rpminspect: Don't run annocheck on test binaries

[skip changelog]

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1,201 +1,4 @@
-samba-3.5.4.tar.gz
-samba-3.6.0pre1.tar.gz
-/samba-3.6.0pre2.tar.gz
-/samba-3.6.0pre3.tar.gz
-/samba-3.6.0rc1.tar.gz
-/samba-3.6.0rc2.tar.gz
-/samba-3.6.0rc3.tar.gz
-/samba-3.6.0.tar.gz
-/samba-3.6.1.tar.gz
-/samba-3.6.3.tar.gz
-/samba-3.6.4.tar.gz
-/samba-3.6.5.tar.gz
-/samba-3.6.6.tar.gz
-/samba-3.6.7.tar.gz
-/samba-4.0.0rc1.tar.bz2
-/samba-4.0.0rc2.tar.bz2
-/samba-4.0.0rc3.tar.bz2
-/samba-4.0.0rc4.tar.bz2
-/samba-4.0.0rc5.tar.bz2
-/samba-4.0.0rc6.tar.bz2
-/samba-4.0.0.tar.bz2
-/samba-4.0.1.tar.bz2
-/samba-4.0.2.tar.bz2
-/samba-4.0.3.tar.bz2
-/samba-4.0.4.tar.bz2
-/samba-4.0.5.tar.bz2
-/samba-4.0.6.tar.bz2
-/samba-4.0.7.tar.xz
-/samba-4.1.0rc1.tar.xz
-/samba-4.1.0rc2.tar.xz
-/samba-4.1.0rc3.tar.xz
-/samba-4.1.0rc4.tar.xz
-/samba-4.1.0.tar.xz
-/samba-4.1.1.tar.xz
-/samba-4.1.2.tar.xz
-/samba-4.1.3.tar.xz
-/samba-4.1.4.tar.xz
-/samba-4.1.5.tar.xz
-/samba-4.1.6.tar.xz
-/samba-4.1.8.tar.xz
-/samba-4.1.9.tar.xz
-/samba-4.1.11.tar.gz
-/samba-4.1.11.tar.xz
-/samba-4.1.12.tar.xz
-/samba-4.2.0rc2.tar.xz
-/samba-4.2.0rc3.tar.xz
-/samba-4.2.0rc4.tar.xz
-/samba-4.2.0rc5.tar.xz
-/samba-4.2.0.tar.xz
-/samba-4.2.1.tar.xz
-/samba-4.2.2.tar.xz
-/samba-4.2.3.tar.xz
-/samba-4.3.0rc3.tar.xz
-/samba-4.3.0rc4.tar.xz
-/samba-4.3.0.tar.xz
-/samba-4.3.1.tar.xz
-/samba-4.3.2.tar.xz
-/samba-4.3.3.tar.xz
-/samba-4.3.4.tar.xz
-/samba-4.4.0rc1.tar.xz
-/samba-4.4.0rc2.tar.xz
-/samba-4.4.0rc3.tar.xz
-/samba-4.4.0rc4.tar.xz
-/samba-4.4.0rc5.tar.xz
-/samba-4.4.0.tar.xz
-/samba-4.4.2.tar.xz
-/samba-4.4.3.tar.xz
-/samba-4.4.4.tar.xz
-/samba-4.4.5.tar.xz
-/samba-4.5.0rc1.tar.xz
-/samba-4.5.0rc2.tar.xz
-/samba-4.5.0rc3.tar.xz
-/samba-4.5.0.tar.xz
-/samba-4.5.1.tar.xz
-/samba-4.5.2.tar.xz
-/samba-4.5.3.tar.xz
-/samba-4.6.0rc1.tar.xz
-/samba-4.6.0rc2.tar.xz
-/samba-4.6.0rc2.tar.asc
-/samba-4.6.0rc3.tar.asc
-/samba-4.6.0rc3.tar.xz
-/samba-4.6.0rc4.tar.xz
-/samba-4.6.0rc4.tar.asc
-/samba-4.6.0.tar.asc
-/samba-4.6.0.tar.xz
-/samba-4.6.1.tar.xz
-/samba-4.6.1.tar.asc
-/samba-4.6.2.tar.xz
-/samba-4.6.2.tar.asc
-/samba-4.6.3.tar.xz
-/samba-4.6.3.tar.asc
-/samba-4.6.4.tar.xz
-/samba-4.6.4.tar.asc
-/samba-4.6.5.tar.xz
-/samba-4.6.5.tar.asc
-/samba-4.7.0rc1.tar.xz
-/samba-4.7.0rc1.tar.asc
-/samba-4.7.0rc3.tar.xz
-/samba-4.7.0rc3.tar.asc
-/samba-4.7.0rc5.tar.xz
-/samba-4.7.0rc5.tar.asc
