import CS samba-4.24.5-1.el9

2026-08-24 09:54:58 -04:00 · 2026-08-24 09:54:58 -04:00 · c68a2ebff2
commit c68a2ebff2
parent aec19cff4b
7 changed files with 416 additions and 1108 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1,2 @@
-SOURCES/samba-4.23.5.tar.xz
+SOURCES/samba-4.24.5.tar.xz
 SOURCES/samba-pubkey_AA99442FB680B620.gpg
--- a/.samba.metadata
+++ b/.samba.metadata
@ -1,2 +1,2 @@
-19e3789510e8306f9584f56e198559f5c1c5bbc2 SOURCES/samba-4.23.5.tar.xz
+d8bc9b1cb04f3d03fcf96f5af4b959f7ec26cefd SOURCES/samba-4.24.5.tar.xz
 971f563c447eda8d144d6c9e743cd0f0488c0d9e SOURCES/samba-pubkey_AA99442FB680B620.gpg
--- a/SOURCES/redhat-4.23.patch
+++ b/SOURCES/redhat-4.23.patch
@ -1,957 +0,0 @@
-From e8384b6daea3b8091ad1bcfce84efc9e2c6a746d Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
-Date: Thu, 22 Jan 2026 14:27:09 +0100
-Subject: [PATCH 01/13] s3:libads: Allocate cli_credentials on a stackframe
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This fixes:
-ERROR: talloc_free with references at ../../source3/libads/ldap_utils.c:158
-
-What happens:
-
-* `struct cli_credentials *creds` is allocated on `ads` talloc context
-* gensec_set_credentials() creates a talloc_reference to `creds`
-* TALLOC_FREE(creds) sees two parents and complains
-
-All other code is using temporary talloc_stackframe() for `creds`.
-Do it here as well.
-
-Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
-Reviewed-by: Stefan Metzmacher <metze@samba.org>
-
-Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
-Autobuild-Date(master): Fri Jan 23 11:20:28 UTC 2026 on atb-devel-224
---
- source3/libads/ldap_utils.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/source3/libads/ldap_utils.c b/source3/libads/ldap_utils.c
-index 9d6d962a2bc..d01afa69697 100644
--- a/source3/libads/ldap_utils.c
-+++ b/source3/libads/ldap_utils.c
-@@ -99,6 +99,7 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind
- 		struct cli_credentials *creds = NULL;
- 		char *cred_name = NULL;
- 		NTSTATUS ntstatus;
-+		TALLOC_CTX *frame = talloc_stackframe();
- 
- 		if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) &&
- 		    ads->config.ldap_page_size >= (lp_ldap_page_size() / 4) &&
-@@ -119,18 +120,20 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind
- 			DBG_NOTICE("Search for %s in <%s> failed: %s\n",
- 				   expr, bp, ads_errstr(status));
- 			SAFE_FREE(bp);
-+			TALLOC_FREE(frame);
- 			return status;
- 		}
- 
- 		ntstatus = ads->auth.reconnect_state->fn(ads,
- 				ads->auth.reconnect_state->private_data,
-				ads, &creds);
-+				frame, &creds);
- 		if (!NT_STATUS_IS_OK(ntstatus)) {
- 			DBG_WARNING("Failed to get creds for realm(%s): %s\n",
- 				    ads->server.realm, nt_errstr(ntstatus));
- 			DBG_WARNING("Search for %s in <%s> failed: %s\n",
- 				   expr, bp, ads_errstr(status));
- 			SAFE_FREE(bp);
-+			TALLOC_FREE(frame);
- 			return status;
- 		}
- 
-@@ -151,11 +154,11 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind
- 			 * callers depend on it being around.
- 			 */
- 			ads_disconnect(ads);
-			TALLOC_FREE(creds);
-+			TALLOC_FREE(frame);
- 			SAFE_FREE(bp);
- 			return status;
- 		}
-		TALLOC_FREE(creds);
-+		TALLOC_FREE(frame);
- 
- 		*res = NULL;
- 
-- 
-2.53.0
-
-
-From 7af95c7cb142aeb5f422a69d3b7a0ea3c0d2c2c2 Mon Sep 17 00:00:00 2001
-From: Samuel Cabrero <scabrero@samba.org>
-Date: Mon, 26 Jan 2026 13:36:02 +0100
-Subject: [PATCH 02/13] s3:rpc_client: Fix memory leak opening local named pipe
-
-If no local server name was passed to rpc_pipe_open_local_np() then
-get_myname() was called with NULL talloc context instead of the
-current stackframe.
-
-This was causing an increase of memory usage on busy servers with long-living
-rpcd_* workers.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15979
-
-Signed-off-by: Samuel Cabrero <scabrero@samba.org>
-Reviewed-by: Noel Power <noel.power@suse.com>
-Reviewed-by: Volker Lendecke <vl@samba.org>
-
-Autobuild-User(master): Volker Lendecke <vl@samba.org>
-Autobuild-Date(master): Tue Jan 27 10:13:40 UTC 2026 on atb-devel-224
-
-(cherry picked from commit 24dc455362fb49ef81c99d95880e106a234ce29a)
---
- source3/rpc_client/cli_pipe.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c
-index e3f48526492..c61b8eb16cf 100644
--- a/source3/rpc_client/cli_pipe.c
-+++ b/source3/rpc_client/cli_pipe.c
-@@ -3625,7 +3625,7 @@ NTSTATUS rpc_pipe_open_local_np(
- 	}
- 
- 	if (local_server_name == NULL) {
-		local_server_name = get_myname(result);
-+		local_server_name = get_myname(frame);
- 	}
- 
- 	if (local_server_addr != NULL) {
-- 
-2.53.0
-
-
-From ab1287f78bd9d2397c8eb26fbedafa028e2aaa16 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
-Date: Tue, 2 Dec 2025 17:17:33 +0100
-Subject: [PATCH 03/13] s3-selftest: mention in-memory ccache usage when
- nothing is provided
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840
-
-Guenther
-
-Signed-off-by: Guenther Deschner <gd@samba.org>
-Reviewed-by: Andreas Schneider <asn@samba.org>
---
- source3/script/tests/test_net_ads_kerberos.sh | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/source3/script/tests/test_net_ads_kerberos.sh b/source3/script/tests/test_net_ads_kerberos.sh
-index 8a3c9ef2bc7..92d3996d078 100755
--- a/source3/script/tests/test_net_ads_kerberos.sh
-+++ b/source3/script/tests/test_net_ads_kerberos.sh
-@@ -30,6 +30,7 @@ KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
- ## Test "net ads kerberos kinit" variants
- #################################################
- 
-+#simply uses in memory ccache
- testit "net_ads_kerberos_kinit" \
- 	"$VALGRIND" "$BINDIR"/net ads kerberos kinit \
- 	-U"$USERNAME"%"$PASSWORD" "$ADDARGS" \
-@@ -50,6 +51,7 @@ rm -f "$KRB5CCNAME_PATH"
- #	--use-krb5-ccache=${KRB5CCNAME} \
- #	|| failed=$((failed + 1))
- 
-+#simply uses in memory ccache
- testit "net_ads_kerberos_kinit (-P)" \
- 	"$VALGRIND" "$BINDIR"/net ads kerberos kinit \
- 	-P "$ADDARGS" \
-- 
-2.53.0
-
-
-From 0aa0d39e9a5deb77114f40930b599f11fd7cf3b6 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
-Date: Tue, 2 Dec 2025 17:18:41 +0100
-Subject: [PATCH 04/13] s3-selftest: verify KRB5CCNAME presence after kinit
- using klist
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840
-
-Guenther
-
-Signed-off-by: Guenther Deschner <gd@samba.org>
-Reviewed-by: Andreas Schneider <asn@samba.org>
---
- source3/script/tests/test_net_ads_kerberos.sh | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/source3/script/tests/test_net_ads_kerberos.sh b/source3/script/tests/test_net_ads_kerberos.sh
-index 92d3996d078..c53520cf733 100755
--- a/source3/script/tests/test_net_ads_kerberos.sh
-+++ b/source3/script/tests/test_net_ads_kerberos.sh
-@@ -14,6 +14,12 @@ PREFIX="$4"
- shift 4
- ADDARGS="$*"
- 
-+if [ -x $(which klist) ]; then
-+	KLIST=$(which klist);
-+else
-+	KLIST="test -e";
-+fi
-+
- incdir=$(dirname "$0")/../../../testprogs/blackbox
- . "$incdir"/subunit.sh
- 
-@@ -41,6 +47,9 @@ testit "net_ads_kerberos_kinit (KRB5CCNAME env set)" \
- 	"$VALGRIND" "$BINDIR"/net ads kerberos kinit \
- 	-U"$USERNAME"%"$PASSWORD" "$ADDARGS" \
- 	|| failed=$((failed + 1))
-+testit "klist env $KRB5CCNAME" \
-+	"$KLIST" "$KRB5CCNAME" \
-+	|| failed=$((failed +1))
- unset KRB5CCNAME
- rm -f "$KRB5CCNAME_PATH"
- 
-@@ -62,6 +71,9 @@ testit "net_ads_kerberos_kinit (-P and KRB5CCNAME env set)" \
- 	"$VALGRIND" "$BINDIR"/net ads kerberos kinit \
- 	-P "$ADDARGS" \
- 	|| failed=$((failed + 1))
-+testit "klist env $KRB5CCNAME" \
-+	"$KLIST" "$KRB5CCNAME" \
-+	|| failed=$((failed +1))
- unset KRB5CCNAME
- rm -f "$KRB5CCNAME_PATH"
- 
-- 
-2.53.0
-
-
-From b9c07d59c6a20931b80fa104629477ab8f78b4ad Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
-Date: Tue, 2 Dec 2025 17:01:31 +0100
-Subject: [PATCH 05/13] s3-selftest: Activate "net ads kerberos kinit" tests
- with --use-krb5-ccache
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840
-
-Guenther
-
-Signed-off-by: Guenther Deschner <gd@samba.org>
-Reviewed-by: Andreas Schneider <asn@samba.org>
---
- selftest/knownfail                            |  2 ++
- source3/script/tests/test_net_ads_kerberos.sh | 30 +++++++++++--------
- 2 files changed, 20 insertions(+), 12 deletions(-)
-
-diff --git a/selftest/knownfail b/selftest/knownfail
-index ab2d79d7114..76f1dae605d 100644
--- a/selftest/knownfail
-+++ b/selftest/knownfail
-@@ -338,3 +338,5 @@
- 
- # We currently don't send referrals for LDAP modify of non-replicated attrs
- ^samba4.ldap.rodc.python\(rodc\).__main__.RodcTests.test_modify_nonreplicated.*
-+
-+^samba3.blackbox.net_ads_kerberos.*.klist.*--use-krb5-ccache.*
-diff --git a/source3/script/tests/test_net_ads_kerberos.sh b/source3/script/tests/test_net_ads_kerberos.sh
-index c53520cf733..b7933bab6a6 100755
--- a/source3/script/tests/test_net_ads_kerberos.sh
-+++ b/source3/script/tests/test_net_ads_kerberos.sh
-@@ -53,12 +53,15 @@ testit "klist env $KRB5CCNAME" \
- unset KRB5CCNAME
- rm -f "$KRB5CCNAME_PATH"
- 
-# --use-krb5-ccache is not working
-#testit "net_ads_kerberos_kinit (with --use-krb5-ccache)" \
-#	$VALGRIND $BINDIR/net ads kerberos kinit \
-#	-U$USERNAME%$PASSWORD $ADDARGS \
-#	--use-krb5-ccache=${KRB5CCNAME} \
-#	|| failed=$((failed + 1))
-+testit "net_ads_kerberos_kinit (with --use-krb5-ccache)" \
-+	"$VALGRIND" "$BINDIR"/net ads kerberos kinit \
-+	-U"$USERNAME"%"$PASSWORD" "$ADDARGS" \
-+	--use-krb5-ccache="${KRB5CCNAME_PATH}" \
-+	|| failed=$((failed + 1))
-+testit "klist --use-krb5-ccache $KRB5CCNAME_PATH" \
-+	"$KLIST" "$KRB5CCNAME_PATH" \
