rpminspect: Don't run annocheck on test binaries

[skip changelog]
Remove duplicate libdsdb-module-private-samba.so
2026-01-15 17:21:55 +01:00 · 2026-01-14 16:36:45 +01:00 · 2026-01-14 16:36:45 +01:00 · 2026-01-14 16:36:45 +01:00 · 2026-01-14 14:30:40 +01:00 · 2026-01-14 13:36:05 +01:00
16 changed files with 4472 additions and 5124 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -0,0 +1 @@
+1
--- a/.gitignore
+++ b/.gitignore
@ -1,323 +1,4 @@
-samba-3.5.4.tar.gz
-samba-3.6.0pre1.tar.gz
-/samba-3.6.0pre2.tar.gz
-/samba-3.6.0pre3.tar.gz
-/samba-3.6.0rc1.tar.gz
-/samba-3.6.0rc2.tar.gz
-/samba-3.6.0rc3.tar.gz
-/samba-3.6.0.tar.gz
-/samba-3.6.1.tar.gz
-/samba-3.6.3.tar.gz
-/samba-3.6.4.tar.gz
-/samba-3.6.5.tar.gz
-/samba-3.6.6.tar.gz
-/samba-3.6.7.tar.gz
-/samba-4.0.0rc1.tar.bz2
-/samba-4.0.0rc2.tar.bz2
-/samba-4.0.0rc3.tar.bz2
-/samba-4.0.0rc4.tar.bz2
-/samba-4.0.0rc5.tar.bz2
-/samba-4.0.0rc6.tar.bz2
-/samba-4.0.0.tar.bz2
-/samba-4.0.1.tar.bz2
-/samba-4.0.2.tar.bz2
-/samba-4.0.3.tar.bz2
-/samba-4.0.4.tar.bz2
-/samba-4.0.5.tar.bz2
-/samba-4.0.6.tar.bz2
-/samba-4.0.7.tar.xz
-/samba-4.1.0rc1.tar.xz
-/samba-4.1.0rc2.tar.xz
-/samba-4.1.0rc3.tar.xz
-/samba-4.1.0rc4.tar.xz
-/samba-4.1.0.tar.xz
-/samba-4.1.1.tar.xz
-/samba-4.1.2.tar.xz
-/samba-4.1.3.tar.xz
-/samba-4.1.4.tar.xz
-/samba-4.1.5.tar.xz
-/samba-4.1.6.tar.xz
-/samba-4.1.8.tar.xz
-/samba-4.1.9.tar.xz
-/samba-4.1.11.tar.gz
-/samba-4.1.11.tar.xz
-/samba-4.1.12.tar.xz
-/samba-4.2.0rc2.tar.xz
-/samba-4.2.0rc3.tar.xz
-/samba-4.2.0rc4.tar.xz
-/samba-4.2.0rc5.tar.xz
-/samba-4.2.0.tar.xz
-/samba-4.2.1.tar.xz
-/samba-4.2.2.tar.xz
-/samba-4.2.3.tar.xz
-/samba-4.3.0rc3.tar.xz
-/samba-4.3.0rc4.tar.xz
-/samba-4.3.0.tar.xz
-/samba-4.3.1.tar.xz
-/samba-4.3.2.tar.xz
-/samba-4.3.3.tar.xz
-/samba-4.3.4.tar.xz
-/samba-4.4.0rc1.tar.xz
-/samba-4.4.0rc2.tar.xz
-/samba-4.4.0rc3.tar.xz
-/samba-4.4.0rc4.tar.xz
-/samba-4.4.0rc5.tar.xz
-/samba-4.4.0.tar.xz
-/samba-4.4.2.tar.xz
-/samba-4.4.3.tar.xz
-/samba-4.4.4.tar.xz
-/samba-4.4.5.tar.xz
-/samba-4.5.0rc1.tar.xz
-/samba-4.5.0rc2.tar.xz
-/samba-4.5.0rc3.tar.xz
-/samba-4.5.0.tar.xz
-/samba-4.5.1.tar.xz
-/samba-4.5.2.tar.xz
-/samba-4.5.3.tar.xz
-/samba-4.6.0rc1.tar.xz
-/samba-4.6.0rc2.tar.xz
-/samba-4.6.0rc2.tar.asc
-/samba-4.6.0rc3.tar.asc
-/samba-4.6.0rc3.tar.xz
-/samba-4.6.0rc4.tar.xz
-/samba-4.6.0rc4.tar.asc
-/samba-4.6.0.tar.asc
-/samba-4.6.0.tar.xz
-/samba-4.6.1.tar.xz
-/samba-4.6.1.tar.asc
-/samba-4.6.2.tar.xz
-/samba-4.6.2.tar.asc
-/samba-4.6.3.tar.xz
-/samba-4.6.3.tar.asc
-/samba-4.6.4.tar.xz
-/samba-4.6.4.tar.asc
-/samba-4.6.5.tar.xz
-/samba-4.6.5.tar.asc
-/samba-4.7.0rc1.tar.xz
-/samba-4.7.0rc1.tar.asc
-/samba-4.7.0rc3.tar.xz
-/samba-4.7.0rc3.tar.asc
-/samba-4.7.0rc5.tar.xz
-/samba-4.7.0rc5.tar.asc
-/samba-4.7.0rc6.tar.xz
-/samba-4.7.0rc6.tar.asc
-/samba-4.7.0.tar.xz
-/samba-4.7.0.tar.asc
-/samba-4.7.1.tar.xz
-/samba-4.7.1.tar.asc
-/samba-4.7.2.tar.xz
-/samba-4.7.2.tar.asc
-/samba-4.7.3.tar.xz
-/samba-4.7.3.tar.asc
-/samba-4.7.4.tar.xz
-/samba-4.7.4.tar.asc
-/samba-4.8.0rc1.tar.xz
-/samba-4.8.0rc1.tar.asc
-/samba-4.8.0rc2.tar.xz
-/samba-4.8.0rc2.tar.asc
-/samba-4.8.0rc3.tar.xz
-/samba-4.8.0rc3.tar.asc
-/samba-4.8.0rc4.tar.xz
-/samba-4.8.0rc4.tar.asc
-/samba-4.8.0.tar.xz
-/samba-4.8.0.tar.asc
-/samba-4.8.1.tar.xz
-/samba-4.8.1.tar.asc
-/samba-4.8.2.tar.xz
-/samba-4.8.2.tar.asc
-/samba-4.8.3.tar.asc
-/samba-4.8.3.tar.xz
-/samba-4.9.0rc1.tar.xz
-/samba-4.9.0rc1.tar.asc
-/samba-4.9.0rc2.tar.xz
-/samba-4.9.0rc2.tar.asc
-/samba-4.9.0rc3.tar.xz
-/samba-4.9.0rc3.tar.asc
-/samba-4.9.0rc4.tar.xz
-/samba-4.9.0rc4.tar.asc
-/samba-4.9.0rc5.tar.asc
-/samba-4.9.0rc5.tar.xz
-/samba-4.9.0.tar.xz
-/samba-4.9.0.tar.asc
-/samba-4.9.1.tar.asc
-/samba-4.9.1.tar.xz
-/samba-4.9.2.tar.xz
-/samba-4.9.2.tar.asc
-/samba-4.9.3.tar.xz
-/samba-4.9.3.tar.asc
-/samba-4.9.4.tar.xz
-/samba-4.9.4.tar.asc
-/samba-4.10.0rc1.tar.xz
-/samba-4.10.0rc1.tar.asc
-/samba-4.10.0rc2.tar.xz
-/samba-4.10.0rc2.tar.asc
-/samba-4.10.0rc3.tar.xz
-/samba-4.10.0rc3.tar.asc
-/samba-4.10.0rc4.tar.xz
-/samba-4.10.0rc4.tar.asc
-/samba-4.10.0.tar.xz
-/samba-4.10.0.tar.asc
-/samba-4.10.1.tar.xz
-/samba-4.10.1.tar.asc
-/samba-4.10.2.tar.xz
-/samba-4.10.2.tar.asc