-/samba-4.7.0rc6.tar.xz
-/samba-4.7.0rc6.tar.asc
-/samba-4.7.0.tar.xz
-/samba-4.7.0.tar.asc
-/samba-4.7.1.tar.xz
-/samba-4.7.1.tar.asc
-/samba-4.7.2.tar.xz
-/samba-4.7.2.tar.asc
-/samba-4.7.3.tar.xz
-/samba-4.7.3.tar.asc
-/samba-4.7.4.tar.xz
-/samba-4.7.4.tar.asc
-/samba-4.8.0rc1.tar.xz
-/samba-4.8.0rc1.tar.asc
-/samba-4.8.0rc2.tar.xz
-/samba-4.8.0rc2.tar.asc
-/samba-4.8.0rc3.tar.xz
-/samba-4.8.0rc3.tar.asc
-/samba-4.8.0rc4.tar.xz
-/samba-4.8.0rc4.tar.asc
-/samba-4.8.0.tar.xz
-/samba-4.8.0.tar.asc
-/samba-4.8.1.tar.xz
-/samba-4.8.1.tar.asc
-/samba-4.8.2.tar.xz
-/samba-4.8.2.tar.asc
-/samba-4.8.3.tar.asc
-/samba-4.8.3.tar.xz
-/samba-4.9.0rc1.tar.xz
-/samba-4.9.0rc1.tar.asc
-/samba-4.9.0rc2.tar.xz
-/samba-4.9.0rc2.tar.asc
-/samba-4.9.0rc3.tar.xz
-/samba-4.9.0rc3.tar.asc
-/samba-4.9.0rc4.tar.xz
-/samba-4.9.0rc4.tar.asc
-/samba-4.9.0rc5.tar.asc
-/samba-4.9.0rc5.tar.xz
-/samba-4.9.0.tar.xz
-/samba-4.9.0.tar.asc
-/samba-4.9.1.tar.asc
-/samba-4.9.1.tar.xz
-/samba-4.9.2.tar.xz
-/samba-4.9.2.tar.asc
-/samba-4.9.3.tar.xz
-/samba-4.9.3.tar.asc
-/samba-4.9.4.tar.xz
-/samba-4.9.4.tar.asc
-/samba-4.10.0rc1.tar.xz
-/samba-4.10.0rc1.tar.asc
-/samba-4.10.0rc2.tar.xz
-/samba-4.10.0rc2.tar.asc
-/samba-4.10.0rc3.tar.xz
-/samba-4.10.0rc3.tar.asc
-/samba-4.10.0rc4.tar.xz
-/samba-4.10.0rc4.tar.asc
-/samba-4.10.0.tar.xz
-/samba-4.10.0.tar.asc
-/samba-4.10.1.tar.xz
-/samba-4.10.1.tar.asc
-/samba-4.10.2.tar.xz
-/samba-4.10.2.tar.asc
-/samba-4.10.3.tar.xz
-/samba-4.10.3.tar.asc
-/samba-4.10.4.tar.xz
-/samba-4.10.4.tar.asc
-/samba-4.10.5.tar.xz
-/samba-4.10.5.tar.asc
-/samba-4.10.6.tar.xz
-/samba-4.10.6.tar.asc
-/samba-4.11.0rc1.tar.xz
-/samba-4.11.0rc1.tar.asc
-/samba-4.11.0rc2.tar.xz
-/samba-4.11.0rc2.tar.asc
-/samba-4.11.0rc3.tar.xz
-/samba-4.11.0rc3.tar.asc
-/samba-4.11.0rc4.tar.xz
-/samba-4.11.0rc4.tar.asc
-/samba-4.11.0.tar.xz
-/samba-4.11.0.tar.asc
-/samba-4.11.1.tar.xz
-/samba-4.11.1.tar.asc
-/samba-4.11.2.tar.xz
-/samba-4.11.2.tar.asc
-/samba-4.11.3.tar.xz
-/samba-4.11.3.tar.asc
-/samba-4.11.4.tar.xz
-/samba-4.11.4.tar.asc
-/samba-4.11.5.tar.xz
-/samba-4.11.5.tar.asc
-/samba-4.12.0rc1.tar.xz
-/samba-4.12.0rc1.tar.asc
-/samba-4.12.0rc2.tar.xz
-/samba-4.12.0rc2.tar.asc
-/samba-4.12.0rc3.tar.xz
-/samba-4.12.0rc3.tar.asc
-/samba-4.12.0rc4.tar.xz
-/samba-4.12.0rc4.tar.asc
-/samba-4.12.0.tar.xz
-/samba-4.12.0.tar.asc
+/samba-*.tar.xz
+/samba-*.tar.asc
+/*.rpm
+/results_samba

