rpminspect: Don't run annocheck on test binaries

[skip changelog]

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1,295 +1,4 @@
-samba-3.5.4.tar.gz
-samba-3.6.0pre1.tar.gz
-/samba-3.6.0pre2.tar.gz
-/samba-3.6.0pre3.tar.gz
-/samba-3.6.0rc1.tar.gz
-/samba-3.6.0rc2.tar.gz
-/samba-3.6.0rc3.tar.gz
-/samba-3.6.0.tar.gz
-/samba-3.6.1.tar.gz
-/samba-3.6.3.tar.gz
-/samba-3.6.4.tar.gz
-/samba-3.6.5.tar.gz
-/samba-3.6.6.tar.gz
-/samba-3.6.7.tar.gz
-/samba-4.0.0rc1.tar.bz2
-/samba-4.0.0rc2.tar.bz2
-/samba-4.0.0rc3.tar.bz2
-/samba-4.0.0rc4.tar.bz2
-/samba-4.0.0rc5.tar.bz2
-/samba-4.0.0rc6.tar.bz2
-/samba-4.0.0.tar.bz2
-/samba-4.0.1.tar.bz2
-/samba-4.0.2.tar.bz2
-/samba-4.0.3.tar.bz2
-/samba-4.0.4.tar.bz2
-/samba-4.0.5.tar.bz2
-/samba-4.0.6.tar.bz2
-/samba-4.0.7.tar.xz
-/samba-4.1.0rc1.tar.xz
-/samba-4.1.0rc2.tar.xz
-/samba-4.1.0rc3.tar.xz
-/samba-4.1.0rc4.tar.xz
-/samba-4.1.0.tar.xz
-/samba-4.1.1.tar.xz
-/samba-4.1.2.tar.xz
-/samba-4.1.3.tar.xz
-/samba-4.1.4.tar.xz
-/samba-4.1.5.tar.xz
-/samba-4.1.6.tar.xz
-/samba-4.1.8.tar.xz
-/samba-4.1.9.tar.xz
-/samba-4.1.11.tar.gz
-/samba-4.1.11.tar.xz
-/samba-4.1.12.tar.xz
-/samba-4.2.0rc2.tar.xz
-/samba-4.2.0rc3.tar.xz
-/samba-4.2.0rc4.tar.xz
-/samba-4.2.0rc5.tar.xz
-/samba-4.2.0.tar.xz
-/samba-4.2.1.tar.xz
-/samba-4.2.2.tar.xz
-/samba-4.2.3.tar.xz
-/samba-4.3.0rc3.tar.xz
-/samba-4.3.0rc4.tar.xz
-/samba-4.3.0.tar.xz
-/samba-4.3.1.tar.xz
-/samba-4.3.2.tar.xz
-/samba-4.3.3.tar.xz
-/samba-4.3.4.tar.xz
-/samba-4.4.0rc1.tar.xz
-/samba-4.4.0rc2.tar.xz
-/samba-4.4.0rc3.tar.xz
-/samba-4.4.0rc4.tar.xz
-/samba-4.4.0rc5.tar.xz
-/samba-4.4.0.tar.xz
-/samba-4.4.2.tar.xz
-/samba-4.4.3.tar.xz
-/samba-4.4.4.tar.xz
-/samba-4.4.5.tar.xz
-/samba-4.5.0rc1.tar.xz
-/samba-4.5.0rc2.tar.xz
-/samba-4.5.0rc3.tar.xz
-/samba-4.5.0.tar.xz
-/samba-4.5.1.tar.xz
-/samba-4.5.2.tar.xz
-/samba-4.5.3.tar.xz
-/samba-4.6.0rc1.tar.xz
-/samba-4.6.0rc2.tar.xz
-/samba-4.6.0rc2.tar.asc
-/samba-4.6.0rc3.tar.asc
-/samba-4.6.0rc3.tar.xz
-/samba-4.6.0rc4.tar.xz
-/samba-4.6.0rc4.tar.asc
-/samba-4.6.0.tar.asc
-/samba-4.6.0.tar.xz
-/samba-4.6.1.tar.xz
-/samba-4.6.1.tar.asc
-/samba-4.6.2.tar.xz
-/samba-4.6.2.tar.asc
-/samba-4.6.3.tar.xz
-/samba-4.6.3.tar.asc
-/samba-4.6.4.tar.xz
-/samba-4.6.4.tar.asc
-/samba-4.6.5.tar.xz
-/samba-4.6.5.tar.asc
-/samba-4.7.0rc1.tar.xz
-/samba-4.7.0rc1.tar.asc
-/samba-4.7.0rc3.tar.xz
-/samba-4.7.0rc3.tar.asc
-/samba-4.7.0rc5.tar.xz
-/samba-4.7.0rc5.tar.asc
-/samba-4.7.0rc6.tar.xz
-/samba-4.7.0rc6.tar.asc
-/samba-4.7.0.tar.xz
-/samba-4.7.0.tar.asc
-/samba-4.7.1.tar.xz
-/samba-4.7.1.tar.asc
-/samba-4.7.2.tar.xz
-/samba-4.7.2.tar.asc
-/samba-4.7.3.tar.xz
-/samba-4.7.3.tar.asc
-/samba-4.7.4.tar.xz
-/samba-4.7.4.tar.asc
-/samba-4.8.0rc1.tar.xz
-/samba-4.8.0rc1.tar.asc
-/samba-4.8.0rc2.tar.xz
-/samba-4.8.0rc2.tar.asc
-/samba-4.8.0rc3.tar.xz
-/samba-4.8.0rc3.tar.asc
-/samba-4.8.0rc4.tar.xz
-/samba-4.8.0rc4.tar.asc
-/samba-4.8.0.tar.xz
-/samba-4.8.0.tar.asc
-/samba-4.8.1.tar.xz
-/samba-4.8.1.tar.asc
-/samba-4.8.2.tar.xz
-/samba-4.8.2.tar.asc
-/samba-4.8.3.tar.asc
-/samba-4.8.3.tar.xz
-/samba-4.9.0rc1.tar.xz
-/samba-4.9.0rc1.tar.asc
-/samba-4.9.0rc2.tar.xz
-/samba-4.9.0rc2.tar.asc
-/samba-4.9.0rc3.tar.xz
-/samba-4.9.0rc3.tar.asc
-/samba-4.9.0rc4.tar.xz
-/samba-4.9.0rc4.tar.asc
-/samba-4.9.0rc5.tar.asc
-/samba-4.9.0rc5.tar.xz
-/samba-4.9.0.tar.xz
-/samba-4.9.0.tar.asc
-/samba-4.9.1.tar.asc
-/samba-4.9.1.tar.xz
-/samba-4.9.2.tar.xz
-/samba-4.9.2.tar.asc
-/samba-4.9.3.tar.xz
-/samba-4.9.3.tar.asc
-/samba-4.9.4.tar.xz
-/samba-4.9.4.tar.asc
