From 1a9bba249857b25a2acc07a3988137778dccd9ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Sat, 8 Feb 2025 23:02:27 +0100
Subject: [PATCH 01/29] Update to version 4.22.0rc1

- resolves: rhbz#2344189

Guenther
---
 samba-4-21-fix-smbreadline.patch | 112 ----
 samba-4-21-pycrypt.patch         | 943 -------------------------------
 samba-4.21.0-s3-notifyd.patch    | 513 -----------------
 samba.spec                       |  36 +-
 sources                          |   4 +-
 5 files changed, 23 insertions(+), 1585 deletions(-)
 delete mode 100644 samba-4-21-fix-smbreadline.patch
 delete mode 100644 samba-4-21-pycrypt.patch
 delete mode 100644 samba-4.21.0-s3-notifyd.patch

diff --git a/samba-4-21-fix-smbreadline.patch b/samba-4-21-fix-smbreadline.patch
deleted file mode 100644
index 9fd288d..0000000
--- a/samba-4-21-fix-smbreadline.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-From 36e3944418789f5d2018063fa3988c318baa0a35 Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Tue, 21 Jan 2025 17:59:12 +0100
-Subject: [PATCH 1/2] lib:replace: Remove trailing spaces from readline.h
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
-Reviewed-by: Alexander Bokovoy <ab@samba.org>
-(cherry picked from commit dbff53f77680f0ccd022f2d864ba6ae7585a34b7)
----
- lib/replace/system/readline.h | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h
-index 29379626e0d..9a9af266ca6 100644
---- a/lib/replace/system/readline.h
-+++ b/lib/replace/system/readline.h
-@@ -1,14 +1,14 @@
- #ifndef _system_readline_h
- #define _system_readline_h
--/* 
-+/*
-    Unix SMB/CIFS implementation.
- 
-    Readline wrappers
--   
-+
-      ** NOTE! The following LGPL license applies to the replace
-      ** library. This does NOT imply that all of Samba is released
-      ** under the LGPL
--   
-+
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Lesser General Public
-    License as published by the Free Software Foundation; either
--- 
-2.48.1
-
-
-From 6944f700dcd4ad795652070dfb04135d602622a2 Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Tue, 21 Jan 2025 17:59:27 +0100
-Subject: [PATCH 2/2] lib:replace: Don't use deprecated readline CPPFunction
- cast
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-HAVE_RL_COMPLETION_FUNC_T was unused and not checking for the right
-function.
-
-libcli/smbreadline/smbreadline.c: In function ‘smb_readline’:
-libcli/smbreadline/smbreadline.c:139:17: warning: ‘CPPFunction’ is deprecated [-Wdeprecated-declarations]
-  139 |                 rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn;
-      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-libcli/smbreadline/smbreadline.c:139:50: error: assignment to ‘char ** (*)(const char *, int,  int)’ from incompatible pointer type ‘char ** (*)(void)’ [-Wincompatible-pointer-types]
-  139 |                 rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn;
-      |                                                  ^
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
-Reviewed-by: Alexander Bokovoy <ab@samba.org>
-
-Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
-Autobuild-Date(master): Tue Jan 21 19:38:37 UTC 2025 on atb-devel-224
-
-(cherry picked from commit 9aa5c43315d83c19514251a11c4fba5a137f2821)
----
- lib/replace/system/readline.h        | 4 +++-
- libcli/smbreadline/wscript_configure | 8 +++++---
- 2 files changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h
-index 9a9af266ca6..ac3604fc12e 100644
---- a/lib/replace/system/readline.h
-+++ b/lib/replace/system/readline.h
-@@ -46,7 +46,9 @@
- #endif
- 
- #ifdef HAVE_NEW_LIBREADLINE
--#ifdef HAVE_CPPFUNCTION
-+#if defined(HAVE_RL_COMPLETION_FUNC_T)
-+#  define RL_COMPLETION_CAST (rl_completion_func_t *)
-+#elif defined(HAVE_CPPFUNCTION)
- #  define RL_COMPLETION_CAST (CPPFunction *)
- #elif defined(HAVE_RL_COMPLETION_T)
- #  define RL_COMPLETION_CAST (rl_completion_t *)
-diff --git a/libcli/smbreadline/wscript_configure b/libcli/smbreadline/wscript_configure
-index 912ff53a150..f5a401ebae0 100644
---- a/libcli/smbreadline/wscript_configure
-+++ b/libcli/smbreadline/wscript_configure
-@@ -51,10 +51,12 @@ conf.CHECK_CODE('''
- #    endif
- #  endif
- #endif
--int main(void) {rl_completion_t f; return 0;}
-+int main(void) {rl_completion_func_t f; return 0;}
- ''',
--'HAVE_RL_COMPLETION_FUNC_T', execute=False, addmain=False,
--msg='Checking for rl_completion_t')
-+                'HAVE_RL_COMPLETION_FUNC_T',
-+                execute=False,
-+                addmain=False,
-+                msg='Checking for rl_completion_func_t')
- 
- conf.CHECK_CODE('''
- #ifdef HAVE_READLINE_READLINE_H
--- 
-2.48.1
-
diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch
deleted file mode 100644
index bf4c1e5..0000000
--- a/samba-4-21-pycrypt.patch
+++ /dev/null
@@ -1,943 +0,0 @@
-From 07fe7b437c695c7a715418d4414c930b72758dab Mon Sep 17 00:00:00 2001
-From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Date: Thu, 5 Dec 2024 16:35:51 +1300
-Subject: [PATCH 01/11] util: add a crypt wrapper, derived from
- dsdb:password_hash
-
-This is going to be used by the dsdb password_hash module, and exposed
-to Python via pyglue.
-
-We're doing this because Python 3.13 has dropped crypt from the Python
-standard library.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756
-
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit 833455c7f9f71583d567e3a53e854567cd8c3b0b)
----
- lib/util/util_crypt.c  | 90 ++++++++++++++++++++++++++++++++++++++++++
- lib/util/util_crypt.h  |  5 +++
- lib/util/wscript_build |  6 +++
- 3 files changed, 101 insertions(+)
- create mode 100644 lib/util/util_crypt.c
- create mode 100644 lib/util/util_crypt.h
-
-diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c
-new file mode 100644
-index 00000000000..0f7b2d0fd31
---- /dev/null
-+++ b/lib/util/util_crypt.c
-@@ -0,0 +1,90 @@
-+#include <replace.h>
-+#include "data_blob.h"
-+#include <talloc.h>
-+#include <crypt.h>
-+#include "util_crypt.h"
-+
-+
-+static int crypt_as_best_we_can(const char *phrase,
-+				const char *setting,
-+				const char **hashp)
-+{
-+	int ret = 0;
-+	const char *hash = NULL;
-+
-+#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN)
-+	struct crypt_data crypt_data = {
-+		.initialized = 0        /* working storage used by crypt */
-+	};
-+#endif
-+
-+	/*
-+	 * crypt_r() and crypt() may return a null pointer upon error
-+	 * depending on how libcrypt was configured, so we prefer
-+	 * crypt_rn() from libcrypt / libxcrypt which always returns
-+	 * NULL on error.
-+	 *
-+	 * POSIX specifies returning a null pointer and setting
-+	 * errno.
-+	 *
-+	 * RHEL 7 (which does not use libcrypt / libxcrypt) returns a
-+	 * non-NULL pointer from crypt_r() on success but (always?)
-+	 * sets errno during internal processing in the NSS crypto
-+	 * subsystem.
-+	 *
-+	 * By preferring crypt_rn we avoid the 'return non-NULL but
-+	 * set-errno' that we otherwise cannot tell apart from the
-+	 * RHEL 7 behaviour.
-+	 */
-+	errno = 0;
-+
-+#ifdef HAVE_CRYPT_RN
-+	hash = crypt_rn(phrase, setting,
-+			&crypt_data,
-+			sizeof(crypt_data));
-+#elif HAVE_CRYPT_R
-+	hash = crypt_r(phrase, setting, &crypt_data);
-+#else
-+	/*
-+	 * No crypt_r falling back to crypt, which is NOT thread safe
-+	 * Thread safety MT-Unsafe race:crypt
-+	 */
-+	hash = crypt(phrase, setting);
-+#endif
-+	/*
-+	* On error, crypt() and crypt_r() may return a null pointer,
-+	* or a pointer to an invalid hash beginning with a '*'.
-+	*/
-+	ret = errno;
-+	errno = 0;
-+	if (hash == NULL || hash[0] == '*') {
-+		if (ret == 0) {
-+			/* this is annoying */
-+			ret = ENOTRECOVERABLE;
-+		}
-+	}
-+
-+	*hashp = hash;
-+	return ret;
-+}
-+
-+
-+int talloc_crypt_blob(TALLOC_CTX *mem_ctx,
-+		      const char *phrase,
-+		      const char *setting,
-+		      DATA_BLOB *blob)
-+{
-+	const char *hash = NULL;
-+	int ret = crypt_as_best_we_can(phrase, setting, &hash);
-+	if (ret != 0) {
-+		blob->data = NULL;
-+		blob->length = 0;
-+		return ret;
-+	}
-+	blob->length = strlen(hash);
-+	blob->data = talloc_memdup(mem_ctx, hash, blob->length);
-+	if (blob->data == NULL) {
-+		return ENOMEM;
-+	}
-+	return 0;
-+}
-diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h
-new file mode 100644
-index 00000000000..8c289e489e8
---- /dev/null
-+++ b/lib/util/util_crypt.h
-@@ -0,0 +1,5 @@
-+
-+int talloc_crypt_blob(TALLOC_CTX *mem_ctx,
-+		      const char *phrase,
-+		      const char *cmd,
-+		      DATA_BLOB *blob);
-diff --git a/lib/util/wscript_build b/lib/util/wscript_build
-index b4fcfeaba07..7de9c0b7b17 100644
---- a/lib/util/wscript_build
-+++ b/lib/util/wscript_build
-@@ -253,6 +253,12 @@ else:
-                       private_library=True,
-                       local_include=False)
- 
-+    bld.SAMBA_LIBRARY('util_crypt',
-+                      source='util_crypt.c',
-+                      deps='talloc crypt',
-+                      private_library=True,
-+                      local_include=False)
-+
- 
-     bld.SAMBA_SUBSYSTEM('UNIX_PRIVS',
-                         source='unix_privs.c',
--- 
-2.48.1
-
-
-From adf180613e4172292090d4c3573a439388a09788 Mon Sep 17 00:00:00 2001
-From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Date: Wed, 11 Dec 2024 14:29:21 +1300
-Subject: [PATCH 02/11] dsdb:password_hash: move hash_blob allocation up
-
-This will make the next patch simpler.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756
-
-Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit 1edb12f79593d0b2aac36d5acdaaae6f495772f6)
----
- source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------
- 1 file changed, 8 insertions(+), 6 deletions(-)
-
-diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
-index 1d1267624e2..c1902126a72 100644
---- a/source4/dsdb/samdb/ldb_modules/password_hash.c
-+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
-@@ -1649,6 +1649,13 @@ static int setup_primary_userPassword_hash(
- 		}
- 	}
- 
-+	hash_blob = talloc_zero(ctx, DATA_BLOB);
-+
-+	if (hash_blob == NULL) {
-+		TALLOC_FREE(frame);
-+		return ldb_oom(ldb);
-+	}
-+
- 	/*
- 	 * Relies on the assertion that cleartext_utf8->data is a zero
- 	 * terminated UTF-8 string
-@@ -1712,15 +1719,10 @@ static int setup_primary_userPassword_hash(
- 			scheme,
- 			reason);
- 		TALLOC_FREE(frame);
-+		TALLOC_FREE(hash_blob);
- 		return LDB_ERR_OPERATIONS_ERROR;
- 	}
- 
--	hash_blob = talloc_zero(ctx, DATA_BLOB);
--
--	if (hash_blob == NULL) {
--		TALLOC_FREE(frame);
--		return ldb_oom(ldb);
--	}
- 
- 	*hash_blob =  data_blob_talloc(hash_blob,
- 				       (const uint8_t *)hash,
--- 
-2.48.1
-
-
-From 9d43e4d649db23549bbb230ed60426fa286b7ab7 Mon Sep 17 00:00:00 2001
-From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Date: Thu, 12 Dec 2024 11:16:22 +1300
-Subject: [PATCH 03/11] dsdb:password_hash: use talloc_crypt_blob()
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756
-
-Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit c7597380b479208e33a403211cec9b3c7bd3f034)
----
- .../dsdb/samdb/ldb_modules/password_hash.c    | 68 ++++---------------
- .../samdb/ldb_modules/wscript_build_server    |  2 +-
- 2 files changed, 13 insertions(+), 57 deletions(-)
-
-diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
-index c1902126a72..7a7114c1caa 100644
---- a/source4/dsdb/samdb/ldb_modules/password_hash.c
-+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
-@@ -51,6 +51,7 @@
- #include "auth/common_auth.h"
- #include "lib/messaging/messaging.h"
- #include "lib/param/loadparm.h"
-+#include "lib/util/util_crypt.h"
- 
- #include "lib/crypto/gnutls_helpers.h"
- #include <gnutls/crypto.h>
-@@ -1592,16 +1593,11 @@ static int setup_primary_userPassword_hash(
- 	struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
- 	const char *salt = NULL;        /* Randomly generated salt */
- 	const char *cmd = NULL;         /* command passed to crypt */
--	const char *hash = NULL;        /* password hash generated by crypt */
- 	int algorithm = 0;              /* crypt hash algorithm number */
- 	int rounds = 0;                 /* The number of hash rounds */
-+	int ret;
- 	DATA_BLOB *hash_blob = NULL;
- 	TALLOC_CTX *frame = talloc_stackframe();
--#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN)
--	struct crypt_data crypt_data = {
--		.initialized = 0        /* working storage used by crypt */
--	};
--#endif
- 
- 	/* Generate a random password salt */
- 	salt = generate_random_str_list(frame,
-@@ -1660,52 +1656,20 @@ static int setup_primary_userPassword_hash(
- 	 * Relies on the assertion that cleartext_utf8->data is a zero
- 	 * terminated UTF-8 string
- 	 */
--
--	/*
--	 * crypt_r() and crypt() may return a null pointer upon error
--	 * depending on how libcrypt was configured, so we prefer
--	 * crypt_rn() from libcrypt / libxcrypt which always returns
