Adding debian version 2.6.8+dfsg-1~exp1.debian/2.6.8+dfsg-1_exp1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

12 files changed, 477 insertions, 230 deletions

diff --git a/debian/changelog b/debian/changelog
index 5c3333e..c65d389 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,37 @@
+openldap (2.6.8+dfsg-1~exp1) experimental; urgency=medium
+
+  [ Sergio Durigan Junior ]
+  * d/rules: Anchor DEB_MAINTAINER regexp.
+    This is needed in Ubuntu because of XSBC-Original-Maintainer.
+  * New upstream version 2.6.8+dfsg
+  * d/p/smbk5pwd-implicit-declaration: Remove; fixed upstream.
+  * d/control: B-D on pkgconf instead of pkg-config.
+  * d/p/slapd-contrib.{install,manpages}: Install new slapo-neogroup overlay.
+
+  [ Steve Langasek ]
+  * debian/patches/64-bit-time-t-compat:
+    handle sizeof(time_t) > sizeof(long) in format strings.
+
+  [ Ryan Tandy ]
+  * Drop transitional package slapd-smbk5pwd. (Closes: #1032742)
+  * Drop dbgsym migration for slapd-dbg.
+    The dbgsym transition was done in buster.
+  * Build and install the ppm module in slapd-contrib. (Closes: #1039740)
+  * Fix implicit declaration of kadm5_s_init_with_password_ctx.
+    (Closes: #1065633)
+  * debian/patches/64-bit-time-t-compat.patch: Refresh patch.
+  * debian/copyright: Exclude doc/guide/admin/guide.html from
+    the upstream source.
+    The tool required to build it from source is not packaged in Debian.
+    Fixes a Lintian error (source-is-missing).
+  * Update Swedish debconf translation.
+    Thanks to Martin Bagge and Anders Jonsson (Closes: #1056955)
+  * debian/salsa-ci.yml: Enable Salsa CI pipeline.
+  * debian/copyright: Remove build/missing.
+    Fixes a Lintian warning (superfluous-file-pattern).
+
+ -- Sergio Durigan Junior <sergiodj@debian.org>  Thu, 30 May 2024 23:18:02 -0400
+
 openldap (2.6.7+dfsg-1~exp1) experimental; urgency=medium
 
   * New upstream version 2.6.7+dfsg
diff --git a/debian/control b/debian/control
index 961e6de..59bc4f3 100644
--- a/debian/control
+++ b/debian/control
@@ -11,6 +11,7 @@ Build-Depends: debhelper-compat (= 13),
                groff-base,
                heimdal-multidev (>= 7.4.0.dfsg.1-1~) <!pkg.openldap.noslapd>,
                libargon2-dev <!pkg.openldap.noslapd>,
+               libcrack2-dev <!pkg.openldap.noslapd>,
                libgnutls28-dev,
                libltdl-dev <!pkg.openldap.noslapd>,
                libperl-dev (>= 5.8.0) <!pkg.openldap.noslapd>,
@@ -19,7 +20,7 @@ Build-Depends: debhelper-compat (= 13),
                nettle-dev <!pkg.openldap.noslapd>,
                openssl <!nocheck>,
                perl:any,
-               pkg-config (>= 0.29),
+               pkgconf,
                po-debconf,
                unixodbc-dev <!pkg.openldap.noslapd>,
 # Needed for SASL/GSSAPI tests
@@ -65,16 +66,6 @@ Description: contributed plugins for OpenLDAP slapd
  the OpenLDAP community. While distributed as part of OpenLDAP Software, they
  are not necessarily supported by the OpenLDAP Project.
 
-Package: slapd-smbk5pwd
-Architecture: all
-Section: oldlibs
-Build-Profiles: <!pkg.openldap.noslapd>
-Depends: slapd-contrib, ${misc:Depends}
-Breaks: slapd (<< 2.4.47+dfsg-2~)
-Description: transitional package for slapd-contrib
- This is a transitional package from slapd-smbk5pwd to slapd-contrib. It can be
- safely removed.
-
 Package: ldap-utils
 Architecture: any
 Depends: ${shlibs:Depends}, libldap2 (= ${binary:Version}), ${misc:Depends}
diff --git a/debian/copyright b/debian/copyright
index 51976e6..9983bf7 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -35,6 +35,7 @@ Comment:
  Additional information about OpenLDAP can be obtained at
  <http://www.openldap.org/>.
 Files-Excluded: doc/drafts/*
+                doc/guide/admin/guide.html
                 doc/rfc/*
                 servers/slapd/schema/collective.schema
                 servers/slapd/schema/corba.schema
@@ -87,9 +88,8 @@ Files: build/lt~obsolete.m4
 Copyright: Copyright (C) 2004-2005, 2007, 2009, 2011-2015 Free Software Foundation, Inc.
 License: FSF-unlimited
 
-Files: build/missing
-       contrib/ldapc++/missing
-Copyright: Copyright (C) 1996-2014 Free Software Foundation, Inc.
+Files: contrib/ldapc++/missing
+Copyright: Copyright (C) 1996-2018 Free Software Foundation, Inc.
 License: GPL-2+ with Autoconf exception
 