-/samba-4.10.0rc1.tar.xz
-/samba-4.10.0rc1.tar.asc
-/samba-4.10.0rc2.tar.xz
-/samba-4.10.0rc2.tar.asc
-/samba-4.10.0rc3.tar.xz
-/samba-4.10.0rc3.tar.asc
-/samba-4.10.0rc4.tar.xz
-/samba-4.10.0rc4.tar.asc
-/samba-4.10.0.tar.xz
-/samba-4.10.0.tar.asc
-/samba-4.10.1.tar.xz
-/samba-4.10.1.tar.asc
-/samba-4.10.2.tar.xz
-/samba-4.10.2.tar.asc
-/samba-4.10.3.tar.xz
-/samba-4.10.3.tar.asc
-/samba-4.10.4.tar.xz
-/samba-4.10.4.tar.asc
-/samba-4.10.5.tar.xz
-/samba-4.10.5.tar.asc
-/samba-4.10.6.tar.xz
-/samba-4.10.6.tar.asc
-/samba-4.11.0rc1.tar.xz
-/samba-4.11.0rc1.tar.asc
-/samba-4.11.0rc2.tar.xz
-/samba-4.11.0rc2.tar.asc
-/samba-4.11.0rc3.tar.xz
-/samba-4.11.0rc3.tar.asc
-/samba-4.11.0rc4.tar.xz
-/samba-4.11.0rc4.tar.asc
-/samba-4.11.0.tar.xz
-/samba-4.11.0.tar.asc
-/samba-4.11.1.tar.xz
-/samba-4.11.1.tar.asc
-/samba-4.11.2.tar.xz
-/samba-4.11.2.tar.asc
-/samba-4.11.3.tar.xz
-/samba-4.11.3.tar.asc
-/samba-4.11.4.tar.xz
-/samba-4.11.4.tar.asc
-/samba-4.11.5.tar.xz
-/samba-4.11.5.tar.asc
-/samba-4.12.0rc1.tar.xz
-/samba-4.12.0rc1.tar.asc
-/samba-4.12.0rc2.tar.xz
-/samba-4.12.0rc2.tar.asc
-/samba-4.12.0rc3.tar.xz
-/samba-4.12.0rc3.tar.asc
-/samba-4.12.0rc4.tar.xz
-/samba-4.12.0rc4.tar.asc
-/samba-4.12.0.tar.xz
-/samba-4.12.0.tar.asc
-/samba-4.12.1.tar.xz
-/samba-4.12.1.tar.asc
-/samba-4.12.2.tar.xz
-/samba-4.12.2.tar.asc
-/samba-4.12.3.tar.xz
-/samba-4.12.3.tar.asc
-/samba-4.12.4.tar.xz
-/samba-4.12.4.tar.asc
-/samba-4.12.5.tar.xz
-/samba-4.12.5.tar.asc
-/samba-4.13.0rc1.tar.xz
-/samba-4.13.0rc1.tar.asc
-/samba-4.13.0rc2.tar.xz
-/samba-4.13.0rc2.tar.asc
-/samba-4.13.0rc3.tar.xz
-/samba-4.13.0rc3.tar.asc
-/samba-4.13.0rc4.tar.xz
-/samba-4.13.0rc4.tar.asc
-/samba-4.13.0rc5.tar.xz
-/samba-4.13.0rc5.tar.asc
-/samba-4.13.0rc6.tar.xz
-/samba-4.13.0rc6.tar.asc
-/samba-4.13.0.tar.xz
-/samba-4.13.0.tar.asc
-/samba-4.13.1.tar.xz
-/samba-4.13.1.tar.asc
-/samba-4.13.2.tar.xz
-/samba-4.13.2.tar.asc
-/samba-4.13.3.tar.xz
-/samba-4.13.3.tar.asc
-/samba-4.13.4.tar.xz
-/samba-4.13.4.tar.asc
-/samba-4.14.0rc1.tar.xz
-/samba-4.14.0rc1.tar.asc
-/samba-4.14.0rc2.tar.xz
-/samba-4.14.0rc2.tar.asc
-/samba-4.14.0rc3.tar.xz
-/samba-4.14.0rc3.tar.asc
-/samba-4.14.0rc4.tar.xz
-/samba-4.14.0rc4.tar.asc
-/samba-4.14.0.tar.xz
-/samba-4.14.0.tar.asc
-/samba-4.14.1.tar.xz
-/samba-4.14.1.tar.asc
-/samba-4.14.2.tar.xz
-/samba-4.14.2.tar.asc
-/samba-4.14.3.tar.xz
-/samba-4.14.3.tar.asc
-/samba-4.14.4.tar.xz
-/samba-4.14.4.tar.asc
-/samba-4.14.5.tar.xz
-/samba-4.14.5.tar.asc
-/samba-4.14.6.tar.xz
-/samba-4.14.6.tar.asc
-/samba-4.15.0rc1.tar.xz
-/samba-4.15.0rc1.tar.asc
-/samba-4.15.0rc2.tar.xz
-/samba-4.15.0rc2.tar.asc
-/samba-4.15.0rc3.tar.xz
-/samba-4.15.0rc3.tar.asc
-/samba-4.15.0rc4.tar.xz
-/samba-4.15.0rc4.tar.asc
-/samba-4.15.0rc5.tar.xz
-/samba-4.15.0rc5.tar.asc
-/samba-4.15.0rc6.tar.xz
-/samba-4.15.0rc6.tar.asc
-/samba-4.15.0rc7.tar.xz
-/samba-4.15.0rc7.tar.asc
-/samba-4.15.0.tar.xz
-/samba-4.15.0.tar.asc
-/samba-4.15.1.tar.xz
-/samba-4.15.1.tar.asc
-/samba-4.15.2.tar.xz
-/samba-4.15.2.tar.asc
-/samba-4.15.3.tar.xz
-/samba-4.15.3.tar.asc
-/samba-4.15.4.tar.xz
-/samba-4.15.4.tar.asc
-/samba-4.15.5.tar.xz
-/samba-4.15.5.tar.asc
-/samba-4.15.6.tar.xz
-/samba-4.15.6.tar.asc
-/samba-4.15.7.tar.xz
-/samba-4.15.7.tar.asc
-/samba-4.15.8.tar.xz
-/samba-4.15.8.tar.asc
-/samba-4.15.9.tar.xz
-/samba-4.15.9.tar.asc
-/samba-4.15.10.tar.xz
-/samba-4.15.10.tar.asc
-/samba-4.15.11.tar.xz
-/samba-4.15.11.tar.asc
-/samba-4.15.12.tar.xz
-/samba-4.15.12.tar.asc
+/samba-*.tar.xz
+/samba-*.tar.asc
+/*.rpm
+/results_samba

