Resolves: RHEL-30640 - Remove libdb requirement from 389-ds-base

.gitignore

@@ -227,3 +227,4 @@
 /389-ds-base-2.4.5.tar.bz2
 /389-ds-base-3.0.1.tar.bz2
 /389-ds-base-3.0.3.tar.bz2
+/libdb-5.3.28-59.tar.bz2

389-ds-base-devel.README

@@ -1,4 +1,4 @@
-For detailed information on developing plugins for 
+For detailed information on developing plugins for 389 Directory Server visit
-389 Directory Server visit.
 
-http://port389/wiki/Plugins
+https://www.port389.org/docs/389ds/design/plugins.html
+https://github.com/389ds/389-ds-base/blob/main/src/slapi_r_plugin/README.md

389-ds-base-git-local.sh

@@ -1,23 +0,0 @@
-#!/bin/bash
-
-DATE=`date +%Y%m%d`
-# use a real tag name here
-VERSION=1.3.5.14
-PKGNAME=389-ds-base
-TAG=${TAG:-$PKGNAME-$VERSION}
-#SRCNAME=$PKGNAME-$VERSION-$DATE
-SRCNAME=$PKGNAME-$VERSION
-
-test -d .git || {
-    echo you must be in the ds git repo to use this
-    echo bye
-    exit 1
-}
-
-if [ -z "$1" ] ; then
-	dir=.
-else
-	dir="$1"
-fi
-
-git archive --prefix=$SRCNAME/ $TAG | bzip2 > $dir/$SRCNAME.tar.bz2

389-ds-base-git.sh

@@ -1,16 +0,0 @@
-#!/bin/bash
-
-DATE=`date +%Y%m%d`
-# use a real tag name here
-VERSION=1.3.5.14
-PKGNAME=389-ds-base
-TAG=${TAG:-$PKGNAME-$VERSION}
-URL="https://git.fedorahosted.org/git/?p=389/ds.git;a=snapshot;h=$TAG;sf=tgz"
-SRCNAME=$PKGNAME-$VERSION
-
-wget -O $SRCNAME.tar.gz "$URL"
-
-echo convert tgz format to tar.bz2 format
-
-gunzip $PKGNAME-$VERSION.tar.gz
-bzip2 $PKGNAME-$VERSION.tar

389-ds-base.spec

@@ -1,30 +1,47 @@
-
+%global pkgname dirsrv
-%global pkgname   dirsrv
-%global srcname   389-ds-base
 
 # Exclude i686 bit arches
-ExcludeArch: i686 
+ExcludeArch: i686
 
-# If perl-Socket-2.000 or newer is available, set 0 to use_Socket6.
+%bcond bundle_jemalloc 1
-%global use_Socket6 0
+%if %{with bundle_jemalloc}
-
-%global use_asan 0
-%global bundle_jemalloc 1
-%if %{use_asan}
-%global bundle_jemalloc 0
-%endif
-
-%if %{bundle_jemalloc}
 %global jemalloc_name jemalloc
 %global jemalloc_ver 5.3.0
-%global __provides_exclude ^libjemalloc\\.so.*$
+%endif
+
+%bcond bundle_libdb 1
+%if %{with bundle_libdb}
+%global libdb_version 5.3
+%global libdb_base_version db-%{libdb_version}.28
+%global libdb_full_version lib%{libdb_base_version}-59
+%global libdb_bundle_name libdb-%{libdb_version}-389ds.so
+%endif
+
+# This is used in certain builds to help us know if it has extra features.
+%global variant base
+# This enables a sanitized build.
+%bcond asan 0
+%bcond msan 0
+%bcond tsan 0
+%bcond ubsan 0
+
+%if %{with asan} || %{with msan} || %{with tsan} || %{with ubsan}
+%global variant base-xsan
 %endif
 
 # Use Clang instead of GCC
-%global use_clang 0
+%bcond clang 0
+%if %{with msan}
+%bcond clang 1
+%endif
+
+%if %{with clang}
+%global toolchain clang
+%global _missing_build_ids_terminate_build 0
+%endif
 
