Update to version 4.16.4

resolves: #2111490
resolves: #X, #Y - Security fixes for CVE-2022-32742
resolves: #X, #Y - Security fixes for CVE-2022-32744
resolves: #X, #Y - Security fixes for CVE-2022-32745
resolves: #X, #Y - Security fixes for CVE-2022-32746

Guenther

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -1,4 +1,299 @@
-/samba-*.tar.xz
-/samba-*.tar.asc
-/*.rpm
-/results_samba
+samba-3.5.4.tar.gz
+samba-3.6.0pre1.tar.gz
+/samba-3.6.0pre2.tar.gz
+/samba-3.6.0pre3.tar.gz
+/samba-3.6.0rc1.tar.gz
+/samba-3.6.0rc2.tar.gz
+/samba-3.6.0rc3.tar.gz
+/samba-3.6.0.tar.gz
+/samba-3.6.1.tar.gz
+/samba-3.6.3.tar.gz
+/samba-3.6.4.tar.gz
+/samba-3.6.5.tar.gz
+/samba-3.6.6.tar.gz
+/samba-3.6.7.tar.gz
+/samba-4.0.0rc1.tar.bz2
+/samba-4.0.0rc2.tar.bz2
+/samba-4.0.0rc3.tar.bz2
+/samba-4.0.0rc4.tar.bz2
+/samba-4.0.0rc5.tar.bz2
+/samba-4.0.0rc6.tar.bz2
+/samba-4.0.0.tar.bz2
+/samba-4.0.1.tar.bz2
+/samba-4.0.2.tar.bz2
+/samba-4.0.3.tar.bz2
+/samba-4.0.4.tar.bz2
+/samba-4.0.5.tar.bz2
+/samba-4.0.6.tar.bz2
+/samba-4.0.7.tar.xz
+/samba-4.1.0rc1.tar.xz
+/samba-4.1.0rc2.tar.xz
+/samba-4.1.0rc3.tar.xz
+/samba-4.1.0rc4.tar.xz
+/samba-4.1.0.tar.xz
+/samba-4.1.1.tar.xz
+/samba-4.1.2.tar.xz
+/samba-4.1.3.tar.xz
+/samba-4.1.4.tar.xz
+/samba-4.1.5.tar.xz
+/samba-4.1.6.tar.xz
+/samba-4.1.8.tar.xz
+/samba-4.1.9.tar.xz
+/samba-4.1.11.tar.gz
+/samba-4.1.11.tar.xz
+/samba-4.1.12.tar.xz
+/samba-4.2.0rc2.tar.xz
+/samba-4.2.0rc3.tar.xz
+/samba-4.2.0rc4.tar.xz
+/samba-4.2.0rc5.tar.xz
+/samba-4.2.0.tar.xz
+/samba-4.2.1.tar.xz
+/samba-4.2.2.tar.xz
+/samba-4.2.3.tar.xz
+/samba-4.3.0rc3.tar.xz
+/samba-4.3.0rc4.tar.xz
+/samba-4.3.0.tar.xz
+/samba-4.3.1.tar.xz
+/samba-4.3.2.tar.xz
+/samba-4.3.3.tar.xz
+/samba-4.3.4.tar.xz
+/samba-4.4.0rc1.tar.xz
+/samba-4.4.0rc2.tar.xz
+/samba-4.4.0rc3.tar.xz
+/samba-4.4.0rc4.tar.xz
+/samba-4.4.0rc5.tar.xz
+/samba-4.4.0.tar.xz
+/samba-4.4.2.tar.xz
+/samba-4.4.3.tar.xz
+/samba-4.4.4.tar.xz
+/samba-4.4.5.tar.xz
+/samba-4.5.0rc1.tar.xz
+/samba-4.5.0rc2.tar.xz
+/samba-4.5.0rc3.tar.xz
+/samba-4.5.0.tar.xz
+/samba-4.5.1.tar.xz
+/samba-4.5.2.tar.xz
+/samba-4.5.3.tar.xz
+/samba-4.6.0rc1.tar.xz
+/samba-4.6.0rc2.tar.xz
+/samba-4.6.0rc2.tar.asc
+/samba-4.6.0rc3.tar.asc
+/samba-4.6.0rc3.tar.xz
+/samba-4.6.0rc4.tar.xz
+/samba-4.6.0rc4.tar.asc
+/samba-4.6.0.tar.asc
+/samba-4.6.0.tar.xz
+/samba-4.6.1.tar.xz
+/samba-4.6.1.tar.asc
+/samba-4.6.2.tar.xz
+/samba-4.6.2.tar.asc
+/samba-4.6.3.tar.xz
+/samba-4.6.3.tar.asc
+/samba-4.6.4.tar.xz
+/samba-4.6.4.tar.asc
+/samba-4.6.5.tar.xz
+/samba-4.6.5.tar.asc
+/samba-4.7.0rc1.tar.xz
+/samba-4.7.0rc1.tar.asc
+/samba-4.7.0rc3.tar.xz
+/samba-4.7.0rc3.tar.asc
+/samba-4.7.0rc5.tar.xz
+/samba-4.7.0rc5.tar.asc
+/samba-4.7.0rc6.tar.xz
+/samba-4.7.0rc6.tar.asc
+/samba-4.7.0.tar.xz
+/samba-4.7.0.tar.asc
+/samba-4.7.1.tar.xz
+/samba-4.7.1.tar.asc
+/samba-4.7.2.tar.xz
+/samba-4.7.2.tar.asc
+/samba-4.7.3.tar.xz
+/samba-4.7.3.tar.asc
+/samba-4.7.4.tar.xz
+/samba-4.7.4.tar.asc
+/samba-4.8.0rc1.tar.xz
+/samba-4.8.0rc1.tar.asc
+/samba-4.8.0rc2.tar.xz
+/samba-4.8.0rc2.tar.asc
+/samba-4.8.0rc3.tar.xz
+/samba-4.8.0rc3.tar.asc
+/samba-4.8.0rc4.tar.xz
+/samba-4.8.0rc4.tar.asc
+/samba-4.8.0.tar.xz
+/samba-4.8.0.tar.asc
+/samba-4.8.1.tar.xz
+/samba-4.8.1.tar.asc
+/samba-4.8.2.tar.xz
+/samba-4.8.2.tar.asc
+/samba-4.8.3.tar.asc
+/samba-4.8.3.tar.xz
+/samba-4.9.0rc1.tar.xz
+/samba-4.9.0rc1.tar.asc
+/samba-4.9.0rc2.tar.xz
+/samba-4.9.0rc2.tar.asc
+/samba-4.9.0rc3.tar.xz
+/samba-4.9.0rc3.tar.asc
+/samba-4.9.0rc4.tar.xz
+/samba-4.9.0rc4.tar.asc
+/samba-4.9.0rc5.tar.asc
+/samba-4.9.0rc5.tar.xz
+/samba-4.9.0.tar.xz
+/samba-4.9.0.tar.asc
+/samba-4.9.1.tar.asc
+/samba-4.9.1.tar.xz
+/samba-4.9.2.tar.xz
+/samba-4.9.2.tar.asc
+/samba-4.9.3.tar.xz
+/samba-4.9.3.tar.asc
+/samba-4.9.4.tar.xz
+/samba-4.9.4.tar.asc
+/samba-4.10.0rc1.tar.xz
+/samba-4.10.0rc1.tar.asc
+/samba-4.10.0rc2.tar.xz
+/samba-4.10.0rc2.tar.asc
+/samba-4.10.0rc3.tar.xz
+/samba-4.10.0rc3.tar.asc
+/samba-4.10.0rc4.tar.xz
+/samba-4.10.0rc4.tar.asc
+/samba-4.10.0.tar.xz
+/samba-4.10.0.tar.asc
+/samba-4.10.1.tar.xz
+/samba-4.10.1.tar.asc
+/samba-4.10.2.tar.xz
+/samba-4.10.2.tar.asc
+/samba-4.10.3.tar.xz
+/samba-4.10.3.tar.asc
+/samba-4.10.4.tar.xz
+/samba-4.10.4.tar.asc
+/samba-4.10.5.tar.xz
+/samba-4.10.5.tar.asc
+/samba-4.10.6.tar.xz
+/samba-4.10.6.tar.asc
+/samba-4.11.0rc1.tar.xz
+/samba-4.11.0rc1.tar.asc
+/samba-4.11.0rc2.tar.xz
+/samba-4.11.0rc2.tar.asc
+/samba-4.11.0rc3.tar.xz
+/samba-4.11.0rc3.tar.asc
+/samba-4.11.0rc4.tar.xz
+/samba-4.11.0rc4.tar.asc
+/samba-4.11.0.tar.xz
+/samba-4.11.0.tar.asc
+/samba-4.11.1.tar.xz
+/samba-4.11.1.tar.asc
+/samba-4.11.2.tar.xz
+/samba-4.11.2.tar.asc
+/samba-4.11.3.tar.xz
+/samba-4.11.3.tar.asc
+/samba-4.11.4.tar.xz
+/samba-4.11.4.tar.asc
+/samba-4.11.5.tar.xz
+/samba-4.11.5.tar.asc
+/samba-4.12.0rc1.tar.xz
+/samba-4.12.0rc1.tar.asc
+/samba-4.12.0rc2.tar.xz
+/samba-4.12.0rc2.tar.asc
+/samba-4.12.0rc3.tar.xz
+/samba-4.12.0rc3.tar.asc
+/samba-4.12.0rc4.tar.xz
+/samba-4.12.0rc4.tar.asc
+/samba-4.12.0.tar.xz
+/samba-4.12.0.tar.asc
+/samba-4.12.1.tar.xz
+/samba-4.12.1.tar.asc
+/samba-4.12.2.tar.xz
+/samba-4.12.2.tar.asc
+/samba-4.12.3.tar.xz
+/samba-4.12.3.tar.asc
+/samba-4.12.4.tar.xz
+/samba-4.12.4.tar.asc
+/samba-4.12.5.tar.xz
+/samba-4.12.5.tar.asc
+/samba-4.13.0rc1.tar.xz
+/samba-4.13.0rc1.tar.asc
+/samba-4.13.0rc2.tar.xz
+/samba-4.13.0rc2.tar.asc
+/samba-4.13.0rc3.tar.xz
+/samba-4.13.0rc3.tar.asc
+/samba-4.13.0rc4.tar.xz
+/samba-4.13.0rc4.tar.asc
+/samba-4.13.0rc5.tar.xz
+/samba-4.13.0rc5.tar.asc
+/samba-4.13.0rc6.tar.xz
+/samba-4.13.0rc6.tar.asc
+/samba-4.13.0.tar.xz
+/samba-4.13.0.tar.asc
+/samba-4.13.1.tar.xz
+/samba-4.13.1.tar.asc
+/samba-4.13.2.tar.xz
+/samba-4.13.2.tar.asc
+/samba-4.13.3.tar.xz
+/samba-4.13.3.tar.asc
+/samba-4.13.4.tar.xz
+/samba-4.13.4.tar.asc
+/samba-4.14.0rc1.tar.xz
+/samba-4.14.0rc1.tar.asc
+/samba-4.14.0rc2.tar.xz
+/samba-4.14.0rc2.tar.asc
+/samba-4.14.0rc3.tar.xz
+/samba-4.14.0rc3.tar.asc
+/samba-4.14.0rc4.tar.xz
+/samba-4.14.0rc4.tar.asc
+/samba-4.14.0.tar.xz
+/samba-4.14.0.tar.asc
+/samba-4.14.1.tar.xz
+/samba-4.14.1.tar.asc
+/samba-4.14.2.tar.xz
+/samba-4.14.2.tar.asc
+/samba-4.14.3.tar.xz
+/samba-4.14.3.tar.asc
+/samba-4.14.4.tar.xz
+/samba-4.14.4.tar.asc
+/samba-4.14.5.tar.xz
+/samba-4.14.5.tar.asc
+/samba-4.14.6.tar.xz
+/samba-4.14.6.tar.asc
+/samba-4.15.0rc1.tar.xz
+/samba-4.15.0rc1.tar.asc
+/samba-4.15.0rc2.tar.xz
+/samba-4.15.0rc2.tar.asc
+/samba-4.15.0rc3.tar.xz
+/samba-4.15.0rc3.tar.asc
+/samba-4.15.0rc4.tar.xz
+/samba-4.15.0rc4.tar.asc
+/samba-4.15.0rc5.tar.xz
+/samba-4.15.0rc5.tar.asc
+/samba-4.15.0rc6.tar.xz
+/samba-4.15.0rc6.tar.asc
+/samba-4.15.0rc7.tar.xz
+/samba-4.15.0rc7.tar.asc
+/samba-4.15.0.tar.xz
+/samba-4.15.0.tar.asc
+/samba-4.15.1.tar.xz
+/samba-4.15.1.tar.asc
+/samba-4.15.2.tar.xz
+/samba-4.15.2.tar.asc
+/samba-4.15.3.tar.xz
+/samba-4.15.3.tar.asc
+/samba-4.15.4.tar.xz
+/samba-4.15.4.tar.asc
+/samba-4.16.0rc1.tar.xz
+/samba-4.16.0rc1.tar.asc
+/samba-4.16.0rc2.tar.xz
+/samba-4.16.0rc2.tar.asc
+/samba-4.16.0rc3.tar.xz
+/samba-4.16.0rc3.tar.asc
+/samba-4.16.0rc4.tar.xz
+/samba-4.16.0rc4.tar.asc
+/samba-4.16.0rc5.tar.xz
+/samba-4.16.0rc5.tar.asc
+/samba-4.16.0.tar.xz
+/samba-4.16.0.tar.asc
+/samba-4.16.1.tar.xz
+/samba-4.16.1.tar.asc
+/samba-4.16.2.tar.xz
+/samba-4.16.2.tar.asc
+/samba-4.16.3.tar.xz
+/samba-4.16.3.tar.asc
+/samba-4.16.4.tar.xz
+/samba-4.16.4.tar.asc

