From f675973ab07cdc1f00b4a450b0b7bceedb0b6ede Mon Sep 17 00:00:00 2001 From: Khem Raj Date: Sat, 7 Nov 2026 23:59:46 -0800 Subject: [PATCH] openldap: Upgrade 2.6.13 -> 2.7.2 2.7 is the new release series; library ABI is unchanged (libldap.so.2, liblber.so.2). It also builds the symbol version map through the preprocessor (ITS#9739), which drops most entries for code that is not configured in. - back-perl and back-sql were removed upstream, drop their PACKAGECONFIGs. - Refresh remove-user-host-pwd-from-version.patch for the LDAP_GCCATTR((unused)) attribute added in build/mkversion. - Add a patch to guard the remaining SASL-only symbols in ldap.map.in; without Cyrus SASL lld fails: ld.lld: error: version script assignment of 'OPENLDAP_2.200' to symbol 'ldap_int_sasl_config' failed: symbol not defined This replaces the -Wl,--undefined-version workaround meta-clang carried for openldap. License checksums are unchanged. Tested on qemux86-64 with clang/lld: openldap and samba (with ldap) build. AI-Generated: Uses Claude Code Signed-off-by: Khem Raj --- ...ort-SASL-symbols-when-built-with-Cyr.patch | 56 +++++++++++++++++++ .../remove-user-host-pwd-from-version.patch | 8 +-- .../{openldap_2.6.13.bb => openldap_2.7.2.bb} | 16 +----- 3 files changed, 62 insertions(+), 18 deletions(-) create mode 100644 meta-oe/recipes-support/openldap/openldap/0001-libldap-Only-export-SASL-symbols-when-built-with-Cyr.patch rename meta-oe/recipes-support/openldap/{openldap_2.6.13.bb => openldap_2.7.2.bb} (92%) diff --git a/meta-oe/recipes-support/openldap/openldap/0001-libldap-Only-export-SASL-symbols-when-built-with-Cyr.patch b/meta-oe/recipes-support/openldap/openldap/0001-libldap-Only-export-SASL-symbols-when-built-with-Cyr.patch new file mode 100644 index 0000000000..307d1040ae --- /dev/null +++ b/meta-oe/recipes-support/openldap/openldap/0001-libldap-Only-export-SASL-symbols-when-built-with-Cyr.patch @@ -0,0 +1,56 @@ +From 5a05f63b8a693739834069ecd7dbec66010567bc Mon Sep 17 00:00:00 2001 +From: Khem Raj +Date: Sat, 7 Nov 2026 23:46:45 -0800 +Subject: [PATCH] libldap: Only export SASL symbols when built with Cyrus SASL + +ldap_host_connected_to(), ldap_int_sasl_config(), +ldap_int_sasl_get_option(), ldap_int_sasl_open() and +ldap_int_sasl_set_option() are only compiled with HAVE_CYRUS_SASL, +but ldap.map.in lists them unconditionally. Linkers that reject +version script entries for undefined symbols, such as lld (default +since 17), fail to link libldap without SASL: + + ld.lld: error: version script assignment of 'OPENLDAP_2.200' to + symbol 'ldap_int_sasl_config' failed: symbol not defined + +Guard them like the other SASL-only entries. + +Upstream-Status: Pending +Signed-off-by: Khem Raj +--- + libraries/libldap/ldap.map.in | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/libraries/libldap/ldap.map.in b/libraries/libldap/ldap.map.in +index 677d244..65613a3 100644 +--- a/libraries/libldap/ldap.map.in ++++ b/libraries/libldap/ldap.map.in +@@ -140,7 +140,9 @@ OPENLDAP_2.200 + ldap_get_message_ber; + ldap_get_option; + ldap_get_values_len; ++#ifdef HAVE_CYRUS_SASL + ldap_host_connected_to; ++#endif + ldap_init_fd; + ldap_initialize; + ldap_install_tls; +@@ -166,12 +168,18 @@ OPENLDAP_2.200 + ldap_int_put_controls; + ldap_int_sasl_bind; + ldap_int_sasl_close; ++#ifdef HAVE_CYRUS_SASL + ldap_int_sasl_config; ++#endif + ldap_int_sasl_external; ++#ifdef HAVE_CYRUS_SASL + ldap_int_sasl_get_option; ++#endif + ldap_int_sasl_init; ++#ifdef HAVE_CYRUS_SASL + ldap_int_sasl_open; + ldap_int_sasl_set_option; ++#endif + ldap_int_select; + ldap_int_timeval_dup; + ldap_int_tls_destroy; diff --git