Merge ~ahasenack/ubuntu/+source/samba:kinetic-samba-416-merge into ubuntu/+source/samba:debian/sid

[Andreas Hasenack]

This is the big samba merge.

As always, when we go ahead of debian in terms of upstream versions, things get complicated to review. git range-diff, for example, just spins the CPU here and I didn't wait for it to finish. It goes nuts probably because part of the delta is adding and dropping the samba source code, a few times, and that's a large code base.

I will highlight what I did, decisions I made, in order to facilitate review.
- the delta drops I think are self explanatory and easy to follow
- the added delta around ctdb/nfs is just a consequence of debian changing the packaging of our existing ctdb/nfs delta. This can be squashed in the next upload with the existing ctdb/nfs delta we have. I also submitted the lot to debian via https://salsa.debian.org/samba-team/samba/-/merge_requests/58

Debian changes
This was a bit trickier. I listed many debian changes that needed a closer inspection[1]:

- ldb modules dir changed, compat symlinks added
Tested upgrade, and sssd.

- /var/lib/samba/private/msg.sock/ removal in postinst (it has a new place in /run/samba
/msg.sock). Check client tooling with new path
Seems to work fine. This is a code change, not config. Note: the new maintainer isn't shy of adding patches to upstream code even when they are not committed upstream. He does discuss them in the mailing list, though.

- ctdb-create-piddir.patch
Also works fine. It was the only service that didn't do this.

- stopped using tmpfiles.d
Some debian systems still use sysv. This works for us, provided the testparm-do-not-fail-if-pid-dir-does-not-exist.patch is applied as well (which it is)

- ensure-lfs patch (#221618)
ubuntu-devel thread[8][9]
Bigger change. Now instead of silently defining the LFS (Large File System/Summit) flags in libsmbclient.h via a patch, now this fails the build if an app includes that header and does not have a 64bit off_t type. I did a build of all reverse dependencies in a PPA[2], and the only failure was adsys, which is fixed upstream[3] and I notified didrocks to pull that fix in. Note the adsys build in the bileto ppa is using a packaging fix to pass, not upstream's fix. I tested the upstream fix in isolation and it was fine.
An extra protection layer to this change would be to define these extra flags in the 32bit build to the pkgconfig file, as suggested[4] by mvo. I sent that idea to the samba package maintainers list[5]. Not all apps use pkgconfig, but those who do, would benefit. mvo just added support[6] for pkgconfig to the libsmbclient-go upstream as well.

- selftest builddeps in d/control
Debian commented the build-dependencies used for self-test. I expect these to come back at some point in the future, because it looks like a different test-only build is needed, which generates binaries not suitable for production. So two builds of samba just for the tests, and this is a long build already.

- check symbols for python3-ldb and libldb2
LDB is now built from src:samba, obsoleting src:ldb we have in the archive (I'll take care of its removal). Note src:ldb is already gone from debian testing and unstable. The versioning and symbol generation for the ldb binary packages built from src:samba went through some iterations, but seem to have calmed down now. I tested build and upgrades, and dep8 where applicable, including sssd (which is the only rdeps of ldb outside of samba itself), and it all worked.

- changes to i386 builds
In particular, samba-vfs-modules is no longer built for i386 (rdeps is just samba itself, which is also not built on i386). This is fine.

- files moved from samba, samba-libs to python3-samba
Here I encountered something missing, according to "spec". The moving of files from `samba` and `samba-libs` to `python3-samba` did not fully follow case #9 from https://wiki.debian.org/PackageTransition. Only the `Replaces: A (<< 2)` bit was added to new B. It's missing `Breaks: A (<< 2)` in new B, and `Breaks: B (<< 2)` in new A. I did some testing and upgrades seem to work fine, even when a specific ordering was forced. I believe because many of the dependencies between these packages are of the "=" sort, and not ">" or "<", thus forcing upgrades to happen together.

- helper programs moved from /usr/lib/$arch to /usr/libexec
No side effects noticed.

- --with-profiling-data enabled: performance impact?
See bug #1846947: “No profiling support”. I pinged the debian samba list[7]. Conclusion seems to be the performance impact is negligible unless profiling is enabled in the config, in which case it is expected. Time will tell.

- disable-setuid-confchecks.patch is probably not needed in ubuntu... But it's just a build-
time thing.

Tests I did:
- there is bileto: https://bileto.ubuntu.com/#/ticket/4858
Besides the adsys failure, which is fixed upstream, the other failures are already existing in the archive, in particular the i386 ones which show missing i386 dependencies. I'll deal with them during the real migration.
- AD/DC provisioning with BIND9 DLZ. Worked fine.
- verifications for some of the debian changes above. Not profiling, though.

I would like to add an samba AD/DC provisioning DEP8 test, but this branch is too big already. I filed https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1977746 for it.

1. https://trello.com/c/8GZXl3t9
2. https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4858/+packages
3. https://github.com/mvo5/libsmbclient-go/issues/10
4. https://github.com/mvo5/libsmbclient-go/pull/11#issue-1259602702
5. https://alioth-lists.debian.net/pipermail/pkg-samba-maint/2022-June/023576.html
6. https://github.com/mvo5/libsmbclient-go/pull/12
7. https://alioth-lists.debian.net/pipermail/pkg-samba-maint/2022-June/023562.html
8. https://lists.ubuntu.com/archives/ubuntu-devel/2022-May/042109.html
9. https://lists.ubuntu.com/archives/ubuntu-devel/2022-June/042114.html

[Sergio Durigan Junior (sergiodj)]

FWIW, I'm still reviewing this MP. I got sidetracked with other stuff today, but tomorrow this will be my priority.

[Sergio Durigan Junior (sergiodj)]

Thanks for the MP, Andreas.

This is a big merge indeed. As I mentioned to you in the channel, I was a bit weary about bringing in so many chances (some of them seemingly experimental), but OTOH I also agree that this is a good time to do it & I trust your judgement here, of course. On a positive note, I'm overall happy to see the improvements the maintainer has been doing to the packaging bits.

I'll try to organize my review here; if there's something confusing just let me know and I'll be happy to clarify.

- The dropped delta, as you said, is self-explanatory. It's also very satisfying to see such a big drop!

- Thanks a lot for submitting the ctdb/nfs delta to Debian. The commits you're adding to the Ubuntu package LGTM.

Debian changes:

- ldb modules dir changed, compat symlinks added
Seems to be OK, indeed. I couldn't spot anything wrong, but then again I felt a bit lost while looking at the commits.

- /var/lib/samba/private/msg.sock/ removal in postinst (it has a new place in /run/samba
/msg.sock). Check client tooling with new path
This seems OK. Based on his message at https://lists.samba.org/archive/samba-technical/2022-April/137322.html, he found a few errors when performing this change. Unfortunately there weren't any replies to his message and I don't see an MR open either...

- ctdb-create-piddir.patch
OK.

- stopped using tmpfiles.d
OK. The previous hack was a bit ugly IMHO.

- ensure-lfs patch (#221618)
Great investigation, thanks for doing this. I think you covered everything there is to cover in this scenario; I also like the pkg-config suggestion and the fact that you forwarded the idea to Debian.

- selftest builddeps in d/control
OK. --enable-selftest was never enabled before, and I see that the new maintainer tried to enable it but stumbled upon some test failures, so he decided to just disable it again (but still leave all the machinery responsible for running the tests in d/rules).

- check symbols for python3-ldb and libldb2
What a mess :-/. Seems to be OK.

- changes to i386 builds
OK.

- files moved from samba, samba-libs to python3-samba
OK. The commit message for this specific change also mentions the decision to not add "Breaks":

https://salsa.debian.org/samba-team/samba/-/commit/e4b8f52090d61f03c27907331da254f3a333a774

- helper programs moved from /usr/lib/$arch to /usr/libexec
OK. I just wanted to double check whether the current supported FHS version includes /usr/libexec/ and it does (since 2018, in fact). I do remember seeing some lintian warnings with /usr/libexec/ previously, but it's been a while.

- --with-profiling-data enabled: performance impact?
Adding --with-profiling-data indeed raises some flags. I read the thread you pointed to, but I felt like I needed more data to be comfortable with this decision. I took some time to read the source code and check what this profile is and how it works. Basically, there are two types of profiling offered: counter profiling and "all" profiling. The counter one just counts the number of transactions made by Samba. The "all" profiling is basically "counter" + "times", which also keeps a record of the time taken to complete each transaction. T...

review: Approve

[Andreas Hasenack (ahasenack)]

> - helper programs moved from /usr/lib/$arch to /usr/libexec
> OK. I just wanted to double check whether the current supported FHS version includes
> /usr/libexec/ and it does (since 2018, in fact). I do remember seeing some lintian warnings with
> /usr/libexec/ previously, but it's been a while.

The lintian output on this package with -I is a "party", and takes about 5min to run. There was nothing specific about libexec indeed.

Thanks for the careful review of the profiling option. I hadn't gone that deep into it myself.

> - We've talked about this, but I don't know if you're planning to rebase your work against the
> latest uploads made by the Debian maintainer.

I have to, launchpad ingested them now ;)

> - It looks like LP #1807177 could/should be closed with this merge.

I was going to close these:
- #1846947: no profiling support
- #1971256: the merge bug

Thanks for finding #1807177, the gluster one I forgot to close during jammy.

09da202... by Andreas Hasenack on 2022-06-08

merge-changelogs

6f8d90e... by Andreas Hasenack on 2022-06-08

reconstruct-changelog

ca5f1ed... by Andreas Hasenack on 2022-06-08

update-maintainer

[Andreas Hasenack (ahasenack)]

I rebased and pushed. I dropped this added delta as expected because it's in 2:4.16.1+dfsg-7:

commit 6d9cafa6963bc5eae0c96e46bdf2fa82ad000953 (kinetic-samba-416-merge)
Author: Michael Tokarev <email address hidden>
Date: Mon May 30 11:00:04 2022 +0300

        - d/control: remove libunwind-dev build-dep again: internal
          backtrace is actually better
          [Committed to Debian, will be in their next upload]

diff --git a/debian/control b/debian/control
index c57523cf1609..78880674374b 100644
--- a/debian/control
+++ b/debian/control
@@ -59,7 +59,6 @@ Build-Depends-Arch:
        libsystemd-dev [linux-any],
        libtasn1-6-dev (>= 3.8),
        libtasn1-bin,
- libunwind-dev [amd64 arm64 armel armhf hppa i386 ia64 mips mips64 mips64el mipsel powerpc powerpcspe ppc64 ppc64el sh4],
        liburing-dev [!i386],
        xfslibs-dev [linux-any],
        zlib1g-dev (>= 1:1.2.3),

93d4762... by Andreas Hasenack on 2022-06-08

changelog: also close #1846947 (no profiling support)

[Andreas Hasenack (ahasenack)]

I uploaded this to bileto again (4858) just to avoid any brown paper bag bugs at the last minute.

[Andreas Hasenack (ahasenack)]

The latest debian changes are scary, specially the symbol removals from libwbclient0. I tested all reverse dependencies of that library that do not come from samba itself, and they seem to continue working after I just update libwbclient0, without any rebuilds. I did very basic testing, namely, just running the executable linked with libwbclient0:
- cifs-utils
- freeradius
- nfs-ganesha

gss-ntlmssp just provides a library, no app, and has no reverse dependencies (what uses this in the archive? I don't know).

The samba packages themselves all have exact versioning requirements amongst themselves, so by just updating libwbclient0 everything else is also upgraded.

Still, scary changes :) But maybe for the best, the samba libraries are a mix of internal and external use, and this cleanup seems to be going in the right direction.

[Andreas Hasenack (ahasenack)]

I'm just waiting for another bileto round, and then will upload if no other surprises appear. Hopefully there will be no new debian upload in the meantime.

[Andreas Hasenack (ahasenack)]

All green

[Andreas Hasenack (ahasenack)]

Uploaded:

Uploading samba using ftp to ubuntu (host: upload.ubuntu.com; directory: /ubuntu)
running badauthor: Stop if uploading with root@ or ubuntu@ email adresses.
running checksum: verify checksums before uploading
running gitubuntu: Warn if uploading without git-ubuntu Vcs-* entries.
running check-debs: makes sure the upload contains a binary package
running gpg: check GnuPG signatures before the upload
running supported-distribution: check whether the target distribution is currently supported (using distro-info)
{'allowed': ['release', 'proposed', 'backports', 'security'], 'known': ['release', 'proposed', 'updates', 'backports', 'security']}
running ppaforppaonly: Stop uploads to the archive with or to ppa without ~ppa suffix.
running suite-mismatch: check the target distribution for common errors
running nobug: Stop if uploading without any bug reference.
running updatemaintainer: Stop if ubuntu changes are without ubuntu maintainer.
running placeholderbug: Stop if using common placeholder numbers as bug reference.
running releasemismatch: Warn about mismatching suffixesg e.g. focal with a XX.YY not being 20.04
running required-fields: check whether a field is present and non-empty in the changes file
Uploading samba_4.16.1+dfsg-8ubuntu1.dsc
Uploading samba_4.16.1+dfsg.orig.tar.xz
Uploading samba_4.16.1+dfsg-8ubuntu1.debian.tar.xz
Uploading samba_4.16.1+dfsg-8ubuntu1_source.buildinfo
Uploading samba_4.16.1+dfsg-8ubuntu1_source.changes

[Andreas Hasenack (ahasenack)]

This migrated, closing MP.

diff --git a/debian/changelog b/debian/changelog
index 9531541..b835d74 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,96 @@
+samba (2:4.16.1+dfsg-8ubuntu1) kinetic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1971256, LP: #1846947). Remaining
+    changes:
+    - d/p/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/control: Ubuntu i386 binary compatibility:
+      + drop ceph support
+    - d/control: enable the liburing vfs module, except on i386 where
+      liburing is not available
+    - d/t/{cifs-share-access-uring,smbclient-share-access-uring}:
+      Skip running the tests if on i386 platform, because the uring
+      package is not available there.
+    - d/t/util: fix setting the password of the smb test user
+      (LP #1955851)
+    - Update nfs scripts for new nfs.conf config (LP #1961840):
+      + d/p/fix-nfs-service-name-to-nfs-kernel-server.patch: updated to use
+        nfsconf(8) if it's available, instead of parsing the old config
+        files in /etc/default/nfs-*
+      + d/ctdb.example/nfs-kernel-server/nfs.conf: /etc/nfs.conf to be
+        used by the example enable-nfs.sh example script
+      + d/ctdb.example/nfs-kernel-server/ctdb.example.quota: quota
+        config file to be used by the example enable-nfs.sh script
+      + d/ctdb.example/nfs-kernel-server/nfs-{common,kernel-server}:
+        obsolete, replaced by nfs.conf
+      + d/ctdb.example/nfs-kernel-server/enable-nfs.sh: handle new
+        nfs.conf and other changes in the new nfs server packages
+    - Build dlz module for bind 9.18.x (LP #1964032)
+      + d/p/add-support-for-bind-918.patch: build a dlz module for
+        bind 9.18.x
+      + d/p/add-support-for-bind-918-2.patch: also update the
+        provisioning tool and template config file
+    - d/rules: in Ubuntu, glusterfs is not built for i386, so don't
+      enable the samba glusterfs vfs mofule in that case
+    - d/control: build-depend on libglusterfs-dev only on !i386 arches
+  * Dropped:
+    - d/control: add a versioned libgnutls28-dev build-depends to reduce
+      the amount of in-tree crypto code that is built
+      [superfluous, the version in the archive is recent enough]
+    - d/samba.postinst: do not populate sambashare from the Ubuntu admin group (LP 1942195)
+      [Included in 2:4.13.13+dfsg-1]
+    - d/control: bump required build-depends
+      [Included in Debian]
+    - d/samba-libs.install: update list of installed libraries and
+      modules/plugins
+      [Done in Debian]
+    - debian/patches/CVE-2021-20254.patch: removed, applied upstream
+      [Applied upstream, Debian didn't have this patch]
+    - d/p/Rename-mdfind-to-mdsearch.patch: removed, applied usptream
+      [Applied usptream, Debian did not have it]
+    - d/{gpb.conf,watch,README.source}: update for 4.15
+      [Debian updated it for 4.16]
+    - d/rules: remove --with-dnsupdate, it was merged with
+      --with-ads in samba 4.15.0
+      [Included in 2:4.16.0+dfsg-1]
+    - d/rules: drop removal of ctdb tests, they are no longer installed
+      [Included in 2:4.16.0+dfsg-1]
+    - Remove findsmb, no longer installed:
+      + d/smbclient.install: remove findsmb
+      + d/rules: drop fixing of findsmb shebang
+      [Included in 2:4.16.0+dfsg-1]
+    - d/ctdb.install: remove ctdb_local_daemons, part of ctdb tests,
+      no longer installed
+      [Included in 2:4.16.0+dfsg-1]
+    - d/ctdb.install: add tdb_mutex_check
+      [Included in 2:4.16.0+dfsg-1]
+    - d/winbind.install: add async_dns_krb5_locator
+      [Included in 2:4.16.0+dfsg-1]
+    - d/samba.install: install samba-bgqd and its manpage
+      [Included in 2:4.16.0+dfsg-1]
+    - d/{libsmbclient,libwbclient0}.symbols: symbols updates
+      [Obsolete, these were for 4.15.5]
+    - d/rules: drop dh_perl override, unneeded
+      [Included in 2:4.16.0+dfsg-1]
+    - d/p/lp-1951490-fix-printing-KB5006743.patch: Fix printing after
+      Windows 2021-10 Monthly Rollup patch (LP #1951490)
+      [Included upstream in 4.16.0rc2]
+    - d/rules: install the new/changed ctdb example nfs files
+      [Installed via ctdb.examples]
+  * Added:
+    - rename ctdb example files nfs.conf and quota, to match what the
+      enable-nfs.sh script expects
+    - enable-nfs.sh ctdb example: use debian's filename for the
+      static port sysctl configuration
+    - enable-nfs.sh: in ctdb 4.16, the "recovery lock" config option was
+      renamed to "cluster lock"
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 08 Jun 2022 11:02:29 -0300
+
 samba (2:4.16.1+dfsg-8) unstable; urgency=medium
 
   * fix the Breaks/Replaces versions in the previous upload for moving
@@ -294,6 +387,95 @@ samba (2:4.16.0+dfsg-1) experimental; urgency=medium
 
