[Pkg-samba-maint] samba and ldb updates for bullseye-security

[Salvatore Bonaccorso]

Hi Michael,

On Tue, Aug 09, 2022 at 12:15:07PM +0300, Michael Tokarev wrote:
> 08.08.2022 21:20, Salvatore Bonaccorso wrote:
> ...
> 
> > So wanted to go ahead with the DSA release but did some additional
> > testing and it seems we have a problem:
> > 
> > samba-dsdb-modules for instance has Depends on
> > 
> > libldb2 (<< 2:2.2.5~), libldb2 (>> 2:2.2.4~)
> > 
> > and in fact now we cannot install:
> 
> Wow. This is what you warned about before, but which I didn't understand
> at that time. It is the place which took quite some effort to fix for real
> in a later version where libldb is built from the samba sources (4.16+).
> 
> samba build instructions use pkg-config to get version of installed libldb.
> And the patch modifies this version, but keeps source version the same.
> So the result is that samba package uses non-existing *debian* version of
> libldb in Requires: field.
> 
> samba-dsdb-modules is the package I did not test, actually.
> 
> Now this is interesting.  I can cut out the part of upstream patch which
> modifies internal version number (I'll have to patch the upstream symbols
> file at the same time), - this will keep old upstream version after patching
> and the internal version will match debian source version. Or I can patch
> the samba build instructions (d/rules) to use debian version of libldb
> package instead of pkg-config version.  Both are ugly but both will work.
> I'll see which way is better.
> 
> Overall, samba in bullseye becomes more and more ugly and hackish... :(

Thanks for investigating it! As you say, let's then go with the way it
goes better.

> BTW, after fixing this mess, should I increase the debian revision number
> (~deb11u5 => ~deb11u6) or can I keep the same u5?

I can reject the samba upload currently on security-master so you can
keep and reupload then with the ~deb11u5 version. Depending if we need
to do as well ldb as well will reject that one as well (not done yet).
Then we can go through the same upload order again as previously done.

Thank you!

Salvatore