a/meta-oe/recipes-support/openldap/openldap/remove-user-host-pwd-from-version.patch b/meta-oe/recipes-support/openldap/openldap/remove-user-host-pwd-from-version.patch index 7a1b5aaad7..91acb9853f 100644 --- a/meta-oe/recipes-support/openldap/openldap/remove-user-host-pwd-from-version.patch +++ b/meta-oe/recipes-support/openldap/openldap/remove-user-host-pwd-from-version.patch @@ -6,12 +6,10 @@ Subject: [PATCH] mkversion: remove user host pwd from version Upstream-Status: Pending Update this patch to version 2.4.47 +Refresh for 2.7.2 Signed-off-by: Changqing Li --- - build/mkversion | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - --- a/build/mkversion +++ b/build/mkversion @@ -53,8 +53,12 @@ APPLICATION=$1 @@ -28,10 +26,10 @@ Signed-off-by: Changqing Li fi cat << __EOF__ -@@ -77,7 +81,7 @@ static const char copyright[] = +@@ -79,7 +83,7 @@ static const char copyright[] LDAP_GCCATTR((unused)) = "COPYING RESTRICTIONS APPLY\n"; - $static $const char $SYMBOL[] = + $static $const char $SYMBOL[] LDAP_GCCATTR((unused)) = -"@(#) \$$PACKAGE: $APPLICATION $VERSION (" __DATE__ " " __TIME__ ") \$\n" +"@(#) \$$PACKAGE: $APPLICATION $VERSION ($DATE $TIME) \$\n" "\t$WHOWHERE\n"; diff --git a/meta-oe/recipes-support/openldap/openldap_2.6.13.bb b/meta-oe/recipes-support/openldap/openldap_2.7.2.bb similarity index 92% rename from meta-oe/recipes-support/openldap/openldap_2.6.13.bb rename to meta-oe/recipes-support/openldap/openldap_2.7.2.bb index 743888e5b6..efa2b4986f 100644 --- a/meta-oe/recipes-support/openldap/openldap_2.6.13.bb +++ b/meta-oe/recipes-support/openldap/openldap_2.7.2.bb @@ -19,9 +19,10 @@ SRC_URI = "http://www.openldap.org/software/download/OpenLDAP/openldap-release/$ file://slapd.service \ file://remove-user-host-pwd-from-version.patch \ file://0001-build-top.mk-unset-STRIP_OPTS.patch \ + file://0001-libldap-Only-export-SASL-symbols-when-built-with-Cyr.patch \ " -SRC_URI[sha256sum] = "d693b49517a42efb85a1a364a310aed16a53d428d1b46c0d31ef3fba78fcb656" +SRC_URI[sha256sum] = "aad731aa22118ff327b9b4ddfc4b6f18ef9476586205da88a532e90940b523d2" DEPENDS = "util-linux groff-native" @@ -62,7 +63,7 @@ EXTRA_OECONF += "--enable-crypt" # The backend must be set by the configuration. This controls the # required database. # -# Backends="asyncmeta dnssrv ldap mdb meta null passwd perl relay sock sql wt" +# Backends="asyncmeta dnssrv ldap mdb meta null passwd relay sock wt" # # Note that multiple backends can be built. The ldbm backend requires a # build-time choice of database API. To use the gdbm (or other) API the @@ -91,23 +92,12 @@ PACKAGECONFIG[null] = "--enable-null=mod,--enable-null=no," #--enable-passwd enable passwd backend no|yes|mod no PACKAGECONFIG[passwd] = "--enable-passwd=mod,--enable-passwd=no," -#--enable-perl enable perl backend no|yes|mod no -# This requires a loadable perl dynamic library, if enabled without -# doing something appropriate (building perl?) the build will pick -# up the build machine perl - not good (inherit perlnative?) -PACKAGECONFIG[perl] = "--enable-perl=mod,--enable-perl=no,perl" - #--enable-relay enable relay backend no|yes|mod [yes] PACKAGECONFIG[relay] = "--enable-relay=mod,--enable-relay=no," #--enable-sock enable sock backend no|yes|mod [no] PACKAGECONFIG[sock] = "--enable-sock=mod,--enable-sock=no," -#--enable-sql enable sql backend no|yes|mod no -# sql requires some sql backend which provides sql.h, sqlite* provides -# sqlite.h (which may be compatible but hasn't been tried.) -PACKAGECONFIG[sql] = "--enable-sql=mod,--enable-sql=no,sqlite3" - #--enable-wt enable wt backend no|yes|mod no # back-wt is marked currently as experimental PACKAGECONFIG[wt] = "--enable-wt=mod,--enable-wt=no"