import mariadb-10.5.9-1.module+el8.4.0+10457+88cd7ba1

.gitignore

@@ -1 +1 @@
-SOURCES/mariadb-10.5.8.tar.gz
+SOURCES/mariadb-10.5.9.tar.gz

.mariadb.metadata

@@ -1 +1 @@
-6442a3c9d9d316086ce6822f18e2e026bd8422d0 SOURCES/mariadb-10.5.8.tar.gz
+73767fac3d1c504298259708272fb6a58e644967 SOURCES/mariadb-10.5.9.tar.gz

SOURCES/rh-skipped-tests-s390.list

@@ -1,3 +1,5 @@
 # Fails since 10.5.2
 perfschema.memory_aggregate_32bit :
 period.overlaps :
+# Fails since 10.5.9
+bugfix.wait_timeout :

SPECS/mariadb.spec

@@ -15,7 +15,7 @@
 # The last version on which the full testsuite has been run
 # In case of further rebuilds of that version, don't require full testsuite to be run
 # run only "main" suite
-%global last_tested_version 10.5.8
+%global last_tested_version 10.5.9
 # Set to 1 to force run the testsuite even if it was already tested in current version
 %global force_run_testsuite 0
 
@@ -61,6 +61,9 @@
 # hierarchies and more complex graph structures to be handled in a relational fashion
 %bcond_without oqgraph
 
+# PAM authentication plugin
+%bcond_without pam
+
 # Other plugins
 %if 0%{?fedora}
 %bcond_without cracklib
@@ -113,7 +116,7 @@
 %bcond_without unbundled_pcre
 %else
 %bcond_with unbundled_pcre
-%global pcre_bundled_version 10.34
+%global pcre_bundled_version 10.36
 %endif
 
 # Use main python interpretter version
@@ -151,8 +154,8 @@
 %global sameevr   %{epoch}:%{version}-%{release}
 
 Name:             mariadb
-Version:          10.5.8
-Release:          2%{?with_debug:.debug}%{?dist}
+Version:          10.5.9
+Release:          1%{?with_debug:.debug}%{?dist}
 Epoch:            3
 
 Summary:          A very fast and robust SQL database server
@@ -444,6 +447,7 @@ Recommends:       %{name}-backup%{?_isa} = %{sameevr}
 %{?with_sphinx:Suggests:       %{name}-sphinx-engine%{?_isa} = %{sameevr}}
 %{?with_oqgraph:Suggests:      %{name}-oqgraph-engine%{?_isa} = %{sameevr}}
 %{?with_connect:Suggests:      %{name}-connect-engine%{?_isa} = %{sameevr}}
+%{?with_pam:Suggests:          %{name}-pam%{?_isa} = %{sameevr}}
 
 Suggests:         mytop
 Suggests:         logrotate
@@ -588,6 +592,21 @@ This plugin includes support for Kerberos on Unix.
 %endif
 
 
+%if %{with pam}
+%package          pam
+Summary:          PAM authentication plugin for the MariaDB server
+
+Requires:         %{name}-server%{?_isa} = %{sameevr}
+# This subpackage NEED the 'mysql' user/group (created during mariadb-server %pre) to be available prior installation
+Requires(pre):    %{name}-server%{?_isa} = %{sameevr}
+
+BuildRequires:    pam-devel
+
+%description      pam
+PAM authentication server-side plugin for MariaDB.
+%endif
+
+
 %if %{with sphinx}
 %package          sphinx-engine
 Summary:          The Sphinx storage engine for MariaDB
@@ -892,7 +911,7 @@ export CFLAGS CXXFLAGS CPPFLAGS
 # Print all Cmake options values; "-LAH" means "List Advanced Help"
 cmake -B %{_vpath_builddir} -LAH
 
