samba (2:4.24.6+dfsg-1ubuntu1) stonking; urgency=medium

  * Merge with Debian unstable (LP: #2164694). Remaining changes:
    - Ubuntu i386 binary compatibility:
      + d/control: enable the liburing vfs module, except on i386 where
        liburing is not available
      + python3-samba depends on python3-cryptography, which Ubuntu doesn't
        build on i386 (LP #2099895):
        - d/control: don't recommend python3-samba on i386
        - d/rules: don't build python3-samba on ubuntu i386
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: have the (now transitional) samba-vfs-modules package
      depend on samba-vfs-ceph, so that upgrades retain the ceph vfs
      module
    - d/control: samba-vfs-modules should only depend on the new
      samba-vfs-ceph and samba-vfs-glusterfs packages on the
      architectures where those two packages are built (LP #2076682)
    - d/p/fix-motd-gpo-list-empty.patch: fix crash when listing an empty MOTD
      GPO
    - d/t/samba-ad-dc-provisioning-internal-dns: add MOTD GPO test
    - d/control, d/samba-libs.install: remove the pkg.samba.builtin-ngtcp2
      build profile and the build dependency on libngtcp2 because it's in
      universe, and switch to the builtin version shipped with samba.
    - d/t/control: certain tests don't work on i386 in Ubuntu
    - d/t/samba-ad-dc-provisioning-internal-dns: force a known short
      hostname to avoid netbios length limitations (LP #2160627)

 -- Andreas Hasenack <andreas.hasenack@canonical.com>  Thu, 20 Aug 2026 19:08:39 -0300

samba (2:4.24.6+dfsg-1) unstable; urgency=medium

  * debian/upstream/signing-key.asc: update
  * new upstream stable.bugfix release:
   - https://bugzilla.samba.org/show_bug.cgi?id=15978:
     leases torture test flappy (marked flappy)
   - https://bugzilla.samba.org/show_bug.cgi?id=15994:
     CTDB doesn't send tickle ACKs when taking over a released IP
   - https://bugzilla.samba.org/show_bug.cgi?id=16065:
     Memory leak in DRS when replication fails
   - https://bugzilla.samba.org/show_bug.cgi?id=16077:
     witness test flappy needs to be fixed
   - https://bugzilla.samba.org/show_bug.cgi?id=16093:
     temporary read of unrelated or non-existing memory in s3 dfs server
   - https://bugzilla.samba.org/show_bug.cgi?id=16094:
     source4/dsdb/samdb/cracknames.c doesn't use ldb_binary_encode_string()
     consistently
   - https://bugzilla.samba.org/show_bug.cgi?id=16152:
     CTDB can run nested elections, in rare circumstances
   - https://bugzilla.samba.org/show_bug.cgi?id=16153:
     dsgetdcname() may not detect an active directory domain if the
     netbios domain name is given and nmbd nor the nbt service is available
   - https://bugzilla.samba.org/show_bug.cgi?id=16176:
     vfs_ceph_snapshots: smbd panics on snapshot access for a share
     mounted at the CephFS root ("/")
   - https://bugzilla.samba.org/show_bug.cgi?id=16186:
     vfs_ceph_new: smbd crashes when mixing proxy and non-proxy CephFS shares
   - https://bugzilla.samba.org/show_bug.cgi?id=16191:
     race condition in pthreadpool when forking
   - https://bugzilla.samba.org/show_bug.cgi?id=16199:
     ndr_{push,pull,print}_{timeval,timespec} encode/decode the value twice
  * d/samba-libs.symbols: add new ndr symbols

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 13 Aug 2026 19:14:56 +0300

samba (2:4.24.5+dfsg-1) unstable; urgency=medium

  * new upstream Jul-2026 secrity release, fixing the following issues:
    CVE-2026-6949: TSIG packet with name compression can crash DNS
      https://www.samba.org/samba/security/CVE-2026-6949.html
    CVE-2026-58216: An authenticated user could possibly crash a KDC process
      https://www.samba.org/samba/security/CVE-2026-58216.html
    CVE-2026-58218: DNS signing DoS via TKEY name cache exhaustion
      https://www.samba.org/samba/security/CVE-2026-58218.html
    CVE-2026-58221: Samba AD authenticated LDAP access domain takeover
      https://www.samba.org/samba/security/CVE-2026-58221.html
    CVE-2026-58222: Samba AD LDAP Compare filter injection and
      trusted-request confusion disclose protected attributes
      https://www.samba.org/samba/security/CVE-2026-58222.html
    CVE-2026-58224: The CTDB protocol has bounds checking issues
      https://www.samba.org/samba/security/CVE-2026-58224.html

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 28 Jul 2026 14:09:41 +0300

samba (2:4.24.4+dfsg-1ubuntu1) stonking; urgency=medium

  * Merge with Debian unstable (LP: #2153251). Remaining changes:
    - Ubuntu i386 binary compatibility:
      + d/control: enable the liburing vfs module, except on i386 where
        liburing is not available
      + python3-samba depends on python3-cryptography, which Ubuntu doesn't
        build on i386 (LP #2099895):
        - d/control: don't recommend python3-samba on i386
        - d/rules: don't build python3-samba on ubuntu i386
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: have the (now transitional) samba-vfs-modules package
      depend on samba-vfs-ceph, so that upgrades retain the ceph vfs
      module
    - d/control: samba-vfs-modules should only depend on the new
      samba-vfs-ceph and samba-vfs-glusterfs packages on the
      architectures where those two packages are built (LP #2076682)
    - d/p/fix-motd-gpo-list-empty.patch: fix crash when listing an empty MOTD
      GPO
    - d/t/samba-ad-dc-provisioning-internal-dns: add MOTD GPO test
    - d/control, d/samba-libs.install: remove the pkg.samba.builtin-ngtcp2
      build profile and the build dependency on libngtcp2 because it's in
      universe, and switch to the builtin version shipped with samba.
    - d/t/control: certain tests don't work on i386 in Ubuntu
  * Dropped:
    - d/control: drop lib{nss-pam}-winbind Recommends from bin:samba-ad-dc, as
      these are not necessary nor recommended for an Active Directory server
      (LP #2144939)
      [In 2:4.23.6+dfsg-2]
    - SECURITY UPDATE: May 2026 security updates
      + debian/patches/security-202605-*.patch
      + CVE-2026-1933 - Missing access checks on reparse point operations
      + CVE-2026-2340 - WORM vfs module does not block overwrites
      + CVE-2026-3012 - auto-enrolment GPO installing CA certificate over
                        http without verification
      + CVE-2026-3238 - Denial of service against AD DC WINS server
      + CVE-2026-4408 - Unauthenticated Remote Code Execution in Samba
                        DCE/RPC SAMR server
      + CVE-2026-4480 - Unauthenticated Remote Code Execution in Samba
                        printing subsystem
      [Fixed upstream in 4.24.4]
    - d/control: make samba-vfs-modules-extra a transitional package.
      The glusterfs vfs module (the only vfs module shipped in it
      previously) is now in bin:samba-vfs-glusterfs. Can be dropped
      after 26.04.
      [Not needed anymore in 26.10+]
    - d/control: samba-vfs-modules i386 adjustments:
      + samba-vfs-modules-extra was not built before for 32bit architectures,
        adjust Architectures line
      + samba-vfs-modules: this one was build for 32bit architectures before,
        so we need the conditional Depends for ceph
      [Not needed anymore in 26.10+]
  * Added:
    - d/t/samba-ad-dc-provisioning-internal-dns: force a known short
      hostname to avoid netbios length limitations (LP: #2160627)

 -- Andreas Hasenack <andreas.hasenack@canonical.com>  Wed, 15 Jul 2026 17:12:19 -0300

samba (2:4.24.4+dfsg-1) unstable; urgency=medium

  [ Pino Toscano ]
  * heimdal-errno-include.patch
    fix build on Hurd using fix from upstream heimdal

  [ Michael Tokarev ]
  * update to the new upstream stable/bugfix release:
   - https://bugzilla.samba.org/show_bug.cgi?id=14638:
     restrict anonymous = 2 breaks RODC functionality
   - https://bugzilla.samba.org/show_bug.cgi?id=16006:
     warning: assignment discards 'const' qualifier from pointer target type
     [-Wdiscarded-qualifiers]
   - https://bugzilla.samba.org/show_bug.cgi?id=16067:
     Require NTLMv2 session security on Windows makes trusts to Samba unusable
   - https://bugzilla.samba.org/show_bug.cgi?id=16092:
     Compilers may ignore overflow checks - Fix tautological-compare warnings
   - https://bugzilla.samba.org/show_bug.cgi?id=16095:
     Use-after-free in handling acls with claims and conditions
   - https://bugzilla.samba.org/show_bug.cgi?id=16149:
     domain\user not split when provided as username
     in smbc_set_credentials_with_fallback()
   - https://bugzilla.samba.org/show_bug.cgi?id=16151:
     winbindd stuck in init_dc_connection_rpc() returning
     NT_STATUS_TRUSTED_DOMAIN_FAILURE

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 30 Jun 2026 22:37:50 +0300

samba (2:4.24.3+dfsg-1) unstable; urgency=medium

  * This is a security release in order to address the following defects:

    CVE-2026-1933: Missing access checks on reparse point operations

      On a share marked "read only = yes" and on file handles opened R/O users
      can set or delete the reparse point xattrs on files that the user has
      write-access in the file system for.

      https://www.samba.org/samba/security/CVE-2026-1933.html

    CVE-2026-2340: WORM vfs module does not block overwrites

      The WORM (Write-Once, Read Many) vfs module is supposed to lock write
      access to shared files, so they cannot be altered after initial writes.
      It was allowing files to be overwritten by renaming a newly created file
      over a protected file.

      https://www.samba.org/samba/security/CVE-2026-2340.html

    CVE-2026-3012: auto-enrolment GPO installing CA certificate over http
      without verification

      To bootstrap a certificate chain a domain member must fetch a certificate
      without TLS. It was trusting HTTP for this when a more secure encrypted
      LDAP channel was also available.

      https://www.samba.org/samba/security/CVE-2026-3012.html

    CVE-2026-3238: Denial of service against AD DC WINS server

      The WINS server component of the Active Directory Domain controller code
      in Samba is vulnerable to a NULL pointer dereference and crash caused by
      an unauthenticated UDP packet.

      https://www.samba.org/samba/security/CVE-2026-3238.html

    CVE-2026-4408: Unauthenticated Remote Code Execution in Samba DCE/RPC
      SAMR server

      Samba file servers and classic (non-AD) domain controllers with
      samba-dcerpcd started as a system service and with a "check password
      script" that has the %u substitution character are vulnerable to a
      remote code execution.

      https://www.samba.org/samba/security/CVE-2026-4408.html

    CVE-2026-4480: Unauthenticated Remote Code Execution in Samba
      printing subsystem

      Samba print servers with a "print command" that has the %J substitution
      character are vulnerable to a Remote Code Execution.

      https://www.samba.org/samba/security/CVE-2026-4480.html

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 26 May 2026 15:46:55 +0300

samba (2:4.24.2+dfsg-1) unstable; urgency=medium

  * new upstream point release

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 12 May 2026 21:10:42 +0300

samba (2:4.24.1+dfsg-1) unstable; urgency=medium

  * new upstream point release
  * promote to unstable

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 17 Apr 2026 11:02:47 +0300

samba (2:4.24.0+dfsg-1) experimental; urgency=medium

  * new upstream release
  * use-explicit_bzero-to-zero-memory.diff: update
    to replace memset_explicit()
  * replace-progname.diff: refresh, shorten context
  * libtalloc, libtdb: bump versions, add new symbols
  * d/not-installed: add libcmocka-private-samba.so.0
  * d/not-installed: remove old entries

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 18 Mar 2026 14:17:08 +0300

samba (2:4.23.6+dfsg-2) unstable; urgency=medium

  * samba-bgqd.service: ship a unit file, but not auto-enable it
  * d/rules: do not enable nmbd by default
  * d/control: drop libnss-winbind & libpam-winbind from
    samba-ad-dc:Recommends (Closes: #1130068)

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 08 Mar 2026 14:27:42 +0300

samba (2:4.23.6+dfsg-1ubuntu3) stonking; urgency=medium

  * SECURITY UPDATE: May 2026 security updates
    - debian/patches/security-202605-*.patch
    - CVE-2026-1933 - Missing access checks on reparse point operations
    - CVE-2026-2340 - WORM vfs module does not block overwrites
    - CVE-2026-3012 - auto-enrolment GPO installing CA certificate over
                      http without verification
    - CVE-2026-3238 - Denial of service against AD DC WINS server
    - CVE-2026-4408 - Unauthenticated Remote Code Execution in Samba
                      DCE/RPC SAMR server
    - CVE-2026-4480 - Unauthenticated Remote Code Execution in Samba
                      printing subsystem

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 21 May 2026 12:27:46 -0400

samba (2:4.23.6+dfsg-1ubuntu2) resolute; urgency=medium

  * d/control: drop lib{nss-pam}-winbind Recommends from bin:samba-ad-dc, as
    these are not necessary nor recommended for an Active Directory server
    (LP: #2144939)

