Merge ~ahasenack/ubuntu/+source/samba:zesty-revert-static-winbind-1677329 into ~usd-import-team/ubuntu/+source/samba:ubuntu/zesty-devel

[Andreas Hasenack]

Remove the fix for LP #1584485 as it builds a broken pam_winbind module. There is a revised version of that patch attached to #1584485 but it has not been vetted yet, so for now it's best to revert (again) so that pam_winbind can be used. (LP: #1677329, LP: #1644428)
  - d/p/fix-1584485.patch: drop
  - d/rules: remove winbind static build option

I just attached the revised patch to #1584485 and reopened the artful (devel) task with a comment, but in the "incomplete" state because of the clarifications I asked in comment #43.

[ChristianEhrhardt (paelzer)]

Still nothing happened upstream :-/
You are waiting on https://lists.samba.org/archive/samba-technical/2017-June/121139.html right?

If anything I'm a bit lost on "There is a fixed version of that patch attached" - since there is no attachement. You either mean one of the branches you linked or the upstream discussion that is linked. If you want to fix this uncertainty you might update the changelog here before a merge and upload pointing to the suggested final fix in a way clear to somebody not involved so far.

Anyway I agree with reverting it in general to make it "as usable as before" for now.

I can not upload that for you yet (core-dev only), but I can approve the change.
And you can ping Nish/Robie to do the merge and sponsoring rather soon IMHO.

One thing to be sure on that - will you follow on to this under the banner of bug 1584485 to fix it the right way eventually?

review: Approve

[Andreas Hasenack (ahasenack)]

> Still nothing happened upstream :-/
> You are waiting on https://lists.samba.org/archive/samba-
> technical/2017-June/121139.html right?

Yes, I doubt it will get traction.

> If anything I'm a bit lost on "There is a fixed version of that patch
> attached" - since there is no attachement. You either mean one of the branches

I meant attached to the bug, but in the form of an MP. This one:
https://code.launchpad.net/~ahasenack/ubuntu/+source/samba/+git/samba/+merge/323767

> you linked or the upstream discussion that is linked. If you want to fix this
> uncertainty you might update the changelog here before a merge and upload
> pointing to the suggested final fix in a way clear to somebody not involved so
> far.

Good idea, will do.

>
> Anyway I agree with reverting it in general to make it "as usable as before"
> for now.
>
> I can not upload that for you yet (core-dev only), but I can approve the
> change.
> And you can ping Nish/Robie to do the merge and sponsoring rather soon IMHO.
>
> One thing to be sure on that - will you follow on to this under the banner of
> bug 1584485 to fix it the right way eventually?

I will have to reopen it. Do you agree with that approach? It might be best even to attach my reworked patch there.

[ChristianEhrhardt (paelzer)]

On Thu, Jul 13, 2017 at 3:29 PM, Andreas Hasenack <email address hidden>
wrote:

> > One thing to be sure on that - will you follow on to this under the
> banner of
> > bug 1584485 to fix it the right way eventually?
>
> I will have to reopen it. Do you agree with that approach? It might be
> best even to attach my reworked patch there.

Yes exactly that - reopen, explain, attach (there)

--
Christian Ehrhardt
Software Engineer, Ubuntu Server
Canonical Ltd

[Andreas Hasenack (ahasenack)]

I had to push again because in the meantime zesty got a new update, so my changelog entry conflicted.

24e5c1b... by Steve Beattie on 2017-07-13

Update ubuntu/zesty-devel from 2:4.5.8+dfsg-0ubuntu0.17.04.3 to 2:4.5.8+dfsg-0ubuntu0.17.04.4

Prior ubuntu/zesty-devel commit: 6cb1945b8af46a47aab9a39f2f4a1803c2ef6e3e
New ubuntu/zesty-devel commit: 569f5199d8c4e49cf890bef61406b64f685579f4

[Andreas Hasenack (ahasenack)]

Another rebase due to an upload by the security team, this time we are at 0.17.04.5.

[Nish Aravamudan (nacc)]

FYI, 0.17.04.5 was uploaded to zesty-p, I'm running the importer now to catchup and if it applies cleanly, I'll rebase your branch and fix up the changelog.

[Nish Aravamudan (nacc)]

Ah actually, I see this was already sponsored.

[Nish Aravamudan (nacc)]

Taking this off the active review queue.

Robie, can you decide (if you remember) what to do with sponsored but not tagged uploads? Do we want to affect future re-imports?

