openldap: Upgrade 2.6.13 -> 2.7.2

2.7 is the new release series; library ABI is unchanged (libldap.so.2,
liblber.so.2). It also builds the symbol version map through the
preprocessor (ITS#9739), which drops most entries for code that is not
configured in.

- back-perl and back-sql were removed upstream, drop their
  PACKAGECONFIGs.
- Refresh remove-user-host-pwd-from-version.patch for the
  LDAP_GCCATTR((unused)) attribute added in build/mkversion.
- Add a patch to guard the remaining SASL-only symbols in ldap.map.in;
  without Cyrus SASL lld fails:

  ld.lld: error: version script assignment of 'OPENLDAP_2.200' to
  symbol 'ldap_int_sasl_config' failed: symbol not defined

  This replaces the -Wl,--undefined-version workaround meta-clang
  carried for openldap.

License checksums are unchanged. Tested on qemux86-64 with clang/lld:
openldap and samba (with ldap) build.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-oe/recipes-support/openldap/openldap/0001-libldap-Only-export-SASL-symbols-when-built-with-Cyr.patch

@@ -0,0 +1,56 @@
+From 5a05f63b8a693739834069ecd7dbec66010567bc Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Sat, 7 Nov 2026 23:46:45 -0800
+Subject: [PATCH] libldap: Only export SASL symbols when built with Cyrus SASL
+
+ldap_host_connected_to(), ldap_int_sasl_config(),
+ldap_int_sasl_get_option(), ldap_int_sasl_open() and
+ldap_int_sasl_set_option() are only compiled with HAVE_CYRUS_SASL,
+but ldap.map.in lists them unconditionally. Linkers that reject
+version script entries for undefined symbols, such as lld (default
+since 17), fail to link libldap without SASL:
+
+  ld.lld: error: version script assignment of 'OPENLDAP_2.200' to
+  symbol 'ldap_int_sasl_config' failed: symbol not defined
+
+Guard them like the other SASL-only entries.
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ libraries/libldap/ldap.map.in | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/libraries/libldap/ldap.map.in b/libraries/libldap/ldap.map.in
+index 677d244..65613a3 100644
+--- a/libraries/libldap/ldap.map.in
++++ b/libraries/libldap/ldap.map.in
+@@ -140,7 +140,9 @@ OPENLDAP_2.200
+     ldap_get_message_ber;
+     ldap_get_option;
+     ldap_get_values_len;
++#ifdef HAVE_CYRUS_SASL
+     ldap_host_connected_to;
++#endif
+     ldap_init_fd;
+     ldap_initialize;
+     ldap_install_tls;
+@@ -166,12 +168,18 @@ OPENLDAP_2.200
+     ldap_int_put_controls;
+     ldap_int_sasl_bind;
+     ldap_int_sasl_close;
++#ifdef HAVE_CYRUS_SASL
+     ldap_int_sasl_config;
++#endif
+     ldap_int_sasl_external;
++#ifdef HAVE_CYRUS_SASL
+     ldap_int_sasl_get_option;
++#endif
+     ldap_int_sasl_init;
++#ifdef HAVE_CYRUS_SASL
+     ldap_int_sasl_open;
+     ldap_int_sasl_set_option;
++#endif
+     ldap_int_select;
+     ldap_int_timeval_dup;
+     ldap_int_tls_destroy;

meta-oe/recipes-support/openldap/openldap/remove-user-host-pwd-from-version.patch

@@ -6,12 +6,10 @@ Subject: [PATCH] mkversion: remove user host pwd from version
 Upstream-Status: Pending
 
 Update this patch to version 2.4.47
+Refresh for 2.7.2
 
 Signed-off-by: Changqing Li <changqing.li@windriver.com>
 ---
- build/mkversion | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
 --- a/build/mkversion
 +++ b/build/mkversion
 @@ -53,8 +53,12 @@ APPLICATION=$1
@@ -28,10 +26,10 @@ Signed-off-by: Changqing Li <changqing.li@windriver.com>
  fi
  
  cat << __EOF__
-@@ -77,7 +81,7 @@ static const char copyright[] =
+@@ -79,7 +83,7 @@ static const char copyright[] LDAP_GCCATTR((unused)) =
  "COPYING RESTRICTIONS APPLY\n";
  
- $static $const char $SYMBOL[] =
+ $static $const char $SYMBOL[] LDAP_GCCATTR((unused)) =
 -"@(#) \$$PACKAGE: $APPLICATION $VERSION (" __DATE__ " " __TIME__ ") \$\n"
 +"@(#) \$$PACKAGE: $APPLICATION $VERSION ($DATE $TIME) \$\n"
  "\t$WHOWHERE\n";

meta-oe/recipes-support/openldap/openldap_2.7.2.bb

@@ -19,9 +19,10 @@ SRC_URI = "http://www.openldap.org/software/download/OpenLDAP/openldap-release/$
     file://slapd.service \
     file://remove-user-host-pwd-from-version.patch \
     file://0001-build-top.mk-unset-STRIP_OPTS.patch \
+    file://0001-libldap-Only-export-SASL-symbols-when-built-with-Cyr.patch \
 "
 
-SRC_URI[sha256sum] = "d693b49517a42efb85a1a364a310aed16a53d428d1b46c0d31ef3fba78fcb656"
+SRC_URI[sha256sum] = "aad731aa22118ff327b9b4ddfc4b6f18ef9476586205da88a532e90940b523d2"
 
 DEPENDS = "util-linux groff-native"
 
@@ -62,7 +63,7 @@ EXTRA_OECONF += "--enable-crypt"
 # The backend must be set by the configuration.  This controls the
 # required database.
 #
-# Backends="asyncmeta dnssrv ldap mdb meta null passwd perl relay sock sql wt"
+# Backends="asyncmeta dnssrv ldap mdb meta null passwd relay sock wt"
 #
 # Note that multiple backends can be built.  The ldbm backend requires a
 # build-time choice of database API. To use the gdbm (or other) API the
@@ -91,23 +92,12 @@ PACKAGECONFIG[null] = "--enable-null=mod,--enable-null=no,"
 #--enable-passwd       enable passwd backend no|yes|mod no
 PACKAGECONFIG[passwd] = "--enable-passwd=mod,--enable-passwd=no,"
 
-#--enable-perl         enable perl backend no|yes|mod no
-#  This requires a loadable perl dynamic library, if enabled without
-#  doing something appropriate (building perl?) the build will pick
-#  up the build machine perl - not good (inherit perlnative?)
-PACKAGECONFIG[perl] = "--enable-perl=mod,--enable-perl=no,perl"
-
 #--enable-relay        enable relay backend no|yes|mod [yes]
 PACKAGECONFIG[relay] = "--enable-relay=mod,--enable-relay=no,"
 
 #--enable-sock         enable sock backend no|yes|mod [no]
 PACKAGECONFIG[sock] = "--enable-sock=mod,--enable-sock=no,"
 
-#--enable-sql          enable sql backend no|yes|mod no
-# sql requires some sql backend which provides sql.h, sqlite* provides
-# sqlite.h (which may be compatible but hasn't been tried.)
-PACKAGECONFIG[sql] = "--enable-sql=mod,--enable-sql=no,sqlite3"
-
 #--enable-wt           enable wt backend no|yes|mod no
 # back-wt is marked currently as experimental
 PACKAGECONFIG[wt] = "--enable-wt=mod,--enable-wt=no"