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_stable
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

plans.fmf

@@ -0,0 +1,4 @@
+discover:
+    how: fmf
+execute:
+    how: tmt

rpminspect.yaml

@@ -1,12 +1,17 @@
 ---
+inspections:
+    disttag: off
+
 badfuncs:
     ignore:
+        - /usr/bin/nmbd
         - /usr/bin/nmblookup
         - /usr/bin/smbtorture
         - /usr/lib*/libndr.so.*
         - /usr/lib*/libsmbconf.so.*
-        - /usr/lib*/samba/libgse-samba4.so
-        - /usr/lib*/samba/libsamba-sockets-samba4.so
+        - /usr/lib*/samba/libgse-private-samba.so
+        - /usr/lib*/samba/libsamba-sockets-private-samba.so
+        - /usr/lib*/samba/service/nbtd.so
         - /usr/libexec/ctdb/smnotify
         - /usr/sbin/nmbd
 
@@ -14,3 +19,17 @@ runpath:
     allowed_paths:
         - /usr/lib/samba
         - /usr/lib64/samba
+
+abidiff:
+    suppression_file: samba.abignore
+
+debuginfo:
+    ignore:
+        - /usr/lib*/libdcerpc-samr.so.*
+
+annocheck:
+    ignore:
+        - /usr/bin/gentest
+        - /usr/bin/locktest
+        - /usr/bin/masktest
+        - /usr/bin/smbtorture

samba-4.23-fix-cmocka.patch

@@ -0,0 +1,38 @@
+From b1ec803f420b2c6d3c5c83d70c6875a7f36b15fc Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Fri, 21 Nov 2025 15:33:32 +0100
+Subject: [PATCH] s4:dsdb: Do not declare cm_print_error()
+
+This is part of the cmocka.h header file.
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Martin Schwenke <martin@meltin.net>
+Reviewed-by: Volker Lendecke <vl@samba.org>
+
+Autobuild-User(master): Volker Lendecke <vl@samba.org>
+Autobuild-Date(master): Mon Nov 24 11:28:08 UTC 2025 on atb-devel-224
+
+(cherry picked from commit 5a981663e4f677042ba80191770100aecff2120a)
+---
+ source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
+index f7075f3485e..12c464b49c7 100644
+--- a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
++++ b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
+@@ -103,11 +103,6 @@ void audit_message_send(
+ 
+ #define check_group_change_message(m, u, a, e)                                 \
+ 	_check_group_change_message(m, u, a, e, __FILE__, __LINE__);
+-/*
+- * declare the internal cmocka cm_print_error so that we can output messages
+- * in sub unit format
+- */
+-void cm_print_error(const char * const format, ...);
+ 
+ /*
+  * Validate a group change JSON audit message
+-- 
+2.52.0
+

samba-ctdb-etcd-reclock.patch

@@ -1,30 +0,0 @@
-From 939aed0498269df3c1e012f3b68c314b583f25bd Mon Sep 17 00:00:00 2001
-From: Martin Schwenke <martin@meltin.net>
-Date: Tue, 27 Apr 2021 15:46:14 +1000
-Subject: [PATCH] utils: Use Python 3
-
-Due to the number of flake8 and pylint warnings it is unclear if the
-source has Python 3 incompatibilities.  These will be cleaned up in
-subsequent commits.
-
-Signed-off-by: "L.P.H. van Belle" <belle@bazuin.nl>
-Reviewed-by: Martin Schwenke <martin@meltin.net>
-Reviewed-by: David Disseldorp <ddiss@samba.org>
-Reviewed-by: Jose A. Rivera <jarrpa@samba.org>
----
- ctdb/utils/etcd/ctdb_etcd_lock | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/ctdb/utils/etcd/ctdb_etcd_lock b/ctdb/utils/etcd/ctdb_etcd_lock
-index 000c6bb7208..7f5194eff0a 100755
---- a/ctdb/utils/etcd/ctdb_etcd_lock
-+++ b/ctdb/utils/etcd/ctdb_etcd_lock
-@@ -1,4 +1,4 @@
--#!/usr/bin/python
-+#!/usr/bin/env python3
- #
- #    This program is free software: you can redistribute it and/or modify
- #    it under the terms of the GNU General Public License as published by
--- 
-2.31.1
-

