debian/README.source.md

@@ -14,17 +14,22 @@ The first time:
     sudo apt install git-buildpackage pristine-tar cowbuilder
     DIST=sid ARCH=amd64 git-pbuilder create
     git clone https://salsa.debian.org/samba-team/samba.git
-    cd samba
-    git checkout pristine-tar
-    git checkout upstream_4.9
 
 Each time:
 
     cd samba
     git checkout master
-    gbp pull
+    gbp pull --track-missing
+    gbp buildpackage --git-pbuilder --git-dist=sid --git-arch=amd64
+
+Building with selftest
+======================
+
+    DEB_BUILD_PROFILES=pkg.samba.selftest \
     gbp buildpackage --git-pbuilder --git-dist=sid --git-arch=amd64
 
+:warning: DO NOT UPLOAD THE RESULTING PACKAGES! :warning:
+
 Merging minor upstream releases
 ===============================
 
@@ -32,19 +37,15 @@ Importing a new upstream version can be done like this:
 
     # set target version
     upstream_version=4.9.1
-    major_version="$(echo $upstream_version | sed 's/.[^.]\+$//')"
     # go to git repo
     cd $GIT_DIR
     # Import upstream
     git remote add upstream https://git.samba.org/samba.git
     git fetch upstream
-    # ensure required branches exists
-    git checkout "upstream_${major_version}"
-    git checkout pristine-tar
     # go to the Debian branch
     git checkout master
     # sync all required branches
-    gbp pull
+    gbp pull --track-missing
     # Import latest version
     gbp import-orig --uscan \
       -u "${upstream_version}+dfsg" \
@@ -64,6 +65,7 @@ With a new major version, more work is needed.
 
 After `gbp pull`:
 
+    major_version="$(echo $upstream_version | sed 's/.[^.]\+$//')"
     # Edit gbp.conf's upstream-branch
     editor debian/gbp.conf
     # Edit debian/watch's major version

debian/changelog

 samba (2:4.9.1+dfsg-2) UNRELEASED; urgency=medium
 
+  [ Mathieu Parent ]
   * Enable --accel-aes=intelaesni on DEB_HOST_ARCH_CPU=amd64 instead of
     DEB_HOST_ARCH=amd64. This matches samba-libs.install and adds x32
-  * Allow to change password via passwd in default config
+  * Allow one to change password via passwd in default config
     - third_party: Update pam_wrapper to version 1.0.7
     - third_party: Add pam_set_items.so from pam_wrapper
     - nsswitch: Add try_authtok option to pam_winbind
@@ -11,8 +12,15 @@ samba (2:4.9.1+dfsg-2) UNRELEASED; urgency=medium
     - debian/winbind.pam-config: Use the new try_authtok option allowing
       password change while preserving current behavior with password strength
       modules (Closes: #858923, LP: #570944)
+  * README.source: use gbp pull --track-missing
+  * Override library-not-linked-against-libc false positives (See #896012)
+  * Fix wrong-path-for-interpreter for pidl and findsmb
+  * ctdb.postrm: Fix to disable_legacy (found by piuparts) (Closes: #911530)
+
+  [ James Clarke ]
+  * Fix systemd-related build failures on non-Linux
 
- -- Mathieu Parent <sathieu@debian.org>  Tue, 09 Oct 2018 10:09:09 +0200
+ -- Mathieu Parent <sathieu@debian.org>  Mon, 29 Oct 2018 22:49:09 +0100
 
 samba (2:4.9.1+dfsg-1) experimental; urgency=medium
 

debian/control

@@ -17,6 +17,7 @@ Build-Depends: bison,
                docbook-xsl,
                flex,
                glusterfs-common [linux-any],
+               ldb-tools <pkg.samba.selftest>,
                libacl1-dev,
                libarchive-dev,
                libattr1-dev,
@@ -35,19 +36,25 @@ Build-Depends: bison,
                libldap2-dev,
                libldb-dev (>= 2:1.4.2),
                libncurses5-dev,
+               libnss-wrapper (>= 1.1.3) <pkg.samba.selftest>,
+               libpam-wrapper (>= 1.0.7) <pkg.samba.selftest>,
                libpam0g-dev,
                libparse-yapp-perl,
                libpcap-dev [hurd-i386 kfreebsd-any],
                libpopt-dev,
                libreadline-dev,
+               libresolv-wrapper (>= 1.1.4) <pkg.samba.selftest>,
+               libsocket-wrapper (>= 1.1.9) <pkg.samba.selftest>,
                libsystemd-dev [linux-any],
                libtalloc-dev (>= 2.1.14~),
                libtdb-dev (>= 1.3.16~),
                libtevent-dev (>= 0.9.37~),
+               libuid-wrapper (>= 1.2.4) <pkg.samba.selftest>,
                perl,
                pkg-config,
                po-debconf,
                python-all-dev (>= 2.6.6-3),
+               python-crypto <pkg.samba.selftest>,
                python-dnspython,
                python-ldb (>= 2:1.4.2),
                python-ldb-dev (>= 2:1.4.2),

