Accepting request 1323105 from network:samba:STABLE

OBS-URL: https://build.opensuse.org/request/show/1323105
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/samba?expand=0&rev=325

_service

@@ -2,7 +2,7 @@
         <service name="tar_scm" mode="manual">
                 <param name="url">https://gitlab.suse.de/samba/suse-samba.git/</param>
                 <param name="scm">git</param>
-                <param name="revision">factory-4-22-stable</param>
+                <param name="revision">factory-4-23-stable</param>
                 <param name="versionformat">@PARENT_TAG@+git.@TAG_OFFSET@.%h</param>
                 <param name="versionrewrite-pattern">samba-(.*)</param>
                 <param name="versionrewrite-replacement">\1</param>

samba-4.23.4+git.428.6b48e7eba5b.tar.bz2

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:03adbe746df71e750942fe450a72e61704e170e15bddad2fc96bac40b2e243a7
+size 45355211

samba.changes

@@ -1,3 +1,169 @@
+-------------------------------------------------------------------
+Fri Dec 12 15:42:05 UTC 2025 - Noel Power <nopower@suse.com>
+
+- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
+  (bso#15790); (bsc#1249058).
+
+-------------------------------------------------------------------
+Tue Dec  9 11:18:45 UTC 2025 - Noel Power <nopower@suse.com>
+
+- Update to 4.23.4
+  * Samba 4.22 breaks Time Machine; (bso#15926).
+  * mdssvc doesn't support $time.iso dates before 1970;
+    (bso#15947).
+  * Fix winbind cache consistency; (bso#15963).
+  * Assert failed: (dirfd != -1) || (smb_fname->base_name[0] ==
+    '/') in vfswrap_openat; (bso#15897).
+  * ctdb can crash with inconsistent cluster lock configuration;
+    (bso#15950).
+  * samba-bgqd: rework man page; (bso#15809).
+  * samba-bgqd can't find [printers] share; (bso#15936).
+  * Winbind can hang forever in gssapi if there are network
+    issues; (bso#15955).
+  * libldb requires linking libreplace on Linux; (bso#15961).
+
+- Update to 4.23.3
+  * Spotlight search restriction for shares incomplete and
+    default search searches in too many attributes; (bso#15927).
+  * Searching for numbers doesn't work with Spotlight;
+    (bso#15930).
+  * rpcd_mdssvc may crash because name mangling is not
+    initialized; (bso#15931).
+  * Only increment lease epoch if a lease was granted;
+    (bso#15933).
+  * vfs_recycle does not update mtime; (bso#15940).
+  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
+    can't decode byte; (bso#15943).
+  * Crash in ctdbd on failed updateip; (bso#15935).
+
+- Update to 4.23.2
+  * CVE-2025-10230: Command injection via WINS server hook
+    script (bso#15903); (bsc#1251280).
+  * CVE-2025-9640: uninitialized memory disclosure via
+    vfs_streams_xattr; (bso#15885); (bsc#1251279).
+
+- Update to 4.23.1
+  * Incomplete bind configuration causes DLZ plugin to crash;
+    (bso#15920).
+  * winbind can crash at startup; (bso#15914).
+  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
+    for fsync_send; (bso#15919).
+  * CTDB does not support PCP 7.0.0; (bso#15904).
+  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
+    (bso#15921).
+
+- Update to 4.23.0
+  * samba.tests.safe_tarfile fails on Python 3.13 with additional
+    security fixes for tarfile support; (bso#15911).
+  * samba-4.21 fails to join AD when multiple DCs are returned;
+    (bso#15905).
+  * Uninitialized read leads to hanging rpcd_spoolss;
+    (bso#15908).
+  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
+    (bso#15907).
+  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
+  * 'net ads group' failed to list domain groups; (bso#15900).
+  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
+  * Self-signed certificates don't have X509v3 Subject
+    Alternative Name for DNS; (bso#15899).
+  * Improve handling of principals and realms in client tools;
+    (bso#15893).
+  * libquic build fixes; (bso#15896).
+  * getpwuid does not shift to new DC when current DC is down;
+    (bso#15844).
+  * Windows security hardening locks out schannel'ed netlogon dc
+    calls like netr_DsRGetDCName; (bso#15876).
+
+-------------------------------------------------------------------
+Fri Oct 31 09:44:48 UTC 2025 - Noel Power <noel.power@suse.com>
+
+- Update [printers] location to /var/samba/spool; (bsc#1249179).
+
+-------------------------------------------------------------------
+Tue Oct 21 10:46:14 UTC 2025 - Noel Power <nopower@suse.com>
+
+- Update to 4.22.6
+  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
+  * Samba 4.22 breaks Time Machine; (bso#15926).
+  * Spotlight search restriction for shares incomplete and
+    default search searches in too many attributes; (bso#15927).
+  * rpcd_mdssvc may crash because name mangling is not
+    initialized; (bso#15931).
+  * Only increment lease epoch if a lease was granted;
+    (bso#15933).
+  * samba-4.21 fails to join AD when multiple DCs are returned;
+    (bso#15905).
+  * 'net ads group' failed to list domain groups; (bso#15900).
+  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
+    for fsync_send; (bso#15919).
+  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
+    (bso#15921).
+
+-------------------------------------------------------------------
+Wed Oct 15 12:55:57 UTC 2025 - Noel Power <noel.power@suse.com>
+
+- Update to 4.22.5
+  * CVE-2025-10230: Command injection via WINS server hook
+    script (bso#15903); (bsc#1251280).
+  * CVE-2025-9640: uninitialized memory disclosure via
+    vfs_streams_xattr; (bso#15885); (bsc#1251279).
+
+-------------------------------------------------------------------
+Wed Oct  1 13:38:09 UTC 2025 - Samuel Cabrero <scabrero@suse.de>
+
+- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
+  to a recommends. They are only required if utilizing certificate
+  auto enrollment (bsc#1249087).
+
+-------------------------------------------------------------------
+Thu Sep 25 08:56:20 UTC 2025 - Noel Power <noel.power@suse.com>
+
+- Disable timeouts for smb.service so that possibly slow running
+  ExecStartPre script 'update-samba-security-profile' doesn't
+  cause service start to fail due to timeouts;(bsc#1249181).
+
+-------------------------------------------------------------------
+Thu Sep 25 08:55:56 UTC 2025 - Noel Power <noel.power@suse.com>
+
+- Ensure semanage is pulled in as a requirement when samba in
+  installed when selinux security access mechanism that is used;
+  (bsc#1249180).
+
+-------------------------------------------------------------------
+Thu Sep 25 08:55:22 UTC 2025 - Noel Power <noel.power@suse.com>
+
+- don't attempt to label paths that don't exist, also remove
+  unecessary evaluation of semange & restorecon cmds;(bsc#1249179).
+
+-------------------------------------------------------------------
+Thu Sep 25 08:51:52 UTC 2025 - Noel Power <noel.power@suse.com>
+
+- Update to 4.22.4
+  * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with
+    SysvolReady=0; (bso#14981).
+  * getpwuid does not shift to new DC when current DC is down;
+    (bso#15844).
+  * Windows security hardening locks out schannel'ed netlogon dc
+    calls like netr_DsRGetDCName-; (bso#15876).
+  * Unresponsive second DC can cause idmapping failure when using
+    idmap_ad-; (bso#15881).
+  * kinit command is failing with Missing cache Error;
+    (bso#15840).
+  * Figuring out the DC name from IP address fails and breaks
+    fork_domain_child(); (bso#15891).
+  * vfs_streams_depot fstatat broken; (bso#15816).
+  * Delayed leader broadcast can block ctdb forever; (bso#15892).
+  * Apparently there is a conflict between shadow_copy2 module
+    and virusfilter (action quarantine); (bso#15663).
+  * Fix handling of empty GPO link; (bso#15877).
+  * SMB ACL inheritance doesn't work for files created;
+    (bso#15880).
+
+-------------------------------------------------------------------
+Fri Jul 25 15:41:26 UTC 2025 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- adjust gpgme build dependency for future-proofing
+
 -------------------------------------------------------------------
 Tue Jul  8 08:15:46 UTC 2025 - Samuel Cabrero <scabrero@suse.de>
 