  -- Michael Tokarev <[e-mail]>  Tue, 05 Apr 2022 16:01:25 +0300
 
+samba (2:4.15.5~dfsg-0ubuntu6) kinetic; urgency=medium
+
+  * No-change rebuild against libicu71
+
+ -- Steve Langasek <[e-mail]>  Sat, 30 Apr 2022 02:14:39 +0000
+
+samba (2:4.15.5~dfsg-0ubuntu5) jammy; urgency=medium
+
+  * Enable glusterfs support (LP: #1894618):
+    - d/control: revert disabling of glusterfs, since it's in main now
+    - d/rules: in Ubuntu, glusterfs is not built for i386, so don't
+      enable the samba glusterfs vfs mofule in that case
+    - d/control: build-depend on libglusterfs-dev only on !i386 arches
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 09 Mar 2022 17:31:25 -0300
+
+samba (2:4.15.5~dfsg-0ubuntu4) jammy; urgency=medium
+
+  * Build dlz module for bind 9.18.x (LP: #1964032)
+    - d/p/add-support-for-bind-918.patch: build a dlz module for
+      bind 9.18.x
+    - d/samba-libs.install: remove fixme comment
+    - d/p/add-support-for-bind-918-2.patch: also update the provisioning
+      tool and template config file
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 25 Mar 2022 14:53:19 -0300
+
+samba (2:4.15.5~dfsg-0ubuntu3) jammy; urgency=medium
+
+  * Update nfs scripts for new nfs.conf config (LP: #1961840):
+    - d/p/fix-nfs-service-name-to-nfs-kernel-server.patch: updated to use
+      nfsconf(8) if it's available, instead of parsing the old config
+      files in /etc/default/nfs-*
+    - d/ctdb.example.nfs.conf: /etc/nfs.conf to be used by the example
+      enable-nfs.sh example script
+    - d/ctdb.example.quota: quota config file to be used by the example
+      enable-nfs.sh script
+    - d/ctdb.example.nfs-{common,kernel-server}: obsolete, replaced by
+      nfs.conf
+    - d/ctdb.example.enable.nfs.sh: handle new nfs.conf and other
+      changes in the new nfs server packages
+    - d/rules: install the new/changed ctdb example nfs files
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 21 Mar 2022 11:55:54 -0300
+
+samba (2:4.15.5~dfsg-0ubuntu2) jammy; urgency=medium
+
+  * d/p/lp-1951490-fix-printing-KB5006743.patch: Fix printing after
+    Windows 2021-10 Monthly Rollup patch (LP: #1951490)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 10 Mar 2022 10:32:59 -0300
+
+samba (2:4.15.5~dfsg-0ubuntu1) jammy; urgency=medium
+
+  * d/{gpb.conf,watch,README.source}: update for 4.15
+  * New upstream release: 4.15.5 (LP: #1946839)
+  * d/p/Rename-mdfind-to-mdsearch.patch: removed, applied usptream
+  * d/rules: remove --with-dnsupdate, it was merged with
+    --with-ads in samba 4.15.0
+  * d/control: bump required build-depends
+  * d/rules: drop removal of ctdb tests, they are no longer installed
+  * Remove findsmb, no longer installed:
+    - d/smbclient.install: remove findsmb
+    - d/rules: drop fixing of findsmb shebang
+  * d/ctdb.install: remove ctdb_local_daemons, part of ctdb tests,
+    no longer installed
+  * d/samba-libs.install: update list of installed libraries and
+    modules/plugins
+  * d/ctdb.install: add tdb_mutex_check
+  * d/winbind.install: add async_dns_krb5_locator
+  * d/samba.install: install samba-bgqd and its manpage
+  * d/{libsmbclient,libwbclient0}.symbols: symbols updates
+  * d/control: add python3-markdown to build-depends
+  * d/watch: updated to handle ~dfsg versioning, thanks to
+    Sergio Durigan Junior <[e-mail]>
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 22 Feb 2022 17:59:22 -0300
+
+samba (2:4.13.17~dfsg-0ubuntu1) jammy; urgency=medium
+
+  * Update to 4.13.17 as a security update
+    - CVE-2021-43566, CVE-2021-44142, CVE-2022-0336
+  * Removed patches included in new version:
+    - debian/patches/trusted_domain_regression_fix.patch
+    - debian/patches/bug14901-*.patch
+    - debian/patches/bug14922.patch
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 14 Feb 2022 10:19:08 -0500
+
 samba (2:4.13.14+dfsg-1) unstable; urgency=high
 
   * New upstream security release in order to address the following defects:
@@ -320,6 +502,52 @@ samba (2:4.13.14+dfsg-1) unstable; urgency=high
 
  -- Mathieu Parent <[e-mail]>  Tue, 09 Nov 2021 20:53:03 +0100
 
+samba (2:4.13.14+dfsg-0ubuntu5) jammy; urgency=medium
+
+  * No-change rebuild for icu soname change
+
+ -- William 'jawn-smith' Wilson <[e-mail]>  Fri, 11 Feb 2022 11:36:14 -0600
+
+samba (2:4.13.14+dfsg-0ubuntu4) jammy; urgency=medium
+
+  * d/t/util: fix setting the password of the smb test user
+    (LP: #1955851)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 20 Jan 2022 17:06:13 -0300
+
+samba (2:4.13.14+dfsg-0ubuntu3) jammy; urgency=medium
+
+  * No-change rebuild with Python 3.10 as default version
+
+ -- Graham Inggs <[e-mail]>  Sun, 16 Jan 2022 07:01:34 +0000
+
+samba (2:4.13.14+dfsg-0ubuntu2) jammy; urgency=medium
+
+  * SECURITY REGRESSION: Kerberos authentication on standalone server in
+    MIT realm broken
+    - debian/patches/bug14922.patch: fix MIT Realm regression in
+      source3/auth/user_krb5.c.
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 13 Dec 2021 07:09:36 -0500
+
+samba (2:4.13.14+dfsg-0ubuntu1) jammy; urgency=medium
+
+  * Update to 4.13.14 as a security update (LP: #1950363)
+    - debian/patches/CVE-2021-20254.patch: removed, included in new
+      version.
+    - debian/control: bump ldb Build-Depends to 2.2.3.
+    - debian/samba-libs.install: added libdcerpc-pkt-auth.so.0.
+    - debian/patches/trusted_domain_regression_fix.patch: fix regression
+      introduced in 4.13.14.
+    - debian/patches/bug14901-*.patch: upstream patches to fix some
+      mapping issues.
+    - debian/patches/bug14918-*.patch: upstream patches to properly handle
+      dangling symlinks.
+    - CVE-2016-2124, CVE-2020-25717, CVE-2020-25718, CVE-2020-25719,
+      CVE-2020-25721, CVE-2020-25722, CVE-2021-3738, CVE-2021-23192
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 09 Nov 2021 14:52:07 -0500
+
 samba (2:4.13.13+dfsg-1) unstable; urgency=high
 
   [ Athos Ribeiro ]
@@ -341,6 +569,83 @@ samba (2:4.13.13+dfsg-1) unstable; urgency=high
 
  -- Mathieu Parent <[e-mail]>  Mon, 01 Nov 2021 08:59:20 +0100
 
+samba (2:4.13.5+dfsg-2ubuntu4) jammy; urgency=medium
+
+  * No-change rebuild against liburing2
+
+ -- Paride Legovini <[e-mail]>  Mon, 22 Nov 2021 18:08:34 +0100
+
+samba (2:4.13.5+dfsg-2ubuntu3) impish; urgency=medium
+
+  * d/samba.postinst: do not populate sambashare from the admin group
+    (Debian packaging cherry-pick. LP: #1942195)
+
+ -- Paride Legovini <[e-mail]>  Wed, 06 Oct 2021 10:31:14 +0200
+
+samba (2:4.13.5+dfsg-2ubuntu2) impish; urgency=medium
+
+  * No-change rebuild due to OpenLDAP soname bump.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 21 Jun 2021 18:08:36 -0400
+
+samba (2:4.13.5+dfsg-2ubuntu1) impish; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/p/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - d/control: Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+    - debian/control: Ubuntu i386 binary compatibility:
+      + drop ceph support
+    - d/control: add a versioned libgnutls28-dev build-depends to reduce
+      the amount of in-tree crypto code that is built
+    - d/control: enable the liburing vfs module, except on i386 where
+      liburing is not available
+    - d/t/{cifs-share-access-uring,smbclient-share-access-uring}:
+      Skip running the tests if on i386 platform, because the uring
+      package is not available there.
+  * Dropped changes:
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+      [Included in 2:4.13.4+dfsg-1]
+    - d/p/fix-nfs-service-name-to-nfs-kernel-server.patch:
+      change nfs service name from nfs to nfs-kernel-server
+      (LP #722201)
+      [Included in 2:4.13.4+dfsg-1]
+    - d/p/ctdb-config-enable-syslog-by-default.patch:
+      enable syslog and systemd journal by default
+      [Included in 2:4.13.4+dfsg-1]
+    - debian/rules: Ubuntu i386 binary compatibility:
+      + drop ceph support
+      + disable the following binary packages:
+        - ctdb
+        - libnss-winbind
+        - libpam-winbind
+        - python3-samba
+        - samba
+        - samba-common-bin
+        - samba-testsuite
+        - winbind
+      [Included in 2:4.13.4+dfsg-1]
+    - debian/rules: Ubuntu i386 binary compatibility:
+      + re-enable the following binary packages:
+        - libnss-winbind
+        - samba-common-bin
+        - python3-samba
+        - winbind
+      [Included in 2:4.13.4+dfsg-1]
+    - SECURITY UPDATE: wrong group entries via negative idmap cache entries
+      + debian/patches/CVE-2021-20254.patch: Simplify sids_to_unixids() in
+        source3/passdb/lookup_sid.c.
+      + CVE-2021-20254
+      [Included in 2:4.13.5+dfsg-2]
+
+ -- Athos Ribeiro <[e-mail]>  Mon, 17 May 2021 11:51:54 -0300
+
 samba (2:4.13.5+dfsg-2) unstable; urgency=high
 
   * CVE-2021-20254: Negative idmap cache entries can cause incorrect group
@@ -372,6 +677,86 @@ samba (2:4.13.4+dfsg-1) unstable; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Tue, 09 Feb 2021 22:26:43 +0100
 
+samba (2:4.13.3+dfsg-1ubuntu2.1) hirsute-security; urgency=medium
+
+  * SECURITY UPDATE: wrong group entries via negative idmap cache entries
+    - debian/patches/CVE-2021-20254.patch: Simplify sids_to_unixids() in
+      source3/passdb/lookup_sid.c.
+    - CVE-2021-20254
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 29 Apr 2021 06:48:54 -0400
+
+samba (2:4.13.3+dfsg-1ubuntu2) hirsute; urgency=medium
+
+  * No change rebuild to pick up liburing, and also
+    fix d/t/cifs-share-access-uring. (LP: #1914145)
+
+ -- Mauricio Faria de Oliveira <[e-mail]>  Wed, 03 Feb 2021 09:14:25 -0300
+
+samba (2:4.13.3+dfsg-1ubuntu1) hirsute; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/p/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - d/control, d/rules: Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+    - d/p/fix-nfs-service-name-to-nfs-kernel-server.patch:
+      change nfs service name from nfs to nfs-kernel-server
+      (LP #722201)
+    - d/p/ctdb-config-enable-syslog-by-default.patch:
+      enable syslog and systemd journal by default
+    - debian/rules: Ubuntu i386 binary compatibility:
+      + drop ceph support
+      + disable the following binary packages:
+        - ctdb
+        - libnss-winbind
+        - libpam-winbind
+        - python3-samba
+        - samba
+        - samba-common-bin
+        - samba-testsuite
+        - winbind
+    - debian/control: Ubuntu i386 binary compatibility:
+      + drop ceph support
+    - debian/rules: Ubuntu i386 binary compatibility:
+      + re-enable the following binary packages:
+        - libnss-winbind
+        - samba-common-bin
+        - python3-samba
+        - winbind
+    - d/control: add a versioned libgnutls28-dev build-depends to reduce
+      the amount of in-tree crypto code that is built
+    - d/control: enable the liburing vfs module, except on i386 where
+      liburing is not available
+  * Dropped changes, incorporated by Debian:
+    - d/t/smbclient-anonymous-share-list: add set -x and set -e
+    - Factor out common DEP8 test code into d/t/util and change the tests
+      to source from it:
+      + d/t/util: added
+      + d/t/cifs-share-access, d/t/smbclient-share-access: source from
+        util, use random share name and add set -x and set -u
+      + d/t/smbclient-authenticated-share-list: source from util and add
+        set -x and set -u
+    - Add new DEP8 tests for the uring vfs module:
+      + d/t/control: add smbclient-share-access-uring and
+        cifs-share-access-uring tests
+      + d/t/smbclient-share-access-uring: new test
+      + d/t/cifs-share-access-uring: new test
+    - d/t/{util, smbclient-share-access-uring, cifs-share-access-uring}:
+      guard uring tests with a kernel version check and skip if it's too old
+  * Added changes:
+    - d/t/{cifs-share-access-uring,smbclient-share-access-uring}:
+      Skip running the tests if on i386 platform, because the uring
+      package is not available there.
+
+ -- Sergio Durigan Junior <[e-mail]>  Wed, 13 Jan 2021 15:44:04 -0500
+
 samba (2:4.13.3+dfsg-1) unstable; urgency=medium
 
   [ Andreas Hasenack ]
@@ -387,6 +772,93 @@ samba (2:4.13.3+dfsg-1) unstable; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Wed, 16 Dec 2020 18:23:09 +0100
 
+samba (2:4.13.2+dfsg-3ubuntu1) hirsute; urgency=medium
+
+  * Merge with Debian unstable (LP: #1905048). Remaining changes:
+    - d/p/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - d/control, d/rules: Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+    - d/p/fix-nfs-service-name-to-nfs-kernel-server.patch:
+      change nfs service name from nfs to nfs-kernel-server
+      (LP #722201)
+    - d/p/ctdb-config-enable-syslog-by-default.patch:
+      enable syslog and systemd journal by default
+    - debian/rules: Ubuntu i386 binary compatibility:
+      + drop ceph support
+      + disable the following binary packages:
+        - ctdb
+        - libnss-winbind
+        - libpam-winbind
+        - python3-samba
+        - samba
+        - samba-common-bin
+        - samba-testsuite
+        - winbind
+    - debian/control: Ubuntu i386 binary compatibility:
+      + drop ceph support
+    - debian/rules: Ubuntu i386 binary compatibility:
+      + re-enable the following binary packages:
+        - libnss-winbind
+        - samba-common-bin
+        - python3-samba
+        - winbind
+    - d/control: add a versioned libgnutls28-dev build-depends to reduce
+      the amount of in-tree crypto code that is built
+  * d/t/smbclient-anonymous-share-list: add set -x and set -e
+  * Factor out common DEP8 test code into d/t/util and change the tests
+    to source from it:
+    - d/t/util: added
+    - d/t/cifs-share-access, d/t/smbclient-share-access: source from
+      util, use random share name and add set -x and set -u
+    - d/t/smbclient-authenticated-share-list: source from util and add
+      set -x and set -u
+  * d/control: enable the liburing vfs module, except on i386 where
+    liburing is not available
+  * Add new DEP8 tests for the uring vfs module:
+    - d/t/control: add smbclient-share-access-uring and
+      cifs-share-access-uring tests
+    - d/t/smbclient-share-access-uring: new test
+    - d/t/cifs-share-access-uring: new test
+  * d/t/{util, smbclient-share-access-uring, cifs-share-access-uring}:
+    guard uring tests with a kernel version check and skip if it's too old
+  * Dropped changes:
+    - SECURITY UPDATE: Unauthenticated domain controller compromise by
+      subverting Netlogon cryptography (ZeroLogon)
+      + debian/patches/zerologon-*.patch: backport upstream patches:
+        + For compatibility reasons, allow specifying an insecure netlogon
+          configuration per machine. See the following link for examples:
+          https://www.samba.org/samba/security/CVE-2020-1472.html
+        + Add additional server checks for the protocol attack in the
+          client-specified challenge to provide some protection when
+          'server schannel = no/auto' and avoid the false-positive results
+          when running the proof-of-concept exploit.
+    [ Incorporated by upstream. ]
+    - SECURITY UPDATE: Missing handle permissions check in ChangeNotify
+      + debian/patches/CVE-2020-14318-*.patch: ensure change notifies can't
+        get set unless the directory handle is open for SEC_DIR_LIST in
+        source4/torture/smb2/notify.c, source3/smbd/notify.c.
+      + CVE-2020-14318
+    - SECURITY UPDATE: Unprivileged user can crash winbind
+      + debian/patches/CVE-2020-14323-*.patch: fix invalid lookupsids DoS in
+        source3/winbindd/winbindd_lookupsids.c,
+        source4/torture/winbind/struct_based.c.
+      + CVE-2020-14323
+    - SECURITY UPDATE: DNS server crash via invalid records
+      - debian/patches/CVE-2020-14383-*.patch: ensure variable initialization
+        with NULL  and do not crash when additional data not found in
+        source4/rpc_server/dnsserver/dcerpc_dnsserver.c.
+      + CVE-2020-14383
+    [ Incorporated by upstream. ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 24 Nov 2020 22:12:00 -0500
+
 samba (2:4.13.2+dfsg-3) unstable; urgency=medium
 
   * Ensure systemd-tmpfiles is called before testparm (Closes: #975422)
@@ -432,6 +904,138 @@ samba (2:4.13.2+dfsg-1) experimental; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Thu, 12 Nov 2020 11:23:01 +0100
 