 # Build cockpit plugin
-%global use_cockpit 1
+%bcond cockpit 0
 
 # fedora 15 and later uses tmpfiles.d
 # otherwise, comment this out
@@ -33,9 +50,6 @@ ExcludeArch: i686
 # systemd support
 %global groupname %{pkgname}.target
 
-# set PIE flag
-%global _hardened_build 1
-
 # Filter argparse-manpage from autogenerated package Requires
 %global __requires_exclude ^python.*argparse-manpage
 
@@ -43,15 +57,15 @@ ExcludeArch: i686
 # See bz1986327
 %define dirsrv_requires_ge()  %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} >= %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
 
-Summary:          389 Directory Server (base)
+Summary:          389 Directory Server (%{variant})
 Name:             389-ds-base
 Version:          3.0.3
-Release:          %autorelease
+Release:          %{autorelease -n %{?with_asan:-e asan}}%{?dist}
 License:          GPL-3.0-or-later AND (0BSD OR Apache-2.0 OR MIT) AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR MIT OR Zlib) AND (Apache-2.0 OR MIT) AND (CC-BY-4.0 AND MIT) AND (MIT OR Apache-2.0) AND Unicode-DFS-2016 AND (MIT OR CC0-1.0) AND (MIT OR Unlicense) AND 0BSD AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MIT AND ISC AND MPL-2.0 AND PSF-2.0
-URL:              https://www.port389.org
 Conflicts:        selinux-policy-base < 3.9.8
 Conflicts:        freeipa-server < 4.0.3
 Obsoletes:        %{name} <= 1.4.4
+URL:              https://www.port389.org/
 Obsoletes:        %{name}-legacy-tools < 1.4.4.6
 Obsoletes:        %{name}-legacy-tools-debuginfo < 1.4.4.6
 Provides:         ldif2ldbm >= 0
@@ -338,30 +352,43 @@ Provides:  bundled(npm(wrappy)) = 1.0.2
 Provides:  bundled(npm(yocto-queue)) = 0.1.0
 ##### Bundled cargo crates list - END #####
 
-
+# Attach the buildrequires to the top level package:
-BuildRequires:    nspr-devel >= 4.32
+BuildRequires:    nspr-devel
-BuildRequires:    nss-devel >= 3.67.0-7
+BuildRequires:    nss-devel >= 3.34
+BuildRequires:    openldap-clients
 BuildRequires:    openldap-devel
 BuildRequires:    lmdb-devel
-BuildRequires:    libdb-devel
 BuildRequires:    cyrus-sasl-devel
 BuildRequires:    icu
 BuildRequires:    libicu-devel
 BuildRequires:    pcre2-devel
 BuildRequires:    cracklib-devel
 BuildRequires:    json-c-devel
-%if %{use_clang}
+%if %{with clang}
 BuildRequires:    libatomic
 BuildRequires:    clang
+BuildRequires:    compiler-rt
+BuildRequires:    lld
 %else
 BuildRequires:    gcc
 BuildRequires:    gcc-c++
+%if %{with asan}
+BuildRequires:    libasan
 %endif
+%if %{with tsan}
+BuildRequires:    libtsan
+%endif
+%if %{with ubsan}
+BuildRequires:    libubsan
+%endif
+%endif
+%if %{without bundle_libdb}
+BuildRequires:    libdb-devel
+%endif
+
 # The following are needed to build the snmp ldap-agent
 BuildRequires:    net-snmp-devel
-BuildRequires:    lm_sensors-devel
 BuildRequires:    bzip2-devel
-BuildRequires:    zlib-devel
 BuildRequires:    openssl-devel
 # the following is for the pam passthru auth plug-in
 BuildRequires:    pam-devel
@@ -369,16 +396,12 @@ BuildRequires:    systemd-units
 BuildRequires:    systemd-devel
 BuildRequires:    systemd-rpm-macros
 %{?sysusers_requires_compat}
-%if %{use_asan}
-BuildRequires:    libasan
-%endif
 BuildRequires:    cargo
 BuildRequires:    rust
 BuildRequires:    pkgconfig
 BuildRequires:    pkgconfig(systemd)
 BuildRequires:    pkgconfig(krb5)
 BuildRequires:    pkgconfig(libpcre2-8)
-
 # Needed to support regeneration of the autotool artifacts.
 BuildRequires:    autoconf
 BuildRequires:    automake
@@ -387,112 +410,119 @@ BuildRequires:    libtool
 BuildRequires:    doxygen
 # For tests!
 BuildRequires:    libcmocka-devel
-BuildRequires:    libevent-devel
+# For lib389 and related components.
-# For lib389 and related components
+BuildRequires:    python%{python3_pkgversion}
 BuildRequires:    python%{python3_pkgversion}-devel
 BuildRequires:    python%{python3_pkgversion}-setuptools
 BuildRequires:    python%{python3_pkgversion}-ldap
-BuildRequires:    python%{python3_pkgversion}-six
 BuildRequires:    python%{python3_pkgversion}-pyasn1
 BuildRequires:    python%{python3_pkgversion}-pyasn1-modules
 BuildRequires:    python%{python3_pkgversion}-dateutil
 BuildRequires:    python%{python3_pkgversion}-argcomplete
 BuildRequires:    python%{python3_pkgversion}-argparse-manpage
-BuildRequires:    python%{python3_pkgversion}-libselinux
 BuildRequires:    python%{python3_pkgversion}-policycoreutils
+BuildRequires:    python%{python3_pkgversion}-libselinux
 BuildRequires:    python%{python3_pkgversion}-cryptography
 