samba.spec

@@ -39,8 +39,8 @@
 %endif
 
 %define talloc_version 2.4.3
-%define tevent_version 0.16.2
-%define tdb_version    1.4.13
+%define tevent_version 0.17.1
+%define tdb_version    1.4.14
 
 # This table represents the possible combinations of build macros.
 # They are defined only if not already defined in the build service
@@ -137,8 +137,9 @@ BuildRequires:  libcephfs-devel
 BuildRequires:  librados-devel
 %endif
 BuildRequires:  libgnutls-devel >= 3.4.7
+BuildRequires:  libngtcp2_crypto_gnutls-devel >= 1.12.0
 %if %{with_dc}
-BuildRequires:  gpgme-devel
+BuildRequires:  pkgconfig(gpgme)
 BuildRequires:  libjansson-devel
 BuildRequires:  python3-gpg
 BuildRequires:  lmdb-devel >= 0.9.16
@@ -168,7 +169,7 @@ BuildRequires:  liburing-devel
 %endif
 BuildRequires:  sysuser-tools
 
-Version:        4.22.3+git.401.c70158430cc
+Version:        4.23.4+git.428.6b48e7eba5b
 Release:        0
 URL:            https://www.samba.org/
 Obsoletes:      samba-32bit < %{version}
@@ -188,6 +189,7 @@ Requires:       %{fillup_prereq}
 Requires:       samba-client >= %{version}
 Requires:       samba-dcerpc = %{version}
 Requires:       sysuser-shadow
+Requires:       (/usr/sbin/semanage if selinux-policy)
 Provides:       group(ntadmin)
 
 %{?systemd_ordering}
@@ -254,6 +256,8 @@ Samba as part of SUSE Linux Enterprise or openSUSE products, links to
 binary packages of the most current Samba version, and a bug reporting
 how to.
 