gating.yaml

@@ -1,6 +0,0 @@
---- !Policy
-product_versions:
-  - fedora-*
-decision_context: bodhi_update_push_stable
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

plans.fmf

@@ -1,4 +0,0 @@
-discover:
-    how: fmf
-execute:
-    how: tmt

rpminspect.yaml

@@ -1,16 +1,12 @@
 ---
-inspections:
-    disttag: off
-
 badfuncs:
     ignore:
-        - /usr/bin/nmbd
         - /usr/bin/nmblookup
         - /usr/bin/smbtorture
         - /usr/lib*/libndr.so.*
         - /usr/lib*/libsmbconf.so.*
-        - /usr/lib*/samba/libgse-private-samba.so
-        - /usr/lib*/samba/libsamba-sockets-private-samba.so
+        - /usr/lib*/samba/libgse-samba4.so
+        - /usr/lib*/samba/libsamba-sockets-samba4.so
         - /usr/lib*/samba/service/nbtd.so
         - /usr/libexec/ctdb/smnotify
         - /usr/sbin/nmbd
@@ -22,14 +18,3 @@ runpath:
 
 abidiff:
     suppression_file: samba.abignore
-
-debuginfo:
-    ignore:
-        - /usr/lib*/libdcerpc-samr.so.*
-
-annocheck:
-    ignore:
-        - /usr/bin/gentest
-        - /usr/bin/locktest
-        - /usr/bin/masktest
-        - /usr/bin/smbtorture

samba-4.16-waf-crypto.patch

@@ -0,0 +1,77 @@
+From 41d3efebcf6abab9119f9b0f97c86c1c48739fee Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Mon, 4 Apr 2022 11:24:04 +0200
+Subject: [PATCH 1/2] waf: Check for GnuTLS earlier
+
+As GnuTLS is an essential part we need to check for it early so we can react on
+GnuTLS features in other wscripts.
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+---
+ wscript | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/wscript b/wscript
+index d8220b35095..5b85d9a1682 100644
+--- a/wscript
++++ b/wscript
+@@ -189,6 +189,8 @@ def configure(conf):
+     conf.RECURSE('dynconfig')
+     conf.RECURSE('selftest')
+ 
++    conf.PROCESS_SEPARATE_RULE('system_gnutls')
++
+     conf.CHECK_CFG(package='zlib', minversion='1.2.3',
+                    args='--cflags --libs',
+                    mandatory=True)
+@@ -297,8 +299,6 @@ def configure(conf):
+     if not conf.CONFIG_GET('KRB5_VENDOR'):
+         conf.PROCESS_SEPARATE_RULE('embedded_heimdal')
+ 
+-    conf.PROCESS_SEPARATE_RULE('system_gnutls')
+-
+     conf.RECURSE('source4/dsdb/samdb/ldb_modules')
+     conf.RECURSE('source4/ntvfs/sysdep')
+     conf.RECURSE('lib/util')
+-- 
+2.35.1
+
+
+From 63701a28116afc1550c23cb5f7b9d6e366fd1270 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Mon, 4 Apr 2022 11:25:31 +0200
+Subject: [PATCH 2/2] third_party:waf: Do not recurse in aesni-intel if GnuTLS
+ provides the cipher
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+---
+ third_party/wscript | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/third_party/wscript b/third_party/wscript
+index 1f4bc1ce1d7..a17c15bcaa7 100644
+--- a/third_party/wscript
++++ b/third_party/wscript
+@@ -5,7 +5,8 @@ from waflib import Options
+ def configure(conf):
+     conf.RECURSE('cmocka')
+     conf.RECURSE('popt')
+-    conf.RECURSE('aesni-intel')
++    if not conf.CONFIG_SET('HAVE_GNUTLS_AES_CMAC'):
++        conf.RECURSE('aesni-intel')
+     if conf.CONFIG_GET('ENABLE_SELFTEST'):
+         conf.RECURSE('socket_wrapper')
+         conf.RECURSE('nss_wrapper')
+@@ -18,7 +19,8 @@ def configure(conf):
+ def build(bld):
+     bld.RECURSE('cmocka')
+     bld.RECURSE('popt')
+-    bld.RECURSE('aesni-intel')
++    if not bld.CONFIG_SET('HAVE_GNUTLS_AES_CMAC'):
++        bld.RECURSE('aesni-intel')
+     if bld.CONFIG_GET('SOCKET_WRAPPER'):
+         bld.RECURSE('socket_wrapper')
+     if bld.CONFIG_GET('NSS_WRAPPER'):
+-- 
+2.35.1
+

