Update to version 4.21.0

- resolves: RHEL-59777

.gitignore

@@ -363,3 +363,5 @@ samba-3.6.0pre1.tar.gz
 /samba-4.20.1.tar.asc
 /samba-4.20.2.tar.xz
 /samba-4.20.2.tar.asc
+/samba-4.21.0.tar.asc
+/samba-4.21.0.tar.xz

gating.yaml

@@ -1,7 +1,6 @@
 # recipients: idmafs-qe, asn, ftrivino, pfilipen
 --- !Policy
 product_versions:
-  - rhel-9
   - rhel-10
 decision_context: osci_compose_gate
 rules:

redhat-4.20.2.patch

@@ -1,102 +0,0 @@
-From dddbbec2cb10b05a6ec3b4f1fcc877d60a44080a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
-Date: Thu, 4 Jul 2024 11:08:03 +0200
-Subject: [PATCH 1/2] .gitlab-ci-main.yml: Add safe.directory '*'
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This is to fix the error when pushing to personal gitlab repo:
-
-2024-07-04 08:16:05,460 Running: 'git clone --recursive --shared /builds/pfilipen/samba /builds/samba-testbase/master' in '/builds/pfilipen/samba'
-Cloning into '/builds/samba-testbase/master'...
-fatal: detected dubious ownership in repository at '/builds/pfilipen/samba/.git'
-To add an exception for this directory, call:
-	git config --global --add safe.directory /builds/pfilipen/samba/.git
-fatal: Could not read from remote repository.
-
-Instead of adding more and more explicit repositories
-we should just allow any, we're in an isolated environment...
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15660
-
-Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
-Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
-Signed-off-by: Stefan Metzmacher <metze@samba.org>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-
-Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
-Autobuild-Date(master): Wed Jul 10 10:35:00 UTC 2024 on atb-devel-224
-
-(cherry picked from commit 3a21b7d9a4e7e9814d0be8c0ebf72b9821a5dc36)
----
- .gitlab-ci-main.yml | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/.gitlab-ci-main.yml b/.gitlab-ci-main.yml
-index face2103327..08865ca2c42 100644
---- a/.gitlab-ci-main.yml
-+++ b/.gitlab-ci-main.yml
-@@ -146,8 +146,7 @@ include:
-     - ccache -z -M 500M
-     - ccache -s
-       # We are already running .gitlab-ci directives from this repo, remove additional checks that break our CI
--    - git config --global --add safe.directory `pwd`
--    - git config --global --add safe.directory /builds/samba-team/devel/samba/.git
-+    - git config --global --add safe.directory '*'
-   after_script:
-     - mount
-     - df -h
--- 
-2.45.2
-
-
-From 1c69964d34d2cf66532b23ffde76a839a65b0db2 Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Fri, 12 Jul 2024 14:18:26 +0200
-Subject: [PATCH 2/2] s3:printing: Allow to run samba-bgqd as a standalone
- systemd service
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15683
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
-Reviewed-by: Alexander Bokovoy <ab@samba.org>
-(cherry picked from commit 0a532378322661b23b3393eb2ebde29402a16e62)
-
-Autobuild-User(v4-20-test): Jule Anger <janger@samba.org>
-Autobuild-Date(v4-20-test): Tue Jul 23 08:56:24 UTC 2024 on atb-devel-224
-
-(cherry picked from commit 4cf9af9186d7829f11bd07c7d6e526a51dcf0d61)
----
- source3/printing/samba-bgqd.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/source3/printing/samba-bgqd.c b/source3/printing/samba-bgqd.c
-index 59ed0cc40db..9560fcf9e35 100644
---- a/source3/printing/samba-bgqd.c
-+++ b/source3/printing/samba-bgqd.c
-@@ -253,7 +253,9 @@ int main(int argc, const char *argv[])
- 	log_stdout = (debug_get_log_type() == DEBUG_STDOUT);
- 
- 	/* main process will notify systemd */
--	daemon_sd_notifications(false);
-+	if (ready_signal_fd != -1 || watch_fd != -1) {
-+		daemon_sd_notifications(false);
-+	}
- 
- 	if (!cmdline_daemon_cfg->fork) {
- 		daemon_status(progname, "Starting process ... ");
-@@ -325,6 +327,10 @@ int main(int argc, const char *argv[])
- 		goto done;
- 	}
- 
-+	if (!cmdline_daemon_cfg->fork) {
-+		daemon_ready(progname);
-+	}
-+
- 	if (ready_signal_fd != -1) {
- 		pid_t pid = getpid();
- 		ssize_t written;
--- 
-2.45.2
-