-/samba-4.10.3.tar.xz
-/samba-4.10.3.tar.asc
-/samba-4.10.4.tar.xz
-/samba-4.10.4.tar.asc
-/samba-4.10.5.tar.xz
-/samba-4.10.5.tar.asc
-/samba-4.10.6.tar.xz
-/samba-4.10.6.tar.asc
-/samba-4.11.0rc1.tar.xz
-/samba-4.11.0rc1.tar.asc
-/samba-4.11.0rc2.tar.xz
-/samba-4.11.0rc2.tar.asc
-/samba-4.11.0rc3.tar.xz
-/samba-4.11.0rc3.tar.asc
-/samba-4.11.0rc4.tar.xz
-/samba-4.11.0rc4.tar.asc
-/samba-4.11.0.tar.xz
-/samba-4.11.0.tar.asc
-/samba-4.11.1.tar.xz
-/samba-4.11.1.tar.asc
-/samba-4.11.2.tar.xz
-/samba-4.11.2.tar.asc
-/samba-4.11.3.tar.xz
-/samba-4.11.3.tar.asc
-/samba-4.11.4.tar.xz
-/samba-4.11.4.tar.asc
-/samba-4.11.5.tar.xz
-/samba-4.11.5.tar.asc
-/samba-4.12.0rc1.tar.xz
-/samba-4.12.0rc1.tar.asc
-/samba-4.12.0rc2.tar.xz
-/samba-4.12.0rc2.tar.asc
-/samba-4.12.0rc3.tar.xz
-/samba-4.12.0rc3.tar.asc
-/samba-4.12.0rc4.tar.xz
-/samba-4.12.0rc4.tar.asc
-/samba-4.12.0.tar.xz
-/samba-4.12.0.tar.asc
-/samba-4.12.1.tar.xz
-/samba-4.12.1.tar.asc
-/samba-4.12.2.tar.xz
-/samba-4.12.2.tar.asc
-/samba-4.12.3.tar.xz
-/samba-4.12.3.tar.asc
-/samba-4.12.4.tar.xz
-/samba-4.12.4.tar.asc
-/samba-4.12.5.tar.xz
-/samba-4.12.5.tar.asc
-/samba-4.13.0rc1.tar.xz
-/samba-4.13.0rc1.tar.asc
-/samba-4.13.0rc2.tar.xz
-/samba-4.13.0rc2.tar.asc
-/samba-4.13.0rc3.tar.xz
-/samba-4.13.0rc3.tar.asc
-/samba-4.13.0rc4.tar.xz
-/samba-4.13.0rc4.tar.asc
-/samba-4.13.0rc5.tar.xz
-/samba-4.13.0rc5.tar.asc
-/samba-4.13.0rc6.tar.xz
-/samba-4.13.0rc6.tar.asc
-/samba-4.13.0.tar.xz
-/samba-4.13.0.tar.asc
-/samba-4.13.1.tar.xz
-/samba-4.13.1.tar.asc
-/samba-4.13.2.tar.xz
-/samba-4.13.2.tar.asc
-/samba-4.13.3.tar.xz
-/samba-4.13.3.tar.asc
-/samba-4.13.4.tar.xz
-/samba-4.13.4.tar.asc
-/samba-4.14.0rc1.tar.xz
-/samba-4.14.0rc1.tar.asc
-/samba-4.14.0rc2.tar.xz
-/samba-4.14.0rc2.tar.asc
-/samba-4.14.0rc3.tar.xz
-/samba-4.14.0rc3.tar.asc
-/samba-4.14.0rc4.tar.xz
-/samba-4.14.0rc4.tar.asc
-/samba-4.14.0.tar.xz
-/samba-4.14.0.tar.asc
-/samba-4.14.1.tar.xz
-/samba-4.14.1.tar.asc
-/samba-4.14.2.tar.xz
-/samba-4.14.2.tar.asc
-/samba-4.14.3.tar.xz
-/samba-4.14.3.tar.asc
-/samba-4.14.4.tar.xz
-/samba-4.14.4.tar.asc
-/samba-4.14.5.tar.xz
-/samba-4.14.5.tar.asc
-/samba-4.14.6.tar.xz
-/samba-4.14.6.tar.asc
-/samba-4.15.0rc1.tar.xz
-/samba-4.15.0rc1.tar.asc
-/samba-4.15.0rc2.tar.xz
-/samba-4.15.0rc2.tar.asc
-/samba-4.15.0rc3.tar.xz
-/samba-4.15.0rc3.tar.asc
-/samba-4.15.0rc4.tar.xz
-/samba-4.15.0rc4.tar.asc
-/samba-4.15.0rc5.tar.xz
-/samba-4.15.0rc5.tar.asc
-/samba-4.15.0rc6.tar.xz
-/samba-4.15.0rc6.tar.asc
-/samba-4.15.0rc7.tar.xz
-/samba-4.15.0rc7.tar.asc
-/samba-4.15.0.tar.xz
-/samba-4.15.0.tar.asc
-/samba-4.15.1.tar.xz
-/samba-4.15.1.tar.asc
-/samba-4.15.2.tar.xz
-/samba-4.15.2.tar.asc
-/samba-4.15.3.tar.xz
-/samba-4.15.3.tar.asc
-/samba-4.15.4.tar.xz
-/samba-4.15.4.tar.asc
-/samba-4.16.0rc1.tar.xz
-/samba-4.16.0rc1.tar.asc
-/samba-4.16.0rc2.tar.xz
-/samba-4.16.0rc2.tar.asc
-/samba-4.16.0rc3.tar.xz
-/samba-4.16.0rc3.tar.asc
-/samba-4.16.0rc4.tar.xz
-/samba-4.16.0rc4.tar.asc
-/samba-4.16.0rc5.tar.xz
-/samba-4.16.0rc5.tar.asc
-/samba-4.16.0.tar.xz
-/samba-4.16.0.tar.asc
-/samba-4.16.1.tar.xz
-/samba-4.16.1.tar.asc
-/samba-4.16.2.tar.xz
-/samba-4.16.2.tar.asc
-/samba-4.16.3.tar.xz
-/samba-4.16.3.tar.asc
-/samba-4.16.4.tar.xz
-/samba-4.16.4.tar.asc
-/samba-4.17.0rc1.tar.xz
-/samba-4.17.0rc1.tar.asc
-/samba-4.17.0rc2.tar.xz
-/samba-4.17.0rc2.tar.asc
-/samba-4.17.0rc3.tar.asc
-/samba-4.17.0rc3.tar.xz
-/samba-4.17.0rc4.tar.xz
-/samba-4.17.0rc4.tar.asc
-/samba-4.17.0rc5.tar.xz
-/samba-4.17.0rc5.tar.asc
-/samba-4.17.0.tar.xz
-/samba-4.17.0.tar.asc
-/samba-4.17.1.tar.xz
-/samba-4.17.1.tar.asc
-/samba-4.17.2.tar.xz
-/samba-4.17.2.tar.asc
-/samba-4.17.3.tar.xz
-/samba-4.17.3.tar.asc
-/samba-4.17.4.tar.xz
-/samba-4.17.4.tar.asc
-/samba-4.18.0rc1.tar.xz
-/samba-4.18.0rc1.tar.asc
-/samba-4.18.0rc2.tar.xz
-/samba-4.18.0rc2.tar.asc
+/samba-*.tar.xz
+/samba-*.tar.asc
+/*.rpm
+/results_samba
--- a/3039
+++ b/3039
--- a/gating.yaml
+++ b/gating.yaml
@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_stable
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
--- a/plans.fmf
+++ b/plans.fmf
@ -0,0 +1,4 @@
+discover:
+    how: fmf
+execute:
+    how: tmt
