Fix version

- resolves: rhbz#2391698 - Security fix for CVE-2025-9640
- resolves: rhbz#2394377 - Security fix for CVE-2025-10230

Guenther

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -1,4 +1,2 @@
 /samba-*.tar.xz
 /samba-*.tar.asc
-/*.rpm
-/results_samba

gating.yaml

@@ -1,6 +0,0 @@
---- !Policy
-product_versions:
-  - fedora-*
-decision_context: bodhi_update_push_stable
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

plans.fmf

@@ -1,4 +0,0 @@
-discover:
-    how: fmf
-execute:
-    how: tmt

rpminspect.yaml

@@ -4,7 +4,6 @@ inspections:
 
 badfuncs:
     ignore:
-        - /usr/bin/nmbd
         - /usr/bin/nmblookup
         - /usr/bin/smbtorture
         - /usr/lib*/libndr.so.*
@@ -26,10 +25,3 @@ abidiff:
 debuginfo:
     ignore:
         - /usr/lib*/libdcerpc-samr.so.*
-
-annocheck:
-    ignore:
-        - /usr/bin/gentest
-        - /usr/bin/locktest
-        - /usr/bin/masktest
-        - /usr/bin/smbtorture

samba-4.21.0-s3-notifyd.patch

@@ -0,0 +1,513 @@
+From c9a7bc3e8f36cb9d6746e23ea56f9c27b82dcf49 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Mon, 22 Jul 2024 12:26:55 +0200
+Subject: [PATCH] s3:notifyd: Use a watcher per db record
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This fixes a O(n²) performance regression in notifyd. The problem was
+that we had a watcher per notify instance. This changes the code to have
+a watcher per notify db entry.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=14430
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Stefan Metzmacher <metze@samba.org>
+(cherry picked from commit af011b987a4ad0d3753d83cc0b8d97ad64ba874a)
+---
+ source3/smbd/notifyd/notifyd.c         | 214 ++++++++++++++++++-------
+ source3/smbd/notifyd/notifyd_db.c      |   5 +-
+ source3/smbd/notifyd/notifyd_entry.c   |  51 ++++--
+ source3/smbd/notifyd/notifyd_private.h |  46 ++++--
+ 4 files changed, 228 insertions(+), 88 deletions(-)
+
+diff --git a/source3/smbd/notifyd/notifyd.c b/source3/smbd/notifyd/notifyd.c
+index 64dd26a7e11..0b07ab3e435 100644
+--- a/source3/smbd/notifyd/notifyd.c
++++ b/source3/smbd/notifyd/notifyd.c
+@@ -337,6 +337,7 @@ static bool notifyd_apply_rec_change(
+ 	struct messaging_context *msg_ctx)
+ {
+ 	struct db_record *rec = NULL;
++	struct notifyd_watcher watcher = {};
+ 	struct notifyd_instance *instances = NULL;
+ 	size_t num_instances;
+ 	size_t i;
+@@ -344,6 +345,7 @@ static bool notifyd_apply_rec_change(
+ 	TDB_DATA value;
+ 	NTSTATUS status;
+ 	bool ok = false;
++	bool new_watcher = false;
+ 
+ 	if (pathlen == 0) {
+ 		DBG_WARNING("pathlen==0\n");
+@@ -374,8 +376,12 @@ static bool notifyd_apply_rec_change(
+ 	value = dbwrap_record_get_value(rec);
+ 
+ 	if (value.dsize != 0) {
+-		if (!notifyd_parse_entry(value.dptr, value.dsize, NULL,
+-					 &num_instances)) {
++		ok = notifyd_parse_entry(value.dptr,
++					 value.dsize,
++					 &watcher,
++					 NULL,
++					 &num_instances);
++		if (!ok) {
+ 			goto fail;
+ 		}
+ 	}
+@@ -390,8 +396,22 @@ static bool notifyd_apply_rec_change(
+ 		goto fail;
+ 	}
+ 
+-	if (value.dsize != 0) {
+-		memcpy(instances, value.dptr, value.dsize);
++	if (num_instances > 0) {
++		struct notifyd_instance *tmp = NULL;
++		size_t num_tmp = 0;
++
++		ok = notifyd_parse_entry(value.dptr,
++					 value.dsize,
++					 NULL,
++					 &tmp,
++					 &num_tmp);
++		if (!ok) {
++			goto fail;
++		}
++
++		memcpy(instances,
++		       tmp,
++		       sizeof(struct notifyd_instance) * num_tmp);
+ 	}
+ 
+ 	for (i=0; i<num_instances; i++) {
+@@ -414,41 +434,106 @@ static bool notifyd_apply_rec_change(
+ 		*instance = (struct notifyd_instance) {
+ 			.client = *client,
+ 			.instance = *chg,
+-			.internal_filter = chg->filter,
+-			.internal_subdir_filter = chg->subdir_filter
+ 		};
+ 
+ 		num_instances += 1;
+ 	}
+ 
+-	if ((instance->instance.filter != 0) ||
+-	    (instance->instance.subdir_filter != 0)) {
+-		int ret;
++	/*
++	 * Calculate an intersection of the instances filters for the watcher.
++	 */
++	if (instance->instance.filter > 0) {
++		uint32_t filter = instance->instance.filter;
