Update to version 4.16.10

resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922
resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614

Guenther

.gitignore

@@ -281,3 +281,31 @@ samba-3.6.0pre1.tar.gz
 /samba-4.16.0rc1.tar.asc
 /samba-4.16.0rc2.tar.xz
 /samba-4.16.0rc2.tar.asc
+/samba-4.16.0rc3.tar.xz
+/samba-4.16.0rc3.tar.asc
+/samba-4.16.0rc4.tar.xz
+/samba-4.16.0rc4.tar.asc
+/samba-4.16.0rc5.tar.xz
+/samba-4.16.0rc5.tar.asc
+/samba-4.16.0.tar.xz
+/samba-4.16.0.tar.asc
+/samba-4.16.1.tar.xz
+/samba-4.16.1.tar.asc
+/samba-4.16.2.tar.xz
+/samba-4.16.2.tar.asc
+/samba-4.16.3.tar.xz
+/samba-4.16.3.tar.asc
+/samba-4.16.4.tar.xz
+/samba-4.16.4.tar.asc
+/samba-4.16.5.tar.xz
+/samba-4.16.5.tar.asc
+/samba-4.16.6.tar.xz
+/samba-4.16.6.tar.asc
+/samba-4.16.7.tar.xz
+/samba-4.16.7.tar.asc
+/samba-4.16.8.tar.xz
+/samba-4.16.8.tar.asc
+/samba-4.16.9.tar.xz
+/samba-4.16.9.tar.asc
+/samba-4.16.10.tar.xz
+/samba-4.16.10.tar.asc

rpminspect.yaml

@@ -7,6 +7,7 @@ badfuncs:
         - /usr/lib*/libsmbconf.so.*
         - /usr/lib*/samba/libgse-samba4.so
         - /usr/lib*/samba/libsamba-sockets-samba4.so
+        - /usr/lib*/samba/service/nbtd.so
         - /usr/libexec/ctdb/smnotify
         - /usr/sbin/nmbd
 
@@ -14,3 +15,6 @@ runpath:
     allowed_paths:
         - /usr/lib/samba
         - /usr/lib64/samba
+
+abidiff:
+    suppression_file: samba.abignore

samba-4.16-waf-crypto.patch

@@ -0,0 +1,77 @@
+From 41d3efebcf6abab9119f9b0f97c86c1c48739fee Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Mon, 4 Apr 2022 11:24:04 +0200
+Subject: [PATCH 1/2] waf: Check for GnuTLS earlier
+
+As GnuTLS is an essential part we need to check for it early so we can react on
+GnuTLS features in other wscripts.
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+---
+ wscript | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/wscript b/wscript
+index d8220b35095..5b85d9a1682 100644
+--- a/wscript
++++ b/wscript
+@@ -189,6 +189,8 @@ def configure(conf):
+     conf.RECURSE('dynconfig')
+     conf.RECURSE('selftest')
+ 
++    conf.PROCESS_SEPARATE_RULE('system_gnutls')
++
+     conf.CHECK_CFG(package='zlib', minversion='1.2.3',
+                    args='--cflags --libs',
+                    mandatory=True)
+@@ -297,8 +299,6 @@ def configure(conf):
+     if not conf.CONFIG_GET('KRB5_VENDOR'):
+         conf.PROCESS_SEPARATE_RULE('embedded_heimdal')
+ 
+-    conf.PROCESS_SEPARATE_RULE('system_gnutls')
+-
+     conf.RECURSE('source4/dsdb/samdb/ldb_modules')
+     conf.RECURSE('source4/ntvfs/sysdep')
+     conf.RECURSE('lib/util')
+-- 
+2.35.1
+
+
+From 63701a28116afc1550c23cb5f7b9d6e366fd1270 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Mon, 4 Apr 2022 11:25:31 +0200
+Subject: [PATCH 2/2] third_party:waf: Do not recurse in aesni-intel if GnuTLS
+ provides the cipher
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+---
+ third_party/wscript | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/third_party/wscript b/third_party/wscript
+index 1f4bc1ce1d7..a17c15bcaa7 100644
+--- a/third_party/wscript
++++ b/third_party/wscript
+@@ -5,7 +5,8 @@ from waflib import Options
+ def configure(conf):
+     conf.RECURSE('cmocka')
+     conf.RECURSE('popt')
+-    conf.RECURSE('aesni-intel')
++    if not conf.CONFIG_SET('HAVE_GNUTLS_AES_CMAC'):
++        conf.RECURSE('aesni-intel')
+     if conf.CONFIG_GET('ENABLE_SELFTEST'):
+         conf.RECURSE('socket_wrapper')
+         conf.RECURSE('nss_wrapper')
+@@ -18,7 +19,8 @@ def configure(conf):
+ def build(bld):
+     bld.RECURSE('cmocka')
+     bld.RECURSE('popt')
+-    bld.RECURSE('aesni-intel')
++    if not bld.CONFIG_SET('HAVE_GNUTLS_AES_CMAC'):
++        bld.RECURSE('aesni-intel')
+     if bld.CONFIG_GET('SOCKET_WRAPPER'):
+         bld.RECURSE('socket_wrapper')
+     if bld.CONFIG_GET('NSS_WRAPPER'):
+-- 
+2.35.1
+

