c -+++ b/lib/util/data_blob.c -@@ -286,7 +286,7 @@ _PUBLIC_ bool data_blob_pad(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, - size_t old_len = blob->length; - size_t new_len = (old_len + pad - 1) & ~(pad - 1); - -- if (new_len < old_len) { -+ if (new_len < old_len || (pad & (pad - 1)) != 0) { - return false; - } - --- -2.48.1 - - -From 8cfae9f33fb1c170c3fe937be200490597e9e4c2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 17 Jan 2025 13:28:30 +0100 -Subject: [PATCH 11/11] lib:util: Fix stack-use-after-return in - crypt_as_best_we_can() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15784 - -Signed-off-by: Andreas Schneider -Reviewed-by: Douglas Bagnall -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Douglas Bagnall -Autobuild-Date(master): Fri Jan 17 23:21:13 UTC 2025 on atb-devel-224 - -(cherry picked from commit 6cd9849b58ec653cbffc602e3c96996a082faf53) ---- - lib/util/util_crypt.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -index 09cd47597d1..9ac6e1cfd0e 100644 ---- a/lib/util/util_crypt.c -+++ b/lib/util/util_crypt.c -@@ -1,11 +1,13 @@ - #include - #include "data_blob.h" -+#include "discard.h" - #include - #include - #include "util_crypt.h" - - --static int crypt_as_best_we_can(const char *phrase, -+static int crypt_as_best_we_can(TALLOC_CTX *mem_ctx, -+ const char *phrase, - const char *setting, - const char **hashp) - { -@@ -63,8 +65,14 @@ static int crypt_as_best_we_can(const char *phrase, - ret = ENOTRECOVERABLE; - } - } -+ if (ret != 0) { -+ return ret; -+ } - -- *hashp = hash; -+ *hashp = talloc_strdup(mem_ctx, hash); -+ if (*hashp == NULL) { -+ ret = -1; -+ } - return ret; - } - -@@ -75,14 +83,14 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - DATA_BLOB *blob) - { - const char *hash = NULL; -- int ret = crypt_as_best_we_can(phrase, setting, &hash); -+ int ret = crypt_as_best_we_can(mem_ctx, phrase, setting, &hash); - if (ret != 0) { - blob->data = NULL; - blob->length = 0; - return ret; - } - blob->length = strlen(hash); -- blob->data = talloc_memdup(mem_ctx, hash, blob->length); -+ blob->data = discard_const_p(uint8_t, hash); - if (blob->data == NULL) { - return ENOMEM; - } --- -2.48.1 - diff --git a/samba-4.21.0-s3-notifyd.patch b/samba-4.21.0-s3-notifyd.patch deleted file mode 100644 index 31463fd..0000000 --- a/samba-4.21.0-s3-notifyd.patch +++ /dev/null @@ -1,513 +0,0 @@ -From c9a7bc3e8f36cb9d6746e23ea56f9c27b82dcf49 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 22 Jul 2024 12:26:55 +0200 -Subject: [PATCH] s3:notifyd: Use a watcher per db record -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This fixes a O(n²) performance regression in notifyd. The problem was -that we had a watcher per notify instance. This changes the code to have -a watcher per notify db entry. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14430 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit af011b987a4ad0d3753d83cc0b8d97ad64ba874a) ---- - source3/smbd/notifyd/notifyd.c | 214 ++++++++++++++++++------- - source3/smbd/notifyd/notifyd_db.c | 5 +- - source3/smbd/notifyd/notifyd_entry.c | 51 ++++-- - source3/smbd/notifyd/notifyd_private.h | 46 ++++-- - 4 files changed, 228 insertions(+), 88 deletions(-) - -diff --git a/source3/smbd/notifyd/notifyd.c b/source3/smbd/notifyd/notifyd.c -index 64dd26a7e11..0b07ab3e435 100644 ---- a/source3/smbd/notifyd/notifyd.c -+++ b/source3/smbd/notifyd/notifyd.c -@@ -337,6 +337,7 @@ static bool notifyd_apply_rec_change( - struct messaging_context *msg_ctx) - { - struct db_record *rec = NULL; -+ struct notifyd_watcher watcher = {}; - struct notifyd_instance *instances = NULL; - size_t num_instances; - size_t i; -@@ -344,6 +345,7 @@ static bool notifyd_apply_rec_change( - TDB_DATA value; - NTSTATUS status; - bool ok = false; -+ bool new_watcher = false; - - if (pathlen == 0) { - DBG_WARNING("pathlen==0\n"); -@@ -374,8 +376,12 @@ static bool notifyd_apply_rec_change( - value = dbwrap_record_get_value(rec); - - if (value.dsize != 0) { -- if (!notifyd_parse_entry(value.dptr, value.dsize, NULL, -- &num_instances)) { -+ ok = notifyd_parse_entry(value.dptr, -+ value.dsize, -+ &watcher, -+ NULL, -+ &num_instances); -+ if (!ok) { - goto fail; - } - } -@@ -390,8 +396,22 @@ static bool notifyd_apply_rec_change( - goto fail; - } - -- if (value.dsize != 0) { -- memcpy(instances, value.dptr, value.dsize); -+ if (num_instances > 0) { -+ struct notifyd_instance *tmp = NULL; -+ size_t num_tmp = 0; -+ -+ ok = notifyd_parse_entry(value.dptr, -+ value.dsize, -+ NULL, -+ &tmp, -+ &num_tmp); -+ if (!ok) { -+ goto fail; -+ } -+ -+ memcpy(instances, -+ tmp, -+ sizeof(struct notifyd_instance) * num_tmp); - } - - for (i=0; ifilter, -- .internal_subdir_filter = chg->subdir_filter - }; - - num_instances += 1; - } - -- if ((instance->instance.filter != 0) || -- (instance->instance.subdir_filter != 0)) { -- int ret; -+ /* -+ * Calculate an intersection of the instances filters for the watcher. -+ */ -+ if (instance->instance.filter > 0) { -+ uint32_t filter = instance->instance.filter; -+ -+ if ((watcher.filter & filter) != filter) { -+ watcher.filter |= filter; -+ -+ new_watcher = true; -+ } -+ } -+ -+ /* -+ * Calculate an intersection of the instances subdir_filters for the -+ * watcher. -+ */ -+ if (instance->instance.subdir_filter > 0) { -+ uint32_t subdir_filter = instance->instance.subdir_filter; - -- TALLOC_FREE(instance->sys_watch); -+ if ((watcher.subdir_filter & subdir_filter) != subdir_filter) { -+ watcher.subdir_filter |= subdir_filter; - -- ret = sys_notify_watch(entries, sys_notify_ctx, path, -- &instance->internal_filter, -- &instance->internal_subdir_filter, -- notifyd_sys_callback, msg_ctx, -- &instance->sys_watch); -- if (ret != 0) { -- DBG_WARNING("sys_notify_watch for [%s] returned %s\n", -- path, strerror(errno)); -+ new_watcher = true; - } - } - - if ((instance->instance.filter == 0) && - (instance->instance.subdir_filter == 0)) { -+ uint32_t tmp_filter = 0; -+ uint32_t tmp_subdir_filter = 0; -+ - /* This is a delete request */ -- TALLOC_FREE(instance->sys_watch); - *instance = instances[num_instances-1]; - num_instances -= 1; -+ -+ for (i = 0; i < num_instances; i++) { -+ struct notifyd_instance *tmp = &instances[i]; -+ -+ tmp_filter |= tmp->instance.filter; -+ tmp_subdir_filter |= tmp->instance.subdir_filter; -+ } -+ -+ /* -+ * If the filter has changed, register a new watcher with the -+ * changed filter. -+ */ -+ if (watcher.filter != tmp_filter || -+ watcher.subdir_filter != tmp_subdir_filter) -+ { -+ watcher.filter = tmp_filter; -+ watcher.subdir_filter = tmp_subdir_filter; -+ -+ new_watcher = true; -+ } -+ } -+ -+ if (new_watcher) { -+ /* -+ * In case we removed all notify instances, we want to remove -+ * the watcher. We won't register a new one, if no filters are -+ * set anymore. -+ */ -+ -+ TALLOC_FREE(watcher.sys_watch); -+ -+ watcher.sys_filter = watcher.filter; -+ watcher.sys_subdir_filter = watcher.subdir_filter; -+ -+ /* -+ * Only register a watcher if we have filter. -+ */ -+ if (watcher.filter != 0 || watcher.subdir_filter != 0) { -+ int ret = sys_notify_watch(entries, -+ sys_notify_ctx, -+ path, -+ &watcher.sys_filter, -+ &watcher.sys_subdir_filter, -+ notifyd_sys_callback, -+ msg_ctx, -+ &watcher.sys_watch); -+ if (ret != 0) { -+ DBG_WARNING("sys_notify_watch for [%s] " -+ "returned %s\n", -+ path, -+ strerror(errno)); -+ } -+ } - } - - DBG_DEBUG("%s has %zu instances\n", path, num_instances); - - if (num_instances == 0) { -+ TALLOC_FREE(watcher.sys_watch); -+ - status = dbwrap_record_delete(rec); - if (!NT_STATUS_IS_OK(status)) { - DBG_WARNING("dbwrap_record_delete returned %s\n", -@@ -456,13 +541,21 @@ static bool notifyd_apply_rec_change( - goto fail; - } - } else { -- value = make_tdb_data( -- (uint8_t *)instances, -- sizeof(struct notifyd_instance) * num_instances); -+ struct TDB_DATA iov[2] = { -+ { -+ .dptr = (uint8_t *)&watcher, -+ .dsize = sizeof(struct notifyd_watcher), -+ }, -+ { -+ .dptr = (uint8_t *)instances, -+ .dsize = sizeof(struct notifyd_instance) * -+ num_instances, -+ }, -+ }; - -- status = dbwrap_record_store(rec, value, 0); -+ status = dbwrap_record_storev(rec, iov, ARRAY_SIZE(iov), 0); - if (!NT_STATUS_IS_OK(status)) { -- DBG_WARNING("dbwrap_record_store returned %s\n", -+ DBG_WARNING("dbwrap_record_storev returned %s\n", - nt_errstr(status)); - goto fail; - } -@@ -706,12 +799,18 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, - .when = tstate->msg->when }; - struct iovec iov[2]; - size_t path_len = key.dsize; -+ struct notifyd_watcher watcher = {}; - struct notifyd_instance *instances = NULL; - size_t num_instances = 0; - size_t i; -+ bool ok; - -- if (!notifyd_parse_entry(data.dptr, data.dsize, &instances, -- &num_instances)) { -+ ok = notifyd_parse_entry(data.dptr, -+ data.dsize, -+ &watcher, -+ &instances, -+ &num_instances); -+ if (!ok) { - DBG_DEBUG("Could not parse notifyd_entry\n"); - return; - } -@@ -734,9 +833,11 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, - - if (tstate->covered_by_sys_notify) { - if (tstate->recursive) { -- i_filter = instance->internal_subdir_filter; -+ i_filter = watcher.sys_subdir_filter & -+ instance->instance.subdir_filter; - } else { -- i_filter = instance->internal_filter; -+ i_filter = watcher.sys_filter & -+ instance->instance.filter; - } - } else { - if (tstate->recursive) { -@@ -1146,46 +1247,39 @@ static int notifyd_add_proxy_syswatches(struct db_record *rec, - struct db_context *db = dbwrap_record_get_db(rec); - TDB_DATA key = dbwrap_record_get_key(rec); - TDB_DATA value = dbwrap_record_get_value(rec); -- struct notifyd_instance *instances = NULL; -- size_t num_instances = 0; -- size_t i; -+ struct notifyd_watcher watcher = {}; - char path[key.dsize+1]; - bool ok; -+ int ret; - - memcpy(path, key.dptr, key.dsize); - path[key.dsize] = '\0'; - -- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, -- &num_instances); -+ /* This is a remote database, we just need the watcher. */ -+ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); - if (!ok) { - DBG_WARNING("Could not parse notifyd entry for %s\n", path); - return 0; - } - -- for (i=0; iinstance.filter; -- uint32_t subdir_filter = instance->instance.subdir_filter; -- int ret; -+ watcher.sys_watch = NULL; -+ watcher.sys_filter = watcher.filter; -+ watcher.sys_subdir_filter = watcher.subdir_filter; - -- /* -- * This is a remote database. Pointers that we were -- * given don't make sense locally. Initialize to NULL -- * in case sys_notify_watch fails. -- */ -- instances[i].sys_watch = NULL; -- -- ret = state->sys_notify_watch( -- db, state->sys_notify_ctx, path, -- &filter, &subdir_filter, -- notifyd_sys_callback, state->msg_ctx, -- &instance->sys_watch); -- if (ret != 0) { -- DBG_WARNING("inotify_watch returned %s\n", -- strerror(errno)); -- } -+ ret = state->sys_notify_watch(db, -+ state->sys_notify_ctx, -+ path, -+ &watcher.filter, -+ &watcher.subdir_filter, -+ notifyd_sys_callback, -+ state->msg_ctx, -+ &watcher.sys_watch); -+ if (ret != 0) { -+ DBG_WARNING("inotify_watch returned %s\n", strerror(errno)); - } - -+ memcpy(value.dptr, &watcher, sizeof(struct notifyd_watcher)); -+ - return 0; - } - -@@ -1193,21 +1287,17 @@ static int notifyd_db_del_syswatches(struct db_record *rec, void *private_data) - { - TDB_DATA key = dbwrap_record_get_key(rec); - TDB_DATA value = dbwrap_record_get_value(rec); -- struct notifyd_instance *instances = NULL; -- size_t num_instances = 0; -- size_t i; -+ struct notifyd_watcher watcher = {}; - bool ok; - -- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, -- &num_instances); -+ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); - if (!ok) { - DBG_WARNING("Could not parse notifyd entry for %.*s\n", - (int)key.dsize, (char *)key.dptr); - return 0; - } -- for (i=0; ientries database - */ - --bool notifyd_parse_entry( -- uint8_t *buf, -- size_t buflen, -- struct notifyd_instance **instances, -- size_t *num_instances) -+/** -+ * @brief Parse a notifyd database entry. -+ * -+ * The memory we pass down needs to be aligned. If it isn't aligned we can run -+ * into obscure errors as we just point into the data buffer. -+ * -+ * @param data The data to parse -+ * @param data_len The length of the data to parse -+ * @param watcher A pointer to store the watcher data or NULL. -+ * @param instances A pointer to store the array of notify instances or NULL. -+ * @param pnum_instances The number of elements in the array. If you just want -+ * the number of elements pass NULL for the watcher and instances pointers. -+ * -+ * @return true on success, false if an error occurred. -+ */ -+bool notifyd_parse_entry(uint8_t *data, -+ size_t data_len, -+ struct notifyd_watcher *watcher, -+ struct notifyd_instance **instances, -+ size_t *pnum_instances) - { -- if ((buflen % sizeof(struct notifyd_instance)) != 0) { -- DBG_WARNING("invalid buffer size: %zu\n", buflen); -+ size_t ilen; -+ -+ if (data_len < sizeof(struct notifyd_watcher)) { - return false; - } - -- if (instances != NULL) { -- *instances = (struct notifyd_instance *)buf; -+ if (watcher != NULL) { -+ *watcher = *((struct notifyd_watcher *)(uintptr_t)data); - } -- if (num_instances != NULL) { -- *num_instances = buflen / sizeof(struct notifyd_instance); -+ -+ ilen = data_len - sizeof(struct notifyd_watcher); -+ if ((ilen % sizeof(struct notifyd_instance)) != 0) { -+ return false; -+ } -+ -+ if (pnum_instances != NULL) { -+ *pnum_instances = ilen / sizeof(struct notifyd_instance); - } -+ if (instances != NULL) { -+ /* The (uintptr_t) cast removes a warning from -Wcast-align. */ -+ *instances = -+ (struct notifyd_instance *)(uintptr_t) -+ (data + sizeof(struct notifyd_watcher)); -+ } -+ - return true; - } -diff --git a/source3/smbd/notifyd/notifyd_private.h b/source3/smbd/notifyd/notifyd_private.h -index 36c08f47c54..db8e6e1c005 100644 ---- a/source3/smbd/notifyd/notifyd_private.h -+++ b/source3/smbd/notifyd/notifyd_private.h -@@ -20,30 +20,48 @@ - #include "lib/util/server_id.h" - #include "notifyd.h" - -+ - /* -- * notifyd's representation of a notify instance -+ * Representation of a watcher for a path -+ * -+ * This will be stored in the db. - */ --struct notifyd_instance { -- struct server_id client; -- struct notify_instance instance; -- -- void *sys_watch; /* inotify/fam/etc handle */ -+struct notifyd_watcher { -+ /* -+ * This is an intersections of the filter the watcher is listening for. -+ */ -+ uint32_t filter; -+ uint32_t subdir_filter; - - /* -- * Filters after sys_watch took responsibility of some bits -+ * Those are inout variables passed to the sys_watcher. The sys_watcher -+ * will remove the bits it can't handle. - */ -- uint32_t internal_filter; -- uint32_t internal_subdir_filter; -+ uint32_t sys_filter; -+ uint32_t sys_subdir_filter; -+ -+ /* The handle for inotify/fam etc. */ -+ void *sys_watch; -+}; -+ -+/* -+ * Representation of a notifyd instance -+ * -+ * This will be stored in the db. -+ */ -+struct notifyd_instance { -+ struct server_id client; -+ struct notify_instance instance; - }; - - /* - * Parse an entry in the notifyd_context->entries database - */ - --bool notifyd_parse_entry( -- uint8_t *buf, -- size_t buflen, -- struct notifyd_instance **instances, -- size_t *num_instances); -+bool notifyd_parse_entry(uint8_t *data, -+ size_t data_len, -+ struct notifyd_watcher *watcher, -+ struct notifyd_instance **instances, -+ size_t *num_instances); - - #endif --- -2.46.1 - diff --git a/samba.spec b/samba.spec index ba9f3ed..9dbc887 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.3 +%global samba_version 4.22.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -163,7 +163,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc1 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -176,7 +176,7 @@ %global libdcerpc_so_version 0 %global libndr_krb5pac_so_version 0 %global libndr_nbt_so_version 0 -%global libndr_so_version 5 +%global libndr_so_version 6 %global libndr_standard_so_version 0 %global libnetapi_so_version 1 %global libsamba_credentials_so_version 1 @@ -193,9 +193,9 @@ %global libsmbclient_so_version 0 %global libwbclient_so_version 0 -%global talloc_version 2.4.2 -%global tdb_version 1.4.12 -%global tevent_version 0.16.1 +%global talloc_version 2.4.3 +%global tdb_version 1.4.13 +%global tevent_version 0.16.2 %global required_mit_krb5 1.20.1 @@ -250,10 +250,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.21.0-s3-notifyd.patch -Patch1: samba-4-21-pycrypt.patch -Patch2: samba-4-21-fix-smbreadline.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -2666,8 +2662,11 @@ fi %{python3_sitearch}/samba/dnsresolver.py %dir %{python3_sitearch}/samba/domain %{python3_sitearch}/samba/domain/__init__.py +%dir %{python3_sitearch}/samba/domain/__pycache__ %{python3_sitearch}/samba/domain/__pycache__/__init__.*.pyc +%dir %{python3_sitearch}/samba/domain/models %{python3_sitearch}/samba/domain/models/__init__.py +%dir %{python3_sitearch}/samba/domain/models/__pycache__ %{python3_sitearch}/samba/domain/models/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/domain/models/__pycache__/auth_policy.*.pyc %{python3_sitearch}/samba/domain/models/__pycache__/auth_silo.*.pyc @@ -2876,28 +2875,28 @@ fi %dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy -%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/__init__.py -%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__ -%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/policy.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_from.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_from.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_from.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_to.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_from.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_to.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo %{python3_sitearch}/samba/netcmd/domain/auth/silo/__init__.py -%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/member.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/silo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py %{python3_sitearch}/samba/netcmd/domain/auth/silo/silo.py %{python3_sitearch}/samba/netcmd/domain/backup.py %dir %{python3_sitearch}/samba/netcmd/domain/claim @@ -2950,6 +2949,7 @@ fi %{python3_sitearch}/samba/netcmd/schema.py %dir %{python3_sitearch}/samba/netcmd/service_account %{python3_sitearch}/samba/netcmd/service_account/__init__.py +%dir %{python3_sitearch}/samba/netcmd/service_account/__pycache__ %{python3_sitearch}/samba/netcmd/service_account/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/netcmd/service_account/__pycache__/group_msa_membership.*.pyc %{python3_sitearch}/samba/netcmd/service_account/__pycache__/service_account.*.pyc @@ -3238,6 +3238,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/py_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/registry.*.pyc %{python3_sitearch}/samba/tests/__pycache__/reparsepoints.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/rust.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3idmapdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3param.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3passdb.*.pyc @@ -3471,6 +3472,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/netlogon.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pkinit_tests.*.pyc @@ -3513,6 +3515,7 @@ fi %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py %{python3_sitearch}/samba/tests/krb5/lockout_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py +%{python3_sitearch}/samba/tests/krb5/netlogon.py %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py %{python3_sitearch}/samba/tests/krb5/pkinit_tests.py @@ -3585,6 +3588,7 @@ fi %{python3_sitearch}/samba/tests/py_credentials.py %{python3_sitearch}/samba/tests/registry.py %{python3_sitearch}/samba/tests/reparsepoints.py +%{python3_sitearch}/samba/tests/rust.py %{python3_sitearch}/samba/tests/s3idmapdb.py %{python3_sitearch}/samba/tests/s3param.py %{python3_sitearch}/samba/tests/s3passdb.py @@ -3801,6 +3805,7 @@ fi %config(noreplace) %{_sysconfdir}/ctdb/ctdb.conf %config(noreplace) %{_sysconfdir}/ctdb/notify.sh %config(noreplace) %{_sysconfdir}/ctdb/debug-hung-script.sh +%config(noreplace) %{_sysconfdir}/ctdb/ctdb-backup-persistent-tdbs.sh %config(noreplace) %{_sysconfdir}/ctdb/ctdb-crash-cleanup.sh %config(noreplace) %{_sysconfdir}/ctdb/debug_locks.sh @@ -3844,8 +3849,8 @@ fi %{_libexecdir}/ctdb/ctdb_natgw %{_libexecdir}/ctdb/ctdb-path %{_libexecdir}/ctdb/ctdb_recovery_helper +%{_libexecdir}/ctdb/ctdb_smnotify_helper %{_libexecdir}/ctdb/ctdb_takeover_helper -%{_libexecdir}/ctdb/smnotify %{_libexecdir}/ctdb/statd_callout %{_libexecdir}/ctdb/statd_callout_helper %{_libexecdir}/ctdb/tdb_mutex_check @@ -3894,6 +3899,7 @@ fi %{_datadir}/ctdb/events/legacy/60.nfs.script %{_datadir}/ctdb/events/legacy/70.iscsi.script %{_datadir}/ctdb/events/legacy/91.lvs.script +%{_datadir}/ctdb/events/legacy/95.database.script %dir %{_datadir}/ctdb/scripts %{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh diff --git a/sources b/sources index 1055c45..300da04 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.3.tar.xz) = 62eb3bfe1aa1cc8aa68055d4caf21bdea6d6f5b0f767566bef1da210100b5dd17b7d60f5c47da01b0123d3a2c1c3689b1960ef2c2cbd4f804ff998ead994fc3f -SHA512 (samba-4.21.3.tar.asc) = 11e40d32b783b7d57d3f35fe96a17e897719f65d796d965b371dfb58b8cf1f8ffe60c3047bea8c2b2b0d475fa55cd25237b9ba84d44b3d65a8cd53c6af760957 +SHA512 (samba-4.22.0rc1.tar.xz) = 70cefc0c84456ab88971c3eefeb287cf3366c83b6f726c8bcd9c209f7e891390d44230303cedf3ec989749a85a96adb3f5b64bf49b05e10289a0f52669eb3caf +SHA512 (samba-4.22.0rc1.tar.asc) = 07fefd436fac1d5f8344e0a6cfcaa89c36ecb555f3c1484def24febe5c63df386021a726049245e5d08a636b9fddee8725e9cd09406555343b255a79903b768b From 1a9bba249857b25a2acc07a3988137778dccd9ca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 8 Feb 2025 23:02:27 +0100 Subject: [PATCH 02/93] Update to version 4.22.0rc1 - resolves: rhbz#2344189 Guenther --- samba-4-21-fix-smbreadline.patch | 112 ---- samba-4-21-pycrypt.patch | 943 ------------------------------- samba-4.21.0-s3-notifyd.patch | 513 ----------------- samba.spec | 36 +- sources | 4 +- 5 files changed, 23 insertions(+), 1585 deletions(-) delete mode 100644 samba-4-21-fix-smbreadline.patch delete mode 100644 samba-4-21-pycrypt.patch delete mode 100644 samba-4.21.0-s3-notifyd.patch diff --git a/samba-4-21-fix-smbreadline.patch b/samba-4-21-fix-smbreadline.patch deleted file mode 100644 index 9fd288d..0000000 --- a/samba-4-21-fix-smbreadline.patch +++ /dev/null @@ -1,112 +0,0 @@ -From 36e3944418789f5d2018063fa3988c318baa0a35 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Jan 2025 17:59:12 +0100 -Subject: [PATCH 1/2] lib:replace: Remove trailing spaces from readline.h - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit dbff53f77680f0ccd022f2d864ba6ae7585a34b7) ---- - lib/replace/system/readline.h | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h -index 29379626e0d..9a9af266ca6 100644 ---- a/lib/replace/system/readline.h -+++ b/lib/replace/system/readline.h -@@ -1,14 +1,14 @@ - #ifndef _system_readline_h - #define _system_readline_h --/* -+/* - Unix SMB/CIFS implementation. - - Readline wrappers -- -+ - ** NOTE! The following LGPL license applies to the replace - ** library. This does NOT imply that all of Samba is released - ** under the LGPL -- -+ - This library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either --- -2.48.1 - - -From 6944f700dcd4ad795652070dfb04135d602622a2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Jan 2025 17:59:27 +0100 -Subject: [PATCH 2/2] lib:replace: Don't use deprecated readline CPPFunction - cast -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -HAVE_RL_COMPLETION_FUNC_T was unused and not checking for the right -function. - -libcli/smbreadline/smbreadline.c: In function ‘smb_readline’: -libcli/smbreadline/smbreadline.c:139:17: warning: ‘CPPFunction’ is deprecated [-Wdeprecated-declarations] - 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -libcli/smbreadline/smbreadline.c:139:50: error: assignment to ‘char ** (*)(const char *, int, int)’ from incompatible pointer type ‘char ** (*)(void)’ [-Wincompatible-pointer-types] - 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; - | ^ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Tue Jan 21 19:38:37 UTC 2025 on atb-devel-224 - -(cherry picked from commit 9aa5c43315d83c19514251a11c4fba5a137f2821) ---- - lib/replace/system/readline.h | 4 +++- - libcli/smbreadline/wscript_configure | 8 +++++--- - 2 files changed, 8 insertions(+), 4 deletions(-) - -diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h -index 9a9af266ca6..ac3604fc12e 100644 ---- a/lib/replace/system/readline.h -+++ b/lib/replace/system/readline.h -@@ -46,7 +46,9 @@ - #endif - - #ifdef HAVE_NEW_LIBREADLINE --#ifdef HAVE_CPPFUNCTION -+#if defined(HAVE_RL_COMPLETION_FUNC_T) -+# define RL_COMPLETION_CAST (rl_completion_func_t *) -+#elif defined(HAVE_CPPFUNCTION) - # define RL_COMPLETION_CAST (CPPFunction *) - #elif defined(HAVE_RL_COMPLETION_T) - # define RL_COMPLETION_CAST (rl_completion_t *) -diff --git a/libcli/smbreadline/wscript_configure b/libcli/smbreadline/wscript_configure -index 912ff53a150..f5a401ebae0 100644 ---- a/libcli/smbreadline/wscript_configure -+++ b/libcli/smbreadline/wscript_configure -@@ -51,10 +51,12 @@ conf.CHECK_CODE(''' - # endif - # endif - #endif --int main(void) {rl_completion_t f; return 0;} -+int main(void) {rl_completion_func_t f; return 0;} - ''', --'HAVE_RL_COMPLETION_FUNC_T', execute=False, addmain=False, --msg='Checking for rl_completion_t') -+ 'HAVE_RL_COMPLETION_FUNC_T', -+ execute=False, -+ addmain=False, -+ msg='Checking for rl_completion_func_t') - - conf.CHECK_CODE(''' - #ifdef HAVE_READLINE_READLINE_H --- -2.48.1 - diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch deleted file mode 100644 index bf4c1e5..0000000 --- a/samba-4-21-pycrypt.patch +++ /dev/null @@ -1,943 +0,0 @@ -From 07fe7b437c695c7a715418d4414c930b72758dab Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 5 Dec 2024 16:35:51 +1300 -Subject: [PATCH 01/11] util: add a crypt wrapper, derived from - dsdb:password_hash - -This is going to be used by the dsdb password_hash module, and exposed -to Python via pyglue. - -We're doing this because Python 3.13 has dropped crypt from the Python -standard library. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Reviewed-by: Andreas Schneider -(cherry picked from commit 833455c7f9f71583d567e3a53e854567cd8c3b0b) ---- - lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ - lib/util/util_crypt.h | 5 +++ - lib/util/wscript_build | 6 +++ - 3 files changed, 101 insertions(+) - create mode 100644 lib/util/util_crypt.c - create mode 100644 lib/util/util_crypt.h - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -new file mode 100644 -index 00000000000..0f7b2d0fd31 ---- /dev/null -+++ b/lib/util/util_crypt.c -@@ -0,0 +1,90 @@ -+#include -+#include "data_blob.h" -+#include -+#include -+#include "util_crypt.h" -+ -+ -+static int crypt_as_best_we_can(const char *phrase, -+ const char *setting, -+ const char **hashp) -+{ -+ int ret = 0; -+ const char *hash = NULL; -+ -+#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) -+ struct crypt_data crypt_data = { -+ .initialized = 0 /* working storage used by crypt */ -+ }; -+#endif -+ -+ /* -+ * crypt_r() and crypt() may return a null pointer upon error -+ * depending on how libcrypt was configured, so we prefer -+ * crypt_rn() from libcrypt / libxcrypt which always returns -+ * NULL on error. -+ * -+ * POSIX specifies returning a null pointer and setting -+ * errno. -+ * -+ * RHEL 7 (which does not use libcrypt / libxcrypt) returns a -+ * non-NULL pointer from crypt_r() on success but (always?) -+ * sets errno during internal processing in the NSS crypto -+ * subsystem. -+ * -+ * By preferring crypt_rn we avoid the 'return non-NULL but -+ * set-errno' that we otherwise cannot tell apart from the -+ * RHEL 7 behaviour. -+ */ -+ errno = 0; -+ -+#ifdef HAVE_CRYPT_RN -+ hash = crypt_rn(phrase, setting, -+ &crypt_data, -+ sizeof(crypt_data)); -+#elif HAVE_CRYPT_R -+ hash = crypt_r(phrase, setting, &crypt_data); -+#else -+ /* -+ * No crypt_r falling back to crypt, which is NOT thread safe -+ * Thread safety MT-Unsafe race:crypt -+ */ -+ hash = crypt(phrase, setting); -+#endif -+ /* -+ * On error, crypt() and crypt_r() may return a null pointer, -+ * or a pointer to an invalid hash beginning with a '*'. -+ */ -+ ret = errno; -+ errno = 0; -+ if (hash == NULL || hash[0] == '*') { -+ if (ret == 0) { -+ /* this is annoying */ -+ ret = ENOTRECOVERABLE; -+ } -+ } -+ -+ *hashp = hash; -+ return ret; -+} -+ -+ -+int talloc_crypt_blob(TALLOC_CTX *mem_ctx, -+ const char *phrase, -+ const char *setting, -+ DATA_BLOB *blob) -+{ -+ const char *hash = NULL; -+ int ret = crypt_as_best_we_can(phrase, setting, &hash); -+ if (ret != 0) { -+ blob->data = NULL; -+ blob->length = 0; -+ return ret; -+ } -+ blob->length = strlen(hash); -+ blob->data = talloc_memdup(mem_ctx, hash, blob->length); -+ if (blob->data == NULL) { -+ return ENOMEM; -+ } -+ return 0; -+} -diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h -new file mode 100644 -index 00000000000..8c289e489e8 ---- /dev/null -+++ b/lib/util/util_crypt.h -@@ -0,0 +1,5 @@ -+ -+int talloc_crypt_blob(TALLOC_CTX *mem_ctx, -+ const char *phrase, -+ const char *cmd, -+ DATA_BLOB *blob); -diff --git a/lib/util/wscript_build b/lib/util/wscript_build -index b4fcfeaba07..7de9c0b7b17 100644 ---- a/lib/util/wscript_build -+++ b/lib/util/wscript_build -@@ -253,6 +253,12 @@ else: - private_library=True, - local_include=False) - -+ bld.SAMBA_LIBRARY('util_crypt', -+ source='util_crypt.c', -+ deps='talloc crypt', -+ private_library=True, -+ local_include=False) -+ - - bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', - source='unix_privs.c', --- -2.48.1 - - -From adf180613e4172292090d4c3573a439388a09788 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:29:21 +1300 -Subject: [PATCH 02/11] dsdb:password_hash: move hash_blob allocation up - -This will make the next patch simpler. