import UBI samba-4.22.4-6.el9_7

.gitignore

@@ -1,2 +1,2 @@
-SOURCES/samba-4.21.3.tar.xz
+SOURCES/samba-4.22.4.tar.xz
 SOURCES/samba-pubkey_AA99442FB680B620.gpg

.samba.metadata

@@ -1,2 +1,2 @@
-c3c2f51037818ee9e1d24b5b9add13d5f86fdb01 SOURCES/samba-4.21.3.tar.xz
+1437538612045e08c3dde1527825d11a11a6d71f SOURCES/samba-4.22.4.tar.xz
 971f563c447eda8d144d6c9e743cd0f0488c0d9e SOURCES/samba-pubkey_AA99442FB680B620.gpg

SOURCES/redhat-4.22.patch

@@ -0,0 +1,492 @@
+From b0ff8644c06b01252bdbac6a31c77c5781d4b5a0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
+Date: Tue, 29 Jul 2025 11:19:07 +0200
+Subject: [PATCH 1/3] selftest: Add the short name for localvampiredc to hosts
+ file
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15905
+
+Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
+Reviewed-by: Alexander Bokovoy <ab@samba.org>
+(cherry picked from commit 5d2f60ae5aa96751b74901ae5384291ef338b152)
+---
+ selftest/target/Samba4.pm | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
+index 9da339f6239..af0434a8e6b 100755
+--- a/selftest/target/Samba4.pm
++++ b/selftest/target/Samba4.pm
+@@ -878,7 +878,7 @@ nogroup:x:65534:nobody
+ 
+ 	my $hostname = lc($ctx->{hostname});
+ 	open(HOSTS, ">>$ctx->{nsswrap_hosts}");
+-	if ($hostname eq "localdc") {
++	if ($hostname eq "localdc" || $hostname eq "localvampiredc") {
+ 		print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
+ 		print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
+ 	} else {
+-- 
+2.51.0
+
+
+From 03431792b4707e50afc8f9e356f08a91f4fb67c3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
+Date: Mon, 4 Aug 2025 11:20:54 +0200
+Subject: [PATCH 2/3] tests: Add test for 'net ads join' to a preferred DC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15905
+
+Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
+Reviewed-by: Alexander Bokovoy <ab@samba.org>
+(cherry picked from commit 36f6ac547c09f492d1dcab11570e8bcbd377cf26)
+---
+ selftest/knownfail                            |  1 +
+ source4/selftest/tests.py                     |  1 +
+ .../test_net_ads_join_to_preferred_dc.sh      | 61 +++++++++++++++++++
+ 3 files changed, 63 insertions(+)
+ create mode 100755 testprogs/blackbox/test_net_ads_join_to_preferred_dc.sh
+
+diff --git a/selftest/knownfail b/selftest/knownfail
+index ab2d79d7114..7c0e9dd00e7 100644
+--- a/selftest/knownfail
++++ b/selftest/knownfail
+@@ -335,6 +335,7 @@
+ ^samba.tests.dcerpc.dnsserver.samba.tests.dcerpc.dnsserver.DnsserverTests.test_security_descriptor.*
+ ^samba4.blackbox.dbcheck-links.release-4-5-0-pre1.dbcheck_dangling_multi_valued_clean
+ ^samba4.blackbox.dbcheck-links.release-4-5-0-pre1.dangling_multi_valued_check_missing
++^samba4.blackbox.net_ads_join.join
+ 
+ # We currently don't send referrals for LDAP modify of non-replicated attrs
+ ^samba4.ldap.rodc.python\(rodc\).__main__.RodcTests.test_modify_nonreplicated.*
+diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
+index 9c5e85e428a..14a41ba77ed 100755
+--- a/source4/selftest/tests.py
++++ b/source4/selftest/tests.py
+@@ -902,6 +902,7 @@ plantestsuite("samba4.blackbox.rfc2307_mapping",
+ plantestsuite("samba4.blackbox.chgdcpass", "chgdcpass", [os.path.join(bbdir, "test_chgdcpass.sh"), '$SERVER', r"CHGDCPASS\$", '$REALM', '$DOMAIN', '$PREFIX/chgdcpass', "aes256-cts-hmac-sha1-96", '$PREFIX/chgdcpass', smbclient3])
+ plantestsuite("samba4.blackbox.samba_upgradedns(chgdcpass:local)", "chgdcpass:local", [os.path.join(bbdir, "test_samba_upgradedns.sh"), '$SERVER', '$REALM', '$PREFIX', '$SELFTEST_PREFIX/chgdcpass'])
+ plantestsuite("samba4.blackbox.net_ads", "ad_dc:client", [os.path.join(bbdir, "test_net_ads.sh"), '$DC_SERVER', '$DC_USERNAME', '$DC_PASSWORD', '$PREFIX_ABS'])
++plantestsuite("samba4.blackbox.net_ads_join", "vampire_dc:client", [os.path.join(bbdir, "test_net_ads_join_to_preferred_dc.sh"), '$DC_SERVER', '$DC_USERNAME', '$DC_PASSWORD', '$PREFIX'])
+ plantestsuite("samba4.blackbox.net_offlinejoin", "ad_dc:client", [os.path.join(bbdir, "test_net_offline.sh"), '$DC_SERVER', '$DC_USERNAME', '$DC_PASSWORD', '$PREFIX_ABS'])
+ plantestsuite("samba4.blackbox.client_etypes_all(ad_dc:client)", "ad_dc:client", [os.path.join(bbdir, "test_client_etypes.sh"), '$DC_SERVER', '$DC_USERNAME', '$DC_PASSWORD', '$PREFIX_ABS', 'all', '17_18_23'])
+ plantestsuite("samba4.blackbox.client_etypes_legacy(ad_dc:client)", "ad_dc:client", [os.path.join(bbdir, "test_client_etypes.sh"), '$DC_SERVER', '$DC_USERNAME', '$DC_PASSWORD', '$PREFIX_ABS', 'legacy', '23'])
+diff --git a/testprogs/blackbox/test_net_ads_join_to_preferred_dc.sh b/testprogs/blackbox/test_net_ads_join_to_preferred_dc.sh
+new file mode 100755
+index 00000000000..1bebc2f4dbe
+--- /dev/null
++++ b/testprogs/blackbox/test_net_ads_join_to_preferred_dc.sh
+@@ -0,0 +1,61 @@
++if [ $# -lt 4 ]; then
++	cat <<EOF
++Usage: test_net_ads.sh DC_SERVER DC_USERNAME DC_PASSWORD BASEDIR
++EOF
++	exit 1
++fi
++
++DC_SERVER=$1
++DC_USERNAME=$2
++DC_PASSWORD=$3
++BASEDIR=$4
++
++HOSTNAME=$(dd if=/dev/urandom bs=1 count=32 2>/dev/null | sha1sum | cut -b 1-10)
++
++RUNDIR=$(pwd)
++cd $BASEDIR
++WORKDIR=$(mktemp -d -p .)
++WORKDIR=$(basename $WORKDIR)
++cp -a client/* $WORKDIR/
++sed -ri "s@(dir|directory) = (.*)/client/@\1 = \2/$WORKDIR/@" $WORKDIR/client.conf
++sed -ri "s/netbios name = .*/netbios name = $HOSTNAME/" $WORKDIR/client.conf
++rm -f $WORKDIR/private/secrets.tdb
++cd $RUNDIR
++
++failed=0
++
++net_tool="$BINDIR/net --configfile=$BASEDIR/$WORKDIR/client.conf --option=security=ads"
++
++# Load test functions
++. $(dirname $0)/subunit.sh
++. "$(dirname "${0}")/common_test_fns.inc"
++
++# This test is run in environment with two DCs ('localdc' and 'localvampiredc')
++# The 'net ads join' has these two steps:
++#   1. create machine account at DC ('-S' points to 'localvampiredc')
++#   2. create keytab and sync the KVNO from a DC
++#
++# It must be ensured that in step #2 the keytab code contacts the same DC
++# ('localvampiredc'). The configuration below tries to break it.
++# We disable [SAF/DOMAIN/...] and [SAFJOIN/DOMAIN/...] by setting TTL to '-1'
++# And via setting 'password server' to 'localdc' we manage that
++# get_dc_list() returns 'localdc' instead of 'localvampiredc'
++#
++# As long as the keytab code is not explicitly told to use the same DC as join,
++# we get failure:
++# gensec_gse_client_prepare_ccache: Kinit for F0D26C71F6$@SAMBA.EXAMPLE.COM to access ldap/localdc.samba.example.com failed: Client not found in Kerberos database: NT_STATUS_LOGON_FAILURE
++
++cat <<EOF >>$BASEDIR/$WORKDIR/client.conf
++sync machine password to keytab = $BASEDIR/keytab:account_name:machine_password:sync_kvno
++password server = $DC_SERVER
++saf: join ttl = -1
++saf: ttl = -1
++EOF
++
++testit "join" $VALGRIND $net_tool ads join -S$SERVER -U$DC_USERNAME%$DC_PASSWORD || failed=$(expr $failed + 1)
++
++testit "leave" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD || failed=$(expr $failed + 1)
++
++rm -rf $BASEDIR/$WORKDIR
++
++exit $failed
+-- 
+2.51.0
+
+
+From 5cff37091161976a979752351003c9c1deb0d39f Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Mon, 28 Jul 2025 10:43:36 +0200
+Subject: [PATCH 3/3] s3:net: Pass down the server from cmdline to
+ sync_pw2keytabs()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This makes sure that during 'net ads join' the keytab create code
+- sync_pw2keytabs() talks to the same DC at what the machine account
+was created.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15905
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
+Pair-Programmed-With: Pavel Filipenský <pfilipensky@samba.org>
+
+Reviewed-by: Alexander Bokovoy <ab@samba.org>
+
+Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
+Autobuild-Date(master): Fri Sep  5 13:38:33 UTC 2025 on atb-devel-224
+
+(cherry picked from commit 5d1d3a8b568b5a07ed1ed537d20aa93820cecc14)
+---
+ selftest/knownfail                       |  1 -
+ source3/include/secrets.h                | 25 ++++++++++++++----------
+ source3/libads/ads_proto.h               |  2 +-
+ source3/libads/kerberos_keytab.c         | 24 ++++++++++++++++++++---
+ source3/libads/trusts_util.c             | 15 ++++++++------
+ source3/libads/util.c                    | 10 ++++++----
+ source3/libnet/libnet_join.c             |  2 +-
+ source3/passdb/machine_account_secrets.c | 10 ++++++----
+ source3/utils/net.c                      | 10 ++++++----
+ source3/utils/net_ads.c                  |  2 +-
+ 10 files changed, 66 insertions(+), 35 deletions(-)
+
+diff --git a/selftest/knownfail b/selftest/knownfail
+index 7c0e9dd00e7..ab2d79d7114 100644
+--- a/selftest/knownfail
++++ b/selftest/knownfail
+@@ -335,7 +335,6 @@
+ ^samba.tests.dcerpc.dnsserver.samba.tests.dcerpc.dnsserver.DnsserverTests.test_security_descriptor.*
+ ^samba4.blackbox.dbcheck-links.release-4-5-0-pre1.dbcheck_dangling_multi_valued_clean
+ ^samba4.blackbox.dbcheck-links.release-4-5-0-pre1.dangling_multi_valued_check_missing
+-^samba4.blackbox.net_ads_join.join
+ 
+ # We currently don't send referrals for LDAP modify of non-replicated attrs
+ ^samba4.ldap.rodc.python\(rodc\).__main__.RodcTests.test_modify_nonreplicated.*
+diff --git a/source3/include/secrets.h b/source3/include/secrets.h
+index a454c8bb8ff..061b9c6ef34 100644
+--- a/source3/include/secrets.h
++++ b/source3/include/secrets.h
+@@ -125,12 +125,15 @@ char *secrets_domain_info_string(TALLOC_CTX *mem_ctx, const struct secrets_domai
+ NTSTATUS secrets_fetch_or_upgrade_domain_info(const char *domain,
+ 					TALLOC_CTX *mem_ctx,
+ 					struct secrets_domain_info1 **pinfo);
+-NTSTATUS secrets_prepare_password_change(const char *domain, const char *dcname,
+-					 const char *cleartext_unix,
+-					 TALLOC_CTX *mem_ctx,