-+	|| failed=$((failed +1))
-+rm -f "$KRB5CCNAME_PATH"
- 
- #simply uses in memory ccache
- testit "net_ads_kerberos_kinit (-P)" \
-@@ -77,12 +80,15 @@ testit "klist env $KRB5CCNAME" \
- unset KRB5CCNAME
- rm -f "$KRB5CCNAME_PATH"
- 
-# --use-krb5-ccache is not working
-#testit "net_ads_kerberos_kinit (-P with --use-krb5-ccache)" \
-#	$VALGRIND $BINDIR/net ads kerberos kinit \
-#	-P $ADDARGS \
-#	--use-krb5-ccache=${KRB5CCNAME} \
-#	|| failed=$((failed + 1))
-+testit "net_ads_kerberos_kinit (-P with --use-krb5-ccache)" \
-+	"$VALGRIND" "$BINDIR"/net ads kerberos kinit \
-+	-P "$ADDARGS" \
-+	--use-krb5-ccache="${KRB5CCNAME_PATH}" \
-+	|| failed=$((failed + 1))
-+testit "klist --use-krb5-ccache $KRB5CCNAME_PATH" \
-+	"$KLIST" "$KRB5CCNAME_PATH" \
-+	|| failed=$((failed +1))
-+rm -f "$KRB5CCNAME_PATH"
- 
- 
- #################################################
-- 
-2.53.0
-
-
-From c82b7636b633575621e8e5964a93332956c238ff Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
-Date: Tue, 2 Dec 2025 16:56:44 +0100
-Subject: [PATCH 06/13] s3-net: properly setup krb5 ccache name via
- --use-krb5-ccache
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840
-
-Guenther
-
-Signed-off-by: Guenther Deschner <gd@samba.org>
-Reviewed-by: Andreas Schneider <asn@samba.org>
---
- selftest/knownfail      |  2 --
- source3/utils/net.c     | 19 ++++++++++++-------
- source3/utils/net_ads.c |  4 ++++
- 3 files changed, 16 insertions(+), 9 deletions(-)
-
-diff --git a/selftest/knownfail b/selftest/knownfail
-index 76f1dae605d..ab2d79d7114 100644
--- a/selftest/knownfail
-+++ b/selftest/knownfail
-@@ -338,5 +338,3 @@
- 
- # We currently don't send referrals for LDAP modify of non-replicated attrs
- ^samba4.ldap.rodc.python\(rodc\).__main__.RodcTests.test_modify_nonreplicated.*
-
-^samba3.blackbox.net_ads_kerberos.*.klist.*--use-krb5-ccache.*
-diff --git a/source3/utils/net.c b/source3/utils/net.c
-index ecabd980d0c..271c96cf804 100644
--- a/source3/utils/net.c
-+++ b/source3/utils/net.c
-@@ -1396,7 +1396,7 @@ static struct functable net_func[] = {
- 			cli_credentials_get_principal_obtained(c->creds);
- 		enum credentials_obtained password_obtained =
- 			cli_credentials_get_password_obtained(c->creds);
-		char *krb5ccname = NULL;
-+		const char *krb5ccname = NULL;
- 
- 		if (principal_obtained == CRED_SPECIFIED) {
- 			c->explicit_credentials = true;
-@@ -1415,15 +1415,20 @@ static struct functable net_func[] = {
- 		}
- 
- 		/* cli_credentials_get_ccache_name_obtained() would not work
-		 * here, we also cannot get the content of --use-krb5-ccache= so
-		 * for now at least honour the KRB5CCNAME environment variable
-		 * to get 'net ads kerberos' functions to work at all - gd */
-
-		krb5ccname = getenv("KRB5CCNAME");
-		if (krb5ccname == NULL) {
-+		 * here but we can now access the content of the
-+		 * --use-krb5-ccache option via cli credentials. Fallback to
-+		 * KRB5CCNAME environment variable to get 'net ads kerberos'
-+		 * functions to work at all - gd */
-+
-+		krb5ccname = cli_credentials_get_out_ccache_name(c->creds);
-+		if (krb5ccname == NULL || krb5ccname[0] == '\0') {
-+			krb5ccname = getenv("KRB5CCNAME");
-+		}
-+		if (krb5ccname == NULL || krb5ccname[0] == '\0') {
- 			krb5ccname = talloc_strdup(c, "MEMORY:net");
- 		}
- 		if (krb5ccname == NULL) {
-+			DBG_ERR("Not able to setup krb5 ccache");
- 			exit(1);
- 		}
- 		c->opt_krb5_ccache = krb5ccname;
-diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
-index d49b7537e71..5c57a0b290e 100644
--- a/source3/utils/net_ads.c
-+++ b/source3/utils/net_ads.c
-@@ -3245,7 +3245,11 @@ static int net_ads_kerberos_kinit(struct net_context *c, int argc, const char **
- 	if (ret) {
- 		d_printf(_("failed to kinit password: %s\n"),
- 			nt_errstr(status));
-+		return ret;
- 	}
-+
-+	d_printf("Stored Kerberos TGT in: %s\n", c->opt_krb5_ccache);
-+
- 	return ret;
- }
- 
-- 
-2.53.0
-
-
-From 4f5ffea631d805564f7e92cc5f0f2f7ad55ba493 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
-Date: Sat, 13 Dec 2025 13:49:37 +0100
-Subject: [PATCH 07/13] doc-xml: Document "net ads kerberos" commands
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840
-
-Guenther
-
-Signed-off-by: Guenther Deschner <gd@samba.org>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-
-Autobuild-User(master): Günther Deschner <gd@samba.org>
-Autobuild-Date(master): Mon Jan  5 15:49:04 UTC 2026 on atb-devel-224
---
- docs-xml/manpages/net.8.xml | 139 ++++++++++++++++++++++++++++++++++++
- 1 file changed, 139 insertions(+)
-
-diff --git a/docs-xml/manpages/net.8.xml b/docs-xml/manpages/net.8.xml
-index d9293d0bb34..737415b3722 100644
--- a/docs-xml/manpages/net.8.xml
-+++ b/docs-xml/manpages/net.8.xml
-@@ -1810,7 +1810,146 @@ the following entry types;
- 
- </refsect2>
- 
-+<refsect2>
-+	<title>ADS KERBEROS</title>
-+
-+<para>
-+	Issue Kerberos operations against an Active Directory KDC.
-+</para>
-+
-+</refsect2>
-+
-+<refsect2>
-+	<title>ADS KERBEROS KINIT</title>
-+
-+<para>
-+	Issue a kinit request for a given user. When no other options are
-+	defined the ticket granting ticket (TGT) will be stored in a memory cache.
-+</para>
-+
-+<para>
-+	To store the TGT in a different location either use the
-+	<option>--krb5-ccache</option> option or set the
-+	<replaceable>KRB5CCNAME</replaceable> environment variable.
-+</para>
-+
-+<para>Example: <userinput>net ads kerberos kinit -P --krb5-ccache=/tmp/krb5cache</userinput></para>
-+
-+</refsect2>
-+
-+<refsect2>
-+	<title>ADS KERBEROS RENEW</title>
-+
-+<para>
-+	Renew an already acquired ticket granting ticket (TGT).
-+</para>
-+
-+<para>Example: <userinput>net ads kerberos renew</userinput></para>
-+
-+</refsect2>
-+
-+<refsect2>
-+	<title>ADS KERBEROS PAC</title>
-+
-+<para>
-+	Request a Kerberos PAC while authenticating to an Active Directory KDC.
-+</para>
-+
-+<para>
-+	The following commands are provided:
-+</para>
-+
-+<simplelist>
-+<member>net ads kerberos pac dump - Dump a PAC to stdout.</member>
-+<member>net ads kerneros pac save - Save a PAC to a file.</member>
-+</simplelist>
-+
-+<para>
-+	All commands allow to define an impersonation principal to do a Kerberos
-+	Service for User (S4U2SELF) operation via
-+	the <replaceable>impersonate=STRING</replaceable> option.
-+	The impersonation principal can have multiple different formats:
-+</para>
-+
-+<itemizedlist>
-+	<listitem>
-+		<para><replaceable>user@MY.REALM</replaceable></para>
-+		<para>This is the default format.</para>
-+	</listitem>
-+	<listitem>
-+		<para><replaceable>user@MY.REALM@MY.REALM</replaceable></para>
-+		<para>The Kerberos Service for User (S4U2SELF) also supports
-+		Enterprise Principals.</para>
-+	</listitem>
-+	<listitem>
-+		<para><replaceable>user@UPN.SUFFIX@MY.REALM</replaceable></para>
-+		<para>Enterprise Principal using a defined upn suffix.</para>
-+	</listitem>
-+	<listitem>
-+		<para><replaceable>user@WORKGROUP@MY.REALM</replaceable></para>
-+		<para>Enterprise Principal with netbios domain name.
-+		This format is currently not supported by Samba AD.</para>
-+	</listitem>
-+</itemizedlist>
- 
-+<para>
-+	By default net will request a service ticket for the local service
-+	of the joined machine. A different service can be defined via
-+        <replaceable>local_service=STRING</replaceable>.
-+</para>
-+
-+</refsect2>
-+<refsect2>
-+	<title>ADS KERBEROS PAC DUMP [impersonate=string] [local_service=string] [pac_buffer_type=int]</title>
-+
-+<para>
-+	Request a Kerberos PAC while authenticating to an Active Directory KDC.
-+	The PAC will be printed on stdout.
-+</para>
-+
-+<para>
-+	When no specific pac_buffer is selected, all buffers will be printed.
-+	It is possible to select a specific one via
-+	<replaceable>pac_buffer_type=INT</replaceable> from this list:
-+</para>
-+
-+<simplelist>
-+<member>1 PAC_TYPE_LOGON_INFO</member>
-+<member>2 PAC_TYPE_CREDENTIAL_INFO</member>
-+<member>6 PAC_TYPE_SRV_CHECKSUM</member>
-+<member>7 PAC_TYPE_KDC_CHECKSUM</member>
-+<member>10 PAC_TYPE_LOGON_NAME</member>
-+<member>11 PAC_TYPE_CONSTRAINED_DELEGATION</member>
-+<member>12 PAC_TYPE_UPN_DNS_INFO</member>
-+<member>13 PAC_TYPE_CLIENT_CLAIMS_INFO</member>
-+<member>14 PAC_TYPE_DEVICE_INFO</member>
-+<member>15 PAC_TYPE_DEVICE_CLAIMS_INFO</member>
-+<member>16 PAC_TYPE_TICKET_CHECKSUM</member>
-+<member>17 PAC_TYPE_ATTRIBUTES_INFO</member>
-+<member>18 PAC_TYPE_REQUESTER_SID</member>
-+<member>19 PAC_TYPE_FULL_CHECKSUM</member>
-+</simplelist>
-+
-+<para>Example: <userinput>net ads kerberos pac dump -P impersonate=anyuser@MY.REALM.COM</userinput></para>
-+
-+</refsect2>
-+
-+<refsect2>
-+	<title>ADS KERBEROS PAC SAVE [impersonate=string] [local_service=string] [filename=string]</title>
-+
-+<para>
-+	Request a Kerberos PAC while authenticating to an Active Directory KDC.
-+	The PAC will be saved in a file.
-+</para>
-+
-+<para>
-+	The filename to store the PAC can be set via the
-+	<replaceable>filename=STRING</replaceable> option.
-+</para>
-+
-+<para>Example: <userinput>net ads kerberos pac save -U user%password filename=/tmp/pacstore</userinput></para>
-+
-+</refsect2>
- <refsect2>
- <title>SAM CREATEBUILTINGROUP &lt;NAME&gt;</title>
- 
-- 
-2.53.0
-
-
-From f634526bd95b8396ea7f5f1c8ed059eb01a5286b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
-Date: Tue, 3 Feb 2026 12:53:10 +0100
-Subject: [PATCH 08/13] s3:utils: 'net ads kerberos kinit' should use also
- default ccache name from krb5.conf