samba-s4u.patch

@@ -1,7 +1,7 @@
-From 17eb98d3f8ebd0fe48e218bb03a3c0165b9b6e95 Mon Sep 17 00:00:00 2001
+From 5d7ec9a00b6f4c6768c606d37d235415f2006445 Mon Sep 17 00:00:00 2001
 From: Isaac Boukris <iboukris@gmail.com>
 Date: Fri, 27 Sep 2019 18:25:03 +0300
-Subject: [PATCH 1/4] mit-kdc: add basic loacl realm S4U support
+Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support
 
 Signed-off-by: Isaac Boukris <iboukris@gmail.com>
 Pair-Programmed-With: Andreas Schneider <asn@samba.org>
@@ -236,7 +236,7 @@ index 793fe366c35..22534c09974 100644
  
  
 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
-index 27b15828468..994dfed312b 100644
+index cb72b5de294..03c2c2ea1de 100644
 --- a/source4/kdc/mit_samba.c
 +++ b/source4/kdc/mit_samba.c
 @@ -517,7 +517,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
@@ -247,7 +247,7 @@ index 27b15828468..994dfed312b 100644
  				    krb5_db_entry *client,
  				    krb5_db_entry *server,
  				    krb5_db_entry *krbtgt,
-@@ -682,7 +681,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+@@ -689,7 +688,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
  								  context,
  								  *pac,
  								  server->princ,
@@ -256,7 +256,7 @@ index 27b15828468..994dfed312b 100644
  								  deleg_blob);
  		if (!NT_STATUS_IS_OK(nt_status)) {
  			DEBUG(0, ("Update delegation info failed: %s\n",
-@@ -1004,41 +1003,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
+@@ -1081,41 +1080,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
  }
  
  int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
@@ -333,13 +333,13 @@ index 4431e82a1b2..9370ab533af 100644
  int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,
  				      char *pwd,
 -- 
-2.33.1
+2.37.1
 
 
-From f4fc23103f47b712baf3b4b0ebcb42d0f3f3fd42 Mon Sep 17 00:00:00 2001
+From 325912375cf54743ab8ea557172a72b870002e9f Mon Sep 17 00:00:00 2001
 From: Isaac Boukris <iboukris@gmail.com>
 Date: Fri, 27 Sep 2019 18:35:30 +0300
-Subject: [PATCH 2/4] krb5-mit: enable S4U client support for MIT build
+Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build
 
 Signed-off-by: Isaac Boukris <iboukris@gmail.com>
 Pair-Programmed-With: Andreas Schneider <asn@samba.org>
@@ -350,10 +350,10 @@ Pair-Programmed-With: Andreas Schneider <asn@samba.org>
  3 files changed, 185 insertions(+), 13 deletions(-)
 
 diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
-index 61d651b4d5f..462acec90b6 100644
+index 4321f07ca09..3fd95e47fca 100644
 --- a/lib/krb5_wrap/krb5_samba.c
 +++ b/lib/krb5_wrap/krb5_samba.c
-@@ -2699,6 +2699,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
+@@ -2702,6 +2702,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
  
  	return 0;
  }
@@ -611,20 +611,20 @@ index 544d9d853cc..c14d8c72d8c 100644
  				ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context,
  								     ccache,
 -- 
-2.33.1
+2.37.1
 