samba-4.21.0-backport-freeipa-support.patch

@@ -0,0 +1,132 @@
+From 26797d7bd2662718b3eb795f1b8e6100d51e3ab7 Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <ab@samba.org>
+Date: Tue, 3 Sep 2024 08:48:24 +0300
+Subject: [PATCH] sync machine password to keytab: handle FreeIPA use case
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+FreeIPA uses own procedure to retrieve keytabs and during the setup of
+Samba on FreeIPA client the keytab is already present, only machine
+account needs to be set in the secrets database.
+
+'sync machine password to keytab' option handling broke this use case by
+always attempting to contact a domain controller and failing to do so
+(Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2309199).
+
+The original synchronizing machine account password to keytab feature
+did not have a mechanism to disable its logic at all.
+
+Signed-off-by: Alexander Bokovoy <ab@samba.org>
+Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
+
+Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
+Autobuild-Date(master): Fri Sep 13 13:16:09 UTC 2024 on atb-devel-224
+
+(cherry picked from commit 4f577c7b6894132be4842944f2f950b087312b16)
+---
+ .../security/syncmachinepasswordtokeytab.xml  | 29 +++++++++++++++++--
+ source3/libads/kerberos_keytab.c              |  5 ++++
+ source3/utils/net.c                           |  8 +++++
+ source3/utils/testparm.c                      |  3 +-
+ 4 files changed, 41 insertions(+), 4 deletions(-)
+
+diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml
+index 4cad9da73f2..f7dc30023d4 100644
+--- a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml
++++ b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml
+@@ -18,7 +18,11 @@ or by winbindd doing regular updates (see <smbconfoption name="machine password
+ </para>
+ 
+ <para>
+-The option takes a list of keytab strings. Each string has this form:
++The option takes a list of keytab strings to describe how to synchronize
++content of those keytabs or a single 'disabled' value to disable the
++synchronization.
++
++Each string has this form:
+ <programlisting>
+ absolute_path_to_keytab:spn_spec[:sync_etypes][:sync_kvno][:netbios_aliases][:additional_dns_hostnames][:machine_password]
+ </programlisting>
+@@ -70,8 +74,27 @@ If sync_etypes or sync_kvno or sync_spns is present then winbind connects to DC.
+ </para>
+ 
+ <para>
+-If no value is present, winbind uses value <programlisting>/path/to/keytab:sync_spns:sync_kvno:machine_password</programlisting>
+-where the path to the keytab is obtained either from the krb5 library or from <smbconfoption name="dedicated keytab file"/>
++If no value is present and <smbconfoption name="kerberos method"/> is different from
++'secrets only', the behavior differs between winbind and net utility:
++</para>
++<itemizedlist>
++        <listitem>
++                <para><userinput>winbind</userinput> uses value
++                      <programlisting>/path/to/keytab:sync_spns:sync_kvno:machine_password</programlisting>
++                      where the path to the keytab is obtained either from the krb5 library or from
++                      <smbconfoption name="dedicated keytab file"/>.
++                </para>
++        </listitem>
++        <listitem>
++                <para><userinput>net changesecretpw -f</userinput> command uses the default 'disabled' value.</para>
++        </listitem>
++        <listitem><para>No other <userinput>net</userinput> subcommands use the 'disabled' value.</para></listitem>
++</itemizedlist>
++
++<para>
++If a single value 'disabled' is present, the synchronization process is
++disabled. This is required for FreeIPA domain member setup where keytab
++synchronization uses a protocol not implemented by Samba.
+ </para>
+ 
+ <para>
+diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c
+index 6ede567b75f..dbf8af44c1f 100644
+--- a/source3/libads/kerberos_keytab.c
++++ b/source3/libads/kerberos_keytab.c
+@@ -904,6 +904,11 @@ NTSTATUS sync_pw2keytabs(void)
+ 		goto params_ready;
+ 	}
+ 
++	if ((*lp_ptr != NULL) && strequal_m(*lp_ptr, "disabled")) {
++		DBG_DEBUG("'sync machine password to keytab' is explicitly disabled.\n");
++		return NT_STATUS_OK;
++	}
++
+ 	line = lp_ptr;
+ 	while (*line) {
+ 		DBG_DEBUG("Scanning line: %s\n", *line);
+diff --git a/source3/utils/net.c b/source3/utils/net.c
+index 7b40d2bee95..c432ebe991f 100644
+--- a/source3/utils/net.c
++++ b/source3/utils/net.c
+@@ -207,6 +207,14 @@ static int net_changesecretpw(struct net_context *c, int argc,
+ 		struct timeval tv = timeval_current();
+ 		NTTIME now = timeval_to_nttime(&tv);
+ 
++#ifdef HAVE_ADS
++		if (USE_KERBEROS_KEYTAB) {
++		   if (lp_sync_machine_password_to_keytab() == NULL) {
++			lp_do_parameter(-1, "sync machine password to keytab", "disabled");
++		   }
++		}
++#endif
++
+ 		if (c->opt_stdin) {
+ 			set_line_buffering(stdin);
+ 			set_line_buffering(stdout);
+diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c
+index e3ed336a79a..a31a7a8a30a 100644
+--- a/source3/utils/testparm.c
++++ b/source3/utils/testparm.c
+@@ -803,7 +803,8 @@ static int do_global_checks(void)
+ 			"instead of 'kerberos method'.\n\n");
+ 	}
+ 
+-	if (lp_ptr != NULL) {
++	if (lp_ptr != NULL &&
++	    ((*lp_ptr != NULL) && !strequal_m(*lp_ptr, "disabled"))) {
+ 		while (*lp_ptr) {
+ 			ret |= pw2kt_check_line(*lp_ptr++);
+ 		}
+-- 
+2.46.0
+

samba-4.21.0-ldb-lmdb.patch

@@ -0,0 +1,55 @@
+From 9f265d6f3b852a9eed9f19147585fe2801507f63 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Tue, 24 Sep 2024 15:48:23 +0200
+Subject: [PATCH] ldb: Build lmdb backend also in non-AD case
+
+We should build with lmdb support also if it is not in AD case. The lmdb
+backend is also used e.g. by sssd.
+
+If you don't want to build it, you can always specify --without-ldb-lmdb
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15721
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+---
+ lib/ldb/wscript | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/lib/ldb/wscript b/lib/ldb/wscript
+index 87aa3bb6d77..f234fa79c10 100644
+--- a/lib/ldb/wscript
++++ b/lib/ldb/wscript
+@@ -33,21 +33,17 @@ def configure(conf):
+            conf.CONFIG_GET('ENABLE_SELFTEST'):
+             Logs.warn("NOTE: Some AD DC parts of selftest will fail")
+ 
++        conf.env.REQUIRE_LMDB = False
++    elif Options.options.without_ldb_lmdb:
++        if not Options.options.without_ad_dc and \
++           conf.CONFIG_GET('ENABLE_SELFTEST'):
++            raise Errors.WafError('--without-ldb-lmdb conflicts '
++                                 'with --enable-selftest while '
++                                 'building the AD DC')
++
+         conf.env.REQUIRE_LMDB = False
+     else:
+-        if Options.options.without_ad_dc:
+-            conf.env.REQUIRE_LMDB = False
+-        else:
+-            if Options.options.without_ldb_lmdb:
+-                if not Options.options.without_ad_dc and \
+-                   conf.CONFIG_GET('ENABLE_SELFTEST'):
+-                    raise Errors.WafError('--without-ldb-lmdb conflicts '
+-                                         'with --enable-selftest while '
+-                                         'building the AD DC')
+-
+-                conf.env.REQUIRE_LMDB = False
+-            else:
+-                conf.env.REQUIRE_LMDB = True
++        conf.env.REQUIRE_LMDB = True
+ 
+     # if lmdb support is enabled then we require lmdb
+     # is present, build the mdb back end and enable lmdb support in
+-- 
+GitLab
+

samba.spec

@@ -8,7 +8,7 @@
 #
 %bcond_with testsuite
 
-# Build with internal talloc, tevent, tdb and ldb.
+# Build with internal talloc, tevent, tdb
 #
 # fedpkg mockbuild --with=testsuite --with=includelibs
 # or
@@ -144,9 +144,15 @@
 %bcond_with gpupdate
 %endif
 
+%ifarch aarch64 ppc64le s390x x86_64
+%bcond lmdb 1
+%else
+%bcond lmdb 0
+%endif
+
 %define samba_requires_eq()  %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
 