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This is re-introducing the behavior from samba-4.20 where both these
-commands operated on the same ccache (default_ccache_name in
-[libdefaults] section of krb5.conf)
-
- 'net ads kerberos kinit -P'
- 'klist'
-
- With samba-4.21 it no longer works, 'net ads kerberos kinit -P'
- fallbacks to 'MEMORY:net' (which is of a very limited use, ticket
- cannot be used by other process) and klist finds no ticket.
-
- The order is changed from:
-
-    --use-krb5-ccache
-    env "KRB5CCNAME"
-    "MEMORY:net"
-
-to ("MEMORY:net" is removed):
-
-    --use-krb5-ccache
-    env "KRB5CCNAME"
-    default_ccache_name
-
-'--use-krb5-ccache=MEMORY:net' can be used to validate the credentials.
-
-Use smb_force_krb5_cc_default_name() instead of krb5_cc_default_name()
-because of commit:
-1ca6fb5 make sure krb5_cc_default[_name]() is no longer used directly
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15993
-
-Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit 4cc6a13590434f6a3aa1add663728188970d727e)
---
- source3/utils/net.c | 36 ++++++++++++++++++++++++++----------
- 1 file changed, 26 insertions(+), 10 deletions(-)
-
-diff --git a/source3/utils/net.c b/source3/utils/net.c
-index 271c96cf804..0ce03f8213d 100644
--- a/source3/utils/net.c
-+++ b/source3/utils/net.c
-@@ -54,6 +54,7 @@
- #include "source3/utils/passwd_proto.h"
- #include "auth/gensec/gensec.h"
- #include "lib/param/param.h"
-+#include "lib/krb5_wrap/krb5_samba.h"
- 
- #ifdef WITH_FAKE_KASERVER
- #include "utils/net_afs.h"
-@@ -1414,18 +1415,33 @@ static struct functable net_func[] = {
- 				CRED_SPECIFIED);
- 		}
- 
-		/* cli_credentials_get_ccache_name_obtained() would not work
-		 * here but we can now access the content of the
-		 * --use-krb5-ccache option via cli credentials. Fallback to
-		 * KRB5CCNAME environment variable to get 'net ads kerberos'
-		 * functions to work at all - gd */
-
-+		/*
-+		 * Priority order for krb5 credential cache name
-+		 *
-+		 *    via cli_credentials_get_out_ccache_name() :
-+		 *
-+		 * 1. '--use-krb5-ccache' option
-+		 *
-+		 *    via krb5_cc_default_name() :
-+		 *
-+		 * 2. KRB5CCNAME environment variable
-+		 * 3. default_ccache_name in [libdefaults] section of krb5.conf
-+		 * 4. ...more - krb5_cc_default_name() always returns something
-+		 *    - see documentation
-+		 */
- 		krb5ccname = cli_credentials_get_out_ccache_name(c->creds);
- 		if (krb5ccname == NULL || krb5ccname[0] == '\0') {
-			krb5ccname = getenv("KRB5CCNAME");
-		}
-		if (krb5ccname == NULL || krb5ccname[0] == '\0') {
-			krb5ccname = talloc_strdup(c, "MEMORY:net");
-+			krb5_context ct = NULL;
-+			krb5_error_code ret = smb_krb5_init_context_common(&ct);
-+
-+			if (ret == 0) {
-+				krb5ccname = smb_force_krb5_cc_default_name(ct);
-+				if (krb5ccname != NULL) {
-+					krb5ccname = talloc_strdup(c,
-+								   krb5ccname);
-+				}
-+				krb5_free_context(ct);
-+			}
- 		}
- 		if (krb5ccname == NULL) {
- 			DBG_ERR("Not able to setup krb5 ccache");
-- 
-2.53.0
-
-
-From 0ca830d6ddded29b2b5d1969ebcbc4df1156656e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
-Date: Thu, 5 Feb 2026 16:04:25 +0100
-Subject: [PATCH 09/13] manpages: Update NET ADS KERBEROS KINIT manpage
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15993
-
-Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-
-Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
-Autobuild-Date(master): Thu Feb  5 21:11:13 UTC 2026 on atb-devel-224
-
-(cherry picked from commit 9d083a28fe45afd8f82441c6e24255e4c64c113b)
---
- docs-xml/manpages/net.8.xml | 36 ++++++++++++++++++++++++++++--------
- 1 file changed, 28 insertions(+), 8 deletions(-)
-
-diff --git a/docs-xml/manpages/net.8.xml b/docs-xml/manpages/net.8.xml
-index 737415b3722..b793361a27f 100644
--- a/docs-xml/manpages/net.8.xml
-+++ b/docs-xml/manpages/net.8.xml
-@@ -1823,17 +1823,37 @@ the following entry types;
- 	<title>ADS KERBEROS KINIT</title>
- 
- <para>
-	Issue a kinit request for a given user. When no other options are
-	defined the ticket granting ticket (TGT) will be stored in a memory cache.
-+	Issue a kinit request for a given user.  The following methods can be used
-+	to specify where to store the ticket granting ticket (TGT) (in order of
-+	precedence):
- </para>
- 
-<para>
-	To store the TGT in a different location either use the
-	<option>--krb5-ccache</option> option or set the
-	<replaceable>KRB5CCNAME</replaceable> environment variable.
-</para>
-+<itemizedlist>
-+	<listitem>
-+		<para>option <option>--use-krb5-ccache</option></para>
-+	</listitem>
-+	<listitem>
-+		<para><replaceable>KRB5CCNAME</replaceable> environment variable</para>
-+	</listitem>
-+	<listitem>
-+		<para><parameter>default_ccache_name</parameter> setting in <filename>krb5.conf</filename></para>
-+	</listitem>
-+</itemizedlist>
- 
-<para>Example: <userinput>net ads kerberos kinit -P --krb5-ccache=/tmp/krb5cache</userinput></para>
-+<variablelist><title>Examples:</title>
-+<varlistentry>
-+<term>Use file based cache (FILE:/tmp/krb5cache)</term>
-+<listitem><literallayout>
-+net ads kerberos kinit -P --use-krb5-ccache=/tmp/krb5cache
-+</literallayout></listitem>
-+</varlistentry>
-+<varlistentry>
-+<term>Use memory cache (MEMORY:net) to verify the authentication</term>
-+<listitem><literallayout>
-+net ads kerberos kinit -P --use-krb5-ccache=MEMORY:net
-+</literallayout></listitem>
-+</varlistentry>
-+</variablelist>
- 
- </refsect2>
- 
-- 
-2.53.0
-
-
-From 44b613d80c6a3818cc6ca593d57d51cd1bc00aa5 Mon Sep 17 00:00:00 2001
-From: Noel Power <noel.power@suse.com>
-Date: Fri, 13 Feb 2026 11:54:46 +0000
-Subject: [PATCH 10/13] selftest: Update tests to use
- --use-kereros=desired|required no creds
-
-Add tests to call smbclient without passing credentials to
-demonstrate failure with --use-kereros=desired
-
-Also add knownfail
-
-Signed-off-by: Noel Power <noel.power@suse.com>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit a22af9420965083b99b956477d1833000b7f2414)
---
- selftest/knownfail                              |  2 ++
- source3/script/tests/test_smbclient_kerberos.sh | 12 ++++++++++++
- 2 files changed, 14 insertions(+)
-
-diff --git a/selftest/knownfail b/selftest/knownfail
-index ab2d79d7114..f0a5f7bb935 100644
--- a/selftest/knownfail
-+++ b/selftest/knownfail
-@@ -315,6 +315,8 @@
- # ad_member don't support ntlmv1 (not even over SMB1)
- ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.member.creds.*as.user.*ad_member
- ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.*mNT1.member.creds.*as.user.*ad_member
-+# regression smbclient using --use-kerberos=desired https://bugzilla.samba.org/show_bug.cgi?id=15789
-+samba3.blackbox.smbclient.kerberos.smbclient.smb3.kerberos.desired \(no user/pass\).*
- #nt-vfs server blocks read with execute access
- ^samba4.smb2.read.access
- #ntvfs server blocks copychunk with execute access on read handle
-diff --git a/source3/script/tests/test_smbclient_kerberos.sh b/source3/script/tests/test_smbclient_kerberos.sh
-index 31678d17e28..1139efd70d7 100755
--- a/source3/script/tests/test_smbclient_kerberos.sh
-+++ b/source3/script/tests/test_smbclient_kerberos.sh
-@@ -73,6 +73,18 @@ test_smbclient "smbclient.smb3.kerberos.desired[//${SERVER}/tmp]" \
- 	--use-kerberos=desired -U${USERNAME}%${PASSWORD} -mSMB3 ||
- 	failed=$(expr $failed + 1)
- 
-+test_smbclient "smbclient.smb3.kerberos.desired (no user/pass) [//${SERVER}/tmp]" \
-+	"ls; quit" //${SERVER}/tmp \
-+	--use-kerberos=desired -mSMB3 ||
-+	failed=$(expr $failed + 1)
-+
-+test_smbclient "smbclient.smb3.kerberos.required (no user/pass) [//${SERVER}/tmp]" \
-+	"ls; quit" //${SERVER}/tmp \
-+	--use-kerberos=required -mSMB3 ||
-+	failed=$(expr $failed + 1)
-+
-+
-+
- $samba_kdestroy
- 
- rm -rf $KRB5CCNAME_PATH
-- 
-2.53.0
-
-
-From 65f70c0505759489a8b219e1297f8cdee2cc260a Mon Sep 17 00:00:00 2001
-From: Noel Power <noel.power@suse.com>
-Date: Mon, 19 Jan 2026 15:46:59 +0000
-Subject: [PATCH 11/13] auth/credentials: Fix regression with
- --use-kerberos=desired for smbclient
-
-As part of the gse_krb5 processing the following call chain
-
-gensec_gse_client_start()
-  ---> gensec_kerberos_possible()
-         ---> cli_credentials_authentication_requested()
-
-gensec_kerberos_possible()  will always fail when
-cli_credentials_get_kerberos_state() returns CRED_USE_KERBEROS_DESIRED
-
-It seems since use kerberos == desired is the default that it isn't
-necessary to see if credentials were modified to indicated authentication
-was requested. gensec_kerberos_possible() should afaics return true
-if kerberos is desired OR required (regardless of whether credentials
-were requested)
-
-This commit removes the knownfail associated with this bug.
-
-Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789
-Signed-off-by: <noel.power@suse.com>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit 88f42eb222f299189d5f5f8204ae353e63a50970)
---
- auth/gensec/gensec_util.c | 5 -----
- selftest/knownfail        | 2 --
- 2 files changed, 7 deletions(-)
-
-diff --git a/auth/gensec/gensec_util.c b/auth/gensec/gensec_util.c
-index 0c7688d33d2..af6d198d48f 100644
--- a/auth/gensec/gensec_util.c
-+++ b/auth/gensec/gensec_util.c
-@@ -362,7 +362,6 @@ char *gensec_get_unparsed_target_principal(struct gensec_security *gensec_securi
- NTSTATUS gensec_kerberos_possible(struct gensec_security *gensec_security)
- {
- 	struct cli_credentials *creds = gensec_get_credentials(gensec_security);
