Merge ~ahasenack/ubuntu/+source/samba:groovy-samba-4.12.2-update into ubuntu/+source/samba:ubuntu/devel

[Andreas Hasenack]

This is the samba 4.12.2 merge.

We are going ahead of debian on this, as debian is still on 4.11.x (and also behind our 4.11.x package).

Bileto ticket for the whole stack: https://bileto.ubuntu.com/#/ticket/4051

Reds are i386 (hinted in britney already), and the usual flaky gvfs runs.

4.12.0 release notes: https://www.samba.org/samba/history/samba-4.12.0.html

Noteworthy changes and consideration:
- samba is dropping internal crypto code. That resulted in a bunch of symbols disappearing
- libaesni is no longer built when samba detects a recent enough gnutls library being used, which is the case for groovy. I did keep the d/rules --accel-aes=intelaesni switch, though, just in case that build-time check is changed, in which case I expect a noticeable build failure. I can be convinced to drop this, and will likely follow debian when they grab samba 4.12.
- I'm unsure what to do with the spotlight/time-machine feature, mainly because I cannot test it. There are two options now: tracker backend (a gnome thing), and elastic search backend (new in 4.12.x). Debian had the tracker backend enabled[1], but reverted it due to dependency creep. We also have a bug[2] requesting the feature. The elastic search backend is supposed to have less dependencies.
- 4.12.x can use the new kernel uring feature via a new vfs module. In ubuntu, liburing is in universe, so I can't enable it because samba-vfs-modules is in main, unless I create a package specifically for it. I filed a preemptive MIR[3] for now and am gathering information about it. There is currently an open bug[4] about data corruption so I wouldn't want to enable it anyway before there is a committed patch from upstream.

1. https://bugs.debian.org/941654
2. https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1872454
3. https://bugs.launchpad.net/ubuntu/+source/liburing/+bug/1878006
4. https://bugzilla.samba.org/show_bug.cgi?id=14361

[Andreas Hasenack (ahasenack)]

sssd 2.2.3 is building, and the basics are working, but it doesn't fully work with active directory when using samba 4.12. sssd upstream will make a new release when these land:

https://github.com/SSSD/sssd/pull/999
https://github.com/SSSD/sssd/pull/844
https://github.com/SSSD/sssd/pull/1005

Additionally master already has two commits for samba 4.12:
commit c031adde4f532f39845a0efd78693600f1f8b2f4
Author: Noel Power <email address hidden>
Date: Tue Mar 24 18:14:34 2020 +0000

    ad_gpo_ndr.c: refresh ndr_ methods from samba-4.12

    Signed-off-by: Noel Power <email address hidden>

    Reviewed-by: Pavel Březina <email address hidden>

commit 1fdd8fa2fded1985fbfc6aa67394eebcdbb6a2fc
Author: Noel Power <email address hidden>
Date: Tue Mar 24 13:37:07 2020 +0000

    Use ndr_pull_steal_switch_value for modern samba versions

    commit bc56b10aea999284458dcc293b54cf65288e325d attempted to
    fix the build error resulting from removal of 'ndr_pull_get_switch'

    This change uses the new replacement method
    'ndr_pull_steal_switch_value' however depending on the samba version
    the ndr_pull_steal_switch_value abi is different.

    Note: ndr_pull_steal_switch_value is used since samba 4.10 for
          the affected methods

    Note: the following methods have been refreshed from samba-4.12 generated
          code;

        o ndr_pull_security_ace_object_type
        o ndr_pull_security_ace_object_inherited_type
        o ndr_pull_security_ace_object_ctr

    Signed-off-by: Noel Power <email address hidden>

    Reviewed-by: Pavel Březina <email address hidden>

I could pull these in, but since more are coming, and the builds and dep8 tests we have are find, I would rather leave that for sssd 2.2.4.

[Christian Ehrhardt  (paelzer)]

Changelog:
- [√] changelog entry correct version and targeted codename
- [√] changelog entries correct
- [√] update-maintainer has been run (well - in the past, since this goes forward on our side)

Actual changes:
- [√] no "further" major upstream changes to consider
      glad they dropped their "own" aesni, reimplementing that just is a source of issues.
      I'm also glad we have 4.12.2 stable already when moving to the new major, that should help
      to be working better.
- [√] no further upstream version to consider
      I was reviewing https://wiki.samba.org/index.php/Samba_4.12_Features_added/changed if
      there is anything else we might need to do, but as always you had all things under control
      already - a few minor things below.
- [n/a] debian changes look safe

New Delta:
- [√] new patches are good or match what was proposed upstream
- [√] new patches correctly included in debian/patches/series?
- [√] new patches have correct DEP3 metadata

Build/Test:
- [√] build is ok
- [√] autopkgtest against the PPA package passes

This is no merge of the latest Debian but the latest upstream. So our usual changelog-templates don't 100% apply, never the less I'd have expected the three dropped patches under a "* Dropped" section to spot them more easily. This is an unimportant style thing, so it is up to you if you want to change it.

Again I was wondering about some build issues related to pidl:
source4/librpc/idl/irpc.idl:28: warning: subcontext() is deprecated. Use represent_as() or transmit_as() instead
source4/librpc/idl/irpc.idl:70: warning: [out] argument `info' not a pointer
source4/librpc/idl/irpc.idl:83: warning: top-level [out] pointer `dcname' is not a [ref] pointer
source4/librpc/idl/irpc.idl:91: warning: [out] argument `num_addrs' not a pointer
source4/librpc/idl/irpc.idl:113: warning: [out] argument `generic_reply' not a pointer
source4/librpc/idl/irpc.idl:159: warning: [out] argument `info' not a pointer
source4/librpc/idl/irpc.idl:70: error: nbtd_information: [out] argument 'info' is not a pointer or array, skip client functions
source4/librpc/idl/irpc.idl:83: error: nbtd_getdcname: [out] argument 'dcname' is a pointer to type 'string', skip client functions
source4/librpc/idl/irpc.idl:91: error: nbtd_proxy_wins_challenge: [out] argument 'num_addrs' is not a pointer or array, skip client functions
source4/librpc/idl/irpc.idl:113: error: kdc_check_generic_kerberos: [out] argument 'generic_reply' is not a pointer or array, skip client functions
source4/librpc/idl/irpc.idl:159: error: smbsrv_information: [out] argument 'info' is not a pointer or array, skip client functions

But these were present in the former builds as well.
@Andreas do you think that is an issues that should be analyzed or is this known and ok?

4.12 says "GnuTLS 3.4.7 required" and in fact later bumps that to 3.6.5 for some extras.
Build dep libgnutls28-dev is unversioned at the moment for the potential that people might backport it to bionic (3.5.18) adding a >=3.6.5 might be useful - what do you think?

Note: the SMB3 speed improvements out of using tls might be worth a release not entry for gorilla what do you think?

I know you think about ...

review: Approve

[Andreas Hasenack (ahasenack)]

> This is no merge of the latest Debian but the latest upstream.
> So our usual changelog-templates don't 100% apply, never the less
> I'd have expected the three dropped patches under a "* Dropped"
> section to spot them more easily. This is an unimportant style
> thing, so it is up to you if you want to change it.

Done

> 4.12 says "GnuTLS 3.4.7 required" and in fact later bumps that to 3.6.5
> for some extras.
> Build dep libgnutls28-dev is unversioned at the moment for the potential
> that people might backport it to bionic (3.5.18) adding a >=3.6.5 might
> be useful - what do you think?

Agreed and done

> Note: the SMB3 speed improvements out of using tls might be worth a
> release not entry for gorilla what do you think?

Yes if confirmed :) How would I make sure to not forget, this early in the cycle? Maybe a release notes bug task, and a card in our merges board collecting all such tasks? I'll do it

> Do you want to check samba conf on upgrade an warn for removed options
> like "write cache size" ?

The samba packaging never did such a thing, at most testparm(1) is run and it will warn and/or fail.

> Again I was wondering about some build issues related to pidl:

I'll see what I can find about these.

[Andreas Hasenack (ahasenack)]

I found many reports of these pidl warnings in the samba bugzilla. Most are old, and some closed as "wontfix". Here is one example that as a response from upstream saying these issues are known and will be fixed eventually:

https://bugzilla.samba.org/show_bug.cgi?id=12634
"""
We get these warnings on every platform on every build, so we know about them and have already given them the correct attention. Most are long-term 'could be better' rather than 'must fix soon'.
"""

[Christian Ehrhardt  (paelzer)]

Thanks for addressing all my concerns then.
All that is left is +1 and good luck with proposed migration.

[Andreas Hasenack (ahasenack)]

Forgot to mention, but I submitted a pristine-tar branch to salsa for the 4.12.2+dfsg tarball: https://salsa.debian.org/samba-team/samba/-/merge_requests/47

[Andreas Hasenack (ahasenack)]

All updated build-deps built in groovy proposed, time to upload this one:

Tagging and uploading 3365590314bb07f349bb13268085b86371203b86

$ git push pkg upload/2%4.12.2+dfsg-0ubuntu1
Enumerating objects: 3501, done.
Counting objects: 100% (3501/3501), done.
Delta compression using up to 4 threads
Compressing objects: 100% (1392/1392), done.
Writing objects: 100% (1940/1940), 858.48 KiB | 205.00 KiB/s, done.
Total 1940 (delta 1556), reused 753 (delta 518)
remote: Resolving deltas: 100% (1556/1556), completed with 1423 local objects.
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/samba
 * [new tag] upload/2%4.12.2+dfsg-0ubuntu1 -> upload/2%4.12.2+dfsg-0ubuntu1

$ dput ubuntu ../samba_4.12.2+dfsg-0ubuntu1_source.changes
Checking signature on .changes
gpg: ../samba_4.12.2+dfsg-0ubuntu1_source.changes: Valid signature from AC983EB5BF6BCBA9
Checking signature on .dsc
gpg: ../samba_4.12.2+dfsg-0ubuntu1.dsc: Valid signature from AC983EB5BF6BCBA9
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading samba_4.12.2+dfsg-0ubuntu1.dsc: done.
  Uploading samba_4.12.2+dfsg.orig.tar.xz: done.
  Uploading samba_4.12.2+dfsg-0ubuntu1.debian.tar.xz: done.
  Uploading samba_4.12.2+dfsg-0ubuntu1_source.buildinfo: done.
  Uploading samba_4.12.2+dfsg-0ubuntu1_source.changes: done.
Successfully uploaded packages.

[Andreas Hasenack (ahasenack)]

hm, turns out the sssd I had in the ppas was rebuilt with the old samba 4.11, and not 4.12. I must have raced the uploa with the samba 4.12 build actually being published :/

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 67a86d2..56adf10 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -22,7 +22,7 @@ variables:
   # Set this to the contents of bootstrap/sha1sum.txt
   # which is generated by bootstrap/template.py --render
   #
-  SAMBA_CI_CONTAINER_TAG: 970e3a86b8a9dc10a0a3ec716ab355eb9664dc38
+  SAMBA_CI_CONTAINER_TAG: 41319f2580c026f66b2750604a0eb15d6b6f7b50
   #
   # We use the ubuntu1804 image as default as
   # it matches what we have on sn-devel-184.
@@ -36,11 +36,14 @@ variables:
   SAMBA_CI_CONTAINER_IMAGE_ubuntu1804: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-ubuntu1804:${SAMBA_CI_CONTAINER_TAG}
   SAMBA_CI_CONTAINER_IMAGE_ubuntu1604: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-ubuntu1604:${SAMBA_CI_CONTAINER_TAG}
   SAMBA_CI_CONTAINER_IMAGE_debian9: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-debian9:${SAMBA_CI_CONTAINER_TAG}
+  SAMBA_CI_CONTAINER_IMAGE_debian10: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-debian10:${SAMBA_CI_CONTAINER_TAG}
   SAMBA_CI_CONTAINER_IMAGE_opensuse150: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-opensuse150:${SAMBA_CI_CONTAINER_TAG}
   SAMBA_CI_CONTAINER_IMAGE_opensuse151: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-opensuse151:${SAMBA_CI_CONTAINER_TAG}
   SAMBA_CI_CONTAINER_IMAGE_fedora29: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-fedora29:${SAMBA_CI_CONTAINER_TAG}
   SAMBA_CI_CONTAINER_IMAGE_fedora30: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-fedora30:${SAMBA_CI_CONTAINER_TAG}
+  SAMBA_CI_CONTAINER_IMAGE_fedora31: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-fedora31:${SAMBA_CI_CONTAINER_TAG}
   SAMBA_CI_CONTAINER_IMAGE_centos7: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-centos7:${SAMBA_CI_CONTAINER_TAG}
+  SAMBA_CI_CONTAINER_IMAGE_centos8: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-centos8:${SAMBA_CI_CONTAINER_TAG}
 
 include:
   # The image creation details are specified in a separate file
@@ -96,6 +99,10 @@ include:
     - echo "Running cmd script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --testbase /tmp/samba-testbase"
     - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE  --verbose --nocleanup --keeplogs --tail --testbase /tmp/samba-testbase
 
+# Ensure when adding a new job below that you also add it to
+# the dependencies for 'pages' below for the code coverage page
+# generation.
+
 others:
   extends: .shared_template
   script:
@@ -109,6 +116,9 @@ others:
 samba:
   extends: .shared_template
 
+samba-mitkrb5:
+  extends: .shared_template
+
 samba-none-env:
   extends: .shared_template
 
@@ -118,13 +128,10 @@ samba-nopython:
 samba-nopython-py2:
   extends: .shared_template
 
-samba-systemkrb5:
-  extends: .shared_template
-
 samba-xc:
   extends: .shared_template
 
-samba-ad-member:
+samba-admem:
   extends: .shared_template
 
 samba-ad-dc-2:
@@ -148,6 +155,9 @@ samba-libs:
 samba-static:
   extends: .shared_template
 
+samba-fuzz:
+  extends: .shared_template
+
 ctdb:
   extends: .shared_template
 
@@ -157,6 +167,12 @@ samba-ctdb:
 samba-ad-dc-ntvfs:
   extends: .shared_template
 
+samba-admem-mit:
+  extends: .shared_template
+
+samba-ad-dc-4-mitkrb5:
+  extends: .shared_template
+
 .private_template:
   extends: .shared_template
   tags:
@@ -173,6 +189,9 @@ samba-ad-dc-ntvfs:
 samba-ad-dc-backup:
   extends: .private_template
 
+samba-simpleserver:
+  extends: .private_template
+
 samba-fileserver:
   extends: .private_template
 
@@ -188,6 +207,9 @@ samba-nt4:
 samba-schemaupgrade:
   extends: .private_template
 
+samba-ad-dc-1-mitkrb5:
+  extends: .private_template
+
 # 'pages' is a special job which can publish artifacts in `public` dir to gitlab pages
 pages:
   image: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-${SAMBA_CI_CONTAINER_IMAGE}:${SAMBA_CI_CONTAINER_TAG}
@@ -196,29 +218,35 @@ pages:
     - docker
     - shared
   dependencies:  # tell gitlab to download artifacts for these jobs
+    - others
     - samba
-    - samba-ad-dc-1
+    - samba-mitkrb5
+    - samba-none-env
+    - samba-nopython
+    - samba-nopython-py2
+    - samba-xc
+    - samba-admem
     - samba-ad-dc-2
     - samba-ad-dc-3
     - samba-ad-dc-4
     - samba-ad-dc-5
     - samba-ad-dc-6
-    - samba-ad-dc-backup
-    - samba-ad-dc-ntvfs
-    - samba-ad-member
+    - samba-libs
+    - samba-static
+    - samba-fuzz
+    # - ctdb  # TODO
     - samba-ctdb
+    - samba-ad-dc-ntvfs
+    - samba-admem-mit
+    - samba-ad-dc-4-mitkrb5
+    - samba-ad-dc-backup
+    - samba-simpleserver
     - samba-fileserver
-    - samba-libs
-    - samba-none-env
-    - samba-nopython
-    - samba-nopython-py2
+    - samba-ktest-heimdal
+    - samba-ad-dc-1
     - samba-nt4
     - samba-schemaupgrade
-    - samba-static
-    - samba-systemkrb5
-    - samba-xc
-    # - ctdb  # TODO
-    - others
+    - samba-ad-dc-1-mitkrb5
   script:
     - ./configure.developer
     - make -j
@@ -257,6 +285,10 @@ debian9-samba-o3:
   extends: .samba-o3-template
   image: $SAMBA_CI_CONTAINER_IMAGE_debian9
 
+debian10-samba-o3:
+  extends: .samba-o3-template
+  image: $SAMBA_CI_CONTAINER_IMAGE_debian10
+
 opensuse150-samba-o3:
   extends: .samba-o3-template
   image: $SAMBA_CI_CONTAINER_IMAGE_opensuse150
@@ -271,6 +303,12 @@ centos7-samba-o3:
   variables:
     # Git on CentOS doesn't support shallow git cloning
     GIT_DEPTH: ""
+    # We need a newer GnuTLS version on CentOS7
+    PKG_CONFIG_PATH: "/usr/lib64/compat-gnutls34/pkgconfig:/usr/lib64/compat-nettle32/pkgconfig"
+
+centos8-samba-o3:
+  extends: .samba-o3-template
+  image: $SAMBA_CI_CONTAINER_IMAGE_centos8
 
 fedora29-samba-o3:
   extends: .samba-o3-template
@@ -280,6 +318,10 @@ fedora30-samba-o3:
   extends: .samba-o3-template
   image: $SAMBA_CI_CONTAINER_IMAGE_fedora30
 
+fedora31-samba-o3:
+  extends: .samba-o3-template
+  image: $SAMBA_CI_CONTAINER_IMAGE_fedora31
+
 #
 # Keep the samba-o3 sections at the end ...
 #
diff --git a/Makefile b/Makefile
index 07b928e..0b7b0ae 100644
--- a/Makefile
+++ b/Makefile
@@ -100,7 +100,7 @@ pydoctor:
 pep8:
 	$(WAF) pep8
 
-# Adding force on the depencies will force the target to be always rebuild form the Make
+# Adding force on the dependencies will force the target to be always rebuild form the Make
 # point of view forcing make to invoke waf
 
 bin/smbd: FORCE
diff --git a/SECURITY.md b/SECURITY.md
 new file mode 100644
index 0000000..5d3c88c
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,15 @@
+# Security Policy
+
+## Supported Versions
+
+See https://wiki.samba.org/index.php/Samba_Release_Planning for a
+matrix showing the currently supported versions of Samba.
+
+## Reporting a Vulnerability
+
+Please report all security issues or defects to [e-mail] and **never** on IRC, public mailing lists or in Bugzilla!
+
+Once reported and if warrented by the specific issue, the Samba Team
+will follow the process outlined in
+https://wiki.samba.org/index.php/Samba_Security_Process to produce a
+security release.
diff --git a/VERSION b/VERSION
index c07b1d1..a8cdfb7 100644
--- a/VERSION
+++ b/VERSION
@@ -24,8 +24,8 @@
 #  ->  "3.0.0"                                         #
 ########################################################
 SAMBA_VERSION_MAJOR=4
-SAMBA_VERSION_MINOR=11
-SAMBA_VERSION_RELEASE=6
+SAMBA_VERSION_MINOR=12
+SAMBA_VERSION_RELEASE=2
 