 
-From 48d73d552f2fbbdb07bd9aff4d0294883b70417f Mon Sep 17 00:00:00 2001
+From a5713b1558192f24348f7794da84bf65cf78e6ec Mon Sep 17 00:00:00 2001
 From: Isaac Boukris <iboukris@gmail.com>
 Date: Sat, 19 Sep 2020 14:16:20 +0200
-Subject: [PATCH 3/4] wip: for canonicalization with new MIT kdc code
+Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code
 
 ---
  source4/kdc/mit_samba.c | 3 +++
  1 file changed, 3 insertions(+)
 
 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
-index 994dfed312b..9d039e5601b 100644
+index 03c2c2ea1de..30fade56531 100644
 --- a/source4/kdc/mit_samba.c
 +++ b/source4/kdc/mit_samba.c
 @@ -232,6 +232,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx,
@@ -638,33 +638,5 @@ index 994dfed312b..9d039e5601b 100644
  		      KRB5_KDB_FLAG_INCLUDE_PAC)) {
  		/*
 -- 
-2.33.1
-
-
-From f5f54026d151f6d899e8ff52d8829a2f9cf57f25 Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Tue, 21 Dec 2021 12:17:11 +0100
-Subject: [PATCH 4/4] s4:kdc: Also cannoicalize krbtgt principals when
- enforcing canonicalization
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
----
- source4/kdc/db-glue.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
-index 8d17038cfe6..77c0c0e4746 100644
---- a/source4/kdc/db-glue.c
-+++ b/source4/kdc/db-glue.c
-@@ -946,7 +946,7 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
- 	if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT) {
- 		p->is_krbtgt = true;
- 
--		if (flags & (SDB_F_CANON)) {
-+		if (flags & (SDB_F_CANON|SDB_F_FORCE_CANON)) {
- 			/*
- 			 * When requested to do so, ensure that the
- 			 * both realm values in the principal are set
--- 
-2.33.1
+2.37.1
 

samba.abignore

@@ -0,0 +1,5 @@
+#################################################
+# This is a grouping library without any code
+#################################################
+[suppress_file]
+file_name_regexp=.*libdcerpc-samr\\.so.*

samba.spec

@@ -134,15 +134,15 @@
 
 %define samba_requires_eq()  %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
 
-%global baserelease 1
+%global baserelease 0
 
-%global samba_version 4.16.0
+%global samba_version 4.16.10
 %global talloc_version 2.3.3
 %global tdb_version 1.4.6
-%global tevent_version 0.11.0
-%global ldb_version 2.5.0
+%global tevent_version 0.12.0
+%global ldb_version 2.5.3
 # This should be rc1 or nil
-%global pre_release rc2
+%global pre_release %nil
 
 %global samba_release %{baserelease}
 %if "x%{?pre_release}" != "x"
@@ -169,21 +169,21 @@
 
 %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba"
 
+# Make a copy of this variable to prevent repeated evaluation of the
+# embedded shell command.  Avoid recursive macro definition if undefined.
+%{?python3_sitearch: %global python3_sitearch %{python3_sitearch}}
+
 Name:           samba
 Version:        %{samba_version}
 Release:        %{samba_release}%{?dist}
 
-%if 0%{?rhel}
-Epoch:          0
-%else
+%if 0%{?fedora}
 Epoch:          2
+%else
+Epoch:          0
 %endif
 
-%if 0%{?epoch} > 0
 %global samba_depver %{epoch}:%{version}-%{release}
-%else
-%global samba_depver %{version}-%{release}
-%endif
 
 Summary:        Server and Client software to interoperate with Windows machines
 License:        GPLv3+ and LGPLv3+
@@ -200,10 +200,13 @@ Source11:       smb.conf.vendor
 Source12:       smb.conf.example
 Source13:       pam_winbind.conf
 Source14:       samba.pamd
+Source15:       samba.abignore
 
