.gitignore

@@ -1 +1,2 @@
-SOURCES/ldb-2.1.3.tar.gz
+SOURCES/ldb-2.8.0.tar.gz
+SOURCES/ldb.keyring

.libldb.metadata

@@ -1 +1,2 @@
-06d1c8457e56b2df26cec16253a62acc789aa6fb SOURCES/ldb-2.1.3.tar.gz
+cf5c3d8a15c0666cc980a8cf7227ae711664f5a3 SOURCES/ldb-2.8.0.tar.gz
+5d2957f5d63a72a6fc196af3e45242f3d321f6cf SOURCES/ldb.keyring

SOURCES/CVE-2020-10730.patch

@@ -1,48 +0,0 @@
-From 3bdc110e167d7e0f20022dea48ec51b1f46369cb Mon Sep 17 00:00:00 2001
-From: Gary Lockyer <gary@catalyst.net.nz>
-Date: Wed, 13 May 2020 10:56:56 +1200
-Subject: [PATCH 10/11] CVE-2020-10730: lib ldb: Check if
- ldb_lock_backend_callback called twice
-
-Prevent use after free issues if ldb_lock_backend_callback is called
-twice, usually due to ldb_module_done being called twice. This can happen if a
-module ignores the return value from function a function that calls
-ldb_module_done as part of it's error handling.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=14364
-
-Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
-Reviewed-by: Andrew Bartlett <abartlet@samba.org>
----
- lib/ldb/common/ldb.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/lib/ldb/common/ldb.c b/lib/ldb/common/ldb.c
-index 44a487ba987..090d41dde69 100644
---- a/lib/ldb/common/ldb.c
-+++ b/lib/ldb/common/ldb.c
-@@ -1009,6 +1009,13 @@ static int ldb_lock_backend_callback(struct ldb_request *req,
- 	struct ldb_db_lock_context *lock_context;
- 	int ret;
- 
-+	if (req->context == NULL) {
-+		/*
-+		 * The usual way to get here is to ignore the return codes
-+		 * and continuing processing after an error.
-+		 */
-+		abort();
-+	}
- 	lock_context = talloc_get_type(req->context,
- 				       struct ldb_db_lock_context);
- 
-@@ -1023,7 +1030,7 @@ static int ldb_lock_backend_callback(struct ldb_request *req,
- 		 * If this is a LDB_REPLY_DONE or an error, unlock the
- 		 * DB by calling the destructor on this context
- 		 */
--		talloc_free(lock_context);
-+		TALLOC_FREE(req->context);
- 		return ret;
- 	}
- 
--- 
-2.17.1

SOURCES/ldb-2.8.0.tar.asc

@@ -0,0 +1,11 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAABCgAdFiEEkUejOXGVGO6QEby1R5ORYRMIQCUFAmTDr+oACgkQR5ORYRMI
+QCXfwgf/cAqWCgnnKIT3hvUdL2i2F9edDXTOkBDZ1vxQ8hLO+T8JtWO9F40hEZjH
+F5R5B2pxBP6T2Nd9NHVbHUqlIpjqqesweTXtabuW60oz5PZ13owpGDWWQKortH5/
+j49v/ZKHD0NBjVN09AylRgoKQ4kRDtd0rMOAS951aRUcRTFRjK86hnaHPgvQeexy
+SizGRtHlifnwM/lbgJlLkTDUDNA+7RwXRAv0pvLwYReGFoS8vyUbMOYt1lnoiNas
+6cz+6yTKknGO7KSE6bjviDahv7Xg04Qy02eI/HYEZ8NG3aJqNsOqPchP4y/JgVv+
+90FZR2cdZNpTdlZ5TPfihL2/zldXKQ==
+=H6+4
+-----END PGP SIGNATURE-----

