Merge tag '2.9.5' into truenas/2.9

2.9.5

# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCAAyFiEEGkHcZ1BfiaMwgotmr/513ehQjhIFAmZF77gUHHBicmV6aW5h
# QHJlZGhhdC5jb20ACgkQr/513ehQjhI5xQf9GvriZHzVtuQkp7vzfnc56gALORlO
# frxUWPCwVEdhHZtkUAs6D+Kg+NVPRlBXSAkaazCHeCiMubJfUCZPtofRynEHbjJC
# vzp9aSXqho6PXeMOT6xJ086MU6BHDffyJYMlcDjJ2hwtuQ/B8WOfX0V/yTDUORRO
# EJ2Z3apftkKjR2pRWXLMh15rR6YblEj+OWYnmTTQ01N5kDbl6wu9av9KkPXKiybW
# VHArjA90WAmJbFpqiMbqOPikal38igdxj5Y19w/F29O8Awv/Ca0uvQUPNWhNSvt/
# X3bJOzLbf2BiFdr2u1SHNtT/MaDeIBJ4BEwfOAjPYHQa5iFed//Qab5TGA==
# =UU8A
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu May 16 04:36:24 2024 PDT
# gpg:                using RSA key 1A41DC67505F89A330828B66AFFE75DDE8508E12
# gpg:                issuer "[email protected]"
# gpg: Can't check signature: No public key

.github/workflows/analyze-target.yml

@@ -76,7 +76,7 @@ jobs:
 
     - name: Upload artifacts
       if: always()
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         if-no-files-found: ignore
         name: covscan

.github/workflows/ci.yml

@@ -45,7 +45,7 @@ jobs:
         source ../contrib/fedora/bashrc_sssd
         make distcheck
 
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@v4
       if: always()
       with:
         name: build
@@ -115,7 +115,7 @@ jobs:
 
     - name: Upload main artifacts
       if: always()
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         if-no-files-found: ignore
         name: ${{ matrix.tag }}-intgcheck
@@ -128,7 +128,7 @@ jobs:
 
     - name: Upload valgrind artifacts
       if: always()
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         if-no-files-found: ignore
         name: ${{ matrix.tag }}-intgcheck-valgrind
@@ -215,7 +215,7 @@ jobs:
         pip3 install -r ./sssd/src/tests/multihost/requirements.txt
 
     - name: Create multihost configuration
-      uses: DamianReeves/write-file-action@0a7fcbe1960c53fc08fe789fa4850d24885f4d84
+      uses: DamianReeves/write-file-action@6929a9a6d1807689191dcc8bbe62b54d70a32b42
       with:
         path: mhc.yml
         write-mode: overwrite
@@ -234,11 +234,12 @@ jobs:
         set -ex -o pipefail
 
         source .venv/bin/activate
+        export PYTHONPATH="${PYTHONPATH}:$(realpath ./sssd/src/tests/multihost)"
         pytest -s --multihost-config=./mhc.yml ./sssd/src/tests/multihost/basic |& tee multihost-pytest.log
 
     - name: Upload artifacts
       if: always()
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         if-no-files-found: ignore
         name: ${{ matrix.tag }}-multihost
@@ -377,7 +378,7 @@ jobs:
           --mh-config=./mhc.yaml \
           --mh-log-path=$GITHUB_WORKSPACE/mh.log \
           --mh-artifacts-dir=$GITHUB_WORKSPACE/artifacts \
-          --polarion-config=./polarion.yaml \
+          --polarion-config=../polarion.yaml \
           --output-polarion-testcase=$GITHUB_WORKSPACE/artifacts/testcase.xml \
           --collect-only . |& tee $GITHUB_WORKSPACE/pytest-collect.log
 
@@ -394,14 +395,14 @@ jobs:
           --mh-config=./mhc.yaml \
           --mh-log-path=$GITHUB_WORKSPACE/mh.log \
           --mh-artifacts-dir=$GITHUB_WORKSPACE/artifacts \
-          --polarion-config=./polarion.yaml \
+          --polarion-config=../polarion.yaml \
           --output-polarion-testcase=$GITHUB_WORKSPACE/artifacts/testcase.xml \
           --output-polarion-testrun=$GITHUB_WORKSPACE/artifacts/testrun.xml \
           -vvv . |& tee $GITHUB_WORKSPACE/pytest.log
 
     - name: Upload artifacts
       if: always()
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         if-no-files-found: ignore
         name: ${{ matrix.tag }}-system

.github/workflows/copr_build.yml

@@ -53,7 +53,7 @@ jobs:
         version: 9.${{ env.COPR_PROJECT }}
 
     - name: Upload source rpm as an artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.srpm.outputs.file }}
         path: ${{ steps.srpm.outputs.path }}
@@ -117,7 +117,7 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Downlooad source rpm
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: ${{ needs.prepare.outputs.srpm }}
         path: .