+samba (2:4.12.5+dfsg-3ubuntu4.1) groovy-security; urgency=medium
+
+  * SECURITY UPDATE: Missing handle permissions check in ChangeNotify
+    - debian/patches/CVE-2020-14318-*.patch: ensure change notifies can't
+      get set unless the directory handle is open for SEC_DIR_LIST in
+      source4/torture/smb2/notify.c, source3/smbd/notify.c.
+    - CVE-2020-14318
+  * SECURITY UPDATE: Unprivileged user can crash winbind
+    - debian/patches/CVE-2020-14323-*.patch: fix invalid lookupsids DoS in
+      source3/winbindd/winbindd_lookupsids.c,
+      source4/torture/winbind/struct_based.c.
+    - CVE-2020-14323
+  * SECURITY UPDATE: DNS server crash via invalid records
+    - debian/patches/CVE-2020-14383-*.patch: ensure variable initialization
+      with NULL  and do not crash when additional data not found in
+      source4/rpc_server/dnsserver/dcerpc_dnsserver.c.
+    - CVE-2020-14383
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 16 Oct 2020 06:53:44 -0400
+
+samba (2:4.12.5+dfsg-3ubuntu4) groovy; urgency=medium
+
+  * SECURITY UPDATE: Unauthenticated domain controller compromise by
+    subverting Netlogon cryptography (ZeroLogon)
+    - debian/patches/zerologon-*.patch: backport upstream patches:
+      + For compatibility reasons, allow specifying an insecure netlogon
+        configuration per machine. See the following link for examples:
+        https://www.samba.org/samba/security/CVE-2020-1472.html
+      + Add additional server checks for the protocol attack in the
+        client-specified challenge to provide some protection when
+        'server schannel = no/auto' and avoid the false-positive results
+        when running the proof-of-concept exploit.
+    - CVE-2020-1472
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 28 Sep 2020 09:46:49 -0400
+
+samba (2:4.12.5+dfsg-3ubuntu3) groovy; urgency=medium
+
+  * d/t/{util, smbclient-share-access-uring, cifs-share-access-uring}:
+    guard uring tests with a kernel version check and skip if it's too old
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 11 Aug 2020 11:00:35 -0300
+
+samba (2:4.12.5+dfsg-3ubuntu2) groovy; urgency=medium
+
+  * d/t/smbclient-anonymous-share-list: add set -x and set -e
+  * Factor out common DEP8 test code into d/t/util and change the tests
+    to source from it:
+    - d/t/util: added
+    - d/t/cifs-share-access, d/t/smbclient-share-access: source from
+      util, use random share name and add set -x and set -u
+    - d/t/smbclient-authenticated-share-list: source from util and add
+      set -x and set -u
+  * d/control: enable the liburing vfs module, except on i386 where
+    liburing is not available
+  * Add new DEP8 tests for the uring vfs module:
+    - d/t/control: add smbclient-share-access-uring and
+      cifs-share-access-uring tests
+    - d/t/smbclient-share-access-uring: new test
+    - d/t/cifs-share-access-uring: new test
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 04 Aug 2020 17:20:30 -0300
+
+samba (2:4.12.5+dfsg-3ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/p/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - d/control, d/rules: Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+    - d/p/fix-nfs-service-name-to-nfs-kernel-server.patch:
+      change nfs service name from nfs to nfs-kernel-server
+      (LP #722201)
+    - d/p/ctdb-config-enable-syslog-by-default.patch:
+      enable syslog and systemd journal by default
+    - debian/rules: Ubuntu i386 binary compatibility:
+      + drop ceph support
+      + disable the following binary packages:
+        - ctdb
+        - libnss-winbind
+        - libpam-winbind
+        - python3-samba
+        - samba
+        - samba-common-bin
+        - samba-testsuite
+        - winbind
+    - debian/control: Ubuntu i386 binary compatibility:
+      + drop ceph support
+    - debian/rules: Ubuntu i386 binary compatibility:
+      + re-enable the following binary packages:
+        - libnss-winbind
+        - samba-common-bin
+        - python3-samba
+        - winbind
+    - d/control: add a versioned libgnutls28-dev build-depends to reduce
+      the amount of in-tree crypto code that is built
+  * Dropped:
+    - d/gbp.conf, d/watch, d/README.source: update for 4.12
+      [In 2:4.12.3+dfsg-1]
+    - d/control: bump build-depends:
+      + ldb: 2.1.2
+      + tevent: 0.10.2
+      + tdb: 1.4.3
+      + talloc: 2.3.1
+      [In 2:4.12.3+dfsg-1]
+    - d/smbclient.install: add new binary mdfind and its manpage
+      [In 2:4.12.3+dfsg-1]
+    - d/samba-dev.install, d/samba-libs.install: new lib
+      libdcerpc-server-core
+      [In 2:4.12.3+dfsg-1]
+    - d/samba-libs.install: new library libtalloc-report-printf
+      [In 2:4.12.3+dfsg-1]
+    - d/libwbclient0.install: remove libaesni, no longer built when
+      gnutls provides AES CMAC
+      [In 2:4.12.3+dfsg-1]
+    - d/libsmbclient.symbols, d/libwbclient0.symbols: update symbols
+      [In 2:4.12.3+dfsg-1]
+    - d/p/build-Remove-tests-for-getdents-and-getdirentries.patch
+      [Dropped in 2:4.12.3+dfsg-1]
+    - d/p/wscript-remove-all-checks-for-_FUNC-and-__FUNC.patch
+      [Dropped in 2:4.12.3+dfsg-1]
+    - d/p/wscript-split-function-check-to-one-per-line-and-sor.patch
+      [Dropped in 2:4.12.3+dfsg-1]
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 31 Jul 2020 11:07:47 -0300
+
 samba (2:4.12.5+dfsg-3) unstable; urgency=high
 
   * Add Breaks: sssd-ad-common (<< 2.3.0), due to libndr so bump
@@ -496,6 +1100,131 @@ samba (2:4.12.3+dfsg-1) experimental; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Wed, 24 Jun 2020 23:12:11 +0200
 
+samba (2:4.12.2+dfsg-0ubuntu1) groovy; urgency=medium
+
+  * New upstream version: 4.12.2
+  * d/gbp.conf, d/watch, d/README.source: update for 4.12
+  * d/control: bump build-depends:
+    - ldb: 2.1.2
+    - tevent: 0.10.2
+    - tdb: 1.4.3
+    - talloc: 2.3.1
+  * d/smbclient.install: add new binary mdfind and its manpage
+  * d/samba-dev.install, d/samba-libs.install: new lib libdcerpc-server-core
+  * d/samba-libs.install: new library libtalloc-report-printf
+  * d/libwbclient0.install: remove libaesni, no longer built when
+    gnutls provides AES CMAC
+  * d/libsmbclient.symbols, d/libwbclient0.symbols: update symbols
+  * d/control: add a versioned libgnutls28-dev build-depends to reduce
+    the amount of in-tree crypto code that is built
+  * Dropped (applied upstream):
+    - d/p/build-Remove-tests-for-getdents-and-getdirentries.patch
+    - d/p/wscript-remove-all-checks-for-_FUNC-and-__FUNC.patch
+    - d/p/wscript-split-function-check-to-one-per-line-and-sor.patch
+    - d/p/CVE-2020-10700*.patch, d/p/CVE-2020-10704*.patch
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 12 May 2020 10:42:17 -0300
+
+samba (2:4.11.6+dfsg-0ubuntu1.1) focal-security; urgency=medium
+
+  * SECURITY UPDATE: Use-after-free in AD DC LDAP server
+    - debian/patches/CVE-2020-10700-1.patch: add test for ASQ and ASQ in
+      combination with paged_results in selftest/knownfail.d/asq,
+      source4/dsdb/tests/python/asq.py, source4/selftest/tests.py.
+    - debian/patches/CVE-2020-10700-3.patch: do not permit the ASQ control
+      for the GUID search in paged_results in selftest/knownfail.d/asq,
+      source4/dsdb/samdb/ldb_modules/paged_results.c.
+    - debian/control: bump libldb-dev, python3-ldb, and python3-ldb-dev
+      Build-Depends to 2.0.10.
+    - CVE-2020-10700
+  * SECURITY UPDATE: Stack overflow in AD DC LDAP server
+    - debian/patches/CVE-2020-10704-1.patch: add ASN.1 max tree depth in
+      auth/gensec/gensec_util.c, lib/util/asn1.c, lib/util/asn1.h,
+      lib/util/tests/asn1_tests.c, libcli/auth/spnego_parse.c,
+      libcli/cldap/cldap.c, libcli/ldap/ldap_message.c,
+      source3/lib/tldap.c, source3/lib/tldap_util.c,
+      source3/libsmb/clispnego.c, source3/torture/torture.c,
+      source4/auth/gensec/gensec_krb5.c, source4/ldap_server/ldap_server.c,
+      source4/libcli/ldap/ldap_client.c,
+      source4/libcli/ldap/ldap_controls.c.
+    - debian/patches/CVE-2020-10704-3.patch: check parse tree depth in
+      lib/util/asn1.c.
+    - debian/patches/CVE-2020-10704-5.patch: add max ldap request sizes in
+      docs-xml/smbdotconf/ldap/ldapmaxanonrequest.xml,
+      docs-xml/smbdotconf/ldap/ldapmaxauthrequest.xml,
+      lib/param/loadparm.c, source3/param/loadparm.c.
+    - debian/patches/CVE-2020-10704-6.patch: limit request sizes in
+      source4/ldap_server/ldap_server.c.
+    - debian/patches/CVE-2020-10704-7.patch: add search size limits to
+      ldap_decode in docs-xml/smbdotconf/ldap/ldapmaxsearchrequest.xml,
+      lib/param/loadparm.c, libcli/cldap/cldap.c,
+      libcli/ldap/ldap_message.c, libcli/ldap/ldap_message.h,
+      source3/param/loadparm.c, source4/ldap_server/ldap_server.c,
+      source4/libcli/ldap/ldap_client.c.
+    - debian/patches/CVE-2020-10704-8.patch: check search request lengths
+      in lib/util/asn1.c, lib/util/asn1.h, libcli/ldap/ldap_message.c.
+    - CVE-2020-10704
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 24 Apr 2020 08:08:38 -0400
+
+samba (2:4.11.6+dfsg-0ubuntu1) focal; urgency=medium
+
+  * New upstream release: 4.11.6
+  * d/p/samba-tool-py38-*.patch: dropped, fixed upstream
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 26 Feb 2020 11:55:16 -0300
+
+samba (2:4.11.5+dfsg-1ubuntu2) focal; urgency=medium
+
+  * d/p/samba-tool-py38-*.patch: use correct method flags (LP: #1864324)
+
+ -- Andreas Hasenack <[e-mail]>  Sat, 22 Feb 2020 17:22:21 -0300
+
+samba (2:4.11.5+dfsg-1ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - d/control, d/rules: Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+    - d/p/fix-nfs-service-name-to-nfs-kernel-server.patch:
+      change nfs service name from nfs to nfs-kernel-server
+      (LP #722201)
+    - d/p/ctdb-config-enable-syslog-by-default.patch:
+      enable syslog and systemd journal by default
+    - debian/rules: Ubuntu i386 binary compatibility:
+      + drop ceph support
+      + disable the following binary packages:
+        - ctdb
+        - libnss-winbind
+        - libpam-winbind
+        - python3-samba
+        - samba
+        - samba-common-bin
+        - samba-testsuite
+        - winbind
+    - debian/control: Ubuntu i386 binary compatibility:
+      + drop ceph support
+    - debian/rules: Ubuntu i386 binary compatibility:
+      + re-enable the following binary packages:
+        - libnss-winbind
+        - samba-common-bin
+        - python3-samba
+        - winbind
+  * Dropped:
+    - d/control: drop python3-matplotlib. It's only used in
+      script/attr_count_read which is not installed with the
+      samba packages.
+      [In 2:4.11.3+dfsg-1]
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 17 Feb 2020 15:29:35 -0300
+
 samba (2:4.11.5+dfsg-1) unstable; urgency=medium
 
   * New upstream security release
@@ -523,6 +1252,161 @@ samba (2:4.11.3+dfsg-1) unstable; urgency=high
 
  -- Mathieu Parent <[e-mail]>  Mon, 16 Dec 2019 09:47:45 +0100
 
+samba (2:4.11.1+dfsg-3ubuntu4) focal; urgency=medium
+
+   * Ubuntu i386 binary compatibility effort: (LP: #1861316)
+    - debian/rules:
+        + re-enable the following binary packages generation:
+          - libnss-winbind
+          - samba-common-bin
+          - python3-samba
+          - winbind
+
+ -- Rafael David Tinoco <[e-mail]>  Thu, 06 Feb 2020 14:42:38 +0000
+
+samba (2:4.11.1+dfsg-3ubuntu3) focal; urgency=medium
+
+  * No-change rebuild to build with python3.8.
+
+ -- Matthias Klose <[e-mail]>  Sat, 25 Jan 2020 06:06:11 +0000
+
+samba (2:4.11.1+dfsg-3ubuntu2) focal; urgency=medium
+
+  * Ubuntu i386 binary compatibility effort: (LP: #1858479)
+    - debian/control:
+        + drop ceph support
+    - debian/rules:
+        + drop ceph support
+        + disable the following binary packages generation:
+          - ctdb
+          - libnss-winbind
+          - libpam-winbind
+          - python3-samba
+          - samba
+          - samba-common-bin
+          - samba-testsuite
+          - winbind
+
+ -- Rafael David Tinoco <[e-mail]>  Thu, 09 Jan 2020 00:40:31 +0000
+
+samba (2:4.11.1+dfsg-3ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - d/control, d/rules: Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+    - d/p/fix-nfs-service-name-to-nfs-kernel-server.patch:
+      change nfs service name from nfs to nfs-kernel-server
+      (LP #722201)
+      [Adopted the Debian version and added a couple of extra hunks
+      we had]
+    - d/p/ctdb-config-enable-syslog-by-default.patch:
+      enable syslog and systemd journal by default
+  * Dropped:
+    - Add apport hook:
+      + Created debian/source_samba.py.
+      + debian/rules, debian/samba-common-bin.install: install hook.
+      [In 2:4.9.4+dfsg-2]
+    - Removed patches already applied upstream:
+      + d/p/nsswitch-Add-try_authtok-option-to-pam_winbind.patch
+        [Removed in 2:4.10.7+dfsg-1]
+      + d/p/s3-auth-ignore-create_builtin_guests-failing-without.patch
+        [Removed in 4.9.5+dfsg-1]
+    - d/p/add-so-version-to-private-libraries: refreshed to remove fuzz
+      [Refreshed in 2:4.1.17+dfsg-1]
+    - d/control: Updated build dependencies (already updated in Debian):
+      + tdb >= 1.3.17
+      + talloc >= 2.1.15
+      + tevent >= 0.9.38
+      + ldb >= 1.5.3
+    - d/samba-common.docs: README is now README.md
+      [In 2:4.10.7+dfsg-1]
+    - d/libsmbclient.symbols: update symbols for this version
+    - d/libwbclient0.symbols: update symbols for this version
+    - d/ctdb.install: new binary ctdb_local_daemons
+      [In 2:4.10.7+dfsg-1]
+    - d/samba-dev.install: use globbing for the header files with
+      exceptions for wbclient.h and libsmbclient.h, which belong in
+      other packages.
+      [In 2:4.10.7+dfsg-1]
+    - d/rules: fix globbing used to move the dckeytab python module to the
+      samba package, and add a comment explaining why this is being done.
+      [In 2:4.10.7+dfsg-1]
+    - Switch to python3 (in 2:4.10.7+dfsg-1):
+      + d/rules: calculate the ldb version using python3, and drop the
+        "really" bit since the real 1.5.x series is being used now.
+      + d/rules: make sure python3 is used for the build
+      + d/rules: adjust globbing to remove the python3 version of tevent.so
+      + d/rules: drop PYVERS, unused
+      + d/control: adjust dependencies (build and runtime) for python3
+      + d/python3-samba.install, d/control: new python3-samba package
+        (LP #1440381)
+      + d/control, d/python-samba.install: get rid of python-samba, which is py2
+      + d/python3-samba.lintian-overrides: use the same overrides we had for
+        python-samba, now deleted.
+      + d/samba-dev.install, d/samba-libs.install: update file list
+      + d/t/control, d/t/python-smoke: use python3
+      + d/control: use ${python3:Depends} now instead of the python 2
+        counterpart for samba and samba-common-bin.
+    - d/control: drop suggests for python-gpgme, it's no longer available.
+      [In 2:4.10.7+dfsg-1]
+    - d/gbp.conf, d/watch, r/README.source: updated for 4.10
+      [In 2:4.10.7+dfsg-1]
+    - d/control: update cmocka build-depends to >= 1.1.3
+      [In 2:4.10.7+dfsg-1]
+    - d/samba-libs.install: bump passdb minor to 0.27.2
+      [In 2:4.10.7+dfsg-1]
+    - d/ctdb.install, d/rules: create ctdb run directory into tmpfiles.d
+      to allow pid file to exist (LP #1821775)
+      [In 2:4.10.7+dfsg-1]
+    - Allow proper ctdb initalization (LP #1828799):
+      + d/ctdb.dirs: added /var/lib/ctdb/* directories
+      + d/ctdb.postrm: remove leftovers from:
+        /var/lib/ctdb/{state,persistent,volatile,scripts}
+      [In 2:4.10.7+dfsg-1]
+    - d/rules: installing provided config examples and helper scripts
+    - Examples of NFS HA CTDB config files + helper script:
+      + d/ctdb.example.enable.nfs.sh
+      + d/ctdb.example.nfs-common
+      + d/ctdb.example.nfs-kernel-server
+      + d/ctdb.example.services
+      + d/ctdb.example.sysctl-nfs-static-ports.conf
+      [In 2:4.10.7+dfsg-1]
+    - debian/rules: Make DEB_HOST_ARCH_CPU initialized through
+      dpkg-architecture (Closes: #931138)
+      [In 2:4.10.7+dfsg-1]
+    - d/control: update ldb build-deps to 1.5.5
+      [In 2:4.10.7+dfsg-1]
+    - SECURITY UPDATE: restricted share escape by user (LP #1842533)
+      [fixed upstream in 4.11.0rc2]
+      + debian/patches/CVE-2019-10197-01-v4-10.patch: smbd: separate
+        out impersonation debug info into a new function.
+      + debian/patches/CVE-2019-10197-02-v4-10.patch: smbd: make sure that
+        change_to_user_internal() always resets current_user.done_chdir
+      + debian/patches/CVE-2019-10197-03-v4-10.patch: smbd: make sure we
+        reset current_user.{need,done}_chdir in become_root()
+      + debian/patches/CVE-2019-10197-04-v4-10.patch: selftest: make
+        fsrvp_share its own independent subdirectory
+      + debian/patches/CVE-2019-10197-05-v4-10.patch:
+        test_smbclient_s3.sh: add regression test for the no permission
+        on share root problem
+      + debian/patches/CVE-2019-10197-06-v4-10.patch: smbd: split
+        change_to_user_impersonate() out of change_to_user_internal()
+      + CVE-2019-10197
+  * Added:
+    - d/control: drop python3-matplotlib. It's only used in
+      script/attr_count_read which is not installed with the
+      samba packages.
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 29 Nov 2019 18:00:22 -0300
+
 samba (2:4.11.1+dfsg-3) unstable; urgency=medium
 
   * Add some python dependencies:
@@ -731,6 +1615,209 @@ samba (2:4.10.7+dfsg-1) experimental; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Thu, 29 Aug 2019 14:32:52 +0200
 
