- Update to security release of Samba 4.21
- Security fixes (Fixes: CVE-2025-9640, CVE-2025-10230):
  + CVE-2025-9640:  Uninitialized memory disclosure via vfs_streams_xattr.
                    https://www.samba.org/samba/security/CVE-2025-9640.html
  + CVE-2025-10230: Command injection via WINS server hook script.
                    https://www.samba.org/samba/security/CVE-2025-10230.html

- Prepare licenses for new product releases.
- Fix typos in licenses (thx Alexey Ossotoff):
  + ALT_Domain_License
  + ALT_Product_License
  + ALT_Regular_License
  + ALT_Container_OS_License
  + ALT_Orchestra_License english
  + ALT_SP_License
  + ALT_Server_License
  + ALT_Product_License english
  + ALT_SP_Container_License
  + ALT_Container_License
- Add open license (thx Alexey Ossotoff):
  + ALT_Community_License
  + ALT_Orchestra_License
  + ALT_Simply_License
  + ALT_Product_License

- Initial APT PKI for external GnuPG keys.

- Automatically updated to 0.21.

- New version for samba-4.20

- Update to latest stable bugfix and security release
  (upstream fix of CVE-2025-32462, CVE-2025-32463 applied in 1.9.16p2-alt3):
 + Fixed a crash in sudo which could occur if there was a fatal error after the
   user was validated but before the command was actually run.
 + Fixed a problem with the pwfeedback option where an initial backspace would
   reduce the maximum length allowed for the password (GitHub#439).
 + Fixed a bug where a user could avoid entering a password for sudo -l command
   if they specified their own user or group name via the -u or -g options.
 + Avoid potential password guessing based on timing attacks on the strcmp()
   function on systems without PAM or a crypt() function where plaintext
   passwords are stored in the shadow password file.
 + Fixed a potential information leak where sudo -l command could be used to
   determine whether an executable exists in a directory that they do not have
   search access to.
 + Fixed a problem running sudo from a serial console on Linux when the command
   is run in a pseudo-terminal (the default).
 + Fixed a bug where the ALL command in a sudoers rule would override a previous
   NOSETENV tag. Command tags are inherited from previous Cmnds in a
   Cmnd_Spec_List. There is a special case for the SETENV tag with the ALL
   command, where SETENV is implied if no explicit SETENV or NOSETENV tag is
   specified. This special case did not take into account that a NOSETENV tag
   that was inherited should override this behavior.
- Fixes in behavior:
 + The ignore_dot sudoers setting is now on by default.
 + If sudo is run via ssh without a terminal and a password is required, it now
   suggest using ssh's -t option.
 + Sudo uses TCSAFLUSH, not TCSADRAIN, when disabling echo once again. A long
   time ago sudo changed from using TCSAFLUSH to TCSADRAIN due to some systems
   having bugs related to TCSAFLUSH. That should no longer be a concern. Using
   TCSAFLUSH ensures that password input that has been received by the kernel,
   but not yet read by sudo, will be discarded and not echoed.
 + Added the SUDO_TTY environment variable if the user has a terminal. This can
   be used to find the user's original tty device when sudo runs the command in
   its own pseudo-terminal (GitHub#447).

- Update to release for samba-4.21.0 (after rc2).

- Update to latest release for samba-4.20

- NMU: fixed FTBFS

- spec: exclude warnings SC2329 as error

- Updated to new version 1.3.2 (released 2025-07-24)
- Fixes from upstream:
  + Fixed binding the getresgid glibc symbol

- Updates to new version 1.5.0 (released 2025-05-06)
- Fixes from upstream:
  + Added support for quic_ko_wrapper
  + Fixed pcap frames generation for recv(m)msg and recvfrom
  + Fixed setsockopt(SO_REUSEPORT) with glibc 2.40 (from version 1.4.4)

- Add short_display_name for components and categories (thx Michael Chernigin)

- 4.8.0 -> 5.1.0

- Update to latest stable release.
- Major fixes from upstream:
  + Security enhancements including support for password rotation, better
    credential management, and namespaces.
    * getcifsacl: fix return code check for getting full ACL.
    * cifs-utils: support and document password2 mount option.
    * cifs-utils: Skip TGT check if valid service ticket is already available.
    * Do not pass passwords with sec=none and sec=krb5.
  + Various improvements to man pages.

- added the ability to select the fusermount3/fuserumount3 version using
  alternatives by default (thx Korney Gedert) (fixes: 52316).

- Added the ability to select the fusermount2/fuserumount2 version using
  alternatives-manual (thx Korney Gedert).

- Add support distr profile layer
- Add service specific system profile template
- Update obsoletes default user profile during upgrade

- Removed dependency on pipes.

- Added pam_canonicalize_user.so to system-auth-common (closes: #47426).
- Added pam_canonicalize_user control (closes: #47713).
- Disabled legacy pam_propperpwnam.so in system-auth-common during upgrade.

- Fix FTBS by CFLAGS="-Wno-incompatible-pointer-types"

- Updated to 14 version (fixes: CVE-2023-50967)

- Initial build

- Updated to 0.9.33.
- Major fixes from upstream:
  + mdb_page_search: fix error code when DBI record is missing (ITS#9037);
  + Fix meta page usage by read only tools (ITS#10212).

- Move executable script to bindir.
- Update systemd unit.

- Fixed problem with local users definition (difference with previous
  release - fixed path to /etc/tcb/ is removed, which allows to work
  with nsswitch.conf) (thx Maria Alexeeva) (ALT#47499).

- Added additional methods on the bus for forced downloading of gpt (thx greh@)

- Updated to new version 1.1.16 (released 2024-07-05)
- Fixes from upstream:
  + Fixed copy&paste error in the destructor
  + Fixed thread sanitizer on modern Linux Kernels
  + Fixed building with newer cmocka versions

- 2.8.102 -> 2.8.135

- Spec created by cabal2rpm 0.20_11

- Add support LDAP add/mod operation to set/change password:
 + fix unable to join to active directory after KB5008380/CVE-2021-42287 with
   option '--ldap-passwd';
 + https://gitlab.freedesktop.org/realmd/adcli/-/issues/27
- Add support fall back to LDAPS if CLDAP ping was not successful
 + If the --use-ldaps option is used and there is no reply on the CLDAP 389/udp
   port adcli will try to send the request to the LDAPS port 636/tcp.
- Fix write SID before secret to Samba's db looks like 'net changesecretpw'
- Add passwd-user sub-command for (re)set a user password.
- Add dont-expire-password option for computer.

- Update Administrative Templates (.admx) default source URL:
  Windows 10 October 2020 Update -> Windows 10 2022 Update (22H2).

- Improve oddjob-gpupdate-dbus-timeout control.
- Initial support build for debian.

- Add compatibility with stable releases of samba-4.18 and later (closes: 49404).
- Replace python3 build to new pyproject_build process.

- Add control pam_propperpwnam for support module in system authentication (ALT#47713).

- Fixed prepare-vm script dependency to gpasswd.

- Fix check of mime type for images.

- Update spec template to newest rpm-build-haskel supports haskell(abi)

- add requires to apt-gpgkeys with Etersoft keys

- Updated spec to allow any compression of man page

- NMU: spec: adapt to new cmake macros.

- NMU: spec: adapted to new cmake macros.

- Add options to initscript

- Build on aarch64 fixed

- Initial build for Sisyphus

- updated with the help of cabal2gear.

- Spec created by cabal2rpm 0.20_11

- Initial from upstream with Spec created by cabal2rpm 0.20_11

- Fix build on 32-bits platforms

- Spec created by cabal2rpm 0.20_11