 Files: build/shtool
diff --git a/debian/patches/64-bit-time-t-compat.patch b/debian/patches/64-bit-time-t-compat.patch
new file mode 100644
index 0000000..aa72bae
--- /dev/null
+++ b/debian/patches/64-bit-time-t-compat.patch
@@ -0,0 +1,389 @@
+Description: handle sizeof(time_t) > sizeof(long) in format strings
+ 64-bit time_t means that on some architectures, time_t is now larger than
+ a long, and making some references in format strings incorrect.  To avoid
+ truncation or other size mismatch issues, always cast to a long long and
+ read using %lld.
+ .
+ Fixes an assertion failure detected during build-time tests on armhf:
+ slapd: ../../../../../servers/slapd/overlays/dds.c:422: dds_op_add: Assertion `bv.bv_len < sizeof( ttlbuf )' failed.
+Author: Steve Langasek <steve.langasek@canonical.com>
+Last-Update: 2024-03-11
+Forwarded: no
+
+Index: openldap/libraries/libldap/os-ip.c
+===================================================================
+--- openldap.orig/libraries/libldap/os-ip.c
++++ openldap/libraries/libldap/os-ip.c
+@@ -287,8 +287,8 @@
+ 	int		rc;
+ 		
+ 
+-	Debug2(LDAP_DEBUG_TRACE, "ldap_int_poll: fd: %d tm: %ld\n",
+-		s, tvp ? tvp->tv_sec : -1L );
++	Debug2(LDAP_DEBUG_TRACE, "ldap_int_poll: fd: %d tm: %lld\n",
++		s, (long long)(tvp ? tvp->tv_sec : -1L) );
+ 
+ #ifdef HAVE_POLL
+ 	{
+@@ -439,8 +439,8 @@
+ 	}
+ 
+ 	Debug3(LDAP_DEBUG_TRACE,
+-			"ldap_pvt_connect: fd: %d tm: %ld async: %d\n",
+-			s, opt_tv ? tv.tv_sec : -1L, async);
++			"ldap_pvt_connect: fd: %d tm: %lld async: %d\n",
++			s, (long long)(opt_tv ? tv.tv_sec : -1L), async);
+ 
+ 	if ( opt_tv && ldap_pvt_ndelay_on(ld, s) == -1 )
+ 		return ( -1 );
+Index: openldap/libraries/libldap/os-local.c
+===================================================================
+--- openldap.orig/libraries/libldap/os-local.c
++++ openldap/libraries/libldap/os-local.c
+@@ -164,8 +164,8 @@
+ 	}
+ 
+ 	Debug3(LDAP_DEBUG_TRACE,
+-		"ldap_connect_timeout: fd: %d tm: %ld async: %d\n",
+-		s, opt_tv ? tv.tv_sec : -1L, async);
++		"ldap_connect_timeout: fd: %d tm: %lld async: %d\n",
++		s, (long long)(opt_tv ? tv.tv_sec : -1L), async);
+ 
+ 	if ( ldap_pvt_ndelay_on(ld, s) == -1 ) return -1;
+ 
+Index: openldap/libraries/libldap/result.c
+===================================================================
+--- openldap.orig/libraries/libldap/result.c
++++ openldap/libraries/libldap/result.c
+@@ -264,8 +264,8 @@
+ 		Debug2( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (infinite timeout)\n",
+ 			(void *)ld, msgid );
+ 	} else {
+-		Debug3( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (timeout %ld usec)\n",
+-			(void *)ld, msgid, (long)timeout->tv_sec * 1000000 + timeout->tv_usec );
++		Debug3( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (timeout %lld usec)\n",
++			(void *)ld, msgid, (long long)((long long)timeout->tv_sec * 1000000 + timeout->tv_usec) );
+ 	}
+ #endif /* LDAP_DEBUG */
+ 
+Index: openldap/contrib/slapd-modules/smbk5pwd/smbk5pwd.c
+===================================================================
+--- openldap.orig/contrib/slapd-modules/smbk5pwd/smbk5pwd.c
++++ openldap/contrib/slapd-modules/smbk5pwd/smbk5pwd.c
+@@ -513,7 +513,7 @@
+ 		keys[0].bv_val = ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) );
+ 		keys[0].bv_len = snprintf(keys[0].bv_val,
+ 			LDAP_PVT_INTTYPE_CHARS(long),
+-			"%ld", slap_get_time());
++			"%lld", (long long)slap_get_time());
+ 		BER_BVZERO( &keys[1] );
+ 		
+ 		ml->sml_desc = ad_sambaPwdLastSet;
+@@ -535,7 +535,7 @@
+ 			keys[0].bv_val = ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) );
+ 			keys[0].bv_len = snprintf(keys[0].bv_val,
+ 					LDAP_PVT_INTTYPE_CHARS(long),
+-					"%ld", slap_get_time() + pi->smb_must_change);
++					"%lld", (long long)(slap_get_time() + pi->smb_must_change));
+ 			BER_BVZERO( &keys[1] );
+ 
+ 			ml->sml_desc = ad_sambaPwdMustChange;
+@@ -558,7 +558,7 @@
+ 			keys[0].bv_val = ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) );
+ 			keys[0].bv_len = snprintf(keys[0].bv_val,
+ 					LDAP_PVT_INTTYPE_CHARS(long),
+-					"%ld", slap_get_time() + pi->smb_can_change);
++					"%lld", (long long)(slap_get_time() + pi->smb_can_change));
+ 			BER_BVZERO( &keys[1] );
+ 
+ 			ml->sml_desc = ad_sambaPwdCanChange;
+Index: openldap/servers/slapd/back-asyncmeta/add.c
+===================================================================
+--- openldap.orig/servers/slapd/back-asyncmeta/add.c
++++ openldap/servers/slapd/back-asyncmeta/add.c
+@@ -252,8 +252,8 @@
+ 	      op->o_req_dn.bv_val );
+ 
+ 	if (current_time > op->o_time) {
+-		Debug(asyncmeta_debug, "==> asyncmeta_back_add[%s]: o_time:[%ld], current time: [%ld]\n",
+-		      op->o_log_prefix, op->o_time, current_time );
++		Debug(asyncmeta_debug, "==> asyncmeta_back_add[%s]: o_time:[%lld], current time: [%lld]\n",
++		      op->o_log_prefix, (long long)op->o_time, (long long)current_time );
+ 	}
+ 
+ 	if ( mi->mi_ntargets == 0 ) {
+Index: openldap/servers/slapd/back-asyncmeta/compare.c
+===================================================================
+--- openldap.orig/servers/slapd/back-asyncmeta/compare.c
++++ openldap/servers/slapd/back-asyncmeta/compare.c
+@@ -194,8 +194,8 @@
+ 	      op->o_req_dn.bv_val );
+ 
+ 	if (current_time > op->o_time) {
+-		Debug( asyncmeta_debug, "==> asyncmeta_back_compare[%s]: o_time:[%ld], current time: [%ld]\n",
+-		       op->o_log_prefix, op->o_time, current_time );
++		Debug( asyncmeta_debug, "==> asyncmeta_back_compare[%s]: o_time:[%lld], current time: [%lld]\n",
++		       op->o_log_prefix, (long long)op->o_time, (long long)current_time );
+ 	}
+ 
+ 	if ( mi->mi_ntargets == 0 ) {
+Index: openldap/servers/slapd/back-asyncmeta/config.c