--	 * NULL on error.
--	 *
--	 * POSIX specifies returning a null pointer and setting
--	 * errno.
--	 *
--	 * RHEL 7 (which does not use libcrypt / libxcrypt) returns a
--	 * non-NULL pointer from crypt_r() on success but (always?)
--	 * sets errno during internal processing in the NSS crypto
--	 * subsystem.
--	 *
--	 * By preferring crypt_rn we avoid the 'return non-NULL but
--	 * set-errno' that we otherwise cannot tell apart from the
--	 * RHEL 7 behaviour.
--	 */
--	errno = 0;
--
--#ifdef HAVE_CRYPT_RN
--	hash = crypt_rn((char *)io->n.cleartext_utf8->data,
--			cmd,
--			&crypt_data,
--			sizeof(crypt_data));
--#elif HAVE_CRYPT_R
--	hash = crypt_r((char *)io->n.cleartext_utf8->data, cmd, &crypt_data);
--#else
--	/*
--	 * No crypt_r falling back to crypt, which is NOT thread safe
--	 * Thread safety MT-Unsafe race:crypt
--	 */
--	hash = crypt((char *)io->n.cleartext_utf8->data, cmd);
--#endif
--	/*
--	* On error, crypt() and crypt_r() may return a null pointer,
--	* or a pointer to an invalid hash beginning with a '*'.
--	*/
--	if (hash == NULL || hash[0] == '*') {
-+	ret = talloc_crypt_blob(hash_blob,
-+				(char *)io->n.cleartext_utf8->data,
-+				cmd,
-+				hash_blob);
-+	if (ret != 0) {
- 		char buf[1024];
- 		const char *reason = NULL;
--		if (errno == ERANGE) {
-+		if (ret == ERANGE) {
- 			reason = "Password exceeds maximum length allowed for crypt() hashing";
-+		} else if (ret == ENOTRECOVERABLE) {
-+			/* probably weird RHEL7 crypt, see talloc_crypt_blob() */
-+			reason = "Unknown error";
- 		} else {
--			int err = strerror_r(errno, buf, sizeof(buf));
-+			int err = strerror_r(ret, buf, sizeof(buf));
- 			if (err == 0) {
- 				reason = buf;
- 			} else {
-@@ -1723,14 +1687,6 @@ static int setup_primary_userPassword_hash(
- 		return LDB_ERR_OPERATIONS_ERROR;
- 	}
- 
--
--	*hash_blob =  data_blob_talloc(hash_blob,
--				       (const uint8_t *)hash,
--				       strlen(hash));
--	if (hash_blob->data == NULL) {
--		TALLOC_FREE(frame);
--		return ldb_oom(ldb);
--	}
- 	hash_value->value = hash_blob;
- 	TALLOC_FREE(frame);
- 	return LDB_SUCCESS;
-diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server
-index 9c1eb12a7c2..16d9b31a982 100644
---- a/source4/dsdb/samdb/ldb_modules/wscript_build_server
-+++ b/source4/dsdb/samdb/ldb_modules/wscript_build_server
-@@ -195,7 +195,7 @@ bld.SAMBA_MODULE('ldb_password_hash',
- 	init_function='ldb_password_hash_module_init',
- 	module_init_name='ldb_init_module',
- 	internal_module=False,
--	deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS crypt db-glue'
-+	deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS util_crypt db-glue'
- 	)
- 
- 
--- 
-2.48.1
-
-
-From 1c94645881bd5130c67bfee96aa463f360df300a Mon Sep 17 00:00:00 2001
-From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Date: Wed, 11 Dec 2024 14:30:04 +1300
-Subject: [PATCH 04/11] util: add a crypt strerror helper
-
-This will be used by Python also.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756
-
-Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit 5f365e71c1fa8cdc533159283a5977164b5d39f2)
----
- lib/util/util_crypt.c                         | 24 +++++++++++++++++++
- lib/util/util_crypt.h                         |  2 ++
- .../dsdb/samdb/ldb_modules/password_hash.c    | 16 +------------
- 3 files changed, 27 insertions(+), 15 deletions(-)
-
-diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c
-index 0f7b2d0fd31..09cd47597d1 100644
---- a/lib/util/util_crypt.c
-+++ b/lib/util/util_crypt.c
-@@ -88,3 +88,27 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx,
- 	}
- 	return 0;
- }
-+
-+
-+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error)
-+{
-+	char buf[1024];
-+	int err;
-+	if (error == ERANGE) {
-+		return talloc_strdup(
-+			mem_ctx,
-+			"Password exceeds maximum length allowed for crypt() hashing");
-+	}
-+	if (error == ENOTRECOVERABLE) {
-+		/* probably weird RHEL7 crypt, see crypt_as_best_we_can() */
-+		goto unknown;
-+	}
-+
-+	err = strerror_r(error, buf, sizeof(buf));
-+	if (err != 0) {
-+		goto unknown;
-+	}
-+	return talloc_strndup(mem_ctx, buf, sizeof(buf));
-+unknown:
-+	return talloc_strdup(mem_ctx, "Unknown error");
-+}
-diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h
-index 8c289e489e8..ca1a58e922c 100644
---- a/lib/util/util_crypt.h
-+++ b/lib/util/util_crypt.h
-@@ -3,3 +3,5 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx,
- 		      const char *phrase,
- 		      const char *cmd,
- 		      DATA_BLOB *blob);
-+
-+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error);
-diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
-index 7a7114c1caa..6949a92fc3e 100644
---- a/source4/dsdb/samdb/ldb_modules/password_hash.c
-+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
-@@ -1661,21 +1661,7 @@ static int setup_primary_userPassword_hash(
- 				cmd,
- 				hash_blob);
- 	if (ret != 0) {
--		char buf[1024];
--		const char *reason = NULL;
--		if (ret == ERANGE) {
--			reason = "Password exceeds maximum length allowed for crypt() hashing";
--		} else if (ret == ENOTRECOVERABLE) {
--			/* probably weird RHEL7 crypt, see talloc_crypt_blob() */
--			reason = "Unknown error";
--		} else {
--			int err = strerror_r(ret, buf, sizeof(buf));
--			if (err == 0) {
--				reason = buf;
--			} else {
--				reason = "Unknown error";
--			}
--		}
-+		const char *reason = talloc_crypt_errstring(frame, ret);
- 		ldb_asprintf_errstring(
- 			ldb,
- 			"setup_primary_userPassword: generation of a %s "
--- 
-2.48.1
-
-
-From ce70e852783ec69104d274def931e7d39f17576a Mon Sep 17 00:00:00 2001
-From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Date: Wed, 11 Dec 2024 14:30:15 +1300
-Subject: [PATCH 05/11] pyglue: add crypt() function
-
-This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in
-turn wraps the system crypt[_r[n]].
-
-We want this because the Python standard library crypt module is going
-away. That one also wrapped the system crypt or crypt_r, so there
-should be no change.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756
-
-Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(backported from commit 88e3c82d88a68cf972f8189e1c3718698b49974a)
----
- python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++
- python/wscript  |  1 +
- 2 files changed, 42 insertions(+)
-
-diff --git a/python/pyglue.c b/python/pyglue.c
-index 042bf9e14f3..fcccb849f5e 100644
---- a/python/pyglue.c
-+++ b/python/pyglue.c
-@@ -18,6 +18,7 @@
- */
- 
- #include "lib/replace/system/python.h"
-+#include "pyerrors.h"
- #include "python/py3compat.h"
- #include "includes.h"
- #include "python/modules.h"
-@@ -25,6 +26,7 @@
- #include "param/pyparam.h"
- #include "lib/socket/netif.h"
- #include "lib/util/debug.h"
-+#include "lib/util/util_crypt.h"
- #include "librpc/ndr/ndr_private.h"
- #include "lib/cmdline/cmdline.h"
- #include "lib/crypto/gkdi.h"
-@@ -519,6 +521,42 @@ static PyObject *py_get_burnt_commandline(PyObject *self, PyObject *args)
- 	return ret;
- }
- 
-+static PyObject *py_crypt(PyObject *self, PyObject *args)
-+{
-+	PyObject *py_hash = NULL;
-+	char *phrase = NULL;
-+	char *setting = NULL;
-+	TALLOC_CTX *frame = NULL;
-+	int ret;
-+	DATA_BLOB hash = {};
-+
-+	if (!PyArg_ParseTuple(args, "ss", &phrase, &setting)) {
-+		TALLOC_FREE(frame);
-+		return NULL;
-+	}
-+	frame = talloc_stackframe();
-+	ret = talloc_crypt_blob(frame, phrase, setting, &hash);
-+	if (ret != 0) {
-+		const char *errstr = talloc_crypt_errstring(frame, ret);
-+		if (ret == EINVAL || ret == ERANGE || ret == ENOTRECOVERABLE) {
-+			PyErr_Format(PyExc_ValueError,
-+				     "could not crypt(): %s",
-+				     errstr);
-+		} else {
-+			PyErr_Format(PyExc_OSError,
-+				     "could not crypt(): %s",
-+				     errstr);
-+		}
-+		TALLOC_FREE(frame);
-+		return NULL;
-+	}
-+
-+	py_hash = PyUnicode_FromStringAndSize((char *)hash.data, hash.length);
-+	TALLOC_FREE(frame);
-+	return py_hash;
-+}
-+
-+
- static PyMethodDef py_misc_methods[] = {
- 	{ "generate_random_str", (PyCFunction)py_generate_random_str, METH_VARARGS,
- 		"generate_random_str(len) -> string\n"
-@@ -580,6 +618,9 @@ static PyMethodDef py_misc_methods[] = {
- 		METH_NOARGS, "How many NDR internal tokens is too many for this build?" },
- 	{ "get_burnt_commandline", (PyCFunction)py_get_burnt_commandline,
- 		METH_VARARGS, "Return a redacted commandline to feed to setproctitle (None if no redaction required)" },
-+	{ "crypt", (PyCFunction)py_crypt,
-+		METH_VARARGS,
-+		"encrypt as phrase, per crypt(3), as determined by setting." },
- 	{0}
- };
- 
-diff --git a/python/wscript b/python/wscript
-index 3e6439930e9..7c17e390dc7 100644
---- a/python/wscript
-+++ b/python/wscript
-@@ -119,6 +119,7 @@ def build(bld):
-                               ndr
-                               cmdline
-                               gkdi
-+                              util_crypt
-                               %s
-                               ''' % (pyparam_util, pytalloc_util),
-                      realname='samba/_glue.so')
--- 
-2.48.1
-
-
-From 9a0dc2db7cde22f36583159c0d697a3de6640990 Mon Sep 17 00:00:00 2001
-From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Date: Thu, 12 Dec 2024 10:44:07 +1300
-Subject: [PATCH 06/11] pytest: test that _glue.crypt works
-
-The test vectors were generated via Python 3.10 crypt module, which
-directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3.
-
-We mainly test the sha256 and sha512 vectors, which seems to be all we
-use, and which are said to be widely supported.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756
-
-Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit 5636d30c0959fd4a211ee7b8d1b267dcdbf0b963)
----
- python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++
- 1 file changed, 65 insertions(+)
-
-diff --git a/python/samba/tests/glue.py b/python/samba/tests/glue.py
-index ac504b3f366..824f5ca0c81 100644
---- a/python/samba/tests/glue.py
-+++ b/python/samba/tests/glue.py
-@@ -88,3 +88,68 @@ class GlueTests(samba.tests.TestCase):
-         self.assertEqual(_glue.strstr_m(string, '_'), '_string_num__one')
-         self.assertEqual(_glue.strstr_m(string, '__'), '__one')
-         self.assertEqual(_glue.strstr_m(string, 'ring'), 'ring_num__one')
-+
-+    def test_crypt(self):
-+        # We hopefully only use schemes 5 and 6 (sha256 and sha512),
-+        # which are OK and also quite widely supported according to
-+        # https://en.wikipedia.org/wiki/Crypt_(C)
-+        for phrase, setting, expected in [
-+                ("a", "$5$aaaaaa",
-+                 "$5$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6"),
-+                # with scheme 5, 5000 rounds is default, so hash is the same as above
-+                ('a', '$5$rounds=5000$aaaaaa',
-+                 '$5$rounds=5000$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6'),
-+                ('a',
-+                 '$5$rounds=4999$aaaaaa',
-+                 '$5$rounds=4999$aaaaaa$FiP70gtxOJUFLokUJvET06E7jbL6aNmF6Wtv2ddzjY8'),
-+                ('a', '$5$aaaaab',
-+                 '$5$aaaaab$e9qR2F833/JyuMu.nkQc9kn184vBWLo0ODqnCe./mj0'),
-+
-+                ('', '$5$aaaaaa', '$5$aaaaaa$5B4WTdWp5n/v/aNUw2N8RsEitqvlZJEaAKhH/pOkGg4'),
-+
-+                ("a", "$6$aaaaaa",
-+                 "$6$aaaaaa$KHs/Ez7X/I5/K.V8FR7kEsx9rOvjXnEDUmGC.dLBWP87XWy.oUEAM7QYcZQRVhiDwGepOF2pKrCVETYLyASh60"),
-+
-+                ('', '$5$', '$5$$3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.'),
-+
-+                # scheme 1 (md5) should be supported if not used
-+                ('a', '$1$aaaaaa',
-+                 '$1$aaaaaa$MUMWPbGfzrHFCNm7ZHg31.'),
-+
-+                ('', '$6$',
-+                 '$6$$/chiBau24cE26QQVW3IfIe68Xu5.JQ4E8Ie7lcRLwqxO5cxGuBhqF2HmTL.zWJ9zjChg3yJYFXeGBQ2y3Ba1d1'),
-+                (' ',
-+                 '$6$6',
-+                 '$6$6$asLnbxf0obyuv3ybNvDE9ZcdwGFkDhLe7uW.wzdOdKCm4/M3vGFKq4Ttk1tBQrOn4wALZ3tj1L8IarIu5i8hR/'),
-+
-+                # original DES scheme, 12 bits of salt
-+                ("a", "lalala", "laKGbFzgh./R2"),
-+                ("a", "lalalaLALALAla", "laKGbFzgh./R2"),
-+                ("a", "arrgh", "ar7VUiUvDhX2c"),
-+                ("a", "arrggghhh", "ar7VUiUvDhX2c"),
-+                ]:
-+            hash = _glue.crypt(phrase, setting)
-+            self.assertEqual(hash, expected)
-+
-+    def test_crypt_bad(self):
-+        # We can't be too strident in our assertions, because every
-+        # system allows a different set of algorithms, and some have
-+        # different ideas of how to parse.
-+        for phrase, setting, exception in [
-+                ("a", "$5", ValueError),
-+                ("a", "$0$", ValueError),
-+                ("a", None, TypeError),
-+                (None, "", TypeError),
