diff --git a/.gitignore b/.gitignore
index 60d1ab1..a39270d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/mariadb-10.3.17.tar.gz
+SOURCES/mariadb-10.3.27.tar.gz
diff --git a/.mariadb.metadata b/.mariadb.metadata
index 370dae1..b035072 100644
--- a/.mariadb.metadata
+++ b/.mariadb.metadata
@@ -1 +1 @@
-16edbd4762c8804118dda10de713cbddc675df5a SOURCES/mariadb-10.3.17.tar.gz
+8bc164b1a2ad77cd410169ae5b4df12cc97bbd6c SOURCES/mariadb-10.3.27.tar.gz
diff --git a/SOURCES/mariadb-annocheck.patch b/SOURCES/mariadb-annocheck.patch
index d7456a4..223619d 100644
--- a/SOURCES/mariadb-annocheck.patch
+++ b/SOURCES/mariadb-annocheck.patch
@@ -1,11 +1,11 @@
 Harden the "hardened" flags even more to comply with RHEL8 security rules
 
---- mariadb-10.3.10/CMakeLists.txt	2018-10-02 11:45:39.000000000 +0200
-+++ mariadb-10.3.10/CMakeLists.txt_patched	2018-11-08 03:48:01.713969313 +0100
-@@ -226,7 +226,7 @@ IF(NOT WITH_TSAN)
+--- mariadb-10.3.25/CMakeLists.txt	2020-10-05 18:19:45.000000000 +0200
++++ mariadb-10.3.25/CMakeLists.txt_patched	2020-11-03 01:29:52.369426705 +0100
+@@ -247,7 +247,7 @@ IF(NOT WITH_TSAN)
      # security-enhancing flags
      MY_CHECK_AND_SET_COMPILER_FLAG("-pie -fPIC")
-     MY_CHECK_AND_SET_COMPILER_FLAG("-Wl,-z,relro,-z,now")
+     MY_CHECK_AND_SET_LINKER_FLAG("-Wl,-z,relro,-z,now")
 -    MY_CHECK_AND_SET_COMPILER_FLAG("-fstack-protector --param=ssp-buffer-size=4")
 +    MY_CHECK_AND_SET_COMPILER_FLAG("-fstack-protector-strong --param=ssp-buffer-size=4")
      MY_CHECK_AND_SET_COMPILER_FLAG("-D_FORTIFY_SOURCE=2" RELEASE RELWITHDEBINFO)
diff --git a/SOURCES/mariadb-covscan.patch b/SOURCES/mariadb-covscan.patch
deleted file mode 100644
index 08235a0..0000000
--- a/SOURCES/mariadb-covscan.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-Error: SHELLCHECK_WARNING:
-/usr/bin/mysql_install_db:431:10: warning: Remove backticks to avoid executing output. [SC2092]
-#  429|     if test ! -d "$dir"
-#  430|     then
-#  431|->     if ! `mkdir -p "$dir"`
-#  432|       then
-#  433|         echo "Fatal error Can't create database directory '$dir'"
---- mariadb-10.3.10/scripts/mysql_install_db.sh	2018-10-02 11:45:42.000000000 +0200
-+++ mariadb-10.3.10/scripts/mysql_install_db.sh_patched	2018-11-14 10:06:54.868469138 +0100
-@@ -428,7 +428,7 @@ for dir in "$ldata" "$ldata/mysql"
- do
-   if test ! -d "$dir"
-   then
--    if ! `mkdir -p "$dir"`
-+    if ! mkdir -p "$dir"
-     then
-       echo "Fatal error Can't create database directory '$dir'"
-       link_to_help
-
diff --git a/SOURCES/mariadb-groonga.patch b/SOURCES/mariadb-groonga.patch
new file mode 100644
index 0000000..3a0e74c
--- /dev/null
+++ b/SOURCES/mariadb-groonga.patch
@@ -0,0 +1,30 @@
+# Fixing conflict with groonga package
+# https://bugzilla.redhat.com/show_bug.cgi?id=1763287
+
+--- mariadb-10.3.18/storage/mroonga/vendor/groonga/CMakeLists.txt.withoutoption	2019-11-11 14:01:07.762595716 +0100
++++ mariadb-10.3.18/storage/mroonga/vendor/groonga/CMakeLists.txt	2019-11-11 14:33:05.224012458 +0100
+@@ -86,7 +86,9 @@
+ set(INCLUDE_DIR "include")
+ set(GRN_INCLUDE_DIR "include/groonga")
+ set(DATA_DIR "share")
+-set(GRN_DATA_DIR "${DATA_DIR}/${GRN_PROJECT_NAME}")
++if(NOT DEFINED GRN_DATA_DIR)
++    set(GRN_DATA_DIR "${DATA_DIR}/${GRN_PROJECT_NAME}")
++endif()
+ set(CONFIG_DIR "etc")
+ set(GRN_CONFIG_DIR "${CONFIG_DIR}/${GRN_PROJECT_NAME}")
+ set(GRN_CONFIG_PATH "${CMAKE_INSTALL_PREFIX}/${GRN_CONFIG_DIR}/groonga.conf")
+
+--- mariadb-10.3.18/storage/mroonga/vendor/groonga/vendor/plugins/groonga-normalizer-mysql/CMakeLists.txt.withoutoption	2019-11-11 14:34:22.661005715 +0100
++++ mariadb-10.3.18/storage/mroonga/vendor/groonga/vendor/plugins/groonga-normalizer-mysql/CMakeLists.txt	2019-11-11 14:35:59.962244120 +0100
+@@ -16,7 +16,9 @@
+ # MA 02110-1335  USA
+ 
+ cmake_minimum_required(VERSION 2.6)
+-set(GROONGA_NORMALIZER_MYSQL_PROJECT_NAME "groonga-normalizer-mysql")
++if (NOT DEFINED GROONGA_NORMALIZER_MYSQL_PROJECT_NAME)
++    set(GROONGA_NORMALIZER_MYSQL_PROJECT_NAME "groonga-normalizer-mysql")
++endif()
+ project("${GROONGA_NORMALIZER_MYSQL_PROJECT_NAME}")
+ 
+ if(DEFINED GROONGA_NORMALIZER_MYSQL_EMBED)
diff --git a/SOURCES/mariadb-logrotate.patch b/SOURCES/mariadb-logrotate.patch
index fd58c42..6af9466 100644
--- a/SOURCES/mariadb-logrotate.patch
+++ b/SOURCES/mariadb-logrotate.patch
@@ -26,16 +26,13 @@ Update 6/2018
   beeing able to send the SIGHUP to the process and read the mysqld pid file, which root can.
 * Submited as PR: https://github.com/MariaDB/server/pull/807
 
