When built with testsuite rpcd_echo is built as well

Guenther

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -1,4 +1,335 @@
-/samba-*.tar.xz
-/samba-*.tar.asc
-/*.rpm
-/results_samba
+samba-3.5.4.tar.gz
+samba-3.6.0pre1.tar.gz
+/samba-3.6.0pre2.tar.gz
+/samba-3.6.0pre3.tar.gz
+/samba-3.6.0rc1.tar.gz
+/samba-3.6.0rc2.tar.gz
+/samba-3.6.0rc3.tar.gz
+/samba-3.6.0.tar.gz
+/samba-3.6.1.tar.gz
+/samba-3.6.3.tar.gz
+/samba-3.6.4.tar.gz
+/samba-3.6.5.tar.gz
+/samba-3.6.6.tar.gz
+/samba-3.6.7.tar.gz
+/samba-4.0.0rc1.tar.bz2
+/samba-4.0.0rc2.tar.bz2
+/samba-4.0.0rc3.tar.bz2
+/samba-4.0.0rc4.tar.bz2
+/samba-4.0.0rc5.tar.bz2
+/samba-4.0.0rc6.tar.bz2
+/samba-4.0.0.tar.bz2
+/samba-4.0.1.tar.bz2
+/samba-4.0.2.tar.bz2
+/samba-4.0.3.tar.bz2
+/samba-4.0.4.tar.bz2
+/samba-4.0.5.tar.bz2
+/samba-4.0.6.tar.bz2
+/samba-4.0.7.tar.xz
+/samba-4.1.0rc1.tar.xz
+/samba-4.1.0rc2.tar.xz
+/samba-4.1.0rc3.tar.xz
+/samba-4.1.0rc4.tar.xz
+/samba-4.1.0.tar.xz
+/samba-4.1.1.tar.xz
+/samba-4.1.2.tar.xz
+/samba-4.1.3.tar.xz
+/samba-4.1.4.tar.xz
+/samba-4.1.5.tar.xz
+/samba-4.1.6.tar.xz
+/samba-4.1.8.tar.xz
+/samba-4.1.9.tar.xz
+/samba-4.1.11.tar.gz
+/samba-4.1.11.tar.xz
+/samba-4.1.12.tar.xz
+/samba-4.2.0rc2.tar.xz
+/samba-4.2.0rc3.tar.xz
+/samba-4.2.0rc4.tar.xz
+/samba-4.2.0rc5.tar.xz
+/samba-4.2.0.tar.xz
+/samba-4.2.1.tar.xz
+/samba-4.2.2.tar.xz
+/samba-4.2.3.tar.xz
+/samba-4.3.0rc3.tar.xz
+/samba-4.3.0rc4.tar.xz
+/samba-4.3.0.tar.xz
+/samba-4.3.1.tar.xz
+/samba-4.3.2.tar.xz
+/samba-4.3.3.tar.xz
+/samba-4.3.4.tar.xz
+/samba-4.4.0rc1.tar.xz
+/samba-4.4.0rc2.tar.xz
+/samba-4.4.0rc3.tar.xz
+/samba-4.4.0rc4.tar.xz
+/samba-4.4.0rc5.tar.xz
+/samba-4.4.0.tar.xz
+/samba-4.4.2.tar.xz
+/samba-4.4.3.tar.xz
+/samba-4.4.4.tar.xz
+/samba-4.4.5.tar.xz
+/samba-4.5.0rc1.tar.xz
+/samba-4.5.0rc2.tar.xz
+/samba-4.5.0rc3.tar.xz
+/samba-4.5.0.tar.xz
+/samba-4.5.1.tar.xz
+/samba-4.5.2.tar.xz
+/samba-4.5.3.tar.xz
+/samba-4.6.0rc1.tar.xz
+/samba-4.6.0rc2.tar.xz
+/samba-4.6.0rc2.tar.asc
+/samba-4.6.0rc3.tar.asc
+/samba-4.6.0rc3.tar.xz
+/samba-4.6.0rc4.tar.xz
+/samba-4.6.0rc4.tar.asc
+/samba-4.6.0.tar.asc
+/samba-4.6.0.tar.xz
+/samba-4.6.1.tar.xz
+/samba-4.6.1.tar.asc
+/samba-4.6.2.tar.xz
+/samba-4.6.2.tar.asc
+/samba-4.6.3.tar.xz
+/samba-4.6.3.tar.asc
+/samba-4.6.4.tar.xz
+/samba-4.6.4.tar.asc
+/samba-4.6.5.tar.xz
+/samba-4.6.5.tar.asc
+/samba-4.7.0rc1.tar.xz
+/samba-4.7.0rc1.tar.asc
+/samba-4.7.0rc3.tar.xz
+/samba-4.7.0rc3.tar.asc
+/samba-4.7.0rc5.tar.xz
+/samba-4.7.0rc5.tar.asc
+/samba-4.7.0rc6.tar.xz
+/samba-4.7.0rc6.tar.asc
+/samba-4.7.0.tar.xz
+/samba-4.7.0.tar.asc
+/samba-4.7.1.tar.xz
+/samba-4.7.1.tar.asc
+/samba-4.7.2.tar.xz
+/samba-4.7.2.tar.asc
+/samba-4.7.3.tar.xz
+/samba-4.7.3.tar.asc
+/samba-4.7.4.tar.xz
+/samba-4.7.4.tar.asc
+/samba-4.8.0rc1.tar.xz
+/samba-4.8.0rc1.tar.asc
+/samba-4.8.0rc2.tar.xz
+/samba-4.8.0rc2.tar.asc
+/samba-4.8.0rc3.tar.xz
+/samba-4.8.0rc3.tar.asc
+/samba-4.8.0rc4.tar.xz
+/samba-4.8.0rc4.tar.asc
+/samba-4.8.0.tar.xz
+/samba-4.8.0.tar.asc
+/samba-4.8.1.tar.xz
+/samba-4.8.1.tar.asc
+/samba-4.8.2.tar.xz
+/samba-4.8.2.tar.asc
+/samba-4.8.3.tar.asc
+/samba-4.8.3.tar.xz
+/samba-4.9.0rc1.tar.xz
+/samba-4.9.0rc1.tar.asc
+/samba-4.9.0rc2.tar.xz
+/samba-4.9.0rc2.tar.asc
+/samba-4.9.0rc3.tar.xz
+/samba-4.9.0rc3.tar.asc
+/samba-4.9.0rc4.tar.xz
+/samba-4.9.0rc4.tar.asc
+/samba-4.9.0rc5.tar.asc
+/samba-4.9.0rc5.tar.xz
+/samba-4.9.0.tar.xz
+/samba-4.9.0.tar.asc
+/samba-4.9.1.tar.asc
+/samba-4.9.1.tar.xz
+/samba-4.9.2.tar.xz
+/samba-4.9.2.tar.asc
+/samba-4.9.3.tar.xz
+/samba-4.9.3.tar.asc
+/samba-4.9.4.tar.xz
+/samba-4.9.4.tar.asc
+/samba-4.10.0rc1.tar.xz
+/samba-4.10.0rc1.tar.asc
+/samba-4.10.0rc2.tar.xz
+/samba-4.10.0rc2.tar.asc
+/samba-4.10.0rc3.tar.xz
+/samba-4.10.0rc3.tar.asc
+/samba-4.10.0rc4.tar.xz
+/samba-4.10.0rc4.tar.asc
+/samba-4.10.0.tar.xz
+/samba-4.10.0.tar.asc
+/samba-4.10.1.tar.xz
+/samba-4.10.1.tar.asc
+/samba-4.10.2.tar.xz
+/samba-4.10.2.tar.asc
+/samba-4.10.3.tar.xz
+/samba-4.10.3.tar.asc
+/samba-4.10.4.tar.xz
+/samba-4.10.4.tar.asc