debian/ctdb.install

+#!/usr/bin/dh-exec --with-scripts=filter-arch
 ctdb/config/ctdb.conf etc/ctdb
 ctdb/config/ctdb.tunables etc/ctdb
 ctdb/config/script.options etc/ctdb
 etc/ctdb
 etc/sudoers.d
-lib/systemd/system/ctdb.service
+[linux-any] lib/systemd/system/ctdb.service
 usr/bin/ctdb
 usr/bin/ctdb_diagnostics
 usr/bin/ltdbtool

debian/ctdb.postrm

@@ -31,7 +31,7 @@ disable_legacy() { # From ctdb/packaging/RPM/ctdb.spec.in
 
 case "$1" in
     purge)
-        disable_legacy
+        disable_legacy 0
     ;;
 
     remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)

debian/gitlab-ci.yml

+# Warning! This file is autogenerated by salsa pipeline bot. Any change made
+# over this document will be lost. Customization and changes must be made over
+# the template yaml.
+variables:
+  DEBFULLNAME: "Salsa Pipeline"
+  DEBEMAIL: "<salsa-pipeline@debian.org>"
+  DEBIAN_FRONTEND: noninteractive
+  WORKING_DIR: ./debian/output
+
+stages:
+  - build
+  - test
+
+image: debian:unstable
+
+build package:
+  stage: build
+  image: registry.salsa.debian.org/salsa-ci-team/images/gbp
+  services:
+    - docker:dind
+  artifacts:
+    expire_in: 180 day
+    name: "$CI_BUILD_NAME"
+    paths:
+        - ${WORKING_DIR}/
+  script:
+    - gbp pull --ignore-branch --pristine-tar --track-missing
+    - gbp buildpackage --git-ignore-branch --git-export-dir=${WORKING_DIR} --git-builder='docker-build.sh registry.salsa.debian.org/salsa-ci-team/images/dockerbuilder'
+
+run autopkgtest:
+  stage: test
+  image: registry.salsa.debian.org/salsa-ci-team/images/autopkgtest
+  script:
+    - eatmydata autopkgtest -U ${WORKING_DIR}/*.deb -- null
+
+run lintian:
+  stage: test
+  image: registry.salsa.debian.org/salsa-ci-team/images/lintian
+  script:
+    - lintian -iI ${WORKING_DIR}/*.changes
+
+run reprotest:
+  stage: test
+  image: registry.salsa.debian.org/salsa-ci-team/images/reprotest
+  artifacts:
+    name: "$CI_BUILD_NAME"
+    expire_in: 180 day
+    paths:
+      - ./reprotest.log
+    when: always
+  script:
+    - apt-get update
+    - eatmydata apt-get build-dep -y .
+    - export DEB_BUILD_OPTIONS=nocheck
+    - eatmydata reprotest --no-diffoscope --min-cpus $(nproc --all) . -- null &> reprotest.log
+
+run piuparts:
+  stage: test
+  image: registry.salsa.debian.org/sathieu/images/piuparts
+  services:
+    - docker:dind
+  script:
+    - CHROOT_PATH=/tmp/debian-unstable
+    - CONTAINER_ID=$(docker run --rm -d debian:unstable sleep infinity)
+    - docker exec ${CONTAINER_ID} bash -c "apt-get update && apt-get install eatmydata -y"
+    - mkdir -p ${CHROOT_PATH}
+    - docker export ${CONTAINER_ID} | tar -C ${CHROOT_PATH} -xf -
+    - mknod -m 666 ${CHROOT_PATH}/dev/urandom c 1 9
+    - mkdir -p ${CHROOT_PATH}/etc-target/apt/sources.list.d ${CHROOT_PATH}/etc-target/apt/preferences.d
+    - cp -aTv /etc/apt/sources.list.d  ${CHROOT_PATH}/etc-target/apt/sources.list.d
+    - cp -aTv /etc/apt/preferences.d  ${CHROOT_PATH}/etc-target/apt/preferences.d
+    - piuparts --scriptsdir /etc/piuparts/scripts --allow-database --warn-on-leftovers-after-purge --hard-link -e ${CHROOT_PATH} ${WORKING_DIR}/*.deb
+# End of include
+#################################### Below starts the local customization ###################################
+before_script:
+  - echo 'deb http://deb.debian.org/debian experimental main' > /etc/apt/sources.list.d/experimental.list
+  - "echo 'Package: ldb-tools libldb* python*-ldb*\nPin: release a=experimental\nPin-Priority: 500' > /etc/apt/preferences.d/experimental.pref"
+
+build selftest package:
+  stage: test
+  image: registry.salsa.debian.org/salsa-ci-team/images/gbp
+  services:
+    - docker:dind
+  artifacts:
+    expire_in: 7 day
+    name: "$CI_BUILD_NAME"
+    paths:
+        - ${WORKING_DIR}/
+  script:
+    - export DEB_BUILD_PROFILES=pkg.samba.selftest
+    - gbp pull --ignore-branch --pristine-tar --track-missing
+    - gbp buildpackage --git-ignore-branch --git-export-dir=${WORKING_DIR} --git-builder='docker-build.sh registry.salsa.debian.org/salsa-ci-team/images/dockerbuilder'