Unmerged commits

9045a6f... by Andreas Hasenack on 2017-06-21

changelog

4a1f1ce... by Andreas Hasenack on 2017-06-21

  * Remove the fix for LP #1584485 as it builds a broken pam_winbind
    module. There is a revised version of that patch attached to
    #1584485 but it has not been vetted yet, so for now it's best
    to revert (again) so that pam_winbind can be used.
    (LP: #1677329, LP: #1644428)
    - d/p/fix-1584485.patch: drop
    - d/rules: remove winbind static build option

24e5c1b... by Steve Beattie on 2017-07-13

Update ubuntu/zesty-devel from 2:4.5.8+dfsg-0ubuntu0.17.04.3 to 2:4.5.8+dfsg-0ubuntu0.17.04.4

Prior ubuntu/zesty-devel commit: 6cb1945b8af46a47aab9a39f2f4a1803c2ef6e3e
New ubuntu/zesty-devel commit: 569f5199d8c4e49cf890bef61406b64f685579f4

6cb1945... by Andreas Hasenack on 2017-06-30

Update ubuntu/zesty-devel from 2:4.5.8+dfsg-0ubuntu0.17.04.2 to 2:4.5.8+dfsg-0ubuntu0.17.04.3

Prior ubuntu/zesty-devel commit: 0bcfc0416dc36172551e8cb126192141525b548c
New ubuntu/zesty-devel commit: 58da745264ace59c4b6d554c8ac9c53db1448578

0bcfc04... by Marc Deslauriers on 2017-05-19

Update ubuntu/zesty-devel from 2:4.5.8+dfsg-0ubuntu0.17.04.1 to 2:4.5.8+dfsg-0ubuntu0.17.04.2

Prior ubuntu/zesty-devel commit: 42c867a6850d96b55b8d00b369a06c7821239b61
New ubuntu/zesty-devel commit: 88ffe933ac78bef22c5e227540c7e2cebe1f73ac

42c867a... by Marc Deslauriers on 2017-04-21

Update lpusip/ubuntu/zesty-devel from 2:4.5.4+dfsg-1ubuntu2 to 2:4.5.8+dfsg-0ubuntu0.17.04.1

Prior lpusip/ubuntu/zesty-devel commit: dda1d84e2f349bce00b61788a724f49157d33891
New lpusip/ubuntu/zesty-devel commit: 84a9aa9cdfcd48fee8b98f22ca1ee19ab98e8bb7

dda1d84... by Nish Aravamudan on 2017-03-06

Updating lpusip/ubuntu/zesty-devel from 9e52d3838f678402bab6ddf5e369a9034b824891 to da4dae051e104cf622a4e088174c2660016749c5

diff --git a/debian/changelog b/debian/changelog
index db3269c..2b164da 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+samba (2:4.5.8+dfsg-0ubuntu0.17.04.5) zesty; urgency=medium
+
+  * Remove the fix for LP #1584485 as it builds a broken pam_winbind
+    module. There is a revised version of that patch attached to
+    #1584485 but it has not been vetted yet, so for now it's best
+    to revert (again) so that pam_winbind can be used.
+    (LP: #1677329, LP: #1644428)
+    - d/p/fix-1584485.patch: drop
+    - d/rules: remove winbind static build option
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 13 Jul 2017 14:44:16 -0300
+
 samba (2:4.5.8+dfsg-0ubuntu0.17.04.4) zesty-security; urgency=medium
 