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 1edb12f79593d0b2aac36d5acdaaae6f495772f6) ---- - source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ - 1 file changed, 8 insertions(+), 6 deletions(-) - -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index 1d1267624e2..c1902126a72 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -1649,6 +1649,13 @@ static int setup_primary_userPassword_hash( - } - } - -+ hash_blob = talloc_zero(ctx, DATA_BLOB); -+ -+ if (hash_blob == NULL) { -+ TALLOC_FREE(frame); -+ return ldb_oom(ldb); -+ } -+ - /* - * Relies on the assertion that cleartext_utf8->data is a zero - * terminated UTF-8 string -@@ -1712,15 +1719,10 @@ static int setup_primary_userPassword_hash( - scheme, - reason); - TALLOC_FREE(frame); -+ TALLOC_FREE(hash_blob); - return LDB_ERR_OPERATIONS_ERROR; - } - -- hash_blob = talloc_zero(ctx, DATA_BLOB); -- -- if (hash_blob == NULL) { -- TALLOC_FREE(frame); -- return ldb_oom(ldb); -- } - - *hash_blob = data_blob_talloc(hash_blob, - (const uint8_t *)hash, --- -2.48.1 - - -From 9d43e4d649db23549bbb230ed60426fa286b7ab7 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 11:16:22 +1300 -Subject: [PATCH 03/11] dsdb:password_hash: use talloc_crypt_blob() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit c7597380b479208e33a403211cec9b3c7bd3f034) ---- - .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- - .../samdb/ldb_modules/wscript_build_server | 2 +- - 2 files changed, 13 insertions(+), 57 deletions(-) - -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index c1902126a72..7a7114c1caa 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -51,6 +51,7 @@ - #include "auth/common_auth.h" - #include "lib/messaging/messaging.h" - #include "lib/param/loadparm.h" -+#include "lib/util/util_crypt.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -@@ -1592,16 +1593,11 @@ static int setup_primary_userPassword_hash( - struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module); - const char *salt = NULL; /* Randomly generated salt */ - const char *cmd = NULL; /* command passed to crypt */ -- const char *hash = NULL; /* password hash generated by crypt */ - int algorithm = 0; /* crypt hash algorithm number */ - int rounds = 0; /* The number of hash rounds */ -+ int ret; - DATA_BLOB *hash_blob = NULL; - TALLOC_CTX *frame = talloc_stackframe(); --#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) -- struct crypt_data crypt_data = { -- .initialized = 0 /* working storage used by crypt */ -- }; --#endif - - /* Generate a random password salt */ - salt = generate_random_str_list(frame, -@@ -1660,52 +1656,20 @@ static int setup_primary_userPassword_hash( - * Relies on the assertion that cleartext_utf8->data is a zero - * terminated UTF-8 string - */ -- -- /* -- * crypt_r() and crypt() may return a null pointer upon error -- * depending on how libcrypt was configured, so we prefer -- * crypt_rn() from libcrypt / libxcrypt which always returns -- * NULL on error. -- * -- * POSIX specifies returning a null pointer and setting -- * errno. -- * -- * RHEL 7 (which does not use libcrypt / libxcrypt) returns a -- * non-NULL pointer from crypt_r() on success but (always?) -- * sets errno during internal processing in the NSS crypto -- * subsystem. -- * -- * By preferring crypt_rn we avoid the 'return non-NULL but -- * set-errno' that we otherwise cannot tell apart from the -- * RHEL 7 behaviour. -- */ -- errno = 0; -- --#ifdef HAVE_CRYPT_RN -- hash = crypt_rn((char *)io->n.cleartext_utf8->data, -- cmd, -- &crypt_data, -- sizeof(crypt_data)); --#elif HAVE_CRYPT_R -- hash = crypt_r((char *)io->n.cleartext_utf8->data, cmd, &crypt_data); --#else -- /* -- * No crypt_r falling back to crypt, which is NOT thread safe -- * Thread safety MT-Unsafe race:crypt -- */ -- hash = crypt((char *)io->n.cleartext_utf8->data, cmd); --#endif -- /* -- * On error, crypt() and crypt_r() may return a null pointer, -- * or a pointer to an invalid hash beginning with a '*'. -- */ -- if (hash == NULL || hash[0] == '*') { -+ ret = talloc_crypt_blob(hash_blob, -+ (char *)io->n.cleartext_utf8->data, -+ cmd, -+ hash_blob); -+ if (ret != 0) { - char buf[1024]; - const char *reason = NULL; -- if (errno == ERANGE) { -+ if (ret == ERANGE) { - reason = "Password exceeds maximum length allowed for crypt() hashing"; -+ } else if (ret == ENOTRECOVERABLE) { -+ /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ -+ reason = "Unknown error"; - } else { -- int err = strerror_r(errno, buf, sizeof(buf)); -+ int err = strerror_r(ret, buf, sizeof(buf)); - if (err == 0) { - reason = buf; - } else { -@@ -1723,14 +1687,6 @@ static int setup_primary_userPassword_hash( - return LDB_ERR_OPERATIONS_ERROR; - } - -- -- *hash_blob = data_blob_talloc(hash_blob, -- (const uint8_t *)hash, -- strlen(hash)); -- if (hash_blob->data == NULL) { -- TALLOC_FREE(frame); -- return ldb_oom(ldb); -- } - hash_value->value = hash_blob; - TALLOC_FREE(frame); - return LDB_SUCCESS; -diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server -index 9c1eb12a7c2..16d9b31a982 100644 ---- a/source4/dsdb/samdb/ldb_modules/wscript_build_server -+++ b/source4/dsdb/samdb/ldb_modules/wscript_build_server -@@ -195,7 +195,7 @@ bld.SAMBA_MODULE('ldb_password_hash', - init_function='ldb_password_hash_module_init', - module_init_name='ldb_init_module', - internal_module=False, -- deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS crypt db-glue' -+ deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS util_crypt db-glue' - ) - - --- -2.48.1 - - -From 1c94645881bd5130c67bfee96aa463f360df300a Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:30:04 +1300 -Subject: [PATCH 04/11] util: add a crypt strerror helper - -This will be used by Python also. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 5f365e71c1fa8cdc533159283a5977164b5d39f2) ---- - lib/util/util_crypt.c | 24 +++++++++++++++++++ - lib/util/util_crypt.h | 2 ++ - .../dsdb/samdb/ldb_modules/password_hash.c | 16 +------------ - 3 files changed, 27 insertions(+), 15 deletions(-) - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -index 0f7b2d0fd31..09cd47597d1 100644 ---- a/lib/util/util_crypt.c -+++ b/lib/util/util_crypt.c -@@ -88,3 +88,27 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - } - return 0; - } -+ -+ -+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error) -+{ -+ char buf[1024]; -+ int err; -+ if (error == ERANGE) { -+ return talloc_strdup( -+ mem_ctx, -+ "Password exceeds maximum length allowed for crypt() hashing"); -+ } -+ if (error == ENOTRECOVERABLE) { -+ /* probably weird RHEL7 crypt, see crypt_as_best_we_can() */ -+ goto unknown; -+ } -+ -+ err = strerror_r(error, buf, sizeof(buf)); -+ if (err != 0) { -+ goto unknown; -+ } -+ return talloc_strndup(mem_ctx, buf, sizeof(buf)); -+unknown: -+ return talloc_strdup(mem_ctx, "Unknown error"); -+} -diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h -index 8c289e489e8..ca1a58e922c 100644 ---- a/lib/util/util_crypt.h -+++ b/lib/util/util_crypt.h -@@ -3,3 +3,5 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - const char *phrase, - const char *cmd, - DATA_BLOB *blob); -+ -+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error); -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index 7a7114c1caa..6949a92fc3e 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -1661,21 +1661,7 @@ static int setup_primary_userPassword_hash( - cmd, - hash_blob); - if (ret != 0) { -- char buf[1024]; -- const char *reason = NULL; -- if (ret == ERANGE) { -- reason = "Password exceeds maximum length allowed for crypt() hashing"; -- } else if (ret == ENOTRECOVERABLE) { -- /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ -- reason = "Unknown error"; -- } else { -- int err = strerror_r(ret, buf, sizeof(buf)); -- if (err == 0) { -- reason = buf; -- } else { -- reason = "Unknown error"; -- } -- } -+ const char *reason = talloc_crypt_errstring(frame, ret); - ldb_asprintf_errstring( - ldb, - "setup_primary_userPassword: generation of a %s " --- -2.48.1 - - -From ce70e852783ec69104d274def931e7d39f17576a Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:30:15 +1300 -Subject: [PATCH 05/11] pyglue: add crypt() function - -This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in -turn wraps the system crypt[_r[n]]. - -We want this because the Python standard library crypt module is going -away. That one also wrapped the system crypt or crypt_r, so there -should be no change. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(backported from commit 88e3c82d88a68cf972f8189e1c3718698b49974a) ---- - python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ - python/wscript | 1 + - 2 files changed, 42 insertions(+) - -diff --git a/python/pyglue.c b/python/pyglue.c -index 042bf9e14f3..fcccb849f5e 100644 ---- a/python/pyglue.c -+++ b/python/pyglue.c -@@ -18,6 +18,7 @@ - */ - - #include "lib/replace/system/python.h" -+#include "pyerrors.h" - #include "python/py3compat.h" - #include "includes.h" - #include "python/modules.h" -@@ -25,6 +26,7 @@ - #include "param/pyparam.h" - #include "lib/socket/netif.h" - #include "lib/util/debug.h" -+#include "lib/util/util_crypt.h" - #include "librpc/ndr/ndr_private.h" - #include "lib/cmdline/cmdline.h" - #include "lib/crypto/gkdi.h" -@@ -519,6 +521,42 @@ static PyObject *py_get_burnt_commandline(PyObject *self, PyObject *args) - return ret; - } - -+static PyObject *py_crypt(PyObject *self, PyObject *args) -+{ -+ PyObject *py_hash = NULL; -+ char *phrase = NULL; -+ char *setting = NULL; -+ TALLOC_CTX *frame = NULL; -+ int ret; -+ DATA_BLOB hash = {}; -+ -+ if (!PyArg_ParseTuple(args, "ss", &phrase, &setting)) { -+ TALLOC_FREE(frame); -+ return NULL; -+ } -+ frame = talloc_stackframe(); -+ ret = talloc_crypt_blob(frame, phrase, setting, &hash); -+ if (ret != 0) { -+ const char *errstr = talloc_crypt_errstring(frame, ret); -+ if (ret == EINVAL || ret == ERANGE || ret == ENOTRECOVERABLE) { -+ PyErr_Format(PyExc_ValueError, -+ "could not crypt(): %s", -+ errstr); -+ } else { -+ PyErr_Format(PyExc_OSError, -+ "could not crypt(): %s", -+ errstr); -+ } -+ TALLOC_FREE(frame); -+ return NULL; -+ } -+ -+ py_hash = PyUnicode_FromStringAndSize((char *)hash.data, hash.length); -+ TALLOC_FREE(frame); -+ return py_hash; -+} -+ -+ - static PyMethodDef py_misc_methods[] = { - { "generate_random_str", (PyCFunction)py_generate_random_str, METH_VARARGS, - "generate_random_str(len) -> string\n" -@@ -580,6 +618,9 @@ static PyMethodDef py_misc_methods[] = { - METH_NOARGS, "How many NDR internal tokens is too many for this build?" }, - { "get_burnt_commandline", (PyCFunction)py_get_burnt_commandline, - METH_VARARGS, "Return a redacted commandline to feed to setproctitle (None if no redaction required)" }, -+ { "crypt", (PyCFunction)py_crypt, -+ METH_VARARGS, -+ "encrypt as phrase, per crypt(3), as determined by setting." }, - {0} - }; - -diff --git a/python/wscript b/python/wscript -index 3e6439930e9..7c17e390dc7 100644 ---- a/python/wscript -+++ b/python/wscript -@@ -119,6 +119,7 @@ def build(bld): - ndr - cmdline - gkdi -+ util_crypt - %s - ''' % (pyparam_util, pytalloc_util), - realname='samba/_glue.so') --- -2.48.1 - - -From 9a0dc2db7cde22f36583159c0d697a3de6640990 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 10:44:07 +1300 -Subject: [PATCH 06/11] pytest: test that _glue.crypt works - -The test vectors were generated via Python 3.10 crypt module, which -directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. - -We mainly test the sha256 and sha512 vectors, which seems to be all we -use, and which are said to be widely supported. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 5636d30c0959fd4a211ee7b8d1b267dcdbf0b963) ---- - python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ - 1 file changed, 65 insertions(+) - -diff --git a/python/samba/tests/glue.py b/python/samba/tests/glue.py -index ac504b3f366..824f5ca0c81 100644 ---- a/python/samba/tests/glue.py -+++ b/python/samba/tests/glue.py -@@ -88,3 +88,68 @@ class GlueTests(samba.tests.TestCase): - self.assertEqual(_glue.strstr_m(string, '_'), '_string_num__one') - self.assertEqual(_glue.strstr_m(string, '__'), '__one') - self.assertEqual(_glue.strstr_m(string, 'ring'), 'ring_num__one') -+ -+ def test_crypt(self): -+ # We hopefully only use schemes 5 and 6 (sha256 and sha512), -+ # which are OK and also quite widely supported according to -+ # https://en.wikipedia.org/wiki/Crypt_(C) -+ for phrase, setting, expected in [ -+ ("a", "$5$aaaaaa", -+ "$5$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6"), -+ # with scheme 5, 5000 rounds is default, so hash is the same as above -+ ('a', '$5$rounds=5000$aaaaaa', -+ '$5$rounds=5000$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6'), -+ ('a', -+ '$5$rounds=4999$aaaaaa', -+ '$5$rounds=4999$aaaaaa$FiP70gtxOJUFLokUJvET06E7jbL6aNmF6Wtv2ddzjY8'), -+ ('a', '$5$aaaaab', -+ '$5$aaaaab$e9qR2F833/JyuMu.nkQc9kn184vBWLo0ODqnCe./mj0'), -+ -+ ('', '$5$aaaaaa', '$5$aaaaaa$5B4WTdWp5n/v/aNUw2N8RsEitqvlZJEaAKhH/pOkGg4'), -+ -+ ("a", "$6$aaaaaa", -+ "$6$aaaaaa$KHs/Ez7X/I5/K.V8FR7kEsx9rOvjXnEDUmGC.dLBWP87XWy.oUEAM7QYcZQRVhiDwGepOF2pKrCVETYLyASh60"), -+ -+ ('', '$5$', '$5$$3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.'), -+ -+ # scheme 1 (md5) should be supported if not used -+ ('a', '$1$aaaaaa', -+ '$1$aaaaaa$MUMWPbGfzrHFCNm7ZHg31.'), -+ -+ ('', '$6$', -+ '$6$$/chiBau24cE26QQVW3IfIe68Xu5.JQ4E8Ie7lcRLwqxO5cxGuBhqF2HmTL.zWJ9zjChg3yJYFXeGBQ2y3Ba1d1'), -+ (' ', -+ '$6$6', -+ '$6$6$asLnbxf0obyuv3ybNvDE9ZcdwGFkDhLe7uW.wzdOdKCm4/M3vGFKq4Ttk1tBQrOn4wALZ3tj1L8IarIu5i8hR/'), -+ -+ # original DES scheme, 12 bits of salt -+ ("a", "lalala", "laKGbFzgh./R2"), -+ ("a", "lalalaLALALAla", "laKGbFzgh./R2"), -+ ("a", "arrgh", "ar7VUiUvDhX2c"), -+ ("a", "arrggghhh", "ar7VUiUvDhX2c"), -+ ]: -+ hash = _glue.crypt(phrase, setting) -+ self.assertEqual(hash, expected) -+ -+ def test_crypt_bad(self): -+ # We can't be too strident in our assertions, because every -+ # system allows a different set of algorithms, and some have -+ # different ideas of how to parse. -+ for phrase, setting, exception in [ -+ ("a", "$5", ValueError), -+ ("a", "$0$", ValueError), -+ ("a", None, TypeError), -+ (None, "", TypeError), -+ ('a', '$66$', ValueError), -+ ('a', '$$', ValueError), -+ ('a', '*0', ValueError), -+ ('a', '*', ValueError), -+ ('a', '++', ValueError), -+ # this next one is too long, except on Rocky Linux 8. -+ #('a' * 10000, '$5$5', ValueError), -+ # this is invalid, except on Debian 11. -+ # (' ', '$6$ ', ValueError), -+ ]: -+ with self.assertRaises(exception, -+ msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): -+ _glue.crypt(phrase, setting) --- -2.48.1 - - -From 6425e2514052027ee2269e15e0e0dff1686fa34e Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 15:54:48 +1300 -Subject: [PATCH 07/11] samba-tool user: use _glue.crypt, not crypt.crypt - -Because we know we have _glue.crypt, and we know it raises exceptions -rather than returning None, we can simplify the checks. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 405187d2ef4920a9a284649c9c3287f5844d5180) ---- - .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- - 1 file changed, 6 insertions(+), 15 deletions(-) - -diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py -index 7944d4e1682..68befb3f356 100644 ---- a/python/samba/netcmd/user/readpasswords/common.py -+++ b/python/samba/netcmd/user/readpasswords/common.py -@@ -37,6 +37,7 @@ from samba.netcmd import Command, CommandError - from samba.samdb import SamDB - from samba.nt_time import timedelta_from_nt_time_delta, nt_time_from_datetime - from samba.gkdi import MAX_CLOCK_SKEW -+from samba._glue import crypt - - # python[3]-gpgme is abandoned since ubuntu 1804 and debian 9 - # have to use python[3]-gpg instead -@@ -132,9 +133,7 @@ def get_crypt_value(alg, utf8pw, rounds=0): - else: - crypt_salt = "$%s$%s$" % (alg, b64salt) - -- crypt_value = crypt.crypt(utf8pw, crypt_salt) -- if crypt_value is None: -- raise NotImplementedError("crypt.crypt(%s) returned None" % (crypt_salt)) -+ crypt_value = crypt(utf8pw, crypt_salt) - expected_len = len(crypt_salt) + algs[alg]["length"] - if len(crypt_value) != expected_len: - raise NotImplementedError("crypt.crypt(%s) returned a value with length %d, expected length is %d" % ( -@@ -156,21 +155,13 @@ except ImportError as e: - - for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: - try: -- import crypt - get_crypt_value(alg, "") -- virtual_attributes[attr] = { -- } -- except ImportError as e: -- reason = "crypt" -- reason += " required" -- disabled_virtual_attributes[attr] = { -- "reason": reason, -- } -- except NotImplementedError as e: -- reason = "modern '$%s$' salt in crypt(3) required" % (alg) -+ except (ValueError, OSError): - disabled_virtual_attributes[attr] = { -- "reason": reason, -+ "reason": f"modern '${alg}$' salt in crypt(3) required" - } -+ continue -+ virtual_attributes[attr] = {} - - # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 - for x in range(1, 30): --- -2.48.1 - - -From a2a04286e13676177c952e67363fc7502f544861 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 15:56:20 +1300 -Subject: [PATCH 08/11] samba-tool user: hashlib.sha1 is always present - -We maybe thought we were checking that sha1 was in hashlib, but we were -only checking that hashlib is in the Python library (`hashlib.sha1()` -would not raise ImportError). - -The documentation says hashlib always contains sha1 -- if that -changes, it is better we know by failing noisily with the import error -at the top of the file. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 4af4dd8135e8edbe2a16cfdfc7ded8c145c82e98) ---- - python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ - 1 file changed, 4 insertions(+), 12 deletions(-) - -diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py -index 68befb3f356..3043525874e 100644 ---- a/python/samba/netcmd/user/readpasswords/common.py -+++ b/python/samba/netcmd/user/readpasswords/common.py -@@ -26,6 +26,7 @@ import datetime - import errno - import io - import os -+from hashlib import sha1 - - import ldb - from samba import credentials, nttime2float -@@ -141,17 +142,8 @@ def get_crypt_value(alg, utf8pw, rounds=0): - return crypt_value - - --try: -- import hashlib -- hashlib.sha1() -- virtual_attributes["virtualSSHA"] = { -- } --except ImportError as e: -- reason = "hashlib.sha1()" -- reason += " required" -- disabled_virtual_attributes["virtualSSHA"] = { -- "reason": reason, -- } -+ -+virtual_attributes["virtualSSHA"] = {} - - for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: - try: -@@ -736,7 +728,7 @@ class GetPasswordCommand(Command): - if u8 is None: - continue - salt = os.urandom(4) -- h = hashlib.sha1() -+ h = sha1() - h.update(u8) - h.update(salt) - bv = h.digest() + salt --- -2.48.1 - - -From e9a8748f3cc4ba74f8b0d75e7a01866e7c12a0a4 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 10:46:16 +1300 -Subject: [PATCH 09/11] pytest: password_hash uses internal _glue.crypt - -This will remove an external dependency. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 552053b6445611ecef6ac4c11c55ebf92f03571d) ---- - python/samba/tests/password_hash.py | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/python/samba/tests/password_hash.py b/python/samba/tests/password_hash.py -index 1b7af7de7b8..39ef13fd7b2 100644 ---- a/python/samba/tests/password_hash.py -+++ b/python/samba/tests/password_hash.py -@@ -30,11 +30,11 @@ from samba.dcerpc.samr import DOMAIN_PASSWORD_STORE_CLEARTEXT - from samba.dsdb import UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED - from samba.tests import delete_force - from samba.tests.password_test import PasswordCommon -+from samba._glue import crypt - import ldb - import samba - import binascii - from hashlib import md5 --import crypt - - - USER_NAME = "PasswordHashTestUser" -@@ -321,7 +321,7 @@ class PassWordHashTests(TestCase): - cmd = "$%s$rounds=%d$%s" % (alg, rounds, data[3]) - - # Calculate the expected hash value -- expected = crypt.crypt(USER_PASS, cmd) -+ expected = crypt(USER_PASS, cmd) - self.assertEqual(expected, up.hashes[i].value.decode('utf8')) - i += 1 - --- -2.48.1 - - -From 0e01dc4f1fabfd2c3f21f724c05d94227a278b20 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:31:18 +1300 -Subject: [PATCH 10/11] util:datablob: data_blob_pad checks its alignment - assumption - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 - -(cherry picked from commit 8b84282008dc372d67ba01c8fe256ef756c3dcfb) ---- - lib/util/data_blob.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/util/data_blob.c b/lib/util/data_blob.c -index b5b78bc7a8a..0522e7755af 100644 ---- a/lib/util/data_blob.c -+++ b/lib/util/data_blob.c -@@ -286,7 +286,7 @@ _PUBLIC_ bool data_blob_pad(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, - size_t old_len = blob->length; - size_t new_len = (old_len + pad - 1) & ~(pad - 1); - -- if (new_len < old_len) { -+ if (new_len < old_len || (pad & (pad - 1)) != 0) { - return false; - } - --- -2.48.1 - - -From 8cfae9f33fb1c170c3fe937be200490597e9e4c2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 17 Jan 2025 13:28:30 +0100 -Subject: [PATCH 11/11] lib:util: Fix stack-use-after-return in - crypt_as_best_we_can() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15784 - -Signed-off-by: Andreas Schneider -Reviewed-by: Douglas Bagnall -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Douglas Bagnall -Autobuild-Date(master): Fri Jan 17 23:21:13 UTC 2025 on atb-devel-224 - -(cherry picked from commit 6cd9849b58ec653cbffc602e3c96996a082faf53) ---- - lib/util/util_crypt.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -index 09cd47597d1..9ac6e1cfd0e 100644 ---- a/lib/util/util_crypt.c -+++ b/lib/util/util_crypt.c -@@ -1,11 +1,13 @@ - #include - #include "data_blob.h" -+#include "discard.h" - #include - #include - #include "util_crypt.h" - - --static int crypt_as_best_we_can(const char *phrase, -+static int crypt_as_best_we_can(TALLOC_CTX *mem_ctx, -+ const char *phrase, - const char *setting, - const char **hashp) - { -@@ -63,8 +65,14 @@ static int crypt_as_best_we_can(const char *phrase, - ret = ENOTRECOVERABLE; - } - } -+ if (ret != 0) { -+ return ret; -+ } - -- *hashp = hash; -+ *hashp = talloc_strdup(mem_ctx, hash); -+ if (*hashp == NULL) { -+ ret = -1; -+ } - return ret; - } - -@@ -75,14 +83,14 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - DATA_BLOB *blob) - { - const char *hash = NULL; -- int ret = crypt_as_best_we_can(phrase, setting, &hash); -+ int ret = crypt_as_best_we_can(mem_ctx, phrase, setting, &hash); - if (ret != 0) { - blob->data = NULL; - blob->length = 0; - return ret; - } - blob->length = strlen(hash); -- blob->data = talloc_memdup(mem_ctx, hash, blob->length); -+ blob->data = discard_const_p(uint8_t, hash); - if (blob->data == NULL) { - return ENOMEM; - } --- -2.48.1 - diff --git a/samba-4.21.0-s3-notifyd.patch b/samba-4.21.0-s3-notifyd.patch deleted file mode 100644 index 31463fd..0000000 --- a/samba-4.21.0-s3-notifyd.patch +++ /dev/null @@ -1,513 +0,0 @@ -From c9a7bc3e8f36cb9d6746e23ea56f9c27b82dcf49 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 22 Jul 2024 12:26:55 +0200 -Subject: [PATCH] s3:notifyd: Use a watcher per db record -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This fixes a O(n²) performance regression in notifyd. The problem was -that we had a watcher per notify instance. This changes the code to have -a watcher per notify db entry. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14430 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit af011b987a4ad0d3753d83cc0b8d97ad64ba874a) ---- - source3/smbd/notifyd/notifyd.c | 214 ++++++++++++++++++------- - source3/smbd/notifyd/notifyd_db.c | 5 +- - source3/smbd/notifyd/notifyd_entry.c | 51 ++++-- - source3/smbd/notifyd/notifyd_private.h | 46 ++++-- - 4 files changed, 228 insertions(+), 88 deletions(-) - -diff --git a/source3/smbd/notifyd/notifyd.c b/source3/smbd/notifyd/notifyd.c -index 64dd26a7e11..0b07ab3e435 100644 ---- a/source3/smbd/notifyd/notifyd.c -+++ b/source3/smbd/notifyd/notifyd.c -@@ -337,6 +337,7 @@ static bool notifyd_apply_rec_change( - struct messaging_context *msg_ctx) - { - struct db_record *rec = NULL; -+ struct notifyd_watcher watcher = {}; - struct notifyd_instance *instances = NULL; - size_t num_instances; - size_t i; -@@ -344,6 +345,7 @@ static bool notifyd_apply_rec_change( - TDB_DATA value; - NTSTATUS status; - bool ok = false; -+ bool new_watcher = false; - - if (pathlen == 0) { - DBG_WARNING("pathlen==0\n"); -@@ -374,8 +376,12 @@ static bool notifyd_apply_rec_change( - value = dbwrap_record_get_value(rec); - - if (value.dsize != 0) { -- if (!notifyd_parse_entry(value.dptr, value.dsize, NULL, -- &num_instances)) { -+ ok = notifyd_parse_entry(value.dptr, -+ value.dsize, -+ &watcher, -+ NULL, -+ &num_instances); -+ if (!ok) { - goto fail; - } - } -@@ -390,8 +396,22 @@ static bool notifyd_apply_rec_change( - goto fail; - } - -- if (value.dsize != 0) { -- memcpy(instances, value.dptr, value.dsize); -+ if (num_instances > 0) { -+ struct notifyd_instance *tmp = NULL; -+ size_t num_tmp = 0; -+ -+ ok = notifyd_parse_entry(value.dptr, -+ value.dsize, -+ NULL, -+ &tmp, -+ &num_tmp); -+ if (!ok) { -+ goto fail; -+ } -+ -+ memcpy(instances, -+ tmp, -+ sizeof(struct notifyd_instance) * num_tmp); - } - - for (i=0; ifilter, -- .internal_subdir_filter = chg->subdir_filter - }; - - num_instances += 1; - } - -- if ((instance->instance.filter != 0) || -- (instance->instance.subdir_filter != 0)) { -- int ret; -+ /* -+ * Calculate an intersection of the instances filters for the watcher. -+ */ -+ if (instance->instance.filter > 0) { -+ uint32_t filter = instance->instance.filter; -+ -+ if ((watcher.filter & filter) != filter) { -+ watcher.filter |= filter; -+ -+ new_watcher = true; -+ } -+ } -+ -+ /* -+ * Calculate an intersection of the instances subdir_filters for the -+ * watcher. -+ */ -+ if (instance->instance.subdir_filter > 0) { -+ uint32_t subdir_filter = instance->instance.subdir_filter; - -- TALLOC_FREE(instance->sys_watch); -+ if ((watcher.subdir_filter & subdir_filter) != subdir_filter) { -+ watcher.subdir_filter |= subdir_filter; - -- ret = sys_notify_watch(entries, sys_notify_ctx, path, -- &instance->internal_filter, -- &instance->internal_subdir_filter, -- notifyd_sys_callback, msg_ctx, -- &instance->sys_watch); -- if (ret != 0) { -- DBG_WARNING("sys_notify_watch for [%s] returned %s\n", -- path, strerror(errno)); -+ new_watcher = true; - } - } - - if ((instance->instance.filter == 0) && - (instance->instance.subdir_filter == 0)) { -+ uint32_t tmp_filter = 0; -+ uint32_t tmp_subdir_filter = 0; -+ - /* This is a delete request */ -- TALLOC_FREE(instance->sys_watch); - *instance = instances[num_instances-1]; - num_instances -= 1; -+ -+ for (i = 0; i < num_instances; i++) { -+ struct notifyd_instance *tmp = &instances[i]; -+ -+ tmp_filter |= tmp->instance.filter; -+ tmp_subdir_filter |= tmp->instance.subdir_filter; -+ } -+ -+ /* -+ * If the filter has changed, register a new watcher with the -+ * changed filter. -+ */ -+ if (watcher.filter != tmp_filter || -+ watcher.subdir_filter != tmp_subdir_filter) -+ { -+ watcher.filter = tmp_filter; -+ watcher.subdir_filter = tmp_subdir_filter; -+ -+ new_watcher = true; -+ } -+ } -+ -+ if (new_watcher) { -+ /* -+ * In case we removed all notify instances, we want to remove -+ * the watcher. We won't register a new one, if no filters are -+ * set anymore. -+ */ -+ -+ TALLOC_FREE(watcher.sys_watch); -+ -+ watcher.sys_filter = watcher.filter; -+ watcher.sys_subdir_filter = watcher.subdir_filter; -+ -+ /* -+ * Only register a watcher if we have filter. -+ */ -+ if (watcher.filter != 0 || watcher.subdir_filter != 0) { -+ int ret = sys_notify_watch(entries, -+ sys_notify_ctx, -+ path, -+ &watcher.sys_filter, -+ &watcher.sys_subdir_filter, -+ notifyd_sys_callback, -+ msg_ctx, -+ &watcher.sys_watch); -+ if (ret != 0) { -+ DBG_WARNING("sys_notify_watch for [%s] " -+ "returned %s\n", -+ path, -+ strerror(errno)); -+ } -+ } - } - - DBG_DEBUG("%s has %zu instances\n", path, num_instances); - - if (num_instances == 0) { -+ TALLOC_FREE(watcher.sys_watch); -+ - status = dbwrap_record_delete(rec); - if (!NT_STATUS_IS_OK(status)) { - DBG_WARNING("dbwrap_record_delete returned %s\n", -@@ -456,13 +541,21 @@ static bool notifyd_apply_rec_change( - goto fail; - } - } else { -- value = make_tdb_data( -- (uint8_t *)instances, -- sizeof(struct notifyd_instance) * num_instances); -+ struct TDB_DATA iov[2] = { -+ { -+ .dptr = (uint8_t *)&watcher, -+ .dsize = sizeof(struct notifyd_watcher), -+ }, -+ { -+ .dptr = (uint8_t *)instances, -+ .dsize = sizeof(struct notifyd_instance) * -+ num_instances, -+ }, -+ }; - -- status = dbwrap_record_store(rec, value, 0); -+ status = dbwrap_record_storev(rec, iov, ARRAY_SIZE(iov), 0); - if (!NT_STATUS_IS_OK(status)) { -- DBG_WARNING("dbwrap_record_store returned %s\n", -+ DBG_WARNING("dbwrap_record_storev returned %s\n", - nt_errstr(status)); - goto fail; - } -@@ -706,12 +799,18 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, - .when = tstate->msg->when }; - struct iovec iov[2]; - size_t path_len = key.dsize; -+ struct notifyd_watcher watcher = {}; - struct notifyd_instance *instances = NULL; - size_t num_instances = 0; - size_t i; -+ bool ok; - -- if (!notifyd_parse_entry(data.dptr, data.dsize, &instances, -- &num_instances)) { -+ ok = notifyd_parse_entry(data.dptr, -+ data.dsize, -+ &watcher, -+ &instances, -+ &num_instances); -+ if (!ok) { - DBG_DEBUG("Could not parse notifyd_entry\n"); - return; - } -@@ -734,9 +833,11 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, - - if (tstate->covered_by_sys_notify) { - if (tstate->recursive) { -- i_filter = instance->internal_subdir_filter; -+ i_filter = watcher.sys_subdir_filter & -+ instance->instance.subdir_filter; - } else { -- i_filter = instance->internal_filter; -+ i_filter = watcher.sys_filter & -+ instance->instance.filter; - } - } else { - if (tstate->recursive) { -@@ -1146,46 +1247,39 @@ static int notifyd_add_proxy_syswatches(struct db_record *rec, - struct db_context *db = dbwrap_record_get_db(rec); - TDB_DATA key = dbwrap_record_get_key(rec); - TDB_DATA value = dbwrap_record_get_value(rec); -- struct notifyd_instance *instances = NULL; -- size_t num_instances = 0; -- size_t i; -+ struct notifyd_watcher watcher = {}; - char path[key.dsize+1]; - bool ok; -+ int ret; - - memcpy(path, key.dptr, key.dsize); - path[key.dsize] = '\0'; - -- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, -- &num_instances); -+ /* This is a remote database, we just need the watcher. */ -+ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); - if (!ok) { - DBG_WARNING("Could not parse notifyd entry for %s\n", path); - return 0; - } - -- for (i=0; iinstance.filter; -- uint32_t subdir_filter = instance->instance.subdir_filter; -- int ret; -+ watcher.sys_watch = NULL; -+ watcher.sys_filter = watcher.filter; -+ watcher.sys_subdir_filter = watcher.subdir_filter; - -- /* -- * This is a remote database. Pointers that we were -- * given don't make sense locally. Initialize to NULL -- * in case sys_notify_watch fails. -- */ -- instances[i].sys_watch = NULL; -- -- ret = state->sys_notify_watch( -- db, state->sys_notify_ctx, path, -- &filter, &subdir_filter, -- notifyd_sys_callback, state->msg_ctx, -- &instance->sys_watch); -- if (ret != 0) { -- DBG_WARNING("inotify_watch returned %s\n", -- strerror(errno)); -- } -+ ret = state->sys_notify_watch(db, -+ state->sys_notify_ctx, -+ path, -+ &watcher.filter, -+ &watcher.subdir_filter, -+ notifyd_sys_callback, -+ state->msg_ctx, -+ &watcher.sys_watch); -+ if (ret != 0) { -+ DBG_WARNING("inotify_watch returned %s\n", strerror(errno)); - } - -+ memcpy(value.dptr, &watcher, sizeof(struct notifyd_watcher)); -+ - return 0; - } - -@@ -1193,21 +1287,17 @@ static int notifyd_db_del_syswatches(struct db_record *rec, void *private_data) - { - TDB_DATA key = dbwrap_record_get_key(rec); - TDB_DATA value = dbwrap_record_get_value(rec); -- struct notifyd_instance *instances = NULL; -- size_t num_instances = 0; -- size_t i; -+ struct notifyd_watcher watcher = {}; - bool ok; - -- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, -- &num_instances); -+ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); - if (!ok) { - DBG_WARNING("Could not parse notifyd entry for %.