+samba (2:4.10.7+dfsg-0ubuntu3) focal; urgency=medium
+
+  * No-change rebuild to build with python3.8.
+
+ -- Matthias Klose <[e-mail]>  Fri, 18 Oct 2019 18:53:34 +0000
+
+samba (2:4.10.7+dfsg-0ubuntu2) eoan; urgency=medium
+
+  * SECURITY UPDATE: restricted share escape by user (LP: #1842533)
+    - debian/patches/CVE-2019-10197-01-v4-10.patch: smbd: separate
+      out impersonation debug info into a new function.
+    - debian/patches/CVE-2019-10197-02-v4-10.patch: smbd: make sure that
+      change_to_user_internal() always resets current_user.done_chdir
+    - debian/patches/CVE-2019-10197-03-v4-10.patch: smbd: make sure we
+      reset current_user.{need,done}_chdir in become_root()
+    - debian/patches/CVE-2019-10197-04-v4-10.patch: selftest: make
+      fsrvp_share its own independent subdirectory
+    - debian/patches/CVE-2019-10197-05-v4-10.patch:
+      test_smbclient_s3.sh: add regression test for the no permission
+      on share root problem
+    - debian/patches/CVE-2019-10197-06-v4-10.patch: smbd: split
+      change_to_user_impersonate() out of change_to_user_internal()
+    - CVE-2019-10197
+
+ -- Steve Beattie <[e-mail]>  Fri, 30 Aug 2019 11:07:19 -0700
+
+samba (2:4.10.7+dfsg-0ubuntu1) eoan; urgency=medium
+
+  * New upstream version: 4.10.7
+    - d/p/ctdb-config-depend-on-etc-default-nodes-file.patch: dropped,
+      included upstream in 4.10.7
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 22 Aug 2019 15:03:23 -0300
+
+samba (2:4.10.6+dfsg-0ubuntu1) eoan; urgency=medium
+
+  * New upstream version: 4.10.6
+    - d/p/fix-nfs-service-name-to-nfs-kernel-server.patch: changed to update
+      the Debian config and use it.
+    - d/control: update ldb build-deps to 1.5.5
+  * Dropped:
+    - d/p/CVE-2019-12436.patch: fixed upstream in 4.10.5
+    - d/p/CVE-2019-12435-*.patch: fixed upstream in 4.10.5
+    - d/p/CVE-2018-16860-*.patch: fixed upstream in 4.10.3
+    - d/p/CVE-2019-3880.patch: fixed upstream in 4.10.2
+    - d/p/CVE-2019-3870-*.patch: fixed upstream in 4.10.2
+    - d/p/dlz_bind_zone_update.patch: fixed upstream in 4.10.1
+    - d/p/ctdb-scripts-fix-tcp_tw_recycle-existence-check.patch: fixed
+      upstream in 4.10.5
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 07 Aug 2019 17:20:48 -0300
+
+samba (2:4.10.0+dfsg-0ubuntu6) eoan; urgency=medium
+
+  * d/p/fix-nfs-service-name-to-nfs-kernel-server.patch:
+    change service name from nfs to nfs-kernel-server in
+    legacy script 06.nfs.script also (LP: #722201)
+
+ -- Rafael David Tinoco <[e-mail]>  Thu, 11 Jul 2019 21:44:49 +0000
+
+samba (2:4.10.0+dfsg-0ubuntu5) eoan; urgency=medium
+
+  * debian/rules: Make DEB_HOST_ARCH_CPU initialized through
+    dpkg-architecture (Closes: #931138)
+  * d/p/ctdb-scripts-fix-tcp_tw_recycle-existence-check.patch:
+    fix tcp_tw_recycle existence check. (LP: #722201)
+  * d/p/fix-nfs-service-name-to-nfs-kernel-server.patch:
+    change nfs service name from nfs to nfs-kernel-server
+    (LP: #722201)
+  * d/ctdb.install, d/rules: create ctdb run directory into tmpfiles.d
+    to allow pid file to exist (LP: #1821775)
+  * Allow proper ctdb initialization (LP: #1828799):
+    - d/ctdb.dirs: added /var/lib/ctdb/* directories
+    - d/ctdb.postrm: remove leftovers from:
+      /var/lib/ctdb/{state,persistent,volatile,scripts}
+  * d/rules: installing provided config examples and helper scripts
+  * Examples of NFS HA CTDB config files + helper script:
+    - d/ctdb.example.enable.nfs.sh
+    - d/ctdb.example.nfs-common
+    - d/ctdb.example.nfs-kernel-server
+    - d/ctdb.example.services
+    - d/ctdb.example.sysctl-nfs-static-ports.conf
+  * d/p/ctdb-config-depend-on-etc-default-nodes-file.patch:
+    do not try to start daemon if /etc/ctdb/nodes does not exist
+  * d/p/ctdb-config-enable-syslog-by-default.patch:
+    enable syslog and systemd journal by default
+
+ -- Rafael David Tinoco <[e-mail]>  Fri, 28 Jun 2019 00:14:27 +0000
+
+samba (2:4.10.0+dfsg-0ubuntu4) eoan; urgency=medium
+
+  * SECURITY UPDATE: zone operations can crash rpc server
+    - debian/patches/CVE-2019-12435-1.patch: avoid NULL deference if zone
+      not found in DnssrvOperation in
+      python/samba/tests/dcerpc/dnsserver.py,
+      source4/rpc_server/dnsserver/dcerpc_dnsserver.c.
+    - debian/patches/CVE-2019-12435-2.patch: avoid NULL deference if zone
+      not found in DnssrvOperation2 in
+      python/samba/tests/dcerpc/dnsserver.py,
+      source4/rpc_server/dnsserver/dcerpc_dnsserver.c.
+    - CVE-2019-12435
+  * SECURITY UPDATE: paged_searches crash on LDAP and homes access
+    - debian/patches/CVE-2019-12436.patch: ignore successful results
+      without messages in source4/dsdb/samdb/ldb_modules/paged_results.c,
+      source4/dsdb/tests/python/vlv.py.
+    - CVE-2019-12436
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 12 Jun 2019 10:08:44 -0400
+
+samba (2:4.10.0+dfsg-0ubuntu3) eoan; urgency=medium
+
+  * SECURITY UPDATE: Samba AD DC S4U2Self/S4U2Proxy unkeyed checksum
+    - debian/patches/CVE-2018-16860-1.patch: add test for S4U2Self with
+      unkeyed checksum in selftest/knownfail.d/mitm-s4u2self,
+      source4/torture/krb5/kdc-canon-heimdal.c.
+    - debian/patches/CVE-2018-16860-2.patch: reject PA-S4U2Self with
+      unkeyed checksum in selftest/knownfail.d/mitm-s4u2self,
+      source4/heimdal/kdc/krb5tgs.c.
+    - CVE-2018-16860
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 14 May 2019 09:10:24 -0400
+
+samba (2:4.10.0+dfsg-0ubuntu2) disco; urgency=medium
+
+  * SECURITY UPDATE: world writable files in Samba AD DC private/ dir
+    - debian/patches/CVE-2019-3870-1.patch: extend smbd tests to check for
+      umask being overwritten in python/samba/tests/ntacls_backup.py,
+      python/samba/tests/posixacl.py, python/samba/tests/smbd_base.py,
+      selftest/knownfail.d/umask-leak.
+    - debian/patches/CVE-2019-3870-2.patch: add test to check
+      file-permissions are correct after provision in
+      selftest/knownfail.d/provision_fileperms, source4/selftest/tests.py,
+      source4/setup/tests/provision_fileperms.sh.
+    - debian/patches/CVE-2019-3870-3.patch: include tests to show the
+      outside umask has no impact in python/samba/tests/ntacls_backup.py,
+      python/samba/tests/smbd_base.py, selftest/knownfail.d/pymkdir-umask.
+    - debian/patches/CVE-2019-3870-4.patch: move umask manipuations as
+      close as possible to users in source3/smbd/pysmbd.c,
+      selftest/knownfail.d/provision_fileperms,
+      selftest/knownfail.d/umask-leak.
+    - debian/patches/CVE-2019-3870-5.patch: ensure a zero umask is set for
+      smbd.mkdir() in selftest/knownfail.d/pymkdir-umask,
+      source3/smbd/pysmbd.c.
+    - CVE-2019-3870
+  * SECURITY UPDATE: save registry file outside share as unprivileged user
+    - debian/patches/CVE-2019-3880.patch: remove implementations of
+      SaveKey/RestoreKey in source3/rpc_server/winreg/srv_winreg_nt.c.
+    - CVE-2019-3880
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 08 Apr 2019 10:32:30 -0400
+
+samba (2:4.10.0+dfsg-0ubuntu1) disco; urgency=medium
+
+  * New upstream version: 4.10.0
+    - d/gbp.conf, d/watch, r/README.source: updated for 4.10
+    - d/control: update cmocka build-depends to >= 1.1.3
+    - d/samba-libs.install: bump passdb minor to 0.27.2
+  * d/p/dlz_bind_zone_update.patch: make b9_has_soa check dc=@ node. Thanks to
+    Michael Saxl <[e-mail]>. (LP: #1820846)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 21 Mar 2019 14:40:32 -0300
+
+samba (2:4.10.0~rc4+dfsg-0ubuntu1) disco; urgency=medium
+
+  * New upstream version 4.10.0rc4 (LP: #1818518):
+    - Removed patches already applied upstream:
+      + d/p/nsswitch-Add-try_authtok-option-to-pam_winbind.patch
+      + d/p/s3-auth-ignore-create_builtin_guests-failing-without.patch
+    - d/p/add-so-version-to-private-libraries: refreshed to remove fuzz
+    - d/control: Updated build dependencies:
+      + tdb >= 1.3.17
+      + talloc >= 2.1.15
+      + tevent >= 0.9.38
+      + ldb >= 1.5.3
+    - d/samba-common.docs: README is now README.md
+    - d/libsmbclient.symbols: update symbols for this version
+    - d/libwbclient0.symbols: update symbols for this version
+    - d/ctdb.install: new binary ctdb_local_daemons
+    - d/samba-dev.install: use globbing for the header files with
+      exceptions for wbclient.h and libsmbclient.h, which belong in
+     other packages.
+    - d/rules: fix globbing used to move the dckeytab python module to the
+      samba package, and add a comment explaining why this is being done.
+  * Switch to python3:
+    - d/rules: calculate the ldb version using python3, and drop the
+      "really" bit since the real 1.5.x series is being used now.
+    - d/rules: make sure python3 is used for the build
+    - d/rules: adjust globbing to remove the python3 version of tevent.so
+    - d/rules: drop PYVERS, unused
+    - d/control: adjust dependencies (build and runtime) for python3
+    - d/python3-samba.install, d/control: new python3-samba package
+      (LP: #1440381)
+    - d/control, d/python-samba.install: get rid of python-samba, which is py2
+    - d/python3-samba.lintian-overrides: use the same overrides we had for
+      python-samba, now deleted.
+    - d/samba-dev.install, d/samba-libs.install: update file list
+    - d/t/control, d/t/python-smoke: use python3
+    - d/control: use ${python3:Depends} now instead of the python 2
+      counterpart for samba and samba-common-bin.
+  * d/control: drop suggests for python-gpgme, it's no longer available.
+
+ -- Andreas Hasenack <[e-mail]>  Sat, 09 Mar 2019 12:45:25 +0000
+
 samba (2:4.9.5+dfsg-1) experimental; urgency=medium
 
   * New upstream release
@@ -775,6 +1862,31 @@ samba (2:4.9.4+dfsg-2) unstable; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Wed, 23 Jan 2019 20:59:08 +0100
 
+samba (2:4.9.4+dfsg-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - Add apport hook:
+      + Created debian/source_samba.py.
+      + debian/rules, debian/samba-common-bin.install: install hook.
+    - d/control, d/rules: Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+  * Dropped:
+    - d/p/smbd-startup-with-winbind.patch: ignore create_builtin_guests()
+      failing without a valid idmap configuration. This fixes the smbd startup
+      on a standalone server where winbind is available and running. Thanks to
+      Stefan Metzmacher <[e-mail]>. (LP #1806035)
+      [Fixed in 2:4.9.4+dfsg-1]
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 17 Jan 2019 18:23:52 -0200
+
 samba (2:4.9.4+dfsg-1) unstable; urgency=medium
 
   * New upstream release
@@ -785,6 +1897,44 @@ samba (2:4.9.4+dfsg-1) unstable; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Sat, 22 Dec 2018 18:32:00 +0100
 
+samba (2:4.9.2+dfsg-2ubuntu3) disco; urgency=medium
+
+  * No-change rebuild for readline soname change.
+
+ -- Matthias Klose <[e-mail]>  Mon, 14 Jan 2019 20:03:58 +0000
+
+samba (2:4.9.2+dfsg-2ubuntu2) disco; urgency=medium
+
+  * d/p/smbd-startup-with-winbind.patch: ignore create_builtin_guests()
+    failing without a valid idmap configuration. This fixes the smbd startup
+    on a standalone server where winbind is available and running. Thanks to
+    Stefan Metzmacher <[e-mail]>. (LP: #1806035)
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 21 Dec 2018 10:39:23 -0200
+
+samba (2:4.9.2+dfsg-2ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - Add apport hook:
+      + Created debian/source_samba.py.
+      + debian/rules, debian/samba-common-bin.install: install hook.
+    - d/control, d/rules: Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+  * Dropped:
+    - d/p/fix-rmdir.patch: Fix to make smbclient report directory-not-empty
+      errors (LP: 1795772)
+      [Fixed upstream]
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 28 Nov 2018 20:06:47 -0200
+
 samba (2:4.9.2+dfsg-2) unstable; urgency=high
 
   * New upstream security release
@@ -894,6 +2044,58 @@ samba (2:4.8.5+dfsg-1) unstable; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Thu, 30 Aug 2018 19:32:24 +0200
 
+samba (2:4.8.4+dfsg-2ubuntu3) disco; urgency=medium
+
+  * No-change rebuild against libldb1 1.4.2
+
+ -- Steve Langasek <[e-mail]>  Wed, 14 Nov 2018 22:46:24 +0000
+
+samba (2:4.8.4+dfsg-2ubuntu2) cosmic; urgency=high
+
+  [ Karl Stenerud ]
+  * d/p/fix-rmdir.patch: Fix to make the samba client library report
+    directory-not-empty errors (LP: #1795772)
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 09 Oct 2018 14:32:16 -0300
+
+samba (2:4.8.4+dfsg-2ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1778125). Remaining changes:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - Add apport hook:
+      + Created debian/source_samba.py.
+      + debian/rules, debian/samba-common-bin.install: install hook.
+    - d/control, d/rules: Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+  * Drop:
+    - Add extra DEP8 tests to samba (LP #1696823):
+      + d/t/control, d/t/cifs-share-access: access a file in a share using cifs
+      + d/t/control, d/t/smbclient-anonymous-share-list: list available shares
+        anonymously
+      + d/t/control, d/t/smbclient-authenticated-share-list: list available
+        shares using an authenticated connection
+      + d/t/control, d/t/smbclient-share-access: create a share and download a
+        file from it
+      [Accepted by Debian in 2:4.7.4+dfsg-2]
+    - d/samba-common.dhcp: If systemctl is available, use it to query the
+      status of the smbd service before trying to reload it. Otherwise,
+      keep the same check as before and reload the service based on the
+      existence of the initscript. (LP #1579597)
+      [In Debian since 2:4.7.4+dfsg-2]
+    - debian/patches/passdb_dont_return_ok_if_pinfo_not_filled.patch:
+      [PATCH] s3:passdb: Do not return OK if we don't have pinfo filled.
+      Thanks to Andreas Schneider <[e-mail]>. (LP #1761737)
+      [Fixed upstream]
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 21 Aug 2018 09:57:57 -0300
+
 samba (2:4.8.4+dfsg-2) unstable; urgency=high
 
   * Fix typo in previous release: s/usefull/useful/
@@ -1051,6 +2253,55 @@ samba (2:4.8.0+dfsg-1) experimental; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Mon, 19 Mar 2018 13:02:51 +0100
 
+samba (2:4.7.6+dfsg~ubuntu-0ubuntu3) cosmic; urgency=medium
+
+  * No change rebuild to link with new ldb 1.3.3
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 03 Jul 2018 09:57:24 -0300
+
+samba (2:4.7.6+dfsg~ubuntu-0ubuntu2) bionic; urgency=medium
+
+  * debian/patches/passdb_dont_return_ok_if_pinfo_not_filled.patch:
+    [PATCH] s3:passdb: Do not return OK if we don't have pinfo filled.
+    Thanks to Andreas Schneider <[e-mail]>. (LP: #1761737)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 18 Apr 2018 11:49:55 -0300
+
+samba (2:4.7.6+dfsg~ubuntu-0ubuntu1) bionic; urgency=medium
+
+  * New upstream version:
+    - Fix database corruption bug when upgrading from samba 4.6 or lower
+      AD controllers (LP: #1755057)
+    - Fix security issues: CVE-2018-1050 and CVE-2018-1057 (LP: #1755059)
+  * Remaining changes:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - Add apport hook:
+      + Created debian/source_samba.py.
+      + debian/rules, debian/samba-common-bin.install: install hook.
+    - Add extra DEP8 tests to samba (LP #1696823):
+      + d/t/control, d/t/cifs-share-access: access a file in a share using cifs
+      + d/t/control, d/t/smbclient-anonymous-share-list: list available shares
+        anonymously
+      + d/t/control, d/t/smbclient-authenticated-share-list: list available
+        shares using an authenticated connection
+      + d/t/control, d/t/smbclient-share-access: create a share and download a
+        file from it
+    - d/samba-common.dhcp: If systemctl is available, use it to query the
+      status of the smbd service before trying to reload it. Otherwise,
+      keep the same check as before and reload the service based on the
+      existence of the initscript. (LP #1579597)
+    - d/control, d/rules: Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 13 Mar 2018 16:58:49 -0300
+
 samba (2:4.7.4+dfsg-2) unstable; urgency=high
 
   [ Mathieu Parent ]
@@ -1081,6 +2332,37 @@ samba (2:4.7.4+dfsg-2) unstable; urgency=high
 
  -- Mathieu Parent <[e-mail]>  Fri, 02 Mar 2018 20:55:06 +0100
 
+samba (2:4.7.4+dfsg-1ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1744779). Remaining changes:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - Add apport hook:
+      + Created debian/source_samba.py.
+      + debian/rules, debian/samba-common-bin.install: install hook.
+    - Add extra DEP8 tests to samba (LP #1696823):
+      + d/t/control, d/t/cifs-share-access: access a file in a share using cifs
+      + d/t/control, d/t/smbclient-anonymous-share-list: list available shares
+        anonymously
+      + d/t/control, d/t/smbclient-authenticated-share-list: list available
+        shares using an authenticated connection
+      + d/t/control, d/t/smbclient-share-access: create a share and download a
+        file from it
+    - d/samba-common.dhcp: If systemctl is available, use it to query the
+      status of the smbd service before trying to reload it. Otherwise,
+      keep the same check as before and reload the service based on the
+      existence of the initscript. (LP #1579597)
+    - d/control, d/rules: Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 22 Jan 2018 16:31:41 -0200
+
 samba (2:4.7.4+dfsg-1) unstable; urgency=medium
 
   * New upstream version
@@ -1097,6 +2379,42 @@ samba (2:4.7.4+dfsg-1) unstable; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Thu, 11 Jan 2018 20:49:28 +0100
 
+samba (2:4.7.3+dfsg-1ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - Add apport hook:
+      + Created debian/source_samba.py.
+      + debian/rules, debian/samba-common-bin.install: install hook.
+    - Add extra DEP8 tests to samba (LP #1696823):
+      + d/t/control: enable the new DEP8 tests
+      + d/t/smbclient-anonymous-share-list: list available shares anonymously
+      + d/t/smbclient-authenticated-share-list: list available shares using
+        an authenticated connection
+      + d/t/smbclient-share-access: create a share and download a file from it
+      + d/t/cifs-share-access: access a file in a share using cifs
+    - Ask the user if we can run testparm against the config file. If yes,
+      include its stderr and exit status in the bug report. Otherwise, only
+      include the exit status. (LP #1694334)
+    - If systemctl is available, use it to query the status of the smbd
+      service before trying to reload it. Otherwise, keep the same check
+      as before and reload the service based on the existence of the
+      initscript. (LP #1579597)
+    - d/rules: Compile winbindd/winbindd statically.
+    - Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+    - d/source_samba.py: use the new recommended findmnt(8) tool to list
+      mountpoints and correctly filter by the cifs filesystem type.
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 05 Dec 2017 12:49:20 -0500
+
 samba (2:4.7.3+dfsg-1) unstable; urgency=high
 
   * New upstream version
@@ -1120,6 +2438,42 @@ samba (2:4.7.1+dfsg-2) unstable; urgency=high
 
  -- Mathieu Parent <[e-mail]>  Sun, 12 Nov 2017 10:02:19 +0100
 
+samba (2:4.7.1+dfsg-1ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - Add apport hook:
+      + Created debian/source_samba.py.
+      + debian/rules, debian/samba-common-bin.install: install hook.
+    - Add extra DEP8 tests to samba (LP #1696823):
+      + d/t/control: enable the new DEP8 tests
+      + d/t/smbclient-anonymous-share-list: list available shares anonymously
+      + d/t/smbclient-authenticated-share-list: list available shares using
+        an authenticated connection
+      + d/t/smbclient-share-access: create a share and download a file from it
+      + d/t/cifs-share-access: access a file in a share using cifs
+    - Ask the user if we can run testparm against the config file. If yes,
+      include its stderr and exit status in the bug report. Otherwise, only
+      include the exit status. (LP #1694334)
+    - If systemctl is available, use it to query the status of the smbd
+      service before trying to reload it. Otherwise, keep the same check
+      as before and reload the service based on the existence of the
+      initscript. (LP #1579597)
+    - d/rules: Compile winbindd/winbindd statically.
+    - Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+    - d/source_samba.py: use the new recommended findmnt(8) tool to list
+      mountpoints and correctly filter by the cifs filesystem type.
+
+ -- Matthias Klose <[e-mail]>  Fri, 10 Nov 2017 10:03:57 +0100
+
 samba (2:4.7.1+dfsg-1) unstable; urgency=medium
 