-+                ('a', '$66$', ValueError),
-+                ('a', '$$', ValueError),
-+                ('a', '*0', ValueError),
-+                ('a', '*', ValueError),
-+                ('a', '++', ValueError),
-+                # this next one is too long, except on Rocky Linux 8.
-+                #('a' * 10000, '$5$5', ValueError),
-+                # this is invalid, except on Debian 11.
-+                # (' ', '$6$ ', ValueError),
-+                ]:
-+            with self.assertRaises(exception,
-+                                   msg=f"crypt({phrase!r}, {setting!r}) didn't fail"):
-+                _glue.crypt(phrase, setting)
--- 
-2.48.1
-
-
-From 6425e2514052027ee2269e15e0e0dff1686fa34e Mon Sep 17 00:00:00 2001
-From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Date: Wed, 11 Dec 2024 15:54:48 +1300
-Subject: [PATCH 07/11] samba-tool user: use _glue.crypt, not crypt.crypt
-
-Because we know we have _glue.crypt, and we know it raises exceptions
-rather than returning None, we can simplify the checks.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756
-
-Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit 405187d2ef4920a9a284649c9c3287f5844d5180)
----
- .../samba/netcmd/user/readpasswords/common.py | 21 ++++++-------------
- 1 file changed, 6 insertions(+), 15 deletions(-)
-
-diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py
-index 7944d4e1682..68befb3f356 100644
---- a/python/samba/netcmd/user/readpasswords/common.py
-+++ b/python/samba/netcmd/user/readpasswords/common.py
-@@ -37,6 +37,7 @@ from samba.netcmd import Command, CommandError
- from samba.samdb import SamDB
- from samba.nt_time import timedelta_from_nt_time_delta, nt_time_from_datetime
- from samba.gkdi import MAX_CLOCK_SKEW
-+from samba._glue import crypt
- 
- # python[3]-gpgme is abandoned since ubuntu 1804 and debian 9
- # have to use python[3]-gpg instead
-@@ -132,9 +133,7 @@ def get_crypt_value(alg, utf8pw, rounds=0):
-     else:
-         crypt_salt = "$%s$%s$" % (alg, b64salt)
- 
--    crypt_value = crypt.crypt(utf8pw, crypt_salt)
--    if crypt_value is None:
--        raise NotImplementedError("crypt.crypt(%s) returned None" % (crypt_salt))
-+    crypt_value = crypt(utf8pw, crypt_salt)
-     expected_len = len(crypt_salt) + algs[alg]["length"]
-     if len(crypt_value) != expected_len:
-         raise NotImplementedError("crypt.crypt(%s) returned a value with length %d, expected length is %d" % (
-@@ -156,21 +155,13 @@ except ImportError as e:
- 
- for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]:
-     try:
--        import crypt
-         get_crypt_value(alg, "")
--        virtual_attributes[attr] = {
--        }
--    except ImportError as e:
--        reason = "crypt"
--        reason += " required"
--        disabled_virtual_attributes[attr] = {
--            "reason": reason,
--        }
--    except NotImplementedError as e:
--        reason = "modern '$%s$' salt in crypt(3) required" % (alg)
-+    except (ValueError, OSError):
-         disabled_virtual_attributes[attr] = {
--            "reason": reason,
-+            "reason": f"modern '${alg}$' salt in crypt(3) required"
-         }
-+        continue
-+    virtual_attributes[attr] = {}
- 
- # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29
- for x in range(1, 30):
--- 
-2.48.1
-
-
-From a2a04286e13676177c952e67363fc7502f544861 Mon Sep 17 00:00:00 2001
-From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Date: Wed, 11 Dec 2024 15:56:20 +1300
-Subject: [PATCH 08/11] samba-tool user: hashlib.sha1 is always present
-
-We maybe thought we were checking that sha1 was in hashlib, but we were
-only checking that hashlib is in the Python library (`hashlib.sha1()`
-would not raise ImportError).
-
-The documentation says hashlib always contains sha1 -- if that
-changes, it is better we know by failing noisily with the import error
-at the top of the file.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756
-
-Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit 4af4dd8135e8edbe2a16cfdfc7ded8c145c82e98)
----
- python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------
- 1 file changed, 4 insertions(+), 12 deletions(-)
-
-diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py
-index 68befb3f356..3043525874e 100644
---- a/python/samba/netcmd/user/readpasswords/common.py
-+++ b/python/samba/netcmd/user/readpasswords/common.py
-@@ -26,6 +26,7 @@ import datetime
- import errno
- import io
- import os
-+from hashlib import sha1
- 
- import ldb
- from samba import credentials, nttime2float
-@@ -141,17 +142,8 @@ def get_crypt_value(alg, utf8pw, rounds=0):
-     return crypt_value
- 
- 
--try:
--    import hashlib
--    hashlib.sha1()
--    virtual_attributes["virtualSSHA"] = {
--    }
--except ImportError as e:
--    reason = "hashlib.sha1()"
--    reason += " required"
--    disabled_virtual_attributes["virtualSSHA"] = {
--        "reason": reason,
--    }
-+
-+virtual_attributes["virtualSSHA"] = {}
- 
- for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]:
-     try:
-@@ -736,7 +728,7 @@ class GetPasswordCommand(Command):
-                 if u8 is None:
-                     continue
-                 salt = os.urandom(4)
--                h = hashlib.sha1()
-+                h = sha1()
-                 h.update(u8)
-                 h.update(salt)
-                 bv = h.digest() + salt
--- 
-2.48.1
-
-
-From e9a8748f3cc4ba74f8b0d75e7a01866e7c12a0a4 Mon Sep 17 00:00:00 2001
-From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Date: Thu, 12 Dec 2024 10:46:16 +1300
-Subject: [PATCH 09/11] pytest: password_hash uses internal _glue.crypt
-
-This will remove an external dependency.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756
-
-Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit 552053b6445611ecef6ac4c11c55ebf92f03571d)
----
- python/samba/tests/password_hash.py | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/python/samba/tests/password_hash.py b/python/samba/tests/password_hash.py
-index 1b7af7de7b8..39ef13fd7b2 100644
---- a/python/samba/tests/password_hash.py
-+++ b/python/samba/tests/password_hash.py
-@@ -30,11 +30,11 @@ from samba.dcerpc.samr import DOMAIN_PASSWORD_STORE_CLEARTEXT
- from samba.dsdb import UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED
- from samba.tests import delete_force
- from samba.tests.password_test import PasswordCommon
-+from samba._glue import crypt
- import ldb
- import samba
- import binascii
- from hashlib import md5
--import crypt
- 
- 
- USER_NAME = "PasswordHashTestUser"
-@@ -321,7 +321,7 @@ class PassWordHashTests(TestCase):
-                 cmd = "$%s$rounds=%d$%s" % (alg, rounds, data[3])
- 
-             # Calculate the expected hash value
--            expected = crypt.crypt(USER_PASS, cmd)
-+            expected = crypt(USER_PASS, cmd)
-             self.assertEqual(expected, up.hashes[i].value.decode('utf8'))
-             i += 1
- 
--- 
-2.48.1
-
-
-From 0e01dc4f1fabfd2c3f21f724c05d94227a278b20 Mon Sep 17 00:00:00 2001
-From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Date: Wed, 11 Dec 2024 14:31:18 +1300
-Subject: [PATCH 10/11] util:datablob: data_blob_pad checks its alignment
- assumption
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756
-
-Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-
-Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
-Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224
-
-(cherry picked from commit 8b84282008dc372d67ba01c8fe256ef756c3dcfb)
----
- lib/util/data_blob.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/util/data_blob.c b/lib/util/data_blob.c
-index b5b78bc7a8a..0522e7755af 100644
---- a/lib/util/data_blob.c
-+++ b/lib/util/data_blob.c
-@@ -286,7 +286,7 @@ _PUBLIC_ bool data_blob_pad(TALLOC_CTX *mem_ctx, DATA_BLOB *blob,
- 	size_t old_len = blob->length;
- 	size_t new_len = (old_len + pad - 1) & ~(pad - 1);
- 
--	if (new_len < old_len) {
-+	if (new_len < old_len || (pad & (pad - 1)) != 0) {
- 		return false;
- 	}
- 
--- 
-2.48.1
-
-
-From 8cfae9f33fb1c170c3fe937be200490597e9e4c2 Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Fri, 17 Jan 2025 13:28:30 +0100
-Subject: [PATCH 11/11] lib:util: Fix stack-use-after-return in
- crypt_as_best_we_can()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15784
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
-Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
-
-Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
-Autobuild-Date(master): Fri Jan 17 23:21:13 UTC 2025 on atb-devel-224
-
-(cherry picked from commit 6cd9849b58ec653cbffc602e3c96996a082faf53)
----
- lib/util/util_crypt.c | 16 ++++++++++++----
- 1 file changed, 12 insertions(+), 4 deletions(-)
-
-diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c
-index 09cd47597d1..9ac6e1cfd0e 100644
---- a/lib/util/util_crypt.c
-+++ b/lib/util/util_crypt.c
-@@ -1,11 +1,13 @@
- #include <replace.h>
- #include "data_blob.h"
-+#include "discard.h"
- #include <talloc.h>
- #include <crypt.h>
- #include "util_crypt.h"
- 
- 
--static int crypt_as_best_we_can(const char *phrase,
-+static int crypt_as_best_we_can(TALLOC_CTX *mem_ctx,
-+				const char *phrase,
- 				const char *setting,
- 				const char **hashp)
- {
-@@ -63,8 +65,14 @@ static int crypt_as_best_we_can(const char *phrase,
- 			ret = ENOTRECOVERABLE;
- 		}
- 	}
-+	if (ret != 0) {
-+		return ret;
-+	}
- 
--	*hashp = hash;
-+	*hashp = talloc_strdup(mem_ctx, hash);
-+	if (*hashp == NULL) {
-+		ret = -1;
-+	}
- 	return ret;
- }
- 
-@@ -75,14 +83,14 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx,
- 		      DATA_BLOB *blob)
- {
- 	const char *hash = NULL;
--	int ret = crypt_as_best_we_can(phrase, setting, &hash);
-+	int ret = crypt_as_best_we_can(mem_ctx, phrase, setting, &hash);
- 	if (ret != 0) {
- 		blob->data = NULL;
- 		blob->length = 0;
- 		return ret;
- 	}
- 	blob->length = strlen(hash);
--	blob->data = talloc_memdup(mem_ctx, hash, blob->length);
-+	blob->data = discard_const_p(uint8_t, hash);
- 	if (blob->data == NULL) {
- 		return ENOMEM;
- 	}
--- 
-2.48.1
-
diff --git a/samba-4.21.0-s3-notifyd.patch b/samba-4.21.0-s3-notifyd.patch
deleted file mode 100644
index 31463fd..0000000
--- a/samba-4.21.0-s3-notifyd.patch
+++ /dev/null
@@ -1,513 +0,0 @@
-From c9a7bc3e8f36cb9d6746e23ea56f9c27b82dcf49 Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Mon, 22 Jul 2024 12:26:55 +0200
-Subject: [PATCH] s3:notifyd: Use a watcher per db record
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This fixes a O(n²) performance regression in notifyd. The problem was
-that we had a watcher per notify instance. This changes the code to have
-a watcher per notify db entry.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=14430
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
-Reviewed-by: Stefan Metzmacher <metze@samba.org>
-(cherry picked from commit af011b987a4ad0d3753d83cc0b8d97ad64ba874a)
----
- source3/smbd/notifyd/notifyd.c         | 214 ++++++++++++++++++-------
- source3/smbd/notifyd/notifyd_db.c      |   5 +-
- source3/smbd/notifyd/notifyd_entry.c   |  51 ++++--
- source3/smbd/notifyd/notifyd_private.h |  46 ++++--
- 4 files changed, 228 insertions(+), 88 deletions(-)
-
-diff --git a/source3/smbd/notifyd/notifyd.c b/source3/smbd/notifyd/notifyd.c
-index 64dd26a7e11..0b07ab3e435 100644
---- a/source3/smbd/notifyd/notifyd.c
-+++ b/source3/smbd/notifyd/notifyd.c
-@@ -337,6 +337,7 @@ static bool notifyd_apply_rec_change(
- 	struct messaging_context *msg_ctx)
- {
- 	struct db_record *rec = NULL;
-+	struct notifyd_watcher watcher = {};
- 	struct notifyd_instance *instances = NULL;
- 	size_t num_instances;
- 	size_t i;
-@@ -344,6 +345,7 @@ static bool notifyd_apply_rec_change(
- 	TDB_DATA value;
- 	NTSTATUS status;
- 	bool ok = false;
-+	bool new_watcher = false;
- 
- 	if (pathlen == 0) {
- 		DBG_WARNING("pathlen==0\n");
-@@ -374,8 +376,12 @@ static bool notifyd_apply_rec_change(
- 	value = dbwrap_record_get_value(rec);
- 
- 	if (value.dsize != 0) {
--		if (!notifyd_parse_entry(value.dptr, value.dsize, NULL,
--					 &num_instances)) {
-+		ok = notifyd_parse_entry(value.dptr,
-+					 value.dsize,
-+					 &watcher,
-+					 NULL,
-+					 &num_instances);
-+		if (!ok) {
- 			goto fail;
- 		}
- 	}
-@@ -390,8 +396,22 @@ static bool notifyd_apply_rec_change(
- 		goto fail;
- 	}
- 
--	if (value.dsize != 0) {
--		memcpy(instances, value.dptr, value.dsize);
-+	if (num_instances > 0) {
-+		struct notifyd_instance *tmp = NULL;
-+		size_t num_tmp = 0;
-+
-+		ok = notifyd_parse_entry(value.dptr,
-+					 value.dsize,
-+					 NULL,
-+					 &tmp,
-+					 &num_tmp);
-+		if (!ok) {
-+			goto fail;
-+		}
-+
-+		memcpy(instances,
-+		       tmp,
-+		       sizeof(struct notifyd_instance) * num_tmp);
- 	}
- 
- 	for (i=0; i<num_instances; i++) {