---- mariadb-10.3.7/support-files/mysql-log-rotate.sh	2018-05-23 22:38:46.000000000 +0200
-+++ mariadb-10.3.7/support-files/mysql-log-rotate.sh_patched	2018-06-27 12:11:23.705719826 +0200
-@@ -1,25 +1,12 @@
- # This logname can be set in /etc/my.cnf
- # by setting the variable "err-log"
--# in the [safe_mysqld] section as follows:
-+# in the [mysqld] section as follows:
+--- mariadb-10.3.19/support-files/mysql-log-rotate.sh	2019-11-03 17:03:27.000000000 +0100
++++ mariadb-10.3.19/support-files/mysql-log-rotate.sh_patched	2019-11-06 15:07:54.205379672 +0100
+@@ -3,23 +3,10 @@
+ # in the [mysqld] section as follows:
  #
--# [safe_mysqld]
--# err-log=@localstatedir@/mysqld.log
+ # [mysqld]
+-# log-error=@localstatedir@/mysqld.log
 -#
 -# If the root user has a password you have to create a
 -# /root/.my.cnf configuration file with the following
@@ -49,15 +46,14 @@ Update 6/2018
 -#
 -# ATTENTION: This /root/.my.cnf should be readable ONLY
 -# for root !
-+# [mysqld]
-+# log_error=@LOG_LOCATION@
++# log-error=@LOG_LOCATION@
  
 -@localstatedir@/mysqld.log {
 -        # create 600 mysql mysql
 +@LOG_LOCATION@ {
 +        create 600 mysql mysql
          notifempty
- 	daily
+         daily
          rotate 3
 @@ -27,11 +14,9 @@
          compress
diff --git a/SOURCES/mariadb-ownsetup.patch b/SOURCES/mariadb-ownsetup.patch
index 23dcba8..3534c43 100644
--- a/SOURCES/mariadb-ownsetup.patch
+++ b/SOURCES/mariadb-ownsetup.patch
@@ -1,17 +1,19 @@
 diff -up mariadb-10.1.8/support-files/CMakeLists.txt.p9 mariadb-10.1.8/support-files/CMakeLists.txt
---- mariadb-10.1.8/support-files/CMakeLists.txt.p9	2015-11-03 11:38:46.029139464 +0100
-+++ mariadb-10.1.8/support-files/CMakeLists.txt	2015-11-03 11:41:07.107605055 +0100
-@@ -62,6 +62,7 @@ IF(UNIX)
+--- mariadb-10.2.32/support-files/CMakeLists.txt	2020-05-08 13:45:27.000000000 +0200
++++ mariadb-10.2.32/support-files/CMakeLists.txt_pacthed	2020-05-13 10:11:30.884190396 +0200
+@@ -100,7 +100,8 @@ IF(UNIX)
    ENDIF()
  
