From 052edc4ab62c26380f1865674a88047a41201db4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 12 Aug 2025 22:09:33 +0200 Subject: [PATCH 01/32] Update to Samba 4.23.0rc1 - resolves: #2387090 Guenther --- samba-4.22.x-get_kdc_ip_string.patch | 34 ------------ samba.spec | 78 +++++++++++++++++++++++++--- sources | 4 +- 3 files changed, 73 insertions(+), 43 deletions(-) delete mode 100644 samba-4.22.x-get_kdc_ip_string.patch diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch deleted file mode 100644 index 9277c9b..0000000 --- a/samba-4.22.x-get_kdc_ip_string.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Fri, 4 Jul 2025 17:50:40 +0200 -Subject: [PATCH] libads: fix get_kdc_ip_string() ... -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 - -Signed-off-by: Ralph Boehme -Reviewed-by: Guenther Deschner - -Autobuild-User(master): Günther Deschner -Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224 ---- - source3/libads/kerberos.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c -index 75803500d31..145bc36cdb2 100644 ---- a/source3/libads/kerberos.c -+++ b/source3/libads/kerberos.c -@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx, - - if (!NT_STATUS_IS_OK(status)) { - DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status)); -+ result = talloc_move(mem_ctx, &kdc_str); - goto out; - } - --- -2.50.0 - diff --git a/samba.spec b/samba.spec index 7da5ef4..bebd14a 100644 --- a/samba.spec +++ b/samba.spec @@ -107,13 +107,20 @@ %bcond etcd_mutex 0 %endif +# Build the prometheus exporter by default on Fedora +%if 0%{?fedora} +%bcond prometheus 1 +%else +%bcond prometheus 0 +%endif + %ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond lmdb 1 %else %bcond lmdb 0 %endif -%global samba_version 4.22.3 +%global samba_version 4.23.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -128,7 +135,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc1 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -159,8 +166,8 @@ %global libwbclient_so_version 0 %global talloc_version 2.4.3 -%global tdb_version 1.4.13 -%global tevent_version 0.16.2 +%global tdb_version 1.4.14 +%global tevent_version 0.17.1 %global required_mit_krb5 1.20.1 @@ -215,8 +222,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.22.x-get_kdc_ip_string.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -345,6 +350,9 @@ BuildRequires: librados-devel %if %{with etcd_mutex} BuildRequires: python3-etcd %endif +%if %{with prometheus} +BuildRequires: libevent-devel +%endif BuildRequires: cepces-certmonger >= 0.3.8 @@ -1206,6 +1214,18 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB #endif with clustering %endif +%if %{with prometheus} + +%package prometheus +Summary: SMB Prometheus exporter +Requires: samba = %{samba_depver} + +%description prometheus +Support for exporting metrics via Prometheus + +#endif with prometheus +%endif + ### LIBLDB %package -n libldb Summary: A schema-less, ldap like, API and database @@ -1357,6 +1377,8 @@ if [ -n "${CCACHE}" ]; then fi %endif +# workaround https://gitlab.com/ita1024/waf/-/issues/2472 +export PYTHONARCHDIR=%{python3_sitearch} %configure \ --enable-fhs \ --with-piddir=/run \ @@ -1396,6 +1418,9 @@ fi %endif %if %{with etcd_mutex} --enable-etcd-reclock \ +%endif +%if %{with prometheus} + --with-prometheus-exporter \ %endif --with-profiling-data \ --with-systemd \ @@ -1995,22 +2020,25 @@ fi %{_libdir}/samba/libndr-samba4-private-samba.so %{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so +%{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so +%{_libdir}/samba/libngtcp2-private-samba.so %{_libdir}/samba/libnpa-tstream-private-samba.so %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so %{_libdir}/samba/libprinting-migrate-private-samba.so +%{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so %{_libdir}/samba/libsamba-debug-private-samba.so %{_libdir}/samba/libsamba-modules-private-samba.so %{_libdir}/samba/libsamba-security-private-samba.so +%{_libdir}/samba/libsamba-security-trusts-private-samba.so %{_libdir}/samba/libsamba-sockets-private-samba.so %{_libdir}/samba/libsamba3-util-private-samba.so %{_libdir}/samba/libsamdb-common-private-samba.so %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so %{_libdir}/samba/libserver-role-private-samba.so -%{_libdir}/samba/libsmb-transport-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so %{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so @@ -2106,6 +2134,7 @@ fi %{_mandir}/man8/net.8* %{_mandir}/man8/pdbedit.8* %{_mandir}/man8/smbpasswd.8* +%{_datadir}/locale/*/LC_MESSAGES/net.mo ### TOOLS %files tools @@ -2228,6 +2257,7 @@ fi %{_libdir}/samba/service/dns.so %{_libdir}/samba/service/dns_update.so %{_libdir}/samba/service/drepl.so +%{_libdir}/samba/service/ft_scanner.so %{_libdir}/samba/service/kcc.so %{_libdir}/samba/service/kdc.so %{_libdir}/samba/service/ldap.so @@ -2580,6 +2610,7 @@ fi %{python3_sitearch}/samba/dcerpc/atsvc.*.so %{python3_sitearch}/samba/dcerpc/auth.*.so %{python3_sitearch}/samba/dcerpc/base.*.so +%{python3_sitearch}/samba/dcerpc/bcrypt_rsakey_blob.*.so %{python3_sitearch}/samba/dcerpc/claims.*.so %{python3_sitearch}/samba/dcerpc/conditional_ace.*.so %{python3_sitearch}/samba/dcerpc/dcerpc.*.so @@ -2595,6 +2626,7 @@ fi %{python3_sitearch}/samba/dcerpc/idmap.*.so %{python3_sitearch}/samba/dcerpc/initshutdown.*.so %{python3_sitearch}/samba/dcerpc/irpc.*.so +%{python3_sitearch}/samba/dcerpc/keycredlink.*.so %{python3_sitearch}/samba/dcerpc/krb5ccache.*.so %{python3_sitearch}/samba/dcerpc/krb5pac.*.so %{python3_sitearch}/samba/dcerpc/lsa.*.so @@ -2616,6 +2648,7 @@ fi %{python3_sitearch}/samba/dcerpc/spoolss.*.so %{python3_sitearch}/samba/dcerpc/srvsvc.*.so %{python3_sitearch}/samba/dcerpc/svcctl.*.so +%{python3_sitearch}/samba/dcerpc/tpm20_rsakey_blob.*.so %{python3_sitearch}/samba/dcerpc/unixinfo.*.so %{python3_sitearch}/samba/dcerpc/winbind.*.so %{python3_sitearch}/samba/dcerpc/windows_event_ids.*.so @@ -3119,6 +3152,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/auth_log_netlogon_bad_creds.*.pyc %{python3_sitearch}/samba/tests/__pycache__/auth_log_samlogon.*.pyc %{python3_sitearch}/samba/tests/__pycache__/auth_log_winbind.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/bcrypt_rsakey_blob.*.pyc %{python3_sitearch}/samba/tests/__pycache__/common.*.pyc %{python3_sitearch}/samba/tests/__pycache__/complex_expressions.*.pyc %{python3_sitearch}/samba/tests/__pycache__/compression.*.pyc @@ -3160,6 +3194,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/tests/__pycache__/imports.*.pyc %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/key_credential_link.*.pyc %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc @@ -3237,6 +3272,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/subunitrun.*.pyc %{python3_sitearch}/samba/tests/__pycache__/tdb_util.*.pyc %{python3_sitearch}/samba/tests/__pycache__/token_factory.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/tpm20_rsakey_blob.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovision.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovisionneeddc.*.pyc @@ -3254,6 +3290,7 @@ fi %{python3_sitearch}/samba/tests/auth_log_pass_change.py %{python3_sitearch}/samba/tests/auth_log_samlogon.py %{python3_sitearch}/samba/tests/auth_log_winbind.py +%{python3_sitearch}/samba/tests/bcrypt_rsakey_blob.py %dir %{python3_sitearch}/samba/tests/blackbox %{python3_sitearch}/samba/tests/blackbox/__init__.py %dir %{python3_sitearch}/samba/tests/blackbox/__pycache__ @@ -3414,6 +3451,7 @@ fi %{python3_sitearch}/samba/tests/kcc/graph_utils.py %{python3_sitearch}/samba/tests/kcc/kcc_utils.py %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py +%{python3_sitearch}/samba/tests/key_credential_link.py %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ %{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc @@ -3529,6 +3567,12 @@ fi %{python3_sitearch}/samba/tests/net_join_no_spnego.py %{python3_sitearch}/samba/tests/net_join.py %{python3_sitearch}/samba/tests/netlogonsvc.py +%dir %{python3_sitearch}/samba/tests/nss +%dir %{python3_sitearch}/samba/tests/nss/__pycache__ +%{python3_sitearch}/samba/tests/nss/__pycache__/base.*.pyc +%{python3_sitearch}/samba/tests/nss/__pycache__/group.*.pyc +%{python3_sitearch}/samba/tests/nss/base.py +%{python3_sitearch}/samba/tests/nss/group.py %{python3_sitearch}/samba/tests/ntacls.py %{python3_sitearch}/samba/tests/ntacls_backup.py %{python3_sitearch}/samba/tests/ntlmdisabled.py @@ -3689,10 +3733,21 @@ fi %{python3_sitearch}/samba/tests/subunitrun.py %{python3_sitearch}/samba/tests/tdb_util.py %{python3_sitearch}/samba/tests/token_factory.py +%{python3_sitearch}/samba/tests/tpm20_rsakey_blob.py %{python3_sitearch}/samba/tests/upgrade.py %{python3_sitearch}/samba/tests/upgradeprovision.py %{python3_sitearch}/samba/tests/upgradeprovisionneeddc.py %{python3_sitearch}/samba/tests/usage.py +%dir %{python3_sitearch}/samba/tests/varlink +%dir %{python3_sitearch}/samba/tests/varlink/__pycache__ +%{python3_sitearch}/samba/tests/varlink/__pycache__/base.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getgrouprecord.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getmemberships.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getuserrecord.*.pyc +%{python3_sitearch}/samba/tests/varlink/base.py +%{python3_sitearch}/samba/tests/varlink/getgrouprecord.py +%{python3_sitearch}/samba/tests/varlink/getmemberships.py +%{python3_sitearch}/samba/tests/varlink/getuserrecord.py %{python3_sitearch}/samba/tests/xattr.py ### TEST @@ -3761,6 +3816,7 @@ fi %config(noreplace) %{_sysconfdir}/security/pam_winbind.conf %{_mandir}/man5/pam_winbind.conf.5* %{_mandir}/man8/pam_winbind.8* +%{_datadir}/locale/*/LC_MESSAGES/pam_winbind.mo %if %{with clustering} %files -n ctdb @@ -3910,6 +3966,13 @@ fi %{_mandir}/man1/winexe.1.gz %endif +%if %{with prometheus} +%files prometheus +%{_bindir}/smb_prometheus_endpoint +%{_mandir}/man8/smb_prometheus_endpoint.8.gz +#endif with prometheus + +%endif %files -n libldb %license lib/ldb/LICENSE %{_libdir}/libldb.so.* @@ -3933,6 +3996,7 @@ fi %{_libdir}/samba/ldb/server_sort.so %{_libdir}/samba/ldb/skel.so %{_libdir}/samba/ldb/tdb.so +%{_libdir}/samba/ldb/trust_notify.so %files -n libldb-devel %{_includedir}/samba-4.0/ldb_module.h diff --git a/sources b/sources index c47ad40..ddc3910 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.3.tar.xz) = 426f5128eefc8e96677e507d6980756e7bc70d063c62a9d38d5c33b9c3eb54aaffe1fab5432e09f50d6dfc898635952df8122b2a1a9ee45a6a01702f3c91f43c -SHA512 (samba-4.22.3.tar.asc) = 612d3bec57048168e5c0f95c2ce28daaf0dd29282ba34af26a590ff20c6187f5efaa5b717577d445df4f4752ded6f8ee139ab878b8ccb4cf41c2a38fb8b4694e +SHA512 (samba-4.23.0rc1.tar.xz) = 6472b7445c138abb69185954c2ba86164fa500d8e267cf26ca6208f78599abcd6af282c19a7609cb72dc2d40d68956cdef3599d27dbf7e30d6b9b1f02d0cddea +SHA512 (samba-4.23.0rc1.tar.asc) = 56c9f8a4357599c52ad62e5ddf342c7e0eee4eb3f3c874f77280f06684e00aaf19d3a6d8bea9da8e63f8f79c4f6f28b0bdf3997dbe5213b17b3b4679e5fe5441 From c2bf86b8d2dc38adaded41822a69127cce364e47 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Sun, 17 Aug 2025 23:05:41 -0400 Subject: [PATCH 02/32] Move trust_notify module to -dc subpackage This module is not built in ELN, resulting in a file not found error when packaging libldb. Its build conditions are the same as the dns_notify module already in -dc. --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index bebd14a..5811a12 100644 --- a/samba.spec +++ b/samba.spec @@ -2212,6 +2212,7 @@ fi %{_libdir}/samba/ldb/subtree_delete.so %{_libdir}/samba/ldb/subtree_rename.so %{_libdir}/samba/ldb/tombstone_reanimate.so +%{_libdir}/samba/ldb/trust_notify.so %{_libdir}/samba/ldb/unique_object_sids.so %{_libdir}/samba/ldb/update_keytab.so %{_libdir}/samba/ldb/vlv.so @@ -3996,7 +3997,6 @@ fi %{_libdir}/samba/ldb/server_sort.so %{_libdir}/samba/ldb/skel.so %{_libdir}/samba/ldb/tdb.so -%{_libdir}/samba/ldb/trust_notify.so %files -n libldb-devel %{_includedir}/samba-4.0/ldb_module.h From c108db5e55fd5b9b4e9a5b8062744e4b7796dac6 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 18 Aug 2025 13:57:35 +0200 Subject: [PATCH 03/32] Rebuilt for Python 3.14.0rc2 bytecode From e6a975e42205afdb48c4c0e56c7ae97d61630788 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 22 Aug 2025 21:51:03 +0200 Subject: [PATCH 04/32] Update to Samba 4.23.0rc2 - resolves: #2387090 Guenther --- samba.spec | 5 +++-- sources | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 5811a12..76df67c 100644 --- a/samba.spec +++ b/samba.spec @@ -102,7 +102,8 @@ # Build the etcd helpers by default on Fedora %if 0%{?fedora} -%bcond etcd_mutex 1 +# disable etcd mutex helper as etcd is orphaned in Fedora now +%bcond etcd_mutex 0 %else %bcond etcd_mutex 0 %endif @@ -135,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc1 +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index ddc3910..24013e1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc1.tar.xz) = 6472b7445c138abb69185954c2ba86164fa500d8e267cf26ca6208f78599abcd6af282c19a7609cb72dc2d40d68956cdef3599d27dbf7e30d6b9b1f02d0cddea -SHA512 (samba-4.23.0rc1.tar.asc) = 56c9f8a4357599c52ad62e5ddf342c7e0eee4eb3f3c874f77280f06684e00aaf19d3a6d8bea9da8e63f8f79c4f6f28b0bdf3997dbe5213b17b3b4679e5fe5441 +SHA512 (samba-4.23.0rc2.tar.xz) = 44c8fab0523038270295b1d4ea9d535df04deb91dfe08680e1bde0b621eb6146ff9157ec97e9c0f0fb95ae33aaf66903a192b486b2df35899b6c5d4a57e09ee9 +SHA512 (samba-4.23.0rc2.tar.asc) = 7bdc54eb7bf4736123ea889f18ff0aa29eca91d2ab25fbfaeed431a0c7d193167526312bf051e58c70d2d9de0dfa9a5cdc9d8177f6f144c1b2d32c8ed2d0631d From 83273a97b1fb10bb6db374215af67549ef94637a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 29 Aug 2025 23:32:47 +0200 Subject: [PATCH 05/32] Update to Samba 4.23.0rc3 - resolves: #2387090 Guenther --- samba.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 76df67c..3e1a5fd 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -3361,6 +3361,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/dfs.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc @@ -3381,6 +3382,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py %{python3_sitearch}/samba/tests/dcerpc/binding.py +%{python3_sitearch}/samba/tests/dcerpc/dfs.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/lsa.py diff --git a/sources b/sources index 24013e1..168a85d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc2.tar.xz) = 44c8fab0523038270295b1d4ea9d535df04deb91dfe08680e1bde0b621eb6146ff9157ec97e9c0f0fb95ae33aaf66903a192b486b2df35899b6c5d4a57e09ee9 -SHA512 (samba-4.23.0rc2.tar.asc) = 7bdc54eb7bf4736123ea889f18ff0aa29eca91d2ab25fbfaeed431a0c7d193167526312bf051e58c70d2d9de0dfa9a5cdc9d8177f6f144c1b2d32c8ed2d0631d +SHA512 (samba-4.23.0rc3.tar.xz) = 1e8b9bec0e42d387a0b4665d395ec63bcb9b84353c62be0ed253dfe79c1ff44f13a8a1825f2a1eba4c8f209cae55e0b3ed7f89b39884ec73b05383b0008a5249 +SHA512 (samba-4.23.0rc3.tar.asc) = 727d328c0f4bd075d927bcfdb86083c3e6e9f066c938d5232e655c676d78f936453bc0d39bf271d0f8371f33e8ffe30aa376ad6461ca0be8d34ebca01553c3ab From a6119e2bb3d77153a87af9be96ca2140a9da6316 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 2 Sep 2025 10:47:58 +0300 Subject: [PATCH 06/32] Fix FreeIPA trust to AD - resolves: rhbz#2392626 Signed-off-by: Alexander Bokovoy --- samba-bz15902.patch | 167 ++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 168 insertions(+) create mode 100644 samba-bz15902.patch diff --git a/samba-bz15902.patch b/samba-bz15902.patch new file mode 100644 index 0000000..659eecc --- /dev/null +++ b/samba-bz15902.patch @@ -0,0 +1,167 @@ +From 00b900e82ac0d859562ec88825975a2d9fbe1040 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Tue, 2 Sep 2025 10:36:11 +0300 +Subject: [PATCH] krb5: handle GSS-Proxy credentials lifetime +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +GSS-Proxy stores its credential in encrypted form in the Kerberos ccache +with a start and end time of 0 and a server principal in the realm named +'X-GSSPROXY:'. This credential is accessed through GSS-Proxy interposer +mechanism in MIT Kerberos and cannot be analysed with raw krb5 API. + +As MIT Kerberos has no krb5_cc_get_lifetime() implementation, add check +for the GSS-Proxy credential to smb_krb5_cc_get_lifetime() wrapper to +return KRB5_PLUGIN_NO_HANDLE. The two places where +smb_krb5_cc_get_lifetime() is used then handle this return code to avoid +deciding on the 'expired' lifetime to cause a kinit. + +This fixes FreeIPA use case where an IPA API endpoint uses Samba Python +bindings with a GSS-Proxy-controlled credential cache. + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=15902 + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Pavel Filipenský + +Autobuild-User(master): Pavel Filipensky +Autobuild-Date(master): Wed Sep 3 10:15:50 UTC 2025 on atb-devel-224 + +(cherry picked from commit c00b98ad840706cda222bb610d0d4860b98c72d4) +--- + auth/credentials/credentials_krb5.c | 36 +++++++++++++++++++++-------- + lib/krb5_wrap/krb5_samba.c | 35 ++++++++++++++++++++++++++-- + 2 files changed, 59 insertions(+), 12 deletions(-) + +diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c +index 4dc7e7be67e..8d289e26781 100644 +--- a/auth/credentials/credentials_krb5.c ++++ b/auth/credentials/credentials_krb5.c +@@ -687,7 +687,14 @@ _PUBLIC_ int cli_credentials_get_named_ccache(struct cli_credentials *cred, + bool kinit_required = false; + ret = smb_krb5_cc_get_lifetime(cred->ccache->smb_krb5_context->krb5_context, + cred->ccache->ccache, &lifetime); +- if (ret == KRB5_CC_END || ret == ENOENT) { ++ if (ret == KRB5_PLUGIN_NO_HANDLE) { ++ /* ++ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted ++ * GSSProxy credential. We don't know its lifetime but assume it ++ * is a valid one. Acquiring it will show the lifetime. ++ */ ++ kinit_required = false; ++ } else if (ret == KRB5_CC_END || ret == ENOENT) { + kinit_required = true; + } else if (ret == 0) { + if (lifetime == 0) { +@@ -800,18 +807,27 @@ _PUBLIC_ bool cli_credentials_get_ccache_name_obtained( + if (ret == KRB5_CC_END || ret == ENOENT) { + return false; + } +- if (ret != 0) { ++ ++ /* ++ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted ++ * GSSProxy credential. We don't know its lifetime but assume it ++ * is a valid one. Acquiring it will show the lifetime. ++ * */ ++ if (ret != 0 && ret != KRB5_PLUGIN_NO_HANDLE) { + return false; + } +- if (lifetime == 0) { +- return false; +- } else if (lifetime < 300) { +- if (cred->password_obtained >= cred->ccache_obtained) { +- /* +- * we have a password to re-kinit +- * so let the caller try that. +- */ ++ ++ if (ret == 0) { ++ if (lifetime == 0) { + return false; ++ } else if (lifetime < 300) { ++ if (cred->password_obtained >= cred->ccache_obtained) { ++ /* ++ * we have a password to re-kinit ++ * so let the caller try that. ++ */ ++ return false; ++ } + } + } + +diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c +index f9d91a4f0c1..dcf91348d1a 100644 +--- a/lib/krb5_wrap/krb5_samba.c ++++ b/lib/krb5_wrap/krb5_samba.c +@@ -3025,6 +3025,8 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + krb5_creds cred; + krb5_timestamp endtime = 0; + krb5_timestamp now; ++ char *realm = NULL; ++ TALLOC_CTX *mem_ctx = NULL; + + *t = 0; + +@@ -3038,12 +3040,37 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + return kerr; + } + ++ mem_ctx = talloc_stackframe(); ++ if (mem_ctx == NULL) { ++ krb5_cc_end_seq_get(context, id, &cursor); ++ return ENOMEM; ++ } ++ + while ((kerr = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) { + if (krb5_is_config_principal(context, cred.server)) { + krb5_free_cred_contents(context, &cred); + continue; + } + ++ realm = smb_krb5_principal_get_realm(mem_ctx, context, cred.server); ++ if (realm == NULL) { ++ krb5_free_cred_contents(context, &cred); ++ kerr = ENOMEM; ++ break; ++ } ++ ++ /* ++ * 'X-GSSPROXY:' is the realm for an encrypted credential stored ++ * by the GSSProxy. There are no other creds in such ccache and ++ * we cannot see the actual lifetime (it is set to 0), ++ * indicate to the caller they need to handle this themselves. ++ */ ++ if (strcmp(realm, "X-GSSPROXY:") == 0) { ++ krb5_free_cred_contents(context, &cred); ++ kerr = KRB5_PLUGIN_NO_HANDLE; ++ break; ++ } ++ + #ifndef HAVE_FLAGS_IN_KRB5_CREDS + if (cred.ticket_flags & TKT_FLG_INITIAL) { + #else +@@ -3073,13 +3100,17 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + krb5_free_cred_contents(context, &cred); + } + ++ krb5_cc_end_seq_get(context, id, &cursor); ++ talloc_free(mem_ctx); ++ if (kerr == ENOMEM || kerr == KRB5_PLUGIN_NO_HANDLE) { ++ return kerr; ++ } ++ + if (now < endtime) { + *t = (time_t) (endtime - now); + kerr = 0; + } + +- krb5_cc_end_seq_get(context, id, &cursor); +- + return kerr; + } + #endif /* HAVE_KRB5_CC_GET_LIFETIME */ +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index 3e1a5fd..aa68a70 100644 --- a/samba.spec +++ b/samba.spec @@ -222,6 +222,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-bz15902.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 5a96c9042742117afd7b42a742495e578ae06db4 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 3 Sep 2025 15:44:06 +0300 Subject: [PATCH 07/32] Disable PCP 7.0.0 support PCP 7.0.0 API has changed, needs more work in ctdb https://bugzilla.samba.org/show_bug.cgi?id=15904 - resolves: rhbz#2392879 Signed-off-by: Alexander Bokovoy --- samba-pcp-7.0.0.patch | 63 +++++++++++++++++++++++++++++++++++++++++++ samba.spec | 3 +++ 2 files changed, 66 insertions(+) create mode 100644 samba-pcp-7.0.0.patch diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch new file mode 100644 index 0000000..953bc46 --- /dev/null +++ b/samba-pcp-7.0.0.patch @@ -0,0 +1,63 @@ +From edede7256f7bfa25186e22b3c5f1aab9a56ac141 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Wed, 3 Sep 2025 15:42:46 +0300 +Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 + +Signed-off-by: Alexander Bokovoy +--- + ctdb/utils/pmda/pmda_ctdb.c | 4 ++++ + ctdb/wscript | 20 +++++++++----------- + 2 files changed, 13 insertions(+), 11 deletions(-) + +diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c +index 7ac8a3b38d1..a8d6704c8a9 100644 +--- a/ctdb/utils/pmda/pmda_ctdb.c ++++ b/ctdb/utils/pmda/pmda_ctdb.c +@@ -39,9 +39,13 @@ + + #define pmID_cluster(id) id->cluster + #define pmID_item(id) id->item ++#ifndef pmGetProgname + #define pmGetProgname() pmProgname ++#endif ++#ifndef pmSetProgname + #define pmSetProgname(a) __pmSetProgname(a) + #endif ++#endif + + #include "domain.h" + +diff --git a/ctdb/wscript b/ctdb/wscript +index e9cd89436a3..15dedb1c432 100644 +--- a/ctdb/wscript ++++ b/ctdb/wscript +@@ -226,17 +226,15 @@ def configure(conf): + + have_pmda = False + if Options.options.ctdb_pmda: +- pmda_support = True +- +- if not conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', +- together=True): +- pmda_support = False +- if not conf.CHECK_FUNCS_IN('pmProgname', 'pcp'): +- pmda_support = False +- if not conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda'): +- pmda_support = False +- if pmda_support: +- conf.CHECK_TYPE_IN('__pmID_int', 'pcp/pmapi.h pcp/impl.h') ++ checks = [conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', ++ together=True), ++ conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda')] ++ ++ have_progname = [conf.CHECK_FUNCS_IN('pmProgname', 'pcp'), ++ conf.CHECK_FUNCS_IN('pmGetProgname', 'pcp')] ++ ++ if all(checks) and any(have_progname): ++ conf.CHECK_TYPE_IN('__pmID_int', 'libpcp.h pcp/pmapi.h pcp/impl.h') + have_pmda = True + else: + Logs.error("PMDA support not available") +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index aa68a70..8a8a21e 100644 --- a/samba.spec +++ b/samba.spec @@ -94,8 +94,10 @@ # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 +%if 0%{?fedora} < 43 %bcond pcp_pmda 1 %endif +%endif %else %bcond pcp_pmda 0 %endif @@ -223,6 +225,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore Patch0: samba-bz15902.patch +Patch1: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From beb6a110890db1bd1c6d5f1ef7602cc21d84ec6b Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 4 Sep 2025 09:25:26 +0300 Subject: [PATCH 08/32] Restore PCP support - resolves: rhbz#2392879 Signed-off-by: Alexander Bokovoy --- samba-pcp-7.0.0.patch | 17 +++++++++++++---- samba.spec | 2 -- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch index 953bc46..1b2c6a5 100644 --- a/samba-pcp-7.0.0.patch +++ b/samba-pcp-7.0.0.patch @@ -1,16 +1,16 @@ -From edede7256f7bfa25186e22b3c5f1aab9a56ac141 Mon Sep 17 00:00:00 2001 +From 4b74db174b92e00eb4c342c77adcb8140851d025 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 3 Sep 2025 15:42:46 +0300 Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 Signed-off-by: Alexander Bokovoy --- - ctdb/utils/pmda/pmda_ctdb.c | 4 ++++ + ctdb/utils/pmda/pmda_ctdb.c | 6 +++++- ctdb/wscript | 20 +++++++++----------- - 2 files changed, 13 insertions(+), 11 deletions(-) + 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 7ac8a3b38d1..a8d6704c8a9 100644 +index 7ac8a3b38d1..75ae1079dc4 100644 --- a/ctdb/utils/pmda/pmda_ctdb.c +++ b/ctdb/utils/pmda/pmda_ctdb.c @@ -39,9 +39,13 @@ @@ -27,6 +27,15 @@ index 7ac8a3b38d1..a8d6704c8a9 100644 #include "domain.h" +@@ -450,7 +454,7 @@ err_out: + * instance domain evaluation. + */ + static int +-pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmResult **resp, pmdaExt *pmda) ++pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmdaResult **resp, pmdaExt *pmda) + { + int ret; + diff --git a/ctdb/wscript b/ctdb/wscript index e9cd89436a3..15dedb1c432 100644 --- a/ctdb/wscript diff --git a/samba.spec b/samba.spec index 8a8a21e..1d9ef9a 100644 --- a/samba.spec +++ b/samba.spec @@ -94,10 +94,8 @@ # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 -%if 0%{?fedora} < 43 %bcond pcp_pmda 1 %endif -%endif %else %bcond pcp_pmda 0 %endif From e0762b936f9c379833168f93bde983aa8b82131c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 10 Sep 2025 10:28:22 +0200 Subject: [PATCH 09/32] Update to Samba 4.23.0rc4 - resolves: #2393434 Guenther --- samba-bz15902.patch | 167 -------------------------------------------- samba.spec | 5 +- sources | 4 +- 3 files changed, 4 insertions(+), 172 deletions(-) delete mode 100644 samba-bz15902.patch diff --git a/samba-bz15902.patch b/samba-bz15902.patch deleted file mode 100644 index 659eecc..0000000 --- a/samba-bz15902.patch +++ /dev/null @@ -1,167 +0,0 @@ -From 00b900e82ac0d859562ec88825975a2d9fbe1040 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Tue, 2 Sep 2025 10:36:11 +0300 -Subject: [PATCH] krb5: handle GSS-Proxy credentials lifetime -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -GSS-Proxy stores its credential in encrypted form in the Kerberos ccache -with a start and end time of 0 and a server principal in the realm named -'X-GSSPROXY:'. This credential is accessed through GSS-Proxy interposer -mechanism in MIT Kerberos and cannot be analysed with raw krb5 API. - -As MIT Kerberos has no krb5_cc_get_lifetime() implementation, add check -for the GSS-Proxy credential to smb_krb5_cc_get_lifetime() wrapper to -return KRB5_PLUGIN_NO_HANDLE. The two places where -smb_krb5_cc_get_lifetime() is used then handle this return code to avoid -deciding on the 'expired' lifetime to cause a kinit. - -This fixes FreeIPA use case where an IPA API endpoint uses Samba Python -bindings with a GSS-Proxy-controlled credential cache. - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=15902 - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Pavel Filipensky -Autobuild-Date(master): Wed Sep 3 10:15:50 UTC 2025 on atb-devel-224 - -(cherry picked from commit c00b98ad840706cda222bb610d0d4860b98c72d4) ---- - auth/credentials/credentials_krb5.c | 36 +++++++++++++++++++++-------- - lib/krb5_wrap/krb5_samba.c | 35 ++++++++++++++++++++++++++-- - 2 files changed, 59 insertions(+), 12 deletions(-) - -diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c -index 4dc7e7be67e..8d289e26781 100644 ---- a/auth/credentials/credentials_krb5.c -+++ b/auth/credentials/credentials_krb5.c -@@ -687,7 +687,14 @@ _PUBLIC_ int cli_credentials_get_named_ccache(struct cli_credentials *cred, - bool kinit_required = false; - ret = smb_krb5_cc_get_lifetime(cred->ccache->smb_krb5_context->krb5_context, - cred->ccache->ccache, &lifetime); -- if (ret == KRB5_CC_END || ret == ENOENT) { -+ if (ret == KRB5_PLUGIN_NO_HANDLE) { -+ /* -+ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted -+ * GSSProxy credential. We don't know its lifetime but assume it -+ * is a valid one. Acquiring it will show the lifetime. -+ */ -+ kinit_required = false; -+ } else if (ret == KRB5_CC_END || ret == ENOENT) { - kinit_required = true; - } else if (ret == 0) { - if (lifetime == 0) { -@@ -800,18 +807,27 @@ _PUBLIC_ bool cli_credentials_get_ccache_name_obtained( - if (ret == KRB5_CC_END || ret == ENOENT) { - return false; - } -- if (ret != 0) { -+ -+ /* -+ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted -+ * GSSProxy credential. We don't know its lifetime but assume it -+ * is a valid one. Acquiring it will show the lifetime. -+ * */ -+ if (ret != 0 && ret != KRB5_PLUGIN_NO_HANDLE) { - return false; - } -- if (lifetime == 0) { -- return false; -- } else if (lifetime < 300) { -- if (cred->password_obtained >= cred->ccache_obtained) { -- /* -- * we have a password to re-kinit -- * so let the caller try that. -- */ -+ -+ if (ret == 0) { -+ if (lifetime == 0) { - return false; -+ } else if (lifetime < 300) { -+ if (cred->password_obtained >= cred->ccache_obtained) { -+ /* -+ * we have a password to re-kinit -+ * so let the caller try that. -+ */ -+ return false; -+ } - } - } - -diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index f9d91a4f0c1..dcf91348d1a 100644 ---- a/lib/krb5_wrap/krb5_samba.c -+++ b/lib/krb5_wrap/krb5_samba.c -@@ -3025,6 +3025,8 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - krb5_creds cred; - krb5_timestamp endtime = 0; - krb5_timestamp now; -+ char *realm = NULL; -+ TALLOC_CTX *mem_ctx = NULL; - - *t = 0; - -@@ -3038,12 +3040,37 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - return kerr; - } - -+ mem_ctx = talloc_stackframe(); -+ if (mem_ctx == NULL) { -+ krb5_cc_end_seq_get(context, id, &cursor); -+ return ENOMEM; -+ } -+ - while ((kerr = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) { - if (krb5_is_config_principal(context, cred.server)) { - krb5_free_cred_contents(context, &cred); - continue; - } - -+ realm = smb_krb5_principal_get_realm(mem_ctx, context, cred.server); -+ if (realm == NULL) { -+ krb5_free_cred_contents(context, &cred); -+ kerr = ENOMEM; -+ break; -+ } -+ -+ /* -+ * 'X-GSSPROXY:' is the realm for an encrypted credential stored -+ * by the GSSProxy. There are no other creds in such ccache and -+ * we cannot see the actual lifetime (it is set to 0), -+ * indicate to the caller they need to handle this themselves. -+ */ -+ if (strcmp(realm, "X-GSSPROXY:") == 0) { -+ krb5_free_cred_contents(context, &cred); -+ kerr = KRB5_PLUGIN_NO_HANDLE; -+ break; -+ } -+ - #ifndef HAVE_FLAGS_IN_KRB5_CREDS - if (cred.ticket_flags & TKT_FLG_INITIAL) { - #else -@@ -3073,13 +3100,17 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - krb5_free_cred_contents(context, &cred); - } - -+ krb5_cc_end_seq_get(context, id, &cursor); -+ talloc_free(mem_ctx); -+ if (kerr == ENOMEM || kerr == KRB5_PLUGIN_NO_HANDLE) { -+ return kerr; -+ } -+ - if (now < endtime) { - *t = (time_t) (endtime - now); - kerr = 0; - } - -- krb5_cc_end_seq_get(context, id, &cursor); -- - return kerr; - } - #endif /* HAVE_KRB5_CC_GET_LIFETIME */ --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 1d9ef9a..5cebd13 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -222,8 +222,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-bz15902.patch -Patch1: samba-pcp-7.0.0.patch +Patch0: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} diff --git a/sources b/sources index 168a85d..a13eeba 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc3.tar.xz) = 1e8b9bec0e42d387a0b4665d395ec63bcb9b84353c62be0ed253dfe79c1ff44f13a8a1825f2a1eba4c8f209cae55e0b3ed7f89b39884ec73b05383b0008a5249 -SHA512 (samba-4.23.0rc3.tar.asc) = 727d328c0f4bd075d927bcfdb86083c3e6e9f066c938d5232e655c676d78f936453bc0d39bf271d0f8371f33e8ffe30aa376ad6461ca0be8d34ebca01553c3ab +SHA512 (samba-4.23.0rc4.tar.xz) = 0e31cce7b6627d07c0d6caa4be6e7e962c5c32bb426532584f5d429c9354c5e9a3180c6cb6c2cabe0daad130c78fb43cf0b304b515d1e0a92e67e0e581539dba +SHA512 (samba-4.23.0rc4.tar.asc) = 068891e289c62ce8602ea6524c05c0348cc21853597e3e192bf932d3a4b7fb514925950828bc97375492aa30e5937761911f0ade2af202ddaec504f105fec580 From 86832ccc3983caa58af6bcc646f1bccabaa9b7e5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 14:55:35 +0200 Subject: [PATCH 10/32] Update to version 4.23.0 - resolves: rhbz#2394791 --- samba-pcp-7.0.0.patch | 72 ------------------------------------------- samba.spec | 8 +++-- 2 files changed, 6 insertions(+), 74 deletions(-) delete mode 100644 samba-pcp-7.0.0.patch diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch deleted file mode 100644 index 1b2c6a5..0000000 --- a/samba-pcp-7.0.0.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 4b74db174b92e00eb4c342c77adcb8140851d025 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Wed, 3 Sep 2025 15:42:46 +0300 -Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 - -Signed-off-by: Alexander Bokovoy ---- - ctdb/utils/pmda/pmda_ctdb.c | 6 +++++- - ctdb/wscript | 20 +++++++++----------- - 2 files changed, 14 insertions(+), 12 deletions(-) - -diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 7ac8a3b38d1..75ae1079dc4 100644 ---- a/ctdb/utils/pmda/pmda_ctdb.c -+++ b/ctdb/utils/pmda/pmda_ctdb.c -@@ -39,9 +39,13 @@ - - #define pmID_cluster(id) id->cluster - #define pmID_item(id) id->item -+#ifndef pmGetProgname - #define pmGetProgname() pmProgname -+#endif -+#ifndef pmSetProgname - #define pmSetProgname(a) __pmSetProgname(a) - #endif -+#endif - - #include "domain.h" - -@@ -450,7 +454,7 @@ err_out: - * instance domain evaluation. - */ - static int --pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmResult **resp, pmdaExt *pmda) -+pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmdaResult **resp, pmdaExt *pmda) - { - int ret; - -diff --git a/ctdb/wscript b/ctdb/wscript -index e9cd89436a3..15dedb1c432 100644 ---- a/ctdb/wscript -+++ b/ctdb/wscript -@@ -226,17 +226,15 @@ def configure(conf): - - have_pmda = False - if Options.options.ctdb_pmda: -- pmda_support = True -- -- if not conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', -- together=True): -- pmda_support = False -- if not conf.CHECK_FUNCS_IN('pmProgname', 'pcp'): -- pmda_support = False -- if not conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda'): -- pmda_support = False -- if pmda_support: -- conf.CHECK_TYPE_IN('__pmID_int', 'pcp/pmapi.h pcp/impl.h') -+ checks = [conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', -+ together=True), -+ conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda')] -+ -+ have_progname = [conf.CHECK_FUNCS_IN('pmProgname', 'pcp'), -+ conf.CHECK_FUNCS_IN('pmGetProgname', 'pcp')] -+ -+ if all(checks) and any(have_progname): -+ conf.CHECK_TYPE_IN('__pmID_int', 'libpcp.h pcp/pmapi.h pcp/impl.h') - have_pmda = True - else: - Logs.error("PMDA support not available") --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 5cebd13..dca57e4 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -222,7 +222,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -323,6 +322,11 @@ BuildRequires: xz BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) +# TODO