*s\n", - (int)key.dsize, (char *)key.dptr); - return 0; - } -- for (i=0; ientries database - */ - --bool notifyd_parse_entry( -- uint8_t *buf, -- size_t buflen, -- struct notifyd_instance **instances, -- size_t *num_instances) -+/** -+ * @brief Parse a notifyd database entry. -+ * -+ * The memory we pass down needs to be aligned. If it isn't aligned we can run -+ * into obscure errors as we just point into the data buffer. -+ * -+ * @param data The data to parse -+ * @param data_len The length of the data to parse -+ * @param watcher A pointer to store the watcher data or NULL. -+ * @param instances A pointer to store the array of notify instances or NULL. -+ * @param pnum_instances The number of elements in the array. If you just want -+ * the number of elements pass NULL for the watcher and instances pointers. -+ * -+ * @return true on success, false if an error occurred. -+ */ -+bool notifyd_parse_entry(uint8_t *data, -+ size_t data_len, -+ struct notifyd_watcher *watcher, -+ struct notifyd_instance **instances, -+ size_t *pnum_instances) - { -- if ((buflen % sizeof(struct notifyd_instance)) != 0) { -- DBG_WARNING("invalid buffer size: %zu\n", buflen); -+ size_t ilen; -+ -+ if (data_len < sizeof(struct notifyd_watcher)) { - return false; - } - -- if (instances != NULL) { -- *instances = (struct notifyd_instance *)buf; -+ if (watcher != NULL) { -+ *watcher = *((struct notifyd_watcher *)(uintptr_t)data); - } -- if (num_instances != NULL) { -- *num_instances = buflen / sizeof(struct notifyd_instance); -+ -+ ilen = data_len - sizeof(struct notifyd_watcher); -+ if ((ilen % sizeof(struct notifyd_instance)) != 0) { -+ return false; -+ } -+ -+ if (pnum_instances != NULL) { -+ *pnum_instances = ilen / sizeof(struct notifyd_instance); - } -+ if (instances != NULL) { -+ /* The (uintptr_t) cast removes a warning from -Wcast-align. */ -+ *instances = -+ (struct notifyd_instance *)(uintptr_t) -+ (data + sizeof(struct notifyd_watcher)); -+ } -+ - return true; - } -diff --git a/source3/smbd/notifyd/notifyd_private.h b/source3/smbd/notifyd/notifyd_private.h -index 36c08f47c54..db8e6e1c005 100644 ---- a/source3/smbd/notifyd/notifyd_private.h -+++ b/source3/smbd/notifyd/notifyd_private.h -@@ -20,30 +20,48 @@ - #include "lib/util/server_id.h" - #include "notifyd.h" - -+ - /* -- * notifyd's representation of a notify instance -+ * Representation of a watcher for a path -+ * -+ * This will be stored in the db. - */ --struct notifyd_instance { -- struct server_id client; -- struct notify_instance instance; -- -- void *sys_watch; /* inotify/fam/etc handle */ -+struct notifyd_watcher { -+ /* -+ * This is an intersections of the filter the watcher is listening for. -+ */ -+ uint32_t filter; -+ uint32_t subdir_filter; - - /* -- * Filters after sys_watch took responsibility of some bits -+ * Those are inout variables passed to the sys_watcher. The sys_watcher -+ * will remove the bits it can't handle. - */ -- uint32_t internal_filter; -- uint32_t internal_subdir_filter; -+ uint32_t sys_filter; -+ uint32_t sys_subdir_filter; -+ -+ /* The handle for inotify/fam etc. */ -+ void *sys_watch; -+}; -+ -+/* -+ * Representation of a notifyd instance -+ * -+ * This will be stored in the db. -+ */ -+struct notifyd_instance { -+ struct server_id client; -+ struct notify_instance instance; - }; - - /* - * Parse an entry in the notifyd_context->entries database - */ - --bool notifyd_parse_entry( -- uint8_t *buf, -- size_t buflen, -- struct notifyd_instance **instances, -- size_t *num_instances); -+bool notifyd_parse_entry(uint8_t *data, -+ size_t data_len, -+ struct notifyd_watcher *watcher, -+ struct notifyd_instance **instances, -+ size_t *num_instances); - - #endif --- -2.46.1 - diff --git a/samba.spec b/samba.spec index ba9f3ed..9dbc887 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.3 +%global samba_version 4.22.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -163,7 +163,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc1 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -176,7 +176,7 @@ %global libdcerpc_so_version 0 %global libndr_krb5pac_so_version 0 %global libndr_nbt_so_version 0 -%global libndr_so_version 5 +%global libndr_so_version 6 %global libndr_standard_so_version 0 %global libnetapi_so_version 1 %global libsamba_credentials_so_version 1 @@ -193,9 +193,9 @@ %global libsmbclient_so_version 0 %global libwbclient_so_version 0 -%global talloc_version 2.4.2 -%global tdb_version 1.4.12 -%global tevent_version 0.16.1 +%global talloc_version 2.4.3 +%global tdb_version 1.4.13 +%global tevent_version 0.16.2 %global required_mit_krb5 1.20.1 @@ -250,10 +250,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.21.0-s3-notifyd.patch -Patch1: samba-4-21-pycrypt.patch -Patch2: samba-4-21-fix-smbreadline.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -2666,8 +2662,11 @@ fi %{python3_sitearch}/samba/dnsresolver.py %dir %{python3_sitearch}/samba/domain %{python3_sitearch}/samba/domain/__init__.py +%dir %{python3_sitearch}/samba/domain/__pycache__ %{python3_sitearch}/samba/domain/__pycache__/__init__.*.pyc +%dir %{python3_sitearch}/samba/domain/models %{python3_sitearch}/samba/domain/models/__init__.py +%dir %{python3_sitearch}/samba/domain/models/__pycache__ %{python3_sitearch}/samba/domain/models/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/domain/models/__pycache__/auth_policy.*.pyc %{python3_sitearch}/samba/domain/models/__pycache__/auth_silo.*.pyc @@ -2876,28 +2875,28 @@ fi %dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy -%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/__init__.py -%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__ -%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/policy.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_from.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_from.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_from.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_to.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_from.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_to.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo %{python3_sitearch}/samba/netcmd/domain/auth/silo/__init__.py -%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/member.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/silo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py %{python3_sitearch}/samba/netcmd/domain/auth/silo/silo.py %{python3_sitearch}/samba/netcmd/domain/backup.py %dir %{python3_sitearch}/samba/netcmd/domain/claim @@ -2950,6 +2949,7 @@ fi %{python3_sitearch}/samba/netcmd/schema.py %dir %{python3_sitearch}/samba/netcmd/service_account %{python3_sitearch}/samba/netcmd/service_account/__init__.py +%dir %{python3_sitearch}/samba/netcmd/service_account/__pycache__ %{python3_sitearch}/samba/netcmd/service_account/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/netcmd/service_account/__pycache__/group_msa_membership.*.pyc %{python3_sitearch}/samba/netcmd/service_account/__pycache__/service_account.*.pyc @@ -3238,6 +3238,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/py_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/registry.*.pyc %{python3_sitearch}/samba/tests/__pycache__/reparsepoints.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/rust.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3idmapdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3param.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3passdb.*.pyc @@ -3471,6 +3472,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/netlogon.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pkinit_tests.*.pyc @@ -3513,6 +3515,7 @@ fi %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py %{python3_sitearch}/samba/tests/krb5/lockout_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py +%{python3_sitearch}/samba/tests/krb5/netlogon.py %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py %{python3_sitearch}/samba/tests/krb5/pkinit_tests.py @@ -3585,6 +3588,7 @@ fi %{python3_sitearch}/samba/tests/py_credentials.py %{python3_sitearch}/samba/tests/registry.py %{python3_sitearch}/samba/tests/reparsepoints.py +%{python3_sitearch}/samba/tests/rust.py %{python3_sitearch}/samba/tests/s3idmapdb.py %{python3_sitearch}/samba/tests/s3param.py %{python3_sitearch}/samba/tests/s3passdb.py @@ -3801,6 +3805,7 @@ fi %config(noreplace) %{_sysconfdir}/ctdb/ctdb.conf %config(noreplace) %{_sysconfdir}/ctdb/notify.sh %config(noreplace) %{_sysconfdir}/ctdb/debug-hung-script.sh +%config(noreplace) %{_sysconfdir}/ctdb/ctdb-backup-persistent-tdbs.sh %config(noreplace) %{_sysconfdir}/ctdb/ctdb-crash-cleanup.sh %config(noreplace) %{_sysconfdir}/ctdb/debug_locks.sh @@ -3844,8 +3849,8 @@ fi %{_libexecdir}/ctdb/ctdb_natgw %{_libexecdir}/ctdb/ctdb-path %{_libexecdir}/ctdb/ctdb_recovery_helper +%{_libexecdir}/ctdb/ctdb_smnotify_helper %{_libexecdir}/ctdb/ctdb_takeover_helper -%{_libexecdir}/ctdb/smnotify %{_libexecdir}/ctdb/statd_callout %{_libexecdir}/ctdb/statd_callout_helper %{_libexecdir}/ctdb/tdb_mutex_check @@ -3894,6 +3899,7 @@ fi %{_datadir}/ctdb/events/legacy/60.nfs.script %{_datadir}/ctdb/events/legacy/70.iscsi.script %{_datadir}/ctdb/events/legacy/91.lvs.script +%{_datadir}/ctdb/events/legacy/95.database.script %dir %{_datadir}/ctdb/scripts %{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh diff --git a/sources b/sources index 1055c45..300da04 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.3.tar.xz) = 62eb3bfe1aa1cc8aa68055d4caf21bdea6d6f5b0f767566bef1da210100b5dd17b7d60f5c47da01b0123d3a2c1c3689b1960ef2c2cbd4f804ff998ead994fc3f -SHA512 (samba-4.21.3.tar.asc) = 11e40d32b783b7d57d3f35fe96a17e897719f65d796d965b371dfb58b8cf1f8ffe60c3047bea8c2b2b0d475fa55cd25237b9ba84d44b3d65a8cd53c6af760957 +SHA512 (samba-4.22.0rc1.tar.xz) = 70cefc0c84456ab88971c3eefeb287cf3366c83b6f726c8bcd9c209f7e891390d44230303cedf3ec989749a85a96adb3f5b64bf49b05e10289a0f52669eb3caf +SHA512 (samba-4.22.0rc1.tar.asc) = 07fefd436fac1d5f8344e0a6cfcaa89c36ecb555f3c1484def24febe5c63df386021a726049245e5d08a636b9fddee8725e9cd09406555343b255a79903b768b From 67e7277c752d1795e50066139c904e3c7b62a162 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 13 Feb 2025 23:53:18 +0100 Subject: [PATCH 03/93] Update to Samba 4.22.0rc2 - resolves: rhbz#2345547 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 9dbc887..7e88c49 100644 --- a/samba.spec +++ b/samba.spec @@ -163,7 +163,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc1 +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index 300da04..b75ed0a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc1.tar.xz) = 70cefc0c84456ab88971c3eefeb287cf3366c83b6f726c8bcd9c209f7e891390d44230303cedf3ec989749a85a96adb3f5b64bf49b05e10289a0f52669eb3caf -SHA512 (samba-4.22.0rc1.tar.asc) = 07fefd436fac1d5f8344e0a6cfcaa89c36ecb555f3c1484def24febe5c63df386021a726049245e5d08a636b9fddee8725e9cd09406555343b255a79903b768b +SHA512 (samba-4.22.0rc2.tar.xz) = e0211687c51e0261a170a1d84d44ce82d65e44ff0f18f92fd59dff464037efbc9408c532d5717f9e1ba6cce9160cbd27be60c16b3d5b6b707c48f71503621d90 +SHA512 (samba-4.22.0rc2.tar.asc) = aac019083d039f633dc6f3255972832c8071a7415bb7bb2ee355e2a0095118a1c6351daaa70c5c7e95b0524094f2443ca9331f50ae5e2776ebd0c89309bd03fd From 9547b086638785d54c9cdaca8b334984da47dca8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 13 Feb 2025 23:53:18 +0100 Subject: [PATCH 04/93] Update to Samba 4.22.0rc2 - resolves: rhbz#2345547 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 9dbc887..7e88c49 100644 --- a/samba.spec +++ b/samba.spec @@ -163,7 +163,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc1 +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index 300da04..b75ed0a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc1.tar.xz) = 70cefc0c84456ab88971c3eefeb287cf3366c83b6f726c8bcd9c209f7e891390d44230303cedf3ec989749a85a96adb3f5b64bf49b05e10289a0f52669eb3caf -SHA512 (samba-4.22.0rc1.tar.asc) = 07fefd436fac1d5f8344e0a6cfcaa89c36ecb555f3c1484def24febe5c63df386021a726049245e5d08a636b9fddee8725e9cd09406555343b255a79903b768b +SHA512 (samba-4.22.0rc2.tar.xz) = e0211687c51e0261a170a1d84d44ce82d65e44ff0f18f92fd59dff464037efbc9408c532d5717f9e1ba6cce9160cbd27be60c16b3d5b6b707c48f71503621d90 +SHA512 (samba-4.22.0rc2.tar.asc) = aac019083d039f633dc6f3255972832c8071a7415bb7bb2ee355e2a0095118a1c6351daaa70c5c7e95b0524094f2443ca9331f50ae5e2776ebd0c89309bd03fd From cb85d85e0f490da7cf6ca5fe93a38852aabcaaaa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 11:52:05 +0100 Subject: [PATCH 05/93] Make %bcond switches easier to understand This also removes support for building on rhel8. --- samba.spec | 99 ++++++++++++++---------------------------------------- 1 file changed, 25 insertions(+), 74 deletions(-) diff --git a/samba.spec b/samba.spec index 7e88c49..680bd4f 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,7 @@ # or # rpmbuild --rebuild --with testsuite samba.src.rpm # -%bcond_with testsuite +%bcond testsuite 0 # Build with internal talloc, tevent, tdb # @@ -14,132 +14,97 @@ # or # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm # -%bcond_with includelibs +%bcond includelibs 0 # fedpkg mockbuild --with=ccache -%bcond_with ccache +%bcond ccache 0 # ctdb is enabled by default, you can disable it with: --without clustering -%bcond_without clustering +%bcond clustering 1 # Define _make_verbose if it doesn't exist (RHEL8) %{!?_make_verbose:%define _make_verbose V=1 VERBOSE=1} # Build with Active Directory Domain Controller support by default on Fedora %if 0%{?fedora} -%bcond_without dc +%bcond dc 1 %else -%bcond_with dc +%bcond dc 0 %endif # Build a libsmbclient package by default -%bcond_without libsmbclient +%bcond libsmbclient 1 # Build a libwbclient package by default -%bcond_without libwbclient +%bcond libwbclient 1 # Build with winexe by default %if 0%{?rhel} %ifarch x86_64 -%bcond_without winexe +%bcond winexe 1 %else -%bcond_with winexe +%bcond winexe 0 #endifarch %endif %else -%bcond_without winexe +%bcond winexe 1 %endif # Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_cephfs -%bcond_without ceph_mutex +%bcond vfs_cephfs 1 +%bcond ceph_mutex 1 %else -%bcond_with vfs_cephfs -%bcond_with ceph_mutex +%bcond vfs_cephfs 0 +%bcond ceph_mutex 0 #endifarch %endif %else -%bcond_with vfs_cephfs -%bcond_with ceph_mutex +%bcond vfs_cephfs 0 +%bcond ceph_mutex 0 #endif fedora %endif -# Build vfs_gluster module by default on 64bit Fedora -%global is_rhgs 0 -%if "%{dist}" == ".el7rhgs" || "%{dist}" == ".el8rhgs" -%global is_rhgs 1 -%endif - %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_glusterfs +%bcond vfs_glusterfs 1 %else -%bcond_with vfs_glusterfs +%bcond vfs_glusterfs 0 #endifarch %endif -#else rhel -%else - -%if 0%{?is_rhgs} -# Enable on rhgs x86_64 -%ifarch x86_64 -%bcond_without vfs_glusterfs -%else -%bcond_with vfs_glusterfs -#endifarch -%endif -%else -%bcond_with vfs_glusterfs -#endif is_rhgs -%endif - #endif fedora %endif # Build vfs_io_uring module by default on 64bit Fedora -%if 0%{?fedora} || 0%{?rhel} >= 8 - %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_io_uring +%bcond vfs_io_uring 1 %else -%bcond_with vfs_io_uring +%bcond vfs_io_uring 0 #endifarch %endif -%else -%bcond_with vfs_io_uring -#endif fedora || rhel >= 8 -%endif - # Build the ctdb-pcp-pmda package by default on Fedora, except for i686 where # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 -%bcond_without pcp_pmda +%bcond pcp_pmda 1 %endif %else -%bcond_with pcp_pmda +%bcond pcp_pmda 0 %endif # Build the etcd helpers by default on Fedora %if 0%{?fedora} -%bcond_without etcd_mutex +%bcond etcd_mutex 1 %else -%bcond_with etcd_mutex -%endif - -%if 0%{?fedora} || 0%{?rhel} >= 9 -%bcond_without gpupdate -%else -%bcond_with gpupdate +%bcond etcd_mutex 0 %endif %ifarch aarch64 ppc64le s390x x86_64 @@ -379,9 +344,7 @@ BuildRequires: librados-devel BuildRequires: python3-etcd %endif -%if %{with gpupdate} BuildRequires: cepces-certmonger >= 0.3.8 -%endif # pidl requirements BuildRequires: perl(ExtUtils::MakeMaker) @@ -775,7 +738,6 @@ Samba VFS module for GlusterFS integration. %endif ### GPUPDATE -%if %{with gpupdate} %package gpupdate Summary: Samba GPO support for clients Requires: cepces-certmonger @@ -789,9 +751,6 @@ Requires: python3-%{name}-dc = %{samba_depver} This package provides the samba-gpupdate tool to apply Group Policy Objects (GPO) on Samba clients. -#endif with gpupdate -%endif - ### KRB5-PRINTING %package krb5-printing Summary: Samba CUPS backend for printing with Kerberos @@ -1542,11 +1501,6 @@ for i in \ done %endif -%if %{without gpupdate} -rm -f %{buildroot}%{_sbindir}/samba-gpupdate -rm -f %{buildroot}%{_mandir}/man8/samba-gpupdate.8* -%endif - %if %{without vfs_glusterfs} rm -f %{buildroot}%{_mandir}/man8/vfs_glusterfs.8* %endif @@ -2444,12 +2398,9 @@ fi %endif ### GPUPDATE -%if %{with gpupdate} %files gpupdate %{_mandir}/man8/samba-gpupdate.8* %{_sbindir}/samba-gpupdate -#endif with gpupdate -%endif ### KRB5-PRINTING %files krb5-printing From 25ced122733bf41fdb7da753037d59f9414748d1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 11:52:05 +0100 Subject: [PATCH 06/93] Make %bcond switches easier to understand This also removes support for building on rhel8. --- samba.spec | 99 ++++++++++++++---------------------------------------- 1 file changed, 25 insertions(+), 74 deletions(-) diff --git a/samba.spec b/samba.spec index 7e88c49..680bd4f 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,7 @@ # or # rpmbuild --rebuild --with testsuite samba.src.rpm # -%bcond_with testsuite +%bcond testsuite 0 # Build with internal talloc, tevent, tdb # @@ -14,132 +14,97 @@ # or # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm # -%bcond_with includelibs +%bcond includelibs 0 # fedpkg mockbuild --with=ccache -%bcond_with ccache +%bcond ccache 0 # ctdb is enabled by default, you can disable it with: --without clustering -%bcond_without clustering +%bcond clustering 1 # Define _make_verbose if it doesn't exist (RHEL8) %{!?_make_verbose:%define _make_verbose V=1 VERBOSE=1} # Build with Active Directory Domain Controller support by default on Fedora %if 0%{?fedora} -%bcond_without dc +%bcond dc 1 %else -%bcond_with dc +%bcond dc 0 %endif # Build a libsmbclient package by default -%bcond_without libsmbclient +%bcond libsmbclient 1 # Build a libwbclient package by default -%bcond_without libwbclient +%bcond libwbclient 1 # Build with winexe by default %if 0%{?rhel} %ifarch x86_64 -%bcond_without winexe +%bcond winexe 1 %else -%bcond_with winexe +%bcond winexe 0 #endifarch %endif %else -%bcond_without winexe +%bcond winexe 1 %endif # Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_cephfs -%bcond_without ceph_mutex +%bcond vfs_cephfs 1 +%bcond ceph_mutex 1 %else -%bcond_with vfs_cephfs -%bcond_with ceph_mutex +%bcond vfs_cephfs 0 +%bcond ceph_mutex 0 #endifarch %endif %else -%bcond_with vfs_cephfs -%bcond_with ceph_mutex +%bcond vfs_cephfs 0 +%bcond ceph_mutex 0 #endif fedora %endif -# Build vfs_gluster module by default on 64bit Fedora -%global is_rhgs 0 -%if "%{dist}" == ".el7rhgs" || "%{dist}" == ".el8rhgs" -%global is_rhgs 1 -%endif - %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_glusterfs +%bcond vfs_glusterfs 1 %else -%bcond_with vfs_glusterfs +%bcond vfs_glusterfs 0 #endifarch %endif -#else rhel -%else - -%if 0%{?is_rhgs} -# Enable on rhgs x86_64 -%ifarch x86_64 -%bcond_without vfs_glusterfs -%else -%bcond_with vfs_glusterfs -#endifarch -%endif -%else -%bcond_with vfs_glusterfs -#endif is_rhgs -%endif - #endif fedora %endif # Build vfs_io_uring module by default on 64bit Fedora -%if 0%{?fedora} || 0%{?rhel} >= 8 - %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_io_uring +%bcond vfs_io_uring 1 %else -%bcond_with vfs_io_uring +%bcond vfs_io_uring 0 #endifarch %endif -%else -%bcond_with vfs_io_uring -#endif fedora || rhel >= 8 -%endif - # Build the ctdb-pcp-pmda package by default on Fedora, except for i686 where # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 -%bcond_without pcp_pmda +%bcond pcp_pmda 1 %endif %else -%bcond_with pcp_pmda +%bcond pcp_pmda 0 %endif # Build the etcd helpers by default on Fedora %if 0%{?fedora} -%bcond_without etcd_mutex +%bcond etcd_mutex 1 %else -%bcond_with etcd_mutex -%endif - -%if 0%{?fedora} || 0%{?rhel} >= 9 -%bcond_without gpupdate -%else -%bcond_with gpupdate +%bcond etcd_mutex 0 %endif %ifarch aarch64 ppc64le s390x x86_64 @@ -379,9 +344,7 @@ BuildRequires: librados-devel BuildRequires: python3-etcd %endif -%if %{with gpupdate} BuildRequires: cepces-certmonger >= 0.3.8 -%endif # pidl requirements BuildRequires: perl(ExtUtils::MakeMaker) @@ -775,7 +738,6 @@ Samba VFS module for GlusterFS integration. %endif ### GPUPDATE -%if %{with gpupdate} %package gpupdate Summary: Samba GPO support for clients Requires: cepces-certmonger @@ -789,9 +751,6 @@ Requires: python3-%{name}-dc = %{samba_depver} This package provides the samba-gpupdate tool to apply Group Policy Objects (GPO) on Samba clients. -#endif with gpupdate -%endif - ### KRB5-PRINTING %package krb5-printing Summary: Samba CUPS backend for printing with Kerberos @@ -1542,11 +1501,6 @@ for i in \ done %endif -%if %{without gpupdate} -rm -f %{buildroot}%{_sbindir}/samba-gpupdate -rm -f %{buildroot}%{_mandir}/man8/samba-gpupdate.8* -%endif - %if %{without vfs_glusterfs} rm -f %{buildroot}%{_mandir}/man8/vfs_glusterfs.8* %endif @@ -2444,12 +2398,9 @@ fi %endif ### GPUPDATE -%if %{with gpupdate} %files gpupdate %{_mandir}/man8/samba-gpupdate.8* %{_sbindir}/samba-gpupdate -#endif with gpupdate -%endif ### KRB5-PRINTING %files krb5-printing From 314544c636c2987c2399dcbd87234d6d95459fb0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 14:30:24 +0100 Subject: [PATCH 07/93] Add LICENSE file of libldb --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 680bd4f..9c84080 100644 --- a/samba.spec +++ b/samba.spec @@ -3892,6 +3892,7 @@ fi %endif %files -n libldb +%license lib/ldb/LICENSE %{_libdir}/libldb.so.* %dir %{_libdir}/samba %{_libdir}/samba/libldb-key-value-private-samba.so From 2bed3a07266361e79c3d6abdfcc46ae3afb542fa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 14:30:24 +0100 Subject: [PATCH 08/93] Add LICENSE file of libldb --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 680bd4f..9c84080 100644 --- a/samba.spec +++ b/samba.spec @@ -3892,6 +3892,7 @@ fi %endif %files -n libldb +%license lib/ldb/LICENSE %{_libdir}/libldb.so.* %dir %{_libdir}/samba %{_libdir}/samba/libldb-key-value-private-samba.so From 036c40ef5eb24c660d9e2ac71dbbe80dcf7ddf63 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 19:05:42 +0100 Subject: [PATCH 09/93] Fix the '--with includelibs' build --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 9c84080..9e37fbb 100644 --- a/samba.spec +++ b/samba.spec @@ -3013,6 +3013,7 @@ fi %if %{with includelibs} %{_libdir}/samba/libpyldb-util.cpython*.so +%{_libdir}/samba/libpytalloc-util.cpython*.so %{python3_sitearch}/__pycache__/_ldb_text*.pyc %{python3_sitearch}/__pycache__/_tdb_text*.pyc @@ -3021,8 +3022,7 @@ fi %{python3_sitearch}/_tdb_text.py %{python3_sitearch}/_tevent.cpython*.so %{python3_sitearch}/ldb.cpython*.so -#FIXME why is it missing? -#%{python3_sitearch}/talloc.cpython*.so +%{python3_sitearch}/talloc.cpython*.so %{python3_sitearch}/tdb.cpython*.so %{python3_sitearch}/tevent.py #endif with includelibs From e10ed71be7ce4da8b7d24e3c78d261cce57b62c9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 19:05:42 +0100 Subject: [PATCH 10/93] Fix the '--with includelibs' build --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 9c84080..9e37fbb 100644 --- a/samba.spec +++ b/samba.spec @@ -3013,6 +3013,7 @@ fi %if %{with includelibs} %{_libdir}/samba/libpyldb-util.cpython*.so +%{_libdir}/samba/libpytalloc-util.cpython*.so %{python3_sitearch}/__pycache__/_ldb_text*.pyc %{python3_sitearch}/__pycache__/_tdb_text*.pyc @@ -3021,8 +3022,7 @@ fi %{python3_sitearch}/_tdb_text.py %{python3_sitearch}/_tevent.cpython*.so %{python3_sitearch}/ldb.cpython*.so -#FIXME why is it missing? -#%{python3_sitearch}/talloc.cpython*.so +%{python3_sitearch}/talloc.cpython*.so %{python3_sitearch}/tdb.cpython*.so %{python3_sitearch}/tevent.py #endif with includelibs From 4e6ca9ecfb75a192cfc49ce7591e8afe88ca9fba Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Feb 2025 11:00:44 +0100 Subject: [PATCH 11/93] Fix libldb built with '--with includelibs' --- samba.spec | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/samba.spec b/samba.spec index 9e37fbb..cc94374 100644 --- a/samba.spec +++ b/samba.spec @@ -1205,9 +1205,12 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB %package -n libldb Summary: A schema-less, ldap like, API and database License: LGPL-3.0-or-later +%if %{without includelibs} Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} +# /endif without includelibs +%endif Provides: bundled(libreplace) Obsoletes: libldb < 0:2.10 @@ -1223,9 +1226,12 @@ servers, or use local tdb databases. Summary: Developer tools for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} +%if %{without includelibs} Requires: libtdb-devel%{?_isa} >= %{tdb_version} Requires: libtalloc-devel%{?_isa} >= %{talloc_version} Requires: libtevent-devel%{?_isa} >= %{tevent_version} +# /endif without includelibs +%endif Obsoletes: libldb-devel < 0:2.10 Provides: libldb-devel = 0:2.10 @@ -1250,7 +1256,10 @@ Tools to manage LDB files Summary: Python bindings for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} +%if %{without includelibs} Requires: python3-tdb%{?