samba-s4u.patch

@@ -1,642 +0,0 @@
-From cfdb01091c4ad005654da9b4a64251a6d02ea637 Mon Sep 17 00:00:00 2001
-From: Isaac Boukris <iboukris@gmail.com>
-Date: Fri, 27 Sep 2019 18:25:03 +0300
-Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support
-
-Signed-off-by: Isaac Boukris <iboukris@gmail.com>
-Pair-Programmed-With: Andreas Schneider <asn@samba.org>
----
- source4/kdc/mit-kdb/kdb_samba_policies.c | 124 +++++++++++------------
- source4/kdc/mit_samba.c                  |  47 ++-------
- source4/kdc/mit_samba.h                  |   6 +-
- 3 files changed, 71 insertions(+), 106 deletions(-)
-
-diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c
-index dada3b79144..677ec1007c9 100644
---- a/source4/kdc/mit-kdb/kdb_samba_policies.c
-+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c
-@@ -197,13 +197,17 @@ static krb5_error_code ks_verify_pac(krb5_context context,
- 				     krb5_keyblock *krbtgt_key,
- 				     krb5_timestamp authtime,
- 				     krb5_authdata **tgt_auth_data,
--				     krb5_pac *pac)
-+				     krb5_pac *out_pac)
- {
- 	struct mit_samba_context *mit_ctx;
- 	krb5_authdata **authdata = NULL;
--	krb5_pac ipac = NULL;
--	DATA_BLOB logon_data = { NULL, 0 };
-+	krb5_keyblock *header_server_key = NULL;
-+	krb5_key_data *impersonator_kd = NULL;
-+	krb5_keyblock impersonator_key = {0};
- 	krb5_error_code code;
-+	krb5_pac pac;
-+
-+	*out_pac = NULL;
- 
- 	mit_ctx = ks_get_context(context);
- 	if (mit_ctx == NULL) {
-@@ -235,41 +239,43 @@ static krb5_error_code ks_verify_pac(krb5_context context,
- 	code = krb5_pac_parse(context,
- 			      authdata[0]->contents,
- 			      authdata[0]->length,
--			      &ipac);
-+			      &pac);
- 	if (code != 0) {
- 		goto done;
- 	}
- 
--	/* TODO: verify this is correct
--	 *
--	 * In the constrained delegation case, the PAC is from a service
--	 * ticket rather than a TGT; we must verify the server and KDC
--	 * signatures to assert that the server did not forge the PAC.
-+	/*
-+	 * For constrained delegation in MIT version < 1.18 we aren't provided
-+	 * with the 2nd ticket server key to verify the PAC.
-+	 * We can workaround that by fetching the key from the client db entry,
-+	 * which is the impersonator account in that version.
-+	 * TODO: use the provided entry in the new 1.18 version.
- 	 */
- 	if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {
--		code = krb5_pac_verify(context,
--				       ipac,
--				       authtime,
--				       client_princ,
--				       server_key,
--				       krbtgt_key);
-+		/* The impersonator must be local. */
-+		if (client == NULL) {
-+			code = KRB5KDC_ERR_BADOPTION;
-+			goto done;
-+		}
-+		/* Fetch and decrypt 2nd ticket server's current key. */
-+		code = krb5_dbe_find_enctype(context, client, -1, -1, 0,
-+					     &impersonator_kd);
-+		if (code != 0) {
-+			goto done;
-+		}
-+		code = krb5_dbe_decrypt_key_data(context, NULL,
-+						 impersonator_kd,
-+						 &impersonator_key, NULL);
-+		if (code != 0) {
-+			goto done;
-+		}
-+		header_server_key = &impersonator_key;
- 	} else {
--		code = krb5_pac_verify(context,
--				       ipac,
--				       authtime,
--				       client_princ,
--				       krbtgt_key,
--				       NULL);
--	}
--	if (code != 0) {
--		goto done;
-+		header_server_key = krbtgt_key;
- 	}
- 
--	/* check and update PAC */
--	code = krb5_pac_parse(context,
--			      authdata[0]->contents,
--			      authdata[0]->length,
--			      pac);
-+	code = krb5_pac_verify(context, pac, authtime, client_princ,
-+			       header_server_key, NULL);
- 	if (code != 0) {
- 		goto done;
- 	}
-@@ -277,17 +283,22 @@ static krb5_error_code ks_verify_pac(krb5_context context,
- 	code = mit_samba_reget_pac(mit_ctx,
- 				   context,
- 				   flags,
--				   client_princ,
- 				   client,
- 				   server,
- 				   krbtgt,
- 				   krbtgt_key,
--				   pac);
-+				   &pac);
-+	if (code != 0) {
-+		goto done;
-+	}
-+
-+	*out_pac = pac;
-+	pac = NULL;
- 
- done:
-+	krb5_free_keyblock_contents(context, &impersonator_key);
- 	krb5_free_authdata(context, authdata);
--	krb5_pac_free(context, ipac);
--	free(logon_data.data);
-+	krb5_pac_free(context, pac);
- 
- 	return code;
- }
-@@ -316,6 +327,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 	krb5_authdata **pac_auth_data = NULL;
- 	krb5_authdata **authdata = NULL;
- 	krb5_boolean is_as_req;
-+	krb5_const_principal pac_client;
- 	krb5_error_code code;
- 	krb5_pac pac = NULL;
- 	krb5_data pac_data;
-@@ -327,11 +339,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 	krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt;
- 	krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key;
- 
--	/* FIXME: We don't support S4U yet */
--	if (flags & KRB5_KDB_FLAGS_S4U) {
--		return KRB5_KDB_DBTYPE_NOSUP;
--	}
--
- 	is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
- 
- 	/*
-@@ -392,6 +399,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 		ks_client_princ = client->princ;
- 	}
- 
-+	/* In protocol transition, we are currently not provided with the tgt
-+	 * client name to verify the PAC, we could probably skip the name
-+	 * verification and just verify the signatures, but since we don't
-+	 * support cross-realm nor aliases, we can just use server->princ */
-+	if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) {
-+		pac_client = server->princ;
-+	} else {
-+		pac_client = ks_client_princ;
-+	}
-+
- 	if (client_entry == NULL) {
- 		client_entry = client;
- 	}
-@@ -456,7 +473,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 
- 			code = ks_verify_pac(context,
- 					     flags,
--					     ks_client_princ,
-+					     pac_client,
- 					     client_entry,
- 					     server,
- 					     krbtgt,
-@@ -497,7 +514,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 		  is_as_req ? "AS-REQ" : "TGS-REQ",
- 		  client_name);
- 	code = krb5_pac_sign(context, pac, authtime, ks_client_princ,
--			server_key, krbtgt_key, &pac_data);
-+			     server_key, krbtgt_key, &pac_data);
- 	if (code != 0) {
- 		DBG_ERR("krb5_pac_sign failed: %d\n", code);
- 		goto done;
-@@ -523,12 +540,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 					      KRB5_AUTHDATA_IF_RELEVANT,
- 					      authdata,
- 					      signed_auth_data);
--	if (code != 0) {
--		goto done;
--	}
--
--	code = 0;
--
- done:
- 	if (client_entry != NULL && client_entry != client) {
- 		ks_free_principal(context, client_entry);
-@@ -554,32 +565,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
- 	 * server; -> delegating service
- 	 * proxy; -> target principal
- 	 */
--	krb5_db_entry *delegating_service = discard_const_p(krb5_db_entry, server);
--
--	char *target_name = NULL;
--	bool is_enterprise;
--	krb5_error_code code;
- 
- 	mit_ctx = ks_get_context(context);
- 	if (mit_ctx == NULL) {
- 		return KRB5_KDB_DBNOTINITED;
- 	}
- 
--	code = krb5_unparse_name(context, proxy, &target_name);
--	if (code) {
--		goto done;
--	}
--
--	is_enterprise = (proxy->type == KRB5_NT_ENTERPRISE_PRINCIPAL);
--
--	code = mit_samba_check_s4u2proxy(mit_ctx,
--					 delegating_service,
--					 target_name,
--					 is_enterprise);
--
--done:
--	free(target_name);
--	return code;
-+	return mit_samba_check_s4u2proxy(mit_ctx, server, proxy);
- }
- 
- 
-diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
-index ef4e8c2ed38..962fd05e1ac 100644
---- a/source4/kdc/mit_samba.c
-+++ b/source4/kdc/mit_samba.c
-@@ -517,7 +517,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
- krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
- 				    krb5_context context,
- 				    int flags,
--				    krb5_const_principal client_principal,
- 				    krb5_db_entry *client,
- 				    krb5_db_entry *server,
- 				    krb5_db_entry *krbtgt,
-@@ -688,7 +687,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
- 								  context,
- 								  *pac,
- 								  server->princ,
--								  discard_const(client_principal),
-+								  client->princ,
- 								  deleg_blob);
- 		if (!NT_STATUS_IS_OK(nt_status)) {
- 			DEBUG(0, ("Update delegation info failed: %s\n",
-@@ -1080,41 +1079,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
- }
- 
- int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
--			      krb5_db_entry *kentry,
--			      const char *target_name,
--			      bool is_nt_enterprise_name)
-+			      const krb5_db_entry *server,
-+			      krb5_const_principal target_principal)
- {
--#if 1
--	/*
--	 * This is disabled because mit_samba_update_pac_data() does not handle
--	 * S4U_DELEGATION_INFO
--	 */
--
--	return KRB5KDC_ERR_BADOPTION;
--#else
--	krb5_principal target_principal;
--	int flags = 0;
--	int ret;
--
--	if (is_nt_enterprise_name) {
--		flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE;
--	}
--
--	ret = krb5_parse_name_flags(ctx->context, target_name,
--				    flags, &target_principal);
--	if (ret) {
--		return ret;
--	}
--
--	ret = samba_kdc_check_s4u2proxy(ctx->context,
--					ctx->db_ctx,
--					skdc_entry,
--					target_principal);
--
--	krb5_free_principal(ctx->context, target_principal);
--
--	return ret;
--#endif
-+	struct samba_kdc_entry *server_skdc_entry =
-+		 talloc_get_type_abort(server->e_data,
-+				       struct samba_kdc_entry);
-+
-+	return samba_kdc_check_s4u2proxy(ctx->context,
-+					 ctx->db_ctx,
-+					 server_skdc_entry,
-+					 target_principal);
- }
- 
- static krb5_error_code mit_samba_change_pwd_error(krb5_context context,
-diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h
-index 4431e82a1b2..9370ab533af 100644
---- a/source4/kdc/mit_samba.h
-+++ b/source4/kdc/mit_samba.h
-@@ -57,7 +57,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
- krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
- 				    krb5_context context,
- 				    int flags,
--				    krb5_const_principal client_principal,
- 				    krb5_db_entry *client,
- 				    krb5_db_entry *server,
- 				    krb5_db_entry *krbtgt,
-@@ -74,9 +73,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
- 				  DATA_BLOB *e_data);
- 
- int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
--			      krb5_db_entry *kentry,
--			      const char *target_name,
--			      bool is_nt_enterprise_name);
-+			      const krb5_db_entry *server,
-+			      krb5_const_principal target_principal);
- 
- int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,
- 				      char *pwd,
--- 
-2.37.1
-
-
-From 6e985cf7d5f29292c5f2dd2de75867dd30ef3df6 Mon Sep 17 00:00:00 2001
-From: Isaac Boukris <iboukris@gmail.com>
-Date: Fri, 27 Sep 2019 18:35:30 +0300
-Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build
-
-Signed-off-by: Isaac Boukris <iboukris@gmail.com>
-Pair-Programmed-With: Andreas Schneider <asn@samba.org>
----
- lib/krb5_wrap/krb5_samba.c            | 185 ++++++++++++++++++++++++++
- lib/krb5_wrap/krb5_samba.h            |   2 -
- source4/auth/kerberos/kerberos_util.c |  11 --
- 3 files changed, 185 insertions(+), 13 deletions(-)
-
-diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
-index 610efcc9b87..96686147006 100644
---- a/lib/krb5_wrap/krb5_samba.c
-+++ b/lib/krb5_wrap/krb5_samba.c
-@@ -2697,6 +2697,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
- 
- 	return 0;
- }
-+
-+#else /* MIT */
-+
-+static bool princ_compare_no_dollar(krb5_context ctx,
-+				    krb5_principal a,
-+				    krb5_principal b)
-+{
-+	bool cmp;
-+	krb5_principal mod = NULL;
-+
-+	if (a->length == 1 && b->length == 1 &&
-+	    a->data[0].length != 0 && b->data[0].length != 0 &&
-+	    a->data[0].data[a->data[0].length -1] !=
-+	    b->data[0].data[b->data[0].length -1]) {
-+		if (a->data[0].data[a->data[0].length -1] == '$') {
-+			mod = a;
-+			mod->data[0].length--;
-+		} else if (b->data[0].data[b->data[0].length -1] == '$') {
-+			mod = b;
-+			mod->data[0].length--;
-+		}
-+	}
-+
-+	cmp = krb5_principal_compare_flags(ctx, a, b,
-+					   KRB5_PRINCIPAL_COMPARE_CASEFOLD);
-+
-+	if (mod != NULL) {
-+		mod->data[0].length++;
-+	}
-+
-+	return cmp;
-+}
-+
-+krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
-+					   krb5_ccache store_cc,
-+					   krb5_principal init_principal,
-+					   const char *init_password,
-+					   krb5_principal impersonate_principal,
-+					   const char *self_service,
-+					   const char *target_service,
-+					   krb5_get_init_creds_opt *krb_options,
-+					   time_t *expire_time,
-+					   time_t *kdc_time)
-+{
-+	krb5_error_code code;
-+	krb5_principal self_princ = NULL;
-+	krb5_principal target_princ = NULL;
-+	krb5_creds *store_creds;
-+	krb5_creds *s4u2self_creds = NULL;
-+	krb5_creds *s4u2proxy_creds = NULL;
-+	krb5_creds init_creds = {0};
-+	krb5_creds mcreds = {0};
-+	krb5_flags options = KRB5_GC_NO_STORE;