+-					 struct secrets_domain_info1 **pinfo,
+-					 struct secrets_domain_info1_change **pprev,
+-					 NTSTATUS (*sync_pw2keytabs_fn)(void));
++NTSTATUS secrets_prepare_password_change(
++	const char *domain,
++	const char *dcname,
++	const char *cleartext_unix,
++	TALLOC_CTX *mem_ctx,
++	struct secrets_domain_info1 **pinfo,
++	struct secrets_domain_info1_change **pprev,
++	NTSTATUS (*sync_pw2keytabs_fn)(const char *),
++	const char *opt_host);
+ NTSTATUS secrets_failed_password_change(const char *change_server,
+ 					NTSTATUS local_status,
+ 					NTSTATUS remote_status,
+@@ -139,10 +142,12 @@ NTSTATUS secrets_defer_password_change(const char *change_server,
+ 				       NTSTATUS local_status,
+ 				       NTSTATUS remote_status,
+ 				       const struct secrets_domain_info1 *info);
+-NTSTATUS secrets_finish_password_change(const char *change_server,
+-					NTTIME change_time,
+-					const struct secrets_domain_info1 *info,
+-					NTSTATUS (*sync_pw2keytabs_fn)(void));
++NTSTATUS secrets_finish_password_change(
++	const char *change_server,
++	NTTIME change_time,
++	const struct secrets_domain_info1 *info,
++	NTSTATUS (*sync_pw2keytabs_fn)(const char *),
++	const char *prefer_dc);
+ bool secrets_delete_machine_password_ex(const char *domain, const char *realm);
+ bool secrets_delete_domain_sid(const char *domain);
+ char *secrets_fetch_prev_machine_password(const char *domain);
+diff --git a/source3/libads/ads_proto.h b/source3/libads/ads_proto.h
+index 8440c35e46d..2e67eef155c 100644
+--- a/source3/libads/ads_proto.h
++++ b/source3/libads/ads_proto.h
+@@ -230,6 +230,6 @@ struct spn_struct {
+ /* parse a windows style SPN, returns NULL if parsing fails */
+ struct spn_struct *parse_spn(TALLOC_CTX *ctx, const char *srvprinc);
+ 
+-NTSTATUS sync_pw2keytabs(void);
++NTSTATUS sync_pw2keytabs(const char *prefer_dc);
+ 
+ #endif /* _LIBADS_ADS_PROTO_H_ */
+diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c
+index 49a892e5a55..1d4f9c12e1d 100644
+--- a/source3/libads/kerberos_keytab.c
++++ b/source3/libads/kerberos_keytab.c
+@@ -84,6 +84,7 @@ struct pw2kt_global_state {
+ 	char *ad_upn;
+ 	char *ad_sam_account;
+ 	char **ad_spn_array;
++	const char *prefer_dc;
+ 	size_t ad_num_spns;
+ 	/* This is from secrets.db */
+ 	struct secrets_domain_info1 *info;
+@@ -869,8 +870,11 @@ static ADS_STATUS pw2kt_get_dc_info(struct pw2kt_global_state *state)
+ 	int count;
+ 	bool ok;
+ 	TALLOC_CTX *tmp_ctx = talloc_stackframe();
+-	ADS_STRUCT *ads = ads_init(
+-		tmp_ctx, lp_realm(), lp_workgroup(), NULL, ADS_SASL_SIGN);
++	ADS_STRUCT *ads = ads_init(tmp_ctx,
++				   lp_realm(),
++				   lp_workgroup(),
++				   state->prefer_dc,
++				   ADS_SASL_SIGN);
+ 
+ 	if (ads == NULL) {
+ 		DBG_ERR("ads_init() failed\n");
+@@ -1029,7 +1033,20 @@ static bool pw2kt_default_keytab_name(char *name_str, size_t name_size)
+ 	return true;
+ }
+ 
+-NTSTATUS sync_pw2keytabs(void)
++/**
++ * @internal
++ *
++ * @brief Sync machine password from secrets to keytab
++ *
++ * @param prefer_dc  The DC we should talk to. This is especially important
++ *                   during domain join. Pass NULL if we should pick a random
++ *                   one.
++ *
++ * @return An NTSTATUS error code.
++ *
++ * @see NT_STATUS_IS_OK()
++ */
++NTSTATUS sync_pw2keytabs(const char *prefer_dc)
+ {
+ 	TALLOC_CTX *frame = talloc_stackframe();
+ 	const struct loadparm_substitution *lp_sub =
+@@ -1055,6 +1072,7 @@ NTSTATUS sync_pw2keytabs(void)
+ 		TALLOC_FREE(frame);
+ 		return NT_STATUS_NO_MEMORY;
+ 	}
++	state->prefer_dc = prefer_dc;
+ 
+ 	lp_ptr = lp_sync_machine_password_to_keytab();
+ 	if (lp_ptr == NULL) {
+diff --git a/source3/libads/trusts_util.c b/source3/libads/trusts_util.c
+index 6a39f32f350..c51c556e86b 100644
+--- a/source3/libads/trusts_util.c
++++ b/source3/libads/trusts_util.c
+@@ -360,10 +360,11 @@ NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context,
+ 							 &info,
+ 							 &prev,
+ #ifdef HAVE_ADS
+-							 sync_pw2keytabs);
++							 sync_pw2keytabs,
+ #else
+-							 NULL);
++							 NULL,
+ #endif
++							 NULL /* opt_host */);
+ 		if (!NT_STATUS_IS_OK(status)) {
+ 			DEBUG(0, ("secrets_prepare_password_change() failed for domain %s!\n",
+ 				  domain));
+@@ -610,10 +611,11 @@ NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context,
+ 			prev->password->change_time,
+ 			info,
+ #ifdef HAVE_ADS
+-			sync_pw2keytabs);
++			sync_pw2keytabs,
+ #else
+-			NULL);
++			NULL,
+ #endif
++			prev->password->change_server);
+ 		if (!NT_STATUS_IS_OK(status)) {
+ 			DEBUG(0, ("secrets_prepare_password_change() failed for domain %s!\n",
+ 				  domain));
+@@ -759,10 +761,11 @@ NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context,
+ 			info->next_change->change_time,
+ 			info,
+ #ifdef HAVE_ADS
+-			sync_pw2keytabs);
++			sync_pw2keytabs,
+ #else
+-			NULL);
++			NULL,
+ #endif
++			info->next_change->change_server);
+ 		if (!NT_STATUS_IS_OK(status)) {
+ 			DEBUG(0, ("secrets_finish_password_change() failed for domain %s!\n",
+ 				  domain));
+diff --git a/source3/libads/util.c b/source3/libads/util.c
+index 243dd09f3d0..360e556ab9b 100644
+--- a/source3/libads/util.c
++++ b/source3/libads/util.c
+@@ -59,10 +59,11 @@ ADS_STATUS ads_change_trust_account_password(ADS_STRUCT *ads, char *host_princip
+ 						 &info,
+ 						 &prev,
+ #ifdef HAVE_ADS
+-						 sync_pw2keytabs);
++						 sync_pw2keytabs,
+ #else
+-						 NULL);
++						 NULL,
+ #endif
++						 ads->auth.kdc_server);
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		return ADS_ERROR_NT(status);
+ 	}
+@@ -138,10 +139,11 @@ ADS_STATUS ads_change_trust_account_password(ADS_STRUCT *ads, char *host_princip
+ 						now,
+ 						info,
+ #ifdef HAVE_ADS
+-						sync_pw2keytabs);
++						sync_pw2keytabs,
+ #else
+-						NULL);
++						NULL,
+ #endif
++						ads->auth.kdc_server);
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		DEBUG(1,("Failed to save machine password\n"));
+ 		return ADS_ERROR_NT(status);
+diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
+index 5796c68e2e0..cb997dcbe23 100644
+--- a/source3/libnet/libnet_join.c
++++ b/source3/libnet/libnet_join.c
+@@ -867,7 +867,7 @@ static ADS_STATUS libnet_join_set_etypes(TALLOC_CTX *mem_ctx,
+ static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
+ 				      struct libnet_JoinCtx *r)
+ {
+-	NTSTATUS ntstatus = sync_pw2keytabs();
++	NTSTATUS ntstatus = sync_pw2keytabs(r->in.dc_name);
+ 
+ 	return NT_STATUS_IS_OK(ntstatus);
+ }
+diff --git a/source3/passdb/machine_account_secrets.c b/source3/passdb/machine_account_secrets.c
+index 0679535f026..568d77a3892 100644
+--- a/source3/passdb/machine_account_secrets.c
++++ b/source3/passdb/machine_account_secrets.c
+@@ -1674,7 +1674,8 @@ NTSTATUS secrets_prepare_password_change(const char *domain, const char *dcname,
+ 					 TALLOC_CTX *mem_ctx,
+ 					 struct secrets_domain_info1 **pinfo,
+ 					 struct secrets_domain_info1_change **pprev,
+-					 NTSTATUS (*sync_pw2keytabs_fn)(void))
++					 NTSTATUS (*sync_pw2keytabs_fn)(const char *),
++					 const char *opt_host)
+ {
+ 	TALLOC_CTX *frame = talloc_stackframe();
+ 	struct db_context *db = NULL;
+@@ -1770,7 +1771,7 @@ NTSTATUS secrets_prepare_password_change(const char *domain, const char *dcname,
+ 	}
+ 
+ 	if (prev == NULL && sync_pw2keytabs_fn != NULL) {
+-		status = sync_pw2keytabs_fn();
++		status = sync_pw2keytabs_fn(opt_host);
+ 		if (!NT_STATUS_IS_OK(status)) {
+ 			DBG_ERR("Sync of machine password failed.\n");
+ 			dbwrap_transaction_cancel(db);
+@@ -2023,7 +2024,8 @@ NTSTATUS secrets_defer_password_change(const char *change_server,
+ NTSTATUS secrets_finish_password_change(const char *change_server,
+ 					NTTIME change_time,
+ 					const struct secrets_domain_info1 *cookie,
+-					NTSTATUS (*sync_pw2keytabs_fn)(void))
++					NTSTATUS (*sync_pw2keytabs_fn)(const char *),
++					const char *prefer_dc)
+ {
+ 	const char *domain = cookie->domain_info.name.string;
+ 	TALLOC_CTX *frame = talloc_stackframe();
+@@ -2102,7 +2104,7 @@ NTSTATUS secrets_finish_password_change(const char *change_server,
+ 	}
+ 
+ 	if (sync_pw2keytabs_fn != NULL) {
+-		status = sync_pw2keytabs_fn();
++		status = sync_pw2keytabs_fn(prefer_dc);
+ 		if (!NT_STATUS_IS_OK(status)) {
+ 			DBG_ERR("Sync of machine password failed.\n");
+ 			TALLOC_FREE(frame);
+diff --git a/source3/utils/net.c b/source3/utils/net.c
+index 7ce93ced79e..ecabd980d0c 100644
+--- a/source3/utils/net.c
++++ b/source3/utils/net.c
+@@ -235,10 +235,11 @@ static int net_changesecretpw(struct net_context *c, int argc,
+ 							 &info,
+ 							 &prev,
+ #ifdef HAVE_ADS
+-							 sync_pw2keytabs);
++							 sync_pw2keytabs,
+ #else
+-							 NULL);
++							 NULL,
+ #endif
++							 c->opt_host);
+ 		if (!NT_STATUS_IS_OK(status)) {
+ 			d_fprintf(stderr,
+ 			        _("Unable to write the machine account password in the secrets database"));
+@@ -261,10 +262,11 @@ static int net_changesecretpw(struct net_context *c, int argc,
+ 							now,
+ 							info,
+ #ifdef HAVE_ADS
+-							sync_pw2keytabs);
++							sync_pw2keytabs,
+ #else
+-							NULL);
++							NULL,
+ #endif
++							c->opt_host);
+ 		if (!NT_STATUS_IS_OK(status)) {
+ 			d_fprintf(stderr,
+ 			        _("Unable to write the machine account password in the secrets database"));
+diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
+index 46531210411..753b957e43f 100644
+--- a/source3/utils/net_ads.c
++++ b/source3/utils/net_ads.c
+@@ -2965,7 +2965,7 @@ static int net_ads_keytab_create(struct net_context *c, int argc, const char **a
+ 		net_use_krb_machine_account(c);
+ 	}
+ 
+-	ntstatus = sync_pw2keytabs();
++	ntstatus = sync_pw2keytabs(c->opt_host);
+ 	ret = NT_STATUS_IS_OK(ntstatus) ? 0 : 1;
+ 	return ret;
+ }
+-- 
+2.51.0
+