_isa} >= %{tdb_version} +# /endif without includelibs +%endif Requires: samba-client-libs = %{samba_depver} %{?python_provide:%python_provide python3-ldb} From 926e2f0a2843dbe9513b38731443723e8f21f7f0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Feb 2025 11:00:44 +0100 Subject: [PATCH 12/93] Fix libldb built with '--with includelibs' --- samba.spec | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/samba.spec b/samba.spec index 9e37fbb..cc94374 100644 --- a/samba.spec +++ b/samba.spec @@ -1205,9 +1205,12 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB %package -n libldb Summary: A schema-less, ldap like, API and database License: LGPL-3.0-or-later +%if %{without includelibs} Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} +# /endif without includelibs +%endif Provides: bundled(libreplace) Obsoletes: libldb < 0:2.10 @@ -1223,9 +1226,12 @@ servers, or use local tdb databases. Summary: Developer tools for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} +%if %{without includelibs} Requires: libtdb-devel%{?_isa} >= %{tdb_version} Requires: libtalloc-devel%{?_isa} >= %{talloc_version} Requires: libtevent-devel%{?_isa} >= %{tevent_version} +# /endif without includelibs +%endif Obsoletes: libldb-devel < 0:2.10 Provides: libldb-devel = 0:2.10 @@ -1250,7 +1256,10 @@ Tools to manage LDB files Summary: Python bindings for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} +%if %{without includelibs} Requires: python3-tdb%{?_isa} >= %{tdb_version} +# /endif without includelibs +%endif Requires: samba-client-libs = %{samba_depver} %{?python_provide:%python_provide python3-ldb} From c4883ac1e7043a7ec8f3673b9d419c8e43290a7b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 20 Feb 2025 18:39:08 +0100 Subject: [PATCH 13/93] Update to Samba 4.22.0rc3 - resolves: rhbz#2346803 Guenther --- samba.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index cc94374..71388b2 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -3511,9 +3511,11 @@ fi %dir %{python3_sitearch}/samba/tests/ndr %{python3_sitearch}/samba/tests/ndr/gkdi.py %{python3_sitearch}/samba/tests/ndr/gmsa.py +%{python3_sitearch}/samba/tests/ndr/sd.py %dir %{python3_sitearch}/samba/tests/ndr/__pycache__ %{python3_sitearch}/samba/tests/ndr/__pycache__/gkdi.*.pyc %{python3_sitearch}/samba/tests/ndr/__pycache__/gmsa.*.pyc +%{python3_sitearch}/samba/tests/ndr/__pycache__/sd.*.pyc %{python3_sitearch}/samba/tests/ndr/__pycache__/wbint.*.pyc %{python3_sitearch}/samba/tests/ndr/wbint.py %{python3_sitearch}/samba/tests/netbios.py diff --git a/sources b/sources index b75ed0a..a7d3db0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc2.tar.xz) = e0211687c51e0261a170a1d84d44ce82d65e44ff0f18f92fd59dff464037efbc9408c532d5717f9e1ba6cce9160cbd27be60c16b3d5b6b707c48f71503621d90 -SHA512 (samba-4.22.0rc2.tar.asc) = aac019083d039f633dc6f3255972832c8071a7415bb7bb2ee355e2a0095118a1c6351daaa70c5c7e95b0524094f2443ca9331f50ae5e2776ebd0c89309bd03fd +SHA512 (samba-4.22.0rc3.tar.xz) = fbfd87cbb874e8818061dfb5cc962e80148b8fe68ffa414c9345e70b49777b237c5f6eb633d546d12d47a3027e9da9098a7c08e91f6f87237e1515181e0b73d6 +SHA512 (samba-4.22.0rc3.tar.asc) = ba9ab3ecdd6912f302c9ba1cb8c12cce1d390c6703528796a7d75e6281d578d9bc19df7e612ebc4e6c7d58b964e0aebf108061f08da8af57668424e7ce968222 From c295775181cbe26686635dadeb9feb38c16615be Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 27 Feb 2025 20:00:34 +0100 Subject: [PATCH 14/93] Update to Samba 4.22.0rc4 - resolves: rhbz#2348758 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 71388b2..1c9b659 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index a7d3db0..2a41d3e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc3.tar.xz) = fbfd87cbb874e8818061dfb5cc962e80148b8fe68ffa414c9345e70b49777b237c5f6eb633d546d12d47a3027e9da9098a7c08e91f6f87237e1515181e0b73d6 -SHA512 (samba-4.22.0rc3.tar.asc) = ba9ab3ecdd6912f302c9ba1cb8c12cce1d390c6703528796a7d75e6281d578d9bc19df7e612ebc4e6c7d58b964e0aebf108061f08da8af57668424e7ce968222 +SHA512 (samba-4.22.0rc4.tar.xz) = 050f13471a5b21db7e9bf0a68326e2a821811b3a779758e275c7bcafeebe4534c0797e6beb76335ec31ab3a1b0a97c66d62b9c87ea4585d151810a0159946aca +SHA512 (samba-4.22.0rc4.tar.asc) = f3d114f427935c3a3a5fc4e29a1ab9929163219fe0cc1a446df45cf2098a561b0765ed1ebab14e20d82b86328e2d1a8f03b565537b8e1fc539245fb93e55250c From 6744eb181dae65b117b56a7c9deae7a0cee98f23 Mon Sep 17 00:00:00 2001 From: David Abdurachmanov Date: Wed, 11 Dec 2024 17:45:11 +0200 Subject: [PATCH 15/93] Enable lmdb on riscv64 Solves configuration error: [..] Checking for a 64-bit host to support lmdb : ok Checking for lmdb >= 0.9.16 : not found Checking for header lmdb.h : no Checking for lmdb >= 0.9.16 via header check : not found Samba AD DC and --enable-selftest requires lmdb 0.9.16 or later [..] Signed-off-by: David Abdurachmanov --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 1c9b659..f40570f 100644 --- a/samba.spec +++ b/samba.spec @@ -107,7 +107,7 @@ %bcond etcd_mutex 0 %endif -%ifarch aarch64 ppc64le s390x x86_64 +%ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond lmdb 1 %else %bcond lmdb 0 From 947b0b72d5d1ec7e3f3e62b19bab6329ec182673 Mon Sep 17 00:00:00 2001 From: Andrea Bolognani Date: Tue, 25 Feb 2025 20:48:03 +0100 Subject: [PATCH 16/93] Re-enable mold on riscv64 mold didn't build successfully on riscv64 back when riscv64 support was added to samba, but that has changed since and today there is no longer any reason not to use it. Signed-off-by: Andrea Bolognani --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index f40570f..ac9f967 100644 --- a/samba.spec +++ b/samba.spec @@ -315,7 +315,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%ifnarch i686 riscv64 +%ifnarch i686 %if 0%{?fedora} >= 37 BuildRequires: mold %endif From 7ebad9bdd168b4fce18a0ef2face757a5a4487ae Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:41:36 +0100 Subject: [PATCH 17/93] Set version for bundled libreplace --- samba.spec | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/samba.spec b/samba.spec index ac9f967..2aa6242 100644 --- a/samba.spec +++ b/samba.spec @@ -249,7 +249,7 @@ Obsoletes: samba-swat < %{samba_depver} Provides: samba4-swat = %{samba_depver} Obsoletes: samba4-swat < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} BuildRequires: make BuildRequires: gcc @@ -441,7 +441,7 @@ Obsoletes: samba4-client < %{samba_depver} Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description client The %{name}-client package provides some SMB/CIFS clients to complement @@ -494,7 +494,7 @@ Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %if %{without dc} && %{without testsuite} Obsoletes: samba-dc < %{samba_depver} @@ -536,7 +536,7 @@ Requires: libnetapi = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description common-tools The samba-common-tools package contains tools for SMB/CIFS clients. @@ -606,7 +606,7 @@ Requires: bind-utils Provides: samba4-dc = %{samba_depver} Obsoletes: samba4-dc < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc The samba-dc package provides AD Domain Controller functionality @@ -634,7 +634,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc-libs The %{name}-dc-libs package contains the libraries needed by the DC to @@ -653,7 +653,7 @@ Requires: bind Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc-bind-dlz The %{name}-dc-bind-dlz package contains the libraries for bind to manage all @@ -689,7 +689,7 @@ Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-cephfs Samba VFS module for Ceph distributed storage system integration. @@ -706,7 +706,7 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-iouring Samba VFS module for io_uring instance integration. @@ -731,7 +731,7 @@ Requires: libwbclient = %{samba_depver} Obsoletes: samba-glusterfs < %{samba_depver} Provides: samba-glusterfs = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-glusterfs Samba VFS module for GlusterFS integration. @@ -791,7 +791,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-libs = %{samba_depver} Obsoletes: samba4-libs < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description libs The %{name}-libs package contains the libraries needed by programs that link @@ -892,7 +892,7 @@ Requires: libsmbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description -n python3-%{name} The python3-%{name} package contains the Python 3 libraries needed by programs @@ -966,7 +966,7 @@ Requires: perl(Archive::Tar) Provides: samba4-test = %{samba_depver} Obsoletes: samba4-test < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description test %{name}-test provides testing tools for both the server and client @@ -986,7 +986,7 @@ Requires: libwbclient = %{samba_depver} Provides: %{name}-test-devel = %{samba_depver} Obsoletes: %{name}-test-devel < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description test-libs %{name}-test-libs provides libraries required by the testing tools. @@ -1030,7 +1030,7 @@ Obsoletes: samba4-winbind < %{samba_depver} # Old NetworkManager expects the dispatcher scripts in a different place Conflicts: NetworkManager < 1.20 -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind The samba-winbind package provides the winbind NSS library, and some client @@ -1053,7 +1053,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-winbind-clients = %{samba_depver} Obsoletes: samba4-winbind-clients < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-clients The samba-winbind-clients package provides the wbinfo and ntlm_auth @@ -1083,7 +1083,7 @@ Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives Requires(preun): %{_sbindir}/update-alternatives -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-krb5-locator The winbind krb5 locator is a plugin for the system kerberos library to allow @@ -1099,7 +1099,7 @@ Requires: libwbclient = %{samba_depver} %endif Requires: pam -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-modules The samba-winbind-modules package provides the NSS library and a PAM module @@ -1115,7 +1115,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winexe Winexe is a Remote Windows-command executor @@ -1151,7 +1151,7 @@ Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description -n ctdb CTDB is a cluster implementation of the TDB database used by Samba and other @@ -1212,7 +1212,7 @@ Requires: libtevent%{?_isa} >= %{tevent_version} # /endif without includelibs %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} Obsoletes: libldb < 0:2.10 Provides: libldb = 0:2.10 Provides: libldb = %{samba_depver} From 1b2e68adffe00a7f5a881cc3901106a257e847f4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:43:32 +0100 Subject: [PATCH 18/93] Add missing /run/ctdb dir to files list --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 2aa6242..78d3c22 100644 --- a/samba.spec +++ b/samba.spec @@ -3835,6 +3835,8 @@ fi %{_mandir}/man7/ctdb-tunables.7.gz %{_mandir}/man7/ctdb-statistics.7.gz +%ghost %dir /run/ctdb + %{_tmpfilesdir}/ctdb.conf %{_unitdir}/ctdb.service From e1991f29eccc30163711bb8f4a0192697bd3c548 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:32:35 +0100 Subject: [PATCH 19/93] Set samba-usershare to noarch It only includes configuration files. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 78d3c22..605fedb 100644 --- a/samba.spec +++ b/samba.spec @@ -996,6 +996,7 @@ Provides: bundled(libreplace) = %{samba_depver} Summary: Provides support for non-root user shares Requires: %{name} = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} +BuildArch: noarch %description usershares Installing this package will provide a configuration file, group and From f00c21e2a89e49b9aeb5a4915869dc392f99e429 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:01:51 +0100 Subject: [PATCH 20/93] Set samba-tools to noarch This only include a python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 605fedb..03442a5 100644 --- a/samba.spec +++ b/samba.spec @@ -556,6 +556,7 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg %endif +BuildArch: noarch %description tools The samba-tools package contains tools for Samba servers From e4ac2d5dcb832c64a9c7ecf28fa61272d3497d16 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:02:47 +0100 Subject: [PATCH 21/93] Set samba-gpupdate to noarch This only includes python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 03442a5..8cfd96c 100644 --- a/samba.spec +++ b/samba.spec @@ -747,6 +747,7 @@ Requires: %{name}-ldb-ldap-modules = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # samba-tool needs python3-samba-dc also on non-dc build Requires: python3-%{name}-dc = %{samba_depver} +BuildArch: noarch %description gpupdate This package provides the samba-gpupdate tool to apply Group Policy Objects From 8ee5558015bd0da1c51388fb219c4fb0f608a473 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:03:58 +0100 Subject: [PATCH 22/93] Set ctdb-etcd-mutex to noarch This only includes python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 8cfd96c..941ad1a 100644 --- a/samba.spec +++ b/samba.spec @@ -1182,6 +1182,7 @@ Performance Co-Pilot (PCP) support for CTDB Summary: CTDB ETCD mutex helper Requires: ctdb = %{samba_depver} Requires: python3-etcd +BuildArch: noarch %description -n ctdb-etcd-mutex Support for using an existing ETCD cluster as a mutex helper for CTDB From 417731acd07046213951b3614bf13d73dae3b8ee Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:06:07 +0100 Subject: [PATCH 23/93] Use spaces instead of tabs for krb5-printing scripts Removes rpmlint warnings --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 941ad1a..bde77c1 100644 --- a/samba.spec +++ b/samba.spec @@ -1650,12 +1650,12 @@ fi %post krb5-printing %{_sbindir}/update-alternatives --install %{_libexecdir}/samba/cups_backend_smb \ - cups_backend_smb \ - %{_libexecdir}/samba/smbspool_krb5_wrapper 50 + cups_backend_smb \ + %{_libexecdir}/samba/smbspool_krb5_wrapper 50 %postun krb5-printing if [ $1 -eq 0 ] ; then - %{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper + %{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper fi %ldconfig_scriptlets libs From 8739ca29c566b4ba8b368a659487a6d1d3bc7349 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 20 Feb 2025 18:39:08 +0100 Subject: [PATCH 24/93] Update to Samba 4.22.0rc3 - resolves: rhbz#2346803 Guenther --- samba.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index cc94374..71388b2 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -3511,9 +3511,11 @@ fi %dir %{python3_sitearch}/samba/tests/ndr %{python3_sitearch}/samba/tests/ndr/gkdi.py %{python3_sitearch}/samba/tests/ndr/gmsa.py +%{python3_sitearch}/samba/tests/ndr/sd.py %dir %{python3_sitearch}/samba/tests/ndr/__pycache__ %{python3_sitearch}/samba/tests/ndr/__pycache__/gkdi.*.pyc %{python3_sitearch}/samba/tests/ndr/__pycache__/gmsa.*.pyc +%{python3_sitearch}/samba/tests/ndr/__pycache__/sd.*.pyc %{python3_sitearch}/samba/tests/ndr/__pycache__/wbint.*.pyc %{python3_sitearch}/samba/tests/ndr/wbint.py %{python3_sitearch}/samba/tests/netbios.py diff --git a/sources b/sources index b75ed0a..a7d3db0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc2.tar.xz) = e0211687c51e0261a170a1d84d44ce82d65e44ff0f18f92fd59dff464037efbc9408c532d5717f9e1ba6cce9160cbd27be60c16b3d5b6b707c48f71503621d90 -SHA512 (samba-4.22.0rc2.tar.asc) = aac019083d039f633dc6f3255972832c8071a7415bb7bb2ee355e2a0095118a1c6351daaa70c5c7e95b0524094f2443ca9331f50ae5e2776ebd0c89309bd03fd +SHA512 (samba-4.22.0rc3.tar.xz) = fbfd87cbb874e8818061dfb5cc962e80148b8fe68ffa414c9345e70b49777b237c5f6eb633d546d12d47a3027e9da9098a7c08e91f6f87237e1515181e0b73d6 +SHA512 (samba-4.22.0rc3.tar.asc) = ba9ab3ecdd6912f302c9ba1cb8c12cce1d390c6703528796a7d75e6281d578d9bc19df7e612ebc4e6c7d58b964e0aebf108061f08da8af57668424e7ce968222 From 34ae6832adcee397451b6d37435ec23d6b251be1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 27 Feb 2025 20:00:34 +0100 Subject: [PATCH 25/93] Update to Samba 4.22.0rc4 - resolves: rhbz#2348758 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 71388b2..1c9b659 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index a7d3db0..2a41d3e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc3.tar.xz) = fbfd87cbb874e8818061dfb5cc962e80148b8fe68ffa414c9345e70b49777b237c5f6eb633d546d12d47a3027e9da9098a7c08e91f6f87237e1515181e0b73d6 -SHA512 (samba-4.22.0rc3.tar.asc) = ba9ab3ecdd6912f302c9ba1cb8c12cce1d390c6703528796a7d75e6281d578d9bc19df7e612ebc4e6c7d58b964e0aebf108061f08da8af57668424e7ce968222 +SHA512 (samba-4.22.0rc4.tar.xz) = 050f13471a5b21db7e9bf0a68326e2a821811b3a779758e275c7bcafeebe4534c0797e6beb76335ec31ab3a1b0a97c66d62b9c87ea4585d151810a0159946aca +SHA512 (samba-4.22.0rc4.tar.asc) = f3d114f427935c3a3a5fc4e29a1ab9929163219fe0cc1a446df45cf2098a561b0765ed1ebab14e20d82b86328e2d1a8f03b565537b8e1fc539245fb93e55250c From 23147a55025632631f1d3a20bc81e9ce4c35e5fe Mon Sep 17 00:00:00 2001 From: David Abdurachmanov Date: Wed, 11 Dec 2024 17:45:11 +0200 Subject: [PATCH 26/93] Enable lmdb on riscv64 Solves configuration error: [..] Checking for a 64-bit host to support lmdb : ok Checking for lmdb >= 0.9.16 : not found Checking for header lmdb.h : no Checking for lmdb >= 0.9.16 via header check : not found Samba AD DC and --enable-selftest requires lmdb 0.9.16 or later [..] Signed-off-by: David Abdurachmanov --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 1c9b659..f40570f 100644 --- a/samba.spec +++ b/samba.spec @@ -107,7 +107,7 @@ %bcond etcd_mutex 0 %endif -%ifarch aarch64 ppc64le s390x x86_64 +%ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond lmdb 1 %else %bcond lmdb 0 From 460952917bb4e22cca7b775aa63d1e129c92ae73 Mon Sep 17 00:00:00 2001 From: Andrea Bolognani Date: Tue, 25 Feb 2025 20:48:03 +0100 Subject: [PATCH 27/93] Re-enable mold on riscv64 mold didn't build successfully on riscv64 back when riscv64 support was added to samba, but that has changed since and today there is no longer any reason not to use it. Signed-off-by: Andrea Bolognani --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index f40570f..ac9f967 100644 --- a/samba.spec +++ b/samba.spec @@ -315,7 +315,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%ifnarch i686 riscv64 +%ifnarch i686 %if 0%{?fedora} >= 37 BuildRequires: mold %endif From b8994ec49c00112838109f93252197b64b342496 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:41:36 +0100 Subject: [PATCH 28/93] Set version for bundled libreplace --- samba.spec | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/samba.spec b/samba.spec index ac9f967..2aa6242 100644 --- a/samba.spec +++ b/samba.spec @@ -249,7 +249,7 @@ Obsoletes: samba-swat < %{samba_depver} Provides: samba4-swat = %{samba_depver} Obsoletes: samba4-swat < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} BuildRequires: make BuildRequires: gcc @@ -441,7 +441,7 @@ Obsoletes: samba4-client < %{samba_depver} Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description client The %{name}-client package provides some SMB/CIFS clients to complement @@ -494,7 +494,7 @@ Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %if %{without dc} && %{without testsuite} Obsoletes: samba-dc < %{samba_depver} @@ -536,7 +536,7 @@ Requires: libnetapi = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description common-tools The samba-common-tools package contains tools for SMB/CIFS clients. @@ -606,7 +606,7 @@ Requires: bind-utils Provides: samba4-dc = %{samba_depver} Obsoletes: samba4-dc < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc The samba-dc package provides AD Domain Controller functionality @@ -634,7 +634,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc-libs The %{name}-dc-libs package contains the libraries needed by the DC to @@ -653,7 +653,7 @@ Requires: bind Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc-bind-dlz The %{name}-dc-bind-dlz package contains the libraries for bind to manage all @@ -689,7 +689,7 @@ Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-cephfs Samba VFS module for Ceph distributed storage system integration. @@ -706,7 +706,7 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-iouring Samba VFS module for io_uring instance integration. @@ -731,7 +731,7 @@ Requires: libwbclient = %{samba_depver} Obsoletes: samba-glusterfs < %{samba_depver} Provides: samba-glusterfs = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-glusterfs Samba VFS module for GlusterFS integration. @@ -791,7 +791,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-libs = %{samba_depver} Obsoletes: samba4-libs < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description libs The %{name}-libs package contains the libraries needed by programs that link @@ -892,7 +892,7 @@ Requires: libsmbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description -n python3-%{name} The python3-%{name} package contains the Python 3 libraries needed by programs @@ -966,7 +966,7 @@ Requires: perl(Archive::Tar) Provides: samba4-test = %{samba_depver} Obsoletes: samba4-test < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description test %{name}-test provides testing tools for both the server and client @@ -986,7 +986,7 @@ Requires: libwbclient = %{samba_depver} Provides: %{name}-test-devel = %{samba_depver} Obsoletes: %{name}-test-devel < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description test-libs %{name}-test-libs provides libraries required by the testing tools. @@ -1030,7 +1030,7 @@ Obsoletes: samba4-winbind < %{samba_depver} # Old NetworkManager expects the dispatcher scripts in a different place Conflicts: NetworkManager < 1.20 -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind The samba-winbind package provides the winbind NSS library, and some client @@ -1053,7 +1053,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-winbind-clients = %{samba_depver} Obsoletes: samba4-winbind-clients < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-clients The samba-winbind-clients package provides the wbinfo and ntlm_auth @@ -1083,7 +1083,7 @@ Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives Requires(preun): %{_sbindir}/update-alternatives -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-krb5-locator The winbind krb5 locator is a plugin for the system kerberos library to allow @@ -1099,7 +1099,7 @@ Requires: libwbclient = %{samba_depver} %endif Requires: pam -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-modules The samba-winbind-modules package provides the NSS library and a PAM module @@ -1115,7 +1115,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winexe Winexe is a Remote Windows-command executor @@ -1151,7 +1151,7 @@ Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description -n ctdb CTDB is a cluster implementation of the TDB database used by Samba and other @@ -1212,7 +1212,7 @@ Requires: libtevent%{?_isa} >= %{tevent_version} # /endif without includelibs %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} Obsoletes: libldb < 0:2.10 Provides: libldb = 0:2.10 Provides: libldb = %{samba_depver} From 3bb52a5a6543e3206063246704afafe7187df859 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:43:32 +0100 Subject: [PATCH 29/93] Add missing /run/ctdb dir to files list --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 2aa6242..78d3c22 100644 --- a/samba.spec +++ b/samba.spec @@ -3835,6 +3835,8 @@ fi %{_mandir}/man7/ctdb-tunables.7.gz %{_mandir}/man7/ctdb-statistics.7.gz +%ghost %dir /run/ctdb + %{_tmpfilesdir}/ctdb.conf %{_unitdir}/ctdb.service From 0355abfef0da879012f30a5c28d982cdb1e9bfa4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:32:35 +0100 Subject: [PATCH 30/93] Set samba-usershare to noarch It only includes configuration files. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 78d3c22..605fedb 100644 --- a/samba.spec +++ b/samba.spec @@ -996,6 +996,7 @@ Provides: bundled(libreplace) = %{samba_depver} Summary: Provides support for non-root user shares Requires: %{name} = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} +BuildArch: noarch %description usershares Installing this package will provide a configuration file, group and From d4d514afc46f6e5b16abf1477431f3881a23b744 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:01:51 +0100 Subject: [PATCH 31/93] Set samba-tools to noarch This only include a python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 605fedb..03442a5 100644 --- a/samba.spec +++ b/samba.spec @@ -556,6 +556,7 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg %endif +BuildArch: noarch %description tools The samba-tools package contains tools for Samba servers From cf446e51f072b45c06245b7fb0d13c3819b2bd14 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:02:47 +0100 Subject: [PATCH 32/93] Set samba-gpupdate to noarch This only includes python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 03442a5..8cfd96c 100644 --- a/samba.spec +++ b/samba.spec @@ -747,6 +747,7 @@ Requires: %{name}-ldb-ldap-modules = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # samba-tool needs python3-samba-dc also on non-dc build Requires: python3-%{name}-dc = %{samba_depver} +BuildArch: noarch %description gpupdate This package provides the samba-gpupdate tool to apply Group Policy Objects From 09a1f226b4c84669ca3823790d44c379e9e7cde5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:03:58 +0100 Subject: [PATCH 33/93] Set ctdb-etcd-mutex to noarch This only includes python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 8cfd96c..941ad1a 100644 --- a/samba.spec +++ b/samba.spec @@ -1182,6 +1182,7 @@ Performance Co-Pilot (PCP) support for CTDB Summary: CTDB ETCD mutex helper Requires: ctdb = %{samba_depver} Requires: python3-etcd +BuildArch: noarch %description -n ctdb-etcd-mutex Support for using an existing ETCD cluster as a mutex helper for CTDB From e630ce35b77276a117eef57db594d43187d6a5ab Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:06:07 +0100 Subject: [PATCH 34/93] Use spaces instead of tabs for krb5-printing scripts Removes rpmlint warnings --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 941ad1a..bde77c1 100644 --- a/samba.spec +++ b/samba.spec @@ -1650,12 +1650,12 @@ fi %post krb5-printing %{_sbindir}/update-alternatives --install %{_libexecdir}/samba/cups_backend_smb \ - cups_backend_smb \ - %{_libexecdir}/samba/smbspool_krb5_wrapper 50 + cups_backend_smb \ + %{_libexecdir}/samba/smbspool_krb5_wrapper 50 %postun krb5-printing if [ $1 -eq 0 ] ; then - %{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper + %{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper fi %ldconfig_scriptlets libs From 21e22997d47dd5c656e95a18ae8b8741fdf449c8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 14:01:29 +0100 Subject: [PATCH 35/93] Revert "Set samba-tools to noarch" This reverts commit f00c21e2a89e49b9aeb5a4915869dc392f99e429. We can't set it to noarch as koji complains that "Requires: lmdb" is present on some arches and not on others. --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index bde77c1..bd6a4ec 100644 --- a/samba.spec +++ b/samba.spec @@ -556,7 +556,6 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg %endif -BuildArch: noarch %description tools The samba-tools package contains tools for Samba servers From 30ff8554df8fb3435491d5959145abd59a60ecb6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:10:31 +0100 Subject: [PATCH 36/93] Update to Samba 4.22.0 - resolves: rhbz#2350342 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index bd6a4ec..d6d6e9d 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index 2a41d3e..914331f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc4.tar.xz) = 050f13471a5b21db7e9bf0a68326e2a821811b3a779758e275c7bcafeebe4534c0797e6beb76335ec31ab3a1b0a97c66d62b9c87ea4585d151810a0159946aca -SHA512 (samba-4.22.0rc4.tar.asc) = f3d114f427935c3a3a5fc4e29a1ab9929163219fe0cc1a446df45cf2098a561b0765ed1ebab14e20d82b86328e2d1a8f03b565537b8e1fc539245fb93e55250c +SHA512 (samba-4.22.0.tar.xz) = 649c8808cf88e1f8df55e9df32cbb0a87afa0b5fe13b220fb5ee00506ed94f76073c9196866903a6061ea945670fc0a85f4c67940c86a18198e1cda22a75ea88 +SHA512 (samba-4.22.0.tar.asc) = 0098927156b01667d69e2850caf64156129d5da5aea557774acb43d4403d50759d48cf1c976ede4e7f312d75b639002aa1c11337e48922c7d7c5eeb0d057e900 From 0cb9860a40530163c1f6893ed04e7e4d59d5757a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:23:22 +0100 Subject: [PATCH 37/93] Turn on SMB 3.1.1 Unix Extensions in default smb.conf Guenther --- smb.conf.example | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/smb.conf.example b/smb.conf.example index 4e6b5d4..271f13b 100644 --- a/smb.conf.example +++ b/smb.conf.example @@ -269,6 +269,13 @@ ; map system = no ; store dos attributes = yes +# Turn on SMB 3.1.1 Unix Extensions by default +# +# Note: The Linux Kernel SMB3 client will negotiate unix extensions by default, +# find more info in man mount.smb3(8). Linux 6.13 will finally support special +# filetypes and symlink handling. + + smb3 unix extensions = yes #============================ Share Definitions ============================== From 39ad9b9ae4e3e42e274c954837f26a8fce41d45f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:10:31 +0100 Subject: [PATCH 38/93] Update to Samba 4.22.0 - resolves: rhbz#2350342 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index bde77c1..6f6b70c 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index 2a41d3e..914331f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc4.tar.xz) = 050f13471a5b21db7e9bf0a68326e2a821811b3a779758e275c7bcafeebe4534c0797e6beb76335ec31ab3a1b0a97c66d62b9c87ea4585d151810a0159946aca -SHA512 (samba-4.22.0rc4.tar.asc) = f3d114f427935c3a3a5fc4e29a1ab9929163219fe0cc1a446df45cf2098a561b0765ed1ebab14e20d82b86328e2d1a8f03b565537b8e1fc539245fb93e55250c +SHA512 (samba-4.22.0.tar.xz) = 