++
++		if ((watcher.filter & filter) != filter) {
++			watcher.filter |= filter;
++
++			new_watcher = true;
++		}
++	}
++
++	/*
++	 * Calculate an intersection of the instances subdir_filters for the
++	 * watcher.
++	 */
++	if (instance->instance.subdir_filter > 0) {
++		uint32_t subdir_filter = instance->instance.subdir_filter;
+ 
+-		TALLOC_FREE(instance->sys_watch);
++		if ((watcher.subdir_filter & subdir_filter) != subdir_filter) {
++			watcher.subdir_filter |= subdir_filter;
+ 
+-		ret = sys_notify_watch(entries, sys_notify_ctx, path,
+-				       &instance->internal_filter,
+-				       &instance->internal_subdir_filter,
+-				       notifyd_sys_callback, msg_ctx,
+-				       &instance->sys_watch);
+-		if (ret != 0) {
+-			DBG_WARNING("sys_notify_watch for [%s] returned %s\n",
+-				    path, strerror(errno));
++			new_watcher = true;
+ 		}
+ 	}
+ 
+ 	if ((instance->instance.filter == 0) &&
+ 	    (instance->instance.subdir_filter == 0)) {
++		uint32_t tmp_filter = 0;
++		uint32_t tmp_subdir_filter = 0;
++
+ 		/* This is a delete request */
+-		TALLOC_FREE(instance->sys_watch);
+ 		*instance = instances[num_instances-1];
+ 		num_instances -= 1;
++
++		for (i = 0; i < num_instances; i++) {
++			struct notifyd_instance *tmp = &instances[i];
++
++			tmp_filter |= tmp->instance.filter;
++			tmp_subdir_filter |= tmp->instance.subdir_filter;
++		}
++
++		/*
++		 * If the filter has changed, register a new watcher with the
++		 * changed filter.
++		 */
++		if (watcher.filter != tmp_filter ||
++		    watcher.subdir_filter != tmp_subdir_filter)
++		{
++			watcher.filter = tmp_filter;
++			watcher.subdir_filter = tmp_subdir_filter;
++
++			new_watcher = true;
++		}
++	}
++
++	if (new_watcher) {
++		/*
++		 * In case we removed all notify instances, we want to remove
++		 * the watcher. We won't register a new one, if no filters are
++		 * set anymore.
++		 */
++
++		TALLOC_FREE(watcher.sys_watch);
++
++		watcher.sys_filter = watcher.filter;
++		watcher.sys_subdir_filter = watcher.subdir_filter;
++
++		/*
++		 * Only register a watcher if we have filter.
++		 */
++		if (watcher.filter != 0 || watcher.subdir_filter != 0) {
++			int ret = sys_notify_watch(entries,
++						   sys_notify_ctx,
++						   path,
++						   &watcher.sys_filter,
++						   &watcher.sys_subdir_filter,
++						   notifyd_sys_callback,
++						   msg_ctx,
++						   &watcher.sys_watch);
++			if (ret != 0) {
++				DBG_WARNING("sys_notify_watch for [%s] "
++					    "returned %s\n",
++					    path,
++					    strerror(errno));
++			}
++		}
+ 	}
+ 
+ 	DBG_DEBUG("%s has %zu instances\n", path, num_instances);
+ 
+ 	if (num_instances == 0) {
++		TALLOC_FREE(watcher.sys_watch);
++
+ 		status = dbwrap_record_delete(rec);
+ 		if (!NT_STATUS_IS_OK(status)) {
+ 			DBG_WARNING("dbwrap_record_delete returned %s\n",
+@@ -456,13 +541,21 @@ static bool notifyd_apply_rec_change(
+ 			goto fail;
+ 		}
+ 	} else {
+-		value = make_tdb_data(
+-			(uint8_t *)instances,
+-			sizeof(struct notifyd_instance) * num_instances);
++		struct TDB_DATA iov[2] = {
++			{
++				.dptr = (uint8_t *)&watcher,
++				.dsize = sizeof(struct notifyd_watcher),
++			},
++			{
++				.dptr = (uint8_t *)instances,
++				.dsize = sizeof(struct notifyd_instance) *
++					 num_instances,
++			},
++		};
+ 
+-		status = dbwrap_record_store(rec, value, 0);
++		status = dbwrap_record_storev(rec, iov, ARRAY_SIZE(iov), 0);
+ 		if (!NT_STATUS_IS_OK(status)) {
+-			DBG_WARNING("dbwrap_record_store returned %s\n",
++			DBG_WARNING("dbwrap_record_storev returned %s\n",
+ 				    nt_errstr(status));
+ 			goto fail;
+ 		}
+@@ -706,12 +799,18 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data,
+ 					.when = tstate->msg->when };
+ 	struct iovec iov[2];
+ 	size_t path_len = key.dsize;
++	struct notifyd_watcher watcher = {};
+ 	struct notifyd_instance *instances = NULL;
+ 	size_t num_instances = 0;
+ 	size_t i;
++	bool ok;
+ 
+-	if (!notifyd_parse_entry(data.dptr, data.dsize, &instances,
+-				 &num_instances)) {