 ########################################################
 # If a official release has a serious bug              #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 6f63561..57498cd 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,265 +1,39 @@
                    ==============================
-                   Release Notes for Samba 4.11.6
-                          January 28, 2020
-		   ==============================
-
-
-This is the latest stable release of the Samba 4.11 release series.
-
-
-Changes since 4.11.5:
----------------------
-
-o  Douglas Bagnall <[e-mail]>
-   * BUG 14209: pygpo: Use correct method flags.
-
-o  David Disseldorp <[e-mail]>
-   * BUG 14216: vfs_ceph_snapshots: Fix root relative path handling.
-
-o  Torsten Fohrer <[e-mail]>
-   * BUG 14209: Avoiding bad call flags with python 3.8, using METH_NOARGS
-     instead of zero.
-
-o  Fabrice Fontaine <[e-mail]>
-   * BUG 14218: source4/utils/oLschema2ldif: Include stdint.h before cmocka.h.
-
-o  Björn Jacke <[e-mail]>
-   * BUG 14122: docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc.
-
-o  Volker Lendecke <[e-mail]>
-   * BUG 14251: smbd: Fix the build with clang.
-
-o  Gary Lockyer <[e-mail]>
-   * BUG 14199: upgradedns: Ensure lmdb lock files linked.
-
-o  Anoop C S <[e-mail]>
-   * BUG 14182: s3: VFS: glusterfs: Reset nlinks for symlink entries during
-     readdir.
-
-o  Andreas Schneider <[e-mail]>
-   * BUG 14101: smbc_stat() doesn't return the correct st_mode and also the
-     uid/gid is not filled (SMBv1) file.
-   * BUG 14219: librpc: Fix string length checking in
-     ndr_pull_charset_to_null().
-
-o  Martin Schwenke <[e-mail]>
-   * BUG 14227: ctdb-scripts: Strip square brackets when gathering connection
-     info.
-
-
-#######################################
-Reporting bugs & Development Discussion
-#######################################
-
-Please discuss this release on the samba-technical mailing list or by
-joining the #samba-technical IRC channel on irc.freenode.net.
-
-If you do report problems then please try to send high quality
-feedback. If you don't provide vital information to help us track down
-the problem then you will probably be ignored.  All bug reports should
-be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
-database (https://bugzilla.samba.org/).
-
-
-======================================================================
-== Our Code, Our Bugs, Our Responsibility.
-== The Samba Team
-======================================================================
-
-
-Release notes for older releases follow:
-----------------------------------------
-
-                   ==============================
-                   Release Notes for Samba 4.11.5
-                          January 21, 2020
-		   ==============================
-
-
-This is a security release in order to address the following defects:
-
-o CVE-2019-14902: Replication of ACLs set to inherit down a subtree on AD
-		  Directory not automatic.        
-o CVE-2019-14907: Crash after failed character conversion at log level 3 or
-		  above.                                               
-o CVE-2019-19344: Use after free during DNS zone scavenging in Samba AD DC.
-                                                                                
-                                                                                
-=======                                                                         
-Details                                                                         
-=======                                                                         
-                                                                                
-o  CVE-2019-14902:                                                                                
-   The implementation of ACL inheritance in the Samba AD DC was not complete,
-   and so absent a 'full-sync' replication, ACLs could get out of sync between
-   domain controllers. 
-
-o  CVE-2019-14907:
-   When processing untrusted string input Samba can read past the end of the
-   allocated buffer when printing a "Conversion error" message to the logs.
-
-o  CVE-2019-19344:                                                                                
-   During DNS zone scavenging (of expired dynamic entries) there is a read of
-   memory after it has been freed.
-
-For more details and workarounds, please refer to the security advisories.
-
-
-Changes since 4.11.4:
----------------------
-
-o  Andrew Bartlett <[e-mail]>
-   * BUG 12497: CVE-2019-14902: Replication of ACLs down subtree on AD Directory
-     not automatic.
-   * BUG 14208: CVE-2019-14907: lib/util: Do not print the failed to convert
-     string into the logs.
-
-o  Gary Lockyer <[e-mail]>
-   * BUG 14050: CVE-2019-19344: kcc dns scavenging: Fix use after free in
-     dns_tombstone_records_zone.
-
-
-#######################################
-Reporting bugs & Development Discussion
-#######################################
-
-Please discuss this release on the samba-technical mailing list or by
-joining the #samba-technical IRC channel on irc.freenode.net.
-
-If you do report problems then please try to send high quality
-feedback. If you don't provide vital information to help us track down
-the problem then you will probably be ignored.  All bug reports should
-be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
-database (https://bugzilla.samba.org/).
-
-
-======================================================================
-== Our Code, Our Bugs, Our Responsibility.
-== The Samba Team
-======================================================================
-
-
-----------------------------------------------------------------------
-
-
-                   ==============================
-                   Release Notes for Samba 4.11.4
-                          December 16, 2019
-		   ==============================
-
-
-This is the latest stable release of the Samba 4.11 release series.
-
-
-Changes since 4.11.3:
----------------------
-
-o  Jeremy Allison <[e-mail]>
-   * BUG 14161: s3: libsmb: Ensure SMB1 cli_qpathinfo2() doesn't return an inode
-     number.
-   * BUG 14174: s3: utils: smbtree. Ensure we don't call cli_RNetShareEnum()
-     on an SMB1 connection.
-   * BUG 14176: NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in
-     SMBC_opendir_ctx.
-   * BUG 14189: s3: smbd: SMB2 - Ensure we use the correct session_id if
-     encrypting an interim response.
-   * BUG 14205: Prevent smbd crash after invalid SMB1 negprot.
-
-o  Ralph Boehme <[e-mail]>
-   * BUG 13745: s3:printing: Fix %J substition.
-   * BUG 13925: s3: Remove now unneeded call to cmdline_messaging_context().
-   * BUG 14069: Incomplete conversion of former parametric options.
-   * BUG 14070: Fix sync dosmode fallback in async dosmode codepath.
-   * BUG 14171: vfs_fruit returns capped resource fork length.
-
-o  Isaac Boukris <[e-mail]>
-   * BUG 14116: libnet_join: Add SPNs for additional-dns-hostnames entries.
-
-o  Volker Lendecke <[e-mail]>
-   * BUG 14211: smbd: Increase a debug level.
-
-o  Stefan Metzmacher <[e-mail]>
-   * BUG 14153: Prevent azure ad connect from reporting discovery errors:
-     reference-value-not-ldap-conformant.
-
-o  Christof Schmitt <[e-mail]>
-   * BUG 14179: krb5_plugin: Fix developer build with newer heimdal system
-     library.
-
-o  Andreas Schneider <[e-mail]>
-   * BUG 14168: replace: Only link libnsl and libsocket if requrired.
-
-o  Martin Schwenke <[e-mail]>
-   * BUG 14175: ctdb: Incoming queue can be orphaned causing communication
-     breakdown.
-
-o  Uri Simchoni <[e-mail]>
-   * BUG 13846: ldb: Release ldb 2.0.8. Cross-compile will not take
-     cross-answers or cross-execute.
-   * BUG 13856: heimdal-build: Avoid hard-coded /usr/include/heimdal in
-     asn1_compile-generated code.
-
-
-#######################################
-Reporting bugs & Development Discussion
-#######################################
-
-Please discuss this release on the samba-technical mailing list or by
-joining the #samba-technical IRC channel on irc.freenode.net.
-
-If you do report problems then please try to send high quality
-feedback. If you don't provide vital information to help us track down
-the problem then you will probably be ignored.  All bug reports should
-be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
-database (https://bugzilla.samba.org/).
-
-
-======================================================================
-== Our Code, Our Bugs, Our Responsibility.
-== The Samba Team
-======================================================================
-
-
-----------------------------------------------------------------------
-
-
-                   ==============================
-                   Release Notes for Samba 4.11.3
-                          December 10, 2019
+                   Release Notes for Samba 4.12.2
+                           April 28, 2020
 		   ==============================
 
 
 This is a security release in order to address the following defects:
 
-o CVE-2019-14861: Samba AD DC zone-named record Denial of Service in DNS
-		  management server (dnsserver).
-o CVE-2019-14870: DelegationNotAllowed not being enforced in protocol transition
-		  on Samba AD DC.
+o CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ
+o CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC
 
 
 =======
 Details
 =======
 
-o  CVE-2019-14861:
-   An authenticated user can crash the DCE/RPC DNS management server by creating
-   records with matching the zone name.
+o  CVE-2020-10700:
+   A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause a
+   use-after-free in Samba's AD DC LDAP server.
+o  CVE-2020-10704:
+   A deeply nested filter in an un-authenticated LDAP search can exhaust the
+   LDAP server's stack memory causing a SIGSEGV.
 
-o  CVE-2019-14870:
-   The DelegationNotAllowed Kerberos feature restriction was not being applied
-   when processing protocol transition requests (S4U2Self), in the AD DC KDC.
+For more details, please refer to the security advisories.
 
-For more details and workarounds, please refer to the security advisories.
 
-
-Changes since 4.11.2:
----------------------
+Changes since 4.12.1
+--------------------
 
 o  Andrew Bartlett <[e-mail]>
-   * BUG 14138: CVE-2019-14861: Fix DNSServer RPC server crash.
+   * BUG 14331: CVE-2020-10700: Fix use-after-free in AD DC LDAP server when
+     ASQ and paged_results combined.
 
-o  Isaac Boukris <[e-mail]>
-   * BUG 14187: CVE-2019-14870: DelegationNotAllowed not being enforced.
+o  Gary Lockyer <[e-mail]>
+   * BUG 20454: CVE-2020-10704: Fix LDAP Denial of Service (stack overflow) in
+     Samba AD DC.
 
 
 #######################################
@@ -272,7 +46,7 @@ joining the #samba-technical IRC channel on irc.freenode.net.
 If you do report problems then please try to send high quality
 feedback. If you don't provide vital information to help us track down
 the problem then you will probably be ignored.  All bug reports should
-be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
+be filed under the Samba 4.1 and newer product in the project's Bugzilla
 database (https://bugzilla.samba.org/).
 
 
@@ -282,144 +56,59 @@ database (https://bugzilla.samba.org/).
 ======================================================================
 
 
-----------------------------------------------------------------------
-
+Release notes for older releases follow:
+----------------------------------------
 
                    ==============================
-                   Release Notes for Samba 4.11.2
-                          October 29, 2019
+                   Release Notes for Samba 4.12.1
+                           April 07, 2020
 		   ==============================
 
 
-This is a security release in order to address the following defects:
-
-o CVE-2019-10218: Client code can return filenames containing path separators.          
-o CVE-2019-14833: Samba AD DC check password script does not receive the full
-		  password.
-o CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server
-		  via dirsync.
-
-=======
-Details
-=======
-
-o  CVE-2019-10218:
-   Malicious servers can cause Samba client code to return filenames containing
-   path separators to calling code.
-
-o  CVE-2019-14833:
-   When the password contains multi-byte (non-ASCII) characters, the check
-   password script does not receive the full password string.
+This is the latest stable release of the Samba 4.12 release series.
 
-o  CVE-2019-14847:
-   Users with the "get changes" extended access right can crash the AD DC LDAP
-   server by requesting an attribute using the range= syntax.
 
-For more details and workarounds, please refer to the security advisories.
+Changes since 4.12.0
+--------------------
 
-
-Changes since 4.11.1:
----------------------
-
-o  Jeremy Allison <[e-mail]>
-   * BUG 14071: CVE-2019-10218 - s3: libsmb: Protect SMB1 and SMB2 client code
-     from evil server returned names.
-
-o  Andrew Bartlett <[e-mail]>
-   * BUG 12438: CVE-2019-14833: Use utf8 characters in the unacceptable
-     password.
-   * BUG 14040: CVE-2019-14847 dsdb: Correct behaviour of ranged_results when
-     combined with dirsync.
+o  Douglas Bagnall <[e-mail]>
+   * BUG 14295: nmblib: Avoid undefined behaviour in handle_name_ptrs().
 
 o  Björn Baumbach <[e-mail]>
-   * BUG 12438: CVE-2019-14833 dsdb: Send full password to check password
-     script.
-
-
-#######################################
-Reporting bugs & Development Discussion
-#######################################
-
-Please discuss this release on the samba-technical mailing list or by
-joining the #samba-technical IRC channel on irc.freenode.net.
-
-If you do report problems then please try to send high quality
-feedback. If you don't provide vital information to help us track down
-the problem then you will probably be ignored.  All bug reports should
-be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
-database (https://bugzilla.samba.org/).
-
-
-======================================================================
-== Our Code, Our Bugs, Our Responsibility.
-== The Samba Team
-======================================================================
-
-
-----------------------------------------------------------------------
-
-
-                   ==============================
-                   Release Notes for Samba 4.11.1
-                          October 18, 2019
-		   ==============================
-
-
-This is the latest stable release of the Samba 4.11 release series.
-
-
-Changes since 4.11.0:
----------------------
-
-o  Michael Adam <[e-mail]>
-   * BUG 14141: getpwnam and getpwuid need to return data for ID_TYPE_BOTH
-     group.
-
-o  Jeremy Allison <[e-mail]>
-   * BUG 14094: smbc_readdirplus() is incompatible with smbc_telldir() and
-     smbc_lseekdir().
-   * BUG 14152: s3: smbclient: Stop an SMB2-connection from blundering into
-     SMB1-specific calls.
+   * BUG 14296: samba-tool group: Handle group names with special chars
+     correctly.
 
 o  Ralph Boehme <[e-mail]>
-   * BUG 14137: Fix stale file handle error when using mkstemp on a share.
-
-o  Isaac Boukris <[e-mail]>
-   * BUG 14106: Fix spnego fallback from kerberos to ntlmssp in smbd server.
-   * BUG 14140: Overlinking libreplace against librt and pthread against every
-     binary or library causes issues.
+   * BUG 14293: Add missing check for DMAPI offline status in async DOS
+     attributes.
+   * BUG 14295: Starting ctdb node that was powered off hard before results in
+     recovery loop.
+   * BUG 14307: smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs.
+   * BUG 14316: vfs_recycle: Prevent flooding the log if we're called on
+     non-existant paths.
 
 o  Günther Deschner <[e-mail]>
-   * BUG 14130: s3-winbindd: Fix forest trusts with additional trust attributes.
-   * BUG 14134: auth/gensec: Fix non-AES schannel seal.
-
-o  Amitay Isaacs <[e-mail]>
-   * BUG 14147: Deleted records can be resurrected during recovery.
+   * BUG 14313: librpc: Fix IDL for svcctl_ChangeServiceConfigW.
+   * BUG 14327: nsswitch: Fix use-after-free causing segfault in 
+     _pam_delete_cred.
 
-o  Björn Jacke <[e-mail]>
-   * BUG 14136: Fix uncaught exception in classicupgrade.
-   * BUG 14139: fault.c: Improve fault_report message text pointing to our wiki.
+o  Art M. Gallagher <[e-mail]>
+   * BUG 13622: fruit:time machine max size is broken on arm.
 
-o  Bryan Mason <[e-mail]>
-   * BUG 14128: s3:client: Use DEVICE_URI, instead of argv[0], for Device URI.
-
-o  Stefan Metzmacher <[e-mail]>
-   * BUG 14124: pam_winbind with krb5_auth or wbinfo -K doesn't work for users
-     of trusted domains/forests.
-
-o  Mathieu Parent <[e-mail]>
-   * BUG 14131: Remove 'pod2man' as it is no longer needed.
+o  Amitay Isaacs <[e-mail]>
+   * BUG 14294: CTDB recovery corner cases can cause record resurrection and
+     node banning.
 
-o  Andreas Schneider <[e-mail]>
-   * BUG 13884: Joining Active Directory should not use SAMR to set the
-     password.
-   * BUG 14140: Overlinking libreplace against librt and pthread against every
-     binary or library causes issues.
-   * BUG 14155: 'kpasswd' fails when built with MIT Kerberos.
+o  Noel Power <[e-mail]>
+   * BUG 14332: s3/utils: Fix double free error with smbtree. 
 
 o  Martin Schwenke <[e-mail]>
-   * BUG 14129: Exit code of ctdb nodestatus should not be influenced by deleted
-     nodes.
+   * BUG 14294: CTDB recovery corner cases can cause record resurrection and
+     node banning.
+   * BUG 14295: Starting ctdb node that was powered off hard before results in
+     recovery loop.
+   * BUG 14324: CTDB recovery daemon can crash due to dereference of NULL
+     pointer.
 
 
 #######################################
@@ -432,7 +121,7 @@ joining the #samba-technical IRC channel on irc.freenode.net.
 If you do report problems then please try to send high quality
 feedback. If you don't provide vital information to help us track down
 the problem then you will probably be ignored.  All bug reports should
-be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
+be filed under the Samba 4.1 and newer product in the project's Bugzilla
 database (https://bugzilla.samba.org/).
 
 
@@ -446,185 +135,49 @@ database (https://bugzilla.samba.org/).
 
 
                    ==============================
-                   Release Notes for Samba 4.11.0
-                         September 17, 2019
+                   Release Notes for Samba 4.12.0
+                           March 03, 2020
 		   ==============================
 
 
-This is the first stable release of the Samba 4.11 release series.
+This is the first stable release of the Samba 4.12 release series.
 Please read the release notes carefully before upgrading.
 
 
-UPGRADING
-=========
-
-AD Database compatibility
--------------------------
-
-Samba 4.11 has changed how the AD database is stored on disk. AD users should
-not really be affected by this change when upgrading to 4.11. However, AD
-users should be extremely careful if they need to downgrade from Samba 4.11 to
-an older release.
-
-Samba 4.11 maintains database compatibility with older Samba releases. The
-database will automatically get rewritten in the new 4.11 format when you
-first start the upgraded samba executable.
-
-However, when downgrading from 4.11 you will need to manually downgrade the AD
-database yourself. Note that you will need to do this step before you install
-the downgraded Samba packages. For more details, see:
-https://wiki.samba.org/index.php/Downgrading_an_Active_Directory_DC
-
-When either upgrading or downgrading, users should also avoid making any
-database modifications between installing the new Samba packages and starting
-the samba executable.
-
-SMB1 is disabled by default
----------------------------
-
-The defaults of 'client min protocol' and 'server min protocol'
-have been changed to SMB2_02.
-
-This means clients without support for SMB2 or SMB3 are no longer
-able to connect to smbd (by default).
-
-It also means client tools like smbclient and other,
-as well as applications making use of libsmbclient are no longer
-able to connect to servers without SMB2 or SMB3 support (by default).
-
-It's still possible to allow SMB1 dialects, e.g. NT1, LANMAN2
-and LANMAN1 for client and server, as well as CORE and COREPLUS on
-the client.
-
-Note that most commandline tools e.g. smbclient, smbcacls and others
-also support the '--option' argument to overwrite smb.conf options,
-e.g. --option='client min protocol=NT1' might be useful.
-
-As Microsoft no longer installs SMB1 support in recent releases
-or uninstalls it after 30 days without usage, the Samba Team
-tries to get remove the SMB1 usage as much as possible.
-
-SMB1 is officially deprecated and might be removed step by step
-in the following years. If you have a strong requirement for SMB1
-(except for supporting old Linux Kernels), please file a bug
-at https://bugzilla.samba.org and let us know about the details.
-
-LanMan and plaintext authentication deprecated
-----------------------------------------------
-
-The "lanman auth" and "encrypt passwords" parameters are deprecated
-with this release as both are only applicable to SMB1 and are quite
-insecure.  NTLM, NTLMv2 and Kerberos authentication are unaffected, as
-"encrypt passwords = yes" has been the default since Samba 3.0.0.
-
-If you have a strong requirement for these authentication protocols,
-please file a bug at https://bugzilla.samba.org and let us know about
-the details.
-
-BIND9_FLATFILE deprecated
--------------------------
-
-The BIND9_FLATFILE DNS backend is deprecated in this release and will
-be removed in the future.  This was only practically useful on a single
-domain controller or under expert care and supervision.
-
-This release therefore deprecates the "rndc command" smb.conf
-parameter, which is used to support this configuration.  After writing
-out a list of DCs permitted to make changes to the DNS Zone "rndc
-command" is called with reload to tell the 'named' server if a DC was
-added/removed to to the domain.
-
-
 NEW FEATURES/CHANGES
 ====================
 
-Default samba process model
----------------------------
-
-The default for the '--model' argument passed to the samba executable has changed
-from 'standard' to 'prefork'. This means a difference in the number of samba
-child processes that are created to handle client connections. The previous
-default would create a separate process for every LDAP or NETLOGON client
-connection. For a network with a lot of persistent client connections, this
-could result in significant memory overhead.  Now, with the new default of
-'prefork', the LDAP, NETLOGON, and KDC services will create a fixed number of
-worker processes at startup and share the client connections amongst these
-workers. The number of worker processes can be configured by the 'prefork
-children' setting in the smb.conf (the default is 4).
-
-Authentication Logging
-----------------------
-
-Winbind now logs PAM_AUTH and NTLM_AUTH events, a new attribute "logonId" has
-been added to the Authentication JSON log messages.  This contains a random
-logon id that is generated for each PAM_AUTH and NTLM_AUTH request and is passed
-to SamLogon, linking the windbind and SamLogon requests.
-
-The serviceDescription of the messages is set to "winbind", the authDescription
-is set to one of:
-   "PASSDB, <command>, <pid>"
-   "PAM_AUTH, <command>, <pid>"
-   "NTLM_AUTH, <command>, <pid>"
-where:
-   <command> is the name of the command makinmg the winbind request i.e. wbinfo
-   <pid>     is the process id of the requesting process.
-
-The version of the JSON Authentication messages has been changed from 1.1 to
-1.2.
-
-LDAP referrals
---------------
-
-The scheme of returned LDAP referrals now reflects the scheme of the original
-request, i.e. referrals received via ldap are prefixed with "ldap://"
-and those over ldaps are prefixed with "ldaps://".
-
-Previously all referrals were prefixed with "ldap://".
-
-Bind9 logging
--------------
-
-It is now possible to log the duration of DNS operations performed by Bind9.
-This should aid future diagnosis of performance issues and could be used to
-monitor DNS performance. The logging is enabled by setting log level to
-"dns:10" in smb.conf.
-
-The logs are currently human readable text only, i.e. no JSON formatted output.
-
-Log lines are of the form:
-
-    <function>: DNS timing: result: [<result>] duration: (<duration>)
-    zone: [<zone>] name: [<name>] data: [<data>]
-
-    durations are in microseconds.
-
-Default schema updated to 2012_R2
----------------------------------
+Python 3.5 Required
+-------------------
 
-Default AD schema changed from 2008_R2 to 2012_R2.  2012_R2 functional level
-is not yet available.  Older schemas can be used by provisioning with the
-'--base-schema' argument.  Existing installations can be updated with the
-samba-tool command "domain schemaupgrade".
+Samba's minimum runtime requirement for python was raised to Python
+3.4 with samba 4.11.  Samba 4.12 raises this minimum version to Python
+3.5 both to access new features and because this is the oldest version
+we test with in our CI infrastructure.
 
-Samba's replication code has also been improved to handle replication
-with the 2012 schema (the core of this replication fix has also been
-backported to 4.9.11 and will be in a 4.10.x release).
+(Build time support for the file server with Python 2.6 has not
+changed)
 
-For more about how the AD schema relates to overall Windows compatibility,
-please read:
-https://wiki.samba.org/index.php/Windows_2012_Server_compatibility
-
-GnuTLS 3.2 required
--------------------
+Removing in-tree cryptography: GnuTLS 3.4.7 required
+----------------------------------------------------
 
 Samba is making efforts to remove in-tree cryptographic functionality,
 and to instead rely on externally maintained libraries.  To this end,
 Samba has chosen GnuTLS as our standard cryptographic provider.
 
-Samba now requires GnuTLS 3.2 to be installed (including development
+Samba now requires GnuTLS 3.4.7 to be installed (including development
 headers at build time) for all configurations, not just the Samba AD
 DC.
 
+Thanks to this work Samba no longer ships an in-tree DES
+implementation and on GnuTLS 3.6.5 or later Samba will include no
+in-tree cryptography other than the MD4 hash and that
+implemented in our copy of Heimdal.
+
+Using GnuTLS for SMB3 encryption you will notice huge performance and copy
+speed improvements. Tests with the CIFS Kernel client from Linux Kernel 5.3
+show a 3x speed improvement for writing and a 2.5x speed improvement for reads!
+
 NOTE WELL: The use of GnuTLS means that Samba will honour the
 system-wide 'FIPS mode' (a reference to the US FIPS-140 cryptographic
 standard) and so will not operate in many still common situations if
@@ -635,165 +188,200 @@ A future Samba version will mitigate this to some extent where good
 cryptography effectively wraps bad cryptography, but for now that above
 applies.
 
-samba-tool improvements
------------------------
+zlib library is now required to build Samba
+-------------------------------------------
 
-A new "samba-tool contact" command has been added to allow the
-command-line manipulation of contacts, as used for address book
-lookups in LDAP.
+Samba no longer includes a local copy of zlib in our source tarball.
+By removing this we do not need to ship (even where we did not
+build) the old, broken zip encryption code found there.
 