-%global samba_version 4.20.2
+%global samba_version 4.21.0
 
 # The release field is extended:
 # <pkgrel>[.<extraver>][.<snapinfo>]%%{?dist}[.<minorbump>]
@@ -174,13 +180,14 @@
 %global libdcerpc_so_version 0
 %global libndr_krb5pac_so_version 0
 %global libndr_nbt_so_version 0
-%global libndr_so_version 4
+%global libndr_so_version 5
 %global libndr_standard_so_version 0
 %global libnetapi_so_version 1
 %global libsamba_credentials_so_version 1
 %global libsamba_errors_so_version 1
 %global libsamba_hostconfig_so_version 0
 %global libsamba_passdb_so_version 0
+%global libsamba_policy_so_version 0
 %global libsamba_util_so_version 0
 %global libsamdb_so_version 0
 %global libsmbconf_so_version 0
@@ -191,9 +198,8 @@
 %global libwbclient_so_version 0
 
 %global talloc_version 2.4.2
-%global tdb_version 1.4.10
+%global tdb_version 1.4.12
 %global tevent_version 0.16.1
-%global ldb_version 2.9.1
 
 %global required_mit_krb5 1.20.1
 
@@ -248,15 +254,9 @@ Source18:       samba-winbind-systemd-sysusers.conf
 Source201:      README.downgrade
 Source202:      samba.abignore
 
-# Patch0 is created using:
+Patch0:         samba-4.21.0-backport-freeipa-support.patch
-#
+# https://gitlab.com/samba-team/samba/-/merge_requests/3807
-# git clone git@gitlab.com:samba-redhat/samba.git
+Patch1:         samba-4.21.0-ldb-lmdb.patch
-# cd samba
-# git checkout v4-20-redhat
-# git format-patch --stdout -l1 --no-renames -N > redhat-4.20.2.patch
-# where N is number of commits
-
-Patch0:        redhat-4.20.2.patch
 
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
@@ -301,6 +301,7 @@ BuildRequires: bison
 BuildRequires: cups-devel
 BuildRequires: dbus-devel
 BuildRequires: docbook-style-xsl
+BuildRequires: doxygen
 BuildRequires: e2fsprogs-devel
 BuildRequires: flex
 BuildRequires: gawk
@@ -319,7 +320,10 @@ BuildRequires: libcmocka-devel
 BuildRequires: libtirpc-devel
 BuildRequires: libuuid-devel
 BuildRequires: libxslt
+%if %{with lmdb}
 BuildRequires: lmdb
+BuildRequires: lmdb-devel >= 0.9.16
+%endif
 %if %{with winexe}
 BuildRequires: mingw32-gcc
 BuildRequires: mingw64-gcc
@@ -399,17 +403,6 @@ BuildRequires: python3-tevent >= %{tevent_version}
 
 BuildRequires: libtdb-devel >= %{tdb_version}
 BuildRequires: python3-tdb >= %{tdb_version}
-
-BuildRequires: libldb-devel >= %{ldb_version}
-BuildRequires: python3-ldb >= %{ldb_version}
-BuildRequires: python3-ldb-devel >= %{ldb_version}
-%endif
-
-%if %{with includelibs} || %{with testsuite}
-# lmdb-devel is required for the mdb ldb module, if samba is configured
-# to build includelibs we need lmdb-devel for building that module on our own
-BuildRequires: lmdb-devel
-#endif without includelibs
 %endif
 
 %if %{with dc} || %{with testsuite}
@@ -427,7 +420,6 @@ BuildRequires: python3-setproctitle
 
 %if %{without includelibs}
 BuildRequires: tdb-tools
-BuildRequires: ldb-tools
 #endif without includelibs
 %endif
 
@@ -569,7 +561,9 @@ Requires: python3-%{name} = %{samba_depver}
 Requires: python3-%{name}-dc = %{samba_depver}
 %if %{with dc}
 # samba-tool needs mdb_copy and tdbackup for domain backup or upgrade provision
+%if %{with lmdb}
 Requires: lmdb
+%endif
 Requires: tdb-tools
 Requires: python3-gpg
 %endif
@@ -613,11 +607,7 @@ Requires: libwbclient = %{samba_depver}
 
 Requires: ldb-tools
 Requires: python3-setproctitle
-# Force using libldb version to be the same as build version
+Requires: libldb = %{samba_depver}
-# Otherwise LDB modules will not be loaded and samba-tool will fail
-# See bug 1507420
-%samba_requires_eq libldb
-
 Requires: python3-%{name} = %{samba_depver}
 Requires: python3-%{name}-dc = %{samba_depver}
 Requires: krb5-server >= %{required_mit_krb5}
@@ -906,13 +896,6 @@ Provides: bundled(libreplace)
 The python3-%{name} package contains the Python 3 libraries needed by programs
 that use SMB, RPC and other Samba provided protocols in Python 3 programs.
 
-%package -n python3-%{name}-devel
-Summary: Samba python devel files
-Requires: python3-%{name} = %{samba_depver}
-
-%description -n python3-%{name}-devel
-The python3-%{name}-devel package contains the Python 3 devel files.
-
 %package -n python3-samba-test
 Summary: Samba Python libraries
 Requires: python3-%{name} = %{samba_depver}
@@ -1231,7 +1214,70 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB
 #endif with clustering
 %endif
 
+### LIBLDB
+%package -n libldb
+Summary: A schema-less, ldap like, API and database
+License: LGPL-3.0-or-later
+Requires: libtalloc%{?_isa} >= %{talloc_version}
+Requires: libtdb%{?_isa} >= %{tdb_version}
+Requires: libtevent%{?_isa} >= %{tevent_version}
 