   * New upstream version
@@ -1168,6 +2522,87 @@ samba (2:4.6.7+dfsg-2) unstable; urgency=high
 
  -- Mathieu Parent <[e-mail]>  Tue, 19 Sep 2017 22:00:13 +0200
 
+samba (2:4.6.7+dfsg-1ubuntu3) artful; urgency=medium
+
+  * SECURITY UPDATE: SMB1/2/3 connections may not require signing where
+    they should
+    - debian/patches/CVE-2017-12150-1.patch: don't turn a guessed username
+      into a specified one in source3/include/auth_info.h,
+      source3/lib/popt_common.c, source3/lib/util_cmdline.c.
+    - debian/patches/CVE-2017-12150-2.patch: add SMB_SIGNING_REQUIRED to
+      source3/lib/util_cmdline.c.
+    - debian/patches/CVE-2017-12150-3.patch: add SMB_SIGNING_REQUIRED to
+      source3/libsmb/pylibsmb.c.
+    - debian/patches/CVE-2017-12150-4.patch: add SMB_SIGNING_REQUIRED to
+      libgpo/gpo_fetch.c.
+    - debian/patches/CVE-2017-12150-5.patch: add check for
+      NTLM_CCACHE/SIGN/SEAL to auth/credentials/credentials.c.
+    - debian/patches/CVE-2017-12150-6.patch: add
+      smbXcli_conn_signing_mandatory() to libcli/smb/smbXcli_base.*.
+    - debian/patches/CVE-2017-12150-7.patch: only fallback to anonymous if
+      authentication was not requested in source3/libsmb/clidfs.c.
+    - CVE-2017-12150
+  * SECURITY UPDATE: SMB3 connections don't keep encryption across DFS
+    redirects
+    - debian/patches/CVE-2017-12151-1.patch: add
+      cli_state_is_encryption_on() helper function to
+      source3/libsmb/clientgen.c, source3/libsmb/proto.h.
+    - debian/patches/CVE-2017-12151-2.patch: make use of
+      cli_state_is_encryption_on() in source3/libsmb/clidfs.c,
+      source3/libsmb/libsmb_context.c.
+    - CVE-2017-12151
+  * SECURITY UPDATE: Server memory information leak over SMB1
+    - debian/patches/CVE-2017-12163.patch: prevent client short SMB1 write
+      from writing server memory to file in source3/smbd/reply.c.
+    - CVE-2017-12163
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 21 Sep 2017 08:10:03 -0400
+
+samba (2:4.6.7+dfsg-1ubuntu2) artful; urgency=medium
+
+  * d/source_samba.py: use the new recommended findmnt(8) tool to list
+    mountpoints and correctly filter by the cifs filesystem type.
+    (LP: #1703604)
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 01 Sep 2017 09:47:58 -0300
+
+samba (2:4.6.7+dfsg-1ubuntu1) artful; urgency=medium
+
+  * Merge with Debian unstable (LP: #1710281).
+    - Upstream version 4.6.7 fixes the CVE-2017-2619 regression with non-wide
+      symlinks to directories (LP: #1701073)
+  * Remaining changes:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - Add apport hook:
+      + Created debian/source_samba.py.
+      + debian/rules, debian/samba-common-bin.install: install hook.
+    - Add extra DEP8 tests to samba (LP #1696823):
+      + d/t/control: enable the new DEP8 tests
+      + d/t/smbclient-anonymous-share-list: list available shares anonymously
+      + d/t/smbclient-authenticated-share-list: list available shares using
+        an authenticated connection
+      + d/t/smbclient-share-access: create a share and download a file from it
+      + d/t/cifs-share-access: access a file in a share using cifs
+    - Ask the user if we can run testparm against the config file. If yes,
+      include its stderr and exit status in the bug report. Otherwise, only
+      include the exit status. (LP #1694334)
+    - If systemctl is available, use it to query the status of the smbd
+      service before trying to reload it. Otherwise, keep the same check
+      as before and reload the service based on the existence of the
+      initscript. (LP #1579597)
+    - d/rules: Compile winbindd/winbindd statically.
+    - Disable glusterfs support because it's not in main.
+      MIR bug is https://launchpad.net/bugs/1274247
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 21 Aug 2017 17:27:08 -0300
+
 samba (2:4.6.7+dfsg-1) unstable; urgency=medium
 
   * New upstream version
@@ -1179,6 +2614,60 @@ samba (2:4.6.7+dfsg-1) unstable; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Tue, 15 Aug 2017 23:06:36 +0200
 
+samba (2:4.6.5+dfsg-8ubuntu1) artful; urgency=medium
+
+  * Merge with Debian unstable (LP: #1700644). Remaining changes:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - Add apport hook:
+      + Created debian/source_samba.py.
+      + debian/rules, debian/samba-common-bin.install: install hook.
+    - Add extra DEP8 tests to samba (LP #1696823):
+      + d/t/control: enable the new DEP8 tests
+      + d/t/smbclient-anonymous-share-list: list available shares anonymously
+      + d/t/smbclient-authenticated-share-list: list available shares using
+        an authenticated connection
+      + d/t/smbclient-share-access: create a share and download a file from it
+      + d/t/cifs-share-access: access a file in a share using cifs
+    - Ask the user if we can run testparm against the config file. If yes,
+      include its stderr and exit status in the bug report. Otherwise, only
+      include the exit status. (LP #1694334)
+    - If systemctl is available, use it to query the status of the smbd
+      service before trying to reload it. Otherwise, keep the same check
+      as before and reload the service based on the existence of the
+      initscript. (LP #1579597)
+  * Drop:
+    - d/rules: Compile winbindd/winbindd statically. (LP: #1700527)
+      [This hunk was missed in 2:4.5.8+dfsg-2ubuntu2 when patch
+      fix-1584485.patch was dropped there.]
+    - d/p/krb_zero_cursor.patch - apply proposed-upstream fix for
+      pam_winbind krb5_ccache_type=FILE failure
+      [Replaced by d/p/s3-gse_krb5-fix-a-possible-crash-in-fill_mem_keytab.patch
+      in 2:4.6.5+dfsg-3 that closed Debian's bug #739768]
+    - debian/patches/winbind_trusted_domains.patch: make sure domain
+      members can talk to trusted domains DCs.
+      [Upstream committed a different fix, see updated patch attached to
+      https://bugzilla.samba.org/show_bug.cgi?id=11830]
+    - d/control: add libcephfs-dev as b-d to build vfs_ceph
+      [Adopted by Debian in 2:4.6.5+dfsg-1]
+    - debian/patches/CVE-2017-11103.patch: use encrypted service
+      name rather than unencrypted (and therefore spoofable) version
+      in heimdal
+      [Adopted by Debian as
+      d/p/CVE-2017-11103-Orpheus-Lyre-KDC-REP-service-name-val.patch]
+    - Cherrypick upstream patch to fix FTBFS with new ceph lib.
+      [Merged upstream in 4.6.0rc1]
+  * Disable glusterfs support because it's not in main.
+    MIR bug is https://launchpad.net/bugs/1274247
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 10 Aug 2017 22:20:22 -0300
+
 samba (2:4.6.5+dfsg-8) unstable; urgency=medium
 
   * Remove dependency on update-inetd, not used anymore
@@ -1298,6 +2787,77 @@ samba (2:4.6.5+dfsg-1) experimental; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Mon, 12 Jun 2017 08:09:43 +0200
 
+samba (2:4.5.8+dfsg-2ubuntu5) artful; urgency=medium
+
+  * Cherrypick upstream patch to fix FTBFS with new ceph lib.
+
+ -- Dimitri John Ledkov <[e-mail]>  Wed, 26 Jul 2017 08:34:24 +0100
+
+samba (2:4.5.8+dfsg-2ubuntu4) artful; urgency=medium
+
+  * SECURITY UPDATE: KDC-REP service name impersonation
+    - debian/patches/CVE-2017-11103.patch: use encrypted service
+      name rather than unencrypted (and therefore spoofable) version
+      in heimdal
+    - CVE-2017-11103
+
+ -- Steve Beattie <[e-mail]>  Mon, 17 Jul 2017 16:22:28 -0700
+
+samba (2:4.5.8+dfsg-2ubuntu3) artful; urgency=medium
+
+  * No-change rebuild against libldb 1.1.29
+
+ -- Steve Langasek <[e-mail]>  Sun, 25 Jun 2017 16:09:33 -0700
+
+samba (2:4.5.8+dfsg-2ubuntu2) artful; urgency=medium
+
+  * Add extra DEP8 tests to samba (LP: #1696823):
+    - d/t/control: enable the new DEP8 tests
+    - d/t/smbclient-anonymous-share-list: list available shares anonymously
+    - d/t/smbclient-authenticated-share-list: list available shares using
+      an authenticated connection
+    - d/t/smbclient-share-access: create a share and download a file from it
+    - d/t/cifs-share-access: access a file in a share using cifs
+  * Ask the user if we can run testparm against the config file. If yes,
+    include its stderr and exit status in the bug report. Otherwise, only
+    include the exit status. (LP: #1694334)
+  * If systemctl is available, use it to query the status of the smbd
+    service before trying to reload it. Otherwise, keep the same check
+    as before and reload the service based on the existence of the
+    initscript. (LP: #1579597)
+  * Remove d/p/fix-1584485.patch as it builds a broken pam_winbind
+    module. There is a fixed version of that patch attached to
+    #1677329 but it has not been vetted yet, so for now it's best
+    to revert (again) so that pam_winbind can be used.
+    (LP: #1677329, LP: #1644428)
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 19 Jun 2017 10:49:29 -0700
+
+samba (2:4.5.8+dfsg-2ubuntu1) artful; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+    - debian/smb.conf;
+      + Add "(Samba, Ubuntu)" to server string.
+      + Comment out the default [homes] share, and add a comment about
+        "valid users = %s" to show users how to restrict access to
+        \\server\username to only username.
+    - debian/samba-common.config:
+      + Do not change priority to high if dhclient3 is installed.
+    - Add apport hook:
+      + Created debian/source_samba.py.
+      + debian/rules, debian/samba-common-bin.install: install hook.
+    - d/p/krb_zero_cursor.patch - apply proposed-upstream fix for
+      pam_winbind krb5_ccache_type=FILE failure
+    - debian/patches/winbind_trusted_domains.patch: make sure domain
+      members can talk to trusted domains DCs.
+    - d/p/fix-1584485.patch: Make libnss-winbind and libpam-winbind
+      to be statically linked
+    - d/rules: Compile winbindd/winbindd statically.
+    - d/control: add libcephfs-dev as b-d to build vfs_ceph
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 15 Jun 2017 14:17:43 -0400
+
 samba (2:4.5.8+dfsg-2) unstable; urgency=high
 
   * CVE-2017-7494: rpc_server3: Refuse to open pipe names with / inside
@@ -1312,6 +2872,23 @@ samba (2:4.5.8+dfsg-1) unstable; urgency=high
 
  -- Mathieu Parent <[e-mail]>  Sat, 01 Apr 2017 20:39:17 +0200
 
+samba (2:4.5.8+dfsg-0ubuntu1) artful; urgency=medium
+
+  * SECURITY UPDATE: remote code execution from a writable share
+    - debian/patches/CVE-2017-7494.patch: refuse to open pipe names with a
+      slash inside in source3/rpc_server/srv_pipe.c.
+    - CVE-2017-7494
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 24 May 2017 07:39:13 -0400
+
+samba (2:4.5.8+dfsg-0ubuntu0.17.04.1) zesty-security; urgency=medium
+
+  * SECURITY UPDATE: Symlink race allows access outside share definition
+    - Updated to new upstream release 4.5.8.
+    - CVE-2017-2619
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 21 Apr 2017 07:33:25 -0400
+
 samba (2:4.5.6+dfsg-2) unstable; urgency=high
 
   * This is a security release in order to address the following defects:
@@ -1341,6 +2918,61 @@ samba (2:4.5.5+dfsg-1) unstable; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Sun, 05 Mar 2017 23:21:09 +0100
 
+samba (2:4.5.4+dfsg-1ubuntu2) zesty; urgency=medium
+
+  * d/control: add libcephfs-dev as b-d to build vfs_ceph
+    (LP: #1668940).
+
+ -- Nishanth Aravamudan <[e-mail]>  Mon, 06 Mar 2017 11:13:41 -0800
+
+samba (2:4.5.4+dfsg-1ubuntu1) zesty; urgency=medium
+
+  * Merge from Debian unstable (LP: #1659707, LP: #1639962). Remaining
+    changes:
+    + debian/VERSION.patch: Update vendor string to "Ubuntu".
+    + debian/smb.conf;
+      - Add "(Samba, Ubuntu)" to server string.
+      - Comment out the default [homes] share, and add a comment about "valid users = %s"
+         to show users how to restrict access to \\server\username to only username.
+    + debian/samba-common.config:
+      - Do not change prioritiy to high if dhclient3 is installed.
+    + Add apport hook:
+      - Created debian/source_samba.py.
+      - debian/rules, debia/samb-common-bin.install: install hook.
+    + d/p/krb_zero_cursor.patch - apply proposed-upstream fix for
+      pam_winbind krb5_ccache_type=FILE failure (LP #1310919)
+    + debian/patches/winbind_trusted_domains.patch: make sure domain members
+      can talk to trusted domains DCs.
+      [ update patch based upon upstream discussion ]
+    + d/p/fix-1584485.patch: Make libnss-winbind and libpam-winbind
+      to be statically linked fixes LP #1584485.
+    + d/rules: Compile winbindd/winbindd statically.
+  * Drop:
+    - Delete debian/.gitignore
+    [ Previously undocumented ]
+    - debian/patches/git_smbclient_cpu.patch:
+      + backport upstream patch to fix smbclient users hanging/eating cpu on
+        trying to contact a machine which is not there (lp #1572260)
+    [ Fixed upstream ]
+    - SECURITY UPDATE: remote code execution via heap overflow in NDR parsing
+      + debian/patches/CVE-2016-2123.patch: check lengths in
+        librpc/ndr/ndr_dnsp.c.
+      + CVE-2016-2123
+    [ Fixed in Debian ]
+    - SECURITY UPDATE: unconditional privilege delegation to Kerberos servers
+      + debian/patches/CVE-2016-2125.patch: don't use GSS_C_DELEG_FLAG in
+        source4/scripting/bin/nsupdate-gss, source3/librpc/crypto/gse.c,
+        source4/auth/gensec/gensec_gssapi.c.
+      + CVE-2016-2125
+    [ Fixed in Debian ]
+    - SECURITY UPDATE: privilege elevation in Kerberos PAC validation
+      + debian/patches/CVE-2016-2126.patch: only allow known checksum types
+        in auth/kerberos/kerberos_pac.c.
+      + CVE-2016-2126
+    [ Fixed in Debian ]
+
+ -- Nishanth Aravamudan <[e-mail]>  Thu, 26 Jan 2017 17:20:15 -0800
+
 samba (2:4.5.4+dfsg-1) unstable; urgency=medium
 
   [ Mathieu Parent ]
@@ -1468,6 +3100,77 @@ samba (2:4.4.5+dfsg-3) unstable; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Fri, 09 Sep 2016 13:00:54 +0200
 
+samba (2:4.4.5+dfsg-2ubuntu7) zesty; urgency=medium
+
+  * SECURITY UPDATE: remote code execution via heap overflow in NDR parsing
+    - debian/patches/CVE-2016-2123.patch: check lengths in
+      librpc/ndr/ndr_dnsp.c.
+    - CVE-2016-2123
+  * SECURITY UPDATE: unconditional privilege delegation to Kerberos servers
+    - debian/patches/CVE-2016-2125.patch: don't use GSS_C_DELEG_FLAG in
+      source4/scripting/bin/nsupdate-gss, source3/librpc/crypto/gse.c,
+      source4/auth/gensec/gensec_gssapi.c.
+    - CVE-2016-2125
+  * SECURITY UPDATE: privilege elevation in Kerberos PAC validation
+    - debian/patches/CVE-2016-2126.patch: only allow known checksum types
+      in auth/kerberos/kerberos_pac.c.
+    - CVE-2016-2126
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 20 Jan 2017 12:32:25 -0500
+
+samba (2:4.4.5+dfsg-2ubuntu6) zesty; urgency=high
+
+  * d/p/fix-1584485.patch: Make libnss-winbind and libpam-winbind 
+    to be statically linked fixes LP: #1584485.
+
+  * d/rules: Compile winbindd/winbindd statically.
+
+ -- Jorge Niedbalski <[e-mail]>  Wed, 02 Nov 2016 13:59:10 +0100
+
+samba (2:4.4.5+dfsg-2ubuntu5) yakkety; urgency=medium
+
+  * No-change rebuild for readline soname change.
+
+ -- Matthias Klose <[e-mail]>  Sun, 18 Sep 2016 10:26:52 +0000
+
+samba (2:4.4.5+dfsg-2ubuntu4) yakkety; urgency=medium
+
+  * No-change rebuild for readline soname change.
+
+ -- Matthias Klose <[e-mail]>  Sat, 17 Sep 2016 12:09:21 +0000
+
+samba (2:4.4.5+dfsg-2ubuntu3) yakkety; urgency=medium
+
+  * debian/patches/git_smbclient_cpu.patch:
+    - backport upstream patch to fix smbclient users hanging/eating cpu on
+      trying to contact a machine which is not there (lp: #1572260)
+
+ -- Sebastien Bacher <[e-mail]>  Fri, 05 Aug 2016 17:32:43 +0200
+
+samba (2:4.4.5+dfsg-2ubuntu1) yakkety; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    + debian/VERSION.patch: Update vendor string to "Ubuntu".
+    + debian/smb.conf;
+      - Add "(Samba, Ubuntu)" to server string.
+      - Comment out the default [homes] share, and add a comment about "valid users = %s"
+         to show users how to restrict access to \\server\username to only username.
+    + debian/samba-common.config:
+      - Do not change prioritiy to high if dhclient3 is installed.
+    + Add apport hook:
+      - Created debian/source_samba.py.
+      - debian/rules, debia/samb-common-bin.install: install hook.
+    + d/p/krb_zero_cursor.patch - apply proposed-upstream fix for
+      pam_winbind krb5_ccache_type=FILE failure (LP: #1310919)
+    + debian/patches/winbind_trusted_domains.patch: make sure domain members
+      can talk to trusted domains DCs.
+  * Dropped changes:
+    - build-depends on libgnutls-dev instead of libgnutsl28-dev: rename was
+      never done in Debian, revert.
+    - ufw integration: included in Debian.
+
+ -- Steve Langasek <[e-mail]>  Thu, 14 Jul 2016 17:45:46 -0700
+
 samba (2:4.4.5+dfsg-2) unstable; urgency=medium
 
   * Disable running of 'make quicktest' during build, as it takes very
@@ -1595,6 +3298,20 @@ samba (2:4.4.0+dfsg-1) experimental; urgency=medium
 
