Re: [PR PATCH] [Updated] openldap: update to 2.6.3

[klarasm <klarasm@users.noreply.github.com>]

[-- Attachment #1: Type: text/plain, Size: 2384 bytes --]

There is an updated pull request by klarasm against master on the void-packages repository

https://github.com/klarasm/void-packages openldap-2.6
https://github.com/void-linux/void-packages/pull/41948

openldap: update to 2.6.3
The 2.4 branch is not maintained anymore and I don't know if there's much advantage to going to 2.5 instead of 2.6

Some shared libraries have changed name so this updates common/shlibs.

It builds and the test suite is ok on x86_64-glibc but fails on x86_64-musl (if I remember correctly from earlier testing the 2.5 branch had the same test suite error).
[openldap-2.6.3-test079.log](https://github.com/void-linux/void-packages/files/10530843/openldap-2.6.3-test079.log)
[openldap-2.6.3-no-tests.log](https://github.com/void-linux/void-packages/files/10530903/openldap-2.6.3-no-tests.log)
[openldap-2.6.3-all-tests.log](https://github.com/void-linux/void-packages/files/10530929/openldap-2.6.3-all-tests.log)

It seems that test 79 also fails on alpine: https://git.alpinelinux.org/aports/tree/main/openldap/APKBUILD#n227
I'll have to look closer into the specific test and why it fails, but if it's not critical it may be ok to ignore it.

The rest of the test suite does not seem to be a problem.

As this is a major update the ldap database should be backed up and recreated as per https://www.openldap.org/doc/admin26/maintenance.html

#### Testing the changes
- I tested the changes in this PR: in progress

I have upgraded my ldap setup to this version. It's not very complicated so may not be great for coverage.
Basically:
- two nodes, with normal syncrepl and gssapi/kerberos for authentication
- the ldap directory is used as database backend for my kerberos setup
- I have a few machines setup with kerberos for authentication and ldap as id provider (some with sssd and some with nslcd)

So far it seems promising but will test more. I would appreciate if anyone else could test as well.

I have probably missed packages that need to be revbumped so please point them out in that case.

<!--
#### Local build testing
- I built this PR locally for my native architecture, (ARCH-LIBC)
- I built this PR locally for these architectures (if supported. mark crossbuilds):
  - aarch64-musl
  - armv7l
  - armv6l-musl
-->

A patch file from https://github.com/void-linux/void-packages/pull/41948.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-openldap-2.6-41948.patch --]
[-- Type: text/x-diff, Size: 10580 bytes --]

From 5bf4f910cb1bc058a59f0c1bd8e94a32ac1b1e65 Mon Sep 17 00:00:00 2001
From: Klara Modin <klarasmodin@gmail.com>
Date: Wed, 2 Nov 2022 21:04:46 +0100
Subject: [PATCH 1/3] openldap: update to 2.6.3

- update common/shlibs
- add slapd.ldif to conf_files
- add more options to runit service
- add patch fixing test079 on musl (for some reason arguments are
  ignored if placed after the filter)
---
 common/shlibs                                 |   5 +-
 srcpkgs/openldap/files/slapd/run              |   2 +-
 .../fix-test079-musl-ignored-params.patch     | 106 ++++++++++++++++++
 srcpkgs/openldap/template                     |   8 +-
 4 files changed, 113 insertions(+), 8 deletions(-)
 create mode 100644 srcpkgs/openldap/patches/fix-test079-musl-ignored-params.patch

