.gitlab-ci-main.yml

@@ -47,7 +47,7 @@ variables:
   # Set this to the contents of bootstrap/sha1sum.txt
   # which is generated by bootstrap/template.py --render
   #
-  SAMBA_CI_CONTAINER_TAG: d101907857587b6421907c45676497c336d45ea7
+  SAMBA_CI_CONTAINER_TAG: 936722ecb26bedf6ea0acd9228963ce45ed419d4
   #
   # We use the ubuntu2204 image as default as
   # it matches what we have on atb-devel-224
@@ -66,7 +66,7 @@ variables:
   SAMBA_CI_CONTAINER_IMAGE_opensuse155: opensuse155
   SAMBA_CI_CONTAINER_IMAGE_rocky8: rocky8
   SAMBA_CI_CONTAINER_IMAGE_centos9s: centos9s
-  SAMBA_CI_CONTAINER_IMAGE_fedora41: fedora41
+  SAMBA_CI_CONTAINER_IMAGE_fedora40: fedora40
 
 include:
   # The image creation details are specified in a separate file
@@ -267,13 +267,13 @@ samba-def-build:
 samba-mit-build:
   extends: .shared_template_build_only
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora41}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora40}
   stage: build_first
 
 .needs_samba-mit-build:
   extends: .shared_template_test_only
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora41}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora40}
   needs:
     - job: samba-mit-build
       artifacts: true
@@ -321,7 +321,7 @@ samba:
 samba-mitkrb5:
   extends: .shared_template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora41}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora40}
 
 samba-minimal-smbd:
   extends: .shared_template
@@ -391,7 +391,7 @@ samba-addc-mit-4b:
 samba-fips:
   extends: .shared_template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora41}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora40}
 
 samba-codecheck:
   extends: .shared_template
@@ -672,10 +672,10 @@ centos9s-samba-o3:
   variables:
     SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_centos9s}
 
-fedora41-samba-o3:
+fedora40-samba-o3:
   extends: .samba-o3-template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora41}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora40}
 
 #
 # Keep the samba-o3 sections at the end ...

bootstrap/.gitlab-ci.yml

@@ -10,7 +10,6 @@
   variables:
     SAMBA_CI_IS_BROKEN_IMAGE: "no"
     SAMBA_CI_TEST_JOB: "samba-o3"
-    SAMBA_CI_PLATFORM: "linux/amd64"
   before_script:
     # install prerequisites
     - dnf install -qy diffutils
@@ -28,7 +27,7 @@
   script: |
     set -xueo pipefail
     ci_image_name=samba-ci-${CI_JOB_NAME}
-    podman build --platform ${SAMBA_CI_PLATFORM} --tag ${ci_image_name} --build-arg SHA1SUM=${SAMBA_CI_CONTAINER_TAG} bootstrap/generated-dists/${CI_JOB_NAME}
+    podman build -t ${ci_image_name} --build-arg SHA1SUM=${SAMBA_CI_CONTAINER_TAG} bootstrap/generated-dists/${CI_JOB_NAME}
     ci_image_path="${SAMBA_CI_CONTAINER_REGISTRY}/${ci_image_name}"
     timestamp=$(date +%Y%m%d%H%M%S)
     container_hash=$(podman image inspect --format='{{ .Id }}' ${ci_image_name} | cut -c 1-9)
@@ -99,14 +98,13 @@ debian11:
 debian12:
   extends: .build_image_template
 
-fedora41:
+fedora40:
   extends: .build_image_template
 
 debian11-32bit:
   extends: .build_image_template
   variables:
     SAMBA_CI_TEST_JOB: "samba-32bit"
-    SAMBA_CI_PLATFORM: "linux/i386"
 
 rocky8:
   extends: .build_image_template

bootstrap/config.py

@@ -159,10 +159,6 @@ PKGS = [
     ('', 'python3-libsemanage'),
     ('', 'python3-policycoreutils'),
 
