debian/changelog

+openldap (2.4.47+dfsg-2~bpo9+1) stretch-backports; urgency=medium
+
+  * Rebuild for stretch-backports.
+  * Revert "Fix build with Heimdal 7.2.0" as stretch contains a lower version
+    of heimdal.
+
+ -- Ryan Tandy <ryan@nardis.ca>  Thu, 17 Jan 2019 19:07:11 -0800
+
+openldap (2.4.47+dfsg-2) unstable; urgency=medium
+
+  * Reintroduce slapi-dev binary package. (Closes: #711469)
+    Thanks to Florian Schlichting.
+  * Do not call gnutls_global_set_mutex(). (Closes: #803197)
+  * Use dh_auto_* to build and install contrib modules.
+    - Stop patching the clean rule in smbk5pwd's Makefile.
+  * Explicitly list overlays and man pages installed by slapd package in
+    slapd.install and slapd.manpages files.
+  * Set common variables for contrib Makefiles by make(1) command line instead
+    of patching every Makefile.
+  * Build and install more contrib plugins in a new slapd-contrib package:
+    - pw-apr1 and pw-netscape (Closes: #592362)
+    - pw-pbkdf2 (Closes: #794999)
+  * Import the slapo-pw-pbkdf2 man page from upstream git master and install
+    it with the slapd-contrib package.
+  * Add smbk5pwd to slapd-contrib and turn slapd-smbk5pwd into a transitional
+    package. Drop smbk5pwd README since it now has a man page which is a
+    better resource for users.
+    - Use Breaks to ensure that slapd is not upgraded in between removing the
+      old smbk5pwd module and installing the new one.
+  * Include the apr1-atol.pl and apr1-lota.pl helper scripts in the
+    slapd-contrib package as examples.
+  * Merge remaining contrib Makefile patches into a single contrib-makefiles
+    patch.
+
+ -- Ryan Tandy <ryan@nardis.ca>  Sat, 12 Jan 2019 11:18:03 -0800
+
 openldap (2.4.47+dfsg-1~bpo9+1) stretch-backports; urgency=medium
 
   * Rebuild for stretch-backports.

debian/control

@@ -43,15 +43,27 @@ Description: OpenLDAP server (slapd)
  (slapd). The server can be used to provide a standalone directory
  service.
 
-Package: slapd-smbk5pwd
+Package: slapd-contrib
 Architecture: any
 Build-Profiles: <!stage1>
 Depends: slapd (= ${binary:Version}), ${shlibs:Depends}, ${misc:Depends}
-Description: Keeps Samba and Kerberos passwords in sync within slapd.
- Extends the PasswordModify Extended Operation to update Kerberos keys
- and Samba password hashes for an LDAP user. The Kerberos support is
- written for Heimdal using its hdb-ldap backend. The Samba support is
- written using the Samba 3.0 LDAP schema.
+Provides: slapd-smbk5pwd
+Breaks: slapd-smbk5pwd (<< 2.4.47+dfsg-2~)
+Replaces: slapd-smbk5pwd (<< 2.4.47+dfsg-2~)
+Description: contributed plugins for OpenLDAP slapd
+ This package contains a number of slapd overlays and plugins contributed by
+ the OpenLDAP community. While distributed as part of OpenLDAP Software, they
+ are not necessarily supported by the OpenLDAP Project.
+
+Package: slapd-smbk5pwd
+Architecture: all
+Section: oldlibs
+Build-Profiles: <!stage1>
+Depends: slapd-contrib, ${misc:Depends}
+Breaks: slapd (<< 2.4.47+dfsg-2~)
+Description: transitional package for slapd-contrib
+ This is a transitional package from slapd-smbk5pwd to slapd-contrib. It can be
+ safely removed.
 