-The "samba-tool [user|group|computer|group|contact] edit" command has been
-improved to operate more pleasantly on international character sets.
+New Spotlight backend for Elasticsearch
+---------------------------------------
 
-100,000 USER and LARGER Samba AD DOMAINS
-========================================
+Support for the macOS specific Spotlight search protocol has been enhanced
+significantly. Starting with 4.12 Samba supports using Elasticsearch as search
+backend. Various new parameters have been added to configure this:
 
-Extensive efforts have been made to optimise Samba for use in
-organisations (for example) targeting 100,000 users, plus 120,000
-computer objects, as well as large number of group memberships.
+  spotlight backend = noindex | elasticsearch | tracker
+  elasticsearch:address = ADDRESS
+  elasticsearch:port = PORT
+  elasticsearch:use tls = BOOLEAN
+  elasticsearch:index = INDEXNAME
+  elasticsearch:mappings = PATH
+  elasticsearch:max results = NUMBER
 
-Many of the specific efforts are detailed below, but the net results
-is to remove barriers to significantly larger Samba deployments
-compared to previous releases.
+Samba also ships a Spotlight client command "mdfind" which can be used to search
+any SMB server that runs the Spotlight RPC service. See the manpage of mdfind
+for details.
 
-Reindex performance improvements
---------------------------------
+Note that when upgrading existing installations that are using the previous
+default Spotlight backend Gnome Tracker must explicitly set "spotlight backend =
+tracker" as the new default is "noindex".
 
-The performance of samba-tool dbcheck --reindex has been improved,
-especially for large domains.
+'net ads kerberos pac save' and 'net eventlog export'
+-----------------------------------------------------
 
-join performance improvements
------------------------------
+The 'net ads kerberos pac save' and 'net eventlog export' tools will
+no longer silently overwrite an existing file during data export.  If
+the filename given exits, an error will be shown.
 
-The performance of samba-tool domain join has been improved,
-especially for large domains.
+Fuzzing
+-------
 
-LDAP Server memory improvements
--------------------------------
+A large number of fuzz targets have been added to Samba, and Samba has
+been registered in Google's oss-fuzz cloud fuzzing service.  In
+particular, we now have good fuzzing coverage of our generated NDR
+parsing code.
 
-The LDAP server has improved memory efficiency, ensuring that large
-LDAP responses (for example a search for all objects) is not copied
-multiple times into memory.
+A large number of issues have been found and fixed thanks to this
+effort.
 
-Setting lmdb map size
----------------------
+'samba-tool' improvements add contacts as member to groups
+----------------------------------------------------------
 
-It is now possible to set the lmdb map size (the maximum permitted
-size for the database).  "samba-tool" now accepts the
-"--backend-store-size" i.e. --backend-store-size=4Gb.  If not
-specified it defaults to 8Gb.
+Previously 'samba-tool group addmemers' can just add users, groups and
+computers as members to groups. But also contacts can be members of
+groups. Samba 4.12 adds the functionality to add contacts to
+groups. Since contacts have no sAMAccountName, it's possible that
+there are more than one contact with the same name in different
+organizational units. Therefore it's necessary to have an option to
+handle group members by their DN.
 
-This option is avaiable for the following sub commands:
- * domain provision
- * domain join
- * domain dcpromo
- * drs clone-dc-database
+To get the DN of an object there is now the "--full-dn" option available
+for all necessary commands.
 
-LDB "batch_mode"
-----------------
+The MS Windows UI allows to search for specific types of group members
+when searching for new members for a group. This feature is included
+here with the new samba-tool group addmembers "--object-type=OBJECTYPE"
+option. The different types are selected accordingly to the Windows
+UI. The default samba-toole behaviour shouldn't be changed.
 
-To improve performance during batch operations i.e. joins, ldb now
-accepts a "batch_mode" option.  However to prevent any index or
-database inconsistencies if an operation fails, the entire transaction
-will be aborted at commit.
-
-New LDB pack format
--------------------
+Allow filtering by OU or subtree in samba-tool
+----------------------------------------------
 
-On first use (startup of 'samba' or the first transaction write)
-Samba's sam.ldb will be updated to a new more efficient pack format.
-This will take a few moments.
+A new "--base-dn" and "--member-base-dn" option is added to relevant
+samba-tool user, group and ou management commands to allow operation
+on just one part of the AD tree, such as a single OU.
 
-New LDB <= and >= index mode to improve replication performance
----------------------------------------------------------------
+VFS
+===
 
-As well as a new pack format, Samba's sam.ldb uses a new index format
-allowing Samba to efficiently select objects changed since the last
-replication cycle.  This in turn improves performance during
-replication of large domains.
+SMB_VFS_NTIMES
+--------------
 
-https://wiki.samba.org/index.php/LDB_Greater_than_and_Less_than_indexing
+Samba now uses a sentinel value based on utimensat(2) UTIME_OMIT to denote
+to-be-ignored timestamp variables passed to the SMB_VFS_NTIMES() VFS function.
 
-Improvements to ldb search performance
---------------------------------------
+VFS modules can check whether any of the time values inside a struct
+smb_file_time is to be ignored by calling is_omit_timespec() on the value.
 
-Search performance on large LDB databases has been improved by
-reducing memory allocations made on each object.
+'io_uring' vfs module
+---------------------
 
-Improvements to subtree rename performance
-------------------------------------------
+The module makes use of the new io_uring infrastructure
+(intruduced in Linux 5.1), see https://lwn.net/Articles/776703/
 
-Improvements have been made to Samba's handling of subtree renames,
-for example of containers and organisational units, however large
-renames are still not recommended.
+Currently this implements SMB_VFS_{PREAD,PWRITE,FSYNC}_SEND/RECV
+and avoids the overhead of the userspace threadpool in the default
+vfs backend. See also vfs_io_uring(8).
 
-CTDB changes
-============
+In order to build the module you need the liburing userspace library
+and its developement headers installed, see
+https://git.kernel.dk/cgit/liburing/
 
-* nfs-linux-kernel-callout now defaults to using systemd service names
+At runtime you'll need a Linux kernel with version 5.1 or higher.
+Note that 5.4.14 and 5.4.15 have a regression that breaks the Samba
+module! The regression was fixed in Linux 5.4.16 again.
 
-  The Red Hat service names continue to be the default.
+MS-DFS changes in the VFS
+-------------------------
 
-  Other distributions should patch this file when packaging it.
+This release changes set getting and setting of MS-DFS redirects
+on the filesystem to go through two new VFS functions:
 
-* The onnode -o option has been removed
+SMB_VFS_CREATE_DFS_PATHAT()
+SMB_VFS_READ_DFS_PATHAT()
 
-* ctdbd logs when it is using more than 90% of a CPU thread
+instead of smbd explicitly storing MS-DFS redirects inside
+symbolic links on the filesystem. The underlying default
+implementations of this has not changed, the redirects are
+still stored inside symbolic links on the filesystem, but
+moving the creation and reading of these links into the VFS
+as first-class functions now allows alternate methods of
+storing them (maybe in extended attributes) for OEMs who
+don't want to mis-use filesystem symbolic links in this
+way.
 
-  ctdbd is single threaded, so can become saturated if it uses the
-  full capacity of a CPU thread.  To help detect this situation, ctdbd
-  now logs messages when CPU utilisation exceeds 90%.  Each change in
-  CPU utilisation over 90% is logged.  A message is also logged when
-  CPU utilisation drops below the 90% threshold.
 
-* Script configuration variable CTDB_MONITOR_SWAP_USAGE has been removed
+CTDB changes
+============
 
-  05.system.script now monitors total memory (i.e. physical memory +
-  swap) utilisation using the existing CTDB_MONITOR_MEMORY_USAGE
-  script configuration variable.
+* The ctdb_mutex_fcntl_helper periodically re-checks the lock file
 
-CephFS Snapshot Integration
----------------------------
+  The re-check period is specified using a 2nd argument to this
+  helper.  The default re-check period is 5s.
 
-CephFS snapshots can now be exposed as previous file versions using the new
-ceph_snapshots VFS module. See the vfs_ceph_snapshots(8) man page for details.
+  If the file no longer exists or the inode number changes then the
+  helper exits.  This triggers an election.
 
 
 REMOVED FEATURES
 ================
 
-Web server
-----------
+The smb.conf parameter "write cache size" has been removed.
 
-As a leftover from work related to the Samba Web Administration Tool (SWAT),
-Samba still supported a Python WSGI web server (which could still be turned on
-from the 'server services' smb.conf parameter). This service was unused and has
-now been removed from Samba.
+Since the in-memory write caching code was written, our write path has
+changed significantly. In particular we have gained very flexible
+support for async I/O, with the new linux io_uring interface in
+development.  The old write cache concept which cached data in main
+memory followed by a blocking pwrite no longer gives any improvement
+on modern systems, and may make performance worse on memory-contrained
+systems, so this functionality should not be enabled in core smbd
+code.
 
-samba-tool join subdomain
--------------------------
+In addition, it complicated the write code, which is a performance
+critical code path.
+
+If required for specialist purposes, it can be recreated as a VFS
+module.
+
+Retiring DES encryption types in Kerberos.
+------------------------------------------
+With this release, support for DES encryption types has been removed from
+Samba, and setting DES_ONLY flag for an account will cause Kerberos
+authentication to fail for that account (see RFC-6649).
+
+Samba-DC: DES keys no longer saved in DB.
+-----------------------------------------
+When a new password is set for an account, Samba DC will store random keys
+in DB instead of DES keys derived from the password.  If the account is being
+migrated to Windbows or to an older version of Samba in order to use DES keys,
+the password must be reset to make it work.
+
+Heimdal-DC: removal of weak-crypto.
+-----------------------------------
+Following removal of DES encryption types from Samba, the embedded Heimdal
+build has been updated to not compile weak crypto code (HEIM_WEAK_CRYPTO).
 
-The subdomain role has been removed from the join command.  This option did
-not work and has no tests.
+vfs_netatalk: The netatalk VFS module has been removed.
+-------------------------------------------------------
 
-Python2 support
----------------
+The netatalk VFS module has been removed. It was unmaintained and is not needed
+any more.
 
-Samba 4.11 will not have any runtime support for Python 2.
+BIND9_FLATFILE deprecated
+-------------------------
 
-If you are building Samba using the '--disable-python' option
-(i.e. you're excluding all the run-time Python support), then this
-will continue to work on a system that supports either python2 or
-python3.
+The BIND9_FLATFILE DNS backend is deprecated in this release and will
+be removed in the future.  This was only practically useful on a single
+domain controller or under expert care and supervision.
 
-To build Samba with python2 you *must* set the 'PYTHON' environment
-variable for both the 'configure' and 'make' steps, i.e.
-   'PYTHON=python2 ./configure'
-   'PYTHON=python2 make'
-This will override the python3 default.
+This release removes the 'rndc command' smb.conf parameter, which
+supported this configuration by writing out a list of DCs permitted to
+make changes to the DNS Zone and nudging the 'named' server if a new
+DC was added to the domain.  Administrators using BIND9_FLATFILE will
+need to maintain this manually from now on.
 
-Except for this specific build-time use of python2, Samba now requires
-Python 3.4 as a minimum.
 
 smb.conf changes
 ================
@@ -801,111 +389,85 @@ smb.conf changes
   Parameter Name                     Description                Default
   --------------                     -----------                -------
 
-  allocation roundup size            Default changed/           0
-                                     Deprecated
-  client min protocol                Changed default            SMB2_02
-  server min protocol                Changed default            SMB2_02
-  mangled names                      Changed default            illegal
-  web port                           Removed
-  fruit:zero_file_id                 Changed default            False
-  debug encryption                   New: dump encryption keys  False
-  rndc command                       Deprecated
-  lanman auth                        Deprecated
-  encrypt passwords                  Deprecated
+  elasticsearch:address              New                        localhost
+  elasticsearch:port                 New                        9200
+  elasticsearch:use tls              New                        No
+  elasticsearch:index                New                        _all
+  elasticsearch:mappings             New                        DATADIR/elasticsearch_mappings.json
+  elasticsearch:max results          New                        100
+  nfs4:acedup                        Changed default            merge
+  rndc command                       Removed
+  write cache size                   Removed
+  spotlight backend		     New			noindex
 
 
-CHANGES SINCE 4.11.0rc4
+CHANGES SINCE 4.12.0rc4
 =======================
 
+o  Andrew Bartlett <[e-mail]>
+   * BUG 14258: dsdb: Correctly handle memory in objectclass_attrs.
+
 
-CHANGES SINCE 4.11.0rc3
+CHANGES SINCE 4.12.0rc3
 =======================
 
+o  Jeremy Allison <[e-mail]>
+   * BUG 14269: s3: DFS: Don't allow link deletion on a read-only share.
+
 o  Douglas Bagnall <[e-mail]>
-   * BUG 14049: ldb: Don't try to save a value that isn't there.
-   * ldb_dn: Free dn components on explode failure.
-   * ldb: Do not allow adding a DN as a base to itself.
+   * BUG 14284: pidl/wscript: configure should insist on Parse::Yapp::Driver.
 
 o  Andrew Bartlett <[e-mail]>
-   * ldb: Release ldb 2.0.7.
-   * BUG 13695: ldb: Correct Pigeonhole principle validation in
-     ldb_filter_attrs().
-   * BUG 14049: Fix ldb dn crash.
-   * BUG 14117: Deprecate "lanman auth = yes" and "encrypt passwords = no".
+   * BUG 14270: ldb: Fix search with scope ONE and small result sets. 
+   * BUG 14284: build: Do not check if system perl modules should be bundled.
 
-o  Ralph Boehme <[e-mail]>
-   * BUG 14038: Fix compiling ctdb on older systems lacking POSIX robust
-     mutexes.
-   * BUG 14121: smbd returns bad File-ID on filehandle used to create a file or
-     directory.
-
-o  Poornima G <[e-mail]>
-   * BUG 14098: vfs_glusterfs: Use pthreadpool for scheduling aio operations.
+o  Volker Lendecke <[e-mail]>
+   * BUG 14285: smbd fails to handle EINTR from open(2) properly.
 
 o  Stefan Metzmacher <[e-mail]>
-   * BUG 14055: Add the target server name of SMB 3.1.1 connections as a hint to
-     load balancers or servers with "multi-tenancy" support.
-   * BUG 14113: Fix byte range locking bugs/regressions.
+   * BUG 14270: ldb: version 2.1.1.
 
-o  Swen Schillig <[e-mail]>
-   * ldb: Fix mem-leak if talloc_realloc fails.
 
-o  Evgeny Sinelnikov <[e-mail]>
-   * BUG 14007: Fix join with don't exists machine account.
-
-o  Martin Schwenke <[e-mail]>
-   * BUG 14085: ctdb-recoverd: Only check for LMASTER nodes in the VNN map.
-
-
-CHANGES SINCE 4.11.0rc2
+CHANGES SINCE 4.12.0rc2
 =======================
 
-o  Michael Adam <[e-mail]>
-   * BUG 13972: Different Device Id for GlusterFS FUSE mount is causing data
-     loss in CTDB cluster.
-
 o  Jeremy Allison <[e-mail]>
-   * BUG 14035: CVE-2019-10197: Permissions check deny can allow user to escape
-     from the share.
+   * BUG 14282: Set getting and setting of MS-DFS redirects on the filesystem
+     to go through two new VFS functions SMB_VFS_CREATE_DFS_PATHAT() and
+     SMB_VFS_READ_DFS_PATHAT().
 
 o  Andrew Bartlett <[e-mail]>
-   * BUG 14059: ldb: Release ldb 2.0.6 (log database repack so users know what
-     is happening).
-   * BUG 14092: docs: Deprecate "rndc command" for Samba 4.11.
+   * BUG 14255: bootstrap: Remove un-used dependency python3-crypto.
 
-o  Tim Beale <[e-mail]>
-   * BUG 14059: ldb: Free memory when repacking database.
+o  Volker Lendecke <[e-mail]>
+   * BUG 14247: Fix CID 1458418 and 1458420.
+   * BUG 14281: lib: Fix a shutdown crash with "clustering = yes".
 
-o  Ralph Boehme <[e-mail]>
-   * BUG 14089: vfs_default: Use correct flag in vfswrap_fs_file_id.
-   * BUG 14090: vfs_glusterfs: Initialize st_ex_file_id, st_ex_itime and
-     st_ex_iflags.
+o  Stefan Metzmacher <[e-mail]>
+   * BUG 14247: Winbind member (source3) fails local SAM auth with empty domain
+     name.
+   * BUG 14265: winbindd: Handle missing idmap in getgrgid().
+   * BUG 14271: Don't use forward declaration for GnuTLS typedefs.
+   * BUG 14280: Add io_uring vfs module.
 
-o  Anoop C S <[e-mail]>
-   * BUG 14093: vfs_glusterfs: Enable profiling for file system operations.
+o  Andreas Schneider <[e-mail]>
+   * BUG 14250: libcli:smb: Improve check for gnutls_aead_cipher_(en|de)cryptv2.
 
-o  Aaron Haslett <[e-mail]>
-   * BUG 14059: Backport sambadowngradedatabase for v4.11.
 
-o  Stefan Metzmacher <[e-mail]>
-   * BUG 14035: CVE-2019-10197: Permissions check deny can allow user to escape
-     from the share.
+CHANGES SINCE 4.12.0rc1
+=======================
 
-o  Christof Schmitt <[e-mail]>
-   * BUG 14032: vfs_gpfs: Implement special case for denying owner access to
-     ACL.
+o  Jeremy Allison <[e-mail]>
+   * BUG 14239: s3: lib: nmblib. Clean up and harden nmb packet processing.
 
-o  Martin Schwenke <[e-mail]>
-   * BUG 14084: Avoid marking a node as connected before it can receive packets.
-   * BUG 14086: Fix onnode test failure with ShellCheck >= 0.4.7.
-   * BUG 14087: ctdb-daemon: Stop "ctdb stop" from completing before freezing
-     databases.
+o  Andreas Schneider <[e-mail]>
+   * BUG 14253: lib:util: Log mkdir error on correct debug levels.
 
 
 KNOWN ISSUES
 ============
 
-https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.11#Release_blocking_bugs
+https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.12#Release_blocking_bugs
 
 
 #######################################
diff --git a/auth/common_auth.h b/auth/common_auth.h
index 9f04c9b..0452c67 100644
--- a/auth/common_auth.h
+++ b/auth/common_auth.h
@@ -129,12 +129,6 @@ struct auth4_context {
 	/* Private data for the callbacks on this auth context */
 	void *private_data;
 
-	NTSTATUS (*check_ntlm_password)(struct auth4_context *auth_ctx,
-					TALLOC_CTX *mem_ctx,
-					const struct auth_usersupplied_info *user_info,
-					uint8_t *pauthoritative,
-					void **server_returned_info,
-					DATA_BLOB *nt_session_key, DATA_BLOB *lm_session_key);
 	struct tevent_req *(*check_ntlm_password_send)(TALLOC_CTX *mem_ctx,
 					struct tevent_context *ev,
 					struct auth4_context *auth_ctx,
diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
index 5ebec48..81f9dbb 100644
--- a/auth/credentials/credentials.c
+++ b/auth/credentials/credentials.c
@@ -1333,19 +1333,19 @@ _PUBLIC_ NTSTATUS netlogon_creds_session_encrypt(
 		return NT_STATUS_INVALID_PARAMETER;
 	}
 	if (state->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
-		netlogon_creds_aes_encrypt(state,
-					   data.data,
-					   data.length);
+		status = netlogon_creds_aes_encrypt(state,
+						    data.data,
+						    data.length);
 	} else if (state->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
 		status = netlogon_creds_arcfour_crypt(state,
 						      data.data,
 						      data.length);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
-		}
 	} else {
 		DBG_ERR("Unsupported encryption option negotiated");
-		return NT_STATUS_NOT_SUPPORTED;
+		status = NT_STATUS_NOT_SUPPORTED;
+	}
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
 	}
 	return NT_STATUS_OK;
 }
diff --git a/auth/credentials/credentials_ntlm.c b/auth/credentials/credentials_ntlm.c
index bf55ab9..f1b22a6 100644
--- a/auth/credentials/credentials_ntlm.c
+++ b/auth/credentials/credentials_ntlm.c
@@ -51,6 +51,7 @@ _PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred
 	DATA_BLOB lm_session_key = data_blob_null;
 	DATA_BLOB session_key = data_blob_null;
 	const struct samr_Password *nt_hash = NULL;
+	int rc;
 
 	if (cred->use_kerberos == CRED_MUST_USE_KERBEROS) {
 		TALLOC_FREE(frame);
@@ -159,7 +160,6 @@ _PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred
 		uint8_t session_nonce[16];
 		uint8_t session_nonce_hash[16];
 		uint8_t user_session_key[16];
-		int rc;
 
 		lm_response = data_blob_talloc_zero(frame, 24);
 		if (lm_response.data == NULL) {
@@ -188,9 +188,13 @@ _PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred
 			TALLOC_FREE(frame);
 			return NT_STATUS_NO_MEMORY;
 		}
-		SMBOWFencrypt(nt_hash->hash,
-			      session_nonce_hash,
-			      nt_response.data);
+		rc = SMBOWFencrypt(nt_hash->hash,
+				   session_nonce_hash,
+                                   nt_response.data);
+		if (rc != 0) {
+			TALLOC_FREE(frame);
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
+		}
 
 		ZERO_ARRAY(session_nonce_hash);
 
@@ -228,8 +232,12 @@ _PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred
 			TALLOC_FREE(frame);
 			return NT_STATUS_NO_MEMORY;
 		}
-		SMBOWFencrypt(nt_hash->hash, challenge.data,
-			      nt_response.data);
+		rc = SMBOWFencrypt(nt_hash->hash, challenge.data,
+				   nt_response.data);
+		if (rc != 0) {
+			TALLOC_FREE(frame);
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
+		}
 
 		session_key = data_blob_talloc_zero(frame, 16);
 		if (session_key.data == NULL) {
@@ -254,9 +262,14 @@ _PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred
 				return NT_STATUS_NO_MEMORY;
 			}
 
-			SMBencrypt_hash(lm_hash,
-					challenge.data,
-					lm_response.data);
+			rc = SMBencrypt_hash(lm_hash,
+					     challenge.data,
+					     lm_response.data);
+			if (rc != 0) {
+				ZERO_STRUCT(lm_hash);
+				TALLOC_FREE(frame);
+				return gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
+			}
 		} else {
 			/* just copy the nt_response */
 			lm_response = data_blob_dup_talloc(frame, nt_response);
diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c
index 1aef16a..7427e28 100644
--- a/auth/credentials/pycredentials.c
+++ b/auth/credentials/pycredentials.c
@@ -37,13 +37,6 @@
 
 void initcredentials(void);
 