 -- Andreas Hasenack <andreas.hasenack@canonical.com>  Thu, 19 Mar 2026 16:34:10 -0300

samba (2:4.23.6+dfsg-1ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2143168). Remaining changes:
    - Ubuntu i386 binary compatibility:
      + d/control: enable the liburing vfs module, except on i386 where
        liburing is not available
      + python3-samba depends on python3-cryptography, which Ubuntu doesn't
        build on i386 (LP #2099895):
        - d/control: don't recommend python3-samba on i386
        - d/rules: don't build python3-samba on ubuntu i386
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: make samba-vfs-modules-extra a transitional package.
      The glusterfs vfs module (the only vfs module shipped in it
      previously) is now in bin:samba-vfs-glusterfs. Can be dropped
      after 26.04.
    - d/control: have the (now transitional) samba-vfs-modules package
      depend on samba-vfs-ceph, so that upgrades retain the ceph vfs
      module
    - d/control: samba-vfs-modules and samba-vfs-modules-extra, now
      transitional packages, should only depend on the new samba-vfs-ceph and
      samba-vfs-glusterfs packages on the architectures where those two
      packages are built (LP #2076682)
    - d/control: samba-vfs-modules i386 adjustments:
      + samba-vfs-modules-extra was not built before for 32bit architectures,
        adjust Architectures line
      + samba-vfs-modules: this one was build for 32bit architectures before,
        so we need the conditional Depends for ceph
    - d/p/fix-motd-gpo-list-empty.patch: fix crash when listing an empty MOTD
      GPO
    - d/t/samba-ad-dc-provisioning-internal-dns: add MOTD GPO test
    - d/control, d/samba-libs.install: remove the pkg.samba.builtin-ngtcp2
      build profile and the build dependency on libngtcp2 because it's in
      universe, and switch to the builtin version shipped with samba.
    - d/t/control: certain tests don't work on i386 in Ubuntu

 -- Andreas Hasenack <andreas.hasenack@canonical.com>  Tue, 03 Mar 2026 18:02:46 -0300

samba (2:4.23.6+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release.
  * d/clean: also remove python/samba/provision/kerberos_implementation.py
    (Closes: #1048754)
  * check-for-openat2.patch: detect openat2 in libc (Closes: #1128849)

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 27 Feb 2026 13:11:48 +0300

samba (2:4.23.5+dfsg-1ubuntu2) resolute; urgency=medium

  * No-change rebuild for gpgme1.0 2.0

 -- Ural Tunaboyu <ural.tunaboyu@canonical.com>  Thu, 19 Feb 2026 18:57:14 +0000

samba (2:4.23.5+dfsg-1ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2139074). Remaining changes:
    - Ubuntu i386 binary compatibility:
      + d/control: enable the liburing vfs module, except on i386 where
        liburing is not available
      + python3-samba depends on python3-cryptography, which Ubuntu doesn't
        build on i386 (LP #2099895):
        - d/control: don't recommend python3-samba on i386
        - d/rules: don't build python3-samba on ubuntu i386
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: make samba-vfs-modules-extra a transitional package.
      The glusterfs vfs module (the only vfs module shipped in it
      previously) is now in bin:samba-vfs-glusterfs. Can be dropped
      after 26.04.
    - d/control: have the (now transitional) samba-vfs-modules package
      depend on samba-vfs-ceph, so that upgrades retain the ceph vfs
      module
    - d/control: samba-vfs-modules and samba-vfs-modules-extra, now
      transitional packages, should only depend on the new samba-vfs-ceph and
      samba-vfs-glusterfs packages on the architectures where those two
      packages are built (LP #2076682)
    - d/control: samba-vfs-modules i386 adjustments:
      + samba-vfs-modules-extra was not built before for 32bit architectures,
        adjust Architectures line
      + samba-vfs-modules: this one was build for 32bit architectures before,
        so we need the conditional Depends for ceph
    - d/p/fix-motd-gpo-list-empty.patch: fix crash when listing an empty MOTD
      GPO
    - d/t/samba-ad-dc-provisioning-internal-dns: add MOTD GPO test
    - d/control, d/samba-libs.install: remove the pkg.samba.builtin-ngtcp2
      build profile and the build dependency on libngtcp2 because it's in
      universe, and switch to the builtin version shipped with samba.
    - d/t/control: certain tests don't work on i386 in Ubuntu
  * Dropped:
    - d/t/{control,smbclient-macro-expansion}: add test for macro expansion
      (related to LP #2120811)
      [In 2:4.23.5+dfsg-1]

 -- Andreas Hasenack <andreas.hasenack@canonical.com>  Wed, 11 Feb 2026 11:42:28 -0300

samba (2:4.23.5+dfsg-1) unstable; urgency=medium

  [ Michael Tokarev ]
  * new upstream bugfix release
  * use-explicit_bzero-to-zero-memory.diff: use explicit_bzero()
    to explicitly zero memory everywhere, not just for ZERO_STRUCT
  * heimdal-kdc-fix-memset_s-calls-1296.patch -
    fix some wrong memset_s usages
  * d/*.lintian-overrides: remove library-not-linked-against-libc tags
    (#896012 is now fixed)
  * inline-getprogname.diff, inline-openat2.diff - reduce libreplace usage
  * d/patches/series: remove old commented-out entry
  * add-support-for-bind-9.20.patch: remove, applied upstream

  [ Andreas Hasenack ]
  * Add DEP8 test for macro expansion in config file

 -- Michael Tokarev <mjt@tls.msk.ru>  Sat, 24 Jan 2026 08:55:25 +0300

samba (2:4.23.4+dfsg-1ubuntu2) resolute; urgency=medium

  * No-change rebuild for Python 3.14 as the default.

 -- Andreas Hasenack <andreas.hasenack@canonical.com>  Mon, 26 Jan 2026 16:22:49 -0300

samba (2:4.23.4+dfsg-1ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2126006). Remaining changes:
    - Ubuntu i386 binary compatibility:
      + d/control: enable the liburing vfs module, except on i386 where
        liburing is not available
      + python3-samba depends on python3-cryptography, which Ubuntu doesn't
        build on i386 (LP #2099895):
        - d/control: don't recommend python3-samba on i386
        - d/rules: don't build python3-samba on ubuntu i386
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: make samba-vfs-modules-extra a transitional package.
      The glusterfs vfs module (the only vfs module shipped in it
      previously) is now in bin:samba-vfs-glusterfs. Can be dropped
      after 26.04.
    - d/control: have the (now transitional) samba-vfs-modules package
      depend on samba-vfs-ceph, so that upgrades retain the ceph vfs
      module
    - d/control: samba-vfs-modules and samba-vfs-modules-extra, now
      transitional packages, should only depend on the new samba-vfs-ceph and
      samba-vfs-glusterfs packages on the architectures where those two
      packages are built (LP #2076682)
    - d/control: samba-vfs-modules i386 adjustments:
      + samba-vfs-modules-extra was not built before for 32bit architectures,
        adjust Architectures line
      + samba-vfs-modules: this one was build for 32bit architectures before,
        so we need the conditional Depends for ceph
    - d/p/fix-motd-gpo-list-empty.patch: fix crash when listing an empty MOTD
      GPO
    - d/t/samba-ad-dc-provisioning-internal-dns: add MOTD GPO test
    - d/t/{control,smbclient-macro-expansion}: add test for macro expansion
      (related to LP #2120811)
  * Dropped:
    - SECURITY UPDATE: uninitialized memory disclosure via vfs_streams_xattr
      + debian/patches/CVE-2025-9640-1.patch: add torture test for inserting
        hole in stream in source3/selftest/tests.py, source4/torture/*.
      + debian/patches/CVE-2025-9640-2.patch: fix unitialized write in
        source3/modules/vfs_streams_xattr.c.
      + CVE-2025-9640
      [Fixed upstream in 4.23.2]
    - SECURITY UPDATE: command injection via WINS server hook script
      + debian/patches/CVE-2025-10230-1.patch: check that wins hook sanitizes
        names in python/samba/tests/usage.py, selftest/*, source4/torture/*,
        testprogs/blackbox/wins_hook_test.
      + debian/patches/CVE-2025-10230-2.patch: restrict names fed to shell in
        source4/nbt_server/wins/wins_hook.c.
      + CVE-2025-10230
      [Fixed upstream in 4.23.2]
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP #2024663)
      [Only needed for upgrades from jammy to noble]
    - d/control: don't have bin:samba recommend bin:samba-ad-dc (LP #2101838)
      [In 2:4.23.0+dfsg-1]
  * Added:
    - d/control, d/samba-libs.install: remove the pkg.samba.builtin-ngtcp2
      build profile and the build dependency on libngtcp2 because it's in
      universe, and switch to the builtin version shipped with samba.
    - d/t/control: certain tests don't work on i386 in Ubuntu

 -- Andreas Hasenack <andreas.hasenack@canonical.com>  Fri, 09 Jan 2026 16:59:09 -0300

samba (2:4.23.4+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release:
   - https://bugzilla.samba.org/show_bug.cgi?id=15809:
     samba-bgqd: rework man page
   - https://bugzilla.samba.org/show_bug.cgi?id=15897:
     Assert failed: (dirfd != -1) || (smb_fname->base_name[0] == '/')
     in vfswrap_openat
   - https://bugzilla.samba.org/show_bug.cgi?id=15926:
     Samba 4.22 breaks Time Machine
   - https://bugzilla.samba.org/show_bug.cgi?id=15936:
     samba-bgqd can't find [printers] share
   - https://bugzilla.samba.org/show_bug.cgi?id=15947:
     mdssvc doesn't support $time.iso dates before 1970
   - https://bugzilla.samba.org/show_bug.cgi?id=15950:
     ctdb can crash with inconsistent cluster lock configuration
   - https://bugzilla.samba.org/show_bug.cgi?id=15955:
     Winbind can hang forever in gssapi if there are network issues
   - https://bugzilla.samba.org/show_bug.cgi?id=15961:
     libldb requires linking libreplace on Linux
   - https://bugzilla.samba.org/show_bug.cgi?id=15963:
  * d/patches: remove revert-ldb-use-hexchars_upper-from-replace.h.patch
    (applied upstream)

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 12 Dec 2025 23:10:50 +0300

samba (2:4.23.3+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release:
   - https://bugzilla.samba.org/show_bug.cgi?id=15926:
     Samba 4.22 breaks Time Machine
   - https://bugzilla.samba.org/show_bug.cgi?id=15927:
     Spotlight search restriction for shares incomplete and
     default search searches in too many attributes
   - https://bugzilla.samba.org/show_bug.cgi?id=15930:
     Searching for numbers doesn't work with Spotlight
   - https://bugzilla.samba.org/show_bug.cgi?id=15931:
     rpcd_mdssvc may crash because name mangling is not initialized
   - https://bugzilla.samba.org/show_bug.cgi?id=15933:
     Only increment lease epoch if a lease was granted
   - https://bugzilla.samba.org/show_bug.cgi?id=15935:
     Crash in ctdbd on failed updateip
   - https://bugzilla.samba.org/show_bug.cgi?id=15940:
     vfs_recycle does not update mtime
   - https://bugzilla.samba.org/show_bug.cgi?id=15943:
     samba-log-parser fails with UnicodeDecodeError:
     'utf-8' codec can't decode byte

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 07 Nov 2025 16:45:53 +0300

samba (2:4.23.2+dfsg-1) unstable; urgency=medium

  * new upstream security release:
  * CVE-2025-9640: Uninitialized memory disclosure via vfs_streams_xattr
    https://www.samba.org/samba/security/CVE-2025-9640.html
  * CVE-2025-10230: Command injection via WINS server hook script
    https://www.samba.org/samba/security/CVE-2025-10230.html

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 15 Oct 2025 17:21:11 +0300

samba (2:4.23.1+dfsg-1) unstable; urgency=medium

  [ Michael Tokarev ]
  * new upstream stable/bugfix release (Closes: #1116050):
   - https://bugzilla.samba.org/show_bug.cgi?id=15904:
     CTDB does not support PCP 7.0.0
   - https://bugzilla.samba.org/show_bug.cgi?id=15914:
     winbind can crash at startup
   - https://bugzilla.samba.org/show_bug.cgi?id=15919:
     vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
     for fsync_send
   - https://bugzilla.samba.org/show_bug.cgi?id=15920:
     Incomplete bind configuration causes DLZ plugin to crash
   - https://bugzilla.samba.org/show_bug.cgi?id=15921:
     CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set
  * d/control: describe the forgotten mitkrb5 build profile
  * d/control: Standards-Version: 4.7.2 (no changes)
  * d/control: sort python build-deps together
  * d/control: clarify some :native usages and add non-:native
    alternatives for gcc-mingw*
  * d/control: clarify python3-dev:native, libpython3-dev:host
  * usershare.patch: remove
  * d/samba.postinst: add `usershare max shares` parameter on upgrade
  * debian/samba{,-libs}.lintian-overrides: remove unused
    hardening-no-fortify-functions overrides

  [ Grzegorz Szymaszek ]
  * d/smb.conf: delete trailing spaces in comments

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 26 Sep 2025 22:31:59 +0300

samba (2:4.23.0+dfsg-3) unstable; urgency=medium

  * libmscat-deps.patch (Closes: #1103869)
  * disable building undocumented dumpmscat binary, but provide
    pkg.samba.dumpmscat build profile to enable buildig it
  * enable system libngtcp2 (for !pkg.samba.builtin-ngtcp2 build profile)
  * d/control: describe all current build profiles
  * d/smb.conf: disable netbios by default
  * d/samba.postinst: remove hunk for samba << 4.16.0 (pre-bookworm)
    concerning socket directory
  * d/samba.postinst: remove hunk for samba << 4.17.4-3 (pre-bookworm)
    concerning handling of samba spool dir
  * d/samba.postinst: remove hunk for samba << 4.17.4-3 (pre-bookworm)
    concerning masking of services
  * d/winbind.postinst: remove hunk for samba << 4.17.4-3 (pre-bookworm)
    concerning masking of services
  * d/samba-common.postinst: actually clean-up old debconf entries
  * d/changelog: fix typo in previous entry