-	bool auth_requested = cli_credentials_authentication_requested(creds);
- 	enum credentials_use_kerberos krb5_state =
- 		cli_credentials_get_kerberos_state(creds);
- 	char *user_principal = NULL;
-@@ -370,10 +369,6 @@ NTSTATUS gensec_kerberos_possible(struct gensec_security *gensec_security)
- 	const char *target_principal = gensec_get_target_principal(gensec_security);
- 	const char *hostname = gensec_get_target_hostname(gensec_security);
- 
-	if (!auth_requested) {
-		return NT_STATUS_INVALID_PARAMETER;
-	}
-
- 	if (krb5_state == CRED_USE_KERBEROS_DISABLED) {
- 		return NT_STATUS_INVALID_PARAMETER;
- 	}
-diff --git a/selftest/knownfail b/selftest/knownfail
-index f0a5f7bb935..ab2d79d7114 100644
--- a/selftest/knownfail
-+++ b/selftest/knownfail
-@@ -315,8 +315,6 @@
- # ad_member don't support ntlmv1 (not even over SMB1)
- ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.member.creds.*as.user.*ad_member
- ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.*mNT1.member.creds.*as.user.*ad_member
-# regression smbclient using --use-kerberos=desired https://bugzilla.samba.org/show_bug.cgi?id=15789
-samba3.blackbox.smbclient.kerberos.smbclient.smb3.kerberos.desired \(no user/pass\).*
- #nt-vfs server blocks read with execute access
- ^samba4.smb2.read.access
- #ntvfs server blocks copychunk with execute access on read handle
-- 
-2.53.0
-
-
-From 8c955cad98b197936fceaf98306047e1f929ddfe Mon Sep 17 00:00:00 2001
-From: Noel Power <noel.power@suse.com>
-Date: Mon, 19 Jan 2026 16:10:10 +0000
-Subject: [PATCH 12/13] s3/libsmb: cli_session_creds_init fails when kerberos
- is desired
-
-There is a regression with code using cli_session_creds_init when
-cli_credentials_get_kerberos_state() returns CRED_USE_KERBEROS_DESIRED
-
-Authentication succeeds when boolean fallback_after_kerberos is false
-and fails when true.
-There doesn't seem to be a good reason why the value of
-fallback_after_kerberos should initialise the krb5 ccache or not.
-It would seems that krb5 cache should be setup for creds
-for *any* kerberos auth (whether fallback is enabled or not)
-
-Partial patch from <will69@gmx.de> (see bug referenced below)
-Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789
-Signed-off-by: Noel Power <noel.power@suse.com>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-(cherry picked from commit 1c48599105736499d18aa1f647bce9e1f8dbdcca)
---
- source3/libsmb/cliconnect.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
-index 116f746d37e..3fd423d8e5f 100644
--- a/source3/libsmb/cliconnect.c
-+++ b/source3/libsmb/cliconnect.c
-@@ -218,7 +218,7 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx,
- 				goto fail;
- 			}
- 		}
-	} else if (use_kerberos && !fallback_after_kerberos) {
-+	} else if (use_kerberos) {
- 		const char *error_string = NULL;
- 		int rc;
- 
-- 
-2.53.0
-
-
-From 015167aea7ece2bb683f86aa4b8c688d7a83267d Mon Sep 17 00:00:00 2001
-From: Noel Power <noel.power@suse.com>
-Date: Mon, 19 Jan 2026 16:18:02 +0000
-Subject: [PATCH 13/13] s3/libsmb: block anon authentication fallback is
- use-kerberos = desired
-
-When cli_credentials_get_kerberos_state returns CRED_USE_KERBEROS_REQUIRED
-libsmbclient method SMBC_server_internal will still try to fallback to
-anon NTLM. This patch prevents that.
-
-Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789
-Signed-off-by: Noel Power <noel.power@suse.com>
-Reviewed-by: Andreas Schneider <asn@samba.org>
-
-Autobuild-User(master): Noel Power <npower@samba.org>
-Autobuild-Date(master): Tue Feb 17 16:06:18 UTC 2026 on atb-devel-224
-
-(cherry picked from commit bc868800276fe09cbcb206ebe4cb4da32af7599f)
---
- source3/libsmb/libsmb_server.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c
-index f9b52e1f05a..8c7208aaee0 100644
--- a/source3/libsmb/libsmb_server.c
-+++ b/source3/libsmb/libsmb_server.c
-@@ -632,6 +632,8 @@ SMBC_server_internal(TALLOC_CTX *ctx,
- 		password_used = "";
- 
-                 if (smbc_getOptionNoAutoAnonymousLogin(context) ||
-+		    cli_credentials_get_kerberos_state(creds) ==
-+			    CRED_USE_KERBEROS_REQUIRED ||
- 		    !NT_STATUS_IS_OK(cli_session_setup_anon(c))) {
- 
-                         cli_shutdown(c);
-- 
-2.53.0
-
--- a/SOURCES/redhat-4.24.patch
+++ b/SOURCES/redhat-4.24.patch
@ -0,0 +1,80 @@
+From 1de6565c25272b536607e7e787d65765a3ad5220 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
+Date: Thu, 22 Jan 2026 14:27:09 +0100
+Subject: [PATCH] s3:libads: Allocate cli_credentials on a stackframe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This fixes:
+ERROR: talloc_free with references at ../../source3/libads/ldap_utils.c:158
+
+What happens:
+
+* `struct cli_credentials *creds` is allocated on `ads` talloc context
+* gensec_set_credentials() creates a talloc_reference to `creds`
+* TALLOC_FREE(creds) sees two parents and complains
+
+All other code is using temporary talloc_stackframe() for `creds`.
+Do it here as well.
+
+Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
+Reviewed-by: Stefan Metzmacher <metze@samba.org>
+
+Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
+Autobuild-Date(master): Fri Jan 23 11:20:28 UTC 2026 on atb-devel-224
+---
+ source3/libads/ldap_utils.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/source3/libads/ldap_utils.c b/source3/libads/ldap_utils.c
+index 9d6d962a2bc..d01afa69697 100644
+--- a/source3/libads/ldap_utils.c
+++ b/source3/libads/ldap_utils.c
+@@ -99,6 +99,7 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind
+ 		struct cli_credentials *creds = NULL;
+ 		char *cred_name = NULL;
+ 		NTSTATUS ntstatus;
+		TALLOC_CTX *frame = talloc_stackframe();
+ 
+ 		if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) &&
+ 		    ads->config.ldap_page_size >= (lp_ldap_page_size() / 4) &&
+@@ -119,18 +120,20 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind
+ 			DBG_NOTICE("Search for %s in <%s> failed: %s\n",
+ 				   expr, bp, ads_errstr(status));
+ 			SAFE_FREE(bp);
+			TALLOC_FREE(frame);
+ 			return status;
+ 		}
+ 
+ 		ntstatus = ads->auth.reconnect_state->fn(ads,
+ 				ads->auth.reconnect_state->private_data,
+-				ads, &creds);
+				frame, &creds);
+ 		if (!NT_STATUS_IS_OK(ntstatus)) {
+ 			DBG_WARNING("Failed to get creds for realm(%s): %s\n",
+ 				    ads->server.realm, nt_errstr(ntstatus));
+ 			DBG_WARNING("Search for %s in <%s> failed: %s\n",
+ 				   expr, bp, ads_errstr(status));
+ 			SAFE_FREE(bp);
+			TALLOC_FREE(frame);
+ 			return status;
+ 		}
+ 
+@@ -151,11 +154,11 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind
+ 			 * callers depend on it being around.
+ 			 */
+ 			ads_disconnect(ads);
+-			TALLOC_FREE(creds);
+			TALLOC_FREE(frame);
+ 			SAFE_FREE(bp);
+ 			return status;
+ 		}
+-		TALLOC_FREE(creds);
+		TALLOC_FREE(frame);
+ 
+ 		*res = NULL;
+ 
+-- 
+2.53.0
+
--- a/SOURCES/samba-4.23.5.tar.asc
+++ b/SOURCES/samba-4.23.5.tar.asc
@ -1,16 +0,0 @@
-----BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEEgfXigyvSVFoYl7cTqplEL7aAtiAFAmlzV8sACgkQqplEL7aA
-tiCrUxAAkEcyHkI48DZpwRd+0rP2IJC+6vpGj/RSGHdlyztw3R+49EOW9HURNqsl
-8FHHUairod5CzyXc2UfoZNHuo5s3YE2WOuxSur2W8/FYPVllX9sOvNilaQsplvDX
-8zMsQ4Ky5z57EeScDFaGl/NPypLcJ5i2hrBHRrn4Gsa5koKs9M+BlO1/xH8TBFPG
-hAAXaLFw8pkMFDEIIrRMdOGAUeNaBq3dVkfzPAgd6FYAAUjuP/3O2gM87zLPgbf1
-5Deg+HYNLhKaAUNJPs3OuiLZTN3FpRAif/DKJCL16kbNxygN71OXI1vf20BooNpj
-qTx3xseHraHkTy3HElru5CTlW+jYPLd7UqHcH0g+wRp/xlwH5vR7vc+wZpyFmOfm
-OThXsVzZKzwQo9Ce+N9vs0FgSR0BLXvHHIs77XV0BdC3G/tE+iOPsp1GFbmhC5Dn
-F/hqFmbKBBNiqv2v1s3mT1rX8DNeUaHA44coJJnr8vc9fMtrqkDuBiAOtzknm+j+
-IW3NLWsvl2y94anc9Aq6Ffanc1qSwVvdFNb/d1dZjR7sLP19UdJAFZTiJ/V2yQET
-++AX9DKBtIO0KguJowEROrRu+inOT/Rs4PLwxxbtEVxqmqH7An+nO0FzV+xSjI/1
-l+zLG3njDFDSDS/cXvrnzvFAWqs/5pKmlhcDzAicnuUgIzsKd08=
-=qxcw
-----END PGP SIGNATURE-----
--- a/SOURCES/samba-4.24.5.tar.asc
+++ b/SOURCES/samba-4.24.5.tar.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEgfXigyvSVFoYl7cTqplEL7aAtiAFAmpg4boACgkQqplEL7aA
+tiDZrBAAiBI8SST7hZeDLH5NYqyduC8PWrgOm6ljVrsqwPOofIt1HVbJNmeujQx4
+9EuVATaf5S2+RS94hZmnJOxY2Bqd5LfXM3i+uaKAYkXx+qjBzFhT0qEGW0L+ZQl
+x4fA0X5T0TdGF/022KRyZDt6LsgKl+O+0FiminuHDgqE8EsMNZ1jwjtbtn4cZVfn
+OU0Cq0w0TP38QDMkDxsLu+ZrrHR0gxmp0KVR+pLjUXITwXsLYtXmOnforCUKhdIt
+aIAg9B7uHrUMXPdF68s0msIFAA9aW9Y2UQPN7xRCvhlkKRwJKqLrFPJeRsaNrUkB
+beOXqjMCs3WUtnBSCmJGKWaWAiQhazxSfBdo1obNI6CYNOy47ibwUzDUBGfBeeJ2
+1kcEtQRKSo1I6yzTYptj7LlOHBaN9eB/myIrmaTyzn9v/RHgZ2dx9lCa12h+kkjS
+SnrTHJUpsNry26vtbV/5yph0cYRLo8A4bjoSWTINioa3KtN71384rQjgeaIK9Szb
+Du4Cs2cQzcLZ6Fj5TertAnL+sW0WnI+kmN5EVxzSffqLSzrBI18dTG13mFNweFV2
+mC72vW1mPdAE5rqjzwMahcxril2zKvezD8F2mP77gGs+oWxkEM9Wiuz2AfSEToZQ
+bg2oli+FIG9aGhRRjpxFaiYWq6gsws9h0a8as87YbAd+a2futPQ=
+=onxY
+-----END PGP SIGNATURE-----
--- a/SPECS/samba.spec
+++ b/SPECS/samba.spec
@ -2,7 +2,7 @@
 ## (rpmautospec version 0.6.5)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 6;
+    release_number = 1;
    base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
    print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@ -16,7 +16,17 @@
 # or
 # rpmbuild --rebuild --with testsuite samba.src.rpm
 #
+# If you just want to run a single test, you can use:
+# fedpkg mockbuild --with testsuite -- --define 'SAMBA_TESTS regex' samba.src.rpm
+# or
+# rpmbuild --rebuild --with testsuite --define='SAMBA_TESTS regex' samba.src.rpm
+#
 %bcond testsuite 0
+%if %{with testsuite}
+# As the file list is empty for running just the tests, we have empty debuginfo
+# package. Disable it to avoid error reporting.
+%global debug_package %{nil}
+%endif