-static PyObject *PyString_FromStringOrNULL(const char *str)
-{
-	if (str == NULL)
-		Py_RETURN_NONE;
-	return PyUnicode_FromString(str);
-}
-
 static PyObject *py_creds_new(PyTypeObject *type, PyObject *args, PyObject *kwargs)
 {
 	return pytalloc_steal(type, cli_credentials_init(NULL));
@@ -51,7 +44,12 @@ static PyObject *py_creds_new(PyTypeObject *type, PyObject *args, PyObject *kwar
 
 static PyObject *py_creds_get_username(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_username(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_username(creds));
 }
 
 static PyObject *py_creds_set_username(PyObject *self, PyObject *args)
@@ -59,13 +57,18 @@ static PyObject *py_creds_set_username(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	return PyBool_FromLong(cli_credentials_set_username(PyCredentials_AsCliCredentials(self), newval, obt));
+	return PyBool_FromLong(cli_credentials_set_username(creds, newval, obt));
 }
 
 static PyObject *py_creds_get_ntlm_username_domain(PyObject *self, PyObject *unused)
@@ -74,7 +77,12 @@ static PyObject *py_creds_get_ntlm_username_domain(PyObject *self, PyObject *unu
 	const char *user = NULL;
 	const char *domain = NULL;
 	PyObject *ret = NULL;
-	cli_credentials_get_ntlm_username_domain(PyCredentials_AsCliCredentials(self),
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	cli_credentials_get_ntlm_username_domain(creds,
 						 frame, &user, &domain);
 	ret = Py_BuildValue("(ss)",
 			    user,
@@ -101,6 +109,11 @@ static PyObject *py_creds_get_ntlm_response(PyObject *self, PyObject *args, PyOb
 	const char *kwnames[] = { "flags", "challenge",
 				  "target_info",
 				  NULL };
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	tv_now = timeval_current();
 	server_timestamp = timeval_to_nttime(&tv_now);
@@ -115,7 +128,7 @@ static PyObject *py_creds_get_ntlm_response(PyObject *self, PyObject *args, PyOb
 		return NULL;
 	}
 
-	status = cli_credentials_get_ntlm_response(PyCredentials_AsCliCredentials(self),
+	status = cli_credentials_get_ntlm_response(creds,
 						   frame, &flags,
 						   challenge,
 						   &server_timestamp,
@@ -147,7 +160,13 @@ static PyObject *py_creds_get_ntlm_response(PyObject *self, PyObject *args, PyOb
 static PyObject *py_creds_get_principal(PyObject *self, PyObject *unused)
 {
 	TALLOC_CTX *frame = talloc_stackframe();
-	PyObject *ret = PyString_FromStringOrNULL(cli_credentials_get_principal(PyCredentials_AsCliCredentials(self), frame));
+	PyObject *ret = NULL;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	ret = PyString_FromStringOrNULL(cli_credentials_get_principal(creds, frame));
 	TALLOC_FREE(frame);
 	return ret;
 }
@@ -157,18 +176,28 @@ static PyObject *py_creds_set_principal(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	return PyBool_FromLong(cli_credentials_set_principal(PyCredentials_AsCliCredentials(self), newval, obt));
+	return PyBool_FromLong(cli_credentials_set_principal(creds, newval, obt));
 }
 
 static PyObject *py_creds_get_password(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_password(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_password(creds));
 }
 
 static PyObject *py_creds_set_password(PyObject *self, PyObject *args)
@@ -177,12 +206,18 @@ static PyObject *py_creds_set_password(PyObject *self, PyObject *args)
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
 	PyObject *result = NULL;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+
 	if (!PyArg_ParseTuple(args, PYARG_STR_UNI"|i", "utf8", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	result = PyBool_FromLong(cli_credentials_set_password(PyCredentials_AsCliCredentials(self), newval, obt));
+	result = PyBool_FromLong(cli_credentials_set_password(creds, newval, obt));
 	PyMem_Free(discard_const_p(void*, newval));
 	return result;
 }
@@ -196,6 +231,11 @@ static PyObject *py_creds_set_utf16_password(PyObject *self, PyObject *args)
 	Py_ssize_t size =  0;
 	int result;
 	bool ok;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "O|i", &newval, &_obt)) {
 		return NULL;
@@ -209,7 +249,7 @@ static PyObject *py_creds_set_utf16_password(PyObject *self, PyObject *args)
 	}
 	blob.length = size;
 
-	ok = cli_credentials_set_utf16_password(PyCredentials_AsCliCredentials(self),
+	ok = cli_credentials_set_utf16_password(creds,
 						&blob, obt);
 
 	return PyBool_FromLong(ok);
@@ -217,7 +257,12 @@ static PyObject *py_creds_set_utf16_password(PyObject *self, PyObject *args)
 
 static PyObject *py_creds_get_old_password(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_old_password(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_old_password(creds));
 }
 
 static PyObject *py_creds_set_old_password(PyObject *self, PyObject *args)
@@ -225,13 +270,18 @@ static PyObject *py_creds_set_old_password(PyObject *self, PyObject *args)
 	char *oldval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &oldval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	return PyBool_FromLong(cli_credentials_set_old_password(PyCredentials_AsCliCredentials(self), oldval, obt));
+	return PyBool_FromLong(cli_credentials_set_old_password(creds, oldval, obt));
 }
 
 static PyObject *py_creds_set_old_utf16_password(PyObject *self, PyObject *args)
@@ -241,6 +291,11 @@ static PyObject *py_creds_set_old_utf16_password(PyObject *self, PyObject *args)
 	Py_ssize_t size =  0;
 	int result;
 	bool ok;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "O", &oldval)) {
 		return NULL;
@@ -253,7 +308,7 @@ static PyObject *py_creds_set_old_utf16_password(PyObject *self, PyObject *args)
 	}
 	blob.length = size;
 
-	ok = cli_credentials_set_old_utf16_password(PyCredentials_AsCliCredentials(self),
+	ok = cli_credentials_set_old_utf16_password(creds,
 						    &blob);
 
 	return PyBool_FromLong(ok);
@@ -261,7 +316,12 @@ static PyObject *py_creds_set_old_utf16_password(PyObject *self, PyObject *args)
 
 static PyObject *py_creds_get_domain(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_domain(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_domain(creds));
 }
 
 static PyObject *py_creds_set_domain(PyObject *self, PyObject *args)
@@ -269,18 +329,28 @@ static PyObject *py_creds_set_domain(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	return PyBool_FromLong(cli_credentials_set_domain(PyCredentials_AsCliCredentials(self), newval, obt));
+	return PyBool_FromLong(cli_credentials_set_domain(creds, newval, obt));
 }
 
 static PyObject *py_creds_get_realm(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_realm(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_realm(creds));
 }
 
 static PyObject *py_creds_set_realm(PyObject *self, PyObject *args)
@@ -288,32 +358,52 @@ static PyObject *py_creds_set_realm(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	return PyBool_FromLong(cli_credentials_set_realm(PyCredentials_AsCliCredentials(self), newval, obt));
+	return PyBool_FromLong(cli_credentials_set_realm(creds, newval, obt));
 }
 
 static PyObject *py_creds_get_bind_dn(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_bind_dn(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_bind_dn(creds));
 }
 
 static PyObject *py_creds_set_bind_dn(PyObject *self, PyObject *args)
 {
 	char *newval;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 	if (!PyArg_ParseTuple(args, "s", &newval))
 		return NULL;
 
-	return PyBool_FromLong(cli_credentials_set_bind_dn(PyCredentials_AsCliCredentials(self), newval));
+	return PyBool_FromLong(cli_credentials_set_bind_dn(creds, newval));
 }
 
 static PyObject *py_creds_get_workstation(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_workstation(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_workstation(creds));
 }
 
 static PyObject *py_creds_set_workstation(PyObject *self, PyObject *args)
@@ -321,39 +411,69 @@ static PyObject *py_creds_set_workstation(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	return PyBool_FromLong(cli_credentials_set_workstation(PyCredentials_AsCliCredentials(self), newval, obt));
+	return PyBool_FromLong(cli_credentials_set_workstation(creds, newval, obt));
 }
 
 static PyObject *py_creds_is_anonymous(PyObject *self, PyObject *unused)
 {
-	return PyBool_FromLong(cli_credentials_is_anonymous(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyBool_FromLong(cli_credentials_is_anonymous(creds));
 }
 
 static PyObject *py_creds_set_anonymous(PyObject *self, PyObject *unused)
 {
-	cli_credentials_set_anonymous(PyCredentials_AsCliCredentials(self));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	cli_credentials_set_anonymous(creds);
 	Py_RETURN_NONE;
 }
 
 static PyObject *py_creds_authentication_requested(PyObject *self, PyObject *unused)
 {
-        return PyBool_FromLong(cli_credentials_authentication_requested(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+        return PyBool_FromLong(cli_credentials_authentication_requested(creds));
 }
 
 static PyObject *py_creds_wrong_password(PyObject *self, PyObject *unused)
 {
-        return PyBool_FromLong(cli_credentials_wrong_password(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+         return PyBool_FromLong(cli_credentials_wrong_password(creds));
 }
 
 static PyObject *py_creds_set_cmdline_callbacks(PyObject *self, PyObject *unused)
 {
-        return PyBool_FromLong(cli_credentials_set_cmdline_callbacks(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+        return PyBool_FromLong(cli_credentials_set_cmdline_callbacks(creds));
 }
 
 static PyObject *py_creds_parse_string(PyObject *self, PyObject *args)
@@ -361,13 +481,18 @@ static PyObject *py_creds_parse_string(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	cli_credentials_parse_string(PyCredentials_AsCliCredentials(self), newval, obt);
+	cli_credentials_parse_string(creds, newval, obt);
 	Py_RETURN_NONE;
 }
 
@@ -376,13 +501,18 @@ static PyObject *py_creds_parse_file(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	cli_credentials_parse_file(PyCredentials_AsCliCredentials(self), newval, obt);
+	cli_credentials_parse_file(creds, newval, obt);
 	Py_RETURN_NONE;
 }
 
@@ -404,8 +534,13 @@ static PyObject *py_cli_credentials_set_password_will_be_nt_hash(PyObject *self,
 static PyObject *py_creds_get_nt_hash(PyObject *self, PyObject *unused)
 {
 	PyObject *ret;
+	struct samr_Password *ntpw = NULL;
 	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
-	struct samr_Password *ntpw = cli_credentials_get_nt_hash(creds, creds);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	ntpw = cli_credentials_get_nt_hash(creds, creds);
 
 	ret = PyBytes_FromStringAndSize(discard_const_p(char, ntpw->hash), 16);
 	TALLOC_FREE(ntpw);
@@ -414,34 +549,55 @@ static PyObject *py_creds_get_nt_hash(PyObject *self, PyObject *unused)
 
 static PyObject *py_creds_get_kerberos_state(PyObject *self, PyObject *unused)
 {
-	int state = cli_credentials_get_kerberos_state(PyCredentials_AsCliCredentials(self));
+	int state;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	state = cli_credentials_get_kerberos_state(creds);
 	return PyInt_FromLong(state);
 }
 
 static PyObject *py_creds_set_kerberos_state(PyObject *self, PyObject *args)
 {
 	int state;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 	if (!PyArg_ParseTuple(args, "i", &state))
 		return NULL;
 
-	cli_credentials_set_kerberos_state(PyCredentials_AsCliCredentials(self), state);
+	cli_credentials_set_kerberos_state(creds, state);
 	Py_RETURN_NONE;
 }
 
 static PyObject *py_creds_set_krb_forwardable(PyObject *self, PyObject *args)
 {
 	int state;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 	if (!PyArg_ParseTuple(args, "i", &state))
 		return NULL;
 
-	cli_credentials_set_krb_forwardable(PyCredentials_AsCliCredentials(self), state);
+	cli_credentials_set_krb_forwardable(creds, state);
 	Py_RETURN_NONE;
 }
 
 
 static PyObject *py_creds_get_forced_sasl_mech(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_forced_sasl_mech(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_forced_sasl_mech(creds));
 }
 
 static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args)
@@ -449,13 +605,18 @@ static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s", &newval)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	cli_credentials_set_forced_sasl_mech(PyCredentials_AsCliCredentials(self), newval);
+	cli_credentials_set_forced_sasl_mech(creds, newval);
 	Py_RETURN_NONE;
 }
 
@@ -467,6 +628,10 @@ static PyObject *py_creds_guess(PyObject *self, PyObject *args)
 	struct cli_credentials *creds;
 
 	creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx))
 		return NULL;
@@ -499,6 +664,10 @@ static PyObject *py_creds_set_machine_account(PyObject *self, PyObject *args)
 	TALLOC_CTX *mem_ctx;
 
 	creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx))
 		return NULL;
@@ -542,6 +711,10 @@ static PyObject *py_creds_get_named_ccache(PyObject *self, PyObject *args)
 	TALLOC_CTX *mem_ctx;
 
 	creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "|Os", &py_lp_ctx, &ccache_name))
 		return NULL;
@@ -585,6 +758,11 @@ static PyObject *py_creds_set_named_ccache(PyObject *self, PyObject *args)
 	PyObject *py_lp_ctx = Py_None;
 	int _obt = obt;
 	int ret;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|iO", &newval, &_obt, &py_lp_ctx))
 		return NULL;
@@ -601,7 +779,7 @@ static PyObject *py_creds_set_named_ccache(PyObject *self, PyObject *args)
 		return NULL;
 	}
 
-	ret = cli_credentials_set_ccache(PyCredentials_AsCliCredentials(self),
+	ret = cli_credentials_set_ccache(creds,
 					 lp_ctx,
 					 newval, CRED_SPECIFIED,
 					 &error_string);
@@ -620,11 +798,16 @@ static PyObject *py_creds_set_named_ccache(PyObject *self, PyObject *args)
 static PyObject *py_creds_set_gensec_features(PyObject *self, PyObject *args)
 {
 	unsigned int gensec_features;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "I", &gensec_features))
 		return NULL;
 
-	cli_credentials_set_gensec_features(PyCredentials_AsCliCredentials(self), gensec_features);
+	cli_credentials_set_gensec_features(creds, gensec_features);
 
 	Py_RETURN_NONE;
 }
@@ -632,8 +815,13 @@ static PyObject *py_creds_set_gensec_features(PyObject *self, PyObject *args)
 static PyObject *py_creds_get_gensec_features(PyObject *self, PyObject *args)
 {
 	unsigned int gensec_features;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
-	gensec_features = cli_credentials_get_gensec_features(PyCredentials_AsCliCredentials(self));
+	gensec_features = cli_credentials_get_gensec_features(creds);
 	return PyInt_FromLong(gensec_features);
 }
 
@@ -644,6 +832,7 @@ static PyObject *py_creds_new_client_authenticator(PyObject *self,
 	struct cli_credentials *creds = NULL;
 	struct netlogon_creds_CredentialState *nc = NULL;
 	PyObject *ret = NULL;
+	NTSTATUS status;
 
 	creds = PyCredentials_AsCliCredentials(self);
 	if (creds == NULL) {
@@ -660,9 +849,13 @@ static PyObject *py_creds_new_client_authenticator(PyObject *self,
 		return NULL;
 	}
 
-	netlogon_creds_client_authenticator(
-		nc,
-		&auth);
+	status = netlogon_creds_client_authenticator(nc, &auth);
+	if (!NT_STATUS_IS_OK(status)) {
+		PyErr_SetString(PyExc_ValueError,
+				"Failed to create client authenticator");
+		return NULL;
+	}
+
 	ret = Py_BuildValue("{s"PYARG_BYTES_LEN"si}",
 			    "credential",
 			    (const char *) &auth.cred, sizeof(auth.cred),
@@ -673,12 +866,17 @@ static PyObject *py_creds_new_client_authenticator(PyObject *self,
 static PyObject *py_creds_set_secure_channel_type(PyObject *self, PyObject *args)
 {
 	unsigned int channel_type;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "I", &channel_type))
 		return NULL;
 
 	cli_credentials_set_secure_channel_type(
-		PyCredentials_AsCliCredentials(self),
+		creds,
 		channel_type);
 
 	Py_RETURN_NONE;
@@ -687,9 +885,13 @@ static PyObject *py_creds_set_secure_channel_type(PyObject *self, PyObject *args
 static PyObject *py_creds_get_secure_channel_type(PyObject *self, PyObject *args)
 {
 	enum netr_SchannelType channel_type = SEC_CHAN_NULL;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
-	channel_type = cli_credentials_get_secure_channel_type(
-		PyCredentials_AsCliCredentials(self));
+	channel_type = cli_credentials_get_secure_channel_type(creds);
 
 	return PyInt_FromLong(channel_type);
 }
@@ -704,11 +906,20 @@ static PyObject *py_creds_encrypt_netr_crypt_password(PyObject *self,
 	PyObject *py_cp = Py_None;
 
 	creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
-	if (!PyArg_ParseTuple(args, "|O", &py_cp)) {
+	if (!PyArg_ParseTuple(args, "O", &py_cp)) {
 		return NULL;
 	}
+
 	pwd = pytalloc_get_type(py_cp, struct netr_CryptPassword);
+	if (pwd == NULL) {
+		/* pytalloc_get_type sets TypeError */
+		return NULL;
+	}
 	data.length = sizeof(struct netr_CryptPassword);
 	data.data   = (uint8_t *)pwd;
 	status = netlogon_creds_session_encrypt(creds->netlogon_creds, data);
diff --git a/auth/credentials/pycredentials.h b/auth/credentials/pycredentials.h
index a136a21..bf6962c 100644
--- a/auth/credentials/pycredentials.h
+++ b/auth/credentials/pycredentials.h
@@ -20,12 +20,21 @@
 #define _PYCREDENTIALS_H_
 
 #include "auth/credentials/credentials.h"
+#include "librpc/rpc/pyrpc_util.h"
 #include <pytalloc.h>
 
 extern PyTypeObject PyCredentials;
 extern PyTypeObject PyCredentialCacheContainer;
-#define PyCredentials_Check(py_obj) PyObject_TypeCheck(py_obj, &PyCredentials)
-#define PyCredentials_AsCliCredentials(py_obj) pytalloc_get_type(py_obj, struct cli_credentials)
-#define cli_credentials_from_py_object(py_obj) (py_obj == Py_None)?cli_credentials_init_anon(NULL):PyCredentials_AsCliCredentials(py_obj)
+#define PyCredentials_Check(py_obj)					\
+	py_check_dcerpc_type(py_obj, "samba.credentials", "Credentials")
+
+#define PyCredentials_AsCliCredentials(py_obj)				\
+	(PyCredentials_Check(py_obj) ?					\
+	 pytalloc_get_type(py_obj, struct cli_credentials) : NULL)
+
+#define cli_credentials_from_py_object(py_obj)			 \
+	((py_obj == Py_None) ?					 \
+	 cli_credentials_init_anon(NULL) :			 \
+	 PyCredentials_AsCliCredentials(py_obj))
 
 #endif /*  _PYCREDENTIALS_H_ */
diff --git a/auth/gensec/gensec_util.c b/auth/gensec/gensec_util.c
index 20c9c2a..e185acc 100644
--- a/auth/gensec/gensec_util.c
+++ b/auth/gensec/gensec_util.c
@@ -76,7 +76,7 @@ NTSTATUS gensec_generate_session_info_pac(TALLOC_CTX *mem_ctx,
 static bool gensec_gssapi_check_oid(const DATA_BLOB *blob, const char *oid)
 {
 	bool ret = false;
-	struct asn1_data *data = asn1_init(NULL);
+	struct asn1_data *data = asn1_init(NULL, ASN1_MAX_TREE_DEPTH);
 
 	if (!data) return false;
 
diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c
index 74a3eb5..0cdae14 100644
--- a/auth/gensec/schannel.c
+++ b/auth/gensec/schannel.c
@@ -33,9 +33,12 @@
 #include "librpc/gen_ndr/dcerpc.h"
 #include "param/param.h"
 #include "auth/gensec/gensec_toplevel_proto.h"
-#include "lib/crypto/aes.h"
 #include "libds/common/roles.h"
 
+#ifndef HAVE_GNUTLS_AES_CFB8
+#include "lib/crypto/aes.h"
+#endif
+
 #include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
@@ -147,6 +150,43 @@ static NTSTATUS netsec_do_seq_num(struct schannel_state *state,
 				  uint8_t seq_num[8])
 {
 	if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+#ifdef HAVE_GNUTLS_AES_CFB8
+		gnutls_cipher_hd_t cipher_hnd = NULL;
+		gnutls_datum_t key = {
+			.data = state->creds->session_key,
+			.size = sizeof(state->creds->session_key),
+		};
+		uint32_t iv_size =
+			gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_128_CFB8);
+		uint8_t _iv[iv_size];
+		gnutls_datum_t iv = {
+			.data = _iv,
+			.size = iv_size,
+		};
+		int rc;
+
+		ZERO_ARRAY(_iv);
+
+		memcpy(iv.data + 0, checksum, 8);
+		memcpy(iv.data + 8, checksum, 8);
+
+		rc = gnutls_cipher_init(&cipher_hnd,
+					GNUTLS_CIPHER_AES_128_CFB8,
+					&key,
+					&iv);
+		if (rc < 0) {
+			return gnutls_error_to_ntstatus(rc,
+							NT_STATUS_CRYPTO_SYSTEM_INVALID);
+		}
+
+		rc = gnutls_cipher_encrypt(cipher_hnd, seq_num, 8);
+		gnutls_cipher_deinit(cipher_hnd);
+		if (rc < 0) {
+			return gnutls_error_to_ntstatus(rc,
+							NT_STATUS_CRYPTO_SYSTEM_INVALID);
+		}
+
+#else /* NOT HAVE_GNUTLS_AES_CFB8 */
 		AES_KEY key;
 		uint8_t iv[AES_BLOCK_SIZE];
 