+Provides: bundled(libreplace)
+Obsoletes: libldb < 2.10
+Provides: libldb = 2.10
+Provides: libldb = %{samba_depver}
+
+%description -n libldb
+An extensible library that implements an LDAP like API to access remote LDAP
+servers, or use local tdb databases.
+
+### LIBLDB-DEVEL
+%package -n libldb-devel
+Summary: Developer tools for the LDB library
+License: LGPL-3.0-or-later
+Requires: libldb%{?_isa} = %{samba_depver}
+Requires: libtdb-devel%{?_isa} >= %{tdb_version}
+Requires: libtalloc-devel%{?_isa} >= %{talloc_version}
+Requires: libtevent-devel%{?_isa} >= %{tevent_version}
+
+Obsoletes: libldb-devel < 2.10
+Provides: libldb-devel = 2.10
+Provides: libldb-devel = %{samba_depver}
+
+%description -n libldb-devel
+Header files needed to develop programs that link against the LDB library.
+
+### LDB-TOOLS
+%package -n ldb-tools
+Summary: Tools to manage LDB files
+License: LGPL-3.0-or-later
+Requires: libldb%{?_isa} = %{samba_depver}
+Obsoletes: ldb-tools < 2.10
+Provides: ldb-tools = %{samba_depver}
+
+%description -n ldb-tools
+Tools to manage LDB files
+
+### PYTHON3-LDB
+%package -n python3-ldb
+Summary: Python bindings for the LDB library
+License: LGPL-3.0-or-later
+Requires: libldb%{?_isa} = %{samba_depver}
+Requires: python3-tdb%{?_isa} >= %{tdb_version}
+%{?python_provide:%python_provide python3-ldb}
+
+Obsoletes: python3-ldb < 2.10
+Provides: python3-ldb = %{samba_depver}
+# These were the C bindings, only used by Samba
+Obsoletes: python-ldb-devel-common < 2.10
+Provides: python-ldb-devel-common = 2.10
+Provides: python-ldb-devel-common = %{samba_depver}
+Obsoletes: python3-ldb-devel < 2.10
+Provides: python3-ldb-devel = 2.10
+Provides: python3-ldb-devel = %{samba_depver}
+
+%description -n python3-ldb
+Python bindings for the LDB library
 
 %prep
 %if 0%{?fedora} || 0%{?rhel} >= 9
@@ -1249,16 +1295,14 @@ rm -rfv third_party/heimdal
 %global _talloc_lib ,talloc,pytalloc,pytalloc-util
 %global _tevent_lib ,tevent,pytevent
 %global _tdb_lib ,tdb,pytdb
-%global _ldb_lib ,ldb,pyldb,pyldb-util
 %else
 %global _talloc_lib ,!talloc,!pytalloc,!pytalloc-util
 %global _tevent_lib ,!tevent,!pytevent
 %global _tdb_lib ,!tdb,!pytdb
-%global _ldb_lib ,!ldb,!pyldb,!pyldb-util
 #endif with includelibs
 %endif
 
-%global _samba_libraries !popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib}%{_ldb_lib}
+%global _samba_bundled_libraries !popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib}
 
 %global _samba_idmap_modules idmap_ad,idmap_rid,idmap_ldap,idmap_hash,idmap_tdb2
 %global _samba_pdb_modules pdb_tdbsam,pdb_ldap,pdb_smbpasswd,pdb_wbc_sam,pdb_samba4
@@ -1284,7 +1328,8 @@ rm -rfv third_party/heimdal
 %global _libwbclient wbclient,
 %endif
 
-%global _samba_private_libraries %{_libsmbclient}%{_libwbclient}
+%global _default_private_libraries !ldb,!dcerpc-samr,!samba-policy,!tevent-util,!dcerpc,!samba-hostconfig,!samba-credentials,!dcerpc_server,!samdb,
+%global _samba_private_libraries %{_default_private_libraries}%{_libsmbclient}%{_libwbclient}
 
 # TODO: resolve underlinked python modules
 export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')"
@@ -1321,14 +1366,12 @@ fi
         --with-cachedir=/var/lib/samba \
         --disable-rpath-install \
         --with-shared-modules=%{_samba_modules} \
-        --bundled-libraries=%{_samba_libraries} \
+        --bundled-libraries=%{_samba_bundled_libraries} \
+        --private-libraries=%{_samba_private_libraries} \
         --with-pam \
         --with-pie \
         --with-relro \
         --without-fam \
-%if (%{without libsmbclient}) || (%{without libwbclient})
-        --private-libraries=%{_samba_private_libraries} \
-%endif
         --with-system-mitkrb5 \
         --with-experimental-mit-ad-dc \
 %if %{without dc} && %{without testsuite}
@@ -1374,6 +1417,10 @@ pushd pidl
 %make_build
 popd
 
+pushd lib/ldb
+doxygen Doxyfile
+popd
+
 %install
 # Do not use %%make_install, make is just a wrapper around waf in Samba!
 %{__make} %{?_smp_mflags} %{_make_verbose} install DESTDIR=%{buildroot}
@@ -1381,9 +1428,11 @@ popd
 install -d -m 0755 %{buildroot}/usr/{sbin,bin}
 install -d -m 0755 %{buildroot}%{_libdir}/security
 install -d -m 0755 %{buildroot}/var/lib/samba
+install -d -m 0755 %{buildroot}/var/lib/samba/certs
 install -d -m 0755 %{buildroot}/var/lib/samba/drivers
 install -d -m 0755 %{buildroot}/var/lib/samba/lock
 install -d -m 0755 %{buildroot}/var/lib/samba/private
+install -d -m 0755 %{buildroot}/var/lib/samba/private/certs
 install -d -m 0755 %{buildroot}/var/lib/samba/scripts
 install -d -m 0755 %{buildroot}/var/lib/samba/sysvol
 install -d -m 0755 %{buildroot}/var/lib/samba/usershares
@@ -1482,10 +1531,7 @@ rm -f %{buildroot}%{_mandir}/man8/vfs_ceph_snapshots.8*
 /sbin/ldconfig -N -n %{buildroot}%{_libdir}
 
 %if %{without dc} && %{without testsuite}
-for f in samba/libsamba-net-samba4.so \
+for f in samba/libsamba-python-private-samba.so; do
-         samba/libsamba-python-samba4.so \
-         libsamba-policy.so* \
-         pkgconfig/samba-policy.pc ; do
     rm -f %{buildroot}%{_libdir}/$f
 done
 #endif without dc
@@ -1506,6 +1552,12 @@ rm -f %{buildroot}%{perl_archlib}/vendor_perl/auto/Parse/Pidl/.packlist
 rm -rf %{buildroot}%{perl_vendorlib}/Parse/Yapp
 popd
 
+# Install libldb manpages
+cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir}
+# Remove manpages we don't want
+rm -f %{buildroot}%{_mandir}/man3/_*
+rm -f %{buildroot}%{_mandir}/man3/PyLdb*
+
 %if %{with testsuite}
 %check
 #
@@ -1664,6 +1716,8 @@ fi
 %systemd_postun_with_restart ctdb.service
 %endif
 