  -- Andrew Bartlett <[e-mail]>  Wed, 06 Apr 2016 17:08:20 +1200
 
+samba (2:4.3.9+dfsg-0ubuntu1) yakkety; urgency=medium
+
+  * SECURITY REGRESSION: Updated to 4.3.9 to fix multiple regressions in
+    the previous security updates. (LP: #1577739)
+    - debian/control: bump tevent Build-Depends to 0.9.28.
+  * SECURITY REGRESSION: NTLM authentication issues (LP: #1578576)
+    - debian/patches/samba-bug11912.patch: let msrpc_parse() return
+      talloc'ed empty strings in libcli/auth/msrpc_parse.c.
+    - debian/patches/samba-bug11914.patch: make
+      ntlm_auth_generate_session_info() more complete in
+      source3/utils/ntlm_auth.c.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 25 May 2016 09:29:15 -0400
+
 samba (2:4.3.8+dfsg-1) unstable; urgency=low
 
   [ Jelmer Vernooij ]
@@ -1609,6 +3326,25 @@ samba (2:4.3.8+dfsg-1) unstable; urgency=low
 
  -- Jelmer Vernooij <[e-mail]>  Sat, 16 Apr 2016 01:18:36 +0000
 
+samba (2:4.3.8+dfsg-0ubuntu1) xenial; urgency=medium
+
+  * SECURITY UPDATE: Updated to 4.3.8 to fix multiple security issues
+    - CVE-2015-5370: Multiple errors in DCE-RPC code
+    - CVE-2016-2110: Man in the middle attacks possible with NTLMSSP
+    - CVE-2016-2111: NETLOGON Spoofing Vulnerability
+    - CVE-2016-2112: The LDAP client and server don't enforce integrity
+      protection
+    - CVE-2016-2113: Missing TLS certificate validation allows man in the
+      middle attacks
+    - CVE-2016-2114: "server signing = mandatory" not enforced
+    - CVE-2016-2115: SMB client connections for IPC traffic are not
+      integrity protected
+    - CVE-2016-2118: SAMR and LSA man in the middle attacks possible
+  * debian/patches/winbind_trusted_domains.patch: make sure domain members
+    can talk to trusted domains DCs.
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 12 Apr 2016 07:26:29 -0400
+
 samba (2:4.3.7+dfsg-1) unstable; urgency=high
 
   * New upstream release.
@@ -1651,6 +3387,29 @@ samba (2:4.3.6+dfsg-2) unstable; urgency=low
 
  -- Mathieu Parent <[e-mail]>  Thu, 31 Mar 2016 22:26:11 +0200
 
+samba (2:4.3.6+dfsg-1ubuntu1) xenial; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    + debian/VERSION.patch: Update vendor string to "Ubuntu".
+    + debian/smb.conf;
+      - Add "(Samba, Ubuntu)" to server string.
+      - Comment out the default [homes] share, and add a comment about "valid users = %s"
+         to show users how to restrict access to \\server\username to only username.
+    + debian/samba-common.config:
+      - Do not change prioritiy to high if dhclient3 is installed.
+    + debian/control:
+      - Switch build depends from transitional libgnutsl28-dev to libgnutls-dev
+    + Add ufw integration:
+      - Created debian/samba.ufw.profile:
+      - debian/rules, debian/samba.install: install profile
+    + Add apport hook:
+      - Created debian/source_samba.py.
+      - debian/rules, debia/samb-common-bin.install: install hook.
+    + d/p/krb_zero_cursor.patch - apply proposed-upstream fix for
+      pam_winbind krb5_ccache_type=FILE failure (LP: #1310919)
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 09 Mar 2016 08:49:12 -0500
+
 samba (2:4.3.6+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
@@ -1696,6 +3455,42 @@ samba (2:4.3.3+dfsg-2) unstable; urgency=medium
 
  -- Mathieu Parent <[e-mail]>  Thu, 04 Feb 2016 13:25:01 +0100
 
+samba (2:4.3.3+dfsg-1ubuntu3) xenial; urgency=medium
+
+  * No-change rebuild for gnutls transition.
+
+ -- Matthias Klose <[e-mail]>  Wed, 17 Feb 2016 22:41:43 +0000
+
+samba (2:4.3.3+dfsg-1ubuntu2) xenial; urgency=medium
+
+  * Fixes regression introduced by debian/patches/CVE-2015-5252.patch.
+    (LP: #1545750)
+
+ -- Dariusz Gadomski <[e-mail]>  Mon, 15 Feb 2016 16:05:12 +0100
+
+samba (2:4.3.3+dfsg-1ubuntu1) xenial; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    + debian/VERSION.patch: Update vendor string to "Ubuntu".
+    + debian/smb.conf;
+      - Add "(Samba, Ubuntu)" to server string.
+      - Comment out the default [homes] share, and add a comment about "valid users = %s"
+         to show users how to restrict access to \\server\username to only username.
+    + debian/samba-common.config:
+      - Do not change prioritiy to high if dhclient3 is installed.
+    + debian/control:
+      - Switch build depends from transitional libgnutsl28-dev to libgnutls-dev
+    + Add ufw integration:
+      - Created debian/samba.ufw.profile:
+      - debian/rules, debian/samba.install: install profile
+    + Add apport hook:
+      - Created debian/source_samba.py.
+      - debian/rules, debia/samb-common-bin.install: install hook.
+    + d/p/krb_zero_cursor.patch - apply proposed-upstream fix for
+      pam_winbind krb5_ccache_type=FILE failure (LP: #1310919)
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 06 Jan 2016 07:41:39 -0500
+
 samba (2:4.3.3+dfsg-1) unstable; urgency=medium
 
   * New upstream release. Closes: #808133.
@@ -1780,6 +3575,63 @@ samba (2:4.2.1+dfsg-1) experimental; urgency=medium
 
  -- Jelmer Vernooij <[e-mail]>  Sun, 07 Dec 2014 15:34:36 +0000
 
+samba (2:4.1.20+dfsg-1ubuntu5) xenial; urgency=medium
+
+  * Resolve small merge error in the rules
+
+ -- Sebastien Bacher <[e-mail]>  Wed, 16 Dec 2015 12:02:12 +0100
+
+samba (2:4.1.20+dfsg-1ubuntu4) xenial; urgency=medium
+
+  * Backport Debian change to remove libpam-smbpasswd, it segfaults
+    leading to non working session (lp: #1515207)
+
+ -- Sebastien Bacher <[e-mail]>  Wed, 16 Dec 2015 11:47:44 +0100
+
+samba (2:4.1.20+dfsg-1ubuntu3) xenial; urgency=medium
+
+  * Build with the new ldb
+
+ -- Sebastien Bacher <[e-mail]>  Wed, 18 Nov 2015 11:45:32 +0100
+
+samba (2:4.1.20+dfsg-1ubuntu2) xenial; urgency=medium
+
+  * debian/samba.logrotate:
+    - revert to Debian version of the logrotate reload command, fix an 
+      invalid syntax introduced in the upstart->systemd transition 
+      (lp: #1385868)
+
+ -- Sebastien Bacher <[e-mail]>  Tue, 10 Nov 2015 19:01:06 +0100
+
+samba (2:4.1.20+dfsg-1ubuntu1) xenial; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    + debian/VERSION.patch: Update vendor string to "Ubuntu".
+    + debian/smb.conf;
+      - Add "(Samba, Ubuntu)" to server string.
+      - Comment out the default [homes] share, and add a comment about "valid users = %s"
+         to show users how to restrict access to \\server\username to only username.
+    + debian/samba-common.config:
+      - Do not change prioritiy to high if dhclient3 is installed.
+    + debian/control:
+      - Don't build against or suggest ctdb and tdb.
+      - Switch build depends from transitional libgnutsl28-dev to libgnutls-dev
+    + debian/rules:
+      - Drop explicit configuration options for ctdb and tdb.
+    + Add ufw integration:
+      - Created debian/samba.ufw.profile:
+      - debian/rules, debian/samba.install: install profile
+    + Add apport hook:
+      - Created debian/source_samba.py.
+      - debian/rules, debia/samb-common-bin.install: install hook.
+    + debian/samba.logrotate: use service command to reload (send SIGHUP) the main
+      processes such that it works under both upstart and systemd.
+    + debian/samba-common.dirs: Move /var/lib/samba/private from samba.dirs.
+    + d/p/krb_zero_cursor.patch - apply proposed-upstream fix for
+      pam_winbind krb5_ccache_type=FILE failure (LP: #1310919)
+
+ -- Matthias Klose <[e-mail]>  Sat, 24 Oct 2015 14:57:47 +0200
+
 samba (2:4.1.20+dfsg-1) unstable; urgency=medium
 
   * New upstream release (last compatible with current OpenChange).
@@ -1793,6 +3645,44 @@ samba (2:4.1.17+dfsg-5) unstable; urgency=medium
 
  -- Jelmer Vernooij <[e-mail]>  Sun, 20 Sep 2015 13:20:53 +0000
 
+samba (2:4.1.17+dfsg-4ubuntu2) wily; urgency=medium
+
+  * debian/control:
+    - Switch build depends from transitional libgnutsl28-dev to libgnutls-dev
+
+ -- Robert Ancell <[e-mail]>  Tue, 11 Aug 2015 11:34:50 +1200
+
+samba (2:4.1.17+dfsg-4ubuntu1) wily; urgency=medium
+
+  * Merge from Debian unstable.  Remaining changes:
+    + debian/VERSION.patch: Update vendor string to "Ubuntu".
+    + debian/smb.conf;
+      - Add "(Samba, Ubuntu)" to server string.
+      - Comment out the default [homes] share, and add a comment about "valid users = %s"
+         to show users how to restrict access to \\server\username to only username.
+    + debian/samba-common.config:
+      - Do not change prioritiy to high if dhclient3 is installed.
+    + debian/control:
+      - Don't build against or suggest ctdb and tdb.
+    + debian/rules:
+      - Drop explicit configuration options for ctdb and tdb.
+    + Add ufw integration:
+      - Created debian/samba.ufw.profile:
+      - debian/rules, debian/samba.install: install profile
+    + Add apport hook:
+      - Created debian/source_samba.py.
+      - debian/rules, debia/samb-common-bin.install: install hook.
+    + debian/samba.logrotate: use service command to reload (send SIGHUP) the main
+      processes such that it works under both upstart and systemd.
+    + debian/samba-common.dirs: Move /var/lib/samba/private from samba.dirs.
+    + d/p/krb_zero_cursor.patch - apply proposed-upstream fix for
+      pam_winbind krb5_ccache_type=FILE failure (LP: #1310919)
+    + debian/patches/git_timeout_client_error.patch:
+    - don't let smb mounts timeout that leads to errors when trying to
+      reuse a mount after idling for a while in e.g nautilus (lp: #310932)
+
+ -- Martin Pitt <[e-mail]>  Fri, 08 May 2015 10:49:12 +0200
+
 samba (2:4.1.17+dfsg-4) unstable; urgency=medium
 
   * Add pidl_reproducible.patch: Make pidl output reproducible.
@@ -1829,6 +3719,53 @@ samba (2:4.1.17+dfsg-1) unstable; urgency=high
 
  -- Ivo De Decker <[e-mail]>  Mon, 23 Feb 2015 20:20:21 +0100
 
+samba (2:4.1.13+dfsg-4ubuntu3) vivid; urgency=medium
+
+  * debian/patches/git_timeout_client_error.patch:
+    - don't let smb mounts timeout that leads to errors when trying to 
+      reuse a mount after idling for a while in e.g nautilus (lp: #310932)
+
+ -- Sebastien Bacher <[e-mail]>  Fri, 03 Apr 2015 17:20:06 +0200
+
+samba (2:4.1.13+dfsg-4ubuntu2) vivid; urgency=medium
+
+  * SECURITY UPDATE: code execution vulnerability in smbd daemon
+    - debian/patches/CVE-2015-0240.patch: don't call talloc_free on an
+      uninitialized pointer and don't dereference a NULL pointer in
+      source3/rpc_server/netlogon/srv_netlog_nt.c.
+    - CVE-2015-0240
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 23 Feb 2015 08:36:51 -0500
+
+samba (2:4.1.13+dfsg-4ubuntu1) vivid; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    + debian/VERSION.patch: Update vendor string to "Ubuntu".
+    + debian/smb.conf;
+      - Add "(Samba, Ubuntu)" to server string.
+      - Comment out the default [homes] share, and add a comment about "valid users = %s"
+         to show users how to restrict access to \\server\username to only username.
+    + debian/samba-common.config:
+      - Do not change prioritiy to high if dhclient3 is installed.
+    + debian/control:
+      - Don't build against or suggest ctdb and tdb.
+    + debian/rules:
+      - Drop explicit configuration options for ctdb and tdb.
+    + Add ufw integration:
+      - Created debian/samba.ufw.profile:
+      - debian/rules, debian/samba.install: install profile
+    + Add apport hook:
+      - Created debian/source_samba.py.
+      - debian/rules, debia/samb-common-bin.install: install hook.
+    + debian/samba.logrotate: use service command to reload (send SIGHUP) the main
+      processes such that it works under both upstart and systemd.
+    + debian/samba-common.dirs: Move /var/lib/samba/private from samba.dirs.
+    + d/p/krb_zero_cursor.patch - apply proposed-upstream fix for
+      pam_winbind krb5_ccache_type=FILE failure (LP: #1310919)
+    + debian/patches/CVE-2014-8143.patch fix CVE-2014-8143.
+
+ -- Gianfranco Costamagna <[e-mail]>  Wed, 21 Jan 2015 15:48:05 +0100
+
 samba (2:4.1.13+dfsg-4) unstable; urgency=medium
 
   * Revert previous patch, since ldb has an active module version check.
@@ -1871,6 +3808,69 @@ samba (2:4.1.11+dfsg-2) unstable; urgency=medium
 
  -- Jelmer Vernooij <[e-mail]>  Sun, 07 Sep 2014 20:52:27 +0200
 
+samba (2:4.1.11+dfsg-1ubuntu4) vivid; urgency=medium
+
+  * SECURITY UPDATE: elevation of privilege to AD Domain Controller
+    - debian/patches/CVE-2014-8143.patch: check for extended access rights
+      before allowing changes to userAccountControl in
+      librpc/idl/security.idl, source4/auth/session.c,
+      source4/dsdb/common/util.c, source4/dsdb/pydsdb.c,
+      source4/dsdb/samdb/ldb_modules/samldb.c, source4/dsdb/samdb/samdb.h,
+      source4/rpc_server/lsa/dcesrv_lsa.c,
+      source4/setup/schema_samba4.ldif.
+    - CVE-2014-8143
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 21 Jan 2015 09:19:12 -0500
+
+samba (2:4.1.11+dfsg-1ubuntu3) vivid; urgency=medium
+
+  * No-change rebuild against current ldb. Note that I'm not claiming the
+    merging for this package.
+
+ -- Martin Pitt <[e-mail]>  Thu, 04 Dec 2014 07:50:22 +0100
+
+samba (2:4.1.11+dfsg-1ubuntu2) utopic; urgency=medium
+
+  * d/p/krb_zero_cursor.patch - apply proposed-upstream fix for
+    pam_winbind krb5_ccache_type=FILE failure (LP: #1310919)
+
+ -- Serge Hallyn <[e-mail]>  Thu, 11 Sep 2014 11:53:36 -0500
+
+samba (2:4.1.11+dfsg-1ubuntu1) utopic; urgency=medium
+
+  * Merge from Debian unstable.  Remaining changes:
+    + debian/VERSION.patch: Update vendor string to "Ubuntu".
+    +  debian/smb.conf;
+       - Add "(Samba, Ubuntu)" to server string.
+       - Comment out the default [homes] share, and add a comment about "valid users = %s"
+         to show users how to restrict access to \\server\username to only username.
+    + debian/samba-common.config:
+      - Do not change prioritiy to high if dhclient3 is installed.
+    + debian/control:
+      - Don't build against or suggest ctdb and tdb.
+    + debian/rules:
+      - Drop explicit configuration options for ctdb and tdb.
+    + Add ufw integration:
+      - Created debian/samba.ufw.profile:
+      - debian/rules, debian/samba.install: install profile
+    + Add apport hook:
+      - Created debian/source_samba.py.
+      - debian/rules, debia/samb-common-bin.install: install hook.
+    + debian/samba.logrotate: call upstart interfaces unconditionally instead
+      of hacking arround with pid files.
+    + Set sbmclients conflicts with samba4-clients less than 4.0.3+dfsg1-0.1ubuntu4, 
+      first dummy transitional package version.
+    + debian/samba-common.dirs: Move /var/lib/samba/private from samba.dirs.
+
+  * In logrotate, use service command to reload (send SIGHUP) the main
+    processes such that it works under both upstart and systemd.
+  * Drop CVE patches, applied upstream.
+  * Drop patches absent from series: readline-ftbfs.patch,
+    krb5_kt_start_seq.diff, config-bind99.patch
+  * Drop debian/source/include-binaries, pyc files are correctly cleaned up
+
+ -- Dimitri John Ledkov <[e-mail]>  Sat, 09 Aug 2014 21:26:23 +0100
+
 samba (2:4.1.11+dfsg-1) unstable; urgency=high
 
   * New upstream release. Fixes:
@@ -1906,6 +3906,62 @@ samba (2:4.1.9+dfsg-1) unstable; urgency=high
 
  -- Ivo De Decker <[e-mail]>  Mon, 23 Jun 2014 18:33:27 +0200
 
+samba (2:4.1.8+dfsg-1ubuntu3) utopic; urgency=medium
+
+  * SECURITY UPDATE: remote code execution on unauthenticated nmbd
+    - debian/patches/CVE-2014-3560.patch: fix unstrcpy in
+      lib/util/string_wrappers.h.
+    - CVE-2014-3560
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 01 Aug 2014 17:54:54 -0400
+
+samba (2:4.1.8+dfsg-1ubuntu2) utopic; urgency=medium
+
+  * SECURITY UPDATE: denial of service on nmbd malformed packet
+    - debian/patches/CVE-2014-0244.patch: return on EWOULDBLOCK/EAGAIN in
+      source3/lib/system.c.
+    - CVE-2014-0244
+  * SECURITY UPDATE: denial of service via bad unicode conversion
+    - debian/patches/CVE-2014-3493.patch: refactor code in
+      source3/lib/charcnv.c, change return code checks in
+      source3/libsmb/clirap.c, source3/smbd/lanman.c.
+    - CVE-2014-3493
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 23 Jun 2014 14:10:12 -0400
+
+samba (2:4.1.8+dfsg-1ubuntu1) utopic; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    + debian/VERSION.patch: Update vendor string to "Ubuntu".
+    +  debian/smb.conf;
+       - Add "(Samba, Ubuntu)" to server string.
+       - Comment out the default [homes] share, and add a comment about "valid users = %s"
+         to show users how to restrict access to \\server\username to only username.
+    + debian/samba-common.config:
+      - Do not change prioritiy to high if dhclient3 is installed.
+    + debian/control:
+      - Don't build against or suggest ctdb and tdb.
+    + debian/rules:
+      - Drop explicit configuration options for ctdb and tdb.
+    + Add ufw integration:
+      - Created debian/samba.ufw.profile:
+      - debian/rules, debian/samba.install: install profile
+    + Add apport hook:
+      - Created debian/source_samba.py.
+      - debian/rules, debia/samb-common-bin.install: install hook.
+    + debian/samba.logrotate: call upstart interfaces unconditionally instead
+      of hacking arround with pid files.
+    + Set sbmclients conflicts with samba4-clients less than 4.0.3+dfsg1-0.1ubuntu4, 
+      first dummy transitional package version.
+    + Dropped patches:
+      - debian/patches/CVE-2013-4496.patch: Dropped no longer needed
+      - debian/patches/CVE-2013-6442.patch: Dropped no longer needed.
+      - debian/patches/readline-ftbfs.patch: Use the debian version.
+    + debian/samba-common.dirs: Move /var/lib/samba/private from samba.dirs.
+      (LP: #1268180)
+
+ -- Chuck Short <[e-mail]>  Wed, 18 Jun 2014 10:50:25 -0400
+
 samba (2:4.1.8+dfsg-1) unstable; urgency=medium
 