    CONFIGURE_FILE(mariadb.pc.in ${CMAKE_CURRENT_BINARY_DIR}/mariadb.pc @ONLY)
+-  INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/mariadb.pc DESTINATION ${INSTALL_LIBDIR}/pkgconfig COMPONENT Development)
 +  CONFIGURE_FILE(rpm/server.cnf ${CMAKE_CURRENT_BINARY_DIR}/rpm/server.cnf @ONLY)
-   INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/mariadb.pc DESTINATION ${INSTALL_SHAREDIR}/pkgconfig COMPONENT Development)
++  INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/mariadb.pc DESTINATION ${INSTALL_SHAREDIR}/pkgconfig COMPONENT Development)
  
    INSTALL(FILES mysql.m4 DESTINATION ${INSTALL_SHAREDIR}/aclocal COMPONENT Development)
-diff -up mariadb-10.1.8/support-files/rpm/server.cnf.p9 mariadb-10.1.8/support-files/rpm/server.cnf
---- mariadb-10.1.8/support-files/rpm/server.cnf.p9	2015-10-15 17:44:19.000000000 +0200
-+++ mariadb-10.1.8/support-files/rpm/server.cnf	2015-11-03 11:38:25.228070808 +0100
+   
+diff -up mariadb-10.0.15/support-files/rpm/server.cnf.ownsetup mariadb-10.0.15/support-files/rpm/server.cnf
+--- mariadb-10.0.15/support-files/rpm/server.cnf.ownsetup	2015-01-24 23:55:55.110063592 +0100
++++ mariadb-10.0.15/support-files/rpm/server.cnf	2015-01-24 23:57:42.308114387 +0100
 @@ -9,7 +9,16 @@
  [server]
  
diff --git a/SOURCES/rh-skipped-tests-arm.list b/SOURCES/rh-skipped-tests-arm.list
index 1e5b7a9..c3b5ced 100644
--- a/SOURCES/rh-skipped-tests-arm.list
+++ b/SOURCES/rh-skipped-tests-arm.list
@@ -1,21 +1,3 @@
 # Fails on aarch64
-encryption.create_or_replace :
-innodb_gis.rtree_compress2 :
 innodb.innodb_buffer_pool_resize :
-innodb.innodb_defrag_concurrent :
-
-parts.partition_alter1_1_innodb :
-parts.partition_alter1_2_innodb : 
-parts.partition_alter1_1_2_innodb :
-parts.partition_alter1_2_1_innodb :
-parts.partition_alter2_1_1_innodb : 
-parts.partition_alter1_2_2_innodb : 
-parts.partition_alter2_1_2_innodb : 
-parts.partition_alter2_2_1_innodb : 
-parts.partition_alter2_2_2_innodb : 
-parts.partition_alter4_innodb : 
-parts.partition_basic_innodb :
-parts.part_supported_sql_func_innodb :
-
-# Check of testcase failed:
-sys_vars.innodb_buffer_pool_size_basic :
\ No newline at end of file
+innodb.innodb_buffer_pool_resize_with_chunks :
diff --git a/SOURCES/rh-skipped-tests-base.list b/SOURCES/rh-skipped-tests-base.list
index 59fc521..6b720f4 100644
--- a/SOURCES/rh-skipped-tests-base.list
+++ b/SOURCES/rh-skipped-tests-base.list
@@ -1,27 +1,27 @@
 # Fails everywhere
 innodb.innodb_defrag_binlog :
-main.mysql :
+
 main.ssl_7937 :
 main.ssl_8k_key :
 main.ssl_crl :
+main.ssl_system_ca :
 main.userstat :
+
 perfschema.cnf_option :
 perfschema.nesting :
 perfschema.socket_summary_by_event_name_func :
 perfschema.socket_summary_by_instance_func :
+
+plugins.feedback_plugin_load :
+
 rpl.rpl_row_img_blobs :
 rpl.rpl_row_img_eng_min :
 rpl.rpl_row_img_eng_noblob :
-sys_vars.slave_parallel_threads_basic :
-unit.conc_ps_bugs :
-versioning.update-big :
-# Fails only on i686
-main.myisampack : 
-
-
-
-
-
 