+%ldconfig_scriptlets -n libldb
+%ldconfig_scriptlets -n python3-ldb
 
 ### SAMBA
 %files
@@ -1964,7 +2018,6 @@ fi
 %{_libdir}/samba/libtdb-wrap-private-samba.so
 %{_libdir}/samba/libtime-basic-private-samba.so
 %{_libdir}/samba/libtorture-private-samba.so
-%{_libdir}/samba/libtrusts-util-private-samba.so
 %{_libdir}/samba/libutil-reg-private-samba.so
 %{_libdir}/samba/libutil-setid-private-samba.so
 %{_libdir}/samba/libutil-tdb-private-samba.so
@@ -1986,16 +2039,6 @@ fi
 %{_libdir}/samba/libtdb-private-samba.so
 %{_libdir}/samba/libtevent-private-samba.so
 
-%{_libdir}/samba/ldb/asq.so
-%{_libdir}/samba/ldb/ldb.so
-%{_libdir}/samba/ldb/mdb.so
-%{_libdir}/samba/ldb/paged_searches.so
-%{_libdir}/samba/ldb/rdn_name.so
-%{_libdir}/samba/ldb/sample.so
-%{_libdir}/samba/ldb/server_sort.so
-%{_libdir}/samba/ldb/skel.so
-%{_libdir}/samba/ldb/tdb.so
-
 %{_mandir}/man3/ldb.3.gz
 %{_mandir}/man3/talloc.3.gz
 #endif with includelibs
@@ -2014,7 +2057,9 @@ fi
 %ghost %dir /run/samba
 %ghost %dir /run/winbindd
 %dir /var/lib/samba
+%dir /var/lib/samba/certs
 %attr(700,root,root) %dir /var/lib/samba/private
+%attr(700,root,root) %dir /var/lib/samba/private/certs
 %dir /var/lib/samba/lock
 %attr(755,root,root) %dir %{_sysconfdir}/samba
 %config(noreplace) %{_sysconfdir}/samba/smb.conf
@@ -2160,7 +2205,9 @@ fi
 %endif
 ### DC-LIBS
 %files dc-libs
+%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}*
 %{_libdir}/samba/libauth4-private-samba.so
+%{_libdir}/samba/libsamba-net-private-samba.so
 
 %if %{with dc} || %{with testsuite}
 %{_libdir}/samba/libdb-glue-private-samba.so
@@ -2321,9 +2368,11 @@ fi
 %{_libdir}/pkgconfig/ndr_standard.pc
 %{_libdir}/pkgconfig/samba-credentials.pc
 %{_libdir}/pkgconfig/samba-hostconfig.pc
+%{_libdir}/pkgconfig/samba-policy.pc
 %{_libdir}/pkgconfig/samba-util.pc
 %{_libdir}/pkgconfig/samdb.pc
 %{_libdir}/libsamba-passdb.so
+%{_libdir}/libsamba-policy.so
 %{_libdir}/libsmbldap.so
 
 %if %{with dc} || %{with testsuite}
@@ -2346,8 +2395,10 @@ fi
 %if %{with vfs_cephfs}
 %files vfs-cephfs
 %{_libdir}/samba/vfs/ceph.so
+%{_libdir}/samba/vfs/ceph_new.so
 %{_libdir}/samba/vfs/ceph_snapshots.so
 %{_mandir}/man8/vfs_ceph.8*
+%{_mandir}/man8/vfs_ceph_new.8*
 %{_mandir}/man8/vfs_ceph_snapshots.8*
 %endif
 
@@ -2382,6 +2433,7 @@ fi
 %files ldb-ldap-modules
 %{_libdir}/samba/ldb/ldbsamba_extensions.so
 %{_libdir}/samba/ldb/ildap.so
+%{_libdir}/samba/ldb/ldap.so
 