-+	krb5_ccache tmp_cc;
-+	bool s4u2proxy;
-+
-+	code = krb5_cc_new_unique(ctx, "MEMORY", NULL, &tmp_cc);
-+	if (code != 0) {
-+		return code;
-+	}
-+
-+	code = krb5_get_init_creds_password(ctx, &init_creds,
-+					    init_principal,
-+					    init_password,
-+					    NULL, NULL,
-+					    0,
-+					    NULL,
-+					    krb_options);
-+	if (code != 0) {
-+		goto done;
-+	}
-+
-+	code = krb5_cc_initialize(ctx, tmp_cc, init_creds.client);
-+	if (code != 0) {
-+		goto done;
-+	}
-+
-+	code = krb5_cc_store_cred(ctx, tmp_cc, &init_creds);
-+	if (code != 0) {
-+		goto done;
-+	}
-+
-+	/*
-+	 * Check if we also need S4U2Proxy or if S4U2Self is
-+	 * enough in order to get a ticket for the target.
-+	 */
-+	if (target_service == NULL) {
-+		s4u2proxy = false;
-+	} else if (strcmp(target_service, self_service) == 0) {
-+		s4u2proxy = false;
-+	} else {
-+		s4u2proxy = true;
-+	}
-+
-+	code = krb5_parse_name(ctx, self_service, &self_princ);
-+	if (code != 0) {
-+		goto done;
-+	}
-+
-+	/* MIT lacks aliases support in S4U, for S4U2Self we require the tgt
-+	 * client and the request server to be the same principal name. */
-+	if (!princ_compare_no_dollar(ctx, init_creds.client, self_princ)) {
-+		code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
-+		goto done;
-+	}
-+
-+	mcreds.client = impersonate_principal;
-+	mcreds.server = init_creds.client;
-+
-+	code = krb5_get_credentials_for_user(ctx, options, tmp_cc, &mcreds,
-+					     NULL, &s4u2self_creds);
-+	if (code != 0) {
-+		goto done;
-+	}
-+
-+	if (s4u2proxy) {
-+		code = krb5_parse_name(ctx, target_service, &target_princ);
-+		if (code != 0) {
-+			goto done;
-+		}
-+
-+		mcreds.client = init_creds.client;
-+		mcreds.server = target_princ;
-+		mcreds.second_ticket = s4u2self_creds->ticket;
-+
-+		code = krb5_get_credentials(ctx, options |
-+					    KRB5_GC_CONSTRAINED_DELEGATION,
-+					    tmp_cc, &mcreds, &s4u2proxy_creds);
-+		if (code != 0) {
-+			goto done;
-+		}
-+
-+		/* Check KDC support of S4U2Proxy extension */
-+		if (!krb5_principal_compare(ctx, s4u2self_creds->client,
-+					    s4u2proxy_creds->client)) {
-+			code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
-+			goto done;
-+		}
-+
-+		store_creds = s4u2proxy_creds;
-+	} else {
-+		store_creds = s4u2self_creds;;
-+
-+		/* We need to save the ticket with the requested server name
-+		 * or the caller won't be able to find it in cache. */
-+		if (!krb5_principal_compare(ctx, self_princ,
-+			store_creds->server)) {
-+			krb5_free_principal(ctx, store_creds->server);
-+			store_creds->server = NULL;
-+			code = krb5_copy_principal(ctx, self_princ,
-+						   &store_creds->server);
-+			if (code != 0) {
-+				goto done;
-+			}
-+		}
-+	}
-+
-+	code = krb5_cc_initialize(ctx, store_cc, store_creds->client);
-+	if (code != 0) {
-+		goto done;
-+	}
-+
-+	code = krb5_cc_store_cred(ctx, store_cc, store_creds);
-+	if (code != 0) {
-+		goto done;
-+	}
-+
-+	if (expire_time) {
-+		*expire_time = (time_t) store_creds->times.endtime;
-+	}
-+
-+	if (kdc_time) {
-+		*kdc_time = (time_t) store_creds->times.starttime;
-+	}
-+
-+done:
-+	krb5_cc_destroy(ctx, tmp_cc);
-+	krb5_free_cred_contents(ctx, &init_creds);
-+	krb5_free_creds(ctx, s4u2self_creds);
-+	krb5_free_creds(ctx, s4u2proxy_creds);
-+	krb5_free_principal(ctx, self_princ);
-+	krb5_free_principal(ctx, target_princ);
-+
-+	return code;
-+}
- #endif
- 
- #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA)
-diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h
-index eab67f6d969..b5385c69a33 100644
---- a/lib/krb5_wrap/krb5_samba.h
-+++ b/lib/krb5_wrap/krb5_samba.h
-@@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx,
- 					       krb5_get_init_creds_opt *krb_options,
- 					       time_t *expire_time,
- 					       time_t *kdc_time);
--#ifdef SAMBA4_USES_HEIMDAL
- krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
- 					   krb5_ccache store_cc,
- 					   krb5_principal init_principal,
-@@ -263,7 +262,6 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
- 					   krb5_get_init_creds_opt *krb_options,
- 					   time_t *expire_time,
- 					   time_t *kdc_time);
--#endif
- 
- #if defined(HAVE_KRB5_MAKE_PRINCIPAL)
- #define smb_krb5_make_principal krb5_make_principal
-diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c
-index 544d9d853cc..c14d8c72d8c 100644
---- a/source4/auth/kerberos/kerberos_util.c
-+++ b/source4/auth/kerberos/kerberos_util.c
-@@ -234,9 +234,7 @@ done:
- {
- 	krb5_error_code ret;
- 	const char *password;
--#ifdef SAMBA4_USES_HEIMDAL
- 	const char *self_service;
--#endif
- 	const char *target_service;
- 	time_t kdc_time = 0;
- 	krb5_principal princ;
-@@ -268,9 +266,7 @@ done:
- 		return ret;
- 	}
- 
--#ifdef SAMBA4_USES_HEIMDAL
- 	self_service = cli_credentials_get_self_service(credentials);
--#endif
- 	target_service = cli_credentials_get_target_service(credentials);
- 
- 	password = cli_credentials_get_password(credentials);
-@@ -331,7 +327,6 @@ done:
- #endif
- 		if (password) {
- 			if (impersonate_principal) {
--#ifdef SAMBA4_USES_HEIMDAL
- 				ret = smb_krb5_kinit_s4u2_ccache(smb_krb5_context->krb5_context,
- 								 ccache,
- 								 princ,
-@@ -342,12 +337,6 @@ done:
- 								 krb_options,
- 								 NULL,
- 								 &kdc_time);
--#else
--				talloc_free(mem_ctx);
--				(*error_string) = "INTERNAL error: s4u2 ops "
--					"are not supported with MIT build yet";
--				return EINVAL;
--#endif
- 			} else {
- 				ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context,
- 								     ccache,
--- 
-2.37.1
-
-
-From 3a9c224f229128451c878b262a716d48cb9f75d6 Mon Sep 17 00:00:00 2001
-From: Isaac Boukris <iboukris@gmail.com>
-Date: Sat, 19 Sep 2020 14:16:20 +0200
-Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code
-
----
- source4/kdc/mit_samba.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
-index 962fd05e1ac..9dc1bdf870b 100644
---- a/source4/kdc/mit_samba.c
-+++ b/source4/kdc/mit_samba.c
-@@ -232,6 +232,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx,
- 	if (kflags & KRB5_KDB_FLAG_CANONICALIZE) {
- 		sflags |= SDB_F_CANON;
- 	}
-+#if KRB5_KDB_API_VERSION >= 10
-+	sflags |= SDB_F_FORCE_CANON;
-+#endif
- 	if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY |
- 		      KRB5_KDB_FLAG_INCLUDE_PAC)) {
- 		/*
--- 
-2.37.1
-