 Package: ldap-utils
 Architecture: any
@@ -101,3 +113,13 @@ Description: OpenLDAP development libraries
  This package allows development of LDAP applications using the OpenLDAP
  libraries. It includes headers, libraries and links to allow static and
  dynamic linking.
+
+Package: slapi-dev
+Section: libdevel
+Architecture: any
+Build-Profiles: <!stage1>
+Depends: slapd (= ${binary:Version}), ${misc:Depends}
+Description: development libraries for OpenLDAP SLAPI plugin interface
+ This package allows development of plugins for the OpenLDAP slapd server
+ using the SLAPI interface.  It includes the headers and libraries needed
+ to build such plugins.

debian/patches/autogroup-makefile

---- a/contrib/slapd-modules/autogroup/Makefile
-+++ b/contrib/slapd-modules/autogroup/Makefile
-@@ -2,11 +2,11 @@
- 
- LDAP_SRC = ../../..
- LDAP_BUILD = $(LDAP_SRC)
--LDAP_INC = -I$(LDAP_BUILD)/include -I$(LDAP_SRC)/include -I$(LDAP_SRC)/servers/slapd
--LDAP_LIB = $(LDAP_BUILD)/libraries/libldap_r/libldap_r.la \
--	$(LDAP_BUILD)/libraries/liblber/liblber.la
-+LDAP_INC = -I$(LDAP_BUILD)/debian/build/include -I$(LDAP_BUILD)/include -I$(LDAP_SRC)/include -I$(LDAP_SRC)/servers/slapd
-+LDAP_LIB = $(LDAP_BUILD)/debian/build/libraries/libldap_r/libldap_r.la \
-+	$(LDAP_BUILD)/debian/build/libraries/liblber/liblber.la
- 
--LIBTOOL = $(LDAP_BUILD)/libtool
-+LIBTOOL = $(LDAP_BUILD)/debian/build/libtool
- CC = gcc
- OPT = -g -O2 -Wall
- DEFS = 
-@@ -16,13 +16,13 @@ LIBS = $(LDAP_LIB)
- PROGRAMS = autogroup.la
- LTVER = 0:0:0
- 
--prefix=/usr/local
-+prefix=/usr
- exec_prefix=$(prefix)
--ldap_subdir=/openldap
-+ldap_subdir=/ldap
- 
- libdir=$(exec_prefix)/lib
- libexecdir=$(exec_prefix)/libexec
--moduledir = $(libexecdir)$(ldap_subdir)
-+moduledir = $(libdir)$(ldap_subdir)
- 
- .SUFFIXES: .c .o .lo
- 

debian/patches/smbk5pwd-makefile → debian/patches/contrib-makefiles

+--- a/contrib/slapd-modules/passwd/Makefile
++++ b/contrib/slapd-modules/passwd/Makefile
+@@ -13,7 +13,7 @@
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+ 
+-PROGRAMS = pw-kerberos.la pw-netscape.la pw-radius.la pw-apr1.la
++PROGRAMS = pw-netscape.la pw-apr1.la
+ LTVER = 0:0:0
+ 
+ prefix=/usr/local
+--- a/contrib/slapd-modules/passwd/pbkdf2/Makefile
++++ b/contrib/slapd-modules/passwd/pbkdf2/Makefile
+@@ -12,7 +12,7 @@
+ #DEFS = -DSLAPD_PBKDF2_DEBUG
+ 
+ INCS = $(LDAP_INC)
+-LIBS = $(LDAP_LIB) -lcrypto
++LIBS = $(LDAP_LIB) -lnettle
+ 
+ PROGRAMS = pw-pbkdf2.la
+ LTVER = 0:0:0
 --- a/contrib/slapd-modules/smbk5pwd/Makefile
 +++ b/contrib/slapd-modules/smbk5pwd/Makefile
-@@ -14,34 +14,35 @@
- 
- LDAP_SRC = ../../..
- LDAP_BUILD = $(LDAP_SRC)
--LDAP_INC = -I$(LDAP_BUILD)/include -I$(LDAP_SRC)/include -I$(LDAP_SRC)/servers/slapd
--LDAP_LIB = $(LDAP_BUILD)/libraries/libldap_r/libldap_r.la \
--	$(LDAP_BUILD)/libraries/liblber/liblber.la
-+LDAP_INC = -I$(LDAP_BUILD)/debian/build/include -I$(LDAP_BUILD)/debian/build/servers/slapd -I$(LDAP_BUILD)/include -I$(LDAP_SRC)/include -I$(LDAP_SRC)/servers/slapd
-+LDAP_LIB = $(LDAP_BUILD)/debian/build/libraries/libldap_r/libldap_r.la \
-+	$(LDAP_BUILD)/debian/build/libraries/liblber/liblber.la
+@@ -19,10 +19,10 @@
+ 	$(LDAP_BUILD)/libraries/liblber/liblber.la
  