samba-4.23-fix-cmocka.patch

@@ -1,38 +0,0 @@
-From b1ec803f420b2c6d3c5c83d70c6875a7f36b15fc Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Fri, 21 Nov 2025 15:33:32 +0100
-Subject: [PATCH] s4:dsdb: Do not declare cm_print_error()
-
-This is part of the cmocka.h header file.
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
-Reviewed-by: Martin Schwenke <martin@meltin.net>
-Reviewed-by: Volker Lendecke <vl@samba.org>
-
-Autobuild-User(master): Volker Lendecke <vl@samba.org>
-Autobuild-Date(master): Mon Nov 24 11:28:08 UTC 2025 on atb-devel-224
-
-(cherry picked from commit 5a981663e4f677042ba80191770100aecff2120a)
----
- source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
-index f7075f3485e..12c464b49c7 100644
---- a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
-+++ b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
-@@ -103,11 +103,6 @@ void audit_message_send(
- 
- #define check_group_change_message(m, u, a, e)                                 \
- 	_check_group_change_message(m, u, a, e, __FILE__, __LINE__);
--/*
-- * declare the internal cmocka cm_print_error so that we can output messages
-- * in sub unit format
-- */
--void cm_print_error(const char * const format, ...);
- 
- /*
-  * Validate a group change JSON audit message
--- 
-2.52.0
-