+/samba-4.10.5.tar.xz
+/samba-4.10.5.tar.asc
+/samba-4.10.6.tar.xz
+/samba-4.10.6.tar.asc
+/samba-4.11.0rc1.tar.xz
+/samba-4.11.0rc1.tar.asc
+/samba-4.11.0rc2.tar.xz
+/samba-4.11.0rc2.tar.asc
+/samba-4.11.0rc3.tar.xz
+/samba-4.11.0rc3.tar.asc
+/samba-4.11.0rc4.tar.xz
+/samba-4.11.0rc4.tar.asc
+/samba-4.11.0.tar.xz
+/samba-4.11.0.tar.asc
+/samba-4.11.1.tar.xz
+/samba-4.11.1.tar.asc
+/samba-4.11.2.tar.xz
+/samba-4.11.2.tar.asc
+/samba-4.11.3.tar.xz
+/samba-4.11.3.tar.asc
+/samba-4.11.4.tar.xz
+/samba-4.11.4.tar.asc
+/samba-4.11.5.tar.xz
+/samba-4.11.5.tar.asc
+/samba-4.12.0rc1.tar.xz
+/samba-4.12.0rc1.tar.asc
+/samba-4.12.0rc2.tar.xz
+/samba-4.12.0rc2.tar.asc
+/samba-4.12.0rc3.tar.xz
+/samba-4.12.0rc3.tar.asc
+/samba-4.12.0rc4.tar.xz
+/samba-4.12.0rc4.tar.asc
+/samba-4.12.0.tar.xz
+/samba-4.12.0.tar.asc
+/samba-4.12.1.tar.xz
+/samba-4.12.1.tar.asc
+/samba-4.12.2.tar.xz
+/samba-4.12.2.tar.asc
+/samba-4.12.3.tar.xz
+/samba-4.12.3.tar.asc
+/samba-4.12.4.tar.xz
+/samba-4.12.4.tar.asc
+/samba-4.12.5.tar.xz
+/samba-4.12.5.tar.asc
+/samba-4.13.0rc1.tar.xz
+/samba-4.13.0rc1.tar.asc
+/samba-4.13.0rc2.tar.xz
+/samba-4.13.0rc2.tar.asc
+/samba-4.13.0rc3.tar.xz
+/samba-4.13.0rc3.tar.asc
+/samba-4.13.0rc4.tar.xz
+/samba-4.13.0rc4.tar.asc
+/samba-4.13.0rc5.tar.xz
+/samba-4.13.0rc5.tar.asc
+/samba-4.13.0rc6.tar.xz
+/samba-4.13.0rc6.tar.asc
+/samba-4.13.0.tar.xz
+/samba-4.13.0.tar.asc
+/samba-4.13.1.tar.xz
+/samba-4.13.1.tar.asc
+/samba-4.13.2.tar.xz
+/samba-4.13.2.tar.asc
+/samba-4.13.3.tar.xz
+/samba-4.13.3.tar.asc
+/samba-4.13.4.tar.xz
+/samba-4.13.4.tar.asc
+/samba-4.14.0rc1.tar.xz
+/samba-4.14.0rc1.tar.asc
+/samba-4.14.0rc2.tar.xz
+/samba-4.14.0rc2.tar.asc
+/samba-4.14.0rc3.tar.xz
+/samba-4.14.0rc3.tar.asc
+/samba-4.14.0rc4.tar.xz
+/samba-4.14.0rc4.tar.asc
+/samba-4.14.0.tar.xz
+/samba-4.14.0.tar.asc
+/samba-4.14.1.tar.xz
+/samba-4.14.1.tar.asc
+/samba-4.14.2.tar.xz
+/samba-4.14.2.tar.asc
+/samba-4.14.3.tar.xz
+/samba-4.14.3.tar.asc
+/samba-4.14.4.tar.xz
+/samba-4.14.4.tar.asc
+/samba-4.14.5.tar.xz
+/samba-4.14.5.tar.asc
+/samba-4.14.6.tar.xz
+/samba-4.14.6.tar.asc
+/samba-4.15.0rc1.tar.xz
+/samba-4.15.0rc1.tar.asc
+/samba-4.15.0rc2.tar.xz
+/samba-4.15.0rc2.tar.asc
+/samba-4.15.0rc3.tar.xz
+/samba-4.15.0rc3.tar.asc
+/samba-4.15.0rc4.tar.xz
+/samba-4.15.0rc4.tar.asc
+/samba-4.15.0rc5.tar.xz
+/samba-4.15.0rc5.tar.asc
+/samba-4.15.0rc6.tar.xz
+/samba-4.15.0rc6.tar.asc
+/samba-4.15.0rc7.tar.xz
+/samba-4.15.0rc7.tar.asc
+/samba-4.15.0.tar.xz
+/samba-4.15.0.tar.asc
+/samba-4.15.1.tar.xz
+/samba-4.15.1.tar.asc
+/samba-4.15.2.tar.xz
+/samba-4.15.2.tar.asc
+/samba-4.15.3.tar.xz
+/samba-4.15.3.tar.asc
+/samba-4.15.4.tar.xz
+/samba-4.15.4.tar.asc
+/samba-4.16.0rc1.tar.xz
+/samba-4.16.0rc1.tar.asc
+/samba-4.16.0rc2.tar.xz
+/samba-4.16.0rc2.tar.asc
+/samba-4.16.0rc3.tar.xz
+/samba-4.16.0rc3.tar.asc
+/samba-4.16.0rc4.tar.xz
+/samba-4.16.0rc4.tar.asc
+/samba-4.16.0rc5.tar.xz
+/samba-4.16.0rc5.tar.asc
+/samba-4.16.0.tar.xz
+/samba-4.16.0.tar.asc
+/samba-4.16.1.tar.xz
+/samba-4.16.1.tar.asc
+/samba-4.16.2.tar.xz
+/samba-4.16.2.tar.asc
+/samba-4.16.3.tar.xz
+/samba-4.16.3.tar.asc
+/samba-4.16.4.tar.xz
+/samba-4.16.4.tar.asc
+/samba-4.17.0rc1.tar.xz
+/samba-4.17.0rc1.tar.asc
+/samba-4.17.0rc2.tar.xz
+/samba-4.17.0rc2.tar.asc
+/samba-4.17.0rc3.tar.asc
+/samba-4.17.0rc3.tar.xz
+/samba-4.17.0rc4.tar.xz
+/samba-4.17.0rc4.tar.asc
+/samba-4.17.0rc5.tar.xz
+/samba-4.17.0rc5.tar.asc
+/samba-4.17.0.tar.xz
+/samba-4.17.0.tar.asc
+/samba-4.17.1.tar.xz
+/samba-4.17.1.tar.asc
+/samba-4.17.2.tar.xz
+/samba-4.17.2.tar.asc
+/samba-4.17.3.tar.xz
+/samba-4.17.3.tar.asc
+/samba-4.17.4.tar.xz
+/samba-4.17.4.tar.asc
+/samba-4.17.5.tar.xz
+/samba-4.17.5.tar.asc
+/samba-4.17.6.tar.xz
+/samba-4.17.6.tar.asc
+/samba-4.17.7.tar.xz
+/samba-4.17.7.tar.asc
+/samba-4.17.8.tar.xz
+/samba-4.17.8.tar.asc
+/samba-4.17.9.tar.xz
+/samba-4.17.9.tar.asc
+/samba-4.17.10.tar.xz
+/samba-4.17.10.tar.asc
+/samba-4.17.11.tar.xz
+/samba-4.17.11.tar.asc
+/samba-4.17.12.tar.xz
+/samba-4.17.12.tar.asc