-@@ -414,41 +434,106 @@ static bool notifyd_apply_rec_change(
- 		*instance = (struct notifyd_instance) {
- 			.client = *client,
- 			.instance = *chg,
--			.internal_filter = chg->filter,
--			.internal_subdir_filter = chg->subdir_filter
- 		};
- 
- 		num_instances += 1;
- 	}
- 
--	if ((instance->instance.filter != 0) ||
--	    (instance->instance.subdir_filter != 0)) {
--		int ret;
-+	/*
-+	 * Calculate an intersection of the instances filters for the watcher.
-+	 */
-+	if (instance->instance.filter > 0) {
-+		uint32_t filter = instance->instance.filter;
-+
-+		if ((watcher.filter & filter) != filter) {
-+			watcher.filter |= filter;
-+
-+			new_watcher = true;
-+		}
-+	}
-+
-+	/*
-+	 * Calculate an intersection of the instances subdir_filters for the
-+	 * watcher.
-+	 */
-+	if (instance->instance.subdir_filter > 0) {
-+		uint32_t subdir_filter = instance->instance.subdir_filter;
- 
--		TALLOC_FREE(instance->sys_watch);
-+		if ((watcher.subdir_filter & subdir_filter) != subdir_filter) {
-+			watcher.subdir_filter |= subdir_filter;
- 
--		ret = sys_notify_watch(entries, sys_notify_ctx, path,
--				       &instance->internal_filter,
--				       &instance->internal_subdir_filter,
--				       notifyd_sys_callback, msg_ctx,
--				       &instance->sys_watch);
--		if (ret != 0) {
--			DBG_WARNING("sys_notify_watch for [%s] returned %s\n",
--				    path, strerror(errno));
-+			new_watcher = true;
- 		}
- 	}
- 
- 	if ((instance->instance.filter == 0) &&
- 	    (instance->instance.subdir_filter == 0)) {
-+		uint32_t tmp_filter = 0;
-+		uint32_t tmp_subdir_filter = 0;
-+
- 		/* This is a delete request */
--		TALLOC_FREE(instance->sys_watch);
- 		*instance = instances[num_instances-1];
- 		num_instances -= 1;
-+
-+		for (i = 0; i < num_instances; i++) {
-+			struct notifyd_instance *tmp = &instances[i];
-+
-+			tmp_filter |= tmp->instance.filter;
-+			tmp_subdir_filter |= tmp->instance.subdir_filter;
-+		}
-+
-+		/*
-+		 * If the filter has changed, register a new watcher with the
-+		 * changed filter.
-+		 */
-+		if (watcher.filter != tmp_filter ||
-+		    watcher.subdir_filter != tmp_subdir_filter)
-+		{
-+			watcher.filter = tmp_filter;
-+			watcher.subdir_filter = tmp_subdir_filter;
-+
-+			new_watcher = true;
-+		}
-+	}
-+
-+	if (new_watcher) {
-+		/*
-+		 * In case we removed all notify instances, we want to remove
-+		 * the watcher. We won't register a new one, if no filters are
-+		 * set anymore.
-+		 */
-+
-+		TALLOC_FREE(watcher.sys_watch);
-+
-+		watcher.sys_filter = watcher.filter;
-+		watcher.sys_subdir_filter = watcher.subdir_filter;
-+
-+		/*
-+		 * Only register a watcher if we have filter.
-+		 */
-+		if (watcher.filter != 0 || watcher.subdir_filter != 0) {
-+			int ret = sys_notify_watch(entries,
-+						   sys_notify_ctx,
-+						   path,
-+						   &watcher.sys_filter,
-+						   &watcher.sys_subdir_filter,
-+						   notifyd_sys_callback,
-+						   msg_ctx,
-+						   &watcher.sys_watch);
-+			if (ret != 0) {
-+				DBG_WARNING("sys_notify_watch for [%s] "
-+					    "returned %s\n",
-+					    path,
-+					    strerror(errno));
-+			}
-+		}
- 	}
- 
- 	DBG_DEBUG("%s has %zu instances\n", path, num_instances);
- 
- 	if (num_instances == 0) {
-+		TALLOC_FREE(watcher.sys_watch);
-+
- 		status = dbwrap_record_delete(rec);
- 		if (!NT_STATUS_IS_OK(status)) {
- 			DBG_WARNING("dbwrap_record_delete returned %s\n",
-@@ -456,13 +541,21 @@ static bool notifyd_apply_rec_change(
- 			goto fail;
- 		}
- 	} else {
--		value = make_tdb_data(
--			(uint8_t *)instances,
--			sizeof(struct notifyd_instance) * num_instances);
-+		struct TDB_DATA iov[2] = {
-+			{
-+				.dptr = (uint8_t *)&watcher,
-+				.dsize = sizeof(struct notifyd_watcher),
-+			},
-+			{
-+				.dptr = (uint8_t *)instances,
-+				.dsize = sizeof(struct notifyd_instance) *
-+					 num_instances,
-+			},
-+		};
- 
--		status = dbwrap_record_store(rec, value, 0);
-+		status = dbwrap_record_storev(rec, iov, ARRAY_SIZE(iov), 0);
- 		if (!NT_STATUS_IS_OK(status)) {
--			DBG_WARNING("dbwrap_record_store returned %s\n",
-+			DBG_WARNING("dbwrap_record_storev returned %s\n",
- 				    nt_errstr(status));
- 			goto fail;
- 		}
-@@ -706,12 +799,18 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data,
- 					.when = tstate->msg->when };
- 	struct iovec iov[2];
- 	size_t path_len = key.dsize;
-+	struct notifyd_watcher watcher = {};
- 	struct notifyd_instance *instances = NULL;
- 	size_t num_instances = 0;
- 	size_t i;
-+	bool ok;
- 
--	if (!notifyd_parse_entry(data.dptr, data.dsize, &instances,
--				 &num_instances)) {
-+	ok = notifyd_parse_entry(data.dptr,
-+				 data.dsize,
-+				 &watcher,
-+				 &instances,
-+				 &num_instances);
-+	if (!ok) {
- 		DBG_DEBUG("Could not parse notifyd_entry\n");
- 		return;
- 	}
-@@ -734,9 +833,11 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data,
- 
- 		if (tstate->covered_by_sys_notify) {
- 			if (tstate->recursive) {
--				i_filter = instance->internal_subdir_filter;
-+				i_filter = watcher.sys_subdir_filter &
-+					   instance->instance.subdir_filter;
- 			} else {
--				i_filter = instance->internal_filter;
-+				i_filter = watcher.sys_filter &
-+					   instance->instance.filter;
- 			}
- 		} else {
- 			if (tstate->recursive) {
-@@ -1146,46 +1247,39 @@ static int notifyd_add_proxy_syswatches(struct db_record *rec,
- 	struct db_context *db = dbwrap_record_get_db(rec);
- 	TDB_DATA key = dbwrap_record_get_key(rec);
- 	TDB_DATA value = dbwrap_record_get_value(rec);
--	struct notifyd_instance *instances = NULL;
--	size_t num_instances = 0;
--	size_t i;
-+	struct notifyd_watcher watcher = {};
- 	char path[key.dsize+1];
- 	bool ok;
-+	int ret;
- 
- 	memcpy(path, key.dptr, key.dsize);
- 	path[key.dsize] = '\0';
- 
--	ok = notifyd_parse_entry(value.dptr, value.dsize, &instances,
--				 &num_instances);
-+	/* This is a remote database, we just need the watcher. */
-+	ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL);
- 	if (!ok) {
- 		DBG_WARNING("Could not parse notifyd entry for %s\n", path);
- 		return 0;
- 	}
- 
--	for (i=0; i<num_instances; i++) {
--		struct notifyd_instance *instance = &instances[i];
--		uint32_t filter = instance->instance.filter;
--		uint32_t subdir_filter = instance->instance.subdir_filter;
--		int ret;
-+	watcher.sys_watch = NULL;
-+	watcher.sys_filter = watcher.filter;
-+	watcher.sys_subdir_filter = watcher.subdir_filter;
- 
--		/*
--		 * This is a remote database. Pointers that we were
--		 * given don't make sense locally. Initialize to NULL
--		 * in case sys_notify_watch fails.
--		 */
--		instances[i].sys_watch = NULL;
--
--		ret = state->sys_notify_watch(
--			db, state->sys_notify_ctx, path,
--			&filter, &subdir_filter,
--			notifyd_sys_callback, state->msg_ctx,
--			&instance->sys_watch);
--		if (ret != 0) {
--			DBG_WARNING("inotify_watch returned %s\n",
--				    strerror(errno));
--		}
-+	ret = state->sys_notify_watch(db,
-+				      state->sys_notify_ctx,
-+				      path,
-+				      &watcher.filter,
-+				      &watcher.subdir_filter,
-+				      notifyd_sys_callback,
-+				      state->msg_ctx,
-+				      &watcher.sys_watch);
-+	if (ret != 0) {
-+		DBG_WARNING("inotify_watch returned %s\n", strerror(errno));
- 	}
- 
-+	memcpy(value.dptr, &watcher, sizeof(struct notifyd_watcher));
-+
- 	return 0;
- }
- 
-@@ -1193,21 +1287,17 @@ static int notifyd_db_del_syswatches(struct db_record *rec, void *private_data)
- {
- 	TDB_DATA key = dbwrap_record_get_key(rec);
- 	TDB_DATA value = dbwrap_record_get_value(rec);
--	struct notifyd_instance *instances = NULL;
--	size_t num_instances = 0;
--	size_t i;
-+	struct notifyd_watcher watcher = {};
- 	bool ok;
- 
--	ok = notifyd_parse_entry(value.dptr, value.dsize, &instances,
--				 &num_instances);
-+	ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL);
- 	if (!ok) {
- 		DBG_WARNING("Could not parse notifyd entry for %.*s\n",
- 			    (int)key.dsize, (char *)key.dptr);
- 		return 0;
- 	}
--	for (i=0; i<num_instances; i++) {
--		TALLOC_FREE(instances[i].sys_watch);
--	}
-+	TALLOC_FREE(watcher.sys_watch);
-+
- 	return 0;
- }
- 
-diff --git a/source3/smbd/notifyd/notifyd_db.c b/source3/smbd/notifyd/notifyd_db.c
-index 18228619e9a..7dc3cd58081 100644
---- a/source3/smbd/notifyd/notifyd_db.c
-+++ b/source3/smbd/notifyd/notifyd_db.c
-@@ -40,7 +40,10 @@ static bool notifyd_parse_db_parser(TDB_DATA key, TDB_DATA value,
- 	memcpy(path, key.dptr, key.dsize);
- 	path[key.dsize] = 0;
- 
--	ok = notifyd_parse_entry(value.dptr, value.dsize, &instances,
-+	ok = notifyd_parse_entry(value.dptr,
-+				 value.dsize,
-+				 NULL,
-+				 &instances,
- 				 &num_instances);
- 	if (!ok) {
- 		DBG_DEBUG("Could not parse entry for path %s\n", path);
-diff --git a/source3/smbd/notifyd/notifyd_entry.c b/source3/smbd/notifyd/notifyd_entry.c
-index 539010de03a..f3b0e908136 100644
---- a/source3/smbd/notifyd/notifyd_entry.c
-+++ b/source3/smbd/notifyd/notifyd_entry.c
-@@ -21,22 +21,51 @@
-  * Parse an entry in the notifyd_context->entries database
-  */
- 
--bool notifyd_parse_entry(
--	uint8_t *buf,
--	size_t buflen,
--	struct notifyd_instance **instances,
--	size_t *num_instances)
-+/**
-+ * @brief Parse a notifyd database entry.
-+ *
-+ * The memory we pass down needs to be aligned. If it isn't aligned we can run
-+ * into obscure errors as we just point into the data buffer.
-+ *
-+ * @param data The data to parse
-+ * @param data_len The length of the data to parse
-+ * @param watcher A pointer to store the watcher data or NULL.
-+ * @param instances A pointer to store the array of notify instances or NULL.
-+ * @param pnum_instances The number of elements in the array. If you just want
-+ * the number of elements pass NULL for the watcher and instances pointers.
-+ *
-+ * @return true on success, false if an error occurred.
-+ */
-+bool notifyd_parse_entry(uint8_t *data,
-+			 size_t data_len,
-+			 struct notifyd_watcher *watcher,
-+			 struct notifyd_instance **instances,
-+			 size_t *pnum_instances)
- {
--	if ((buflen % sizeof(struct notifyd_instance)) != 0) {
--		DBG_WARNING("invalid buffer size: %zu\n", buflen);
-+	size_t ilen;
-+
-+	if (data_len < sizeof(struct notifyd_watcher)) {
- 		return false;
- 	}
- 
--	if (instances != NULL) {
--		*instances = (struct notifyd_instance *)buf;
-+	if (watcher != NULL) {
-+		*watcher = *((struct notifyd_watcher *)(uintptr_t)data);
- 	}
--	if (num_instances != NULL) {
--		*num_instances = buflen / sizeof(struct notifyd_instance);
-+
-+	ilen = data_len - sizeof(struct notifyd_watcher);
-+	if ((ilen % sizeof(struct notifyd_instance)) != 0) {
-+		return false;
-+	}
-+
-+	if (pnum_instances != NULL) {
-+		*pnum_instances = ilen / sizeof(struct notifyd_instance);
- 	}
-+	if (instances != NULL) {
-+		/* The (uintptr_t) cast removes a warning from -Wcast-align. */
-+		*instances =
-+			(struct notifyd_instance *)(uintptr_t)
-+				(data + sizeof(struct notifyd_watcher));
-+	}
-+
- 	return true;
- }
-diff --git a/source3/smbd/notifyd/notifyd_private.h b/source3/smbd/notifyd/notifyd_private.h
-index 36c08f47c54..db8e6e1c005 100644
---- a/source3/smbd/notifyd/notifyd_private.h
-+++ b/source3/smbd/notifyd/notifyd_private.h
-@@ -20,30 +20,48 @@
- #include "lib/util/server_id.h"
- #include "notifyd.h"
- 
-+
- /*
-- * notifyd's representation of a notify instance
-+ * Representation of a watcher for a path
-+ *
-+ * This will be stored in the db.
-  */
--struct notifyd_instance {
--	struct server_id client;
--	struct notify_instance instance;
--
--	void *sys_watch; /* inotify/fam/etc handle */
-+struct notifyd_watcher {
-+	/*
-+	 * This is an intersections of the filter the watcher is listening for.
-+	 */
-+	uint32_t filter;
-+	uint32_t subdir_filter;
- 
- 	/*
--	 * Filters after sys_watch took responsibility of some bits
-+	 * Those are inout variables passed to the sys_watcher. The sys_watcher
-+	 * will remove the bits it can't handle.
- 	 */
--	uint32_t internal_filter;
--	uint32_t internal_subdir_filter;
-+	uint32_t sys_filter;
-+	uint32_t sys_subdir_filter;
-+
-+	/* The handle for inotify/fam etc. */
-+	void *sys_watch;
-+};
-+
-+/*
-+ * Representation of a notifyd instance
-+ *
-+ * This will be stored in the db.
-+ */
-+struct notifyd_instance {
-+	struct server_id client;
-+	struct notify_instance instance;
- };
- 
- /*
-  * Parse an entry in the notifyd_context->entries database
-  */
- 
--bool notifyd_parse_entry(
--	uint8_t *buf,
--	size_t buflen,
--	struct notifyd_instance **instances,
--	size_t *num_instances);
-+bool notifyd_parse_entry(uint8_t *data,
-+			 size_t data_len,
-+			 struct notifyd_watcher *watcher,
-+			 struct notifyd_instance **instances,
-+			 size_t *num_instances);
- 
- #endif
--- 
-2.46.1
-
diff --git a/samba.spec b/samba.spec
index ba9f3ed..9dbc887 100644
--- a/samba.spec
+++ b/samba.spec
@@ -148,7 +148,7 @@
 %bcond lmdb 0
 %endif
 