diff --git a/common/shlibs b/common/shlibs
index 523fd15af734..90b250132d4f 100644
--- a/common/shlibs
+++ b/common/shlibs
@@ -700,9 +700,8 @@ libgnome-bluetooth.so.13 gnome-bluetooth1-3.12.0_1
 libgnome-bluetooth-3.0.so.13 gnome-bluetooth-42.1_1
 libgnome-bluetooth-ui-3.0.so.13 gnome-bluetooth-42.1_1
 libsasl2.so.3 libsasl-2.1.26_1
-liblber-2.4.so.2 libldap-2.4.21_1
-libldap-2.4.so.2 libldap-2.4.21_1
-libldap_r-2.4.so.2 libldap-2.4.21_1
+liblber.so.2 libldap-2.6.3_1
+libldap.so.2 libldap-2.6.3_1
 libevent-2.1.so.7 libevent-2.1.11_1
 libevent_core-2.1.so.7 libevent-2.1.11_1
 libevent_extra-2.1.so.7 libevent-2.1.11_1
diff --git a/srcpkgs/openldap/files/slapd/run b/srcpkgs/openldap/files/slapd/run
index f7addfcbeea3..4fa2253b1825 100644
--- a/srcpkgs/openldap/files/slapd/run
+++ b/srcpkgs/openldap/files/slapd/run
@@ -7,4 +7,4 @@ if [ ! -d /run/openldap ]; then
 	chown $LDAPUSER:$LDAPGROUP /run/openldap
 fi
 exec 2>&1
-exec slapd -u $LDAPUSER -g $LDAPGROUP -d 0
+exec slapd -u $LDAPUSER -g $LDAPGROUP -d 0 ${LDAPURLS:+-h "$LDAPURLS"} $LDAPOPTS
diff --git a/srcpkgs/openldap/patches/fix-test079-musl-ignored-params.patch b/srcpkgs/openldap/patches/fix-test079-musl-ignored-params.patch
new file mode 100644
index 000000000000..8ba1832901c8
--- /dev/null
+++ b/srcpkgs/openldap/patches/fix-test079-musl-ignored-params.patch
@@ -0,0 +1,106 @@
+--- a/tests/scripts/test079-proxy-timeout	2023-01-31 23:37:19.378324038 +0100
++++ b/tests/scripts/test079-proxy-timeout	2023-01-31 23:47:25.289052240 +0100
+@@ -139,10 +139,10 @@
+ 
+ echo "Checking that proxy has created connections towards backend (time_t now=`date +%s`)"
+ 
+-$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
++$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL \
+         -D "cn=Manager,dc=local,dc=com" \
+         -H $URI2 \
+-        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
++        -w $PASSWD olmDbConnURI 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+ RC=$?
+ if test $RC != 0 ; then
+     echo "Error: LDAP connection to remote LDAP server is not found ($RC)"
+@@ -150,10 +150,10 @@
+     exit $RC
+ fi
+ 
+-$LDAPSEARCH -b "cn=Connections,cn=database 3,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
++$LDAPSEARCH -b "cn=Connections,cn=database 3,cn=databases,cn=monitor" -s one -LLL \
+         -D "cn=Manager,dc=local,dc=com" \
+         -H $URI2 \
+-        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
++        -w $PASSWD olmDbConnURI 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+ RC=$?
+ if test $RC != 0 ; then
+     echo "Error: LDAP connection to remote LDAP server is not found ($RC)"
+@@ -171,10 +171,10 @@
+ 
+ echo "Checking that proxy has closed expired connections towards the remote LDAP server (time_t now=`date +%s`)"
+ 
+-$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
++$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL \
+         -D "cn=Manager,dc=local,dc=com" \
+         -H $URI2 \
+-        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
++        -w $PASSWD olmDbConnURI 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+ RC=$?
+ if test $RC != 1 ; then
+     echo "Error: LDAP connection to remote LDAP server was not closed"
+@@ -182,10 +182,10 @@
+     exit $RC
+ fi
+ 
+-$LDAPSEARCH -b "cn=Connections,cn=database 3,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
++$LDAPSEARCH -b "cn=Connections,cn=database 3,cn=databases,cn=monitor" -s one -LLL \
+         -D "cn=Manager,dc=local,dc=com" \
+         -H $URI2 \
+-        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
++        -w $PASSWD olmDbConnURI 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+ RC=$?
+ if test $RC != 1 ; then
+     echo "Error: LDAP connection to remote LDAP server was not closed"
+@@ -235,10 +235,10 @@
+ 
+ echo "Checking that proxy has created connections towards backend (time_t now=`date +%s`)"
+ 
+-$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
++$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL \
+         -D "cn=Manager,dc=local,dc=com" \
+         -H $URI2 \
+-        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
++        -w $PASSWD olmDbConnURI 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+ RC=$?
+ if test $RC != 0 ; then
+     echo "Error: LDAP connection to remote LDAP server is not found ($RC)"
+@@ -246,10 +246,10 @@
+     exit $RC
+ fi
+ 
+-$LDAPSEARCH -b "cn=Connections,cn=database 3,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
++$LDAPSEARCH -b "cn=Connections,cn=database 3,cn=databases,cn=monitor" -s one -LLL \
+         -D "cn=Manager,dc=local,dc=com" \
+         -H $URI2 \
+-        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
++        -w $PASSWD olmDbConnURI 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+ RC=$?
+ if test $RC != 0 ; then
+     echo "Error: LDAP connection to remote LDAP server is not found ($RC)"
+@@ -339,10 +339,10 @@
+ NOW=`date +%s`
+ sleep `expr $CONN_EXPIRES - $NOW - 2`
+ echo "Check that connection is still alive due to idle-timeout reset (time_t now=`date +%s`)"
+-$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
++$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL \
+         -D "cn=Manager,dc=local,dc=com" \
+         -H $URI2 \
+-        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
++        -w $PASSWD olmDbConnURI 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+ RC=$?
+ if test $RC != 0 ; then
+     echo "Error: LDAP connection to remote LDAP server is not found ($RC)"
+@@ -354,10 +354,10 @@
+ NOW=`date +%s`
+ sleep `expr $CONN_EXPIRES - $NOW + 2`
+ echo "Check that connection is closed after extended idle-timeout has passed (time_t now=`date +%s`)"
+-$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
++$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL \
+         -D "cn=Manager,dc=local,dc=com" \
+         -H $URI2 \
+-        -w $PASSWD  2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
++        -w $PASSWD  olmDbConnURI 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+ RC=$?
+ if test $RC != 1 ; then
+     echo "Error: LDAP connection to remote LDAP server was not closed"
diff --git a/srcpkgs/openldap/template b/srcpkgs/openldap/template
index 85fe79d77d1e..30d2d9893cb8 100644
--- a/srcpkgs/openldap/template
+++ b/srcpkgs/openldap/template
@@ -1,6 +1,6 @@
 # Template file for 'openldap'
 pkgname=openldap
-version=2.4.58
+version=2.6.3
 revision=1
 build_style=gnu-configure
 configure_args="--prefix=/usr
@@ -16,13 +16,13 @@ configure_args="--prefix=/usr
 hostmakedepends="pkg-config groff"
 makedepends="openssl-devel libsasl-devel db-devel libltdl-devel"
 depends="openldap-tools>=${version}_${revision}"
-conf_files="/etc/openldap/ldap.conf /etc/openldap/slapd.conf"
+conf_files="/etc/openldap/ldap.conf /etc/openldap/slapd.conf /etc/openldap/slapd.ldif"
 short_desc="OpenLDAP (Lightweight Directory Access Protocol)"
 maintainer="Orphaned <orphan@voidlinux.org>"
 license="OLDAP-2.0"
 homepage="http://www.openldap.org"
 distfiles="https://www.openldap.org/software/download/OpenLDAP/openldap-release/openldap-${version}.tgz"
-checksum=57b59254be15d0bf6a9ab3d514c1c05777b02123291533134a87c94468f8f47b
+checksum=d2a2a1d71df3d77396b1c16ad7502e674df446e06072b0e5a4e941c3d06c0d46
 