 Source201:      README.downgrade
 
 Patch0:         samba-s4u.patch
+# https://gitlab.com/samba-team/samba/-/merge_requests/2477
+Patch1:         samba-4.16-waf-crypto.patch
 
 Requires(pre): /usr/sbin/groupadd
 Requires(post): systemd
@@ -216,6 +219,7 @@ Requires: %{name}-common-libs = %{samba_depver}
 Requires: %{name}-common-tools = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
+Requires: %{name}-dcerpc = %{samba_depver}
 %if %{with libwbclient}
 Requires(post): libwbclient = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
@@ -426,7 +430,7 @@ SMB/CIFS clients.
 Summary: Files used by both Samba servers and clients
 BuildArch: noarch
 
-Requires(post): systemd
+Requires(post): (systemd-standalone-tmpfiles or systemd)
 Recommends:     logrotate
 
 Provides: samba4-common = %{samba_depver}
@@ -490,6 +494,8 @@ Requires: python3-%{name} = %{samba_depver}
 # samba-tool needs tdbbackup
 Requires: tdb-tools
 %if %{with dc}
+# samba-tool needs python3-samba-dc on a full build
+Requires: python3-%{name}-dc = %{samba_depver}
 # samba-tool needs mdb_copy for domain backup or upgrade provision
 Requires: lmdb
 %endif
@@ -500,11 +506,26 @@ Provides: bundled(libreplace)
 The samba-common-tools package contains tools for Samba servers and
 SMB/CIFS clients.
 
+### RPC
+%package dcerpc
+Summary: DCE RPC binaries
+Requires: samba-common-libs = %{samba_depver}
+Requires: samba-client-libs = %{samba_depver}
+Requires: samba-libs = %{samba_depver}
+%if %{with libwbclient}
+Requires: libwbclient = %{samba_depver}
+%endif
+
+%description dcerpc
+The samba-dcerpc package contains binaries that serve DCERPC over named pipes.
+
 ### DC
 %if %{with dc} || %{with testsuite}
 %package dc
 Summary: Samba AD Domain Controller
 Requires: %{name} = %{samba_depver}
+Requires: %{name}-client-libs = %{samba_depver}
+Requires: %{name}-common-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 Requires: %{name}-dc-provision = %{samba_depver}
 Requires: %{name}-dc-libs = %{samba_depver}
@@ -542,9 +563,13 @@ BuildArch: noarch
 %description dc-provision
 The samba-dc-provision package provides files to setup a domain controller
 
+#endif with dc || with testsuite
+%endif
+
 ### DC-LIBS
 %package dc-libs
 Summary: Samba AD Domain Controller Libraries
+Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-common-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 
@@ -557,12 +582,15 @@ Provides: bundled(libreplace)
 The %{name}-dc-libs package contains the libraries needed by the DC to
 link against the SMB, RPC and other protocols.
 
+%if %{with dc} || %{with testsuite}
 ### DC-BIND
 %package dc-bind-dlz
 Summary: Bind DLZ module for Samba AD
+Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
 Requires: %{name}-dc-libs = %{samba_depver}
 Requires: %{name}-dc = %{samba_depver}
+Requires: %{name}-libs = %{samba_depver}
 Requires: bind
 
 Provides: bundled(libreplace)
@@ -578,6 +606,9 @@ name server related details of Samba AD.
 Summary: Developer tools for Samba libraries
 Requires: %{name}-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
+%if %{with dc}
+Requires: %{name}-dc-libs = %{samba_depver}
+%endif
 
 Provides: samba4-devel = %{samba_depver}
 Obsoletes: samba4-devel < %{samba_depver}
@@ -592,6 +623,7 @@ libraries in the Samba suite.
 %package vfs-cephfs
 Summary: Samba VFS module for Ceph distributed storage system
 Requires: %{name} = %{samba_depver}
+Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 
 Provides: bundled(libreplace)
@@ -728,6 +760,7 @@ Requires: %{name} = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-common-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
+Requires: %{name}-dc-libs = %{samba_depver}
 Requires: python3-talloc
 Requires: python3-tevent
 Requires: python3-tdb
@@ -766,6 +799,8 @@ If you want to run full set of Samba tests, you need to install this package.
 %if %{with dc} || %{with testsuite}
 %package -n python3-samba-dc
 Summary: Samba Python libraries for Samba AD
+Requires: %{name}-client-libs = %{samba_depver}
+Requires: %{name}-dc-libs = %{samba_depver}
 Requires: python3-%{name} = %{samba_depver}
 