-%global samba_version 4.21.3
+%global samba_version 4.22.0
 
 # The release field is extended:
 # <pkgrel>[.<extraver>][.<snapinfo>]%%{?dist}[.<minorbump>]
@@ -163,7 +163,7 @@
 #                    default is 1).
 %global samba_release %autorelease
 
-%global pre_release %nil
+%global pre_release rc1
 %if "x%{?pre_release}" != "x"
 %global samba_release %autorelease -p -e %pre_release
 %endif
@@ -176,7 +176,7 @@
 %global libdcerpc_so_version 0
 %global libndr_krb5pac_so_version 0
 %global libndr_nbt_so_version 0
-%global libndr_so_version 5
+%global libndr_so_version 6
 %global libndr_standard_so_version 0
 %global libnetapi_so_version 1
 %global libsamba_credentials_so_version 1
@@ -193,9 +193,9 @@
 %global libsmbclient_so_version 0
 %global libwbclient_so_version 0
 
-%global talloc_version 2.4.2
-%global tdb_version 1.4.12
-%global tevent_version 0.16.1
+%global talloc_version 2.4.3
+%global tdb_version 1.4.13
+%global tevent_version 0.16.2
 
 %global required_mit_krb5 1.20.1
 
@@ -250,10 +250,6 @@ Source18:       samba-winbind-systemd-sysusers.conf
 Source201:      README.downgrade
 Source202:      samba.abignore
 
-Patch0:         samba-4.21.0-s3-notifyd.patch
-Patch1:         samba-4-21-pycrypt.patch
-Patch2:         samba-4-21-fix-smbreadline.patch
-
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
 Requires: %{name}-common-libs = %{samba_depver}
@@ -2666,8 +2662,11 @@ fi
 %{python3_sitearch}/samba/dnsresolver.py
 %dir %{python3_sitearch}/samba/domain
 %{python3_sitearch}/samba/domain/__init__.py
+%dir %{python3_sitearch}/samba/domain/__pycache__
 %{python3_sitearch}/samba/domain/__pycache__/__init__.*.pyc
+%dir %{python3_sitearch}/samba/domain/models
 %{python3_sitearch}/samba/domain/models/__init__.py
+%dir %{python3_sitearch}/samba/domain/models/__pycache__
 %{python3_sitearch}/samba/domain/models/__pycache__/__init__.*.pyc
 %{python3_sitearch}/samba/domain/models/__pycache__/auth_policy.*.pyc
 %{python3_sitearch}/samba/domain/models/__pycache__/auth_silo.*.pyc
@@ -2876,28 +2875,28 @@ fi
 %dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__
 %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc
 %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy
-%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__init__.py
-%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py
 %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__
-%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/__init__.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/policy.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_from.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_to.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_from.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_to.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_from.py
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_to.py
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_from.py
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_to.py
 %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo
 %{python3_sitearch}/samba/netcmd/domain/auth/silo/__init__.py
-%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py
 %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__
 %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/__init__.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/member.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/silo.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py
 %{python3_sitearch}/samba/netcmd/domain/auth/silo/silo.py
 %{python3_sitearch}/samba/netcmd/domain/backup.py
 %dir %{python3_sitearch}/samba/netcmd/domain/claim
@@ -2950,6 +2949,7 @@ fi
 %{python3_sitearch}/samba/netcmd/schema.py
 %dir %{python3_sitearch}/samba/netcmd/service_account
 %{python3_sitearch}/samba/netcmd/service_account/__init__.py
+%dir %{python3_sitearch}/samba/netcmd/service_account/__pycache__
 %{python3_sitearch}/samba/netcmd/service_account/__pycache__/__init__.*.pyc
 %{python3_sitearch}/samba/netcmd/service_account/__pycache__/group_msa_membership.*.pyc
 %{python3_sitearch}/samba/netcmd/service_account/__pycache__/service_account.*.pyc
@@ -3238,6 +3238,7 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/py_credentials.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/registry.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/reparsepoints.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/rust.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/s3idmapdb.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/s3param.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/s3passdb.*.pyc
@@ -3471,6 +3472,7 @@ fi
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/netlogon.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/pkinit_tests.*.pyc
@@ -3513,6 +3515,7 @@ fi
 %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py
 %{python3_sitearch}/samba/tests/krb5/lockout_tests.py
 %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py
+%{python3_sitearch}/samba/tests/krb5/netlogon.py
 %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py
 %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py
 %{python3_sitearch}/samba/tests/krb5/pkinit_tests.py
@@ -3585,6 +3588,7 @@ fi
 %{python3_sitearch}/samba/tests/py_credentials.py
 %{python3_sitearch}/samba/tests/registry.py
 %{python3_sitearch}/samba/tests/reparsepoints.py
+%{python3_sitearch}/samba/tests/rust.py
 %{python3_sitearch}/samba/tests/s3idmapdb.py
 %{python3_sitearch}/samba/tests/s3param.py
 %{python3_sitearch}/samba/tests/s3passdb.py
@@ -3801,6 +3805,7 @@ fi
 %config(noreplace) %{_sysconfdir}/ctdb/ctdb.conf
 %config(noreplace) %{_sysconfdir}/ctdb/notify.sh
 %config(noreplace) %{_sysconfdir}/ctdb/debug-hung-script.sh
+%config(noreplace) %{_sysconfdir}/ctdb/ctdb-backup-persistent-tdbs.sh
 %config(noreplace) %{_sysconfdir}/ctdb/ctdb-crash-cleanup.sh
 %config(noreplace) %{_sysconfdir}/ctdb/debug_locks.sh
 
@@ -3844,8 +3849,8 @@ fi
 %{_libexecdir}/ctdb/ctdb_natgw
 %{_libexecdir}/ctdb/ctdb-path
 %{_libexecdir}/ctdb/ctdb_recovery_helper
+%{_libexecdir}/ctdb/ctdb_smnotify_helper
 %{_libexecdir}/ctdb/ctdb_takeover_helper
-%{_libexecdir}/ctdb/smnotify
 %{_libexecdir}/ctdb/statd_callout
 %{_libexecdir}/ctdb/statd_callout_helper
 %{_libexecdir}/ctdb/tdb_mutex_check
@@ -3894,6 +3899,7 @@ fi
 %{_datadir}/ctdb/events/legacy/60.nfs.script
 %{_datadir}/ctdb/events/legacy/70.iscsi.script
 %{_datadir}/ctdb/events/legacy/91.lvs.script
+%{_datadir}/ctdb/events/legacy/95.database.script
 %dir %{_datadir}/ctdb/scripts
 %{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh
 
diff --git a/sources b/sources
index 1055c45..300da04 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.21.3.tar.xz) = 62eb3bfe1aa1cc8aa68055d4caf21bdea6d6f5b0f767566bef1da210100b5dd17b7d60f5c47da01b0123d3a2c1c3689b1960ef2c2cbd4f804ff998ead994fc3f
-SHA512 (samba-4.21.3.tar.asc) = 11e40d32b783b7d57d3f35fe96a17e897719f65d796d965b371dfb58b8cf1f8ffe60c3047bea8c2b2b0d475fa55cd25237b9ba84d44b3d65a8cd53c6af760957
+SHA512 (samba-4.22.0rc1.tar.xz) = 70cefc0c84456ab88971c3eefeb287cf3366c83b6f726c8bcd9c209f7e891390d44230303cedf3ec989749a85a96adb3f5b64bf49b05e10289a0f52669eb3caf
+SHA512 (samba-4.22.0rc1.tar.asc) = 07fefd436fac1d5f8344e0a6cfcaa89c36ecb555f3c1484def24febe5c63df386021a726049245e5d08a636b9fddee8725e9cd09406555343b255a79903b768b

From 9547b086638785d54c9cdaca8b334984da47dca8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Thu, 13 Feb 2025 23:53:18 +0100
Subject: [PATCH 02/29] Update to Samba 4.22.0rc2

- resolves: rhbz#2345547

Guenther
---
 samba.spec | 2 +-
 sources    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/samba.spec b/samba.spec
index 9dbc887..7e88c49 100644
--- a/samba.spec
+++ b/samba.spec
@@ -163,7 +163,7 @@
 #                    default is 1).
 %global samba_release %autorelease
 
-%global pre_release rc1
+%global pre_release rc2
 %if "x%{?pre_release}" != "x"
 %global samba_release %autorelease -p -e %pre_release
 %endif
diff --git a/sources b/sources
index 300da04..b75ed0a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.22.0rc1.tar.xz) = 70cefc0c84456ab88971c3eefeb287cf3366c83b6f726c8bcd9c209f7e891390d44230303cedf3ec989749a85a96adb3f5b64bf49b05e10289a0f52669eb3caf
-SHA512 (samba-4.22.0rc1.tar.asc) = 07fefd436fac1d5f8344e0a6cfcaa89c36ecb555f3c1484def24febe5c63df386021a726049245e5d08a636b9fddee8725e9cd09406555343b255a79903b768b
+SHA512 (samba-4.22.0rc2.tar.xz) = e0211687c51e0261a170a1d84d44ce82d65e44ff0f18f92fd59dff464037efbc9408c532d5717f9e1ba6cce9160cbd27be60c16b3d5b6b707c48f71503621d90
+SHA512 (samba-4.22.0rc2.tar.asc) = aac019083d039f633dc6f3255972832c8071a7415bb7bb2ee355e2a0095118a1c6351daaa70c5c7e95b0524094f2443ca9331f50ae5e2776ebd0c89309bd03fd

From 25ced122733bf41fdb7da753037d59f9414748d1 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Fri, 14 Feb 2025 11:52:05 +0100
Subject: [PATCH 03/29] Make %bcond switches easier to understand

This also removes support for building on rhel8.
---
 samba.spec | 99 ++++++++++++++----------------------------------------
 1 file changed, 25 insertions(+), 74 deletions(-)

diff --git a/samba.spec b/samba.spec
index 7e88c49..680bd4f 100644
--- a/samba.spec
+++ b/samba.spec
@@ -6,7 +6,7 @@
 # or
 # rpmbuild --rebuild --with testsuite samba.src.rpm
 #
-%bcond_with testsuite
+%bcond testsuite 0
 
 # Build with internal talloc, tevent, tdb
 #
@@ -14,132 +14,97 @@
 # or
 # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm
 #
-%bcond_with includelibs
+%bcond includelibs 0
 
 # fedpkg mockbuild --with=ccache
-%bcond_with ccache
+%bcond ccache 0
 
 # ctdb is enabled by default, you can disable it with: --without clustering
-%bcond_without clustering
+%bcond clustering 1
 
 # Define _make_verbose if it doesn't exist (RHEL8)
 %{!?_make_verbose:%define _make_verbose V=1 VERBOSE=1}
 
 # Build with Active Directory Domain Controller support by default on Fedora
 %if 0%{?fedora}
-%bcond_without dc
+%bcond dc 1
 %else
-%bcond_with dc
+%bcond dc 0
 %endif
 
 # Build a libsmbclient package by default
-%bcond_without libsmbclient
+%bcond libsmbclient 1
 
 # Build a libwbclient package by default
-%bcond_without libwbclient
+%bcond libwbclient 1
 
 # Build with winexe by default
 %if 0%{?rhel}
 
 %ifarch x86_64
-%bcond_without winexe
+%bcond winexe 1
 %else
-%bcond_with winexe
+%bcond winexe 0
 #endifarch
 %endif
 
 %else
-%bcond_without winexe
+%bcond winexe 1
 %endif
 
 # Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora
 %if 0%{?fedora}
 
 %ifarch aarch64 ppc64le s390x x86_64 riscv64
-%bcond_without vfs_cephfs
-%bcond_without ceph_mutex
+%bcond vfs_cephfs 1
+%bcond ceph_mutex 1
 %else
-%bcond_with vfs_cephfs
-%bcond_with ceph_mutex
+%bcond vfs_cephfs 0
+%bcond ceph_mutex 0
 #endifarch
 %endif
 
 %else
-%bcond_with vfs_cephfs
-%bcond_with ceph_mutex
+%bcond vfs_cephfs 0
+%bcond ceph_mutex 0
 #endif fedora
 %endif
 
-# Build vfs_gluster module by default on 64bit Fedora
-%global is_rhgs 0
-%if "%{dist}" == ".el7rhgs" || "%{dist}" == ".el8rhgs"
-%global is_rhgs 1
-%endif
-
 %if 0%{?fedora}
 
 %ifarch aarch64 ppc64le s390x x86_64 riscv64
-%bcond_without vfs_glusterfs
+%bcond vfs_glusterfs 1
 %else
-%bcond_with vfs_glusterfs
+%bcond vfs_glusterfs 0
 #endifarch
 %endif
 
-#else rhel
-%else
-
-%if 0%{?is_rhgs}
-# Enable on rhgs x86_64
-%ifarch x86_64
-%bcond_without vfs_glusterfs
-%else
-%bcond_with vfs_glusterfs
-#endifarch
-%endif
-%else
-%bcond_with vfs_glusterfs
-#endif is_rhgs
-%endif
-
 #endif fedora
 %endif
 
 # Build vfs_io_uring module by default on 64bit Fedora
-%if 0%{?fedora} || 0%{?rhel} >= 8
-
 %ifarch aarch64 ppc64le s390x x86_64 riscv64
-%bcond_without vfs_io_uring
+%bcond vfs_io_uring 1
 %else
-%bcond_with vfs_io_uring
+%bcond vfs_io_uring 0
 #endifarch
 %endif
 
-%else
-%bcond_with vfs_io_uring
-#endif fedora || rhel >= 8
-%endif
-
 # Build the ctdb-pcp-pmda package by default on Fedora, except for i686 where
 # pcp is no longer supported
 %if 0%{?fedora}
 %ifnarch i686
-%bcond_without pcp_pmda
+%bcond pcp_pmda 1
 %endif
 %else
-%bcond_with pcp_pmda
+%bcond pcp_pmda 0
 %endif
 
 # Build the etcd helpers by default on Fedora
 %if 0%{?fedora}
-%bcond_without etcd_mutex
+%bcond etcd_mutex 1
 %else
-%bcond_with etcd_mutex
-%endif
-
-%if 0%{?fedora} || 0%{?rhel} >= 9
-%bcond_without gpupdate
-%else
-%bcond_with gpupdate
+%bcond etcd_mutex 0
 %endif
 
 %ifarch aarch64 ppc64le s390x x86_64
@@ -379,9 +344,7 @@ BuildRequires: librados-devel
 BuildRequires: python3-etcd
 %endif
 
-%if %{with gpupdate}
 BuildRequires: cepces-certmonger >= 0.3.8
-%endif
 
 # pidl requirements
 BuildRequires: perl(ExtUtils::MakeMaker)
@@ -775,7 +738,6 @@ Samba VFS module for GlusterFS integration.
 %endif
 
 ### GPUPDATE
-%if %{with gpupdate}
 %package gpupdate
 Summary: Samba GPO support for clients
 Requires: cepces-certmonger
@@ -789,9 +751,6 @@ Requires: python3-%{name}-dc = %{samba_depver}
 This package provides the samba-gpupdate tool to apply Group Policy Objects
 (GPO) on Samba clients.
 