+===================================================================
+--- openldap.orig/servers/slapd/back-asyncmeta/config.c
++++ openldap/servers/slapd/back-asyncmeta/config.c
+@@ -1165,8 +1165,8 @@
+ 			if ( mc->mc_network_timeout == 0 ) {
+ 				return 1;
+ 			}
+-			bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%ld",
+-				mc->mc_network_timeout );
++			bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%lld",
++				(long long)mc->mc_network_timeout );
+ 			bv.bv_val = c->cr_msg;
+ 			value_add_one( &c->rvalue_vals, &bv );
+ 			break;
+Index: openldap/servers/slapd/back-asyncmeta/delete.c
+===================================================================
+--- openldap.orig/servers/slapd/back-asyncmeta/delete.c
++++ openldap/servers/slapd/back-asyncmeta/delete.c
+@@ -186,8 +186,8 @@
+ 	      op->o_req_dn.bv_val );
+ 
+ 	if (current_time > op->o_time) {
+-		Debug(asyncmeta_debug, "==> asyncmeta_back_delete[%s]: o_time:[%ld], current time: [%ld]\n",
+-		      op->o_log_prefix, op->o_time, current_time );
++		Debug(asyncmeta_debug, "==> asyncmeta_back_delete[%s]: o_time:[%lld], current time: [%lld]\n",
++		      op->o_log_prefix, (long long)op->o_time, (long long)current_time );
+ 	}
+ 
+ 	if ( mi->mi_ntargets == 0 ) {
+Index: openldap/servers/slapd/back-asyncmeta/meta_result.c
+===================================================================
+--- openldap.orig/servers/slapd/back-asyncmeta/meta_result.c
++++ openldap/servers/slapd/back-asyncmeta/meta_result.c
+@@ -1660,7 +1660,7 @@
+ 	LDAP_STAILQ_HEAD(BCList, bm_context_t) timeout_list;
+ 	LDAP_STAILQ_INIT( &timeout_list );
+ 
+-	Debug( asyncmeta_debug, "asyncmeta_timeout_loop[%p] start at [%ld] \n", rtask, current_time );
++	Debug( asyncmeta_debug, "asyncmeta_timeout_loop[%p] start at [%lld] \n", rtask, (long long)current_time );
+ 	void *oldctx = slap_sl_mem_create(SLAP_SLAB_SIZE, SLAP_SLAB_STACK, ctx, 0);
+ 	for (i=0; i<mi->mi_num_conns; i++) {
+ 		a_metaconn_t * mc= &mi->mi_conns[i];
+@@ -1751,9 +1751,9 @@
+ 				a_metasingleconn_t *log_msc =  &mc->mc_conns[0];
+ 				Debug( asyncmeta_debug,
+ 				       "asyncmeta_timeout_loop:Timeout op %s loop[%p], "
+-				       "current_time:%ld, op->o_time:%ld msc: %p, "
++				       "current_time:%lld, op->o_time:%lld msc: %p, "
+ 				       "msc->msc_binding_time: %x, msc->msc_flags:%x \n",
+-				       bc->op->o_log_prefix, rtask, current_time, bc->op->o_time,
++				       bc->op->o_log_prefix, rtask, (long long)current_time, (long long)bc->op->o_time,
+ 				       log_msc, (unsigned int)log_msc->msc_binding_time, log_msc->msc_mscflags );
+ 
+ 				if (bc->searchtime) {
+@@ -1814,7 +1814,7 @@
+ 
+ 	slap_sl_mem_setctx(ctx, oldctx);
+ 	current_time = slap_get_time();
+-	Debug( asyncmeta_debug, "asyncmeta_timeout_loop[%p] stop at [%ld] \n", rtask, current_time );
++	Debug( asyncmeta_debug, "asyncmeta_timeout_loop[%p] stop at [%lld] \n", rtask, (long long)current_time );
+ 	ldap_pvt_thread_mutex_lock( &slapd_rq.rq_mutex );
+ 	if ( ldap_pvt_runqueue_isrunning( &slapd_rq, rtask )) {
+ 		ldap_pvt_runqueue_stoptask( &slapd_rq, rtask );
+Index: openldap/servers/slapd/back-asyncmeta/modify.c
+===================================================================
+--- openldap.orig/servers/slapd/back-asyncmeta/modify.c
++++ openldap/servers/slapd/back-asyncmeta/modify.c
+@@ -242,8 +242,8 @@
+ 	      op->o_req_dn.bv_val );
+ 
+ 	if (current_time > op->o_time) {
+-		Debug(asyncmeta_debug, "==> asyncmeta_back_modify[%s]: o_time:[%ld], current time: [%ld]\n",
+-		      op->o_log_prefix, op->o_time, current_time );
++		Debug(asyncmeta_debug, "==> asyncmeta_back_modify[%s]: o_time:[%lld], current time: [%lld]\n",
++		      op->o_log_prefix, (long long)op->o_time, (long long)current_time );
+ 	}
+ 
+ 	if ( mi->mi_ntargets == 0 ) {
+Index: openldap/servers/slapd/back-asyncmeta/modrdn.c
+===================================================================
+--- openldap.orig/servers/slapd/back-asyncmeta/modrdn.c
++++ openldap/servers/slapd/back-asyncmeta/modrdn.c
+@@ -256,8 +256,8 @@
+ 	      op->o_req_dn.bv_val );
+ 
+ 	if (current_time > op->o_time) {
+-		Debug(asyncmeta_debug, "==> asyncmeta_back_modrdn[%s]: o_time:[%ld], current time: [%ld]\n",
+-		      op->o_log_prefix, op->o_time, current_time );
++		Debug(asyncmeta_debug, "==> asyncmeta_back_modrdn[%s]: o_time:[%lld], current time: [%lld]\n",
++		      op->o_log_prefix, (long long)op->o_time, (long long)current_time );
+ 	}
+ 
+ 	if ( mi->mi_ntargets == 0 ) {
+Index: openldap/servers/slapd/back-ldap/bind.c
+===================================================================
+--- openldap.orig/servers/slapd/back-ldap/bind.c
++++ openldap/servers/slapd/back-ldap/bind.c
+@@ -2999,14 +2999,14 @@
+ 	}
+ 
+ 	if ( lc->lcb_create_time != 0 ) {
+-		len = snprintf( tbuf, sizeof(tbuf), "%ld", lc->lcb_create_time );
++		len = snprintf( tbuf, sizeof(tbuf), "%lld", (long long)lc->lcb_create_time );
+ 		if ( ptr + sizeof(" created=") + len >= end ) return -1;
+ 		ptr = lutil_strcopy( ptr, " created=" );
+ 		ptr = lutil_strcopy( ptr, tbuf );
+ 	}
+ 
+ 	if ( lc->lcb_time != 0 ) {
+-		len = snprintf( tbuf, sizeof(tbuf), "%ld", lc->lcb_time );
++		len = snprintf( tbuf, sizeof(tbuf), "%lld", (long long)lc->lcb_time );
+ 		if ( ptr + sizeof(" modified=") + len >= end ) return -1;
+ 		ptr = lutil_strcopy( ptr, " modified=" );
+ 		ptr = lutil_strcopy( ptr, tbuf );
+@@ -3185,8 +3185,8 @@
+ 		 */
+ 		slap_wake_listener();
+ 		Debug( LDAP_DEBUG_TRACE,
+-			"ldap_back_conn_prune: scheduled connection expiry timer to %ld sec\n",
+-			li->li_conn_expire_task->interval.tv_sec );
++			"ldap_back_conn_prune: scheduled connection expiry timer to %lld sec\n",