+sys_vars.slave_parallel_threads_basic :
 
+# Fails only on i686
+main.myisampack :
 
+# We don't build the plugin in server; we build it in mariadb-connector-c instead
+plugins.auth_ed25519 :
\ No newline at end of file
diff --git a/SOURCES/rh-skipped-tests-ppc.list b/SOURCES/rh-skipped-tests-ppc.list
index 19add86..1938180 100644
--- a/SOURCES/rh-skipped-tests-ppc.list
+++ b/SOURCES/rh-skipped-tests-ppc.list
@@ -1,9 +1,4 @@
 # Fails on ppc64le
-encryption.create_or_replace :
-innodb_gis.rtree_compress2 :
-innodb.innodb_buffer_pool_resize :
-innodb.innodb_defrag_concurrent :
-
 parts.partition_alter1_1_innodb :
 parts.partition_alter1_2_innodb : 
 parts.partition_alter1_1_2_innodb :
@@ -17,5 +12,19 @@ parts.partition_alter4_innodb :
 parts.partition_basic_innodb :
 parts.part_supported_sql_func_innodb :
 
-# Check of testcase failed:
-sys_vars.innodb_buffer_pool_size_basic :
\ No newline at end of file
+rpl.rpl_loaddata_m :
+
+#
+stress.ddl_innodb :
+
+innodb.innodb_buffer_pool_resize :
+innodb.innodb_buffer_pool_resize_with_chunks :
+innodb.innodb_bulk_create_index :
+innodb.innodb_defrag_binlog :
+innodb.innodb_defrag_concurrent :
+innodb_gis.kill_server :
+gcol.innodb_virtual_basic :
+
+# Unstable (randomly failing) tests
+innodb_gis.rtree_search :
+main.type_ranges :
diff --git a/SOURCES/rh-skipped-tests-s390.list b/SOURCES/rh-skipped-tests-s390.list
index 869fa8f..278459f 100644
--- a/SOURCES/rh-skipped-tests-s390.list
+++ b/SOURCES/rh-skipped-tests-s390.list
@@ -1,2 +1,3 @@
 # Fails on s390x
-handler.heap :
+disks.disks :
+disks.disks_notembedded :
diff --git a/SOURCES/wsrep_sst_rsync_tunnel b/SOURCES/wsrep_sst_rsync_tunnel
index 562d191..f537249 100644
--- a/SOURCES/wsrep_sst_rsync_tunnel
+++ b/SOURCES/wsrep_sst_rsync_tunnel
@@ -1,7 +1,7 @@
 #!/bin/bash -ue
 
 # Copyright (C) 2010-2014 Codership Oy
-# Copyright (C) 2017 Damien Ciabrini <damien.ciabrini@gmail.com>
+# Copyright (C) 2017-2020 Damien Ciabrini <damien.ciabrini@gmail.com>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -53,8 +53,10 @@ cleanup_pid()
 
 cleanup_tunnel()
 {
-    wsrep_log_info "cleanup socat PID: $SOCAT_REAL_PID"
-    [ -n "$SOCAT_REAL_PID" ] && cleanup_pid $SOCAT_REAL_PID
+    if [ -n "$SOCAT_REAL_PID" ] && ps -p "$SOCAT_REAL_PID" >/dev/null 2>&1; then
+	wsrep_log_info "cleanup socat PID: $SOCAT_REAL_PID"
+	cleanup_pid $SOCAT_REAL_PID
+    fi
     rm -rf "$SOCAT_PID"
 }
 
@@ -347,6 +349,10 @@ then
     echo "$STATE" > "$MAGIC_FILE"
     rsync --archive --quiet --checksum "$MAGIC_FILE" rsync://$TARGET_ADDR
 
+    # to avoid cleanup race, stop tunnel before declaring the SST finished.
+    # This ensures galera won't start a new SST locally before we exit.
+    cleanup_tunnel
+
     echo "done $STATE"
 
 elif [ "$WSREP_SST_OPT_ROLE" = "joiner" ]
@@ -438,6 +444,10 @@ EOF
         sleep 1
     done
 
+    # to avoid cleanup race, we can tear down the socat tunnel now
+    # before signaling the end of the SST to galera.
+    cleanup_tunnel
+
     if ! ps -p $MYSQLD_PID >/dev/null
     then
         wsrep_log_error \
diff --git a/SPECS/mariadb.spec b/SPECS/mariadb.spec
index b0ad640..5aa6e56 100644
--- a/SPECS/mariadb.spec
+++ b/SPECS/mariadb.spec
@@ -106,7 +106,7 @@
 %bcond_without unbundled_pcre
 %else
 %bcond_with unbundled_pcre
-%global pcre_bundled_version 8.43
+%global pcre_bundled_version 8.44
 %endif
 