-#endif with gpupdate
-%endif
-
 ### KRB5-PRINTING
 %package krb5-printing
 Summary: Samba CUPS backend for printing with Kerberos
@@ -1542,11 +1501,6 @@ for i in \
 done
 %endif
 
-%if %{without gpupdate}
-rm -f %{buildroot}%{_sbindir}/samba-gpupdate
-rm -f %{buildroot}%{_mandir}/man8/samba-gpupdate.8*
-%endif
-
 %if %{without vfs_glusterfs}
 rm -f %{buildroot}%{_mandir}/man8/vfs_glusterfs.8*
 %endif
@@ -2444,12 +2398,9 @@ fi
 %endif
 
 ### GPUPDATE
-%if %{with gpupdate}
 %files gpupdate
 %{_mandir}/man8/samba-gpupdate.8*
 %{_sbindir}/samba-gpupdate
-#endif with gpupdate
-%endif
 
 ### KRB5-PRINTING
 %files krb5-printing

From 2bed3a07266361e79c3d6abdfcc46ae3afb542fa Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Fri, 14 Feb 2025 14:30:24 +0100
Subject: [PATCH 04/29] Add LICENSE file of libldb

---
 samba.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/samba.spec b/samba.spec
index 680bd4f..9c84080 100644
--- a/samba.spec
+++ b/samba.spec
@@ -3892,6 +3892,7 @@ fi
 %endif
 
 %files -n libldb
+%license lib/ldb/LICENSE
 %{_libdir}/libldb.so.*
 %dir %{_libdir}/samba
 %{_libdir}/samba/libldb-key-value-private-samba.so

From e10ed71be7ce4da8b7d24e3c78d261cce57b62c9 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Fri, 14 Feb 2025 19:05:42 +0100
Subject: [PATCH 05/29] Fix the '--with includelibs' build

---
 samba.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/samba.spec b/samba.spec
index 9c84080..9e37fbb 100644
--- a/samba.spec
+++ b/samba.spec
@@ -3013,6 +3013,7 @@ fi
 
 %if %{with includelibs}
 %{_libdir}/samba/libpyldb-util.cpython*.so
+%{_libdir}/samba/libpytalloc-util.cpython*.so
 
 %{python3_sitearch}/__pycache__/_ldb_text*.pyc
 %{python3_sitearch}/__pycache__/_tdb_text*.pyc
@@ -3021,8 +3022,7 @@ fi
 %{python3_sitearch}/_tdb_text.py
 %{python3_sitearch}/_tevent.cpython*.so
 %{python3_sitearch}/ldb.cpython*.so
-#FIXME why is it missing?
-#%{python3_sitearch}/talloc.cpython*.so
+%{python3_sitearch}/talloc.cpython*.so
 %{python3_sitearch}/tdb.cpython*.so
 %{python3_sitearch}/tevent.py
 #endif with includelibs

From 926e2f0a2843dbe9513b38731443723e8f21f7f0 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Tue, 18 Feb 2025 11:00:44 +0100
Subject: [PATCH 06/29] Fix libldb built with '--with includelibs'

---
 samba.spec | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/samba.spec b/samba.spec
index 9e37fbb..cc94374 100644
--- a/samba.spec
+++ b/samba.spec
@@ -1205,9 +1205,12 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB
 %package -n libldb
 Summary: A schema-less, ldap like, API and database
 License: LGPL-3.0-or-later
+%if %{without includelibs}
 Requires: libtalloc%{?_isa} >= %{talloc_version}
 Requires: libtdb%{?_isa} >= %{tdb_version}
 Requires: libtevent%{?_isa} >= %{tevent_version}
+# /endif without includelibs
+%endif
 
 Provides: bundled(libreplace)
 Obsoletes: libldb < 0:2.10
@@ -1223,9 +1226,12 @@ servers, or use local tdb databases.
 Summary: Developer tools for the LDB library
 License: LGPL-3.0-or-later
 Requires: libldb%{?_isa} = %{samba_depver}
+%if %{without includelibs}
 Requires: libtdb-devel%{?_isa} >= %{tdb_version}
 Requires: libtalloc-devel%{?_isa} >= %{talloc_version}
 Requires: libtevent-devel%{?_isa} >= %{tevent_version}
+# /endif without includelibs
+%endif
 
 Obsoletes: libldb-devel < 0:2.10
 Provides: libldb-devel = 0:2.10
@@ -1250,7 +1256,10 @@ Tools to manage LDB files
 Summary: Python bindings for the LDB library
 License: LGPL-3.0-or-later
 Requires: libldb%{?_isa} = %{samba_depver}
+%if %{without includelibs}
 Requires: python3-tdb%{?_isa} >= %{tdb_version}
+# /endif without includelibs
+%endif
 Requires: samba-client-libs = %{samba_depver}
 %{?python_provide:%python_provide python3-ldb}
 

From 8739ca29c566b4ba8b368a659487a6d1d3bc7349 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Thu, 20 Feb 2025 18:39:08 +0100
Subject: [PATCH 07/29] Update to Samba 4.22.0rc3

- resolves: rhbz#2346803

Guenther
---
 samba.spec | 4 +++-
 sources    | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/samba.spec b/samba.spec
index cc94374..71388b2 100644
--- a/samba.spec
+++ b/samba.spec
@@ -128,7 +128,7 @@
 #                    default is 1).
 %global samba_release %autorelease
 
-%global pre_release rc2
+%global pre_release rc3
 %if "x%{?pre_release}" != "x"
 %global samba_release %autorelease -p -e %pre_release
 %endif
@@ -3511,9 +3511,11 @@ fi
 %dir %{python3_sitearch}/samba/tests/ndr
 %{python3_sitearch}/samba/tests/ndr/gkdi.py
 %{python3_sitearch}/samba/tests/ndr/gmsa.py
+%{python3_sitearch}/samba/tests/ndr/sd.py
 %dir %{python3_sitearch}/samba/tests/ndr/__pycache__
 %{python3_sitearch}/samba/tests/ndr/__pycache__/gkdi.*.pyc
 %{python3_sitearch}/samba/tests/ndr/__pycache__/gmsa.*.pyc
+%{python3_sitearch}/samba/tests/ndr/__pycache__/sd.*.pyc
 %{python3_sitearch}/samba/tests/ndr/__pycache__/wbint.*.pyc
 %{python3_sitearch}/samba/tests/ndr/wbint.py
 %{python3_sitearch}/samba/tests/netbios.py
diff --git a/sources b/sources
index b75ed0a..a7d3db0 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.22.0rc2.tar.xz) = e0211687c51e0261a170a1d84d44ce82d65e44ff0f18f92fd59dff464037efbc9408c532d5717f9e1ba6cce9160cbd27be60c16b3d5b6b707c48f71503621d90
-SHA512 (samba-4.22.0rc2.tar.asc) = aac019083d039f633dc6f3255972832c8071a7415bb7bb2ee355e2a0095118a1c6351daaa70c5c7e95b0524094f2443ca9331f50ae5e2776ebd0c89309bd03fd
+SHA512 (samba-4.22.0rc3.tar.xz) = fbfd87cbb874e8818061dfb5cc962e80148b8fe68ffa414c9345e70b49777b237c5f6eb633d546d12d47a3027e9da9098a7c08e91f6f87237e1515181e0b73d6
+SHA512 (samba-4.22.0rc3.tar.asc) = ba9ab3ecdd6912f302c9ba1cb8c12cce1d390c6703528796a7d75e6281d578d9bc19df7e612ebc4e6c7d58b964e0aebf108061f08da8af57668424e7ce968222

From 34ae6832adcee397451b6d37435ec23d6b251be1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Thu, 27 Feb 2025 20:00:34 +0100
Subject: [PATCH 08/29] Update to Samba 4.22.0rc4

- resolves: rhbz#2348758

Guenther
---
 samba.spec | 2 +-
 sources    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/samba.spec b/samba.spec
index 71388b2..1c9b659 100644
--- a/samba.spec
+++ b/samba.spec
@@ -128,7 +128,7 @@
 #                    default is 1).
 %global samba_release %autorelease
 
-%global pre_release rc3
+%global pre_release rc4
 %if "x%{?pre_release}" != "x"
 %global samba_release %autorelease -p -e %pre_release
 %endif
diff --git a/sources b/sources
index a7d3db0..2a41d3e 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.22.0rc3.tar.xz) = fbfd87cbb874e8818061dfb5cc962e80148b8fe68ffa414c9345e70b49777b237c5f6eb633d546d12d47a3027e9da9098a7c08e91f6f87237e1515181e0b73d6
-SHA512 (samba-4.22.0rc3.tar.asc) = ba9ab3ecdd6912f302c9ba1cb8c12cce1d390c6703528796a7d75e6281d578d9bc19df7e612ebc4e6c7d58b964e0aebf108061f08da8af57668424e7ce968222
+SHA512 (samba-4.22.0rc4.tar.xz) = 050f13471a5b21db7e9bf0a68326e2a821811b3a779758e275c7bcafeebe4534c0797e6beb76335ec31ab3a1b0a97c66d62b9c87ea4585d151810a0159946aca
+SHA512 (samba-4.22.0rc4.tar.asc) = f3d114f427935c3a3a5fc4e29a1ab9929163219fe0cc1a446df45cf2098a561b0765ed1ebab14e20d82b86328e2d1a8f03b565537b8e1fc539245fb93e55250c

From 23147a55025632631f1d3a20bc81e9ce4c35e5fe Mon Sep 17 00:00:00 2001
From: David Abdurachmanov <davidlt@rivosinc.com>
Date: Wed, 11 Dec 2024 17:45:11 +0200
Subject: [PATCH 09/29] Enable lmdb on riscv64

Solves configuration error:

[..]
Checking for a 64-bit host to support lmdb          : ok
Checking for lmdb >= 0.9.16                         : not found
Checking for header lmdb.h                          : no
Checking for lmdb >= 0.9.16 via header check        : not found
Samba AD DC and --enable-selftest requires lmdb 0.9.16 or later
[..]

Signed-off-by: David Abdurachmanov <davidlt@rivosinc.com>
---
 samba.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/samba.spec b/samba.spec
index 1c9b659..f40570f 100644
--- a/samba.spec
+++ b/samba.spec
@@ -107,7 +107,7 @@
 %bcond etcd_mutex 0
 %endif
 
-%ifarch aarch64 ppc64le s390x x86_64
+%ifarch aarch64 ppc64le s390x x86_64 riscv64
 %bcond lmdb 1
 %else
 %bcond lmdb 0

From 460952917bb4e22cca7b775aa63d1e129c92ae73 Mon Sep 17 00:00:00 2001
From: Andrea Bolognani <abologna@redhat.com>
Date: Tue, 25 Feb 2025 20:48:03 +0100
Subject: [PATCH 10/29] Re-enable mold on riscv64

mold didn't build successfully on riscv64 back when riscv64
support was added to samba, but that has changed since and
today there is no longer any reason not to use it.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
---
 samba.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/samba.spec b/samba.spec
index f40570f..ac9f967 100644
--- a/samba.spec
+++ b/samba.spec
@@ -315,7 +315,7 @@ BuildRequires: zlib-devel >= 1.2.3
 
 BuildRequires: pkgconfig(libsystemd)
 
-%ifnarch i686 riscv64
+%ifnarch i686
 %if 0%{?fedora} >= 37
 BuildRequires: mold
 %endif

From b8994ec49c00112838109f93252197b64b342496 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Tue, 4 Mar 2025 10:41:36 +0100
Subject: [PATCH 11/29] Set version for bundled libreplace

