Description: statically link winbind libraries
 This patch statically links libnss-winbind and libpam-winbind against the
 samba-libs to prevent upgrade problems with running processes being
 incompatible with old libraries or the other way around.  The original version
 of this patch produced a pam_winbind.so module that had missing symbols and
 could not be loaded (LP: #1677329). It was then updated to also link in
 wbclient, which provided the missing symbols, and allow_undefined_symbols was
 changed from True to False for the pam module to trigger build failures should
 this happen again.
Author: Jorge Niedbalski <jorge.niedbalski@canonical.com>
Author: Andreas Hasenack <andreas@canonical.com>
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833287
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1584485
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1677329
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1644428
Last-Update: 2017-05-08
Origin: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1584485/comments/17

--- samba-4.4.5+dfsg.orig/buildtools/wafsamba/wafsamba.py
+++ samba-4.4.5+dfsg/buildtools/wafsamba/wafsamba.py
@@ -140,7 +140,8 @@ def SAMBA_LIBRARY(bld, libname, source,
                   grouping_library=False,
                   allow_undefined_symbols=False,
                   allow_warnings=False,
-                  enabled=True):
+                  enabled=True,
+                  static=False):
     '''define a Samba library'''
 
     if pyembed and bld.env['IS_EXTRA_PYTHON']:
@@ -253,7 +254,12 @@ def SAMBA_LIBRARY(bld, libname, source,
     if bld.env['ENABLE_RELRO'] is True:
         ldflags.extend(TO_LIST('-Wl,-z,relro,-z,now'))
 
-    features = 'c cshlib symlink_lib install_lib'
+    features = 'c symlink_lib install_lib'
+    if static:
+        features += ' cstaticlib'
+    else:
+        features += ' cshlib'
+
     if pyext:
         features += ' pyext'
     if pyembed:
--- samba-4.4.5+dfsg.orig/nsswitch/wscript_build
+++ samba-4.4.5+dfsg/nsswitch/wscript_build
@@ -10,6 +10,13 @@ bld.SAMBA_LIBRARY('winbind-client',
 	private_library=True
 	)
 
+bld.SAMBA_LIBRARY('winbind-client-static',
+	source='wb_common.c',
+	deps='replace',
+	cflags='-DWINBINDD_SOCKET_DIR=\"%s\"' % bld.env.WINBINDD_SOCKET_DIR,
+	private_library=True, static=True, install=False
+	)
+
 
 bld.SAMBA_BINARY('nsstest',
 		 source='nsstest.c',
@@ -33,11 +40,12 @@ if (Utils.unversioned_sys_platform() ==
     bld.SAMBA_LIBRARY('nss_winbind',
               keep_underscore=True,
               source='winbind_nss_linux.c',
-              deps='winbind-client',
+              deps='winbind-client-static',
               public_headers=[],
               public_headers_install=False,
               pc_files=[],
-              vnum='2')
+              vnum='2',
+	       allow_undefined_symbols=True)
 
     bld.SAMBA3_LIBRARY('nss_wins',
                        keep_underscore=True,
@@ -87,21 +95,32 @@ elif Utils.unversioned_sys_platform() ==
 elif (host_os.rfind('hpux') > -1):
 	bld.SAMBA_LIBRARY('nss_winbind',
 			  source='winbind_nss_linux.c',
-			  deps='winbind-client', 
+			  deps='winbind-client',
 			  realname='libnss_winbind.so')
 elif (host_os.rfind('aix') > -1):
 	bld.SAMBA_LIBRARY('nss_winbind',
 			  source='winbind_nss_aix.c',
-			  deps='winbind-client', 
+			  deps='winbind-client',
 			  realname='WINBIND')
 
 if bld.CONFIG_SET('WITH_PAM_MODULES') and bld.CONFIG_SET('HAVE_PAM_START'):
+	bld.SAMBA_LIBRARY('pamwinbind-static',
+		source='pam_winbind.c',
+		deps='talloc wbclient winbind-client-static tiniparser pam samba_intl',
+		cflags='-DLOCALEDIR=\"%s/locale\"' % bld.env.DATADIR,
+		realname='pam_winbind.so',
+		install_path='${PAMMODULESDIR}',
+	        static=True,
+               install=False
+		)
+
 	bld.SAMBA_LIBRARY('pamwinbind',
 		source='pam_winbind.c',
-		deps='talloc wbclient winbind-client tiniparser pam samba_intl',
+		deps='wbclient pamwinbind-static',
 		cflags='-DLOCALEDIR=\"%s/locale\"' % bld.env.DATADIR,
 		realname='pam_winbind.so',
-		install_path='${PAMMODULESDIR}'
+		install_path='${PAMMODULESDIR}',
+		allow_undefined_symbols=False
 		)
 
 if bld.CONFIG_SET('HAVE_KRB5_LOCATE_PLUGIN_H'):