 # Build with internal talloc, tevent, tdb
 #
@ -112,7 +122,8 @@

 # Build the etcd helpers by default on Fedora
 %if 0%{?fedora}
-%bcond etcd_mutex 1
+# disable etcd mutex helper as etcd is orphaned in Fedora now
+%bcond etcd_mutex 0
 %else
 %bcond etcd_mutex 0
 %endif
@ -130,7 +141,13 @@
 %bcond lmdb 0
 %endif

-%global samba_version 4.23.5
+%if 0%{?fedora} >= 43
+%bcond varlink 1
+%else
+%bcond varlink 0
+%endif
+
+%global samba_version 4.24.5

 # The release field is extended:
 # <pkgrel>[.<extraver>][.<snapinfo>]%%{?dist}[.<minorbump>]
@ -175,8 +192,8 @@
 %global libsmbclient_so_version 0
 %global libwbclient_so_version 0

-%global talloc_version 2.4.3
-%global tdb_version 1.4.14
+%global talloc_version 2.4.4
+%global tdb_version 1.4.15
 %global tevent_version 0.17.1

 %global required_mit_krb5 1.20.1
@ -236,15 +253,15 @@ Source202:      samba.abignore
 #
 # git clone git@gitlab.com:samba-redhat/samba.git
 # cd samba
-# git checkout v4-23-redhat
-# git format-patch --stdout -l1 --no-renames -N > redhat-4.23.patch
+# git checkout v4-24-redhat
+# git format-patch --stdout -l1 --no-renames -N > redhat-4.24.patch
 # where N is number of commits

-Patch0:        redhat-4.23.patch
+Patch0:        redhat-4.24.patch

 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-common-tools = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
@ -345,6 +362,12 @@ BuildRequires: pkgconfig(libsystemd)
 %if 0%{?fedora} >= 43
 BuildRequires: pkgconfig(libngtcp2)
 BuildRequires: pkgconfig(libngtcp2_crypto_gnutls)
+%else
+Provides:      bundled(ngtcp2)
+%endif
+
+%if %{with varlink}
+BuildRequires: pkgconfig(libvarlink) >= 24
 %endif

 %ifnarch i686
@ -460,7 +483,7 @@ Unix.
 Summary: Samba client programs
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 %if %{with libsmbclient}
@ -483,12 +506,62 @@ The %{name}-client package provides some SMB/CIFS clients to complement
 the built-in SMB/CIFS filesystem in Linux. These clients allow access
 of SMB/CIFS shares and printing to SMB/CIFS printers.

+### CORE-LIBS
+%package core-libs
+Summary: Samba core libraries
+Requires(pre): %{name}-common = %{samba_depver}
+Requires: %{name}-common = %{samba_depver}
+
+Provides: bundled(libreplace) = %{samba_depver}
+
+%description core-libs
+The samba-core-libs package contains foundational libraries needed by
+both Samba servers and clients. This includes error handling, utilities,
+and basic support libraries.
+
+### NDR-LIBS
+%package ndr-libs
+Summary: Samba NDR libraries
+Requires(pre): %{name}-common = %{samba_depver}
+Requires: %{name}-common = %{samba_depver}
+Requires: %{name}-core-libs = %{samba_depver}
+
+Provides: %{name}-common-libs = %{samba_depver}
+Obsoletes: %{name}-common-libs < %{samba_depver}
+
+%if %{without dc} && %{without testsuite}
+Obsoletes: samba-dc < %{samba_depver}
+Obsoletes: samba-dc-libs < %{samba_depver}
+Obsoletes: samba-dc-bind-dlz < %{samba_depver}
+%endif
+
+# ctdb-tests package has been dropped if we do not build the testsuite
+%if %{with clustering}
+%if %{without testsuite}
+Obsoletes: ctdb-tests < %{samba_depver}
+Obsoletes: ctdb-tests-debuginfo < %{samba_depver}
+# endif without testsuite
+%endif
+# endif with clustering
+%endif
+
+# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions
+# of the distro
+%if %{without vfs_glusterfs}
+Obsoletes: samba-vfs-glusterfs < %{samba_depver}
+# endif without vfs_glusterfs
+%endif
+
+%description ndr-libs
+The samba-ndr-libs package contains NDR (Network Data Representation)
+encoding libraries used by both Samba servers and clients.
+
 ### CLIENT-LIBS
 %package client-libs
 Summary: Samba client libraries
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 %if %{with libwbclient}
 Requires: libwbclient = %{samba_depver}
@ -518,50 +591,10 @@ Obsoletes: samba4-common < %{samba_depver}
 samba-common provides files necessary for both the server and client
 packages of Samba.