SOURCES/samba-4.21.3.tar.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEEgfXigyvSVFoYl7cTqplEL7aAtiAFAmd796YACgkQqplEL7aA
-tiAdpA/9EodazpG4Vo534WW3aKiBxEWt0LzGjDZ6GUbTpCRIJE+a/a36rxbAgHFH
-Mpc9mVnCI6/UWv1plnsLwNG4RnC/o0tDrw2ttvIX/ZEiWEPWU38sgfZ+vlwX1r2B
-3Hi7Uym4br0SmPwrep5kPfjnE396ftlnC6YMHXZ+tg3i6y8m6msr8rEB8ejLx7RF
-qXtJ/YO4HK2DrE51l/Ziyav9FwBgVoE9Sl0oXwLoUX5lhWh6qNe8Qz+bd0s36x1e
-5w+ocSNuD2ph5uO1W+pmdOJyMgq8QFchOwxdHi454nRrelp7Kwtb2ARBHrFwoQ+V
-kinQlufJ0sb59imso65Tl3EGuuV61CUQgGx9Ln9/wBMXdiPDNhi/H+ikH2AeVzpz
-DFuL9WEU/HYT4thCKlNox5T8s90/95vT5MlN2q/CJhFjIti6mb7iM9uxatGFzUBI
-A3OxPRc9IbORTEPYxLzsuPrxo+bcFXg0Go8SoNa4W3NYIehMDqnuWOOnC/ixleta
-ig635ivxl5owC1CC/GzilBnJ/Tq4bzbZOrYDeYCYa5FkXv9EaTIT9JQcRr0LJcDS
-Z43RoD9g9tG6tIea0XyAaPkfVillfnf70vcuelxycl3bhhuvSZUQ+8cqQ0vuUg1V
-pcclEjCcgIecIR9r2zSv5S5EldS7hQ6t5pCC5KcJKyeq+LLaj5s=
-=DkSu
------END PGP SIGNATURE-----