++ 			(long long)li->li_conn_expire_task->interval.tv_sec );
+ 	} else if ( next_timeout == -1 && li->li_conn_expire_task != NULL ) {
+ 		if ( ldap_pvt_runqueue_isrunning( &slapd_rq, li->li_conn_expire_task ) ) {
+ 			ldap_pvt_runqueue_stoptask( &slapd_rq, li->li_conn_expire_task );
+@@ -3221,8 +3221,8 @@
+ 			"ldap_back_conn_expire_timer" );
+ 		slap_wake_listener();
+ 		Debug( LDAP_DEBUG_TRACE,
+-			"ldap_back_conn_prune: scheduled connection expiry timer to %ld sec\n",
+-			li->li_conn_expire_task->interval.tv_sec );
++			"ldap_back_conn_prune: scheduled connection expiry timer to %lld sec\n",
++			(long long)li->li_conn_expire_task->interval.tv_sec );
+ 	}
+ 	ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
+ 
+Index: openldap/servers/slapd/bind.c
+===================================================================
+--- openldap.orig/servers/slapd/bind.c
++++ openldap/servers/slapd/bind.c
+@@ -430,8 +430,8 @@
+ 			bindtime = tt.tt_sec;
+ 		}
+ 		Debug( LDAP_DEBUG_TRACE, "fe_op_lastbind: "
+-				"old pwdLastSuccess value=%s %lds ago\n",
+-				a->a_nvals[0].bv_val, bindtime == (time_t)-1 ? -1 : op->o_time - bindtime );
++				"old pwdLastSuccess value=%s %llds ago\n",
++				a->a_nvals[0].bv_val, (long long)(bindtime == (time_t)-1 ? -1 : op->o_time - bindtime) );
+ 
+ 		/*
+ 		 * TODO: If the recorded bind time is within configurable precision,
+Index: openldap/servers/slapd/overlays/dds.c
+===================================================================
+--- openldap.orig/servers/slapd/overlays/dds.c
++++ openldap/servers/slapd/overlays/dds.c
+@@ -418,7 +418,7 @@
+ 		assert( ttl <= DDS_RF2589_MAX_TTL );
+ 
+ 		bv.bv_val = ttlbuf;
+-		bv.bv_len = snprintf( ttlbuf, sizeof( ttlbuf ), "%ld", ttl );
++		bv.bv_len = snprintf( ttlbuf, sizeof( ttlbuf ), "%lld", (long long)ttl );
+ 		assert( bv.bv_len < sizeof( ttlbuf ) );
+ 
+ 		/* FIXME: apparently, values in op->ora_e are malloc'ed
+@@ -696,7 +696,7 @@
+ 					goto done;
+ 				}
+ 
+-				bv_entryTtl.bv_len = snprintf( textbuf, sizeof( textbuf ), "%ld", entryTtl );
++				bv_entryTtl.bv_len = snprintf( textbuf, sizeof( textbuf ), "%lld", (long long)entryTtl );
+ 				break;
+ 
+ 			default:
+@@ -918,7 +918,7 @@
+ 		ttl = (ttl < 0) ? 0 : ttl;
+ 		assert( ttl <= DDS_RF2589_MAX_TTL );
+ 
+-		len = snprintf( ttlbuf, sizeof(ttlbuf), "%ld", ttl );
++		len = snprintf( ttlbuf, sizeof(ttlbuf), "%lld", (long long)ttl );
+ 		if ( len < 0 )
+ 		{
+ 			goto done;
+@@ -1178,7 +1178,7 @@
+ 		ttlmod.sml_values = ttlvalues;
+ 		ttlmod.sml_numvals = 1;
+ 		ttlvalues[ 0 ].bv_val = ttlbuf;
+-		ttlvalues[ 0 ].bv_len = snprintf( ttlbuf, sizeof( ttlbuf ), "%ld", ttl );
++		ttlvalues[ 0 ].bv_len = snprintf( ttlbuf, sizeof( ttlbuf ), "%lld", (long long)ttl );
+ 		BER_BVZERO( &ttlvalues[ 1 ] );
+ 
+ 		/* the entryExpireTimestamp is added by modify */
+@@ -1206,8 +1206,8 @@
+ 				rs->sr_rspoid = ch_strdup( slap_EXOP_REFRESH.bv_val );
+ 
+ 				Log( LDAP_DEBUG_TRACE, LDAP_LEVEL_INFO,
+-					"%s REFRESH dn=\"%s\" TTL=%ld\n",
+-					op->o_log_prefix, op->o_req_ndn.bv_val, ttl );
++					"%s REFRESH dn=\"%s\" TTL=%lld\n",
++					op->o_log_prefix, op->o_req_ndn.bv_val, (long long)ttl );
+ 			}
+ 
+ 			ber_free_buf( ber );
+Index: openldap/servers/slapd/overlays/pcache.c
+===================================================================
+--- openldap.orig/servers/slapd/overlays/pcache.c
++++ openldap/servers/slapd/overlays/pcache.c
+@@ -2729,8 +2729,8 @@
+ 					pbi->bi_flags |= BI_HASHED;
+ 			} else {
+ 				Debug( pcache_debug, "pc_bind_search: cache is stale, "
+-					"reftime: %ld, current time: %ld\n",
+-					pbi->bi_cq->bindref_time, op->o_time );
++					"reftime: %lld, current time: %lld\n",
++					(long long)pbi->bi_cq->bindref_time, (long long)op->o_time );
+ 			}
+ 		} else if ( pbi->bi_si ) {
+ 			/* This search result is going into the cache */
+@@ -3866,9 +3866,9 @@
+ 		struct berval bv;
+ 		switch( c->type ) {
+ 		case PC_MAIN:
+-			bv.bv_len = snprintf( c->cr_msg, sizeof( c->cr_msg ), "%s %d %d %d %ld",
++			bv.bv_len = snprintf( c->cr_msg, sizeof( c->cr_msg ), "%s %d %d %d %lld",
+ 				cm->db.bd_info->bi_type, cm->max_entries, cm->numattrsets,
+-				cm->num_entries_limit, cm->cc_period );
++				cm->num_entries_limit, (long long)cm->cc_period );
+ 			bv.bv_val = c->cr_msg;
+ 			value_add_one( &c->rvalue_vals, &bv );
+ 			break;
+@@ -3910,12 +3910,12 @@
+ 				/* HEADS-UP: always print all;
+ 				 * if optional == 0, ignore */
+ 				bv.bv_len = snprintf( c->cr_msg, sizeof( c->cr_msg ),
+-					" %d %ld %ld %ld %ld",
++					" %d %lld %lld %lld %lld",
+ 					temp->attr_set_index,
+-					temp->ttl,
+-					temp->negttl,
+-					temp->limitttl,
+-					temp->ttr );
++					(long long)temp->ttl,
++					(long long)temp->negttl,
++					(long long)temp->limitttl,
++					(long long)temp->ttr );
+ 				bv.bv_len += temp->querystr.bv_len + 2;
+ 				bv.bv_val = ch_malloc( bv.bv_len+1 );
+ 				ptr = bv.bv_val;
+@@ -3932,9 +3932,9 @@
+ 			for (temp=qm->templates; temp; temp=temp->qmnext) {
+ 				if ( !temp->bindttr ) continue;
+ 				bv.bv_len = snprintf( c->cr_msg, sizeof( c->cr_msg ),
+-					" %d %ld %s ",
++					" %d %lld %s ",
+ 					temp->attr_set_index,
+-					temp->bindttr,
++					(long long)temp->bindttr,
+ 					ldap_pvt_scope2str( temp->bindscope ));
+ 				bv.bv_len += temp->bindbase.bv_len + temp->bindftemp.bv_len + 4;
+ 				bv.bv_val = ch_malloc( bv.bv_len + 1 );
diff --git a/debian/patches/contrib-makefiles b/debian/patches/contrib-makefiles
index b2c8f99..2d127c8 100644
--- a/debian/patches/contrib-makefiles
+++ b/debian/patches/contrib-makefiles
@@ -52,3 +52,24 @@ Index: openldap/contrib/slapd-modules/smbk5pwd/Makefile
  LD_FLAGS = $(LDFLAGS) $($(PLAT)_LDFLAGS) -rpath $(moduledir) -module
  