+%lang_package -n samba-client
+
 %package devel
 Summary:        Development files shared by Samba subpackages
 License:        GPL-3.0-or-later
@@ -419,11 +423,11 @@ that use SMB, RPC and other Samba provided protocols in Python3 programs.
 Summary:        Samba Group Policy
 License:        GPL-3.0-or-later
 Group:          Productivity/Networking/Samba
-Requires:       cepces
-Requires:       certmonger
 Requires:       samba-ldb-ldap = %{version}
 Requires:       samba-python3 = %{version}
-Requires:       sscep
+Recommends:     cepces
+Recommends:     certmonger
+Recommends:     sscep
 
 %description gpupdate
 The samba-gpupdate package provides the samba-gpupdate tool for applying
@@ -484,6 +488,8 @@ Requires(postun):/sbin/ldconfig
 %description winbind-libs
 This package contains the libraries required by the Winbind daemon.
 
+%lang_package -n samba-winbind-libs
+
 %package dcerpc
 Summary:	Samba dcerpc service binaries
 License:        GPL-3.0-or-later
@@ -679,7 +685,7 @@ fi
 export CFLAGS="%{optflags} -D_GNU_SOURCE -D_LARGEFILE64_SOURCE -DIDMAP_RID_SUPPORT_TRUSTED_DOMAINS -I/usr/include/tirpc"
 export LDFLAGS="-ltirpc"
 
-bundled_libraries="NONE"
+bundled_libraries=",libquic"
 %if ! 0%{?with_mscat}
 bundled_libraries+=",libtasn1"
 %endif
@@ -701,6 +707,7 @@ CONFIGURE_OPTIONS="\
 	--enable-debug \
 	--with-profiling-data \
 	--private-libraries=${private_libraries} \
+	--pythonarchdir=%{python3_sitearch}
 %if !%{with_lmdb}
 	--without-ldb-lmdb \
 %endif
@@ -801,6 +808,9 @@ rm \
 	%{buildroot}/%{_unitdir}/samba-ad-dc.service
 %endif
 
+%find_lang pam_winbind
+%find_lang net
+
 # CTDB
 install -m 0644 packaging/SuSE/config/sysconfig.ctdb %{buildroot}/%{_fillupdir}
 ln -s service %{buildroot}/%{_sbindir}/rcctdb
@@ -1205,6 +1215,10 @@ exit 0
 %{_fillupdir}/sysconfig.samba
 %{_sysusersdir}/samba.conf
 
+
+%files client-lang -f net.lang
+%defattr(-,root,root)
+
 %files client
 %defattr(-,root,root)
 %dir %{CONFIGDIR}
@@ -1297,6 +1311,8 @@ exit 0
 %attr(0700,root,root) %dir %{LOCKDIR}/private/msg.sock
 %attr(0750,root,root) %dir %{LOGDIR}
 %ghost %dir %{PIDDIR}
+%ghost %dir %{_var}/samba
+%ghost %dir %{_var}/samba/spool
 %dir %{_tmpfilesdir}
 %{_tmpfilesdir}/samba.conf
 %if %{with_mscat}
@@ -1519,7 +1535,8 @@ exit 0
 %{_libdir}/samba/libsamba3-util-private-samba.so
 %{_libdir}/samba/libsamba-modules-private-samba.so
 %{_libdir}/samba/libsamdb-common-private-samba.so
-%{_libdir}/samba/libsmb-transport-private-samba.so
+%{_libdir}/samba/libsamba-security-trusts-private-samba.so
+%{_libdir}/samba/libquic-private-samba.so
 %{_libdir}/samba/libsmbclient-raw-private-samba.so
 %{_libdir}/samba/libsmbd-base-private-samba.so
 %{_libdir}/samba/libsmbd-shim-private-samba.so
@@ -1539,6 +1556,7 @@ exit 0
 %{_libdir}/samba/libmscat-private-samba.so
 %endif
 %if %{with_dc}
+%{_libdir}/samba/service/ft_scanner.so
 %{_libdir}/samba/libdfs-server-ad-private-samba.so
 %endif
 %dir %{_libdir}/samba/pdb
@@ -1615,6 +1633,9 @@ exit 0
 %{_mandir}/man1/ndrdump.1.*
 %{_mandir}/man1/mdsearch.1.*
 
+%files winbind-libs-lang -f pam_winbind.lang
+%defattr(-,root,root)
+
 %files winbind-libs
 %defattr(-,root,root)
 %{_pam_moduledir}/pam_winbind.so
@@ -1916,6 +1937,9 @@ exit 0
 %{_libdir}/samba/ldb/ldap.so
 %{_libdir}/samba/ldb/ildap.so
 %{_libdir}/samba/ldb/ldbsamba_extensions.so
+%if %{with_dc}
+%{_libdir}/samba/ldb/trust_notify.so
+%endif
 
 %if %{with_dc}
 %files ad-dc-libs