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@ -1,12 +1,16 @@
 ---
+inspections:
+    disttag: off
+
 badfuncs:
    ignore:
+        - /usr/bin/nmbd
        - /usr/bin/nmblookup
        - /usr/bin/smbtorture
        - /usr/lib*/libndr.so.*
        - /usr/lib*/libsmbconf.so.*
-        - /usr/lib*/samba/libgse-samba4.so
-        - /usr/lib*/samba/libsamba-sockets-samba4.so
+        - /usr/lib*/samba/libgse-private-samba.so
+        - /usr/lib*/samba/libsamba-sockets-private-samba.so
        - /usr/lib*/samba/service/nbtd.so
        - /usr/libexec/ctdb/smnotify
        - /usr/sbin/nmbd
@ -22,3 +26,10 @@ abidiff:
 debuginfo:
    ignore:
        - /usr/lib*/libdcerpc-samr.so.*
+
+annocheck:
+    ignore:
+        - /usr/bin/gentest
+        - /usr/bin/locktest
+        - /usr/bin/masktest
+        - /usr/bin/smbtorture
--- a/samba-4.17-fix-changeuserpassword4.patch
+++ b/samba-4.17-fix-changeuserpassword4.patch
@ -1,540 +0,0 @@
-From a3e3d05f35d6082ea48450060b39084e3d0e4056 Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Mon, 10 Oct 2022 15:15:20 +0200
-Subject: [PATCH 1/5] s3:librpc: Improve GSE error message
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
-Reviewed-by: Noel Power <noel.power@suse.com>
---
- source3/librpc/crypto/gse.c | 21 +++++++++++++++++++--
- 1 file changed, 19 insertions(+), 2 deletions(-)
-
-diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
-index c50a8a036df..c2cac7abf82 100644
--- a/source3/librpc/crypto/gse.c
-+++ b/source3/librpc/crypto/gse.c
-@@ -546,11 +546,28 @@ init_sec_context_done:
- 		goto done;
- 	case GSS_S_FAILURE:
- 		switch (gss_min) {
-		case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
-			DBG_NOTICE("Server principal not found\n");
-+		case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: {
-+			gss_buffer_desc name_token = {
-+				.length = 0,
-+			};
-+
-+			gss_maj = gss_display_name(&gss_min,
-+						   gse_ctx->server_name,
-+						   &name_token,
-+						   NULL);
-+			if (gss_maj == GSS_S_COMPLETE) {
-+				DBG_NOTICE("Server principal %.*s not found\n",
-+					   (int)name_token.length,
-+					   (char *)name_token.value);
-+				gss_release_buffer(&gss_maj, &name_token);
-+			} else {
-+				DBG_NOTICE("Server principal not found\n");
-+			}
-+
- 			/* Make SPNEGO ignore us, we can't go any further here */
- 			status = NT_STATUS_INVALID_PARAMETER;
- 			goto done;
-+		}
- 		case (OM_uint32)KRB5KRB_AP_ERR_TKT_EXPIRED:
- 			DBG_NOTICE("Ticket expired\n");
- 			/* Make SPNEGO ignore us, we can't go any further here */
-- 
-2.37.3
-
-
-From d2e2e9acd717e45806f1b19378e09f39c8fe3da8 Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Fri, 7 Oct 2022 14:35:15 +0200
-Subject: [PATCH 2/5] s3:rpcclient: Pass salt down to
- init_samr_CryptPasswordAES()
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
-Reviewed-by: Noel Power <noel.power@suse.com>
---
- source3/rpc_client/init_samr.c | 15 ++++-----------
- source3/rpc_client/init_samr.h |  1 +
- source3/rpcclient/cmd_samr.c   |  8 ++++++++
- source4/libnet/libnet_passwd.c | 13 +++++++------
- source4/torture/rpc/samr.c     | 27 +++++++++++++++++++++++++++
- 5 files changed, 47 insertions(+), 17 deletions(-)
-
-diff --git a/source3/rpc_client/init_samr.c b/source3/rpc_client/init_samr.c
-index 68f42b602b3..52fa2f90d6e 100644
--- a/source3/rpc_client/init_samr.c
-+++ b/source3/rpc_client/init_samr.c
-@@ -79,6 +79,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd,
- 
- NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx,
- 				    const char *password,
-+				    DATA_BLOB *salt,
- 				    DATA_BLOB *session_key,
- 				    struct samr_EncryptedPasswordAES *ppwd_buf)
- {
-@@ -87,12 +88,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx,
- 		.data = pw_data,
- 		.length = sizeof(pw_data),
- 	};
-	size_t iv_size = gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_256_CBC);
-	uint8_t iv_data[iv_size];
-	DATA_BLOB iv = {
-		.data = iv_data,
-		.length = iv_size,
-	};
- 	DATA_BLOB ciphertext = data_blob_null;
- 	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
- 	bool ok;
-@@ -101,8 +96,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx,
- 		return NT_STATUS_INVALID_PARAMETER;
