Update to version 4.15.12

resolves: #2140960, #2143115 - Security fixes for CVE-2022-42898

Guenther

.gitignore

@@ -257,3 +257,39 @@ samba-3.6.0pre1.tar.gz
 /samba-4.15.0rc1.tar.asc
 /samba-4.15.0rc2.tar.xz
 /samba-4.15.0rc2.tar.asc
+/samba-4.15.0rc3.tar.xz
+/samba-4.15.0rc3.tar.asc
+/samba-4.15.0rc4.tar.xz
+/samba-4.15.0rc4.tar.asc
+/samba-4.15.0rc5.tar.xz
+/samba-4.15.0rc5.tar.asc
+/samba-4.15.0rc6.tar.xz
+/samba-4.15.0rc6.tar.asc
+/samba-4.15.0rc7.tar.xz
+/samba-4.15.0rc7.tar.asc
+/samba-4.15.0.tar.xz
+/samba-4.15.0.tar.asc
+/samba-4.15.1.tar.xz
+/samba-4.15.1.tar.asc
+/samba-4.15.2.tar.xz
+/samba-4.15.2.tar.asc
+/samba-4.15.3.tar.xz
+/samba-4.15.3.tar.asc
+/samba-4.15.4.tar.xz
+/samba-4.15.4.tar.asc
+/samba-4.15.5.tar.xz
+/samba-4.15.5.tar.asc
+/samba-4.15.6.tar.xz
+/samba-4.15.6.tar.asc
+/samba-4.15.7.tar.xz
+/samba-4.15.7.tar.asc
+/samba-4.15.8.tar.xz
+/samba-4.15.8.tar.asc
+/samba-4.15.9.tar.xz
+/samba-4.15.9.tar.asc
+/samba-4.15.10.tar.xz
+/samba-4.15.10.tar.asc
+/samba-4.15.11.tar.xz
+/samba-4.15.11.tar.asc
+/samba-4.15.12.tar.xz
+/samba-4.15.12.tar.asc

samba-ctdb-etcd-reclock.patch

@@ -0,0 +1,30 @@
+From 939aed0498269df3c1e012f3b68c314b583f25bd Mon Sep 17 00:00:00 2001
+From: Martin Schwenke <martin@meltin.net>
+Date: Tue, 27 Apr 2021 15:46:14 +1000
+Subject: [PATCH] utils: Use Python 3
+
+Due to the number of flake8 and pylint warnings it is unclear if the
+source has Python 3 incompatibilities.  These will be cleaned up in
+subsequent commits.
+
+Signed-off-by: "L.P.H. van Belle" <belle@bazuin.nl>
+Reviewed-by: Martin Schwenke <martin@meltin.net>
+Reviewed-by: David Disseldorp <ddiss@samba.org>
+Reviewed-by: Jose A. Rivera <jarrpa@samba.org>
+---
+ ctdb/utils/etcd/ctdb_etcd_lock | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ctdb/utils/etcd/ctdb_etcd_lock b/ctdb/utils/etcd/ctdb_etcd_lock
+index 000c6bb7208..7f5194eff0a 100755
+--- a/ctdb/utils/etcd/ctdb_etcd_lock
++++ b/ctdb/utils/etcd/ctdb_etcd_lock
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/env python3
+ #
+ #    This program is free software: you can redistribute it and/or modify
+ #    it under the terms of the GNU General Public License as published by
+-- 
+2.31.1
+

samba-s4u.patch

@@ -1,22 +1,21 @@
-From fe300549844509624d944b93fc64dc6d382e71c1 Mon Sep 17 00:00:00 2001
+From cfdb01091c4ad005654da9b4a64251a6d02ea637 Mon Sep 17 00:00:00 2001
 From: Isaac Boukris <iboukris@gmail.com>
 Date: Fri, 27 Sep 2019 18:25:03 +0300
-Subject: [PATCH 3/7] mit-kdc: add basic loacl realm S4U support
+Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support
 
 Signed-off-by: Isaac Boukris <iboukris@gmail.com>
 Pair-Programmed-With: Andreas Schneider <asn@samba.org>
 ---
- source4/kdc/mit-kdb/kdb_samba_policies.c      | 148 +++++++++---------
- source4/kdc/mit_samba.c                       |  47 ++----
- source4/kdc/mit_samba.h                       |   6 +-
- wscript_configure_system_mitkrb5              |   3 +
- 6 files changed, 91 insertions(+), 115 deletions(-)
+ source4/kdc/mit-kdb/kdb_samba_policies.c | 124 +++++++++++------------
+ source4/kdc/mit_samba.c                  |  47 ++-------
+ source4/kdc/mit_samba.h                  |   6 +-
+ 3 files changed, 71 insertions(+), 106 deletions(-)
 
 diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c
-index 9197551ed61..944324d9a2f 100644
+index dada3b79144..677ec1007c9 100644
 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c
 +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c
-@@ -192,13 +192,17 @@ static krb5_error_code ks_verify_pac(krb5_context context,
+@@ -197,13 +197,17 @@ static krb5_error_code ks_verify_pac(krb5_context context,
  				     krb5_keyblock *krbtgt_key,
  				     krb5_timestamp authtime,
  				     krb5_authdata **tgt_auth_data,
@@ -37,7 +36,7 @@ index 9197551ed61..944324d9a2f 100644
  