.github/workflows/static-code-analysis.yml

@@ -24,7 +24,7 @@ jobs:
       uses: ./.github/actions/install-dependencies
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: cpp, python
         queries: +security-and-quality
@@ -39,7 +39,7 @@ jobs:
         make -j$PROCESSORS
 
     - name: Upload configuration artifacts
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       if: always()
       with:
         name: codeql-build
@@ -49,7 +49,7 @@ jobs:
         if-no-files-found: ignore
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
 
   python-system-tests:
     runs-on: ubuntu-latest

contrib/ci/deps.sh

@@ -23,7 +23,6 @@ declare -r _DEPS_SH=
 
 # Dependency list
 declare -a DEPS_LIST=(
-    lcov
     valgrind
 )
 

contrib/ci/misc.sh

@@ -28,46 +28,4 @@ function rm_rf_ro()
     rm -Rf -- "$@"
 }
 
-# Extract line and function coverage percentage from a "genhtml" or "lcov
-# --summary" output.
-# Input: "genhtml" or "lcov --summary" output
-# Output: lines funcs
-function lcov_summary()
-{
-    sed -ne 's/^ *\(lines\|functions\)\.*: \([0-9]\+\).*$/ \2/p' |
-        tr -d '\n'
-    echo
-}
-
-# Check if a "genhtml" or "lcov --summary" output has a minimum coverage
-# percentage of lines and functions.
-# Input: "genhtml" or "lcov --summary" output
-# Args: min_lines min_funcs
-function lcov_check()
-{
-    declare -r min_lines="$1";      shift
-    declare -r min_funcs="$1";      shift
-    declare lines
-    declare funcs
-
-    read -r lines funcs < <(lcov_summary)
-    ((lines >= min_lines && funcs >= min_funcs)) && return 0 || return 1
-}
-
-# Check if the current user belongs to a group.
-# Args: group_name
-function memberof()
-{
-    declare -r group_name="$1"
-    declare group_id
-    declare id
-    group_id=`getent group "$group_name" | cut -d: -f3` || return 1
-    for id in "${GROUPS[@]}"; do
-        if [ "$id" == "$group_id" ]; then
-            return 0
-        fi
-    done
-    return 1
-}
-
 fi # _MISC_SH

po/ko.po

@@ -4,14 +4,14 @@
 # Ludek Janda <[email protected]>, 2021.
 # simmon <[email protected]>, 2021.
 # seo hojin <[email protected]>, 2021.
-# 김인수 <[email protected]>, 2022, 2023.
+# 김인수 <[email protected]>, 2022, 2023, 2024.
 # Transtats <[email protected]>, 2022.
 msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: [email protected]\n"
 "POT-Creation-Date: 2024-01-12 13:01+0100\n"
-"PO-Revision-Date: 2023-09-18 03:54+0000\n"
+"PO-Revision-Date: 2024-02-13 09:36+0000\n"
 "Last-Translator: 김인수 <[email protected]>\n"
 "Language-Team: Korean <https://translate.fedoraproject.org/projects/sssd/"
 "sssd-2-9/ko/>\n"
@@ -20,7 +20,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=1; plural=0;\n"
-"X-Generator: Weblate 5.0.2\n"
+"X-Generator: Weblate 5.3.1\n"
 
 #: src/config/SSSDConfig/sssdoptions.py:20
 #: src/config/SSSDConfig/sssdoptions.py:21
@@ -1046,7 +1046,7 @@ msgstr "클라이언트가 사용할 특정 사이트"
 #: src/config/SSSDConfig/sssdoptions.py:316
 msgid ""
 "Maximum age in days before the machine account password should be renewed"
-msgstr "시스템 계정 암호를 갱신하기 전의 최대 사용 기간(일)"
+msgstr "장비 계정 비밀번호를 갱신하기 전의 최대 사용 기간(일)"
 
 #: src/config/SSSDConfig/sssdoptions.py:318
 msgid "Option for tuning the machine account renewal task"
@@ -1172,7 +1172,7 @@ msgstr "LDAP 서버에서 사용되는 스키마 유형 rfc2307"
 