- 	}
- 
-	generate_nonce_buffer(iv.data, iv.length);
-
- 	ok = encode_pwd_buffer514_from_str(pw_data, password, STR_UNICODE);
- 	if (!ok) {
- 		return NT_STATUS_INTERNAL_ERROR;
-@@ -114,7 +107,7 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx,
- 			session_key,
- 			&samr_aes256_enc_key_salt,
- 			&samr_aes256_mac_key_salt,
-			&iv,
-+			salt,
- 			&ciphertext,
- 			ppwd_buf->auth_data);
- 	BURN_DATA(pw_data);
-@@ -126,8 +119,8 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx,
- 	ppwd_buf->cipher = ciphertext.data;
- 	ppwd_buf->PBKDF2Iterations = 0;
- 
-	SMB_ASSERT(iv.length == sizeof(ppwd_buf->salt));
-	memcpy(ppwd_buf->salt, iv.data, iv.length);
-+	SMB_ASSERT(salt->length == sizeof(ppwd_buf->salt));
-+	memcpy(ppwd_buf->salt, salt->data, salt->length);
- 
- 	return NT_STATUS_OK;
- }
-diff --git a/source3/rpc_client/init_samr.h b/source3/rpc_client/init_samr.h
-index 940534e7168..71b4c0e573d 100644
--- a/source3/rpc_client/init_samr.h
-+++ b/source3/rpc_client/init_samr.h
-@@ -47,6 +47,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd,
-  */
- NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx,
- 				    const char *password,
-+				    DATA_BLOB *salt,
- 				    DATA_BLOB *session_key,
- 				    struct samr_EncryptedPasswordAES *ppwd_buf);
- 
-diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c
-index 9ccd2f78a8d..8106ca90cf2 100644
--- a/source3/rpcclient/cmd_samr.c
-+++ b/source3/rpcclient/cmd_samr.c
-@@ -3172,6 +3172,11 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli,
- 	uint8_t nt_hash[16];
- 	uint8_t lm_hash[16];
- 	DATA_BLOB session_key;
-+	uint8_t salt_data[16];
-+	DATA_BLOB salt = {
-+		.data = salt_data,
-+		.length = sizeof(salt_data),
-+	};
- 	uint8_t password_expired = 0;
- 	struct dcerpc_binding_handle *b = cli->binding_handle;
- 	TALLOC_CTX *frame = NULL;
-@@ -3198,6 +3203,8 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli,
- 		goto done;
- 	}
- 
-+	generate_nonce_buffer(salt.data, salt.length);
-+
- 	switch(level) {
- 	case 18:
- 	case 21:
-@@ -3220,6 +3227,7 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli,
- 	case 31:
- 		status = init_samr_CryptPasswordAES(frame,
- 						    param,
-+						    &salt,
- 						    &session_key,
- 						    &pwd_buf_aes);
- 		if (!NT_STATUS_IS_OK(status)) {
-diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c
-index 4f662110e55..a1672104824 100644
--- a/source4/libnet/libnet_passwd.c
-+++ b/source4/libnet/libnet_passwd.c
-@@ -57,13 +57,13 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx,
- 	struct samr_EncryptedPasswordAES pwd_buf = {
- 		.cipher_len = 0
- 	};
-	DATA_BLOB iv = {
-+	DATA_BLOB salt = {
- 		.data = pwd_buf.salt,
- 		.length = sizeof(pwd_buf.salt),
- 	};
-	gnutls_datum_t iv_datum = {
-		.data = iv.data,
-		.size = iv.length,
-+	gnutls_datum_t salt_datum = {
-+		.data = pwd_buf.salt,
-+		.size = sizeof(pwd_buf.salt),
- 	};
- 	uint64_t pbkdf2_iterations = generate_random_u64_range(5000, 1000000);
- 	NTSTATUS status;
-@@ -71,11 +71,11 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx,
- 
- 	E_md4hash(old_password, old_nt_key_data);
- 
-	generate_nonce_buffer(iv.data, iv.length);
-+	generate_nonce_buffer(salt.data, salt.length);
- 
- 	rc = gnutls_pbkdf2(GNUTLS_MAC_SHA512,
- 			   &old_nt_key,
-			   &iv_datum,
-+			   &salt_datum,
- 			   pbkdf2_iterations,
- 			   cek.data,
- 			   cek.length);
-@@ -86,6 +86,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx,
- 
- 	status = init_samr_CryptPasswordAES(mem_ctx,
- 					    new_password,
-+					    &salt,
- 					    &cek,
- 					    &pwd_buf);
- 	data_blob_clear(&cek);
-diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c
-index de354659067..0b1880efa18 100644
--- a/source4/torture/rpc/samr.c
-+++ b/source4/torture/rpc/samr.c
-@@ -783,6 +783,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t
- 	struct samr_SetUserInfo s;
- 	union samr_UserInfo u;
- 	DATA_BLOB session_key;
-+	uint8_t salt_data[16];
-+	DATA_BLOB salt = {
-+		.data = salt_data,
-+		.length = sizeof(salt_data),
-+	};
- 	char *newpass = NULL;
- 	struct dcerpc_binding_handle *b = p->binding_handle;
- 	struct samr_GetUserPwInfo pwp;