  	mit_ctx = ks_get_context(context);
  	if (mit_ctx == NULL) {
-@@ -230,41 +234,43 @@ static krb5_error_code ks_verify_pac(krb5_context context,
+@@ -235,41 +239,43 @@ static krb5_error_code ks_verify_pac(krb5_context context,
  	code = krb5_pac_parse(context,
  			      authdata[0]->contents,
  			      authdata[0]->length,
@@ -107,7 +106,7 @@ index 9197551ed61..944324d9a2f 100644
  	if (code != 0) {
  		goto done;
  	}
-@@ -272,17 +278,22 @@ static krb5_error_code ks_verify_pac(krb5_context context,
+@@ -277,17 +283,22 @@ static krb5_error_code ks_verify_pac(krb5_context context,
  	code = mit_samba_reget_pac(mit_ctx,
  				   context,
  				   flags,
@@ -134,31 +133,30 @@ index 9197551ed61..944324d9a2f 100644
  
  	return code;
  }
-@@ -324,7 +335,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- {
- #endif
+@@ -316,6 +327,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 	krb5_authdata **pac_auth_data = NULL;
  	krb5_authdata **authdata = NULL;
--	krb5_boolean is_as_req;
+ 	krb5_boolean is_as_req;
 +	krb5_const_principal pac_client;
  	krb5_error_code code;
  	krb5_pac pac = NULL;
  	krb5_data pac_data;
-@@ -334,24 +345,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+@@ -327,11 +339,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 	krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt;
  	krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key;
- #endif
  
 -	/* FIXME: We don't support S4U yet */
 -	if (flags & KRB5_KDB_FLAGS_S4U) {
 -		return KRB5_KDB_DBTYPE_NOSUP;
 -	}
 -
--	is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
--
--	if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) {
--		code = ks_get_pac(context, client, client_key, &pac);
--		if (code != 0) {
--			goto done;
--		}
+ 	is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
+ 
+ 	/*
+@@ -392,6 +399,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 		ks_client_princ = client->princ;
+ 	}
+ 
 +	/* In protocol transition, we are currently not provided with the tgt
 +	 * client name to verify the PAC, we could probably skip the name
 +	 * verification and just verify the signatures, but since we don't
@@ -166,59 +164,31 @@ index 9197551ed61..944324d9a2f 100644
 +	if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) {
 +		pac_client = server->princ;
 +	} else {
-+		pac_client = client_princ;
- 	}
- 
--	if (!is_as_req) {
-+	/* TGS request */
-+	if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)) {
- 		code = ks_verify_pac(context,
- 				     flags,
--				     client_princ,
-+				     pac_client,
- 				     client,
- 				     server,
- 				     krbtgt,
-@@ -363,14 +371,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 		if (code != 0) {
- 			goto done;
- 		}
-+
-+		/* We require PAC as we don't support LSA_TRUST_TYPE_MIT */
-+		if (pac == NULL) {
-+			code = KRB5_KDB_DBTYPE_NOSUP;
-+			goto done;
-+		}
- 	}
- 
--	if (pac == NULL && client != NULL) {
-+	if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) {
-+		krb5_pac_free(context, pac);
-+		pac = NULL;
++		pac_client = ks_client_princ;
 +	}
- 
-+	/* AS request or local realm protocol transition */
-+	if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) ||
-+	    (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) {
- 		code = ks_get_pac(context, client, client_key, &pac);
- 		if (code != 0) {
- 			goto done;
- 		}
-+		/* We require a pac! */
-+		SMB_ASSERT(pac != NULL);
++
+ 	if (client_entry == NULL) {
+ 		client_entry = client;
  	}
+@@ -456,7 +473,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
  
- 	if (pac == NULL) {
-@@ -379,7 +401,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 	}
- 
- 	code = krb5_pac_sign(context, pac, authtime, client_princ,
+ 			code = ks_verify_pac(context,
+ 					     flags,
+-					     ks_client_princ,
++					     pac_client,
+ 					     client_entry,
+ 					     server,
+ 					     krbtgt,
+@@ -497,7 +514,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 		  is_as_req ? "AS-REQ" : "TGS-REQ",
+ 		  client_name);
+ 	code = krb5_pac_sign(context, pac, authtime, ks_client_princ,
 -			server_key, krbtgt_key, &pac_data);
 +			     server_key, krbtgt_key, &pac_data);
  	if (code != 0) {
  		DBG_ERR("krb5_pac_sign failed: %d\n", code);
  		goto done;
-@@ -405,11 +427,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+@@ -523,12 +540,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
  					      KRB5_AUTHDATA_IF_RELEVANT,
  					      authdata,
  					      signed_auth_data);
@@ -227,10 +197,11 @@ index 9197551ed61..944324d9a2f 100644
 -	}
 -
 -	code = 0;
- 
+-
  done:
- 	krb5_pac_free(context, pac);
-@@ -432,32 +449,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
+ 	if (client_entry != NULL && client_entry != client) {
+ 		ks_free_principal(context, client_entry);
+@@ -554,32 +565,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
  	 * server; -> delegating service
  	 * proxy; -> target principal
  	 */
@@ -265,10 +236,10 @@ index 9197551ed61..944324d9a2f 100644
  
