[rpms/389-ds-base] f44: Bump version to 3.2.3

[Viktor Ashirov <vashirov@redhat.com>]

A new commit has been pushed.

Repo   : rpms/389-ds-base
Branch : f44
Commit : 8880d88869d1c5444b8f4101f08f2752ce43f763
Author : Viktor Ashirov <vashirov@redhat.com>
Date   : 2026-09-07T15:14:58+02:00
Stats  : +235/-177 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/389-ds-base/c/8880d88869d1c5444b8f4101f08f2752ce43f763?branch=f44

Log:
Bump version to 3.2.3

---
diff --git a/389-ds-base.spec b/389-ds-base.spec
index d683264..8695140 100644
--- a/389-ds-base.spec
+++ b/389-ds-base.spec
@@ -1,6 +1,6 @@
 %global pkgname dirsrv
 
-# Exclude i686 bit arches
+# Exclude i686 architecture
 ExcludeArch: i686
 
 %bcond bundle_jemalloc 1
@@ -10,11 +10,7 @@ ExcludeArch: i686
 %global __provides_exclude ^libjemalloc\\.so.*$
 %endif
 
-%bcond bundle_libdb 0
-%if 0%{?rhel} >= 10
-%bcond bundle_libdb 1
-%endif
-
+%bcond bundle_libdb %{defined rhel}
 %if %{with bundle_libdb}
 %global libdb_version 5.3
 %global libdb_base_version db-%{libdb_version}.28
@@ -28,13 +24,21 @@ ExcludeArch: i686
 %endif
 %endif
 
-%bcond libbdb_ro 0
+%bcond repl_reports 0
+%if 0%{?fedora} >= 40 && 0%{?fedora} < 44
+%bcond repl_reports 1
+%endif
+
 %if 0%{?fedora} >= 43
 %bcond libbdb_ro 1
+%else
+%bcond libbdb_ro 0
 %endif
 
 # This is used in certain builds to help us know if it has extra features.
 %global variant base
+%global prerel %{nil}
+
 # This enables a sanitized build.
 %bcond asan 0
 %bcond msan 0
@@ -57,20 +61,34 @@ ExcludeArch: i686
 %endif
 
 # Build cockpit plugin
+# Enabled on Fedora and EPEL community builds.
+# Disabled on RHEL/CentOS Stream unless RHDS (distribution contains "dsrv").
+%if 0%{?rhel} && !0%{?epel}
+%bcond cockpit %(echo "%{?distribution}" | grep -q dsrv && echo 1 || echo 0)
+%else
 %bcond cockpit 1
+%endif
+
+# HIBP password breach checking
+%bcond hibp 1
 
-# Build HIBP password breach checking (requires libcurl)
-%bcond hibp 0
+%bcond usdt 1
 
-# fedora 15 and later uses tmpfiles.d
-# otherwise, comment this out
-%{!?with_tmpfiles_d: %global with_tmpfiles_d %{_sysconfdir}/tmpfiles.d}
+# Perl log analyzer (logconv.pl)
+# Disabled on Fedora >= 46 and RHEL >= 11, use logconv.py instead
+%if 0%{?fedora} >= 46 || 0%{?rhel} >= 11
+%bcond logconvpl 0
+%else
+%bcond logconvpl 1
+%endif
 
 # systemd support
 %global groupname %{pkgname}.target
 
 # Filter argparse-manpage from autogenerated package Requires
 %global __requires_exclude ^python.*argparse-manpage
+# Filter perl auto-dep from jemalloc's jeprof profiler script
+%global __requires_exclude_from %{_libdir}/%{pkgname}/bin/jeprof
 
 # Force to require nss version greater or equal as the version available at the build time
 # See bz1986327
@@ -78,25 +96,22 @@ ExcludeArch: i686
 