-@@ -818,8 +823,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t
- 		return false;
- 	}
- 
-+	generate_nonce_buffer(salt.data, salt.length);
-+
- 	status = init_samr_CryptPasswordAES(tctx,
- 					    newpass,
-+					    &salt,
- 					    &session_key,
- 					    &u.info32.password);
- 	torture_assert_ntstatus_ok(tctx,
-@@ -852,6 +860,7 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t
- 
- 	status = init_samr_CryptPasswordAES(tctx,
- 					    newpass,
-+					    &salt,
- 					    &session_key,
- 					    &u.info32.password);
- 	torture_assert_ntstatus_ok(tctx,
-@@ -896,6 +905,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t
- 	union samr_UserInfo u;
- 	bool ret = true;
- 	DATA_BLOB session_key;
-+	uint8_t salt_data[16];
-+	DATA_BLOB salt = {
-+		.data = salt_data,
-+		.length = sizeof(salt_data),
-+	};
- 	char *newpass;
- 	struct dcerpc_binding_handle *b = p->binding_handle;
- 	struct samr_GetUserPwInfo pwp;
-@@ -931,8 +945,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t
- 		return false;
- 	}
- 
-+	generate_nonce_buffer(salt.data, salt.length);
-+
- 	status = init_samr_CryptPasswordAES(tctx,
- 					    newpass,
-+					    &salt,
- 					    &session_key,
- 					    &u.info31.password);
- 	torture_assert_ntstatus_ok(tctx,
-@@ -959,6 +976,7 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t
- 
- 	status = init_samr_CryptPasswordAES(tctx,
- 					    newpass,
-+					    &salt,
- 					    &session_key,
- 					    &u.info31.password);
- 	torture_assert_ntstatus_ok(tctx,
-@@ -1381,6 +1399,11 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
- 	union samr_UserInfo u;
- 	bool ret = true;
- 	DATA_BLOB session_key;
-+	uint8_t salt_data[16];
-+	DATA_BLOB salt = {
-+		.data = salt_data,
-+		.length = sizeof(salt_data),
-+	};
- 	char *newpass;
- 	struct dcerpc_binding_handle *b = p->binding_handle;
- 	struct samr_GetUserPwInfo pwp;
-@@ -1490,6 +1513,8 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
- 		return false;
- 	}
- 
-+	generate_nonce_buffer(salt.data, salt.length);
-+
- 	switch (level) {
- 	case 18:
- 		{
-@@ -1561,6 +1586,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
- 	case 31:
- 		status = init_samr_CryptPasswordAES(tctx,
- 						    newpass,
-+						    &salt,
- 						    &session_key,
- 						    &u.info31.password);
- 
-@@ -1568,6 +1594,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
- 	case 32:
- 		status = init_samr_CryptPasswordAES(tctx,
- 						    newpass,
-+						    &salt,
- 						    &session_key,
- 						    &u.info32.password);
- 
-- 
-2.37.3
-
-
-From 1d630363c9b2497266e418aad89c55d5b51a63ad Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Mon, 17 Oct 2022 09:02:28 +0200
-Subject: [PATCH 3/5] s4:libnet: If we successfully changed the password we are
- done
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
-Reviewed-by: Noel Power <noel.power@suse.com>
---
- source4/libnet/libnet_passwd.c | 32 ++++++++++++++++++--------------
- 1 file changed, 18 insertions(+), 14 deletions(-)
-
-diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c
-index a1672104824..b17614bcd97 100644
--- a/source4/libnet/libnet_passwd.c
-+++ b/source4/libnet/libnet_passwd.c
-@@ -101,7 +101,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx,
- 	r.in.password = &pwd_buf;
- 
- 	status = dcerpc_samr_ChangePasswordUser4_r(h, mem_ctx, &r);
-	if (NT_STATUS_IS_OK(status)) {
-+	if (!NT_STATUS_IS_OK(status)) {
- 		goto done;
- 	}
- 	if (!NT_STATUS_IS_OK(r.out.result)) {
-@@ -112,6 +112,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx,
- 						account->string,
- 						nt_errstr(status));
- 		status = r.out.result;
-+		goto done;
- 	}
- 
- done:
-@@ -424,20 +425,23 @@ static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CT
- 		r->samr.in.oldpassword,
- 		r->samr.in.newpassword,
- 		&(r->samr.out.error_string));
-	if (!NT_STATUS_IS_OK(status)) {
-		if (NT_STATUS_EQUAL(status,
-				     NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
-		    NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) ||
-		    NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
-			/*
-			* Don't fallback to RC4 based SAMR if weak crypto is not
-			* allowed.
