11 files changed, 123 insertions, 68 deletions
diff --git a/debian/changelog b/debian/changelog
index 154100a..106c9f9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,25 @@
+samba (2:4.20.1+dfsg-1) unstable; urgency=medium
+
+  * new upstream major release
+  * d/control: bump tevent/talloc/tdb versions for Build-Depends
+  * d/libldb2.symbols, d/python3-ldb.symbols.in: add new version (2.9.0)
+  * d/patches/meaningful-error-if-no-python3-markdown.patch: fixup
+  * d/*.install: internal library names changed:
+    libfoo-samba4.so.0 => libfoo-private-samba.so.0
+  * d/samba-libs.install: update names for libdcerpc & libndr private libs
+  * d/samba-libs.install, d/samba-libs.links, d/samba-libs.symbols:
+    libndr has soversion 4 now.  This breaks binaries linked with libndr!
+  * d/samba-libs.symbols: update with new ndr4 symbols
+  * d/libsmbclient.symbols: update with new symbols
+  * d/samba-dev.install: add smb3posix.h
+  * d/not-installed: add usr/bin/wspsearch experimental windows search binary
+  * d/control: libperl-json is not needed for build anymore
+  * d/control: bump minimum mit-krb5 version in Build-Depends to 1.21
+    (for pkg.samba.mitkrb5 build profile)
+  * Closes: #1070335 (wronly filed)
+
+ -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 08 May 2024 13:23:57 +0300
+
 samba (2:4.20.0+dfsg-1~exp2~progress7.99u1) graograman-backports; urgency=medium
 
   * Uploading to graograman-backports, remaining changes:
@@ -12,16 +34,6 @@ samba (2:4.20.0+dfsg-1~exp2~progress7.99u1) graograman-backports; urgency=medium
 
  -- Daniel Baumann <daniel.baumann@progress-linux.org>  Fri, 19 Apr 2024 19:31:37 +0200
 
-samba (2:4.20.0+dfsg-1~exp2) experimental; urgency=medium
-
-  * implement pkg.samba.before-trixie build profile
-    (undo t64 changhes and drop build-dep)
-  * d/rules: remove Debian/Ubuntu "branding", no need in that
-  * d/control: samba-dsdb-modules: drop hardcoded dependency on libgpgme11
-    (Closes: #1068526)
-
- -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 07 Apr 2024 16:04:30 +0300
-
 samba (2:4.20.0+dfsg-1~exp1~progress7.99u1) graograman-backports; urgency=medium
 
   * Initial reupload to graograman-backports.
@@ -34,27 +46,56 @@ samba (2:4.20.0+dfsg-1~exp1~progress7.99u1) graograman-backports; urgency=medium
 
  -- Daniel Baumann <daniel.baumann@progress-linux.org>  Fri, 19 Apr 2024 19:28:21 +0200
 
-samba (2:4.20.0+dfsg-1~exp1) experimental; urgency=medium
+samba (2:4.19.6+dfsg-3) unstable; urgency=medium
 