gating.yaml

@@ -1,6 +0,0 @@
---- !Policy
-product_versions:
-  - fedora-*
-decision_context: bodhi_update_push_stable
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

plans.fmf

@@ -1,4 +0,0 @@
-discover:
-    how: fmf
-execute:
-    how: tmt

rpminspect.yaml

@@ -1,16 +1,12 @@
 ---
-inspections:
-    disttag: off
-
 badfuncs:
     ignore:
-        - /usr/bin/nmbd
         - /usr/bin/nmblookup
         - /usr/bin/smbtorture
         - /usr/lib*/libndr.so.*
         - /usr/lib*/libsmbconf.so.*
-        - /usr/lib*/samba/libgse-private-samba.so
-        - /usr/lib*/samba/libsamba-sockets-private-samba.so
+        - /usr/lib*/samba/libgse-samba4.so
+        - /usr/lib*/samba/libsamba-sockets-samba4.so
         - /usr/lib*/samba/service/nbtd.so
         - /usr/libexec/ctdb/smnotify
         - /usr/sbin/nmbd
@@ -26,10 +22,3 @@ abidiff:
 debuginfo:
     ignore:
         - /usr/lib*/libdcerpc-samr.so.*
-
-annocheck:
-    ignore:
-        - /usr/bin/gentest
-        - /usr/bin/locktest
-        - /usr/bin/masktest
-        - /usr/bin/smbtorture