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 16 Sep 2025 16:17:37 +0300

samba (2:4.23.0+dfsg-2) unstable; urgency=medium

  * d/rules: override dh_gencontrol for arch build only
    (no need to do that for indep build)
  * d/samba-libs.install: libquic is linux-specific
  * d/samba-libs.install: ngtcp2 is linux-specific, not non-hurd
  * d/control: build-depend on :native variant of mingw gcc/tools
    (helps building for bookworm where these tools aren't M-A:foreign)

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 14 Sep 2025 15:35:35 +0300

samba (2:4.23.0+dfsg-1) unstable; urgency=medium

  * new upstream release
  * d/watch: 4.23
  * d/gbp.conf: switch to 4.23 upstream branch
  * d/rules: tevent=0.17.1 tdb=1.4.14
  * libads-fix-get_kdc_ip_string.patch: remove (included upstream)
  * d/copyright: remove entries for two removed files
  * d/libpam-winbind.install: install message catalogs
  * d/samba-common-bin.install: install message catalog(s) for the net command
  * d/libsmbclient0.symbols,d/libtevent0t64.symbols: add new symbols
  * d/libtdb1.symbols: add new version
  * d/samba-dsdb-modules.install: add new AD module (trust_notify.so)
  * d/samba-libs.install: refresh private libraries list (-1, +4 libs)
  * d/samba-libs.preinst: remove, used in distant past
    for upgrades from ancient versions
  * d/control: stop recommending samba-ad-dc (and python3-samba)
    from samba package (was needed for transition)
  * d/control: stop recommending attr by samba
  * d/control: remove pre-bookworm (samba<<4.17) breaks/replaces
  * d/control: stop samba from being dependent on procps
    (ps was used in initscript long ago)
  * d/control: stop ctdb from being dependent on psmisc and sudo
  * stop ctdb from depending on time package
  * d/libnss-winbind.triggers: remove, ldconfig call is generated by genshlibs
  * d/rules: explicitly specify --pythondir= & --pythonarchdir=
    (so it doesn't install to /usr/lib/python3.13/site-packages/)
  * d/rules,d/lib{nss,pam}-winbind.install: use ${SYSLIBDIR}
    for /lib vs /usr/lib, stop using dh_movetousr

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 12 Sep 2025 12:38:48 +0300

samba (2:4.22.3+dfsg-4ubuntu4) resolute; urgency=medium

  * No-change rebuild for icu soname.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 03 Dec 2025 14:37:35 +0100

samba (2:4.22.3+dfsg-4ubuntu3) resolute; urgency=medium

  * No-change rebuild to fix amd64v3 publishing issue.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 12 Nov 2025 08:18:52 -0500

samba (2:4.22.3+dfsg-4ubuntu2.1) questing-security; urgency=medium

  * SECURITY UPDATE: uninitialized memory disclosure via vfs_streams_xattr
    - debian/patches/CVE-2025-9640-1.patch: add torture test for inserting
      hole in stream in source3/selftest/tests.py, source4/torture/*.
    - debian/patches/CVE-2025-9640-2.patch: fix unitialized write in
      source3/modules/vfs_streams_xattr.c.
    - CVE-2025-9640
  * SECURITY UPDATE: command injection via WINS server hook script
    - debian/patches/CVE-2025-10230-1.patch: check that wins hook sanitizes
      names in python/samba/tests/usage.py, selftest/*, source4/torture/*,
      testprogs/blackbox/wins_hook_test.
    - debian/patches/CVE-2025-10230-2.patch: restrict names fed to shell in
      source4/nbt_server/wins/wins_hook.c.
    - CVE-2025-10230

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 09 Oct 2025 08:57:10 -0400

samba (2:4.22.3+dfsg-4ubuntu2) questing; urgency=medium

  * d/t/{control,smbclient-macro-expansion}: add test for macro expansion
    (related to LP #2120811)

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 01 Sep 2025 08:56:55 -0300

samba (2:4.22.3+dfsg-4ubuntu1) questing; urgency=medium

  * Merge with Debian unstable (LP: #2117421, LP: #2116098). Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + enable the liburing vfs module, except on i386 where liburing is
        not available
      + python3-samba depends on python3-cryptography, which Ubuntu doesn't
        build on i386 (LP #2099895):
        - d/control: don't recommend python3-samba on i386
        - d/rules: don't build python3-samba on ubuntu i386
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP #2024663)
    - d/control: make samba-vfs-modules-extra a transitional package.
      The glusterfs vfs module (the only vfs module shipped in it
      previously) is now in bin:samba-vfs-glusterfs
    - d/control: have the (now transitional) samba-vfs-modules package
      depend on samba-vfs-ceph, so that upgrades retain the ceph vfs
      module
    - d/control: samba-vfs-modules and samba-vfs-modules-extra, now
      transitional packages, should only depend on the new samba-vfs-ceph and
      samba-vfs-glusterfs packages on the architectures where those two
      packages are built (LP #2076682)
    - d/control: samba-vfs-modules i386 adjustments:
      + samba-vfs-modules-extra was not built before for 32bit architectures,
        adjust Architectures line
      + samba-vfs-modules: this one was build for 32bit architectures before,
        so we need the conditional Depends for ceph
    - d/p/fix-motd-gpo-list-empty.patch: fix crash when listing an empty MOTD
      GPO
    - d/t/samba-ad-dc-provisioning-internal-dns: add MOTD GPO test
    - d/control: don't have bin:samba recommend bin:samba-ad-dc (LP #2101838)
  * Dropped:
    - d/control: Fix t64 package name in 'Enhances' attribute.
      [In 2:4.22.3+dfsg-3]
    - d/p/fix-update-motd-gpo.patch: multiple fixes for MOTD GPO:
      + fix crash when updating an already existing MOTD GPO (LP #2092308)
      + fix another crash when the GPO doesn't exist yet (LP #2098755)
      + replace instead of append MOTD GPO text
      [Fixed upstream in 4.22.1, should have been dropped in previous merge]

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 21 Jul 2025 18:13:42 -0300

samba (2:4.22.3+dfsg-4) unstable; urgency=medium

  * fix python3-talloc.symbols generation to not have -debian_revision
    or +dfsg/+samba suffix in the version number - just the epoch if any
    and the upstream version (fix lintian error)

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 17 Jul 2025 13:52:35 +0300

samba (2:4.22.3+dfsg-3) unstable; urgency=medium

  [ Sascha Lucas ]
  * winbind pam-config: fix account section to actually execute pam_winbind
    entries after usually successful call to pam_unix, in a way how it's done
    in sssd (Closes: #907318)

  [ Douglas Bagnall ]
  * debian/panic-action: make the wording more user-friendly and steer users
    towards configuration and logs (Closes: #1089853)

  [ Michael Tokarev ]
  * d/python3-talloc.symbols.in: add forgotten epoch number for recent versions
    (this doesn't actually affect anything since there were no new symbols with
    these versions, but it's better to stay correct)
  * d/control: fix winbind:Enhances for libkrb5-26-heimdal which
    is libkrb5-26t64-heimdal in trixie and up, keeping in mind possible
    backporting to older debian/ubuntu versions (before-trixie build profile)
  * libads-fix-get_kdc_ip_string.patch (upstream fix for #1109005)
    (Closes: #1109005)

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 15 Jul 2025 12:42:04 +0300

samba (2:4.22.3+dfsg-2) unstable; urgency=medium

  * Revert "d/control,d/rules: ensure we use the most recent talloc/tevent/tdb"
    There's no need for samba-libs to depend on exact versions of support libs
    anymore, since 4.21.3+dfsg-5 (where the mistake has been made) is long gone
  * Revert "d/control: add conflicts/breaks for libtevent0t64 on mjt repo"
    This Breaks was special and temporary, and not useful for debian archive at
    all (it was only needed for mjt's own repository where the wrong package
    name slipped out once).  Remove this cruft for trixie
  * python3-talloc.symbols[.in] -- provide long-forgotten symbols file, so that
    versioned dependency on python3-talloc (mostly for python3-samba) will be
    less strict.  For smoother upgrades
  * document forgotten change in previous changelog entry

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 09 Jul 2025 17:08:31 +0300

samba (2:4.22.3+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release, mostly targetting the Jul-08 update
    for Active Directory Domain Controllers
    (https://bugzilla.samba.org/show_bug.cgi?id=15876, Closes: #1108904):
   - https://bugzilla.samba.org/show_bug.cgi?id=15854:
     samba-tool cannot add user to group whose name
     is exactly 16 characters long
   - https://bugzilla.samba.org/show_bug.cgi?id=15869:
     Startup messages of rpc daemons fills /var/log/messages
   - https://bugzilla.samba.org/show_bug.cgi?id=15876:
     Windows security hardening locks out schannel'ed netlogon
     dc calls like netr_DsRGetDCName
  * update d/copyright to point to https://www.gnu.org/licenses/
    instead of FSF postal address
  * d/control: stop depending on exact same version of samba-common
    Package samba-common contains a few files/dirs common for several samba
    packages.  Its contents hasn't changed for quite some time.  There's
    definitely no need to depend on exact version of this package - eg, 4.17
    (from bookworm) will work just fine with samba version 4.22.  Drop version
    requirement for samba-common dep entirely.  If/when we have real change in
    samba-common which is needed by other packages, we can specify particular
    version there.  For smoother upgrades

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 07 Jul 2025 23:16:23 +0300

samba (2:4.22.2+dfsg-1ubuntu1) questing; urgency=medium

  * Merge with Debian unstable (LP: #2110446, LP: #2108981). Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + enable the liburing vfs module, except on i386 where liburing is
        not available
      + python3-samba depends on python3-cryptography, which Ubuntu doesn't
        build on i386 (LP #2099895):
        - d/control: don't recommend python3-samba on i386
        - d/rules: don't build python3-samba on ubuntu i386
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP #2024663)
    - d/control: Fix t64 package name in 'Enhances' attribute.
    - d/control: make samba-vfs-modules-extra a transitional package.
      The glusterfs vfs module (the only vfs module shipped in it
      previously) is now in bin:samba-vfs-glusterfs
    - d/control: have the (now transitional) samba-vfs-modules package
      depend on samba-vfs-ceph, so that upgrades retain the ceph vfs
      module
    - d/control: samba-vfs-modules and samba-vfs-modules-extra, now
      transitional packages, should only depend on the new samba-vfs-ceph and
      samba-vfs-glusterfs packages on the architectures where those two
      packages are built (LP #2076682)
    - d/control: samba-vfs-modules i386 adjustments:
      + samba-vfs-modules-extra was not built before for 32bit architectures,
        adjust Architectures line
      + samba-vfs-modules: this one was build for 32bit architectures before,
        so we need the conditional Depends for ceph
    - d/p/fix-update-motd-gpo.patch: multiple fixes for MOTD GPO:
      + fix crash when updating an already existing MOTD GPO (LP #2092308)
      + fix another crash when the GPO doesn't exist yet (LP #2098755)
      + replace instead of append MOTD GPO text
    - d/p/fix-motd-gpo-list-empty.patch: fix crash when listing an empty MOTD
      GPO
    - d/t/samba-ad-dc-provisioning-internal-dns: add MOTD GPO test
    - d/control: don't have bin:samba recommend bin:samba-ad-dc (LP #2101838)
  * Dropped:
    - d/samba-vfs-ceph.install: add the ceph_new vfs module and manpage
      (LP #2099928)
      [In 2:4.22.0+dfsg-1]

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 18 Jun 2025 17:29:20 -0300

samba (2:4.22.2+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release:
   - https://bugzilla.samba.org/show_bug.cgi?id=15707:
     CVE-2025-0620: smbd doesn't pick up group membership changes when
     re-authenticating an expired SMB session
     Closes: #1107248
   - https://bugzilla.samba.org/show_bug.cgi?id=15727:
     net ad join fails with
    "Failed to join domain: failed to create kerberos keytab"
   - https://bugzilla.samba.org/show_bug.cgi?id=15819:
     vfs_ceph_snapshots fails to list snapshots for entries at any level
     beyond share root
   - https://bugzilla.samba.org/show_bug.cgi?id=15851:
     dcerpcd not able to bind to listening port
   - https://bugzilla.samba.org/show_bug.cgi?id=15858:
     CTDB does not put nodes running NFS into grace on graceful shutdown
   - https://bugzilla.samba.org/show_bug.cgi?id=15861:
     Profile sync fails due to Directory Leases
  * d/control: add libcrypt-dev build-dependency (Closes: #1106959)
  * add-support-for-bind-9.20.patch (Closes: #1107139)