filter-requires-samba.sh

@@ -1,3 +0,0 @@
-#!/bin/sh
-
-/usr/lib/rpm/perl.req $* | grep -E -v '(Net::LDAP|Crypt::SmbHash|CGI|Unicode::MapUTF8|smbldap_tools|Carp|Convert::ASN1|Getopt::Long|Getopt::Std|IO::Socket|POSIX|Time::Local|strict)'

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_stable
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

new_mit_118.patch

@@ -1,174 +0,0 @@
-From 04b262f686b5b16ba659ade1e4b5778e2b219f0a Mon Sep 17 00:00:00 2001
-From: Isaac Boukris <iboukris@gmail.com>
-Date: Mon, 16 Sep 2019 16:40:12 +0300
-Subject: [PATCH 1/2] Adapt sign_authdata in our KDB module for krb5 v1.18
-
-Signed-off-by: Isaac Boukris <iboukris@samba.org>
----
- source4/kdc/mit-kdb/kdb_samba.c          |  2 +-
- source4/kdc/mit-kdb/kdb_samba.h          | 21 +++++++++++++++++++++
- source4/kdc/mit-kdb/kdb_samba_policies.c | 24 ++++++++++++++++++++++++
- 3 files changed, 46 insertions(+), 1 deletion(-)
-
-diff --git a/source4/kdc/mit-kdb/kdb_samba.c b/source4/kdc/mit-kdb/kdb_samba.c
-index c5157d6ed1b..02bbdca9f54 100644
---- a/source4/kdc/mit-kdb/kdb_samba.c
-+++ b/source4/kdc/mit-kdb/kdb_samba.c
-@@ -139,7 +139,7 @@ static void kdb_samba_db_free_principal_e_data(krb5_context context,
- 
- kdb_vftabl kdb_function_table = {
- 	.maj_ver                   = KRB5_KDB_DAL_MAJOR_VERSION,
--	.min_ver                   = 1,
-+	.min_ver                   = KRB5_KDB_DAL_MAJOR_VERSION == 6 ? 1 : 0,
- 
- 	.init_library              = kdb_samba_init_library,
- 	.fini_library              = kdb_samba_fini_library,
-diff --git a/source4/kdc/mit-kdb/kdb_samba.h b/source4/kdc/mit-kdb/kdb_samba.h
-index 22ef9085b6a..ad4f6e27573 100644
---- a/source4/kdc/mit-kdb/kdb_samba.h
-+++ b/source4/kdc/mit-kdb/kdb_samba.h
-@@ -114,6 +114,7 @@ krb5_error_code kdb_samba_dbekd_encrypt_key_data(krb5_context context,
- 
- /* from kdb_samba_policies.c */
- 
-+#if KRB5_KDB_API_VERSION < 10
- krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 					    unsigned int flags,
- 					    krb5_const_principal client_princ,
-@@ -127,6 +128,26 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 					    krb5_timestamp authtime,
- 					    krb5_authdata **tgt_auth_data,
- 					    krb5_authdata ***signed_auth_data);
-+#else
-+krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
-+					    unsigned int flags,
-+					    krb5_const_principal client_princ,
-+					    krb5_const_principal server_princ,
-+					    krb5_db_entry *client,
-+					    krb5_db_entry *server,
-+					    krb5_db_entry *krbtgt,
-+					    krb5_db_entry *local_krbtgt,
-+					    krb5_keyblock *client_key,
-+					    krb5_keyblock *server_key,
-+					    krb5_keyblock *krbtgt_key,
-+					    krb5_keyblock *local_krbtgt_key,
-+					    krb5_keyblock *session_key,
-+					    krb5_timestamp authtime,
-+					    krb5_authdata **tgt_auth_data,
-+					    void *authdata_info,
-+					    krb5_data ***auth_indicators,
-+					    krb5_authdata ***signed_auth_data);
-+#endif
- 
- krb5_error_code kdb_samba_db_check_policy_as(krb5_context context,
- 					     krb5_kdc_req *kdcreq,
-diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c
-index fc80329f221..e2f7174b0c2 100644
---- a/source4/kdc/mit-kdb/kdb_samba_policies.c
-+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c
-@@ -287,6 +287,7 @@ done:
- 	return code;
- }
- 
-+#if KRB5_KDB_API_VERSION < 10
- krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 					    unsigned int flags,
- 					    krb5_const_principal client_princ,
-@@ -301,6 +302,29 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 					    krb5_authdata **tgt_auth_data,
- 					    krb5_authdata ***signed_auth_data)
- {
-+#else
-+krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
-+					    unsigned int flags,
-+					    krb5_const_principal client_princ,
-+					    krb5_const_principal server_princ,
-+					    krb5_db_entry *client,
-+					    krb5_db_entry *server,
-+					    krb5_db_entry *krbtgt,
-+					    krb5_db_entry *local_krbtgt,
-+					    krb5_keyblock *client_key,
-+					    krb5_keyblock *server_key,
-+					    krb5_keyblock *krbtgt_key,
-+					    krb5_keyblock *local_krbtgt_key,
-+					    krb5_keyblock *session_key,
-+					    krb5_timestamp authtime,
-+					    krb5_authdata **tgt_auth_data,
-+					    void *authdata_info,
-+					    krb5_data ***auth_indicators,
-+					    krb5_authdata ***signed_auth_data)
-+{
-+	krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt;
-+	krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key;
-+#endif
- 	krb5_const_principal ks_client_princ;
- 	krb5_authdata **authdata = NULL;
- 	krb5_boolean is_as_req;
--- 
-2.24.1
-
-
-From c968ec07fa403ed919dcda7b3087e0d10d1e7a32 Mon Sep 17 00:00:00 2001
-From: Isaac Boukris <iboukris@gmail.com>
-Date: Thu, 16 Jan 2020 22:00:21 +0100
-Subject: [PATCH 2/2] Sign and verify PAC with ticket principal instead of
- canon principal
-
-With MIT library 1.18 the KDC no longer set
-KRB5_KDB_FLAG_CANONICALIZE for enterprise principals which allows
-us to not canonicalize them (like in Windwos / Heimdal).
-
-However, it now breaks the PAC signature verification as it was
-wrongly done using canonical client rather than ticket client name.
-
-Signed-off-by: Isaac Boukris <iboukris@samba.org>
----
- source4/kdc/mit-kdb/kdb_samba_policies.c | 12 ++----------
- 1 file changed, 2 insertions(+), 10 deletions(-)
-
-diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c
-index e2f7174b0c2..6a5f06a8a8c 100644
---- a/source4/kdc/mit-kdb/kdb_samba_policies.c
-+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c
-@@ -325,20 +325,12 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 	krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt;
- 	krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key;
- #endif
--	krb5_const_principal ks_client_princ;
- 	krb5_authdata **authdata = NULL;
- 	krb5_boolean is_as_req;
- 	krb5_error_code code;
- 	krb5_pac pac = NULL;
- 	krb5_data pac_data;
- 
--	/* Prefer canonicalised name from client entry */
--	if (client != NULL) {
--		ks_client_princ = client->princ;
--	} else {
--		ks_client_princ = client_princ;
--	}
--
- 	is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
- 
- 	if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) {
-@@ -351,7 +343,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 	if (!is_as_req) {
- 		code = ks_verify_pac(context,
- 				     flags,
--				     ks_client_princ,
-+				     client_princ,
- 				     client,
- 				     server,
- 				     krbtgt,
-@@ -378,7 +370,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 		goto done;
- 	}
- 
--	code = krb5_pac_sign(context, pac, authtime, ks_client_princ,
-+	code = krb5_pac_sign(context, pac, authtime, client_princ,
- 			server_key, krbtgt_key, &pac_data);
- 	if (code != 0) {
- 		DBG_ERR("krb5_pac_sign failed: %d\n", code);
--- 
-2.24.1
-

plans.fmf

@@ -0,0 +1,4 @@
+discover:
+    how: fmf
+execute:
+    how: tmt

rpminspect.yaml

@@ -0,0 +1,35 @@
+---
+inspections:
+    disttag: off
+
+badfuncs:
+    ignore:
+        - /usr/bin/nmbd
+        - /usr/bin/nmblookup
+        - /usr/bin/smbtorture
+        - /usr/lib*/libndr.so.*
+        - /usr/lib*/libsmbconf.so.*
+        - /usr/lib*/samba/libgse-private-samba.so
+        - /usr/lib*/samba/libsamba-sockets-private-samba.so
+        - /usr/lib*/samba/service/nbtd.so
+        - /usr/libexec/ctdb/smnotify
+        - /usr/sbin/nmbd
+
+runpath:
+    allowed_paths:
+        - /usr/lib/samba
+        - /usr/lib64/samba
+
+abidiff:
+    suppression_file: samba.abignore
+
+debuginfo:
+    ignore:
+        - /usr/lib*/libdcerpc-samr.so.*
+
+annocheck:
+    ignore:
+        - /usr/bin/gentest
+        - /usr/bin/locktest
+        - /usr/bin/masktest
+        - /usr/bin/smbtorture