SOURCES/libldb-fix-indexes-performance.patch

@@ -0,0 +1,221 @@
+From 1944fcf4b7e5ab4cf580e17031918ba5f441902b Mon Sep 17 00:00:00 2001
+From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
+Date: Wed, 26 Jun 2024 11:05:49 +1200
+Subject: [PATCH 1/2] ldb_kv_index: dn_list load sub transaction can re-use
+ keys
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We don't want to modify the original list, but we can reuse the keys
+if we treat them as immutable and don't free them. That makes it a lot
+quicker if there are many keys (i.e. where an index is useful) and may
+sub-transactions. In particular, it avoids O(n²) talloc_memdups.
+
+A removed comment that says "We have to free the top level index
+memory otherwise we would leak", and this will be addressed in the
+next commit.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15590
+
+Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
+Reviewed-by: Stefan Metzmacher <metze@samba.org>
+(cherry picked from commit 5f0198d69843c864f2b98a7c0c6305ad789a68a0)
+---
+ lib/ldb/ldb_key_value/ldb_kv_index.c | 96 +++++++++++++++++-----------
+ 1 file changed, 57 insertions(+), 39 deletions(-)
+
+diff --git a/lib/ldb/ldb_key_value/ldb_kv_index.c b/lib/ldb/ldb_key_value/ldb_kv_index.c
+index 3f1a847f2b6..fed1033f492 100644
+--- a/lib/ldb/ldb_key_value/ldb_kv_index.c
++++ b/lib/ldb/ldb_key_value/ldb_kv_index.c
+@@ -446,34 +446,39 @@ static int ldb_kv_dn_list_load(struct ldb_module *module,
+ 	 * There is an active index sub transaction, and the record was
+ 	 * found in the primary index transaction cache.  A copy of the
+ 	 * record needs be taken to prevent the original entry being
+-	 * altered, until the index sub transaction is committed.
++	 * altered, until the index sub transaction is committed, but we
++	 * don't copy the actual values, just the array of struct ldb_val
++	 * that points to the values (which are offsets into a GUID array).
++	 *
++	 * As a reminder, our primary cache is an in-memory tdb that
++	 * maps attributes to struct dn_list objects, which point to
++	 * the actual index, which is an array of struct ldb_val, the
++	 * contents of which are {.data = <binary GUID>, .length =
++	 * 16}. The array is sorted by GUID data, and these GUIDs are
++	 * used to look up index entries in the main database. There
++	 * are more layers of indirection than necessary, but what
++	 * makes the index useful is we can use a binary search to
++	 * find if the array contains a GUID.
++	 *
++	 * What we do in a sub-transaction is make a copy of the struct
++	 * dn_list and the array of struct ldb_val, but *not* of the
++	 * .data that they point to. This copy is put into a new
++	 * in-memory tdb which masks the primary cache for the duration
++	 * of the sub-transaction.
++	 *
++	 * In an add operation in a sub-transaction, the new ldb_val
++	 * is a child of the sub-transaction dn_list, which will
++	 * become the main dn_list if the transaction succeeds.
++	 *
++	 * These acrobatics do not affect read-only operations.
+ 	 */
+-
+-	{
+-		struct ldb_val *dns = NULL;
+-		size_t x = 0;
+-
+-		dns = talloc_array(
+-			list,
+-			struct ldb_val,
+-			list2->count);
+-		if (dns == NULL) {
+-			return LDB_ERR_OPERATIONS_ERROR;
+-		}
+-		for (x = 0; x < list2->count; x++) {
+-			dns[x].length = list2->dn[x].length;
+-			dns[x].data = talloc_memdup(
+-				dns,
+-				list2->dn[x].data,
+-				list2->dn[x].length);
+-			if (dns[x].data == NULL) {
+-				TALLOC_FREE(dns);
+-				return LDB_ERR_OPERATIONS_ERROR;
+-			}
+-		}
+-		list->dn = dns;
+-		list->count = list2->count;
++	list->dn = talloc_memdup(list,
++				 list2->dn,
++				 talloc_get_size(list2->dn));
++	if (list->dn == NULL) {
++		return LDB_ERR_OPERATIONS_ERROR;
+ 	}
++	list->count = list2->count;
+ 	return LDB_SUCCESS;
+ 
+ 	/*
+@@ -3852,9 +3857,7 @@ int ldb_kv_reindex(struct ldb_module *module)
+  * Copy the contents of the nested transaction index cache record to the
+  * transaction index cache.
+  *
+- * During this 'commit' of the subtransaction to the main transaction
+- * (cache), care must be taken to free any existing index at the top
+- * level because otherwise we would leak memory.
++ * This is a 'commit' of the subtransaction to the main transaction cache.
+  */
+ static int ldb_kv_sub_transaction_traverse(