debian/gitlab-ci.yml.tpl

+include: https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
+
+# end of salsa pipeline bot parser
+before_script:
+  - echo 'deb http://deb.debian.org/debian experimental main' > /etc/apt/sources.list.d/experimental.list
+  - "echo 'Package: ldb-tools libldb* python*-ldb*\nPin: release a=experimental\nPin-Priority: 500' > /etc/apt/preferences.d/experimental.pref"
+
+build selftest package:
+  stage: test
+  image: registry.salsa.debian.org/salsa-ci-team/images/gbp
+  services:
+    - docker:dind
+  artifacts:
+    expire_in: 7 day
+    name: "$CI_BUILD_NAME"
+    paths:
+        - ${WORKING_DIR}/
+  script:
+    - export DEB_BUILD_PROFILES=pkg.samba.selftest
+    - gbp pull --ignore-branch --pristine-tar --track-missing
+    - gbp buildpackage --git-ignore-branch --git-export-dir=${WORKING_DIR} --git-builder='docker-build.sh registry.salsa.debian.org/salsa-ci-team/images/dockerbuilder'

debian/python-samba.lintian-overrides

+# False positives, see #896012
+python-samba: library-not-linked-against-libc *

debian/rules

@@ -69,6 +69,11 @@ conf_args = \
 		--with-socketpath=/var/run/ctdb/ctdbd.socket \
 		--with-logdir=/var/log/ctdb
 
+ifneq ($(filter pkg.samba.selftest,$(DEB_BUILD_PROFILES)),)
+	conf_args += \
+		--enable-selftest
+endif
+
 ifeq ($(DEB_HOST_ARCH_OS), linux)
 	conf_args += \
 		--with-systemd \
@@ -94,8 +99,19 @@ override_dh_auto_build:
 	DESTDIR="$(DESTDIR)" $(WAF)
 
 override_dh_auto_test:
-	# Running make test requires configuration with --enable-selftest, which
-	# we don't want to do for production systems.
+ifeq (,$(findstring nocheck, $(DEB_BUILD_OPTIONS)))
+ifneq ($(filter pkg.samba.selftest,$(DEB_BUILD_PROFILES)),)
+	make quicktest
+else
+	# Running make test requires "waf configure" with --enable-selftest, which
+	# requires --with-ntvfs-fileserver which we don't want on production systems
+	@echo "** tests skipped **"
+	@echo "   use DEB_BUILD_PROFILES=pkg.samba.selftest to enable"
+	@echo "   but DO NOT UPLOAD!"
+endif
+else
+	@echo "** tests disabled **"
+endif
 