FIXME This is not in RHEL yet +%if 0%{?fedora} >= 34 +BuildRequires: pkgconfig(libngtcp2) +BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) +%endif %ifnarch i686 %if 0%{?fedora} >= 37 From 0bc0416ee8ae7375d809c566d6ecfcba9b2beb04 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 15:03:30 +0200 Subject: [PATCH 11/32] Remove `smb3 unix extensions = yes` from smb.conf This is enabled by default now. --- smb.conf.vendor | 2 -- sources | 4 ++-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/smb.conf.vendor b/smb.conf.vendor index cbb2e0f..f237c86 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -18,8 +18,6 @@ load printers = yes cups options = raw - smb3 unix extensions = yes - # Install samba-usershares package for support include = /etc/samba/usershares.conf diff --git a/sources b/sources index a13eeba..e69f8ff 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc4.tar.xz) = 0e31cce7b6627d07c0d6caa4be6e7e962c5c32bb426532584f5d429c9354c5e9a3180c6cb6c2cabe0daad130c78fb43cf0b304b515d1e0a92e67e0e581539dba -SHA512 (samba-4.23.0rc4.tar.asc) = 068891e289c62ce8602ea6524c05c0348cc21853597e3e192bf932d3a4b7fb514925950828bc97375492aa30e5937761911f0ade2af202ddaec504f105fec580 +SHA512 (samba-4.23.0.tar.xz) = 660b35a99544a868b11b24ea3c2ed58de5f68c7fc12d3ea71bc84724285eee4375d13ccf357f0248352fab344d76303660e09598f5f1988f3d0f8e76c535a781 +SHA512 (samba-4.23.0.tar.asc) = 508587816e941cd8dc9f65b7f05c828ce859fb7f74a01a200f685c5188c79c916b4d5b167b71298c53cc8a01d6e17a272ea773980488af532a85308fd1142156 From 54c3bbd3f168e8816d279498b3d18435d9a4081b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 18:04:02 +0200 Subject: [PATCH 12/32] Fix building ctdb with PCP 7.0.0 --- samba-fix-ctdb-pcp-7-support.patch | 36 ++++++++++++++++++++++++++++++ samba.spec | 6 ++++- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 samba-fix-ctdb-pcp-7-support.patch diff --git a/samba-fix-ctdb-pcp-7-support.patch b/samba-fix-ctdb-pcp-7-support.patch new file mode 100644 index 0000000..116a4ff --- /dev/null +++ b/samba-fix-ctdb-pcp-7-support.patch @@ -0,0 +1,36 @@ +From 56be6583e8a32cd4dcdfcd3a1f072cc7642668e4 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 12 Sep 2025 15:37:38 +0200 +Subject: [PATCH] ctdb: Fix redefinitoin of pmdaResult + +../../ctdb/utils/pmda/pmda_ctdb.c:52:9: warning: 'pmdaResult' redefined + 52 | #define pmdaResult pmResult + | ^~~~~~~~~~ +In file included from ../../ctdb/utils/pmda/pmda_ctdb.c:35: +/usr/include/pcp/pmda.h:30:9: note: this is the location of the previous definition + 30 | #define pmdaResult pmResult_v2 + | ^~~~~~~~~~ + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15904 + +Signed-off-by: Andreas Schneider +--- + ctdb/utils/pmda/pmda_ctdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c +index 9845f26defb..5c09aca7b84 100644 +--- a/ctdb/utils/pmda/pmda_ctdb.c ++++ b/ctdb/utils/pmda/pmda_ctdb.c +@@ -48,7 +48,7 @@ + #define pmSetProgname(a) __pmSetProgname(a) + #endif + +-#ifdef HAVE_STRUCT_PMRESULT ++#if !defined(pmdaResult) && defined(HAVE_STRUCT_PMRESULT) + #define pmdaResult pmResult + #endif + +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index dca57e4..a68adfa 100644 --- a/samba.spec +++ b/samba.spec @@ -223,6 +223,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-fix-ctdb-pcp-7-support.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -323,7 +325,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) # TODO FIXME This is not in RHEL yet -%if 0%{?fedora} >= 34 +%if 0%{?fedora} >= 43 BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) %endif @@ -2026,8 +2028,10 @@ fi %{_libdir}/samba/libndr-samba4-private-samba.so %{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so +%if 0%{?rhel} %{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so %{_libdir}/samba/libngtcp2-private-samba.so +%endif %{_libdir}/samba/libnpa-tstream-private-samba.so %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so From b40a7310d3f6cc89d9b97bd587235793ad42a4b9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 15 Sep 2025 10:43:55 +0200 Subject: [PATCH 13/32] Build with systemd-userdb support --- samba.spec | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/samba.spec b/samba.spec index a68adfa..406e975 100644 --- a/samba.spec +++ b/samba.spec @@ -121,6 +121,12 @@ %bcond lmdb 0 %endif +%if 0%{?fedora} >= 43 +%bcond varlink 1 +%else +%bcond varlink 0 +%endif + %global samba_version 4.23.0 # The release field is extended: @@ -330,6 +336,10 @@ BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) %endif +%if %{with varlink} +BuildRequires: pkgconfig(libvarlink) >= 24 +%endif + %ifnarch i686 %if 0%{?fedora} >= 37 BuildRequires: mold @@ -1429,6 +1439,9 @@ export PYTHONARCHDIR=%{python3_sitearch} %endif %if %{with prometheus} --with-prometheus-exporter \ +%endif +%if %{with varlink} + --with-systemd-userdb \ %endif --with-profiling-data \ --with-systemd \ From 07953f426e3bacaaab66308f0cc460811ce9a29d Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 23 Sep 2025 11:40:30 +0300 Subject: [PATCH 14/32] Fix DLZ crash on unconfigured Samba AD system and rebuild against Python 3.14.0rc3 - Resolves: rhbz#2396621 - Resolves: rhbz#2397242 Signed-off-by: Alexander Bokovoy --- samba-dlz-crash-fix.patch | 53 +++++++++++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 54 insertions(+) create mode 100644 samba-dlz-crash-fix.patch diff --git a/samba-dlz-crash-fix.patch b/samba-dlz-crash-fix.patch new file mode 100644 index 0000000..e3e84b2 --- /dev/null +++ b/samba-dlz-crash-fix.patch @@ -0,0 +1,53 @@ +From 821cf798d87162b1f3b5d7388891d15fea0a969a Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Fri, 19 Sep 2025 16:23:41 +0300 +Subject: [PATCH] Fix crash in DLZ plugin for incorrect setup + +When bind is not yet setup properly, logging errors should be done +through the temporary handle. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15920 + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Douglas Bagnall + +Autobuild-User(master): Douglas Bagnall +Autobuild-Date(master): Sat Sep 20 06:49:37 UTC 2025 on atb-devel-224 +--- + source4/dns_server/dlz_bind9.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/source4/dns_server/dlz_bind9.c b/source4/dns_server/dlz_bind9.c +index e5c9679835e..2a2430caba2 100644 +--- a/source4/dns_server/dlz_bind9.c ++++ b/source4/dns_server/dlz_bind9.c +@@ -671,6 +671,9 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, + } + va_end(ap); + ++ /* starting from here, we can only use state->log() until ++ * dlz_bind9_state is assigned */ ++ + /* Do not install samba signal handlers */ + fault_setup_disable(); + +@@ -727,11 +730,11 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, + } + + if (!file_exist(state->options.url)) { +- dlz_bind9_state->log(ISC_LOG_ERROR, +- "samba_dlz: dlz_create could not find '%s'; " +- "trying old location '%s/dns/sam.ldb' instead", +- state->options.url, +- lpcfg_private_dir(state->lp)); ++ state->log(ISC_LOG_ERROR, ++ "samba_dlz: dlz_create could not find '%s'; " ++ "trying old location '%s/dns/sam.ldb' instead", ++ state->options.url, ++ lpcfg_private_dir(state->lp)); + state->options.url = talloc_asprintf(state, + "%s/dns/sam.ldb", + lpcfg_private_dir(state->lp)); +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index 406e975..4846712 100644 --- a/samba.spec +++ b/samba.spec @@ -230,6 +230,7 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-fix-ctdb-pcp-7-support.patch +Patch1: samba-dlz-crash-fix.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 4e3699d8b510bcd13d65116dca74012906d32a31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 29 Sep 2025 14:14:11 +0200 Subject: [PATCH 15/32] Update to Samba 4.23.1 - resolves: #2399755 Guenther --- samba-dlz-crash-fix.patch | 53 ------------------------------ samba-fix-ctdb-pcp-7-support.patch | 36 -------------------- samba.spec | 5 +-- sources | 4 +-- 4 files changed, 3 insertions(+), 95 deletions(-) delete mode 100644 samba-dlz-crash-fix.patch delete mode 100644 samba-fix-ctdb-pcp-7-support.patch diff --git a/samba-dlz-crash-fix.patch b/samba-dlz-crash-fix.patch deleted file mode 100644 index e3e84b2..0000000 --- a/samba-dlz-crash-fix.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 821cf798d87162b1f3b5d7388891d15fea0a969a Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Fri, 19 Sep 2025 16:23:41 +0300 -Subject: [PATCH] Fix crash in DLZ plugin for incorrect setup - -When bind is not yet setup properly, logging errors should be done -through the temporary handle. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15920 - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Douglas Bagnall - -Autobuild-User(master): Douglas Bagnall -Autobuild-Date(master): Sat Sep 20 06:49:37 UTC 2025 on atb-devel-224 ---- - source4/dns_server/dlz_bind9.c | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -diff --git a/source4/dns_server/dlz_bind9.c b/source4/dns_server/dlz_bind9.c -index e5c9679835e..2a2430caba2 100644 ---- a/source4/dns_server/dlz_bind9.c -+++ b/source4/dns_server/dlz_bind9.c -@@ -671,6 +671,9 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, - } - va_end(ap); - -+ /* starting from here, we can only use state->log() until -+ * dlz_bind9_state is assigned */ -+ - /* Do not install samba signal handlers */ - fault_setup_disable(); - -@@ -727,11 +730,11 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, - } - - if (!file_exist(state->options.url)) { -- dlz_bind9_state->log(ISC_LOG_ERROR, -- "samba_dlz: dlz_create could not find '%s'; " -- "trying old location '%s/dns/sam.ldb' instead", -- state->options.url, -- lpcfg_private_dir(state->lp)); -+ state->log(ISC_LOG_ERROR, -+ "samba_dlz: dlz_create could not find '%s'; " -+ "trying old location '%s/dns/sam.ldb' instead", -+ state->options.url, -+ lpcfg_private_dir(state->lp)); - state->options.url = talloc_asprintf(state, - "%s/dns/sam.ldb", - lpcfg_private_dir(state->lp)); --- -2.51.0 - diff --git a/samba-fix-ctdb-pcp-7-support.patch b/samba-fix-ctdb-pcp-7-support.patch deleted file mode 100644 index 116a4ff..0000000 --- a/samba-fix-ctdb-pcp-7-support.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 56be6583e8a32cd4dcdfcd3a1f072cc7642668e4 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 12 Sep 2025 15:37:38 +0200 -Subject: [PATCH] ctdb: Fix redefinitoin of pmdaResult - -../../ctdb/utils/pmda/pmda_ctdb.c:52:9: warning: 'pmdaResult' redefined - 52 | #define pmdaResult pmResult - | ^~~~~~~~~~ -In file included from ../../ctdb/utils/pmda/pmda_ctdb.c:35: -/usr/include/pcp/pmda.h:30:9: note: this is the location of the previous definition - 30 | #define pmdaResult pmResult_v2 - | ^~~~~~~~~~ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15904 - -Signed-off-by: Andreas Schneider ---- - ctdb/utils/pmda/pmda_ctdb.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 9845f26defb..5c09aca7b84 100644 ---- a/ctdb/utils/pmda/pmda_ctdb.c -+++ b/ctdb/utils/pmda/pmda_ctdb.c -@@ -48,7 +48,7 @@ - #define pmSetProgname(a) __pmSetProgname(a) - #endif - --#ifdef HAVE_STRUCT_PMRESULT -+#if !defined(pmdaResult) && defined(HAVE_STRUCT_PMRESULT) - #define pmdaResult pmResult - #endif - --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 4846712..493c0bf 100644 --- a/samba.spec +++ b/samba.spec @@ -127,7 +127,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.0 +%global samba_version 4.23.1 # The release field is extended: # [.][.]%%{?dist}[.] @@ -229,9 +229,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-fix-ctdb-pcp-7-support.patch -Patch1: samba-dlz-crash-fix.