++	ok = notifyd_parse_entry(data.dptr,
++				 data.dsize,
++				 &watcher,
++				 &instances,
++				 &num_instances);
++	if (!ok) {
+ 		DBG_DEBUG("Could not parse notifyd_entry\n");
+ 		return;
+ 	}
+@@ -734,9 +833,11 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data,
+ 
+ 		if (tstate->covered_by_sys_notify) {
+ 			if (tstate->recursive) {
+-				i_filter = instance->internal_subdir_filter;
++				i_filter = watcher.sys_subdir_filter &
++					   instance->instance.subdir_filter;
+ 			} else {
+-				i_filter = instance->internal_filter;
++				i_filter = watcher.sys_filter &
++					   instance->instance.filter;
+ 			}
+ 		} else {
+ 			if (tstate->recursive) {
+@@ -1146,46 +1247,39 @@ static int notifyd_add_proxy_syswatches(struct db_record *rec,
+ 	struct db_context *db = dbwrap_record_get_db(rec);
+ 	TDB_DATA key = dbwrap_record_get_key(rec);
+ 	TDB_DATA value = dbwrap_record_get_value(rec);
+-	struct notifyd_instance *instances = NULL;
+-	size_t num_instances = 0;
+-	size_t i;
++	struct notifyd_watcher watcher = {};
+ 	char path[key.dsize+1];
+ 	bool ok;
++	int ret;
+ 
+ 	memcpy(path, key.dptr, key.dsize);
+ 	path[key.dsize] = '\0';
+ 
+-	ok = notifyd_parse_entry(value.dptr, value.dsize, &instances,
+-				 &num_instances);
++	/* This is a remote database, we just need the watcher. */
++	ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL);
+ 	if (!ok) {
+ 		DBG_WARNING("Could not parse notifyd entry for %s\n", path);
+ 		return 0;
+ 	}
+ 
+-	for (i=0; i<num_instances; i++) {
+-		struct notifyd_instance *instance = &instances[i];
+-		uint32_t filter = instance->instance.filter;
+-		uint32_t subdir_filter = instance->instance.subdir_filter;
+-		int ret;
++	watcher.sys_watch = NULL;
++	watcher.sys_filter = watcher.filter;
++	watcher.sys_subdir_filter = watcher.subdir_filter;
+ 
+-		/*
+-		 * This is a remote database. Pointers that we were
+-		 * given don't make sense locally. Initialize to NULL
+-		 * in case sys_notify_watch fails.
+-		 */
+-		instances[i].sys_watch = NULL;
+-
+-		ret = state->sys_notify_watch(
+-			db, state->sys_notify_ctx, path,
+-			&filter, &subdir_filter,
+-			notifyd_sys_callback, state->msg_ctx,
+-			&instance->sys_watch);
+-		if (ret != 0) {
+-			DBG_WARNING("inotify_watch returned %s\n",
+-				    strerror(errno));
+-		}
++	ret = state->sys_notify_watch(db,
++				      state->sys_notify_ctx,
++				      path,
++				      &watcher.filter,
++				      &watcher.subdir_filter,
++				      notifyd_sys_callback,
++				      state->msg_ctx,
++				      &watcher.sys_watch);
++	if (ret != 0) {
++		DBG_WARNING("inotify_watch returned %s\n", strerror(errno));
+ 	}
+ 
++	memcpy(value.dptr, &watcher, sizeof(struct notifyd_watcher));
++
+ 	return 0;
+ }
+ 
+@@ -1193,21 +1287,17 @@ static int notifyd_db_del_syswatches(struct db_record *rec, void *private_data)
+ {
+ 	TDB_DATA key = dbwrap_record_get_key(rec);
+ 	TDB_DATA value = dbwrap_record_get_value(rec);
+-	struct notifyd_instance *instances = NULL;
+-	size_t num_instances = 0;
+-	size_t i;
++	struct notifyd_watcher watcher = {};
+ 	bool ok;
+ 
+-	ok = notifyd_parse_entry(value.dptr, value.dsize, &instances,
+-				 &num_instances);
++	ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL);
+ 	if (!ok) {
+ 		DBG_WARNING("Could not parse notifyd entry for %.*s\n",
+ 			    (int)key.dsize, (char *)key.dptr);
+ 		return 0;
+ 	}
+-	for (i=0; i<num_instances; i++) {
+-		TALLOC_FREE(instances[i].sys_watch);
+-	}
++	TALLOC_FREE(watcher.sys_watch);
++
+ 	return 0;
+ }
+ 
+diff --git a/source3/smbd/notifyd/notifyd_db.c b/source3/smbd/notifyd/notifyd_db.c
+index 18228619e9a..7dc3cd58081 100644
+--- a/source3/smbd/notifyd/notifyd_db.c
++++ b/source3/smbd/notifyd/notifyd_db.c
+@@ -40,7 +40,10 @@ static bool notifyd_parse_db_parser(TDB_DATA key, TDB_DATA value,
+ 	memcpy(path, key.dptr, key.dsize);
+ 	path[key.dsize] = 0;
+ 
+-	ok = notifyd_parse_entry(value.dptr, value.dsize, &instances,
++	ok = notifyd_parse_entry(value.dptr,
++				 value.dsize,
++				 NULL,
++				 &instances,
+ 				 &num_instances);
+ 	if (!ok) {