SOURCES/samba-4.22.4.tar.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEgfXigyvSVFoYl7cTqplEL7aAtiAFAminOhEACgkQqplEL7aA
+tiDtRg//e/Jocf1iPjaEtiR2tGQSnqQPdaaRId8luFu0ykevvIiR+GL2IctJnvWZ
+IYL/svmWAlLULgb+13S1Gs7CGYTievrh+OaEnuo+CmnGpNYUFO/yyymBW9eWFGA4
+bA6ilMjE2KgyCakvBT22mL9IFGZQsKQh46YXjs4hCKZdadx733/Znwj/kIkm0Wxl
+S6gnxstroM5zUbA/Xw26KUOBTd0mTZXXKH14HSH1XX3RNgA0/FsZ+kde4Y+VUwP+
+t/LvuNqN2s/pyUeKd8eoiZv7zTwUT1gsvoBTWP8kzmubtBbxz4abJ9QCEb/HEdkv
+iMh1RbRQZRKpmIo/NzAMRhxDyuVtzg69Egn19iLjnPfmrpqDZpxhi5csNumIFKsi
+bFmT7/KTZfKvsg9h5SfHL3JeblYbEQNjIhDutdZ3yJ+JymAkaWjChHqY0wTwiZbX
+pHing+t+c4SRx2064/jBFn48kdj1JweEaGSGdEEwa7zejMHLcl7vKheyGqSTWMYH
+XiBtm1kN2gLrgazLFNXKTD9YectYPmRkiv6f1hUhqLfac2jkwIdWeT1LIPqJ2fMw
+YrNk4UYYS4L7PZSXUJ3r88RGPWJvTa7WQrM556uxcspCr7W6TauMRe0hKquqOekH
+0J4jD+hmfuEQ/LryC29rSLSNG0N99v2nWuAn78KxUk7FuZ9H4og=
+=D+9R
+-----END PGP SIGNATURE-----