---
 samba.spec | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/samba.spec b/samba.spec
index ac9f967..2aa6242 100644
--- a/samba.spec
+++ b/samba.spec
@@ -249,7 +249,7 @@ Obsoletes: samba-swat < %{samba_depver}
 Provides: samba4-swat = %{samba_depver}
 Obsoletes: samba4-swat < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 BuildRequires: make
 BuildRequires: gcc
@@ -441,7 +441,7 @@ Obsoletes: samba4-client < %{samba_depver}
 Requires(post): %{_sbindir}/update-alternatives
 Requires(postun): %{_sbindir}/update-alternatives
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description client
 The %{name}-client package provides some SMB/CIFS clients to complement
@@ -494,7 +494,7 @@ Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 %endif
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %if %{without dc} && %{without testsuite}
 Obsoletes: samba-dc < %{samba_depver}
@@ -536,7 +536,7 @@ Requires: libnetapi = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 %endif
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description common-tools
 The samba-common-tools package contains tools for SMB/CIFS clients.
@@ -606,7 +606,7 @@ Requires: bind-utils
 Provides: samba4-dc = %{samba_depver}
 Obsoletes: samba4-dc < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description dc
 The samba-dc package provides AD Domain Controller functionality
@@ -634,7 +634,7 @@ Requires: libwbclient = %{samba_depver}
 Provides: samba4-dc-libs = %{samba_depver}
 Obsoletes: samba4-dc-libs < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description dc-libs
 The %{name}-dc-libs package contains the libraries needed by the DC to
@@ -653,7 +653,7 @@ Requires: bind
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description dc-bind-dlz
 The %{name}-dc-bind-dlz package contains the libraries for bind to manage all
@@ -689,7 +689,7 @@ Requires: %{name}-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description vfs-cephfs
 Samba VFS module for Ceph distributed storage system integration.
@@ -706,7 +706,7 @@ Requires: %{name}-client-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description vfs-iouring
 Samba VFS module for io_uring instance integration.
@@ -731,7 +731,7 @@ Requires: libwbclient = %{samba_depver}
 Obsoletes: samba-glusterfs < %{samba_depver}
 Provides: samba-glusterfs = %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description vfs-glusterfs
 Samba VFS module for GlusterFS integration.
@@ -791,7 +791,7 @@ Requires: libwbclient = %{samba_depver}
 Provides: samba4-libs = %{samba_depver}
 Obsoletes: samba4-libs < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description libs
 The %{name}-libs package contains the libraries needed by programs that link
@@ -892,7 +892,7 @@ Requires: libsmbclient = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 %endif
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description -n python3-%{name}
 The python3-%{name} package contains the Python 3 libraries needed by programs
@@ -966,7 +966,7 @@ Requires: perl(Archive::Tar)
 Provides: samba4-test = %{samba_depver}
 Obsoletes: samba4-test < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description test
 %{name}-test provides testing tools for both the server and client
@@ -986,7 +986,7 @@ Requires: libwbclient = %{samba_depver}
 Provides: %{name}-test-devel = %{samba_depver}
 Obsoletes: %{name}-test-devel < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description test-libs
 %{name}-test-libs provides libraries required by the testing tools.
@@ -1030,7 +1030,7 @@ Obsoletes: samba4-winbind < %{samba_depver}
 # Old NetworkManager expects the dispatcher scripts in a different place
 Conflicts: NetworkManager < 1.20
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description winbind
 The samba-winbind package provides the winbind NSS library, and some client
@@ -1053,7 +1053,7 @@ Requires: libwbclient = %{samba_depver}
 Provides: samba4-winbind-clients = %{samba_depver}
 Obsoletes: samba4-winbind-clients < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description winbind-clients
 The samba-winbind-clients package provides the wbinfo and ntlm_auth
@@ -1083,7 +1083,7 @@ Requires(post): %{_sbindir}/update-alternatives
 Requires(postun): %{_sbindir}/update-alternatives
 Requires(preun): %{_sbindir}/update-alternatives
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description winbind-krb5-locator
 The winbind krb5 locator is a plugin for the system kerberos library to allow
@@ -1099,7 +1099,7 @@ Requires: libwbclient = %{samba_depver}
 %endif
 Requires: pam
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description winbind-modules
 The samba-winbind-modules package provides the NSS library and a PAM module
@@ -1115,7 +1115,7 @@ Requires: %{name}-common-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description winexe
 Winexe is a Remote Windows-command executor
@@ -1151,7 +1151,7 @@ Requires(post): systemd-units
 Requires(preun): systemd-units
 Requires(postun): systemd-units
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description -n ctdb
 CTDB is a cluster implementation of the TDB database used by Samba and other
@@ -1212,7 +1212,7 @@ Requires: libtevent%{?_isa} >= %{tevent_version}
 # /endif without includelibs
 %endif
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 Obsoletes: libldb < 0:2.10
 Provides: libldb = 0:2.10
 Provides: libldb = %{samba_depver}

From 3bb52a5a6543e3206063246704afafe7187df859 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Tue, 4 Mar 2025 10:43:32 +0100
Subject: [PATCH 12/29] Add missing /run/ctdb dir to files list

---
 samba.spec | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/samba.spec b/samba.spec
index 2aa6242..78d3c22 100644
--- a/samba.spec
+++ b/samba.spec
@@ -3835,6 +3835,8 @@ fi
 %{_mandir}/man7/ctdb-tunables.7.gz
 %{_mandir}/man7/ctdb-statistics.7.gz
 
+%ghost %dir /run/ctdb
+
 %{_tmpfilesdir}/ctdb.conf
 
 %{_unitdir}/ctdb.service

From 0355abfef0da879012f30a5c28d982cdb1e9bfa4 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Tue, 4 Mar 2025 10:32:35 +0100
Subject: [PATCH 13/29] Set samba-usershare to noarch

It only includes configuration files.
---
 samba.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/samba.spec b/samba.spec
index 78d3c22..605fedb 100644
--- a/samba.spec
+++ b/samba.spec
@@ -996,6 +996,7 @@ Provides: bundled(libreplace) = %{samba_depver}
 Summary: Provides support for non-root user shares
 Requires: %{name} = %{samba_depver}
 Requires: %{name}-common-tools = %{samba_depver}
+BuildArch: noarch
 
 %description usershares
 Installing this package will provide a configuration file, group and

From d4d514afc46f6e5b16abf1477431f3881a23b744 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Tue, 4 Mar 2025 11:01:51 +0100
Subject: [PATCH 14/29] Set samba-tools to noarch

This only include a python scripts.
---
 samba.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/samba.spec b/samba.spec
index 605fedb..03442a5 100644
--- a/samba.spec
+++ b/samba.spec
@@ -556,6 +556,7 @@ Requires: lmdb
 Requires: tdb-tools
 Requires: python3-gpg
 %endif
+BuildArch: noarch
 
 %description tools
 The samba-tools package contains tools for Samba servers

From cf446e51f072b45c06245b7fb0d13c3819b2bd14 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Tue, 4 Mar 2025 11:02:47 +0100
Subject: [PATCH 15/29] Set samba-gpupdate to noarch

This only includes python scripts.
---
 samba.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/samba.spec b/samba.spec
index 03442a5..8cfd96c 100644
--- a/samba.spec
+++ b/samba.spec
@@ -747,6 +747,7 @@ Requires: %{name}-ldb-ldap-modules = %{samba_depver}
 Requires: python3-%{name} = %{samba_depver}
 # samba-tool needs python3-samba-dc also on non-dc build
 Requires: python3-%{name}-dc = %{samba_depver}
+BuildArch: noarch
 
 %description gpupdate
 This package provides the samba-gpupdate tool to apply Group Policy Objects

From 09a1f226b4c84669ca3823790d44c379e9e7cde5 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Tue, 4 Mar 2025 11:03:58 +0100
Subject: [PATCH 16/29] Set ctdb-etcd-mutex to noarch

This only includes python scripts.
---
 samba.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/samba.spec b/samba.spec
index 8cfd96c..941ad1a 100644
--- a/samba.spec
+++ b/samba.spec
@@ -1182,6 +1182,7 @@ Performance Co-Pilot (PCP) support for CTDB
 Summary: CTDB ETCD mutex helper
 Requires: ctdb = %{samba_depver}
 Requires: python3-etcd
+BuildArch: noarch
 
 %description -n ctdb-etcd-mutex
 Support for using an existing ETCD cluster as a mutex helper for CTDB

From e630ce35b77276a117eef57db594d43187d6a5ab Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Tue, 4 Mar 2025 11:06:07 +0100
Subject: [PATCH 17/29] Use spaces instead of tabs for krb5-printing scripts

Removes rpmlint warnings
---
 samba.spec | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/samba.spec b/samba.spec
index 941ad1a..bde77c1 100644
--- a/samba.spec
+++ b/samba.spec
@@ -1650,12 +1650,12 @@ fi
 
 %post krb5-printing
 %{_sbindir}/update-alternatives --install %{_libexecdir}/samba/cups_backend_smb \
-	cups_backend_smb \
-	%{_libexecdir}/samba/smbspool_krb5_wrapper 50
+    cups_backend_smb \
+    %{_libexecdir}/samba/smbspool_krb5_wrapper 50
 
 %postun krb5-printing
 if [ $1 -eq 0 ] ; then
-	%{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper
+    %{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper
 fi
 
 %ldconfig_scriptlets libs

From 39ad9b9ae4e3e42e274c954837f26a8fce41d45f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Thu, 6 Mar 2025 16:10:31 +0100
Subject: [PATCH 18/29] Update to Samba 4.22.0

- resolves: rhbz#2350342

Guenther
---
 samba.spec | 2 +-
 sources    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/samba.spec b/samba.spec
index bde77c1..6f6b70c 100644
--- a/samba.spec
+++ b/samba.spec
@@ -128,7 +128,7 @@
 #                    default is 1).
 %global samba_release %autorelease
 
-%global pre_release rc4
+%global pre_release %nil
 %if "x%{?pre_release}" != "x"
 %global samba_release %autorelease -p -e %pre_release
 %endif
diff --git a/sources b/sources
index 2a41d3e..914331f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.22.0rc4.tar.xz) = 050f13471a5b21db7e9bf0a68326e2a821811b3a779758e275c7bcafeebe4534c0797e6beb76335ec31ab3a1b0a97c66d62b9c87ea4585d151810a0159946aca
-SHA512 (samba-4.22.0rc4.tar.asc) = f3d114f427935c3a3a5fc4e29a1ab9929163219fe0cc1a446df45cf2098a561b0765ed1ebab14e20d82b86328e2d1a8f03b565537b8e1fc539245fb93e55250c
+SHA512 (samba-4.22.0.tar.xz) = 649c8808cf88e1f8df55e9df32cbb0a87afa0b5fe13b220fb5ee00506ed94f76073c9196866903a6061ea945670fc0a85f4c67940c86a18198e1cda22a75ea88
+SHA512 (samba-4.22.0.tar.asc) = 0098927156b01667d69e2850caf64156129d5da5aea557774acb43d4403d50759d48cf1c976ede4e7f312d75b639002aa1c11337e48922c7d7c5eeb0d057e900

From 5cf235e0927ceb524271c5cb86eaa5a72be28d5a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Thu, 6 Mar 2025 16:23:22 +0100
Subject: [PATCH 19/29] Turn on SMB 3.1.1 Unix Extensions in default smb.conf

Guenther
---
 smb.conf.example | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/smb.conf.example b/smb.conf.example
index 4e6b5d4..271f13b 100644
--- a/smb.conf.example
+++ b/smb.conf.example
@@ -269,6 +269,13 @@
 ;	map system = no
 ;	store dos attributes = yes
 
+# Turn on SMB 3.1.1 Unix Extensions by default
+#
+# Note: The Linux Kernel SMB3 client will negotiate unix extensions by default,
+# find more info in man mount.smb3(8). Linux 6.13 will finally support special
+# filetypes and symlink handling.
+
+	smb3 unix extensions = yes
 
 #============================ Share Definitions ==============================
 

From 1c181216208f5ddf53b41e35a72bf12d3e6c234e Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Tue, 4 Mar 2025 14:01:29 +0100
Subject: [PATCH 20/29] Revert "Set samba-tools to noarch"

This reverts commit f00c21e2a89e49b9aeb5a4915869dc392f99e429.

We can't set it to noarch as koji complains that "Requires: lmdb" is
present on some arches and not on others.
---
 samba.spec | 1 -
 1 file changed, 1 deletion(-)

diff --git a/samba.spec b/samba.spec
index 6f6b70c..d6d6e9d 100644
--- a/samba.spec
+++ b/samba.spec
@@ -556,7 +556,6 @@ Requires: lmdb
 Requires: tdb-tools
 Requires: python3-gpg
 %endif
-BuildArch: noarch
 
 %description tools
 The samba-tools package contains tools for Samba servers

From 8e57b7ea4d7d5d98d7bb081590d05e5b2168f67a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Thu, 6 Mar 2025 16:23:22 +0100
Subject: [PATCH 21/29] Turn on SMB 3.1.1 Unix Extensions in vendor smb.conf as
 well...

Guenther
---
 smb.conf.vendor | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/smb.conf.vendor b/smb.conf.vendor
index e45384d..748c6e5 100644
--- a/smb.conf.vendor
+++ b/smb.conf.vendor
@@ -18,6 +18,8 @@
 	load printers = yes
 	cups options = raw
 
+	smb3 unix extensions = yes
+
 	# Install samba-usershares package for support
 	include = /etc/samba/usershares.conf
 

From 6d3bdd4932d440297a083697d075d4843ab80ece Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Fri, 18 Apr 2025 02:26:37 +0200
Subject: [PATCH 22/29] Update to Samba 4.22.1

- resolves: rhbz#2360776

Guenther
---
 samba.spec | 2 +-
 sources    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/samba.spec b/samba.spec
index d6d6e9d..531958b 100644
--- a/samba.spec
+++ b/samba.spec
@@ -113,7 +113,7 @@
 %bcond lmdb 0
 %endif
 
-%global samba_version 4.22.0
+%global samba_version 4.22.1
 
 # The release field is extended:
 # <pkgrel>[.<extraver>][.<snapinfo>]%%{?dist}[.<minorbump>]
diff --git a/sources b/sources
index 914331f..8e2875d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.22.0.tar.xz) = 649c8808cf88e1f8df55e9df32cbb0a87afa0b5fe13b220fb5ee00506ed94f76073c9196866903a6061ea945670fc0a85f4c67940c86a18198e1cda22a75ea88
-SHA512 (samba-4.22.0.tar.asc) = 0098927156b01667d69e2850caf64156129d5da5aea557774acb43d4403d50759d48cf1c976ede4e7f312d75b639002aa1c11337e48922c7d7c5eeb0d057e900
+SHA512 (samba-4.22.1.tar.xz) = 34c5e63da50ccbf68f59d8fcea23711a18374a3f6e112cb62dde86ad084a4be0857ff347c763de2ae0eb14fb9991cf226d74c522ae61571feb518cec752dca67
+SHA512 (samba-4.22.1.tar.asc) = dd574647892f992312bdfeea9f1202a0a16cef667418e9cd239c7d6cca68f4dd0f34fbafca5c2d67fbc7b8ee888ca6798c4909960ce1b7eba39d8461f29f3341

From 30237b1f018d5b9eacb5f1cfa716ac455ce52bde Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Thu, 5 Jun 2025 19:14:20 +0200
Subject: [PATCH 23/29] Update to Samba 4.22.2

- resolves: rhbz#2370468
- resolves: rhbz#2370455 - Security fix for CVE-2025-0620

Guenther
---
 samba.spec | 2 +-
 sources    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/samba.spec b/samba.spec
index 531958b..a4eca83 100644
--- a/samba.spec
+++ b/samba.spec
@@ -113,7 +113,7 @@
 %bcond lmdb 0
 %endif
 