 %description -n python3-samba-dc
@@ -858,6 +893,7 @@ Requires: %{name}-winbind-modules = %{samba_depver}
 Requires(post): libwbclient = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 %endif
+Requires: %{name}-dcerpc = %{samba_depver}
 
 Provides: samba4-winbind = %{samba_depver}
 Obsoletes: samba4-winbind < %{samba_depver}
@@ -1019,6 +1055,7 @@ and use CTDB instead.
 Summary: CTDB PCP pmda support
 Requires: ctdb = %{samba_depver}
 Requires: pcp-libs
+Requires: %{name}-client-libs = %{samba_depver}
 
 %description -n ctdb-pcp-pmda
 Performance Co-Pilot (PCP) support for CTDB
@@ -1060,6 +1097,11 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB
 xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} -
 %autosetup -n samba-%{version}%{pre_release} -p1
 
+# Ensure we rely on GnuTLS and do not build any other crypto code shipping with
+# the sources.
+rm -rf third_party/{aesni-intel,heimdal}
+rm -f lib/crypto/{aes,rijndael}*.c
+
 %build
 %if %{with includelibs}
 %global _talloc_lib ,talloc,pytalloc,pytalloc-util
@@ -1616,15 +1658,6 @@ fi
 
 %dir %{_libexecdir}/samba
 %{_libexecdir}/samba/samba-bgqd
-%{_libexecdir}/samba/samba-dcerpcd
-%{_libexecdir}/samba/rpcd_classic
-%{_libexecdir}/samba/rpcd_epmapper
-%{_libexecdir}/samba/rpcd_fsrvp
-%{_libexecdir}/samba/rpcd_lsad
-%{_libexecdir}/samba/rpcd_mdssvc
-%{_libexecdir}/samba/rpcd_rpcecho
-%{_libexecdir}/samba/rpcd_spoolss
-%{_libexecdir}/samba/rpcd_winreg
 
 %dir %{_datadir}/samba
 %dir %{_datadir}/samba/mdssvc
@@ -1638,7 +1671,6 @@ fi
 %{_mandir}/man1/smbstatus.1*
 %{_mandir}/man8/eventlogadm.8*
 %{_mandir}/man8/samba-bgqd.8*
-%{_mandir}/man8/samba-dcerpcd.8*
 %{_mandir}/man8/smbd.8*
 %{_mandir}/man8/nmbd.8*
 %{_mandir}/man8/vfs_acl_tdb.8*
@@ -1864,7 +1896,6 @@ fi
 
 %if %{without libwbclient}
 %{_libdir}/samba/libwbclient.so.*
-#%%{_libdir}/samba/libwinbind-client-samba4.so
 #endif without libwbclient
 %endif
 
@@ -1946,6 +1977,20 @@ fi
 %{_mandir}/man8/samba-tool.8*
 %{_mandir}/man8/smbpasswd.8*
 
+### RPC
+%files dcerpc
+%dir %{_libexecdir}/samba
+%{_libexecdir}/samba/samba-dcerpcd
+%{_libexecdir}/samba/rpcd_classic
+%{_libexecdir}/samba/rpcd_epmapper
+%{_libexecdir}/samba/rpcd_fsrvp
+%{_libexecdir}/samba/rpcd_lsad
+%{_libexecdir}/samba/rpcd_mdssvc
+%{_libexecdir}/samba/rpcd_rpcecho
+%{_libexecdir}/samba/rpcd_spoolss
+%{_libexecdir}/samba/rpcd_winreg
+%{_mandir}/man8/samba-dcerpcd.8*
+
 ### DC
 %if %{with dc} || %{with testsuite}
 %files dc
@@ -1961,7 +2006,6 @@ fi
 %{_libdir}/krb5/plugins/kdb/samba.so
 