  
 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
-index 54dcd545ea1..f23327c9613 100644
+index ef4e8c2ed38..962fd05e1ac 100644
 --- a/source4/kdc/mit_samba.c
 +++ b/source4/kdc/mit_samba.c
-@@ -467,7 +467,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
+@@ -517,7 +517,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
  krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
  				    krb5_context context,
  				    int flags,
@@ -276,7 +247,7 @@ index 54dcd545ea1..f23327c9613 100644
  				    krb5_db_entry *client,
  				    krb5_db_entry *server,
  				    krb5_db_entry *krbtgt,
-@@ -615,7 +614,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+@@ -688,7 +687,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
  								  context,
  								  *pac,
  								  server->princ,
@@ -285,7 +256,7 @@ index 54dcd545ea1..f23327c9613 100644
  								  deleg_blob);
  		if (!NT_STATUS_IS_OK(nt_status)) {
  			DEBUG(0, ("Update delegation info failed: %s\n",
-@@ -937,41 +936,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
+@@ -1080,41 +1079,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
  }
  
  int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
@@ -338,10 +309,10 @@ index 54dcd545ea1..f23327c9613 100644
  
  static krb5_error_code mit_samba_change_pwd_error(krb5_context context,
 diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h
-index ba824557bd5..5aadf206443 100644
+index 4431e82a1b2..9370ab533af 100644
 --- a/source4/kdc/mit_samba.h
 +++ b/source4/kdc/mit_samba.h
-@@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
+@@ -57,7 +57,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
  krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
  				    krb5_context context,
  				    int flags,
@@ -349,7 +320,7 @@ index ba824557bd5..5aadf206443 100644
  				    krb5_db_entry *client,
  				    krb5_db_entry *server,
  				    krb5_db_entry *krbtgt,
-@@ -73,9 +72,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
+@@ -74,9 +73,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
  				  DATA_BLOB *e_data);
  
  int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
@@ -362,12 +333,13 @@ index ba824557bd5..5aadf206443 100644
  int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,
  				      char *pwd,
 -- 
-2.25.4
+2.37.1
 
-From ff1b225493ede3d43cfad571770dacb73f75ec42 Mon Sep 17 00:00:00 2001
+
+From 6e985cf7d5f29292c5f2dd2de75867dd30ef3df6 Mon Sep 17 00:00:00 2001
 From: Isaac Boukris <iboukris@gmail.com>
 Date: Fri, 27 Sep 2019 18:35:30 +0300
-Subject: [PATCH 5/7] krb5-mit: enable S4U client support for MIT build
+Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build
 
 Signed-off-by: Isaac Boukris <iboukris@gmail.com>
 Pair-Programmed-With: Andreas Schneider <asn@samba.org>
@@ -375,13 +347,13 @@ Pair-Programmed-With: Andreas Schneider <asn@samba.org>
  lib/krb5_wrap/krb5_samba.c            | 185 ++++++++++++++++++++++++++
  lib/krb5_wrap/krb5_samba.h            |   2 -
  source4/auth/kerberos/kerberos_util.c |  11 --
- 4 files changed, 185 insertions(+), 14 deletions(-)
+ 3 files changed, 185 insertions(+), 13 deletions(-)
 
 diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
-index 20ce86c708d..e72ab3c30f7 100644
+index 610efcc9b87..96686147006 100644
 --- a/lib/krb5_wrap/krb5_samba.c
 +++ b/lib/krb5_wrap/krb5_samba.c
-@@ -2568,6 +2568,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
+@@ -2697,6 +2697,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
  
  	return 0;
  }
@@ -574,7 +546,7 @@ index 20ce86c708d..e72ab3c30f7 100644
  
  #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA)
 diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h
-index ca9a893e4f7..3264ce5eb3b 100644
+index eab67f6d969..b5385c69a33 100644
 --- a/lib/krb5_wrap/krb5_samba.h
 +++ b/lib/krb5_wrap/krb5_samba.h
 @@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx,
@@ -639,67 +611,23 @@ index 544d9d853cc..c14d8c72d8c 100644
  				ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context,
  								     ccache,
 -- 
-2.25.4
+2.37.1
 
 
-
-From cf1b9bdc09180d68e2b30258839d2f78b7af9c62 Mon Sep 17 00:00:00 2001
+From 3a9c224f229128451c878b262a716d48cb9f75d6 Mon Sep 17 00:00:00 2001
 From: Isaac Boukris <iboukris@gmail.com>
 Date: Sat, 19 Sep 2020 14:16:20 +0200
-Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code
+Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code
 
 ---
- source4/heimdal/lib/hdb/hdb.h | 1 +
- source4/kdc/db-glue.c         | 8 ++++++--
- source4/kdc/mit_samba.c       | 3 +++
- source4/kdc/sdb.h             | 1 +
- 4 files changed, 11 insertions(+), 2 deletions(-)
+ source4/kdc/mit_samba.c | 3 +++
+ 1 file changed, 3 insertions(+)
 
-diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h
-index 6a09ecb6fe1..bc5211fef35 100644
---- a/source4/heimdal/lib/hdb/hdb.h
-+++ b/source4/heimdal/lib/hdb/hdb.h
-@@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
- #define HDB_F_ALL_KVNOS		2048	/* we want all the keys, live or not */
- #define HDB_F_FOR_AS_REQ	4096	/* fetch is for a AS REQ */
- #define HDB_F_FOR_TGS_REQ	8192	/* fetch is for a TGS REQ */
-+#define HDB_F_FORCE_CANON	16384	/* force canonicalition */
- 
- /* hdb_capability_flags */
- #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1
-diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
-index a560a1cd84b..c27b6a8ef4c 100644
---- a/source4/kdc/db-glue.c
-+++ b/source4/kdc/db-glue.c
-@@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
- 			}
- 		}
- 
--	} else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) {
-+	} else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { // was this supposed to be || ?
- 		ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL);
- 		if (ret) {
- 			krb5_clear_error_message(context);
- 			goto out;
- 		}
--	} else if ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) {
-+	} else if (((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) || (flags & SDB_F_FORCE_CANON)){
- 		/*
- 		 * SDB_F_CANON maps from the canonicalize flag in the
- 		 * packet, and has a different meaning between AS-REQ
- 		 * and TGS-REQ.  We only change the principal in the AS-REQ case
-+		 *
-+		 * The SDB_F_FORCE_CANON if for the new MIT kdc code that wants
-+		 * the canonical name in all lookups, and takes care to canonicalize
-+		 * only when appropriate.
- 		 */
- 		ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL);
- 		if (ret) {
 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
-index f23327c9613..4084e893cc2 100644
+index 962fd05e1ac..9dc1bdf870b 100644
 --- a/source4/kdc/mit_samba.c
 +++ b/source4/kdc/mit_samba.c
-@@ -198,6 +198,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx,
+@@ -232,6 +232,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx,
  	if (kflags & KRB5_KDB_FLAG_CANONICALIZE) {
  		sflags |= SDB_F_CANON;
  	}
@@ -709,18 +637,6 @@ index f23327c9613..4084e893cc2 100644
  	if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY |
  		      KRB5_KDB_FLAG_INCLUDE_PAC)) {
  		/*
-diff --git a/source4/kdc/sdb.h b/source4/kdc/sdb.h
-index c929acccce6..a9115ec23d7 100644
---- a/source4/kdc/sdb.h
-+++ b/source4/kdc/sdb.h
-@@ -116,6 +116,7 @@ struct sdb_entry_ex {
- #define SDB_F_KVNO_SPECIFIED	128	/* we want a particular KVNO */
- #define SDB_F_FOR_AS_REQ	4096	/* fetch is for a AS REQ */
- #define SDB_F_FOR_TGS_REQ	8192	/* fetch is for a TGS REQ */
-+#define SDB_F_FORCE_CANON	16384	/* force canonicalition */
- 
- void sdb_free_entry(struct sdb_entry_ex *e);
- void free_sdb_entry(struct sdb_entry *s);
 -- 
-2.25.4
+2.37.1
 

samba.spec

@@ -2,12 +2,16 @@
 #
 # To build and run the tests use:
 #
+# fedpkg local --with testsuite
+# or
 # rpmbuild --rebuild --with testsuite samba.src.rpm
 #
 %bcond_with testsuite
 
 # Build with internal talloc, tevent, tdb and ldb.
 #
+# fedpkg local --with=testsuite --with=includelibs
+# or
 # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm
 #
 %bcond_with includelibs
@@ -42,24 +46,27 @@
 %bcond_without winexe
 %endif
 
-# Build vfs_ceph module by default on 64bit Fedora
+# Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora
 %if 0%{?fedora}
 
 %ifarch aarch64 ppc64le s390x x86_64
 %bcond_without vfs_cephfs
+%bcond_without ceph_mutex
 %else
 %bcond_with vfs_cephfs
+%bcond_with ceph_mutex
 #endifarch
 %endif
 
 %else
 %bcond_with vfs_cephfs
+%bcond_with ceph_mutex
 #endif fedora
 %endif
 
 # Build vfs_gluster module by default on 64bit Fedora
 %global is_rhgs 0
-%if "%{dist}" == ".el8rhgs" || "%{dist}" == ".el9rhgs"
+%if "%{dist}" == ".el7rhgs" || "%{dist}" == ".el8rhgs"
 %global is_rhgs 1
 %endif
 
@@ -113,17 +120,24 @@
 %bcond_with pcp_pmda
 %endif
 
+# Build the etcd helpers by default on Fedora
+%if 0%{?fedora}
+%bcond_without etcd_mutex
+%else
+%bcond_with etcd_mutex
+%endif
+
 %define samba_requires_eq()  %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
 
-%global baserelease 3
+%global baserelease 0
 
-%global samba_version 4.15.0
+%global samba_version 4.15.12
 %global talloc_version 2.3.3
 %global tdb_version 1.4.4
 %global tevent_version 0.11.0
-%global ldb_version 2.4.0
+%global ldb_version 2.4.4
 # This should be rc1 or nil
-%global pre_release rc2
+%global pre_release %nil
 
