debian/changelog

+openldap (2.4.47+dfsg-3) unstable; urgency=medium
+
+  * Restore patches to contrib Makefiles to set CFLAGS, CPPFLAGS, and LDFLAGS
+    individually in the relevant command lines instead of overriding OPT. The
+    change to use OPT caused FTBFS on some ports arches where PIE enablement
+    uses spec files, by mixing compile-time and link-time flags.
+    (Closes: #919136)
+  * Fix architecture-specific path in smbk5pwd's binary-or-shlib-defines-rpath
+    Lintian override.
+  * Skip exporting cn=config to LDIF in preinst for upgrades where nothing
+    needs to be checked in it.
+  * Update Standards-Version to 4.3.0.
+
+ -- Ryan Tandy <ryan@nardis.ca>  Sat, 02 Feb 2019 10:30:10 -0800
+
 openldap (2.4.47+dfsg-2) unstable; urgency=medium
 
   * Reintroduce slapi-dev binary package. (Closes: #711469)

debian/control

@@ -20,7 +20,7 @@ Build-Depends: debhelper (>= 10),
                po-debconf,
                unixodbc-dev <!stage1>
 Build-Conflicts: libbind-dev, bind-dev, libicu-dev, autoconf2.13
-Standards-Version: 4.2.1
+Standards-Version: 4.3.0
 Homepage: http://www.openldap.org/
 Vcs-Git: https://salsa.debian.org/openldap-team/openldap.git
 Vcs-Browser: https://salsa.debian.org/openldap-team/openldap

debian/patches/contrib-makefiles

@@ -9,6 +9,36 @@
  LTVER = 0:0:0
  
  prefix=/usr/local
+@@ -27,24 +27,24 @@
+ .SUFFIXES: .c .o .lo
+ 
+ .c.lo:
+-	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
++	$(LIBTOOL) --mode=compile $(CC) $(CFLAGS) $(CPPFLAGS) $(DEFS) $(INCS) -c $<
+ 
+ all: $(PROGRAMS)
+ 
+ pw-kerberos.la:	kerberos.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
++	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -version-info $(LTVER) \
+ 	-rpath $(moduledir) -module -o $@ $? -lkrb5
+ 
+ pw-netscape.la:	netscape.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
++	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -version-info $(LTVER) \
+ 	-rpath $(moduledir) -module -o $@ $?
+ 
+ pw-radius.la:	radius.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
++	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -version-info $(LTVER) \
+ 	-rpath $(moduledir) -module -o $@ $? -lradius
+ 
+ pw-apr1.la:	apr1.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
++	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -version-info $(LTVER) \
+ 	-rpath $(moduledir) -module -o $@ $?
+ 
+ clean:
 --- a/contrib/slapd-modules/passwd/pbkdf2/Makefile
 +++ b/contrib/slapd-modules/passwd/pbkdf2/Makefile
 @@ -12,7 +12,7 @@
@@ -20,6 +50,21 @@
  
  PROGRAMS = pw-pbkdf2.la
  LTVER = 0:0:0
+@@ -30,12 +30,12 @@
+ .SUFFIXES: .c .o .lo
+ 
+ .c.lo:
+-	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
++	$(LIBTOOL) --mode=compile $(CC) $(CFLAGS) $(CPPFLAGS) $(DEFS) $(INCS) -c $<
+ 
+ all:		$(PROGRAMS)
+ 
+ pw-pbkdf2.la: pw-pbkdf2.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
++	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -version-info $(LTVER) \
+ 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
+ 
+ clean:
 --- a/contrib/slapd-modules/smbk5pwd/Makefile
 +++ b/contrib/slapd-modules/smbk5pwd/Makefile
 @@ -19,10 +19,10 @@
@@ -46,3 +91,69 @@
  
