sssd-2.9.5-160000.2.2

- Add python3-setuptools build dependency
- Drop nscd build dependency

- Migrate away from update-alternatives, replaced by package
  conflicts; (bsc#1235789); (bsc#1216739);

- Update filelists involving memberof.so and idmap/sss.so to
  avoid gobbling up one file into multiple sssd subpackages.
  (Between samba-4.20 and 4.21, %ldbdir changes from
  /usr/lib64/ldb2/modules/ldb to /usr/lib64/samba/ldb, so now
  `%_libdir/samba` is a bit too broad.)

- Fix spec file for openSUSE ALP and SUSE SLFO, where the
  python3_fix_shebang_path RPM macro is not available

- Revert the change dropping the default configuration file. If
  /usr/etc exists will be installed there, otherwise in /etc.
  (bsc#1226157);

- Update to release 2.9.5
  * Added failover_primary_timout configuration option. This can
    be used to configure how often SSSD tries to reconnect to a
    primary server after a successful connection to a backup
    server. This was previously hardcoded to 31 seconds which is
    kept as the default value.

- remove dependency on /usr/bin/python3 using
  %python3_fix_shebang_path macro, [bsc#1212476]

- Update to release 2.9.4
  * Fixes a crash when PAM passkey processing incorrectly handles
    non-passkey data.
  * Fixed group membership handling when members are coming from
    different forest domains and using ldap token groups is
    prohibited.
  * Files provider was erroneously taking into consideration
    ``local_auth_policy`` config option, thus breaking smartcard
    authentication of local user in setups that did not explicitly
    specify this option. This is now fixed.

- Adapt spec file for SLE 15 SP6/Leap 15.6; (jsc#PED-6714);
  * Remove package sssd-common, merged into sssd
  * Continue building deprecated files provider and infopipe
    responder
  * Disable selinux and semanage
  * Provide rcsssd shortcut

- Fix spec file for Leap

- fix use-after-free during p11_child processing in the PAM
  responder; (bsc#1269807); (CVE-2026-12610); Add patch
  0019-PAM-fix-use-after-free-during-p11_child-processing.patch

- Fix GPO cache path traversal via unsanitized gPCFileSysPath;
  (bsc#1270708); (CVE-2026-14476); Add patch
  0017-gpo-reject-path-traversal-in-gPCFileSysPath.patch
- Warn when a SUDO provider LDAP search falls back to root DN;
  (bsc#1270709); (CVE-2026-14474); Add patch
  0018-sudo-warn-when-ldap_sudo_search_base-falls-back-to-r.patch

- Reduce the message severity logged when the LDAP server hosts
  multiple naming contexts without defining a default one in the
  rootdse; (bsc#1264185); Add patch
  0016-sdap-Reduce-log-level-when-get_naming_context-fails.patch
- Do not ignore tests result at build time; (bsc#1246196);
- Skip tests depending on soft-hsm; Add patch
  0015-TESTS-Disable-pam-srv-and-certmap-cmocka-tests.patch

- With the 2.10 update sssd runs under unprivileged user which is
  not possible in certain scenarios. This update reverts to run as
  root with minimum privileges; (bsc#1259436); Add patch
  0012-run-as-root.patch
- Let krb5 child tolerate missing capabilities; Add patch
  0013-KRB5-let-krb5_child-tolerate-missing-cap-set-id.patch
- Add support for UsrEtc; (bsc#1257643); Add patch
  0014-UsrEtc.patch
- The default configuration file is installed now in
  /usr/etc/sssd/sssd.conf. It can be completely overridden by
  manually creating the system specific config file
  /etc/sssd/sssd.conf, or partially overridden by creating config
  snippets in /etc/sssd/conf.d/ directory. Check sssd.conf manpage
  for more details.

- Fix ldap_child process started by the backend process ending in
  defunc state. Add patch
  0011-sdap_select_principal_from_keytab_sync-waitpid-synch.patch
- Create the secrets directory for the KCM service; (bsc#1259253);

- Make sure previously rotated logs are chown-ed as well;
  (bsc#1259475); Add patch
  0009-Make-sure-previously-rotated-logs-are-chown-ed-as-we.patch

- Use %pre scriptlet instead of %pretrans to migrate from
  sssd-common; (bsc#1257509);

- Update to release 2.10.2; (jsc#PED-12449);
  * If the ssh responder is not running, sss_ssh_knownhosts will
    not fail (but it will not return the keys).
  * SSSD is now capable of handling multiple services associated
    with the same port.
  * sssd_pam, being a privileged binary, now clears the
    environment and does not allow configuration of the
    PR_SET_DUMPABLE flag as a precaution.
- Changes from sssd 2.10.1
  * SSSD does not create anymore missing path components of
    DIR:/FILE: ccache types while acquiring user's TGT. The
    parent directory of requested ccache directory must exist and
    the user trying to log in must have rwx access to this
    directory. This matches behavior of /usr/bin/kinit.
  * The option default_domain_suffix is deprecated.
- Changes from sssd 2.10.0
  * The ``sssctl cache-upgrade`` command was removed. SSSD
    performs automatic upgrades at startup when needed.
  * Support of ``enumeration`` feature (i.e. ability to list all
    users/groups using ``getent passwd/group`` without argument)
    for AD/IPA providers is deprecated and might be removed in
    further releases.
  * The new tool ``sss_ssh_knownhosts`` can be used with ssh's
    ``KnownHostsCommand`` configuration option to retrieve the
    host's public keys from a remote server (FreeIPA, LDAP,
    etc.). It replaces ```sss_ssh_knownhostsproxy``.
  * The default value for ``ldap_id_use_start_tls`` changed from
    false to true for improved security.
  * https://github.com/SSSD/sssd/releases/tag/2.10.0
- Fix socket activation of responders
- Daemon runs now as unprivileged user 'sssd'
- Add patch:
  * 0007-TOOL-Fix-build-parameter-name-omitted.patch

- Fix sssctl config-check exit code when the conf.d snippets
  directory does not exist; (bsc#1230348); Add patch
  0006-SSSCTL-config-check-do-not-return-an-error-if-snippe.patch