 # Include systemd files
@@ -135,12 +135,6 @@
 %else
 %bcond_with    mysql_names
 %endif
-# Explicit conflicts with mysql
-%if 0%{?scl:1}
-%bcond_with    conflicts
-%else
-%bcond_without conflicts
-%endif
 
 
 
@@ -148,8 +142,8 @@
 %global sameevr   %{epoch}:%{version}-%{release}
 
 Name:             mariadb
-Version:          10.3.17
-Release:          1%{?with_debug:.debug}%{?dist}
+Version:          10.3.27
+Release:          3%{?with_debug:.debug}%{?dist}
 Epoch:            3
 
 Summary:          A very fast and robust SQL database server
@@ -194,10 +188,11 @@ Patch7:           %{pkgnamepatch}-scripts.patch
 Patch9:           %{pkgnamepatch}-ownsetup.patch
 #   Patch10: Add RHEL8 required security
 Patch10:          %{pkgnamepatch}-annocheck.patch
-#   Patch11: Fix issues found by static analysis
-Patch11:          %{pkgnamepatch}-covscan.patch
 #   Patch12: Downstream fix for a correct pkgconfig file location
 Patch12:          %{pkgnamepatch}-pcdir.patch
+# Patch15:  Add option to edit groonga's and groonga-normalizer-mysql install path
+Patch15:          %{pkgnamepatch}-groonga.patch
+
 
 BuildRequires:    cmake gcc-c++
 BuildRequires:    multilib-rpm-config
@@ -259,7 +254,7 @@ Requires:         %{name}-common%{?_isa} = %{sameevr}
 Requires:         %{name}-libs%{?_isa} = %{sameevr}
 %else
 # If not built with client library in this package, use connector-c
-Requires:         mariadb-connector-c >= 3.0
+Requires:         mariadb-connector-c >= 3.1.11
 %endif
 
 %if %{with mysql_names}
@@ -271,8 +266,7 @@ Provides:         mysql-compat-client%{?_isa} = %{sameevr}
 
 Suggests:         %{name}-server%{?_isa} = %{sameevr}
 
-# MySQL (with caps) is upstream's spelling of their own RPMs for mysql
-%{?with_conflicts:Conflicts:        mysql}
+Conflicts:        mysql
 
 # obsoletion of mariadb-galera
 Provides: mariadb-galera = %{sameevr}
@@ -432,7 +426,7 @@ Provides:         mysql-server%{?_isa} = %{sameevr}
 Provides:         mysql-compat-server = %{sameevr}
 Provides:         mysql-compat-server%{?_isa} = %{sameevr}
 %endif
-%{?with_conflicts:Conflicts:        mysql-server}
+Conflicts:        mysql-server
 
 %description      server
 MariaDB is a multi-user, multi-threaded SQL database server. It is a
@@ -463,6 +457,9 @@ standard SQL syntax, and results joined onto other tables.
 Summary:          The CONNECT storage engine for MariaDB
 Requires:         %{name}-server%{?_isa} = %{sameevr}
 
+# As per https://jira.mariadb.org/browse/MDEV-21450
+BuildRequires:    libxml2-devel
+
 %description      connect-engine
 The CONNECT storage engine enables MariaDB to access external local or
 remote data (MED). This is done by defining tables based on different data
@@ -564,6 +561,7 @@ Requires:         %{name}-server%{?_isa} = %{sameevr}
 %if %{with mysql_names}
 Provides:         mysql-perl = %{sameevr}
 %endif
+Conflicts:        mysql-server
 # mysqlhotcopy needs DBI/DBD support
 Requires:         perl(DBI) perl(DBD::mysql)
 
@@ -579,13 +577,13 @@ Summary:          Files for development of MariaDB/MySQL applications
 %{?with_clibrary:Requires:         %{name}-libs%{?_isa} = %{sameevr}}
 Requires:         openssl-devel
 %if %{without clibrary}
-Requires:         mariadb-connector-c-devel >= 3.0
+Requires:         mariadb-connector-c-devel >= 3.1.11
 %endif
 %if %{with mysql_names}
 Provides:         mysql-devel = %{sameevr}
 Provides:         mysql-devel%{?_isa} = %{sameevr}
 %endif
-%{?with_conflicts:Conflicts:        mysql-devel}
+Conflicts:        mysql-devel
 