649c8808cf88e1f8df55e9df32cbb0a87afa0b5fe13b220fb5ee00506ed94f76073c9196866903a6061ea945670fc0a85f4c67940c86a18198e1cda22a75ea88 +SHA512 (samba-4.22.0.tar.asc) = 0098927156b01667d69e2850caf64156129d5da5aea557774acb43d4403d50759d48cf1c976ede4e7f312d75b639002aa1c11337e48922c7d7c5eeb0d057e900 From 5cf235e0927ceb524271c5cb86eaa5a72be28d5a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:23:22 +0100 Subject: [PATCH 39/93] Turn on SMB 3.1.1 Unix Extensions in default smb.conf Guenther --- smb.conf.example | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/smb.conf.example b/smb.conf.example index 4e6b5d4..271f13b 100644 --- a/smb.conf.example +++ b/smb.conf.example @@ -269,6 +269,13 @@ ; map system = no ; store dos attributes = yes +# Turn on SMB 3.1.1 Unix Extensions by default +# +# Note: The Linux Kernel SMB3 client will negotiate unix extensions by default, +# find more info in man mount.smb3(8). Linux 6.13 will finally support special +# filetypes and symlink handling. + + smb3 unix extensions = yes #============================ Share Definitions ============================== From 1c181216208f5ddf53b41e35a72bf12d3e6c234e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 14:01:29 +0100 Subject: [PATCH 40/93] Revert "Set samba-tools to noarch" This reverts commit f00c21e2a89e49b9aeb5a4915869dc392f99e429. We can't set it to noarch as koji complains that "Requires: lmdb" is present on some arches and not on others. --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index 6f6b70c..d6d6e9d 100644 --- a/samba.spec +++ b/samba.spec @@ -556,7 +556,6 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg %endif -BuildArch: noarch %description tools The samba-tools package contains tools for Samba servers From b508f2ed7a9797fcbf82c9e2eee69832c5d20282 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:23:22 +0100 Subject: [PATCH 41/93] Turn on SMB 3.1.1 Unix Extensions in vendor smb.conf as well... Guenther --- smb.conf.vendor | 2 ++ 1 file changed, 2 insertions(+) diff --git a/smb.conf.vendor b/smb.conf.vendor index e45384d..748c6e5 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -18,6 +18,8 @@ load printers = yes cups options = raw + smb3 unix extensions = yes + # Install samba-usershares package for support include = /etc/samba/usershares.conf From 8e57b7ea4d7d5d98d7bb081590d05e5b2168f67a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:23:22 +0100 Subject: [PATCH 42/93] Turn on SMB 3.1.1 Unix Extensions in vendor smb.conf as well... Guenther --- smb.conf.vendor | 2 ++ 1 file changed, 2 insertions(+) diff --git a/smb.conf.vendor b/smb.conf.vendor index e45384d..748c6e5 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -18,6 +18,8 @@ load printers = yes cups options = raw + smb3 unix extensions = yes + # Install samba-usershares package for support include = /etc/samba/usershares.conf From 40bd3a26e8685d077cf7818dbc8e3e16a2181d5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 18 Apr 2025 02:26:37 +0200 Subject: [PATCH 43/93] Update to Samba 4.22.1 - resolves: rhbz#2360776 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index d6d6e9d..531958b 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.0 +%global samba_version 4.22.1 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 914331f..8e2875d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0.tar.xz) = 649c8808cf88e1f8df55e9df32cbb0a87afa0b5fe13b220fb5ee00506ed94f76073c9196866903a6061ea945670fc0a85f4c67940c86a18198e1cda22a75ea88 -SHA512 (samba-4.22.0.tar.asc) = 0098927156b01667d69e2850caf64156129d5da5aea557774acb43d4403d50759d48cf1c976ede4e7f312d75b639002aa1c11337e48922c7d7c5eeb0d057e900 +SHA512 (samba-4.22.1.tar.xz) = 34c5e63da50ccbf68f59d8fcea23711a18374a3f6e112cb62dde86ad084a4be0857ff347c763de2ae0eb14fb9991cf226d74c522ae61571feb518cec752dca67 +SHA512 (samba-4.22.1.tar.asc) = dd574647892f992312bdfeea9f1202a0a16cef667418e9cd239c7d6cca68f4dd0f34fbafca5c2d67fbc7b8ee888ca6798c4909960ce1b7eba39d8461f29f3341 From 6d3bdd4932d440297a083697d075d4843ab80ece Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 18 Apr 2025 02:26:37 +0200 Subject: [PATCH 44/93] Update to Samba 4.22.1 - resolves: rhbz#2360776 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index d6d6e9d..531958b 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.0 +%global samba_version 4.22.1 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 914331f..8e2875d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0.tar.xz) = 649c8808cf88e1f8df55e9df32cbb0a87afa0b5fe13b220fb5ee00506ed94f76073c9196866903a6061ea945670fc0a85f4c67940c86a18198e1cda22a75ea88 -SHA512 (samba-4.22.0.tar.asc) = 0098927156b01667d69e2850caf64156129d5da5aea557774acb43d4403d50759d48cf1c976ede4e7f312d75b639002aa1c11337e48922c7d7c5eeb0d057e900 +SHA512 (samba-4.22.1.tar.xz) = 34c5e63da50ccbf68f59d8fcea23711a18374a3f6e112cb62dde86ad084a4be0857ff347c763de2ae0eb14fb9991cf226d74c522ae61571feb518cec752dca67 +SHA512 (samba-4.22.1.tar.asc) = dd574647892f992312bdfeea9f1202a0a16cef667418e9cd239c7d6cca68f4dd0f34fbafca5c2d67fbc7b8ee888ca6798c4909960ce1b7eba39d8461f29f3341 From b8a889b232cd2519d49fa87dbda960fa19f18f3e Mon Sep 17 00:00:00 2001 From: Python Maint Date: Thu, 5 Jun 2025 00:08:08 +0200 Subject: [PATCH 45/93] Rebuilt for Python 3.14 From eb8dac413e347d2b662b93045d9fcf964d6b45f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 5 Jun 2025 19:14:20 +0200 Subject: [PATCH 46/93] Update to Samba 4.22.2 - resolves: rhbz#2370468 - resolves: rhbz#2370455 - Security fix for CVE-2025-0620 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 531958b..a4eca83 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.1 +%global samba_version 4.22.2 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 8e2875d..d93d58f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.1.tar.xz) = 34c5e63da50ccbf68f59d8fcea23711a18374a3f6e112cb62dde86ad084a4be0857ff347c763de2ae0eb14fb9991cf226d74c522ae61571feb518cec752dca67 -SHA512 (samba-4.22.1.tar.asc) = dd574647892f992312bdfeea9f1202a0a16cef667418e9cd239c7d6cca68f4dd0f34fbafca5c2d67fbc7b8ee888ca6798c4909960ce1b7eba39d8461f29f3341 +SHA512 (samba-4.22.2.tar.xz) = 8ce34210797e531c7624a033d4b68a424d7e698872cdac826109a66930257fad41396bca4b90d7a0fc8551ef2a640d8d8b875cf2115146360acee354d6483351 +SHA512 (samba-4.22.2.tar.asc) = 68c1dae279b732c7fcdab014fc670b6d90c0f139be53176d1275c756a30f28c86d40cd4e4edb90aab871470274ce65d58aae27e2d8eba5d5c1ebafbb192626fe From 30237b1f018d5b9eacb5f1cfa716ac455ce52bde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 5 Jun 2025 19:14:20 +0200 Subject: [PATCH 47/93] Update to Samba 4.22.2 - resolves: rhbz#2370468 - resolves: rhbz#2370455 - Security fix for CVE-2025-0620 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 531958b..a4eca83 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.1 +%global samba_version 4.22.2 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 8e2875d..d93d58f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.1.tar.xz) = 34c5e63da50ccbf68f59d8fcea23711a18374a3f6e112cb62dde86ad084a4be0857ff347c763de2ae0eb14fb9991cf226d74c522ae61571feb518cec752dca67 -SHA512 (samba-4.22.1.tar.asc) = dd574647892f992312bdfeea9f1202a0a16cef667418e9cd239c7d6cca68f4dd0f34fbafca5c2d67fbc7b8ee888ca6798c4909960ce1b7eba39d8461f29f3341 +SHA512 (samba-4.22.2.tar.xz) = 8ce34210797e531c7624a033d4b68a424d7e698872cdac826109a66930257fad41396bca4b90d7a0fc8551ef2a640d8d8b875cf2115146360acee354d6483351 +SHA512 (samba-4.22.2.tar.asc) = 68c1dae279b732c7fcdab014fc670b6d90c0f139be53176d1275c756a30f28c86d40cd4e4edb90aab871470274ce65d58aae27e2d8eba5d5c1ebafbb192626fe From e9a8536578eda0bae0a91d467b271f5c86e033fa Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 6 Jun 2025 09:34:20 +0200 Subject: [PATCH 48/93] Rebuilt for Python 3.14 From 64f8b2a48455f504c8018a6f929c672170d6aa98 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 10 Jun 2025 14:08:56 +0200 Subject: [PATCH 49/93] Install /run/ctdb Fix following report: rpm --verify ctdb-0:4.22.2-3.el9.x86_64 .M....... g /run/ctdb M Mode differs (includes permissions and file type) --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index a4eca83..d044cbd 100644 --- a/samba.spec +++ b/samba.spec @@ -1439,6 +1439,7 @@ install -d -m 0755 %{buildroot}/var/lib/samba/sysvol install -d -m 0755 %{buildroot}/var/lib/samba/usershares install -d -m 0755 %{buildroot}/var/lib/samba/winbindd_privileged install -d -m 0755 %{buildroot}/var/log/samba/old +install -d -m 0755 %{buildroot}/run/ctdb install -d -m 0755 %{buildroot}/run/samba install -d -m 0755 %{buildroot}/run/winbindd install -d -m 0755 %{buildroot}/%{_libdir}/samba From ac5f4a1f4b8f3ed80469febdf56c7dd2519162cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 10 Jun 2025 14:11:41 +0200 Subject: [PATCH 50/93] Move libreplace-private-samba.so to samba-common-libs Fix this rpmdeps report: VERIFY Subpackage libldb on x86_64 carries 'Requires: libreplace-private-samba.so()(64bit)' which comes from subpackage samba-client-libs but does not carry an explicit package version requirement. Please add 'Requires: samba-client-libs = %{version}-%{release}' to the spec file to avoid the need to test interoperability between various combinations of old and new subpackages. --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index d044cbd..68508b7 100644 --- a/samba.spec +++ b/samba.spec @@ -1212,10 +1212,10 @@ License: LGPL-3.0-or-later Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} +Requires: samba-common-libs = %{samba_depver} # /endif without includelibs %endif -Provides: bundled(libreplace) = %{samba_depver} Obsoletes: libldb < 0:2.10 Provides: libldb = 0:2.10 Provides: libldb = %{samba_depver} @@ -1997,7 +1997,6 @@ fi %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so %{_libdir}/samba/libprinting-migrate-private-samba.so -%{_libdir}/samba/libreplace-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so %{_libdir}/samba/libsamba-debug-private-samba.so @@ -2080,6 +2079,7 @@ fi %files common-libs # common libraries %{_libdir}/samba/libcmdline-private-samba.so +%{_libdir}/samba/libreplace-private-samba.so %dir %{_libdir}/samba/ldb From 060552411c704e9f5f965ded37e9b1c9e8373692 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jun 2025 10:14:07 +0200 Subject: [PATCH 51/93] smb.conf: Remove the '@' for NIX groups, we removed NIS support --- smb.conf.vendor | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/smb.conf.vendor b/smb.conf.vendor index 748c6e5..cbb2e0f 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -40,7 +40,8 @@ [print$] comment = Printer Drivers path = /var/lib/samba/drivers - write list = @printadmin root - force group = @printadmin + # printadmin is a local group + write list = printadmin root + force group = printadmin create mask = 0664 directory mask = 0775 From d5056e867a933be92f93c22c7e3c47f37af380b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 8 Jul 2025 00:50:10 +0200 Subject: [PATCH 52/93] Update to Samba 4.22.3 - resolves: #2376873 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 68508b7..f59cd87 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.2 +%global samba_version 4.22.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index d93d58f..c47ad40 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.2.tar.xz) = 8ce34210797e531c7624a033d4b68a424d7e698872cdac826109a66930257fad41396bca4b90d7a0fc8551ef2a640d8d8b875cf2115146360acee354d6483351 -SHA512 (samba-4.22.2.tar.asc) = 68c1dae279b732c7fcdab014fc670b6d90c0f139be53176d1275c756a30f28c86d40cd4e4edb90aab871470274ce65d58aae27e2d8eba5d5c1ebafbb192626fe +SHA512 (samba-4.22.3.tar.xz) = 426f5128eefc8e96677e507d6980756e7bc70d063c62a9d38d5c33b9c3eb54aaffe1fab5432e09f50d6dfc898635952df8122b2a1a9ee45a6a01702f3c91f43c +SHA512 (samba-4.22.3.tar.asc) = 612d3bec57048168e5c0f95c2ce28daaf0dd29282ba34af26a590ff20c6187f5efaa5b717577d445df4f4752ded6f8ee139ab878b8ccb4cf41c2a38fb8b4694e From 8953edf2cdf039e2be5c12ae70841bc11b6510da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 8 Jul 2025 00:50:10 +0200 Subject: [PATCH 53/93] Update to Samba 4.22.3 - resolves: #2376873 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index a4eca83..e18ac86 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.2 +%global samba_version 4.22.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index d93d58f..c47ad40 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.2.tar.xz) = 8ce34210797e531c7624a033d4b68a424d7e698872cdac826109a66930257fad41396bca4b90d7a0fc8551ef2a640d8d8b875cf2115146360acee354d6483351 -SHA512 (samba-4.22.2.tar.asc) = 68c1dae279b732c7fcdab014fc670b6d90c0f139be53176d1275c756a30f28c86d40cd4e4edb90aab871470274ce65d58aae27e2d8eba5d5c1ebafbb192626fe +SHA512 (samba-4.22.3.tar.xz) = 426f5128eefc8e96677e507d6980756e7bc70d063c62a9d38d5c33b9c3eb54aaffe1fab5432e09f50d6dfc898635952df8122b2a1a9ee45a6a01702f3c91f43c +SHA512 (samba-4.22.3.tar.asc) = 612d3bec57048168e5c0f95c2ce28daaf0dd29282ba34af26a590ff20c6187f5efaa5b717577d445df4f4752ded6f8ee139ab878b8ccb4cf41c2a38fb8b4694e From cc54c0c19d6d1cad1da79712278d2133ae251cce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 10 Jul 2025 21:46:16 +0200 Subject: [PATCH 54/93] Fix get_kdc_ip_string handling for secondary KDCs - resolves: bzso#15881 Guenther --- samba-4.22.x-get_kdc_ip_string.patch | 34 ++++++++++++++++++++++++++++ samba.spec | 2 ++ 2 files changed, 36 insertions(+) create mode 100644 samba-4.22.x-get_kdc_ip_string.patch diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch new file mode 100644 index 0000000..9277c9b --- /dev/null +++ b/samba-4.22.x-get_kdc_ip_string.patch @@ -0,0 +1,34 @@ +From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Fri, 4 Jul 2025 17:50:40 +0200 +Subject: [PATCH] libads: fix get_kdc_ip_string() ... +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 + +Signed-off-by: Ralph Boehme +Reviewed-by: Guenther Deschner + +Autobuild-User(master): Günther Deschner +Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224 +--- + source3/libads/kerberos.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c +index 75803500d31..145bc36cdb2 100644 +--- a/source3/libads/kerberos.c ++++ b/source3/libads/kerberos.c +@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx, + + if (!NT_STATUS_IS_OK(status)) { + DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status)); ++ result = talloc_move(mem_ctx, &kdc_str); + goto out; + } + +-- +2.50.0 + diff --git a/samba.spec b/samba.spec index e18ac86..0dabc07 100644 --- a/samba.spec +++ b/samba.spec @@ -215,6 +215,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.22.x-get_kdc_ip_string.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From b40f280be5c9cc340c245d69dfd554891cedd4ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 10 Jul 2025 21:46:16 +0200 Subject: [PATCH 55/93] Fix get_kdc_ip_string handling for secondary KDCs - resolves: bzso#15881 Guenther --- samba-4.22.x-get_kdc_ip_string.patch | 34 ++++++++++++++++++++++++++++ samba.spec | 2 ++ 2 files changed, 36 insertions(+) create mode 100644 samba-4.22.x-get_kdc_ip_string.patch diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch new file mode 100644 index 0000000..9277c9b --- /dev/null +++ b/samba-4.22.x-get_kdc_ip_string.patch @@ -0,0 +1,34 @@ +From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Fri, 4 Jul 2025 17:50:40 +0200 +Subject: [PATCH] libads: fix get_kdc_ip_string() ... +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 + +Signed-off-by: Ralph Boehme +Reviewed-by: Guenther Deschner + +Autobuild-User(master): Günther Deschner +Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224 +--- + source3/libads/kerberos.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c +index 75803500d31..145bc36cdb2 100644 +--- a/source3/libads/kerberos.c ++++ b/source3/libads/kerberos.c +@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx, + + if (!NT_STATUS_IS_OK(status)) { + DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status)); ++ result = talloc_move(mem_ctx, &kdc_str); + goto out; + } + +-- +2.50.0 + diff --git a/samba.spec b/samba.spec index f59cd87..7da5ef4 100644 --- a/samba.spec +++ b/samba.spec @@ -215,6 +215,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.22.x-get_kdc_ip_string.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From 5c93354123f7302192a52b305334853f6d2ef56d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 17:53:14 +0000 Subject: [PATCH 56/93] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From ad5439e191ee3e9dab69e76b148b78207e66fb19 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20Zatloukal?= Date: Wed, 6 Aug 2025 09:57:46 +0200 Subject: [PATCH 57/93] Rebuilt for icu 77.1 From 052edc4ab62c26380f1865674a88047a41201db4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 12 Aug 2025 22:09:33 +0200 Subject: [PATCH 58/93] Update to Samba 4.23.0rc1 - resolves: #2387090 Guenther --- samba-4.22.x-get_kdc_ip_string.patch | 34 ------------ samba.spec | 78 +++++++++++++++++++++++++--- sources | 4 +- 3 files changed, 73 insertions(+), 43 deletions(-) delete mode 100644 samba-4.22.x-get_kdc_ip_string.patch diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch deleted file mode 100644 index 9277c9b..0000000 --- a/samba-4.22.x-get_kdc_ip_string.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Fri, 4 Jul 2025 17:50:40 +0200 -Subject: [PATCH] libads: fix get_kdc_ip_string() ... -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 - -Signed-off-by: Ralph Boehme -Reviewed-by: Guenther Deschner - -Autobuild-User(master): Günther Deschner -Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224 ---- - source3/libads/kerberos.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c -index 75803500d31..145bc36cdb2 100644 ---- a/source3/libads/kerberos.c -+++ b/source3/libads/kerberos.c -@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx, - - if (!NT_STATUS_IS_OK(status)) { - DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status)); -+ result = talloc_move(mem_ctx, &kdc_str); - goto out; - } - --- -2.50.0 - diff --git a/samba.spec b/samba.spec index 7da5ef4..bebd14a 100644 --- a/samba.spec +++ b/samba.spec @@ -107,13 +107,20 @@ %bcond etcd_mutex 0 %endif +# Build the prometheus exporter by default on Fedora +%if 0%{?fedora} +%bcond prometheus 1 +%else +%bcond prometheus 0 +%endif + %ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond lmdb 1 %else %bcond lmdb 0 %endif -%global samba_version 4.22.3 +%global samba_version 4.23.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -128,7 +135,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc1 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -159,8 +166,8 @@ %global libwbclient_so_version 0 %global talloc_version 2.4.3 -%global tdb_version 1.4.13 -%global tevent_version 0.16.2 +%global tdb_version 1.4.14 +%global tevent_version 0.17.1 %global required_mit_krb5 1.20.1 @@ -215,8 +222,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.22.x-get_kdc_ip_string.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -345,6 +350,9 @@ BuildRequires: librados-devel %if %{with etcd_mutex} BuildRequires: python3-etcd %endif +%if %{with prometheus} +BuildRequires: libevent-devel +%endif BuildRequires: cepces-certmonger >= 0.3.8 @@ -1206,6 +1214,18 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB #endif with clustering %endif +%if %{with prometheus} + +%package prometheus +Summary: SMB Prometheus exporter +Requires: samba = %{samba_depver} + +%description prometheus +Support for exporting metrics via Prometheus + +#endif with prometheus +%endif + ### LIBLDB %package -n libldb Summary: A schema-less, ldap like, API and database @@ -1357,6 +1377,8 @@ if [ -n "${CCACHE}" ]; then fi %endif +# workaround https://gitlab.com/ita1024/waf/-/issues/2472 +export PYTHONARCHDIR=%{python3_sitearch} %configure \ --enable-fhs \ --with-piddir=/run \ @@ -1396,6 +1418,9 @@ fi %endif %if %{with etcd_mutex} --enable-etcd-reclock \ +%endif +%if %{with prometheus} + --with-prometheus-exporter \ %endif --with-profiling-data \ --with-systemd \ @@ -1995,22 +2020,25 @@ fi %{_libdir}/samba/libndr-samba4-private-samba.so %{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so +%{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so +%{_libdir}/samba/libngtcp2-private-samba.so %{_libdir}/samba/libnpa-tstream-private-samba.so %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so %{_libdir}/samba/libprinting-migrate-private-samba.so +%{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so %{_libdir}/samba/libsamba-debug-private-samba.so %{_libdir}/samba/libsamba-modules-private-samba.so %{_libdir}/samba/libsamba-security-private-samba.so +%{_libdir}/samba/libsamba-security-trusts-private-samba.so %{_libdir}/samba/libsamba-sockets-private-samba.so %{_libdir}/samba/libsamba3-util-private-samba.so %{_libdir}/samba/libsamdb-common-private-samba.so %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so %{_libdir}/samba/libserver-role-private-samba.so -%{_libdir}/samba/libsmb-transport-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so %{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so @@ -2106,6 +2134,7 @@ fi %{_mandir}/man8/net.8* %{_mandir}/man8/pdbedit.8* %{_mandir}/man8/smbpasswd.8* +%{_datadir}/locale/*/LC_MESSAGES/net.mo ### TOOLS %files tools @@ -2228,6 +2257,7 @@ fi %{_libdir}/samba/service/dns.so %{_libdir}/samba/service/dns_update.so %{_libdir}/samba/service/drepl.so +%{_libdir}/samba/service/ft_scanner.so %{_libdir}/samba/service/kcc.so %{_libdir}/samba/service/kdc.so %{_libdir}/samba/service/ldap.so @@ -2580,6 +2610,7 @@ fi %{python3_sitearch}/samba/dcerpc/atsvc.*.so %{python3_sitearch}/samba/dcerpc/auth.*.so %{python3_sitearch}/samba/dcerpc/base.*.so +%{python3_sitearch}/samba/dcerpc/bcrypt_rsakey_blob.*.so %{python3_sitearch}/samba/dcerpc/claims.*.so %{python3_sitearch}/samba/dcerpc/conditional_ace.*.so %{python3_sitearch}/samba/dcerpc/dcerpc.*.so @@ -2595,6 +2626,7 @@ fi %{python3_sitearch}/samba/dcerpc/idmap.*.so %{python3_sitearch}/samba/dcerpc/initshutdown.*.so %{python3_sitearch}/samba/dcerpc/irpc.*.so +%{python3_sitearch}/samba/dcerpc/keycredlink.*.so %{python3_sitearch}/samba/dcerpc/krb5ccache.*.so %{python3_sitearch}/samba/dcerpc/krb5pac.*.so %{python3_sitearch}/samba/dcerpc/lsa.*.so @@ -2616,6 +2648,7 @@ fi %{python3_sitearch}/samba/dcerpc/spoolss.*.so %{python3_sitearch}/samba/dcerpc/srvsvc.*.so %{python3_sitearch}/samba/dcerpc/svcctl.*.so +%{python3_sitearch}/samba/dcerpc/tpm20_rsakey_blob.*.so %{python3_sitearch}/samba/dcerpc/unixinfo.*.so %{python3_sitearch}/samba/dcerpc/winbind.*.so %{python3_sitearch}/samba/dcerpc/windows_event_ids.*.so @@ -3119,6 +3152,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/auth_log_netlogon_bad_creds.*.pyc %{python3_sitearch}/samba/tests/__pycache__/auth_log_samlogon.*.pyc %{python3_sitearch}/samba/tests/__pycache__/auth_log_winbind.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/bcrypt_rsakey_blob.*.pyc %{python3_sitearch}/samba/tests/__pycache__/common.*.pyc %{python3_sitearch}/samba/tests/__pycache__/complex_expressions.*.pyc %{python3_sitearch}/samba/tests/__pycache__/compression.*.pyc @@ -3160,6 +3194,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/tests/__pycache__/imports.*.pyc %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/key_credential_link.*.pyc %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc @@ -3237,6 +3272,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/subunitrun.*.pyc %{python3_sitearch}/samba/tests/__pycache__/tdb_util.*.pyc %{python3_sitearch}/samba/tests/__pycache__/token_factory.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/tpm20_rsakey_blob.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovision.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovisionneeddc.*.pyc @@ -3254,6 +3290,7 @@ fi %{python3_sitearch}/samba/tests/auth_log_pass_change.py %{python3_sitearch}/samba/tests/auth_log_samlogon.py %{python3_sitearch}/samba/tests/auth_log_winbind.py +%{python3_sitearch}/samba/tests/bcrypt_rsakey_blob.py %dir %{python3_sitearch}/samba/tests/blackbox %{python3_sitearch}/samba/tests/blackbox/__init__.py %dir %{python3_sitearch}/samba/tests/blackbox/__pycache__ @@ -3414,6 +3451,7 @@ fi %{python3_sitearch}/samba/tests/kcc/graph_utils.py %{python3_sitearch}/samba/tests/kcc/kcc_utils.py %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py +%{python3_sitearch}/samba/tests/key_credential_link.py %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ %{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc @@ -3529,6 +3567,12 @@ fi %{python3_sitearch}/samba/tests/net_join_no_spnego.py %{python3_sitearch}/samba/tests/net_join.py %{python3_sitearch}/samba/tests/netlogonsvc.py +%dir %{python3_sitearch}/samba/tests/nss +%dir %{python3_sitearch}/samba/tests/nss/__pycache__ +%{python3_sitearch}/samba/tests/nss/__pycache__/base.*.pyc +%{python3_sitearch}/samba/tests/nss/__pycache__/group.*.pyc +%{python3_sitearch}/samba/tests/nss/base.py +%{python3_sitearch}/samba/tests/nss/group.py %{python3_sitearch}/samba/tests/ntacls.py %{python3_sitearch}/samba/tests/ntacls_backup.py %{python3_sitearch}/samba/tests/ntlmdisabled.py @@ -3689,10 +3733,21 @@ fi %{python3_sitearch}/samba/tests/subunitrun.py %{python3_sitearch}/samba/tests/tdb_util.py %{python3_sitearch}/samba/tests/token_factory.py +%{python3_sitearch}/samba/tests/tpm20_rsakey_blob.py %{python3_sitearch}/samba/tests/upgrade.py %{python3_sitearch}/samba/tests/upgradeprovision.py %{python3_sitearch}/samba/tests/upgradeprovisionneeddc.py %{python3_sitearch}/samba/tests/usage.py +%dir %{python3_sitearch}/samba/tests/varlink +%dir %{python3_sitearch}/samba/tests/varlink/__pycache__ +%{python3_sitearch}/samba/tests/varlink/__pycache__/base.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getgrouprecord.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getmemberships.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getuserrecord.*.pyc +%{python3_sitearch}/samba/tests/varlink/base.py +%{python3_sitearch}/samba/tests/varlink/getgrouprecord.py +%{python3_sitearch}/samba/tests/varlink/getmemberships.py +%{python3_sitearch}/samba/tests/varlink/getuserrecord.py %{python3_sitearch}/samba/tests/xattr.py ### TEST @@ -3761,6 +3816,7 @@ fi %config(noreplace) %{_sysconfdir}/security/pam_winbind.conf %{_mandir}/man5/pam_winbind.conf.5* %{_mandir}/man8/pam_winbind.8* +%{_datadir}/locale/*/LC_MESSAGES/pam_winbind.mo %if %{with clustering} %files -n ctdb @@ -3910,6 +3966,13 @@ fi %{_mandir}/man1/winexe.1.gz %endif +%if %{with prometheus} +%files prometheus +%{_bindir}/smb_prometheus_endpoint +%{_mandir}/man8/smb_prometheus_endpoint.8.gz +#endif with prometheus + +%endif %files -n libldb %license lib/ldb/LICENSE %{_libdir}/libldb.so.* @@ -3933,6 +3996,7 @@ fi %{_libdir}/samba/ldb/server_sort.so %{_libdir}/samba/ldb/skel.so %{_libdir}/samba/ldb/tdb.so +%{_libdir}/samba/ldb/trust_notify.so %files -n libldb-devel %{_includedir}/samba-4.0/ldb_module.h diff --git a/sources b/sources index c47ad40..ddc3910 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.3.tar.xz) = 426f5128eefc8e96677e507d6980756e7bc70d063c62a9d38d5c33b9c3eb54aaffe1fab5432e09f50d6dfc898635952df8122b2a1a9ee45a6a01702f3c91f43c -SHA512 (samba-4.22.3.tar.asc) = 612d3bec57048168e5c0f95c2ce28daaf0dd29282ba34af26a590ff20c6187f5efaa5b717577d445df4f4752ded6f8ee139ab878b8ccb4cf41c2a38fb8b4694e +SHA512 (samba-4.23.0rc1.tar.xz) = 6472b7445c138abb69185954c2ba86164fa500d8e267cf26ca6208f78599abcd6af282c19a7609cb72dc2d40d68956cdef3599d27dbf7e30d6b9b1f02d0cddea +SHA512 (samba-4.23.0rc1.tar.asc) = 56c9f8a4357599c52ad62e5ddf342c7e0eee4eb3f3c874f77280f06684e00aaf19d3a6d8bea9da8e63f8f79c4f6f28b0bdf3997dbe5213b17b3b4679e5fe5441 From c2bf86b8d2dc38adaded41822a69127cce364e47 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Sun, 17 Aug 2025 23:05:41 -0400 Subject: [PATCH 59/93] Move trust_notify module to -dc subpackage This module is not built in ELN, resulting in a file not found error when packaging libldb. Its build conditions are the same as the dns_notify module already in -dc. --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index bebd14a..5811a12 100644 --- a/samba.spec +++ b/samba.spec @@ -2212,6 +2212,7 @@ fi %{_libdir}/samba/ldb/subtree_delete.so %{_libdir}/samba/ldb/subtree_rename.so %{_libdir}/samba/ldb/tombstone_reanimate.so +%{_libdir}/samba/ldb/trust_notify.so %{_libdir}/samba/ldb/unique_object_sids.so %{_libdir}/samba/ldb/update_keytab.so %{_libdir}/samba/ldb/vlv.so @@ -3996,7 +3997,6 @@ fi %{_libdir}/samba/ldb/server_sort.so %{_libdir}/samba/ldb/skel.so %{_libdir}/samba/ldb/tdb.so -%{_libdir}/samba/ldb/trust_notify.so %files -n libldb-devel %{_includedir}/samba-4.0/ldb_module.h From c108db5e55fd5b9b4e9a5b8062744e4b7796dac6 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 18 Aug 2025 13:57:35 +0200 Subject: [PATCH 60/93] Rebuilt for Python 3.14.0rc2 bytecode From af56354596c2da74a7df058d1b5f81d72cafaaf7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 21 Aug 2025 18:39:36 +0200 Subject: [PATCH 61/93] Update to Samba 4.22.4 Guenther --- samba-4.22.x-get_kdc_ip_string.patch | 34 ---------------------------- samba.spec | 4 +--- sources | 4 ++-- 3 files changed, 3 insertions(+), 39 deletions(-) delete mode 100644 samba-4.22.x-get_kdc_ip_string.patch diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch deleted file mode 100644 index 9277c9b..0000000 --- a/samba-4.22.x-get_kdc_ip_string.