 %{_libdir}/samba/auth/samba4.so
-%{_libdir}/samba/libpac-samba4.so
 %dir %{_libdir}/samba/gensec
 %{_libdir}/samba/gensec/krb5.so
 %{_libdir}/samba/ldb/acl.so
@@ -2026,9 +2070,15 @@ fi
 %license source4/setup/ad-schema/licence.txt
 %{_datadir}/samba/setup
 
+#endif with dc || with testsuite
+%endif
 ### DC-LIBS
 %files dc-libs
+%{_libdir}/samba/libauth4-samba4.so
+
+%if %{with dc} || %{with testsuite}
 %{_libdir}/samba/libdb-glue-samba4.so
+%{_libdir}/samba/libpac-samba4.so
 %{_libdir}/samba/libprocess-model-samba4.so
 %{_libdir}/samba/libservice-samba4.so
 
@@ -2072,6 +2122,7 @@ fi
 %{_libdir}/samba/bind9/dlz_bind9_12.so
 %{_libdir}/samba/bind9/dlz_bind9_14.so
 %{_libdir}/samba/bind9/dlz_bind9_16.so
+%{_libdir}/samba/bind9/dlz_bind9_18.so
 #endif with dc
 %endif
 
@@ -2237,7 +2288,6 @@ fi
 %{_libdir}/libdcerpc-samr.so.*
 
 %{_libdir}/samba/libLIBWBCLIENT-OLD-samba4.so
-%{_libdir}/samba/libauth4-samba4.so
 %{_libdir}/samba/libauth-unix-token-samba4.so
 %{_libdir}/samba/libdcerpc-samba4.so
 %{_libdir}/samba/libdnsserver-common-samba4.so
@@ -2266,7 +2316,6 @@ fi
 %if %{with libwbclient}
 %files -n libwbclient
 %{_libdir}/samba/wbclient/libwbclient.so.*
-#%%{_libdir}/samba/libwinbind-client-samba4.so
 
 ### LIBWBCLIENT-DEVEL
 %files -n libwbclient-devel
@@ -2942,11 +2991,14 @@ fi
 %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc
@@ -2968,11 +3020,14 @@ fi
 %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py
 %{python3_sitearch}/samba/tests/krb5/as_req_tests.py
 %{python3_sitearch}/samba/tests/krb5/compatability_tests.py
+%{python3_sitearch}/samba/tests/krb5/etype_tests.py
 %{python3_sitearch}/samba/tests/krb5/fast_tests.py
 %{python3_sitearch}/samba/tests/krb5/kcrypto.py
 %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py
 %{python3_sitearch}/samba/tests/krb5/kdc_tests.py
 %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py
+%{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py
+%{python3_sitearch}/samba/tests/krb5/lockout_tests.py
 %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py
 %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py
 %{python3_sitearch}/samba/tests/krb5/raw_testcase.py
@@ -4131,6 +4186,85 @@ fi
 %endif
 