-### COMMON-LIBS
-%package common-libs
-Summary: Libraries used by both Samba servers and clients
-Requires(pre): samba-common = %{samba_depver}
-Requires: samba-common = %{samba_depver}
-Requires: %{name}-client-libs = %{samba_depver}
-Requires: libldb = %{samba_depver}
-%if %{with libwbclient}
-Requires: libwbclient = %{samba_depver}
-%endif
-
-Provides: bundled(libreplace) = %{samba_depver}
-
-%if %{without dc} && %{without testsuite}
-Obsoletes: samba-dc < %{samba_depver}
-Obsoletes: samba-dc-libs < %{samba_depver}
-Obsoletes: samba-dc-bind-dlz < %{samba_depver}
-%endif
-
-# ctdb-tests package has been dropped if we do not build the testsuite
-%if %{with clustering}
-%if %{without testsuite}
-Obsoletes: ctdb-tests < %{samba_depver}
-Obsoletes: ctdb-tests-debuginfo < %{samba_depver}
-# endif without testsuite
-%endif
-# endif with clustering
-%endif
-
-# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions
-# of the distro
-%if %{without vfs_glusterfs}
-Obsoletes: samba-vfs-glusterfs < %{samba_depver}
-# endif without vfs_glusterfs
-%endif
-
-%description common-libs
-The samba-common-libs package contains internal libraries needed by the
-SMB/CIFS clients.
-
 ### COMMON-TOOLS
 %package common-tools
 Summary: Tools for Samba clients
-Requires: samba-common-libs = %{samba_depver}
+Requires: samba-ndr-libs = %{samba_depver}
 Requires: samba-client-libs = %{samba_depver}
 Requires: samba-libs = %{samba_depver}
 Requires: samba-ldb-ldap-modules = %{samba_depver}
@ -599,7 +632,7 @@ and for GPO management on domain members.
 ### RPC
 %package dcerpc
 Summary: DCE RPC binaries
-Requires: samba-common-libs = %{samba_depver}
+Requires: samba-ndr-libs = %{samba_depver}
 Requires: samba-client-libs = %{samba_depver}
 Requires: samba-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
@ -617,7 +650,7 @@ The samba-dcerpc package contains binaries that serve DCERPC over named pipes.
 Summary: Samba AD Domain Controller
 Requires: %{name} = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-common-tools = %{samba_depver}
 Requires: %{name}-tools = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
@ -661,7 +694,7 @@ The samba-dc-provision package provides files to setup a domain controller
 %package dc-libs
 Summary: Samba AD Domain Controller Libraries
 Requires: %{name}-client-libs = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
@ -699,8 +732,10 @@ name server related details of Samba AD.
 ### DEVEL
 %package devel
 Summary: Developer tools for Samba libraries
-Requires: %{name}-libs = %{samba_depver}
+Requires: %{name}-core-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
+Requires: %{name}-libs = %{samba_depver}
 Requires: %{name}-dc-libs = %{samba_depver}
 Requires: libnetapi = %{samba_depver}

@ -755,7 +790,7 @@ Summary: Samba VFS module for GlusterFS
 Requires: glusterfs-api >= 3.4.0.16
 Requires: glusterfs >= 3.4.0.16
 Requires: %{name} = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
@ -806,7 +841,7 @@ the Kerberos credentials cache of the user issuing the print job.
 %package ldb-ldap-modules
 Summary: Samba ldap modules for ldb
 Requires: %{name}-client-libs = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}

@ -817,7 +852,7 @@ samba-gpupdate.
 ### LIBS
 %package libs
 Summary: Samba libraries
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 %if %{with libwbclient}
@ -838,7 +873,7 @@ against the SMB, RPC and other protocols provided by the Samba suite.
 Summary: The NETAPI library
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
@ -860,7 +895,7 @@ develop programs that link against the NETAPI library in the Samba suite.
 Summary: The SMB client library
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 %if %{with libwbclient}
@ -885,7 +920,7 @@ suite.
 %if %{with libwbclient}
 %package -n libwbclient
 Summary: The winbind client library
-Requires: %{name}-client-libs = %{samba_depver}
+# libwbclient.so only links to libc - no samba library dependencies needed
 Conflicts: sssd-libwbclient

 %description -n libwbclient
@ -910,7 +945,7 @@ library.
 %package -n python3-%{name}
 Summary: Samba Python3 libraries
 Requires: %{name}-client-libs = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 Requires: %{name}-dc-libs = %{samba_depver}
 Requires: python3-cryptography
@ -980,7 +1015,7 @@ Requires: %{name} = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
 Requires: %{name}-winbind = %{samba_depver}

-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 Requires: %{name}-test-libs = %{samba_depver}
@ -1011,7 +1046,7 @@ packages of Samba.
 ### TEST-LIBS
 %package test-libs
 Summary: Libraries need by the testing tools for Samba servers and clients
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
@ -1044,8 +1079,8 @@ as a user using the `net usershare` command.
 Summary: Samba winbind
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
-Requires(post): %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
+Requires(post): %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-common-tools = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires(post): %{name}-client-libs = %{samba_depver}
@ -1078,7 +1113,7 @@ Windows user and group accounts on Linux.
 %package winbind-clients
 Summary: Samba winbind clients
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 Requires: %{name}-winbind = %{samba_depver}
@ -1148,7 +1183,7 @@ necessary to communicate to the Winbind Daemon
 Summary: Samba Winexe Windows Binary
 License: GPL-3.0-only
 Requires: %{name}-client-libs = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}

@ -1163,7 +1198,7 @@ Winexe is a Remote Windows-command executor
 %package -n ctdb
 Summary: A Clustered Database based on Samba's Trivial Database (TDB)

-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-winbind-clients = %{samba_depver}

@ -1336,6 +1371,13 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} -
 # Make sure we do not build with heimdal code
 rm -rfv third_party/heimdal

+%if %{with testsuite}
+# WARNING: Don't change that for production!
+#
+# Shorten the priviliged dir, as unix sockets only have 108 chars
+sed -i 's/#define WINBINDD_PRIV_SOCKET_SUBDIR.*/#define WINBINDD_PRIV_SOCKET_SUBDIR "wb_priv"/' nsswitch/winbind_struct_protocol.h
+%endif
+
 %build
 %if %{with includelibs}
 %global _talloc_lib ,talloc,pytalloc,pytalloc-util
@ -1445,6 +1487,9 @@ export PYTHONARCHDIR=%{python3_sitearch}
 %endif
 %if %{with prometheus}
        --with-prometheus-exporter \
+%endif
+%if %{with varlink}
+        --with-systemd-userdb \
 %endif
        --with-profiling-data \
        --with-systemd \
@ -1609,6 +1654,9 @@ rm -f %{buildroot}%{_mandir}/man3/PyLdb*
 # CTDB
 %if %{with clustering}
 touch %{buildroot}%{_libexecdir}/ctdb/statd_callout
+
+# Remove symlinks that are marked as %ghost (CTDB will create them at runtime)
+rm -f %{buildroot}%{_sysconfdir}/ctdb/statd-callout
 #endif with clustering
 %endif

@ -1624,20 +1672,37 @@ touch %{buildroot}%{_libexecdir}/ctdb/statd_callout
 # in the timestamp so the year 2038 problem is deferred till 2446.
 # https://bugzilla.samba.org/show_bug.cgi?id=14546
 #
-for t in samba3.smb2.timestamps.time_t_15032385535 \
-         samba3.smb2.timestamps.time_t_10000000000 \
-         samba3.smb2.timestamps.time_t_4294967295 \
-         ; do
-    echo "^$t" >> selftest/knownfail.d/fedora.%{dist}
-done
-cat selftest/knownfail.d/fedora.%{dist}
+if [ "$(df --portability --print-type "$(pwd)" | grep -c ext4)" == "1" ]; then
+    cat > selftest/knownfail.d/fedora%{dist} << EOF
+^samba3.smb2.timestamps.time_t_15032385535
+^samba3.smb2.timestamps.time_t_10000000000
+^samba3.smb2.timestamps.time_t_4294967295
+EOF
+fi
+
+echo
+echo "Content of selftest/knownfail.d/fedora%{dist}:"
+cat selftest/knownfail.d/fedora%{dist} || true
+
+cat >> selftest/skip << EOF
+# FIXME: Investigate why it fails. Might be CUPS is not running?
+^samba3.rpc.spoolss.printserver
+EOF
+
+echo
+echo "Content of selftest/skip:"
+cat selftest/skip

 export TDB_NO_FSYNC=1
 export NMBD_DONT_LOG_STDOUT=1
 export SMBD_DONT_LOG_STDOUT=1
 export WINBINDD_DONT_LOG_STDOUT=1
 export SAMBA_DCERPCD_DONT_LOG_STDOUT=1
+%if "x%{?SAMBA_TESTS}" != "x"
+%{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 TESTS="%{SAMBA_TESTS}"
+%else
 %{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1
+%endif
 #endif with testsuite
 %endif

@ -1683,7 +1748,7 @@ fi

 %ldconfig_scriptlets client-libs

-%ldconfig_scriptlets common-libs
+%ldconfig_scriptlets ndr-libs

 %if %{with dc}
 %ldconfig_scriptlets dc-libs
@ -1798,6 +1863,7 @@ fi
 %{_libdir}/samba/vfs/acl_xattr.so
 %{_libdir}/samba/vfs/aio_fork.so
 %{_libdir}/samba/vfs/aio_pthread.so
+%{_libdir}/samba/vfs/aio_ratelimit.so
 %{_libdir}/samba/vfs/audit.so
 %{_libdir}/samba/vfs/btrfs.so
 %{_libdir}/samba/vfs/cap.so
@ -1860,6 +1926,7 @@ fi
 %{_mandir}/man8/vfs_acl_xattr.8*
 %{_mandir}/man8/vfs_aio_fork.8*
 %{_mandir}/man8/vfs_aio_pthread.8*
+%{_mandir}/man8/vfs_aio_ratelimit.8*
 %{_mandir}/man8/vfs_audit.8*
 %{_mandir}/man8/vfs_btrfs.8*
 %{_mandir}/man8/vfs_cap.8*
@ -1977,33 +2044,104 @@ fi
 #endif with includelibs
 %endif