SOURCES/samba.logrotate

@@ -1,4 +1,4 @@
-/var/log/samba/log.* {
+/var/log/samba/*log* {
     compress
     dateext
     maxage 365

SPECS/samba.spec

@@ -2,7 +2,7 @@
 ## (rpmautospec version 0.6.5)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 14;
+    release_number = 6;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -16,7 +16,7 @@
 # or
 # rpmbuild --rebuild --with testsuite samba.src.rpm
 #
-%bcond_with testsuite
+%bcond testsuite 0
 
 # Build with internal talloc, tevent, tdb
 #
@@ -24,132 +24,97 @@
 # or
 # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm
 #
-%bcond_with includelibs
+%bcond includelibs 0
 
 # fedpkg mockbuild --with=ccache
-%bcond_with ccache
+%bcond ccache 0
 
 # ctdb is enabled by default, you can disable it with: --without clustering
-%bcond_without clustering
+%bcond clustering 1
 
 # Define _make_verbose if it doesn't exist (RHEL8)
 %{!?_make_verbose:%define _make_verbose V=1 VERBOSE=1}
 
 # Build with Active Directory Domain Controller support by default on Fedora
 %if 0%{?fedora}
-%bcond_without dc
+%bcond dc 1
 %else
-%bcond_with dc
+%bcond dc 0
 %endif
 
 # Build a libsmbclient package by default
-%bcond_without libsmbclient
+%bcond libsmbclient 1
 
 # Build a libwbclient package by default
-%bcond_without libwbclient
+%bcond libwbclient 1
 
 # Build with winexe by default
 %if 0%{?rhel}
 
 %ifarch x86_64
-%bcond_without winexe
+%bcond winexe 1
 %else
-%bcond_with winexe
+%bcond winexe 0
 #endifarch
 %endif
 
 %else
-%bcond_without winexe
+%bcond winexe 1
 %endif
 
 # Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora
 %if 0%{?fedora}
 
 %ifarch aarch64 ppc64le s390x x86_64 riscv64
-%bcond_without vfs_cephfs
+%bcond vfs_cephfs 1
-%bcond_without ceph_mutex
+%bcond ceph_mutex 1
 %else
-%bcond_with vfs_cephfs
+%bcond vfs_cephfs 0
-%bcond_with ceph_mutex
+%bcond ceph_mutex 0
 #endifarch
 %endif
 
 %else
-%bcond_with vfs_cephfs
+%bcond vfs_cephfs 0
-%bcond_with ceph_mutex
+%bcond ceph_mutex 0
 #endif fedora
 %endif
 
-# Build vfs_gluster module by default on 64bit Fedora
-%global is_rhgs 0
-%if "%{dist}" == ".el7rhgs" || "%{dist}" == ".el8rhgs"
-%global is_rhgs 1
-%endif
-
 %if 0%{?fedora}
 
 %ifarch aarch64 ppc64le s390x x86_64 riscv64
-%bcond_without vfs_glusterfs
+%bcond vfs_glusterfs 1
 %else
-%bcond_with vfs_glusterfs
+%bcond vfs_glusterfs 0
 #endifarch
 %endif
 
-#else rhel
-%else
-
-%if 0%{?is_rhgs}
-# Enable on rhgs x86_64
-%ifarch x86_64
-%bcond_without vfs_glusterfs
-%else
-%bcond_with vfs_glusterfs
-#endifarch
-%endif
-%else
-%bcond_with vfs_glusterfs
-#endif is_rhgs
-%endif
-
 #endif fedora
 %endif
 
 # Build vfs_io_uring module by default on 64bit Fedora
-%if 0%{?fedora} || 0%{?rhel} >= 8
-
 %ifarch aarch64 ppc64le s390x x86_64 riscv64
-%bcond_without vfs_io_uring
+%bcond vfs_io_uring 1
 %else
-%bcond_with vfs_io_uring
+%bcond vfs_io_uring 0
 #endifarch
 %endif
 
-%else
-%bcond_with vfs_io_uring
-#endif fedora || rhel >= 8
-%endif
-
 # Build the ctdb-pcp-pmda package by default on Fedora, except for i686 where
 # pcp is no longer supported
 %if 0%{?fedora}
 %ifnarch i686
-%bcond_without pcp_pmda
+%bcond pcp_pmda 1
 %endif
 %else
-%bcond_with pcp_pmda
+%bcond pcp_pmda 0
 %endif
 
 # Build the etcd helpers by default on Fedora
 %if 0%{?fedora}
-%bcond_without etcd_mutex
+%bcond etcd_mutex 1
 %else
-%bcond_with etcd_mutex
+%bcond etcd_mutex 0
-%endif
-
-%if 0%{?fedora} || 0%{?rhel} >= 9
-%bcond_without gpupdate
-%else
-%bcond_with gpupdate
 %endif
 
 %ifarch aarch64 ppc64le s390x x86_64
@@ -158,7 +123,7 @@
 %bcond lmdb 0
 %endif
 
-%global samba_version 4.21.3
+%global samba_version 4.22.4
 
 # The release field is extended:
 # <pkgrel>[.<extraver>][.<snapinfo>]%%{?dist}[.<minorbump>]
@@ -186,7 +151,7 @@
 %global libdcerpc_so_version 0
 %global libndr_krb5pac_so_version 0
 %global libndr_nbt_so_version 0
-%global libndr_so_version 5
+%global libndr_so_version 6
 %global libndr_standard_so_version 0
 %global libnetapi_so_version 1
 %global libsamba_credentials_so_version 1
@@ -203,9 +168,9 @@
 %global libsmbclient_so_version 0
 %global libwbclient_so_version 0
 
-%global talloc_version 2.4.2
+%global talloc_version 2.4.3
-%global tdb_version 1.4.12
+%global tdb_version 1.4.13
-%global tevent_version 0.16.1
+%global tevent_version 0.16.2
 
 %global required_mit_krb5 1.20.1
 
@@ -264,11 +229,11 @@ Source202:      samba.abignore
 #
 # git clone git@gitlab.com:samba-redhat/samba.git
 # cd samba
-# git checkout v4-21-redhat
+# git checkout v4-22-redhat
-# git format-patch --stdout -l1 --no-renames -N > redhat-4.21.patch
+# git format-patch --stdout -l1 --no-renames -N > redhat-4.22.patch
 # where N is number of commits
 
-Patch0:        redhat-4.21.patch
+Patch0:        redhat-4.22.patch
 
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
@@ -304,7 +269,7 @@ Obsoletes: samba-swat < %{samba_depver}
 Provides: samba4-swat = %{samba_depver}
 Obsoletes: samba4-swat < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 BuildRequires: make
 BuildRequires: gcc
@@ -332,6 +297,7 @@ BuildRequires: libicu-devel
 BuildRequires: libcmocka-devel
 BuildRequires: libtirpc-devel
 BuildRequires: libuuid-devel
+BuildRequires: libxcrypt-devel
 BuildRequires: libxslt
 %if %{with lmdb}
 BuildRequires: lmdb
@@ -369,7 +335,7 @@ BuildRequires: zlib-devel >= 1.2.3
 