+ 	struct tdb_context *tdb,
+@@ -3883,8 +3886,7 @@ static int ldb_kv_sub_transaction_traverse(
+ 
+ 	/*
+ 	 * Do we already have an entry in the primary transaction cache
+-	 * If so free it's dn_list and replace it with the dn_list from
+-	 * the secondary cache
++	 * If so replace dn_list with the one from the subtransaction.
+ 	 *
+ 	 * The TDB and so the fetched rec contains NO DATA, just a
+ 	 * pointer to data held in memory.
+@@ -3897,21 +3899,37 @@ static int ldb_kv_sub_transaction_traverse(
+ 			abort();
+ 		}
+ 		/*
+-		 * We had this key at the top level.  However we made a copy
+-		 * at the sub-transaction level so that we could possibly
+-		 * roll back.  We have to free the top level index memory
+-		 * otherwise we would leak
++		 * We had this key at the top level, and made a copy
++		 * of the dn list for this sub-transaction level that
++		 * borrowed the top level GUID data. We can't free the
++		 * original dn list just yet.
++		 *
++		 * In this diagram, ... is the C pointer structure
++		 * and --- is the talloc structure (::: is both).
++		 *
++		 *   index_in_top_level ::: dn orig ..............
++		 *	|			|		  :
++		 *	|			`--GUID array	  :
++		 *	|				   |----- val1 data
++		 * ldb_kv				   `----- val2 data
++		 *	|					  :
++		 *   index_in_subtransaction :: dn copy ..........:
++		 *				|		  :
++		 *				`------------ new val3 data
++		 *
++		 * So we don't free the index_in_top_level dn list yet,
++		 * because we are (probably) borrowing most of its
++		 * children.
+ 		 */
+-		if (index_in_top_level->count > 0) {
+-			TALLOC_FREE(index_in_top_level->dn);
+-		}
+ 		index_in_top_level->dn
+ 			= talloc_steal(index_in_top_level,
+ 				       index_in_subtransaction->dn);
+ 		index_in_top_level->count = index_in_subtransaction->count;
+ 		return 0;
+ 	}
+-
++	/*
++	 * We found no top level index in the cache, so we put one in.
++	 */
+ 	index_in_top_level = talloc(ldb_kv->idxptr, struct dn_list);
+ 	if (index_in_top_level == NULL) {
+ 		ldb_kv->idxptr->error = LDB_ERR_OPERATIONS_ERROR;
+-- 
+2.46.0
+
+
+From 70d8b1b2f87cbb16b671d334e46244ba001fbd31 Mon Sep 17 00:00:00 2001
+From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
+Date: Mon, 22 Jul 2024 22:22:15 +1200
+Subject: [PATCH 2/2] ldb:kv_index: realloc away old dn list
+
+We can't just free it, because has the GUID index list as a child, and
+these are shared by the new dn list (from the subtransaction we are
+committing). But if the dn list is long and the main transaction is
+long-lived, we can save a lot of memory by turning this dn list into
+an almost empty node in the talloc tree. This returns us to roughly
+the situation we had prior to the last commit.
+
+For example, with the repro.sh script on bug 15590 in indexes mode
+with 10000 rules, The last 3 commits use this much memory at the end
+of an unusually large transaction:
+
+full talloc report on 'struct ldb_context' (total 4012222 bytes in 90058 blocks)
+full talloc report on 'struct ldb_context' (total 2405482219 bytes in 90058 blocks)
+full talloc report on 'struct ldb_context' (total 4282195 bytes in 90058 blocks)
+
+That is, the last commit increased usage 500 fold, and this commit
+brings it back to normal.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15590
+
+Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
+Reviewed-by: Stefan Metzmacher <metze@samba.org>
+(cherry picked from commit 1bf9ede94f0a6b41fb18e880e59a8e390f8c21d3)
+---
+ lib/ldb/ldb_key_value/ldb_kv_index.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/lib/ldb/ldb_key_value/ldb_kv_index.c b/lib/ldb/ldb_key_value/ldb_kv_index.c
+index fed1033f492..11bdf00dc08 100644
+--- a/lib/ldb/ldb_key_value/ldb_kv_index.c
++++ b/lib/ldb/ldb_key_value/ldb_kv_index.c
+@@ -3919,8 +3919,12 @@ static int ldb_kv_sub_transaction_traverse(
+ 		 *
+ 		 * So we don't free the index_in_top_level dn list yet,
+ 		 * because we are (probably) borrowing most of its
+-		 * children.
++		 * children. But we can save memory by discarding the
++		 * values and keeping it as an almost empty talloc
++		 * node.
+ 		 */
++		talloc_realloc(index_in_top_level,
++			       index_in_top_level->dn, struct ldb_val *, 1);
+ 		index_in_top_level->dn
+ 			= talloc_steal(index_in_top_level,
+ 				       index_in_subtransaction->dn);
+-- 
+2.46.0
+