 Summary:          389 Directory Server (%{variant})
 Name:             389-ds-base
-Version:          3.2.2
+Version:          3.2.3%{?prerel}
 Release:          %{autorelease -n %{?with_asan:-e asan}}%{?dist}
-License:          GPL-3.0-or-later WITH GPL-3.0-389-ds-base-exception AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR LGPL-2.1-or-later OR MIT) AND (Apache-2.0 OR MIT) AND (CC-BY-4.0 AND MIT) AND (MIT OR Apache-2.0) AND Unicode-3.0 AND (MIT OR Unlicense) AND 0BSD AND Apache-2.0 AND BSD-3-Clause AND ISC AND MIT AND MIT AND ISC AND MPL-2.0 AND Zlib
+License:          GPL-3.0-or-later WITH GPL-3.0-389-ds-base-exception AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR LGPL-2.1-or-later OR MIT) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT) AND Unicode-3.0 AND (CC-BY-4.0 AND MIT) AND (MIT OR Unlicense) AND 0BSD AND Apache-2.0 AND BSD-3-Clause AND ISC AND MIT AND MIT AND ISC AND MPL-2.0 AND Zlib
 URL:              https://www.port389.org
-Obsoletes:        %{name}-legacy-tools < 1.4.4.6
-Obsoletes:        %{name}-legacy-tools-debuginfo < 1.4.4.6
-Provides:         ldif2ldbm >= 0
 