  SSL_INC = 
 -SSL_LIB = -lcrypto
@@ -20,10 +34,9 @@
 +HEIMDAL_INC = $(shell krb5-config.heimdal --cflags kadm-server)
 +HEIMDAL_LIB = $(shell krb5-config.heimdal --libs kadm-server)
  
--LIBTOOL = $(LDAP_BUILD)/libtool
-+LIBTOOL = $(LDAP_BUILD)/debian/build/libtool
+ LIBTOOL = $(LDAP_BUILD)/libtool
  CC = gcc
- OPT = -g -O2 -Wall
+@@ -30,7 +30,8 @@
  # Omit DO_KRB5, DO_SAMBA or DO_SHADOW if you don't want to support it.
  DEFS = -DDO_KRB5 -DDO_SAMBA -DDO_SHADOW
  INCS = $(LDAP_INC) $(HEIMDAL_INC) $(SSL_INC)
@@ -33,26 +46,3 @@
  
  PROGRAMS = smbk5pwd.la
  LTVER = 0:0:0
- 
--prefix=/usr/local
-+prefix=/usr
- exec_prefix=$(prefix)
--ldap_subdir=/openldap
-+ldap_subdir=/ldap
- 
- libdir=$(exec_prefix)/lib
- libexecdir=$(exec_prefix)/libexec
--moduledir = $(libexecdir)$(ldap_subdir)
-+moduledir = $(libdir)$(ldap_subdir)
- 
- .SUFFIXES: .c .o .lo
- 
-@@ -55,7 +56,7 @@
- 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
- 
- clean:
--	rm -rf *.o *.lo *.la .libs
-+	$(LIBTOOL) --mode=clean rm -f
- 
- install: $(PROGRAMS)
- 	mkdir -p $(DESTDIR)$(moduledir)

debian/patches/contrib-modules-use-dpkg-buildflags

-Description: pass CFLAGS to contrib builds
- $(CFLAGS) is missing from the compiler invocations for autogroup and
- smbk5pwd, which means they're not being hardened.
-Author: Simon Ruderich <simon@ruderich.org>
-Bug-Debian: http://bugs.debian.org/663724
-
---- a/contrib/slapd-modules/autogroup/Makefile
-+++ b/contrib/slapd-modules/autogroup/Makefile
-@@ -27,12 +27,12 @@ moduledir = $(libexecdir)$(ldap_subdir)
- .SUFFIXES: .c .o .lo
- 
- .c.lo:
--	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
-+	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(CFLAGS) $(CPPFLAGS) $(DEFS) $(INCS) -c $<
- 
- all: $(PROGRAMS)
- 
- autogroup.la: autogroup.lo
--	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
-+	$(LIBTOOL) --mode=link $(CC) $(OPT) $(LDFLAGS) -version-info $(LTVER) \
- 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
- 
- clean:
---- a/contrib/slapd-modules/smbk5pwd/Makefile
-+++ b/contrib/slapd-modules/smbk5pwd/Makefile
-@@ -46,12 +46,12 @@ moduledir = $(libexecdir)$(ldap_subdir)
- .SUFFIXES: .c .o .lo
- 
- .c.lo:
--	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
-+	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(CFLAGS) $(CPPFLAGS) $(DEFS) $(INCS) -c $<
- 
- all: $(PROGRAMS)
- 
- smbk5pwd.la:	smbk5pwd.lo
--	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
-+	$(LIBTOOL) --mode=link $(CC) $(OPT) $(LDFLAGS) -version-info $(LTVER) \
- 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
- 
- clean:
---- a/contrib/slapd-modules/lastbind/Makefile
-+++ b/contrib/slapd-modules/lastbind/Makefile
-@@ -37,12 +37,12 @@
- .SUFFIXES: .c .o .lo
- 
- .c.lo:
--	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
-+	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(CFLAGS) $(CPPFLAGS) $(DEFS) $(INCS) -c $<
- 
- all: $(PROGRAMS)
- 
- lastbind.la: lastbind.lo
--	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
-+	$(LIBTOOL) --mode=link $(CC) $(OPT) $(LDFLAGS) -version-info $(LTVER) \
- 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
- 
- clean:
---- a/contrib/slapd-modules/passwd/sha2/Makefile
-+++ b/contrib/slapd-modules/passwd/sha2/Makefile
-@@ -28,12 +28,12 @@
- .SUFFIXES: .c .o .lo
- 
- .c.lo:
--	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
-+	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(CFLAGS) $(CPPFLAGS) $(DEFS) $(INCS) -c $<
- 
- all:		$(PROGRAMS)
- 
- pw-sha2.la:	slapd-sha2.lo sha2.lo
--	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
-+	$(LIBTOOL) --mode=link $(CC) $(OPT) $(LDFLAGS) -version-info $(LTVER) \
- 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
- 
- clean:

debian/patches/lastbind-makefile

---- a/contrib/slapd-modules/lastbind/Makefile
-+++ b/contrib/slapd-modules/lastbind/Makefile
-@@ -12,11 +12,11 @@
- 
- LDAP_SRC = ../../..
- LDAP_BUILD = $(LDAP_SRC)
--LDAP_INC = -I$(LDAP_BUILD)/include -I$(LDAP_SRC)/include -I$(LDAP_SRC)/servers/slapd
--LDAP_LIB = $(LDAP_BUILD)/libraries/libldap_r/libldap_r.la \
--	$(LDAP_BUILD)/libraries/liblber/liblber.la
-+LDAP_INC = -I$(LDAP_BUILD)/debian/build/include -I$(LDAP_BUILD)/include -I$(LDAP_SRC)/include -I$(LDAP_SRC)/servers/slapd
-+LDAP_LIB = $(LDAP_BUILD)/debian/build/libraries/libldap_r/libldap_r.la \
-+	$(LDAP_BUILD)/debian/build/libraries/liblber/liblber.la
- 
--LIBTOOL = $(LDAP_BUILD)/libtool
-+LIBTOOL = $(LDAP_BUILD)/debian/build/libtool
- CC = gcc
- OPT = -g -O2 -Wall
- DEFS = -DSLAPD_OVER_LASTBIND=SLAPD_MOD_DYNAMIC
-@@ -26,13 +26,13 @@
- PROGRAMS = lastbind.la
- LTVER = 0:0:0
- 
--prefix=/usr/local
-+prefix=/usr
- exec_prefix=$(prefix)
--ldap_subdir=/openldap
-+ldap_subdir=/ldap
- 
- libdir=$(exec_prefix)/lib
- libexecdir=$(exec_prefix)/libexec
--moduledir = $(libexecdir)$(ldap_subdir)
-+moduledir = $(libdir)$(ldap_subdir)
- 
- .SUFFIXES: .c .o .lo
- 

debian/patches/lastbind-makefile-manpage

 --- a/contrib/slapd-modules/lastbind/Makefile
 +++ b/contrib/slapd-modules/lastbind/Makefile
 @@ -17,6 +17,7 @@
- 	$(LDAP_BUILD)/debian/build/libraries/liblber/liblber.la
+ 	$(LDAP_BUILD)/libraries/liblber/liblber.la
  
- LIBTOOL = $(LDAP_BUILD)/debian/build/libtool
+ LIBTOOL = $(LDAP_BUILD)/libtool
 +INSTALL = /usr/bin/install
  CC = gcc
  OPT = -g -O2 -Wall
@@ -14,12 +14,12 @@
  LTVER = 0:0:0
 +MANPAGES = slapo-lastbind.5
  
