diff --git a/.gitignore b/.gitignore
index b43c6a5..023cbee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/mariadb-10.5.8.tar.gz
+SOURCES/mariadb-10.5.9.tar.gz
diff --git a/.mariadb.metadata b/.mariadb.metadata
index ab6f23b..032702d 100644
--- a/.mariadb.metadata
+++ b/.mariadb.metadata
@@ -1 +1 @@
-6442a3c9d9d316086ce6822f18e2e026bd8422d0 SOURCES/mariadb-10.5.8.tar.gz
+73767fac3d1c504298259708272fb6a58e644967 SOURCES/mariadb-10.5.9.tar.gz
diff --git a/SOURCES/rh-skipped-tests-s390.list b/SOURCES/rh-skipped-tests-s390.list
index 3ca7588..b7f91d6 100644
--- a/SOURCES/rh-skipped-tests-s390.list
+++ b/SOURCES/rh-skipped-tests-s390.list
@@ -1,3 +1,5 @@
# Fails since 10.5.2
perfschema.memory_aggregate_32bit :
period.overlaps :
+# Fails since 10.5.9
+bugfix.wait_timeout :
diff --git a/SPECS/mariadb.spec b/SPECS/mariadb.spec
index bd40bda..09fea8f 100644
--- a/SPECS/mariadb.spec
+++ b/SPECS/mariadb.spec
@@ -15,7 +15,7 @@
# The last version on which the full testsuite has been run
# In case of further rebuilds of that version, don't require full testsuite to be run
# run only "main" suite
-%global last_tested_version 10.5.8
+%global last_tested_version 10.5.9
# Set to 1 to force run the testsuite even if it was already tested in current version
%global force_run_testsuite 0
@@ -61,6 +61,9 @@
# hierarchies and more complex graph structures to be handled in a relational fashion
%bcond_without oqgraph
+# PAM authentication plugin
+%bcond_without pam
+
# Other plugins
%if 0%{?fedora}
%bcond_without cracklib
@@ -113,7 +116,7 @@
%bcond_without unbundled_pcre
%else
%bcond_with unbundled_pcre
-%global pcre_bundled_version 10.34
+%global pcre_bundled_version 10.36
%endif
# Use main python interpretter version
@@ -151,8 +154,8 @@
%global sameevr %{epoch}:%{version}-%{release}
Name: mariadb
-Version: 10.5.8
-Release: 2%{?with_debug:.debug}%{?dist}
+Version: 10.5.9
+Release: 1%{?with_debug:.debug}%{?dist}
Epoch: 3
Summary: A very fast and robust SQL database server
@@ -444,6 +447,7 @@ Recommends: %{name}-backup%{?_isa} = %{sameevr}
%{?with_sphinx:Suggests: %{name}-sphinx-engine%{?_isa} = %{sameevr}}
%{?with_oqgraph:Suggests: %{name}-oqgraph-engine%{?_isa} = %{sameevr}}
%{?with_connect:Suggests: %{name}-connect-engine%{?_isa} = %{sameevr}}
+%{?with_pam:Suggests: %{name}-pam%{?_isa} = %{sameevr}}
Suggests: mytop
Suggests: logrotate
@@ -588,6 +592,21 @@ This plugin includes support for Kerberos on Unix.
%endif
+%if %{with pam}
+%package pam
+Summary: PAM authentication plugin for the MariaDB server
+
+Requires: %{name}-server%{?_isa} = %{sameevr}
+# This subpackage NEED the 'mysql' user/group (created during mariadb-server %pre) to be available prior installation
+Requires(pre): %{name}-server%{?_isa} = %{sameevr}
+
+BuildRequires: pam-devel
+
+%description pam
+PAM authentication server-side plugin for MariaDB.