   [ Jelmer Vernooij ]
@@ -1943,6 +3999,74 @@ samba (2:4.1.7+dfsg-1) unstable; urgency=medium
 
  -- Ivo De Decker <[e-mail]>  Sat, 19 Apr 2014 13:39:09 +0200
 
+samba (2:4.1.6+dfsg-1ubuntu6) utopic; urgency=medium
+
+  * Set the stack size to unlimited during the build to avoid a SIGBUS in
+    xsltproc on some architectures.
+
+ -- Colin Watson <[e-mail]>  Mon, 02 Jun 2014 23:18:40 +0100
+
+samba (2:4.1.6+dfsg-1ubuntu5) utopic; urgency=medium
+
+  * Backport from unstable (Ivo De Decker):
+    - Build-depend on heimdal-dev.
+
+ -- Colin Watson <[e-mail]>  Mon, 02 Jun 2014 15:39:54 +0100
+
+samba (2:4.1.6+dfsg-1ubuntu4) utopic; urgency=high
+
+  * No change rebuild against new dh_installinit, to call update-rc.d at
+    postinst.
+
+ -- Dimitri John Ledkov <[e-mail]>  Wed, 28 May 2014 10:41:32 +0100
+
+samba (2:4.1.6+dfsg-1ubuntu3) utopic; urgency=medium
+
+  * cherrypick upstream patch 1310919 to fix pam_winbind regression
+    (LP: #1310919)
+
+ -- Serge Hallyn <[e-mail]>  Tue, 29 Apr 2014 16:05:44 -0500
+
+samba (2:4.1.6+dfsg-1ubuntu2) trusty; urgency=medium
+
+  * Fix a grammatical error in smb.conf that showed up in a ucf prompt on
+    upgrade.
+
+ -- Steve Langasek <[e-mail]>  Thu, 03 Apr 2014 19:08:03 -0700
+
+samba (2:4.1.6+dfsg-1ubuntu1) trusty; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    + debian/VERSION.patch: Update vendor string to "Ubuntu".
+    +  debian/smb.conf;
+       - Add "(Samba, Ubuntu)" to server string.
+       - Comment out the default [homes] share, and add a comment about "valid users = %s"
+         to show users how to restrict access to \\server\username to only username.
+    + debian/samba-common.config:
+      - Do not change prioritiy to high if dhclient3 is installed.
+    + debian/control:
+      - Don't build against or suggest ctdb and tdb.
+    + debian/rules:
+      - Drop explicit configuration options for ctdb and tdb.
+    + Add ufw integration:
+      - Created debian/samba.ufw.profile:
+      - debian/rules, debian/samba.install: install profile
+    + Add apport hook:
+      - Created debian/source_samba.py.
+      - debian/rules, debia/samb-common-bin.install: install hook.
+    + debian/samba.logrotate: call upstart interfaces unconditionally instead
+      of hacking arround with pid files.
+    + Set sbmclients conflicts with samba4-clients less than 4.0.3+dfsg1-0.1ubuntu4, 
+      first dummy transitional package version.
+    + Dropped patches:
+      - debian/patches/CVE-2013-4496.patch: Dropped no longer needed
+      - debian/patches/CVE-2013-6442.patch: Dropped no longer needed.
+      - debian/patches/readline-ftbfs.patch: Use the debian version.
+    + debian/samba-common.dirs: Move /var/lib/samba/private from samba.dirs.
+      (LP: #1268180)
+
+ -- Chuck Short <[e-mail]>  Wed, 02 Apr 2014 13:40:30 -0400
+
 samba (2:4.1.6+dfsg-1) unstable; urgency=high
 
   * New upstream security release. Fixes:
@@ -2002,6 +4126,77 @@ samba (2:4.1.4+dfsg-1) unstable; urgency=medium
 
  -- Ivo De Decker <[e-mail]>  Sat, 18 Jan 2014 14:07:15 +0100
 
+samba (2:4.1.3+dfsg-2ubuntu5) trusty; urgency=medium
+
+  * debian/smb.conf: comment back some of the "share definitions"
+    options (including "valid users"). That was an Ubuntu diff and seems to
+    have been dropped in the trusty merge. Those changes seem needed to
+    get the usershare feature working (used by nautilus-share) (lp: #1261873)
+
+ -- Sebastien Bacher <[e-mail]>  Tue, 01 Apr 2014 16:01:04 +0200
+
+samba (2:4.1.3+dfsg-2ubuntu4) trusty; urgency=medium
+
+  * SECURITY UPDATE: Password lockout not enforced for SAMR password
+    changes
+    - debian/patches/CVE-2013-4496.patch: refactor password lockout code in
+      source3/auth/check_samsec.c,
+      source3/rpc_server/samr/srv_samr_chgpasswd.c,
+      source3/rpc_server/samr/srv_samr_nt.c,
+      source3/smbd/lanman.c,
+      source4/rpc_server/samr/samr_password.c,
+      source4/torture/rpc/samr.c.
+    - CVE-2013-4496
+  * SECURITY UPDATE: smbcacls can remove a file or directory ACL by
+    mistake
+    - debian/patches/CVE-2013-6442.patch: handle existing ACL in
+      source3/utils/smbcacls.c.
+    - CVE-2013-6442
+  * debian/patches/readline-ftbfs.patch: fix ftbfs with newer readline6.
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 17 Mar 2014 08:32:30 -0400
+
+samba (2:4.1.3+dfsg-2ubuntu3) trusty; urgency=medium
+
+  * Depend on tdb-tools (LP: #1279593)
+  * Updated generated config for Bind9.9.
+
+ -- Stéphane Graber <[e-mail]>  Wed, 12 Feb 2014 21:26:00 -0500
+
+samba (2:4.1.3+dfsg-2ubuntu2) trusty; urgency=medium
+
+  * Add missing python-ntdb dependency to python-samba (spotted by
+    autopkgtest).
+
+ -- Martin Pitt <[e-mail]>  Mon, 10 Feb 2014 09:53:01 +0100
+
+samba (2:4.1.3+dfsg-2ubuntu1) trusty; urgency=low
+
+  * Merge from Debian Unstable:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+  * debian/smb.conf;
+    - Add "(Samba, Ubuntu)" to server string.
+    - Comment out the default [homes] share, and add a comment about "valid users = %s"
+      to show users how to restrict access to \\server\username to only username.
+  + debian/samba-common.config:
+    - Do not change prioritiy to high if dhclient3 is installed.
+  + debian/control:
+    - Don't build against or suggest ctdb and tdb.
+  + debian/rules:
+    - Drop explicit configuration options for ctdb and tdb.
+  + Add ufw integration:
+    - Created debian/samba.ufw.profile:
+    - debian/rules, debian/samba.install: install profile
+  + Add apport hook:
+   - Created debian/source_samba.py.
+   - debian/rules, debia/samb-common-bin.install: install hook.
+  + debian/samba.logrotate: call upstart interfaces unconditionally instead
+    of hacking arround with pid files.
+  + Set sbmclients conflicts with samba4-clients less than 4.0.3+dfsg1-0.1ubuntu4, 
+    first dummy transitional package version.
+
+ -- Chuck Short <[e-mail]>  Mon, 13 Jan 2014 08:52:31 -0500
+
 samba (2:4.1.3+dfsg-2) unstable; urgency=medium
 
   * Add debug symbols for all binaries to samba-dbg. Closes: #732493
@@ -2044,6 +4239,33 @@ samba (2:4.0.13+dfsg-2) UNRELEASED; urgency=low
 
  -- Steve Langasek <[e-mail]>  Mon, 09 Dec 2013 11:13:59 -0800
 
+samba (2:4.0.13+dfsg-1ubuntu1) trusty; urgency=low
+
+  * Merge from Debian Unstable:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+  * debian/smb.conf;
+    - Add "(Samba, Ubuntu)" to server string.
+    - Comment out the default [homes] share, and add a comment about "valid users = %s"
+      to show users how to restrict access to \\server\username to only username.
+  + debian/samba-common.config:
+    - Do not change prioritiy to high if dhclient3 is installed.
+  + debian/control:
+    - Don't build against or suggest ctdb and tdb.
+  + debian/rules:
+    - Drop explicit configuration options for ctdb and tdb.
+  + Add ufw integration:
+    - Created debian/samba.ufw.profile:
+    - debian/rules, debian/samba.install: install profile
+  + Add apport hook:
+   - Created debian/source_samba.py.
+   - debian/rules, debia/samb-common-bin.install: install hook.
+  + debian/samba.logrotate: call upstart interfaces unconditionally instead
+    of hacking arround with pid files.
+  + Set sbmclients conflicts with samba4-clients less than 4.0.3+dfsg1-0.1ubuntu4, 
+    first dummy transitional package version.
+
+ -- Chuck Short <[e-mail]>  Wed, 11 Dec 2013 19:55:47 -0500
+
 samba (2:4.0.13+dfsg-1) unstable; urgency=high
 
   [ Steve Langasek ]
@@ -2098,6 +4320,37 @@ samba (2:4.0.11+dfsg-1) unstable; urgency=high
 
  -- Ivo De Decker <[e-mail]>  Mon, 11 Nov 2013 15:42:40 +0100
 
+samba (2:4.0.10+dfsg-4ubuntu2) trusty; urgency=low
+
+  * Set sbmclients conflicts with samba4-clients less than 4.0.3+dfsg1-0.1ubuntu4, first dummy transitional package version.
+
+ -- Dmitrijs Ledkovs <[e-mail]>  Wed, 27 Nov 2013 21:50:43 +0000
+
+samba (2:4.0.10+dfsg-4ubuntu1) trusty; urgency=low
+
+  * Merge from Debian Unstable:
+    - debian/VERSION.patch: Update vendor string to "Ubuntu".
+  * debian/smb.conf;
+    - Add "(Samba, Ubuntu)" to server string.
+    - Comment out the default [homes] share, and add a comment about "valid users = %s"
+      to show users how to restrict access to \\server\username to only username.
+  + debian/samba-common.config:
+    - Do not change prioritiy to high if dhclient3 is installed.
+  + debian/control:
+    - Don't build against or suggest ctdb and tdb.
+  + debian/rules:
+    - Drop explicit configuration options for ctdb and tdb.
+  + Add ufw integration:
+    - Created debian/samba.ufw.profile:
+    - debian/rules, debian/samba.install: install profile
+  + Add apport hook:
+   - Created debian/source_samba.py.
+   - debian/rules, debia/samb-common-bin.install: install hook.
+  + debian/samba.logrotate: call upstart interfaces unconditionally instead
+    of hacking arround with pid files.
+
+ -- Chuck Short <[e-mail]>  Fri, 08 Nov 2013 13:47:46 +0800
+
 samba (2:4.0.10+dfsg-4) unstable; urgency=low
 
   [ Christian Perrier ]
diff --git a/debian/control b/debian/control
index bfb2839..94bed47 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: samba
 Section: net
 Priority: optional
-Maintainer: Debian Samba Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Samba Maintainers <[e-mail]>
 Uploaders: Steve Langasek <[e-mail]>,
            Jelmer Vernooij <[e-mail]>,
            Mathieu Parent <[e-mail]>,
@@ -37,11 +38,11 @@ Build-Depends-Arch:
 	libblkid-dev,
 	libbsd-dev,
 	libcap-dev [linux-any],
-	libcephfs-dev [amd64 arm64 armel armhf i386 mips64el mipsel ppc64el ppc64 s390x x32],
+	libcephfs-dev [amd64 arm64 armel armhf mips64el mipsel ppc64el ppc64 s390x x32],
 	libcmocka-dev (>= 1.1.3),
 	libcups2-dev,
 	libdbus-1-dev,
-	libglusterfs-dev [linux-any],
+	libglusterfs-dev [!i386],
 	libgnutls28-dev,
 	libgpgme11-dev,
 	libicu-dev,
@@ -54,12 +55,12 @@ Build-Depends-Arch:
 	libparse-yapp-perl,
 	libpcap-dev [hurd-i386 kfreebsd-any],
 	libpopt-dev,
-	librados-dev [amd64 arm64 armel armhf i386 mips64el mipsel ppc64el ppc64 s390x x32],
+	librados-dev [amd64 arm64 armel armhf mips64el mipsel ppc64el ppc64 s390x x32],
 	libreadline-dev,
 	libsystemd-dev [linux-any],
 	libtasn1-6-dev (>= 3.8),
 	libtasn1-bin,
-	liburing-dev [linux-any],
+	liburing-dev [!i386],
 	xfslibs-dev [linux-any],
 	zlib1g-dev (>= 1:1.2.3),
 # python:
diff --git a/debian/ctdb.example/nfs-kernel-server/enable-nfs.sh b/debian/ctdb.example/nfs-kernel-server/enable-nfs.sh
index 2a99074..2346601 100755
--- a/debian/ctdb.example/nfs-kernel-server/enable-nfs.sh
+++ b/debian/ctdb.example/nfs-kernel-server/enable-nfs.sh
@@ -19,6 +19,14 @@ backupfile() {
     [ -f $1 ] && cp $1 $1.prvctdb || true
 }
 
+renamefiles() {
+    for f; do
+        [ -f "$f" ] || continue
+        echo "Renaming $f to $f.prvctdb"
+        mv "$f" "$f".prvctdb
+    done
+}
+
 checkservice() {
     (systemctl list-unit-files | grep -q $1.service) || die "service $1 not found"
 }
@@ -46,20 +54,6 @@ appendfile() {
     cat $base/$origfile >> $replfile
 }
 
-appendnfsenv() {
-
-    file=$1 ; [ -f $file ] || die "inexistent file $file";
-
-    echo appending NFS_HOSTNAME to $file...
-
-    grep -q "NFS_HOSTNAME" $file || \
-    {
-        echo
-        echo "echo NFS_HOSTNAME=\\\"\$NFS_HOSTNAME\\\"" \>\> \/run\/sysconfig\/nfs-utils
-        echo
-    } >> $file
-}
-
 execnfsenv() {
 
     file=$1 ; [ -f $file ] || due "inexistent file $file";
@@ -71,7 +65,7 @@ execnfsenv() {
 
 fixnfshostname() {
 
-    file=$1 ; [ -f $file ] || due "inexistent file $file";
+    type nfsconf > /dev/null 2>&1 || die "nfsconf(8) not found"
 
     if [ "$ghostname" == "" ]; then
         echo "What is the FQDN for the public IP address of this host ?"
@@ -79,8 +73,8 @@ fixnfshostname() {
         read ghostname
     fi
 
-    echo placing hostname $ghostname into $file...
-    sed -i "s:PLACE_HOSTNAME_HERE:$ghostname:g" $file
+    echo "Setting $ghostname in nfs.conf..."
+    nfsconf --set statd name "$ghostname"
 }
 
 # end of functions --
@@ -90,13 +84,14 @@ fixnfshostname() {
 echo """
 This script will enable CTDB NFS HA by changing the following files:
 
-(1) /etc/default/nfs-common                   ( replace )
-(2) /etc/default/nfs-kernel-server            ( replace )
+(1) /etc/nfs.conf                             ( replace )
+(2) /etc/nfs.conf.d/*.conf                    ( rename  )
 (3) /etc/services                             ( append  )
-(4) /etc/sysctl.d/99-nfs-static-ports.conf    ( create  )
-(5) /usr/lib/systemd/scripts/nfs-utils_env.sh ( modify  )
+(4) /etc/sysctl.d/98-nfs-static-ports.conf    ( create  )
+(5) /etc/default/quota                        ( replace )
 
-and disabling the following services:
+and disabling the following services, as they will be managed
+by ctdb:
 
 (1) rpcbind
 (2) nfs-kernel-server
@@ -124,10 +119,10 @@ checkservice rpcbind
 echo "requirements okay!"
 echo
 
-backupfile /etc/default/nfs-common
-backupfile /etc/default/nfs-kernel-server
+backupfile /etc/nfs.conf
+renamefiles /etc/nfs.conf.d/*.conf
 backupfile /etc/services
-backupfile /usr/lib/systemd/scripts/nfs-utils_env.sh
+backupfile /etc/default/quota
 echo
 
 set +e
@@ -150,20 +145,15 @@ echo
 
 set -e
 
-replacefile nfs-common /etc/default/nfs-common
-replacefile nfs-kernel-server /etc/default/nfs-kernel-server
-replacefile 99-nfs-static-ports.conf /etc/sysctl.d/99-nfs-static-ports.conf
+replacefile nfs.conf /etc/nfs.conf
+replacefile 98-nfs-static-ports.conf /etc/sysctl.d/98-nfs-static-ports.conf
+replacefile quota /etc/default/quota
 echo
 
 appendfile services /etc/services
 echo
 
-fixnfshostname /etc/default/nfs-common
-fixnfshostname /etc/default/nfs-kernel-server
-echo
-
-appendnfsenv /usr/lib/systemd/scripts/nfs-utils_env.sh
-execnfsenv /usr/lib/systemd/scripts/nfs-utils_env.sh
+fixnfshostname
 echo
 
 sysctlrefresh
@@ -181,10 +171,10 @@ A log file can be found at:
 
 Remember:
 
-    - to place a recovery lock in /etc/ctdb/ctdb.conf:
+    - to place a cluster lock in /etc/ctdb/ctdb.conf:
         ...
         [cluster]
-        recovery lock = /clustered.filesystem/.reclock
+        cluster lock = /clustered.filesystem/.reclock
         ...
 