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 05 Jun 2025 19:12:34 +0300

samba (2:4.22.1+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release:
   - https://bugzilla.samba.org/show_bug.cgi?id=15727:
     net ad join fails with "Failed to join domain:
     failed to create kerberos keytab"
   - https://bugzilla.samba.org/show_bug.cgi?id=15767:
     Deadlock between two smbd processes
   - https://bugzilla.samba.org/show_bug.cgi?id=15774:
     Running "gpo manage motd set" twice fails with backtrace
   - https://bugzilla.samba.org/show_bug.cgi?id=15791:
     Remove of file or directory not possible with vfs_acl_tdb
   - https://bugzilla.samba.org/show_bug.cgi?id=15810:
     Add async io API from libcephfs to ceph_new VFS module
   - https://bugzilla.samba.org/show_bug.cgi?id=15818:
     vfs_ceph_new module does not work with other modules
     for snapshot management
   - https://bugzilla.samba.org/show_bug.cgi?id=15822:
     Enable support for cephfs case insensitive behavior
   - https://bugzilla.samba.org/show_bug.cgi?id=15823:
     Subnet based interfaces definition not listening
     on all covered IP addresses
   - https://bugzilla.samba.org/show_bug.cgi?id=15829:
     samba-tool gpo backup creates entity backups it can't read
   - https://bugzilla.samba.org/show_bug.cgi?id=15834:
     vfs_ceph_new: Add path based fallback for SMB_VFS_FCHOWN,
     SMB_VFS_FCHMOD and SMB_VFS_FNTIMES
   - https://bugzilla.samba.org/show_bug.cgi?id=15836:
     PANIC: assert failed at source3/smbd/smb2_oplock.c(156):
     sconn->oplocks.exclusive_open>=0
   - https://bugzilla.samba.org/show_bug.cgi?id=15839:
     gp_cert_auto_enroll_ext.py has problem unpacking GUIDs with prepended 0's
   - https://bugzilla.samba.org/show_bug.cgi?id=15841:
     Wide link issue in samba 4.22
   - https://bugzilla.samba.org/show_bug.cgi?id=15845:
     NT_STATUS_INVALID_PARAMETER: Can't create folders
     on share of an exfat file system
   - https://bugzilla.samba.org/show_bug.cgi?id=15849:
     Lease code is not endian-safe
  * drop widelinks-nofollow.patch (included upstream)
  * drop smbd-fix-handling-of-directory-leases-and-oplock-lev.patch (ditto)

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 18 Apr 2025 13:02:55 +0300

samba (2:4.22.0+dfsg-3) unstable; urgency=medium

  * widelinks-nofollow.patch (https://bugzilla.samba.org/show_bug.cgi?id=15841)
    (Closes: #1101581)

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 02 Apr 2025 14:34:31 +0300

samba (2:4.22.0+dfsg-2) unstable; urgency=medium

  * smbd-fix-handling-of-directory-leases-and-oplock-lev.patch
    (Closes: #1100604)

 -- Michael Tokarev <mjt@tls.msk.ru>  Sat, 29 Mar 2025 07:24:47 +0300

samba (2:4.22.0+dfsg-1) unstable; urgency=medium

  * new upstream release
  * samba-libs: provide libndr5 too (with a compat symlink)
  * add libsamba-security-private.so link for freeipa testsuite
    (Closes: #1099340)
  * d/samba-vfs-ceph.install: install also ceph_new vfs module
    (Closes: #1098670)
  * d/*.install: s@/*/@/${DEB_HOST_MULTIARCH}/@
  * d/source/lintian-overrides: add dh-exec-useless-usage *DEB_HOST_MULTIARCH*

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 07 Mar 2025 00:02:26 +0300

samba (2:4.22.0~rc1+dfsg-1) experimental; urgency=medium

  * d/control: remove vorlon@ from Uploaders.
    Thank you, dear friend, for all the work you've done. RIP!
  * new upstream release candidate
    Closes: #1084559 (crypt module removal in python 3.13)
  * remove patches which has been applied upstream
  * fix-nfs-service-name-to-nfs-kernel-server.patch:
    refresh, remove now-unneeded hunk
  * revert-ldb-use-hexchars_upper-from-replace.h.patch
    to avoid linking libldb2 with libreplace
  * replace-xpg-strerror.patch
    to avoid linking other libs with libreplace
  * d/rules: fixup component versions
  * libtalloc, libtevent, libtdb, libldb: symbols: add new versions
  * libldb2.symbols: add new version
  * samba-libs: libndr.so soname bump to 6, add new symbols
  * samba-libs: add libutil-crypt-private-samba.so.0

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 07 Feb 2025 12:37:12 +0300

samba (2:4.21.4+dfsg-1ubuntu5) questing; urgency=medium

  * d/t/samba-ad-dc-provisioning-internal-dns: ignore MOTD GPO test failure on
    s390x due to LP #2110127

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 07 May 2025 10:23:02 -0300

samba (2:4.21.4+dfsg-1ubuntu4) questing; urgency=medium

  * Fix updating an existing MOTD GPO (LP: #2107395):
    - d/p/fix-update-motd-gpo.patch: replace with upstream's version
    - d/t/samba-ad-dc-provisioning-internal-dns: add MOTD GPO test
    - d/p/fix-motd-gpo-list-empty.patch: fix crash when listing an empty MOTD
      GPO

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 23 Apr 2025 09:30:40 -0300

samba (2:4.21.4+dfsg-1ubuntu3) plucky; urgency=medium

  * d/control: don't have bin:samba recommend bin:samba-ad-dc (LP: #2101838)

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 10 Mar 2025 10:58:01 -0300

samba (2:4.21.4+dfsg-1ubuntu2) plucky; urgency=medium

  * d/samba-vfs-ceph.install: add the ceph_new vfs module and manpage
    (LP: #2099928)
  * python3-samba depends on python3-cryptography, which Ubuntu doesn't build
    on i386 (LP: #2099895):
    - d/control: don't recommend python3-samba on i386
    - d/rules: don't build python3-samba on ubuntu i386

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 24 Feb 2025 16:05:36 -0300

samba (2:4.21.4+dfsg-1ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2085212). Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + enable the liburing vfs module, except on i386 where liburing is
        not available
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP #2024663)
    - Fix t64 package name in 'Enhances' attribute.
    - debian/tests: launch container with security.nesting=true
      Otherwise, systemd-resolved in the member-server container will
      fail to start, and cause the test to fail. (LP #2046486)
    - d/control: make samba-vfs-modules-extra a transitional package.
      The glusterfs vfs module (the only vfs module shipped in it
      previously) is now in bin:samba-vfs-glusterfs
    - d/control: have the (now transitional) samba-vfs-modules package
      depend on samba-vfs-ceph, so that upgrades retain the ceph vfs
      module
    - d/control: samba-vfs-modules and samba-vfs-modules-extra, now
      transitional packages, should only depend on the new samba-vfs-ceph and
      samba-vfs-glusterfs packages on the architectures where those two
      packages are built (LP #2076682)
    - d/control:
      + samba-vfs-modules-extra was not built before for 32bit architectures,
        adjust Architectures line
      + samba-vfs-modules: this one was build for 32bit architectures before,
        so we need the conditional Depends for ceph
    - d/p/fix-update-motd-gpo.patch: fix crash when updating an already existing
      MOTD GPO (LP #2092308)
  * Added:
    - d/t/samba-ad-dc-provisioning-internal-dns: force samba-tool to use
      kerberos when interrogating the DNS server, otherwise it will prompt for
      a password
    - d/t/control: dpkg-vendor is also needed for the AD test
    - d/p/fix-update-motd-gpo.patch: fix another crash when the GPO doesn't
      exist yet (LP: #2098755)

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 20 Feb 2025 07:56:20 -0300

samba (2:4.21.3+dfsg-6) unstable; urgency=medium

  * d/genshlibs: remove the special-case for libsmbclient0 since
    we expand t64:Provides in d/control directly
  * d/control: add ${t64:Provides} comments
  * d/control: more t64 work: for libtevent0t64, break libtevent0
    not <<${source:Version} but <<${binary:Version}, because source
    is samba not tevent (Closes: #1092881)

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 12 Jan 2025 23:16:00 +0300

samba (2:4.21.3+dfsg-5) unstable; urgency=medium

  * the Fixing Big Mishaps release.

  * d/rules: fix talloc, tevent, tdb subpackages version numbers, add epoch

    Due to a mistake, I screwed up sub-packages versions completely,
    by using the wrong variable when generating the versions, - so
    all mentioned packages had version number of ldb, not their own.

    Fix this.

    Unfortunately, the wrong version is larger than all the correct ones.
    To compensate, use the same epoch number as is already used by current
    samba package (2:).

    While at it, use common variable to hold the +samba version suffix.

  * d/*.symbols: mark most recent version markers with 2: epoch too

  * d/control,d/rules: ensure we use the most recent libtalloc/libtevent/libtdb
    for now, to compensate for the wrong versions.

  * d/control: add explicit Provides of non-t64 libs

    Apparentlty due to usage of both t64 and pre-t64 packages
    (with different build profiles), debhelper is not populating
    necessary values for ${t64:Provides}.  So libtevent0t64 is
    not providing libtevent0 on the relevant architectures.
    Ditto for libsmbclient0 providing libsmbclient.

    Add explicit arch-specific Provides: for libsmbclient0 and
    libtevent0t64.

    List only the affected release architectures in there.

    This removes the only user of X-Time64-Compat control field
    in debian.

  * d/rules: do not install wscript_build in examples

  * d/control: fix libtevent wrong build profile when building for mjt's
    repository.  Does not affect debian thankfully.  The problem is that
    libtevent0t64 slipped into the repository for older (before-trixie)
    distributions, where t64 migration hasn't been completed.  This should
    not cause actual problems as a problem is only possible when upgrading
    to the new debian (or ubuntu) release where t64 transition has happened,
    and during such upgrade, new libtevent0t64 will be pulled in - thanks to
    the first big mistake above, since it now has 2: epoch.
  * d/control: add Breaks for libtevent0t64 on mjt repo.  This also
    does not affect debian, but makes my life definitely easier.

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 12 Jan 2025 00:17:49 +0300

samba (2:4.21.3+dfsg-4) unstable; urgency=medium

  * Revert "d/control: mark arch-all perl and python packages with :native
    for now" - it worked just fine on local build but fails on buildds?
  * d/control: add :native alternative for arch-all perl & python packages
    for now, to help cross-building samba on bookworm and before
    (no difference for trixie).  Use foo:native|foo alternative to work
    around dpkg/apt disparity in handling :native deps.

 -- Michael Tokarev <mjt@tls.msk.ru>  Sat, 11 Jan 2025 11:47:04 +0300

samba (2:4.21.3+dfsg-2) unstable; urgency=medium

  * ctdb-failover-statd_callout-PATH_MAX-workaround.patch
    another tweak for hurd (for missing PATH_MAX)
  * d/control: add a note about ntp & signd socket, replace ntp with ntpsec
  * d/control: provide ability to cross-build samba finally
    (using qemu-user helper)
  * d/control: mark arch-all perl and python packages with :native for now
    (to help cross-building on bookworm)

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 10 Jan 2025 23:23:31 +0300

samba (2:4.21.3+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release:
   - https://bugzilla.samba.org/show_bug.cgi?id=6750:
     After 'machine password timeout' /etc/krb5.keytab is not updated
   - https://bugzilla.samba.org/show_bug.cgi?id=15697:
     Compound rename from Mac clients can fail with
     NT_STATUS_INTERNAL_ERROR if the file has a lease
   - https://bugzilla.samba.org/show_bug.cgi?id=15701:
     More possible replication loops against Azure AD
   - https://bugzilla.samba.org/show_bug.cgi?id=15724:
     vfs crossrename seems not work correctly
   - https://bugzilla.samba.org/show_bug.cgi?id=15755:
     Avoid event failure race when disabling an event script
   - https://bugzilla.samba.org/show_bug.cgi?id=15758:
     Segfault in vfs_btrfs
   - https://bugzilla.samba.org/show_bug.cgi?id=15765:
     Fix heap-user-after-free with association groups
   - https://bugzilla.samba.org/show_bug.cgi?id=15771:
     Memory leak wbcCtxLookupSid
  * d/patches/: specify more Forwarded: urls
  * d/patches/: source3-lib-util_sec.c-include-grp.h-for-setgroups.patch >
                include-grp.h-for-setgroups-in-a-few-places.patch:
    add 1 more place for setgroups()
  * d/rules: remember last versions of ldb/talloc/tevent/tdb, reality check
  * d/control: since we don't use debconf anymore, no need
    to (build-)depend on po-debconf either

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 06 Jan 2025 21:20:31 +0300

samba (2:4.21.2+dfsg-4) unstable; urgency=medium

  * d/rules: guard building compile_et target with !mitkrb5
  * source3-lib-util_sec.c-include-grp.h-for-setgroups.patch for hurd ftbfs
  * build talloc/tevent/tdb from samba source:
   - import talloc, tevent and tdb packaging into samba
   - stop shipping internal-to-samba libpytalloc-util development files
  * d/copyright: mention myself for d/*

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 01 Dec 2024 22:28:05 +0300

samba (2:4.21.2+dfsg-3) unstable; urgency=medium

  * Revert "d/rules: as of 4.17, no need to explicitly build intermediate
    targets anymore".  It is still a problem with samba 4.21, it just were
    hidden.
  * ldb-no-replace.diff: avoid embedding rpath to private samba libs
    for libldb.so
  * heimdal-spelling.patch: remove (forgotten, applied upstream)
  * d/patches/* update dep3 metadata
  * add-missing-libs-deps.diff: update to include more missing deps
    (as submitted upstream)

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 28 Nov 2024 22:28:27 +0300

samba (2:4.21.2+dfsg-2) unstable; urgency=medium

  * resurrect python3-ldb (removed in previous release)
    The removal of python3-ldb were unwarranted, as long as libldb
    itself is stand-alone, lets keep its python bindings stand-alone
    too.
  * d/rules: s/execute_after_dh_install/execute_after_dh_install-arch/
    since it is arch-specific