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} diff --git a/sources b/sources index e69f8ff..1bea503 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0.tar.xz) = 660b35a99544a868b11b24ea3c2ed58de5f68c7fc12d3ea71bc84724285eee4375d13ccf357f0248352fab344d76303660e09598f5f1988f3d0f8e76c535a781 -SHA512 (samba-4.23.0.tar.asc) = 508587816e941cd8dc9f65b7f05c828ce859fb7f74a01a200f685c5188c79c916b4d5b167b71298c53cc8a01d6e17a272ea773980488af532a85308fd1142156 +SHA512 (samba-4.23.1.tar.xz) = d6e2863dc729b2c4feb337634ad80d9f8cb244455dbdb035f6d164ed722c07e507d2018d68221beada429d6e2c00aa36bfbfcc788e96e34225bb963beb2e017e +SHA512 (samba-4.23.1.tar.asc) = cea22d67e374b4350bd78e941ec60655b4176b7c24dc3514f476608f91c5806f1dc11aed66a237dec82ed31979eeeacac91f2191c3b9fe415920f762a0085118 From c05bf06122c9f8f630c5435c3ebe7d04046472c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 15 Oct 2025 23:27:11 +0200 Subject: [PATCH 16/32] Update to Samba 4.23.2 - resolves: rhbz#2404204 - resolves: rhbz#2391698 - Security fix for CVE-2025-9640 - resolves: rhbz#2394377 - Security fix for CVE-2025-10230 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 493c0bf..d6e2912 100644 --- a/samba.spec +++ b/samba.spec @@ -127,7 +127,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.1 +%global samba_version 4.23.2 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 1bea503..4af6c05 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.1.tar.xz) = d6e2863dc729b2c4feb337634ad80d9f8cb244455dbdb035f6d164ed722c07e507d2018d68221beada429d6e2c00aa36bfbfcc788e96e34225bb963beb2e017e -SHA512 (samba-4.23.1.tar.asc) = cea22d67e374b4350bd78e941ec60655b4176b7c24dc3514f476608f91c5806f1dc11aed66a237dec82ed31979eeeacac91f2191c3b9fe415920f762a0085118 +SHA512 (samba-4.23.2.tar.xz) = ffc9415d76244a199ef23cb39da7b97ec07b7fd061f84ba6185ac3a45e6b6942d0196945ac6d7e72f137787eafb2811220227c2c72a006fdfc903f90caa4673f +SHA512 (samba-4.23.2.tar.asc) = 775a8e321ea63193b027e6c2f351f9532b93cb6662571dc30bf2150624649afc425d3c9a0bfdea92ac093d25a1aee71d7ff6e4a47d44b2286074cf7ac6cdea98 From efaa5fdc6d2a13fc842f453c360f76a8f8ed587e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 20:08:17 +0100 Subject: [PATCH 17/32] Fix --with testsuite [skip changelog] --- samba.spec | 48 +++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 41 insertions(+), 7 deletions(-) diff --git a/samba.spec b/samba.spec index d6e2912..08d2cb9 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,17 @@ # or # rpmbuild --rebuild --with testsuite samba.src.rpm # +# If you just want to run a single test, you can use: +# fedpkg mockbuild --with testsuite -- --define 'SAMBA_TESTS regex' samba.src.rpm +# or +# rpmbuild --rebuild --with testsuite --define='SAMBA_TESTS regex' samba.src.rpm +# %bcond testsuite 0 +%if %{with testsuite} +# As the file list is empty for running just the tests, we have empty debuginfo +# package. Disable it to avoid error reporting. +%global debug_package %{nil} +%endif # Build with internal talloc, tevent, tdb # @@ -1328,6 +1338,13 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - # Make sure we do not build with heimdal code rm -rfv third_party/heimdal +%if %{with testsuite} +# WARNING: Don't change that for production! +# +# Shorten the priviliged dir, as unix sockets only have 108 chars +sed -i 's/#define WINBINDD_PRIV_SOCKET_SUBDIR.*/#define WINBINDD_PRIV_SOCKET_SUBDIR "wb_priv"/' nsswitch/winbind_struct_protocol.h +%endif + %build %if %{with includelibs} %global _talloc_lib ,talloc,pytalloc,pytalloc-util @@ -1619,20 +1636,37 @@ touch %{buildroot}%{_libexecdir}/ctdb/statd_callout # in the timestamp so the year 2038 problem is deferred till 2446. # https://bugzilla.samba.org/show_bug.cgi?id=14546 # -for t in samba3.smb2.timestamps.time_t_15032385535 \ - samba3.smb2.timestamps.time_t_10000000000 \ - samba3.smb2.timestamps.time_t_4294967295 \ - ; do - echo "^$t" >> selftest/knownfail.d/fedora.%{dist} -done -cat selftest/knownfail.d/fedora.%{dist} +if [ "$(df --portability --print-type "$(pwd)" | grep -c ext4)" == "1" ]; then + cat > selftest/knownfail.d/fedora%{dist} << EOF +^samba3.smb2.timestamps.time_t_15032385535 +^samba3.smb2.timestamps.time_t_10000000000 +^samba3.smb2.timestamps.time_t_4294967295 +EOF +fi + +echo +echo "Content of selftest/knownfail.d/fedora%{dist}:" +cat selftest/knownfail.d/fedora%{dist} || true + +cat >> selftest/skip << EOF +# FIXME: Investigate why it fails. Might be CUPS is not running? +^samba3.rpc.spoolss.printserver +EOF + +echo +echo "Content of selftest/skip:" +cat selftest/skip export TDB_NO_FSYNC=1 export NMBD_DONT_LOG_STDOUT=1 export SMBD_DONT_LOG_STDOUT=1 export WINBINDD_DONT_LOG_STDOUT=1 export SAMBA_DCERPCD_DONT_LOG_STDOUT=1 +%if "x%{?SAMBA_TESTS}" != "x" +%{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 TESTS="%{SAMBA_TESTS}" +%else %{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 +%endif #endif with testsuite %endif From 80c8f322115895534520fe5a4c6159ff629fe13a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 7 Nov 2025 16:41:40 +0100 Subject: [PATCH 18/32] Update to Samba 4.23.3 - resolves: #2413362 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 08d2cb9..25b8dbc 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.2 +%global samba_version 4.23.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 4af6c05..d966a50 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.2.tar.xz) = ffc9415d76244a199ef23cb39da7b97ec07b7fd061f84ba6185ac3a45e6b6942d0196945ac6d7e72f137787eafb2811220227c2c72a006fdfc903f90caa4673f -SHA512 (samba-4.23.2.tar.asc) = 775a8e321ea63193b027e6c2f351f9532b93cb6662571dc30bf2150624649afc425d3c9a0bfdea92ac093d25a1aee71d7ff6e4a47d44b2286074cf7ac6cdea98 +SHA512 (samba-4.23.3.tar.xz) = 5cb15c8eeda14dc4317b239864a4b7aa50b9c16a49ac9aefdc06ba6bde9b869fee2955eb21ed4620b73bb68682d368821869594fd106f3387e9ced9978483e7e +SHA512 (samba-4.23.3.tar.asc) = 27804ead26f8363d2a84b8ad37495a60b28c80b002e3c7420d434792c893355bd2652a8222825dbc877acbba65db18c4a648eaec218d69f275428b6f6d8a990e From 4af627337110534bd4de9e18adc758c2e7c1b093 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Nov 2025 13:20:07 +0100 Subject: [PATCH 19/32] Update gitignore [skip changelog] --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index a695288..47652a9 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,4 @@ /samba-*.tar.xz /samba-*.tar.asc +/*.rpm +/results_samba From fb14cf225b29844693fd6240ba590d7c77622d00 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Nov 2025 19:10:30 +0100 Subject: [PATCH 20/32] Add hint that we bundle ngtcp2 if not provided by the system --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 25b8dbc..789eb43 100644 --- a/samba.spec +++ b/samba.spec @@ -342,6 +342,8 @@ BuildRequires: pkgconfig(libsystemd) %if 0%{?fedora} >= 43 BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) +%else +Provides: bundled(ngtcp2) %endif %if %{with varlink} From 8c46386794df75e98db1520c6f03cc26e14e8c1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 12 Dec 2025 17:04:18 +0100 Subject: [PATCH 21/32] Update to Samba 4.23.4 - resolves: #2421764 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 789eb43..9b87190 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.3 +%global samba_version 4.23.4 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index d966a50..01648ec 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.3.tar.xz) = 5cb15c8eeda14dc4317b239864a4b7aa50b9c16a49ac9aefdc06ba6bde9b869fee2955eb21ed4620b73bb68682d368821869594fd106f3387e9ced9978483e7e -SHA512 (samba-4.23.3.tar.asc) = 27804ead26f8363d2a84b8ad37495a60b28c80b002e3c7420d434792c893355bd2652a8222825dbc877acbba65db18c4a648eaec218d69f275428b6f6d8a990e +SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac +SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce From a170fadc8dd6bcea5ed3839b6086643e43d06f71 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 12 Jan 2026 10:05:53 +0100 Subject: [PATCH 22/32] Do not redeclare cmocka functions This might cause issues when compiling with newer cmocka versions. --- samba-4.23-fix-cmocka.patch | 38 +++++++++++++++++++++++++++++++++++++ samba.spec | 2 ++ 2 files changed, 40 insertions(+) create mode 100644 samba-4.23-fix-cmocka.patch diff --git a/samba-4.23-fix-cmocka.patch b/samba-4.23-fix-cmocka.patch new file mode 100644 index 0000000..26289d6 --- /dev/null +++ b/samba-4.23-fix-cmocka.patch @@ -0,0 +1,38 @@ +From b1ec803f420b2c6d3c5c83d70c6875a7f36b15fc Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 21 Nov 2025 15:33:32 +0100 +Subject: [PATCH] s4:dsdb: Do not declare cm_print_error() + +This is part of the cmocka.h header file. + +Signed-off-by: Andreas Schneider +Reviewed-by: Martin Schwenke +Reviewed-by: Volker Lendecke + +Autobuild-User(master): Volker Lendecke +Autobuild-Date(master): Mon Nov 24 11:28:08 UTC 2025 on atb-devel-224 + +(cherry picked from commit 5a981663e4f677042ba80191770100aecff2120a) +--- + source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c +index f7075f3485e..12c464b49c7 100644 +--- a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c ++++ b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c +@@ -103,11 +103,6 @@ void audit_message_send( + + #define check_group_change_message(m, u, a, e) \ + _check_group_change_message(m, u, a, e, __FILE__, __LINE__); +-/* +- * declare the internal cmocka cm_print_error so that we can output messages +- * in sub unit format +- */ +-void cm_print_error(const char * const format, ...); + + /* + * Validate a group change JSON audit message +-- +2.52.0 + diff --git a/samba.spec b/samba.spec index 9b87190..2e3fe75 100644 --- a/samba.spec +++ b/samba.spec @@ -239,6 +239,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.23-fix-cmocka.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From 4a23ce5b7a021fac72e887bf4f71f843b150c987 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 08:01:17 +0100 Subject: [PATCH 23/32] Remove unneeded dependency to samba-common-libs --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index 2e3fe75..647fc92 100644 --- a/samba.spec +++ b/samba.spec @@ -1264,7 +1264,6 @@ License: LGPL-3.0-or-later Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} -Requires: samba-common-libs = %{samba_depver} # /endif without includelibs %endif From b8395d93a751e2417fd1dd28e5cc09501ac2bb24 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 10:53:10 +0100 Subject: [PATCH 24/32] Create a core-libs sub-package to split up library dependencies --- samba.spec | 135 +++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 100 insertions(+), 35 deletions(-) diff --git a/samba.spec b/samba.spec index 647fc92..c72ba68 100644 --- a/samba.spec +++ b/samba.spec @@ -488,12 +488,26 @@ The %{name}-client package provides some SMB/CIFS clients to complement the built-in SMB/CIFS filesystem in Linux. These clients allow access of SMB/CIFS shares and printing to SMB/CIFS printers. +### CORE-LIBS +%package core-libs +Summary: Samba core libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} + +Provides: bundled(libreplace) = %{samba_depver} + +%description core-libs +The samba-core-libs package contains foundational libraries needed by +both Samba servers and clients. This includes error handling, utilities, +and NDR serialization support. + ### CLIENT-LIBS %package client-libs Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -528,7 +542,7 @@ packages of Samba. Summary: Libraries used by both Samba servers and clients Requires(pre): samba-common = %{samba_depver} Requires: samba-common = %{samba_depver} -Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -890,7 +904,7 @@ suite. %if %{with libwbclient} %package -n libwbclient Summary: The winbind client library -Requires: %{name}-client-libs = %{samba_depver} +# libwbclient.so only links to libc - no samba library dependencies needed Conflicts: sssd-libwbclient %description -n libwbclient @@ -2009,6 +2023,45 @@ fi #endif with includelibs %endif +### CORE-LIBS +%files core-libs +%dir %{_libdir}/samba + +# +# Tier 0: Private libraries - libc only dependencies +# +%{_libdir}/samba/libreplace-private-samba.so +%{_libdir}/samba/libsocket-blocking-private-samba.so +%{_libdir}/samba/libsys-rw-private-samba.so +%{_libdir}/samba/libtime-basic-private-samba.so + +# +# Tier 1: Private libraries - system libs (libtalloc, libsystemd) +# +%{_libdir}/samba/libsamba-debug-private-samba.so +%{_libdir}/samba/libserver-role-private-samba.so + +# +# Tier 1: Public libraries - system libs (libtalloc) +# +%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* + +# +# Tier 2: Private libraries - adds gnutls +# +%{_libdir}/samba/libgenrand-private-samba.so + +# +# Tier 2: Public libraries - adds gnutls, icu, tevent +# +%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* +%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* + +# +# Tier 3: Public libraries - NDR serialization (depends on Tier 1-2) +# +%{_libdir}/libndr.so.