 And, make sure you enable ctdb service again:
diff --git a/debian/ctdb.example/nfs-kernel-server/nfs-common b/debian/ctdb.example/nfs-kernel-server/nfs-common
deleted file mode 100644
index 9d4f22c..0000000
--- a/debian/ctdb.example/nfs-kernel-server/nfs-common
+++ /dev/null
@@ -1,19 +0,0 @@
-# CTDB: /etc/default/nfs-common for clustering
-
-NFS_HOSTNAME="PLACE_HOSTNAME_HERE"
-
-# rpc.statd - daemon listening for reboot notifications (locks related)
-NEED_STATD="yes"
-STATDOPTS="-n ${NFS_HOSTNAME} -p 32765 -o 32766 -H /etc/ctdb/statd-callout -T 32768 -U 32768"
-STATD_HOSTNAME="$NFS_HOSTNAME"
-
-# rpc.gssd - security context for rpc connections
-NEED_GSSD="no"
-
-# rpc.idmapd - NFSv4 <-> name mapping daemon (fallback nowadays)
-# recent kernels use nfsidmap(8) instead
-NEED_IDMAPD="no"
-
-# rpc.quota - usage quota
-RPCRQUOTADOPTS="-p 32769"
-
diff --git a/debian/ctdb.example/nfs-kernel-server/nfs-kernel-server b/debian/ctdb.example/nfs-kernel-server/nfs-kernel-server
deleted file mode 100644
index 6aa5df9..0000000
--- a/debian/ctdb.example/nfs-kernel-server/nfs-kernel-server
+++ /dev/null
@@ -1,16 +0,0 @@
-# CTDB: /etc/default/nfs-kernel-server for clustering
-
-NFS_HOSTNAME="PLACE_HOSTNAME_HERE"
-
-# rpc.nfsd - user level part of nfs service (kernel: nfsd module)
-RPCNFSDPRIORITY=0
-RPCNFSDCOUNT=8
-RPCNFSDOPTS="-N 4"
-
-# rpc.mountd - server side of nfs mount protocol
-RPCMOUNTDOPTS="-p 32767 --manage-gids --no-nfs-version 4"
-
-# rpc.svcgssd - userspace daemon to handle sec context for kernel rpcsec_gss
-NEED_SVCGSSD="no"
-RPCSVCGSSDOPTS=""
-
diff --git a/debian/ctdb.example/nfs-kernel-server/nfs.conf b/debian/ctdb.example/nfs-kernel-server/nfs.conf
new file mode 100644
index 0000000..5cfa13a
--- /dev/null
+++ b/debian/ctdb.example/nfs-kernel-server/nfs.conf
@@ -0,0 +1,20 @@
+[general]
+pipefs-directory = /run/rpc_pipefs
+
+[lockd]
+port = 32768
+udp-port = 32768
+
+[mountd]
+manage-gids = 1
+port = 32767
+
+[nfsd]
+threads = 8
+vers4 = n
+
+[statd]
+ha-callout = /etc/ctdb/statd-callout
+name = @NFS_HOSTNAME@
+outgoing-port = 32766
+port = 32765
diff --git a/debian/ctdb.example/nfs-kernel-server/quota b/debian/ctdb.example/nfs-kernel-server/quota
new file mode 100644
index 0000000..00eab66
--- /dev/null
+++ b/debian/ctdb.example/nfs-kernel-server/quota
@@ -0,0 +1,5 @@
+# Set to "true" if warnquota should be run in cron.daily
+run_warnquota=
+
+# Add options to rpc.rquotad here
+RPCRQUOTADOPTS="-p 32769"
diff --git a/debian/patches/VERSION.patch b/debian/patches/VERSION.patch
index d50c4c9..b92d155 100644
--- a/debian/patches/VERSION.patch
+++ b/debian/patches/VERSION.patch
@@ -1,5 +1,5 @@
 From: Eloy A. Paris <[e-mail]>
-Subject: Add "Debian" as vendor suffix
+Subject: Add "Ubuntu" as vendor suffix
 
 Forwarded: not-needed
 ---
@@ -15,5 +15,5 @@ index d91963a..2650887 100644
  #                                                      #
  ########################################################
 -SAMBA_VERSION_VENDOR_SUFFIX=
-+SAMBA_VERSION_VENDOR_SUFFIX=Debian
++SAMBA_VERSION_VENDOR_SUFFIX=Ubuntu
  SAMBA_VERSION_VENDOR_PATCH=
diff --git a/debian/patches/add-support-for-bind-918-2.patch b/debian/patches/add-support-for-bind-918-2.patch
new file mode 100644
index 0000000..bdcddcc
--- /dev/null
+++ b/debian/patches/add-support-for-bind-918-2.patch
@@ -0,0 +1,51 @@
+Description: further changes to support bind 9.18 DLZ
+Author: Andreas Hasenack <[e-mail]>
+Bug: https://bugzilla.samba.org/show_bug.cgi?id=14986
+Bug-Ubuntu: https://bugs.launchpad.net/samba/+bug/1964032
+Forwarded: https://bugzilla.samba.org/attachment.cgi?id=17194
+Last-Update: 2022-03-07
+
+diff --git a/python/samba/provision/sambadns.py b/python/samba/provision/sambadns.py
+index 6823f9ee56b..404b346a885 100644
+--- a/python/samba/provision/sambadns.py
++++ b/python/samba/provision/sambadns.py
+@@ -1017,6 +1017,7 @@ def create_named_conf(paths, realm, dnsdomain, dns_backend, logger):
+         bind9_12 = '#'
+         bind9_14 = '#'
+         bind9_16 = '#'
++        bind9_18 = '#'
+         if bind_info.upper().find('BIND 9.8') != -1:
+             bind9_8 = ''
+         elif bind_info.upper().find('BIND 9.9') != -1:
+@@ -1031,6 +1032,8 @@ def create_named_conf(paths, realm, dnsdomain, dns_backend, logger):
+             bind9_14 = ''
+         elif bind_info.upper().find('BIND 9.16') != -1:
+             bind9_16 = ''
++        elif bind_info.upper().find('BIND 9.18') != -1:
++            bind9_18 = ''
+         elif bind_info.upper().find('BIND 9.7') != -1:
+             raise ProvisioningError("DLZ option incompatible with BIND 9.7.")
+         elif bind_info.upper().find('BIND_9.13') != -1:
+@@ -1050,7 +1053,8 @@ def create_named_conf(paths, realm, dnsdomain, dns_backend, logger):
+                     "BIND9_11": bind9_11,
+                     "BIND9_12": bind9_12,
+                     "BIND9_14": bind9_14,
+-                    "BIND9_16": bind9_16
++                    "BIND9_16": bind9_16,
++                    "BIND9_18": bind9_18
+                     })
+ 
+ 
+diff --git a/source4/setup/named.conf.dlz b/source4/setup/named.conf.dlz
+index c2c41e2cddf..cbe7d805f58 100644
+--- a/source4/setup/named.conf.dlz
++++ b/source4/setup/named.conf.dlz
+@@ -30,5 +30,8 @@ dlz "AD DNS Zone" {
+ 
+     # For BIND 9.16.x
+     ${BIND9_16} database "dlopen ${MODULESDIR}/bind9/dlz_bind9_16.so";
++    #
++    # For BIND 9.18.x
++    ${BIND9_18} database "dlopen ${MODULESDIR}/bind9/dlz_bind9_18.so";
+ };
+ 
diff --git a/debian/patches/add-support-for-bind-918.patch b/debian/patches/add-support-for-bind-918.patch
new file mode 100644
index 0000000..ddad02f
--- /dev/null
+++ b/debian/patches/add-support-for-bind-918.patch
@@ -0,0 +1,54 @@
+From cee61ae9e633afef8debe3ed1d0ceda1e41d8307 Mon Sep 17 00:00:00 2001
+From: Douglas Bagnall <[e-mail]>
+Date: Thu, 24 Feb 2022 12:17:00 +1300
+Subject: [PATCH] s4/dlz: try adding support for bind 9.18
+
+Signed-off-by: Douglas Bagnall <[e-mail]>
+---
+ source4/dns_server/dlz_minimal.h |  3 +++
+ source4/dns_server/wscript_build | 10 ++++++++++
+ 2 files changed, 13 insertions(+)
+
+Origin: other, https://bugzilla.samba.org/attachment.cgi?id=17176
+Bug: https://bugzilla.samba.org/show_bug.cgi?id=14986
+Bug-Ubuntu: https://bugs.launchpad.net/samba/+bug/1964032
+Last-Update: 2022-03-07
+
+diff --git a/source4/dns_server/dlz_minimal.h b/source4/dns_server/dlz_minimal.h
+index e2a14266810..b7e36e7f8e6 100644
+--- a/source4/dns_server/dlz_minimal.h
++++ b/source4/dns_server/dlz_minimal.h
+@@ -48,6 +48,9 @@
+ #elif defined (BIND_VERSION_9_16)
+ # define DLZ_DLOPEN_VERSION 3
+ # define DNS_CLIENTINFO_VERSION 2
++#elif defined (BIND_VERSION_9_18)
++# define DLZ_DLOPEN_VERSION 3
++# define DNS_CLIENTINFO_VERSION 2
+ #else
+ # error Unsupported BIND version
+ #endif
+diff --git a/source4/dns_server/wscript_build b/source4/dns_server/wscript_build
+index 8f606f92692..ab0a241b937 100644
+--- a/source4/dns_server/wscript_build
++++ b/source4/dns_server/wscript_build
+@@ -70,6 +70,16 @@ bld.SAMBA_LIBRARY('dlz_bind9_16',
+                   deps='samba-hostconfig samdb-common gensec popt dnsserver_common',
+                   enabled=bld.AD_DC_BUILD_IS_ENABLED())
+ 
++bld.SAMBA_LIBRARY('dlz_bind9_18',
++                  source='dlz_bind9.c',
++                  cflags='-DBIND_VERSION_9_18',
++                  private_library=True,
++                  link_name='modules/bind9/dlz_bind9_18.so',
++                  realname='dlz_bind9_18.so',
++                  install_path='${MODULESDIR}/bind9',
++                  deps='samba-hostconfig samdb-common gensec popt dnsserver_common',
++                  enabled=bld.AD_DC_BUILD_IS_ENABLED())
++
+ bld.SAMBA_LIBRARY('dlz_bind9_for_torture',
+                   source='dlz_bind9.c',
+                   cflags='-DBIND_VERSION_9_16',
+-- 
+2.30.2
+
diff --git a/debian/patches/fix-nfs-service-name-to-nfs-kernel-server.patch b/debian/patches/fix-nfs-service-name-to-nfs-kernel-server.patch
index 70afeba..0010ab2 100644
--- a/debian/patches/fix-nfs-service-name-to-nfs-kernel-server.patch
+++ b/debian/patches/fix-nfs-service-name-to-nfs-kernel-server.patch
@@ -4,13 +4,15 @@ Subject: fix nfs related service names
 Upstream defines nfs related service names based on the Linux
 distribution. This patch fixes the names for Debian and derivatives.
 
+Update by Andreas Hasenack <[e-mail]> (LP: #1961840):
+Use nfsconf(8) if it's available, instead of parsing the old config
+files in /etc/default/nfs-*
+
 Bug-Debian: https://bugs.debian.org/929931
 Bug-Ubuntu: https://bugs.launchpad.net/bugs/722201
-Last-Update: 2018-08-05
-Index: samba/ctdb/config/events/legacy/06.nfs.script
-===================================================================
---- samba.orig/ctdb/config/events/legacy/06.nfs.script	2020-11-24 18:11:53.506104058 -0500
-+++ samba/ctdb/config/events/legacy/06.nfs.script	2020-11-24 18:11:53.502104093 -0500
+Last-Update: 2022-03-16
+--- a/ctdb/config/events/legacy/06.nfs.script
++++ b/ctdb/config/events/legacy/06.nfs.script
 @@ -6,7 +6,7 @@
  
  . "${CTDB_BASE}/functions"
@@ -20,11 +22,9 @@ Index: samba/ctdb/config/events/legacy/06.nfs.script
  
  load_script_options "service" "60.nfs"
  
-Index: samba/ctdb/config/events/legacy/60.nfs.script
-===================================================================
---- samba.orig/ctdb/config/events/legacy/60.nfs.script	2020-11-24 18:11:53.506104058 -0500
-+++ samba/ctdb/config/events/legacy/60.nfs.script	2020-11-24 18:11:53.502104093 -0500
-@@ -6,9 +6,9 @@
+--- a/ctdb/config/events/legacy/60.nfs.script
++++ b/ctdb/config/events/legacy/60.nfs.script
+@@ -6,9 +6,11 @@
  
  . "${CTDB_BASE}/functions"
  
@@ -32,14 +32,14 @@ Index: samba/ctdb/config/events/legacy/60.nfs.script
 +service_name="nfs-kernel-server"
  
 -load_system_config "nfs"
-+load_system_config "nfs-kernel-server"
++if ! type nfsconf > /dev/null 2>&1; then
++    load_system_config "nfs-kernel-server"
++fi
  
  load_script_options
  
-Index: samba/ctdb/config/nfs-linux-kernel-callout
-===================================================================
---- samba.orig/ctdb/config/nfs-linux-kernel-callout	2020-11-24 18:11:53.506104058 -0500
-+++ samba/ctdb/config/nfs-linux-kernel-callout	2020-11-24 18:11:53.502104093 -0500
+--- a/ctdb/config/nfs-linux-kernel-callout
++++ b/ctdb/config/nfs-linux-kernel-callout
 @@ -14,7 +14,7 @@
  
  # As above, edit the default value below.  CTDB_NFS_DISTRO_STYLE is a
@@ -49,31 +49,40 @@ Index: samba/ctdb/config/nfs-linux-kernel-callout
  
  case "$nfs_distro_style" in
  systemd-*)
-@@ -33,6 +33,14 @@
+@@ -32,7 +32,22 @@
+ 		: # Defaults only
  		;;
  	*-debian)
- 		nfs_rquotad_service="quotarpc"
-+		nfs_lock_service=""
-+		nfs_lock_service=""
-+		nfs_mountd_service=""
-+		nfs_status_service=""
+-		nfs_rquotad_service="quotarpc"
++		# XXX
++		# Undefine nfs_rquotad_services because the quotarpc service won't
++		# start unless there are specific "quota" mount options in /etc/fstab.
++		# In this way, we let ctdb start it up manually once the
++		# /etc/ctdb/nfs-checks.d/50.rquotad.check detects rpc.rquotad isn't
++		# running.
++		# Users who really don't want rpc.rquotad running should then move
++		# the 50.rquotad.check script away.
 +		nfs_rquotad_service=""
 +		nfs_service="nfs-kernel-server"
-+		nfs_config="/etc/default/nfs-kernel-server"
++		if type nfsconf >/dev/null 2>&1; then
++			nfs_config=""
++		else
++			nfs_config="/etc/default/nfs-kernel-server"
++		fi
 +		nfs_rquotad_config="/etc/default/quota"
  		;;
  	*)
  		echo "Internal error"
-Index: samba/ctdb/config/statd-callout
-===================================================================
---- samba.orig/ctdb/config/statd-callout	2020-11-24 18:11:53.506104058 -0500
-+++ samba/ctdb/config/statd-callout	2020-11-24 18:11:53.502104093 -0500
-@@ -29,7 +29,7 @@
+--- a/ctdb/config/statd-callout
++++ b/ctdb/config/statd-callout
+@@ -29,7 +29,9 @@
  }
  
  # Try different variables to find config file for NFS_HOSTNAME
 -load_system_config "nfs" "nfs-common"
-+load_system_config "nfs-kernel-server"
++if ! type nfsconf > /dev/null 2>&1; then
++    load_system_config "nfs-common" "nfs-kernel-server"
++fi
  
  # If NFS_HOSTNAME not set then try to pull it out of /etc/nfs.conf
  if [ -z "$NFS_HOSTNAME" ] && type nfsconf >/dev/null 2>&1 ; then
diff --git a/debian/patches/series b/debian/patches/series
index 534c7a2..84b4e9e 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -21,3 +21,5 @@ move-msg.sock-from-var-lib-samba-to-run-samba.patch
 testparm-do-not-fail-if-pid-dir-does-not-exist.patch
 add-missing-libs-deps.diff
 fix-samba-tool-domain-join-segfault.patch
+add-support-for-bind-918.patch
+add-support-for-bind-918-2.patch
diff --git a/debian/rules b/debian/rules
index 5236cac..b4d6710 100755
--- a/debian/rules
+++ b/debian/rules
@@ -86,6 +86,10 @@ WITH_GLUSTERFS = yes
 ifneq ($(DEB_HOST_ARCH_OS), linux)
     WITH_GLUSTERFS =
 endif
+# GlusterFS is not built for i386 on Ubuntu
+ifeq ($(DEB_VENDOR) $(DEB_HOST_ARCH), Ubuntu i386)
+    WITH_GLUSTERFS =
+endif
 
 ifeq ($(DEB_HOST_ARCH_OS), linux)
 conf_args += \
diff --git a/debian/smb.conf b/debian/smb.conf
index 37fafb2..385197a 100644
--- a/debian/smb.conf
+++ b/debian/smb.conf
@@ -28,6 +28,9 @@
 # Change this to the workgroup/NT-domain name your Samba server will part of
    workgroup = WORKGROUP
 
+# server string is the equivalent of the NT Description field
+   server string = %h server (Samba, Ubuntu)
+
 #### Networking ####
 
 # The specific set of interfaces / networks to bind to
@@ -166,28 +169,31 @@
 
 #======================= Share Definitions =======================
 
-[homes]
-   comment = Home Directories
-   browseable = no
+# Un-comment the following (and tweak the other settings below to suit)
+# to enable the default home directory shares. This will share each
+# user's home directory as \\server\username
+;[homes]
+;   comment = Home Directories
+;   browseable = no
 
 # By default, the home directories are exported read-only. Change the
 # next parameter to 'no' if you want to be able to write to them.
-   read only = yes
+;   read only = yes
 
 # File creation mask is set to 0700 for security reasons. If you want to
 # create files with group=rw permissions, set next parameter to 0775.
-   create mask = 0700
+;   create mask = 0700
 
 # Directory creation mask is set to 0700 for security reasons. If you want to
 # create dirs. with group=rw permissions, set next parameter to 0775.
-   directory mask = 0700
+;   directory mask = 0700
 
 # By default, \\server\username shares can be connected to by anyone
 # with access to the samba server.
-# The following parameter makes sure that only "username" can connect
-# to \\server\username
+# Un-comment the following parameter to make sure that only "username"
+# can connect to \\server\username
 # This might need tweaking when using external authentication schemes
-   valid users = %S
+;   valid users = %S
 
 # Un-comment the following and create the netlogon directory for Domain Logons
 # (you need to configure Samba to act as a domain controller too.)
diff --git a/debian/tests/cifs-share-access-uring b/debian/tests/cifs-share-access-uring
index 013d12c..11a1914 100644
--- a/debian/tests/cifs-share-access-uring
+++ b/debian/tests/cifs-share-access-uring
@@ -3,6 +3,12 @@
 set -x
 set -e
 
+ARCH=$(dpkg --print-architecture)
+if [ "$ARCH" = "i386" ]; then
+    echo "liburing not available on $ARCH, skipping test"
+    exit 77
+fi
+
 . debian/tests/util
 
 k_ver=$(uname -r | cut -d - -f 1)
diff --git a/debian/tests/smbclient-share-access-uring b/debian/tests/smbclient-share-access-uring
index 27d69e0..07eab66 100644
--- a/debian/tests/smbclient-share-access-uring
+++ b/debian/tests/smbclient-share-access-uring
@@ -3,6 +3,12 @@
 set -x
 set -e
 
+ARCH=$(dpkg --print-architecture)
+if [ "$ARCH" = "i386" ]; then
+    echo "liburing not available on $ARCH, skipping test"
+    exit 77
+fi
+
 . debian/tests/util
 
 k_ver=$(uname -r | cut -d - -f 1)
diff --git a/debian/tests/util b/debian/tests/util
index 47d58b9..87a2ccd 100644
--- a/debian/tests/util
+++ b/debian/tests/util
@@ -31,7 +31,7 @@ add_user() {
     echo "Creating a local and samba user called ${username}"
     useradd -m "${username}"
     echo "Setting samba password for the ${username} user"
-    echo "${password}\n${password}" | smbpasswd -s -a ${username}
+    (echo "${password}"; echo "${password}") | smbpasswd -s -a ${username}
 }
 
 # $1: share name