 #: src/config/SSSDConfig/sssdoptions.py:359
 msgid "Mode used to change user password"
-msgstr "사용자 암호를 변경하는 데 사용되는 모드"
+msgstr "사용자 비밀번호를 변경하는 데 사용되는 방식"
 
 #: src/config/SSSDConfig/sssdoptions.py:360
 msgid "The default bind DN"
@@ -2117,8 +2117,8 @@ msgstr "시스템이 오프라인 상태이며 암호가 변경될 수 없습니
 msgid ""
 "After changing the OTP password, you need to log out and back in order to "
 "acquire a ticket"
-msgstr ""
-"OTP 암호를 변경한 후 티켓을 받으려면 로그아웃한 후 다시 로그인해야 합니다"
+msgstr "OTP 비밀번호를 변경한 후, 티켓을 받으려면 로그아웃한 후 다시 로그인해야 "
+"합니다"
 
 #: src/sss_client/pam_sss.c:730
 msgid "PIN locked"
@@ -2152,11 +2152,11 @@ msgstr "다른 스마트카드를 (다시)입력해 주세요"
 
 #: src/sss_client/pam_sss.c:2380
 msgid "New Password: "
-msgstr "신규 암호: "
+msgstr "신규 비밀번호: "
 
 #: src/sss_client/pam_sss.c:2381
 msgid "Reenter new Password: "
-msgstr "신규 암호 재입력: "
+msgstr "신규 비밀번호 재입력: "
 
 #: src/sss_client/pam_sss.c:2551 src/sss_client/pam_sss.c:2554
 msgid "First Factor: "
@@ -2180,15 +2180,15 @@ msgstr "비밀번호: "
 
 #: src/sss_client/pam_sss.c:2739 src/sss_client/pam_sss.c:2742
 msgid "First Factor (Current Password): "
-msgstr "첫 번째 요인 (현재 암호): "
+msgstr "첫 번째 요인 (현재 비밀번호): "
 
 #: src/sss_client/pam_sss.c:2746
 msgid "Current Password: "
-msgstr "현재 암호: "
+msgstr "현재 비밀번호: "
 
 #: src/sss_client/pam_sss.c:3103
 msgid "Password expired. Change your password now."
-msgstr "암호가 만료되었습니다. 지금 암호를 변경하십시오."
+msgstr "비밀번호가 만료되었습니다. 지금 비밀번호를 변경하세요."
 
 #: src/sss_client/ssh/sss_ssh_authorizedkeys.c:41
 #: src/sss_client/ssh/sss_ssh_knownhostsproxy.c:186 src/tools/sss_cache.c:732

po/sv.po

@@ -3,18 +3,18 @@
 # This file is distributed under the same license as the PACKAGE package.
 #
 # Translators:
-# Göran Uddeborg <[email protected]>, 2013-2014, 2020, 2021, 2022, 2023.
+# Göran Uddeborg <[email protected]>, 2013-2014, 2020, 2021, 2022, 2023, 2024.
 # Anders Jonsson <[email protected]>, 2018. #zanata
-# Göran Uddeborg <[email protected]>, 2018. #zanata, 2020, 2021, 2022, 2023.
-# Göran Uddeborg <[email protected]>, 2019. #zanata, 2020, 2021, 2022, 2023.
+# Göran Uddeborg <[email protected]>, 2018. #zanata, 2020, 2021, 2022, 2023, 2024.
+# Göran Uddeborg <[email protected]>, 2019. #zanata, 2020, 2021, 2022, 2023, 2024.
 # Anders Jonsson <[email protected]>, 2020. #zanata
 # Luna Jernberg <[email protected]>, 2022.
 msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: [email protected]\n"
 "POT-Creation-Date: 2024-01-12 13:01+0100\n"
-"PO-Revision-Date: 2023-08-30 14:21+0000\n"
+"PO-Revision-Date: 2024-03-06 08:35+0000\n"
 "Last-Translator: Göran Uddeborg <[email protected]>\n"
 "Language-Team: Swedish <https://translate.fedoraproject.org/projects/sssd/"
 "sssd-2-9/sv/>\n"
@@ -23,7 +23,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 4.18.2\n"
+"X-Generator: Weblate 5.4\n"
 
 #: src/config/SSSDConfig/sssdoptions.py:20
 #: src/config/SSSDConfig/sssdoptions.py:21
@@ -761,7 +761,7 @@ msgstr ""
 
 #: src/config/SSSDConfig/sssdoptions.py:226
 msgid "Local authentication methods policy "
-msgstr ""
+msgstr "Lokal policy för autentiseringsmetoder "
 
 #: src/config/SSSDConfig/sssdoptions.py:229
 msgid "IPA domain"
@@ -2136,6 +2136,8 @@ msgid ""
 "Kerberos TGT will not be granted upon login, user experience will be "
 "affected."
 msgstr ""
+"Kerberos-TGT kommer inte att ges vid inloggning, användarupplevelsen kommer "
+"påverkas."
 