 # For cockpit
-%if %{use_cockpit}
+%if %{with cockpit}
 BuildRequires:    rsync
+BuildRequires:    npm
+BuildRequires:    nodejs
 %endif
 
 Requires:         %{name}-libs = %{version}-%{release}
 Requires:         python%{python3_pkgversion}-lib389 = %{version}-%{release}
-Requires:         lmdb-libs
 
 # this is needed for using semanage from our setup scripts
 Requires:         policycoreutils-python-utils
-Requires:         /usr/sbin/semanage
 Requires:         libsemanage-python%{python3_pkgversion}
-Requires:         selinux-policy >= 3.14.1-29
-
 # the following are needed for some of our scripts
 Requires:         openldap-clients
-Requires:         /usr/bin/c_rehash
-Requires:         python%{python3_pkgversion}-ldap
 Requires:         acl
-Requires:         zlib
-Requires:         json-c
-
 # this is needed to setup SSL if you are not using the
 # administration server package
 Requires:         nss-tools
-Requires:         nss >= 3.67.0-7
+%dirsrv_requires_ge nss
-Requires:         nspr >= 4.32
-
 # these are not found by the auto-dependency method
 # they are required to support the mandatory LDAP SASL mechs
 Requires:         cyrus-sasl-gssapi
 Requires:         cyrus-sasl-md5
+# This is optionally supported by us, as we use it in our tests
 Requires:         cyrus-sasl-plain
-
+# this is needed for backldbm
-# this is needed for verify-db.pl
+%if %{without bundle_libdb}
-Requires:         libdb-utils
+Requires:         libdb
-
+%endif
-# Needed for password dictionary checks
+Requires:         lmdb
-Requires:         cracklib-dicts
+# This picks up libperl.so as a Requires, so we add this versioned one
-
+Requires:         perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
 # Needed by logconv.pl
+%if %{without bundle_libdb}
 Requires:         perl-DB_File
+%endif
 Requires:         perl-Archive-Tar
 %if 0%{?fedora} >= 33 || 0%{?rhel} >= 9
 Requires:         perl-debugger
 Requires:         perl-sigtrap
 %endif
-
+# Needed for password dictionary checks
+Requires:         cracklib-dicts
+Requires:         json-c
+# Log compression
+Requires:         zlib-devel
 # Picks up our systemd deps.
 %{?systemd_requires}
 