@@ -156,6 +196,7 @@ static NTSTATUS netsec_do_seq_num(struct schannel_state *state,
 		memcpy(iv+8, checksum, 8);
 
 		aes_cfb8_encrypt(seq_num, seq_num, 8, &key, iv, AES_ENCRYPT);
+#endif /* HAVE_GNUTLS_AES_CFB8 */
 	} else {
 		static const uint8_t zeros[4];
 		uint8_t _sequence_key[16];
@@ -220,6 +261,100 @@ static NTSTATUS netsec_do_seal(struct schannel_state *state,
 			       bool forward)
 {
 	if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+#ifdef HAVE_GNUTLS_AES_CFB8
+		gnutls_cipher_hd_t cipher_hnd = NULL;
+		uint8_t sess_kf0[16] = {0};
+		gnutls_datum_t key = {
+			.data = sess_kf0,
+			.size = sizeof(sess_kf0),
+		};
+		uint32_t iv_size =
+			gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_128_CFB8);
+		uint8_t _iv[iv_size];
+		gnutls_datum_t iv = {
+			.data = _iv,
+			.size = iv_size,
+		};
+		uint32_t i;
+		int rc;
+
+		for (i = 0; i < key.size; i++) {
+			key.data[i] = state->creds->session_key[i] ^ 0xf0;
+		}
+
+		ZERO_ARRAY(_iv);
+
+		memcpy(iv.data + 0, seq_num, 8);
+		memcpy(iv.data + 8, seq_num, 8);
+
+		rc = gnutls_cipher_init(&cipher_hnd,
+					GNUTLS_CIPHER_AES_128_CFB8,
+					&key,
+					&iv);
+		if (rc < 0) {
+			DBG_ERR("ERROR: gnutls_cipher_init: %s\n",
+				gnutls_strerror(rc));
+			return NT_STATUS_NO_MEMORY;
+		}
+
+		if (forward) {
+			rc = gnutls_cipher_encrypt(cipher_hnd,
+						   confounder,
+						   8);
+			if (rc < 0) {
+				gnutls_cipher_deinit(cipher_hnd);
+				return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
+			}
+
+			rc = gnutls_cipher_encrypt(cipher_hnd,
+						   data,
+						   length);
+			if (rc < 0) {
+				gnutls_cipher_deinit(cipher_hnd);
+				return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
+			}
+		} else {
+
+			/*
+			 * Workaround bug present in gnutls 3.6.8:
+			 *
+			 * gnutls_cipher_decrypt() uses an optimization
+			 * internally that breaks decryption when processing
+			 * buffers with their length not being a multiple
+			 * of the blocksize.
+			 */
+
+			uint8_t tmp[16] = { 0, };
+			uint32_t tmp_dlength = MIN(length, sizeof(tmp) - 8);
+
+			memcpy(tmp, confounder, 8);
+			memcpy(tmp + 8, data, tmp_dlength);
+
+			rc = gnutls_cipher_decrypt(cipher_hnd,
+						   tmp,
+						   8 + tmp_dlength);
+			if (rc < 0) {
+				ZERO_STRUCT(tmp);
+				gnutls_cipher_deinit(cipher_hnd);
+				return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
+			}
+
+			memcpy(confounder, tmp, 8);
+			memcpy(data, tmp + 8, tmp_dlength);
+			ZERO_STRUCT(tmp);
+
+			if (length > tmp_dlength) {
+				rc = gnutls_cipher_decrypt(cipher_hnd,
+							   data + tmp_dlength,
+							   length - tmp_dlength);
+				if (rc < 0) {
+					gnutls_cipher_deinit(cipher_hnd);
+					return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
+				}
+			}
+		}
+		gnutls_cipher_deinit(cipher_hnd);
+#else /* NOT HAVE_GNUTLS_AES_CFB8 */
 		AES_KEY key;
 		uint8_t iv[AES_BLOCK_SIZE];
 		uint8_t sess_kf0[16];
@@ -241,6 +376,7 @@ static NTSTATUS netsec_do_seal(struct schannel_state *state,
 			aes_cfb8_encrypt(confounder, confounder, 8, &key, iv, AES_DECRYPT);
 			aes_cfb8_encrypt(data, data, length, &key, iv, AES_DECRYPT);
 		}
+#endif /* HAVE_GNUTLS_AES_CFB8 */
 	} else {
 		gnutls_cipher_hd_t cipher_hnd;
 		uint8_t _sealing_key[16];
@@ -266,7 +402,7 @@ static NTSTATUS netsec_do_seal(struct schannel_state *state,
 				      digest2);
 		if (rc < 0) {
 			ZERO_ARRAY(digest2);
-			return NT_STATUS_INTERNAL_ERROR;
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_HMAC_NOT_SUPPORTED);
 		}
 
 		rc = gnutls_hmac_fast(GNUTLS_MAC_MD5,
@@ -278,7 +414,7 @@ static NTSTATUS netsec_do_seal(struct schannel_state *state,
 
 		ZERO_ARRAY(digest2);
 		if (rc < 0) {
-			return NT_STATUS_INTERNAL_ERROR;
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_HMAC_NOT_SUPPORTED);
 		}
 
 		rc = gnutls_cipher_init(&cipher_hnd,
@@ -337,7 +473,7 @@ static NTSTATUS netsec_do_sign(struct schannel_state *state,
 				      state->creds->session_key,
 				      sizeof(state->creds->session_key));
 		if (rc < 0) {
-			return NT_STATUS_NO_MEMORY;
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_HMAC_NOT_SUPPORTED);
 		}
 
 		if (confounder) {
diff --git a/auth/gensec/spnego.c b/auth/gensec/spnego.c
index ddbe03c..db8a91b 100644
--- a/auth/gensec/spnego.c
+++ b/auth/gensec/spnego.c
@@ -72,7 +72,7 @@ struct spnego_neg_ops {
 	 * 'in_next'. Note that 'in_mem_ctx' is just passed as a hint, the
 	 * caller should treat 'in_next' as const and don't attempt to free the
 	 * content.  NT_STATUS_OK indicates the finish hook should be invoked
-	 * directly withing the need of gensec_update() on the subcontext.
+	 * directly within the need of gensec_update() on the subcontext.
 	 * Every other error indicates an error that's returned to the caller.
 	 */
 	NTSTATUS (*start_fn)(struct gensec_security *gensec_security,
@@ -90,7 +90,7 @@ struct spnego_neg_ops {
 	 * 'in_next'. Note that 'in_mem_ctx' is just passed as a hint, the
 	 * caller should treat 'in_next' as const and don't attempt to free the
 	 * content.  NT_STATUS_OK indicates the finish hook should be invoked
-	 * directly withing the need of gensec_update() on the subcontext.
+	 * directly within the need of gensec_update() on the subcontext.
 	 * Every other error indicates an error that's returned to the caller.
 	 */
 	NTSTATUS (*step_fn)(struct gensec_security *gensec_security,
@@ -900,8 +900,6 @@ static NTSTATUS gensec_spnego_client_negTokenTarg_finish(
 	NTSTATUS status;
 	struct spnego_data spnego_out;
 
-	status = sub_status;
-
 	if (!spnego_state->sub_sec_ready) {
 		/*
 		 * We're not yet ready to deal with signatures.
diff --git a/auth/ntlmssp/ntlmssp_client.c b/auth/ntlmssp/ntlmssp_client.c
index df891f8..58e4e3d 100644
--- a/auth/ntlmssp/ntlmssp_client.c
+++ b/auth/ntlmssp/ntlmssp_client.c
@@ -673,12 +673,20 @@ NTSTATUS ntlmssp_client_challenge(struct gensec_security *gensec_security,
 	    && ntlmssp_state->allow_lm_key && lm_session_key.length == 16) {
 		DATA_BLOB new_session_key = data_blob_talloc(mem_ctx, NULL, 16);
 		if (lm_response.length == 24) {
-			SMBsesskeygen_lm_sess_key(lm_session_key.data, lm_response.data,
-						  new_session_key.data);
+			nt_status = SMBsesskeygen_lm_sess_key(lm_session_key.data,
+							      lm_response.data,
+							      new_session_key.data);
+			if (!NT_STATUS_IS_OK(nt_status)) {
+				return nt_status;
+			}
 		} else {
 			static const uint8_t zeros[24];
-			SMBsesskeygen_lm_sess_key(lm_session_key.data, zeros,
-						  new_session_key.data);
+			nt_status = SMBsesskeygen_lm_sess_key(lm_session_key.data,
+                                                              zeros,
+                                                              new_session_key.data);
+			if (!NT_STATUS_IS_OK(nt_status)) {
+				return nt_status;
+			}
 		}
 		session_key = new_session_key;
 		dump_data_pw("LM session key\n", session_key.data, session_key.length);
@@ -690,17 +698,43 @@ NTSTATUS ntlmssp_client_challenge(struct gensec_security *gensec_security,
 	if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
 		/* Make up a new session key */
 		uint8_t client_session_key[16];
-		generate_secret_buffer(client_session_key, sizeof(client_session_key));
+		gnutls_cipher_hd_t cipher_hnd;
+		gnutls_datum_t enc_session_key = {
+			.data = session_key.data,
+			.size = session_key.length,
+		};
+
+		generate_random_buffer(client_session_key, sizeof(client_session_key));
 
 		/* Encrypt the new session key with the old one */
 		encrypted_session_key = data_blob_talloc(ntlmssp_state,
 							 client_session_key, sizeof(client_session_key));
 		dump_data_pw("KEY_EXCH session key:\n", encrypted_session_key.data, encrypted_session_key.length);
-		arcfour_crypt(encrypted_session_key.data, session_key.data, encrypted_session_key.length);
+
+		rc = gnutls_cipher_init(&cipher_hnd,
+					GNUTLS_CIPHER_ARCFOUR_128,
+					&enc_session_key,
+					NULL);
+		if (rc < 0) {
+			nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_NTLM_BLOCKED);
+			ZERO_ARRAY(client_session_key);
+			goto done;
+		}
+		rc = gnutls_cipher_encrypt(cipher_hnd,
+					   encrypted_session_key.data,
+					   encrypted_session_key.length);
+		gnutls_cipher_deinit(cipher_hnd);
+		if (rc < 0) {
+			nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_NTLM_BLOCKED);
+			ZERO_ARRAY(client_session_key);
+			goto done;
+		}
+
 		dump_data_pw("KEY_EXCH session key (enc):\n", encrypted_session_key.data, encrypted_session_key.length);
 
 		/* Mark the new session key as the 'real' session key */
 		session_key = data_blob_talloc(mem_ctx, client_session_key, sizeof(client_session_key));
+		ZERO_ARRAY(client_session_key);
 	}
 
 	/* this generates the actual auth packet */
diff --git a/auth/ntlmssp/ntlmssp_private.h b/auth/ntlmssp/ntlmssp_private.h
index 95ec637..4d84e33 100644
--- a/auth/ntlmssp/ntlmssp_private.h
+++ b/auth/ntlmssp/ntlmssp_private.h
@@ -20,14 +20,15 @@
 
 /* For structures internal to the NTLMSSP implementation that should not be exposed */
 
-#include "../lib/crypto/arcfour.h"
+#include <gnutls/gnutls.h>
+#include <gnutls/crypto.h>
 
 struct auth_session_info;
 
 struct ntlmssp_crypt_direction {
 	uint32_t seq_num;
 	uint8_t sign_key[16];
-	struct arcfour_state seal_state;
+	gnutls_cipher_hd_t seal_state;
 };
 
 union ntlmssp_crypt_state {
diff --git a/auth/ntlmssp/ntlmssp_server.c b/auth/ntlmssp/ntlmssp_server.c
index 5a56a4d..0012382 100644
--- a/auth/ntlmssp/ntlmssp_server.c
+++ b/auth/ntlmssp/ntlmssp_server.c
@@ -335,8 +335,8 @@ struct tevent_req *ntlmssp_server_auth_send(TALLOC_CTX *mem_ctx,
 				      struct gensec_ntlmssp_context);
 	struct auth4_context *auth_context = gensec_security->auth_context;
 	struct tevent_req *req = NULL;
+	struct tevent_req *subreq = NULL;
 	struct ntlmssp_server_auth_state *state = NULL;
-	uint8_t authoritative = 0;
 	NTSTATUS status;
 
 	req = tevent_req_create(mem_ctx, &state,
@@ -355,54 +355,13 @@ struct tevent_req *ntlmssp_server_auth_send(TALLOC_CTX *mem_ctx,
 		return tevent_req_post(req, ev);
 	}
 
-	if (auth_context->check_ntlm_password_send != NULL) {
-		struct tevent_req *subreq = NULL;
-
-		subreq = auth_context->check_ntlm_password_send(state, ev,
-						auth_context,
-						state->user_info);
-		if (tevent_req_nomem(subreq, req)) {
-			return tevent_req_post(req, ev);
-		}
-		tevent_req_set_callback(subreq,
-					ntlmssp_server_auth_done,
-					req);
-		return req;
-	}
-
-	if (auth_context->check_ntlm_password == NULL) {
-		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
-		return tevent_req_post(req, ev);
-	}
-
-	status = auth_context->check_ntlm_password(auth_context,
-						   gensec_ntlmssp,
-						   state->user_info,
-						   &authoritative,
-						   &gensec_ntlmssp->server_returned_info,
-						   &state->user_session_key,
-						   &state->lm_session_key);
-	if (!NT_STATUS_IS_OK(status)) {
-		DBG_INFO("Checking NTLMSSP password for %s\\%s failed: %s\n",
-			 state->user_info->client.domain_name,
-			 state->user_info->client.account_name,
-			 nt_errstr(status));
-	}
-	if (tevent_req_nterror(req, status)) {
+	subreq = auth_context->check_ntlm_password_send(
+		state, ev, auth_context, state->user_info);
+	if (tevent_req_nomem(subreq, req)) {
 		return tevent_req_post(req, ev);
 	}
-	talloc_steal(state, state->user_session_key.data);
-	talloc_steal(state, state->lm_session_key.data);
-
-	status = ntlmssp_server_postauth(gensec_security,
-					 gensec_ntlmssp,
-					 state, in);
-	if (tevent_req_nterror(req, status)) {
-		return tevent_req_post(req, ev);
-	}
-
-	tevent_req_done(req);
-	return tevent_req_post(req, ev);
+	tevent_req_set_callback(subreq,	ntlmssp_server_auth_done, req);
+	return req;
 }
 
 /**
@@ -970,8 +929,12 @@ static NTSTATUS ntlmssp_server_postauth(struct gensec_security *gensec_security,
 				if (session_key.data == NULL) {
 					return NT_STATUS_NO_MEMORY;
 				}
-				SMBsesskeygen_lm_sess_key(lm_session_key.data, ntlmssp_state->lm_resp.data,
-							  session_key.data);
+				nt_status = SMBsesskeygen_lm_sess_key(lm_session_key.data,
+								      ntlmssp_state->lm_resp.data,
+								      session_key.data);
+				if (!NT_STATUS_IS_OK(nt_status)) {
+					return nt_status;
+				}
 				DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
 			} else {
 				static const uint8_t zeros[24] = {0, };
@@ -980,8 +943,11 @@ static NTSTATUS ntlmssp_server_postauth(struct gensec_security *gensec_security,
 				if (session_key.data == NULL) {
 					return NT_STATUS_NO_MEMORY;
 				}
-				SMBsesskeygen_lm_sess_key(zeros, zeros,
-							  session_key.data);
+				nt_status = SMBsesskeygen_lm_sess_key(zeros, zeros,
+								      session_key.data);
+				if (!NT_STATUS_IS_OK(nt_status)) {
+					return nt_status;
+				}
 				DEBUG(10,("ntlmssp_server_auth: Created NTLM session key.\n"));
 			}
 			dump_data_pw("LM session key:\n", session_key.data,
diff --git a/auth/ntlmssp/ntlmssp_sign.c b/auth/ntlmssp/ntlmssp_sign.c
index 8ba2e24..89f1aa0 100644
--- a/auth/ntlmssp/ntlmssp_sign.c
+++ b/auth/ntlmssp/ntlmssp_sign.c
@@ -47,9 +47,9 @@
  */
 
 static void dump_arc4_state(const char *description,
-			    struct arcfour_state *state)
+			    gnutls_cipher_hd_t *state)
 {
-	dump_data_pw(description, state->sbox, sizeof(state->sbox));
+	DBG_DEBUG("%s\n", description);
 }
 
 static NTSTATUS calc_ntlmv2_key(uint8_t subkey[16],
@@ -90,13 +90,13 @@ static NTSTATUS ntlmssp_make_packet_signature(struct ntlmssp_state *ntlmssp_stat
 					      enum ntlmssp_direction direction,
 					      DATA_BLOB *sig, bool encrypt_sig)
 {
-	NTSTATUS status;
+	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
+	int rc;
 
 	if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 		gnutls_hmac_hd_t hmac_hnd = NULL;
 		uint8_t digest[16];
 		uint8_t seq_num[4];
-		int rc;
 
 		*sig = data_blob_talloc(sig_mem_ctx, NULL, NTLMSSP_SIG_SIZE);
 		if (!sig->data) {
@@ -158,14 +158,24 @@ static NTSTATUS ntlmssp_make_packet_signature(struct ntlmssp_state *ntlmssp_stat
 		if (encrypt_sig && (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH)) {
 			switch (direction) {
 			case NTLMSSP_SEND:
-				arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.sending.seal_state,
-						   digest, 8);
+				rc = gnutls_cipher_encrypt(ntlmssp_state->crypt->ntlm2.sending.seal_state,
+							   digest,
+							   8);
 				break;
 			case NTLMSSP_RECEIVE:
-				arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.receiving.seal_state,
-						   digest, 8);
+				rc = gnutls_cipher_encrypt(ntlmssp_state->crypt->ntlm2.receiving.seal_state,
+							   digest,
+							   8);
 				break;
 			}
+			if (rc < 0) {
+				DBG_ERR("gnutls_cipher_encrypt for NTLMv2 EXCH "
+					"%s packet signature failed: %s\n",
+					direction == NTLMSSP_SEND ?
+						"send" : "receive",
+					gnutls_strerror(rc));
+				return gnutls_error_to_ntstatus(rc, NT_STATUS_NTLM_BLOCKED);
+			}
 		}
 
 		SIVAL(sig->data, 0, NTLMSSP_SIGN_VERSION);
@@ -194,8 +204,15 @@ static NTSTATUS ntlmssp_make_packet_signature(struct ntlmssp_state *ntlmssp_stat
 
 		dump_arc4_state("ntlmssp hash: \n",
 				&ntlmssp_state->crypt->ntlm.seal_state);
-		arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm.seal_state,
-				   sig->data+4, sig->length-4);
+		rc = gnutls_cipher_encrypt(ntlmssp_state->crypt->ntlm.seal_state,
+					   sig->data + 4,
+					   sig->length - 4);
+		if (rc < 0) {
+			DBG_ERR("gnutls_cipher_encrypt for NTLM packet "
+				"signature failed: %s\n",
+				gnutls_strerror(rc));
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_NTLM_BLOCKED);
+		}
 	}
 
 	return NT_STATUS_OK;
@@ -317,6 +334,8 @@ NTSTATUS ntlmssp_seal_packet(struct ntlmssp_state *ntlmssp_state,
 			     const uint8_t *whole_pdu, size_t pdu_length,
 			     DATA_BLOB *sig)
 {
+	int rc;
+
 	if (!(ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 		DEBUG(3, ("NTLMSSP Sealing not negotiated - cannot seal packet!\n"));
 		return NT_STATUS_INVALID_PARAMETER;
@@ -353,11 +372,25 @@ NTSTATUS ntlmssp_seal_packet(struct ntlmssp_state *ntlmssp_state,
 			return nt_status;
 		}
 
-		arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.sending.seal_state,
-				   data, length);
+		rc = gnutls_cipher_encrypt(ntlmssp_state->crypt->ntlm2.sending.seal_state,
+					   data,
+					   length);
+		if (rc < 0) {
+			DBG_ERR("gnutls_cipher_encrypt ntlmv2 sealing the data "
+				"failed: %s\n",
+				gnutls_strerror(rc));
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_NTLM_BLOCKED);
+		}
 		if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
-			arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.sending.seal_state,
-					   sig->data+4, 8);
+			rc = gnutls_cipher_encrypt(ntlmssp_state->crypt->ntlm2.sending.seal_state,
+						    sig->data + 4,
+						    8);
+			if (rc < 0) {
+				DBG_ERR("gnutls_cipher_encrypt ntlmv2 sealing "
+					"the EXCH signature data failed: %s\n",
+					gnutls_strerror(rc));
+				return gnutls_error_to_ntstatus(rc, NT_STATUS_NTLM_BLOCKED);
+			}
 		}
 	} else {
 		NTSTATUS status;
@@ -381,17 +414,30 @@ NTSTATUS ntlmssp_seal_packet(struct ntlmssp_state *ntlmssp_state,
 		 * is not constant, but is is rather updated with
 		 * each iteration
 		 */
-
 		dump_arc4_state("ntlmv1 arc4 state:\n",
 				&ntlmssp_state->crypt->ntlm.seal_state);
-		arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm.seal_state,
-				   data, length);
+		rc = gnutls_cipher_encrypt(ntlmssp_state->crypt->ntlm.seal_state,
+					   data,
+					   length);
+		if (rc < 0) {
+			DBG_ERR("gnutls_cipher_encrypt ntlmv1 sealing data"
+				"failed: %s\n",
+				gnutls_strerror(rc));
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_NTLM_BLOCKED);
+		}
 
 		dump_arc4_state("ntlmv1 arc4 state:\n",
 				&ntlmssp_state->crypt->ntlm.seal_state);
 
-		arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm.seal_state,
-				   sig->data+4, sig->length-4);
+		rc = gnutls_cipher_encrypt(ntlmssp_state->crypt->ntlm.seal_state,
+					    sig->data + 4,
+					    sig->length - 4);
+		if (rc < 0) {
+			DBG_ERR("gnutls_cipher_encrypt ntlmv1 sealing signing "
+				"data failed: %s\n",
+				gnutls_strerror(rc));
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_NTLM_BLOCKED);
+		}
 
 		ntlmssp_state->crypt->ntlm.seq_num++;
 	}
@@ -412,6 +458,8 @@ NTSTATUS ntlmssp_unseal_packet(struct ntlmssp_state *ntlmssp_state,
 			       const DATA_BLOB *sig)
 {
 	NTSTATUS status;
+	int rc;
+
 	if (!ntlmssp_state->session_key.length) {
 		DEBUG(3, ("NO session key, cannot unseal packet\n"));
 		return NT_STATUS_NO_USER_SESSION_KEY;
@@ -422,14 +470,29 @@ NTSTATUS ntlmssp_unseal_packet(struct ntlmssp_state *ntlmssp_state,
 
 	if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
 		/* First unseal the data. */
-		arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm2.receiving.seal_state,
-				   data, length);
+		rc = gnutls_cipher_decrypt(ntlmssp_state->crypt->ntlm2.receiving.seal_state,
+					   data,
+					   length);
+		if (rc < 0) {
+			DBG_ERR("gnutls_cipher_decrypt ntlmv2 unsealing the "
+				"data failed: %s\n",
+				gnutls_strerror(rc));
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_NTLM_BLOCKED);
+		}
 		dump_data_pw("ntlmv2 clear data\n", data, length);
 	} else {
-		arcfour_crypt_sbox(&ntlmssp_state->crypt->ntlm.seal_state,
-				   data, length);
+		rc = gnutls_cipher_decrypt(ntlmssp_state->crypt->ntlm.seal_state,
+					   data,
+					   length);
+		if (rc < 0) {
+			DBG_ERR("gnutls_cipher_decrypt ntlmv1 unsealing the "
+				"data failed: %s\n",
+				gnutls_strerror(rc));
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_NTLM_BLOCKED);
+		}
 		dump_data_pw("ntlmv1 clear data\n", data, length);
 	}
+
 	status = ntlmssp_check_packet(ntlmssp_state,
 				      data, length,
 				      whole_pdu, pdu_length,
@@ -555,6 +618,8 @@ NTSTATUS ntlmssp_unwrap(struct ntlmssp_state *ntlmssp_state,
 NTSTATUS ntlmssp_sign_reset(struct ntlmssp_state *ntlmssp_state,
 			    bool reset_seqnums)
 {
+	int rc;
+
 	DEBUG(3, ("NTLMSSP Sign/Seal - Initialising with flags:\n"));
 	debug_ntlmssp_flags(ntlmssp_state->neg_flags);
 