 %global samba_release %{baserelease}
 %if "x%{?pre_release}" != "x"
@@ -185,6 +199,7 @@ Source14:       samba.pamd
 Source201:      README.downgrade
 
 Patch0:         samba-s4u.patch
+Patch1:         samba-ctdb-etcd-reclock.patch
 
 Requires(pre): /usr/sbin/groupadd
 Requires(post): systemd
@@ -295,12 +310,18 @@ BuildRequires: liburing-devel >= 0.4
 %if %{with pcp_pmda}
 BuildRequires: pcp-libs-devel
 %endif
+%if %{with ceph_mutex}
+BuildRequires: librados-devel
+%endif
+%if %{with etcd_mutex}
+BuildRequires: python3-etcd
+%endif
 
 %if %{with dc} || %{with testsuite}
 # Add python3-iso8601 to avoid that the
 # version in Samba is being packaged
 BuildRequires: python3-iso8601
-BuildRequires: python3-pyasn1
+BuildRequires: python3-pyasn1 >= 0.4.8
 
 BuildRequires: bind
 BuildRequires: krb5-server >= %{required_mit_krb5}
@@ -325,7 +346,9 @@ BuildRequires: python3-tdb >= %{tdb_version}
 BuildRequires: libldb-devel >= %{ldb_version}
 BuildRequires: python3-ldb >= %{ldb_version}
 BuildRequires: python3-ldb-devel >= %{ldb_version}
-%else
+%endif
+
+%if %{with includelibs} || %{with testsuite}
 # lmdb-devel is required for the mdb ldb module, if samba is configured
 # to build includelibs we need lmdb-devel for building that module on our own
 BuildRequires: lmdb-devel
@@ -339,6 +362,7 @@ BuildRequires: ldb-tools
 BuildRequires: python3-gpg
 BuildRequires: python3-markdown
 BuildRequires: python3-setproctitle
+BuildRequires: python3-cryptography
 BuildRequires: tdb-tools
 %endif
 
@@ -457,6 +481,17 @@ Requires: samba-libs = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 %endif
 
+# samba-tool needs python3-samba
+Requires: python3-%{name} = %{samba_depver}
+# samba-tool needs tdbbackup
+Requires: tdb-tools
+%if %{with dc}
+# samba-tool needs python3-samba-dc on a full build
+Requires: python3-%{name}-dc = %{samba_depver}
+# samba-tool needs mdb_copy for domain backup or upgrade provision
+Requires: lmdb
+%endif
+
 Provides: bundled(libreplace)
 
 %description common-tools
@@ -478,10 +513,6 @@ Requires(post): libwbclient = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 %endif
 
-# samba-tool needs tdbbackup
-Requires: tdb-tools
-# samba-tool needs mdb_copy
-Requires: lmdb
 Requires: ldb-tools
 Requires: python3-setproctitle
 # Force using libldb version to be the same as build version
@@ -574,6 +605,7 @@ Samba VFS module for Ceph distributed storage system integration.
 Summary: Samba VFS module for io_uring
 Requires: %{name} = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
+Requires: %{name}-client-libs = %{samba_depver}
 
 Provides: bundled(libreplace)
 
@@ -812,9 +844,12 @@ Summary: Samba winbind
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
 Requires: %{name}-common-libs = %{samba_depver}
+Requires(post): %{name}-common-libs = %{samba_depver}
 Requires: %{name}-common-tools = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
+Requires(post): %{name}-client-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
+Requires(post): %{name}-libs = %{samba_depver}
 Requires: %{name}-winbind-modules = %{samba_depver}
 
 %if %{with libwbclient}
@@ -907,6 +942,7 @@ necessary to communicate to the Winbind Daemon
 Summary: Samba Winexe Windows Binary
 License: GPLv3
 Requires: %{name}-client-libs = %{samba_depver}
+Requires: %{name}-common-libs = %{samba_depver}
 
 Provides: bundled(libreplace)
 
@@ -988,6 +1024,31 @@ Performance Co-Pilot (PCP) support for CTDB
 #endif with pcp_pmda
 %endif
 
+%if %{with etcd_mutex}
+
+%package -n ctdb-etcd-mutex
+Summary: CTDB ETCD mutex helper
+Requires: ctdb = %{samba_depver}
+Requires: python3-etcd
+
+%description -n ctdb-etcd-mutex
+Support for using an existing ETCD cluster as a mutex helper for CTDB
+
+#endif with etcd_mutex
+%endif
+
+%if %{with ceph_mutex}
+
+%package -n ctdb-ceph-mutex
+Summary: CTDB ceph mutex helper
+Requires: ctdb = %{samba_depver}
+
+%description -n ctdb-ceph-mutex
+Support for using an existing CEPH cluster as a mutex helper for CTDB
+
+#endif with ceph_mutex
+%endif
+
 #endif with clustering
 %endif
 