+### CORE-LIBS
+%files core-libs
+%dir %{_libdir}/samba
+
+#
+# Tier 0: Private libraries - libc only dependencies
+#
+%{_libdir}/samba/libreplace-private-samba.so
+%{_libdir}/samba/libsocket-blocking-private-samba.so
+%{_libdir}/samba/libsys-rw-private-samba.so
+%{_libdir}/samba/libtime-basic-private-samba.so
+
+#
+# Tier 1: Private libraries - system libs (libtalloc, libsystemd)
+#
+%{_libdir}/samba/libsamba-debug-private-samba.so
+%{_libdir}/samba/libserver-role-private-samba.so
+
+#
+# Tier 1: Public libraries - system libs (libtalloc)
+#
+%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}*
+
+#
+# Tier 2: Private libraries - adds gnutls
+#
+%{_libdir}/samba/libgenrand-private-samba.so
+
+#
+# Tier 2: Public libraries - adds gnutls, icu, tevent
+#
+%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}*
+%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}*
+
+### NDR-LIBS
+%files ndr-libs
+
+#
+# Core NDR library
+#
+%{_libdir}/libndr.so.%{libndr_so_version}*
+
+#
+# Tier 0: libc only dependencies
+#
+%{_libdir}/samba/libutil-setid-private-samba.so
+%{_libdir}/samba/libutil-tdb-private-samba.so
+
+#
+# Tier 1: system libs only (libtalloc)
+#
+%{_libdir}/samba/libiov-buf-private-samba.so
+%{_libdir}/samba/libstable-sort-private-samba.so
+%{_libdir}/samba/libtalloc-report-private-samba.so
+%{_libdir}/samba/libtalloc-report-printf-private-samba.so
+
+#
+# Tier 2: depends on core-libs (debug, replace)
+#
+%{_libdir}/samba/libflag-mapping-private-samba.so
+%{_libdir}/samba/libinterfaces-private-samba.so
+%{_libdir}/samba/libtdb-wrap-private-samba.so
+
+#
+# Tier 3: depends on core-libs (util, errors, ndr)
+#
+%{_libdir}/samba/libdbwrap-private-samba.so
+%{_libdir}/samba/libsamba3-util-private-samba.so
+%{_libdir}/samba/libutil-reg-private-samba.so
+
+#
+# Tier 4: depends on core-libs + Tier 3 libs
+#
+%{_libdir}/samba/libsamba-security-private-samba.so
+
+#
+# NDR encoding libraries
+#
+%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}*
+%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}*
+%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}*
+
 ### CLIENT-LIBS
 %files client-libs
 %{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}*
 %{_libdir}/libdcerpc-server-core.so.%{libdcerpc_server_core_so_version}*
 %{_libdir}/libdcerpc.so.%{libdcerpc_so_version}*
-%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}*
-%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}*
-%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}*
-%{_libdir}/libndr.so.%{libndr_so_version}*
 %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}*
-%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}*
 %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}*
 %{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}*
-%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}*
 %{_libdir}/libsamdb.so.%{libsamdb_so_version}*
 %{_libdir}/libsmbconf.so.%{libsmbconf_so_version}*
 %{_libdir}/libsmbldap.so.%{libsmbldap_so_version}*
-%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}*
-
-%dir %{_libdir}/samba
 %{_libdir}/samba/libCHARSET3-private-samba.so
 %{_libdir}/samba/libMESSAGING-SEND-private-samba.so
-%{_libdir}/samba/libMESSAGING-private-samba.so
 %{_libdir}/samba/libaddns-private-samba.so
 %{_libdir}/samba/libads-private-samba.so
 %{_libdir}/samba/libasn1util-private-samba.so
-%{_libdir}/samba/libauth-private-samba.so
 %{_libdir}/samba/libauthkrb5-private-samba.so
 %{_libdir}/samba/libcli-cldap-private-samba.so
 %{_libdir}/samba/libcli-ldap-common-private-samba.so
@ -2016,20 +2154,12 @@ fi
 %{_libdir}/samba/libcluster-private-samba.so
 %{_libdir}/samba/libcmdline-contexts-private-samba.so
 %{_libdir}/samba/libcommon-auth-private-samba.so
-%{_libdir}/samba/libctdb-event-client-private-samba.so
-%{_libdir}/samba/libdbwrap-private-samba.so
 %{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so
 %{_libdir}/samba/libdcerpc-samba-private-samba.so
 %{_libdir}/samba/libevents-private-samba.so
-%{_libdir}/samba/libflag-mapping-private-samba.so
-%{_libdir}/samba/libgenrand-private-samba.so
 %{_libdir}/samba/libgensec-private-samba.so
-%{_libdir}/samba/libgpext-private-samba.so
-%{_libdir}/samba/libgpo-private-samba.so
 %{_libdir}/samba/libgse-private-samba.so
 %{_libdir}/samba/libhttp-private-samba.so
-%{_libdir}/samba/libinterfaces-private-samba.so
-%{_libdir}/samba/libiov-buf-private-samba.so
 %{_libdir}/samba/libkrb5samba-private-samba.so
 %{_libdir}/samba/libldbsamba-private-samba.so
 %{_libdir}/samba/liblibcli-lsa3-private-samba.so
@ -2042,45 +2172,36 @@ fi
 %{_libdir}/samba/libmsrpc3-private-samba.so
 %{_libdir}/samba/libndr-samba-private-samba.so
 %{_libdir}/samba/libndr-samba4-private-samba.so
-%{_libdir}/samba/libnet-keytab-private-samba.so
 %{_libdir}/samba/libnetif-private-samba.so
 %if 0%{?rhel}
 %{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so
 %{_libdir}/samba/libngtcp2-private-samba.so
 %endif
 %{_libdir}/samba/libnpa-tstream-private-samba.so
-%{_libdir}/samba/libposix-eadb-private-samba.so
-%{_libdir}/samba/libprinter-driver-private-samba.so
-%{_libdir}/samba/libprinting-migrate-private-samba.so
 %{_libdir}/samba/libquic-private-samba.so
 %{_libdir}/samba/libregistry-private-samba.so
 %{_libdir}/samba/libsamba-cluster-support-private-samba.so
-%{_libdir}/samba/libsamba-debug-private-samba.so
 %{_libdir}/samba/libsamba-modules-private-samba.so
-%{_libdir}/samba/libsamba-security-private-samba.so
 %{_libdir}/samba/libsamba-security-trusts-private-samba.so
 %{_libdir}/samba/libsamba-sockets-private-samba.so
-%{_libdir}/samba/libsamba3-util-private-samba.so
 %{_libdir}/samba/libsamdb-common-private-samba.so
 %{_libdir}/samba/libsecrets3-private-samba.so
 %{_libdir}/samba/libserver-id-db-private-samba.so
-%{_libdir}/samba/libserver-role-private-samba.so
 %{_libdir}/samba/libsmbclient-raw-private-samba.so
-%{_libdir}/samba/libsmbd-base-private-samba.so
 %{_libdir}/samba/libsmbd-shim-private-samba.so
-%{_libdir}/samba/libsmbldaphelper-private-samba.so
-%{_libdir}/samba/libstable-sort-private-samba.so
-%{_libdir}/samba/libsys-rw-private-samba.so
-%{_libdir}/samba/libsocket-blocking-private-samba.so
-%{_libdir}/samba/libtalloc-report-printf-private-samba.so
-%{_libdir}/samba/libtalloc-report-private-samba.so
-%{_libdir}/samba/libtdb-wrap-private-samba.so
-%{_libdir}/samba/libtime-basic-private-samba.so
-%{_libdir}/samba/libtorture-private-samba.so
-%{_libdir}/samba/libutil-crypt-private-samba.so
-%{_libdir}/samba/libutil-reg-private-samba.so
-%{_libdir}/samba/libutil-setid-private-samba.so
-%{_libdir}/samba/libutil-tdb-private-samba.so
+
+#
+# Command line library
+#
+%{_libdir}/samba/libcmdline-private-samba.so
+
+#
+# Password database modules (depend on libsamba-passdb)
+#
+%dir %{_libdir}/samba/ldb
+%dir %{_libdir}/samba/pdb
+%{_libdir}/samba/pdb/smbpasswd.so
+%{_libdir}/samba/pdb/tdbsam.so

 %if %{without libwbclient}
 %{_libdir}/samba/libwbclient.so.*
@ -2131,19 +2252,6 @@ fi
 %{_mandir}/man5/smbpasswd.5*
 %{_mandir}/man7/samba.7*

-### COMMON-LIBS
-%files common-libs
-# common libraries
-%{_libdir}/samba/libcmdline-private-samba.so
-%{_libdir}/samba/libreplace-private-samba.so
-
-%dir %{_libdir}/samba/ldb
-
-%dir %{_libdir}/samba/pdb
-%{_libdir}/samba/pdb/ldapsam.so
-%{_libdir}/samba/pdb/smbpasswd.so
-%{_libdir}/samba/pdb/tdbsam.so
-
 ### COMMON-TOOLS
 %files common-tools
 %{_bindir}/net
@ -2392,6 +2500,7 @@ fi
 %{_includedir}/samba-4.0/util/idtree_random.h
 %{_includedir}/samba-4.0/util/signal.h
 %{_includedir}/samba-4.0/util/substitute.h
+%{_includedir}/samba-4.0/util/talloc_keep_secret.h
 %{_includedir}/samba-4.0/util/tevent_ntstatus.h
 %{_includedir}/samba-4.0/util/tevent_unix.h
 %{_includedir}/samba-4.0/util/tevent_werror.h
@ -2500,6 +2609,28 @@ fi
 %{_libdir}/samba/libRPC-SERVER-LOOP-private-samba.so
 %{_libdir}/samba/libRPC-WORKER-private-samba.so