+ 		DBG_DEBUG("Could not parse entry for path %s\n", path);
+diff --git a/source3/smbd/notifyd/notifyd_entry.c b/source3/smbd/notifyd/notifyd_entry.c
+index 539010de03a..f3b0e908136 100644
+--- a/source3/smbd/notifyd/notifyd_entry.c
++++ b/source3/smbd/notifyd/notifyd_entry.c
+@@ -21,22 +21,51 @@
+  * Parse an entry in the notifyd_context->entries database
+  */
+ 
+-bool notifyd_parse_entry(
+-	uint8_t *buf,
+-	size_t buflen,
+-	struct notifyd_instance **instances,
+-	size_t *num_instances)
++/**
++ * @brief Parse a notifyd database entry.
++ *
++ * The memory we pass down needs to be aligned. If it isn't aligned we can run
++ * into obscure errors as we just point into the data buffer.
++ *
++ * @param data The data to parse
++ * @param data_len The length of the data to parse
++ * @param watcher A pointer to store the watcher data or NULL.
++ * @param instances A pointer to store the array of notify instances or NULL.
++ * @param pnum_instances The number of elements in the array. If you just want
++ * the number of elements pass NULL for the watcher and instances pointers.
++ *
++ * @return true on success, false if an error occurred.
++ */
++bool notifyd_parse_entry(uint8_t *data,
++			 size_t data_len,
++			 struct notifyd_watcher *watcher,
++			 struct notifyd_instance **instances,
++			 size_t *pnum_instances)
+ {
+-	if ((buflen % sizeof(struct notifyd_instance)) != 0) {
+-		DBG_WARNING("invalid buffer size: %zu\n", buflen);
++	size_t ilen;
++
++	if (data_len < sizeof(struct notifyd_watcher)) {
+ 		return false;
+ 	}
+ 
+-	if (instances != NULL) {
+-		*instances = (struct notifyd_instance *)buf;
++	if (watcher != NULL) {
++		*watcher = *((struct notifyd_watcher *)(uintptr_t)data);
+ 	}
+-	if (num_instances != NULL) {
+-		*num_instances = buflen / sizeof(struct notifyd_instance);
++
++	ilen = data_len - sizeof(struct notifyd_watcher);
++	if ((ilen % sizeof(struct notifyd_instance)) != 0) {
++		return false;
++	}
++
++	if (pnum_instances != NULL) {
++		*pnum_instances = ilen / sizeof(struct notifyd_instance);
+ 	}
++	if (instances != NULL) {
++		/* The (uintptr_t) cast removes a warning from -Wcast-align. */
++		*instances =
++			(struct notifyd_instance *)(uintptr_t)
++				(data + sizeof(struct notifyd_watcher));
++	}
++
+ 	return true;
+ }
+diff --git a/source3/smbd/notifyd/notifyd_private.h b/source3/smbd/notifyd/notifyd_private.h
+index 36c08f47c54..db8e6e1c005 100644
+--- a/source3/smbd/notifyd/notifyd_private.h
++++ b/source3/smbd/notifyd/notifyd_private.h
+@@ -20,30 +20,48 @@
+ #include "lib/util/server_id.h"
+ #include "notifyd.h"
+ 
++
+ /*
+- * notifyd's representation of a notify instance
++ * Representation of a watcher for a path
++ *
++ * This will be stored in the db.
+  */
+-struct notifyd_instance {
+-	struct server_id client;
+-	struct notify_instance instance;
+-
+-	void *sys_watch; /* inotify/fam/etc handle */
++struct notifyd_watcher {
++	/*
++	 * This is an intersections of the filter the watcher is listening for.
++	 */
++	uint32_t filter;
++	uint32_t subdir_filter;
+ 
+ 	/*
+-	 * Filters after sys_watch took responsibility of some bits
++	 * Those are inout variables passed to the sys_watcher. The sys_watcher
++	 * will remove the bits it can't handle.
+ 	 */
+-	uint32_t internal_filter;
+-	uint32_t internal_subdir_filter;
++	uint32_t sys_filter;
++	uint32_t sys_subdir_filter;
++
++	/* The handle for inotify/fam etc. */
++	void *sys_watch;
++};
++
++/*
++ * Representation of a notifyd instance
++ *
++ * This will be stored in the db.
++ */
++struct notifyd_instance {
++	struct server_id client;
++	struct notify_instance instance;
+ };
+ 
+ /*
+  * Parse an entry in the notifyd_context->entries database
+  */
+ 
+-bool notifyd_parse_entry(
+-	uint8_t *buf,
+-	size_t buflen,
+-	struct notifyd_instance **instances,
+-	size_t *num_instances);
++bool notifyd_parse_entry(uint8_t *data,
++			 size_t data_len,
++			 struct notifyd_watcher *watcher,
++			 struct notifyd_instance **instances,
++			 size_t *num_instances);
+ 
+ #endif
+-- 
+2.46.1
+