@@ -584,12 +649,16 @@ NTSTATUS ntlmssp_sign_reset(struct ntlmssp_state *ntlmssp_state,
 		const char *send_seal_const;
 		const char *recv_sign_const;
 		const char *recv_seal_const;
-		uint8_t send_seal_key[16];
-		DATA_BLOB send_seal_blob = data_blob_const(send_seal_key,
-					   sizeof(send_seal_key));
-		uint8_t recv_seal_key[16];
-		DATA_BLOB recv_seal_blob = data_blob_const(recv_seal_key,
-					   sizeof(recv_seal_key));
+		uint8_t send_seal_key[16] = {0};
+		gnutls_datum_t send_seal_blob = {
+			.data = send_seal_key,
+			.size = sizeof(send_seal_key),
+		};
+		uint8_t recv_seal_key[16] = {0};
+		gnutls_datum_t recv_seal_blob = {
+			.data = recv_seal_key,
+			.size = sizeof(recv_seal_key),
+		};
 		NTSTATUS status;
 
 		switch (ntlmssp_state->role) {
@@ -648,10 +717,22 @@ NTSTATUS ntlmssp_sign_reset(struct ntlmssp_state *ntlmssp_state,
 		if (!NT_STATUS_IS_OK(status)) {
 			return status;
 		}
-		dump_data_pw("NTLMSSP send seal key:\n", send_seal_key, 16);
+		dump_data_pw("NTLMSSP send seal key:\n",
+			     send_seal_key,
+			     sizeof(send_seal_key));
 
-		arcfour_init(&ntlmssp_state->crypt->ntlm2.sending.seal_state,
-			     &send_seal_blob);
+		if (ntlmssp_state->crypt->ntlm2.sending.seal_state != NULL) {
+			gnutls_cipher_deinit(ntlmssp_state->crypt->ntlm2.sending.seal_state);
+		}
+		rc = gnutls_cipher_init(&ntlmssp_state->crypt->ntlm2.sending.seal_state,
+					GNUTLS_CIPHER_ARCFOUR_128,
+					&send_seal_blob,
+					NULL);
+		if (rc < 0) {
+			DBG_ERR("gnutls_cipher_init failed: %s\n",
+				gnutls_strerror(rc));
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_NTLM_BLOCKED);
+		}
 
 		dump_arc4_state("NTLMSSP send seal arc4 state:\n",
 				&ntlmssp_state->crypt->ntlm2.sending.seal_state);
@@ -677,10 +758,22 @@ NTSTATUS ntlmssp_sign_reset(struct ntlmssp_state *ntlmssp_state,
 		if (!NT_STATUS_IS_OK(status)) {
 			return status;
 		}
-		dump_data_pw("NTLMSSP recv seal key:\n", recv_seal_key, 16);
+		dump_data_pw("NTLMSSP recv seal key:\n",
+			     recv_seal_key,
+			     sizeof(recv_seal_key));
 
-		arcfour_init(&ntlmssp_state->crypt->ntlm2.receiving.seal_state,
-			     &recv_seal_blob);
+		if (ntlmssp_state->crypt->ntlm2.receiving.seal_state != NULL) {
+			gnutls_cipher_deinit(ntlmssp_state->crypt->ntlm2.receiving.seal_state);
+		}
+		rc = gnutls_cipher_init(&ntlmssp_state->crypt->ntlm2.receiving.seal_state,
+					GNUTLS_CIPHER_ARCFOUR_128,
+					&recv_seal_blob,
+					NULL);
+		if (rc < 0) {
+			DBG_ERR("gnutls_cipher_init failed: %s\n",
+				gnutls_strerror(rc));
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_NTLM_BLOCKED);
+		}
 
 		dump_arc4_state("NTLMSSP recv seal arc4 state:\n",
 				&ntlmssp_state->crypt->ntlm2.receiving.seal_state);
@@ -690,8 +783,10 @@ NTSTATUS ntlmssp_sign_reset(struct ntlmssp_state *ntlmssp_state,
 			ntlmssp_state->crypt->ntlm2.receiving.seq_num = 0;
 		}
 	} else {
-		uint8_t weak_session_key[8];
-		DATA_BLOB seal_session_key = ntlmssp_state->session_key;
+		gnutls_datum_t seal_session_key = {
+			.data = ntlmssp_state->session_key.data,
+			.size = ntlmssp_state->session_key.length,
+		};
 		bool do_weak = false;
 
 		DEBUG(5, ("NTLMSSP Sign/Seal - using NTLM1\n"));
@@ -709,14 +804,19 @@ NTSTATUS ntlmssp_sign_reset(struct ntlmssp_state *ntlmssp_state,
 		 * Nothing to weaken.
 		 * We certainly don't want to 'extend' the length...
 		 */
-		if (seal_session_key.length < 16) {
+		if (ntlmssp_state->session_key.length < 16) {
 			/* TODO: is this really correct? */
 			do_weak = false;
 		}
 
 		if (do_weak) {
+			uint8_t weak_session_key[8];
+
 			memcpy(weak_session_key, seal_session_key.data, 8);
-			seal_session_key = data_blob_const(weak_session_key, 8);
+			seal_session_key = (gnutls_datum_t) {
+				.data = weak_session_key,
+				.size = sizeof(weak_session_key),
+			};
 
 			/*
 			 * LM key doesn't support 128 bit crypto, so this is
@@ -732,8 +832,18 @@ NTSTATUS ntlmssp_sign_reset(struct ntlmssp_state *ntlmssp_state,
 			}
 		}
 
-		arcfour_init(&ntlmssp_state->crypt->ntlm.seal_state,
-			     &seal_session_key);
+		if (ntlmssp_state->crypt->ntlm.seal_state != NULL) {
+			gnutls_cipher_deinit(ntlmssp_state->crypt->ntlm.seal_state);
+		}
+		rc = gnutls_cipher_init(&ntlmssp_state->crypt->ntlm.seal_state,
+					GNUTLS_CIPHER_ARCFOUR_128,
+					&seal_session_key,
+					NULL);
+		if (rc < 0) {
+			DBG_ERR("gnutls_cipher_init failed: %s\n",
+				gnutls_strerror(rc));
+			return gnutls_error_to_ntstatus(rc, NT_STATUS_NTLM_BLOCKED);
+		}
 
 		dump_arc4_state("NTLMv1 arc4 state:\n",
 				&ntlmssp_state->crypt->ntlm.seal_state);
@@ -746,6 +856,24 @@ NTSTATUS ntlmssp_sign_reset(struct ntlmssp_state *ntlmssp_state,
 	return NT_STATUS_OK;
 }
 
+static int ntlmssp_crypt_free_gnutls_cipher_state(union ntlmssp_crypt_state *c)
+{
+	if (c->ntlm2.sending.seal_state != NULL) {
+		gnutls_cipher_deinit(c->ntlm2.sending.seal_state);
+		c->ntlm2.sending.seal_state = NULL;
+	}
+	if (c->ntlm2.receiving.seal_state != NULL) {
+		gnutls_cipher_deinit(c->ntlm2.receiving.seal_state);
+		c->ntlm2.receiving.seal_state = NULL;
+	}
+	if (c->ntlm.seal_state != NULL) {
+		gnutls_cipher_deinit(c->ntlm.seal_state);
+		c->ntlm.seal_state = NULL;
+	}
+
+	return 0;
+}
+
 NTSTATUS ntlmssp_sign_init(struct ntlmssp_state *ntlmssp_state)
 {
 	if (ntlmssp_state->session_key.length < 8) {
@@ -758,6 +886,8 @@ NTSTATUS ntlmssp_sign_init(struct ntlmssp_state *ntlmssp_state)
 	if (ntlmssp_state->crypt == NULL) {
 		return NT_STATUS_NO_MEMORY;
 	}
+	talloc_set_destructor(ntlmssp_state->crypt,
+			      ntlmssp_crypt_free_gnutls_cipher_state);
 
 	return ntlmssp_sign_reset(ntlmssp_state, true);
 }
diff --git a/bootstrap/.gitlab-ci.yml b/bootstrap/.gitlab-ci.yml
index 8bec8cc..aa0b644 100644
--- a/bootstrap/.gitlab-ci.yml
+++ b/bootstrap/.gitlab-ci.yml
@@ -6,6 +6,7 @@ services:
   stage: images
   tags:
     - docker
+    - gce
   variables:
     SAMBA_CI_IS_BROKEN_IMAGE: "no"
   before_script:
@@ -41,7 +42,7 @@ services:
     diff -u bootstrap/sha1sum.txt /tmp/sha1sum-template.txt
     # run smoke test with samba-o3
     docker run --volume $(pwd):${samba_repo_root} --workdir ${samba_repo_root} ${ci_image_name} \
-        /bin/bash -c "sudo chown -R samba:samba ./** && script/autobuild.py samba-o3 --verbose --nocleanup --keeplogs --tail --testbase /tmp/samba-testbase"
+        /bin/bash -c "sudo chown -R samba:samba ./** && export PKG_CONFIG_PATH=/usr/lib64/compat-gnutls34/pkgconfig:/usr/lib64/compat-nettle32/pkgconfig && script/autobuild.py samba-o3 --verbose --nocleanup --keeplogs --tail --testbase /tmp/samba-testbase"
     docker tag ${ci_image_name} ${ci_image_path}:${SAMBA_CI_CONTAINER_TAG}
     docker tag ${ci_image_name} ${ci_image_path}:${timestamp_tag}
     # We build all images, but only upload is it's not marked as broken
@@ -91,6 +92,9 @@ ubuntu1604:
 ubuntu1404:
   extends: .build_image_template_force_broken
 
+debian10:
+  extends: .build_image_template
+
 debian9:
   extends: .build_image_template
 
@@ -100,20 +104,25 @@ debian8:
 debian7:
   extends: .build_image_template_force_broken
 
+fedora31:
+  extends: .build_image_template
+
 fedora30:
   extends: .build_image_template
 
 fedora29:
   extends: .build_image_template
 
-fedora28:
-  extends: .build_image_template_force_broken
+centos8:
+  extends: .build_image_template
 
 centos7:
   extends: .build_image_template
   variables:
     # Shallow copies are not supported by git on CentOS7
     GIT_DEPTH: ""
+    # We install a compat-gnutls34 package for GnuTLS >= 3.4.7
+    PKG_CONFIG_PATH: /usr/lib64/compat-gnutls34/pkgconfig:/usr/lib64/compat-nettle32/pkgconfig
 
 centos6:
   extends: .build_image_template_force_broken
diff --git a/bootstrap/READMD.md b/bootstrap/READMD.md
index d653d6d..b8a3009 100644
--- a/bootstrap/READMD.md
+++ b/bootstrap/READMD.md
@@ -12,7 +12,7 @@ A pure python3 module with CLI to bootstrap Samba envs for multiple distribution
 
 ## Supported Distributions
 
-deb: Debian 7|8|9, Ubuntu 1404|1604|1804
+deb: Debian 7|8|9|10, Ubuntu 1404|1604|1804
 rpm: CentOS 6|7, Fedora 28|29, openSUSE Leap 15.0|15.1
 
 Easy to add more.
diff --git a/bootstrap/config.py b/bootstrap/config.py
index a83a3ef..bcada1d 100644
--- a/bootstrap/config.py
+++ b/bootstrap/config.py
@@ -37,6 +37,7 @@ COMMON = [
     'binutils',
     'bison',
     'curl',
+    'chrpath',
     'flex',
     'gcc',
     'gdb',
@@ -66,10 +67,9 @@ PKGS = [
     # NAME1-dev, NAME2-devel
     ('lmdb-utils', 'lmdb'),
     ('mingw-w64', 'mingw64-gcc'),
-    ('nettle-dev', 'nettle-devel'),
     ('zlib1g-dev', 'zlib-devel'),
     ('libbsd-dev', 'libbsd-devel'),
-    ('libaio-dev', 'libaio-devel'),
+    ('liburing-dev', 'liburing-devel'),
     ('libarchive-dev', 'libarchive-devel'),
     ('libblkid-dev', 'libblkid-devel'),
     ('libcap-dev', 'libcap-devel'),
@@ -128,22 +128,11 @@ PKGS = [
     ('', 'rpcsvc-proto-devel'), # for <rpcsvc/rquota.h> header
     ('mawk', 'gawk'),
 
-    # python
-    ('python-dev', 'python-devel'),
-    ('python-dbg', ''),
-    ('python-iso8601', ''),
-    ('python-gpg', 'python2-gpg'),  # defaults to ubuntu/fedora latest
-    ('python-crypto', 'python-crypto'),
-    ('python-markdown', 'python-markdown'),
-    ('python-dnspython', 'python-dns'),
-    ('python-pexpect', ''),  # for wintest only
-
     ('python3', 'python3'),
     ('python3-dev', 'python3-devel'),
     ('python3-dbg', ''),
     ('python3-iso8601', ''),
     ('python3-gpg', 'python3-gpg'),  # defaults to ubuntu/fedora latest
-    ('python3-crypto', 'python3-crypto'),
     ('python3-markdown', 'python3-markdown'),
     ('python3-matplotlib', ''),
     ('python3-dnspython', 'python3-dns'),
@@ -215,6 +204,8 @@ set -xueo pipefail
 
 yum update -y
 yum install -y epel-release
+yum install -y yum-plugin-copr
+yum copr enable -y sergiomb/SambaAD
 yum update -y
 
 yum install -y \
@@ -227,6 +218,23 @@ if [ ! -f /usr/bin/python3 ]; then
 fi
 """
 
+CENTOS8_YUM_BOOTSTRAP = r"""
+#!/bin/bash
+{GENERATED_MARKER}
+set -xueo pipefail
+
+yum update -y
+yum install -y dnf-plugins-core
+yum install -y epel-release
+yum config-manager --set-enabled PowerTools -y
+yum update -y
+
+yum install -y \
+    --setopt=install_weak_deps=False \
+    {pkgs}
+
+yum clean all
+"""
 
 DNF_BOOTSTRAP = r"""
 #!/bin/bash
@@ -377,6 +385,7 @@ DEB_DISTS = {
             'python-gpg': 'python-gpgme',
             'python3-gpg': '',  # no python3 gpg pkg available, remove
             'language-pack-en': '',   # included in locales
+            'liburing-dev': '',   # not available
         }
     },
     'debian8': {
@@ -386,6 +395,7 @@ DEB_DISTS = {
             'python-gpg': 'python-gpgme',
             'python3-gpg': 'python3-gpgme',
             'language-pack-en': '',   # included in locales
+            'liburing-dev': '',   # not available
         }
     },
     'debian9': {
@@ -393,6 +403,15 @@ DEB_DISTS = {
         'vagrant_box': 'debian/stretch64',
         'replace': {
             'language-pack-en': '',   # included in locales
+            'liburing-dev': '',   # not available
+        }
+    },
+    'debian10': {
+        'docker_image': 'debian:10',
+        'vagrant_box': 'debian/buster64',
+        'replace': {
+            'language-pack-en': '',   # included in locales
+            'liburing-dev': '',   # not available
         }
     },
     'ubuntu1404': {
@@ -408,6 +427,7 @@ DEB_DISTS = {
             'libunwind-dev': 'libunwind8-dev',
             'glusterfs-common': '',
             'libcephfs-dev': '',
+            'liburing-dev': '',   # not available
         }
     },
     'ubuntu1604': {
@@ -418,11 +438,15 @@ DEB_DISTS = {
             'python3-gpg': 'python3-gpgme',
             'glusterfs-common': '',
             'libcephfs-dev': '',
+            'liburing-dev': '',   # not available
         }
     },
     'ubuntu1804': {
         'docker_image': 'ubuntu:18.04',
         'vagrant_box': 'ubuntu/bionic64',
+        'replace': {
+            'liburing-dev': '',   # not available
+        }
     },
 }
 
@@ -449,6 +473,7 @@ RPM_DISTS = {
             'glusterfs-api-devel': '',
             'glusterfs-devel': '',
             'libcephfs-devel': '',
+            'liburing-devel': '',   # not available
         }
     },
     'centos7': {
@@ -479,14 +504,25 @@ RPM_DISTS = {
             'glusterfs-api-devel': '',
             'glusterfs-devel': '',
             'libcephfs-devel': '',
+            'gnutls-devel': 'compat-gnutls34-devel',
+            'liburing-devel': '',   # not available
         }
     },
-    'fedora28': {
-        'docker_image': 'fedora:28',
-        'vagrant_box': 'fedora/28-cloud-base',
-        'bootstrap': DNF_BOOTSTRAP,
+    'centos8': {
+        'docker_image': 'centos:8',
+        'vagrant_box': 'centos/8',
+        'bootstrap': CENTOS8_YUM_BOOTSTRAP,
         'replace': {
             'lsb-release': 'redhat-lsb',
+            '@development-tools': '"@Development Tools"',  # add quotes
+            'libsemanage-python': 'python3-libsemanage',
+            'lcov': '', # does not exist
+            'perl-JSON-Parse': '', # does not exist?
+            'perl-Test-Base': 'perl-Test-Simple',
+            'policycoreutils-python': 'python3-policycoreutils',
+            'python3-crypto': '',
+            'quota-devel': '', # FIXME: Add me back, once available!
+            'liburing-devel': '', # not available yet, Add me back, once available!
         }
     },
     'fedora29': {
@@ -495,6 +531,7 @@ RPM_DISTS = {
         'bootstrap': DNF_BOOTSTRAP,
         'replace': {
             'lsb-release': 'redhat-lsb',
+            'liburing-devel': '',   # not available
         }
     },
     'fedora30': {
@@ -503,6 +540,17 @@ RPM_DISTS = {
         'bootstrap': DNF_BOOTSTRAP,
         'replace': {
             'lsb-release': 'redhat-lsb',
+            'liburing-devel': '',   # not available
+        }
+    },
+    'fedora31': {
+        'docker_image': 'fedora:31',
+        'vagrant_box': 'fedora/31-cloud-base',
+        'bootstrap': DNF_BOOTSTRAP,
+        'replace': {
+            'lsb-release': 'redhat-lsb',
+            'libsemanage-python': 'python3-libsemanage',
+            'policycoreutils-python': 'python3-policycoreutils',
         }
     },
     'opensuse150': {
@@ -521,7 +569,6 @@ RPM_DISTS = {
             'krb5-workstation': 'krb5-client',
             'libnsl2-devel': 'libnsl-devel',
             'libsemanage-python': 'python2-semanage',
-            'nettle-devel': 'libnettle-devel',
             'openldap-devel': 'openldap2-devel',
             'perl-Archive-Tar': 'perl-Archive-Tar-Wrapper',
             'perl-JSON-Parse': 'perl-JSON-XS',
@@ -536,6 +583,7 @@ RPM_DISTS = {
             'glusterfs-api-devel': '',
             'libtasn1-tools': '', # asn1Parser is part of libtasn1
             'mingw64-gcc': '', # doesn't exist
+            'liburing-devel': '',   # not available
         }
     },
     'opensuse151': {
@@ -554,7 +602,6 @@ RPM_DISTS = {
             'krb5-workstation': 'krb5-client',
             'libnsl2-devel': 'libnsl-devel',
             'libsemanage-python': 'python2-semanage',
-            'nettle-devel': 'libnettle-devel',
             'openldap-devel': 'openldap2-devel',
             'perl-Archive-Tar': 'perl-Archive-Tar-Wrapper',
             'perl-JSON-Parse': 'perl-JSON-XS',
@@ -569,6 +616,7 @@ RPM_DISTS = {
             'glusterfs-api-devel': '',
             'libtasn1-tools': '', # asn1Parser is part of libtasn1
             'mingw64-gcc': '', # doesn't exist
+            'liburing-devel': '',   # not available, will be added in 15.2
         }
     }
 }
diff --git a/bootstrap/generated-dists/Vagrantfile b/bootstrap/generated-dists/Vagrantfile
index 941cc9a..b3cb6be 100644
--- a/bootstrap/generated-dists/Vagrantfile
+++ b/bootstrap/generated-dists/Vagrantfile
@@ -24,6 +24,20 @@ Vagrant.configure("2") do |config|
         v.vm.provision :shell, path: "centos7/locale.sh"
     end
 
+    config.vm.define "centos8" do |v|
+        v.vm.box = "centos/8"
+        v.vm.hostname = "centos8"
+        v.vm.provision :shell, path: "centos8/bootstrap.sh"
+        v.vm.provision :shell, path: "centos8/locale.sh"
+    end
+
+    config.vm.define "debian10" do |v|
+        v.vm.box = "debian/buster64"
+        v.vm.hostname = "debian10"
+        v.vm.provision :shell, path: "debian10/bootstrap.sh"
+        v.vm.provision :shell, path: "debian10/locale.sh"
+    end
+
     config.vm.define "debian7" do |v|
         v.vm.box = "debian/wheezy64"
         v.vm.hostname = "debian7"
@@ -45,13 +59,6 @@ Vagrant.configure("2") do |config|
         v.vm.provision :shell, path: "debian9/locale.sh"
     end
 
-    config.vm.define "fedora28" do |v|
-        v.vm.box = "fedora/28-cloud-base"
-        v.vm.hostname = "fedora28"
-        v.vm.provision :shell, path: "fedora28/bootstrap.sh"
-        v.vm.provision :shell, path: "fedora28/locale.sh"
-    end
-
     config.vm.define "fedora29" do |v|
         v.vm.box = "fedora/29-cloud-base"
         v.vm.hostname = "fedora29"
@@ -66,6 +73,13 @@ Vagrant.configure("2") do |config|
         v.vm.provision :shell, path: "fedora30/locale.sh"
     end
 