 ### LIBS
 %files libs
@@ -2501,6 +2553,7 @@ fi
 %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc
 %{python3_sitearch}/samba/__pycache__/idmap.*.pyc
 %{python3_sitearch}/samba/__pycache__/join.*.pyc
+%{python3_sitearch}/samba/__pycache__/lsa_utils.*.pyc
 %{python3_sitearch}/samba/__pycache__/logger.*.pyc
 %{python3_sitearch}/samba/__pycache__/mdb_util.*.pyc
 %{python3_sitearch}/samba/__pycache__/ms_display_specifiers.*.pyc
@@ -2514,7 +2567,6 @@ fi
 %{python3_sitearch}/samba/__pycache__/sites.*.pyc
 %{python3_sitearch}/samba/__pycache__/subnets.*.pyc
 %{python3_sitearch}/samba/__pycache__/tdb_util.*.pyc
-%{python3_sitearch}/samba/__pycache__/trust_utils.*.pyc
 %{python3_sitearch}/samba/__pycache__/upgrade.*.pyc
 %{python3_sitearch}/samba/__pycache__/upgradehelpers.*.pyc
 %{python3_sitearch}/samba/__pycache__/xattr.*.pyc
@@ -2580,6 +2632,53 @@ fi
 %{python3_sitearch}/samba/dcerpc/xattr.*.so
 %{python3_sitearch}/samba/descriptor.py
 %{python3_sitearch}/samba/dnsresolver.py
+%dir %{python3_sitearch}/samba/domain
+%{python3_sitearch}/samba/domain/__init__.py
+%{python3_sitearch}/samba/domain/__pycache__/__init__.*.pyc
+%{python3_sitearch}/samba/domain/models/__init__.py
+%{python3_sitearch}/samba/domain/models/__pycache__/__init__.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/auth_policy.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/auth_silo.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/claim_type.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/computer.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/constants.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/container.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/exceptions.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/fields.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/gmsa.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/group.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/model.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/org.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/person.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/query.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/registry.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/schema.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/site.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/subnet.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/types.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/user.*.pyc
+%{python3_sitearch}/samba/domain/models/__pycache__/value_type.*.pyc
+%{python3_sitearch}/samba/domain/models/auth_policy.py
+%{python3_sitearch}/samba/domain/models/auth_silo.py
+%{python3_sitearch}/samba/domain/models/claim_type.py
+%{python3_sitearch}/samba/domain/models/computer.py
+%{python3_sitearch}/samba/domain/models/constants.py
+%{python3_sitearch}/samba/domain/models/container.py
+%{python3_sitearch}/samba/domain/models/exceptions.py
+%{python3_sitearch}/samba/domain/models/fields.py
+%{python3_sitearch}/samba/domain/models/gmsa.py
+%{python3_sitearch}/samba/domain/models/group.py
+%{python3_sitearch}/samba/domain/models/model.py
+%{python3_sitearch}/samba/domain/models/org.py
+%{python3_sitearch}/samba/domain/models/person.py
+%{python3_sitearch}/samba/domain/models/query.py
+%{python3_sitearch}/samba/domain/models/registry.py
+%{python3_sitearch}/samba/domain/models/schema.py
+%{python3_sitearch}/samba/domain/models/site.py
+%{python3_sitearch}/samba/domain/models/subnet.py
+%{python3_sitearch}/samba/domain/models/types.py
+%{python3_sitearch}/samba/domain/models/user.py
+%{python3_sitearch}/samba/domain/models/value_type.py
 %{python3_sitearch}/samba/drs_utils.py
 %{python3_sitearch}/samba/dsdb.*.so
 %{python3_sitearch}/samba/dsdb_dns.*.so
@@ -2591,6 +2690,7 @@ fi
 %{python3_sitearch}/samba/hostconfig.py
 %{python3_sitearch}/samba/idmap.py
 %{python3_sitearch}/samba/join.py
+%{python3_sitearch}/samba/lsa_utils.py
 %{python3_sitearch}/samba/messaging.*.so
 %{python3_sitearch}/samba/ndr.py
 %{python3_sitearch}/samba/net.*.so
@@ -2743,12 +2843,30 @@ fi
 %{python3_sitearch}/samba/netcmd/domain/auth/__init__.py
 %dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__
 %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/policy.*.pyc
+%dir %{python3_sitearch}/samba/netcmd/domain/auth/policy
-%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py
-%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo_member.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/__init__.py
-%{python3_sitearch}/samba/netcmd/domain/auth/policy.py
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py
-%{python3_sitearch}/samba/netcmd/domain/auth/silo.py
+%dir %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__
-%{python3_sitearch}/samba/netcmd/domain/auth/silo_member.py
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/__init__.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/policy.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_from.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_to.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_from.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_to.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_from.py
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_to.py
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_from.py
+%{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_to.py
+%dir %{python3_sitearch}/samba/netcmd/domain/auth/silo
+%{python3_sitearch}/samba/netcmd/domain/auth/silo/__init__.py
+%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py
+%dir %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__
+%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/__init__.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/member.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/silo.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/auth/silo/silo.py
 %{python3_sitearch}/samba/netcmd/domain/backup.py
 %dir %{python3_sitearch}/samba/netcmd/domain/claim
 %{python3_sitearch}/samba/netcmd/domain/claim/__init__.py
@@ -2765,39 +2883,15 @@ fi
 %{python3_sitearch}/samba/netcmd/domain/functional_prep.py
 %{python3_sitearch}/samba/netcmd/domain/info.py
 %{python3_sitearch}/samba/netcmd/domain/join.py
+%dir %{python3_sitearch}/samba/netcmd/domain/kds
+%{python3_sitearch}/samba/netcmd/domain/kds/__init__.py
+%dir %{python3_sitearch}/samba/netcmd/domain/kds/__pycache__
+%{python3_sitearch}/samba/netcmd/domain/kds/__pycache__/__init__.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/kds/__pycache__/root_key.*.pyc
+%{python3_sitearch}/samba/netcmd/domain/kds/root_key.py
 %{python3_sitearch}/samba/netcmd/domain/keytab.py
 %{python3_sitearch}/samba/netcmd/domain/leave.py
 %{python3_sitearch}/samba/netcmd/domain/level.py
-%dir %{python3_sitearch}/samba/netcmd/domain/models
-%{python3_sitearch}/samba/netcmd/domain/models/__init__.py
-%dir %{python3_sitearch}/samba/netcmd/domain/models/__pycache__
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/__init__.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_policy.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_silo.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/claim_type.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/exceptions.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/fields.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/group.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/model.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/query.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/schema.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/site.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/subnet.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/user.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/value_type.*.pyc
-%{python3_sitearch}/samba/netcmd/domain/models/auth_policy.py
-%{python3_sitearch}/samba/netcmd/domain/models/auth_silo.py
-%{python3_sitearch}/samba/netcmd/domain/models/claim_type.py
-%{python3_sitearch}/samba/netcmd/domain/models/exceptions.py
-%{python3_sitearch}/samba/netcmd/domain/models/fields.py
-%{python3_sitearch}/samba/netcmd/domain/models/group.py
-%{python3_sitearch}/samba/netcmd/domain/models/model.py
-%{python3_sitearch}/samba/netcmd/domain/models/query.py
-%{python3_sitearch}/samba/netcmd/domain/models/schema.py
-%{python3_sitearch}/samba/netcmd/domain/models/site.py
-%{python3_sitearch}/samba/netcmd/domain/models/subnet.py
-%{python3_sitearch}/samba/netcmd/domain/models/user.py
-%{python3_sitearch}/samba/netcmd/domain/models/value_type.py
 %{python3_sitearch}/samba/netcmd/domain/passwordsettings.py
 %{python3_sitearch}/samba/netcmd/domain/provision.py
 %{python3_sitearch}/samba/netcmd/domain/samba3upgrade.py
@@ -2822,6 +2916,13 @@ fi
 %{python3_sitearch}/samba/netcmd/pso.py
 %{python3_sitearch}/samba/netcmd/rodc.py
 %{python3_sitearch}/samba/netcmd/schema.py
+%dir %{python3_sitearch}/samba/netcmd/service_account
+%{python3_sitearch}/samba/netcmd/service_account/__init__.py
+%{python3_sitearch}/samba/netcmd/service_account/__pycache__/__init__.*.pyc
+%{python3_sitearch}/samba/netcmd/service_account/__pycache__/group_msa_membership.*.pyc
+%{python3_sitearch}/samba/netcmd/service_account/__pycache__/service_account.*.pyc
+%{python3_sitearch}/samba/netcmd/service_account/group_msa_membership.py
+%{python3_sitearch}/samba/netcmd/service_account/service_account.py
 %{python3_sitearch}/samba/netcmd/shell.py
 %{python3_sitearch}/samba/netcmd/sites.py
 %{python3_sitearch}/samba/netcmd/spn.py
@@ -2918,20 +3019,17 @@ fi
 %{python3_sitearch}/samba/subunit/__pycache__/run.*.pyc
 %{python3_sitearch}/samba/subunit/run.py
 %{python3_sitearch}/samba/tdb_util.py
-%{python3_sitearch}/samba/trust_utils.py
 %{python3_sitearch}/samba/upgrade.py
 %{python3_sitearch}/samba/upgradehelpers.py
 %{python3_sitearch}/samba/werror.*.so
 %{python3_sitearch}/samba/xattr.py
 %{python3_sitearch}/samba/xattr_native.*.so
 %{python3_sitearch}/samba/xattr_tdb.*.so
-%{_libdir}/libsamba-policy.cpython*.so.*
+%{_libdir}/samba/libsamba-net-join.cpython*.so
-%{_libdir}/samba/libsamba-net.cpython*.so
 %{_libdir}/samba/libsamba-python.cpython*.so
 