samba-4.23-fix-cmocka.patch

@@ -1,38 +0,0 @@
-From b1ec803f420b2c6d3c5c83d70c6875a7f36b15fc Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Fri, 21 Nov 2025 15:33:32 +0100
-Subject: [PATCH] s4:dsdb: Do not declare cm_print_error()
-
-This is part of the cmocka.h header file.
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
-Reviewed-by: Martin Schwenke <martin@meltin.net>
-Reviewed-by: Volker Lendecke <vl@samba.org>
-
-Autobuild-User(master): Volker Lendecke <vl@samba.org>
-Autobuild-Date(master): Mon Nov 24 11:28:08 UTC 2025 on atb-devel-224
-
-(cherry picked from commit 5a981663e4f677042ba80191770100aecff2120a)
----
- source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
-index f7075f3485e..12c464b49c7 100644
---- a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
-+++ b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
-@@ -103,11 +103,6 @@ void audit_message_send(
- 
- #define check_group_change_message(m, u, a, e)                                 \
- 	_check_group_change_message(m, u, a, e, __FILE__, __LINE__);
--/*
-- * declare the internal cmocka cm_print_error so that we can output messages
-- * in sub unit format
-- */
--void cm_print_error(const char * const format, ...);
- 
- /*
-  * Validate a group change JSON audit message
--- 
-2.52.0
-