 BuildRequires: pkgconfig(libsystemd)
 
-%ifnarch i686 riscv64
+%ifnarch i686
 %if 0%{?fedora} >= 37
 BuildRequires: mold
 %endif
@@ -398,9 +364,7 @@ BuildRequires: librados-devel
 BuildRequires: python3-etcd
 %endif
 
-%if %{with gpupdate}
 BuildRequires: cepces-certmonger >= 0.3.8
-%endif
 
 # pidl requirements
 BuildRequires: perl(ExtUtils::MakeMaker)
@@ -497,7 +461,7 @@ Obsoletes: samba4-client < %{samba_depver}
 Requires(post): %{_sbindir}/update-alternatives
 Requires(postun): %{_sbindir}/update-alternatives
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description client
 The %{name}-client package provides some SMB/CIFS clients to complement
@@ -550,7 +514,7 @@ Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 %endif
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %if %{without dc} && %{without testsuite}
 Obsoletes: samba-dc < %{samba_depver}
@@ -592,7 +556,7 @@ Requires: libnetapi = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 %endif
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description common-tools
 The samba-common-tools package contains tools for SMB/CIFS clients.
@@ -662,7 +626,7 @@ Requires: bind-utils
 Provides: samba4-dc = %{samba_depver}
 Obsoletes: samba4-dc < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description dc
 The samba-dc package provides AD Domain Controller functionality
@@ -690,7 +654,7 @@ Requires: libwbclient = %{samba_depver}
 Provides: samba4-dc-libs = %{samba_depver}
 Obsoletes: samba4-dc-libs < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description dc-libs
 The %{name}-dc-libs package contains the libraries needed by the DC to
@@ -709,7 +673,7 @@ Requires: bind
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description dc-bind-dlz
 The %{name}-dc-bind-dlz package contains the libraries for bind to manage all
@@ -745,7 +709,7 @@ Requires: %{name}-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description vfs-cephfs
 Samba VFS module for Ceph distributed storage system integration.
@@ -762,7 +726,7 @@ Requires: %{name}-client-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description vfs-iouring
 Samba VFS module for io_uring instance integration.
@@ -787,14 +751,13 @@ Requires: libwbclient = %{samba_depver}
 Obsoletes: samba-glusterfs < %{samba_depver}
 Provides: samba-glusterfs = %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description vfs-glusterfs
 Samba VFS module for GlusterFS integration.
 %endif
 
 ### GPUPDATE
-%if %{with gpupdate}
 %package gpupdate
 Summary: Samba GPO support for clients
 Requires: cepces-certmonger
@@ -803,14 +766,12 @@ Requires: %{name}-ldb-ldap-modules = %{samba_depver}
 Requires: python3-%{name} = %{samba_depver}
 # samba-tool needs python3-samba-dc also on non-dc build
 Requires: python3-%{name}-dc = %{samba_depver}
+BuildArch: noarch
 
 %description gpupdate
 This package provides the samba-gpupdate tool to apply Group Policy Objects
 (GPO) on Samba clients.
 
-#endif with gpupdate
-%endif
-
 ### KRB5-PRINTING
 %package krb5-printing
 Summary: Samba CUPS backend for printing with Kerberos
@@ -851,7 +812,7 @@ Requires: libwbclient = %{samba_depver}
 Provides: samba4-libs = %{samba_depver}
 Obsoletes: samba4-libs < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description libs
 The %{name}-libs package contains the libraries needed by programs that link
@@ -952,7 +913,7 @@ Requires: libsmbclient = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 %endif
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description -n python3-%{name}
 The python3-%{name} package contains the Python 3 libraries needed by programs
@@ -1026,7 +987,7 @@ Requires: perl(Archive::Tar)
 Provides: samba4-test = %{samba_depver}
 Obsoletes: samba4-test < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description test
 %{name}-test provides testing tools for both the server and client
@@ -1046,7 +1007,7 @@ Requires: libwbclient = %{samba_depver}
 Provides: %{name}-test-devel = %{samba_depver}
 Obsoletes: %{name}-test-devel < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description test-libs
 %{name}-test-libs provides libraries required by the testing tools.
@@ -1056,6 +1017,7 @@ Provides: bundled(libreplace)
 Summary: Provides support for non-root user shares
 Requires: %{name} = %{samba_depver}
 Requires: %{name}-common-tools = %{samba_depver}
+BuildArch: noarch
 
 %description usershares
 Installing this package will provide a configuration file, group and
@@ -1090,7 +1052,7 @@ Obsoletes: samba4-winbind < %{samba_depver}
 # Old NetworkManager expects the dispatcher scripts in a different place
 Conflicts: NetworkManager < 1.20
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description winbind
 The samba-winbind package provides the winbind NSS library, and some client
@@ -1113,7 +1075,7 @@ Requires: libwbclient = %{samba_depver}
 Provides: samba4-winbind-clients = %{samba_depver}
 Obsoletes: samba4-winbind-clients < %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description winbind-clients
 The samba-winbind-clients package provides the wbinfo and ntlm_auth
@@ -1143,7 +1105,7 @@ Requires(post): %{_sbindir}/update-alternatives
 Requires(postun): %{_sbindir}/update-alternatives
 Requires(preun): %{_sbindir}/update-alternatives
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description winbind-krb5-locator
 The winbind krb5 locator is a plugin for the system kerberos library to allow
@@ -1159,7 +1121,7 @@ Requires: libwbclient = %{samba_depver}
 %endif
 Requires: pam
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description winbind-modules
 The samba-winbind-modules package provides the NSS library and a PAM module
@@ -1175,7 +1137,7 @@ Requires: %{name}-common-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description winexe
 Winexe is a Remote Windows-command executor
@@ -1211,7 +1173,7 @@ Requires(post): systemd-units
 Requires(preun): systemd-units
 Requires(postun): systemd-units
 
-Provides: bundled(libreplace)
+Provides: bundled(libreplace) = %{samba_depver}
 
 %description -n ctdb
 CTDB is a cluster implementation of the TDB database used by Samba and other
@@ -1239,6 +1201,7 @@ Performance Co-Pilot (PCP) support for CTDB
 Summary: CTDB ETCD mutex helper
 Requires: ctdb = %{samba_depver}
 Requires: python3-etcd
+BuildArch: noarch
 
 %description -n ctdb-etcd-mutex
 Support for using an existing ETCD cluster as a mutex helper for CTDB
@@ -1265,11 +1228,14 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB
 %package -n libldb
 Summary: A schema-less, ldap like, API and database
 License: LGPL-3.0-or-later
+%if %{without includelibs}
 Requires: libtalloc%{?_isa} >= %{talloc_version}
 Requires: libtdb%{?_isa} >= %{tdb_version}
 Requires: libtevent%{?_isa} >= %{tevent_version}
+Requires: samba-common-libs = %{samba_depver}
+# /endif without includelibs
+%endif
 