-    # A copy of the `crypt` module that was removed in Python 3.13
-    # See also https://bugzilla.samba.org/show_bug.cgi?id=15756
-    ('', 'python3-crypt-r'),
-
     # perl
     ('libparse-yapp-perl', 'perl-Parse-Yapp'),
     ('perl-modules', ''),
@@ -461,7 +457,7 @@ DEB_DISTS = {
         }
     },
     'debian11-32bit': {
-        'docker_image': 'debian:11',  # specify the platform in .gitlab-ci.yaml
+        'docker_image': 'registry-1.docker.io/i386/debian:11',
         'vagrant_box': 'debian/bullseye32',
         'replace': {
             'language-pack-en': '',   # included in locales
@@ -538,7 +534,6 @@ RPM_DISTS = {
             'ShellCheck': '',
             'shfmt': '',
             'codespell': '',
-            'python3-crypt-r': '',
         }
     },
     'centos9s': {
@@ -558,12 +553,11 @@ RPM_DISTS = {
             'codespell': '',
             'libcephfs-devel': '',  # not available anymore
             'curl': '',  # Use installed curl-minimal
-            'python3-crypt-r': '',
         }
     },
-    'fedora41': {
-        'docker_image': 'quay.io/fedora/fedora:41',
-        'vagrant_box': 'fedora/41-cloud-base',
+    'fedora40': {
+        'docker_image': 'quay.io/fedora/fedora:40',
+        'vagrant_box': 'fedora/40-cloud-base',
         'bootstrap': DNF_BOOTSTRAP,
         'replace': {
             'lsb-release': 'redhat-lsb',
@@ -587,7 +581,6 @@ RPM_DISTS = {
             'keyutils-libs-devel': 'keyutils-devel',
             'krb5-workstation': 'krb5-client',
             'python3-libsemanage': 'python3-semanage',
-            'python3-crypt-r': '',
             'openldap-devel': 'openldap2-devel',
             'perl-Archive-Tar': 'perl-Archive-Tar-Wrapper',
             'perl-JSON-Parse': 'perl-JSON-XS',

bootstrap/generated-dists/Vagrantfile

@@ -45,11 +45,11 @@ Vagrant.configure("2") do |config|
         v.vm.provision :shell, path: "debian12-32bit/locale.sh"
     end
 
-    config.vm.define "fedora41" do |v|
-        v.vm.box = "fedora/41-cloud-base"
-        v.vm.hostname = "fedora41"
-        v.vm.provision :shell, path: "fedora41/bootstrap.sh"
-        v.vm.provision :shell, path: "fedora41/locale.sh"
+    config.vm.define "fedora40" do |v|
+        v.vm.box = "fedora/40-cloud-base"
+        v.vm.hostname = "fedora40"
+        v.vm.provision :shell, path: "fedora40/bootstrap.sh"
+        v.vm.provision :shell, path: "fedora40/locale.sh"
     end
 
     config.vm.define "opensuse155" do |v|

bootstrap/generated-dists/debian11-32bit/Dockerfile

@@ -3,7 +3,7 @@
 # See also bootstrap/config.py
 #
 
-FROM debian:11
+FROM registry-1.docker.io/i386/debian:11
 
 # pass in with --build-arg while build
 ARG SHA1SUM

bootstrap/generated-dists/fedora40/Dockerfile

@@ -3,7 +3,7 @@
 # See also bootstrap/config.py
 #
 
-FROM quay.io/fedora/fedora:41
+FROM quay.io/fedora/fedora:40
 
 # pass in with --build-arg while build
 ARG SHA1SUM

bootstrap/generated-dists/fedora40/bootstrap.sh

@@ -92,7 +92,6 @@ dnf install -y \
     procps-ng \
     psmisc \
     python3 \
-    python3-crypt-r \
     python3-cryptography \
     python3-dateutil \
     python3-devel \

bootstrap/generated-dists/fedora40/packages.yml

@@ -81,7 +81,6 @@ packages:
   - procps-ng
   - psmisc
   - python3
-  - python3-crypt-r
   - python3-cryptography
   - python3-dateutil
   - python3-devel

bootstrap/sha1sum.txt

@@ -1 +1 @@
-d101907857587b6421907c45676497c336d45ea7
+936722ecb26bedf6ea0acd9228963ce45ed419d4

python/samba/tests/krb5/pkinit_tests.py

@@ -1493,7 +1493,8 @@ class PkInitTests(KDCBaseTest):
             x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, 'SambaState'),
             x509.NameAttribute(NameOID.ORGANIZATION_NAME, 'SambaSelfTesting'),
             x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, 'Users'),
-            x509.NameAttribute(NameOID.COMMON_NAME, f'{cert_name}'),
+            x509.NameAttribute(NameOID.COMMON_NAME,
+                               f'{cert_name}/emailAddress={cert_name}'),
         ]))
 