samba-4.12.0-winexe.patch

@@ -1,438 +0,0 @@
-From a1fdd83ab776f981e992c3f2fc8c341d6b37a0d4 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
-Date: Thu, 5 Mar 2020 22:45:48 +0100
-Subject: [PATCH 1/3] s4-torture: add rpc test for ChangeServiceConfigW
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313
-
-Guenther
-
-Signed-off-by: Guenther Deschner <gd@samba.org>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit 0825324bc75d2ab10164a1f137be782d84c822b8)
----
- selftest/knownfail           |  3 ++
- source4/torture/rpc/svcctl.c | 78 +++++++++++++++++++++++++++++++++++-
- 2 files changed, 80 insertions(+), 1 deletion(-)
-
-diff --git a/selftest/knownfail b/selftest/knownfail
-index c9ef0851172..20441c078b4 100644
---- a/selftest/knownfail
-+++ b/selftest/knownfail
-@@ -234,6 +234,9 @@
- ^samba3.rpc.eventlog.eventlog.GetNumRecords\(ad_dc\)
- ^samba3.rpc.eventlog.eventlog.OpenEventLog\(ad_dc\)
- ^samba3.rap.basic.netsessiongetinfo\(ad_dc\)
-+# not implemented
-+^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\)
-+^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\)
- #
- # This makes less sense when not running against an AD DC
- #
-diff --git a/source4/torture/rpc/svcctl.c b/source4/torture/rpc/svcctl.c
-index ebb2bc6ad0e..bd16ed4627d 100644
---- a/source4/torture/rpc/svcctl.c
-+++ b/source4/torture/rpc/svcctl.c
-@@ -3,7 +3,7 @@
-    test suite for svcctl rpc operations
- 
-    Copyright (C) Jelmer Vernooij 2004
--   Copyright (C) Guenther Deschner 2008,2009
-+   Copyright (C) Guenther Deschner 2008,2009,2020
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-@@ -623,6 +623,80 @@ static bool test_SCManager(struct torture_context *tctx,
- 	return true;
- }
- 
-+static bool test_ChangeServiceConfigW(struct torture_context *tctx,
-+				      struct dcerpc_pipe *p)
-+{
-+	struct svcctl_ChangeServiceConfigW r;
-+	struct svcctl_QueryServiceConfigW q;
-+	struct policy_handle h, s;
-+	NTSTATUS status;
-+	struct dcerpc_binding_handle *b = p->binding_handle;
-+	struct QUERY_SERVICE_CONFIG query;
-+	bool ok;
-+
-+	uint32_t offered = 0;
-+	uint32_t needed = 0;
-+
-+	ok = test_OpenSCManager(b, tctx, &h);
-+	if (!ok) {
-+		return false;
-+	}
-+
-+	ok = test_OpenService(b, tctx, &h, TORTURE_DEFAULT_SERVICE, &s);
-+	if (!ok) {
-+		return false;
-+	}
-+
-+	q.in.handle = &s;
-+	q.in.offered = offered;
-+	q.out.query = &query;
-+	q.out.needed = &needed;
-+
-+	status = dcerpc_svcctl_QueryServiceConfigW_r(b, tctx, &q);
-+	torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfigW failed!");
-+
-+	if (W_ERROR_EQUAL(q.out.result, WERR_INSUFFICIENT_BUFFER)) {
-+		q.in.offered = needed;
-+		status = dcerpc_svcctl_QueryServiceConfigW_r(b, tctx, &q);
-+		torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfigW failed!");
-+	}
-+	torture_assert_werr_ok(tctx, q.out.result, "QueryServiceConfigW failed!");
-+
-+	r.in.handle = &s;
-+	r.in.type		= query.service_type;
-+	r.in.start_type		= query.start_type;
-+	r.in.error_control	= query.error_control;
-+
-+	/*
-+	 * according to MS-SCMR 3.1.4.11 NULL params are supposed to leave the
-+	 * existing values intact.
-+	 */
-+
-+	r.in.binary_path	= NULL;
-+	r.in.load_order_group	= NULL;
-+	r.in.dependencies	= NULL;
-+	r.in.service_start_name	= NULL;
-+	r.in.password		= NULL;
-+	r.in.display_name	= NULL;
-+	r.out.tag_id		= NULL;
-+
-+	status = dcerpc_svcctl_ChangeServiceConfigW_r(b, tctx, &r);
-+	torture_assert_ntstatus_ok(tctx, status, "ChangeServiceConfigW failed!");
-+	torture_assert_werr_ok(tctx, r.out.result, "ChangeServiceConfigW failed!");
-+
-+	ok = test_CloseServiceHandle(b, tctx, &s);
-+	if (!ok) {
-+		return false;
-+	}
-+
-+	ok = test_CloseServiceHandle(b, tctx, &h);
-+	if (!ok) {
-+		return false;
-+	}
-+
-+	return true;
-+}
-+
- struct torture_suite *torture_rpc_svcctl(TALLOC_CTX *mem_ctx)
- {
- 	struct torture_suite *suite = torture_suite_create(mem_ctx, "svcctl");
-@@ -652,6 +726,8 @@ struct torture_suite *torture_rpc_svcctl(TALLOC_CTX *mem_ctx)
- 				   test_StartServiceW);
- 	torture_rpc_tcase_add_test(tcase, "ControlService",
- 				   test_ControlService);
-+	torture_rpc_tcase_add_test(tcase, "ChangeServiceConfigW",
-+				   test_ChangeServiceConfigW);
- 
- 	return suite;
- }
--- 
-2.24.1
-
-
-From 1168f1c392b3e315b5a4af9be793b93234420786 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
-Date: Thu, 5 Mar 2020 20:42:21 +0100
-Subject: [PATCH 2/3] s4-torture: add ndr svcctl testsuite
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313
-
-Guenther
-
-Signed-off-by: Guenther Deschner <gd@samba.org>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit c3fa0b2df9fc53dddcc3160b6a3dc751bbb389a4)
----
- librpc/idl/svcctl.idl         |  2 +-
- selftest/knownfail            |  5 +++
- source4/torture/ndr/ndr.c     |  1 +
- source4/torture/ndr/svcctl.c  | 85 +++++++++++++++++++++++++++++++++++
- source4/torture/wscript_build |  1 +
- 5 files changed, 93 insertions(+), 1 deletion(-)
- create mode 100644 source4/torture/ndr/svcctl.c
-
-diff --git a/librpc/idl/svcctl.idl b/librpc/idl/svcctl.idl
-index 671a1dc47be..e909bf2dbed 100644
---- a/librpc/idl/svcctl.idl
-+++ b/librpc/idl/svcctl.idl
-@@ -188,7 +188,7 @@ import "misc.idl", "security.idl";
- 		SVCCTL_DISABLED			= 0x00000004
- 	} svcctl_StartType;
- 
--	WERROR svcctl_ChangeServiceConfigW(
-+	[public] WERROR svcctl_ChangeServiceConfigW(