 %description      devel
 MariaDB is a multi-user, multi-threaded SQL database server.
@@ -628,7 +626,7 @@ Requires:         libaio-devel
 Provides:         mysql-embedded-devel = %{sameevr}
 Provides:         mysql-embedded-devel%{?_isa} = %{sameevr}
 %endif
-%{?with_conflicts:Conflicts:        mysql-embedded-devel}
+Conflicts:        mysql-embedded-devel
 
 %description      embedded-devel
 MariaDB is a multi-user, multi-threaded SQL database server.
@@ -646,7 +644,7 @@ Requires:         %{name}%{?_isa} = %{sameevr}
 Provides:         mysql-bench = %{sameevr}
 Provides:         mysql-bench%{?_isa} = %{sameevr}
 %endif
-%{?with_conflicts:Conflicts:        mysql-bench}
+Conflicts:        mysql-bench
 
 %description      bench
 MariaDB is a multi-user, multi-threaded SQL database server.
@@ -673,7 +671,8 @@ Requires:         perl(Socket)
 Requires:         perl(Sys::Hostname)
 Requires:         perl(Test::More)
 Requires:         perl(Time::HiRes)
-%{?with_conflicts:Conflicts:        mysql-test}
+
+Conflicts:        mysql-test
 %if %{with mysql_names}
 Provides:         mysql-test = %{sameevr}
 Provides:         mysql-test%{?_isa} = %{sameevr}
@@ -697,8 +696,8 @@ find . -name "*.jar" -type f -exec rm --verbose -f {} \;
 %patch7 -p1
 %patch9 -p1
 %patch10 -p1
-%patch11 -p1
 %patch12 -p1
+%patch15 -p1
 
 # workaround for upstream bug #56342
 #rm mysql-test/t/ssl_8k_key-master.opt
@@ -812,6 +811,8 @@ export CFLAGS CXXFLAGS CPPFLAGS
          -DMYSQL_DATADIR="%{dbdatadir}" \
          -DMYSQL_UNIX_ADDR="/var/lib/mysql/mysql.sock" \
          -DTMPDIR=/var/tmp \
+         -DGRN_DATA_DIR=share/%{name}-server/groonga \
+         -DGROONGA_NORMALIZER_MYSQL_PROJECT_NAME=%{name}-server/groonga-normalizer-mysql \
          -DENABLED_LOCAL_INFILE=ON \
          -DENABLE_DTRACE=ON \
          -DSECURITY_HARDENED=ON \
@@ -835,6 +836,7 @@ export CFLAGS CXXFLAGS CPPFLAGS
          -DPLUGIN_SPHINX=%{?with_sphinx:DYNAMIC}%{!?with_sphinx:NO} \
          -DPLUGIN_TOKUDB=%{?with_tokudb:DYNAMIC}%{!?with_tokudb:NO} \
          -DPLUGIN_CONNECT=%{?with_connect:DYNAMIC}%{!?with_connect:NO} \
+         -DPLUGIN_CLIENT_ED25519=OFF \
          -DWITH_CASSANDRA=%{?with_cassandra:TRUE}%{!?with_cassandra:FALSE} \
          -DPLUGIN_CACHING_SHA2_PASSWORD=%{?with_clibrary:DYNAMIC}%{!?with_clibrary:OFF} \
          -DPLUGIN_AWS_KEY_MANAGEMENT=NO \
@@ -906,9 +908,6 @@ rm scripts/my.cnf
 # use different config file name for each variant of server (mariadb / mysql)
 mv %{buildroot}%{_sysconfdir}/my.cnf.d/server.cnf %{buildroot}%{_sysconfdir}/my.cnf.d/%{pkg_name}-server.cnf
 
-# Rename sysusers and tmpfiles config files, they should be named after the software they belong to
-mv %{buildroot}%{_sysusersdir}/sysusers.conf %{buildroot}%{_sysusersdir}/%{name}.conf
-
 # remove SysV init script and a symlink to that, we pack our very own
 rm %{buildroot}%{_sysconfdir}/init.d/mysql
 rm %{buildroot}%{_libexecdir}/rcmysql
@@ -916,7 +915,7 @@ rm %{buildroot}%{_libexecdir}/rcmysql
 install -D -p -m 644 scripts/mysql.service %{buildroot}%{_unitdir}/%{daemon_name}.service
 install -D -p -m 644 scripts/mysql@.service %{buildroot}%{_unitdir}/%{daemon_name}@.service
 # Remove the upstream version
-rm %{buildroot}%{_tmpfilesdir}/tmpfiles.conf
+rm %{buildroot}%{_tmpfilesdir}/mariadb.conf
 # Install downstream version
 install -D -p -m 0644 scripts/mysql.tmpfiles.d %{buildroot}%{_tmpfilesdir}/%{name}.conf
 %if 0%{?mysqld_pid_dir:1}
@@ -992,6 +991,9 @@ rm %{buildroot}%{logrotateddir}/mysql
 # Remove AppArmor files
 rm -r %{buildroot}%{_datadir}/%{pkg_name}/policy/apparmor
 