samba-s4u.patch

@@ -0,0 +1,642 @@
+From 5d7ec9a00b6f4c6768c606d37d235415f2006445 Mon Sep 17 00:00:00 2001
+From: Isaac Boukris <iboukris@gmail.com>
+Date: Fri, 27 Sep 2019 18:25:03 +0300
+Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support
+
+Signed-off-by: Isaac Boukris <iboukris@gmail.com>
+Pair-Programmed-With: Andreas Schneider <asn@samba.org>
+---
+ source4/kdc/mit-kdb/kdb_samba_policies.c | 124 +++++++++++------------
+ source4/kdc/mit_samba.c                  |  47 ++-------
+ source4/kdc/mit_samba.h                  |   6 +-
+ 3 files changed, 71 insertions(+), 106 deletions(-)
+
+diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c
+index 793fe366c35..22534c09974 100644
+--- a/source4/kdc/mit-kdb/kdb_samba_policies.c
++++ b/source4/kdc/mit-kdb/kdb_samba_policies.c
+@@ -200,13 +200,17 @@ static krb5_error_code ks_verify_pac(krb5_context context,
+ 				     krb5_keyblock *krbtgt_key,
+ 				     krb5_timestamp authtime,
+ 				     krb5_authdata **tgt_auth_data,
+-				     krb5_pac *pac)
++				     krb5_pac *out_pac)
+ {
+ 	struct mit_samba_context *mit_ctx;
+ 	krb5_authdata **authdata = NULL;
+-	krb5_pac ipac = NULL;
+-	DATA_BLOB logon_data = { NULL, 0 };
++	krb5_keyblock *header_server_key = NULL;
++	krb5_key_data *impersonator_kd = NULL;
++	krb5_keyblock impersonator_key = {0};
+ 	krb5_error_code code;
++	krb5_pac pac;
++
++	*out_pac = NULL;
+ 
+ 	mit_ctx = ks_get_context(context);
+ 	if (mit_ctx == NULL) {
+@@ -238,41 +242,43 @@ static krb5_error_code ks_verify_pac(krb5_context context,
+ 	code = krb5_pac_parse(context,
+ 			      authdata[0]->contents,
+ 			      authdata[0]->length,
+-			      &ipac);
++			      &pac);
+ 	if (code != 0) {
+ 		goto done;
+ 	}
+ 
+-	/* TODO: verify this is correct
+-	 *
+-	 * In the constrained delegation case, the PAC is from a service
+-	 * ticket rather than a TGT; we must verify the server and KDC
+-	 * signatures to assert that the server did not forge the PAC.
++	/*
++	 * For constrained delegation in MIT version < 1.18 we aren't provided
++	 * with the 2nd ticket server key to verify the PAC.
++	 * We can workaround that by fetching the key from the client db entry,
++	 * which is the impersonator account in that version.
++	 * TODO: use the provided entry in the new 1.18 version.
+ 	 */
+ 	if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {
+-		code = krb5_pac_verify(context,
+-				       ipac,
+-				       authtime,
+-				       client_princ,
+-				       server_key,
+-				       krbtgt_key);
++		/* The impersonator must be local. */
++		if (client == NULL) {
++			code = KRB5KDC_ERR_BADOPTION;
++			goto done;
++		}
++		/* Fetch and decrypt 2nd ticket server's current key. */
++		code = krb5_dbe_find_enctype(context, client, -1, -1, 0,
++					     &impersonator_kd);
++		if (code != 0) {
++			goto done;
++		}
++		code = krb5_dbe_decrypt_key_data(context, NULL,
++						 impersonator_kd,
++						 &impersonator_key, NULL);
++		if (code != 0) {
++			goto done;
++		}
++		header_server_key = &impersonator_key;
+ 	} else {
+-		code = krb5_pac_verify(context,
+-				       ipac,
+-				       authtime,
+-				       client_princ,
+-				       krbtgt_key,
+-				       NULL);
+-	}
+-	if (code != 0) {
+-		goto done;
++		header_server_key = krbtgt_key;
+ 	}
+ 
+-	/* check and update PAC */
+-	code = krb5_pac_parse(context,
+-			      authdata[0]->contents,
+-			      authdata[0]->length,
+-			      pac);
++	code = krb5_pac_verify(context, pac, authtime, client_princ,
++			       header_server_key, NULL);
+ 	if (code != 0) {
+ 		goto done;
+ 	}
+@@ -280,17 +286,22 @@ static krb5_error_code ks_verify_pac(krb5_context context,
+ 	code = mit_samba_reget_pac(mit_ctx,
+ 				   context,
+ 				   flags,
+-				   client_princ,
+ 				   client,
+ 				   server,
+ 				   krbtgt,
+ 				   krbtgt_key,
+-				   pac);
++				   &pac);
++	if (code != 0) {
++		goto done;
++	}
++
++	*out_pac = pac;
++	pac = NULL;
+ 
+ done:
++	krb5_free_keyblock_contents(context, &impersonator_key);
+ 	krb5_free_authdata(context, authdata);
+-	krb5_pac_free(context, ipac);
+-	free(logon_data.data);
++	krb5_pac_free(context, pac);
+ 
+ 	return code;
+ }
+@@ -319,6 +330,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 	krb5_authdata **pac_auth_data = NULL;
+ 	krb5_authdata **authdata = NULL;
+ 	krb5_boolean is_as_req;
++	krb5_const_principal pac_client;
+ 	krb5_error_code code;
+ 	krb5_pac pac = NULL;
+ 	krb5_data pac_data;
+@@ -330,11 +342,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 	krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt;
+ 	krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key;
+ 
+-	/* FIXME: We don't support S4U yet */
+-	if (flags & KRB5_KDB_FLAGS_S4U) {
+-		return KRB5_KDB_DBTYPE_NOSUP;
+-	}
+-
+ 	is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
+ 
+ 	/*
+@@ -395,6 +402,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 		ks_client_princ = client->princ;
+ 	}
+ 
++	/* In protocol transition, we are currently not provided with the tgt
++	 * client name to verify the PAC, we could probably skip the name
++	 * verification and just verify the signatures, but since we don't
++	 * support cross-realm nor aliases, we can just use server->princ */
++	if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) {
++		pac_client = server->princ;
++	} else {
++		pac_client = ks_client_princ;
++	}
++
+ 	if (client_entry == NULL) {
+ 		client_entry = client;
+ 	}
+@@ -469,7 +486,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 
+ 			code = ks_verify_pac(context,
+ 					     flags,
+-					     ks_client_princ,
++					     pac_client,
+ 					     client_entry,
+ 					     server,
+ 					     krbtgt,
+@@ -515,7 +532,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 		  is_as_req ? "AS-REQ" : "TGS-REQ",
+ 		  client_name);
+ 	code = krb5_pac_sign(context, pac, authtime, ks_client_princ,
+-			server_key, krbtgt_key, &pac_data);
++			     server_key, krbtgt_key, &pac_data);
+ 	if (code != 0) {
+ 		DBG_ERR("krb5_pac_sign failed: %d\n", code);
+ 		goto done;
+@@ -541,12 +558,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 					      KRB5_AUTHDATA_IF_RELEVANT,
+ 					      authdata,
+ 					      signed_auth_data);
+-	if (code != 0) {
+-		goto done;
+-	}
+-
+-	code = 0;
+-
+ done:
+ 	if (client_entry != NULL && client_entry != client) {
+ 		ks_free_principal(context, client_entry);
+@@ -572,32 +583,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
+ 	 * server; -> delegating service
+ 	 * proxy; -> target principal
+ 	 */
+-	krb5_db_entry *delegating_service = discard_const_p(krb5_db_entry, server);
+-
+-	char *target_name = NULL;
+-	bool is_enterprise;
+-	krb5_error_code code;
+ 
+ 	mit_ctx = ks_get_context(context);
+ 	if (mit_ctx == NULL) {
+ 		return KRB5_KDB_DBNOTINITED;
+ 	}
+ 
+-	code = krb5_unparse_name(context, proxy, &target_name);
+-	if (code) {
+-		goto done;
+-	}
+-
+-	is_enterprise = (proxy->type == KRB5_NT_ENTERPRISE_PRINCIPAL);
+-
+-	code = mit_samba_check_s4u2proxy(mit_ctx,
+-					 delegating_service,
+-					 target_name,
+-					 is_enterprise);
+-
+-done:
+-	free(target_name);
+-	return code;
++	return mit_samba_check_s4u2proxy(mit_ctx, server, proxy);
+ }
+ 
+ 
+diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
+index cb72b5de294..03c2c2ea1de 100644
+--- a/source4/kdc/mit_samba.c
++++ b/source4/kdc/mit_samba.c
+@@ -517,7 +517,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
+ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+ 				    krb5_context context,
+ 				    int flags,
+-				    krb5_const_principal client_principal,
+ 				    krb5_db_entry *client,
+ 				    krb5_db_entry *server,
+ 				    krb5_db_entry *krbtgt,
+@@ -689,7 +688,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+ 								  context,
+ 								  *pac,
+ 								  server->princ,
+-								  discard_const(client_principal),
++								  client->princ,
+ 								  deleg_blob);
+ 		if (!NT_STATUS_IS_OK(nt_status)) {
+ 			DEBUG(0, ("Update delegation info failed: %s\n",
+@@ -1081,41 +1080,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
+ }
+ 
+ int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
+-			      krb5_db_entry *kentry,
+-			      const char *target_name,
+-			      bool is_nt_enterprise_name)
++			      const krb5_db_entry *server,
++			      krb5_const_principal target_principal)
+ {
+-#if 1
+-	/*
+-	 * This is disabled because mit_samba_update_pac_data() does not handle
+-	 * S4U_DELEGATION_INFO
+-	 */
+-
+-	return KRB5KDC_ERR_BADOPTION;
+-#else
+-	krb5_principal target_principal;
+-	int flags = 0;
+-	int ret;
+-
+-	if (is_nt_enterprise_name) {
+-		flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE;
+-	}
+-
+-	ret = krb5_parse_name_flags(ctx->context, target_name,
+-				    flags, &target_principal);
+-	if (ret) {
+-		return ret;
+-	}
+-
+-	ret = samba_kdc_check_s4u2proxy(ctx->context,
+-					ctx->db_ctx,
+-					skdc_entry,
+-					target_principal);
+-
+-	krb5_free_principal(ctx->context, target_principal);
+-
+-	return ret;
+-#endif
++	struct samba_kdc_entry *server_skdc_entry =
++		 talloc_get_type_abort(server->e_data,
++				       struct samba_kdc_entry);
++
++	return samba_kdc_check_s4u2proxy(ctx->context,
++					 ctx->db_ctx,
++					 server_skdc_entry,
++					 target_principal);
+ }
+ 
+ static krb5_error_code mit_samba_change_pwd_error(krb5_context context,
+diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h
+index 4431e82a1b2..9370ab533af 100644
+--- a/source4/kdc/mit_samba.h
++++ b/source4/kdc/mit_samba.h
+@@ -57,7 +57,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
+ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+ 				    krb5_context context,
+ 				    int flags,
+-				    krb5_const_principal client_principal,
+ 				    krb5_db_entry *client,
+ 				    krb5_db_entry *server,
+ 				    krb5_db_entry *krbtgt,
+@@ -74,9 +73,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
+ 				  DATA_BLOB *e_data);
+ 
+ int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
+-			      krb5_db_entry *kentry,
+-			      const char *target_name,
+-			      bool is_nt_enterprise_name);
++			      const krb5_db_entry *server,
++			      krb5_const_principal target_principal);
+ 
+ int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,
+ 				      char *pwd,
+-- 
+2.37.1
+
+
+From 325912375cf54743ab8ea557172a72b870002e9f Mon Sep 17 00:00:00 2001
+From: Isaac Boukris <iboukris@gmail.com>
+Date: Fri, 27 Sep 2019 18:35:30 +0300
+Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build
+
+Signed-off-by: Isaac Boukris <iboukris@gmail.com>
+Pair-Programmed-With: Andreas Schneider <asn@samba.org>
+---
+ lib/krb5_wrap/krb5_samba.c            | 185 ++++++++++++++++++++++++++
+ lib/krb5_wrap/krb5_samba.h            |   2 -
+ source4/auth/kerberos/kerberos_util.c |  11 --
+ 3 files changed, 185 insertions(+), 13 deletions(-)
+
+diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
+index 4321f07ca09..3fd95e47fca 100644
+--- a/lib/krb5_wrap/krb5_samba.c
++++ b/lib/krb5_wrap/krb5_samba.c
+@@ -2702,6 +2702,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
+ 
+ 	return 0;
+ }
++
++#else /* MIT */
++
++static bool princ_compare_no_dollar(krb5_context ctx,
++				    krb5_principal a,
++				    krb5_principal b)
++{
++	bool cmp;
++	krb5_principal mod = NULL;
++
++	if (a->length == 1 && b->length == 1 &&
++	    a->data[0].length != 0 && b->data[0].length != 0 &&
++	    a->data[0].data[a->data[0].length -1] !=
++	    b->data[0].data[b->data[0].length -1]) {
++		if (a->data[0].data[a->data[0].length -1] == '$') {
++			mod = a;
++			mod->data[0].length--;
++		} else if (b->data[0].data[b->data[0].length -1] == '$') {
++			mod = b;
++			mod->data[0].length--;
++		}
++	}
++
++	cmp = krb5_principal_compare_flags(ctx, a, b,
++					   KRB5_PRINCIPAL_COMPARE_CASEFOLD);
++
++	if (mod != NULL) {
++		mod->data[0].length++;
++	}
++
++	return cmp;
++}
++
++krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
++					   krb5_ccache store_cc,
++					   krb5_principal init_principal,
++					   const char *init_password,
++					   krb5_principal impersonate_principal,
++					   const char *self_service,
++					   const char *target_service,
++					   krb5_get_init_creds_opt *krb_options,
++					   time_t *expire_time,
++					   time_t *kdc_time)
++{
++	krb5_error_code code;
++	krb5_principal self_princ = NULL;
++	krb5_principal target_princ = NULL;
++	krb5_creds *store_creds;
++	krb5_creds *s4u2self_creds = NULL;
++	krb5_creds *s4u2proxy_creds = NULL;
++	krb5_creds init_creds = {0};
++	krb5_creds mcreds = {0};
++	krb5_flags options = KRB5_GC_NO_STORE;