- 		[in,ref] policy_handle *handle,
- 		[in] uint32 type,
- 		[in] svcctl_StartType start_type,
-diff --git a/selftest/knownfail b/selftest/knownfail
-index 20441c078b4..c5d4cdd9419 100644
---- a/selftest/knownfail
-+++ b/selftest/knownfail
-@@ -237,6 +237,11 @@
- # not implemented
- ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\)
- ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\)
-+# broken IDL
-+^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_IN
-+^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_OUT
-+^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_IN
-+^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_OUT
- #
- # This makes less sense when not running against an AD DC
- #
-diff --git a/source4/torture/ndr/ndr.c b/source4/torture/ndr/ndr.c
-index 32efe90757d..690301f31b1 100644
---- a/source4/torture/ndr/ndr.c
-+++ b/source4/torture/ndr/ndr.c
-@@ -708,6 +708,7 @@ struct torture_suite *torture_local_ndr(TALLOC_CTX *mem_ctx)
- 	torture_suite_add_suite(suite, ndr_krb5pac_suite(suite));
- 	torture_suite_add_suite(suite, ndr_cabinet_suite(suite));
- 	torture_suite_add_suite(suite, ndr_charset_suite(suite));
-+	torture_suite_add_suite(suite, ndr_svcctl_suite(suite));
- 
- 	torture_suite_add_simple_test(suite, "string terminator",
- 				      test_check_string_terminator);
-diff --git a/source4/torture/ndr/svcctl.c b/source4/torture/ndr/svcctl.c
-new file mode 100644
-index 00000000000..1c9404597cd
---- /dev/null
-+++ b/source4/torture/ndr/svcctl.c
-@@ -0,0 +1,85 @@
-+/*
-+   Unix SMB/CIFS implementation.
-+   test suite for svcctl ndr operations
-+
-+   Copyright (C) Guenther Deschner 2020
-+
-+   This program is free software; you can redistribute it and/or modify
-+   it under the terms of the GNU General Public License as published by
-+   the Free Software Foundation; either version 3 of the License, or
-+   (at your option) any later version.
-+
-+   This program is distributed in the hope that it will be useful,
-+   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+   GNU General Public License for more details.
-+
-+   You should have received a copy of the GNU General Public License
-+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-+*/
-+
-+#include "includes.h"
-+#include "torture/ndr/ndr.h"
-+#include "librpc/gen_ndr/ndr_svcctl.h"
-+#include "torture/ndr/proto.h"
-+#include "param/param.h"
-+
-+static const uint8_t svcctl_ChangeServiceConfigW_req_data[] = {
-+	0x00, 0x00, 0x00, 0x00, 0xcd, 0x94, 0x05, 0x40, 0x30, 0x28, 0x00, 0x49,
-+	0x8d, 0xe4, 0x8e, 0x85, 0xb7, 0x19, 0x5c, 0x83, 0x10, 0x01, 0x00, 0x00,
-+	0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
-+};
-+
-+static bool svcctl_ChangeServiceConfigW_req_check(struct torture_context *tctx,
-+						  struct svcctl_ChangeServiceConfigW *r)
-+{
-+	struct policy_handle handle = { 0 };
-+	GUID_from_string("400594cd-2830-4900-8de4-8e85b7195c83", &handle.uuid);
-+
-+	torture_assert_guid_equal(tctx, r->in.handle->uuid, handle.uuid, "handle");
-+	torture_assert_u32_equal(tctx, r->in.type, 0x00000110, "type");
-+	torture_assert_u32_equal(tctx, r->in.start_type, SVCCTL_AUTO_START, "start_type");
-+	torture_assert_u32_equal(tctx, r->in.error_control, SVCCTL_SVC_ERROR_NORMAL, "error_control");
-+	torture_assert_str_equal(tctx, r->in.binary_path, NULL, "binary_path");
-+	torture_assert_str_equal(tctx, r->in.load_order_group, NULL, "load_order_group");
-+	torture_assert_str_equal(tctx, r->in.dependencies, NULL, "dependencies");
-+	torture_assert_str_equal(tctx, r->in.service_start_name, NULL, "service_start_name");
-+	torture_assert_str_equal(tctx, r->in.password, NULL, "password");
-+	torture_assert_str_equal(tctx, r->in.display_name, NULL, "display_name");
-+
-+	return true;
-+}
-+
-+static const uint8_t svcctl_ChangeServiceConfigW_rep_data[] = {
-+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
-+};
-+
-+static bool svcctl_ChangeServiceConfigW_rep_check(struct torture_context *tctx,
-+						  struct svcctl_ChangeServiceConfigW *r)
-+{
-+	torture_assert(tctx, r->out.tag_id == NULL, "tag_id");
-+	torture_assert_werr_ok(tctx, r->out.result, "result");
-+
-+	return true;
-+}
-+
-+struct torture_suite *ndr_svcctl_suite(TALLOC_CTX *ctx)
-+{
-+	struct torture_suite *suite = torture_suite_create(ctx, "svcctl");
-+
-+	torture_suite_add_ndr_pull_fn_test(suite,
-+					   svcctl_ChangeServiceConfigW,
-+					   svcctl_ChangeServiceConfigW_req_data,
-+					   NDR_IN,
-+					   svcctl_ChangeServiceConfigW_req_check);
-+
-+	torture_suite_add_ndr_pull_fn_test(suite,
-+					   svcctl_ChangeServiceConfigW,
-+					   svcctl_ChangeServiceConfigW_rep_data,
-+					   NDR_OUT,
-+					   svcctl_ChangeServiceConfigW_rep_check);
-+	return suite;
-+}
-diff --git a/source4/torture/wscript_build b/source4/torture/wscript_build
-index 65af160b322..05a6fbcbf14 100644
---- a/source4/torture/wscript_build
-+++ b/source4/torture/wscript_build
-@@ -71,6 +71,7 @@ bld.SAMBA_SUBSYSTEM('TORTURE_NDR',
-                   ndr/winspool.c
-                   ndr/cabinet.c
-                   ndr/charset.c
-+                  ndr/svcctl.c
- 		  ''',
- 	autoproto='ndr/proto.h',
- 	deps='torture krb5samba',
--- 
-2.24.1
-
-
-From 28d86d48adfee6c1d03ea192b69be87a0b9ce400 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
-Date: Wed, 4 Mar 2020 15:23:43 +0100