smb.conf.example

@@ -269,13 +269,6 @@
 ;	map system = no
 ;	store dos attributes = yes
 
-# Turn on SMB 3.1.1 Unix Extensions by default
-#
-# Note: The Linux Kernel SMB3 client will negotiate unix extensions by default,
-# find more info in man mount.smb3(8). Linux 6.13 will finally support special
-# filetypes and symlink handling.
-
-	smb3 unix extensions = yes
 
 #============================ Share Definitions ==============================
 

smb.conf.vendor

@@ -38,8 +38,7 @@
 [print$]
 	comment = Printer Drivers
 	path = /var/lib/samba/drivers
-	# printadmin is a local group
-	write list = printadmin root
-	force group = printadmin
+	write list = @printadmin root
+	force group = @printadmin
 	create mask = 0664
 	directory mask = 0775

sources

@@ -1,2 +1,2 @@
-SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac
-SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce
+SHA512 (samba-4.21.9.tar.xz) = 64c9b2b4eb2f1bd9ac2578d2a5e858565a25b8b2bbde1f12a698fb675da8e0a311119eadbcd1be7f063bf985110bfc4fd35f1408a7e4095fa004cda81aa3d26c
+SHA512 (samba-4.21.9.tar.asc) = e395b02bcf979813329add3e2c7ffcf91f121670a5101d9e07af312bbf6b4ac2edac86c25050effca733113d35aa441200a90164d9ddf1313e2ec2e28065c725

tests/deps-check.fmf

@@ -1,22 +0,0 @@
-summary: Check samba package dependency structure
-description: |
-    Verify that samba library packages maintain correct dependency hierarchy:
-    - samba-core-libs has no samba-*-libs dependencies
-    - samba-ndr-libs depends on samba-core-libs (not samba-client-libs or samba-libs)
-    - samba-client-libs depends on core-libs + ndr-libs (not samba-libs)
-    - samba-client depends on samba-client-libs (not samba-libs)
-    - samba-libs does not depend on samba-dc-libs
-    - libsmbclient depends on samba-client-libs (not samba-libs)
-    - libwbclient has no samba-*-libs dependencies
-    - libldb has no samba-*-libs dependencies
-test: ./deps-check.sh
-framework: shell
-require:
-  - samba-core-libs
-  - samba-ndr-libs
-  - samba-client-libs
-  - samba-libs
-  - samba-client
-  - libwbclient
-  - libsmbclient
-  - libldb