SPECS/libldb.spec

@@ -1,48 +1,73 @@
-%global talloc_version 2.3.1
+%if ((0%{?fedora} || 0%{?rhel} > 7 || 0%{?epel} > 6))
-%global tdb_version 1.4.3
+
-%global tevent_version 0.10.2
+# lmdb is not supported on 32 bit architectures
+%ifarch aarch64 ppc64le s390x x86_64
+%bcond_without lmdb
+%else
+%bcond_with lmdb
+#endif arch
+%endif
+
+%else
+%bcond_with lmdb
+#endif fedora || rhel || epel
+%endif
+
+%if 0%{?fedora} || 0%{?rhel} > 7
+%bcond_without python3
+%else
+%bcond_with python3
+%endif
+
+%global talloc_version 2.4.1
+%global tdb_version 1.4.9
+%global tevent_version 0.15.0
 
 Name: libldb
-Version: 2.1.3
+Version: 2.8.0
-Release: 2%{?dist}
+Release: 1%{?dist}
 Summary: A schema-less, ldap like, API and database
 Requires: libtalloc%{?_isa} >= %{talloc_version}
 Requires: libtdb%{?_isa} >= %{tdb_version}
 Requires: libtevent%{?_isa} >= %{tevent_version}
-License: LGPLv3+
+License: LGPL-3.0-or-later
 URL: http://ldb.samba.org/
-Source: http://samba.org/ftp/ldb/ldb-%{version}.tar.gz
+Source0: https://www.samba.org/ftp/ldb/ldb-%{version}.tar.gz
+Source1: https://www.samba.org/ftp/ldb/ldb-%{version}.tar.asc
+# gpg2 --no-default-keyring --keyring ./ldb.keyring --recv-keys 9147A339719518EE9011BCB54793916113084025
+Source2: ldb.keyring
+
+# Patches
+Patch0:         libldb-fix-indexes-performance.patch
 
 BuildRequires: gcc
 BuildRequires: libtalloc-devel >= %{talloc_version}
 BuildRequires: libtdb-devel >= %{tdb_version}
 BuildRequires: libtevent-devel >= %{tevent_version}
-
+%if %{with lmdb}
-%if ! 0%{?rhel}
 BuildRequires: lmdb-devel >= 0.9.16
 %endif
-
 BuildRequires: popt-devel
 BuildRequires: libxslt
 BuildRequires: docbook-style-xsl
-BuildRequires: doxygen
+%if %{with python3}
-BuildRequires: openldap-devel
-BuildRequires: libcmocka-devel
-
-Provides: bundled(libreplace)
-
 BuildRequires: python3-devel
 BuildRequires: python3-tdb
 BuildRequires: python3-talloc-devel
 BuildRequires: python3-tevent
+#endif with python
+%endif
+BuildRequires: doxygen
+BuildRequires: openldap-devel
+BuildRequires: libcmocka-devel
+BuildRequires: gnupg2
+BuildRequires: make
 
-Obsoletes: python2-ldb < %{version}-%{release}
+Provides: bundled(libreplace)
-Obsoletes: python2-ldb-devel < %{version}-%{release}
+Obsoletes: python2-ldb < 2.0.5-1
-Obsoletes: python2-ldb-debuginfo < %{version}-%{release}
+Obsoletes: python2-ldb-devel < 2.0.5-1
+Obsoletes: pyldb < 1.1.26-2
 
-# Patches
-
-Patch0001: CVE-2020-10730.patch
 
 %description
 An extensible library that implements an LDAP like API to access remote LDAP
@@ -61,11 +86,21 @@ Requires: libldb%{?_isa} = %{version}-%{release}
 Requires: libtdb-devel%{?_isa} >= %{tdb_version}
 Requires: libtalloc-devel%{?_isa} >= %{talloc_version}
 Requires: libtevent-devel%{?_isa} >= %{tevent_version}
-Requires: pkgconfig
 
 %description devel
 Header files needed to develop programs that link against the LDB library.
 