-Subject: [PATCH 3/3] librpc: fix IDL for svcctl_ChangeServiceConfigW
-
-Found while trying to run winexe against Windows Server 2019.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313
-
-Guenther
-
-Signed-off-by: Guenther Deschner <gd@samba.org>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit ebda529b59105e9b70cc74377fe4d54cc16b4f37)
----
- examples/winexe/winexe.c     |  2 ++
- librpc/idl/svcctl.idl        | 23 ++++++++++++++++++-----
- selftest/knownfail           |  5 -----
- source4/torture/ndr/svcctl.c |  3 +++
- source4/torture/rpc/svcctl.c |  3 +++
- 5 files changed, 26 insertions(+), 10 deletions(-)
-
-diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c
-index 22f748b1d45..fc6b15f8e52 100644
---- a/examples/winexe/winexe.c
-+++ b/examples/winexe/winexe.c
-@@ -625,8 +625,10 @@ static NTSTATUS winexe_svc_install(
- 			NULL,	    /* load_order_group */
- 			NULL,	    /* tag_id */
- 			NULL,	    /* dependencies */
-+			0,	    /* dwDependSize */
- 			NULL,	    /* service_start_name */
- 			NULL,	    /* password */
-+			0,	    /* dwPwSize */
- 			NULL,	    /* display_name */
- 			&werr);
- 
-diff --git a/librpc/idl/svcctl.idl b/librpc/idl/svcctl.idl
-index e909bf2dbed..a9dd3dec990 100644
---- a/librpc/idl/svcctl.idl
-+++ b/librpc/idl/svcctl.idl
-@@ -13,6 +13,17 @@ import "misc.idl", "security.idl";
-   helpstring("Service Control")
- ] interface svcctl
- {
-+	const int MAX_SERVICE_NAME_LENGTH = 256;
-+	const short SC_MAX_DEPEND_SIZE = 4 * 1024;
-+	const short SC_MAX_NAME_LENGTH = MAX_SERVICE_NAME_LENGTH + 1;
-+	const short SC_MAX_PATH_LENGTH = 32 * 1024;
-+	const short SC_MAX_PWD_SIZE = 514;
-+	const short SC_MAX_COMPUTER_NAME_LENGTH = 1024;
-+	const short SC_MAX_ACCOUNT_NAME_LENGTH = 2 * 1024;
-+	const short SC_MAX_COMMENT_LENGTH = 128;
-+	const short SC_MAX_ARGUMENT_LENGTH = 1024;
-+	const short SC_MAX_ARGUMENTS = 1024;
-+
- 	typedef struct {
- 		uint32 is_locked;
- 		[string,charset(UTF16)] uint16 *lock_owner;
-@@ -195,11 +206,13 @@ import "misc.idl", "security.idl";
- 		[in] svcctl_ErrorControl error_control,
- 		[in,unique] [string,charset(UTF16)] uint16 *binary_path,
- 		[in,unique] [string,charset(UTF16)] uint16 *load_order_group,
--		[out,ref] uint32 *tag_id,
--		[in,unique] [string,charset(UTF16)] uint16 *dependencies,
--		[in,unique] [string,charset(UTF16)] uint16 *service_start_name,
--		[in,unique] [string,charset(UTF16)] uint16 *password,
--		[in,unique] [string,charset(UTF16)] uint16 *display_name
-+		[in,out,unique] uint32 *tag_id,
-+		[in,unique,size_is(dwDependSize)] [string,charset(UTF16)] uint16 *dependencies,
-+		[in,range(0, SC_MAX_DEPEND_SIZE)] uint32 dwDependSize,
-+		[in,unique,range(0, SC_MAX_ACCOUNT_NAME_LENGTH)] [string,charset(UTF16)] uint16 *service_start_name,
-+		[in,unique,size_is(dwPwSize)] [string,charset(UTF16)] uint16 *password,
-+		[in,range(0, SC_MAX_PWD_SIZE)] uint32 dwPwSize,
-+		[in,unique,range(0, SC_MAX_NAME_LENGTH)] [string,charset(UTF16)] uint16 *display_name
- 	);
- 
- 	/*****************/
-diff --git a/selftest/knownfail b/selftest/knownfail
-index c5d4cdd9419..20441c078b4 100644
---- a/selftest/knownfail
-+++ b/selftest/knownfail
-@@ -237,11 +237,6 @@
- # not implemented
- ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\)
- ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\)
--# broken IDL
--^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_IN
--^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_OUT
--^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_IN
--^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_OUT
- #
- # This makes less sense when not running against an AD DC
- #
-diff --git a/source4/torture/ndr/svcctl.c b/source4/torture/ndr/svcctl.c
-index 1c9404597cd..6592beda02e 100644
---- a/source4/torture/ndr/svcctl.c
-+++ b/source4/torture/ndr/svcctl.c
-@@ -45,9 +45,12 @@ static bool svcctl_ChangeServiceConfigW_req_check(struct torture_context *tctx,
- 	torture_assert_u32_equal(tctx, r->in.error_control, SVCCTL_SVC_ERROR_NORMAL, "error_control");
- 	torture_assert_str_equal(tctx, r->in.binary_path, NULL, "binary_path");
- 	torture_assert_str_equal(tctx, r->in.load_order_group, NULL, "load_order_group");
-+	torture_assert(tctx, r->in.tag_id == NULL, "tag_id");
- 	torture_assert_str_equal(tctx, r->in.dependencies, NULL, "dependencies");
-+	torture_assert_u32_equal(tctx, r->in.dwDependSize, 0, "dwDependSize");
- 	torture_assert_str_equal(tctx, r->in.service_start_name, NULL, "service_start_name");
- 	torture_assert_str_equal(tctx, r->in.password, NULL, "password");
-+	torture_assert_u32_equal(tctx, r->in.dwPwSize, 0, "dwPwSize");
- 	torture_assert_str_equal(tctx, r->in.display_name, NULL, "display_name");
- 
- 	return true;
-diff --git a/source4/torture/rpc/svcctl.c b/source4/torture/rpc/svcctl.c
-index bd16ed4627d..746b399360e 100644
---- a/source4/torture/rpc/svcctl.c
-+++ b/source4/torture/rpc/svcctl.c
-@@ -675,9 +675,12 @@ static bool test_ChangeServiceConfigW(struct torture_context *tctx,
- 	r.in.binary_path	= NULL;
- 	r.in.load_order_group	= NULL;
- 	r.in.dependencies	= NULL;
-+	r.in.dwDependSize	= 0;
- 	r.in.service_start_name	= NULL;
- 	r.in.password		= NULL;
-+	r.in.dwPwSize		= 0;
- 	r.in.display_name	= NULL;
-+	r.in.tag_id		= NULL;
- 	r.out.tag_id		= NULL;
- 
- 	status = dcerpc_svcctl_ChangeServiceConfigW_r(b, tctx, &r);
--- 
-2.24.1
-