tests/deps-check.sh

@@ -1,167 +0,0 @@
-#!/bin/bash
-#
-# Samba package dependency structure verification
-#
-# This test ensures that the samba library package dependencies don't regress.
-# The expected hierarchy is:
-#
-#   samba-core-libs    (no samba-*-libs dependencies)
-#        ^
-#        |
-#   samba-ndr-libs     (depends on samba-core-libs only)
-#        ^
-#        |
-#   samba-client-libs  (depends on samba-core-libs + samba-ndr-libs)
-#
-#   libwbclient        (no samba-*-libs dependencies - only links to libc)
-#
-#   samba-client       (depends on samba-client-libs, NOT samba-libs)
-#   libsmbclient       (depends on samba-client-libs, NOT samba-libs)
-#
-# NOTE: This test checks RESOLVED dependencies, not just explicit Requires.
-# A library requirement like 'libfoo.so' is resolved to the package that
-# provides it, ensuring we catch indirect dependencies.
-#
-
-set -e
-
-ERRORS=0
-
-# Get all packages that a package depends on (resolved)
-# This resolves library deps like 'libfoo.so' to actual package names
-get_resolved_deps() {
-    local pkg="$1"
-
-    rpm --query --requires "$pkg" 2>/dev/null | while read -r req; do
-        # Skip rpmlib and config requirements
-        [[ "$req" =~ ^rpmlib ]] && continue
-        [[ "$req" =~ ^config ]] && continue
-        [[ "$req" =~ ^/ ]] && continue
-
-        # Get the package that provides this requirement
-        provider=$(rpm --query --whatprovides "$req" 2>/dev/null | head -1)
-        if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then
-            # Extract just the package name (remove version-release.arch)
-            echo "${provider%%-[0-9]*}"
-        fi
-    done | sort -u
-}
-
-# Check that a package does NOT depend on packages matching a pattern
-# This checks RESOLVED dependencies (what packages actually get pulled in)
-check_no_resolved_dep() {
-    local pkg="$1"
-    local pattern="$2"
-    local description="$3"
-
-    if ! rpm --query "$pkg" &>/dev/null; then
-        echo "SKIP: $pkg not installed"
-        return 0
-    fi
-
-    local bad_deps
-    # Exclude the package itself from the check
-    bad_deps=$(get_resolved_deps "$pkg" | grep -v "^${pkg}$" | grep -E "$pattern" || true)
-
-    if [ -n "$bad_deps" ]; then
-        echo "FAIL: $pkg depends on $description"
-        echo "  Found: $bad_deps"
-        ERRORS=$((ERRORS + 1))
-        return 1
-    fi
-    echo "PASS: $pkg does not depend on $description"
-    return 0
-}
-
-# Check that a package DOES depend on a specific package
-check_has_resolved_dep() {
-    local pkg="$1"
-    local expected="$2"
-
-    if ! rpm --query "$pkg" &>/dev/null; then
-        echo "SKIP: $pkg not installed"
-        return 0
-    fi
-
-    if get_resolved_deps "$pkg" | grep -qF "$expected"; then
-        echo "PASS: $pkg depends on $expected"
-        return 0
-    fi
-    echo "FAIL: $pkg does not depend on $expected"
-    ERRORS=$((ERRORS + 1))
-    return 1
-}
-
-echo "=== Samba Package Dependency Checks ==="
-echo ""
-echo "Checking resolved dependencies (library deps resolved to packages)"
-echo ""
-
-# 1. samba-core-libs must NOT depend on any samba-*-libs packages
-echo "--- samba-core-libs ---"
-check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba*-libs package"
-
-echo ""
-
-# 2. samba-ndr-libs must depend on samba-core-libs
-#    but NOT samba-client-libs or samba-libs
-echo "--- samba-ndr-libs ---"
-check_has_resolved_dep samba-ndr-libs "samba-core-libs"
-check_no_resolved_dep samba-ndr-libs "^samba-client-libs$" "samba-client-libs"
-check_no_resolved_dep samba-ndr-libs "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 3. samba-client-libs must depend on samba-core-libs and samba-ndr-libs
-#    but NOT samba-libs
-echo "--- samba-client-libs ---"
-check_has_resolved_dep samba-client-libs "samba-core-libs"
-check_has_resolved_dep samba-client-libs "samba-ndr-libs"
-check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 4. libwbclient must NOT depend on any samba-*-libs packages
-echo "--- libwbclient ---"
-check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba*-libs package"
-
-echo ""
-
-# 5. samba-client must depend on samba-client-libs but NOT samba-libs
-#    (client tools should not pull in server libraries)
-echo "--- samba-client ---"
-check_has_resolved_dep samba-client "samba-client-libs"
-check_no_resolved_dep samba-client "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 6. libsmbclient must depend on samba-client-libs but NOT samba-libs
-#    (SMB client library should not pull in server libraries)
-echo "--- libsmbclient ---"
-check_has_resolved_dep libsmbclient "samba-client-libs"
-check_no_resolved_dep libsmbclient "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 7. libldb must NOT depend on any samba-*-libs packages
-#    (libldb is a standalone database library)
-echo "--- libldb ---"
-check_no_resolved_dep libldb "^samba-.*-libs$" "any samba*-libs package"
-
-echo ""
-
-# 8. samba-libs must NOT depend on samba-dc-libs
-#    (server libraries should not pull in DC-specific libraries)
-echo "--- samba-libs ---"
-check_no_resolved_dep samba-libs "^samba-dc-libs$" "samba-dc-libs"
-
-echo ""
-echo "=== Summary ==="
-
-if [ $ERRORS -gt 0 ]; then
-    echo "FAILED: $ERRORS dependency check(s) failed"
-    exit 1
-fi
-
-echo "All dependency checks passed"
-exit 0