+    config.vm.define "fedora31" do |v|
+        v.vm.box = "fedora/31-cloud-base"
+        v.vm.hostname = "fedora31"
+        v.vm.provision :shell, path: "fedora31/bootstrap.sh"
+        v.vm.provision :shell, path: "fedora31/locale.sh"
+    end
+
     config.vm.define "opensuse150" do |v|
         v.vm.box = "opensuse/openSUSE-15.0-x86_64"
         v.vm.hostname = "opensuse150"
diff --git a/bootstrap/generated-dists/centos6/bootstrap.sh b/bootstrap/generated-dists/centos6/bootstrap.sh
index 6d60bd2..ee6fcc3 100755
--- a/bootstrap/generated-dists/centos6/bootstrap.sh
+++ b/bootstrap/generated-dists/centos6/bootstrap.sh
@@ -9,6 +9,8 @@ set -xueo pipefail
 
 yum update -y
 yum install -y epel-release
+yum install -y yum-plugin-copr
+yum copr enable -y sergiomb/SambaAD
 yum update -y
 
 yum install -y \
@@ -20,6 +22,7 @@ yum install -y \
     bind-utils \
     binutils \
     bison \
+    chrpath \
     cups-devel \
     curl \
     dbus-devel \
@@ -43,7 +46,6 @@ yum install -y \
     krb5-server \
     lcov \
     libacl-devel \
-    libaio-devel \
     libarchive-devel \
     libattr-devel \
     libblkid-devel \
@@ -64,7 +66,6 @@ yum install -y \
     make \
     mingw64-gcc \
     ncurses-devel \
-    nettle-devel \
     openldap-devel \
     pam-devel \
     patch \
@@ -81,12 +82,6 @@ yum install -y \
     popt-devel \
     procps \
     psmisc \
-    pygpgme \
-    python-crypto \
-    python-devel \
-    python-dns \
-    python-markdown \
-    python3-crypto \
     python3-dns \
     python3-markdown \
     python36 \
diff --git a/bootstrap/generated-dists/centos6/packages.yml b/bootstrap/generated-dists/centos6/packages.yml
index 168fbe9..1e2b5a9 100644
--- a/bootstrap/generated-dists/centos6/packages.yml
+++ b/bootstrap/generated-dists/centos6/packages.yml
@@ -8,6 +8,7 @@ packages:
   - bind-utils
   - binutils
   - bison
+  - chrpath
   - cups-devel
   - curl
   - dbus-devel
@@ -31,7 +32,6 @@ packages:
   - krb5-server
   - lcov
   - libacl-devel
-  - libaio-devel
   - libarchive-devel
   - libattr-devel
   - libblkid-devel
@@ -52,7 +52,6 @@ packages:
   - make
   - mingw64-gcc
   - ncurses-devel
-  - nettle-devel
   - openldap-devel
   - pam-devel
   - patch
@@ -69,12 +68,6 @@ packages:
   - popt-devel
   - procps
   - psmisc
-  - pygpgme
-  - python-crypto
-  - python-devel
-  - python-dns
-  - python-markdown
-  - python3-crypto
   - python3-dns
   - python3-markdown
   - python36
diff --git a/bootstrap/generated-dists/centos7/bootstrap.sh b/bootstrap/generated-dists/centos7/bootstrap.sh
index b59ef6a..2f0bb1b 100755
--- a/bootstrap/generated-dists/centos7/bootstrap.sh
+++ b/bootstrap/generated-dists/centos7/bootstrap.sh
@@ -9,6 +9,8 @@ set -xueo pipefail
 
 yum update -y
 yum install -y epel-release
+yum install -y yum-plugin-copr
+yum copr enable -y sergiomb/SambaAD
 yum update -y
 
 yum install -y \
@@ -20,6 +22,8 @@ yum install -y \
     bind-utils \
     binutils \
     bison \
+    chrpath \
+    compat-gnutls34-devel \
     cups-devel \
     curl \
     dbus-devel \
@@ -32,7 +36,6 @@ yum install -y \
     git \
     glib2-devel \
     glibc-common \
-    gnutls-devel \
     gpgme-devel \
     gzip \
     hostname \
@@ -43,7 +46,6 @@ yum install -y \
     krb5-server \
     lcov \
     libacl-devel \
-    libaio-devel \
     libarchive-devel \
     libattr-devel \
     libblkid-devel \
@@ -64,7 +66,6 @@ yum install -y \
     make \
     mingw64-gcc \
     ncurses-devel \
-    nettle-devel \
     openldap-devel \
     pam-devel \
     patch \
@@ -81,13 +82,7 @@ yum install -y \
     popt-devel \
     procps-ng \
     psmisc \
-    pygpgme \
-    python-crypto \
-    python-devel \
-    python-dns \
-    python-markdown \
     python36 \
-    python36-crypto \
     python36-devel \
     python36-dns \
     python36-markdown \
diff --git a/bootstrap/generated-dists/centos7/packages.yml b/bootstrap/generated-dists/centos7/packages.yml
index 7a106d8..475326b 100644
--- a/bootstrap/generated-dists/centos7/packages.yml
+++ b/bootstrap/generated-dists/centos7/packages.yml
@@ -8,6 +8,8 @@ packages:
   - bind-utils
   - binutils
   - bison
+  - chrpath
+  - compat-gnutls34-devel
   - cups-devel
   - curl
   - dbus-devel
@@ -20,7 +22,6 @@ packages:
   - git
   - glib2-devel
   - glibc-common
-  - gnutls-devel
   - gpgme-devel
   - gzip
   - hostname
@@ -31,7 +32,6 @@ packages:
   - krb5-server
   - lcov
   - libacl-devel
-  - libaio-devel
   - libarchive-devel
   - libattr-devel
   - libblkid-devel
@@ -52,7 +52,6 @@ packages:
   - make
   - mingw64-gcc
   - ncurses-devel
-  - nettle-devel
   - openldap-devel
   - pam-devel
   - patch
@@ -69,13 +68,7 @@ packages:
   - popt-devel
   - procps-ng
   - psmisc
-  - pygpgme
-  - python-crypto
-  - python-devel
-  - python-dns
-  - python-markdown
   - python36
-  - python36-crypto
   - python36-devel
   - python36-dns
   - python36-markdown
diff --git a/bootstrap/generated-dists/fedora28/Dockerfile b/bootstrap/generated-dists/centos8/Dockerfile
 similarity index 95%
 rename from bootstrap/generated-dists/fedora28/Dockerfile
 rename to bootstrap/generated-dists/centos8/Dockerfile
index 4d25691..f6343e9 100644
--- a/bootstrap/generated-dists/fedora28/Dockerfile
+++ b/bootstrap/generated-dists/centos8/Dockerfile
@@ -3,7 +3,7 @@
 # See also bootstrap/config.py
 #
 