-  * new upstream release (4.20.0)
-  * d/control: bump tevent/talloc/tdb versions for Build-Depends
-  * d/libldb2.symbols, d/python3-ldb.symbols.in: add new version (2.9.0)
-  * d/patches/meaningful-error-if-no-python3-markdown.patch: fixup
-  * d/*.install: internal library names changed:
-    libfoo-samba4.so.0 => libfoo-private-samba.so.0
-  * d/samba-libs.install: update names for libdcerpc & libndr private libs
-  * d/samba-libs.install, d/samba-libs.links, d/samba-libs.symbols:
-    libndr has soversion 4 now.  This breaks binaries linked with libndr!
-  * d/samba-libs.symbols: update with new ndr4 symbols
-  * d/libsmbclient.symbols: update with new symbols
-  * d/samba-dev.install: add smb3posix.h
-  * d/not-installed: add usr/bin/wspsearch experimental windows search binary
-  * d/control: libperl-json is not needed for build anymore
-  * d/control: bump minimum mit-krb5 version in Build-Depends to 1.21
-    (for pkg.samba.mitkrb5 build profile)
-  * rebase on top of 4.19.5+dfsg-4
+  * fix brown-paper-bag bugs in previous upload
+    (in meaningful-error-if-no-python3-markdown.patch)
+
+ -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 02 May 2024 20:47:15 +0300
+
+samba (2:4.19.6+dfsg-2) unstable; urgency=medium
+
+  [ Michael Tokarev ]
+  * meaningful-error-if-no-python3-markdown.patch:
+    update to include 2 other places where markdown gets improted
+  * d/winbind.service:
+    - order it before nss-user-lookup.target (Closes: #1068649)
+    - fix typo
+    - nmb.service is nmbd.service in debian
+  * move include/samba/core/*.h from samba-libs to libwbclient-dev
+    (Closes: #1064544)
+
+  [ Alex Murray ]
+  * fix smbd apparmor breakage since change to local systemd services
+    (Cloes: #1069661)
+
+ -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 02 May 2024 14:08:31 +0300
+
+samba (2:4.19.6+dfsg-1) unstable; urgency=medium
+
+  * new upstream stable/bugfix release:
+   - https://bugzilla.samba.org/show_bug.cgi?id=15527 fd_handle_destructor()
+     panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close()
+   - https://bugzilla.samba.org/show_bug.cgi?id=15580
+     Packet marshalling push support missing for
+     CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and CTDB_CONTROL_TCP_CLIENT_PASSED
+   - https://bugzilla.samba.org/show_bug.cgi?id=15588
+     samba-gpupdate: Correctly implement site support
+   - https://bugzilla.samba.org/show_bug.cgi?id=15599
+     libgpo: Segfault in python bindings
+  * revert d/rules: remove Debian/Ubuntu "branding"
+
+ -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 08 Apr 2024 11:18:38 +0300
+
+samba (2:4.19.5+dfsg-5) unstable; urgency=medium
 
- -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 28 Mar 2024 10:51:16 +0300
+  * implement pkg.samba.before-trixie build profile
+    (undo t64 changhes and drop build-dep)
+  * d/rules: remove Debian/Ubuntu "branding", no need in that
+  * d/control: samba-dsdb-modules: drop hardcoded dependency on libgpgme11
+    (Closes: #1068526)
+
+ -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 07 Apr 2024 16:04:30 +0300
 
 samba (2:4.19.5+dfsg-4) unstable; urgency=medium
 
diff --git a/debian/control b/debian/control
index d8f48f4..b22e64c 100644
--- a/debian/control
+++ b/debian/control
@@ -227,7 +227,8 @@ Package: samba-ad-provision
 Architecture: all
 Multi-Arch: foreign
 Pre-Depends: ${misc:Pre-Depends}
-Depends: ${misc:Depends}
+Depends: ${misc:Depends},
+ python3-markdown,
 Replaces: samba (<< 2:4.17.3+dfsg-4~)
 Breaks:   samba (<< 2:4.17.3+dfsg-4~)
 Description: Samba files needed for AD domain provision
@@ -514,8 +515,9 @@ Section: libdevel
 Architecture: any
 Multi-Arch: same
 Depends: libwbclient0 (= ${binary:Version}), ${misc:Depends}
-Breaks: samba-libs (<< 2:4.11.0+dfsg-1~), samba-dev (<< 2:4.11)
-Replaces: samba-dev (<< 2:4.11)
+# include/samba-4.0/core/*.h moved from samba-dev in 4.19.6+dfsg-2
+Breaks:   samba-dev (<< 2:4.19.6+dfsg-2~)
+Replaces: samba-dev (<< 2:4.19.6+dfsg-2~)
 Description: Samba winbind client library - development files
  Samba is an implementation of the SMB/CIFS protocol for Unix systems,
  providing support for cross-platform file and printer sharing with
diff --git a/debian/gbp.conf b/debian/gbp.conf
index 202ced2..3dd9657 100644
--- a/debian/gbp.conf
+++ b/debian/gbp.conf
@@ -2,4 +2,3 @@
 sign-tags = True
 pristine-tar = True
 upstream-branch = upstream_4.20
-debian-branch = experimental
diff --git a/debian/libwbclient-dev.install b/debian/libwbclient-dev.install
index cab0e5e..35af5b0 100644
--- a/debian/libwbclient-dev.install
+++ b/debian/libwbclient-dev.install
@@ -1,3 +1,4 @@
+usr/include/samba-4.0/core/*.h
 usr/include/samba-4.0/wbclient.h
 usr/lib/*/libwbclient.so
 usr/lib/*/pkgconfig/samba-util.pc
diff --git a/debian/patches/meaningful-error-if-no-python3-markdown.patch b/debian/patches/meaningful-error-if-no-python3-markdown.patch
index 80ffd73..da085f9 100644
--- a/debian/patches/meaningful-error-if-no-python3-markdown.patch
+++ b/debian/patches/meaningful-error-if-no-python3-markdown.patch
@@ -1,14 +1,10 @@
 From: Michael Tokarev <mjt@tls.msk.ru>
 Date: Fri, 2 Dec 2022 11:08:27 +0300
-Updated: Thu, 03 Aug 2023 17:10:59 +0300
+Updated: Mon, 08 Apr 2024 14:14:38 +0300
 Subject: print meaningful error message if python3-markdown is not installed
 Debian-Specific: yes
 Forwarded: not-needed
 