- prefix=/usr
+ prefix=/usr/local
  exec_prefix=$(prefix)
 @@ -33,6 +35,8 @@
  libdir=$(exec_prefix)/lib
  libexecdir=$(exec_prefix)/libexec
- moduledir = $(libdir)$(ldap_subdir)
+ moduledir = $(libexecdir)$(ldap_subdir)
 +mandir = $(exec_prefix)/share/man
 +man5dir = $(mandir)/man5
  

debian/patches/no-gnutls_global_set_mutex

+Description: Do not call gnutls_global_set_mutex()
+ Since GnuTLS moved to implicit initialization on library load, calling 
+ this function deinitializes GnuTLS and then re-initializes it.
+ .
+ When GnuTLS uses /dev/urandom as an entropy source (getrandom() not 
+ available, or older versions of GnuTLS), and the application closed all 
+ file descriptors at startup, this could result in GnuTLS opening 
+ /dev/urandom over one of the application's file descriptors when 
+ re-initialized.
+ .
+ Additionally, the custom mutex functions are never reset, so if libldap 
+ is unloaded (for example via dlclose()) after calling this, its code 
+ may be unmapped and the application could crash when GnuTLS calls the 
+ mutex functions.
+ .
+ The default behaviour of GnuTLS, using pthreads, should be suitable on 
+ all Debian systems, and is probably the same as what libldap uses 
+ anyway.
+Author: Ryan Tandy <ryan@nardis.ca>
+Bug-Debian: https://bugs.debian.org/803197
+Forwarded: no
+
+--- a/libraries/libldap/tls_g.c
++++ b/libraries/libldap/tls_g.c
+@@ -67,51 +67,10 @@
+ 
+ #ifdef LDAP_R_COMPILE
+ 
+-static int
+-tlsg_mutex_init( void **priv )
+-{
+-	int err = 0;
+-	ldap_pvt_thread_mutex_t *lock = LDAP_MALLOC( sizeof( ldap_pvt_thread_mutex_t ));
+-
+-	if ( !lock )
+-		err = ENOMEM;
+-	if ( !err ) {
+-		err = ldap_pvt_thread_mutex_init( lock );
+-		if ( err )
+-			LDAP_FREE( lock );
+-		else
+-			*priv = lock;
+-	}
+-	return err;
+-}
+-
+-static int
+-tlsg_mutex_destroy( void **lock )
+-{
+-	int err = ldap_pvt_thread_mutex_destroy( *lock );
+-	LDAP_FREE( *lock );
+-	return err;
+-}
+-
+-static int
+-tlsg_mutex_lock( void **lock )
+-{
+-	return ldap_pvt_thread_mutex_lock( *lock );
+-}
+-
+-static int
+-tlsg_mutex_unlock( void **lock )
+-{
+-	return ldap_pvt_thread_mutex_unlock( *lock );
+-}
+-
+ static void
+ tlsg_thr_init( void )
+ {
+-	gnutls_global_set_mutex (tlsg_mutex_init,
+-		tlsg_mutex_destroy,
+-		tlsg_mutex_lock,
+-		tlsg_mutex_unlock);
++	/* do nothing */
+ }
+ #endif /* LDAP_R_COMPILE */
+ 

debian/patches/pw-sha2-makefile

---- a/contrib/slapd-modules/passwd/sha2/Makefile
-+++ b/contrib/slapd-modules/passwd/sha2/Makefile
-@@ -2,11 +2,11 @@
- 
- LDAP_SRC = ../../../..
- LDAP_BUILD = $(LDAP_SRC)
--LDAP_INC = -I$(LDAP_BUILD)/include -I$(LDAP_SRC)/include -I$(LDAP_SRC)/servers/slapd
--LDAP_LIB = $(LDAP_BUILD)/libraries/libldap_r/libldap_r.la \
--	$(LDAP_BUILD)/libraries/liblber/liblber.la
-+LDAP_INC = -I$(LDAP_BUILD)/debian/build/include -I$(LDAP_BUILD)/include -I$(LDAP_SRC)/include -I$(LDAP_SRC)/servers/slapd
-+LDAP_LIB = $(LDAP_BUILD)/debian/build/libraries/libldap_r/libldap_r.la \
-+	$(LDAP_BUILD)/debian/build/libraries/liblber/liblber.la
- 
--LIBTOOL = $(LDAP_BUILD)/libtool
-+LIBTOOL = $(LDAP_BUILD)/debian/build/libtool
- CC = gcc
- OPT = -g -O2 -Wall
- DEFS = 
-@@ -17,13 +17,13 @@
- PROGRAMS = pw-sha2.la
- LTVER = 0:0:0
- 
--prefix=/usr/local
-+prefix=/usr
- exec_prefix=$(prefix)
--ldap_subdir=/openldap
-+ldap_subdir=/ldap
- 
- libdir=$(exec_prefix)/lib
- libexecdir=$(exec_prefix)/libexec
--moduledir = $(libexecdir)$(ldap_subdir)
-+moduledir = $(libdir)$(ldap_subdir)
- 
- .SUFFIXES: .c .o .lo
- 