++	krb5_ccache tmp_cc;
++	bool s4u2proxy;
++
++	code = krb5_cc_new_unique(ctx, "MEMORY", NULL, &tmp_cc);
++	if (code != 0) {
++		return code;
++	}
++
++	code = krb5_get_init_creds_password(ctx, &init_creds,
++					    init_principal,
++					    init_password,
++					    NULL, NULL,
++					    0,
++					    NULL,
++					    krb_options);
++	if (code != 0) {
++		goto done;
++	}
++
++	code = krb5_cc_initialize(ctx, tmp_cc, init_creds.client);
++	if (code != 0) {
++		goto done;
++	}
++
++	code = krb5_cc_store_cred(ctx, tmp_cc, &init_creds);
++	if (code != 0) {
++		goto done;
++	}
++
++	/*
++	 * Check if we also need S4U2Proxy or if S4U2Self is
++	 * enough in order to get a ticket for the target.
++	 */
++	if (target_service == NULL) {
++		s4u2proxy = false;
++	} else if (strcmp(target_service, self_service) == 0) {
++		s4u2proxy = false;
++	} else {
++		s4u2proxy = true;
++	}
++
++	code = krb5_parse_name(ctx, self_service, &self_princ);
++	if (code != 0) {
++		goto done;
++	}
++
++	/* MIT lacks aliases support in S4U, for S4U2Self we require the tgt
++	 * client and the request server to be the same principal name. */
++	if (!princ_compare_no_dollar(ctx, init_creds.client, self_princ)) {
++		code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
++		goto done;
++	}
++
++	mcreds.client = impersonate_principal;
++	mcreds.server = init_creds.client;
++
++	code = krb5_get_credentials_for_user(ctx, options, tmp_cc, &mcreds,
++					     NULL, &s4u2self_creds);
++	if (code != 0) {
++		goto done;
++	}
++
++	if (s4u2proxy) {
++		code = krb5_parse_name(ctx, target_service, &target_princ);
++		if (code != 0) {
++			goto done;
++		}
++
++		mcreds.client = init_creds.client;
++		mcreds.server = target_princ;
++		mcreds.second_ticket = s4u2self_creds->ticket;
++
++		code = krb5_get_credentials(ctx, options |
++					    KRB5_GC_CONSTRAINED_DELEGATION,
++					    tmp_cc, &mcreds, &s4u2proxy_creds);
++		if (code != 0) {
++			goto done;
++		}
++
++		/* Check KDC support of S4U2Proxy extension */
++		if (!krb5_principal_compare(ctx, s4u2self_creds->client,
++					    s4u2proxy_creds->client)) {
++			code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
++			goto done;
++		}
++
++		store_creds = s4u2proxy_creds;
++	} else {
++		store_creds = s4u2self_creds;;
++
++		/* We need to save the ticket with the requested server name
++		 * or the caller won't be able to find it in cache. */
++		if (!krb5_principal_compare(ctx, self_princ,
++			store_creds->server)) {
++			krb5_free_principal(ctx, store_creds->server);
++			store_creds->server = NULL;
++			code = krb5_copy_principal(ctx, self_princ,
++						   &store_creds->server);
++			if (code != 0) {
++				goto done;
++			}
++		}
++	}
++
++	code = krb5_cc_initialize(ctx, store_cc, store_creds->client);
++	if (code != 0) {
++		goto done;
++	}
++
++	code = krb5_cc_store_cred(ctx, store_cc, store_creds);
++	if (code != 0) {
++		goto done;
++	}
++
++	if (expire_time) {
++		*expire_time = (time_t) store_creds->times.endtime;
++	}
++
++	if (kdc_time) {
++		*kdc_time = (time_t) store_creds->times.starttime;
++	}
++
++done:
++	krb5_cc_destroy(ctx, tmp_cc);
++	krb5_free_cred_contents(ctx, &init_creds);
++	krb5_free_creds(ctx, s4u2self_creds);
++	krb5_free_creds(ctx, s4u2proxy_creds);
++	krb5_free_principal(ctx, self_princ);
++	krb5_free_principal(ctx, target_princ);
++
++	return code;
++}
+ #endif
+ 
+ #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA)
+diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h
+index a66b7465530..c8573f52bd9 100644
+--- a/lib/krb5_wrap/krb5_samba.h
++++ b/lib/krb5_wrap/krb5_samba.h
+@@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx,
+ 					       krb5_get_init_creds_opt *krb_options,
+ 					       time_t *expire_time,
+ 					       time_t *kdc_time);
+-#ifdef SAMBA4_USES_HEIMDAL
+ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
+ 					   krb5_ccache store_cc,
+ 					   krb5_principal init_principal,
+@@ -263,7 +262,6 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
+ 					   krb5_get_init_creds_opt *krb_options,
+ 					   time_t *expire_time,
+ 					   time_t *kdc_time);
+-#endif
+ 
+ #if defined(HAVE_KRB5_MAKE_PRINCIPAL)
+ #define smb_krb5_make_principal krb5_make_principal
+diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c
+index 544d9d853cc..c14d8c72d8c 100644
+--- a/source4/auth/kerberos/kerberos_util.c
++++ b/source4/auth/kerberos/kerberos_util.c
+@@ -234,9 +234,7 @@ done:
+ {
+ 	krb5_error_code ret;
+ 	const char *password;
+-#ifdef SAMBA4_USES_HEIMDAL
+ 	const char *self_service;
+-#endif
+ 	const char *target_service;
+ 	time_t kdc_time = 0;
+ 	krb5_principal princ;
+@@ -268,9 +266,7 @@ done:
+ 		return ret;
+ 	}
+ 
+-#ifdef SAMBA4_USES_HEIMDAL
+ 	self_service = cli_credentials_get_self_service(credentials);
+-#endif
+ 	target_service = cli_credentials_get_target_service(credentials);
+ 
+ 	password = cli_credentials_get_password(credentials);
+@@ -331,7 +327,6 @@ done:
+ #endif
+ 		if (password) {
+ 			if (impersonate_principal) {
+-#ifdef SAMBA4_USES_HEIMDAL
+ 				ret = smb_krb5_kinit_s4u2_ccache(smb_krb5_context->krb5_context,
+ 								 ccache,
+ 								 princ,
+@@ -342,12 +337,6 @@ done:
+ 								 krb_options,
+ 								 NULL,
+ 								 &kdc_time);
+-#else
+-				talloc_free(mem_ctx);
+-				(*error_string) = "INTERNAL error: s4u2 ops "
+-					"are not supported with MIT build yet";
+-				return EINVAL;
+-#endif
+ 			} else {
+ 				ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context,
+ 								     ccache,
+-- 
+2.37.1
+
+
+From a5713b1558192f24348f7794da84bf65cf78e6ec Mon Sep 17 00:00:00 2001
+From: Isaac Boukris <iboukris@gmail.com>
+Date: Sat, 19 Sep 2020 14:16:20 +0200
+Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code
+
+---
+ source4/kdc/mit_samba.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
+index 03c2c2ea1de..30fade56531 100644
+--- a/source4/kdc/mit_samba.c
++++ b/source4/kdc/mit_samba.c
+@@ -232,6 +232,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx,
+ 	if (kflags & KRB5_KDB_FLAG_CANONICALIZE) {
+ 		sflags |= SDB_F_CANON;
+ 	}
++#if KRB5_KDB_API_VERSION >= 10
++	sflags |= SDB_F_FORCE_CANON;
++#endif
+ 	if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY |
+ 		      KRB5_KDB_FLAG_INCLUDE_PAC)) {
+ 		/*
+-- 
+2.37.1
+