----
- python/samba/netcmd/domain/schemaupgrade.py | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
 diff --git a/python/samba/netcmd/domain/schemaupgrade.py b/python/samba/netcmd/domain/schemaupgrade.py
 index 1d67ab58c15..858802635a2 100644
 --- a/python/samba/netcmd/domain/schemaupgrade.py
@@ -22,3 +18,37 @@ index 1d67ab58c15..858802635a2 100644
 +            raise CommandError('Failed to import module markdown, please install python3-markdown package')
          from samba.schema import Schema
  
+diff --git a/python/samba/ms_forest_updates_markdown.py b/python/samba/ms_forest_updates_markdown.py
+index 0a0d2111a72..a5ef6ec7279 100644
+--- a/python/samba/ms_forest_updates_markdown.py
++++ b/python/samba/ms_forest_updates_markdown.py
+@@ -24,7 +24,11 @@
+ 
+ import re
+ import os
+-import markdown
++try:
++    import markdown
++except ImportError as e:
++    e.add_note('Please install python3-markdown package')
++    raise
+ import xml.etree.ElementTree as ET
+ from samba.common import get_string
+ 
+diff --git a/python/samba/ms_schema_markdown.py b/python/samba/ms_schema_markdown.py
+index 8a9ad78b870..9af9406081b 100644
+--- a/python/samba/ms_schema_markdown.py
++++ b/python/samba/ms_schema_markdown.py
+@@ -22,7 +22,11 @@
+ 
+ import re
+ import os
+-import markdown
++try:
++    import markdown
++except ImportError as e:
++    e.add_note('Please install python3-markdown package')
++    raise
+ import xml.etree.ElementTree as ET
+ 
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 4c13d2d..b06c91a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -5,7 +5,6 @@ smbclient-pager.patch
 usershare.patch
 heimdal-rfc3454.txt
 add-so-version-to-private-libraries
-smbd.service-Run-update-apparmor-samba-profile-befor.patch
 fix-nfs-service-name-to-nfs-kernel-server.patch
 ctdb-config-enable-syslog-by-default.patch
 Force-LDB-as-standalone.patch
diff --git a/debian/patches/smbd.service-Run-update-apparmor-samba-profile-befor.patch b/debian/patches/smbd.service-Run-update-apparmor-samba-profile-befor.patch
deleted file mode 100644
index c5a64dc..0000000
--- a/debian/patches/smbd.service-Run-update-apparmor-samba-profile-befor.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 0ecd28ff3fd7f3d5c20705a2b8233fc8648cbf9c Mon Sep 17 00:00:00 2001
-From: Mathieu Parent <math.parent@gmail.com>
-Date: Thu, 21 Feb 2019 21:04:30 +0100
-Subject: [PATCH] smbd.service: Run update-apparmor-samba-profile before start
-
-Bug-Debian: https://bugs.debian.org/896080
----
- packaging/systemd/smb.service.in | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/packaging/systemd/smb.service.in b/packaging/systemd/smb.service.in
-index 18912ef0e98..6bb24861682 100644
---- a/packaging/systemd/smb.service.in
-+++ b/packaging/systemd/smb.service.in
-@@ -10,6 +10,7 @@ NotifyAccess=all
- PIDFile=@PIDDIR@/smbd.pid
- LimitNOFILE=16384
- EnvironmentFile=-@SYSCONFDIR@/sysconfig/samba
-+ExecStartPre=/usr/share/samba/update-apparmor-samba-profile
- ExecStart=@SBINDIR@/smbd --foreground --no-process-group $SMBDOPTIONS
- ExecReload=/bin/kill -HUP $MAINPID
- LimitCORE=infinity
--- 
-2.20.1
-
diff --git a/debian/rules b/debian/rules
index 9fd250e..bd00724 100755
--- a/debian/rules
+++ b/debian/rules
@@ -122,7 +122,7 @@ config-args += $(if ${with-ceph},\
 	  --enable-cephfs --enable-ceph-reclock,\
 	  --disable-cephfs)
 