+%package -n python-ldb-devel-common
+Summary: Common development files for the Python bindings for the LDB library
+
+Provides: pyldb-devel%{?_isa} = %{version}-%{release}
+%{?python_provide:%python_provide python2-ldb-devel}
+
+%description -n python-ldb-devel-common
+Development files for the Python bindings for the LDB library.
+This package includes files that aren't specific to a Python version.
+
+%if %{with python3}
 %package -n python3-ldb
 Summary: Python bindings for the LDB library
 Requires: libldb%{?_isa} = %{version}-%{release}
@@ -79,47 +114,50 @@ Python bindings for the LDB library
 %package -n python3-ldb-devel
 Summary: Development files for the Python bindings for the LDB library
 Requires: python3-ldb%{?_isa} = %{version}-%{release}
-Obsoletes: python-ldb-devel-common < %{version}-%{release}
+Requires: python-ldb-devel-common%{?_isa} = %{version}-%{release}
 
 %{?python_provide:%python_provide python3-ldb-devel}
 
 %description -n python3-ldb-devel
 Development files for the Python bindings for the LDB library
+#endif with python
+%endif
 
 %prep
+zcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} -
 %autosetup -n ldb-%{version} -p3
 
 %build
+# workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1217376
+export python_LDFLAGS=""
+
 %configure --disable-rpath \
            --disable-rpath-install \
            --bundled-libraries=NONE \
            --builtin-libraries=replace \
            --with-modulesdir=%{_libdir}/ldb/modules \
+%if %{without lmdb}
            --without-ldb-lmdb \
+%endif
            --with-privatelibdir=%{_libdir}/ldb
 
-make %{?_smp_mflags} V=1
+%make_build
 doxygen Doxyfile
 
+%if %{with lmdb}
 %check
-# jhrozek 2019-05-03: Looks like ldb test suite does not work
+make %{?_smp_mflags} check
-# when ldb is compiled --without-ldb-lmdb
+#endif with lmdb
-# make %{?_smp_mflags} check
+%endif
 
 %install
-make install DESTDIR=$RPM_BUILD_ROOT
+%make_install
-
-rm -f $RPM_BUILD_ROOT%{_libdir}/libldb.a
-
-# Shared libraries need to be marked executable for
-# rpmbuild to strip them and include them in debuginfo
-find $RPM_BUILD_ROOT -name "*.so*" -exec chmod -c +x {} \;
 
 # Install API docs
 cp -a apidocs/man/* $RPM_BUILD_ROOT/%{_mandir}
 
-# LDB 1.1.8+ bug: remove manpage named after full
+# bug: remove manpage named after full file path
-# file path
+# not needed with el8+ and fc28+
 rm -f $RPM_BUILD_ROOT/%{_mandir}/man3/_*
 
 %ldconfig_scriptlets
@@ -130,8 +168,7 @@ rm -f $RPM_BUILD_ROOT/%{_mandir}/man3/_*
 %{_libdir}/ldb/libldb-key-value.so
 %{_libdir}/ldb/libldb-tdb-err-map.so
 %{_libdir}/ldb/libldb-tdb-int.so
-# lmdb is not supported on 32 bit architectures
+%if %{with lmdb}
-%if 0%{?__isa_bits} == 64 && ! 0%{?rhel}
 %{_libdir}/ldb/libldb-mdb-int.so
 %endif
 %dir %{_libdir}/ldb/modules
@@ -165,21 +202,74 @@ rm -f $RPM_BUILD_ROOT/%{_mandir}/man3/_*
 %{_mandir}/man3/ldb*.gz
 %{_mandir}/man3/ldif*.gz
 