samba-4.17-fix-changeuserpassword4.patch

@@ -0,0 +1,540 @@
+From a3e3d05f35d6082ea48450060b39084e3d0e4056 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Mon, 10 Oct 2022 15:15:20 +0200
+Subject: [PATCH 1/5] s3:librpc: Improve GSE error message
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Noel Power <noel.power@suse.com>
+---
+ source3/librpc/crypto/gse.c | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
+index c50a8a036df..c2cac7abf82 100644
+--- a/source3/librpc/crypto/gse.c
++++ b/source3/librpc/crypto/gse.c
+@@ -546,11 +546,28 @@ init_sec_context_done:
+ 		goto done;
+ 	case GSS_S_FAILURE:
+ 		switch (gss_min) {
+-		case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
+-			DBG_NOTICE("Server principal not found\n");
++		case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: {
++			gss_buffer_desc name_token = {
++				.length = 0,
++			};
++
++			gss_maj = gss_display_name(&gss_min,
++						   gse_ctx->server_name,
++						   &name_token,
++						   NULL);
++			if (gss_maj == GSS_S_COMPLETE) {
++				DBG_NOTICE("Server principal %.*s not found\n",
++					   (int)name_token.length,
++					   (char *)name_token.value);
++				gss_release_buffer(&gss_maj, &name_token);
++			} else {
++				DBG_NOTICE("Server principal not found\n");
++			}
++
+ 			/* Make SPNEGO ignore us, we can't go any further here */
+ 			status = NT_STATUS_INVALID_PARAMETER;
+ 			goto done;
++		}
+ 		case (OM_uint32)KRB5KRB_AP_ERR_TKT_EXPIRED:
+ 			DBG_NOTICE("Ticket expired\n");
+ 			/* Make SPNEGO ignore us, we can't go any further here */
+-- 
+2.37.3
+
+
+From d2e2e9acd717e45806f1b19378e09f39c8fe3da8 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Fri, 7 Oct 2022 14:35:15 +0200
+Subject: [PATCH 2/5] s3:rpcclient: Pass salt down to
+ init_samr_CryptPasswordAES()
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Noel Power <noel.power@suse.com>
+---
+ source3/rpc_client/init_samr.c | 15 ++++-----------
+ source3/rpc_client/init_samr.h |  1 +
+ source3/rpcclient/cmd_samr.c   |  8 ++++++++
+ source4/libnet/libnet_passwd.c | 13 +++++++------
+ source4/torture/rpc/samr.c     | 27 +++++++++++++++++++++++++++
+ 5 files changed, 47 insertions(+), 17 deletions(-)
+
+diff --git a/source3/rpc_client/init_samr.c b/source3/rpc_client/init_samr.c
+index 68f42b602b3..52fa2f90d6e 100644
+--- a/source3/rpc_client/init_samr.c
++++ b/source3/rpc_client/init_samr.c
+@@ -79,6 +79,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd,
+ 
+ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx,
+ 				    const char *password,
++				    DATA_BLOB *salt,
+ 				    DATA_BLOB *session_key,
+ 				    struct samr_EncryptedPasswordAES *ppwd_buf)
+ {
+@@ -87,12 +88,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx,
+ 		.data = pw_data,
+ 		.length = sizeof(pw_data),
+ 	};
+-	size_t iv_size = gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_256_CBC);
+-	uint8_t iv_data[iv_size];
+-	DATA_BLOB iv = {
+-		.data = iv_data,
+-		.length = iv_size,
+-	};
+ 	DATA_BLOB ciphertext = data_blob_null;
+ 	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
+ 	bool ok;
+@@ -101,8 +96,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx,
+ 		return NT_STATUS_INVALID_PARAMETER;
+ 	}
+ 
+-	generate_nonce_buffer(iv.data, iv.length);
+-
+ 	ok = encode_pwd_buffer514_from_str(pw_data, password, STR_UNICODE);
+ 	if (!ok) {
+ 		return NT_STATUS_INTERNAL_ERROR;
+@@ -114,7 +107,7 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx,
+ 			session_key,
+ 			&samr_aes256_enc_key_salt,
+ 			&samr_aes256_mac_key_salt,
+-			&iv,
++			salt,
+ 			&ciphertext,
+ 			ppwd_buf->auth_data);
+ 	BURN_DATA(pw_data);
+@@ -126,8 +119,8 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx,
+ 	ppwd_buf->cipher = ciphertext.data;
+ 	ppwd_buf->PBKDF2Iterations = 0;
+ 
+-	SMB_ASSERT(iv.length == sizeof(ppwd_buf->salt));
+-	memcpy(ppwd_buf->salt, iv.data, iv.length);
++	SMB_ASSERT(salt->length == sizeof(ppwd_buf->salt));
++	memcpy(ppwd_buf->salt, salt->data, salt->length);
+ 
+ 	return NT_STATUS_OK;
+ }
+diff --git a/source3/rpc_client/init_samr.h b/source3/rpc_client/init_samr.h
+index 940534e7168..71b4c0e573d 100644
+--- a/source3/rpc_client/init_samr.h
++++ b/source3/rpc_client/init_samr.h
+@@ -47,6 +47,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd,
+  */
+ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx,
+ 				    const char *password,
++				    DATA_BLOB *salt,
+ 				    DATA_BLOB *session_key,
+ 				    struct samr_EncryptedPasswordAES *ppwd_buf);
+ 
+diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c
+index 9ccd2f78a8d..8106ca90cf2 100644
+--- a/source3/rpcclient/cmd_samr.c
++++ b/source3/rpcclient/cmd_samr.c
+@@ -3172,6 +3172,11 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli,
+ 	uint8_t nt_hash[16];
+ 	uint8_t lm_hash[16];
+ 	DATA_BLOB session_key;
++	uint8_t salt_data[16];
++	DATA_BLOB salt = {
++		.data = salt_data,
++		.length = sizeof(salt_data),
++	};
+ 	uint8_t password_expired = 0;
+ 	struct dcerpc_binding_handle *b = cli->binding_handle;
+ 	TALLOC_CTX *frame = NULL;
+@@ -3198,6 +3203,8 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli,
+ 		goto done;
+ 	}
+ 
++	generate_nonce_buffer(salt.data, salt.length);
++
+ 	switch(level) {
+ 	case 18:
+ 	case 21:
+@@ -3220,6 +3227,7 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli,
+ 	case 31:
+ 		status = init_samr_CryptPasswordAES(frame,
+ 						    param,
++						    &salt,
+ 						    &session_key,
+ 						    &pwd_buf_aes);
+ 		if (!NT_STATUS_IS_OK(status)) {
+diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c
+index 4f662110e55..a1672104824 100644
+--- a/source4/libnet/libnet_passwd.c
++++ b/source4/libnet/libnet_passwd.c
+@@ -57,13 +57,13 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx,
+ 	struct samr_EncryptedPasswordAES pwd_buf = {
+ 		.cipher_len = 0
+ 	};
+-	DATA_BLOB iv = {
++	DATA_BLOB salt = {
+ 		.data = pwd_buf.salt,
+ 		.length = sizeof(pwd_buf.salt),
+ 	};
+-	gnutls_datum_t iv_datum = {
+-		.data = iv.data,
+-		.size = iv.length,
++	gnutls_datum_t salt_datum = {
++		.data = pwd_buf.salt,
++		.size = sizeof(pwd_buf.salt),
+ 	};
+ 	uint64_t pbkdf2_iterations = generate_random_u64_range(5000, 1000000);
+ 	NTSTATUS status;
+@@ -71,11 +71,11 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx,
+ 
+ 	E_md4hash(old_password, old_nt_key_data);
+ 
+-	generate_nonce_buffer(iv.data, iv.length);
++	generate_nonce_buffer(salt.data, salt.length);
+ 