 %if %{with includelibs}
 %{_libdir}/samba/libpyldb-util.cpython*.so
-%{_libdir}/samba/libpytalloc-util.cpython*.so
 
 %{python3_sitearch}/__pycache__/_ldb_text*.pyc
 %{python3_sitearch}/__pycache__/_tdb_text*.pyc
@@ -2940,16 +3038,13 @@ fi
 %{python3_sitearch}/_tdb_text.py
 %{python3_sitearch}/_tevent.cpython*.so
 %{python3_sitearch}/ldb.cpython*.so
-%{python3_sitearch}/talloc.cpython*.so
+#FIXME why is it missing?
+#%{python3_sitearch}/talloc.cpython*.so
 %{python3_sitearch}/tdb.cpython*.so
 %{python3_sitearch}/tevent.py
 #endif with includelibs
 %endif
 
-%files -n python3-%{name}-devel
-%{_libdir}/libsamba-policy.*.so
-%{_libdir}/pkgconfig/samba-policy.*.pc
-
 %files -n python3-%{name}-dc
 %{python3_sitearch}/samba/samdb.py
 %{python3_sitearch}/samba/schema.py
@@ -3048,6 +3143,8 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/dsdb_quiet_env_tests.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/dsdb_quiet_provision_tests.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/docs.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/domain_backup.*.pyc
@@ -3166,6 +3263,7 @@ fi
 %{python3_sitearch}/samba/tests/blackbox/__pycache__/check_output.*.pyc
 %{python3_sitearch}/samba/tests/blackbox/__pycache__/claims.*.pyc
 %{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc
+%{python3_sitearch}/samba/tests/blackbox/__pycache__/gmsa.*.pyc
 %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_chunk.*.pyc
 %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_content.*.pyc
 %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc
@@ -3189,6 +3287,7 @@ fi
 %{python3_sitearch}/samba/tests/blackbox/check_output.py
 %{python3_sitearch}/samba/tests/blackbox/claims.py
 %{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py
+%{python3_sitearch}/samba/tests/blackbox/gmsa.py
 %{python3_sitearch}/samba/tests/blackbox/http_chunk.py
 %{python3_sitearch}/samba/tests/blackbox/http_content.py
 %{python3_sitearch}/samba/tests/blackbox/mdsearch.py
@@ -3223,11 +3322,11 @@ fi
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/__init__.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc
-%{python3_sitearch}/samba/tests/dcerpc/__pycache__/createtrustrelax.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc
+%{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa_utils.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/misc.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/raw_protocol.*.pyc
@@ -3244,10 +3343,10 @@ fi
 %{python3_sitearch}/samba/tests/dcerpc/array.py
 %{python3_sitearch}/samba/tests/dcerpc/bare.py
 %{python3_sitearch}/samba/tests/dcerpc/binding.py
-%{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py
 %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py
 %{python3_sitearch}/samba/tests/dcerpc/integer.py
 %{python3_sitearch}/samba/tests/dcerpc/lsa.py
+%{python3_sitearch}/samba/tests/dcerpc/lsa_utils.py
 %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py
 %{python3_sitearch}/samba/tests/dcerpc/misc.py
 %{python3_sitearch}/samba/tests/dcerpc/raw_protocol.py
@@ -3278,6 +3377,8 @@ fi
 %{python3_sitearch}/samba/tests/dsdb_dns.py
 %{python3_sitearch}/samba/tests/dsdb_lock.py
 %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py
+%{python3_sitearch}/samba/tests/dsdb_quiet_env_tests.py
+%{python3_sitearch}/samba/tests/dsdb_quiet_provision_tests.py
 %{python3_sitearch}/samba/tests/docs.py
 %{python3_sitearch}/samba/tests/domain_backup.py
 %{python3_sitearch}/samba/tests/domain_backup_offline.py
@@ -3328,6 +3429,7 @@ fi
 %{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/gkdi_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/gmsa_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/group_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc
@@ -3369,6 +3471,7 @@ fi
 %{python3_sitearch}/samba/tests/krb5/etype_tests.py
 %{python3_sitearch}/samba/tests/krb5/fast_tests.py
 %{python3_sitearch}/samba/tests/krb5/gkdi_tests.py
+%{python3_sitearch}/samba/tests/krb5/gmsa_tests.py
 %{python3_sitearch}/samba/tests/krb5/group_tests.py
 %{python3_sitearch}/samba/tests/krb5/kcrypto.py
 %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py
@@ -3472,6 +3575,7 @@ fi
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_policy.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_silo.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_claim.*.pyc
+%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_kds_root_key.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_models.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/drs_clone_dc_data_lmdb_size.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/dsacl.*.pyc
@@ -3494,6 +3598,7 @@ fi
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_userPassword_crypt.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/rodc.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/schema.*.pyc
+%{python3_sitearch}/samba/tests/samba_tool/__pycache__/service_account.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/silo_base.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/sites.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/timecmd.*.pyc
@@ -3518,6 +3623,7 @@ fi
 %{python3_sitearch}/samba/tests/samba_tool/domain_auth_policy.py
 %{python3_sitearch}/samba/tests/samba_tool/domain_auth_silo.py
 %{python3_sitearch}/samba/tests/samba_tool/domain_claim.py
+%{python3_sitearch}/samba/tests/samba_tool/domain_kds_root_key.py
 %{python3_sitearch}/samba/tests/samba_tool/domain_models.py
 %{python3_sitearch}/samba/tests/samba_tool/drs_clone_dc_data_lmdb_size.py
 %{python3_sitearch}/samba/tests/samba_tool/dsacl.py
@@ -3540,6 +3646,7 @@ fi
 %{python3_sitearch}/samba/tests/samba_tool/provision_userPassword_crypt.py
 %{python3_sitearch}/samba/tests/samba_tool/rodc.py
 %{python3_sitearch}/samba/tests/samba_tool/schema.py
+%{python3_sitearch}/samba/tests/samba_tool/service_account.py
 %{python3_sitearch}/samba/tests/samba_tool/silo_base.py
 %{python3_sitearch}/samba/tests/samba_tool/sites.py
 %{python3_sitearch}/samba/tests/samba_tool/timecmd.py
@@ -3677,7 +3784,6 @@ fi
 %{_sysconfdir}/ctdb/functions
 %{_sysconfdir}/ctdb/nfs-linux-kernel-callout
 %{_sysconfdir}/ctdb/statd-callout
-%config %{_sysconfdir}/sudoers.d/ctdb
 