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 26 Nov 2024 18:56:17 +0300

samba (2:4.21.2+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release:
   - https://bugzilla.samba.org/show_bug.cgi?id=14356
     protocol error - Unclear debug message "pad length mismatch"
     for invalid bind packet
   - https://bugzilla.samba.org/show_bug.cgi?id=15320
     Update CTDB to track all TCP connections to public IP addresses
   - https://bugzilla.samba.org/show_bug.cgi?id=15425
     NetrGetLogonCapabilities QueryLevel 2 needs to be implemented
   - https://bugzilla.samba.org/show_bug.cgi?id=15732
     smbd fails to correctly check sharemode against OVERWRITE dispositions
   - https://bugzilla.samba.org/show_bug.cgi?id=15740
     gss_accept_sec_context() from Heimdal does not imply GSS_C_MUTUAL_FLAG
     with GSS_C_DCE_STYLE
   - https://bugzilla.samba.org/show_bug.cgi?id=15749
     winbindd should call process_set_title() for locator child
   - https://bugzilla.samba.org/show_bug.cgi?id=15752
     winexe no longer works with samba 4.21
   - https://bugzilla.samba.org/show_bug.cgi?id=15754
     Panic in close_directory
  * d/control: add python3-cryptography to python3-samba Depends
    (Closes: #1086768)
  * d/control: move python3-gpg recommends from python3-samba to samba-ad-dc
  * d/control: extend libpcap-dev from hurd-i386 to hurd-any (Closes: #1087409)
  * ship winexe binary (Closes: #1081269).
    New Build-Depends: gcc-mingw-w64-i686-win32 gcc-mingw-w64-x86-64-win32
  * d/control: provide Breaks/Replaces for winexe in kali linux (#1081269)
  * swallow python3-ldb by python3-samba (and remove python3-ldb-dev)
  * d/rules: drop mis-using --bundled-libraries configure option
  * d/samba.postinst: replace test for /usr/bin/deb-systemd-helper file
    with "command -v" (lintian)
  * d/libldb2.lintian-overrides: remove overrides which were needed for compat
    symlink (compat for older ldb in separate source)
  * d/samba.install: stop shipping log2pcap.1 (the tool is not installed)
  * d/rules: rename LDB_* vars to ldb-, and use common var for -Vldb:Version
  * move-msg.sock-from-var-lib-samba-to-run-samba.patch: update
    to cover failing tests too

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 25 Nov 2024 21:38:17 +0300

samba (2:4.21.1+dfsg-2) unstable; urgency=medium

  * d/control: add Recommends: samba-ad-dc for samba for now
    to avoid breaking existing installs
  * d/samba.postrm: stop unmasking of samba-ad-dc
    (it is already done in postinst)
  * d/samba.postinst,d/samba.maintscripts: remove samba-ad-dc
    startup files and stop the service (Closes: #1085617)

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 25 Oct 2024 12:30:52 +0300

samba (2:4.21.1+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release
  * d/salsa-ci.yml: disable reprotest vary build_path
  * d/control: Build-Depend on python3-setuptools (Closes: #1080851)
  * d/rules: stop providing compat symlink for old ldb
    modules location for old sssd
  * d/changelog: mention closing of #835404 by 4.21.0-1

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 14 Oct 2024 21:21:50 +0300

samba (2:4.21.0+dfsg-1) unstable; urgency=medium

  * switch to 4.21 branch
  * update to 4.21.0 (new upstream)
    (Closes: #835404)
  * fix-nfs-service-name-to-nfs-kernel-server.patch: refresh
  * Force-LDB-as-standalone.patch: remove (ldb is always internal now)
  * d/rules: ldb lib is now private by default, expose it as public
  * d/rules: ldb uses LDB_VERSION variable now, not VERSION
  * tilde-in-version.diff: remove (applied upstream)
  * heimdal-spelling.patch: disable for now
  * d/rules: s/vendor-name/vendor-suffix/
  * d/ctdb.install: no more sudoers file
  * d/samba-libs.symbols, d/control, d/samba-libs.install: libndr4=>libndr5
    This requires sssd to be rebuilt
  * samba-{libs,dev}.install, python3-{samba,ldb).install: refresh libs
    (with lintian-overrides)
  * samba-libs.install, samba-dev.install: new (semi-public) library:
    libsamba-policy.so (used by the python stuff only, for now)
  * samba-libs.install: new private library: libsamba-net-private-samba.so.0
  * libldb2.symbols: add new symbols & 2.10.0 version
    (and remove 2.9.1 minor version)
  * d/control: bump libtdb version dependency to 1.4.12
  * d/ctdb.install: install winbind_ctdb_updatekeytab.sh file

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 02 Sep 2024 17:48:34 +0300

samba (2:4.20.4+dfsg-1ubuntu5) plucky; urgency=medium

  * No-change rebuild for icu soname change.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 07 Jan 2025 08:36:04 +0100

samba (2:4.20.4+dfsg-1ubuntu4) plucky; urgency=medium

  * No-change rebuild for Python 3.13 as the default.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 04 Jan 2025 05:17:16 +0100

samba (2:4.20.4+dfsg-1ubuntu3) plucky; urgency=medium

  * d/p/fix-update-motd-gpo.patch: update patch to replace the motd, and not
    keep adding a new one with every update (see comment #4 in LP #2092308)

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 30 Dec 2024 18:18:47 -0300

samba (2:4.20.4+dfsg-1ubuntu2) plucky; urgency=medium

  * d/p/fix-update-motd-gpo.patch: fix crash when updating an already existing
    MOTD GPO (LP: #2092308)

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 20 Dec 2024 17:39:35 -0300

samba (2:4.20.4+dfsg-1ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + enable the liburing vfs module, except on i386 where liburing is
        not available
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP #2024663)
    - Fix t64 package name in 'Enhances' attribute.
    - debian/tests: launch container with security.nesting=true
      Otherwise, systemd-resolved in the member-server container will
      fail to start, and cause the test to fail. (LP #2046486)
    - d/control: make samba-vfs-modules-extra a transitional package.
      The glusterfs vfs module (the only vfs module shipped in it
      previously) is now in bin:samba-vfs-glusterfs
    - d/control: have the (now transitional) samba-vfs-modules package
      depend on samba-vfs-ceph, so that upgrades retain the ceph vfs
      module
  * Added:
    - d/control: samba-vfs-modules and samba-vfs-modules-extra, now
      transitional packages, should only depend on the new samba-vfs-ceph and
      samba-vfs-glusterfs packages on the architectures where those two
      packages are built (LP: #2076682)

 -- Andreas Hasenack <andreas@canonical.com>  Tue, 13 Aug 2024 10:02:30 -0300

samba (2:4.20.4+dfsg-1) unstable; urgency=medium

  * new upstream (minor/bugfix) release fixing the ABI symbol generation
    (Closes: #1078008)
  * mention d/*.symbols change in previous changelog entry
  * revert: d/*.symbols: add new variant of version marks (with underscore)

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 06 Aug 2024 16:58:18 +0300

samba (2:4.20.3+dfsg-1) unstable; urgency=medium

  * update to the new upstream stable/bugfix release (4.20.3).
    See WHATSNEW.txt for details.
  * tilde-in-version.diff: remove, an equivalent is applied upstream
  * d/rules: s/vendor-name/vendor-suffix/ as per new upstream option
  * d/samba-ad-dc.lintian-overrides: add systemd-diversion override too
  * d/*.symbols: add new variant of version marks (with underscore)

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 02 Aug 2024 18:33:51 +0300

samba (2:4.20.2+dfsg-11) unstable; urgency=medium

  * d/control: remove Andrew Bartlett email from Uploaders per his request
  * samba-common-bin.lintian-override: fixup python3-script-but-no-python3-dep
    override
  * fix name of samba-common-bin.lintian-overrides (it is plural)

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 30 Jul 2024 15:54:36 +0300

samba (2:4.20.2+dfsg-10ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2072504). Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + enable the liburing vfs module, except on i386 where liburing is
        not available
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP #2024663)
    - d/t/util: handle breakage introduced by lxd-installer. If on
      Ubuntu, assume lxd comes from a snap and install it if needed
    - d/t/util: ignore cloud-init's warning exit status, which is
      happening because of LP #2048129 (also see LP #2048522)
    - Fix t64 package name in 'Enhances' attribute.
    - debian/tests: launch container with security.nesting=true
      Otherwise, systemd-resolved in the member-server container will
      fail to start, and cause the test to fail. (LP #2046486)
  * Dropped:
    - glusterfs is no longer in main, create new binary package in
      universe to ship the samba glusterfs vfs modules and manpages
      (LP #2045063):
      + d/control: new samba-vfs-modules-glusterfs package
      + d/rules: glusterfs vfs modules and manpages are now in the
        samba-vfs-modules-extra package
      + d/samba-vfs-modules-extra.install: add glusterfs vfs modules and
        manpage
  * Added:
    - d/control: make samba-vfs-modules-extra a transitional package.
      The glusterfs vfs module (the only vfs module shipped in it
      previously) is now in bin:samba-vfs-glusterfs
    - d/control: have the (now transitional) samba-vfs-modules package
      depend on samba-vfs-ceph, so that upgrades retain the ceph vfs
      module

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 05 Aug 2024 14:04:55 -0300

samba (2:4.20.2+dfsg-10) unstable; urgency=medium

  * d/rules: shorten dpkg_late_eval
  * d/rules: stop renaming heimdal dir for mitkrb5 profile
  * d/rules: remove the only usage of ${with_mitkrb5}
  * d/rules: rearrange CFLAGS/LDFLAGS settings to use
    DEB_*_MAINT_APPEND due to dpkg #1077005
  * skip -9 release because of test upload to experimental

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 25 Jul 2024 11:35:21 +0300

samba (2:4.20.2+dfsg-8) unstable; urgency=medium

  * d/samba-common-bin.lintian-override: fix the typo in the last fix
  * d/samba-log-parser: python3-minimal is enough
  * d/rules: define dpkg_late_eval macro since dpkg 1.22.8 does not define
    it anymore (Closes: #1076920)

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 24 Jul 2024 16:54:54 +0300

samba (2:4.20.2+dfsg-7) unstable; urgency=medium

  * d/samba-common-bin.lintian-override: update samba-log-parser override
  * d/control: add Breaks: older samba-ad-dc by samba (Closes: #1076196)

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 14 Jul 2024 19:42:39 +0300

samba (2:4.20.2+dfsg-6) unstable; urgency=medium

  * make-python-optional.diff: remove the forgotten unneeded patch
  * d/samba.NEWS: re-wrap it a little bit
  * d/samba.postinst: notify the user about probably-missing samba-ad-dc
    package on upgrade (debconf template samba/no-samba-ad-dc)
  * d/samba-common.postinst: remove (clean up) old debconf entries

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 08 Jul 2024 16:40:49 +0300

samba (2:4.20.2+dfsg-5) unstable; urgency=medium

  * replace internal-to-samba-build python3-ldb-dev package
    with a transitional empty package (to be removed in trixie+1)
  * d/control: ensure python3-samba depends on exact version of python3-ldb,
    the same way as samba-libs depends on exact version of libldb2
  * d/rules: ensure python3-ldb does not depend on samba-libs|python3-samba
  * d/rules: refine and explain --with-shared-modules
  * d/control: d/control: drop old (buster and before) Breaks

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 01 Jul 2024 10:41:04 +0300

samba (2:4.20.2+dfsg-4) unstable; urgency=medium

  * d/control: add the forgotten epoch for Breaks/Replaces
    of samba-vfs-ceph & samba-vfs-glusterfs (Closes: #1074299)

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 26 Jun 2024 12:20:08 +0300

samba (2:4.20.2+dfsg-3) unstable; urgency=medium

  * split out samba-vfs-glusterfs from samba-vfs-modules
    (pick up and rework ubuntu changes)
  * split out samba-vfs-ceph from samba-vfs-modules
  * merge samba-vfs-modules (remaining) into main samba package
  * the only remaining extra vfs module, snapper, does not need extra handling
  * d/samba-ad-dc.lintian-overrides: add conflicts-with-version override
    for /usr-move
  * samba-common-bin: use trivial separate shell wrapper for the python script
  * d/rules: use before-trixie build profile to control dh_movetousr run too
  * d/*.service: provide empty value for referenced environment vars
    (Closes: #1073969)
  * d/dirs: remove leftover file
  * d/samba-common-bin.dirs: stop creating /etc/samba/tls/
  * d/samba.dirs: stop creating bin & sbin

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 25 Jun 2024 07:58:16 +0300

samba (2:4.20.2+dfsg-2ubuntu2) oracular; urgency=medium

  * debian/tests: launch container with security.nesting=true
    Otherwise, systemd-resolved in the member-server container will
    fail to start, and cause the test to fail. (LP: #2046486)

 -- Nick Rosbrook <enr0n@ubuntu.com>  Tue, 09 Jul 2024 14:46:44 -0400

samba (2:4.20.2+dfsg-2ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2064384). Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + enable the liburing vfs module, except on i386 where liburing is
        not available
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP #2024663)
    - glusterfs is no longer in main, create new binary package in
      universe to ship the samba glusterfs vfs modules and manpages
      (LP #2045063):
      + d/control: new samba-vfs-modules-glusterfs package
      + d/rules: glusterfs vfs modules and manpages are now in the
        samba-vfs-modules-extra package
      + d/samba-vfs-modules-extra.install: add glusterfs vfs modules and
        manpage
    - d/t/util: handle breakage introduced by lxd-installer. If on
      Ubuntu, assume lxd comes from a snap and install it if needed
    - d/t/util: ignore cloud-init's warning exit status, which is
      happening because of LP #2048129 (also see LP #2048522)
    - Fix t64 package name in 'Enhances' attribute.
  * Dropped:
    - Drop explicit, wrong, redundant dependency from samba-dsdb-modules on
      libgpgme11.
      [Included in 2:4.19.5+dfsg-5]
    - d/control: python3-samba has a runtime dep on python3-markdown
      [Fixed in 2:4.19.6+dfsg-2 via
       meaningful-error-if-no-python3-markdown.patch]