   * SECURITY UPDATE: KDC-REP service name impersonation
diff --git a/debian/patches/fix-1584485.patch b/debian/patches/fix-1584485.patch
deleted file mode 100644
index 37fa744..0000000
--- a/debian/patches/fix-1584485.patch
+++ /dev/null
@@ -1,94 +0,0 @@
---- samba-4.4.5+dfsg.orig/buildtools/wafsamba/wafsamba.py
-+++ samba-4.4.5+dfsg/buildtools/wafsamba/wafsamba.py
-@@ -140,7 +140,8 @@ def SAMBA_LIBRARY(bld, libname, source,
-                   grouping_library=False,
-                   allow_undefined_symbols=False,
-                   allow_warnings=False,
--                  enabled=True):
-+                  enabled=True,
-+                  static=False):
-     '''define a Samba library'''
- 
-     if pyembed and bld.env['IS_EXTRA_PYTHON']:
-@@ -253,7 +254,12 @@ def SAMBA_LIBRARY(bld, libname, source,
-     if bld.env['ENABLE_RELRO'] is True:
-         ldflags.extend(TO_LIST('-Wl,-z,relro,-z,now'))
- 
--    features = 'c cshlib symlink_lib install_lib'
-+    features = 'c symlink_lib install_lib'
-+    if static:
-+        features += ' cstaticlib'
-+    else:
-+        features += ' cshlib'
-+
-     if pyext:
-         features += ' pyext'
-     if pyembed:
---- samba-4.4.5+dfsg.orig/nsswitch/wscript_build
-+++ samba-4.4.5+dfsg/nsswitch/wscript_build
-@@ -10,6 +10,13 @@ bld.SAMBA_LIBRARY('winbind-client',
- 	private_library=True
- 	)
- 
-+bld.SAMBA_LIBRARY('winbind-client-static',
-+	source='wb_common.c',
-+	deps='replace',
-+	cflags='-DWINBINDD_SOCKET_DIR=\"%s\"' % bld.env.WINBINDD_SOCKET_DIR,
-+	private_library=True, static=True, install=False
-+	)
-+
- 
- bld.SAMBA_BINARY('nsstest',
- 		 source='nsstest.c',
-@@ -33,11 +40,12 @@ if (Utils.unversioned_sys_platform() ==
-     bld.SAMBA_LIBRARY('nss_winbind',
-               keep_underscore=True,
-               source='winbind_nss_linux.c',
--              deps='winbind-client',
-+              deps='winbind-client-static',
-               public_headers=[],
-               public_headers_install=False,
-               pc_files=[],
--              vnum='2')
-+              vnum='2',
-+	       allow_undefined_symbols=True)
- 
-     bld.SAMBA3_LIBRARY('nss_wins',
-                        keep_underscore=True,
-@@ -87,21 +95,32 @@ elif Utils.unversioned_sys_platform() ==
- elif (host_os.rfind('hpux') > -1):
- 	bld.SAMBA_LIBRARY('nss_winbind',
- 			  source='winbind_nss_linux.c',
--			  deps='winbind-client', 
-+			  deps='winbind-client',
- 			  realname='libnss_winbind.so')
- elif (host_os.rfind('aix') > -1):
- 	bld.SAMBA_LIBRARY('nss_winbind',
- 			  source='winbind_nss_aix.c',
--			  deps='winbind-client', 
-+			  deps='winbind-client',
- 			  realname='WINBIND')
- 
- if bld.CONFIG_SET('WITH_PAM_MODULES') and bld.CONFIG_SET('HAVE_PAM_START'):
-+	bld.SAMBA_LIBRARY('pamwinbind-static',
-+		source='pam_winbind.c',
-+		deps='talloc wbclient winbind-client-static tiniparser pam samba_intl',
-+		cflags='-DLOCALEDIR=\"%s/locale\"' % bld.env.DATADIR,
-+		realname='pam_winbind.so',
-+		install_path='${PAMMODULESDIR}',
-+	        static=True,
-+               install=False
-+		)
-+
- 	bld.SAMBA_LIBRARY('pamwinbind',
- 		source='pam_winbind.c',
--		deps='talloc wbclient winbind-client tiniparser pam samba_intl',
-+		deps='pamwinbind-static',
- 		cflags='-DLOCALEDIR=\"%s/locale\"' % bld.env.DATADIR,
- 		realname='pam_winbind.so',
--		install_path='${PAMMODULESDIR}'
-+		install_path='${PAMMODULESDIR}',
-+		allow_undefined_symbols=True
- 		)
- 
- if bld.CONFIG_SET('HAVE_KRB5_LOCATE_PLUGIN_H'):
diff --git a/debian/patches/series b/debian/patches/series
index 4eaa932..ff38521 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -17,7 +17,6 @@ fix_kill_path_in_units.patch
 nmbd-requires-a-working-network.patch
 krb_zero_cursor.patch
 winbind_trusted_domains.patch
-fix-1584485.patch
 CVE-2017-7494.patch
 non-wide-symlinks-to-directories-12860.patch
 CVE-2017-11103.patch
diff --git a/debian/rules b/debian/rules
index 807e5ae..c8557fd 100755
--- a/debian/rules
+++ b/debian/rules
@@ -66,7 +66,6 @@ conf_args = \
 		--disable-avahi \
 		--disable-rpath \
 		--disable-rpath-install \
-		--nonshared-binary=winbindd/winbindd \
 		--bundled-libraries=NONE,pytevent,iniparser,roken,wind,hx509,asn1,heimbase,hcrypto,krb5,gssapi,heimntlm,hdb,kdc,com_err,compile_et,asn1_compile \
 		--builtin-libraries=replace,ccan,samba-cluster-support \
 		--minimum-library-version="$(shell ./debian/autodeps.py --minimum-library-version)" \