 # CTDB scripts, no config files
 # script with executable bit means activated
@@ -3717,6 +3823,8 @@ fi
 %{_libexecdir}/ctdb/ctdb_recovery_helper
 %{_libexecdir}/ctdb/ctdb_takeover_helper
 %{_libexecdir}/ctdb/smnotify
+%{_libexecdir}/ctdb/statd_callout
+%{_libexecdir}/ctdb/statd_callout_helper
 %{_libexecdir}/ctdb/tdb_mutex_check
 
 %dir %{_localstatedir}/lib/ctdb/
@@ -3747,7 +3855,6 @@ fi
 %{_datadir}/ctdb/events/legacy/00.ctdb.script
 %{_datadir}/ctdb/events/legacy/01.reclock.script
 %{_datadir}/ctdb/events/legacy/05.system.script
-%{_datadir}/ctdb/events/legacy/06.nfs.script
 %{_datadir}/ctdb/events/legacy/10.interface.script
 %{_datadir}/ctdb/events/legacy/11.natgw.script
 %{_datadir}/ctdb/events/legacy/11.routing.script
@@ -3756,6 +3863,7 @@ fi
 %{_datadir}/ctdb/events/legacy/31.clamd.script
 %{_datadir}/ctdb/events/legacy/40.vsftpd.script
 %{_datadir}/ctdb/events/legacy/41.httpd.script
+%{_datadir}/ctdb/events/legacy/46.update-keytabs.script
 %{_datadir}/ctdb/events/legacy/47.samba-dcerpcd.script
 %{_datadir}/ctdb/events/legacy/48.netbios.script
 %{_datadir}/ctdb/events/legacy/49.winbind.script
@@ -3763,6 +3871,8 @@ fi
 %{_datadir}/ctdb/events/legacy/60.nfs.script
 %{_datadir}/ctdb/events/legacy/70.iscsi.script
 %{_datadir}/ctdb/events/legacy/91.lvs.script
+%dir %{_datadir}/ctdb/scripts
+%{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh
 
 %if %{with testsuite}
 %files -n ctdb-tests
@@ -4615,5 +4725,61 @@ fi
 %{_mandir}/man1/winexe.1.gz
 %endif
 
+%files -n libldb
+%{_libdir}/libldb.so.*
+%dir %{_libdir}/samba
+%{_libdir}/samba/libldb-key-value-private-samba.so
+%{_libdir}/samba/libldb-tdb-err-map-private-samba.so
+%{_libdir}/samba/libldb-tdb-int-private-samba.so
+%if %{with lmdb}
+%{_libdir}/samba/libldb-mdb-int-private-samba.so
+%endif
+
+%dir %{_libdir}/samba/ldb
+%{_libdir}/samba/ldb/asq.so
+%{_libdir}/samba/ldb/ldb.so
+%if %{with lmdb}
+%{_libdir}/samba/ldb/mdb.so
+%endif
+%{_libdir}/samba/ldb/paged_searches.so
+%{_libdir}/samba/ldb/rdn_name.so
+%{_libdir}/samba/ldb/sample.so
+%{_libdir}/samba/ldb/server_sort.so
+%{_libdir}/samba/ldb/skel.so
+%{_libdir}/samba/ldb/tdb.so
+
+%files -n libldb-devel
+%{_includedir}/samba-4.0/ldb_module.h
+%{_includedir}/samba-4.0/ldb_handlers.h
+%{_includedir}/samba-4.0/ldb_errors.h
+%{_includedir}/samba-4.0/ldb_version.h
+%{_includedir}/samba-4.0/ldb.h
+%{_libdir}/libldb.so
+
+%{_libdir}/pkgconfig/ldb.pc
+%{_mandir}/man3/ldb*.gz
+%{_mandir}/man3/ldif*.gz
+
+%files -n ldb-tools
+%{_bindir}/ldbadd
+%{_bindir}/ldbdel
+%{_bindir}/ldbedit
+%{_bindir}/ldbmodify
+%{_bindir}/ldbrename
+%{_bindir}/ldbsearch
+%{_libdir}/samba/libldb-cmdline-private-samba.so
+%{_mandir}/man1/ldbadd.1.*
+%{_mandir}/man1/ldbdel.1.*
+%{_mandir}/man1/ldbedit.1.*
+%{_mandir}/man1/ldbmodify.1.*
+%{_mandir}/man1/ldbrename.1.*
+%{_mandir}/man1/ldbsearch.1.*
+
+%files -n python3-ldb
+%{python3_sitearch}/ldb.cpython-*.so
+%{_libdir}/samba/libpyldb-util.cpython-*-private-samba.so
+%{python3_sitearch}/_ldb_text.py
+%{python3_sitearch}/__pycache__/_ldb_text.cpython-*.py*
+
 %changelog
 %autochangelog

sources

@@ -1,2 +1,2 @@
-SHA512 (samba-4.20.2.tar.xz) = cf07b12b6c1ac9bc3fd0df7fd658529ebd08309a0823f49c68dd3c55c0c80f412d6af50a0f78b8f4484635029aeb292a72dd0a6638edbd463e73baff404d5315
+SHA512 (samba-4.21.0.tar.asc) = 7fffbd0b88b42dd7f340e4bcae17da4a68a0f8de86a1e71534a4a02a477a746e4cdb16df7c0da33aaf13278cefb452bd9b7c61ed029e248576f7158e8bec339e
-SHA512 (samba-4.20.2.tar.asc) = a0051efdca684bc6c3e40367b0a8b862d0b1b988aa9c15ec6987d5f97440daa1f7609e6be61611aa9bbed56d89e0258b192c43028384899c75c4cd449cc99694
+SHA512 (samba-4.21.0.tar.xz) = d05c823afc04669766130745c139e7d129eb9961525453d6da8b5ee6693d4c08192496d07e5c211e86d553956504fb9df16611cc9268111b71b95c7f2fa868a0