+ 	rc = gnutls_pbkdf2(GNUTLS_MAC_SHA512,
+ 			   &old_nt_key,
+-			   &iv_datum,
++			   &salt_datum,
+ 			   pbkdf2_iterations,
+ 			   cek.data,
+ 			   cek.length);
+@@ -86,6 +86,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx,
+ 
+ 	status = init_samr_CryptPasswordAES(mem_ctx,
+ 					    new_password,
++					    &salt,
+ 					    &cek,
+ 					    &pwd_buf);
+ 	data_blob_clear(&cek);
+diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c
+index de354659067..0b1880efa18 100644
+--- a/source4/torture/rpc/samr.c
++++ b/source4/torture/rpc/samr.c
+@@ -783,6 +783,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t
+ 	struct samr_SetUserInfo s;
+ 	union samr_UserInfo u;
+ 	DATA_BLOB session_key;
++	uint8_t salt_data[16];
++	DATA_BLOB salt = {
++		.data = salt_data,
++		.length = sizeof(salt_data),
++	};
+ 	char *newpass = NULL;
+ 	struct dcerpc_binding_handle *b = p->binding_handle;
+ 	struct samr_GetUserPwInfo pwp;
+@@ -818,8 +823,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t
+ 		return false;
+ 	}
+ 
++	generate_nonce_buffer(salt.data, salt.length);
++
+ 	status = init_samr_CryptPasswordAES(tctx,
+ 					    newpass,
++					    &salt,
+ 					    &session_key,
+ 					    &u.info32.password);
+ 	torture_assert_ntstatus_ok(tctx,
+@@ -852,6 +860,7 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t
+ 
+ 	status = init_samr_CryptPasswordAES(tctx,
+ 					    newpass,
++					    &salt,
+ 					    &session_key,
+ 					    &u.info32.password);
+ 	torture_assert_ntstatus_ok(tctx,
+@@ -896,6 +905,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t
+ 	union samr_UserInfo u;
+ 	bool ret = true;
+ 	DATA_BLOB session_key;
++	uint8_t salt_data[16];
++	DATA_BLOB salt = {
++		.data = salt_data,
++		.length = sizeof(salt_data),
++	};
+ 	char *newpass;
+ 	struct dcerpc_binding_handle *b = p->binding_handle;
+ 	struct samr_GetUserPwInfo pwp;
+@@ -931,8 +945,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t
+ 		return false;
+ 	}
+ 
++	generate_nonce_buffer(salt.data, salt.length);
++
+ 	status = init_samr_CryptPasswordAES(tctx,
+ 					    newpass,
++					    &salt,
+ 					    &session_key,
+ 					    &u.info31.password);
+ 	torture_assert_ntstatus_ok(tctx,
+@@ -959,6 +976,7 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t
+ 
+ 	status = init_samr_CryptPasswordAES(tctx,
+ 					    newpass,
++					    &salt,
+ 					    &session_key,
+ 					    &u.info31.password);
+ 	torture_assert_ntstatus_ok(tctx,
+@@ -1381,6 +1399,11 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
+ 	union samr_UserInfo u;
+ 	bool ret = true;
+ 	DATA_BLOB session_key;
++	uint8_t salt_data[16];
++	DATA_BLOB salt = {
++		.data = salt_data,
++		.length = sizeof(salt_data),
++	};
+ 	char *newpass;
+ 	struct dcerpc_binding_handle *b = p->binding_handle;
+ 	struct samr_GetUserPwInfo pwp;
+@@ -1490,6 +1513,8 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
+ 		return false;
+ 	}
+ 
++	generate_nonce_buffer(salt.data, salt.length);
++
+ 	switch (level) {
+ 	case 18:
+ 		{
+@@ -1561,6 +1586,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
+ 	case 31:
+ 		status = init_samr_CryptPasswordAES(tctx,
+ 						    newpass,
++						    &salt,
+ 						    &session_key,
+ 						    &u.info31.password);
+ 
+@@ -1568,6 +1594,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
+ 	case 32:
+ 		status = init_samr_CryptPasswordAES(tctx,
+ 						    newpass,
++						    &salt,
+ 						    &session_key,
+ 						    &u.info32.password);
+ 
+-- 
+2.37.3
+
+
+From 1d630363c9b2497266e418aad89c55d5b51a63ad Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Mon, 17 Oct 2022 09:02:28 +0200
+Subject: [PATCH 3/5] s4:libnet: If we successfully changed the password we are
+ done
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Noel Power <noel.power@suse.com>
+---
+ source4/libnet/libnet_passwd.c | 32 ++++++++++++++++++--------------
+ 1 file changed, 18 insertions(+), 14 deletions(-)
+
+diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c
+index a1672104824..b17614bcd97 100644
+--- a/source4/libnet/libnet_passwd.c
++++ b/source4/libnet/libnet_passwd.c
+@@ -101,7 +101,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx,
+ 	r.in.password = &pwd_buf;
+ 
+ 	status = dcerpc_samr_ChangePasswordUser4_r(h, mem_ctx, &r);
+-	if (NT_STATUS_IS_OK(status)) {
++	if (!NT_STATUS_IS_OK(status)) {
+ 		goto done;
+ 	}
+ 	if (!NT_STATUS_IS_OK(r.out.result)) {
+@@ -112,6 +112,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx,
+ 						account->string,
+ 						nt_errstr(status));
+ 		status = r.out.result;
++		goto done;
+ 	}
+ 
+ done:
+@@ -424,20 +425,23 @@ static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CT
+ 		r->samr.in.oldpassword,
+ 		r->samr.in.newpassword,
+ 		&(r->samr.out.error_string));
+-	if (!NT_STATUS_IS_OK(status)) {
+-		if (NT_STATUS_EQUAL(status,
+-				     NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
+-		    NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) ||
+-		    NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
+-			/*
+-			* Don't fallback to RC4 based SAMR if weak crypto is not
+-			* allowed.
+-			*/
+-			if (lpcfg_weak_crypto(ctx->lp_ctx) ==
+-			SAMBA_WEAK_CRYPTO_DISALLOWED) {
+-				goto disconnect;
+-			}
++	if (NT_STATUS_IS_OK(status)) {
++		goto disconnect;
++	} else if (NT_STATUS_EQUAL(status,
++				   NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
++		   NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) ||
++		   NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
++		/*
++		 * Don't fallback to RC4 based SAMR if weak crypto is not
++		 * allowed.
++		 */
++		if (lpcfg_weak_crypto(ctx->lp_ctx) ==
++		    SAMBA_WEAK_CRYPTO_DISALLOWED) {
++			goto disconnect;
+ 		}
++	} else {
++		/* libnet_ChangePassword_samr_aes is implemented and failed */
++		goto disconnect;
+ 	}
+ 
+ 	status = libnet_ChangePassword_samr_rc4(
+-- 
+2.37.3
+
+
+From 9a4a169ab34641afb87e7f81708c9a72b321879e Mon Sep 17 00:00:00 2001
+From: Noel Power <noel.power@suse.com>
+Date: Fri, 21 Oct 2022 17:40:36 +0100
+Subject: [PATCH 4/5] s4/rpc_server/sambr: don't mutate the return of
+ samdb_set_password_aes
+
+prior to this commit return of samdb_set_password_aes was set to
+NT_STATUS_WRONG_PASSWORD on failure. Useful status that should be
+returned such as NT_STATUS_PASSWORD_RESTRICTION are swallowed here
+otherwise (and in this case can be partially responsible for failures
+in test samba.tests.auth_log_pass_change (with later gnutls)