-FROM fedora:28
+FROM centos:8
 
 # pass in with --build-arg while build
 ARG SHA1SUM
diff --git a/bootstrap/generated-dists/centos8/bootstrap.sh b/bootstrap/generated-dists/centos8/bootstrap.sh
 new file mode 100755
index 0000000..22484b3
--- /dev/null
+++ b/bootstrap/generated-dists/centos8/bootstrap.sh
@@ -0,0 +1,109 @@
+#!/bin/bash
+
+#
+# This file is generated by 'bootstrap/template.py --render'
+# See also bootstrap/config.py
+#
+
+set -xueo pipefail
+
+yum update -y
+yum install -y dnf-plugins-core
+yum install -y epel-release
+yum config-manager --set-enabled PowerTools -y
+yum update -y
+
+yum install -y \
+    --setopt=install_weak_deps=False \
+    "@Development Tools" \
+    acl \
+    attr \
+    autoconf \
+    avahi-devel \
+    bind-utils \
+    binutils \
+    bison \
+    chrpath \
+    cups-devel \
+    curl \
+    dbus-devel \
+    docbook-dtds \
+    docbook-style-xsl \
+    flex \
+    gawk \
+    gcc \
+    gdb \
+    git \
+    glib2-devel \
+    glibc-common \
+    glibc-langpack-en \
+    glusterfs-api-devel \
+    glusterfs-devel \
+    gnutls-devel \
+    gpgme-devel \
+    gzip \
+    hostname \
+    htop \
+    jansson-devel \
+    keyutils-libs-devel \
+    krb5-devel \
+    krb5-server \
+    libacl-devel \
+    libarchive-devel \
+    libattr-devel \
+    libblkid-devel \
+    libbsd-devel \
+    libcap-devel \
+    libcephfs-devel \
+    libicu-devel \
+    libnsl2-devel \
+    libpcap-devel \
+    libtasn1-devel \
+    libtasn1-tools \
+    libtirpc-devel \
+    libunwind-devel \
+    libuuid-devel \
+    libxslt \
+    lmdb \
+    lmdb-devel \
+    make \
+    mingw64-gcc \
+    ncurses-devel \
+    openldap-devel \
+    pam-devel \
+    patch \
+    perl \
+    perl-Archive-Tar \
+    perl-ExtUtils-MakeMaker \
+    perl-Parse-Yapp \
+    perl-Test-Simple \
+    perl-generators \
+    perl-interpreter \
+    pkgconfig \
+    popt-devel \
+    procps-ng \
+    psmisc \
+    python3 \
+    python3-devel \
+    python3-dns \
+    python3-gpg \
+    python3-libsemanage \
+    python3-markdown \
+    python3-policycoreutils \
+    readline-devel \
+    redhat-lsb \
+    rng-tools \
+    rpcgen \
+    rpcsvc-proto-devel \
+    rsync \
+    sed \
+    sudo \
+    systemd-devel \
+    tar \
+    tree \
+    which \
+    xfsprogs-devel \
+    yum-utils \
+    zlib-devel
+
+yum clean all
 \ No newline at end of file
diff --git a/bootstrap/generated-dists/fedora28/locale.sh b/bootstrap/generated-dists/centos8/locale.sh
 similarity index 100%
 rename from bootstrap/generated-dists/fedora28/locale.sh
 rename to bootstrap/generated-dists/centos8/locale.sh
diff --git a/bootstrap/generated-dists/centos8/packages.yml b/bootstrap/generated-dists/centos8/packages.yml
 new file mode 100644
index 0000000..07be0de
--- /dev/null
+++ b/bootstrap/generated-dists/centos8/packages.yml
@@ -0,0 +1,92 @@
+---
+packages:
+  - "@Development Tools"
+  - acl
+  - attr
+  - autoconf
+  - avahi-devel
+  - bind-utils
+  - binutils
+  - bison
+  - chrpath
+  - cups-devel
+  - curl
+  - dbus-devel
+  - docbook-dtds
+  - docbook-style-xsl
+  - flex
+  - gawk
+  - gcc
+  - gdb
+  - git
+  - glib2-devel
+  - glibc-common
+  - glibc-langpack-en
+  - glusterfs-api-devel
+  - glusterfs-devel
+  - gnutls-devel
+  - gpgme-devel
+  - gzip
+  - hostname
+  - htop
+  - jansson-devel
+  - keyutils-libs-devel
+  - krb5-devel
+  - krb5-server
+  - libacl-devel
+  - libarchive-devel
+  - libattr-devel
+  - libblkid-devel
+  - libbsd-devel
+  - libcap-devel
+  - libcephfs-devel
+  - libicu-devel
+  - libnsl2-devel
+  - libpcap-devel
+  - libtasn1-devel
+  - libtasn1-tools
+  - libtirpc-devel
+  - libunwind-devel
+  - libuuid-devel
+  - libxslt
+  - lmdb
+  - lmdb-devel
+  - make
+  - mingw64-gcc
+  - ncurses-devel
+  - openldap-devel
+  - pam-devel
+  - patch
+  - perl
+  - perl-Archive-Tar
+  - perl-ExtUtils-MakeMaker
+  - perl-Parse-Yapp
+  - perl-Test-Simple
+  - perl-generators
+  - perl-interpreter
+  - pkgconfig
+  - popt-devel
+  - procps-ng
+  - psmisc
+  - python3
+  - python3-devel
+  - python3-dns
+  - python3-gpg
+  - python3-libsemanage
+  - python3-markdown
+  - python3-policycoreutils
+  - readline-devel
+  - redhat-lsb
+  - rng-tools
+  - rpcgen
+  - rpcsvc-proto-devel
+  - rsync
+  - sed
+  - sudo
+  - systemd-devel
+  - tar
+  - tree
+  - which
+  - xfsprogs-devel
+  - yum-utils
+  - zlib-devel
 \ No newline at end of file
diff --git a/bootstrap/generated-dists/debian10/Dockerfile b/bootstrap/generated-dists/debian10/Dockerfile
 new file mode 100644
index 0000000..a7141db
--- /dev/null
+++ b/bootstrap/generated-dists/debian10/Dockerfile
@@ -0,0 +1,27 @@
+#
+# This file is generated by 'bootstrap/template.py --render'
+# See also bootstrap/config.py
+#
+
+FROM debian:10
+
+# pass in with --build-arg while build
+ARG SHA1SUM
+RUN [ -n $SHA1SUM ] && echo $SHA1SUM > /sha1sum.txt
+
+ADD *.sh /tmp/
+# need root permission, do it before USER samba
+RUN /tmp/bootstrap.sh && /tmp/locale.sh
+
+# if ld.gold exists, force link it to ld
+RUN set -x; LD=$(which ld); LD_GOLD=$(which ld.gold); test -x $LD_GOLD && ln -sf $LD_GOLD $LD && test -x $LD && echo "$LD is now $LD_GOLD"
+
+# make test can not work with root, so we have to create a new user
+RUN useradd -m -U -s /bin/bash samba && \
+    mkdir -p /etc/sudoers.d && \
+    echo "samba ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/samba
+
+USER samba
+WORKDIR /home/samba
+# samba tests rely on this
+ENV USER=samba LC_ALL=en_US.utf8 LANG=en_US.utf8
 \ No newline at end of file
diff --git a/bootstrap/generated-dists/debian10/bootstrap.sh b/bootstrap/generated-dists/debian10/bootstrap.sh
 new file mode 100755
index 0000000..f0847eb
--- /dev/null
+++ b/bootstrap/generated-dists/debian10/bootstrap.sh
@@ -0,0 +1,105 @@
+#!/bin/bash
+
+#
+# This file is generated by 'bootstrap/template.py --render'
+# See also bootstrap/config.py
+#
+
+set -xueo pipefail
+
+export DEBIAN_FRONTEND=noninteractive
+apt-get -y update
+
+apt-get -y install \
+    acl \
+    apt-utils \
+    attr \
+    autoconf \
+    bind9utils \
+    binutils \
+    bison \
+    build-essential \
+    chrpath \
+    curl \
+    debhelper \
+    dnsutils \
+    docbook-xml \
+    docbook-xsl \
+    flex \
+    gcc \
+    gdb \
+    git \
+    glusterfs-common \
+    gzip \
+    heimdal-multidev \
+    hostname \
+    htop \
+    krb5-config \
+    krb5-kdc \
+    krb5-user \
+    lcov \
+    libacl1-dev \
+    libarchive-dev \
+    libattr1-dev \
+    libavahi-common-dev \
+    libblkid-dev \
+    libbsd-dev \
+    libcap-dev \
+    libcephfs-dev \
+    libcups2-dev \
+    libdbus-1-dev \
+    libglib2.0-dev \
+    libgnutls28-dev \
+    libgpgme11-dev \
+    libicu-dev \
+    libjansson-dev \
+    libjs-jquery \
+    libjson-perl \
+    libkrb5-dev \
+    libldap2-dev \
+    liblmdb-dev \
+    libncurses5-dev \
+    libpam0g-dev \
+    libparse-yapp-perl \
+    libpcap-dev \
+    libpopt-dev \
+    libreadline-dev \
+    libsystemd-dev \
+    libtasn1-bin \
+    libtasn1-dev \
+    libunwind-dev \
+    lmdb-utils \
+    locales \
+    lsb-release \
+    make \
+    mawk \
+    mingw-w64 \
+    patch \
+    perl \
+    perl-modules \
+    pkg-config \
+    procps \
+    psmisc \
+    python3 \
+    python3-dbg \
+    python3-dev \
+    python3-dnspython \
+    python3-gpg \
+    python3-iso8601 \
+    python3-markdown \
+    python3-matplotlib \
+    python3-pexpect \
+    rng-tools \
+    rsync \
+    sed \
+    sudo \
+    tar \
+    tree \
+    uuid-dev \
+    xfslibs-dev \
+    xsltproc \
+    zlib1g-dev
+
+apt-get -y autoremove
+apt-get -y autoclean
+apt-get -y clean
 \ No newline at end of file
diff --git a/bootstrap/generated-dists/debian10/locale.sh b/bootstrap/generated-dists/debian10/locale.sh
 new file mode 100755
index 0000000..cc64e18
--- /dev/null
+++ b/bootstrap/generated-dists/debian10/locale.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+#
+# This file is generated by 'bootstrap/template.py --render'
+# See also bootstrap/config.py
+#
+
+set -xueo pipefail
+
+# refer to /usr/share/i18n/locales
+INPUTFILE=en_US
+# refer to /usr/share/i18n/charmaps
+CHARMAP=UTF-8
+# locale to generate in /usr/lib/locale
+# glibc/localedef will normalize UTF-8 to utf8, follow the naming style
+LOCALE=$INPUTFILE.utf8
+
+# if locale is already correct, exit
+( locale | grep LC_ALL | grep -i $LOCALE ) && exit 0
+
+# if locale not available, generate locale into /usr/lib/locale
+if ! ( locale --all-locales | grep -i $LOCALE )
+then
+    # no-archive means create its own dir
+    localedef --inputfile $INPUTFILE --charmap $CHARMAP --no-archive $LOCALE
+fi
+
+# update locale conf and global env file
+# set both LC_ALL and LANG for safe
+
+# update conf for Debian family
+FILE=/etc/default/locale
+if [ -f $FILE ]
+then
+    echo LC_ALL="$LOCALE" > $FILE
+    echo LANG="$LOCALE" >> $FILE
+fi
+
+# update conf for RedHat family
+FILE=/etc/locale.conf
+if [ -f $FILE ]
+then
+    # LC_ALL is not valid in this file, set LANG only
+    echo LANG="$LOCALE" > $FILE
+fi
+
+# update global env file
+FILE=/etc/environment
+if [ -f $FILE ]
+then
+    # append LC_ALL if not exist
+    grep LC_ALL $FILE || echo LC_ALL="$LOCALE" >> $FILE
+    # append LANG if not exist
+    grep LANG $FILE || echo LANG="$LOCALE" >> $FILE
+fi
 \ No newline at end of file
diff --git a/bootstrap/generated-dists/debian10/packages.yml b/bootstrap/generated-dists/debian10/packages.yml
 new file mode 100644
index 0000000..a242cd8
--- /dev/null
+++ b/bootstrap/generated-dists/debian10/packages.yml
@@ -0,0 +1,90 @@
+---
+packages:
+  - acl
+  - apt-utils
+  - attr
+  - autoconf
+  - bind9utils
+  - binutils
+  - bison
+  - build-essential
+  - chrpath
+  - curl
+  - debhelper
+  - dnsutils
+  - docbook-xml
+  - docbook-xsl
+  - flex
+  - gcc
+  - gdb
+  - git
+  - glusterfs-common
+  - gzip
+  - heimdal-multidev
+  - hostname
+  - htop
+  - krb5-config
+  - krb5-kdc
+  - krb5-user
+  - lcov
+  - libacl1-dev
+  - libarchive-dev
+  - libattr1-dev
+  - libavahi-common-dev
+  - libblkid-dev
+  - libbsd-dev
+  - libcap-dev
+  - libcephfs-dev
+  - libcups2-dev
+  - libdbus-1-dev
+  - libglib2.0-dev
+  - libgnutls28-dev
+  - libgpgme11-dev
+  - libicu-dev
+  - libjansson-dev
+  - libjs-jquery
+  - libjson-perl
+  - libkrb5-dev
+  - libldap2-dev
+  - liblmdb-dev
+  - libncurses5-dev
+  - libpam0g-dev
+  - libparse-yapp-perl
+  - libpcap-dev
+  - libpopt-dev
+  - libreadline-dev
+  - libsystemd-dev
+  - libtasn1-bin
+  - libtasn1-dev
+  - libunwind-dev
+  - lmdb-utils
+  - locales
+  - lsb-release
+  - make
+  - mawk
+  - mingw-w64
+  - patch
+  - perl
+  - perl-modules
+  - pkg-config
+  - procps
+  - psmisc
+  - python3
+  - python3-dbg
+  - python3-dev
+  - python3-dnspython
+  - python3-gpg
+  - python3-iso8601
+  - python3-markdown
+  - python3-matplotlib
+  - python3-pexpect
+  - rng-tools
+  - rsync
+  - sed
+  - sudo
+  - tar
+  - tree
+  - uuid-dev
+  - xfslibs-dev
+  - xsltproc
+  - zlib1g-dev
 \ No newline at end of file
diff --git a/bootstrap/generated-dists/debian7/bootstrap.sh b/bootstrap/generated-dists/debian7/bootstrap.sh
index fcba67c..daedce8 100755
--- a/bootstrap/generated-dists/debian7/bootstrap.sh
+++ b/bootstrap/generated-dists/debian7/bootstrap.sh
@@ -19,6 +19,7 @@ apt-get -y install \
     binutils \
     bison \
     build-essential \
+    chrpath \
     curl \
     debhelper \
     dnsutils \
@@ -38,7 +39,6 @@ apt-get -y install \
     krb5-user \
     lcov \
     libacl1-dev \
-    libaio-dev \
     libarchive-dev \
     libattr1-dev \
     libavahi-common-dev \
@@ -71,23 +71,13 @@ apt-get -y install \
     make \
     mawk \
     mingw-w64 \
-    nettle-dev \
     patch \
     perl \
     perl-modules \
     pkg-config \
     procps \
     psmisc \
-    python-crypto \
-    python-dbg \
-    python-dev \
-    python-dnspython \
-    python-gpgme \
-    python-iso8601 \
-    python-markdown \
-    python-pexpect \
     python3 \
-    python3-crypto \
     python3-dbg \
     python3-dev \
     python3-dnspython \
diff --git a/bootstrap/generated-dists/debian7/packages.yml b/bootstrap/generated-dists/debian7/packages.yml
index 62fd54b..3cac687 100644
--- a/bootstrap/generated-dists/debian7/packages.yml
+++ b/bootstrap/generated-dists/debian7/packages.yml
@@ -8,6 +8,7 @@ packages:
   - binutils
   - bison
   - build-essential
+  - chrpath
   - curl
   - debhelper
   - dnsutils
@@ -27,7 +28,6 @@ packages:
   - krb5-user
   - lcov
   - libacl1-dev
-  - libaio-dev
   - libarchive-dev
   - libattr1-dev
   - libavahi-common-dev
@@ -60,23 +60,13 @@ packages:
   - make
   - mawk
   - mingw-w64
-  - nettle-dev
   - patch
   - perl
   - perl-modules
   - pkg-config
   - procps
   - psmisc
-  - python-crypto
-  - python-dbg
-  - python-dev
-  - python-dnspython
-  - python-gpgme
-  - python-iso8601
-  - python-markdown
-  - python-pexpect
   - python3
-  - python3-crypto
   - python3-dbg
   - python3-dev
   - python3-dnspython
diff --git a/bootstrap/generated-dists/debian8/bootstrap.sh b/bootstrap/generated-dists/debian8/bootstrap.sh
index 54e3f78..0105083 100755
--- a/bootstrap/generated-dists/debian8/bootstrap.sh
+++ b/bootstrap/generated-dists/debian8/bootstrap.sh
@@ -19,6 +19,7 @@ apt-get -y install \
     binutils \
     bison \
     build-essential \
+    chrpath \
     curl \
     debhelper \
     dnsutils \
@@ -38,7 +39,6 @@ apt-get -y install \
     krb5-user \
     lcov \
     libacl1-dev \
-    libaio-dev \
     libarchive-dev \
     libattr1-dev \
     libavahi-common-dev \
@@ -74,23 +74,13 @@ apt-get -y install \
     make \
     mawk \
     mingw-w64 \
-    nettle-dev \
     patch \
     perl \
     perl-modules \
     pkg-config \
     procps \
     psmisc \
-    python-crypto \
-    python-dbg \
-    python-dev \
-    python-dnspython \
-    python-gpgme \
-    python-iso8601 \
-    python-markdown \
-    python-pexpect \
     python3 \
-    python3-crypto \
     python3-dbg \
     python3-dev \
     python3-dnspython \
diff --git a/bootstrap/generated-dists/debian8/packages.yml b/bootstrap/generated-dists/debian8/packages.yml
index a65ca2f..1c9552b 100644
--- a/bootstrap/generated-dists/debian8/packages.yml
+++ b/bootstrap/generated-dists/debian8/packages.yml
@@ -8,6 +8,7 @@ packages:
   - binutils
   - bison
   - build-essential
+  - chrpath
   - curl
   - debhelper
   - dnsutils
@@ -27,7 +28,6 @@ packages:
   - krb5-user
   - lcov
   - libacl1-dev
-  - libaio-dev
   - libarchive-dev
   - libattr1-dev
   - libavahi-common-dev
@@ -63,23 +63,13 @@ packages:
   - make
   - mawk
   - mingw-w64
-  - nettle-dev
   - patch
   - perl
   - perl-modules
   - pkg-config
   - procps
   - psmisc
-  - python-crypto
-  - python-dbg
-  - python-dev
-  - python-dnspython
-  - python-gpgme
-  - python-iso8601
-  - python-markdown
-  - python-pexpect
   - python3
-  - python3-crypto
   - python3-dbg
   - python3-dev
   - python3-dnspython
diff --git a/bootstrap/generated-dists/debian9/bootstrap.sh b/bootstrap/generated-dists/debian9/bootstrap.sh
index 4bc4214..f0847eb 100755
--- a/bootstrap/generated-dists/debian9/bootstrap.sh
+++ b/bootstrap/generated-dists/debian9/bootstrap.sh
@@ -19,6 +19,7 @@ apt-get -y install \
     binutils \
     bison \
     build-essential \
+    chrpath \
     curl \
     debhelper \
     dnsutils \
@@ -38,7 +39,6 @@ apt-get -y install \
     krb5-user \
     lcov \
     libacl1-dev \
-    libaio-dev \
     libarchive-dev \
     libattr1-dev \
     libavahi-common-dev \
@@ -74,23 +74,13 @@ apt-get -y install \
     make \
     mawk \
     mingw-w64 \
-    nettle-dev \
     patch \
     perl \
     perl-modules \
     pkg-config \
     procps \
     psmisc \
-    python-crypto \
-    python-dbg \
-    python-dev \
-    python-dnspython \
-    python-gpg \
-    python-iso8601 \
-    python-markdown \
-    python-pexpect \
     python3 \
-    python3-crypto \
     python3-dbg \
     python3-dev \
     python3-dnspython \
diff --git a/bootstrap/generated-dists/debian9/packages.yml b/bootstrap/generated-dists/debian9/packages.yml
index 0021d64..a242cd8 100644
--- a/bootstrap/generated-dists/debian9/packages.yml
+++ b/bootstrap/generated-dists/debian9/packages.yml
@@ -8,6 +8,7 @@ packages:
   - binutils
   - bison
   - build-essential
+  - chrpath
   - curl
   - debhelper
   - dnsutils
@@ -27,7 +28,6 @@ packages:
   - krb5-user
   - lcov
   - libacl1-dev
-  - libaio-dev
   - libarchive-dev
   - libattr1-dev
   - libavahi-common-dev
@@ -63,23 +63,13 @@ packages:
   - make
   - mawk
   - mingw-w64
-  - nettle-dev
   - patch
   - perl
   - perl-modules
   - pkg-config
   - procps
   - psmisc
-  - python-crypto
-  - python-dbg
-  - python-dev
-  - python-dnspython
-  - python-gpg
-  - python-iso8601
-  - python-markdown
-  - python-pexpect
   - python3
-  - python3-crypto
   - python3-dbg
   - python3-dev
   - python3-dnspython
diff --git a/bootstrap/generated-dists/fedora29/bootstrap.sh b/bootstrap/generated-dists/fedora29/bootstrap.sh
index 048efa5..effe2a9 100755
--- a/bootstrap/generated-dists/fedora29/bootstrap.sh
+++ b/bootstrap/generated-dists/fedora29/bootstrap.sh
@@ -19,6 +19,7 @@ dnf install -y \
     bind-utils \
     binutils \
     bison \
+    chrpath \
     cups-devel \
     curl \
     dbus-devel \
@@ -45,7 +46,6 @@ dnf install -y \
     krb5-server \
     lcov \
     libacl-devel \
-    libaio-devel \
     libarchive-devel \
     libattr-devel \
     libblkid-devel \
@@ -67,7 +67,6 @@ dnf install -y \
     make \
     mingw64-gcc \
     ncurses-devel \
-    nettle-devel \
     openldap-devel \
     pam-devel \
     patch \
@@ -84,13 +83,7 @@ dnf install -y \
     popt-devel \
     procps-ng \
     psmisc \
-    python-crypto \
-    python-devel \
-    python-dns \
-    python-markdown \
-    python2-gpg \
     python3 \
-    python3-crypto \
     python3-devel \
     python3-dns \
     python3-gpg \
diff --git a/bootstrap/generated-dists/fedora29/packages.yml b/bootstrap/generated-dists/fedora29/packages.yml
index c96df0b..3b767f8 100644
--- a/bootstrap/generated-dists/fedora29/packages.yml
+++ b/bootstrap/generated-dists/fedora29/packages.yml
@@ -8,6 +8,7 @@ packages:
   - bind-utils
   - binutils
   - bison
+  - chrpath
   - cups-devel
   - curl
   - dbus-devel
@@ -34,7 +35,6 @@ packages:
   - krb5-server
   - lcov
   - libacl-devel
-  - libaio-devel
   - libarchive-devel
   - libattr-devel
   - libblkid-devel
@@ -56,7 +56,6 @@ packages:
   - make
   - mingw64-gcc
   - ncurses-devel
-  - nettle-devel
   - openldap-devel
   - pam-devel
   - patch
@@ -73,13 +72,7 @@ packages:
   - popt-devel
   - procps-ng
   - psmisc
-  - python-crypto
-  - python-devel
-  - python-dns
-  - python-markdown
-  - python2-gpg
   - python3
-  - python3-crypto
   - python3-devel
   - python3-dns
   - python3-gpg
diff --git a/bootstrap/generated-dists/fedora30/bootstrap.sh b/bootstrap/generated-dists/fedora30/bootstrap.sh
index 048efa5..effe2a9 100755
--- a/bootstrap/generated-dists/fedora30/bootstrap.sh
+++ b/bootstrap/generated-dists/fedora30/bootstrap.sh
@@ -19,6 +19,7 @@ dnf install -y \
     bind-utils \
     binutils \
     bison \
+    chrpath \
     cups-devel \
     curl \
     dbus-devel \
@@ -45,7 +46,6 @@ dnf install -y \
     krb5-server \
     lcov \
     libacl-devel \
-    libaio-devel \
     libarchive-devel \
     libattr-devel \
     libblkid-devel \
@@ -67,7 +67,6 @@ dnf install -y \
     make \
     mingw64-gcc \
     ncurses-devel \
-    nettle-devel \
     openldap-devel \
     pam-devel \
     patch \
@@ -84,13 +83,7 @@ dnf install -y \
     popt-devel \
     procps-ng \
     psmisc \
-    python-crypto \
-    python-devel \
-    python-dns \
-    python-markdown \
-    python2-gpg \
     python3 \
-    python3-crypto \
     python3-devel \
     python3-dns \
     python3-gpg \
diff --git a/bootstrap/generated-dists/fedora30/packages.yml b/bootstrap/generated-dists/fedora30/packages.yml
index c96df0b..3b767f8 100644
--- a/bootstrap/generated-dists/fedora30/packages.yml
+++ b/bootstrap/generated-dists/fedora30/packages.yml
@@ -8,6 +8,7 @@ packages:
   - bind-utils
   - binutils
   - bison
+  - chrpath
   - cups-devel
   - curl
   - dbus-devel
@@ -34,7 +35,6 @@ packages:
   - krb5-server
   - lcov
   - libacl-devel
-  - libaio-devel
   - libarchive-devel
   - libattr-devel
   - libblkid-devel
@@ -56,7 +56,6 @@ packages:
   - make
   - mingw64-gcc
   - ncurses-devel
-  - nettle-devel
   - openldap-devel
   - pam-devel
   - patch
@@ -73,13 +72,7 @@ packages:
   - popt-devel
   - procps-ng
   - psmisc
-  - python-crypto
-  - python-devel
-  - python-dns
-  - python-markdown
-  - python2-gpg
   - python3
-  - python3-crypto
   - python3-devel
   - python3-dns
   - python3-gpg
diff --git a/bootstrap/generated-dists/fedora31/Dockerfile b/bootstrap/generated-dists/fedora31/Dockerfile
 new file mode 100644
index 0000000..ff8d0b4
--- /dev/null
+++ b/bootstrap/generated-dists/fedora31/Dockerfile
@@ -0,0 +1,27 @@
+#
+# This file is generated by 'bootstrap/template.py --render'
+# See also bootstrap/config.py
+#
+
+FROM fedora:31
+
+# pass in with --build-arg while build
+ARG SHA1SUM
+RUN [ -n $SHA1SUM ] && echo $SHA1SUM > /sha1sum.txt
+
+ADD *.sh /tmp/
+# need root permission, do it before USER samba
+RUN /tmp/bootstrap.sh && /tmp/locale.sh
+
+# if ld.gold exists, force link it to ld
+RUN set -x; LD=$(which ld); LD_GOLD=$(which ld.gold); test -x $LD_GOLD && ln -sf $LD_GOLD $LD && test -x $LD && echo "$LD is now $LD_GOLD"
+
+# make test can not work with root, so we have to create a new user
+RUN useradd -m -U -s /bin/bash samba && \
+    mkdir -p /etc/sudoers.d && \
+    echo "samba ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/samba
+
+USER samba
+WORKDIR /home/samba
+# samba tests rely on this
+ENV USER=samba LC_ALL=en_US.utf8 LANG=en_US.utf8
 \ No newline at end of file
diff --git a/bootstrap/generated-dists/fedora28/bootstrap.sh b/bootstrap/generated-dists/fedora31/bootstrap.sh
 similarity index 93%
 rename from bootstrap/generated-dists/fedora28/bootstrap.sh
 rename to bootstrap/generated-dists/fedora31/bootstrap.sh
index 048efa5..18c5809 100755
--- a/bootstrap/generated-dists/fedora28/bootstrap.sh
+++ b/bootstrap/generated-dists/fedora31/bootstrap.sh
@@ -19,6 +19,7 @@ dnf install -y \
     bind-utils \
     binutils \
     bison \
+    chrpath \
     cups-devel \
     curl \
     dbus-devel \
@@ -45,7 +46,6 @@ dnf install -y \
     krb5-server \
     lcov \
     libacl-devel \
-    libaio-devel \
     libarchive-devel \
     libattr-devel \
     libblkid-devel \
@@ -55,11 +55,11 @@ dnf install -y \
     libicu-devel \
     libnsl2-devel \
     libpcap-devel \
-    libsemanage-python \
     libtasn1-devel \
     libtasn1-tools \
     libtirpc-devel \
     libunwind-devel \
+    liburing-devel \
     libuuid-devel \
     libxslt \
     lmdb \
@@ -67,7 +67,6 @@ dnf install -y \
     make \
     mingw64-gcc \
     ncurses-devel \
-    nettle-devel \
     openldap-devel \
     pam-devel \
     patch \
@@ -80,21 +79,16 @@ dnf install -y \
     perl-generators \
     perl-interpreter \
     pkgconfig \
-    policycoreutils-python \
     popt-devel \
     procps-ng \
     psmisc \
-    python-crypto \
-    python-devel \
-    python-dns \
-    python-markdown \
-    python2-gpg \
     python3 \
-    python3-crypto \
     python3-devel \
     python3-dns \
     python3-gpg \
+    python3-libsemanage \
     python3-markdown \
+    python3-policycoreutils \
     quota-devel \
     readline-devel \
     redhat-lsb \
diff --git a/bootstrap/generated-dists/fedora31/locale.sh b/bootstrap/generated-dists/fedora31/locale.sh
 new file mode 100755
index 0000000..cc64e18
--- /dev/null
+++ b/bootstrap/generated-dists/fedora31/locale.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+#
+# This file is generated by 'bootstrap/template.py --render'
+# See also bootstrap/config.py
+#
+
+set -xueo pipefail
+
+# refer to /usr/share/i18n/locales
+INPUTFILE=en_US
+# refer to /usr/share/i18n/charmaps
+CHARMAP=UTF-8
+# locale to generate in /usr/lib/locale
+# glibc/localedef will normalize UTF-8 to utf8, follow the naming style
+LOCALE=$INPUTFILE.utf8
+
+# if locale is already correct, exit
+( locale | grep LC_ALL | grep -i $LOCALE ) && exit 0
+
+# if locale not available, generate locale into /usr/lib/locale
+if ! ( locale --all-locales | grep -i $LOCALE )
+then
+    # no-archive means create its own dir
+    localedef --inputfile $INPUTFILE --charmap $CHARMAP --no-archive $LOCALE
+fi
+
+# update locale conf and global env file
+# set both LC_ALL and LANG for safe
+
+# update conf for Debian family
+FILE=/etc/default/locale
+if [ -f $FILE ]
+then
+    echo LC_ALL="$LOCALE" > $FILE
+    echo LANG="$LOCALE" >> $FILE
+fi
+
+# update conf for RedHat family
+FILE=/etc/locale.conf
+if [ -f $FILE ]
+then
+    # LC_ALL is not valid in this file, set LANG only
+    echo LANG="$LOCALE" > $FILE
+fi
+
+# update global env file
+FILE=/etc/environment
+if [ -f $FILE ]
+then
+    # append LC_ALL if not exist
+    grep LC_ALL $FILE || echo LC_ALL="$LOCALE" >> $FILE
+    # append LANG if not exist
+    grep LANG $FILE || echo LANG="$LOCALE" >> $FILE
+fi
 \ No newline at end of file
diff --git a/bootstrap/generated-dists/fedora28/packages.yml b/bootstrap/generated-dists/fedora31/packages.yml
 similarity index 92%
 rename from bootstrap/generated-dists/fedora28/packages.yml
 rename to bootstrap/generated-dists/fedora31/packages.yml
index c96df0b..3165af8 100644
--- a/bootstrap/generated-dists/fedora28/packages.yml
+++ b/bootstrap/generated-dists/fedora31/packages.yml
@@ -8,6 +8,7 @@ packages:
   - bind-utils
   - binutils
   - bison
+  - chrpath
   - cups-devel
   - curl
   - dbus-devel
@@ -34,7 +35,6 @@ packages:
   - krb5-server
   - lcov
   - libacl-devel
-  - libaio-devel
   - libarchive-devel
   - libattr-devel
   - libblkid-devel
@@ -44,11 +44,11 @@ packages:
   - libicu-devel
   - libnsl2-devel
   - libpcap-devel
-  - libsemanage-python
   - libtasn1-devel
   - libtasn1-tools
   - libtirpc-devel
   - libunwind-devel
+  - liburing-devel
   - libuuid-devel
   - libxslt
   - lmdb
@@ -56,7 +56,6 @@ packages:
   - make
   - mingw64-gcc
   - ncurses-devel
-  - nettle-devel
   - openldap-devel
   - pam-devel
   - patch
@@ -69,21 +68,16 @@ packages:
   - perl-generators
   - perl-interpreter
   - pkgconfig
-  - policycoreutils-python
   - popt-devel
   - procps-ng
   - psmisc
-  - python-crypto
-  - python-devel
-  - python-dns
-  - python-markdown
-  - python2-gpg
   - python3
-  - python3-crypto
   - python3-devel
   - python3-dns
   - python3-gpg
+  - python3-libsemanage
   - python3-markdown
+  - python3-policycoreutils
   - quota-devel
   - readline-devel
   - redhat-lsb
diff --git a/bootstrap/generated-dists/opensuse150/bootstrap.sh b/bootstrap/generated-dists/opensuse150/bootstrap.sh
index 4bf205e..3fbcaac 100755
--- a/bootstrap/generated-dists/opensuse150/bootstrap.sh
+++ b/bootstrap/generated-dists/opensuse150/bootstrap.sh
@@ -19,6 +19,7 @@ zypper --non-interactive install \
     bind-utils \
     binutils \
     bison \
+    chrpath \
     cups-devel \
     curl \
     dbus-1-devel \
@@ -42,7 +43,6 @@ zypper --non-interactive install \
     krb5-server \
     lcov \
     libacl-devel \
-    libaio-devel \
     libarchive-devel \
     libattr-devel \
     libblkid-devel \
@@ -51,7 +51,6 @@ zypper --non-interactive install \
     libcephfs-devel \
     libicu-devel \
     libjansson-devel \
-    libnettle-devel \
     libnsl-devel \
     libpcap-devel \
     libtasn1-devel \
@@ -78,18 +77,12 @@ zypper --non-interactive install \
     popt-devel \
     procps \
     psmisc \
-    python-crypto \
-    python-devel \
-    python-markdown \
-    python2-dnspython \
-    python2-gpg \
     python2-semanage \
     python3 \
     python3-Markdown \
     python3-devel \
     python3-dnspython \
     python3-gpg \
-    python3-pycrypto \
     readline-devel \
     rng-tools \
     rpcgen \
diff --git a/bootstrap/generated-dists/opensuse150/packages.yml b/bootstrap/generated-dists/opensuse150/packages.yml
index 8183e89..0eb1924 100644
--- a/bootstrap/generated-dists/opensuse150/packages.yml
+++ b/bootstrap/generated-dists/opensuse150/packages.yml
@@ -7,6 +7,7 @@ packages:
   - bind-utils
   - binutils
   - bison
+  - chrpath
   - cups-devel
   - curl
   - dbus-1-devel
@@ -30,7 +31,6 @@ packages:
   - krb5-server
   - lcov
   - libacl-devel
-  - libaio-devel
   - libarchive-devel
   - libattr-devel
   - libblkid-devel
@@ -39,7 +39,6 @@ packages:
   - libcephfs-devel
   - libicu-devel
   - libjansson-devel
-  - libnettle-devel
   - libnsl-devel
   - libpcap-devel
   - libtasn1-devel
@@ -66,18 +65,12 @@ packages:
   - popt-devel
   - procps
   - psmisc
-  - python-crypto
-  - python-devel
-  - python-markdown
-  - python2-dnspython
-  - python2-gpg
   - python2-semanage
   - python3
   - python3-Markdown
   - python3-devel
   - python3-dnspython
   - python3-gpg
-  - python3-pycrypto
   - readline-devel
   - rng-tools
   - rpcgen
diff --git a/bootstrap/generated-dists/opensuse151/bootstrap.sh b/bootstrap/generated-dists/opensuse151/bootstrap.sh
index 4bf205e..3fbcaac 100755
--- a/bootstrap/generated-dists/opensuse151/bootstrap.sh
+++ b/bootstrap/generated-dists/opensuse151/bootstrap.sh
@@ -19,6 +19,7 @@ zypper --non-interactive install \
     bind-utils \
     binutils \
     bison \
+    chrpath \
     cups-devel \
     curl \
     dbus-1-devel \
@@ -42,7 +43,6 @@ zypper --non-interactive install \
     krb5-server \
     lcov \
     libacl-devel \
-    libaio-devel \
     libarchive-devel \
     libattr-devel \
     libblkid-devel \
@@ -51,7 +51,6 @@ zypper --non-interactive install \
     libcephfs-devel \
     libicu-devel \
     libjansson-devel \
-    libnettle-devel \
     libnsl-devel \
     libpcap-devel \
     libtasn1-devel \
@@ -78,18 +77,12 @@ zypper --non-interactive install \
     popt-devel \
     procps \
     psmisc \
-    python-crypto \
-    python-devel \
-    python-markdown \
-    python2-dnspython \
-    python2-gpg \
     python2-semanage \
     python3 \
     python3-Markdown \
     python3-devel \
     python3-dnspython \
     python3-gpg \
-    python3-pycrypto \
     readline-devel \
     rng-tools \
     rpcgen \
diff --git a/bootstrap/generated-dists/opensuse151/packages.yml b/bootstrap/generated-dists/opensuse151/packages.yml
index 8183e89..0eb1924 100644
--- a/bootstrap/generated-dists/opensuse151/packages.yml
+++ b/bootstrap/generated-dists/opensuse151/packages.yml
@@ -7,6 +7,7 @@ packages:
   - bind-utils
   - binutils
   - bison
+  - chrpath
   - cups-devel
   - curl
   - dbus-1-devel