 system_accounts="ldap"
 ldap_homedir="/var/lib/openldap"
@@ -38,7 +38,7 @@ post_install() {
 	vlicense LICENSE
 	chmod 755 ${DESTDIR}/usr/lib/*.so.*
 	vmkdir usr/share/examples/openldap
-	mv ${DESTDIR}/etc/openldap/*.{example,default} ${DESTDIR}/usr/share/examples/openldap
+	mv ${DESTDIR}/etc/openldap/*.default ${DESTDIR}/usr/share/examples/openldap
 	chmod 0644 ${DESTDIR}/usr/share/examples/openldap/*
 }
 

From 62cb2f451da873ef1db6f7a2fd939f0cc1bbf150 Mon Sep 17 00:00:00 2001
From: Klara Modin <klarasmodin@gmail.com>
Date: Wed, 1 Feb 2023 00:25:36 +0100
Subject: [PATCH 2/3] cyrus-sasl: revbump due to openldap update

---
 srcpkgs/cyrus-sasl/template | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/srcpkgs/cyrus-sasl/template b/srcpkgs/cyrus-sasl/template
index b259152139fd..d9646ed8a642 100644
--- a/srcpkgs/cyrus-sasl/template
+++ b/srcpkgs/cyrus-sasl/template
@@ -1,7 +1,7 @@
 # Template file for 'cyrus-sasl'
 pkgname=cyrus-sasl
 version=2.1.27
-revision=9
+revision=10
 build_style=gnu-configure
 configure_args="--disable-static --enable-shared --enable-checkapop
  --enable-cram --enable-digest --disable-otp --disable-srp

From 5d45bd3002f5798e6b03a05b1985a5bcb5372191 Mon Sep 17 00:00:00 2001
From: Klara Modin <klarasmodin@gmail.com>
Date: Wed, 1 Feb 2023 00:26:08 +0100
Subject: [PATCH 3/3] mit-krb5: revbump due to openldap update

---
 srcpkgs/mit-krb5/template | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/srcpkgs/mit-krb5/template b/srcpkgs/mit-krb5/template
index a67bae19764a..964629c5b347 100644
--- a/srcpkgs/mit-krb5/template
+++ b/srcpkgs/mit-krb5/template
@@ -3,7 +3,7 @@
 # also update srcpkgs/libgssglue/files/gssapi_mech.conf
 pkgname=mit-krb5
 version=1.18.3
-revision=2
+revision=3
 build_style=gnu-configure
 hostmakedepends="e2fsprogs-devel flex perl pkg-config"
 makedepends="e2fsprogs-devel libldap-devel"