-Provides: bundled(libreplace)
 Obsoletes: libldb < 0:2.10
 Provides: libldb = 0:2.10
 Provides: libldb = %{samba_depver}
@@ -1283,9 +1249,12 @@ servers, or use local tdb databases.
 Summary: Developer tools for the LDB library
 License: LGPL-3.0-or-later
 Requires: libldb%{?_isa} = %{samba_depver}
+%if %{without includelibs}
 Requires: libtdb-devel%{?_isa} >= %{tdb_version}
 Requires: libtalloc-devel%{?_isa} >= %{talloc_version}
 Requires: libtevent-devel%{?_isa} >= %{tevent_version}
+# /endif without includelibs
+%endif
 
 Obsoletes: libldb-devel < 0:2.10
 Provides: libldb-devel = 0:2.10
@@ -1310,7 +1279,10 @@ Tools to manage LDB files
 Summary: Python bindings for the LDB library
 License: LGPL-3.0-or-later
 Requires: libldb%{?_isa} = %{samba_depver}
+%if %{without includelibs}
 Requires: python3-tdb%{?_isa} >= %{tdb_version}
+# /endif without includelibs
+%endif
 Requires: samba-client-libs = %{samba_depver}
 %{?python_provide:%python_provide python3-ldb}
 
@@ -1487,6 +1459,7 @@ install -d -m 0755 %{buildroot}/var/lib/samba/sysvol
 install -d -m 0755 %{buildroot}/var/lib/samba/usershares
 install -d -m 0755 %{buildroot}/var/lib/samba/winbindd_privileged
 install -d -m 0755 %{buildroot}/var/log/samba/old
+install -d -m 0755 %{buildroot}/run/ctdb
 install -d -m 0755 %{buildroot}/run/samba
 install -d -m 0755 %{buildroot}/run/winbindd
 install -d -m 0755 %{buildroot}/%{_libdir}/samba
@@ -1561,11 +1534,6 @@ for i in \
 done
 %endif
 
-%if %{without gpupdate}
-rm -f %{buildroot}%{_sbindir}/samba-gpupdate
-rm -f %{buildroot}%{_mandir}/man8/samba-gpupdate.8*
-%endif
-
 %if %{without vfs_glusterfs}
 rm -f %{buildroot}%{_mandir}/man8/vfs_glusterfs.8*
 %endif
@@ -1702,12 +1670,12 @@ fi
 
 %post krb5-printing
 %{_sbindir}/update-alternatives --install %{_libexecdir}/samba/cups_backend_smb \
-	cups_backend_smb \
+    cups_backend_smb \
-	%{_libexecdir}/samba/smbspool_krb5_wrapper 50
+    %{_libexecdir}/samba/smbspool_krb5_wrapper 50
 
 %postun krb5-printing
 if [ $1 -eq 0 ] ; then
-	%{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper
+    %{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper
 fi
 
 %ldconfig_scriptlets libs
@@ -2049,7 +2017,6 @@ fi
 %{_libdir}/samba/libposix-eadb-private-samba.so
 %{_libdir}/samba/libprinter-driver-private-samba.so
 %{_libdir}/samba/libprinting-migrate-private-samba.so
-%{_libdir}/samba/libreplace-private-samba.so
 %{_libdir}/samba/libregistry-private-samba.so
 %{_libdir}/samba/libsamba-cluster-support-private-samba.so
 %{_libdir}/samba/libsamba-debug-private-samba.so
@@ -2132,6 +2099,7 @@ fi
 %files common-libs
 # common libraries
 %{_libdir}/samba/libcmdline-private-samba.so
+%{_libdir}/samba/libreplace-private-samba.so
 
 %dir %{_libdir}/samba/ldb
 
@@ -2463,12 +2431,9 @@ fi
 %endif
 
 ### GPUPDATE
-%if %{with gpupdate}
 %files gpupdate
 %{_mandir}/man8/samba-gpupdate.8*
 %{_sbindir}/samba-gpupdate
-#endif with gpupdate
-%endif
 
 ### KRB5-PRINTING
 %files krb5-printing
@@ -2681,8 +2646,11 @@ fi
 %{python3_sitearch}/samba/dnsresolver.py
 %dir %{python3_sitearch}/samba/domain
 %{python3_sitearch}/samba/domain/__init__.py
+%dir %{python3_sitearch}/samba/domain/__pycache__
 %{python3_sitearch}/samba/domain/__pycache__/__init__.*.pyc
+%dir %{python3_sitearch}/samba/domain/models
 %{python3_sitearch}/samba/domain/models/__init__.py
+%dir %{python3_sitearch}/samba/domain/models/__pycache__
 %{python3_sitearch}/samba/domain/models/__pycache__/__init__.*.pyc
 %{python3_sitearch}/samba/domain/models/__pycache__/auth_policy.*.pyc
 %{python3_sitearch}/samba/domain/models/__pycache__/auth_silo.*.pyc
@@ -2891,28 +2859,28 @@ fi
 %dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__
 %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc
 %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy
-%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__init__.py
-%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py
 %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__
-%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/__init__.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/policy.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_from.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_to.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_from.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_to.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_from.py
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_to.py
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_from.py
 %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_to.py
 %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo
 %{python3_sitearch}/samba/netcmd/domain/auth/silo/__init__.py
-%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py
 %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__
 %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/__init__.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/member.*.pyc
 %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/silo.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py
 %{python3_sitearch}/samba/netcmd/domain/auth/silo/silo.py
 %{python3_sitearch}/samba/netcmd/domain/backup.py
 %dir %{python3_sitearch}/samba/netcmd/domain/claim
@@ -2965,6 +2933,7 @@ fi
 %{python3_sitearch}/samba/netcmd/schema.py
 %dir %{python3_sitearch}/samba/netcmd/service_account
 %{python3_sitearch}/samba/netcmd/service_account/__init__.py
+%dir %{python3_sitearch}/samba/netcmd/service_account/__pycache__
 %{python3_sitearch}/samba/netcmd/service_account/__pycache__/__init__.*.pyc
 %{python3_sitearch}/samba/netcmd/service_account/__pycache__/group_msa_membership.*.pyc
 %{python3_sitearch}/samba/netcmd/service_account/__pycache__/service_account.*.pyc
@@ -3077,6 +3046,7 @@ fi
 
 %if %{with includelibs}
 %{_libdir}/samba/libpyldb-util.cpython*.so
+%{_libdir}/samba/libpytalloc-util.cpython*.so
 