+%endif
+
+
%if %{with sphinx}
%package sphinx-engine
Summary: The Sphinx storage engine for MariaDB
@@ -892,7 +911,7 @@ export CFLAGS CXXFLAGS CPPFLAGS
# Print all Cmake options values; "-LAH" means "List Advanced Help"
cmake -B %{_vpath_builddir} -LAH
-%cmake_build
+%cmake_build -j2
# build selinux policy
%if %{with galera}
@@ -1234,7 +1253,7 @@ export MTR_BUILD_THREAD=$(( $(date +%s) % 1100 ))
--skip-test-list=unstable-tests
%endif
# Second run for the SPIDER suites that fail with SCA (ssl self signed certificate)
- perl ./mysql-test-run.pl $common_testsuite_arguments --skip-ssl --big-test --mem --suite=spider,spider/bg,spider/bugfix,spider/handler \
+ perl ./mysql-test-run.pl $common_testsuite_arguments --skip-ssl --big-test --mem --suite=spider,spider/bg,spider/bugfix,spider/handler --skip-test-list=unstable-tests \
%if %{ignore_testsuite_result}
--max-test-fail=999 || :
%endif
@@ -1416,10 +1435,6 @@ fi
%dir %{_libdir}/%{pkg_name}
%dir %{_libdir}/%{pkg_name}/plugin
-# Change from root:root to mysql:mysql, so it can be accessed by the server
-%attr(0755,mysql,mysql) %dir %{_libdir}/%{pkg_name}/plugin/auth_pam_tool_dir
-%{_libdir}/security/pam_user_map.so
-%{_sysconfdir}/security/user_map.conf
%{_libdir}/%{pkg_name}/plugin/*
%{?with_oqgraph:%exclude %{_libdir}/%{pkg_name}/plugin/ha_oqgraph.so}
%{?with_connect:%exclude %{_libdir}/%{pkg_name}/plugin/ha_connect.so}
@@ -1433,6 +1448,11 @@ fi
%exclude %{_libdir}/%{pkg_name}/plugin/mysql_clear_password.so
%endif
+# PAM plugin; moved to a standalone sub-package
+%exclude %{_libdir}/%{pkg_name}/plugin/{auth_pam_v1.so,auth_pam.so}
+%exclude %dir %{_libdir}/%{pkg_name}/plugin/auth_pam_tool_dir
+%exclude %{_libdir}/%{pkg_name}/plugin/auth_pam_tool_dir/auth_pam_tool
+
%{_mandir}/man1/aria_{chk,dump_log,ftdump,pack,read_log,s3_copy}.1*
%{_mandir}/man1/galera_new_cluster.1*
%{_mandir}/man1/galera_recovery.1*
@@ -1554,6 +1574,16 @@ fi
%config(noreplace) %{_sysconfdir}/my.cnf.d/auth_gssapi.cnf
%endif
+%if %{with pam}
+%files pam
+%{_libdir}/%{pkg_name}/plugin/{auth_pam_v1.so,auth_pam.so}
+%attr(0755,root,root) %dir %{_libdir}/%{pkg_name}/plugin/auth_pam_tool_dir
+# SUID-to-root binary. Access MUST be restricted (https://jira.mariadb.org/browse/MDEV-25126)
+%attr(4750,root,mysql) %{_libdir}/%{pkg_name}/plugin/auth_pam_tool_dir/auth_pam_tool
+%{_libdir}/security/pam_user_map.so
+%{_sysconfdir}/security/user_map.conf
+%endif
+
%if %{with sphinx}
%files sphinx-engine
%{_libdir}/%{pkg_name}/plugin/ha_sphinx.so
@@ -1631,6 +1661,15 @@ fi
%endif
%changelog
+* Mon Mar 22 2021 Michal Schorm <mschorm@redhat.com> - 10.5.9-1
+- Rebase to 10.5.9
+
+* Fri Mar 19 2021 Michal Schorm <mschorm@redhat.com> - 10.5.8-4
+- Move the PAM plugin to a standalone sub-package
+
+* Thu Mar 18 2021 Michal Schorm <mschorm@redhat.com> - 10.5.8-3
+- Fix permissions of the PAMv2 plugin files
+
* Tue Feb 16 2021 Michal Schorm <mschorm@redhat.com> - 10.5.8-2
- Bump release after several commits cherry-picked from Fedora Rawhide