-			*/
-			if (lpcfg_weak_crypto(ctx->lp_ctx) ==
-			SAMBA_WEAK_CRYPTO_DISALLOWED) {
-				goto disconnect;
-			}
-+	if (NT_STATUS_IS_OK(status)) {
-+		goto disconnect;
-+	} else if (NT_STATUS_EQUAL(status,
-+				   NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
-+		   NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) ||
-+		   NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
-+		/*
-+		 * Don't fallback to RC4 based SAMR if weak crypto is not
-+		 * allowed.
-+		 */
-+		if (lpcfg_weak_crypto(ctx->lp_ctx) ==
-+		    SAMBA_WEAK_CRYPTO_DISALLOWED) {
-+			goto disconnect;
- 		}
-+	} else {
-+		/* libnet_ChangePassword_samr_aes is implemented and failed */
-+		goto disconnect;
- 	}
- 
- 	status = libnet_ChangePassword_samr_rc4(
-- 
-2.37.3
-
-
-From 9a4a169ab34641afb87e7f81708c9a72b321879e Mon Sep 17 00:00:00 2001
-From: Noel Power <noel.power@suse.com>
-Date: Fri, 21 Oct 2022 17:40:36 +0100
-Subject: [PATCH 4/5] s4/rpc_server/sambr: don't mutate the return of
- samdb_set_password_aes
-
-prior to this commit return of samdb_set_password_aes was set to
-NT_STATUS_WRONG_PASSWORD on failure. Useful status that should be
-returned such as NT_STATUS_PASSWORD_RESTRICTION are swallowed here
-otherwise (and in this case can be partially responsible for failures
-in test samba.tests.auth_log_pass_change (with later gnutls)
-
-Signed-off-by: Noel Power <noel.power@suse.com>
-Reviewed-by: Andreas Schneider <asn@samba.org>
---
- source4/rpc_server/samr/samr_password.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
-index 4691f9a47a9..b581be6361c 100644
--- a/source4/rpc_server/samr/samr_password.c
-+++ b/source4/rpc_server/samr/samr_password.c
-@@ -250,7 +250,6 @@ NTSTATUS dcesrv_samr_ChangePasswordUser4(struct dcesrv_call_state *dce_call,
- 
- 	if (!NT_STATUS_IS_OK(status)) {
- 		ldb_transaction_cancel(sam_ctx);
-		status = NT_STATUS_WRONG_PASSWORD;
- 		goto done;
- 	}
- 
-- 
-2.37.3
-
-
-From b8b36ecba0f22dbc203c12627ebd629c2437c635 Mon Sep 17 00:00:00 2001
-From: Noel Power <noel.power@suse.com>
-Date: Fri, 21 Oct 2022 17:14:44 +0100
-Subject: [PATCH 5/5] python/samba/tests: fix samba.tests.auth_log_pass_change
- for later gnutls
-
-later gnutls that support GNUTLS_PBKDF2 currently fail,
-we need to conditionally switch test data to reflect use of
-'samr_ChangePasswordUser3' or 'samr_ChangePasswordUser4'
-depending on whether GNUTLS_PBKDF2 is supported or not
-
-Signed-off-by: Noel Power <noel.power@suse.com>
-Reviewed-by: Andreas Schneider <asn@samba.org>
---
- python/samba/tests/auth_log_pass_change.py | 20 ++++++++++++++++----
- source4/selftest/tests.py                  |  9 ++++++---
- 2 files changed, 22 insertions(+), 7 deletions(-)
-
-diff --git a/python/samba/tests/auth_log_pass_change.py b/python/samba/tests/auth_log_pass_change.py
-index 972af2158dd..1ca46c586b3 100644
--- a/python/samba/tests/auth_log_pass_change.py
-+++ b/python/samba/tests/auth_log_pass_change.py
-@@ -72,6 +72,18 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase):
- 
-         # discard any auth log messages for the password setup
-         self.discardMessages()
-+        gnutls_pbkdf2_support = samba.tests.env_get_var_value(
-+            'GNUTLS_PBKDF2_SUPPORT',
-+            allow_missing=True)
-+        if gnutls_pbkdf2_support is None:
-+            gnutls_pbkdf2_support = '0'
-+        self.gnutls_pbkdf2_support = bool(int(gnutls_pbkdf2_support))
-+
-+    def _authDescription(self):
-+        if self.gnutls_pbkdf2_support:
-+            return "samr_ChangePasswordUser4"
-+        else:
-+            return "samr_ChangePasswordUser3"
- 
-     def tearDown(self):
-         super(AuthLogPassChangeTests, self).tearDown()
-@@ -83,7 +95,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase):
-                     (msg["Authentication"]["serviceDescription"] ==
-                         "SAMR Password Change") and
-                     (msg["Authentication"]["authDescription"] ==
-                        "samr_ChangePasswordUser3") and
-+                        self._authDescription()) and
-                     (msg["Authentication"]["eventId"] ==
-                         EVT_ID_SUCCESSFUL_LOGON) and
-                     (msg["Authentication"]["logonType"] ==
-@@ -109,7 +121,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase):
-                     (msg["Authentication"]["serviceDescription"] ==
-                         "SAMR Password Change") and
-                     (msg["Authentication"]["authDescription"] ==
-                        "samr_ChangePasswordUser3") and
-+                        self._authDescription()) and
-                     (msg["Authentication"]["eventId"] ==
-                         EVT_ID_UNSUCCESSFUL_LOGON) and
-                     (msg["Authentication"]["logonType"] ==
-@@ -141,7 +153,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase):
-                     (msg["Authentication"]["serviceDescription"] ==
-                         "SAMR Password Change") and
-                     (msg["Authentication"]["authDescription"] ==
-                        "samr_ChangePasswordUser3") and
-+                        self._authDescription()) and
-                     (msg["Authentication"]["eventId"] ==
-                         EVT_ID_UNSUCCESSFUL_LOGON) and
-                     (msg["Authentication"]["logonType"] ==
-@@ -174,7 +186,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase):
-                     (msg["Authentication"]["serviceDescription"] ==
-                         "SAMR Password Change") and
-                     (msg["Authentication"]["authDescription"] ==
-                        "samr_ChangePasswordUser3") and
-+                        self._authDescription()) and
-                     (msg["Authentication"]["eventId"] ==
-                         EVT_ID_UNSUCCESSFUL_LOGON) and
-                     (msg["Authentication"]["logonType"] ==
-diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
-index a803d4704ea..c92105586a7 100755
--- a/source4/selftest/tests.py
-+++ b/source4/selftest/tests.py
-@@ -1094,9 +1094,11 @@ if have_heimdal_support:
-                            environ={'CLIENT_IP': '10.53.57.11',
-                                     'SOCKET_WRAPPER_DEFAULT_IFACE': 11})
-     planoldpythontestsuite("ad_dc_smb1", "samba.tests.auth_log_pass_change",
-                           extra_args=['-U"$USERNAME%$PASSWORD"'])
-+                           extra_args=['-U"$USERNAME%$PASSWORD"'],
-+                           environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support})
-     planoldpythontestsuite("ad_dc_ntvfs", "samba.tests.auth_log_pass_change",
-                           extra_args=['-U"$USERNAME%$PASSWORD"'])
-+                           extra_args=['-U"$USERNAME%$PASSWORD"'],
-+                           environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support})
- 
-     # these tests use a NCA local RPC connection, so always run on the
-     # :local testenv, and so don't need to fake a client connection
-@@ -1113,7 +1115,8 @@ if have_heimdal_support:
-                            "samba.tests.auth_log_winbind",
-                            extra_args=['-U"$DC_USERNAME%$DC_PASSWORD"'])
-     planoldpythontestsuite("ad_dc", "samba.tests.audit_log_pass_change",
-                           extra_args=['-U"$USERNAME%$PASSWORD"'])
-+                           extra_args=['-U"$USERNAME%$PASSWORD"'],
-+                           environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support})
-     planoldpythontestsuite("ad_dc", "samba.tests.audit_log_dsdb",
-                            extra_args=['-U"$USERNAME%$PASSWORD"'])
-     planoldpythontestsuite("ad_dc", "samba.tests.group_audit",
-- 
-2.37.3
-
--- a/samba-4.23-fix-cmocka.patch
+++ b/samba-4.23-fix-cmocka.patch
@ -0,0 +1,38 @@
+From b1ec803f420b2c6d3c5c83d70c6875a7f36b15fc Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Fri, 21 Nov 2025 15:33:32 +0100
+Subject: [PATCH] s4:dsdb: Do not declare cm_print_error()
+
+This is part of the cmocka.h header file.
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Martin Schwenke <martin@meltin.net>
+Reviewed-by: Volker Lendecke <vl@samba.org>
+
+Autobuild-User(master): Volker Lendecke <vl@samba.org>
+Autobuild-Date(master): Mon Nov 24 11:28:08 UTC 2025 on atb-devel-224
+
+(cherry picked from commit 5a981663e4f677042ba80191770100aecff2120a)
+---
+ source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
+index f7075f3485e..12c464b49c7 100644
+--- a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
+++ b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
+@@ -103,11 +103,6 @@ void audit_message_send(
+ 
+ #define check_group_change_message(m, u, a, e)                                 \
+ 	_check_group_change_message(m, u, a, e, __FILE__, __LINE__);
+-/*
+- * declare the internal cmocka cm_print_error so that we can output messages
+- * in sub unit format
+- */
+-void cm_print_error(const char * const format, ...);
+ 
+ /*
+  * Validate a group change JSON audit message
+-- 
+2.52.0
+
--- a/samba-winbind-systemd-sysusers.conf
+++ b/samba-winbind-systemd-sysusers.conf
@ -0,0 +1,2 @@
+#Type Name       ID
+g     wbpriv     88
--- a/samba.logrotate
+++ b/samba.logrotate
@ -1,4 +1,4 @@
-/var/log/samba/log.* {
+/var/log/samba/*log* {
    compress
    dateext
    maxage 365
--- a/samba.spec
+++ b/samba.spec
--- a/smb.conf.example
+++ b/smb.conf.example
@ -269,6 +269,13 @@
 ;	map system = no
 ;	store dos attributes = yes

+# Turn on SMB 3.1.1 Unix Extensions by default
+#
+# Note: The Linux Kernel SMB3 client will negotiate unix extensions by default,
+# find more info in man mount.smb3(8). Linux 6.13 will finally support special
+# filetypes and symlink handling.
+
+	smb3 unix extensions = yes

 #============================ Share Definitions ==============================

--- a/smb.conf.vendor
+++ b/smb.conf.vendor
@ -38,7 +38,8 @@
 [print$]
 	comment = Printer Drivers
 	path = /var/lib/samba/drivers
-	write list = @printadmin root
-	force group = @printadmin
+	# printadmin is a local group
+	write list = printadmin root
+	force group = printadmin
 	create mask = 0664
 	directory mask = 0775
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (samba-4.18.0rc2.tar.xz) = 1467ee97c5861e7306d2bf96c0c600404212d9b241cc28e5fb649f8297bdb3bb86a774cb78ccfc82a70f7b715eff7eb0de9dc3563ba0300c6a069d9609fbdef4
-SHA512 (samba-4.18.0rc2.tar.asc) = 557eec6485669b172b16fd5032750d8cfa8058d1615316d7e539924d561d7d7e7d0990bcf62f96d0ec467c8fc5e59c0bb8ea1a963396055b6af8659e166073cd
+SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac
+SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce
--- a/tests/deps-check.fmf
+++ b/tests/deps-check.fmf
@ -0,0 +1,22 @@
+summary: Check samba package dependency structure
+description: |
+    Verify that samba library packages maintain correct dependency hierarchy:
+    - samba-core-libs has no samba-*-libs dependencies
+    - samba-ndr-libs depends on samba-core-libs (not samba-client-libs or samba-libs)
+    - samba-client-libs depends on core-libs + ndr-libs (not samba-libs)
+    - samba-client depends on samba-client-libs (not samba-libs)
+    - samba-libs does not depend on samba-dc-libs
+    - libsmbclient depends on samba-client-libs (not samba-libs)
+    - libwbclient has no samba-*-libs dependencies
+    - libldb has no samba-*-libs dependencies
+test: ./deps-check.sh
+framework: shell
+require:
+  - samba-core-libs
+  - samba-ndr-libs
+  - samba-client-libs
+  - samba-libs
+  - samba-client
+  - libwbclient
+  - libsmbclient
+  - libldb
--- a/tests/deps-check.sh
+++ b/tests/deps-check.sh
@ -0,0 +1,167 @@
+#!/bin/bash
+#
+# Samba package dependency structure verification
+#
+# This test ensures that the samba library package dependencies don't regress.