 %changelog
+* Wed Mar 29 2023 Guenther Deschner <gdeschner@redhat.com> - 4.16.10-0
+- Update to version 4.16.10
+- resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922
+- resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614
+
+* Thu Feb 16 2023 Guenther Deschner <gdeschner@redhat.com> - 4.16.9-0
+- Update to version 4.16.9
+
+* Thu Dec 22 2022 Pavel Filipenský <pfilipen@redhat.com> - 4.16.8-2
+- Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
+- Create package dc-libs also for 'non-dc build'
+
+* Tue Dec 20 2022 Pavel Filipenský <pfilipenn@redhat.com> - 4.16.8-1
+- Move libpac and libauth4 to dc-libs
+- Create a new 'samba-dcerpc' sub-package for DCERPC services
+
+* Fri Dec 16 2022 Guenther Deschner <gdeschner@redhat.com> - 4.16.8-0
+- resolves: #2154303, #2154304 - Security fixes for CVE-2022-37966
+- resolves: #2154320, #2154322 - Security fixes for CVE-2022-37967
+- resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023
+
+* Tue Nov 15 2022 Guenther Deschner <gdeschner@redhat.com> - 4.16.7-0
+- Update to version 4.16.7
+- resolves: #2140960, #2143116 - Security fixes for CVE-2022-42898
+
+* Wed Oct 26 2022 Guenther Deschner <gdeschner@redhat.com> - 4.16.6-0
+- Update to version 4.16.6
+- resolves: #2137776, #2137778 - Security fixes for CVE-2022-3592
+- resolves: #2137774, #2137777 - Security fixes for CVE-2022-3437
+
+* Thu Sep 08 2022 Guenther Deschner <gdeschner@redhat.com> - 4.16.5-0
+- Update to version 4.16.5
+
+* Wed Jul 27 2022 Guenther Deschner <gdeschner@redhat.com> - 4.16.4-0
+- resolves: #2111490 - Update to version 4.16.4
+- resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742
+- resolves: #2108205, #2111731 - Security fixes for CVE-2022-32744
+- resolves: #2108211, #2111732 - Security fixes for CVE-2022-32745
+- resolves: #2108215, #2111734 - Security fixes for CVE-2022-32746
+
+* Mon Jul 18 2022 Andreas Schneider <asn@redhat.com> - 4.16.3-1
+- Update to version 4.16.3
+
+* Mon Jun 13 2022 Guenther Deschner <gdeschner@redhat.com> - 4.16.2-0
+- Update to Samba 4.16.2
+- resolves: #2096167
+
+* Fri May 13 2022 Pavel Filipenský <pfilipen@redhat.com> - 4.16.1-5
+- Fix rpminspect abidiff
+
+* Fri May 06 2022 Pavel Filipenský <pfilipen@redhat.com> - 4.16.1-2
+- Update requires for packages
+
+* Thu May 05 2022 Tomas Popela <tpopela@redhat.com> - 4.16.1-1
+- Don't require full systemd for tmp files handling in samba-common
+
+* Mon May 02 2022 Pavel Filipenský <pfilipen@redhat.com> - 4.16.1-0
+- Update to Samba 4.16.1
+- resolves: #2080915
+
+* Tue Mar 22 2022 Guenther Deschner <gdeschner@redhat.com> - 4.16.0-6
+- Update to Samba 4.16.0
+- resolves: #2066290
+
+* Wed Mar 09 2022 Guenther Deschner <gdeschner@redhat.com> - 4.16.0-0.5.rc5
+- Update to Samba 4.16.0rc5
+- resolves: #2042518
+
+* Tue Mar 01 2022 Pavel Filipenský <pfilipen@redhat.com> - 4.16.0-0.4.rc4
+- Update to Samba 4.16.0rc4
+- resolves: #2042518
+
+* Wed Feb 23 2022 Andreas Schneider <asn@redhat.com> - 4.16.0-0.3.rc3
+- resolves: rhbz#2036443 - Fix samba-tool on builds with samba-dc
+
+* Tue Feb 15 2022 Pavel Filipenský <pfilipen@redhat.com> - 4.16.0rc3
+- Update to Samba 4.16.0rc3
+- resolves: #2042518
+
 * Tue Feb 01 2022 Pavel Filipenský <pfilipen@redhat.com> - 4.16.0rc2
 - Update to Samba 4.16.0rc2
 - resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141

sources

@@ -1,2 +1,2 @@
-SHA512 (samba-4.16.0rc2.tar.asc) = ee4fd216f0ea6851c089e6ea0959638a5d62d403303b2a2a7a3e8cf97924969607fae0c520156c4076d41a6ccc52630364497c134ea547e950465a96b66532a1
-SHA512 (samba-4.16.0rc2.tar.xz) = 6b6326d4ae962a01f699a6cc144bac8847281fc85ae1a5d77c71be3f59630c7864832297a9369a5ff83bff0d0c80d03ebfecfdd5d706ec86fc400112ecd6f657
+SHA512 (samba-4.16.10.tar.xz) = 933b04ed25c853264bf36a6a79db6d2f61e890ef76b8bcd2f9116d7dd6ee3112bc9a36ae9e0ad8c75b60b18ca6027572e7f514980479a9f0ae35a4219ff06471
+SHA512 (samba-4.16.10.tar.asc) = deeabf207148761c6c95aa1d5cf38e24bef11648fbc95e345802f05937db95009d6f900ba67f0f197d08bbfe8bc649a61c23cb92fa895246e4b3844ba93d4083