samba-systemd-sysusers.conf

@@ -1,2 +0,0 @@
-#Type Name       ID
-g     printadmin -

samba-usershares-systemd-sysusers.conf

@@ -1,2 +0,0 @@
-#Type Name       ID
-g     usershares -

samba-winbind-systemd-sysusers.conf

@@ -1,2 +0,0 @@
-#Type Name       ID
-g     wbpriv     88

samba.logrotate

@@ -1,4 +1,4 @@
-/var/log/samba/*log* {
+/var/log/samba/log.* {
     compress
     dateext
     maxage 365

smb.conf.example

@@ -269,13 +269,6 @@
 ;	map system = no
 ;	store dos attributes = yes
 
-# Turn on SMB 3.1.1 Unix Extensions by default
-#
-# Note: The Linux Kernel SMB3 client will negotiate unix extensions by default,
-# find more info in man mount.smb3(8). Linux 6.13 will finally support special
-# filetypes and symlink handling.
-
-	smb3 unix extensions = yes
 
 #============================ Share Definitions ==============================
 

smb.conf.vendor

@@ -18,9 +18,6 @@
 	load printers = yes
 	cups options = raw
 
-	# Install samba-usershares package for support
-	include = /etc/samba/usershares.conf
-
 [homes]
 	comment = Home Directories
 	valid users = %S, %D%w%S
@@ -38,8 +35,7 @@
 [print$]
 	comment = Printer Drivers
 	path = /var/lib/samba/drivers
-	# printadmin is a local group
-	write list = printadmin root
-	force group = printadmin
+	write list = @printadmin root
+	force group = @printadmin
 	create mask = 0664
 	directory mask = 0775

sources

@@ -1,2 +1,2 @@
-SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac
-SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce
+SHA512 (samba-4.16.4.tar.xz) = 263c33f202462c50ba9205232cc59f17eef6526bbe97cc1c6be6606e5e2fa8e235f24693da5ef00106ed126c5e2e1d83e2cfc0d2a690303ac94a8737e6760e95
+SHA512 (samba-4.16.4.tar.asc) = aec1d0dc15169dfa0f68776cff083b8a9ecfeb348d20cde02e236eda3548e1df13f6df3e9275ede6e8fdc6193b2fd304d2f493507b49f5877dbb6b7181d90367