samba-systemd-sysusers.conf

@@ -0,0 +1,2 @@
+#Type Name       ID
+g     printadmin -

samba-usershares-systemd-sysusers.conf

@@ -0,0 +1,2 @@
+#Type Name       ID
+g     usershares -

samba-winbind-systemd-sysusers.conf

@@ -0,0 +1,2 @@
+#Type Name       ID
+g     wbpriv     88

samba.abignore

@@ -0,0 +1,5 @@
+#################################################
+# This is a grouping library without any code
+#################################################
+[suppress_file]
+file_name_regexp=.*libdcerpc-samr\\.so.*

samba.logrotate

@@ -1,4 +1,4 @@
-/var/log/samba/log.* {
+/var/log/samba/*log* {
     compress
     dateext
     maxage 365

smb.conf.example

@@ -269,6 +269,13 @@
 ;	map system = no
 ;	store dos attributes = yes
 
+# Turn on SMB 3.1.1 Unix Extensions by default
+#
+# Note: The Linux Kernel SMB3 client will negotiate unix extensions by default,
+# find more info in man mount.smb3(8). Linux 6.13 will finally support special
+# filetypes and symlink handling.
+
+	smb3 unix extensions = yes
 
 #============================ Share Definitions ==============================
 

smb.conf.vendor

@@ -18,6 +18,9 @@
 	load printers = yes
 	cups options = raw
 
+	# Install samba-usershares package for support
+	include = /etc/samba/usershares.conf
+
 [homes]
 	comment = Home Directories
 	valid users = %S, %D%w%S
@@ -35,7 +38,8 @@
 [print$]
 	comment = Printer Drivers
 	path = /var/lib/samba/drivers
-	write list = @printadmin root
-	force group = @printadmin
+	# printadmin is a local group
+	write list = printadmin root
+	force group = printadmin
 	create mask = 0664
 	directory mask = 0775

sources

@@ -1,2 +1,2 @@
-SHA512 (samba-4.15.12.tar.xz) = c3d678944828f718a589630cf19998c8c917d8e93041fc46c07946ecd98ba8656086ca5b8881a1ab7c5a8d8ab4a66c7953e86bd99d67aeac2760e4151ffc0de2
-SHA512 (samba-4.15.12.tar.asc) = ac841370c230d0132c5e3ec8c0c1c87f9ba863fd45f6e48f191d50069c8a77cb924ace4166c5f594eda40f8b56f07b0c0501dbf92e38ee3455ccb5c88fa23fb6
+SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac
+SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce

tests/deps-check.fmf

@@ -0,0 +1,22 @@
+summary: Check samba package dependency structure
+description: |
+    Verify that samba library packages maintain correct dependency hierarchy:
+    - samba-core-libs has no samba-*-libs dependencies
+    - samba-ndr-libs depends on samba-core-libs (not samba-client-libs or samba-libs)
+    - samba-client-libs depends on core-libs + ndr-libs (not samba-libs)
+    - samba-client depends on samba-client-libs (not samba-libs)
+    - samba-libs does not depend on samba-dc-libs
+    - libsmbclient depends on samba-client-libs (not samba-libs)
+    - libwbclient has no samba-*-libs dependencies
+    - libldb has no samba-*-libs dependencies
+test: ./deps-check.sh
+framework: shell
+require:
+  - samba-core-libs
+  - samba-ndr-libs
+  - samba-client-libs
+  - samba-libs
+  - samba-client
+  - libwbclient
+  - libsmbclient
+  - libldb