%{libndr_so_version}* + ### CLIENT-LIBS %files client-libs %{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}* @@ -2017,18 +2070,12 @@ fi %{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* %{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* %{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* -%{_libdir}/libndr.so.%{libndr_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* -%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* %{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}* -%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* %{_libdir}/libsamdb.so.%{libsamdb_so_version}* %{_libdir}/libsmbconf.so.%{libsmbconf_so_version}* %{_libdir}/libsmbldap.so.%{libsmbldap_so_version}* -%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* - -%dir %{_libdir}/samba %{_libdir}/samba/libCHARSET3-private-samba.so %{_libdir}/samba/libMESSAGING-SEND-private-samba.so %{_libdir}/samba/libMESSAGING-private-samba.so @@ -2049,19 +2096,14 @@ fi %{_libdir}/samba/libcmdline-contexts-private-samba.so %{_libdir}/samba/libcommon-auth-private-samba.so %{_libdir}/samba/libctdb-event-client-private-samba.so -%{_libdir}/samba/libdbwrap-private-samba.so %{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so %{_libdir}/samba/libdcerpc-samba-private-samba.so %{_libdir}/samba/libevents-private-samba.so -%{_libdir}/samba/libflag-mapping-private-samba.so -%{_libdir}/samba/libgenrand-private-samba.so %{_libdir}/samba/libgensec-private-samba.so %{_libdir}/samba/libgpext-private-samba.so %{_libdir}/samba/libgpo-private-samba.so %{_libdir}/samba/libgse-private-samba.so %{_libdir}/samba/libhttp-private-samba.so -%{_libdir}/samba/libinterfaces-private-samba.so -%{_libdir}/samba/libiov-buf-private-samba.so %{_libdir}/samba/libkrb5samba-private-samba.so %{_libdir}/samba/libldbsamba-private-samba.so %{_libdir}/samba/liblibcli-lsa3-private-samba.so @@ -2087,32 +2129,32 @@ fi %{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so -%{_libdir}/samba/libsamba-debug-private-samba.so %{_libdir}/samba/libsamba-modules-private-samba.so -%{_libdir}/samba/libsamba-security-private-samba.so %{_libdir}/samba/libsamba-security-trusts-private-samba.so %{_libdir}/samba/libsamba-sockets-private-samba.so -%{_libdir}/samba/libsamba3-util-private-samba.so %{_libdir}/samba/libsamdb-common-private-samba.so %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so -%{_libdir}/samba/libserver-role-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so %{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so %{_libdir}/samba/libsmbldaphelper-private-samba.so -%{_libdir}/samba/libstable-sort-private-samba.so -%{_libdir}/samba/libsys-rw-private-samba.so -%{_libdir}/samba/libsocket-blocking-private-samba.so -%{_libdir}/samba/libtalloc-report-printf-private-samba.so -%{_libdir}/samba/libtalloc-report-private-samba.so -%{_libdir}/samba/libtdb-wrap-private-samba.so -%{_libdir}/samba/libtime-basic-private-samba.so %{_libdir}/samba/libtorture-private-samba.so %{_libdir}/samba/libutil-crypt-private-samba.so -%{_libdir}/samba/libutil-reg-private-samba.so -%{_libdir}/samba/libutil-setid-private-samba.so -%{_libdir}/samba/libutil-tdb-private-samba.so + +# +# Command line library +# +%{_libdir}/samba/libcmdline-private-samba.so + +# +# Password database modules (depend on libsamba-passdb) +# +%dir %{_libdir}/samba/ldb +%dir %{_libdir}/samba/pdb +%{_libdir}/samba/pdb/ldapsam.so +%{_libdir}/samba/pdb/smbpasswd.so +%{_libdir}/samba/pdb/tdbsam.so %if %{without libwbclient} %{_libdir}/samba/libwbclient.so.* @@ -2165,16 +2207,39 @@ fi ### COMMON-LIBS %files common-libs -# common libraries -%{_libdir}/samba/libcmdline-private-samba.so -%{_libdir}/samba/libreplace-private-samba.so -%dir %{_libdir}/samba/ldb +# +# Tier 0: libc only dependencies +# +%{_libdir}/samba/libutil-setid-private-samba.so +%{_libdir}/samba/libutil-tdb-private-samba.so -%dir %{_libdir}/samba/pdb -%{_libdir}/samba/pdb/ldapsam.so -%{_libdir}/samba/pdb/smbpasswd.so -%{_libdir}/samba/pdb/tdbsam.so +# +# Tier 1: system libs only (libtalloc) +# +%{_libdir}/samba/libiov-buf-private-samba.so +%{_libdir}/samba/libstable-sort-private-samba.so +%{_libdir}/samba/libtalloc-report-private-samba.so +%{_libdir}/samba/libtalloc-report-printf-private-samba.so + +# +# Tier 2: depends on core-libs (debug, replace) +# +%{_libdir}/samba/libflag-mapping-private-samba.so +%{_libdir}/samba/libinterfaces-private-samba.so +%{_libdir}/samba/libtdb-wrap-private-samba.so + +# +# Tier 3: depends on core-libs (util, errors, ndr) +# +%{_libdir}/samba/libdbwrap-private-samba.so +%{_libdir}/samba/libsamba3-util-private-samba.so +%{_libdir}/samba/libutil-reg-private-samba.so + +# +# Tier 4: depends on core-libs + Tier 3 libs +# +%{_libdir}/samba/libsamba-security-private-samba.so ### COMMON-TOOLS %files common-tools From fcd8668e55e701de2421c6b27425a4c942673bd7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 11:24:56 +0100 Subject: [PATCH 25/32] Add gating test to detect dependency changes in samba libraries [skip changelog] --- gating.yaml | 6 ++ tests/deps-check.fmf | 13 +++++ tests/deps-check.sh | 133 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 152 insertions(+) create mode 100644 gating.yaml create mode 100644 tests/deps-check.fmf create mode 100755 tests/deps-check.sh diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..c2182c7 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,6 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf new file mode 100644 index 0000000..878b8b2 --- /dev/null +++ b/tests/deps-check.fmf @@ -0,0 +1,13 @@ +summary: Check samba package dependency structure +description: | + Verify that samba library packages maintain correct dependency hierarchy: + - samba-core-libs has no samba-*-libs dependencies + - samba-common-libs depends on samba-core-libs (not samba-client-libs) + - libwbclient has no samba-*-libs dependencies +test: ./deps-check.sh +framework: shell +require: + - samba-core-libs + - samba-common-libs + - samba-client-libs + - libwbclient diff --git a/tests/deps-check.sh b/tests/deps-check.sh new file mode 100755 index 0000000..622e88a --- /dev/null +++ b/tests/deps-check.sh @@ -0,0 +1,133 @@ +#!/bin/bash +# +# Samba package dependency structure verification +# +# This test ensures that the samba library package dependencies don't regress. +# The expected hierarchy is: +# +# samba-core-libs (no samba-*-libs dependencies) +# ^ +# | +# samba-common-libs (depends on samba-core-libs only) +# ^ +# | +# samba-client-libs (depends on samba-core-libs + samba-common-libs) +# +# libwbclient (no samba-*-libs dependencies - only links to libc) +# +# NOTE: This test checks RESOLVED dependencies, not just explicit Requires. +# A library requirement like 'libfoo.so' is resolved to the package that +# provides it, ensuring we catch indirect dependencies. +# + +set -e + +ERRORS=0 + +# Get all packages that a package depends on (resolved) +# This resolves library deps like 'libfoo.so' to actual package names +get_resolved_deps() { + local pkg="$1" + + rpm -qR "$pkg" 2>/dev/null | while read -r req; do + # Skip rpmlib and config requirements + [[ "$req" =~ ^rpmlib ]] && continue + [[ "$req" =~ ^config ]] && continue + [[ "$req" =~ ^/ ]] && continue + + # Get the package that provides this requirement + provider=$(rpm -q --whatprovides "$req" 2>/dev/null | head -1) + if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then + # Extract just the package name (remove version-release.arch) + echo "${provider%%-[0-9]*}" + fi + done | sort -u +} + +# Check that a package does NOT depend on packages matching a pattern +# This checks RESOLVED dependencies (what packages actually get pulled in) +check_no_resolved_dep() { + local pkg="$1" + local pattern="$2" + local description="$3" + + if ! rpm -q "$pkg" &>/dev/null; then + echo "SKIP: $pkg not installed" + return 0 + fi + + local bad_deps + # Exclude the package itself from the check + bad_deps=$(get_resolved_deps "$pkg" | grep -v "^${pkg}$" | grep -E "$pattern" || true) + + if [ -n "$bad_deps" ]; then + echo "FAIL: $pkg depends on $description" + echo " Found: $bad_deps" + ERRORS=$((ERRORS + 1)) + return 1 + fi + echo "PASS: $pkg does not depend on $description" + return 0 +} + +# Check that a package DOES depend on a specific package +check_has_resolved_dep() { + local pkg="$1" + local expected="$2" + + if ! rpm -q "$pkg" &>/dev/null; then + echo "SKIP: $pkg not installed" + return 0 + fi + + if get_resolved_deps "$pkg" | grep -qF "$expected"; then + echo "PASS: $pkg depends on $expected" + return 0 + fi + echo "FAIL: $pkg does not depend on $expected" + ERRORS=$((ERRORS + 1)) + return 1 +} + +echo "=== Samba Package Dependency Checks ===" +echo "" +echo "Checking resolved dependencies (library deps resolved to packages)" +echo "" + +# 1. samba-core-libs must NOT depend on any samba-*-libs packages +echo "--- samba-core-libs ---" +check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba-*-libs package" + +echo "" + +# 2. samba-common-libs must depend on samba-core-libs +# but NOT samba-client-libs +echo "--- samba-common-libs ---" +check_has_resolved_dep samba-common-libs "samba-core-libs" +check_no_resolved_dep samba-common-libs "^samba-client-libs$" "samba-client-libs" + +echo "" + +# 3. samba-client-libs must depend on samba-core-libs and samba-common-libs +# but NOT samba-libs +echo "--- samba-client-libs ---" +check_has_resolved_dep samba-client-libs "samba-core-libs" +check_has_resolved_dep samba-client-libs "samba-common-libs" +check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs" + +echo "" + +# 4. libwbclient must NOT depend on any samba-*-libs packages +echo "--- libwbclient ---" +check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" + +echo "" +echo "=== Summary ===" + +if [ $ERRORS -gt 0 ]; then + echo "FAILED: $ERRORS dependency check(s) failed" + exit 1 +fi + +echo "All dependency checks passed" +exit 0 From baa9e6f8c0c9594e05f953d54cf2e8fd720404c6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 12:23:39 +0100 Subject: [PATCH 26/32] Move libraries from samba-client-libs to samba-libs --- samba.spec | 30 +++++++++++++++++------------- tests/deps-check.fmf | 7 +++++++ tests/deps-check.sh | 26 ++++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 13 deletions(-) diff --git a/samba.spec b/samba.spec index c72ba68..ccb55fc 100644 --- a/samba.spec +++ b/samba.spec @@ -2078,11 +2078,9 @@ fi %{_libdir}/libsmbldap.so.