  PROGRAMS = smbk5pwd.la
+--- a/contrib/slapd-modules/ppm/Makefile
++++ b/contrib/slapd-modules/ppm/Makefile
+@@ -68,7 +68,7 @@
+ 	$(CC) $(CFLAGS) $(OPT) $(CPPFLAGS) $(DEFS) $(LDFLAGS) $(INCS) -Wl,-rpath=. -o $(TEST) ppm_test.c $(PROGRAMS) $(LDAP_LIBS) $(CRACKLIB)
+ 
+ ppm.o:
+-	$(CC) $(CFLAGS) $(OPT) $(CPPFLAGS) $(DEFS) -c $(INCS) ppm.c
++	$(CC) $(CFLAGS) -fPIC $(OPT) $(CPPFLAGS) $(DEFS) -c $(INCS) ppm.c
+ 
+ ppm: ppm.o
+ 	$(CC) $(LDFLAGS) $(INCS) -shared -o $(PROGRAMS) ppm.o $(CRACKLIB)
+@@ -78,7 +78,8 @@
+ 	for p in $(PROGRAMS); do \
+ 		$(LIBTOOL) --mode=install cp $$p $(DESTDIR)/$(moduledir) ; \
+ 	done
+-	$(INSTALL) -m 644 $(EXAMPLE) $(DESTDIR)$(sysconfdir)/
++	# installed by debian/slapd-contrib.examples
++	# $(INSTALL) -m 644 $(EXAMPLE) $(DESTDIR)$(sysconfdir)/
+ 	$(INSTALL) -m 644 $(MANDOC) $(DESTDIR)$(man5dir)/
+ #	$(INSTALL) -m 755 $(TEST) $(libdir)
+ 
diff --git a/debian/patches/series b/debian/patches/series
index a8d57cb..a80392e 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -13,3 +13,4 @@ add-tlscacert-option-to-ldap-conf
 fix-build-top-mk
 switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.diff
 set-maintainer-name
+64-bit-time-t-compat.patch
diff --git a/debian/po/sv.po b/debian/po/sv.po
index 61d8bba..9eeb894 100644
--- a/debian/po/sv.po
+++ b/debian/po/sv.po
@@ -1,22 +1,21 @@
 # Translation of openldap debconf template to Swedish
-# Copyright (C) 2010, 2017 Martin Bagge <brother@bsnet.se>
+# Copyright (C) 2023 Martin Bagge <brother@persilja.net>
 # This file is distributed under the same license as the openldap package.
 #
 # Martin Ågren <martin.agren@gmail.com>, 2008.
-# Martin Bagge <brother@bsnet.se>, 2010, 2017
+# Martin Bagge <brother@perislja.net>, 2010, 2017, 2023
 msgid ""
 msgstr ""
 "Project-Id-Version: openldap_2.4.10-2_sv\n"
 "Report-Msgid-Bugs-To: openldap@packages.debian.org\n"
 "POT-Creation-Date: 2021-08-16 01:12+0000\n"
-"PO-Revision-Date: 2017-01-12 14:59+0100\n"
-"Last-Translator: Martin Bagge / brother <brother@bsnet.se>\n"
+"PO-Revision-Date: 2023-11-27 09:37+0100\n"
+"Last-Translator: Martin Bagge / brother <brother@persilja.net>\n"
 "Language-Team: Swedish <debian-l10n-swedish@lists.debian.org>\n"
 "Language: sv\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"X-Generator: Poedit 1.8.11\n"
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 
 #. Type: boolean
@@ -286,7 +285,7 @@ msgstr ""
 #. Description
 #: ../slapd.templates:15001
 msgid "Error while performing post-installation tasks"
-msgstr ""
+msgstr "Fel uppstod när installationen avslutades"
 