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Fri, 4 Jul 2025 17:50:40 +0200 -Subject: [PATCH] libads: fix get_kdc_ip_string() ... -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 - -Signed-off-by: Ralph Boehme -Reviewed-by: Guenther Deschner - -Autobuild-User(master): Günther Deschner -Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224 ---- - source3/libads/kerberos.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c -index 75803500d31..145bc36cdb2 100644 ---- a/source3/libads/kerberos.c -+++ b/source3/libads/kerberos.c -@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx, - - if (!NT_STATUS_IS_OK(status)) { - DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status)); -+ result = talloc_move(mem_ctx, &kdc_str); - goto out; - } - --- -2.50.0 - diff --git a/samba.spec b/samba.spec index 0dabc07..6325c66 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.3 +%global samba_version 4.22.4 # The release field is extended: # [.][.]%%{?dist}[.] @@ -215,8 +215,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.22.x-get_kdc_ip_string.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} diff --git a/sources b/sources index c47ad40..599a26d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.3.tar.xz) = 426f5128eefc8e96677e507d6980756e7bc70d063c62a9d38d5c33b9c3eb54aaffe1fab5432e09f50d6dfc898635952df8122b2a1a9ee45a6a01702f3c91f43c -SHA512 (samba-4.22.3.tar.asc) = 612d3bec57048168e5c0f95c2ce28daaf0dd29282ba34af26a590ff20c6187f5efaa5b717577d445df4f4752ded6f8ee139ab878b8ccb4cf41c2a38fb8b4694e +SHA512 (samba-4.22.4.tar.xz) = d04db845227ace43642ba69da4ded80d576db01d2e6a7e3e3161c05ce20ff77bd944d39aaf35adab59bed607e0037713969cb9a855a367ab65d021c5aef7ea46 +SHA512 (samba-4.22.4.tar.asc) = ee1b66c6094f6c44954470432676034afc557db84f28a6ef37ea770d987cd5dddf6f6e8c179f3344cf04abc1c6696bbaa5ae031119edc58ea533b464d77641d9 From e6a975e42205afdb48c4c0e56c7ae97d61630788 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 22 Aug 2025 21:51:03 +0200 Subject: [PATCH 62/93] Update to Samba 4.23.0rc2 - resolves: #2387090 Guenther --- samba.spec | 5 +++-- sources | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 5811a12..76df67c 100644 --- a/samba.spec +++ b/samba.spec @@ -102,7 +102,8 @@ # Build the etcd helpers by default on Fedora %if 0%{?fedora} -%bcond etcd_mutex 1 +# disable etcd mutex helper as etcd is orphaned in Fedora now +%bcond etcd_mutex 0 %else %bcond etcd_mutex 0 %endif @@ -135,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc1 +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index ddc3910..24013e1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc1.tar.xz) = 6472b7445c138abb69185954c2ba86164fa500d8e267cf26ca6208f78599abcd6af282c19a7609cb72dc2d40d68956cdef3599d27dbf7e30d6b9b1f02d0cddea -SHA512 (samba-4.23.0rc1.tar.asc) = 56c9f8a4357599c52ad62e5ddf342c7e0eee4eb3f3c874f77280f06684e00aaf19d3a6d8bea9da8e63f8f79c4f6f28b0bdf3997dbe5213b17b3b4679e5fe5441 +SHA512 (samba-4.23.0rc2.tar.xz) = 44c8fab0523038270295b1d4ea9d535df04deb91dfe08680e1bde0b621eb6146ff9157ec97e9c0f0fb95ae33aaf66903a192b486b2df35899b6c5d4a57e09ee9 +SHA512 (samba-4.23.0rc2.tar.asc) = 7bdc54eb7bf4736123ea889f18ff0aa29eca91d2ab25fbfaeed431a0c7d193167526312bf051e58c70d2d9de0dfa9a5cdc9d8177f6f144c1b2d32c8ed2d0631d From 83273a97b1fb10bb6db374215af67549ef94637a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 29 Aug 2025 23:32:47 +0200 Subject: [PATCH 63/93] Update to Samba 4.23.0rc3 - resolves: #2387090 Guenther --- samba.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 76df67c..3e1a5fd 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -3361,6 +3361,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/dfs.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc @@ -3381,6 +3382,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py %{python3_sitearch}/samba/tests/dcerpc/binding.py +%{python3_sitearch}/samba/tests/dcerpc/dfs.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/lsa.py diff --git a/sources b/sources index 24013e1..168a85d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc2.tar.xz) = 44c8fab0523038270295b1d4ea9d535df04deb91dfe08680e1bde0b621eb6146ff9157ec97e9c0f0fb95ae33aaf66903a192b486b2df35899b6c5d4a57e09ee9 -SHA512 (samba-4.23.0rc2.tar.asc) = 7bdc54eb7bf4736123ea889f18ff0aa29eca91d2ab25fbfaeed431a0c7d193167526312bf051e58c70d2d9de0dfa9a5cdc9d8177f6f144c1b2d32c8ed2d0631d +SHA512 (samba-4.23.0rc3.tar.xz) = 1e8b9bec0e42d387a0b4665d395ec63bcb9b84353c62be0ed253dfe79c1ff44f13a8a1825f2a1eba4c8f209cae55e0b3ed7f89b39884ec73b05383b0008a5249 +SHA512 (samba-4.23.0rc3.tar.asc) = 727d328c0f4bd075d927bcfdb86083c3e6e9f066c938d5232e655c676d78f936453bc0d39bf271d0f8371f33e8ffe30aa376ad6461ca0be8d34ebca01553c3ab From a6119e2bb3d77153a87af9be96ca2140a9da6316 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 2 Sep 2025 10:47:58 +0300 Subject: [PATCH 64/93] Fix FreeIPA trust to AD - resolves: rhbz#2392626 Signed-off-by: Alexander Bokovoy --- samba-bz15902.patch | 167 ++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 168 insertions(+) create mode 100644 samba-bz15902.patch diff --git a/samba-bz15902.patch b/samba-bz15902.patch new file mode 100644 index 0000000..659eecc --- /dev/null +++ b/samba-bz15902.patch @@ -0,0 +1,167 @@ +From 00b900e82ac0d859562ec88825975a2d9fbe1040 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Tue, 2 Sep 2025 10:36:11 +0300 +Subject: [PATCH] krb5: handle GSS-Proxy credentials lifetime +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +GSS-Proxy stores its credential in encrypted form in the Kerberos ccache +with a start and end time of 0 and a server principal in the realm named +'X-GSSPROXY:'. This credential is accessed through GSS-Proxy interposer +mechanism in MIT Kerberos and cannot be analysed with raw krb5 API. + +As MIT Kerberos has no krb5_cc_get_lifetime() implementation, add check +for the GSS-Proxy credential to smb_krb5_cc_get_lifetime() wrapper to +return KRB5_PLUGIN_NO_HANDLE. The two places where +smb_krb5_cc_get_lifetime() is used then handle this return code to avoid +deciding on the 'expired' lifetime to cause a kinit. + +This fixes FreeIPA use case where an IPA API endpoint uses Samba Python +bindings with a GSS-Proxy-controlled credential cache. + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=15902 + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Pavel Filipenský + +Autobuild-User(master): Pavel Filipensky +Autobuild-Date(master): Wed Sep 3 10:15:50 UTC 2025 on atb-devel-224 + +(cherry picked from commit c00b98ad840706cda222bb610d0d4860b98c72d4) +--- + auth/credentials/credentials_krb5.c | 36 +++++++++++++++++++++-------- + lib/krb5_wrap/krb5_samba.c | 35 ++++++++++++++++++++++++++-- + 2 files changed, 59 insertions(+), 12 deletions(-) + +diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c +index 4dc7e7be67e..8d289e26781 100644 +--- a/auth/credentials/credentials_krb5.c ++++ b/auth/credentials/credentials_krb5.c +@@ -687,7 +687,14 @@ _PUBLIC_ int cli_credentials_get_named_ccache(struct cli_credentials *cred, + bool kinit_required = false; + ret = smb_krb5_cc_get_lifetime(cred->ccache->smb_krb5_context->krb5_context, + cred->ccache->ccache, &lifetime); +- if (ret == KRB5_CC_END || ret == ENOENT) { ++ if (ret == KRB5_PLUGIN_NO_HANDLE) { ++ /* ++ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted ++ * GSSProxy credential. We don't know its lifetime but assume it ++ * is a valid one. Acquiring it will show the lifetime. ++ */ ++ kinit_required = false; ++ } else if (ret == KRB5_CC_END || ret == ENOENT) { + kinit_required = true; + } else if (ret == 0) { + if (lifetime == 0) { +@@ -800,18 +807,27 @@ _PUBLIC_ bool cli_credentials_get_ccache_name_obtained( + if (ret == KRB5_CC_END || ret == ENOENT) { + return false; + } +- if (ret != 0) { ++ ++ /* ++ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted ++ * GSSProxy credential. We don't know its lifetime but assume it ++ * is a valid one. Acquiring it will show the lifetime. ++ * */ ++ if (ret != 0 && ret != KRB5_PLUGIN_NO_HANDLE) { + return false; + } +- if (lifetime == 0) { +- return false; +- } else if (lifetime < 300) { +- if (cred->password_obtained >= cred->ccache_obtained) { +- /* +- * we have a password to re-kinit +- * so let the caller try that. +- */ ++ ++ if (ret == 0) { ++ if (lifetime == 0) { + return false; ++ } else if (lifetime < 300) { ++ if (cred->password_obtained >= cred->ccache_obtained) { ++ /* ++ * we have a password to re-kinit ++ * so let the caller try that. ++ */ ++ return false; ++ } + } + } + +diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c +index f9d91a4f0c1..dcf91348d1a 100644 +--- a/lib/krb5_wrap/krb5_samba.c ++++ b/lib/krb5_wrap/krb5_samba.c +@@ -3025,6 +3025,8 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + krb5_creds cred; + krb5_timestamp endtime = 0; + krb5_timestamp now; ++ char *realm = NULL; ++ TALLOC_CTX *mem_ctx = NULL; + + *t = 0; + +@@ -3038,12 +3040,37 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + return kerr; + } + ++ mem_ctx = talloc_stackframe(); ++ if (mem_ctx == NULL) { ++ krb5_cc_end_seq_get(context, id, &cursor); ++ return ENOMEM; ++ } ++ + while ((kerr = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) { + if (krb5_is_config_principal(context, cred.server)) { + krb5_free_cred_contents(context, &cred); + continue; + } + ++ realm = smb_krb5_principal_get_realm(mem_ctx, context, cred.server); ++ if (realm == NULL) { ++ krb5_free_cred_contents(context, &cred); ++ kerr = ENOMEM; ++ break; ++ } ++ ++ /* ++ * 'X-GSSPROXY:' is the realm for an encrypted credential stored ++ * by the GSSProxy. There are no other creds in such ccache and ++ * we cannot see the actual lifetime (it is set to 0), ++ * indicate to the caller they need to handle this themselves. ++ */ ++ if (strcmp(realm, "X-GSSPROXY:") == 0) { ++ krb5_free_cred_contents(context, &cred); ++ kerr = KRB5_PLUGIN_NO_HANDLE; ++ break; ++ } ++ + #ifndef HAVE_FLAGS_IN_KRB5_CREDS + if (cred.ticket_flags & TKT_FLG_INITIAL) { + #else +@@ -3073,13 +3100,17 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + krb5_free_cred_contents(context, &cred); + } + ++ krb5_cc_end_seq_get(context, id, &cursor); ++ talloc_free(mem_ctx); ++ if (kerr == ENOMEM || kerr == KRB5_PLUGIN_NO_HANDLE) { ++ return kerr; ++ } ++ + if (now < endtime) { + *t = (time_t) (endtime - now); + kerr = 0; + } + +- krb5_cc_end_seq_get(context, id, &cursor); +- + return kerr; + } + #endif /* HAVE_KRB5_CC_GET_LIFETIME */ +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index 3e1a5fd..aa68a70 100644 --- a/samba.spec +++ b/samba.spec @@ -222,6 +222,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-bz15902.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 5a96c9042742117afd7b42a742495e578ae06db4 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 3 Sep 2025 15:44:06 +0300 Subject: [PATCH 65/93] Disable PCP 7.0.0 support PCP 7.0.0 API has changed, needs more work in ctdb https://bugzilla.samba.org/show_bug.cgi?id=15904 - resolves: rhbz#2392879 Signed-off-by: Alexander Bokovoy --- samba-pcp-7.0.0.patch | 63 +++++++++++++++++++++++++++++++++++++++++++ samba.spec | 3 +++ 2 files changed, 66 insertions(+) create mode 100644 samba-pcp-7.0.0.patch diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch new file mode 100644 index 0000000..953bc46 --- /dev/null +++ b/samba-pcp-7.0.0.patch @@ -0,0 +1,63 @@ +From edede7256f7bfa25186e22b3c5f1aab9a56ac141 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Wed, 3 Sep 2025 15:42:46 +0300 +Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 + +Signed-off-by: Alexander Bokovoy +--- + ctdb/utils/pmda/pmda_ctdb.c | 4 ++++ + ctdb/wscript | 20 +++++++++----------- + 2 files changed, 13 insertions(+), 11 deletions(-) + +diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c +index 7ac8a3b38d1..a8d6704c8a9 100644 +--- a/ctdb/utils/pmda/pmda_ctdb.c ++++ b/ctdb/utils/pmda/pmda_ctdb.c +@@ -39,9 +39,13 @@ + + #define pmID_cluster(id) id->cluster + #define pmID_item(id) id->item ++#ifndef pmGetProgname + #define pmGetProgname() pmProgname ++#endif ++#ifndef pmSetProgname + #define pmSetProgname(a) __pmSetProgname(a) + #endif ++#endif + + #include "domain.h" + +diff --git a/ctdb/wscript b/ctdb/wscript +index e9cd89436a3..15dedb1c432 100644 +--- a/ctdb/wscript ++++ b/ctdb/wscript +@@ -226,17 +226,15 @@ def configure(conf): + + have_pmda = False + if Options.options.ctdb_pmda: +- pmda_support = True +- +- if not conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', +- together=True): +- pmda_support = False +- if not conf.CHECK_FUNCS_IN('pmProgname', 'pcp'): +- pmda_support = False +- if not conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda'): +- pmda_support = False +- if pmda_support: +- conf.CHECK_TYPE_IN('__pmID_int', 'pcp/pmapi.h pcp/impl.h') ++ checks = [conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', ++ together=True), ++ conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda')] ++ ++ have_progname = [conf.CHECK_FUNCS_IN('pmProgname', 'pcp'), ++ conf.CHECK_FUNCS_IN('pmGetProgname', 'pcp')] ++ ++ if all(checks) and any(have_progname): ++ conf.CHECK_TYPE_IN('__pmID_int', 'libpcp.h pcp/pmapi.h pcp/impl.h') + have_pmda = True + else: + Logs.error("PMDA support not available") +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index aa68a70..8a8a21e 100644 --- a/samba.spec +++ b/samba.spec @@ -94,8 +94,10 @@ # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 +%if 0%{?fedora} < 43 %bcond pcp_pmda 1 %endif +%endif %else %bcond pcp_pmda 0 %endif @@ -223,6 +225,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore Patch0: samba-bz15902.patch +Patch1: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From beb6a110890db1bd1c6d5f1ef7602cc21d84ec6b Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 4 Sep 2025 09:25:26 +0300 Subject: [PATCH 66/93] Restore PCP support - resolves: rhbz#2392879 Signed-off-by: Alexander Bokovoy --- samba-pcp-7.0.0.patch | 17 +++++++++++++---- samba.spec | 2 -- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch index 953bc46..1b2c6a5 100644 --- a/samba-pcp-7.0.0.patch +++ b/samba-pcp-7.0.0.patch @@ -1,16 +1,16 @@ -From edede7256f7bfa25186e22b3c5f1aab9a56ac141 Mon Sep 17 00:00:00 2001 +From 4b74db174b92e00eb4c342c77adcb8140851d025 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 3 Sep 2025 15:42:46 +0300 Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 Signed-off-by: Alexander Bokovoy --- - ctdb/utils/pmda/pmda_ctdb.c | 4 ++++ + ctdb/utils/pmda/pmda_ctdb.c | 6 +++++- ctdb/wscript | 20 +++++++++----------- - 2 files changed, 13 insertions(+), 11 deletions(-) + 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 7ac8a3b38d1..a8d6704c8a9 100644 +index 7ac8a3b38d1..75ae1079dc4 100644 --- a/ctdb/utils/pmda/pmda_ctdb.c +++ b/ctdb/utils/pmda/pmda_ctdb.c @@ -39,9 +39,13 @@ @@ -27,6 +27,15 @@ index 7ac8a3b38d1..a8d6704c8a9 100644 #include "domain.h" +@@ -450,7 +454,7 @@ err_out: + * instance domain evaluation. + */ + static int +-pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmResult **resp, pmdaExt *pmda) ++pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmdaResult **resp, pmdaExt *pmda) + { + int ret; + diff --git a/ctdb/wscript b/ctdb/wscript index e9cd89436a3..15dedb1c432 100644 --- a/ctdb/wscript diff --git a/samba.spec b/samba.spec index 8a8a21e..1d9ef9a 100644 --- a/samba.spec +++ b/samba.spec @@ -94,10 +94,8 @@ # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 -%if 0%{?fedora} < 43 %bcond pcp_pmda 1 %endif -%endif %else %bcond pcp_pmda 0 %endif From e0762b936f9c379833168f93bde983aa8b82131c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 10 Sep 2025 10:28:22 +0200 Subject: [PATCH 67/93] Update to Samba 4.23.0rc4 - resolves: #2393434 Guenther --- samba-bz15902.patch | 167 -------------------------------------------- samba.spec | 5 +- sources | 4 +- 3 files changed, 4 insertions(+), 172 deletions(-) delete mode 100644 samba-bz15902.patch diff --git a/samba-bz15902.patch b/samba-bz15902.patch deleted file mode 100644 index 659eecc..0000000 --- a/samba-bz15902.patch +++ /dev/null @@ -1,167 +0,0 @@ -From 00b900e82ac0d859562ec88825975a2d9fbe1040 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Tue, 2 Sep 2025 10:36:11 +0300 -Subject: [PATCH] krb5: handle GSS-Proxy credentials lifetime -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -GSS-Proxy stores its credential in encrypted form in the Kerberos ccache -with a start and end time of 0 and a server principal in the realm named -'X-GSSPROXY:'. This credential is accessed through GSS-Proxy interposer -mechanism in MIT Kerberos and cannot be analysed with raw krb5 API. - -As MIT Kerberos has no krb5_cc_get_lifetime() implementation, add check -for the GSS-Proxy credential to smb_krb5_cc_get_lifetime() wrapper to -return KRB5_PLUGIN_NO_HANDLE. The two places where -smb_krb5_cc_get_lifetime() is used then handle this return code to avoid -deciding on the 'expired' lifetime to cause a kinit. - -This fixes FreeIPA use case where an IPA API endpoint uses Samba Python -bindings with a GSS-Proxy-controlled credential cache. - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=15902 - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Pavel Filipensky -Autobuild-Date(master): Wed Sep 3 10:15:50 UTC 2025 on atb-devel-224 - -(cherry picked from commit c00b98ad840706cda222bb610d0d4860b98c72d4) ---- - auth/credentials/credentials_krb5.c | 36 +++++++++++++++++++++-------- - lib/krb5_wrap/krb5_samba.c | 35 ++++++++++++++++++++++++++-- - 2 files changed, 59 insertions(+), 12 deletions(-) - -diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c -index 4dc7e7be67e..8d289e26781 100644 ---- a/auth/credentials/credentials_krb5.c -+++ b/auth/credentials/credentials_krb5.c -@@ -687,7 +687,14 @@ _PUBLIC_ int cli_credentials_get_named_ccache(struct cli_credentials *cred, - bool kinit_required = false; - ret = smb_krb5_cc_get_lifetime(cred->ccache->smb_krb5_context->krb5_context, - cred->ccache->ccache, &lifetime); -- if (ret == KRB5_CC_END || ret == ENOENT) { -+ if (ret == KRB5_PLUGIN_NO_HANDLE) { -+ /* -+ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted -+ * GSSProxy credential. We don't know its lifetime but assume it -+ * is a valid one. Acquiring it will show the lifetime. -+ */ -+ kinit_required = false; -+ } else if (ret == KRB5_CC_END || ret == ENOENT) { - kinit_required = true; - } else if (ret == 0) { - if (lifetime == 0) { -@@ -800,18 +807,27 @@ _PUBLIC_ bool cli_credentials_get_ccache_name_obtained( - if (ret == KRB5_CC_END || ret == ENOENT) { - return false; - } -- if (ret != 0) { -+ -+ /* -+ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted -+ * GSSProxy credential. We don't know its lifetime but assume it -+ * is a valid one. Acquiring it will show the lifetime. -+ * */ -+ if (ret != 0 && ret != KRB5_PLUGIN_NO_HANDLE) { - return false; - } -- if (lifetime == 0) { -- return false; -- } else if (lifetime < 300) { -- if (cred->password_obtained >= cred->ccache_obtained) { -- /* -- * we have a password to re-kinit -- * so let the caller try that. -- */ -+ -+ if (ret == 0) { -+ if (lifetime == 0) { - return false; -+ } else if (lifetime < 300) { -+ if (cred->password_obtained >= cred->ccache_obtained) { -+ /* -+ * we have a password to re-kinit -+ * so let the caller try that. -+ */ -+ return false; -+ } - } - } - -diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index f9d91a4f0c1..dcf91348d1a 100644 ---- a/lib/krb5_wrap/krb5_samba.c -+++ b/lib/krb5_wrap/krb5_samba.c -@@ -3025,6 +3025,8 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - krb5_creds cred; - krb5_timestamp endtime = 0; - krb5_timestamp now; -+ char *realm = NULL; -+ TALLOC_CTX *mem_ctx = NULL; - - *t = 0; - -@@ -3038,12 +3040,37 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - return kerr; - } - -+ mem_ctx = talloc_stackframe(); -+ if (mem_ctx == NULL) { -+ krb5_cc_end_seq_get(context, id, &cursor); -+ return ENOMEM; -+ } -+ - while ((kerr = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) { - if (krb5_is_config_principal(context, cred.server)) { - krb5_free_cred_contents(context, &cred); - continue; - } - -+ realm = smb_krb5_principal_get_realm(mem_ctx, context, cred.server); -+ if (realm == NULL) { -+ krb5_free_cred_contents(context, &cred); -+ kerr = ENOMEM; -+ break; -+ } -+ -+ /* -+ * 'X-GSSPROXY:' is the realm for an encrypted credential stored -+ * by the GSSProxy. There are no other creds in such ccache and -+ * we cannot see the actual lifetime (it is set to 0), -+ * indicate to the caller they need to handle this themselves. -+ */ -+ if (strcmp(realm, "X-GSSPROXY:") == 0) { -+ krb5_free_cred_contents(context, &cred); -+ kerr = KRB5_PLUGIN_NO_HANDLE; -+ break; -+ } -+ - #ifndef HAVE_FLAGS_IN_KRB5_CREDS - if (cred.ticket_flags & TKT_FLG_INITIAL) { - #else -@@ -3073,13 +3100,17 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - krb5_free_cred_contents(context, &cred); - } - -+ krb5_cc_end_seq_get(context, id, &cursor); -+ talloc_free(mem_ctx); -+ if (kerr == ENOMEM || kerr == KRB5_PLUGIN_NO_HANDLE) { -+ return kerr; -+ } -+ - if (now < endtime) { - *t = (time_t) (endtime - now); - kerr = 0; - } - -- krb5_cc_end_seq_get(context, id, &cursor); -- - return kerr; - } - #endif /* HAVE_KRB5_CC_GET_LIFETIME */ --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 1d9ef9a..5cebd13 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -222,8 +222,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-bz15902.patch -Patch1: samba-pcp-7.0.0.patch +Patch0: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} diff --git a/sources b/sources index 168a85d..a13eeba 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc3.tar.xz) = 1e8b9bec0e42d387a0b4665d395ec63bcb9b84353c62be0ed253dfe79c1ff44f13a8a1825f2a1eba4c8f209cae55e0b3ed7f89b39884ec73b05383b0008a5249 -SHA512 (samba-4.23.0rc3.tar.asc) = 727d328c0f4bd075d927bcfdb86083c3e6e9f066c938d5232e655c676d78f936453bc0d39bf271d0f8371f33e8ffe30aa376ad6461ca0be8d34ebca01553c3ab +SHA512 (samba-4.23.0rc4.tar.xz) = 0e31cce7b6627d07c0d6caa4be6e7e962c5c32bb426532584f5d429c9354c5e9a3180c6cb6c2cabe0daad130c78fb43cf0b304b515d1e0a92e67e0e581539dba +SHA512 (samba-4.23.0rc4.tar.asc) = 068891e289c62ce8602ea6524c05c0348cc21853597e3e192bf932d3a4b7fb514925950828bc97375492aa30e5937761911f0ade2af202ddaec504f105fec580 From 86832ccc3983caa58af6bcc646f1bccabaa9b7e5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 14:55:35 +0200 Subject: [PATCH 68/93] Update to version 4.23.0 - resolves: rhbz#2394791 --- samba-pcp-7.0.0.patch | 72 ------------------------------------------- samba.spec | 8 +++-- 2 files changed, 6 insertions(+), 74 deletions(-) delete mode 100644 samba-pcp-7.0.0.patch diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch deleted file mode 100644 index 1b2c6a5..0000000 --- a/samba-pcp-7.0.0.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 4b74db174b92e00eb4c342c77adcb8140851d025 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Wed, 3 Sep 2025 15:42:46 +0300 -Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 - -Signed-off-by: Alexander Bokovoy ---- - ctdb/utils/pmda/pmda_ctdb.c | 6 +++++- - ctdb/wscript | 20 +++++++++----------- - 2 files changed, 14 insertions(+), 12 deletions(-) - -diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 7ac8a3b38d1..75ae1079dc4 100644 ---- a/ctdb/utils/pmda/pmda_ctdb.c -+++ b/ctdb/utils/pmda/pmda_ctdb.c -@@ -39,9 +39,13 @@ - - #define pmID_cluster(id) id->cluster - #define pmID_item(id) id->item -+#ifndef pmGetProgname - #define pmGetProgname() pmProgname -+#endif -+#ifndef pmSetProgname - #define pmSetProgname(a) __pmSetProgname(a) - #endif -+#endif - - #include "domain.h" - -@@ -450,7 +454,7 @@ err_out: - * instance domain evaluation. - */ - static int --pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmResult **resp, pmdaExt *pmda) -+pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmdaResult **resp, pmdaExt *pmda) - { - int ret; - -diff --git a/ctdb/wscript b/ctdb/wscript -index e9cd89436a3..15dedb1c432 100644 ---- a/ctdb/wscript -+++ b/ctdb/wscript -@@ -226,17 +226,15 @@ def configure(conf): - - have_pmda = False - if Options.options.ctdb_pmda: -- pmda_support = True -- -- if not conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', -- together=True): -- pmda_support = False -- if not conf.CHECK_FUNCS_IN('pmProgname', 'pcp'): -- pmda_support = False -- if not conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda'): -- pmda_support = False -- if pmda_support: -- conf.CHECK_TYPE_IN('__pmID_int', 'pcp/pmapi.h pcp/impl.h') -+ checks = [conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', -+ together=True), -+ conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda')] -+ -+ have_progname = [conf.CHECK_FUNCS_IN('pmProgname', 'pcp'), -+ conf.CHECK_FUNCS_IN('pmGetProgname', 'pcp')] -+ -+ if all(checks) and any(have_progname): -+ conf.CHECK_TYPE_IN('__pmID_int', 'libpcp.h pcp/pmapi.h pcp/impl.h') - have_pmda = True - else: - Logs.error("PMDA support not available") --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 5cebd13..dca57e4 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -222,7 +222,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -323,6 +322,11 @@ BuildRequires: xz BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) +# TODO FIXME This is not in RHEL yet +%if 0%{?fedora} >= 34 +BuildRequires: pkgconfig(libngtcp2) +BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) +%endif %ifnarch i686 %if 0%{?fedora} >= 37 From 0bc0416ee8ae7375d809c566d6ecfcba9b2beb04 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 15:03:30 +0200 Subject: [PATCH 69/93] Remove `smb3 unix extensions = yes` from smb.conf This is enabled by default now. --- smb.conf.vendor | 2 -- sources | 4 ++-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/smb.conf.vendor b/smb.conf.vendor index cbb2e0f..f237c86 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -18,8 +18,6 @@ load printers = yes cups options = raw - smb3 unix extensions = yes - # Install samba-usershares package for support include = /etc/samba/usershares.conf diff --git a/sources b/sources index a13eeba..e69f8ff 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc4.tar.xz) = 0e31cce7b6627d07c0d6caa4be6e7e962c5c32bb426532584f5d429c9354c5e9a3180c6cb6c2cabe0daad130c78fb43cf0b304b515d1e0a92e67e0e581539dba -SHA512 (samba-4.23.0rc4.tar.asc) = 068891e289c62ce8602ea6524c05c0348cc21853597e3e192bf932d3a4b7fb514925950828bc97375492aa30e5937761911f0ade2af202ddaec504f105fec580 +SHA512 (samba-4.23.0.tar.xz) = 660b35a99544a868b11b24ea3c2ed58de5f68c7fc12d3ea71bc84724285eee4375d13ccf357f0248352fab344d76303660e09598f5f1988f3d0f8e76c535a781 +SHA512 (samba-4.23.0.tar.asc) = 508587816e941cd8dc9f65b7f05c828ce859fb7f74a01a200f685c5188c79c916b4d5b167b71298c53cc8a01d6e17a272ea773980488af532a85308fd1142156 From 54c3bbd3f168e8816d279498b3d18435d9a4081b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 18:04:02 +0200 Subject: [PATCH 70/93] Fix building ctdb with PCP 7.0.0 --- samba-fix-ctdb-pcp-7-support.patch | 36 ++++++++++++++++++++++++++++++ samba.spec | 6 ++++- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 samba-fix-ctdb-pcp-7-support.patch diff --git a/samba-fix-ctdb-pcp-7-support.patch b/samba-fix-ctdb-pcp-7-support.patch new file mode 100644 index 0000000..116a4ff --- /dev/null +++ b/samba-fix-ctdb-pcp-7-support.patch @@ -0,0 +1,36 @@ +From 56be6583e8a32cd4dcdfcd3a1f072cc7642668e4 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 12 Sep 2025 15:37:38 +0200 +Subject: [PATCH] ctdb: Fix redefinitoin of pmdaResult + +../../ctdb/utils/pmda/pmda_ctdb.c:52:9: warning: 'pmdaResult' redefined + 52 | #define pmdaResult pmResult + | ^~~~~~~~~~ +In file included from ../../ctdb/utils/pmda/pmda_ctdb.c:35: +/usr/include/pcp/pmda.h:30:9: note: this is the location of the previous definition + 30 | #define pmdaResult pmResult_v2 + | ^~~~~~~~~~ + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15904 + +Signed-off-by: Andreas Schneider +--- + ctdb/utils/pmda/pmda_ctdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c +index 9845f26defb..5c09aca7b84 100644 +--- a/ctdb/utils/pmda/pmda_ctdb.c ++++ b/ctdb/utils/pmda/pmda_ctdb.c +@@ -48,7 +48,7 @@ + #define pmSetProgname(a) __pmSetProgname(a) + #endif + +-#ifdef HAVE_STRUCT_PMRESULT ++#if !defined(pmdaResult) && defined(HAVE_STRUCT_PMRESULT) + #define pmdaResult pmResult + #endif + +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index dca57e4..a68adfa 100644 --- a/samba.spec +++ b/samba.spec @@ -223,6 +223,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-fix-ctdb-pcp-7-support.