debian/patches/series

@@ -8,13 +8,9 @@ sasl-default-path
 libldap-symbol-versions
 getaddrinfo-is-threadsafe
 do-not-second-guess-sonames
-contrib-modules-use-dpkg-buildflags
-smbk5pwd-makefile
+contrib-makefiles
 smbk5pwd-makefile-manpage
-autogroup-makefile
-lastbind-makefile
 lastbind-makefile-manpage
-pw-sha2-makefile
 ldap-conf-tls-cacertdir
 add-tlscacert-option-to-ldap-conf
 fix-build-top-mk
@@ -24,3 +20,4 @@ no-bdb-ABI-second-guessing
 heimdal-fix
 ITS6035-olcauthzregex-needs-restart.patch
 set-maintainer-name
+no-gnutls_global_set_mutex

debian/patches/smbk5pwd-makefile-manpage

@@ -20,7 +20,7 @@ index 676d914..0042a49 100644
 @@ -25,6 +25,7 @@
  HEIMDAL_LIB = $(shell krb5-config.heimdal --libs kadm-server)
  
- LIBTOOL = $(LDAP_BUILD)/debian/build/libtool
+ LIBTOOL = $(LDAP_BUILD)/libtool
 +INSTALL = /usr/bin/install
  CC = gcc
  OPT = -g -O2 -Wall
@@ -32,11 +32,11 @@ index 676d914..0042a49 100644
 +MANPAGES = slapo-smbk5pwd.5
  LTVER = 0:0:0
  
- prefix=/usr
+ prefix=/usr/local
 @@ -43,6 +45,8 @@
  libdir=$(exec_prefix)/lib
  libexecdir=$(exec_prefix)/libexec
- moduledir = $(libdir)$(ldap_subdir)
+ moduledir = $(libexecdir)$(ldap_subdir)
 +mandir = $(exec_prefix)/share/man
 +man5dir = $(mandir)/man5
  
@@ -44,7 +44,7 @@ index 676d914..0042a49 100644
  
 @@ -58,9 +62,17 @@
  clean:
- 	$(LIBTOOL) --mode=clean rm -f
+ 	rm -rf *.o *.lo *.la .libs
  
 -install: $(PROGRAMS)
 +install: install-lib install-man FORCE

debian/rules

@@ -23,6 +23,8 @@ ifneq ($(filter stage1,$(DEB_BUILD_PROFILES)),)
 	CONFIG += --disable-slapd
 endif
 
+CONTRIB_MODULES = autogroup lastbind passwd passwd/pbkdf2 passwd/sha2 smbk5pwd
+
 # Ensure CC is set correctly for cross builds, unless it has already 
 # been set explicitly.
 ifeq ($(origin CC),default)
@@ -35,6 +37,15 @@ slapddir	:= $(CURDIR)/debian/slapd/usr/sbin
 
 MAKEVARS	:= STRIP=
 
+# Standard variables used in contrib Makefiles.
+# We override these in make invocations rather than patch every one.
+CONTRIB_MAKEVARS := \
+	LDAP_BUILD='$(builddir)' \
+	OPT='$$(CFLAGS) $$(CPPFLAGS) $$(LDFLAGS)' \
+	prefix=/usr \
+	ldap_subdir=/ldap \
+	moduledir='$$(libdir)$$(ldap_subdir)'
+
 # These variables are used only by get-orig-source, which will normally only
 # be run by maintainers.
 VERSION = $(shell dpkg-parsechangelog |grep Version| sed 's/.*: //;s/\+dfsg//;s/-.*//')
@@ -103,10 +114,9 @@ override_dh_auto_configure:
 override_dh_auto_build:
 	dh_auto_build -- $(MAKEVARS)
 ifeq ($(filter stage1,$(DEB_BUILD_PROFILES)),)
-	$(MAKE) -C contrib/slapd-modules/smbk5pwd CC=$(CC)
-	$(MAKE) -C contrib/slapd-modules/autogroup CC=$(CC)
-	$(MAKE) -C contrib/slapd-modules/lastbind CC=$(CC)
-	$(MAKE) -C contrib/slapd-modules/passwd/sha2 CC=$(CC)
+	for mod in $(CONTRIB_MODULES); do \
+		dh_auto_build -Dcontrib/slapd-modules/$$mod -Bcontrib/slapd-modules/$$mod -- $(CONTRIB_MAKEVARS) || exit $$?; \
+	done
 endif
 