  PROGRAMS = smbk5pwd.la
  LTVER = 0:0:0
+@@ -46,12 +47,12 @@
+ .SUFFIXES: .c .o .lo
+ 
+ .c.lo:
+-	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
++	$(LIBTOOL) --mode=compile $(CC) $(CFLAGS) $(CPPFLAGS) $(DEFS) $(INCS) -c $<
+ 
+ all: $(PROGRAMS)
+ 
+ smbk5pwd.la:	smbk5pwd.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
++	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -version-info $(LTVER) \
+ 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
+ 
+ clean:
+--- a/contrib/slapd-modules/autogroup/Makefile
++++ b/contrib/slapd-modules/autogroup/Makefile
+@@ -27,12 +27,12 @@
+ .SUFFIXES: .c .o .lo
+ 
+ .c.lo:
+-	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
++	$(LIBTOOL) --mode=compile $(CC) $(CFLAGS) $(CPPFLAGS) $(DEFS) $(INCS) -c $<
+ 
+ all: $(PROGRAMS)
+ 
+ autogroup.la: autogroup.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
++	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -version-info $(LTVER) \
+ 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
+ 
+ clean:
+--- a/contrib/slapd-modules/lastbind/Makefile
++++ b/contrib/slapd-modules/lastbind/Makefile
+@@ -37,12 +37,12 @@
+ .SUFFIXES: .c .o .lo
+ 
+ .c.lo:
+-	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
++	$(LIBTOOL) --mode=compile $(CC) $(CFLAGS) $(CPPFLAGS) $(DEFS) $(INCS) -c $<
+ 
+ all: $(PROGRAMS)
+ 
+ lastbind.la: lastbind.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
++	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -version-info $(LTVER) \
+ 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
+ 
+ clean:
+--- a/contrib/slapd-modules/passwd/sha2/Makefile
++++ b/contrib/slapd-modules/passwd/sha2/Makefile
+@@ -28,12 +28,12 @@
+ .SUFFIXES: .c .o .lo
+ 
+ .c.lo:
+-	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
++	$(LIBTOOL) --mode=compile $(CC) $(CFLAGS) $(CPPFLAGS) $(DEFS) $(INCS) -c $<
+ 
+ all:		$(PROGRAMS)
+ 
+ pw-sha2.la:	slapd-sha2.lo sha2.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
++	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -version-info $(LTVER) \
+ 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
+ 
+ clean:

debian/rules

@@ -41,7 +41,6 @@ MAKEVARS	:= STRIP=
 # We override these in make invocations rather than patch every one.
 CONTRIB_MAKEVARS := \
 	LDAP_BUILD='$(builddir)' \
-	OPT='$$(CFLAGS) $$(CPPFLAGS) $$(LDFLAGS)' \
 	prefix=/usr \
 	ldap_subdir=/ldap \
 	moduledir='$$(libdir)$$(ldap_subdir)'

debian/slapd-contrib.lintian-overrides

 # #204975
 slapd-contrib: package-has-unnecessary-activation-of-ldconfig-trigger
 # rpath set by krb5-config.heimdal; #868840
-binary-or-shlib-defines-rpath usr/lib/ldap/smbk5pwd.so.0.0.0 /usr/lib/x86_64-linux-gnu/heimdal
+binary-or-shlib-defines-rpath usr/lib/ldap/smbk5pwd.so.0.0.0 /usr/lib/*/heimdal

debian/slapd.preinst

@@ -77,6 +77,18 @@ preinst_check_config() {						# {{{
 		return 0
 	fi
 
+	if ! [ -d "$SLAPD_CONF" ]; then
+		# no checks needed for slapd.conf at this time
+		return 0
+	fi
+
+	# If slapd was previously removed and a newer version is being
+	# installed, the config must have already been dumped during
+	# remove, or we cannot proceed.
+	if [ "$MODE" = upgrade ]; then
+		dump_config
+	fi
+
 	# Locate the file exported by dump_config.
 	local dumped_ldif="$(database_dumping_destdir)/cn=config.ldif"
 	if [ ! -f "$dumped_ldif" ]; then
@@ -99,16 +111,9 @@ preinst_check_config() {						# {{{
 # available at this time, so the data should have been dumped before the
 # old slapd was removed.
 
-if [ "$MODE" = upgrade ]; then
-	dump_config
-fi
-
 if [ "$MODE" = upgrade ] || [ "$MODE" = install -a -n "$OLD_VERSION" ]; then
-	# Do not assume slapcat is available in this phase
-	if [ -d "$SLAPD_CONF" ]; then
 	preinst_check_config
 fi
-fi
 
 if [ "$MODE" = upgrade ]; then
 	dump_databases