net-fs/samba: Security bump to versions 4.11.8 and 4.12.2
[gentoo.git] / net-fs / samba / samba-4.11.8.ebuild
1 # Copyright 1999-2020 Gentoo Authors
2 # Distributed under the terms of the GNU General Public License v2
3
4 EAPI=6
5
6 PYTHON_COMPAT=( python3_{6,7,8} )
7 PYTHON_REQ_USE='threads(+),xml(+)'
8 inherit python-single-r1 waf-utils multilib-minimal linux-info systemd pam
9
10 MY_PV="${PV/_rc/rc}"
11 MY_P="${PN}-${MY_PV}"
12
13 SRC_PATH="stable"
14 [[ ${PV} = *_rc* ]] && SRC_PATH="rc"
15
16 SRC_URI="mirror://samba/${SRC_PATH}/${MY_P}.tar.gz"
17 [[ ${PV} = *_rc* ]] || \
18 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86"
19
20 DESCRIPTION="Samba Suite Version 4"
21 HOMEPAGE="https://www.samba.org/"
22 LICENSE="GPL-3"
23
24 SLOT="0"
25
26 IUSE="acl addc addns ads ceph client cluster cups debug dmapi fam gpg iprint
27 json ldap pam profiling-data python quota selinux syslog system-heimdal
28 +system-mitkrb5 systemd test winbind zeroconf"
29
30 MULTILIB_WRAPPED_HEADERS=(
31         /usr/include/samba-4.0/policy.h
32         /usr/include/samba-4.0/dcerpc_server.h
33         /usr/include/samba-4.0/ctdb.h
34         /usr/include/samba-4.0/ctdb_client.h
35         /usr/include/samba-4.0/ctdb_protocol.h
36         /usr/include/samba-4.0/ctdb_private.h
37         /usr/include/samba-4.0/ctdb_typesafe_cb.h
38         /usr/include/samba-4.0/ctdb_version.h
39 )
40
41 CDEPEND="
42         >=app-arch/libarchive-3.1.2[${MULTILIB_USEDEP}]
43         dev-lang/perl:=
44         dev-libs/libbsd[${MULTILIB_USEDEP}]
45         dev-libs/libtasn1[${MULTILIB_USEDEP}]
46         dev-libs/popt[${MULTILIB_USEDEP}]
47         >=net-libs/gnutls-3.2.0[${MULTILIB_USEDEP}]
48         net-libs/libnsl:=[${MULTILIB_USEDEP}]
49         sys-apps/dbus[${MULTILIB_USEDEP}]
50         sys-libs/e2fsprogs-libs[${MULTILIB_USEDEP}]
51         >=sys-libs/ldb-2.0.10[ldap(+)?,python?,${PYTHON_SINGLE_USEDEP},${MULTILIB_USEDEP}]
52         <sys-libs/ldb-2.1.0[ldap(+)?,python?,${PYTHON_SINGLE_USEDEP},${MULTILIB_USEDEP}]
53         sys-libs/libcap
54         sys-libs/ncurses:0=
55         sys-libs/readline:0=
56         >=sys-libs/talloc-2.2.0[python?,${PYTHON_SINGLE_USEDEP},${MULTILIB_USEDEP}]
57         >=sys-libs/tdb-1.4.2[python?,${PYTHON_SINGLE_USEDEP},${MULTILIB_USEDEP}]
58         >=sys-libs/tevent-0.10.0[python?,${PYTHON_SINGLE_USEDEP},${MULTILIB_USEDEP}]
59         sys-libs/zlib[${MULTILIB_USEDEP}]
60         virtual/libiconv
61         pam? ( sys-libs/pam )
62         acl? ( virtual/acl )
63         $(python_gen_cond_dep "
64                 dev-python/subunit[\${PYTHON_MULTI_USEDEP},${MULTILIB_USEDEP}]
65                 addns? (
66                         net-dns/bind-tools[gssapi]
67                         dev-python/dnspython:=[\${PYTHON_MULTI_USEDEP}]
68                 )
69         ")
70         ceph? ( sys-cluster/ceph )
71         cluster? (
72                 net-libs/rpcsvc-proto
73                 !dev-db/ctdb
74         )
75         cups? ( net-print/cups )
76         debug? ( dev-util/lttng-ust )
77         dmapi? ( sys-apps/dmapi )
78         fam? ( virtual/fam )
79         gpg? ( app-crypt/gpgme )
80         json? ( dev-libs/jansson )
81         ldap? ( net-nds/openldap[${MULTILIB_USEDEP}] )
82         system-heimdal? ( >=app-crypt/heimdal-1.5[-ssl,${MULTILIB_USEDEP}] )
83         system-mitkrb5? ( >=app-crypt/mit-krb5-1.15.1[${MULTILIB_USEDEP}] )
84         systemd? ( sys-apps/systemd:0= )
85         zeroconf? ( net-dns/avahi )
86 "
87 DEPEND="${CDEPEND}
88         ${PYTHON_DEPS}
89         app-text/docbook-xsl-stylesheets
90         dev-libs/libxslt
91         >=dev-util/cmocka-1.1.1[${MULTILIB_USEDEP}]
92         net-libs/libtirpc[${MULTILIB_USEDEP}]
93         virtual/pkgconfig
94         || (
95                 net-libs/rpcsvc-proto
96                 <sys-libs/glibc-2.26[rpc(+)]
97         )
98         test? (
99                 !system-mitkrb5? (
100                         >=sys-libs/nss_wrapper-1.1.3
101                         >=net-dns/resolv_wrapper-1.1.4
102                         >=net-libs/socket_wrapper-1.1.9
103                         >=sys-libs/uid_wrapper-1.2.1
104                 )
105         )"
106 RDEPEND="${CDEPEND}
107         python? ( ${PYTHON_DEPS} )