+%files -n python-ldb-devel-common
+%{_includedir}/pyldb.h
+%{_mandir}/man*/Py*.gz
+
+%if %{with python3}
 %files -n python3-ldb
 %{python3_sitearch}/ldb.cpython-*.so
-%{_libdir}/libpyldb-util.cpython-*.so.*
+%{_libdir}/libpyldb-util.cpython-*.so.2*
 %{python3_sitearch}/_ldb_text.py
 %{python3_sitearch}/__pycache__/_ldb_text.cpython-*.py*
 
 %files -n python3-ldb-devel
 %{_libdir}/libpyldb-util.cpython-*.so
 %{_libdir}/pkgconfig/pyldb-util.cpython-*.pc
-%{_includedir}/pyldb.h
-%{_mandir}/man*/Py*.gz
 
 %ldconfig_scriptlets -n python3-ldb
+#endif with python
+%endif
 
 %changelog
+* Tue Aug 13 2024 Andreas Schneider <asn@redhat.com> - 2.8.0-1
+- resolves: RHEL-12109 - Fix performance regression with indexes
+
+* Fri Nov 17 2023 Pavel Filipenský <pfilipen@redhat.com> - 2.8.0-0
+- resolves: RHEL-16509 - Update to libldb-2.8.0 
+
+* Tue Jun 06 2023 Pavel Filipenský <pfilipen@redhat.com> - 2.7.2-3
+- resolves: rhbz#2190427 - Rebuild to trigger distrobaker sync
+
+* Wed May 24 2023 Pavel Filipenský <pfilipen@redhat.com> - 2.7.2-2
+- resolves: rhbz#2190427 - Add missing tests to fix osci.brew-build.tier0.functional
+
+* Thu May 18 2023 Pavel Filipenský <pfilipen@redhat.com> - 2.7.2-1
+- resolves: rhbz#2190427 - Update to version 2.7.2
+
+* Mon Oct 24 2022 Andreas Schneider <asn@redhat.com> - 2.6.1-1
+- resolves: rhbz#2132052 - Update to version 2.6.1
+
+* Thu Aug 11 2022 Andreas Schneider <asn@redhat.com> - 2.5.2-2
+- resolves: rhbz#2108998 - Rebuild to include python3-ldb-devel in CRB
+
+* Wed Jul 27 2022 Andreas Schneider <asn@redhat.com> - 2.5.2-1
+- Rebase to version 2.5.2
+- resolves: rhbz#2109016 - Fix CVE-2022-32746
+
+* Mon Jun 13 2022 Pavel Filipenský <pfilipen@redhat.com> - 2.5.1-1
+- related: rhbz#2077484 - Rebase to version 2.5.1
+
+* Mon May 02 2022 Pavel Filipenský <pfilipen@redhat.com> - 2.5.0-1
+- resolves: rhbz#2077484 - Rebase to version 2.5.0
+
+* Thu Nov 25 2021 Pavel Filipenský <pfilipen@redhat.com> - 2.4.1-1
+- resolves: rhbz#2013605 - Rebase to version 2.4.1
+
+* Tue May 25 2021 Andreas Schneider <asn@redhat.com> - 2.3.0-2
+- related: rhbz#1897082 - Fix libldb tests on ppc64le
+
+* Tue May 11 2021 Andreas Schneider <asn@redhat.com> - 2.3.0-1
+- resolves: rhbz#1945021 - Update to version 2.3.0
+- resolves: rhbz#1897082 - Fix libldb tests on aarch64
+
+* Wed Mar 24 2021 Andreas Schneider <asn@redhat.com> - 2.2.0-2
+* resolves: rhbz#1941516 - Fixed CVE-2021-20277
+
+* Mon Nov 9 2020 Isaac Boukris <iboukris@redhat.com> - 2.2.0-1
+- Resolves: rhbz#1878114 - Rebase libldb to the version required by Samba
+- Resolves: rhbz#1794349 - Build libldb with lmdb support
+
 * Wed Jun 24 2020 Isaac Boukris <iboukris@redhat.com> - 2.1.3-2
 - Resolves: rhbz#1849615 - Fix CVE-2020-10730 use-after-free