-%cmake_build
+%cmake_build -j2
 
 # build selinux policy
 %if %{with galera}
@@ -1234,7 +1253,7 @@ export MTR_BUILD_THREAD=$(( $(date +%s) % 1100 ))
       --skip-test-list=unstable-tests
     %endif
     # Second run for the SPIDER suites that fail with SCA (ssl self signed certificate)
-    perl ./mysql-test-run.pl $common_testsuite_arguments --skip-ssl --big-test --mem --suite=spider,spider/bg,spider/bugfix,spider/handler \
+    perl ./mysql-test-run.pl $common_testsuite_arguments --skip-ssl --big-test --mem --suite=spider,spider/bg,spider/bugfix,spider/handler --skip-test-list=unstable-tests \
     %if %{ignore_testsuite_result}
       --max-test-fail=999 || :
     %endif
@@ -1416,10 +1435,6 @@ fi
 
 %dir %{_libdir}/%{pkg_name}
 %dir %{_libdir}/%{pkg_name}/plugin
-# Change from root:root to mysql:mysql, so it can be accessed by the server
-%attr(0755,mysql,mysql) %dir %{_libdir}/%{pkg_name}/plugin/auth_pam_tool_dir
-%{_libdir}/security/pam_user_map.so
-%{_sysconfdir}/security/user_map.conf
 %{_libdir}/%{pkg_name}/plugin/*
 %{?with_oqgraph:%exclude %{_libdir}/%{pkg_name}/plugin/ha_oqgraph.so}
 %{?with_connect:%exclude %{_libdir}/%{pkg_name}/plugin/ha_connect.so}
@@ -1433,6 +1448,11 @@ fi
 %exclude %{_libdir}/%{pkg_name}/plugin/mysql_clear_password.so
 %endif
 
+# PAM plugin; moved to a standalone sub-package
+%exclude %{_libdir}/%{pkg_name}/plugin/{auth_pam_v1.so,auth_pam.so}
+%exclude %dir %{_libdir}/%{pkg_name}/plugin/auth_pam_tool_dir
+%exclude %{_libdir}/%{pkg_name}/plugin/auth_pam_tool_dir/auth_pam_tool
+
 %{_mandir}/man1/aria_{chk,dump_log,ftdump,pack,read_log,s3_copy}.1*
 %{_mandir}/man1/galera_new_cluster.1*
 %{_mandir}/man1/galera_recovery.1*
@@ -1554,6 +1574,16 @@ fi
 %config(noreplace) %{_sysconfdir}/my.cnf.d/auth_gssapi.cnf
 %endif
 
+%if %{with pam}
+%files pam
+%{_libdir}/%{pkg_name}/plugin/{auth_pam_v1.so,auth_pam.so}
+%attr(0755,root,root) %dir %{_libdir}/%{pkg_name}/plugin/auth_pam_tool_dir
+# SUID-to-root binary. Access MUST be restricted (https://jira.mariadb.org/browse/MDEV-25126)
+%attr(4750,root,mysql) %{_libdir}/%{pkg_name}/plugin/auth_pam_tool_dir/auth_pam_tool
+%{_libdir}/security/pam_user_map.so
+%{_sysconfdir}/security/user_map.conf
+%endif
+
 %if %{with sphinx}
 %files sphinx-engine
 %{_libdir}/%{pkg_name}/plugin/ha_sphinx.so
@@ -1631,6 +1661,15 @@ fi
 %endif
 
 %changelog
+* Mon Mar 22 2021 Michal Schorm <mschorm@redhat.com> - 10.5.9-1
+- Rebase to 10.5.9
+
+* Fri Mar 19 2021 Michal Schorm <mschorm@redhat.com> - 10.5.8-4
+- Move the PAM plugin to a standalone sub-package
+
+* Thu Mar 18 2021 Michal Schorm <mschorm@redhat.com> - 10.5.8-3
+- Fix permissions of the PAMv2 plugin files
+
 * Tue Feb 16 2021 Michal Schorm <mschorm@redhat.com> - 10.5.8-2
 - Bump release after several commits cherry-picked from Fedora Rawhide