+# The expected hierarchy is:
+#
+#   samba-core-libs    (no samba-*-libs dependencies)
+#        ^
+#        |
+#   samba-ndr-libs     (depends on samba-core-libs only)
+#        ^
+#        |
+#   samba-client-libs  (depends on samba-core-libs + samba-ndr-libs)
+#
+#   libwbclient        (no samba-*-libs dependencies - only links to libc)
+#
+#   samba-client       (depends on samba-client-libs, NOT samba-libs)
+#   libsmbclient       (depends on samba-client-libs, NOT samba-libs)
+#
+# NOTE: This test checks RESOLVED dependencies, not just explicit Requires.
+# A library requirement like 'libfoo.so' is resolved to the package that
+# provides it, ensuring we catch indirect dependencies.
+#
+
+set -e
+
+ERRORS=0
+
+# Get all packages that a package depends on (resolved)
+# This resolves library deps like 'libfoo.so' to actual package names
+get_resolved_deps() {
+    local pkg="$1"
+
+    rpm --query --requires "$pkg" 2>/dev/null | while read -r req; do
+        # Skip rpmlib and config requirements
+        [[ "$req" =~ ^rpmlib ]] && continue
+        [[ "$req" =~ ^config ]] && continue
+        [[ "$req" =~ ^/ ]] && continue
+
+        # Get the package that provides this requirement
+        provider=$(rpm --query --whatprovides "$req" 2>/dev/null | head -1)
+        if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then
+            # Extract just the package name (remove version-release.arch)
+            echo "${provider%%-[0-9]*}"
+        fi
+    done | sort -u
+}
+
+# Check that a package does NOT depend on packages matching a pattern
+# This checks RESOLVED dependencies (what packages actually get pulled in)
+check_no_resolved_dep() {
+    local pkg="$1"
+    local pattern="$2"
+    local description="$3"
+
+    if ! rpm --query "$pkg" &>/dev/null; then
+        echo "SKIP: $pkg not installed"
+        return 0
+    fi
+
+    local bad_deps
+    # Exclude the package itself from the check
+    bad_deps=$(get_resolved_deps "$pkg" | grep -v "^${pkg}$" | grep -E "$pattern" || true)
+
+    if [ -n "$bad_deps" ]; then
+        echo "FAIL: $pkg depends on $description"
+        echo "  Found: $bad_deps"
+        ERRORS=$((ERRORS + 1))
+        return 1
+    fi
+    echo "PASS: $pkg does not depend on $description"
+    return 0
+}
+
+# Check that a package DOES depend on a specific package
+check_has_resolved_dep() {
+    local pkg="$1"
+    local expected="$2"
+
+    if ! rpm --query "$pkg" &>/dev/null; then
+        echo "SKIP: $pkg not installed"
+        return 0
+    fi
+
+    if get_resolved_deps "$pkg" | grep -qF "$expected"; then
+        echo "PASS: $pkg depends on $expected"
+        return 0
+    fi
+    echo "FAIL: $pkg does not depend on $expected"
+    ERRORS=$((ERRORS + 1))
+    return 1
+}
+
+echo "=== Samba Package Dependency Checks ==="
+echo ""
+echo "Checking resolved dependencies (library deps resolved to packages)"
+echo ""
+
+# 1. samba-core-libs must NOT depend on any samba-*-libs packages
+echo "--- samba-core-libs ---"
+check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba*-libs package"
+
+echo ""
+
+# 2. samba-ndr-libs must depend on samba-core-libs
+#    but NOT samba-client-libs or samba-libs
+echo "--- samba-ndr-libs ---"
+check_has_resolved_dep samba-ndr-libs "samba-core-libs"
+check_no_resolved_dep samba-ndr-libs "^samba-client-libs$" "samba-client-libs"
+check_no_resolved_dep samba-ndr-libs "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 3. samba-client-libs must depend on samba-core-libs and samba-ndr-libs
+#    but NOT samba-libs
+echo "--- samba-client-libs ---"
+check_has_resolved_dep samba-client-libs "samba-core-libs"
+check_has_resolved_dep samba-client-libs "samba-ndr-libs"
+check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 4. libwbclient must NOT depend on any samba-*-libs packages
+echo "--- libwbclient ---"
+check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba*-libs package"
+
+echo ""
+
+# 5. samba-client must depend on samba-client-libs but NOT samba-libs
+#    (client tools should not pull in server libraries)
+echo "--- samba-client ---"
+check_has_resolved_dep samba-client "samba-client-libs"
+check_no_resolved_dep samba-client "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 6. libsmbclient must depend on samba-client-libs but NOT samba-libs
+#    (SMB client library should not pull in server libraries)
+echo "--- libsmbclient ---"
+check_has_resolved_dep libsmbclient "samba-client-libs"
+check_no_resolved_dep libsmbclient "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 7. libldb must NOT depend on any samba-*-libs packages
+#    (libldb is a standalone database library)
+echo "--- libldb ---"
+check_no_resolved_dep libldb "^samba-.*-libs$" "any samba*-libs package"
+
+echo ""
+
+# 8. samba-libs must NOT depend on samba-dc-libs
+#    (server libraries should not pull in DC-specific libraries)
+echo "--- samba-libs ---"
+check_no_resolved_dep samba-libs "^samba-dc-libs$" "samba-dc-libs"
+
+echo ""
+echo "=== Summary ==="
+
+if [ $ERRORS -gt 0 ]; then
+    echo "FAILED: $ERRORS dependency check(s) failed"
+    exit 1
+fi
+
+echo "All dependency checks passed"
+exit 0