%{libsmbldap_so_version}* %{_libdir}/samba/libCHARSET3-private-samba.so %{_libdir}/samba/libMESSAGING-SEND-private-samba.so -%{_libdir}/samba/libMESSAGING-private-samba.so %{_libdir}/samba/libaddns-private-samba.so %{_libdir}/samba/libads-private-samba.so %{_libdir}/samba/libasn1util-private-samba.so -%{_libdir}/samba/libauth-private-samba.so %{_libdir}/samba/libauthkrb5-private-samba.so %{_libdir}/samba/libcli-cldap-private-samba.so %{_libdir}/samba/libcli-ldap-common-private-samba.so @@ -2095,13 +2093,10 @@ fi %{_libdir}/samba/libcluster-private-samba.so %{_libdir}/samba/libcmdline-contexts-private-samba.so %{_libdir}/samba/libcommon-auth-private-samba.so -%{_libdir}/samba/libctdb-event-client-private-samba.so %{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so %{_libdir}/samba/libdcerpc-samba-private-samba.so %{_libdir}/samba/libevents-private-samba.so %{_libdir}/samba/libgensec-private-samba.so -%{_libdir}/samba/libgpext-private-samba.so -%{_libdir}/samba/libgpo-private-samba.so %{_libdir}/samba/libgse-private-samba.so %{_libdir}/samba/libhttp-private-samba.so %{_libdir}/samba/libkrb5samba-private-samba.so @@ -2116,16 +2111,12 @@ fi %{_libdir}/samba/libmsrpc3-private-samba.so %{_libdir}/samba/libndr-samba-private-samba.so %{_libdir}/samba/libndr-samba4-private-samba.so -%{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so %if 0%{?rhel} %{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so %{_libdir}/samba/libngtcp2-private-samba.so %endif %{_libdir}/samba/libnpa-tstream-private-samba.so -%{_libdir}/samba/libposix-eadb-private-samba.so -%{_libdir}/samba/libprinter-driver-private-samba.so -%{_libdir}/samba/libprinting-migrate-private-samba.so %{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so @@ -2136,11 +2127,7 @@ fi %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so -%{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so -%{_libdir}/samba/libsmbldaphelper-private-samba.so -%{_libdir}/samba/libtorture-private-samba.so -%{_libdir}/samba/libutil-crypt-private-samba.so # # Command line library @@ -2597,6 +2584,23 @@ fi %{_libdir}/samba/libRPC-SERVER-LOOP-private-samba.so %{_libdir}/samba/libRPC-WORKER-private-samba.so +# +# Server-side libraries (not used by libsmbclient) +# +%{_libdir}/samba/libauth-private-samba.so +%{_libdir}/samba/libctdb-event-client-private-samba.so +%{_libdir}/samba/libgpext-private-samba.so +%{_libdir}/samba/libgpo-private-samba.so +%{_libdir}/samba/libMESSAGING-private-samba.so +%{_libdir}/samba/libnet-keytab-private-samba.so +%{_libdir}/samba/libposix-eadb-private-samba.so +%{_libdir}/samba/libprinter-driver-private-samba.so +%{_libdir}/samba/libprinting-migrate-private-samba.so +%{_libdir}/samba/libsmbd-base-private-samba.so +%{_libdir}/samba/libsmbldaphelper-private-samba.so +%{_libdir}/samba/libtorture-private-samba.so +%{_libdir}/samba/libutil-crypt-private-samba.so + ### LIBNETAPI %files -n libnetapi %{_libdir}/libnetapi.so.%{libnetapi_so_version}* diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf index 878b8b2..959093e 100644 --- a/tests/deps-check.fmf +++ b/tests/deps-check.fmf @@ -3,11 +3,18 @@ description: | Verify that samba library packages maintain correct dependency hierarchy: - samba-core-libs has no samba-*-libs dependencies - samba-common-libs depends on samba-core-libs (not samba-client-libs) + - samba-client-libs depends on core-libs + common-libs (not samba-libs) - libwbclient has no samba-*-libs dependencies + - samba-client depends on samba-client-libs (not samba-libs) + - libsmbclient depends on samba-client-libs (not samba-libs) + - libldb has no samba-*-libs dependencies test: ./deps-check.sh framework: shell require: - samba-core-libs - samba-common-libs - samba-client-libs + - samba-client - libwbclient + - libsmbclient + - libldb diff --git a/tests/deps-check.sh b/tests/deps-check.sh index 622e88a..017c01d 100755 --- a/tests/deps-check.sh +++ b/tests/deps-check.sh @@ -15,6 +15,9 @@ # # libwbclient (no samba-*-libs dependencies - only links to libc) # +# samba-client (depends on samba-client-libs, NOT samba-libs) +# libsmbclient (depends on samba-client-libs, NOT samba-libs) +# # NOTE: This test checks RESOLVED dependencies, not just explicit Requires. # A library requirement like 'libfoo.so' is resolved to the package that # provides it, ensuring we catch indirect dependencies. @@ -121,6 +124,29 @@ echo "" echo "--- libwbclient ---" check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" +echo "" + +# 5. samba-client must depend on samba-client-libs but NOT samba-libs +# (client tools should not pull in server libraries) +echo "--- samba-client ---" +check_has_resolved_dep samba-client "samba-client-libs" +check_no_resolved_dep samba-client "^samba-libs$" "samba-libs" + +echo "" + +# 6. libsmbclient must depend on samba-client-libs but NOT samba-libs +# (SMB client library should not pull in server libraries) +echo "--- libsmbclient ---" +check_has_resolved_dep libsmbclient "samba-client-libs" +check_no_resolved_dep libsmbclient "^samba-libs$" "samba-libs" + +echo "" + +# 7. libldb must NOT depend on any samba-*-libs packages +# (libldb is a standalone database library) +echo "--- libldb ---" +check_no_resolved_dep libldb "^samba-.*-libs$" "any samba-*-libs package" + echo "" echo "=== Summary ===" From dab569ad7194d1c3a2b51e50df08b20fdb00ce60 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 12:46:37 +0100 Subject: [PATCH 27/32] Create a samba-ndr-libs package and drop samba-common-libs This should help sssd to reduce some of its dependencies. --- samba.spec | 216 ++++++++++++++++++++++--------------------- tests/deps-check.fmf | 10 +- tests/deps-check.sh | 40 ++++---- 3 files changed, 141 insertions(+), 125 deletions(-) diff --git a/samba.spec b/samba.spec index ccb55fc..da855ba 100644 --- a/samba.spec +++ b/samba.spec @@ -243,7 +243,7 @@ Patch0: samba-4.23-fix-cmocka.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -465,7 +465,7 @@ Unix. Summary: Samba client programs Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libsmbclient} @@ -496,18 +496,54 @@ Requires: %{name}-common = %{samba_depver} Provides: bundled(libreplace) = %{samba_depver} +%if %{without dc} && %{without testsuite} +Obsoletes: samba-dc < %{samba_depver} +Obsoletes: samba-dc-libs < %{samba_depver} +Obsoletes: samba-dc-bind-dlz < %{samba_depver} +%endif + +# ctdb-tests package has been dropped if we do not build the testsuite +%if %{with clustering} +%if %{without testsuite} +Obsoletes: ctdb-tests < %{samba_depver} +Obsoletes: ctdb-tests-debuginfo < %{samba_depver} +# endif without testsuite +%endif +# endif with clustering +%endif + +# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions +# of the distro +%if %{without vfs_glusterfs} +Obsoletes: samba-vfs-glusterfs < %{samba_depver} +# endif without vfs_glusterfs +%endif + %description core-libs The samba-core-libs package contains foundational libraries needed by both Samba servers and clients. This includes error handling, utilities, -and NDR serialization support. +and basic support libraries. + +### NDR-LIBS +%package ndr-libs +Summary: Samba NDR libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} + +Provides: %{name}-common-libs = %{samba_depver} +Obsoletes: %{name}-common-libs < %{samba_depver} + +%description ndr-libs +The samba-ndr-libs package contains NDR (Network Data Representation) +encoding libraries used by both Samba servers and clients. ### CLIENT-LIBS %package client-libs Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -537,50 +573,10 @@ Obsoletes: samba4-common < %{samba_depver} samba-common provides files necessary for both the server and client packages of Samba. -### COMMON-LIBS -%package common-libs -Summary: Libraries used by both Samba servers and clients -Requires(pre): samba-common = %{samba_depver} -Requires: samba-common = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} -Requires: libldb = %{samba_depver} -%if %{with libwbclient} -Requires: libwbclient = %{samba_depver} -%endif - -Provides: bundled(libreplace) = %{samba_depver} - -%if %{without dc} && %{without testsuite} -Obsoletes: samba-dc < %{samba_depver} -Obsoletes: samba-dc-libs < %{samba_depver} -Obsoletes: samba-dc-bind-dlz < %{samba_depver} -%endif - -# ctdb-tests package has been dropped if we do not build the testsuite -%if %{with clustering} -%if %{without testsuite} -Obsoletes: ctdb-tests < %{samba_depver} -Obsoletes: ctdb-tests-debuginfo < %{samba_depver} -# endif without testsuite -%endif -# endif with clustering -%endif - -# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions -# of the distro -%if %{without vfs_glusterfs} -Obsoletes: samba-vfs-glusterfs < %{samba_depver} -# endif without vfs_glusterfs -%endif - -%description common-libs -The samba-common-libs package contains internal libraries needed by the -SMB/CIFS clients. - ### COMMON-TOOLS %package common-tools Summary: Tools for Samba clients -Requires: samba-common-libs = %{samba_depver} +Requires: samba-ndr-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: samba-ldb-ldap-modules = %{samba_depver} @@ -618,7 +614,7 @@ and for GPO management on domain members. ### RPC %package dcerpc Summary: DCE RPC binaries -Requires: samba-common-libs = %{samba_depver} +Requires: samba-ndr-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -636,7 +632,7 @@ The samba-dcerpc package contains binaries that serve DCERPC over named pipes. Summary: Samba AD Domain Controller Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-tools = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -680,7 +676,7 @@ The samba-dc-provision package provides files to setup a domain controller %package dc-libs Summary: Samba AD Domain Controller Libraries Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -718,8 +714,10 @@ name server related details of Samba AD. ### DEVEL %package devel Summary: Developer tools for Samba libraries -Requires: %{name}-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} +Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: libnetapi = %{samba_depver} @@ -774,7 +772,7 @@ Summary: Samba VFS module for GlusterFS Requires: glusterfs-api >= 3.4.0.16 Requires: glusterfs >= 3.4.0.16 Requires: %{name} = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -825,7 +823,7 @@ the Kerberos credentials cache of the user issuing the print job. %package ldb-ldap-modules Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -836,7 +834,7 @@ samba-gpupdate. ### LIBS %package libs Summary: Samba libraries -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} @@ -857,7 +855,7 @@ against the SMB, RPC and other protocols provided by the Samba suite. Summary: The NETAPI library Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -879,7 +877,7 @@ develop programs that link against the NETAPI library in the Samba suite. Summary: The SMB client library Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} @@ -929,7 +927,7 @@ library. %package -n python3-%{name} Summary: Samba Python3 libraries Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-cryptography @@ -999,7 +997,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-test-libs = %{samba_depver} @@ -1030,7 +1028,7 @@ packages of Samba. ### TEST-LIBS %package test-libs Summary: Libraries need by the testing tools for Samba servers and clients -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -1063,8 +1061,8 @@ as a user using the `net usershare` command. Summary: Samba winbind Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} -Requires(post): %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} +Requires(post): %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires(post): %{name}-client-libs = %{samba_depver} @@ -1097,7 +1095,7 @@ Windows user and group accounts on Linux. %package winbind-clients Summary: Samba winbind clients Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} @@ -1167,7 +1165,7 @@ necessary to communicate to the Winbind Daemon Summary: Samba Winexe Windows Binary License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -1182,7 +1180,7 @@ Winexe is a Remote Windows-command executor %package -n ctdb Summary: A Clustered Database based on Samba's Trivial Database (TDB) -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-winbind-clients = %{samba_depver} @@ -1729,7 +1727,7 @@ fi %ldconfig_scriptlets client-libs -%ldconfig_scriptlets common-libs +%ldconfig_scriptlets ndr-libs %if %{with dc} %ldconfig_scriptlets dc-libs @@ -2057,19 +2055,59 @@ fi %{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* %{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* +### NDR-LIBS +%files ndr-libs + # -# Tier 3: Public libraries - NDR serialization (depends on Tier 1-2) +# Core NDR library # %{_libdir}/libndr.so.