tests/deps-check.fmf

@@ -1,22 +0,0 @@
-summary: Check samba package dependency structure
-description: |
-    Verify that samba library packages maintain correct dependency hierarchy:
-    - samba-core-libs has no samba-*-libs dependencies
-    - samba-ndr-libs depends on samba-core-libs (not samba-client-libs or samba-libs)
-    - samba-client-libs depends on core-libs + ndr-libs (not samba-libs)
-    - samba-client depends on samba-client-libs (not samba-libs)
-    - samba-libs does not depend on samba-dc-libs
-    - libsmbclient depends on samba-client-libs (not samba-libs)
-    - libwbclient has no samba-*-libs dependencies
-    - libldb has no samba-*-libs dependencies
-test: ./deps-check.sh
-framework: shell
-require:
-  - samba-core-libs
-  - samba-ndr-libs
-  - samba-client-libs
-  - samba-libs
-  - samba-client
-  - libwbclient
-  - libsmbclient
-  - libldb

tests/deps-check.sh

@@ -1,167 +0,0 @@
-#!/bin/bash
-#
-# Samba package dependency structure verification
-#
-# This test ensures that the samba library package dependencies don't regress.
-# The expected hierarchy is:
-#
-#   samba-core-libs    (no samba-*-libs dependencies)
-#        ^
-#        |
-#   samba-ndr-libs     (depends on samba-core-libs only)
-#        ^
-#        |
-#   samba-client-libs  (depends on samba-core-libs + samba-ndr-libs)
-#
-#   libwbclient        (no samba-*-libs dependencies - only links to libc)
-#
-#   samba-client       (depends on samba-client-libs, NOT samba-libs)
-#   libsmbclient       (depends on samba-client-libs, NOT samba-libs)
-#
-# NOTE: This test checks RESOLVED dependencies, not just explicit Requires.
-# A library requirement like 'libfoo.so' is resolved to the package that
-# provides it, ensuring we catch indirect dependencies.
-#
-
-set -e
-
-ERRORS=0
-
-# Get all packages that a package depends on (resolved)
-# This resolves library deps like 'libfoo.so' to actual package names
-get_resolved_deps() {
-    local pkg="$1"
-
-    rpm --query --requires "$pkg" 2>/dev/null | while read -r req; do
-        # Skip rpmlib and config requirements
-        [[ "$req" =~ ^rpmlib ]] && continue
-        [[ "$req" =~ ^config ]] && continue
-        [[ "$req" =~ ^/ ]] && continue
-
-        # Get the package that provides this requirement
-        provider=$(rpm --query --whatprovides "$req" 2>/dev/null | head -1)
-        if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then
-            # Extract just the package name (remove version-release.arch)
-            echo "${provider%%-[0-9]*}"
-        fi
-    done | sort -u
-}
-
-# Check that a package does NOT depend on packages matching a pattern
-# This checks RESOLVED dependencies (what packages actually get pulled in)
-check_no_resolved_dep() {
-    local pkg="$1"
-    local pattern="$2"
-    local description="$3"
-
-    if ! rpm --query "$pkg" &>/dev/null; then
-        echo "SKIP: $pkg not installed"
-        return 0
-    fi
-
-    local bad_deps
-    # Exclude the package itself from the check
-    bad_deps=$(get_resolved_deps "$pkg" | grep -v "^${pkg}$" | grep -E "$pattern" || true)
-
-    if [ -n "$bad_deps" ]; then
-        echo "FAIL: $pkg depends on $description"
-        echo "  Found: $bad_deps"
-        ERRORS=$((ERRORS + 1))
-        return 1
-    fi
-    echo "PASS: $pkg does not depend on $description"
-    return 0
-}
-
-# Check that a package DOES depend on a specific package
-check_has_resolved_dep() {
-    local pkg="$1"
-    local expected="$2"
-
-    if ! rpm --query "$pkg" &>/dev/null; then
-        echo "SKIP: $pkg not installed"
-        return 0
-    fi
-
-    if get_resolved_deps "$pkg" | grep -qF "$expected"; then
-        echo "PASS: $pkg depends on $expected"
-        return 0
-    fi
-    echo "FAIL: $pkg does not depend on $expected"
-    ERRORS=$((ERRORS + 1))
-    return 1
-}
-
-echo "=== Samba Package Dependency Checks ==="
-echo ""
-echo "Checking resolved dependencies (library deps resolved to packages)"
-echo ""
-
-# 1. samba-core-libs must NOT depend on any samba-*-libs packages
-echo "--- samba-core-libs ---"
-check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba*-libs package"
-
-echo ""
-
-# 2. samba-ndr-libs must depend on samba-core-libs
-#    but NOT samba-client-libs or samba-libs
-echo "--- samba-ndr-libs ---"
-check_has_resolved_dep samba-ndr-libs "samba-core-libs"
-check_no_resolved_dep samba-ndr-libs "^samba-client-libs$" "samba-client-libs"
-check_no_resolved_dep samba-ndr-libs "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 3. samba-client-libs must depend on samba-core-libs and samba-ndr-libs
-#    but NOT samba-libs
-echo "--- samba-client-libs ---"
-check_has_resolved_dep samba-client-libs "samba-core-libs"
-check_has_resolved_dep samba-client-libs "samba-ndr-libs"
-check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 4. libwbclient must NOT depend on any samba-*-libs packages
-echo "--- libwbclient ---"
-check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba*-libs package"
-
-echo ""
-
-# 5. samba-client must depend on samba-client-libs but NOT samba-libs
-#    (client tools should not pull in server libraries)
-echo "--- samba-client ---"
-check_has_resolved_dep samba-client "samba-client-libs"
-check_no_resolved_dep samba-client "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 6. libsmbclient must depend on samba-client-libs but NOT samba-libs
-#    (SMB client library should not pull in server libraries)
-echo "--- libsmbclient ---"
-check_has_resolved_dep libsmbclient "samba-client-libs"
-check_no_resolved_dep libsmbclient "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 7. libldb must NOT depend on any samba-*-libs packages
-#    (libldb is a standalone database library)
-echo "--- libldb ---"
-check_no_resolved_dep libldb "^samba-.*-libs$" "any samba*-libs package"
-
-echo ""
-
-# 8. samba-libs must NOT depend on samba-dc-libs
-#    (server libraries should not pull in DC-specific libraries)
-echo "--- samba-libs ---"
-check_no_resolved_dep samba-libs "^samba-dc-libs$" "samba-dc-libs"
-
-echo ""
-echo "=== Summary ==="
-
-if [ $ERRORS -gt 0 ]; then
-    echo "FAILED: $ERRORS dependency check(s) failed"
-    exit 1
-fi
-
-echo "All dependency checks passed"
-exit 0

usershares.conf.vendor

@@ -1,3 +0,0 @@
-[global]
-	usershare max shares = 100
-	usershare allow guests = yes