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -323,7 +325,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) # TODO FIXME This is not in RHEL yet -%if 0%{?fedora} >= 34 +%if 0%{?fedora} >= 43 BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) %endif @@ -2026,8 +2028,10 @@ fi %{_libdir}/samba/libndr-samba4-private-samba.so %{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so +%if 0%{?rhel} %{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so %{_libdir}/samba/libngtcp2-private-samba.so +%endif %{_libdir}/samba/libnpa-tstream-private-samba.so %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so From b40a7310d3f6cc89d9b97bd587235793ad42a4b9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 15 Sep 2025 10:43:55 +0200 Subject: [PATCH 71/93] Build with systemd-userdb support --- samba.spec | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/samba.spec b/samba.spec index a68adfa..406e975 100644 --- a/samba.spec +++ b/samba.spec @@ -121,6 +121,12 @@ %bcond lmdb 0 %endif +%if 0%{?fedora} >= 43 +%bcond varlink 1 +%else +%bcond varlink 0 +%endif + %global samba_version 4.23.0 # The release field is extended: @@ -330,6 +336,10 @@ BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) %endif +%if %{with varlink} +BuildRequires: pkgconfig(libvarlink) >= 24 +%endif + %ifnarch i686 %if 0%{?fedora} >= 37 BuildRequires: mold @@ -1429,6 +1439,9 @@ export PYTHONARCHDIR=%{python3_sitearch} %endif %if %{with prometheus} --with-prometheus-exporter \ +%endif +%if %{with varlink} + --with-systemd-userdb \ %endif --with-profiling-data \ --with-systemd \ From 07953f426e3bacaaab66308f0cc460811ce9a29d Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 23 Sep 2025 11:40:30 +0300 Subject: [PATCH 72/93] Fix DLZ crash on unconfigured Samba AD system and rebuild against Python 3.14.0rc3 - Resolves: rhbz#2396621 - Resolves: rhbz#2397242 Signed-off-by: Alexander Bokovoy --- samba-dlz-crash-fix.patch | 53 +++++++++++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 54 insertions(+) create mode 100644 samba-dlz-crash-fix.patch diff --git a/samba-dlz-crash-fix.patch b/samba-dlz-crash-fix.patch new file mode 100644 index 0000000..e3e84b2 --- /dev/null +++ b/samba-dlz-crash-fix.patch @@ -0,0 +1,53 @@ +From 821cf798d87162b1f3b5d7388891d15fea0a969a Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Fri, 19 Sep 2025 16:23:41 +0300 +Subject: [PATCH] Fix crash in DLZ plugin for incorrect setup + +When bind is not yet setup properly, logging errors should be done +through the temporary handle. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15920 + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Douglas Bagnall + +Autobuild-User(master): Douglas Bagnall +Autobuild-Date(master): Sat Sep 20 06:49:37 UTC 2025 on atb-devel-224 +--- + source4/dns_server/dlz_bind9.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/source4/dns_server/dlz_bind9.c b/source4/dns_server/dlz_bind9.c +index e5c9679835e..2a2430caba2 100644 +--- a/source4/dns_server/dlz_bind9.c ++++ b/source4/dns_server/dlz_bind9.c +@@ -671,6 +671,9 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, + } + va_end(ap); + ++ /* starting from here, we can only use state->log() until ++ * dlz_bind9_state is assigned */ ++ + /* Do not install samba signal handlers */ + fault_setup_disable(); + +@@ -727,11 +730,11 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, + } + + if (!file_exist(state->options.url)) { +- dlz_bind9_state->log(ISC_LOG_ERROR, +- "samba_dlz: dlz_create could not find '%s'; " +- "trying old location '%s/dns/sam.ldb' instead", +- state->options.url, +- lpcfg_private_dir(state->lp)); ++ state->log(ISC_LOG_ERROR, ++ "samba_dlz: dlz_create could not find '%s'; " ++ "trying old location '%s/dns/sam.ldb' instead", ++ state->options.url, ++ lpcfg_private_dir(state->lp)); + state->options.url = talloc_asprintf(state, + "%s/dns/sam.ldb", + lpcfg_private_dir(state->lp)); +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index 406e975..4846712 100644 --- a/samba.spec +++ b/samba.spec @@ -230,6 +230,7 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-fix-ctdb-pcp-7-support.patch +Patch1: samba-dlz-crash-fix.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 4e3699d8b510bcd13d65116dca74012906d32a31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 29 Sep 2025 14:14:11 +0200 Subject: [PATCH 73/93] Update to Samba 4.23.1 - resolves: #2399755 Guenther --- samba-dlz-crash-fix.patch | 53 ------------------------------ samba-fix-ctdb-pcp-7-support.patch | 36 -------------------- samba.spec | 5 +-- sources | 4 +-- 4 files changed, 3 insertions(+), 95 deletions(-) delete mode 100644 samba-dlz-crash-fix.patch delete mode 100644 samba-fix-ctdb-pcp-7-support.patch diff --git a/samba-dlz-crash-fix.patch b/samba-dlz-crash-fix.patch deleted file mode 100644 index e3e84b2..0000000 --- a/samba-dlz-crash-fix.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 821cf798d87162b1f3b5d7388891d15fea0a969a Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Fri, 19 Sep 2025 16:23:41 +0300 -Subject: [PATCH] Fix crash in DLZ plugin for incorrect setup - -When bind is not yet setup properly, logging errors should be done -through the temporary handle. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15920 - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Douglas Bagnall - -Autobuild-User(master): Douglas Bagnall -Autobuild-Date(master): Sat Sep 20 06:49:37 UTC 2025 on atb-devel-224 ---- - source4/dns_server/dlz_bind9.c | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -diff --git a/source4/dns_server/dlz_bind9.c b/source4/dns_server/dlz_bind9.c -index e5c9679835e..2a2430caba2 100644 ---- a/source4/dns_server/dlz_bind9.c -+++ b/source4/dns_server/dlz_bind9.c -@@ -671,6 +671,9 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, - } - va_end(ap); - -+ /* starting from here, we can only use state->log() until -+ * dlz_bind9_state is assigned */ -+ - /* Do not install samba signal handlers */ - fault_setup_disable(); - -@@ -727,11 +730,11 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, - } - - if (!file_exist(state->options.url)) { -- dlz_bind9_state->log(ISC_LOG_ERROR, -- "samba_dlz: dlz_create could not find '%s'; " -- "trying old location '%s/dns/sam.ldb' instead", -- state->options.url, -- lpcfg_private_dir(state->lp)); -+ state->log(ISC_LOG_ERROR, -+ "samba_dlz: dlz_create could not find '%s'; " -+ "trying old location '%s/dns/sam.ldb' instead", -+ state->options.url, -+ lpcfg_private_dir(state->lp)); - state->options.url = talloc_asprintf(state, - "%s/dns/sam.ldb", - lpcfg_private_dir(state->lp)); --- -2.51.0 - diff --git a/samba-fix-ctdb-pcp-7-support.patch b/samba-fix-ctdb-pcp-7-support.patch deleted file mode 100644 index 116a4ff..0000000 --- a/samba-fix-ctdb-pcp-7-support.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 56be6583e8a32cd4dcdfcd3a1f072cc7642668e4 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 12 Sep 2025 15:37:38 +0200 -Subject: [PATCH] ctdb: Fix redefinitoin of pmdaResult - -../../ctdb/utils/pmda/pmda_ctdb.c:52:9: warning: 'pmdaResult' redefined - 52 | #define pmdaResult pmResult - | ^~~~~~~~~~ -In file included from ../../ctdb/utils/pmda/pmda_ctdb.c:35: -/usr/include/pcp/pmda.h:30:9: note: this is the location of the previous definition - 30 | #define pmdaResult pmResult_v2 - | ^~~~~~~~~~ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15904 - -Signed-off-by: Andreas Schneider ---- - ctdb/utils/pmda/pmda_ctdb.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 9845f26defb..5c09aca7b84 100644 ---- a/ctdb/utils/pmda/pmda_ctdb.c -+++ b/ctdb/utils/pmda/pmda_ctdb.c -@@ -48,7 +48,7 @@ - #define pmSetProgname(a) __pmSetProgname(a) - #endif - --#ifdef HAVE_STRUCT_PMRESULT -+#if !defined(pmdaResult) && defined(HAVE_STRUCT_PMRESULT) - #define pmdaResult pmResult - #endif - --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 4846712..493c0bf 100644 --- a/samba.spec +++ b/samba.spec @@ -127,7 +127,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.0 +%global samba_version 4.23.1 # The release field is extended: # [.][.]%%{?dist}[.] @@ -229,9 +229,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-fix-ctdb-pcp-7-support.patch -Patch1: samba-dlz-crash-fix.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} diff --git a/sources b/sources index e69f8ff..1bea503 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0.tar.xz) = 660b35a99544a868b11b24ea3c2ed58de5f68c7fc12d3ea71bc84724285eee4375d13ccf357f0248352fab344d76303660e09598f5f1988f3d0f8e76c535a781 -SHA512 (samba-4.23.0.tar.asc) = 508587816e941cd8dc9f65b7f05c828ce859fb7f74a01a200f685c5188c79c916b4d5b167b71298c53cc8a01d6e17a272ea773980488af532a85308fd1142156 +SHA512 (samba-4.23.1.tar.xz) = d6e2863dc729b2c4feb337634ad80d9f8cb244455dbdb035f6d164ed722c07e507d2018d68221beada429d6e2c00aa36bfbfcc788e96e34225bb963beb2e017e +SHA512 (samba-4.23.1.tar.asc) = cea22d67e374b4350bd78e941ec60655b4176b7c24dc3514f476608f91c5806f1dc11aed66a237dec82ed31979eeeacac91f2191c3b9fe415920f762a0085118 From c05bf06122c9f8f630c5435c3ebe7d04046472c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 15 Oct 2025 23:27:11 +0200 Subject: [PATCH 74/93] Update to Samba 4.23.2 - resolves: rhbz#2404204 - resolves: rhbz#2391698 - Security fix for CVE-2025-9640 - resolves: rhbz#2394377 - Security fix for CVE-2025-10230 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 493c0bf..d6e2912 100644 --- a/samba.spec +++ b/samba.spec @@ -127,7 +127,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.1 +%global samba_version 4.23.2 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 1bea503..4af6c05 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.1.tar.xz) = d6e2863dc729b2c4feb337634ad80d9f8cb244455dbdb035f6d164ed722c07e507d2018d68221beada429d6e2c00aa36bfbfcc788e96e34225bb963beb2e017e -SHA512 (samba-4.23.1.tar.asc) = cea22d67e374b4350bd78e941ec60655b4176b7c24dc3514f476608f91c5806f1dc11aed66a237dec82ed31979eeeacac91f2191c3b9fe415920f762a0085118 +SHA512 (samba-4.23.2.tar.xz) = ffc9415d76244a199ef23cb39da7b97ec07b7fd061f84ba6185ac3a45e6b6942d0196945ac6d7e72f137787eafb2811220227c2c72a006fdfc903f90caa4673f +SHA512 (samba-4.23.2.tar.asc) = 775a8e321ea63193b027e6c2f351f9532b93cb6662571dc30bf2150624649afc425d3c9a0bfdea92ac093d25a1aee71d7ff6e4a47d44b2286074cf7ac6cdea98 From 75445746a3ef5353df6d53fb0860641b69eb1e62 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 15 Oct 2025 23:32:40 +0200 Subject: [PATCH 75/93] Update to Samba 4.22.5 - resolves: rhbz#2391698 - Security fix for CVE-2025-9640 - resolves: rhbz#2394377 - Security fix for CVE-2025-10230 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 6325c66..551f28a 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.4 +%global samba_version 4.22.5 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 599a26d..dde7a32 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.4.tar.xz) = d04db845227ace43642ba69da4ded80d576db01d2e6a7e3e3161c05ce20ff77bd944d39aaf35adab59bed607e0037713969cb9a855a367ab65d021c5aef7ea46 -SHA512 (samba-4.22.4.tar.asc) = ee1b66c6094f6c44954470432676034afc557db84f28a6ef37ea770d987cd5dddf6f6e8c179f3344cf04abc1c6696bbaa5ae031119edc58ea533b464d77641d9 +SHA512 (samba-4.22.5.tar.xz) = 096043ffb2a3a462718e449f9c892101a65e8061529b03753cc029a950c63e37e5b0e11c7c974e3c2baa2ac6b58138b4d975bea6db0ea79df15d40a56b3ffc87 +SHA512 (samba-4.22.5.tar.asc) = 7a3f233eb03460aafe5a146e55213b6300a9b4ef1b71754a44a83a530eba0e06d0db19b73ade2c218261e8899742a095517d2ce2af9c8b41e11596604c94157d From 209170dee79562713a9d1cbd5b751a292cef78d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 17 Oct 2025 13:37:52 +0200 Subject: [PATCH 76/93] Update to Samba 4.22.6 Guenther --- samba.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 551f28a..f58e45e 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.5 +%global samba_version 4.22.6 # The release field is extended: # [.][.]%%{?dist}[.] @@ -3319,6 +3319,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/dfs.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc @@ -3339,6 +3340,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py %{python3_sitearch}/samba/tests/dcerpc/binding.py +%{python3_sitearch}/samba/tests/dcerpc/dfs.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/lsa.py diff --git a/sources b/sources index dde7a32..9d2b26d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.5.tar.xz) = 096043ffb2a3a462718e449f9c892101a65e8061529b03753cc029a950c63e37e5b0e11c7c974e3c2baa2ac6b58138b4d975bea6db0ea79df15d40a56b3ffc87 -SHA512 (samba-4.22.5.tar.asc) = 7a3f233eb03460aafe5a146e55213b6300a9b4ef1b71754a44a83a530eba0e06d0db19b73ade2c218261e8899742a095517d2ce2af9c8b41e11596604c94157d +SHA512 (samba-4.22.6.tar.xz) = b68bdabccbd1f8f132f6271577efba4eedb0573cbf6e3a83c45d0009b63f9278736bcbbe212682e7068830e2c1c617e2d7840a50d30f32e31134bc33c18e390a +SHA512 (samba-4.22.6.tar.asc) = 633402f4f3698785ab938713149fc9bc7a620336cc608c70cd2d05d27176ad47aaee31e98e5cc7be2200a5cefbd04810dd3cd3ed7e1388a4a88857ff5821da4b From efaa5fdc6d2a13fc842f453c360f76a8f8ed587e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 20:08:17 +0100 Subject: [PATCH 77/93] Fix --with testsuite [skip changelog] --- samba.spec | 48 +++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 41 insertions(+), 7 deletions(-) diff --git a/samba.spec b/samba.spec index d6e2912..08d2cb9 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,17 @@ # or # rpmbuild --rebuild --with testsuite samba.src.rpm # +# If you just want to run a single test, you can use: +# fedpkg mockbuild --with testsuite -- --define 'SAMBA_TESTS regex' samba.src.rpm +# or +# rpmbuild --rebuild --with testsuite --define='SAMBA_TESTS regex' samba.src.rpm +# %bcond testsuite 0 +%if %{with testsuite} +# As the file list is empty for running just the tests, we have empty debuginfo +# package. Disable it to avoid error reporting. +%global debug_package %{nil} +%endif # Build with internal talloc, tevent, tdb # @@ -1328,6 +1338,13 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - # Make sure we do not build with heimdal code rm -rfv third_party/heimdal +%if %{with testsuite} +# WARNING: Don't change that for production! +# +# Shorten the priviliged dir, as unix sockets only have 108 chars +sed -i 's/#define WINBINDD_PRIV_SOCKET_SUBDIR.*/#define WINBINDD_PRIV_SOCKET_SUBDIR "wb_priv"/' nsswitch/winbind_struct_protocol.h +%endif + %build %if %{with includelibs} %global _talloc_lib ,talloc,pytalloc,pytalloc-util @@ -1619,20 +1636,37 @@ touch %{buildroot}%{_libexecdir}/ctdb/statd_callout # in the timestamp so the year 2038 problem is deferred till 2446. # https://bugzilla.samba.org/show_bug.cgi?id=14546 # -for t in samba3.smb2.timestamps.time_t_15032385535 \ - samba3.smb2.timestamps.time_t_10000000000 \ - samba3.smb2.timestamps.time_t_4294967295 \ - ; do - echo "^$t" >> selftest/knownfail.d/fedora.%{dist} -done -cat selftest/knownfail.d/fedora.%{dist} +if [ "$(df --portability --print-type "$(pwd)" | grep -c ext4)" == "1" ]; then + cat > selftest/knownfail.d/fedora%{dist} << EOF +^samba3.smb2.timestamps.time_t_15032385535 +^samba3.smb2.timestamps.time_t_10000000000 +^samba3.smb2.timestamps.time_t_4294967295 +EOF +fi + +echo +echo "Content of selftest/knownfail.d/fedora%{dist}:" +cat selftest/knownfail.d/fedora%{dist} || true + +cat >> selftest/skip << EOF +# FIXME: Investigate why it fails. Might be CUPS is not running? +^samba3.rpc.spoolss.printserver +EOF + +echo +echo "Content of selftest/skip:" +cat selftest/skip export TDB_NO_FSYNC=1 export NMBD_DONT_LOG_STDOUT=1 export SMBD_DONT_LOG_STDOUT=1 export WINBINDD_DONT_LOG_STDOUT=1 export SAMBA_DCERPCD_DONT_LOG_STDOUT=1 +%if "x%{?SAMBA_TESTS}" != "x" +%{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 TESTS="%{SAMBA_TESTS}" +%else %{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 +%endif #endif with testsuite %endif From 80c8f322115895534520fe5a4c6159ff629fe13a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 7 Nov 2025 16:41:40 +0100 Subject: [PATCH 78/93] Update to Samba 4.23.3 - resolves: #2413362 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 08d2cb9..25b8dbc 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.2 +%global samba_version 4.23.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 4af6c05..d966a50 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.2.tar.xz) = ffc9415d76244a199ef23cb39da7b97ec07b7fd061f84ba6185ac3a45e6b6942d0196945ac6d7e72f137787eafb2811220227c2c72a006fdfc903f90caa4673f -SHA512 (samba-4.23.2.tar.asc) = 775a8e321ea63193b027e6c2f351f9532b93cb6662571dc30bf2150624649afc425d3c9a0bfdea92ac093d25a1aee71d7ff6e4a47d44b2286074cf7ac6cdea98 +SHA512 (samba-4.23.3.tar.xz) = 5cb15c8eeda14dc4317b239864a4b7aa50b9c16a49ac9aefdc06ba6bde9b869fee2955eb21ed4620b73bb68682d368821869594fd106f3387e9ced9978483e7e +SHA512 (samba-4.23.3.tar.asc) = 27804ead26f8363d2a84b8ad37495a60b28c80b002e3c7420d434792c893355bd2652a8222825dbc877acbba65db18c4a648eaec218d69f275428b6f6d8a990e From 4af627337110534bd4de9e18adc758c2e7c1b093 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Nov 2025 13:20:07 +0100 Subject: [PATCH 79/93] Update gitignore [skip changelog] --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index a695288..47652a9 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,4 @@ /samba-*.tar.xz /samba-*.tar.asc +/*.rpm +/results_samba From fb14cf225b29844693fd6240ba590d7c77622d00 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Nov 2025 19:10:30 +0100 Subject: [PATCH 80/93] Add hint that we bundle ngtcp2 if not provided by the system --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 25b8dbc..789eb43 100644 --- a/samba.spec +++ b/samba.spec @@ -342,6 +342,8 @@ BuildRequires: pkgconfig(libsystemd) %if 0%{?fedora} >= 43 BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) +%else +Provides: bundled(ngtcp2) %endif %if %{with varlink} From 8c46386794df75e98db1520c6f03cc26e14e8c1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 12 Dec 2025 17:04:18 +0100 Subject: [PATCH 81/93] Update to Samba 4.23.4 - resolves: #2421764 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 789eb43..9b87190 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.3 +%global samba_version 4.23.4 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index d966a50..01648ec 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.3.tar.xz) = 5cb15c8eeda14dc4317b239864a4b7aa50b9c16a49ac9aefdc06ba6bde9b869fee2955eb21ed4620b73bb68682d368821869594fd106f3387e9ced9978483e7e -SHA512 (samba-4.23.3.tar.asc) = 27804ead26f8363d2a84b8ad37495a60b28c80b002e3c7420d434792c893355bd2652a8222825dbc877acbba65db18c4a648eaec218d69f275428b6f6d8a990e +SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac +SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce From 620bccef183fcca63058a49e71698392457299a5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 19 Dec 2025 13:23:20 +0100 Subject: [PATCH 82/93] Update to Samba 4.22.7 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index f58e45e..1a61e99 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.6 +%global samba_version 4.22.7 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 9d2b26d..774e88c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.6.tar.xz) = b68bdabccbd1f8f132f6271577efba4eedb0573cbf6e3a83c45d0009b63f9278736bcbbe212682e7068830e2c1c617e2d7840a50d30f32e31134bc33c18e390a -SHA512 (samba-4.22.6.tar.asc) = 633402f4f3698785ab938713149fc9bc7a620336cc608c70cd2d05d27176ad47aaee31e98e5cc7be2200a5cefbd04810dd3cd3ed7e1388a4a88857ff5821da4b +SHA512 (samba-4.22.7.tar.xz) = b06ef2893d302e0bdb6b137f70e46ba35e2b7daf1ab7f97880fee430170ecad4c4faa188e6193ff39a4475143770bc37d9145935994fceb903f826442a92b6b5 +SHA512 (samba-4.22.7.tar.asc) = 6fb05d0cc13ff0e82d9eda3ac94a34e7ac124fd9348e9462bf1662f37c58cd093aa91d3aed8e0ecbf76436a39f011b3b21162c03e6cb3a76fc7d79d244588fca From a170fadc8dd6bcea5ed3839b6086643e43d06f71 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 12 Jan 2026 10:05:53 +0100 Subject: [PATCH 83/93] Do not redeclare cmocka functions This might cause issues when compiling with newer cmocka versions. --- samba-4.23-fix-cmocka.patch | 38 +++++++++++++++++++++++++++++++++++++ samba.spec | 2 ++ 2 files changed, 40 insertions(+) create mode 100644 samba-4.23-fix-cmocka.patch diff --git a/samba-4.23-fix-cmocka.patch b/samba-4.23-fix-cmocka.patch new file mode 100644 index 0000000..26289d6 --- /dev/null +++ b/samba-4.23-fix-cmocka.patch @@ -0,0 +1,38 @@ +From b1ec803f420b2c6d3c5c83d70c6875a7f36b15fc Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 21 Nov 2025 15:33:32 +0100 +Subject: [PATCH] s4:dsdb: Do not declare cm_print_error() + +This is part of the cmocka.h header file. + +Signed-off-by: Andreas Schneider +Reviewed-by: Martin Schwenke +Reviewed-by: Volker Lendecke + +Autobuild-User(master): Volker Lendecke +Autobuild-Date(master): Mon Nov 24 11:28:08 UTC 2025 on atb-devel-224 + +(cherry picked from commit 5a981663e4f677042ba80191770100aecff2120a) +--- + source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c +index f7075f3485e..12c464b49c7 100644 +--- a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c ++++ b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c +@@ -103,11 +103,6 @@ void audit_message_send( + + #define check_group_change_message(m, u, a, e) \ + _check_group_change_message(m, u, a, e, __FILE__, __LINE__); +-/* +- * declare the internal cmocka cm_print_error so that we can output messages +- * in sub unit format +- */ +-void cm_print_error(const char * const format, ...); + + /* + * Validate a group change JSON audit message +-- +2.52.0 + diff --git a/samba.spec b/samba.spec index 9b87190..2e3fe75 100644 --- a/samba.spec +++ b/samba.spec @@ -239,6 +239,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.23-fix-cmocka.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From 4a23ce5b7a021fac72e887bf4f71f843b150c987 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 08:01:17 +0100 Subject: [PATCH 84/93] Remove unneeded dependency to samba-common-libs --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index 2e3fe75..647fc92 100644 --- a/samba.spec +++ b/samba.spec @@ -1264,7 +1264,6 @@ License: LGPL-3.0-or-later Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} -Requires: samba-common-libs = %{samba_depver} # /endif without includelibs %endif From b8395d93a751e2417fd1dd28e5cc09501ac2bb24 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 10:53:10 +0100 Subject: [PATCH 85/93] Create a core-libs sub-package to split up library dependencies --- samba.spec | 135 +++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 100 insertions(+), 35 deletions(-) diff --git a/samba.spec b/samba.spec index 647fc92..c72ba68 100644 --- a/samba.spec +++ b/samba.spec @@ -488,12 +488,26 @@ The %{name}-client package provides some SMB/CIFS clients to complement the built-in SMB/CIFS filesystem in Linux. These clients allow access of SMB/CIFS shares and printing to SMB/CIFS printers. +### CORE-LIBS +%package core-libs +Summary: Samba core libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} + +Provides: bundled(libreplace) = %{samba_depver} + +%description core-libs +The samba-core-libs package contains foundational libraries needed by +both Samba servers and clients. This includes error handling, utilities, +and NDR serialization support. + ### CLIENT-LIBS %package client-libs Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -528,7 +542,7 @@ packages of Samba. Summary: Libraries used by both Samba servers and clients Requires(pre): samba-common = %{samba_depver} Requires: samba-common = %{samba_depver} -Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -890,7 +904,7 @@ suite. %if %{with libwbclient} %package -n libwbclient Summary: The winbind client library -Requires: %{name}-client-libs = %{samba_depver} +# libwbclient.so only links to libc - no samba library dependencies needed Conflicts: sssd-libwbclient %description -n libwbclient @@ -2009,6 +2023,45 @@ fi #endif with includelibs %endif +### CORE-LIBS +%files core-libs +%dir %{_libdir}/samba + +# +# Tier 0: Private libraries - libc only dependencies +# +%{_libdir}/samba/libreplace-private-samba.so +%{_libdir}/samba/libsocket-blocking-private-samba.so +%{_libdir}/samba/libsys-rw-private-samba.so +%{_libdir}/samba/libtime-basic-private-samba.so + +# +# Tier 1: Private libraries - system libs (libtalloc, libsystemd) +# +%{_libdir}/samba/libsamba-debug-private-samba.so +%{_libdir}/samba/libserver-role-private-samba.so + +# +# Tier 1: Public libraries - system libs (libtalloc) +# +%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* + +# +# Tier 2: Private libraries - adds gnutls +# +%{_libdir}/samba/libgenrand-private-samba.so + +# +# Tier 2: Public libraries - adds gnutls, icu, tevent +# +%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* +%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* + +# +# Tier 3: Public libraries - NDR serialization (depends on Tier 1-2) +# +%{_libdir}/libndr.so.%{libndr_so_version}* + ### CLIENT-LIBS %files client-libs %{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}* @@ -2017,18 +2070,12 @@ fi %{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* %{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* %{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* -%{_libdir}/libndr.so.%{libndr_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* -%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* %{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}* -%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* %{_libdir}/libsamdb.so.%{libsamdb_so_version}* %{_libdir}/libsmbconf.so.%{libsmbconf_so_version}* %{_libdir}/libsmbldap.so.%{libsmbldap_so_version}* -%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* - -%dir %{_libdir}/samba %{_libdir}/samba/libCHARSET3-private-samba.so %{_libdir}/samba/libMESSAGING-SEND-private-samba.so %{_libdir}/samba/libMESSAGING-private-samba.so @@ -2049,19 +2096,14 @@ fi %{_libdir}/samba/libcmdline-contexts-private-samba.so %{_libdir}/samba/libcommon-auth-private-samba.so %{_libdir}/samba/libctdb-event-client-private-samba.so -%{_libdir}/samba/libdbwrap-private-samba.so %{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so %{_libdir}/samba/libdcerpc-samba-private-samba.so %{_libdir}/samba/libevents-private-samba.so -%{_libdir}/samba/libflag-mapping-private-samba.so -%{_libdir}/samba/libgenrand-private-samba.so %{_libdir}/samba/libgensec-private-samba.so %{_libdir}/samba/libgpext-private-samba.so %{_libdir}/samba/libgpo-private-samba.so %{_libdir}/samba/libgse-private-samba.so %{_libdir}/samba/libhttp-private-samba.so -%{_libdir}/samba/libinterfaces-private-samba.so -%{_libdir}/samba/libiov-buf-private-samba.so %{_libdir}/samba/libkrb5samba-private-samba.so %{_libdir}/samba/libldbsamba-private-samba.so %{_libdir}/samba/liblibcli-lsa3-private-samba.so @@ -2087,32 +2129,32 @@ fi %{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so -%{_libdir}/samba/libsamba-debug-private-samba.so %{_libdir}/samba/libsamba-modules-private-samba.so -%{_libdir}/samba/libsamba-security-private-samba.so %{_libdir}/samba/libsamba-security-trusts-private-samba.so %{_libdir}/samba/libsamba-sockets-private-samba.so -%{_libdir}/samba/libsamba3-util-private-samba.so %{_libdir}/samba/libsamdb-common-private-samba.so %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so -%{_libdir}/samba/libserver-role-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so %{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so %{_libdir}/samba/libsmbldaphelper-private-samba.so -%{_libdir}/samba/libstable-sort-private-samba.so -%{_libdir}/samba/libsys-rw-private-samba.so -%{_libdir}/samba/libsocket-blocking-private-samba.so -%{_libdir}/samba/libtalloc-report-printf-private-samba.so -%{_libdir}/samba/libtalloc-report-private-samba.so -%{_libdir}/samba/libtdb-wrap-private-samba.so -%{_libdir}/samba/libtime-basic-private-samba.so %{_libdir}/samba/libtorture-private-samba.so %{_libdir}/samba/libutil-crypt-private-samba.so -%{_libdir}/samba/libutil-reg-private-samba.so -%{_libdir}/samba/libutil-setid-private-samba.so -%{_libdir}/samba/libutil-tdb-private-samba.so + +# +# Command line library +# +%{_libdir}/samba/libcmdline-private-samba.so + +# +# Password database modules (depend on libsamba-passdb) +# +%dir %{_libdir}/samba/ldb +%dir %{_libdir}/samba/pdb +%{_libdir}/samba/pdb/ldapsam.so +%{_libdir}/samba/pdb/smbpasswd.so +%{_libdir}/samba/pdb/tdbsam.so %if %{without libwbclient} %{_libdir}/samba/libwbclient.so.* @@ -2165,16 +2207,39 @@ fi ### COMMON-LIBS %files common-libs -# common libraries -%{_libdir}/samba/libcmdline-private-samba.so -%{_libdir}/samba/libreplace-private-samba.so -%dir %{_libdir}/samba/ldb +# +# Tier 0: libc only dependencies +# +%{_libdir}/samba/libutil-setid-private-samba.so +%{_libdir}/samba/libutil-tdb-private-samba.so -%dir %{_libdir}/samba/pdb -%{_libdir}/samba/pdb/ldapsam.so -%{_libdir}/samba/pdb/smbpasswd.so -%{_libdir}/samba/pdb/tdbsam.so +# +# Tier 1: system libs only (libtalloc) +# +%{_libdir}/samba/libiov-buf-private-samba.so +%{_libdir}/samba/libstable-sort-private-samba.so +%{_libdir}/samba/libtalloc-report-private-samba.so +%{_libdir}/samba/libtalloc-report-printf-private-samba.so + +# +# Tier 2: depends on core-libs (debug, replace) +# +%{_libdir}/samba/libflag-mapping-private-samba.so +%{_libdir}/samba/libinterfaces-private-samba.so +%{_libdir}/samba/libtdb-wrap-private-samba.so + +# +# Tier 3: depends on core-libs (util, errors, ndr) +# +%{_libdir}/samba/libdbwrap-private-samba.so +%{_libdir}/samba/libsamba3-util-private-samba.so +%{_libdir}/samba/libutil-reg-private-samba.so + +# +# Tier 4: depends on core-libs + Tier 3 libs +# +%{_libdir}/samba/libsamba-security-private-samba.so ### COMMON-TOOLS %files common-tools From fcd8668e55e701de2421c6b27425a4c942673bd7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 11:24:56 +0100 Subject: [PATCH 86/93] Add gating test to detect dependency changes in samba libraries [skip changelog] --- gating.yaml | 6 ++ tests/deps-check.fmf | 13 +++++ tests/deps-check.sh | 133 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 152 insertions(+) create mode 100644 gating.yaml create mode 100644 tests/deps-check.fmf create mode 100755 tests/deps-check.sh diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..c2182c7 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,6 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf new file mode 100644 index 0000000..878b8b2 --- /dev/null +++ b/tests/deps-check.fmf @@ -0,0 +1,13 @@ +summary: Check samba package dependency structure +description: | + Verify that samba library packages maintain correct dependency hierarchy: + - samba-core-libs has no samba-*-libs dependencies + - samba-common-libs depends on samba-core-libs (not samba-client-libs) + - libwbclient has no samba-*-libs dependencies +test: ./deps-check.sh +framework: shell +require: + - samba-core-libs + - samba-common-libs + - samba-client-libs + - libwbclient diff --git a/tests/deps-check.sh b/tests/deps-check.sh new file mode 100755 index 0000000..622e88a --- /dev/null +++ b/tests/deps-check.sh @@ -0,0 +1,133 @@ +#!