+
+Signed-off-by: Noel Power <noel.power@suse.com>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ source4/rpc_server/samr/samr_password.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
+index 4691f9a47a9..b581be6361c 100644
+--- a/source4/rpc_server/samr/samr_password.c
++++ b/source4/rpc_server/samr/samr_password.c
+@@ -250,7 +250,6 @@ NTSTATUS dcesrv_samr_ChangePasswordUser4(struct dcesrv_call_state *dce_call,
+ 
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		ldb_transaction_cancel(sam_ctx);
+-		status = NT_STATUS_WRONG_PASSWORD;
+ 		goto done;
+ 	}
+ 
+-- 
+2.37.3
+
+
+From b8b36ecba0f22dbc203c12627ebd629c2437c635 Mon Sep 17 00:00:00 2001
+From: Noel Power <noel.power@suse.com>
+Date: Fri, 21 Oct 2022 17:14:44 +0100
+Subject: [PATCH 5/5] python/samba/tests: fix samba.tests.auth_log_pass_change
+ for later gnutls
+
+later gnutls that support GNUTLS_PBKDF2 currently fail,
+we need to conditionally switch test data to reflect use of
+'samr_ChangePasswordUser3' or 'samr_ChangePasswordUser4'
+depending on whether GNUTLS_PBKDF2 is supported or not
+
+Signed-off-by: Noel Power <noel.power@suse.com>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ python/samba/tests/auth_log_pass_change.py | 20 ++++++++++++++++----
+ source4/selftest/tests.py                  |  9 ++++++---
+ 2 files changed, 22 insertions(+), 7 deletions(-)
+
+diff --git a/python/samba/tests/auth_log_pass_change.py b/python/samba/tests/auth_log_pass_change.py
+index 972af2158dd..1ca46c586b3 100644
+--- a/python/samba/tests/auth_log_pass_change.py
++++ b/python/samba/tests/auth_log_pass_change.py
+@@ -72,6 +72,18 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase):
+ 
+         # discard any auth log messages for the password setup
+         self.discardMessages()
++        gnutls_pbkdf2_support = samba.tests.env_get_var_value(
++            'GNUTLS_PBKDF2_SUPPORT',
++            allow_missing=True)
++        if gnutls_pbkdf2_support is None:
++            gnutls_pbkdf2_support = '0'
++        self.gnutls_pbkdf2_support = bool(int(gnutls_pbkdf2_support))
++
++    def _authDescription(self):
++        if self.gnutls_pbkdf2_support:
++            return "samr_ChangePasswordUser4"
++        else:
++            return "samr_ChangePasswordUser3"
+ 
+     def tearDown(self):
+         super(AuthLogPassChangeTests, self).tearDown()
+@@ -83,7 +95,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase):
+                     (msg["Authentication"]["serviceDescription"] ==
+                         "SAMR Password Change") and
+                     (msg["Authentication"]["authDescription"] ==
+-                        "samr_ChangePasswordUser3") and
++                        self._authDescription()) and
+                     (msg["Authentication"]["eventId"] ==
+                         EVT_ID_SUCCESSFUL_LOGON) and
+                     (msg["Authentication"]["logonType"] ==
+@@ -109,7 +121,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase):
+                     (msg["Authentication"]["serviceDescription"] ==
+                         "SAMR Password Change") and
+                     (msg["Authentication"]["authDescription"] ==
+-                        "samr_ChangePasswordUser3") and
++                        self._authDescription()) and
+                     (msg["Authentication"]["eventId"] ==
+                         EVT_ID_UNSUCCESSFUL_LOGON) and
+                     (msg["Authentication"]["logonType"] ==
+@@ -141,7 +153,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase):
+                     (msg["Authentication"]["serviceDescription"] ==
+                         "SAMR Password Change") and
+                     (msg["Authentication"]["authDescription"] ==
+-                        "samr_ChangePasswordUser3") and
++                        self._authDescription()) and
+                     (msg["Authentication"]["eventId"] ==
+                         EVT_ID_UNSUCCESSFUL_LOGON) and
+                     (msg["Authentication"]["logonType"] ==
+@@ -174,7 +186,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase):
+                     (msg["Authentication"]["serviceDescription"] ==
+                         "SAMR Password Change") and
+                     (msg["Authentication"]["authDescription"] ==
+-                        "samr_ChangePasswordUser3") and
++                        self._authDescription()) and
+                     (msg["Authentication"]["eventId"] ==
+                         EVT_ID_UNSUCCESSFUL_LOGON) and
+                     (msg["Authentication"]["logonType"] ==
+diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
+index a803d4704ea..c92105586a7 100755
+--- a/source4/selftest/tests.py
++++ b/source4/selftest/tests.py
+@@ -1094,9 +1094,11 @@ if have_heimdal_support:
+                            environ={'CLIENT_IP': '10.53.57.11',
+                                     'SOCKET_WRAPPER_DEFAULT_IFACE': 11})
+     planoldpythontestsuite("ad_dc_smb1", "samba.tests.auth_log_pass_change",
+-                           extra_args=['-U"$USERNAME%$PASSWORD"'])
++                           extra_args=['-U"$USERNAME%$PASSWORD"'],
++                           environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support})
+     planoldpythontestsuite("ad_dc_ntvfs", "samba.tests.auth_log_pass_change",
+-                           extra_args=['-U"$USERNAME%$PASSWORD"'])
++                           extra_args=['-U"$USERNAME%$PASSWORD"'],
++                           environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support})
+ 
+     # these tests use a NCA local RPC connection, so always run on the
+     # :local testenv, and so don't need to fake a client connection
+@@ -1113,7 +1115,8 @@ if have_heimdal_support:
+                            "samba.tests.auth_log_winbind",
+                            extra_args=['-U"$DC_USERNAME%$DC_PASSWORD"'])
+     planoldpythontestsuite("ad_dc", "samba.tests.audit_log_pass_change",
+-                           extra_args=['-U"$USERNAME%$PASSWORD"'])
++                           extra_args=['-U"$USERNAME%$PASSWORD"'],
++                           environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support})
+     planoldpythontestsuite("ad_dc", "samba.tests.audit_log_dsdb",
+                            extra_args=['-U"$USERNAME%$PASSWORD"'])
+     planoldpythontestsuite("ad_dc", "samba.tests.group_audit",
+-- 
+2.37.3
+