%{libndr_so_version}* +# +# Tier 0: libc only dependencies +# +%{_libdir}/samba/libutil-setid-private-samba.so +%{_libdir}/samba/libutil-tdb-private-samba.so + +# +# Tier 1: system libs only (libtalloc) +# +%{_libdir}/samba/libiov-buf-private-samba.so +%{_libdir}/samba/libstable-sort-private-samba.so +%{_libdir}/samba/libtalloc-report-private-samba.so +%{_libdir}/samba/libtalloc-report-printf-private-samba.so + +# +# Tier 2: depends on core-libs (debug, replace) +# +%{_libdir}/samba/libflag-mapping-private-samba.so +%{_libdir}/samba/libinterfaces-private-samba.so +%{_libdir}/samba/libtdb-wrap-private-samba.so + +# +# Tier 3: depends on core-libs (util, errors, ndr) +# +%{_libdir}/samba/libdbwrap-private-samba.so +%{_libdir}/samba/libsamba3-util-private-samba.so +%{_libdir}/samba/libutil-reg-private-samba.so + +# +# Tier 4: depends on core-libs + Tier 3 libs +# +%{_libdir}/samba/libsamba-security-private-samba.so + +# +# NDR encoding libraries +# +%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* +%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* +%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* + ### CLIENT-LIBS %files client-libs %{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}* %{_libdir}/libdcerpc-server-core.so.%{libdcerpc_server_core_so_version}* %{_libdir}/libdcerpc.so.%{libdcerpc_so_version}* -%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* -%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* -%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* %{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}* @@ -2139,7 +2177,6 @@ fi # %dir %{_libdir}/samba/ldb %dir %{_libdir}/samba/pdb -%{_libdir}/samba/pdb/ldapsam.so %{_libdir}/samba/pdb/smbpasswd.so %{_libdir}/samba/pdb/tdbsam.so @@ -2192,42 +2229,6 @@ fi %{_mandir}/man5/smbpasswd.5* %{_mandir}/man7/samba.7* -### COMMON-LIBS -%files common-libs - -# -# Tier 0: libc only dependencies -# -%{_libdir}/samba/libutil-setid-private-samba.so -%{_libdir}/samba/libutil-tdb-private-samba.so - -# -# Tier 1: system libs only (libtalloc) -# -%{_libdir}/samba/libiov-buf-private-samba.so -%{_libdir}/samba/libstable-sort-private-samba.so -%{_libdir}/samba/libtalloc-report-private-samba.so -%{_libdir}/samba/libtalloc-report-printf-private-samba.so - -# -# Tier 2: depends on core-libs (debug, replace) -# -%{_libdir}/samba/libflag-mapping-private-samba.so -%{_libdir}/samba/libinterfaces-private-samba.so -%{_libdir}/samba/libtdb-wrap-private-samba.so - -# -# Tier 3: depends on core-libs (util, errors, ndr) -# -%{_libdir}/samba/libdbwrap-private-samba.so -%{_libdir}/samba/libsamba3-util-private-samba.so -%{_libdir}/samba/libutil-reg-private-samba.so - -# -# Tier 4: depends on core-libs + Tier 3 libs -# -%{_libdir}/samba/libsamba-security-private-samba.so - ### COMMON-TOOLS %files common-tools %{_bindir}/net @@ -2601,6 +2602,11 @@ fi %{_libdir}/samba/libtorture-private-samba.so %{_libdir}/samba/libutil-crypt-private-samba.so +# +# Password database modules (server-side, links to libsmbldaphelper) +# +%{_libdir}/samba/pdb/ldapsam.so + ### LIBNETAPI %files -n libnetapi %{_libdir}/libnetapi.so.%{libnetapi_so_version}* diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf index 959093e..c1452d0 100644 --- a/tests/deps-check.fmf +++ b/tests/deps-check.fmf @@ -2,18 +2,20 @@ summary: Check samba package dependency structure description: | Verify that samba library packages maintain correct dependency hierarchy: - samba-core-libs has no samba-*-libs dependencies - - samba-common-libs depends on samba-core-libs (not samba-client-libs) - - samba-client-libs depends on core-libs + common-libs (not samba-libs) - - libwbclient has no samba-*-libs dependencies + - samba-ndr-libs depends on samba-core-libs (not samba-client-libs or samba-libs) + - samba-client-libs depends on core-libs + ndr-libs (not samba-libs) - samba-client depends on samba-client-libs (not samba-libs) + - samba-libs does not depend on samba-dc-libs - libsmbclient depends on samba-client-libs (not samba-libs) + - libwbclient has no samba-*-libs dependencies - libldb has no samba-*-libs dependencies test: ./deps-check.sh framework: shell require: - samba-core-libs - - samba-common-libs + - samba-ndr-libs - samba-client-libs + - samba-libs - samba-client - libwbclient - libsmbclient diff --git a/tests/deps-check.sh b/tests/deps-check.sh index 017c01d..ce49074 100755 --- a/tests/deps-check.sh +++ b/tests/deps-check.sh @@ -8,10 +8,10 @@ # samba-core-libs (no samba-*-libs dependencies) # ^ # | -# samba-common-libs (depends on samba-core-libs only) +# samba-ndr-libs (depends on samba-core-libs only) # ^ # | -# samba-client-libs (depends on samba-core-libs + samba-common-libs) +# samba-client-libs (depends on samba-core-libs + samba-ndr-libs) # # libwbclient (no samba-*-libs dependencies - only links to libc) # @@ -32,14 +32,14 @@ ERRORS=0 get_resolved_deps() { local pkg="$1" - rpm -qR "$pkg" 2>/dev/null | while read -r req; do + rpm --query --requires "$pkg" 2>/dev/null | while read -r req; do # Skip rpmlib and config requirements [[ "$req" =~ ^rpmlib ]] && continue [[ "$req" =~ ^config ]] && continue [[ "$req" =~ ^/ ]] && continue # Get the package that provides this requirement - provider=$(rpm -q --whatprovides "$req" 2>/dev/null | head -1) + provider=$(rpm --query --whatprovides "$req" 2>/dev/null | head -1) if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then # Extract just the package name (remove version-release.arch) echo "${provider%%-[0-9]*}" @@ -54,7 +54,7 @@ check_no_resolved_dep() { local pattern="$2" local description="$3" - if ! rpm -q "$pkg" &>/dev/null; then + if ! rpm --query "$pkg" &>/dev/null; then echo "SKIP: $pkg not installed" return 0 fi @@ -78,7 +78,7 @@ check_has_resolved_dep() { local pkg="$1" local expected="$2" - if ! rpm -q "$pkg" &>/dev/null; then + if ! rpm --query "$pkg" &>/dev/null; then echo "SKIP: $pkg not installed" return 0 fi @@ -99,30 +99,31 @@ echo "" # 1. samba-core-libs must NOT depend on any samba-*-libs packages echo "--- samba-core-libs ---" -check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba*-libs package" echo "" -# 2. samba-common-libs must depend on samba-core-libs -# but NOT samba-client-libs -echo "--- samba-common-libs ---" -check_has_resolved_dep samba-common-libs "samba-core-libs" -check_no_resolved_dep samba-common-libs "^samba-client-libs$" "samba-client-libs" +# 2. samba-ndr-libs must depend on samba-core-libs +# but NOT samba-client-libs or samba-libs +echo "--- samba-ndr-libs ---" +check_has_resolved_dep samba-ndr-libs "samba-core-libs" +check_no_resolved_dep samba-ndr-libs "^samba-client-libs$" "samba-client-libs" +check_no_resolved_dep samba-ndr-libs "^samba-libs$" "samba-libs" echo "" -# 3. samba-client-libs must depend on samba-core-libs and samba-common-libs +# 3. samba-client-libs must depend on samba-core-libs and samba-ndr-libs # but NOT samba-libs echo "--- samba-client-libs ---" check_has_resolved_dep samba-client-libs "samba-core-libs" -check_has_resolved_dep samba-client-libs "samba-common-libs" +check_has_resolved_dep samba-client-libs "samba-ndr-libs" check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs" echo "" # 4. libwbclient must NOT depend on any samba-*-libs packages echo "--- libwbclient ---" -check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba*-libs package" echo "" @@ -145,7 +146,14 @@ echo "" # 7. libldb must NOT depend on any samba-*-libs packages # (libldb is a standalone database library) echo "--- libldb ---" -check_no_resolved_dep libldb "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep libldb "^samba-.*-libs$" "any samba*-libs package" + +echo "" + +# 8. samba-libs must NOT depend on samba-dc-libs +# (server libraries should not pull in DC-specific libraries) +echo "--- samba-libs ---" +check_no_resolved_dep samba-libs "^samba-dc-libs$" "samba-dc-libs" echo "" echo "=== Summary ===" From da7dc3fa610fd20c6e5a2776fc3bec213c1163b6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 14:28:18 +0100 Subject: [PATCH 28/32] Add missing tmt files [skip changelog] --- .fmf/version | 1 + plans.fmf | 4 ++++ 2 files changed, 5 insertions(+) create mode 100644 .fmf/version create mode 100644 plans.fmf diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..e6427de --- /dev/null +++ b/plans.fmf @@ -0,0 +1,4 @@ +discover: + how: fmf +execute: + how: tmt From 6af45b81d32d8b941a8bfcadc8cf302ad2bbdd0b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:11:15 +0100 Subject: [PATCH 29/32] Add /usr/bin/nmbd to rpminspect.yml /usr/sbin/nmbd is a symlink to /usr/bin/nmbd on Fedora. [skip changelog] --- rpminspect.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index c1455e2..b30fdbe 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -4,6 +4,7 @@ inspections: badfuncs: ignore: + - /usr/bin/nmbd - /usr/bin/nmblookup - /usr/bin/smbtorture - /usr/lib*/libndr.so.* From dca7b1cb88abf129b7f421b1b867d5eb068de56e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:35:54 +0100 Subject: [PATCH 30/32] Move Obsoletes to ndr-package which more or less was common-libs [skip changelog] --- samba.spec | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/samba.spec b/samba.spec index da855ba..cdeefca 100644 --- a/samba.spec +++ b/samba.spec @@ -496,6 +496,21 @@ Requires: %{name}-common = %{samba_depver} Provides: bundled(libreplace) = %{samba_depver} +%description core-libs +The samba-core-libs package contains foundational libraries needed by +both Samba servers and clients. This includes error handling, utilities, +and basic support libraries. + +### NDR-LIBS +%package ndr-libs +Summary: Samba NDR libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} + +Provides: %{name}-common-libs = %{samba_depver} +Obsoletes: %{name}-common-libs < %{samba_depver} + %if %{without dc} && %{without testsuite} Obsoletes: samba-dc < %{samba_depver} Obsoletes: samba-dc-libs < %{samba_depver} @@ -519,21 +534,6 @@ Obsoletes: samba-vfs-glusterfs < %{samba_depver} # endif without vfs_glusterfs %endif -%description core-libs -The samba-core-libs package contains foundational libraries needed by -both Samba servers and clients. This includes error handling, utilities, -and basic support libraries. - -### NDR-LIBS -%package ndr-libs -Summary: Samba NDR libraries -Requires(pre): %{name}-common = %{samba_depver} -Requires: %{name}-common = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} - -Provides: %{name}-common-libs = %{samba_depver} -Obsoletes: %{name}-common-libs < %{samba_depver} - %description ndr-libs The samba-ndr-libs package contains NDR (Network Data Representation) encoding libraries used by both Samba servers and clients. From 1f4ee5276f515f685bd1ba2f03eaed47402514ac Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:10:15 +0100 Subject: [PATCH 31/32] Remove duplicate libdsdb-module-private-samba.so --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index cdeefca..b49a21a 100644 --- a/samba.spec +++ b/samba.spec @@ -3904,7 +3904,6 @@ fi %if %{with dc} %{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so %endif -%{_libdir}/samba/libdsdb-module-private-samba.so ### USERSHARES %files usershares From 58df5ed52bbd18e89ba9316f9f8a69ab4800910b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 15 Jan 2026 17:21:14 +0100 Subject: [PATCH 32/32] rpminspect: Don't run annocheck on test binaries [skip changelog] --- rpminspect.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index b30fdbe..f736bfa 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -26,3 +26,10 @@ abidiff: debuginfo: ignore: - /usr/lib*/libdcerpc-samr.so.* + +annocheck: + ignore: + - /usr/bin/gentest + - /usr/bin/locktest + - /usr/bin/masktest + - /usr/bin/smbtorture