 #. Type: note
 #. Description
@@ -297,6 +296,10 @@ msgid ""
 "migrate one or more LDAP databases, or that a backend being used by the "
 "current OpenLDAP installation is not supported anymore."
 msgstr ""
+"Ett eller flera fel uppstod när installationen avslutades med steget post-"
+"installation. Detta innebär vanligen att slapd-paketet inte kunde flytta "
+"över en eller flera LDAP-databaser. Eller att en bakgrundsprocess som "
+"används av den nuvarande OpenLDAP-installationen inte stöds längre."
 
 #. Type: note
 #. Description
@@ -306,6 +309,9 @@ msgid ""
 "has exited, but the slapd service has NOT been (re)started. You will need to "
 "manually fix the problem and then start the service."
 msgstr ""
+"Underhålls-skriptet som är ansvarig för att utföra uppgifterna i post-"
+"installation avslutades men slapd-tjänsten har INTE startat. Du kommer "
+"behöva lösa detta problem och sedan manuellt starta tjänsten."
 
 #. Type: note
 #. Description
@@ -315,209 +321,5 @@ msgid ""
 "them, please take a look at the README.Debian file (under /usr/share/doc/"
 "slapd/)."
 msgstr ""
-
-#~ msgid "abort installation"
-#~ msgstr "avbryt installation"
-
-#~ msgid "continue regardless"
-#~ msgstr "fortsätt oavsett"
-
-#~ msgid "Manual ppolicy schema update recommended"
-#~ msgstr "Manuell uppdatering av ppolicy-schema rekommenderas"
-
-#~ msgid ""
-#~ "The new version of the Password Policy (ppolicy) overlay requires the "
-#~ "schema to define the pwdMaxRecordedFailure attribute type, which is not "
-#~ "present in the schema currently in use. It is recommended to abort the "
-#~ "upgrade now, and to update the ppolicy schema before upgrading slapd. If "
-#~ "replication is in use, the schema update should be applied on every "
-#~ "server before continuing with the upgrade."
-#~ msgstr ""
-#~ "Den nya versionen av överbryggningen av lösenordspolicyn (ppolicy, "
-#~ "password policy) kräver att schemat definierar attributtypen "
-#~ "pwdMaxRecordedFailure vilket inte är med i nuvarande schema. Det är "
-#~ "rekommenderat att avbryta uppgraderingen nu och uppdatera ppolicy-schemat "
-#~ "före uppgraderingen av slapd. Om replikering används måste "
-#~ "schemauppdateringen appliceras på alla servrar innan uppgraderingen "
-#~ "genomförs."
-
-#~ msgid ""
-#~ "An LDIF file has been generated with the changes required for the upgrade:"
-#~ msgstr ""
-#~ "En LDIF-fil har skapats med ändringarna som krävs för uppgraderingen:"
-
-#~ msgid ""
-#~ "so if slapd is using the default access control rules, these changes can "
-#~ "be applied (after starting slapd) by using the command:"
-#~ msgstr ""
-#~ "om slapd använder standardregler för åtkomsthantering kan dessa ändringar "
-#~ "appliceras (efter att slapd startats) genom följande kommando:"
-
-#~ msgid ""
-#~ "If instead you choose to continue the installation, the new attribute "
-#~ "type will be added automatically, but the change will not be acted on by "
-#~ "slapd overlays, and replication with other servers may be affected."
-#~ msgstr ""
-#~ "Om du istället fortsätter med installationen kommer den nya attributtypen "
-#~ "att läggas till automatiskt men ändringen kommer inte leda till att "
-#~ "överbryggad slapd agerar på detta. Replikering till andra servrar kan "
-#~ "påverkas."
-
-#~ msgid "Potentially unsafe slapd access control configuration"
-#~ msgstr "Potentiellt osäker rättighetsinställning för slapd"
-
-#~ msgid ""
-#~ "One or more of the configured databases has an access control rule that "
-#~ "allows users to modify most of their own attributes. This may be unsafe, "
-#~ "depending on how the database is used."
-#~ msgstr ""
-#~ "En eller flera av de inställda databaserna har rättighetsinställningar "
-#~ "som innebär att användare tillåts att ändra de flesta av sina attribut. "
-#~ "Detta kan vara osäkert, beroende på hur databasen används."
-
-#~ msgid ""
-#~ "In the case of slapd access rules that begin with \"to *\", it is "
-#~ "recommended to remove any instances of \"by self write\", so that users "
-#~ "are only able to modify specifically allowed attributes."
-#~ msgstr ""
-#~ "I fallen där rättighetsinställningarna börjar med \"to *\" är det "
-#~ "rekommenderat att ta bort \"by self write\" i förekommande fall. Det får "
-#~ "till följd att användare bara får justera specifikt tillåtna attribut."
-
-#~ msgid "See /usr/share/doc/slapd/README.Debian.gz for more details."
-#~ msgstr ""
-#~ "Läs /usr/share/doc/slapd/README.Debian.gz för detaljerad information."
-
-#~ msgid "Database backend to use:"
-#~ msgstr "Databasbakända att använda:"
-
-#~ msgid ""
-#~ "HDB and BDB use similar storage formats, but HDB adds support for subtree "
-#~ "renames. Both support the same configuration options."
-#~ msgstr ""
-#~ "HDB och BDB använder liknande lagringsformat, men HDB lägger till stöd "
-#~ "för namnbyten på underträd. Båda stödjer samma konfigurationsalternativ."
-
-#~ msgid ""
-#~ "The MDB backend is recommended. MDB uses a new storage format and "
-#~ "requires less configuration than BDB or HDB."
-#~ msgstr ""
-#~ "MDB-bakändan är rekommenderad. MDB använder ett nytt lagringsformat och "
-#~ "behöver mindre inställningar än BDB eller HDB."
-
-#~ msgid ""
-#~ "In any case, you should review the resulting database configuration for "
-#~ "your needs. See /usr/share/doc/slapd/README.Debian.gz for more details."
-#~ msgstr ""
-#~ "I vilket fall, behöver du se över den resulterande databaskonfigurationen "
-#~ "för dina behov. Se /usr/share/doc/slapd/README.Debian.gz för fler "
-#~ "detaljer."
-
-#~ msgid "Allow LDAPv2 protocol?"
-#~ msgstr "Tillåt LDAPv2-protokollet?"
-
-#~ msgid ""