+# Buildroot does not have symlink /lib --> /usr/lib
+mv %{buildroot}/%{_lib}/security %{buildroot}%{_libdir}
+
 # script without shebang: https://jira.mariadb.org/browse/MDEV-14266
 chmod -x %{buildroot}%{_datadir}/sql-bench/myisam.cnf
 
@@ -1020,7 +1022,10 @@ unlink %{buildroot}%{_libdir}/libmysqlclient.so
 unlink %{buildroot}%{_libdir}/libmysqlclient_r.so
 unlink %{buildroot}%{_libdir}/libmariadb.so
 # Client plugins
-rm %{buildroot}%{_libdir}/%{pkg_name}/plugin/{dialog.so,mysql_clear_password.so,sha256_password.so,auth_gssapi_client.so}
+rm %{buildroot}%{_libdir}/%{pkg_name}/plugin/{dialog.so,mysql_clear_password.so,sha256_password.so}
+%if %{with gssapi}
+rm %{buildroot}%{_libdir}/%{pkg_name}/plugin/auth_gssapi_client.so
+%endif
 %endif
 
 %if %{without clibrary} || %{without devel}
@@ -1034,7 +1039,7 @@ unlink %{buildroot}%{_mandir}/man1/mariadb_config.1*
 # This files are already included in mariadb-connector-c
 rm %{buildroot}%{_includedir}/mysql/mysql_version.h
 rm %{buildroot}%{_includedir}/mysql/{errmsg.h,ma_list.h,ma_pvio.h,mariadb_com.h,\
-mariadb_ctype.h,mariadb_dyncol.h,mariadb_stmt.h,mariadb_version.h,ma_tls.h,mysqld_error.h,mysql.h}
+mariadb_ctype.h,mariadb_dyncol.h,mariadb_stmt.h,mariadb_version.h,ma_tls.h,mysqld_error.h,mysql.h,mariadb_rpl.h}
 rm -r %{buildroot}%{_includedir}/mysql/{mariadb,mysql}
 %endif
 
@@ -1060,9 +1065,6 @@ rm %{buildroot}%{_sysconfdir}/my.cnf.d/mysql-clients.cnf
 %endif
 
 %if %{without tokudb}
-# because upstream ships manpages for tokudb even on architectures that tokudb doesn't support
-rm %{buildroot}%{_mandir}/man1/tokuftdump.1*
-rm %{buildroot}%{_mandir}/man1/tokuft_logprint.1*
 %else
 %if 0%{?fedora} || 0%{?rhel} > 7
 # Move the upstream file to the correct location
@@ -1078,10 +1080,6 @@ rm %{buildroot}%{_sysconfdir}/my.cnf
 rm -r %{buildroot}%{_datadir}/%{pkg_name}/charsets
 %endif
 
-%if %{without gssapi}
-rm -r %{buildroot}/etc/my.cnf.d/auth_gssapi.cnf
-%endif
-
 %if %{without errmsg}
 rm %{buildroot}%{_datadir}/%{pkg_name}/errmsg-utf8.txt
 rm -r %{buildroot}%{_datadir}/%{pkg_name}/{english,czech,danish,dutch,estonian,\
@@ -1167,7 +1165,7 @@ export MTR_BUILD_THREAD=%{__isa_bits}
     --suite-timeout=60 --testcase-timeout=10 \
     --mysqld=--binlog-format=mixed --force-restart \
     --shutdown-timeout=60 --max-test-fail=0 --big-test \
-    --skip-ssl --suite=spider,spider/bg \
+    --skip-ssl --suite=spider,spider/bg,spider/bugfix,spider/handler \
 %if %{ignore_testsuite_result}
     --max-test-fail=999 || :
 %endif
@@ -1338,6 +1336,7 @@ fi
 %{_bindir}/mysql_secure_installation
 %{_bindir}/mysql_tzinfo_to_sql
 %{_bindir}/mysqld_safe
+%{_bindir}/mysqld_safe_helper
 %{_bindir}/innochecksum
 %{_bindir}/replace
 %{_bindir}/resolve_stack_dump
@@ -1358,6 +1357,8 @@ fi
 