-# we had t64 transition (libsmbclient => libsmbclient0) before trixie
+# we had t64 transition (libsmbclient => libsmbclient0) for trixie
 ifneq (,$(filter pkg.samba.before-trixie, ${DEB_BUILD_PROFILES}))
 libsmbclient := libsmbclient
 else
@@ -162,6 +162,12 @@ install install-arch install-indep: %:
 configure: bin/configured.stamp
 .PHONY: configure
 bin/configured.stamp:
+# branding
+	if [ ! -f VERSION.orig ]; then \
+	  mv VERSION VERSION.orig; \
+	  sed -r -e 's/^(SAMBA_VERSION_VENDOR_SUFFIX).*/\1=${DEB_VENDOR}/' \
+		VERSION.orig > VERSION; \
+	fi
 	CC="${CC}" CPP="${CPP}" LD="${LD}" PKGCONFIG="${PKG_CONFIG}" \
 	CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" \
 	PYTHON=python3 PYTHON_CONFIG=${DEB_HOST_MULTIARCH}-python3-config \
@@ -393,6 +399,7 @@ endif
 clean:
 	# see also debian/clean
 	dh_clean bin/ testbuild/
+	[ ! -f VERSION.orig ] || mv -f VERSION.orig VERSION
 ifneq (,${with_mitkrb5})
 	[ ! -d third_party/heimdal-build-with-mitkrb5 ] || \
 		mv third_party/heimdal-build-with-mitkrb5 third_party/heimdal
diff --git a/debian/samba-dev.install b/debian/samba-dev.install
index 7cf8e30..ed8a06b 100644
--- a/debian/samba-dev.install
+++ b/debian/samba-dev.install
@@ -3,7 +3,6 @@
 # wbclient.h: libwbclient-dev
 # ldb*.h (except ldb_wrap.h): libldb-dev
 usr/include/samba-4.0/charset.h
-usr/include/samba-4.0/core/*.h
 usr/include/samba-4.0/credentials.h
 usr/include/samba-4.0/dcerpc.h
 usr/include/samba-4.0/dcerpc_server.h
diff --git a/debian/samba.smbd.service b/debian/samba.smbd.service
index 57d8f75..a5b7929 100644
--- a/debian/samba.smbd.service
+++ b/debian/samba.smbd.service
@@ -9,6 +9,7 @@ Type=notify
 PIDFile=/run/samba/smbd.pid
 LimitNOFILE=16384
 EnvironmentFile=-/etc/default/samba
+ExecStartPre=/usr/share/samba/update-apparmor-samba-profile
 ExecStart=/usr/sbin/smbd --foreground --no-process-group $SMBDOPTIONS
 ExecReload=/bin/kill -HUP $MAINPID
 LimitCORE=infinity
diff --git a/debian/winbind.service b/debian/winbind.service
index 190c868..5b009a4 100644
--- a/debian/winbind.service
+++ b/debian/winbind.service
@@ -1,11 +1,12 @@
 [Unit]
 Description=Samba Winbind Daemon
 Documentation=man:winbindd(8) man:samba(7) man:smb.conf(5)
-After=network.target nmb.service
+After=network.target nmbd.service
+Before=nss-user-lookup.target
 
 [Service]
 Type=notify
-PIDFile=/ruin/samba/winbindd.pid
+PIDFile=/run/samba/winbindd.pid
 EnvironmentFile=-/etc/default/samba
 ExecStart=/usr/sbin/winbindd --foreground --no-process-group $WINBINDOPTIONS
 ExecReload=/bin/kill -HUP $MAINPID