@@ -1080,9 +1141,16 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold"
 %endif
 %if %{with pcp_pmda}
         --enable-pmda \
+%endif
+%if %{with ceph_mutex}
+        --enable-ceph-reclock \
+%endif
+%if %{with etcd_mutex}
+        --enable-etcd-reclock \
 %endif
         --with-profiling-data \
         --with-systemd \
+        --with-quotas \
         --systemd-install-services \
         --with-systemddir=/usr/lib/systemd/system \
         --systemd-smb-extra=%{_systemd_extra} \
@@ -1100,7 +1168,8 @@ pushd pidl
 popd
 
 %install
-%make_install
+# Do not use %%make_install, make is just a wrapper around waf in Samba!
+%{__make} %{?_smp_mflags} %{_make_verbose} install DESTDIR=%{buildroot}
 
 install -d -m 0755 %{buildroot}/usr/{sbin,bin}
 install -d -m 0755 %{buildroot}%{_libdir}/security
@@ -1188,12 +1257,10 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
 %if %{without dc} && %{without testsuite}
 for i in \
     %{_libdir}/samba/libdfs-server-ad-samba4.so \
-    %{_libdir}/samba/libdnsserver-common-samba4.so \
     %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \
     %{_libdir}/samba/libscavenge-dns-records-samba4.so \
     %{_mandir}/man8/samba.8 \
     %{_mandir}/man8/samba_downgrade_db.8 \
-    %{_mandir}/man8/samba-tool.8 \
     %{_mandir}/man8/samba-gpupdate.8 \
     %{_libdir}/samba/ldb/ildap.so \
     %{_libdir}/samba/ldb/ldbsamba_extensions.so \
@@ -1852,6 +1919,7 @@ fi
 %{_bindir}/net
 %{_bindir}/pdbedit
 %{_bindir}/profiles
+%{_bindir}/samba-tool
 %{_bindir}/smbcontrol
 %{_bindir}/smbpasswd
 %{_bindir}/testparm
@@ -1860,13 +1928,13 @@ fi
 %{_mandir}/man1/testparm.1*
 %{_mandir}/man8/net.8*
 %{_mandir}/man8/pdbedit.8*
+%{_mandir}/man8/samba-tool.8*
 %{_mandir}/man8/smbpasswd.8*
 
 ### DC
 %if %{with dc} || %{with testsuite}
 %files dc
 %{_unitdir}/samba.service
-%{_bindir}/samba-tool
 %{_sbindir}/samba
 %{_sbindir}/samba_dnsupdate
 %{_sbindir}/samba_downgrade_db
@@ -1934,7 +2002,6 @@ fi
 %{_mandir}/man8/samba.8*
 %{_mandir}/man8/samba_downgrade_db.8*
 %{_mandir}/man8/samba-gpupdate.8*
-%{_mandir}/man8/samba-tool.8*
 %dir %{_datadir}/samba/admx
 %{_datadir}/samba/admx/samba.admx
 %dir %{_datadir}/samba/admx/en-US
@@ -1977,7 +2044,6 @@ fi
 %endif
 
 %{_libdir}/libdcerpc-server.so.*
-%{_libdir}/samba/libdnsserver-common-samba4.so
 %{_libdir}/samba/libdsdb-module-samba4.so
 %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so
 %{_libdir}/samba/libscavenge-dns-records-samba4.so
@@ -1991,6 +2057,7 @@ fi
 %{_libdir}/samba/bind9/dlz_bind9_12.so
 %{_libdir}/samba/bind9/dlz_bind9_14.so
 %{_libdir}/samba/bind9/dlz_bind9_16.so
+%{_libdir}/samba/bind9/dlz_bind9_18.so
 #endif with dc
 %endif
 
@@ -2159,6 +2226,7 @@ fi
 %{_libdir}/samba/libauth4-samba4.so
 %{_libdir}/samba/libauth-unix-token-samba4.so
 %{_libdir}/samba/libdcerpc-samba4.so
+%{_libdir}/samba/libdnsserver-common-samba4.so
 %{_libdir}/samba/libshares-samba4.so
 %{_libdir}/samba/libsmbpasswdparser-samba4.so
 %{_libdir}/samba/libxattr-tdb-samba4.so
@@ -2341,6 +2409,8 @@ fi
 %{python3_sitearch}/samba/descriptor.py
 %{python3_sitearch}/samba/dnsresolver.py
 %{python3_sitearch}/samba/drs_utils.py
+%{python3_sitearch}/samba/dsdb.*.so
+%{python3_sitearch}/samba/dsdb_dns.*.so
 %{python3_sitearch}/samba/gensec.*.so
 %{python3_sitearch}/samba/getopt.py
 %{python3_sitearch}/samba/gpclass.py
@@ -2532,8 +2602,6 @@ fi
 