tests/deps-check.sh

@@ -0,0 +1,167 @@
+#!/bin/bash
+#
+# Samba package dependency structure verification
+#
+# This test ensures that the samba library package dependencies don't regress.
+# The expected hierarchy is:
+#
+#   samba-core-libs    (no samba-*-libs dependencies)
+#        ^
+#        |
+#   samba-ndr-libs     (depends on samba-core-libs only)
+#        ^
+#        |
+#   samba-client-libs  (depends on samba-core-libs + samba-ndr-libs)
+#
+#   libwbclient        (no samba-*-libs dependencies - only links to libc)
+#
+#   samba-client       (depends on samba-client-libs, NOT samba-libs)
+#   libsmbclient       (depends on samba-client-libs, NOT samba-libs)
+#
+# NOTE: This test checks RESOLVED dependencies, not just explicit Requires.
+# A library requirement like 'libfoo.so' is resolved to the package that
+# provides it, ensuring we catch indirect dependencies.
+#
+
+set -e
+
+ERRORS=0
+
+# Get all packages that a package depends on (resolved)
+# This resolves library deps like 'libfoo.so' to actual package names
+get_resolved_deps() {
+    local pkg="$1"
+
+    rpm --query --requires "$pkg" 2>/dev/null | while read -r req; do
+        # Skip rpmlib and config requirements
+        [[ "$req" =~ ^rpmlib ]] && continue
+        [[ "$req" =~ ^config ]] && continue
+        [[ "$req" =~ ^/ ]] && continue
+
+        # Get the package that provides this requirement
+        provider=$(rpm --query --whatprovides "$req" 2>/dev/null | head -1)
+        if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then
+            # Extract just the package name (remove version-release.arch)
+            echo "${provider%%-[0-9]*}"
+        fi
+    done | sort -u
+}
+
+# Check that a package does NOT depend on packages matching a pattern
+# This checks RESOLVED dependencies (what packages actually get pulled in)
+check_no_resolved_dep() {
+    local pkg="$1"
+    local pattern="$2"
+    local description="$3"
+
+    if ! rpm --query "$pkg" &>/dev/null; then
+        echo "SKIP: $pkg not installed"
+        return 0
+    fi
+
+    local bad_deps
+    # Exclude the package itself from the check
+    bad_deps=$(get_resolved_deps "$pkg" | grep -v "^${pkg}$" | grep -E "$pattern" || true)
+
+    if [ -n "$bad_deps" ]; then
+        echo "FAIL: $pkg depends on $description"
+        echo "  Found: $bad_deps"
+        ERRORS=$((ERRORS + 1))
+        return 1
+    fi
+    echo "PASS: $pkg does not depend on $description"
+    return 0
+}
+
+# Check that a package DOES depend on a specific package
+check_has_resolved_dep() {
+    local pkg="$1"
+    local expected="$2"
+
+    if ! rpm --query "$pkg" &>/dev/null; then
+        echo "SKIP: $pkg not installed"
+        return 0
+    fi
+
+    if get_resolved_deps "$pkg" | grep -qF "$expected"; then
+        echo "PASS: $pkg depends on $expected"
+        return 0
+    fi
+    echo "FAIL: $pkg does not depend on $expected"
+    ERRORS=$((ERRORS + 1))
+    return 1
+}
+
+echo "=== Samba Package Dependency Checks ==="
+echo ""
+echo "Checking resolved dependencies (library deps resolved to packages)"
+echo ""
+
+# 1. samba-core-libs must NOT depend on any samba-*-libs packages
+echo "--- samba-core-libs ---"
+check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba*-libs package"
+
+echo ""
+
+# 2. samba-ndr-libs must depend on samba-core-libs
+#    but NOT samba-client-libs or samba-libs
+echo "--- samba-ndr-libs ---"
+check_has_resolved_dep samba-ndr-libs "samba-core-libs"
+check_no_resolved_dep samba-ndr-libs "^samba-client-libs$" "samba-client-libs"
+check_no_resolved_dep samba-ndr-libs "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 3. samba-client-libs must depend on samba-core-libs and samba-ndr-libs
+#    but NOT samba-libs
+echo "--- samba-client-libs ---"
+check_has_resolved_dep samba-client-libs "samba-core-libs"
+check_has_resolved_dep samba-client-libs "samba-ndr-libs"
+check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 4. libwbclient must NOT depend on any samba-*-libs packages
+echo "--- libwbclient ---"
+check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba*-libs package"
+
+echo ""
+
+# 5. samba-client must depend on samba-client-libs but NOT samba-libs
+#    (client tools should not pull in server libraries)
+echo "--- samba-client ---"
+check_has_resolved_dep samba-client "samba-client-libs"
+check_no_resolved_dep samba-client "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 6. libsmbclient must depend on samba-client-libs but NOT samba-libs
+#    (SMB client library should not pull in server libraries)
+echo "--- libsmbclient ---"
+check_has_resolved_dep libsmbclient "samba-client-libs"
+check_no_resolved_dep libsmbclient "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 7. libldb must NOT depend on any samba-*-libs packages
+#    (libldb is a standalone database library)
+echo "--- libldb ---"
+check_no_resolved_dep libldb "^samba-.*-libs$" "any samba*-libs package"
+
+echo ""
+
+# 8. samba-libs must NOT depend on samba-dc-libs
+#    (server libraries should not pull in DC-specific libraries)
+echo "--- samba-libs ---"
+check_no_resolved_dep samba-libs "^samba-dc-libs$" "samba-dc-libs"
+
+echo ""
+echo "=== Summary ==="
+
+if [ $ERRORS -gt 0 ]; then
+    echo "FAILED: $ERRORS dependency check(s) failed"
+    exit 1
+fi
+
+echo "All dependency checks passed"
+exit 0

usershares.conf.vendor

@@ -0,0 +1,3 @@
+[global]
+	usershare max shares = 100
+	usershare allow guests = yes