samba-4.23-fix-cmocka.patch

@@ -0,0 +1,38 @@
+From b1ec803f420b2c6d3c5c83d70c6875a7f36b15fc Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Fri, 21 Nov 2025 15:33:32 +0100
+Subject: [PATCH] s4:dsdb: Do not declare cm_print_error()
+
+This is part of the cmocka.h header file.
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Martin Schwenke <martin@meltin.net>
+Reviewed-by: Volker Lendecke <vl@samba.org>
+
+Autobuild-User(master): Volker Lendecke <vl@samba.org>
+Autobuild-Date(master): Mon Nov 24 11:28:08 UTC 2025 on atb-devel-224
+
+(cherry picked from commit 5a981663e4f677042ba80191770100aecff2120a)
+---
+ source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
+index f7075f3485e..12c464b49c7 100644
+--- a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
++++ b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
+@@ -103,11 +103,6 @@ void audit_message_send(
+ 
+ #define check_group_change_message(m, u, a, e)                                 \
+ 	_check_group_change_message(m, u, a, e, __FILE__, __LINE__);
+-/*
+- * declare the internal cmocka cm_print_error so that we can output messages
+- * in sub unit format
+- */
+-void cm_print_error(const char * const format, ...);
+ 
+ /*
+  * Validate a group change JSON audit message
+-- 
+2.52.0
+

samba-systemd-sysusers.conf

@@ -0,0 +1,2 @@
+#Type Name       ID
+g     printadmin -

samba-usershares-systemd-sysusers.conf

@@ -0,0 +1,2 @@
+#Type Name       ID
+g     usershares -

samba-winbind-systemd-sysusers.conf

@@ -0,0 +1,2 @@
+#Type Name       ID
+g     wbpriv     88

samba.abignore

@@ -0,0 +1,5 @@
+#################################################
+# This is a grouping library without any code
+#################################################
+[suppress_file]
+file_name_regexp=.*libdcerpc-samr\\.so.*

samba.logrotate

@@ -1,4 +1,4 @@
-/var/log/samba/log.* {
+/var/log/samba/*log* {
     compress
     dateext
     maxage 365

smb.conf.example

@@ -269,6 +269,13 @@
 ;	map system = no
 ;	store dos attributes = yes
 
+# Turn on SMB 3.1.1 Unix Extensions by default
+#
+# Note: The Linux Kernel SMB3 client will negotiate unix extensions by default,
+# find more info in man mount.smb3(8). Linux 6.13 will finally support special
+# filetypes and symlink handling.
+
+	smb3 unix extensions = yes
 
 #============================ Share Definitions ==============================
 
@@ -281,7 +288,7 @@
 
 [printers]
 	comment = All Printers
-	path = /var/spool/samba
+	path = /var/tmp
 	browseable = no
 	guest ok = no
 	writable = no

smb.conf.vendor

@@ -2,6 +2,10 @@
 # read the smb.conf manpage.
 # Run 'testparm' to verify the config is correct after
 # you modified it.
+#
+# Note:
+# SMB1 is disabled by default. This means clients without support for SMB2 or
+# SMB3 are no longer able to connect to smbd (by default).
 
 [global]
 	workgroup = SAMBA
@@ -14,6 +18,9 @@
 	load printers = yes
 	cups options = raw
 
+	# Install samba-usershares package for support
+	include = /etc/samba/usershares.conf
+
 [homes]
 	comment = Home Directories
 	valid users = %S, %D%w%S
@@ -31,7 +38,8 @@
 [print$]
 	comment = Printer Drivers
 	path = /var/lib/samba/drivers
-	write list = @printadmin root
-	force group = @printadmin
+	# printadmin is a local group
+	write list = printadmin root
+	force group = printadmin
 	create mask = 0664
 	directory mask = 0775

sources

@@ -1,2 +1,2 @@
-SHA512 (samba-4.12.0.tar.xz) = d9d99136702d339803c96004d68c978405759059e6f71fa303b52d21f4bf5093c43bcec44b22aeee3610a1cdf033edf758ccb4c551de20b7d66632e9a23866b1
-SHA512 (samba-4.12.0.tar.asc) = b833e0917b3b244ce727d80c0b600a88aa986455b7dfa24df1306fd848e2d192a46e2dfd5a5e878cd0ca3f76e0827ee42f704f93ac86b063e57027b786d262f0
+SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac
+SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce

tests/deps-check.fmf

@@ -0,0 +1,22 @@
+summary: Check samba package dependency structure
+description: |
+    Verify that samba library packages maintain correct dependency hierarchy:
+    - samba-core-libs has no samba-*-libs dependencies
+    - samba-ndr-libs depends on samba-core-libs (not samba-client-libs or samba-libs)
+    - samba-client-libs depends on core-libs + ndr-libs (not samba-libs)
+    - samba-client depends on samba-client-libs (not samba-libs)
+    - samba-libs does not depend on samba-dc-libs
+    - libsmbclient depends on samba-client-libs (not samba-libs)
+    - libwbclient has no samba-*-libs dependencies
+    - libldb has no samba-*-libs dependencies
+test: ./deps-check.sh
+framework: shell
+require:
+  - samba-core-libs
+  - samba-ndr-libs
+  - samba-client-libs
+  - samba-libs
+  - samba-client
+  - libwbclient
+  - libsmbclient
+  - libldb