 Obsoletes:        %{name} <= 1.4.4
 
-Source0:          https://releases.pagure.org/389-ds-base/%{name}-%{version}.tar.bz2
+Source0:          %{name}-%{version}.tar.bz2
-# 389-ds-git.sh should be used to generate the source tarball from git
-Source1:          %{name}-git.sh
 Source2:          %{name}-devel.README
-%if %{bundle_jemalloc}
+%if %{with bundle_jemalloc}
 Source3:          https://github.com/jemalloc/%{jemalloc_name}/releases/download/%{jemalloc_ver}/%{jemalloc_name}-%{jemalloc_ver}.tar.bz2
 %endif
 Source4:          389-ds-base.sysusers
+%if %{with bundle_libdb}
+Source5:          https://fedorapeople.org/groups/389ds/libdb-5.3.28-59.tar.bz2
+%endif
 
 %description
 389 Directory Server is an LDAPv3 compliant server.  The base package includes
 the LDAP server and command line utilities for server administration.
-%if %{use_asan}
+%if %{with asan}
 WARNING! This build is linked to Address Sanitisation libraries. This probably
 isn't what you want. Please contact support immediately.
 Please see http://seclists.org/oss-sec/2016/q1/363 for more information.
 %endif
 
+
 %package          libs
-Summary:          Core libraries for 389 Directory Server
+Summary:          Core libraries for 389 Directory Server (%{variant})
-BuildRequires:    nspr-devel
-BuildRequires:    nss-devel >= 3.34
-BuildRequires:    openldap-devel
-BuildRequires:    libdb-devel
-BuildRequires:    cyrus-sasl-devel
-BuildRequires:    libicu-devel
-BuildRequires:    pcre2-devel
-BuildRequires:    libtalloc-devel
-BuildRequires:    libevent-devel
-BuildRequires:    libtevent-devel
-Requires:         krb5-libs
-Requires:         libevent
-BuildRequires:    systemd-devel
-BuildRequires:    make
 Provides:         svrcore = 4.1.4
-Conflicts:        svrcore
 Obsoletes:        svrcore <= 4.1.3
+Conflicts:        svrcore
+%dirsrv_requires_ge nss
+Requires:         nspr
+Requires:         openldap
+Requires:         systemd-libs
+# Pull in sasl
+Requires:         cyrus-sasl-lib
+# KRB
+Requires:         krb5-libs
+%if %{with clang}
+Requires:         llvm
+Requires:         compiler-rt
+%else
+%if %{with asan}
+Requires:         libasan
+%endif
+%if %{with tsan}
+Requires:         libtsan
+%endif
+%if %{with ubsan}
+Requires:         libubsan
+%endif
+%endif
 
 %description      libs
 Core libraries for the 389 Directory Server base package.  These libraries
@@ -500,19 +530,17 @@ are used by the main package and the -devel package.  This allows the -devel
 package to be installed with just the -libs package and without the main package.
 
 %package          devel
-Summary:          Development libraries for 389 Directory Server
+Summary:          Development libraries for 389 Directory Server (%{variant})
+Provides:         svrcore-devel = 4.1.4
+Obsoletes:        svrcore-devel <= 4.1.3
+Conflicts:        svrcore-devel
 Requires:         %{name}-libs = %{version}-%{release}
 Requires:         pkgconfig
 Requires:         nspr-devel
 Requires:         nss-devel >= 3.34
 Requires:         openldap-devel
-Requires:         libtalloc
+# systemd-libs contains the headers iirc.
-Requires:         libevent
-Requires:         libtevent
 Requires:         systemd-libs
-Provides:         svrcore-devel = 4.1.4
-Conflicts:        svrcore-devel
-Obsoletes:        svrcore-devel <= 4.1.3
 
 %description      devel
 Development Libraries and headers for the 389 Directory Server base package.
@@ -526,16 +554,35 @@ Obsoletes:        %{name} <= 1.4.0.0
 %description      snmp
 SNMP Agent for the 389 Directory Server base package.
 