-#~ "The obsolete LDAPv2 protocol is disabled by default in slapd. Programs "
-#~ "and users should upgrade to LDAPv3.  If you have old programs which can't "
-#~ "use LDAPv3, you should select this option and 'allow bind_v2' will be "
-#~ "added to your slapd.conf file."
-#~ msgstr ""
-#~ "Det inte längre aktuella LDAPv2-protokollet är som standard avaktiverat i "
-#~ "slapd. Program och använder ska uppgradera till LDAPv3. Om du har gamla "
-#~ "program som inte kan använda LDAPv3, behöver du välja detta vilket gör "
-#~ "att \"allow bin_v2\" läggs till i din slapd.conf-fil."
-
-#~ msgid "slurpd is obsolete; replicas must be reconfigured by hand"
-#~ msgstr "slurpd är inte aktuell; repliker måste konfigureras för hand"
-
-#~ msgid ""
-#~ "One or more slurpd \"replica\" options were found in your slapd config "
-#~ "when upgrading.  Because slurpd is obsolete beginning with OpenLDAP 2.4, "
-#~ "you will need to migrate your replicas to use the syncrepl protocol "
-#~ "instead."
-#~ msgstr ""
-#~ "En eller flera av slurpds \"replica\"-val har hittats i din slapd-"
-#~ "konfiguration vid uppgraderingen. Eftersom slurpd inte är aktuell längre "
-#~ "från och med OpenLDAP 2.4, kommer du behöva migrera dina repliker till "
-#~ "att använda syncrepl-protokollet istället."
-
-#~ msgid ""
-#~ "The conversion from slurpd to the pull-based syncrepl protocol cannot be "
-#~ "done automatically and you will need to configure your replica servers by "
-#~ "hand.  Please see http://www.openldap.org/doc/admin24/syncrepl.html for "
-#~ "details."
-#~ msgstr ""
-#~ "Konverteringen från slurpd till det frågebaserade syncrepl-protokollet "
-#~ "kan inte göras automatiskt och du kommer behöva konfigurera dina replica-"
-#~ "servrar för hand. Se http://www.openldap.org/doc/admin24/syncrepl.html "
-#~ "för detaljer."
-
-#~ msgid "TLSCipherSuite values have changed"
-#~ msgstr "Värden på TLSCipherSuite har ändrats"
-
-#~ msgid ""
-#~ "A \"TLSCipherSuite\" option was found in your slapd config when "
-#~ "upgrading. The values allowed for this option are determined by the SSL "
-#~ "implementation used, which has been changed from OpenSSL to GnuTLS.  As a "
-#~ "result, your existing TLSCipherSuite setting will not work with this "
-#~ "package."
-#~ msgstr ""
-#~ "Ett \"TLSCipherSuite\"-val hittades i din slapd-konfiguration vid "
-#~ "uppgraderingen. De värden som tillåts för detta val avgörs av den SSL-"
-#~ "implementation som används och detta har ändrats från OpenSSL till "
-#~ "GnuTLS. Som en följd av detta kommer inte din befintliga TLSCipherSuite-"
-#~ "inställning att fungera med det här paketet."
-
-#~ msgid ""
-#~ "This setting has been automatically commented out for you.  If you have "
-#~ "specific encryption needs that require this option to be re-enabled, see "
-#~ "the output of 'gnutls-cli -l' in the gnutls-bin package for the list of "
-#~ "ciphers supported by GnuTLS."
-#~ msgstr ""
-#~ "Den inställning har automatiskt kommenterats ut åt dig. Om du har "
-#~ "särskilda krypteringsbehov som kräver att detta val återaktiveras, se "
-#~ "utdatat från \"gnutls-cli -l\" i gnutls-bin-paketet för en lista över "
-#~ "krypton som stöds av GnuTLS."
-
-#~ msgid "Back up current database and create a new one?"
-#~ msgstr "Säkerhetskopiera aktuell databas och skapa en ny?"
-
-#~ msgid ""
-#~ "The directory suffix (domain) you specified doesn't match the one "
-#~ "currently in /etc/ldap/slapd.conf. Changing the directory suffix requires "
-#~ "moving aside the current LDAP database and creating a new one. Please "
-#~ "confirm whether you want to back up and abandon the current database."
-#~ msgstr ""
-#~ "Katalogsuffixet (domänen) du angett matchar inte den som för tillfället "
-#~ "anges i /etc/ldap/slapd.conf. Om du ändrar katalogsuffixet krävs att du "
-#~ "flyttar den nuvarande LDAP-databasen å sidan och skapar en ny. Bekräfta "
-#~ "att du vill säkerhetskopiera och överge den nuvarande databasen."
-
-#~ msgid "Change backend type from LDBM to BDB?"
-#~ msgstr "Ändra bakändstyp från LDBM till BDB?"
-
-#~ msgid ""
-#~ "The LDBM backend type has serious stability problems and has been "
-#~ "deprecated by OpenLDAP as of 2.2. It is no longer supported by the "
-#~ "OpenLDAP packages."
-#~ msgstr ""
-#~ "LDBM-bakändstypen har allvarliga stabilitetsproblem och har blivit "
-#~ "utdaterad av OpenLDAP från och med 2.2. Den stöds inte längre av OpenLDAP-"
-#~ "paketen."
-
-#~ msgid ""
-#~ "When the BDB backend is used, it must be configured properly. For more "
-#~ "information, see /usr/share/doc/slapd/README.DB_CONFIG.gz."
-#~ msgstr ""
-#~ "När BDB-bakändan används, måste den konfigureras ordentligt. För mer "
-#~ "information, se /usr/share/doc/slapd/README.DB_CONFIG.gz."
-
-#~ msgid ""
-#~ "If you enable this option, an attempt will be made to update the "
-#~ "configuration to use BDB instead of LDBM and convert the databases. If "
-#~ "you do not enable this option, the upgrade will be aborted."
-#~ msgstr ""
-#~ "Om du aktiverar detta val, kommer ett försök göras att uppdatera "
-#~ "konfigurationen till att använda BDB istället för LDBM och konvertera "
-#~ "databaserna. Om du inte aktiverar detta val, kommer uppgraderingen att "
-#~ "avbrytas."
+"För mer information om möjliga problemscenarier och hur dessa ska åtgärdas "
+"läs i filen README.Debian (i /usr/share/doc/slapd)."
diff --git a/debian/rules b/debian/rules
index 3fab06f..205241d 100755
--- a/debian/rules
+++ b/debian/rules
@@ -11,7 +11,7 @@ export DEB_CFLAGS_MAINT_APPEND := -Wall -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE
 export DEB_BUILD_MAINT_OPTIONS := hardening=+all
 