tests/deps-check.sh

@@ -0,0 +1,167 @@
+#!/bin/bash
+#
+# Samba package dependency structure verification
+#
+# This test ensures that the samba library package dependencies don't regress.
+# The expected hierarchy is:
+#
+#   samba-core-libs    (no samba-*-libs dependencies)
+#        ^
+#        |
+#   samba-ndr-libs     (depends on samba-core-libs only)
+#        ^
+#        |
+#   samba-client-libs  (depends on samba-core-libs + samba-ndr-libs)
+#
+#   libwbclient        (no samba-*-libs dependencies - only links to libc)
+#
+#   samba-client       (depends on samba-client-libs, NOT samba-libs)
+#   libsmbclient       (depends on samba-client-libs, NOT samba-libs)
+#
+# NOTE: This test checks RESOLVED dependencies, not just explicit Requires.
+# A library requirement like 'libfoo.so' is resolved to the package that
+# provides it, ensuring we catch indirect dependencies.
+#
+
+set -e
+
+ERRORS=0
+
+# Get all packages that a package depends on (resolved)
+# This resolves library deps like 'libfoo.so' to actual package names
+get_resolved_deps() {
+    local pkg="$1"
+
+    rpm --query --requires "$pkg" 2>/dev/null | while read -r req; do
+        # Skip rpmlib and config requirements
+        [[ "$req" =~ ^rpmlib ]] && continue
+        [[ "$req" =~ ^config ]] && continue
+        [[ "$req" =~ ^/ ]] && continue
+
+        # Get the package that provides this requirement
+        provider=$(rpm --query --whatprovides "$req" 2>/dev/null | head -1)
+        if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then
+            # Extract just the package name (remove version-release.arch)
+            echo "${provider%%-[0-9]*}"
+        fi
+    done | sort -u
+}
+
+# Check that a package does NOT depend on packages matching a pattern
+# This checks RESOLVED dependencies (what packages actually get pulled in)
+check_no_resolved_dep() {
+    local pkg="$1"
+    local pattern="$2"
+    local description="$3"
+
+    if ! rpm --query "$pkg" &>/dev/null; then
+        echo "SKIP: $pkg not installed"
+        return 0
+    fi
+
+    local bad_deps
+    # Exclude the package itself from the check
+    bad_deps=$(get_resolved_deps "$pkg" | grep -v "^${pkg}$" | grep -E "$pattern" || true)
+
+    if [ -n "$bad_deps" ]; then
+        echo "FAIL: $pkg depends on $description"
+        echo "  Found: $bad_deps"
+        ERRORS=$((ERRORS + 1))
+        return 1
+    fi
+    echo "PASS: $pkg does not depend on $description"
+    return 0
+}
+
+# Check that a package DOES depend on a specific package
+check_has_resolved_dep() {
+    local pkg="$1"
+    local expected="$2"
+
+    if ! rpm --query "$pkg" &>/dev/null; then
+        echo "SKIP: $pkg not installed"
+        return 0
+    fi
+
+    if get_resolved_deps "$pkg" | grep -qF "$expected"; then
+        echo "PASS: $pkg depends on $expected"
+        return 0
+    fi
+    echo "FAIL: $pkg does not depend on $expected"
+    ERRORS=$((ERRORS + 1))
+    return 1
+}
+
+echo "=== Samba Package Dependency Checks ==="
+echo ""
+echo "Checking resolved dependencies (library deps resolved to packages)"
+echo ""
+
+# 1. samba-core-libs must NOT depend on any samba-*-libs packages
+echo "--- samba-core-libs ---"
+check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba*-libs package"
+
+echo ""
+
+# 2. samba-ndr-libs must depend on samba-core-libs
+#    but NOT samba-client-libs or samba-libs
+echo "--- samba-ndr-libs ---"
+check_has_resolved_dep samba-ndr-libs "samba-core-libs"
+check_no_resolved_dep samba-ndr-libs "^samba-client-libs$" "samba-client-libs"
+check_no_resolved_dep samba-ndr-libs "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 3. samba-client-libs must depend on samba-core-libs and samba-ndr-libs
+#    but NOT samba-libs
+echo "--- samba-client-libs ---"
+check_has_resolved_dep samba-client-libs "samba-core-libs"
+check_has_resolved_dep samba-client-libs "samba-ndr-libs"
+check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 4. libwbclient must NOT depend on any samba-*-libs packages
+echo "--- libwbclient ---"
+check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba*-libs package"
+
+echo ""
+
+# 5. samba-client must depend on samba-client-libs but NOT samba-libs
+#    (client tools should not pull in server libraries)
+echo "--- samba-client ---"
+check_has_resolved_dep samba-client "samba-client-libs"
+check_no_resolved_dep samba-client "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 6. libsmbclient must depend on samba-client-libs but NOT samba-libs
+#    (SMB client library should not pull in server libraries)
+echo "--- libsmbclient ---"
+check_has_resolved_dep libsmbclient "samba-client-libs"
+check_no_resolved_dep libsmbclient "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 7. libldb must NOT depend on any samba-*-libs packages
+#    (libldb is a standalone database library)
+echo "--- libldb ---"
+check_no_resolved_dep libldb "^samba-.*-libs$" "any samba*-libs package"
+
+echo ""
+
+# 8. samba-libs must NOT depend on samba-dc-libs
+#    (server libraries should not pull in DC-specific libraries)
+echo "--- samba-libs ---"
+check_no_resolved_dep samba-libs "^samba-dc-libs$" "samba-dc-libs"
+
+echo ""
+echo "=== Summary ==="
+
+if [ $ERRORS -gt 0 ]; then
+    echo "FAILED: $ERRORS dependency check(s) failed"
+    exit 1
+fi
+
+echo "All dependency checks passed"
+exit 0

usershares.conf.vendor

@@ -0,0 +1,3 @@
+[global]
+	usershare max shares = 100
+	usershare allow guests = yes