 %{python3_sitearch}/samba/dcerpc/dnsserver.*.so
 %{python3_sitearch}/samba/dckeytab.*.so
-%{python3_sitearch}/samba/dsdb.*.so
-%{python3_sitearch}/samba/dsdb_dns.*.so
 %{python3_sitearch}/samba/domain_update.py
 %{python3_sitearch}/samba/forest_update.py
 %{python3_sitearch}/samba/ms_forest_updates_markdown.py
@@ -2608,6 +2676,7 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc
@@ -2629,6 +2698,8 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/ldap_spn.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/ldap_upn_sam_account.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc
@@ -2753,6 +2824,7 @@ fi
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc
+%{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/misc.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/raw_protocol.*.pyc
@@ -2772,6 +2844,7 @@ fi
 %{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py
 %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py
 %{python3_sitearch}/samba/tests/dcerpc/integer.py
+%{python3_sitearch}/samba/tests/dcerpc/lsa.py
 %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py
 %{python3_sitearch}/samba/tests/dcerpc/misc.py
 %{python3_sitearch}/samba/tests/dcerpc/raw_protocol.py
@@ -2798,6 +2871,7 @@ fi
 %{python3_sitearch}/samba/tests/dns_tkey.py
 %{python3_sitearch}/samba/tests/dns_wildcard.py
 %{python3_sitearch}/samba/tests/dsdb.py
+%{python3_sitearch}/samba/tests/dsdb_api.py
 %{python3_sitearch}/samba/tests/dsdb_dns.py
 %{python3_sitearch}/samba/tests/dsdb_lock.py
 %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py
@@ -2838,38 +2912,54 @@ fi
 %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py
 %dir %{python3_sitearch}/samba/tests/krb5
 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__
+%{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/test_idmap_nss.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/test_min_domain_uid.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/test_smb.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/alias_tests.py
 %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py
 %{python3_sitearch}/samba/tests/krb5/as_req_tests.py
 %{python3_sitearch}/samba/tests/krb5/compatability_tests.py
+%{python3_sitearch}/samba/tests/krb5/fast_tests.py
 %{python3_sitearch}/samba/tests/krb5/kcrypto.py
 %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py
 %{python3_sitearch}/samba/tests/krb5/kdc_tests.py
 %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py
+%{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py
 %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py
 %{python3_sitearch}/samba/tests/krb5/raw_testcase.py
 %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py
 %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py
+%{python3_sitearch}/samba/tests/krb5/rodc_tests.py
+%{python3_sitearch}/samba/tests/krb5/salt_tests.py
 %{python3_sitearch}/samba/tests/krb5/simple_tests.py
+%{python3_sitearch}/samba/tests/krb5/spn_tests.py
 %{python3_sitearch}/samba/tests/krb5/test_ccache.py
+%{python3_sitearch}/samba/tests/krb5/test_idmap_nss.py
 %{python3_sitearch}/samba/tests/krb5/test_ldap.py
+%{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py
 %{python3_sitearch}/samba/tests/krb5/test_rpc.py
 %{python3_sitearch}/samba/tests/krb5/test_smb.py
 %{python3_sitearch}/samba/tests/krb5/s4u_tests.py
@@ -2877,6 +2967,8 @@ fi
 %{python3_sitearch}/samba/tests/krb5_credentials.py
 %{python3_sitearch}/samba/tests/ldap_raw.py
 %{python3_sitearch}/samba/tests/ldap_referrals.py
+%{python3_sitearch}/samba/tests/ldap_spn.py
+%{python3_sitearch}/samba/tests/ldap_upn_sam_account.py
 %{python3_sitearch}/samba/tests/libsmb.py
 %{python3_sitearch}/samba/tests/loadparm.py
 %{python3_sitearch}/samba/tests/lsa_string.py
@@ -3986,6 +4078,20 @@ fi
 #endif with pcp_pmda
 %endif
 
+%if %{with etcd_mutex}
+%files -n ctdb-etcd-mutex
+%{_libexecdir}/ctdb/ctdb_etcd_lock
+%{_mandir}/man7/ctdb-etcd.7.gz
+#endif with etcd_mutex
+%endif
+
+%if %{with ceph_mutex}
+%files -n ctdb-ceph-mutex
+%{_libexecdir}/ctdb/ctdb_mutex_ceph_rados_helper
+%{_mandir}/man7/ctdb_mutex_ceph_rados_helper.7.gz
+#endif with ceph_mutex
+%endif
+
 #endif with clustering
 %endif
 