 %{python3_sitearch}/__pycache__/_ldb_text*.pyc
 %{python3_sitearch}/__pycache__/_tdb_text*.pyc
@@ -3085,8 +3055,7 @@ fi
 %{python3_sitearch}/_tdb_text.py
 %{python3_sitearch}/_tevent.cpython*.so
 %{python3_sitearch}/ldb.cpython*.so
-#FIXME why is it missing?
+%{python3_sitearch}/talloc.cpython*.so
-#%{python3_sitearch}/talloc.cpython*.so
 %{python3_sitearch}/tdb.cpython*.so
 %{python3_sitearch}/tevent.py
 #endif with includelibs
@@ -3253,6 +3222,7 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/py_credentials.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/registry.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/reparsepoints.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/rust.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/s3idmapdb.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/s3param.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/s3passdb.*.pyc
@@ -3486,6 +3456,7 @@ fi
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/netlogon.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/pkinit_tests.*.pyc
@@ -3528,6 +3499,7 @@ fi
 %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py
 %{python3_sitearch}/samba/tests/krb5/lockout_tests.py
 %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py
+%{python3_sitearch}/samba/tests/krb5/netlogon.py
 %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py
 %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py
 %{python3_sitearch}/samba/tests/krb5/pkinit_tests.py
@@ -3563,9 +3535,11 @@ fi
 %dir %{python3_sitearch}/samba/tests/ndr
 %{python3_sitearch}/samba/tests/ndr/gkdi.py
 %{python3_sitearch}/samba/tests/ndr/gmsa.py
+%{python3_sitearch}/samba/tests/ndr/sd.py
 %dir %{python3_sitearch}/samba/tests/ndr/__pycache__
 %{python3_sitearch}/samba/tests/ndr/__pycache__/gkdi.*.pyc
 %{python3_sitearch}/samba/tests/ndr/__pycache__/gmsa.*.pyc
+%{python3_sitearch}/samba/tests/ndr/__pycache__/sd.*.pyc
 %{python3_sitearch}/samba/tests/ndr/__pycache__/wbint.*.pyc
 %{python3_sitearch}/samba/tests/ndr/wbint.py
 %{python3_sitearch}/samba/tests/netbios.py
@@ -3600,6 +3574,7 @@ fi
 %{python3_sitearch}/samba/tests/py_credentials.py
 %{python3_sitearch}/samba/tests/registry.py
 %{python3_sitearch}/samba/tests/reparsepoints.py
+%{python3_sitearch}/samba/tests/rust.py
 %{python3_sitearch}/samba/tests/s3idmapdb.py
 %{python3_sitearch}/samba/tests/s3param.py
 %{python3_sitearch}/samba/tests/s3passdb.py
@@ -3816,6 +3791,7 @@ fi
 %config(noreplace) %{_sysconfdir}/ctdb/ctdb.conf
 %config(noreplace) %{_sysconfdir}/ctdb/notify.sh
 %config(noreplace) %{_sysconfdir}/ctdb/debug-hung-script.sh
+%config(noreplace) %{_sysconfdir}/ctdb/ctdb-backup-persistent-tdbs.sh
 %config(noreplace) %{_sysconfdir}/ctdb/ctdb-crash-cleanup.sh
 %config(noreplace) %{_sysconfdir}/ctdb/debug_locks.sh
 
@@ -3859,8 +3835,8 @@ fi
 %{_libexecdir}/ctdb/ctdb_natgw
 %{_libexecdir}/ctdb/ctdb-path
 %{_libexecdir}/ctdb/ctdb_recovery_helper
+%{_libexecdir}/ctdb/ctdb_smnotify_helper
 %{_libexecdir}/ctdb/ctdb_takeover_helper
-%{_libexecdir}/ctdb/smnotify
 %{_libexecdir}/ctdb/statd_callout
 %{_libexecdir}/ctdb/statd_callout_helper
 %{_libexecdir}/ctdb/tdb_mutex_check
@@ -3883,6 +3859,8 @@ fi
 %{_mandir}/man7/ctdb-tunables.7.gz
 %{_mandir}/man7/ctdb-statistics.7.gz
 
+%ghost %dir /run/ctdb
+
 %{_tmpfilesdir}/ctdb.conf
 
 %{_unitdir}/ctdb.service
@@ -3909,6 +3887,7 @@ fi
 %{_datadir}/ctdb/events/legacy/60.nfs.script
 %{_datadir}/ctdb/events/legacy/70.iscsi.script
 %{_datadir}/ctdb/events/legacy/91.lvs.script
+%{_datadir}/ctdb/events/legacy/95.database.script
 %dir %{_datadir}/ctdb/scripts
 %{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh
 
@@ -3950,6 +3929,7 @@ fi
 %endif
 
 %files -n libldb
+%license lib/ldb/LICENSE
 %{_libdir}/libldb.so.*
 %dir %{_libdir}/samba
 %{_libdir}/samba/libldb-key-value-private-samba.so
@@ -4009,41 +3989,50 @@ fi
 
 %changelog
 ## START: Generated by rpmautospec
-* Wed Sep 10 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-14
+* Thu Sep 11 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.4-6
-- resolves: RHEL-113388 - Rebuild for zstream
+- resolves: RHEL-104147 - Fix 'net ads join' in setups with multiple DCs
 
-* Sat Sep 06 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-13
+* Thu Aug 21 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.4-5
-- resolves: RHEL-113388 - Fix 'net ads join' in setups with multiple DCs
+- resolves: RHEL-101761 - Fix DC discovery after Windows netlogon hardening
+  (follow-up, main fix is in samba-4.22.2-4.el9)
 
-* Wed Aug 27 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-12
+* Thu Aug 21 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.4-4
-- resolves: RHEL-101766 - Fix DC discovery after Windows netlogon hardening
+- resolves: RHEL-110530 - Fix winbind fork bomb in 'IPA with AD trust'
-  (follow-up, main fix is in samba-4.21.3-7)
-
-* Wed Aug 27 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-11
-- resolves: RHEL-111311 - Fix winbind fork bomb in 'IPA with AD trust'
   environment
 
-* Wed Aug 27 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-10
+* Thu Aug 21 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.4-3
-- resolves: RHEL-102934 - Fix samba-gpupdate to process empty GPO Link
+- resolves: RHEL-102932 - Fix samba-gpupdate to process empty GPO Link
 
-* Wed Aug 27 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-9
+* Thu Aug 21 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.4-2
-- resolves: RHEL-105624 - Fix 'net ads kerberos kinit'
+- resolves: RHEL-105623 - Fix 'net ads kerberos kinit'
 
-* Wed Aug 27 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-8
+* Thu Aug 21 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.4-1
-- resolves: RHEL-103411 - smb.conf: Remove the '@' for NIX groups, we
+- Update to version 4.22.4
-  removed NIS support
+- resolves: RHEL-89873
 
-* Mon Jul 07 2025 Andreas Schneider <asn@redhat.com> - 0:4.21.3-7
+* Thu Aug 21 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.3-3
-- Fix DC discovery after Windows netlogon hardening
+- resolves: RHEL-103410 - Update '@printadmin' in sbm.conf
 
-* Tue Jun 17 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-6
+* Tue Jul 08 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.3-2
-- resolves: RHEL-97486
+- resolves: RHEL-102370 - Fix issue with unresponsive second DC when using
+  idmap_ad
 
-* Wed Apr 16 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-5
+* Tue Jul 08 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.3-1
-- resolves: RHEL-75587 - Fix deadlock between two smbd processes
+- Update to version 4.22.3
+- resolves: RHEL-89873
 
-* Mon Mar 31 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-4
+* Mon Jul 07 2025 Andreas Schneider <asn@redhat.com> - 0:4.22.2-4
-- resolves: RHEL-85348 - Fix winbindd memory leak
+- Fix DC discovery after Windows netlogon hardening.
+
+* Tue Jun 10 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.2-3
+- resolves: RHEL-87571 - Fix deadlock between two smbd processes
+
+* Tue Jun 10 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.2-2
+- resolves: RHEL-85342 - Fix winbindd memory leak
+
+* Tue Jun 10 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.2-1
+- Update to version 4.22.2
+- resolves: RHEL-89873
 
 * Mon Feb 17 2025 Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-3
 - resolves: RHEL-78773 - Fix keytab generation