 # Expose maintainer address to build/mkversion (see debian/patches/set-maintainer-name)
-export DEB_MAINTAINER := $(shell sed -ne 's/Maintainer:\s\+//p' debian/control)
+export DEB_MAINTAINER := $(shell sed -ne 's/^Maintainer:\s\+//p' debian/control)
 
 # Expose DEB_VERSION to build/version.sh (see debian/patches/debian-version)
 export DEB_VERSION
@@ -27,7 +27,7 @@ ifneq ($(filter pkg.openldap.noslapd,$(DEB_BUILD_PROFILES)),)
 	CONFIG += --disable-slapd
 endif
 
-CONTRIB_MODULES = autogroup lastbind passwd passwd/pbkdf2 passwd/sha2 smbk5pwd
+CONTRIB_MODULES = autogroup lastbind passwd passwd/pbkdf2 passwd/sha2 ppm smbk5pwd
 
 # Ensure CC is set correctly for cross builds, unless it has already
 # been set explicitly.
@@ -134,8 +134,7 @@ override_dh_fixperms-arch:
 endif
 
 override_dh_strip:
-	dh_strip -pslapd --dbgsym-migration='slapd-dbg (<< 2.4.45+dfsg-1~)'
-	dh_strip --remaining-packages
+	dh_strip
 ifeq ($(filter pkg.openldap.noslapd,$(DEB_BUILD_PROFILES)),)
 	# hardlink these so not confined by apparmor; do this here and not
 	# in dh_link so that dh_strip doesn't get confused and put the wrong
diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml
new file mode 100644
index 0000000..33c3a64
--- /dev/null
+++ b/debian/salsa-ci.yml
@@ -0,0 +1,4 @@
+---
+include:
+  - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
+  - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml
diff --git a/debian/slapd-contrib.examples b/debian/slapd-contrib.examples
index 2db0324..f694504 100644
--- a/debian/slapd-contrib.examples
+++ b/debian/slapd-contrib.examples
@@ -1,2 +1,3 @@
 contrib/slapd-modules/passwd/apr1-atol.pl
 contrib/slapd-modules/passwd/apr1-ltoa.pl
+contrib/slapd-modules/ppm/ppm.example
diff --git a/debian/slapd-contrib.install b/debian/slapd-contrib.install
index 20c9ac0..430db45 100644
--- a/debian/slapd-contrib.install
+++ b/debian/slapd-contrib.install
@@ -1,3 +1,4 @@
+usr/lib/ldap/ppm.so
 usr/lib/ldap/pw-apr1.so*
 usr/lib/ldap/pw-apr1.la
 usr/lib/ldap/pw-netscape.so*
@@ -6,3 +7,4 @@ usr/lib/ldap/pw-pbkdf2.so*
 usr/lib/ldap/pw-pbkdf2.la
 usr/lib/ldap/smbk5pwd.so*
 usr/lib/ldap/smbk5pwd.la
+usr/lib/ldap/nestgroup.so*
diff --git a/debian/slapd-contrib.manpages b/debian/slapd-contrib.manpages
index 7d06ecf..09fb002 100644
--- a/debian/slapd-contrib.manpages
+++ b/debian/slapd-contrib.manpages
@@ -1,3 +1,6 @@
 usr/share/man/man5/slapd-pw-pbkdf2.5
 usr/share/man/man5/slapd-pw-sha2.5
+usr/share/man/man5/slapm-ppm.5
 usr/share/man/man5/slapo-smbk5pwd.5
+usr/share/man/man5/slapo-autogroup.5
+usr/share/man/man5/slapo-nestgroup.5