+%if %{with bundle_libdb}
+%package          bdb
+Summary:          Berkeley Database backend for 389 Directory Server
+%description      bdb
+Berkeley Database backend for 389 Directory Server
+Warning! This backend is deprecated in favor of lmdb and its support
+may be removed in future versions.
+
+Requires:         %{name} = %{version}-%{release}
+# Berkeley DB database libdb was marked as deprecated since F40:
+# https://fedoraproject.org/wiki/Changes/389_Directory_Server_3.0.0
+# because libdb was marked as deprecated since F33
+# https://fedoraproject.org/wiki/Changes/Libdb_deprecated
+Provides:         deprecated()
+%endif
+
+
 %package -n python%{python3_pkgversion}-lib389
 Summary:  A library for accessing, testing, and configuring the 389 Directory Server
 BuildArch:        noarch
+Requires: %{name} = %{version}-%{release}
 Requires: openssl
+# This is for /usr/bin/c_rehash tool, only needed for openssl < 1.1.0
+Requires: openssl-perl
 Requires: iproute
-Recommends: bash-completion
 Requires: python%{python3_pkgversion}
 Requires: python%{python3_pkgversion}-distro
+Requires: python%{python3_pkgversion}-pytest
 Requires: python%{python3_pkgversion}-ldap
-Requires: python%{python3_pkgversion}-six
 Requires: python%{python3_pkgversion}-pyasn1
 Requires: python%{python3_pkgversion}-pyasn1-modules
 Requires: python%{python3_pkgversion}-dateutil
@@ -543,20 +590,21 @@ Requires: python%{python3_pkgversion}-argcomplete
 Requires: python%{python3_pkgversion}-libselinux
 Requires: python%{python3_pkgversion}-setuptools
 Requires: python%{python3_pkgversion}-cryptography
+Recommends: bash-completion
 %{?python_provide:%python_provide python%{python3_pkgversion}-lib389}
 
 %description -n python%{python3_pkgversion}-lib389
 This module contains tools and libraries for accessing, testing,
  and configuring the 389 Directory Server.
 
-%if %{use_cockpit}
+%if %{with cockpit}
 %package -n cockpit-389-ds
 Summary:          Cockpit UI Plugin for configuring and administering the 389 Directory Server
 BuildArch:        noarch
 Requires:         cockpit
-Requires:         389-ds-base
+Requires:         %{name} = %{version}-%{release}
 Requires:         python%{python3_pkgversion}
-Requires:         python%{python3_pkgversion}-lib389
+Requires:         python%{python3_pkgversion}-lib389 = %{version}-%{release}
 
 %description -n cockpit-389-ds
 A cockpit UI Plugin for configuring and administering the 389 Directory Server
@@ -565,34 +613,47 @@ A cockpit UI Plugin for configuring and administering the 389 Directory Server
 %prep
 %autosetup -p1 -v -n %{name}-%{version}
 
-%if %{bundle_jemalloc}
+%if %{with bundle_jemalloc}
 %setup -q -n %{name}-%{version} -T -D -b 3
 %endif
 
+%if %{with bundle_libdb}
+%setup -q -n %{name}-%{version} -T -D -b 5
+%endif
+
 cp %{SOURCE2} README.devel
 
 %build
 
-OPENLDAP_FLAG="--with-openldap"
+%if %{with clang}
-%{?with_tmpfiles_d: TMPFILES_FLAG="--with-tmpfiles-d=%{with_tmpfiles_d}"}
-
-%if %{use_asan}
-ASAN_FLAGS="--enable-asan --enable-debug"
-%endif
-
-RUST_FLAGS="--enable-rust-offline"
-
-%if !%{use_cockpit}
-COCKPIT_FLAGS="--disable-cockpit"
-%endif 
-
-%if %{use_clang}
-export CC=clang
-export CXX=clang++
 CLANG_FLAGS="--enable-clang"
 %endif
 