 override_dh_auto_test:
@@ -119,10 +129,9 @@ endif
 override_dh_auto_install:
 	dh_auto_install -- $(MAKEVARS)
 ifeq ($(filter stage1,$(DEB_BUILD_PROFILES)),)
-	$(MAKE) -C contrib/slapd-modules/smbk5pwd install DESTDIR=$(installdir)
-	$(MAKE) -C contrib/slapd-modules/autogroup install DESTDIR=$(installdir)
-	$(MAKE) -C contrib/slapd-modules/lastbind install DESTDIR=$(installdir)
-	$(MAKE) -C contrib/slapd-modules/passwd/sha2 install DESTDIR=$(installdir)
+	for mod in $(CONTRIB_MODULES); do \
+		dh_auto_install -Dcontrib/slapd-modules/$$mod -Bcontrib/slapd-modules/$$mod -- $(CONTRIB_MAKEVARS) || exit $$?; \
+	done
 
 	# Empty the dependency_libs file in the .la files.
 	for F in $(installdir)/usr/lib/ldap/*.la; do \
@@ -149,12 +158,6 @@ endif
 	find $(installdir)/usr/share/man -name \*.8 \
 		| xargs perl -pi -e 's#(\.TH \w+ 8)C#$$1#'
 
-ifeq ($(filter stage1,$(DEB_BUILD_PROFILES)),)
-override_dh_install-arch:
-	dh_install
-	rm -rf $(CURDIR)/debian/slapd/usr/lib/ldap/smbk5pwd*
-endif
-
 override_dh_installinit:
 	dh_installinit -- "defaults 19 80"
 
@@ -218,22 +221,7 @@ ifeq ($(filter stage1,$(DEB_BUILD_PROFILES)),)
 	fi
 
 	# Clean the contrib directory
-	rm -rf contrib/slapd-modules/smbk5pwd/.libs \
-		contrib/slapd-modules/smbk5pwd/smbk5pwd.lo \
-		contrib/slapd-modules/smbk5pwd/smbk5pwd.la \
-		contrib/slapd-modules/smbk5pwd/smbk5pwd.o
-	rm -rf contrib/slapd-modules/autogroup/.libs \
-		contrib/slapd-modules/autogroup/autogroup.lo \
-		contrib/slapd-modules/autogroup/autogroup.la \
-		contrib/slapd-modules/autogroup/autogroup.o
-	rm -rf contrib/slapd-modules/lastbind/.libs \
-		contrib/slapd-modules/lastbind/lastbind.lo \
-		contrib/slapd-modules/lastbind/lastbind.la \
-		contrib/slapd-modules/lastbind/lastbind.o
-	rm -rf contrib/slapd-modules/passwd/sha2/.libs \
-		contrib/slapd-modules/passwd/sha2/pw-sha2.la \
-		contrib/slapd-modules/passwd/sha2/sha2.lo \
-		contrib/slapd-modules/passwd/sha2/sha2.o \
-		contrib/slapd-modules/passwd/sha2/slapd-sha2.lo \
-		contrib/slapd-modules/passwd/sha2/slapd-sha2.o
+	for mod in $(CONTRIB_MODULES); do \
+		dh_auto_clean -Dcontrib/slapd-modules/$$mod -Bcontrib/slapd-modules/$$mod || exit $?; \
+	done
 endif

debian/slapd-contrib.examples

+contrib/slapd-modules/passwd/apr1-atol.pl
+contrib/slapd-modules/passwd/apr1-ltoa.pl