 override_dh_auto_install:
 	DESTDIR="$(DESTDIR)" $(WAF) install
@@ -144,6 +160,7 @@ override_dh_auto_install:
 	rm $(DESTDIR)/usr/bin/ctdb_run_cluster_tests
 	rm -r $(DESTDIR)/usr/lib/*/ctdb/tests
 	rm -r $(DESTDIR)/usr/share/ctdb/tests
+ifeq ($(DEB_HOST_ARCH_OS), linux)
 	# Install systemd configs
 	mkdir -p $(DESTDIR)/lib/systemd/system/
 	install -m 0644 ctdb/config/ctdb.service $(DESTDIR)/lib/systemd/system/
@@ -160,8 +177,17 @@ override_dh_auto_install:
 	  $(DESTDIR)/lib/systemd/system/samba-ad-dc.service \
 	  $(DESTDIR)/lib/systemd/system/smbd.service \
 	  $(DESTDIR)/lib/systemd/system/winbind.service
+endif
+	# Harmless on systems without systemd-tmpfiles, and other consumers exist
+	# such as OpenRC's opentmpfiles
 	mkdir -p $(DESTDIR)/usr/lib/tmpfiles.d
 	echo "d /run/samba 0755 root root -" > $(DESTDIR)/usr/lib/tmpfiles.d/samba.conf
+ifneq ($(filter pkg.samba.selftest,$(DEB_BUILD_PROFILES)),)
+	# Triggers package-contains-ancient-file Lintian Reject
+	# See https://ftp-master.debian.org/#lintianrejects
+	# RIP Duke Ellington
+	touch -d 1974-05-24 $(DESTDIR)/usr/share/samba
+endif
 
 override_dh_installdocs-arch:
 	cp ctdb/config/events/README ctdb/README.eventscripts
@@ -211,6 +237,13 @@ endif
 override_dh_installpam:
 	dh_installpam --name=samba
 
+override_dh_perl:
+	dh_perl
+	# Fix Perl shbangs
+	sed -i '1s@^#!/usr/bin/env perl@#!/usr/bin/perl@' \
+	  debian/libparse-pidl-perl/usr/bin/pidl \
+	  debian/smbclient/usr/bin/findsmb
+
 override_dh_fixperms:
 	dh_fixperms
 ifneq (,$(filter samba-common, $(shell dh_listpackages)))

debian/samba-dsdb-modules.lintian-overrides

+# False positives, see #896012
+samba-dsdb-modules: library-not-linked-against-libc usr/lib/*/samba/ldb/ildap.so

debian/samba-libs.lintian-overrides

@@ -4,3 +4,5 @@
 samba-libs: package-name-doesnt-match-sonames libdcerpc-binding0 libdcerpc-samr0 libdcerpc-server0 libdcerpc0 libndr-krb5pac0 libndr-nbt0 libndr-standard0 libndr0 libnetapi0 libsamba-credentials0 libsamba-errors1 libsamba-hostconfig0 libsamba-passdb0 libsamba-policy0 libsamba-util0 libsamdb0 libsmbconf0 libsmbldap2 libtevent-util0
 # Embedded Heimdal is patched
 samba-libs: embedded-library usr/lib/*/samba/libgssapi-samba4.so.*: heimdal
+# False positives, see #896012
+samba-libs: library-not-linked-against-libc *

debian/samba-vfs-modules.lintian-overrides

+# False positives, see #896012
+samba-vfs-modules: library-not-linked-against-libc *

debian/samba.install

+#!/usr/bin/dh-exec --with-scripts=filter-arch
 etc/ufw/applications.d/samba
-lib/systemd/system/nmbd.service
-lib/systemd/system/samba-ad-dc.service
-lib/systemd/system/smbd.service
+[linux-any] lib/systemd/system/nmbd.service
+[linux-any] lib/systemd/system/samba-ad-dc.service
+[linux-any] lib/systemd/system/smbd.service
 usr/bin/mvxattr
 usr/bin/oLschema2ldif
 usr/bin/pdbedit

debian/samba.lintian-overrides

 # Standard path for [printers] section is world-writeable with sticky bit set
 samba: non-standard-dir-perm var/spool/samba/ 1777 != 0755
+# False positives, see #896012
+samba: library-not-linked-against-libc usr/lib/*/samba/service/winbindd.so

debian/winbind.install

-lib/systemd/system/winbind.service
+#!/usr/bin/dh-exec --with-scripts=filter-arch
+[linux-any] lib/systemd/system/winbind.service
 usr/bin/ntlm_auth
 usr/bin/wbinfo
 usr/lib/*/samba/idmap

debian/winbind.lintian-overrides

 winbind4 binary: no-shlibs-control-file lib/libnss_winbind.so.2
 winbind4 binary: package-name-doesnt-match-sonames libnss-winbind2
 winbind4 binary: binary-or-shlib-defines-rpath
+# False positives, see #896012
+winbind: library-not-linked-against-libc usr/lib/*/samba/idmap/rid.so