-%global samba_version 4.22.1
+%global samba_version 4.22.2
 
 # The release field is extended:
 # <pkgrel>[.<extraver>][.<snapinfo>]%%{?dist}[.<minorbump>]
diff --git a/sources b/sources
index 8e2875d..d93d58f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.22.1.tar.xz) = 34c5e63da50ccbf68f59d8fcea23711a18374a3f6e112cb62dde86ad084a4be0857ff347c763de2ae0eb14fb9991cf226d74c522ae61571feb518cec752dca67
-SHA512 (samba-4.22.1.tar.asc) = dd574647892f992312bdfeea9f1202a0a16cef667418e9cd239c7d6cca68f4dd0f34fbafca5c2d67fbc7b8ee888ca6798c4909960ce1b7eba39d8461f29f3341
+SHA512 (samba-4.22.2.tar.xz) = 8ce34210797e531c7624a033d4b68a424d7e698872cdac826109a66930257fad41396bca4b90d7a0fc8551ef2a640d8d8b875cf2115146360acee354d6483351
+SHA512 (samba-4.22.2.tar.asc) = 68c1dae279b732c7fcdab014fc670b6d90c0f139be53176d1275c756a30f28c86d40cd4e4edb90aab871470274ce65d58aae27e2d8eba5d5c1ebafbb192626fe

From 8953edf2cdf039e2be5c12ae70841bc11b6510da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Tue, 8 Jul 2025 00:50:10 +0200
Subject: [PATCH 24/29] Update to Samba 4.22.3

- resolves: #2376873

Guenther
---
 samba.spec | 2 +-
 sources    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/samba.spec b/samba.spec
index a4eca83..e18ac86 100644
--- a/samba.spec
+++ b/samba.spec
@@ -113,7 +113,7 @@
 %bcond lmdb 0
 %endif
 
-%global samba_version 4.22.2
+%global samba_version 4.22.3
 
 # The release field is extended:
 # <pkgrel>[.<extraver>][.<snapinfo>]%%{?dist}[.<minorbump>]
diff --git a/sources b/sources
index d93d58f..c47ad40 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.22.2.tar.xz) = 8ce34210797e531c7624a033d4b68a424d7e698872cdac826109a66930257fad41396bca4b90d7a0fc8551ef2a640d8d8b875cf2115146360acee354d6483351
-SHA512 (samba-4.22.2.tar.asc) = 68c1dae279b732c7fcdab014fc670b6d90c0f139be53176d1275c756a30f28c86d40cd4e4edb90aab871470274ce65d58aae27e2d8eba5d5c1ebafbb192626fe
+SHA512 (samba-4.22.3.tar.xz) = 426f5128eefc8e96677e507d6980756e7bc70d063c62a9d38d5c33b9c3eb54aaffe1fab5432e09f50d6dfc898635952df8122b2a1a9ee45a6a01702f3c91f43c
+SHA512 (samba-4.22.3.tar.asc) = 612d3bec57048168e5c0f95c2ce28daaf0dd29282ba34af26a590ff20c6187f5efaa5b717577d445df4f4752ded6f8ee139ab878b8ccb4cf41c2a38fb8b4694e

From cc54c0c19d6d1cad1da79712278d2133ae251cce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Thu, 10 Jul 2025 21:46:16 +0200
Subject: [PATCH 25/29] Fix get_kdc_ip_string handling for secondary KDCs

- resolves: bzso#15881

Guenther
---
 samba-4.22.x-get_kdc_ip_string.patch | 34 ++++++++++++++++++++++++++++
 samba.spec                           |  2 ++
 2 files changed, 36 insertions(+)
 create mode 100644 samba-4.22.x-get_kdc_ip_string.patch

diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch
new file mode 100644
index 0000000..9277c9b
--- /dev/null
+++ b/samba-4.22.x-get_kdc_ip_string.patch
@@ -0,0 +1,34 @@
+From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001
+From: Ralph Boehme <slow@samba.org>
+Date: Fri, 4 Jul 2025 17:50:40 +0200
+Subject: [PATCH] libads: fix get_kdc_ip_string() ...
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881
+
+Signed-off-by: Ralph Boehme <slow@samba.org>
+Reviewed-by: Guenther Deschner <gd@samba.org>
+
+Autobuild-User(master): Günther Deschner <gd@samba.org>
+Autobuild-Date(master): Mon Jul  7 16:46:29 UTC 2025 on atb-devel-224
+---
+ source3/libads/kerberos.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c
+index 75803500d31..145bc36cdb2 100644
+--- a/source3/libads/kerberos.c
++++ b/source3/libads/kerberos.c
+@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx,
+ 
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status));
++		result = talloc_move(mem_ctx, &kdc_str);
+ 		goto out;
+ 	}
+ 
+-- 
+2.50.0
+
diff --git a/samba.spec b/samba.spec
index e18ac86..0dabc07 100644
--- a/samba.spec
+++ b/samba.spec
@@ -215,6 +215,8 @@ Source18:       samba-winbind-systemd-sysusers.conf
 Source201:      README.downgrade
 Source202:      samba.abignore
 
+Patch0:         samba-4.22.x-get_kdc_ip_string.patch
+
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
 Requires: %{name}-common-libs = %{samba_depver}

From af56354596c2da74a7df058d1b5f81d72cafaaf7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Thu, 21 Aug 2025 18:39:36 +0200
Subject: [PATCH 26/29] Update to Samba 4.22.4

Guenther
---
 samba-4.22.x-get_kdc_ip_string.patch | 34 ----------------------------
 samba.spec                           |  4 +---
 sources                              |  4 ++--
 3 files changed, 3 insertions(+), 39 deletions(-)
 delete mode 100644 samba-4.22.x-get_kdc_ip_string.patch

diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch
deleted file mode 100644
index 9277c9b..0000000
--- a/samba-4.22.x-get_kdc_ip_string.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001
-From: Ralph Boehme <slow@samba.org>
-Date: Fri, 4 Jul 2025 17:50:40 +0200
-Subject: [PATCH] libads: fix get_kdc_ip_string() ...
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881
-
-Signed-off-by: Ralph Boehme <slow@samba.org>
-Reviewed-by: Guenther Deschner <gd@samba.org>
-
-Autobuild-User(master): Günther Deschner <gd@samba.org>
-Autobuild-Date(master): Mon Jul  7 16:46:29 UTC 2025 on atb-devel-224
----
- source3/libads/kerberos.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c
-index 75803500d31..145bc36cdb2 100644
---- a/source3/libads/kerberos.c
-+++ b/source3/libads/kerberos.c
-@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx,
- 
- 	if (!NT_STATUS_IS_OK(status)) {
- 		DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status));
-+		result = talloc_move(mem_ctx, &kdc_str);
- 		goto out;
- 	}
- 
--- 
-2.50.0
-
diff --git a/samba.spec b/samba.spec
index 0dabc07..6325c66 100644
--- a/samba.spec
+++ b/samba.spec
@@ -113,7 +113,7 @@
 %bcond lmdb 0
 %endif
 
-%global samba_version 4.22.3
+%global samba_version 4.22.4
 
 # The release field is extended:
 # <pkgrel>[.<extraver>][.<snapinfo>]%%{?dist}[.<minorbump>]
@@ -215,8 +215,6 @@ Source18:       samba-winbind-systemd-sysusers.conf
 Source201:      README.downgrade
 Source202:      samba.abignore
 
-Patch0:         samba-4.22.x-get_kdc_ip_string.patch
-
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
 Requires: %{name}-common-libs = %{samba_depver}
diff --git a/sources b/sources
index c47ad40..599a26d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.22.3.tar.xz) = 426f5128eefc8e96677e507d6980756e7bc70d063c62a9d38d5c33b9c3eb54aaffe1fab5432e09f50d6dfc898635952df8122b2a1a9ee45a6a01702f3c91f43c
-SHA512 (samba-4.22.3.tar.asc) = 612d3bec57048168e5c0f95c2ce28daaf0dd29282ba34af26a590ff20c6187f5efaa5b717577d445df4f4752ded6f8ee139ab878b8ccb4cf41c2a38fb8b4694e
+SHA512 (samba-4.22.4.tar.xz) = d04db845227ace43642ba69da4ded80d576db01d2e6a7e3e3161c05ce20ff77bd944d39aaf35adab59bed607e0037713969cb9a855a367ab65d021c5aef7ea46
+SHA512 (samba-4.22.4.tar.asc) = ee1b66c6094f6c44954470432676034afc557db84f28a6ef37ea770d987cd5dddf6f6e8c179f3344cf04abc1c6696bbaa5ae031119edc58ea533b464d77641d9

From 75445746a3ef5353df6d53fb0860641b69eb1e62 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Wed, 15 Oct 2025 23:32:40 +0200
Subject: [PATCH 27/29] Update to Samba 4.22.5

- resolves: rhbz#2391698 - Security fix for CVE-2025-9640
- resolves: rhbz#2394377 - Security fix for CVE-2025-10230

Guenther
---
 samba.spec | 2 +-
 sources    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/samba.spec b/samba.spec
index 6325c66..551f28a 100644
--- a/samba.spec
+++ b/samba.spec
@@ -113,7 +113,7 @@
 %bcond lmdb 0
 %endif
 
-%global samba_version 4.22.4
+%global samba_version 4.22.5
 
 # The release field is extended:
 # <pkgrel>[.<extraver>][.<snapinfo>]%%{?dist}[.<minorbump>]
diff --git a/sources b/sources
index 599a26d..dde7a32 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.22.4.tar.xz) = d04db845227ace43642ba69da4ded80d576db01d2e6a7e3e3161c05ce20ff77bd944d39aaf35adab59bed607e0037713969cb9a855a367ab65d021c5aef7ea46
-SHA512 (samba-4.22.4.tar.asc) = ee1b66c6094f6c44954470432676034afc557db84f28a6ef37ea770d987cd5dddf6f6e8c179f3344cf04abc1c6696bbaa5ae031119edc58ea533b464d77641d9
+SHA512 (samba-4.22.5.tar.xz) = 096043ffb2a3a462718e449f9c892101a65e8061529b03753cc029a950c63e37e5b0e11c7c974e3c2baa2ac6b58138b4d975bea6db0ea79df15d40a56b3ffc87
+SHA512 (samba-4.22.5.tar.asc) = 7a3f233eb03460aafe5a146e55213b6300a9b4ef1b71754a44a83a530eba0e06d0db19b73ade2c218261e8899742a095517d2ce2af9c8b41e11596604c94157d

From 209170dee79562713a9d1cbd5b751a292cef78d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Fri, 17 Oct 2025 13:37:52 +0200
Subject: [PATCH 28/29] Update to Samba 4.22.6

Guenther
---
 samba.spec | 4 +++-
 sources    | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/samba.spec b/samba.spec
index 551f28a..f58e45e 100644
--- a/samba.spec
+++ b/samba.spec
@@ -113,7 +113,7 @@
 %bcond lmdb 0
 %endif
 
-%global samba_version 4.22.5
+%global samba_version 4.22.6
 
 # The release field is extended:
 # <pkgrel>[.<extraver>][.<snapinfo>]%%{?dist}[.<minorbump>]
@@ -3319,6 +3319,7 @@ fi
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc
+%{python3_sitearch}/samba/tests/dcerpc/__pycache__/dfs.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc
@@ -3339,6 +3340,7 @@ fi
 %{python3_sitearch}/samba/tests/dcerpc/array.py
 %{python3_sitearch}/samba/tests/dcerpc/bare.py
 %{python3_sitearch}/samba/tests/dcerpc/binding.py
+%{python3_sitearch}/samba/tests/dcerpc/dfs.py
 %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py
 %{python3_sitearch}/samba/tests/dcerpc/integer.py
 %{python3_sitearch}/samba/tests/dcerpc/lsa.py
diff --git a/sources b/sources
index dde7a32..9d2b26d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.22.5.tar.xz) = 096043ffb2a3a462718e449f9c892101a65e8061529b03753cc029a950c63e37e5b0e11c7c974e3c2baa2ac6b58138b4d975bea6db0ea79df15d40a56b3ffc87
-SHA512 (samba-4.22.5.tar.asc) = 7a3f233eb03460aafe5a146e55213b6300a9b4ef1b71754a44a83a530eba0e06d0db19b73ade2c218261e8899742a095517d2ce2af9c8b41e11596604c94157d
+SHA512 (samba-4.22.6.tar.xz) = b68bdabccbd1f8f132f6271577efba4eedb0573cbf6e3a83c45d0009b63f9278736bcbbe212682e7068830e2c1c617e2d7840a50d30f32e31134bc33c18e390a
+SHA512 (samba-4.22.6.tar.asc) = 633402f4f3698785ab938713149fc9bc7a620336cc608c70cd2d05d27176ad47aaee31e98e5cc7be2200a5cefbd04810dd3cd3ed7e1388a4a88857ff5821da4b

From 620bccef183fcca63058a49e71698392457299a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Fri, 19 Dec 2025 13:23:20 +0100
Subject: [PATCH 29/29] Update to Samba 4.22.7

Guenther
---
 samba.spec | 2 +-
 sources    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/samba.spec b/samba.spec
index f58e45e..1a61e99 100644
--- a/samba.spec
+++ b/samba.spec
@@ -113,7 +113,7 @@
 %bcond lmdb 0
 %endif
 
-%global samba_version 4.22.6
+%global samba_version 4.22.7
 
 # The release field is extended:
 # <pkgrel>[.<extraver>][.<snapinfo>]%%{?dist}[.<minorbump>]
diff --git a/sources b/sources
index 9d2b26d..774e88c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.22.6.tar.xz) = b68bdabccbd1f8f132f6271577efba4eedb0573cbf6e3a83c45d0009b63f9278736bcbbe212682e7068830e2c1c617e2d7840a50d30f32e31134bc33c18e390a
-SHA512 (samba-4.22.6.tar.asc) = 633402f4f3698785ab938713149fc9bc7a620336cc608c70cd2d05d27176ad47aaee31e98e5cc7be2200a5cefbd04810dd3cd3ed7e1388a4a88857ff5821da4b
+SHA512 (samba-4.22.7.tar.xz) = b06ef2893d302e0bdb6b137f70e46ba35e2b7daf1ab7f97880fee430170ecad4c4faa188e6193ff39a4475143770bc37d9145935994fceb903f826442a92b6b5
+SHA512 (samba-4.22.7.tar.asc) = 6fb05d0cc13ff0e82d9eda3ac94a34e7ac124fd9348e9462bf1662f37c58cd093aa91d3aed8e0ecbf76436a39f011b3b21162c03e6cb3a76fc7d79d244588fca