         # The new certificate must be issued by the root CA.

script/autobuild.py

@@ -1059,7 +1059,7 @@ tasks = {
 
         # build with all modules static
             ("allstatic-configure", "./configure.developer " + samba_configure_params + " --with-static-modules=ALL"),
-            ("allstatic-make", "nice -n 19 make -j 2"),
+            ("allstatic-make", "make -j"),
             ("allstatic-test", make_test(TESTS="samba3.smb2.create.*nt4_dc")),
             ("allstatic-lcov", LCOV_CMD),
             ("allstatic-def-check-clean-tree", CLEAN_SOURCE_TREE_CMD),
@@ -1068,7 +1068,7 @@ tasks = {
         # force all libraries as private
             ("allprivate-def-distclean", "make distclean"),
             ("allprivate-def-configure", "./configure.developer " + samba_configure_params + " --private-libraries=ALL"),
-            ("allprivate-def-make", "nice -n 19 make -j 2"),
+            ("allprivate-def-make", "make -j"),
             # note wrapper libraries need to be public
             ("allprivate-def-no-public", "ls ./bin/shared | egrep -v '^private$|lib[nprsu][saeoi][smscd].*-wrapper.so$|pam_set_items.so|pam_matrix.so' | wc -l | grep -q '^0'"),
             ("allprivate-def-only-private-ext", "ls ./bin/shared/private | egrep 'private-samba' | wc -l | grep -q '^0' && exit 1; exit 0"),
@@ -1082,7 +1082,7 @@ tasks = {
         # extension and 2 exceptions
             ("allprivate-ext-distclean", "make distclean"),
             ("allprivate-ext-configure", "./configure.developer " + samba_configure_params + " --private-libraries=ALL --private-library-extension=private-library --private-extension-exception=pac,ndr"),
-            ("allprivate-ext-make", "nice -n 19 make -j 2"),
+            ("allprivate-ext-make", "make -j"),
             # note wrapper libraries need to be public
             ("allprivate-ext-no-public", "ls ./bin/shared | egrep -v '^private$|lib[nprsu][saeoi][smscd].*-wrapper.so$|pam_set_items.so|pam_matrix.so' | wc -l | grep -q '^0'"),
             ("allprivate-ext-no-private-default-ext", "ls ./bin/shared/private | grep 'private-samba' | wc -l | grep -q '^0'"),
@@ -1097,7 +1097,7 @@ tasks = {
         # retry with nonshared smbd and smbtorture
             ("nonshared-distclean", "make distclean"),
             ("nonshared-configure", "./configure.developer " + samba_configure_params + " --bundled-libraries=ALL --with-static-modules=ALL --nonshared-binary=smbtorture,smbd/smbd"),
-            ("nonshared-make", "nice -n 19 make -j 2"),
+            ("nonshared-make", "make -j"),
             ("nonshared-test", make_test(TESTS="samba3.smb2.create.*nt4_dc")),
             ("nonshared-lcov", LCOV_CMD),
             ("nonshared-check-clean-tree", CLEAN_SOURCE_TREE_CMD),
@@ -1106,7 +1106,7 @@ tasks = {
         # retry without winbindd
             ("nonwinbind-distclean", "make distclean"),
             ("nonwinbind-configure", "./configure.developer " + samba_configure_params + " --bundled-libraries=ALL --with-static-modules=ALL --without-winbind"),
-            ("nonwinbind-make", "nice -n 19 make -j 2"),
+            ("nonwinbind-make", "make -j"),
             ("nonwinbind-test", make_test(TESTS="samba3.smb2.*.simpleserver")),
             ("nonwinbind-lcov", LCOV_CMD),
             ("nonwinbind-check-clean-tree", CLEAN_SOURCE_TREE_CMD),

selftest/selftest.pl

@@ -455,10 +455,6 @@ if ($opt_mitkrb5 == 1) {
 	$ENV{KRB5RCACHETYPE} = "none";
 }
 
-# Enable support for SHA1 in OpenSSL
-# This is required e.g. for pkinit sha1 tests
-$ENV{OPENSSL_ENABLE_SHA1_SIGNATURES} = 1;
-
 # After this many seconds, the server will self-terminate.  All tests
 # must terminate in this time, and testenv will only stay alive this
 # long