108         client? ( net-fs/cifs-utils[ads?] )
109         selinux? ( sec-policy/selinux-samba )
110         !dev-perl/Parse-Yapp
111 "
112
113 REQUIRED_USE="
114         addc? ( python json winbind )
115         addns? ( python )
116         ads? ( acl ldap winbind )
117         cluster? ( ads )
118         gpg? ( addc )
119         test? ( python )
120         ?? ( system-heimdal system-mitkrb5 )
121         ${PYTHON_REQUIRED_USE}
122 "
123
124 # the test suite is messed, it uses system-installed samba
125 # bits instead of what was built, tests things disabled via use
126 # flags, and generally just fails to work in a way ebuilds could
127 # rely on in its current state
128 RESTRICT="test"
129
130 S="${WORKDIR}/${MY_P}"
131
132 PATCHES=(
133         "${FILESDIR}/${PN}-4.4.0-pam.patch"
134         "${FILESDIR}/${PN}-4.9.2-timespec.patch"
135 )
136
137 #CONFDIR="${FILESDIR}/$(get_version_component_range 1-2)"
138 CONFDIR="${FILESDIR}/4.4"
139
140 WAF_BINARY="${S}/buildtools/bin/waf"
141
142 SHAREDMODS=""
143
144 pkg_setup() {
145         python-single-r1_pkg_setup
146         if use cluster ; then
147                 SHAREDMODS="idmap_rid,idmap_tdb2,idmap_ad"
148         elif use ads ; then
149                 SHAREDMODS="idmap_ad"
150         fi
151 }
152
153 src_prepare() {
154         default
155
156         # un-bundle dnspython
157         sed -i -e '/"dns.resolver":/d' "${S}"/third_party/wscript || die
158
159         # unbundle iso8601 unless tests are enabled
160         if ! use test ; then
161                 sed -i -e '/"iso8601":/d' "${S}"/third_party/wscript || die
162         fi
163
164         ## ugly hackaround for bug #592502
165         #cp /usr/include/tevent_internal.h "${S}"/lib/tevent/ || die
166
167         sed -e 's:<gpgme\.h>:<gpgme/gpgme.h>:' \
168                 -i source4/dsdb/samdb/ldb_modules/password_hash.c \
169                 || die
170
171         # Friggin' WAF shit
172         multilib_copy_sources
173 }
174
175 multilib_src_configure() {
176         # when specifying libs for samba build you must append NONE to the end to
177         # stop it automatically including things
178         local bundled_libs="NONE"
179         if ! use system-heimdal && ! use system-mitkrb5 ; then
180                 bundled_libs="heimbase,heimntlm,hdb,kdc,krb5,wind,gssapi,hcrypto,hx509,roken,asn1,com_err,NONE"
181         fi
182
183         local myconf=(
184                 --enable-fhs
185                 --sysconfdir="${EPREFIX}/etc"
186                 --localstatedir="${EPREFIX}/var"
187                 --with-modulesdir="${EPREFIX}/usr/$(get_libdir)/samba"
188                 --with-piddir="${EPREFIX}/run/${PN}"
189                 --bundled-libraries="${bundled_libs}"
190                 --builtin-libraries=NONE
191                 --disable-rpath
192                 --disable-rpath-install
193                 --nopyc
194                 --nopyo
195                 $(multilib_native_use_with acl acl-support)
196                 $(multilib_native_usex addc '' '--without-ad-dc')
197                 $(multilib_native_use_with addns dnsupdate)
198                 $(multilib_native_use_with ads)
199                 $(multilib_native_use_enable ceph cephfs)
200                 $(multilib_native_use_with cluster cluster-support)
201                 $(multilib_native_use_enable cups)
202                 $(multilib_native_use_with dmapi)
203                 $(multilib_native_use_with fam)
204                 $(multilib_native_use_with gpg gpgme)
205                 $(multilib_native_use_with json)
206                 $(multilib_native_use_enable iprint)
207                 $(multilib_native_use_with pam)
208                 $(multilib_native_usex pam "--with-pammodulesdir=${EPREFIX}/$(get_libdir)/security" '')
209                 $(multilib_native_use_with quota quotas)
210                 $(multilib_native_use_with syslog)
211                 $(multilib_native_use_with systemd)
212                 --systemd-install-services
213                 --with-systemddir="$(systemd_get_systemunitdir)"
214                 $(multilib_native_use_with winbind)
215                 $(multilib_native_usex python '' '--disable-python')
216                 $(multilib_native_use_enable zeroconf avahi)