samba-4.23-fix-cmocka.patch

@@ -1,38 +0,0 @@
-From b1ec803f420b2c6d3c5c83d70c6875a7f36b15fc Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Fri, 21 Nov 2025 15:33:32 +0100
-Subject: [PATCH] s4:dsdb: Do not declare cm_print_error()
-
-This is part of the cmocka.h header file.
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
-Reviewed-by: Martin Schwenke <martin@meltin.net>
-Reviewed-by: Volker Lendecke <vl@samba.org>
-
-Autobuild-User(master): Volker Lendecke <vl@samba.org>
-Autobuild-Date(master): Mon Nov 24 11:28:08 UTC 2025 on atb-devel-224
-
-(cherry picked from commit 5a981663e4f677042ba80191770100aecff2120a)
----
- source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
-index f7075f3485e..12c464b49c7 100644
---- a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
-+++ b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
-@@ -103,11 +103,6 @@ void audit_message_send(
- 
- #define check_group_change_message(m, u, a, e)                                 \
- 	_check_group_change_message(m, u, a, e, __FILE__, __LINE__);
--/*
-- * declare the internal cmocka cm_print_error so that we can output messages
-- * in sub unit format
-- */
--void cm_print_error(const char * const format, ...);
- 
- /*
-  * Validate a group change JSON audit message
--- 
-2.52.0
-

samba-winbind-systemd-sysusers.conf

@@ -1,2 +0,0 @@
-#Type Name       ID
-g     wbpriv     88

samba.logrotate

@@ -1,4 +1,4 @@
-/var/log/samba/*log* {
+/var/log/samba/log.* {
     compress
     dateext
     maxage 365

smb.conf.example

@@ -269,13 +269,6 @@
 ;	map system = no
 ;	store dos attributes = yes
 
-# Turn on SMB 3.1.1 Unix Extensions by default
-#
-# Note: The Linux Kernel SMB3 client will negotiate unix extensions by default,
-# find more info in man mount.smb3(8). Linux 6.13 will finally support special
-# filetypes and symlink handling.
-
-	smb3 unix extensions = yes
 
 #============================ Share Definitions ==============================
 

smb.conf.vendor

@@ -38,8 +38,7 @@
 [print$]
 	comment = Printer Drivers
 	path = /var/lib/samba/drivers
-	# printadmin is a local group
-	write list = printadmin root
-	force group = printadmin
+	write list = @printadmin root
+	force group = @printadmin
 	create mask = 0664
 	directory mask = 0775

sources

@@ -1,2 +1,2 @@
-SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac
-SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce
+SHA512 (samba-4.17.12.tar.xz) = 54e7761b1db5a3bc077cd955ec6aadb485ecddc4f5099899208c87ef70fe1f912458569186bba16c61355270c1bfa6eb4d708bc0fe73720f3487ac78b30aa5cc
+SHA512 (samba-4.17.12.tar.asc) = 11a830be3ee78c6ab60782a287aebad160b3613d799580abdac4cef45af2e7743a6b7e04b609bdbb71e5af9e4b1f627176ad6477ef2b77ce9f20354243f0182d

tests/deps-check.fmf

@@ -1,22 +0,0 @@
-summary: Check samba package dependency structure
-description: |
-    Verify that samba library packages maintain correct dependency hierarchy:
-    - samba-core-libs has no samba-*-libs dependencies
-    - samba-ndr-libs depends on samba-core-libs (not samba-client-libs or samba-libs)
-    - samba-client-libs depends on core-libs + ndr-libs (not samba-libs)
-    - samba-client depends on samba-client-libs (not samba-libs)
-    - samba-libs does not depend on samba-dc-libs
-    - libsmbclient depends on samba-client-libs (not samba-libs)
-    - libwbclient has no samba-*-libs dependencies
-    - libldb has no samba-*-libs dependencies
-test: ./deps-check.sh
-framework: shell
-require:
-  - samba-core-libs
-  - samba-ndr-libs
-  - samba-client-libs
-  - samba-libs
-  - samba-client
-  - libwbclient
-  - libsmbclient
-  - libldb