-%if %{bundle_jemalloc}
+%{?with_tmpfiles_d: TMPFILES_FLAG="--with-tmpfiles-d=%{with_tmpfiles_d}"}
+
+%if %{with asan}
+ASAN_FLAGS="--enable-asan --enable-debug"
+%endif
+
+%if %{with msan}
+MSAN_FLAGS="--enable-msan --enable-debug"
+%endif
+
+%if %{with tsan}
+TSAN_FLAGS="--enable-tsan --enable-debug"
+%endif
+
+%if %{with ubsan}
+UBSAN_FLAGS="--enable-ubsan --enable-debug"
+%endif
+
+RUST_FLAGS="--enable-rust --enable-rust-offline"
+
+%if %{without cockpit}
+COCKPIT_FLAGS="--disable-cockpit"
+%endif
+
+%if %{with bundle_jemalloc}
 # Override page size, bz #1545539
 # 4K
 %ifarch %ix86 %arm x86_64 s390x
@@ -615,26 +676,44 @@ pushd ../%{jemalloc_name}-%{jemalloc_ver}
 %configure \
         --libdir=%{_libdir}/%{pkgname}/lib \
         --bindir=%{_libdir}/%{pkgname}/bin \
-        --enable-prof
+        --enable-prof %{lg_page} %{lg_hugepage}
 make %{?_smp_mflags}
 popd
 %endif
 
-# Enforce strict linking
+# Build custom libdb package
-%define _ld_strict_symbol_defs 1
+%if %{with bundle_libdb}
+mkdir -p ../%{libdb_base_version}
+pushd ../%{libdb_base_version}
+tar -xjf  ../../SOURCES/%{libdb_full_version}.tar.bz2
+mv %{libdb_full_version} SOURCES
+rpmbuild  --define "_topdir $PWD" -bc %{_builddir}/%{name}-%{version}/rpm/bundle-libdb.spec
+popd
+%endif
 
 # Rebuild the autotool artifacts now.
 autoreconf -fiv
 
-%configure --enable-autobind --with-selinux $TMPFILES_FLAG \
+%configure \
+%if %{with bundle_libdb}
+           --with-bundle-libdb=%{_builddir}/%{libdb_base_version}/BUILD/%{libdb_base_version}/dist/dist-tls \
+%endif
+           --with-selinux $TMPFILES_FLAG \
            --with-systemd \
            --with-systemdsystemunitdir=%{_unitdir} \
            --with-systemdsystemconfdir=%{_sysconfdir}/systemd/system \
-           --with-systemdgroupname=%{groupname}  \
+           --with-systemdgroupname=%{groupname} \
            --libexecdir=%{_libexecdir}/%{pkgname} \
-           $ASAN_FLAGS $RUST_FLAGS $CLANG_FLAGS $COCKPIT_FLAGS \
+           $ASAN_FLAGS $MSAN_FLAGS $TSAN_FLAGS $UBSAN_FLAGS $RUST_FLAGS $CLANG_FLAGS $COCKPIT_FLAGS \
-           --enable-cmocka \
+%if 0%{?fedora} >= 34 || 0%{?rhel} >= 9
-           --with-libldap-r=no
+           --with-libldap-r=no \
+%endif
+           --enable-cmocka
+
+# Avoid "Unknown key name 'XXX' in section 'Service', ignoring." warnings from systemd on older releases
+%if 0%{?rhel} && 0%{?rhel} < 9
+  sed -r -i '/^(Protect(Home|Hostname|KernelLogs)|PrivateMounts)=/d' %{_builddir}/%{name}-%{version}/wrappers/*.service.in
+%endif
 
 # lib389
 make src/lib389/setup.py
@@ -651,22 +730,26 @@ sed -i  "1s/\"1\"/\"8\"/" %{_builddir}/%{name}-%{version}/src/lib389/man/dscreat
 # Generate symbolic info for debuggers
 export XCFLAGS=$RPM_OPT_FLAGS
 
-#make %{?_smp_mflags}
+make %{?_smp_mflags}
-make
 
 %install
 
 mkdir -p %{buildroot}%{_datadir}/gdb/auto-load%{_sbindir}
-%if %{use_cockpit}
+%if %{with cockpit}
 mkdir -p %{buildroot}%{_datadir}/cockpit
 %endif
 make DESTDIR="$RPM_BUILD_ROOT" install
 