217                 $(multilib_native_usex test '--enable-selftest' '')
218                 $(usex system-mitkrb5 "--with-system-mitkrb5 $(multilib_native_usex addc --with-experimental-mit-ad-dc '')" '')
219                 $(use_with debug lttng)
220                 $(use_with ldap)
221                 $(use_with profiling-data)
222                 # bug #683148
223                 --jobs 1
224         )
225
226         multilib_is_native_abi && myconf+=( --with-shared-modules=${SHAREDMODS} )
227
228         CPPFLAGS="-I${SYSROOT}${EPREFIX}/usr/include/et ${CPPFLAGS}" \
229                 waf-utils_src_configure ${myconf[@]}
230 }
231
232 multilib_src_compile() {
233         waf-utils_src_compile
234 }
235
236 multilib_src_install() {
237         waf-utils_src_install
238
239         # Make all .so files executable
240         find "${ED}" -type f -name "*.so" -exec chmod +x {} + || die
241
242         if multilib_is_native_abi ; then
243                 # install ldap schema for server (bug #491002)
244                 if use ldap ; then
245                         insinto /etc/openldap/schema
246                         doins examples/LDAP/samba.schema
247                 fi
248
249                 # create symlink for cups (bug #552310)
250                 if use cups ; then
251                         dosym ../../../bin/smbspool /usr/libexec/cups/backend/smb
252                 fi
253
254                 # install example config file
255                 insinto /etc/samba
256                 doins examples/smb.conf.default
257
258                 # Fix paths in example file (#603964)
259                 sed \
260                         -e '/log file =/s@/usr/local/samba/var/@/var/log/samba/@' \
261                         -e '/include =/s@/usr/local/samba/lib/@/etc/samba/@' \
262                         -e '/path =/s@/usr/local/samba/lib/@/var/lib/samba/@' \
263                         -e '/path =/s@/usr/local/samba/@/var/lib/samba/@' \
264                         -e '/path =/s@/usr/spool/samba@/var/spool/samba@' \
265                         -i "${ED%/}"/etc/samba/smb.conf.default || die
266
267                 # Install init script and conf.d file
268                 newinitd "${CONFDIR}/samba4.initd-r1" samba
269                 newconfd "${CONFDIR}/samba4.confd" samba
270
271                 systemd_dotmpfilesd "${FILESDIR}"/samba.conf
272                 use addc || rm "${D}/$(systemd_get_systemunitdir)/samba.service" || die
273
274                 # Preserve functionality for old gentoo-specific unit names
275                 dosym nmb.service "$(systemd_get_systemunitdir)/nmbd.service"
276                 dosym smb.service "$(systemd_get_systemunitdir)/smbd.service"
277                 dosym winbind.service "$(systemd_get_systemunitdir)/winbindd.service"
278         fi
279
280         if use pam && use winbind ; then
281                 newpamd "${CONFDIR}/system-auth-winbind.pam" system-auth-winbind
282                 # bugs #376853 and #590374
283                 insinto /etc/security
284                 doins examples/pam_winbind/pam_winbind.conf
285         fi
286
287         keepdir /var/cache/samba
288         keepdir /var/lib/ctdb
289         keepdir /var/lib/samba/{bind-dns,private}
290         keepdir /var/log/samba
291 }
292
293 multilib_src_install_all() {
294         # Attempt to fix bug #673168
295         find "${ED}" -type d -name "Yapp" -print0 \
296                 | xargs -0 --no-run-if-empty rm -r || die
297 }
298
299 multilib_src_test() {
300         if multilib_is_native_abi ; then
301                 "${WAF_BINARY}" test || die "test failed"
302         fi
303 }
304
305 pkg_postinst() {
306         ewarn "Be aware that this release contains the best of all of Samba's"
307         ewarn "technology parts, both a file server (that you can reasonably expect"
308         ewarn "to upgrade existing Samba 3.x releases to) and the AD domain"
309         ewarn "controller work previously known as 'samba4'."
310
311         elog "For further information and migration steps make sure to read "
312         elog "https://samba.org/samba/history/${P}.html "
313         elog "https://wiki.samba.org/index.php/Samba4/HOWTO "
314 }