debian/slapd-contrib.install

+usr/lib/ldap/pw-apr1.so*
+usr/lib/ldap/pw-apr1.la
+usr/lib/ldap/pw-netscape.so*
+usr/lib/ldap/pw-netscape.la
+usr/lib/ldap/pw-pbkdf2.so*
+usr/lib/ldap/pw-pbkdf2.la
+usr/lib/ldap/smbk5pwd.so*
+usr/lib/ldap/smbk5pwd.la

debian/slapd-smbk5pwd.lintian-overrides → debian/slapd-contrib.lintian-overrides

 # #204975
-slapd-smbk5pwd: package-has-unnecessary-activation-of-ldconfig-trigger
+slapd-contrib: package-has-unnecessary-activation-of-ldconfig-trigger
 # rpath set by krb5-config.heimdal; #868840
 binary-or-shlib-defines-rpath usr/lib/ldap/smbk5pwd.so.0.0.0 /usr/lib/x86_64-linux-gnu/heimdal

debian/slapd-smbk5pwd.manpages → debian/slapd-contrib.manpages

+debian/slapo-pw-pbkdf2.5
 debian/tmp/usr/share/man/man5/slapo-smbk5pwd.5

debian/slapd-smbk5pwd.dirs

-usr/lib/ldap

debian/slapd-smbk5pwd.docs

-contrib/slapd-modules/smbk5pwd/README

debian/slapd-smbk5pwd.install

-usr/lib/ldap/smbk5pwd.so*
-usr/lib/ldap/smbk5pwd.la

debian/slapd.install

 etc/ldap/schema
 usr/lib/slapd usr/sbin
-usr/lib/ldap/*.so*
-usr/lib/ldap/*.la
 usr/lib/*/libslapi-*.so.*
 debian/ldiftopasswd usr/share/slapd
 debian/DB_CONFIG usr/share/slapd
 debian/slapd.conf usr/share/slapd
 debian/slapd.init.ldif usr/share/slapd
+
+usr/lib/ldap/back_*.so*
+usr/lib/ldap/back_*.la
+
+usr/lib/ldap/accesslog*.so*
+usr/lib/ldap/accesslog.la
+usr/lib/ldap/auditlog*.so*
+usr/lib/ldap/auditlog.la
+usr/lib/ldap/constraint*.so*
+usr/lib/ldap/constraint.la
+usr/lib/ldap/dds*.so*
+usr/lib/ldap/dds.la
+usr/lib/ldap/deref*.so*
+usr/lib/ldap/deref.la
+usr/lib/ldap/dyngroup*.so*
+usr/lib/ldap/dyngroup.la
+usr/lib/ldap/dynlist*.so*
+usr/lib/ldap/dynlist.la
+usr/lib/ldap/memberof*.so*
+usr/lib/ldap/memberof.la
+usr/lib/ldap/pcache*.so*
+usr/lib/ldap/pcache.la
+usr/lib/ldap/collect*.so*
+usr/lib/ldap/collect.la
+usr/lib/ldap/ppolicy*.so*
+usr/lib/ldap/ppolicy.la
+usr/lib/ldap/refint*.so*
+usr/lib/ldap/refint.la
+usr/lib/ldap/retcode*.so*
+usr/lib/ldap/retcode.la
+usr/lib/ldap/rwm*.so*
+usr/lib/ldap/rwm.la
+usr/lib/ldap/seqmod*.so*
+usr/lib/ldap/seqmod.la
+usr/lib/ldap/sssvlv*.so*
+usr/lib/ldap/sssvlv.la
+usr/lib/ldap/syncprov*.so*
+usr/lib/ldap/syncprov.la
+usr/lib/ldap/translucent*.so*
+usr/lib/ldap/translucent.la
+usr/lib/ldap/unique*.so*
+usr/lib/ldap/unique.la
+usr/lib/ldap/valsort*.so*
+usr/lib/ldap/valsort.la
+
+# contrib modules installed in main package
+usr/lib/ldap/autogroup.so*
+usr/lib/ldap/autogroup.la
+usr/lib/ldap/lastbind.so*
+usr/lib/ldap/lastbind.la
+usr/lib/ldap/pw-sha2.so*
+usr/lib/ldap/pw-sha2.la