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 24 Jun 2024 09:10:47 -0300

samba (2:4.20.2+dfsg-2) unstable; urgency=medium

  * tilde-in-version.diff - allow tilde in version string

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 20 Jun 2024 09:49:50 +0300

samba (2:4.20.2+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release:
   - https://bugzilla.samba.org/show_bug.cgi?id=13019
     Dynamic DNS updates with the internal DNS are not working
   - https://bugzilla.samba.org/show_bug.cgi?id=13213
     Samba build is not reproducible
   - https://bugzilla.samba.org/show_bug.cgi?id=14981
     netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0
   - https://bugzilla.samba.org/show_bug.cgi?id=15412 Anonymous smb3
     signing/encryption should be allowed (similar to Windows Server 2022)
   - https://bugzilla.samba.org/show_bug.cgi?id=15435
     Regression DFS not working with widelinks = true
   - https://bugzilla.samba.org/show_bug.cgi?id=15569
     ldb qsort might r/w out of bounds with an intransitive compare function
   - https://bugzilla.samba.org/show_bug.cgi?id=15573
     Panic in dreplsrv_op_pull_source_apply_changes_trigger
   - https://bugzilla.samba.org/show_bug.cgi?id=15620
     s4:nbt_server: does not provide unexpected handling, so winbindd
     can't use nmb requests instead cldap
   - https://bugzilla.samba.org/show_bug.cgi?id=15625
     Many qsort() comparison functions are non-transitive, which can lead
     to out-of-bounds access in some circumstances
   - https://bugzilla.samba.org/show_bug.cgi?id=15633
     samba-gpupdate - Invalid NtVer in netlogon_samlogon_response
   - https://bugzilla.samba.org/show_bug.cgi?id=15638
     Need to change gitlab-ci.yml tags in all branches to avoid CI bill
   - https://bugzilla.samba.org/show_bug.cgi?id=15642 winbindd,
     net ads join and other things don't work on an ipv6 only host
   - https://bugzilla.samba.org/show_bug.cgi?id=15653 idmap_ad creates
     an incorrect local krb5.conf in case of trusted domain lookups
   - https://bugzilla.samba.org/show_bug.cgi?id=15654
     new --vendor-name and --vendor-patch-revision options for ./configure
   - https://bugzilla.samba.org/show_bug.cgi?id=15659
     Segmentation fault when deleting files in vfs_recycle
     Closes: #1073252
   - https://bugzilla.samba.org/show_bug.cgi?id=15660 The images don't build
     after the git security release and CentOS 8 Stream is EOL
   - https://bugzilla.samba.org/show_bug.cgi?id=15662
     vfs_widelinks with DFS shares breaks case insensitivity
   - https://bugzilla.samba.org/show_bug.cgi?id=15664
     Panic in vfs_offload_token_db_fetch_fsp()
   - https://bugzilla.samba.org/show_bug.cgi?id=15665
     CTDB RADOS mutex helper misses namespace support
   - https://bugzilla.samba.org/show_bug.cgi?id=15666 "client use kerberos"
     and --use-kerberos is ignored for the machine account
  * d/libldb2.symbols,d.python3-ldb.symbols.in: add new version (2.9.1)
  * use ./configure --vendor-name= instead of patching ./VERSION
  * omit samba-ad-dc for i386 ubuntu
  * samba-ad-dc: usr-move compensation maintscripts: add "set -e"

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 19 Jun 2024 23:59:36 +0300

samba (2:4.20.1+dfsg-5) unstable; urgency=medium

  * Build-Depends: dpkg-dev>=trixie for Arch packages only (for t64 rename)
  * d/samba.NEWS: reword the last entry a bit
  * d/samba-ad-dc.init: chmod +x
  * d/control: bump Standards-Version to 4.7.0 (no changes needed)

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 10 Jun 2024 20:17:53 +0300

samba (2:4.20.1+dfsg-4) unstable; urgency=medium

  [ Helmut Grohne ]
  * Mitigate ineffective replaces due to /usr-move (DEP17 P1)
    (Closes: #1072102)

  [ Michael Tokarev ]
  * d/control: mark libkeyutils-dev as linux-only [linux-any]
  * d/control: drop old versions of versioned dependencies

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 29 May 2024 20:31:41 +0300

samba (2:4.20.1+dfsg-3) unstable; urgency=medium

  * d/rules: move samba-common install to d/samba-common.install
  * d/rules: install samba-ad-dc init files for the right package
  * d/samba.postinst: remove nmbd_error_handler for the initscript
    (it is not used in systemd case)

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 26 May 2024 18:48:17 +0300

samba (2:4.20.1+dfsg-2) unstable; urgency=medium

  * move many files from samba package to samba-ad-dc package.
    From now on, samba-ad-dc isn't just a meta-package, it is actually
    needed for AD-DC functionality.  If you run AD-DC, please ensure
    that samba-ad-dc package is installed (it is not recommended by samba)
    Closes: #1051770
  * move samba-tool and samba-gpupdate from samba-common-bin and samba
    packages to python3-samba.  This is an Active Directory stuff, not
    needed for a stand-alone server or a client, but might be useful
    for auth-only (neither file-server nor file-client) AD installs
    Closes: #1068360
  * remove addshare.py, setoption.py and source_samba.py python scripts
    These aren't used by samba packages and are hardly useful generally, esp.
    having in mind their unusual locations.  The apport hook (source_samba.py)
    is mostly obsolete, it hasn't been updated for a very long time.
  * add make-python-optional.diff, so python3 can be made optional
    for samba-common-bin
  * remove python3-samba and python from Depends of samba and samba-common-bin
    packages, moving it to Recommends.  This lets the user to install a stand-
    alone samba file server without any Active Directory bits and even without
    python interpreter
  * d/samba.install: do not install samba_downgrade_db (to old pre-4.8 version)
  * move smbcontrol binary from samba to samba-common-bin,
    since it can also be used to control winbindd
  * d/control: tdb-tools (tdbbackup) are run from python modules,
    move from samba:Depends to python3-samba:Recommends
  * d/control: samba: no need to depend on libpam-runtime or libpam-modules
  * d/control: samba: no need to recommend samba-ad-provision
  * debian/TODO: update a bit, remove many obsolete entries

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 26 May 2024 17:48:13 +0300

samba (2:4.20.1+dfsg-1) unstable; urgency=medium

  * new upstream major release
  * d/control: bump tevent/talloc/tdb versions for Build-Depends
  * d/libldb2.symbols, d/python3-ldb.symbols.in: add new version (2.9.0)
  * d/patches/meaningful-error-if-no-python3-markdown.patch: fixup
  * d/*.install: internal library names changed:
    libfoo-samba4.so.0 => libfoo-private-samba.so.0
  * d/samba-libs.install: update names for libdcerpc & libndr private libs
  * d/samba-libs.install, d/samba-libs.links, d/samba-libs.symbols:
    libndr has soversion 4 now.  This breaks binaries linked with libndr!
  * d/samba-libs.symbols: update with new ndr4 symbols
  * d/libsmbclient.symbols: update with new symbols
  * d/samba-dev.install: add smb3posix.h
  * d/not-installed: add usr/bin/wspsearch experimental windows search binary
  * d/control: libperl-json is not needed for build anymore
  * d/control: bump minimum mit-krb5 version in Build-Depends to 1.21
    (for pkg.samba.mitkrb5 build profile)
  * Closes: #1070335 (wronly filed)

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 08 May 2024 13:23:57 +0300

samba (2:4.19.6+dfsg-3) unstable; urgency=medium

  * fix brown-paper-bag bugs in previous upload
    (in meaningful-error-if-no-python3-markdown.patch)

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 02 May 2024 20:47:15 +0300

samba (2:4.19.6+dfsg-2) unstable; urgency=medium

  [ Michael Tokarev ]
  * meaningful-error-if-no-python3-markdown.patch:
    update to include 2 other places where markdown gets improted
  * d/winbind.service:
    - order it before nss-user-lookup.target (Closes: #1068649)
    - fix typo
    - nmb.service is nmbd.service in debian
  * move include/samba/core/*.h from samba-libs to libwbclient-dev
    (Closes: #1064544)

  [ Alex Murray ]
  * fix smbd apparmor breakage since change to local systemd services
    (Cloes: #1069661)

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 02 May 2024 14:08:31 +0300

samba (2:4.19.6+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release:
   - https://bugzilla.samba.org/show_bug.cgi?id=15527 fd_handle_destructor()
     panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close()
   - https://bugzilla.samba.org/show_bug.cgi?id=15580
     Packet marshalling push support missing for
     CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and CTDB_CONTROL_TCP_CLIENT_PASSED
   - https://bugzilla.samba.org/show_bug.cgi?id=15588
     samba-gpupdate: Correctly implement site support
   - https://bugzilla.samba.org/show_bug.cgi?id=15599
     libgpo: Segfault in python bindings
  * revert d/rules: remove Debian/Ubuntu "branding"

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 08 Apr 2024 11:18:38 +0300

samba (2:4.19.5+dfsg-5) unstable; urgency=medium

  * implement pkg.samba.before-trixie build profile
    (undo t64 changhes and drop build-dep)
  * d/rules: remove Debian/Ubuntu "branding", no need in that
  * d/control: samba-dsdb-modules: drop hardcoded dependency on libgpgme11
    (Closes: #1068526)

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 07 Apr 2024 16:04:30 +0300

samba (2:4.19.5+dfsg-4ubuntu9) noble; urgency=high

  * No change rebuild against libgpgme11t64.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 08 Apr 2024 16:49:25 +0200

samba (2:4.19.5+dfsg-4ubuntu8) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 08:22:04 +0000

samba (2:4.19.5+dfsg-4ubuntu7) noble; urgency=medium

  * Fix t64 package name in 'Enhances' attribute.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 23 Mar 2024 18:12:30 +0100

samba (2:4.19.5+dfsg-4ubuntu6) noble; urgency=high

  * No change rebuild against libkrb5-26t64-heimdal.

 -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 22 Mar 2024 18:18:35 +0100

samba (2:4.19.5+dfsg-4ubuntu5) noble; urgency=medium

  * Drop explicit, wrong, redundant dependency from samba-dsdb-modules on
    libgpgme11.

 -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Thu, 21 Mar 2024 09:47:23 +1300

samba (2:4.19.5+dfsg-4ubuntu4) noble; urgency=medium

  * No-change rebuild against libcups2t64

 -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Wed, 20 Mar 2024 13:56:46 +1300

samba (2:4.19.5+dfsg-4ubuntu3) noble; urgency=medium

  * No-change rebuild against libgpgme t64.

 -- Matthias Klose <doko@ubuntu.com>  Fri, 15 Mar 2024 16:50:16 +0100

samba (2:4.19.5+dfsg-4ubuntu2) noble; urgency=medium

  * No-change rebuild against libgnutls30t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 10 Mar 2024 02:13:07 +0000

samba (2:4.19.5+dfsg-4ubuntu1) noble; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + enable the liburing vfs module, except on i386 where liburing is
        not available
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP #2024663)
    - d/control: python3-samba has a runtime dep on python3-markdown
    - glusterfs is no longer in main, create new binary package in
      universe to ship the samba glusterfs vfs modules and manpages
      (LP #2045063):
      + d/control: new samba-vfs-modules-glusterfs package
      + d/rules: glusterfs vfs modules and manpages are now in the
        samba-vfs-modules-extra package
      + d/samba-vfs-modules-extra.install: add glusterfs vfs modules and
        manpage
    - d/t/util: handle breakage introduced by lxd-installer. If on
      Ubuntu, assume lxd comes from a snap and install it if needed
    - d/t/util: ignore cloud-init's warning exit status, which is
      happening because of LP #2048129 (also see LP #2048522)

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 04 Mar 2024 15:05:13 -0300

samba (2:4.19.5+dfsg-4) unstable; urgency=medium

  * stop shipping python3/dist-packages/samba/tests
    (Closes: #1064512, #1063149)
  * add Debian-Specific tag to debian-specific patches
  * d/genshlibs: run dh_makeshlibs on libsmbclient0
    (Closes: #1065349)

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 03 Mar 2024 15:37:16 +0300

samba (2:4.19.5+dfsg-3) unstable; urgency=medium

  * d/control: add versioned depends on dpkg-dev to avoid accidental
    build of time64_t packages on older systems
  * +lower-dns-lookup-mismatch-messages.patch (reduce log noise)
  * d/control: add libtirpc-dev and rpcsvc-proto to Build-Depends-Arch
    (Closes: #1065188)