-%if %{use_cockpit}
+%if %{with cockpit}
 find %{buildroot}%{_datadir}/cockpit/389-console -type d | sed -e "s@%{buildroot}@@" | sed -e 's/^/\%dir /' > cockpit.list
 find %{buildroot}%{_datadir}/cockpit/389-console -type f | sed -e "s@%{buildroot}@@" >> cockpit.list
 %endif
 
+find %{buildroot}%{_libdir}/%{pkgname}/plugins/ -type f -iname 'lib*.so' | sed -e "s@%{buildroot}@@" > plugins.list
+%if %{with bundle_libdb}
+sed -i -e "/libback-bdb/d" plugins.list
+%endif
+
 # Copy in our docs from doxygen.
 cp -r %{_builddir}/%{name}-%{version}/man/man3 $RPM_BUILD_ROOT/%{_mandir}/man3
 
@@ -684,13 +767,14 @@ done
 
 mkdir -p $RPM_BUILD_ROOT/var/log/%{pkgname}
 mkdir -p $RPM_BUILD_ROOT/var/lib/%{pkgname}
-mkdir -p $RPM_BUILD_ROOT/var/lock/%{pkgname}
+mkdir -p $RPM_BUILD_ROOT/var/lock/%{pkgname} \
+    && chmod 770 $RPM_BUILD_ROOT/var/lock/%{pkgname}
 
 # for systemd
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/%{groupname}.wants
 install -p -D -m 0644 %{SOURCE4} %{buildroot}%{_sysusersdir}/389-ds-base.conf
 
-# remove libtool archives and static libs
+#remove libtool and static libs
 rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/*.a
 rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/*.la
 rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/plugins/*.a
@@ -698,7 +782,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/plugins/*.la
 rm -f $RPM_BUILD_ROOT%{_libdir}/libsvrcore.a
 rm -f $RPM_BUILD_ROOT%{_libdir}/libsvrcore.la
 
-%if %{bundle_jemalloc}
+%if %{with bundle_jemalloc}
 pushd ../%{jemalloc_name}-%{jemalloc_ver}
 make DESTDIR="$RPM_BUILD_ROOT" install_lib install_bin
 cp -pa COPYING ../%{name}-%{version}/COPYING.jemalloc
@@ -706,9 +790,26 @@ cp -pa README ../%{name}-%{version}/README.jemalloc
 popd
 %endif
 
+%if %{with bundle_libdb}
+pushd ../%{libdb_base_version}
+libdbbuilddir=$PWD/BUILD/%{libdb_base_version}
+libdbdestdir=$PWD/../%{name}-%{version}
+cp -pa $libdbbuilddir/LICENSE $libdbdestdir/LICENSE.libdb
+cp -pa $libdbbuilddir/README $libdbdestdir/README.libdb
+cp -pa $libdbbuilddir/lgpl-2.1.txt $libdbdestdir/lgpl-2.1.txt.libdb
+cp -pa $libdbbuilddir/dist/dist-tls/.libs/%{libdb_bundle_name} $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/%{libdb_bundle_name}
+popd
+%endif
+
+
 %check
 # This checks the code, if it fails it prints why, then re-raises the fail to shortcircuit the rpm build.
+%if %{with tsan}
+export TSAN_OPTIONS=print_stacktrace=1:second_deadlock_stack=1:history_size=7
+%endif
+%if %{without asan} && %{without msan}
 if ! make DESTDIR="$RPM_BUILD_ROOT" check; then cat ./test-suite.log && false; fi
+%endif
 