@@ -3997,7 +4103,120 @@ fi
 %endif
 
 %changelog
-* Mon Aug 09 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.0rc2-3
+* Tue Nov 15 2022 Guenther Deschner <gdeschner@redhat.com> - 4.15.12-0
+- Update to version 4.15.12
+- resolves: #2140960, #2143115 - Security fixes for CVE-2022-42898
+
+* Wed Oct 26 2022 Guenther Deschner <gdeschner@redhat.com> - 4.15.11-0
+- Update to version 4.15.11
+- resolves: #2137774, #2137777 - Security fixes for CVE-2022-3437
+
+* Wed Sep 28 2022 Guenther Deschner <gdeschner@redhat.com> - 4.15.10-0
+- Update to Samba 4.15.10
+
+* Wed Jul 27 2022 Guenther Deschner <gdeschner@redhat.com> - 4.15.9-0
+- resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742
+- resolves: #2108205, #2111731 - Security fixes for CVE-2022-32744
+- resolves: #2108211, #2111732 - Security fixes for CVE-2022-32745
+- resolves: #2108215, #2111734 - Security fixes for CVE-2022-32746
+
+* Tue Jun 28 2022 Pavel Filipenský <pfilipen@redhat.com> - 4.15.8-0
+- Update to Samba 4.15.8
+
+* Tue Apr 26 2022 Guenther Deschner <gdeschner@redhat.com> - 4.15.7-0
+- Update to Samba 4.15.7
+
+* Wed Mar 16 2022 Pavel Filipenský <pfilipen@redhat.com> -  4.15.6-0
+- Update to Samba 4.15.6
+
+* Wed Feb 23 2022 Andreas Schneider <asn@redhat.com> - 4.15.5-1
+- resolves: rhbz#2036443 - Fix samba-tool on builds with samba-dc
+
+* Mon Jan 31 2022 Guenther Deschner <gdeschner@redhat.com> - 4.15.5-0
+- Update to Samba 4.15.5
+- resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141
+- resolves: #2046146, #2048570 - Security fixes for CVE-2021-44142
+- resolves: #2046134, #2048568 - Security fixes for CVE-2022-0336
+
+* Thu Jan 20 2022 Pavel Filipenský <pfilipen@redhat.com> - 4.15.4-0
+- Update to Samba 4.15.4
+- resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316
+- resolves: #2042518
+
+* Wed Dec 15 2021 Pavel Filipenský <pfilipen@redhat.com> - 4.15.3-1
+- Fix resolv_wrapper with glibc 2.34
+- resolves: #2019669
+
+* Wed Dec 08 2021 Pavel Filipenský <pfilipen@redhat.com> - 4.15.3-0
+- Update to Samba 4.15.3
+- resolves: #2030382
+
+* Sat Nov 13 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.2-3
+- Fix IPA DC schannel support
+
+* Thu Nov 11 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.2-2
+- Fix winbind trusted domain regression
+- related: #2021716
+- Fix logfile handling
+- Fix smbclient -N failures in container setups
+
+* Tue Nov 09 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.2-0
+- Update to Samba 4.15.2
+- resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124
+- resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717
+- resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718
+- resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719
+- resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721
+- resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722
+- resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738
+- resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192
+- resolves: #2021625
+
+* Fri Nov 05 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.1-1
+- Fix winexe core dump
+- resolves: #2020376
+
+* Wed Oct 27 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.1-0
+- Update to Samba 4.15.1
+- resolves: #2017847
+
+* Mon Sep 20 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.0-13
+- Update to Samba 4.15.0
+- resolves: #2005817
+
+* Mon Sep 13 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.0-0.12.rc7
+- Update to Samba 4.15.0rc7
+- resolves: #2003740
+
+* Thu Sep 09 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.0-0.11.rc6
+- Update to Samba 4.15.0rc6
+- resolves: #2002546
+
+* Tue Sep 07 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.0-0.10.rc5
+- Update to Samba 4.15.0rc5
+- resolves: #2001827
+
+* Wed Sep 01 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.0-0.9.rc4
+- Update to Samba 4.15.0rc4
+- resolves: #2000079
+
+* Thu Aug 26 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.0-0.8.rc3
+- Update to Samba 4.15.0rc3
+- resolves: #1998024
+
+* Wed Aug 25 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.0-0.7.rc2
+- Add ceph and etcd mutex helpers for CTDB
+
+* Mon Aug 16 2021 Anoop C S <anoopcs@samba.org> - 4.15.0-0.6.rc2
+- Avoid removing PyDSDB library files from buildroot for non AD DC build
+
+* Fri Aug 13 2021 Adam Williamson <awilliam@redhat.com> - 4.15.0-0.5.rc2
+- Fix samba-common-tools dependency
+
+* Thu Aug 12 2021 Andreas Schneider <asn@redhat.com> - 4.15.0-0.4.rc2
+- Package samba-tool correctly
+
+* Mon Aug 09 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.0-0.3.rc2
 - Update to Samba 4.15.0rc2
 - resolves: #1991634
 

sources

@@ -1,2 +1,2 @@
-SHA512 (samba-4.15.0rc2.tar.xz) = 5ff2f44c068babd3e37751e4cb52fd73d7c4da8f8d11fb6952206bc970b1206b0af3705991493a0ce1dcbe61d2c9ef6625b6a9b601f77324d5faaa0a9ac4e7d3
-SHA512 (samba-4.15.0rc2.tar.asc) = 8ee5488a0d226d72ae8a84898715ca8f27e7f83dfbc712a52d52e740b08aabd66155c091f92c3ac1a4c58d489ffa6f91a7f293cccb5fba3b878f81fb11da40ff
+SHA512 (samba-4.15.12.tar.xz) = c3d678944828f718a589630cf19998c8c917d8e93041fc46c07946ecd98ba8656086ca5b8881a1ab7c5a8d8ab4a66c7953e86bd99d67aeac2760e4151ffc0de2
+SHA512 (samba-4.15.12.tar.asc) = ac841370c230d0132c5e3ec8c0c1c87f9ba863fd45f6e48f191d50069c8a77cb924ace4166c5f594eda40f8b56f07b0c0501dbf92e38ee3455ccb5c88fa23fb6