+#
+# Server-side libraries (not used by libsmbclient)
+#
+%{_libdir}/samba/libauth-private-samba.so
+%{_libdir}/samba/libctdb-event-client-private-samba.so
+%{_libdir}/samba/libgpext-private-samba.so
+%{_libdir}/samba/libgpo-private-samba.so
+%{_libdir}/samba/libMESSAGING-private-samba.so
+%{_libdir}/samba/libnet-keytab-private-samba.so
+%{_libdir}/samba/libposix-eadb-private-samba.so
+%{_libdir}/samba/libprinter-driver-private-samba.so
+%{_libdir}/samba/libprinting-migrate-private-samba.so
+%{_libdir}/samba/libsmbd-base-private-samba.so
+%{_libdir}/samba/libsmbldaphelper-private-samba.so
+%{_libdir}/samba/libtorture-private-samba.so
+%{_libdir}/samba/libutil-crypt-private-samba.so
+
+#
+# Password database modules (server-side, links to libsmbldaphelper)
+#
+%{_libdir}/samba/pdb/ldapsam.so
+
 ### LIBNETAPI
 %files -n libnetapi
 %{_libdir}/libnetapi.so.%{libnetapi_so_version}*
@ -2589,6 +2720,7 @@ fi
 %{python3_sitearch}/samba/__init__.py
 %dir %{python3_sitearch}/samba/__pycache__
 %{python3_sitearch}/samba/__pycache__/__init__.*.pyc
+%{python3_sitearch}/samba/__pycache__/asn1.*.pyc
 %{python3_sitearch}/samba/__pycache__/auth_util.*.pyc
 %{python3_sitearch}/samba/__pycache__/colour.*.pyc
 %{python3_sitearch}/samba/__pycache__/common.*.pyc
@ -2597,12 +2729,14 @@ fi
 %{python3_sitearch}/samba/__pycache__/dnsresolver.*.pyc
 %{python3_sitearch}/samba/__pycache__/drs_utils.*.pyc
 %{python3_sitearch}/samba/__pycache__/functional_level.*.pyc
+%{python3_sitearch}/samba/__pycache__/generate_csr.*.pyc
 %{python3_sitearch}/samba/__pycache__/getopt.*.pyc
 %{python3_sitearch}/samba/__pycache__/gkdi.*.pyc
 %{python3_sitearch}/samba/__pycache__/graph.*.pyc
 %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc
 %{python3_sitearch}/samba/__pycache__/idmap.*.pyc
 %{python3_sitearch}/samba/__pycache__/join.*.pyc
+%{python3_sitearch}/samba/__pycache__/key_credential_link.*.pyc
 %{python3_sitearch}/samba/__pycache__/lsa_utils.*.pyc
 %{python3_sitearch}/samba/__pycache__/logger.*.pyc
 %{python3_sitearch}/samba/__pycache__/mdb_util.*.pyc
@ -2622,6 +2756,7 @@ fi
 %{python3_sitearch}/samba/__pycache__/xattr.*.pyc
 %{python3_sitearch}/samba/_glue.*.so
 %{python3_sitearch}/samba/_ldb.*.so
+%{python3_sitearch}/samba/asn1.py
 %{python3_sitearch}/samba/auth.*.so
 %{python3_sitearch}/samba/auth_util.py
 %{python3_sitearch}/samba/dbchecker.py
@ -2762,6 +2897,7 @@ fi
 %{python3_sitearch}/samba/emulate/__init__.py
 %{python3_sitearch}/samba/emulate/traffic.py
 %{python3_sitearch}/samba/emulate/traffic_packets.py
+%{python3_sitearch}/samba/generate_csr.py
 %dir %{python3_sitearch}/samba/gp
 %dir %{python3_sitearch}/samba/gp/__pycache__
 %{python3_sitearch}/samba/gp/__init__.py
@ -2832,6 +2968,7 @@ fi
 %{python3_sitearch}/samba/gp_parse/gp_ini.py
 %{python3_sitearch}/samba/gp_parse/gp_pol.py
 %{python3_sitearch}/samba/hresult.*.so
+%{python3_sitearch}/samba/key_credential_link.py
 %{python3_sitearch}/samba/logger.py
 %{python3_sitearch}/samba/mdb_util.py
 %{python3_sitearch}/samba/ms_display_specifiers.py
@ -2843,6 +2980,8 @@ fi
 %{python3_sitearch}/samba/netcmd/__pycache__/__init__.*.pyc
 %{python3_sitearch}/samba/netcmd/__pycache__/common.*.pyc
 %{python3_sitearch}/samba/netcmd/__pycache__/computer.*.pyc
+%{python3_sitearch}/samba/netcmd/__pycache__/computer_generate_csr.*.pyc
+%{python3_sitearch}/samba/netcmd/__pycache__/computer_keytrust.*.pyc
 %{python3_sitearch}/samba/netcmd/__pycache__/contact.*.pyc
 %{python3_sitearch}/samba/netcmd/__pycache__/dbcheck.*.pyc
 %{python3_sitearch}/samba/netcmd/__pycache__/delegation.*.pyc
@ -2872,6 +3011,8 @@ fi
 %{python3_sitearch}/samba/netcmd/__pycache__/visualize.*.pyc
 %{python3_sitearch}/samba/netcmd/common.py
 %{python3_sitearch}/samba/netcmd/computer.py
+%{python3_sitearch}/samba/netcmd/computer_generate_csr.py
+%{python3_sitearch}/samba/netcmd/computer_keytrust.py
 %{python3_sitearch}/samba/netcmd/contact.py
 %{python3_sitearch}/samba/netcmd/dbcheck.py
 %{python3_sitearch}/samba/netcmd/delegation.py
@ -3001,7 +3142,9 @@ fi
 %{python3_sitearch}/samba/netcmd/user/disable.py
 %{python3_sitearch}/samba/netcmd/user/edit.py
 %{python3_sitearch}/samba/netcmd/user/enable.py
+%{python3_sitearch}/samba/netcmd/user/generate_csr.py
 %{python3_sitearch}/samba/netcmd/user/getgroups.py
+%{python3_sitearch}/samba/netcmd/user/keytrust.py
 %{python3_sitearch}/samba/netcmd/user/list.py
 %{python3_sitearch}/samba/netcmd/user/move.py
 %{python3_sitearch}/samba/netcmd/user/password.py
@ -3013,7 +3156,9 @@ fi
 %{python3_sitearch}/samba/netcmd/user/__pycache__/disable.*.pyc
 %{python3_sitearch}/samba/netcmd/user/__pycache__/edit.*.pyc
 %{python3_sitearch}/samba/netcmd/user/__pycache__/enable.*.pyc
+%{python3_sitearch}/samba/netcmd/user/__pycache__/generate_csr.*.pyc
 %{python3_sitearch}/samba/netcmd/user/__pycache__/getgroups.*.pyc
+%{python3_sitearch}/samba/netcmd/user/__pycache__/keytrust.*.pyc
 %{python3_sitearch}/samba/netcmd/user/__pycache__/list.*.pyc
 %{python3_sitearch}/samba/netcmd/user/__pycache__/move.*.pyc
 %{python3_sitearch}/samba/netcmd/user/__pycache__/password.*.pyc
@ -3200,6 +3345,7 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/dsdb_dn.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb_quiet_env_tests.*.pyc
@ -3222,6 +3368,7 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/imports.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/key_credential_link.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/key_credential_link_samdb.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc
@ -3439,6 +3586,7 @@ fi
 %{python3_sitearch}/samba/tests/dns_wildcard.py
 %{python3_sitearch}/samba/tests/dsdb.py
 %{python3_sitearch}/samba/tests/dsdb_api.py
+%{python3_sitearch}/samba/tests/dsdb_dn.py
 %{python3_sitearch}/samba/tests/dsdb_dns.py
 %{python3_sitearch}/samba/tests/dsdb_lock.py
 %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py
@ -3481,6 +3629,7 @@ fi
 %{python3_sitearch}/samba/tests/kcc/kcc_utils.py
 %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py
 %{python3_sitearch}/samba/tests/key_credential_link.py
+%{python3_sitearch}/samba/tests/key_credential_link_samdb.py
 %dir %{python3_sitearch}/samba/tests/krb5
 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__
 %{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc
@ -3502,12 +3651,14 @@ fi
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgt_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/key_trust_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/netlogon.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/pkinit_certificate_mapping_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/pkinit_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/protected_users_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc
@ -3545,12 +3696,14 @@ fi
 %{python3_sitearch}/samba/tests/krb5/kdc_tests.py
 %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py
 %{python3_sitearch}/samba/tests/krb5/kdc_tgt_tests.py
+%{python3_sitearch}/samba/tests/krb5/key_trust_tests.py
 %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py
 %{python3_sitearch}/samba/tests/krb5/lockout_tests.py
 %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py
 %{python3_sitearch}/samba/tests/krb5/netlogon.py
 %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py
 %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py
+%{python3_sitearch}/samba/tests/krb5/pkinit_certificate_mapping_tests.py
 %{python3_sitearch}/samba/tests/krb5/pkinit_tests.py
 %{python3_sitearch}/samba/tests/krb5/protected_users_tests.py
 %{python3_sitearch}/samba/tests/krb5/raw_testcase.py
@ -3683,8 +3836,10 @@ fi
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_auth_policy.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_auth_silo.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_check_password_script.*.pyc
+%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_generate_csr.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_get_kerberos_ticket.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_getpassword_gmsa.*.pyc
+%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_keytrust.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_base.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_gpg.*.pyc
@ -3731,8 +3886,10 @@ fi
 %{python3_sitearch}/samba/tests/samba_tool/user_auth_policy.py
 %{python3_sitearch}/samba/tests/samba_tool/user_auth_silo.py
 %{python3_sitearch}/samba/tests/samba_tool/user_check_password_script.py
+%{python3_sitearch}/samba/tests/samba_tool/user_generate_csr.py
 %{python3_sitearch}/samba/tests/samba_tool/user_get_kerberos_ticket.py
 %{python3_sitearch}/samba/tests/samba_tool/user_getpassword_gmsa.py
+%{python3_sitearch}/samba/tests/samba_tool/user_keytrust.py
 %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA.py
 %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_base.py
 %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_gpg.py
@ -3796,8 +3953,9 @@ fi
 %files test-libs
 %if %{with dc}
 %{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so
-%endif
+%else
 %{_libdir}/samba/libdsdb-module-private-samba.so
+%endif

 ### USERSHARES
 %files usershares
@ -4063,6 +4221,33 @@ fi

 %changelog
 ## START: Generated by rpmautospec
+* Tue Jul 28 2026 Pavel Filipenský <pfilipensky@samba.org> - 0:4.24.5-1
+- Update to version 4.24.5
+- resolves: RHEL-175124
+
+* Fri May 29 2026 Pavel Filipenský <pfilipensky@samba.org> - 0:4.24.3-1
+- Update to version 4.24.3
+- resolves: RHEL-156320 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba:
+  various flaws
+- resolves: RHEL-161658 - CVE-2026-4480 Samba: Remote Code Execution in
+  printing
+- resolves: RHEL-170594 - CVE-2026-40170 samba: ngtcp2
+- resolves: RHEL-177925 - CVE-2026-4408 samba: Remote Code Execution in
+  SAMR
+- resolves: RHEL-166869 - build hardening with FORTIFY_SOURCE
+
+* Wed May 27 2026 Pavel Filipenský <pfilipensky@samba.org> - 0:4.24.2-1
+- Update to version 4.24.2
+- resolves: RHEL-175124
+
+* Tue Apr 21 2026 Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-8
+- Fix 'net ads join' AD replication race with multiple DCs
+- resolves: RHEL-169665
+
+* Tue Apr 21 2026 Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-7
+- Fix samba automount triggering for more file systems
+- resolves: RHEL-169726
+
 * Thu Feb 19 2026 Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-6
 - Fix regression with --use-kerberos=desired for smbclient
 - resolves: RHEL-150824