 %post
 if [ -n "$DEBUGPOSTTRANS" ] ; then
@@ -787,8 +888,8 @@ fi
 
 exit 0
 
-%files
+%files -f plugins.list
-%if %{bundle_jemalloc}
+%if %{with bundle_jemalloc}
 %doc LICENSE LICENSE.GPLv3+ LICENSE.openssl README.jemalloc
 %license COPYING.jemalloc
 %else
@@ -818,7 +919,6 @@ exit 0
 %{_mandir}/man1/logconv.pl.1.gz
 %{_bindir}/pwdhash
 %{_mandir}/man1/pwdhash.1.gz
-#%caps(CAP_NET_BIND_SERVICE=pe) {_sbindir}/ns-slapd
 %{_sbindir}/ns-slapd
 %{_mandir}/man8/ns-slapd.8.gz
 %{_sbindir}/openldap_to_ds
@@ -832,7 +932,6 @@ exit 0
 %{_mandir}/man5/dirsrv.systemd.5.gz
 %{_libdir}/%{pkgname}/python
 %dir %{_libdir}/%{pkgname}/plugins
-%{_libdir}/%{pkgname}/plugins/*.so
 # This has to be hardcoded to /lib - $libdir changes between lib/lib64, but
 # sysctl.d is always in /lib.
 %{_prefix}/lib/sysctl.d/*
@@ -842,7 +941,7 @@ exit 0
 %exclude %{_sbindir}/ldap-agent*
 %exclude %{_mandir}/man1/ldap-agent.1.gz
 %exclude %{_unitdir}/%{pkgname}-snmp.service
-%if %{bundle_jemalloc}
+%if %{with bundle_jemalloc}
 %{_libdir}/%{pkgname}/lib/
 %{_libdir}/%{pkgname}/bin/
 %exclude %{_libdir}/%{pkgname}/bin/jemalloc-config
@@ -873,7 +972,7 @@ exit 0
 %{_libdir}/%{pkgname}/libns-dshttpd.so.*
 %{_libdir}/%{pkgname}/libldaputil.so.*
 %{_libdir}/%{pkgname}/librewriters.so*
-%if %{bundle_jemalloc}
+%if %{with bundle_jemalloc}
 %{_libdir}/%{pkgname}/lib/libjemalloc.so.2
 %endif
 
@@ -884,6 +983,13 @@ exit 0
 %{_mandir}/man1/ldap-agent.1.gz
 %{_unitdir}/%{pkgname}-snmp.service
 
+%if %{with bundle_libdb}
+%files bdb
+%doc LICENSE LICENSE.GPLv3+ README.devel LICENSE.libdb README.libdb lgpl-2.1.txt.libdb
+%{_libdir}/%{pkgname}/%{libdb_bundle_name}
+%{_libdir}/%{pkgname}/plugins/libback-bdb.so
+%endif
+
 %files -n python%{python3_pkgversion}-lib389
 %doc LICENSE LICENSE.GPLv3+
 %{python3_sitelib}/lib389*
@@ -901,7 +1007,7 @@ exit 0
 %{bash_completions_dir}/dscreate
 %{bash_completions_dir}/dsidm
 
-%if %{use_cockpit}
+%if %{with cockpit}
 %files -n cockpit-389-ds -f cockpit.list
 %{_datarootdir}/metainfo/389-console/org.port389.cockpit_console.metainfo.xml
 %doc README.md

sources

@@ -1,2 +1,3 @@
 SHA512 (jemalloc-5.3.0.tar.bz2) = 22907bb052096e2caffb6e4e23548aecc5cc9283dce476896a2b1127eee64170e3562fa2e7db9571298814a7a2c7df6e8d1fbe152bd3f3b0c1abec22a2de34b1
 SHA512 (389-ds-base-3.0.3.tar.bz2) = f9e5432d8acc7701c9455cb7b561ff6dd67a8e2f9d0340f47cf17b8a3558aa02dab7319d139a23e8f89682c2521c9c6852a097b702228785dda37cb03d2c9310
+SHA512 (libdb-5.3.28-59.tar.bz2) = 731a434fa2e6487ebb05c458b0437456eb9f7991284beb08cb3e21931e23bdeddddbc95bfabe3a2f9f029fe69cd33a2d4f0f5ce6a9811e9c3b940cb6fde4bf79