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 01 Mar 2024 19:18:35 +0300

samba (2:4.19.5+dfsg-2ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2055414). Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + enable the liburing vfs module, except on i386 where liburing is
        not available
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP #2024663)
    - d/control: python3-samba has a runtime dep on python3-markdown
    - glusterfs is no longer in main, create new binary package in
      universe to ship the samba glusterfs vfs modules and manpages
      (LP #2045063):
      + d/control: new samba-vfs-modules-glusterfs package
      + d/rules: glusterfs vfs modules and manpages are now in the
        samba-vfs-modules-extra package
      + d/samba-vfs-modules-extra.install: add glusterfs vfs modules and
        manpage
    - d/t/util: handle breakage introduced by lxd-installer. If on
      Ubuntu, assume lxd comes from a snap and install it if needed
    - d/t/util: ignore cloud-init's warning exit status, which is
      happening because of LP #2048129 (also see LP #2048522)

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 29 Feb 2024 09:55:25 -0300

samba (2:4.19.5+dfsg-2) unstable; urgency=medium

  * rename libsmbclient => libsmbclient0 for 64-bit time_t transition
    Closes: #1064337
  * d/libsmbclient.lintian-overrides: remove, soname now = package name
  * add Breaks: of sssd packages to samba-libs
  * +passchange-error-message.patch - fix password change error message
  * +edns0.patch: enable EDNS0 support in internal UDP-only DNS client
    https://bugzilla.samba.org/show_bug.cgi?id=15536

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 28 Feb 2024 19:38:48 +0300

samba (2:4.19.5+dfsg-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libtirpc3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 29 Feb 2024 09:33:34 +0000

samba (2:4.19.5+dfsg-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2054592). Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + enable the liburing vfs module, except on i386 where liburing is
        not available
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP #2024663)
    - d/control: python3-samba has a runtime dep on python3-markdown
    - glusterfs is no longer in main, create new binary package in
      universe to ship the samba glusterfs vfs modules and manpages
      (LP #2045063):
      + d/control: new samba-vfs-modules-glusterfs package
      + d/rules: glusterfs vfs modules and manpages are now in the
        samba-vfs-modules-extra package
      + d/samba-vfs-modules-extra.install: add glusterfs vfs modules and
        manpage
    - d/t/util: handle breakage introduced by lxd-installer. If on
      Ubuntu, assume lxd comes from a snap and install it if needed
    - d/t/util: ignore cloud-init's warning exit status, which is
      happening because of LP #2048129 (also see LP #2048522)

 -- Andreas Hasenack <andreas@canonical.com>  Sun, 25 Feb 2024 14:45:54 -0300

samba (2:4.19.5+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release (4.19.5)
  * reformat previous changelog entry to fit in 80cols
  * d/winbind.postrm: stop recursively removing plain files
  * d/winbind.postrm: winbindd_cache.tdb is in /var/lib now,
    not in /var/cache
  * d/control: RulesRequiresRoot:no
  * d/*.symbols: use #PACKAGE# placeholders where appropriate
    (or add comments where it is not)
  * +silence-can-not-convert-group-sid.diff -
    make another log message less annoying
  * -python-fix-invalid-escape-sequences.patch (applied upstream)
  * d/control: replace pkg-config=>pkgconf in Build-Depends, remove
    pkg-config from Depends of libldb-dev and python3-ldb-dev
  * d/samba-libs.symbols, d/control: make libsmbldapN a virtual package
    provided by samba-libs too, like libndrN

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 19 Feb 2024 15:21:14 +0300

samba (2:4.19.4+dfsg-3ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2051717). Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + enable the liburing vfs module, except on i386 where liburing is
        not available
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP #2024663)
    - d/control: python3-samba has a runtime dep on python3-markdown
    - glusterfs is no longer in main, create new binary package in
      universe to ship the samba glusterfs vfs modules and manpages
      (LP #2045063):
      + d/control: new samba-vfs-modules-glusterfs package
      + d/rules: glusterfs vfs modules and manpages are now in the
        samba-vfs-modules-extra package
      + d/samba-vfs-modules-extra.install: add glusterfs vfs modules and
        manpage
  * Added:
    - d/t/util: handle breakage introduced by lxd-installer. If on
      Ubuntu, assume lxd comes from a snap and install it if needed
    - d/t/util: ignore cloud-init's warning exit status, which is
      happening because of LP #2048129 (also see LP #2048522)

 -- Andreas Hasenack <andreas@canonical.com>  Sat, 03 Feb 2024 10:14:42 -0300

samba (2:4.19.4+dfsg-3) unstable; urgency=medium

  * samba,winbind: remove logrotate scripts
    samba does its own log rotation (max log size (=5000 by default) and
    renaming to .old).  The two clashes with each other in an interesting way.
  * d/samba-libs.symbols, d/control: make libndrN a virtual package
    to ensure rdeps pick the right dependency

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 30 Jan 2024 12:12:42 +0300

samba (2:4.19.4+dfsg-2ubuntu2) noble; urgency=medium

  * No-change rebuild with Python 3.12 as default

 -- Graham Inggs <ginggs@ubuntu.com>  Sat, 20 Jan 2024 19:20:19 +0000

samba (2:4.19.4+dfsg-2ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2040363). Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + enable the liburing vfs module, except on i386 where liburing is
        not available
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP #2024663)
  * Dropped:
    - d/rules: ceph is not available in Ubuntu i386, disable it
      [In 2:4.19.1+dfsg-1]
    - debian/control: Ubuntu i386 binary compatibility:
      + drop ceph support
      [In 2:4.19.1+dfsg-1]
  * Added:
    - d/control: python3-samba has a runtime dep on python3-markdown
    - glusterfs is no longer in main, create new binary package in
      universe to ship the samba glusterfs vfs modules and manpages
      (LP: #2045063):
      + d/control: new samba-vfs-modules-glusterfs package
      + d/rules: glusterfs vfs modules and manpages are now in the
        samba-vfs-modules-extra package
      + d/samba-vfs-modules-extra.install: add glusterfs vfs modules and
        manpage

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 15 Jan 2024 12:21:28 -0300

samba (2:4.19.4+dfsg-2) unstable; urgency=medium

  * d/samba.smbd.service, d/samba.nmbd.service: expand forgotten @BINDIR@

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 08 Jan 2024 20:44:51 +0300

samba (2:4.19.4+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release. See WHATSNEW.txt for details.
  * d/control: drop pkg.samba.nouring build profile: was needed
    for focal which we do not support anymore
  * remove /etc/cron.daily/samba: there's no reason to keep backing it up,
    most stuff is in ldb/tdb files these days.
  * d/samba.maintscript, d/winbind.maintscript:
    remove old rm_connfiles (pre-buster versions)
  * d/rules, d/*.service: provide .service files directly instead of renaming
    and patching upstream templates, and use dh_installsystemd to install them
    (partially Closes: #1059187)
  * d/rules: run dh_movetousr for libpam-winbind & libnss-winbind, if exists.
    This fixes remaining files in /lib (hopefully). In a search for better
    way to detect where to put system libs (/lib vs /usr/lib) as a configure
    option.  Closes: #1059187

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 08 Jan 2024 19:11:37 +0300

samba (2:4.19.3+dfsg-2) unstable; urgency=medium

  * d/rules: simplify LDFLAGS assignment
  * d/rules: add -mlong-jump-table-offsets to CFLAGS on m68k (fix FTBFS there)
  * d/rules: CFLAGS += -ffile-prefix-map=../../=
  * d/control: fix versioned dependency on samba for samba-ad-dc
  * +python-fix-invalid-escape-sequences.patch from upstream (Closes: #1057668)

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 11 Dec 2023 13:19:18 +0300

samba (2:4.19.3+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release:
   - https://bugzilla.samba.org/show_bug.cgi?id=13595
     CVE-2018-14628 [SECURITY] Deleted Object tombstones visible in AD LDAP
     to normal users (Closes: #1034803).  Please see WHATSNEW.txt file for
     more information about this issue: actual fix requires extra steps to
     be performed against samba-based AD-DC
   - https://bugzilla.samba.org/show_bug.cgi?id=15093
     Files without "read attributes" NFS4 ACL permission are not listed
     in directories
   - https://bugzilla.samba.org/show_bug.cgi?id=15487
     smbd crashes if asked to return full information on close of
     a stream handle with delete on close disposition set
   - https://bugzilla.samba.org/show_bug.cgi?id=15492
     Kerberos TGS-REQ with User2User does not work for normal accounts
   - https://bugzilla.samba.org/show_bug.cgi?id=15499
     Improve logging for failover scenarios
   - https://bugzilla.samba.org/show_bug.cgi?id=15507
     vfs_gpfs stat calls fail due to file system permissions
   - https://bugzilla.samba.org/show_bug.cgi?id=15513
     Samba doesn't build with Python 3.12
   - https://bugzilla.samba.org/show_bug.cgi?id=15520
     sid_strings test broken by unix epoch > 1700000000
   - https://bugzilla.samba.org/show_bug.cgi?id=15521
     smbd: fix close order of base_fsp and stream_fsp
     in smb_fname_fsp_destructor()
  * d/samba-common.maintscript: fix version number for dhcp hook removal
    (Closes: #1053780)

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 27 Nov 2023 22:22:54 +0300

samba (2:4.19.2+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release:
   - https://bugzilla.samba.org/show_bug.cgi?id=15423
     Use-after-free in aio_del_req_from_fsp during smbd shutdown
     after failed IPC FSCTL_PIPE_TRANSCEIVE
   - https://bugzilla.samba.org/show_bug.cgi?id=15426
     clidfs.c do_connect() missing a "return" after a cli_shutdown() call
   - https://bugzilla.samba.org/show_bug.cgi?id=15463
     macOS mdfind returns only 50 results
   - https://bugzilla.samba.org/show_bug.cgi?id=15481
     GETREALFILENAME_CACHE can modify incoming new filename
     with previous cache entry value
   - https://bugzilla.samba.org/show_bug.cgi?id=15464
     libnss_winbind causes memory corruption since samba-4.18,
     impacts sendmail, zabbix, potentially more
   - https://bugzilla.samba.org/show_bug.cgi?id=15479
     ctdbd: setproctitle not initialized messages flooding logs
   - https://bugzilla.samba.org/show_bug.cgi?id=15491
     CVE-2023-5568 Heap buffer overflow with freshness tokens
     in the Heimdal KDC in Samba 4.19
   - https://bugzilla.samba.org/show_bug.cgi?id=15477
     The heimdal KDC doesn't detect s4u2self correctly when fast is in use
  * d/samba-common.maintscript: remove obsolete conffile
    /etc/dhcp/dhclient-enter-hooks.d/samba (Closes: #1053780)

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 16 Oct 2023 18:26:31 +0300

samba (2:4.19.1+dfsg-4) unstable; urgency=medium

  * d/samba-common.postinst: restore installing of smb.conf using ucf

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 10 Oct 2023 22:33:32 +0300

samba (2:4.19.1+dfsg-3) unstable; urgency=medium

  * d/ctdb.install: sync ceph arch list
  * d/control: mention other places where ceph arch list is used

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 10 Oct 2023 20:12:20 +0300

samba (2:4.19.1+dfsg-2) unstable; urgency=medium

  * d/rules: sync with-ceph arch list from d/control

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 10 Oct 2023 19:03:42 +0300

samba (2:4.19.1+dfsg-1) unstable; urgency=medium

  * new stable security bugfix release:
    o CVE-2023-3961: https://www.samba.org/samba/security/CVE-2023-3961.html
      Unsanitized pipe names allow SMB clients to connect as root
      to existing unix domain sockets on the file system.
    o CVE-2023-4091: https://www.samba.org/samba/security/CVE-2023-4091.html
      SMB client can truncate files to 0 bytes by opening files with OVERWRITE
      disposition when using the acl_xattr Samba VFS module with the smb.conf
      setting "acl_xattr:ignore system acls = yes"
    o CVE-2023-4154: https://www.samba.org/samba/security/CVE-2023-4154.html
      An RODC and a user with the GET_CHANGES right can view all attributes,
      including secrets and passwords.  Additionally, the access check fails
      open on error conditions.
    o CVE-2023-42669: https://www.samba.org/samba/security/CVE-2023-42669.html
      Calls to the rpcecho server on the AD DC can request that the server
      block for a user-defined amount of time, denying service.
    o CVE-2023-42670: https://www.samba.org/samba/security/CVE-2023-42670.html
      Samba can be made to start multiple incompatible RPC listeners,
      disrupting service on the AD DC.
  * remove debconf questions and wins dhcp hooks together with po files
    (wins is not relevant today anymore)
  * d/control: bump mit-krb5 build-dep (on mitkrb5 profile) to 1.20
  * d/control: disable ceph (libcephfs-dev, librados-dev) on 32bit
    architectures (Closes: #1053202)
  * d/control: enable rados on riscv64 once it's available there
  * d/control: samba-libs: depend on libldb of the same version since libldb
    symbols might appear during previous stable series but they don't propagate
    to next releases with previous minor version numbers.  This is ABI breakage
    but the symbols are mostly internal to samba itself
  * debian/libldb2.symbols: update
  * drop attempts to keep ldb ABI versioning