tests/deps-check.sh

@@ -1,167 +0,0 @@
-#!/bin/bash
-#
-# Samba package dependency structure verification
-#
-# This test ensures that the samba library package dependencies don't regress.
-# The expected hierarchy is:
-#
-#   samba-core-libs    (no samba-*-libs dependencies)
-#        ^
-#        |
-#   samba-ndr-libs     (depends on samba-core-libs only)
-#        ^
-#        |
-#   samba-client-libs  (depends on samba-core-libs + samba-ndr-libs)
-#
-#   libwbclient        (no samba-*-libs dependencies - only links to libc)
-#
-#   samba-client       (depends on samba-client-libs, NOT samba-libs)
-#   libsmbclient       (depends on samba-client-libs, NOT samba-libs)
-#
-# NOTE: This test checks RESOLVED dependencies, not just explicit Requires.
-# A library requirement like 'libfoo.so' is resolved to the package that
-# provides it, ensuring we catch indirect dependencies.
-#
-
-set -e
-
-ERRORS=0
-
-# Get all packages that a package depends on (resolved)
-# This resolves library deps like 'libfoo.so' to actual package names
-get_resolved_deps() {
-    local pkg="$1"
-
-    rpm --query --requires "$pkg" 2>/dev/null | while read -r req; do
-        # Skip rpmlib and config requirements
-        [[ "$req" =~ ^rpmlib ]] && continue
-        [[ "$req" =~ ^config ]] && continue
-        [[ "$req" =~ ^/ ]] && continue
-
-        # Get the package that provides this requirement
-        provider=$(rpm --query --whatprovides "$req" 2>/dev/null | head -1)
-        if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then
-            # Extract just the package name (remove version-release.arch)
-            echo "${provider%%-[0-9]*}"
-        fi
-    done | sort -u
-}
-
-# Check that a package does NOT depend on packages matching a pattern
-# This checks RESOLVED dependencies (what packages actually get pulled in)
-check_no_resolved_dep() {
-    local pkg="$1"
-    local pattern="$2"
-    local description="$3"
-
-    if ! rpm --query "$pkg" &>/dev/null; then
-        echo "SKIP: $pkg not installed"
-        return 0
-    fi
-
-    local bad_deps
-    # Exclude the package itself from the check
-    bad_deps=$(get_resolved_deps "$pkg" | grep -v "^${pkg}$" | grep -E "$pattern" || true)
-
-    if [ -n "$bad_deps" ]; then
-        echo "FAIL: $pkg depends on $description"
-        echo "  Found: $bad_deps"
-        ERRORS=$((ERRORS + 1))
-        return 1
-    fi
-    echo "PASS: $pkg does not depend on $description"
-    return 0
-}
-
-# Check that a package DOES depend on a specific package
-check_has_resolved_dep() {
-    local pkg="$1"
-    local expected="$2"
-
-    if ! rpm --query "$pkg" &>/dev/null; then
-        echo "SKIP: $pkg not installed"
-        return 0
-    fi
-
-    if get_resolved_deps "$pkg" | grep -qF "$expected"; then
-        echo "PASS: $pkg depends on $expected"
-        return 0
-    fi
-    echo "FAIL: $pkg does not depend on $expected"
-    ERRORS=$((ERRORS + 1))
-    return 1
-}
-
-echo "=== Samba Package Dependency Checks ==="
-echo ""
-echo "Checking resolved dependencies (library deps resolved to packages)"
-echo ""
-
-# 1. samba-core-libs must NOT depend on any samba-*-libs packages
-echo "--- samba-core-libs ---"
-check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba*-libs package"
-
-echo ""
-
-# 2. samba-ndr-libs must depend on samba-core-libs
-#    but NOT samba-client-libs or samba-libs
-echo "--- samba-ndr-libs ---"
-check_has_resolved_dep samba-ndr-libs "samba-core-libs"
-check_no_resolved_dep samba-ndr-libs "^samba-client-libs$" "samba-client-libs"
-check_no_resolved_dep samba-ndr-libs "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 3. samba-client-libs must depend on samba-core-libs and samba-ndr-libs
-#    but NOT samba-libs
-echo "--- samba-client-libs ---"
-check_has_resolved_dep samba-client-libs "samba-core-libs"
-check_has_resolved_dep samba-client-libs "samba-ndr-libs"
-check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 4. libwbclient must NOT depend on any samba-*-libs packages
-echo "--- libwbclient ---"
-check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba*-libs package"
-
-echo ""
-
-# 5. samba-client must depend on samba-client-libs but NOT samba-libs
-#    (client tools should not pull in server libraries)
-echo "--- samba-client ---"
-check_has_resolved_dep samba-client "samba-client-libs"
-check_no_resolved_dep samba-client "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 6. libsmbclient must depend on samba-client-libs but NOT samba-libs
-#    (SMB client library should not pull in server libraries)
-echo "--- libsmbclient ---"
-check_has_resolved_dep libsmbclient "samba-client-libs"
-check_no_resolved_dep libsmbclient "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 7. libldb must NOT depend on any samba-*-libs packages
-#    (libldb is a standalone database library)
-echo "--- libldb ---"
-check_no_resolved_dep libldb "^samba-.*-libs$" "any samba*-libs package"
-
-echo ""
-
-# 8. samba-libs must NOT depend on samba-dc-libs
-#    (server libraries should not pull in DC-specific libraries)
-echo "--- samba-libs ---"
-check_no_resolved_dep samba-libs "^samba-dc-libs$" "samba-dc-libs"
-
-echo ""
-echo "=== Summary ==="
-
-if [ $ERRORS -gt 0 ]; then
-    echo "FAILED: $ERRORS dependency check(s) failed"
-    exit 1
-fi
-
-echo "All dependency checks passed"
-exit 0