 #: src/sss_client/pam_sss.c:72
 msgid "Enter PIN:"
@@ -2197,6 +2199,8 @@ msgid ""
 "No Kerberos TGT granted as the server does not support this method. Your "
 "single-sign on(SSO) experience will be affected."
 msgstr ""
+"Ingen Kerberos-TGT gavs eftersom servern inte stödjer denna metod. Din "
+"eninloggningsupplevelse (SSO) kommer påverkas."
 
 #: src/sss_client/pam_sss.c:835 src/sss_client/pam_sss.c:848
 msgid "Password change failed. "

src/config/SSSDConfig/sssdoptions.py

@@ -186,6 +186,8 @@ def __init__(self):
         'dns_resolver_op_timeout': _('How long should keep trying to resolve single DNS query (seconds)'),
         'dns_resolver_timeout': _('How long to wait for replies from DNS when resolving servers (seconds)'),
         'dns_discovery_domain': _('The domain part of service discovery DNS query'),
+        'failover_primary_timeout': _('How often SSSD tries to reconnect to the primary server after a successful '
+                                      'connection to the backup server.'),
         'override_gid': _('Override GID value from the identity provider with this value'),
         'case_sensitive': _('Treat usernames as case sensitive'),
         'entry_cache_user_timeout': _('Entry cache timeout length (seconds)'),

src/config/SSSDConfigTest.py

@@ -579,6 +579,7 @@ def testListOptions(self):
             'dns_resolver_op_timeout',
             'dns_resolver_timeout',
             'dns_discovery_domain',
+            'failover_primary_timeout',
             'dyndns_update',
             'dyndns_ttl',
             'dyndns_iface',
@@ -939,6 +940,7 @@ def testRemoveProvider(self):
             'dns_resolver_op_timeout',
             'dns_resolver_timeout',
             'dns_discovery_domain',
+            'failover_primary_timeout',
             'dyndns_update',
             'dyndns_ttl',
             'dyndns_iface',

src/config/cfg_rules.ini

@@ -99,6 +99,7 @@ option = memcache_timeout
 option = memcache_size_passwd
 option = memcache_size_group
 option = memcache_size_initgroups
+option = memcache_size_sid
 
 [rule/allowed_pam_options]
 validator = ini_allowed_options
@@ -404,6 +405,7 @@ option = dns_resolver_op_timeout
 option = dns_resolver_timeout
 option = dns_resolver_use_search_list
 option = dns_discovery_domain
+option = failover_primary_timeout
 option = override_gid
 option = case_sensitive
 option = override_homedir

src/config/etc/sssd.api.conf

@@ -172,6 +172,7 @@ dns_resolver_server_timeout = int, None, false
 dns_resolver_op_timeout = int, None, false
 dns_resolver_timeout = int, None, false
 dns_discovery_domain = str, None, false
+failover_primary_timeout = int, None, false
 override_gid = int, None, false
 case_sensitive = str, None, false
 override_homedir = str, None, false

src/db/sysdb_gpo.c

@@ -154,7 +154,7 @@ sysdb_gpo_store_gpo(struct sss_domain_info *domain,
             goto done;
         }
 
-        lret = ldb_msg_add_fmt(update_msg, SYSDB_GPO_TIMEOUT_ATTR, "%lu",
+        lret = ldb_msg_add_fmt(update_msg, SYSDB_GPO_TIMEOUT_ATTR, "%"SPRItime,
                                ((cache_timeout) ? (now + cache_timeout) : 0));
         if (lret != LDB_SUCCESS) {
             ret = sysdb_error_to_errno(lret);
@@ -198,7 +198,7 @@ sysdb_gpo_store_gpo(struct sss_domain_info *domain,
             goto done;
         }
 
-        lret = ldb_msg_add_fmt(update_msg, SYSDB_GPO_TIMEOUT_ATTR, "%lu",
+        lret = ldb_msg_add_fmt(update_msg, SYSDB_GPO_TIMEOUT_ATTR, "%"SPRItime,
                                ((cache_timeout) ? (now + cache_timeout) : 0));
         if (lret != LDB_SUCCESS) {
             ret = sysdb_error_to_errno(lret);