 %dir %{_libdir}/%{pkg_name}
 %dir %{_libdir}/%{pkg_name}/plugin
+%{_libdir}/security/pam_user_map.so
+%{_sysconfdir}/security/user_map.conf
 %{_libdir}/%{pkg_name}/plugin/*
 %{?with_oqgraph:%exclude %{_libdir}/%{pkg_name}/plugin/ha_oqgraph.so}
 %{?with_connect:%exclude %{_libdir}/%{pkg_name}/plugin/ha_connect.so}
@@ -1413,10 +1414,10 @@ fi
 %{_datadir}/%{pkg_name}/mroonga/uninstall.sql
 %license %{_datadir}/%{pkg_name}/mroonga/COPYING
 %license %{_datadir}/%{pkg_name}/mroonga/AUTHORS
-%license %{_datadir}/groonga-normalizer-mysql/lgpl-2.0.txt
-%license %{_datadir}/groonga/COPYING
-%doc %{_datadir}/groonga-normalizer-mysql/README.md
-%doc %{_datadir}/groonga/README.md
+%license %{_datadir}/%{name}-server/groonga-normalizer-mysql/lgpl-2.0.txt
+%license %{_datadir}/%{name}-server/groonga/COPYING
+%doc %{_datadir}/%{name}-server/groonga-normalizer-mysql/README.md
+%doc %{_datadir}/%{name}-server/groonga/README.md
 %endif
 %{_datadir}/%{pkg_name}/wsrep.cnf
 %{_datadir}/%{pkg_name}/wsrep_notify
@@ -1533,8 +1534,6 @@ fi
 %{_bindir}/perror
 %{_mandir}/man1/mysql_upgrade.1*
 %{_mandir}/man1/perror.1*
-# Other utilities
-%{_bindir}/mysqld_safe_helper
 
 %if %{with devel}
 %files devel
@@ -1589,6 +1588,48 @@ fi
 %endif
 
 %changelog
+* Thu Dec 03 2020 Michal Schorm <mschorm@redhat.com> - 3:10.3.27-3
+- Remove mariadb_rpl.h from includedir
+  This file is shipped in mariadb-connector-c package
+- Require matching version of mariadb-connector-c package
+
+* Wed Nov 25 2020 Michal Schorm <mschorm@redhat.com> - 3:10.3.27-2
+- Disable building of the ed25519 client plugin.
+  From now on it will be shipped by 'mariadb-connector-c' package
+
+* Thu Nov 12 2020 Michal Schorm <mschorm@redhat.com> - 3:10.3.27-1
+- Rebase to 10.3.27
+- mariadb-debug_build.patch is no more needed, upstream did the changes:
+  https://github.com/MariaDB/server/commit/31eaa2029f3c2a4f8e5609ce8b87682286238d9a#diff-32766783af7cac683980224d63c59929
+  https://github.com/MariaDB/server/commit/23c6fb3e6231b8939331e2d9f157092f24ed8f4f#diff-78f3162f137407db5240950beb2bcd7c
+
+* Fri May 15 2020 Michal Schorm <mschorm@redhat.com> - 3:10.3.23-1
+- Rebase to 10.3.23
+- Make conflicts between corresponding mariadb and mysql packages explicit
+- Get rid of the Conflicts macro, it was intended to mark conflicts with
+  *upstream* packages
+  Resolves: #1853159
+
+* Mon Mar 30 2020 Lukas Javorsky <ljavorsk@redhat.com> - 3:10.3.22-1
+- Rebase to 10.3.22
+
+* Fri Jan 10 2020 Lukas Javorsky <ljavorsk@redhat.com> - 3:10.3.21-1
+- Rebase to 10.3.21
+
+* Thu Dec 05 2019 Lukas Javorsky <ljavorsk@redhat.com> - 3:10.3.20-2
+- Change path of groonga's packaged files
+- Fix bz#1763287
+
+* Thu Dec 05 2019 Lukas Javorsky <ljavorsk@redhat.com> - 3:10.3.20-1
+- Rebase to 10.3.20
+- NOTE: 10.3.19 was deleted by upstream
+
+* Tue Dec 03 2019 Lukas Javorsky <ljavorsk@redhat.com> - 3:10.3.18-1
+- Rebase to 10.3.18
+
+* Tue Dec 03 2019 Lukas Javorsky <ljavorsk@redhat.com> - 3:10.3.17-2
+- Fix the debug build
+
 * Thu Aug 01 2019 Michal Schorm <mschorm@redhat.com> - 3:10.3.17-1
 - Rebase to 10.3.17
   Resolves: #1711265