/bin/bash +# +# Samba package dependency structure verification +# +# This test ensures that the samba library package dependencies don't regress. +# The expected hierarchy is: +# +# samba-core-libs (no samba-*-libs dependencies) +# ^ +# | +# samba-common-libs (depends on samba-core-libs only) +# ^ +# | +# samba-client-libs (depends on samba-core-libs + samba-common-libs) +# +# libwbclient (no samba-*-libs dependencies - only links to libc) +# +# NOTE: This test checks RESOLVED dependencies, not just explicit Requires. +# A library requirement like 'libfoo.so' is resolved to the package that +# provides it, ensuring we catch indirect dependencies. +# + +set -e + +ERRORS=0 + +# Get all packages that a package depends on (resolved) +# This resolves library deps like 'libfoo.so' to actual package names +get_resolved_deps() { + local pkg="$1" + + rpm -qR "$pkg" 2>/dev/null | while read -r req; do + # Skip rpmlib and config requirements + [[ "$req" =~ ^rpmlib ]] && continue + [[ "$req" =~ ^config ]] && continue + [[ "$req" =~ ^/ ]] && continue + + # Get the package that provides this requirement + provider=$(rpm -q --whatprovides "$req" 2>/dev/null | head -1) + if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then + # Extract just the package name (remove version-release.arch) + echo "${provider%%-[0-9]*}" + fi + done | sort -u +} + +# Check that a package does NOT depend on packages matching a pattern +# This checks RESOLVED dependencies (what packages actually get pulled in) +check_no_resolved_dep() { + local pkg="$1" + local pattern="$2" + local description="$3" + + if ! rpm -q "$pkg" &>/dev/null; then + echo "SKIP: $pkg not installed" + return 0 + fi + + local bad_deps + # Exclude the package itself from the check + bad_deps=$(get_resolved_deps "$pkg" | grep -v "^${pkg}$" | grep -E "$pattern" || true) + + if [ -n "$bad_deps" ]; then + echo "FAIL: $pkg depends on $description" + echo " Found: $bad_deps" + ERRORS=$((ERRORS + 1)) + return 1 + fi + echo "PASS: $pkg does not depend on $description" + return 0 +} + +# Check that a package DOES depend on a specific package +check_has_resolved_dep() { + local pkg="$1" + local expected="$2" + + if ! rpm -q "$pkg" &>/dev/null; then + echo "SKIP: $pkg not installed" + return 0 + fi + + if get_resolved_deps "$pkg" | grep -qF "$expected"; then + echo "PASS: $pkg depends on $expected" + return 0 + fi + echo "FAIL: $pkg does not depend on $expected" + ERRORS=$((ERRORS + 1)) + return 1 +} + +echo "=== Samba Package Dependency Checks ===" +echo "" +echo "Checking resolved dependencies (library deps resolved to packages)" +echo "" + +# 1. samba-core-libs must NOT depend on any samba-*-libs packages +echo "--- samba-core-libs ---" +check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba-*-libs package" + +echo "" + +# 2. samba-common-libs must depend on samba-core-libs +# but NOT samba-client-libs +echo "--- samba-common-libs ---" +check_has_resolved_dep samba-common-libs "samba-core-libs" +check_no_resolved_dep samba-common-libs "^samba-client-libs$" "samba-client-libs" + +echo "" + +# 3. samba-client-libs must depend on samba-core-libs and samba-common-libs +# but NOT samba-libs +echo "--- samba-client-libs ---" +check_has_resolved_dep samba-client-libs "samba-core-libs" +check_has_resolved_dep samba-client-libs "samba-common-libs" +check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs" + +echo "" + +# 4. libwbclient must NOT depend on any samba-*-libs packages +echo "--- libwbclient ---" +check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" + +echo "" +echo "=== Summary ===" + +if [ $ERRORS -gt 0 ]; then + echo "FAILED: $ERRORS dependency check(s) failed" + exit 1 +fi + +echo "All dependency checks passed" +exit 0 From baa9e6f8c0c9594e05f953d54cf2e8fd720404c6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 12:23:39 +0100 Subject: [PATCH 87/93] Move libraries from samba-client-libs to samba-libs --- samba.spec | 30 +++++++++++++++++------------- tests/deps-check.fmf | 7 +++++++ tests/deps-check.sh | 26 ++++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 13 deletions(-) diff --git a/samba.spec b/samba.spec index c72ba68..ccb55fc 100644 --- a/samba.spec +++ b/samba.spec @@ -2078,11 +2078,9 @@ fi %{_libdir}/libsmbldap.so.%{libsmbldap_so_version}* %{_libdir}/samba/libCHARSET3-private-samba.so %{_libdir}/samba/libMESSAGING-SEND-private-samba.so -%{_libdir}/samba/libMESSAGING-private-samba.so %{_libdir}/samba/libaddns-private-samba.so %{_libdir}/samba/libads-private-samba.so %{_libdir}/samba/libasn1util-private-samba.so -%{_libdir}/samba/libauth-private-samba.so %{_libdir}/samba/libauthkrb5-private-samba.so %{_libdir}/samba/libcli-cldap-private-samba.so %{_libdir}/samba/libcli-ldap-common-private-samba.so @@ -2095,13 +2093,10 @@ fi %{_libdir}/samba/libcluster-private-samba.so %{_libdir}/samba/libcmdline-contexts-private-samba.so %{_libdir}/samba/libcommon-auth-private-samba.so -%{_libdir}/samba/libctdb-event-client-private-samba.so %{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so %{_libdir}/samba/libdcerpc-samba-private-samba.so %{_libdir}/samba/libevents-private-samba.so %{_libdir}/samba/libgensec-private-samba.so -%{_libdir}/samba/libgpext-private-samba.so -%{_libdir}/samba/libgpo-private-samba.so %{_libdir}/samba/libgse-private-samba.so %{_libdir}/samba/libhttp-private-samba.so %{_libdir}/samba/libkrb5samba-private-samba.so @@ -2116,16 +2111,12 @@ fi %{_libdir}/samba/libmsrpc3-private-samba.so %{_libdir}/samba/libndr-samba-private-samba.so %{_libdir}/samba/libndr-samba4-private-samba.so -%{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so %if 0%{?rhel} %{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so %{_libdir}/samba/libngtcp2-private-samba.so %endif %{_libdir}/samba/libnpa-tstream-private-samba.so -%{_libdir}/samba/libposix-eadb-private-samba.so -%{_libdir}/samba/libprinter-driver-private-samba.so -%{_libdir}/samba/libprinting-migrate-private-samba.so %{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so @@ -2136,11 +2127,7 @@ fi %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so -%{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so -%{_libdir}/samba/libsmbldaphelper-private-samba.so -%{_libdir}/samba/libtorture-private-samba.so -%{_libdir}/samba/libutil-crypt-private-samba.so # # Command line library @@ -2597,6 +2584,23 @@ fi %{_libdir}/samba/libRPC-SERVER-LOOP-private-samba.so %{_libdir}/samba/libRPC-WORKER-private-samba.so +# +# Server-side libraries (not used by libsmbclient) +# +%{_libdir}/samba/libauth-private-samba.so +%{_libdir}/samba/libctdb-event-client-private-samba.so +%{_libdir}/samba/libgpext-private-samba.so +%{_libdir}/samba/libgpo-private-samba.so +%{_libdir}/samba/libMESSAGING-private-samba.so +%{_libdir}/samba/libnet-keytab-private-samba.so +%{_libdir}/samba/libposix-eadb-private-samba.so +%{_libdir}/samba/libprinter-driver-private-samba.so +%{_libdir}/samba/libprinting-migrate-private-samba.so +%{_libdir}/samba/libsmbd-base-private-samba.so +%{_libdir}/samba/libsmbldaphelper-private-samba.so +%{_libdir}/samba/libtorture-private-samba.so +%{_libdir}/samba/libutil-crypt-private-samba.so + ### LIBNETAPI %files -n libnetapi %{_libdir}/libnetapi.so.%{libnetapi_so_version}* diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf index 878b8b2..959093e 100644 --- a/tests/deps-check.fmf +++ b/tests/deps-check.fmf @@ -3,11 +3,18 @@ description: | Verify that samba library packages maintain correct dependency hierarchy: - samba-core-libs has no samba-*-libs dependencies - samba-common-libs depends on samba-core-libs (not samba-client-libs) + - samba-client-libs depends on core-libs + common-libs (not samba-libs) - libwbclient has no samba-*-libs dependencies + - samba-client depends on samba-client-libs (not samba-libs) + - libsmbclient depends on samba-client-libs (not samba-libs) + - libldb has no samba-*-libs dependencies test: ./deps-check.sh framework: shell require: - samba-core-libs - samba-common-libs - samba-client-libs + - samba-client - libwbclient + - libsmbclient + - libldb diff --git a/tests/deps-check.sh b/tests/deps-check.sh index 622e88a..017c01d 100755 --- a/tests/deps-check.sh +++ b/tests/deps-check.sh @@ -15,6 +15,9 @@ # # libwbclient (no samba-*-libs dependencies - only links to libc) # +# samba-client (depends on samba-client-libs, NOT samba-libs) +# libsmbclient (depends on samba-client-libs, NOT samba-libs) +# # NOTE: This test checks RESOLVED dependencies, not just explicit Requires. # A library requirement like 'libfoo.so' is resolved to the package that # provides it, ensuring we catch indirect dependencies. @@ -121,6 +124,29 @@ echo "" echo "--- libwbclient ---" check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" +echo "" + +# 5. samba-client must depend on samba-client-libs but NOT samba-libs +# (client tools should not pull in server libraries) +echo "--- samba-client ---" +check_has_resolved_dep samba-client "samba-client-libs" +check_no_resolved_dep samba-client "^samba-libs$" "samba-libs" + +echo "" + +# 6. libsmbclient must depend on samba-client-libs but NOT samba-libs +# (SMB client library should not pull in server libraries) +echo "--- libsmbclient ---" +check_has_resolved_dep libsmbclient "samba-client-libs" +check_no_resolved_dep libsmbclient "^samba-libs$" "samba-libs" + +echo "" + +# 7. libldb must NOT depend on any samba-*-libs packages +# (libldb is a standalone database library) +echo "--- libldb ---" +check_no_resolved_dep libldb "^samba-.*-libs$" "any samba-*-libs package" + echo "" echo "=== Summary ===" From dab569ad7194d1c3a2b51e50df08b20fdb00ce60 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 12:46:37 +0100 Subject: [PATCH 88/93] Create a samba-ndr-libs package and drop samba-common-libs This should help sssd to reduce some of its dependencies. --- samba.spec | 216 ++++++++++++++++++++++--------------------- tests/deps-check.fmf | 10 +- tests/deps-check.sh | 40 ++++---- 3 files changed, 141 insertions(+), 125 deletions(-) diff --git a/samba.spec b/samba.spec index ccb55fc..da855ba 100644 --- a/samba.spec +++ b/samba.spec @@ -243,7 +243,7 @@ Patch0: samba-4.23-fix-cmocka.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -465,7 +465,7 @@ Unix. Summary: Samba client programs Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libsmbclient} @@ -496,18 +496,54 @@ Requires: %{name}-common = %{samba_depver} Provides: bundled(libreplace) = %{samba_depver} +%if %{without dc} && %{without testsuite} +Obsoletes: samba-dc < %{samba_depver} +Obsoletes: samba-dc-libs < %{samba_depver} +Obsoletes: samba-dc-bind-dlz < %{samba_depver} +%endif + +# ctdb-tests package has been dropped if we do not build the testsuite +%if %{with clustering} +%if %{without testsuite} +Obsoletes: ctdb-tests < %{samba_depver} +Obsoletes: ctdb-tests-debuginfo < %{samba_depver} +# endif without testsuite +%endif +# endif with clustering +%endif + +# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions +# of the distro +%if %{without vfs_glusterfs} +Obsoletes: samba-vfs-glusterfs < %{samba_depver} +# endif without vfs_glusterfs +%endif + %description core-libs The samba-core-libs package contains foundational libraries needed by both Samba servers and clients. This includes error handling, utilities, -and NDR serialization support. +and basic support libraries. + +### NDR-LIBS +%package ndr-libs +Summary: Samba NDR libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} + +Provides: %{name}-common-libs = %{samba_depver} +Obsoletes: %{name}-common-libs < %{samba_depver} + +%description ndr-libs +The samba-ndr-libs package contains NDR (Network Data Representation) +encoding libraries used by both Samba servers and clients. ### CLIENT-LIBS %package client-libs Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -537,50 +573,10 @@ Obsoletes: samba4-common < %{samba_depver} samba-common provides files necessary for both the server and client packages of Samba. -### COMMON-LIBS -%package common-libs -Summary: Libraries used by both Samba servers and clients -Requires(pre): samba-common = %{samba_depver} -Requires: samba-common = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} -Requires: libldb = %{samba_depver} -%if %{with libwbclient} -Requires: libwbclient = %{samba_depver} -%endif - -Provides: bundled(libreplace) = %{samba_depver} - -%if %{without dc} && %{without testsuite} -Obsoletes: samba-dc < %{samba_depver} -Obsoletes: samba-dc-libs < %{samba_depver} -Obsoletes: samba-dc-bind-dlz < %{samba_depver} -%endif - -# ctdb-tests package has been dropped if we do not build the testsuite -%if %{with clustering} -%if %{without testsuite} -Obsoletes: ctdb-tests < %{samba_depver} -Obsoletes: ctdb-tests-debuginfo < %{samba_depver} -# endif without testsuite -%endif -# endif with clustering -%endif - -# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions -# of the distro -%if %{without vfs_glusterfs} -Obsoletes: samba-vfs-glusterfs < %{samba_depver} -# endif without vfs_glusterfs -%endif - -%description common-libs -The samba-common-libs package contains internal libraries needed by the -SMB/CIFS clients. - ### COMMON-TOOLS %package common-tools Summary: Tools for Samba clients -Requires: samba-common-libs = %{samba_depver} +Requires: samba-ndr-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: samba-ldb-ldap-modules = %{samba_depver} @@ -618,7 +614,7 @@ and for GPO management on domain members. ### RPC %package dcerpc Summary: DCE RPC binaries -Requires: samba-common-libs = %{samba_depver} +Requires: samba-ndr-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -636,7 +632,7 @@ The samba-dcerpc package contains binaries that serve DCERPC over named pipes. Summary: Samba AD Domain Controller Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-tools = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -680,7 +676,7 @@ The samba-dc-provision package provides files to setup a domain controller %package dc-libs Summary: Samba AD Domain Controller Libraries Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -718,8 +714,10 @@ name server related details of Samba AD. ### DEVEL %package devel Summary: Developer tools for Samba libraries -Requires: %{name}-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} +Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: libnetapi = %{samba_depver} @@ -774,7 +772,7 @@ Summary: Samba VFS module for GlusterFS Requires: glusterfs-api >= 3.4.0.16 Requires: glusterfs >= 3.4.0.16 Requires: %{name} = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -825,7 +823,7 @@ the Kerberos credentials cache of the user issuing the print job. %package ldb-ldap-modules Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -836,7 +834,7 @@ samba-gpupdate. ### LIBS %package libs Summary: Samba libraries -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} @@ -857,7 +855,7 @@ against the SMB, RPC and other protocols provided by the Samba suite. Summary: The NETAPI library Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -879,7 +877,7 @@ develop programs that link against the NETAPI library in the Samba suite. Summary: The SMB client library Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} @@ -929,7 +927,7 @@ library. %package -n python3-%{name} Summary: Samba Python3 libraries Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-cryptography @@ -999,7 +997,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-test-libs = %{samba_depver} @@ -1030,7 +1028,7 @@ packages of Samba. ### TEST-LIBS %package test-libs Summary: Libraries need by the testing tools for Samba servers and clients -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -1063,8 +1061,8 @@ as a user using the `net usershare` command. Summary: Samba winbind Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} -Requires(post): %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} +Requires(post): %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires(post): %{name}-client-libs = %{samba_depver} @@ -1097,7 +1095,7 @@ Windows user and group accounts on Linux. %package winbind-clients Summary: Samba winbind clients Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} @@ -1167,7 +1165,7 @@ necessary to communicate to the Winbind Daemon Summary: Samba Winexe Windows Binary License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -1182,7 +1180,7 @@ Winexe is a Remote Windows-command executor %package -n ctdb Summary: A Clustered Database based on Samba's Trivial Database (TDB) -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-winbind-clients = %{samba_depver} @@ -1729,7 +1727,7 @@ fi %ldconfig_scriptlets client-libs -%ldconfig_scriptlets common-libs +%ldconfig_scriptlets ndr-libs %if %{with dc} %ldconfig_scriptlets dc-libs @@ -2057,19 +2055,59 @@ fi %{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* %{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* +### NDR-LIBS +%files ndr-libs + # -# Tier 3: Public libraries - NDR serialization (depends on Tier 1-2) +# Core NDR library # %{_libdir}/libndr.so.%{libndr_so_version}* +# +# Tier 0: libc only dependencies +# +%{_libdir}/samba/libutil-setid-private-samba.so +%{_libdir}/samba/libutil-tdb-private-samba.so + +# +# Tier 1: system libs only (libtalloc) +# +%{_libdir}/samba/libiov-buf-private-samba.so +%{_libdir}/samba/libstable-sort-private-samba.so +%{_libdir}/samba/libtalloc-report-private-samba.so +%{_libdir}/samba/libtalloc-report-printf-private-samba.so + +# +# Tier 2: depends on core-libs (debug, replace) +# +%{_libdir}/samba/libflag-mapping-private-samba.so +%{_libdir}/samba/libinterfaces-private-samba.so +%{_libdir}/samba/libtdb-wrap-private-samba.so + +# +# Tier 3: depends on core-libs (util, errors, ndr) +# +%{_libdir}/samba/libdbwrap-private-samba.so +%{_libdir}/samba/libsamba3-util-private-samba.so +%{_libdir}/samba/libutil-reg-private-samba.so + +# +# Tier 4: depends on core-libs + Tier 3 libs +# +%{_libdir}/samba/libsamba-security-private-samba.so + +# +# NDR encoding libraries +# +%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* +%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* +%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* + ### CLIENT-LIBS %files client-libs %{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}* %{_libdir}/libdcerpc-server-core.so.%{libdcerpc_server_core_so_version}* %{_libdir}/libdcerpc.so.%{libdcerpc_so_version}* -%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* -%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* -%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* %{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}* @@ -2139,7 +2177,6 @@ fi # %dir %{_libdir}/samba/ldb %dir %{_libdir}/samba/pdb -%{_libdir}/samba/pdb/ldapsam.so %{_libdir}/samba/pdb/smbpasswd.so %{_libdir}/samba/pdb/tdbsam.so @@ -2192,42 +2229,6 @@ fi %{_mandir}/man5/smbpasswd.5* %{_mandir}/man7/samba.7* -### COMMON-LIBS -%files common-libs - -# -# Tier 0: libc only dependencies -# -%{_libdir}/samba/libutil-setid-private-samba.so -%{_libdir}/samba/libutil-tdb-private-samba.so - -# -# Tier 1: system libs only (libtalloc) -# -%{_libdir}/samba/libiov-buf-private-samba.so -%{_libdir}/samba/libstable-sort-private-samba.so -%{_libdir}/samba/libtalloc-report-private-samba.so -%{_libdir}/samba/libtalloc-report-printf-private-samba.so - -# -# Tier 2: depends on core-libs (debug, replace) -# -%{_libdir}/samba/libflag-mapping-private-samba.so -%{_libdir}/samba/libinterfaces-private-samba.so -%{_libdir}/samba/libtdb-wrap-private-samba.so - -# -# Tier 3: depends on core-libs (util, errors, ndr) -# -%{_libdir}/samba/libdbwrap-private-samba.so -%{_libdir}/samba/libsamba3-util-private-samba.so -%{_libdir}/samba/libutil-reg-private-samba.so - -# -# Tier 4: depends on core-libs + Tier 3 libs -# -%{_libdir}/samba/libsamba-security-private-samba.so - ### COMMON-TOOLS %files common-tools %{_bindir}/net @@ -2601,6 +2602,11 @@ fi %{_libdir}/samba/libtorture-private-samba.so %{_libdir}/samba/libutil-crypt-private-samba.so +# +# Password database modules (server-side, links to libsmbldaphelper) +# +%{_libdir}/samba/pdb/ldapsam.so + ### LIBNETAPI %files -n libnetapi %{_libdir}/libnetapi.so.%{libnetapi_so_version}* diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf index 959093e..c1452d0 100644 --- a/tests/deps-check.fmf +++ b/tests/deps-check.fmf @@ -2,18 +2,20 @@ summary: Check samba package dependency structure description: | Verify that samba library packages maintain correct dependency hierarchy: - samba-core-libs has no samba-*-libs dependencies - - samba-common-libs depends on samba-core-libs (not samba-client-libs) - - samba-client-libs depends on core-libs + common-libs (not samba-libs) - - libwbclient has no samba-*-libs dependencies + - samba-ndr-libs depends on samba-core-libs (not samba-client-libs or samba-libs) + - samba-client-libs depends on core-libs + ndr-libs (not samba-libs) - samba-client depends on samba-client-libs (not samba-libs) + - samba-libs does not depend on samba-dc-libs - libsmbclient depends on samba-client-libs (not samba-libs) + - libwbclient has no samba-*-libs dependencies - libldb has no samba-*-libs dependencies test: ./deps-check.sh framework: shell require: - samba-core-libs - - samba-common-libs + - samba-ndr-libs - samba-client-libs + - samba-libs - samba-client - libwbclient - libsmbclient diff --git a/tests/deps-check.sh b/tests/deps-check.sh index 017c01d..ce49074 100755 --- a/tests/deps-check.sh +++ b/tests/deps-check.sh @@ -8,10 +8,10 @@ # samba-core-libs (no samba-*-libs dependencies) # ^ # | -# samba-common-libs (depends on samba-core-libs only) +# samba-ndr-libs (depends on samba-core-libs only) # ^ # | -# samba-client-libs (depends on samba-core-libs + samba-common-libs) +# samba-client-libs (depends on samba-core-libs + samba-ndr-libs) # # libwbclient (no samba-*-libs dependencies - only links to libc) # @@ -32,14 +32,14 @@ ERRORS=0 get_resolved_deps() { local pkg="$1" - rpm -qR "$pkg" 2>/dev/null | while read -r req; do + rpm --query --requires "$pkg" 2>/dev/null | while read -r req; do # Skip rpmlib and config requirements [[ "$req" =~ ^rpmlib ]] && continue [[ "$req" =~ ^config ]] && continue [[ "$req" =~ ^/ ]] && continue # Get the package that provides this requirement - provider=$(rpm -q --whatprovides "$req" 2>/dev/null | head -1) + provider=$(rpm --query --whatprovides "$req" 2>/dev/null | head -1) if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then # Extract just the package name (remove version-release.arch) echo "${provider%%-[0-9]*}" @@ -54,7 +54,7 @@ check_no_resolved_dep() { local pattern="$2" local description="$3" - if ! rpm -q "$pkg" &>/dev/null; then + if ! rpm --query "$pkg" &>/dev/null; then echo "SKIP: $pkg not installed" return 0 fi @@ -78,7 +78,7 @@ check_has_resolved_dep() { local pkg="$1" local expected="$2" - if ! rpm -q "$pkg" &>/dev/null; then + if ! rpm --query "$pkg" &>/dev/null; then echo "SKIP: $pkg not installed" return 0 fi @@ -99,30 +99,31 @@ echo "" # 1. samba-core-libs must NOT depend on any samba-*-libs packages echo "--- samba-core-libs ---" -check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba*-libs package" echo "" -# 2. samba-common-libs must depend on samba-core-libs -# but NOT samba-client-libs -echo "--- samba-common-libs ---" -check_has_resolved_dep samba-common-libs "samba-core-libs" -check_no_resolved_dep samba-common-libs "^samba-client-libs$" "samba-client-libs" +# 2. samba-ndr-libs must depend on samba-core-libs +# but NOT samba-client-libs or samba-libs +echo "--- samba-ndr-libs ---" +check_has_resolved_dep samba-ndr-libs "samba-core-libs" +check_no_resolved_dep samba-ndr-libs "^samba-client-libs$" "samba-client-libs" +check_no_resolved_dep samba-ndr-libs "^samba-libs$" "samba-libs" echo "" -# 3. samba-client-libs must depend on samba-core-libs and samba-common-libs +# 3. samba-client-libs must depend on samba-core-libs and samba-ndr-libs # but NOT samba-libs echo "--- samba-client-libs ---" check_has_resolved_dep samba-client-libs "samba-core-libs" -check_has_resolved_dep samba-client-libs "samba-common-libs" +check_has_resolved_dep samba-client-libs "samba-ndr-libs" check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs" echo "" # 4. libwbclient must NOT depend on any samba-*-libs packages echo "--- libwbclient ---" -check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba*-libs package" echo "" @@ -145,7 +146,14 @@ echo "" # 7. libldb must NOT depend on any samba-*-libs packages # (libldb is a standalone database library) echo "--- libldb ---" -check_no_resolved_dep libldb "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep libldb "^samba-.*-libs$" "any samba*-libs package" + +echo "" + +# 8. samba-libs must NOT depend on samba-dc-libs +# (server libraries should not pull in DC-specific libraries) +echo "--- samba-libs ---" +check_no_resolved_dep samba-libs "^samba-dc-libs$" "samba-dc-libs" echo "" echo "=== Summary ===" From da7dc3fa610fd20c6e5a2776fc3bec213c1163b6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 14:28:18 +0100 Subject: [PATCH 89/93] Add missing tmt files [skip changelog] --- .fmf/version | 1 + plans.fmf | 4 ++++ 2 files changed, 5 insertions(+) create mode 100644 .fmf/version create mode 100644 plans.fmf diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..e6427de --- /dev/null +++ b/plans.fmf @@ -0,0 +1,4 @@ +discover: + how: fmf +execute: + how: tmt From 6af45b81d32d8b941a8bfcadc8cf302ad2bbdd0b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:11:15 +0100 Subject: [PATCH 90/93] Add /usr/bin/nmbd to rpminspect.yml /usr/sbin/nmbd is a symlink to /usr/bin/nmbd on Fedora. [skip changelog] --- rpminspect.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index c1455e2..b30fdbe 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -4,6 +4,7 @@ inspections: badfuncs: ignore: + - /usr/bin/nmbd - /usr/bin/nmblookup - /usr/bin/smbtorture - /usr/lib*/libndr.so.* From dca7b1cb88abf129b7f421b1b867d5eb068de56e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:35:54 +0100 Subject: [PATCH 91/93] Move Obsoletes to ndr-package which more or less was common-libs [skip changelog] --- samba.spec | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/samba.spec b/samba.spec index da855ba..cdeefca 100644 --- a/samba.spec +++ b/samba.spec @@ -496,6 +496,21 @@ Requires: %{name}-common = %{samba_depver} Provides: bundled(libreplace) = %{samba_depver} +%description core-libs +The samba-core-libs package contains foundational libraries needed by +both Samba servers and clients. This includes error handling, utilities, +and basic support libraries. + +### NDR-LIBS +%package ndr-libs +Summary: Samba NDR libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} + +Provides: %{name}-common-libs = %{samba_depver} +Obsoletes: %{name}-common-libs < %{samba_depver} + %if %{without dc} && %{without testsuite} Obsoletes: samba-dc < %{samba_depver} Obsoletes: samba-dc-libs < %{samba_depver} @@ -519,21 +534,6 @@ Obsoletes: samba-vfs-glusterfs < %{samba_depver} # endif without vfs_glusterfs %endif -%description core-libs -The samba-core-libs package contains foundational libraries needed by -both Samba servers and clients. This includes error handling, utilities, -and basic support libraries. - -### NDR-LIBS -%package ndr-libs -Summary: Samba NDR libraries -Requires(pre): %{name}-common = %{samba_depver} -Requires: %{name}-common = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} - -Provides: %{name}-common-libs = %{samba_depver} -Obsoletes: %{name}-common-libs < %{samba_depver} - %description ndr-libs The samba-ndr-libs package contains NDR (Network Data Representation) encoding libraries used by both Samba servers and clients. From 1f4ee5276f515f685bd1ba2f03eaed47402514ac Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:10:15 +0100 Subject: [PATCH 92/93] Remove duplicate libdsdb-module-private-samba.so --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index cdeefca..b49a21a 100644 --- a/samba.spec +++ b/samba.spec @@ -3904,7 +3904,6 @@ fi %if %{with dc} %{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so %endif -%{_libdir}/samba/libdsdb-module-private-samba.so ### USERSHARES %files usershares From 58df5ed52bbd18e89ba9316f9f8a69ab4800910b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 15 Jan 2026 17:21:14 +0100 Subject: [PATCH 93/93] rpminspect: Don't run annocheck on test binaries [skip changelog] --- rpminspect.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index b30fdbe..f736bfa 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -26,3 +26,10 @@ abidiff: debuginfo: ignore: - /usr/lib*/libdcerpc-samr.so.* + +annocheck: + ignore: + - /usr/bin/gentest + - /usr/bin/locktest + - /usr/bin/masktest + - /usr/bin/smbtorture