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 10 Oct 2023 18:02:05 +0300

samba (2:4.19.0+dfsg-1) unstable; urgency=medium

  * new upstream release. Some highlights:
   o changed command-line interface of smbget utility
   o improved winbindd logging
   o AD database prepared to FL 2016 standards for new domains
   o initial, partial implementation of AD FL 2012, 2012R2 and 2016
   o samba-tool support for silos, claims, sites and subnets
   o updated Heimdal import
   o other improvements and changes, see WHATSNEW.txt file for details.
  * d/patches: remove patches applied upstream, refresh patches
  * d/control: update talloc/tevent/tdb build-deps
  * d/smbclient.install: remove smbgetrc.5
  * d/patches: add ldb 2.7.1 & 2.7.2 ABI files
  * d/libldb2.symbols: add new symbols (ldb_val_as_*) and new version (2.8.0)
  * d/python3-ldb.symbols: remove unused versions, add new version
  * d/control: fix description of samba-common-bin (samba-client)
  * d/samba-common-bin.install: install samba-log-parser (for winbindd for now)
  * d/samba-libs.install: 2 new libs
  * d/samba-libs.install, d/samba-testsuite.install: move libshares-samba4.so.0
    from samba-libs to samba-testsuite
  * d/samba-libs.install, d/samba-vfs-modules.install: move
    libdfs-server-ad-samba4.so.0 from samba-libs to samba-vfs-modules
  * d/samba-libs.install, d/samba-common-bin.install: move
    libnet-keytab-samba4.so.0 from samba-libs to samba-common-bin (used by net)
  * d/samba-libs.install, d/samba-common-bin.install: move
    libRPC-WORKER-samba4.so.0 from samba-libs to samba-common-bin
    (used by usr/libexec/samba/rpcd_*)
  * samba-libs: add libndr 3.0.1 symbols
  * d/source/lintian-overrides: remove unused source-is-missing override
  * d/samba-vfs-modules.lintian-overrides: remove unused
    spelling-error-in-binary override

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 04 Sep 2023 22:57:48 +0300

samba (2:4.18.6+dfsg-1ubuntu2.2) noble; urgency=medium

  * No-change rebuild for ICU soname change.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 19 Dec 2023 18:41:25 +0100

samba (2:4.18.6+dfsg-1ubuntu2.1) mantic-security; urgency=medium

  * SECURITY UPDATE: SMB clients can truncate files with read-only
    permissions
    - debian/patches/CVE-2023-4091-*.patch
    - CVE-2023-4091
  * SECURITY UPDATE: Samba AD DC password exposure to privileged users and
    RODCs
    - debian/patches/CVE-2023-4154-*.patch
    - CVE-2023-4154
  * SECURITY UPDATE: rpcecho development server allows Denial of Service
    via sleep() call on AD DC
    - debian/patches/CVE-2023-42669-*.patch
    - CVE-2023-42669
  * SECURITY UPDATE: Samba AD DC Busy RPC multiple listener DoS
    - debian/patches/CVE-2023-42670-*.patch
    - CVE-2023-42670

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 10 Oct 2023 12:25:20 -0400

samba (2:4.18.6+dfsg-1ubuntu2) mantic; urgency=medium

  * No-change rebuild with glusterfs 10.3 (LP: #2035127)

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 13 Sep 2023 09:57:01 -0300

samba (2:4.18.6+dfsg-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2031655, LP: #2031619). Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + drop ceph support
      + enable the liburing vfs module, except on i386 where liburing is
        not available
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
  * Dropped:
    - build-depend on libglusterfs-dev only on !i386 arches
      [In 2:4.18.5+dfsg-2]
    - Add changes to fix uncaught exception when updating old password
      containing regex metacharacters by simplifying samba-tool password
      redaction (LP #2002949).
      + d/p/lib-cmdline-Return-if-the-commandline-was-redacted-i.patch
      + d/p/lib-cmdline-Also-redact-newpassword-in-samba_cmdline.patch
      + d/p/lib-cmdline-Also-burn-the-password2-parameter-if-giv.patch
      + d/p/samba-tool-Use-samba.glue.get_burnt_cmdline-rather-t.patch
      + d/p/python-Add-glue.burn_commandline-method.patch
      + d/p/python-Move-PyList_AsStringList-to-common-code-so-we.patch
      + d/p/python-Remove-const-from-PyList_AsStringList.patch
        [Fixed upstream in 4.18.6]
  * Added:
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP: #2024663)
    - d/rules: ceph is not available in Ubuntu i386, disable it

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 17 Aug 2023 09:52:00 -0300

samba (2:4.18.6+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release:
   - https://bugzilla.samba.org/show_bug.cgi?id=9959
     Windows client join fails if a second container CN=System exists somewhere
   - https://bugzilla.samba.org/show_bug.cgi?id=15289
     post-exec password redaction for samba-tool is more reliable for
     fully random passwords as it no longer uses regular expressions
     containing the password value itself
   - https://bugzilla.samba.org/show_bug.cgi?id=15342
     Spotlight sometimes returns no results on latest macOS
   - https://bugzilla.samba.org/show_bug.cgi?id=15346
     2-3min delays at reconnect with smb2_validate_sequence_number:
     bad message_id 2
   - https://bugzilla.samba.org/show_bug.cgi?id=15390
     Python tarfile extraction needs change to avoid a warning
     (CVE-2007-4559 mitigation)
   - https://bugzilla.samba.org/show_bug.cgi?id=15400
     rpcserver no longer accepts double backslash in dfs pathname
   - https://bugzilla.samba.org/show_bug.cgi?id=15414
     "net offlinejoin provision" does not work as non-root user
   - https://bugzilla.samba.org/show_bug.cgi?id=15417
     Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted
     to remove the destination
   - https://bugzilla.samba.org/show_bug.cgi?id=15420
     reply_sesssetup_and_X() can dereference uninitialized tmp pointer
   - https://bugzilla.samba.org/show_bug.cgi?id=15427
     Spotlight results return wrong date in result list
   - https://bugzilla.samba.org/show_bug.cgi?id=15430
     Missing return in reply_exit_done()
   - https://bugzilla.samba.org/show_bug.cgi?id=15433
     cm_prepare_connection() calls close(fd) for the second time
   - https://bugzilla.samba.org/show_bug.cgi?id=15435
     Regression DFS not working with widelinks = true
   - https://bugzilla.samba.org/show_bug.cgi?id=15441
     samba-tool ntacl get segfault if aio_pthread appended
   - https://bugzilla.samba.org/show_bug.cgi?id=15446
     DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed
   - https://bugzilla.samba.org/show_bug.cgi?id=15449
     mdssvc: Do an early talloc_free() in _mdssvc_open()
  * d/control: python3-testtools is only needed for selftest,
    remove from Build-Depends for now
  * d/rules: export PYTHONDONTWRITEBYTECODE=1 to stop python from generating
    .pyc caches (Closes: #1048754)

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 16 Aug 2023 20:11:26 +0300

samba (2:4.18.5+dfsg-2) unstable; urgency=medium

  * d/rules, d/control: only build glusterfs support on 64bits
    (Closes: #1041996)
  * d/rules: make ceph conditional similar to gluster
  * d/rules: wrap _PYTHON_SYSCONFIGDATA_NAME setting to cross-compile case
    On e.g. buster, _PYTHON_SYSCONFIGDATA_NAME is different, so this assignment
    does not work right.  In order for it to work on buster, add condition on
    host vs build gnu type. This breaks compilation with foreign python binary.
  * d/control: fix description of samba-common-bin (samba-client)

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 04 Aug 2023 17:29:06 +0300

samba (2:4.18.5+dfsg-1ubuntu2) mantic; urgency=medium

  * Add changes to fix uncaught exception when updating old password
    containing regex metacharacters by simplifying samba-tool password
    redaction (LP: #2002949).
    - d/p/lib-cmdline-Return-if-the-commandline-was-redacted-i.patch
    - d/p/lib-cmdline-Also-redact-newpassword-in-samba_cmdline.patch
    - d/p/lib-cmdline-Also-burn-the-password2-parameter-if-giv.patch
    - d/p/samba-tool-Use-samba.glue.get_burnt_cmdline-rather-t.patch
    - d/p/python-Add-glue.burn_commandline-method.patch
    - d/p/python-Move-PyList_AsStringList-to-common-code-so-we.patch
    - d/p/python-Remove-const-from-PyList_AsStringList.patch

 -- Michal Maloszewski <michal.maloszewski@canonical.com>  Fri, 28 Jul 2023 00:55:03 +0200

samba (2:4.18.5+dfsg-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2028265, LP: #2027716). Remaining
    changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + drop ceph support
      + enable the liburing vfs module, except on i386 where liburing is
        not available
      + build-depend on libglusterfs-dev only on !i386 arches
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
    - d/t/util: reload instead of restarting samba, as it's quicker and
      has the same effect we want in this test

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 20 Jul 2023 10:15:22 -0300

samba (2:4.18.5+dfsg-1) unstable; urgency=medium

  * new upstream stable/security release 4.18.5, including:
   o CVE-2022-2127:  When winbind is used for NTLM authentication,
     a maliciously crafted request can trigger an out-of-bounds read
     in winbind and possibly crash it.
     https://www.samba.org/samba/security/CVE-2022-2127.html
   o CVE-2023-3347:  SMB2 packet signing is not enforced if an admin
     configured "server signing = required" or for SMB2 connections to
     Domain Controllers where SMB2 packet signing is mandatory.
     https://www.samba.org/samba/security/CVE-2023-3347.html
   o CVE-2023-34966: An infinite loop bug in Samba's mdssvc RPC service
     for Spotlight can be triggered by an unauthenticated attacker by
     issuing a malformed RPC request.
     https://www.samba.org/samba/security/CVE-2023-34966.html
   o CVE-2023-34967: Missing type validation in Samba's mdssvc RPC service
     for Spotlight can be used by an unauthenticated attacker to trigger
     a process crash in a shared RPC mdssvc worker process.
     https://www.samba.org/samba/security/CVE-2023-34967.html
   o CVE-2023-34968: As part of the Spotlight protocol Samba discloses
     the server-side absolute path of shares and files and directories
     in search results.
     https://www.samba.org/samba/security/CVE-2023-34968.html
   o BUG 15418: Secure channel faulty since Windows 10/11 update 07/2023.
     https://bugzilla.samba.org/show_bug.cgi?id=15418
     (this has been patched in the previous upload; Closes: #1041043)

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 19 Jul 2023 17:55:58 +0300

samba (2:4.18.4+dfsg-2) unstable; urgency=medium

  * +fix-unsupported-netr_LogonGetCapabilities-l2.patch
    Fix windows logon/trust issues with 2023-07 windows updates:
    https://bugzilla.samba.org/show_bug.cgi?id=15418
  * d/copyright: also remove ctdb/doc/*.?.html pre-generated manpages
    from the upstream tarball (forgotten previously)
  * d/rules: add comment about -latomic gcc issue and drop --as-needed
    there since it is already in use

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 14 Jul 2023 12:30:31 +0300

samba (2:4.18.4+dfsg-1) unstable; urgency=medium

  * new upstream stable/bugfix release, including:
   - https://bugzilla.samba.org/show_bug.cgi?id=2312
     smbcacls and smbcquotas do not check // before the server
   - https://bugzilla.samba.org/show_bug.cgi?id=14030
     Named crashes on DLZ zone update (was in debian before)
   - https://bugzilla.samba.org/show_bug.cgi?id=15355
     NSS_WRAPPER_HOSTNAME doesn't match NSS_WRAPPER_HOSTS entry
     and causes test timeouts
   - https://bugzilla.samba.org/show_bug.cgi?id=15381
     Register Samba processes with GPFS
   - https://bugzilla.samba.org/show_bug.cgi?id=15382
     cli_list loops 100% CPU against pre-lanman2 servers
   - https://bugzilla.samba.org/show_bug.cgi?id=15383
     Remove comments about deprecated 'write cache size'
   - https://bugzilla.samba.org/show_bug.cgi?id=15384
     net ads lookup (with unspecified realm) fails
   - https://bugzilla.samba.org/show_bug.cgi?id=15390
     Python tarfile extraction needs change to avoid a warning
     (CVE-2007-4559 mitigation)
   - https://bugzilla.samba.org/show_bug.cgi?id=15391
     smbclient leaks fds with showacls
   - https://bugzilla.samba.org/show_bug.cgi?id=15398
     The winbind child segfaults when listing users with
     `winbind scan trusted domains = yes`
   - https://bugzilla.samba.org/show_bug.cgi?id=15402
     smbd returns NOT_FOUND when creating files on a r/o filesystem
   - https://bugzilla.samba.org/show_bug.cgi?id=15403
     smbget memory leak if failed to download files recursively
   - https://bugzilla.samba.org/show_bug.cgi?id=15404
     Backport --pidl-developer fixes
  * remove dnsserver-rename-dns_name_equal.patch (applied upstream)

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 05 Jul 2023 18:14:20 +0300

samba (2:4.18.3+dfsg-3ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2018054). Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + drop ceph support
      + enable the liburing vfs module, except on i386 where liburing is
        not available
      + build-depend on libglusterfs-dev only on !i386 arches
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
  * Added changes:
    - d/t/util: reload instead of restarting samba, as it's quicker and
      has the same effect we want in this test

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 22 Jun 2023 11:59:19 -0300

samba (2:4.18.3+dfsg-3) unstable; urgency=medium

  * d/rules: query for DEB_HOST_ARCH, not DEB_HOST_ARCH_CPU,
    for -latomic workaround

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 21 Jun 2023 23:11:59 +0300

samba (2:4.18.3+dfsg-2) unstable; urgency=medium

  * d/rules: include -latomic gcc issue workaround for select arches
    apparently due to a gcc issue, some architectures (armel, mipsel, ...)
    fail to link samba due to not finidng __atomic_load_8 etc symbols
    after using atomic_load etc from stdatomic.h (part of gcc).
    Add -latomic explicitly to the list of libraries we link with.
  * d/rules: add libwbclient0 to the list of krb5-versioned packages
   (thanks to Andrew Kornilov)

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 20 Jun 2023 11:35:13 +0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libnss-winbind`.