 ##### Bundled cargo crates list - START #####
 Provides:  bundled(crate(allocator-api2)) = 0.2.21
 Provides:  bundled(crate(anyhow)) = 1.0.102
 Provides:  bundled(crate(atty)) = 0.2.14
-Provides:  bundled(crate(autocfg)) = 1.5.1
-Provides:  bundled(crate(base64)) = 0.13.1
-Provides:  bundled(crate(bitflags)) = 2.12.1
-Provides:  bundled(crate(bumpalo)) = 3.20.3
+Provides:  bundled(crate(autocfg)) = 1.5.0
+Provides:  bundled(crate(base64)) = 0.23.0
+Provides:  bundled(crate(bitflags)) = 2.11.0
+Provides:  bundled(crate(bumpalo)) = 3.20.2
 Provides:  bundled(crate(byteorder)) = 1.5.0
 Provides:  bundled(crate(cbindgen)) = 0.26.0
-Provides:  bundled(crate(cc)) = 1.2.63
+Provides:  bundled(crate(cc)) = 1.2.56
 Provides:  bundled(crate(cfg-if)) = 1.0.4
 Provides:  bundled(crate(clap)) = 3.2.25
 Provides:  bundled(crate(clap_lex)) = 0.2.4
@@ -106,74 +121,70 @@ Provides:  bundled(crate(crossbeam-queue)) = 0.3.12
 Provides:  bundled(crate(crossbeam-utils)) = 0.8.21
 Provides:  bundled(crate(equivalent)) = 1.0.2
 Provides:  bundled(crate(errno)) = 0.3.14
-Provides:  bundled(crate(fastrand)) = 2.4.1
+Provides:  bundled(crate(fastrand)) = 2.3.0
 Provides:  bundled(crate(fernet)) = 0.1.4
 Provides:  bundled(crate(find-msvc-tools)) = 0.1.9
 Provides:  bundled(crate(foldhash)) = 0.2.0
 Provides:  bundled(crate(foreign-types)) = 0.3.2
 Provides:  bundled(crate(foreign-types-shared)) = 0.1.1
-Provides:  bundled(crate(futures-core)) = 0.3.32
-Provides:  bundled(crate(futures-task)) = 0.3.32
-Provides:  bundled(crate(futures-util)) = 0.3.32
-Provides:  bundled(crate(getrandom)) = 0.4.2
-Provides:  bundled(crate(hashbrown)) = 0.17.1
+Provides:  bundled(crate(getrandom)) = 0.4.1
+Provides:  bundled(crate(hashbrown)) = 0.16.1
 Provides:  bundled(crate(heck)) = 0.5.0
 Provides:  bundled(crate(hermit-abi)) = 0.1.19
 Provides:  bundled(crate(id-arena)) = 2.3.0
-Provides:  bundled(crate(indexmap)) = 2.14.0
-Provides:  bundled(crate(itoa)) = 1.0.18
+Provides:  bundled(crate(indexmap)) = 2.13.0
+Provides:  bundled(crate(itoa)) = 1.0.17
 Provides:  bundled(crate(jobserver)) = 0.1.34
-Provides:  bundled(crate(js-sys)) = 0.3.99
+Provides:  bundled(crate(js-sys)) = 0.3.95
 Provides:  bundled(crate(leb128fmt)) = 0.1.0
-Provides:  bundled(crate(libc)) = 0.2.186
-Provides:  bundled(crate(linux-raw-sys)) = 0.12.1
-Provides:  bundled(crate(log)) = 0.4.32
-Provides:  bundled(crate(lru)) = 0.16.4
-Provides:  bundled(crate(memchr)) = 2.8.1
-Provides:  bundled(crate(once_cell)) = 1.21.4
-Provides:  bundled(crate(openssl)) = 0.10.80
+Provides:  bundled(crate(libc)) = 0.2.182
+Provides:  bundled(crate(linux-raw-sys)) = 0.11.0
+Provides:  bundled(crate(log)) = 0.4.29
+Provides:  bundled(crate(lru)) = 0.16.3
+Provides:  bundled(crate(memchr)) = 2.8.0
+Provides:  bundled(crate(once_cell)) = 1.21.3
+Provides:  bundled(crate(openssl)) = 0.10.79
 Provides:  bundled(crate(openssl-macros)) = 0.1.1
-Provides:  bundled(crate(openssl-sys)) = 0.9.116
+Provides:  bundled(crate(openssl-sys)) = 0.9.115
 Provides:  bundled(crate(os_str_bytes)) = 6.6.1
 Provides:  bundled(crate(paste)) = 1.0.15
-Provides:  bundled(crate(pin-project-lite)) = 0.2.17
-Provides:  bundled(crate(pkg-config)) = 0.3.33
+Provides:  bundled(crate(pin-project-lite)) = 0.2.16
+Provides:  bundled(crate(pkg-config)) = 0.3.32
 Provides:  bundled(crate(prettyplease)) = 0.2.37
 Provides:  bundled(crate(proc-macro2)) = 1.0.106
-Provides:  bundled(crate(quote)) = 1.0.45
-Provides:  bundled(crate(r-efi)) = 6.0.0
-Provides:  bundled(crate(rustix)) = 1.1.4
+Provides:  bundled(crate(quote)) = 1.0.44
+Provides:  bundled(crate(r-efi)) = 5.3.0
+Provides:  bundled(crate(rustix)) = 1.1.3
 Provides:  bundled(crate(rustversion)) = 1.0.22
-Provides:  bundled(crate(semver)) = 1.0.28
+Provides:  bundled(crate(semver)) = 1.0.27
 Provides:  bundled(crate(serde)) = 1.0.228
 Provides:  bundled(crate(serde_core)) = 1.0.228
 Provides:  bundled(crate(serde_derive)) = 1.0.228
-Provides:  bundled(crate(serde_json)) = 1.0.150
-Provides:  bundled(crate(shlex)) = 2.0.1
-Provides:  bundled(crate(slab)) = 0.4.12
+Provides:  bundled(crate(serde_json)) = 1.0.149
+Provides:  bundled(crate(shlex)) = 1.3.0
 Provides:  bundled(crate(smallvec)) = 1.15.1
 Provides:  bundled(crate(sptr)) = 0.3.2
 Provides:  bundled(crate(strsim)) = 0.10.0
 Provides:  bundled(crate(syn)) = 2.0.117
-Provides:  bundled(crate(tempfile)) = 3.27.0
+Provides:  bundled(crate(tempfile)) = 3.25.0
 Provides:  bundled(crate(termcolor)) = 1.4.1
 Provides:  bundled(crate(textwrap)) = 0.16.2
-Provides:  bundled(crate(tokio)) = 1.52.3
+Provides:  bundled(crate(tokio)) = 1.49.0
 Provides:  bundled(crate(toml)) = 0.5.11
 Provides:  bundled(crate(tracing)) = 0.1.44
 Provides:  bundled(crate(tracing-attributes)) = 0.1.31
 Provides:  bundled(crate(tracing-core)) = 0.1.36
 Provides:  bundled(crate(unicode-ident)) = 1.0.24
 Provides:  bundled(crate(unicode-xid)) = 0.2.6
-Provides:  bundled(crate(uuid)) = 1.23.2
+Provides:  bundled(crate(uuid)) = 1.23.1
 Provides:  bundled(crate(vcpkg)) = 0.2.15
 Provides:  bundled(crate(wasi)) = 0.11.1+wasi_snapshot_preview1
-Provides:  bundled(crate(wasip2)) = 1.0.3+wasi_0.2.9
+Provides:  bundled(crate(wasip2)) = 1.0.2+wasi_0.2.9
 Provides:  bundled(crate(wasip3)) = 0.4.0+wasi_0.3.0_rc_2026_01_06
-Provides:  bundled(crate(wasm-bindgen)) = 0.2.122
-Provides:  bundled(crate(wasm-bindgen-macro)) = 0.2.122
-Provides:  bundled(crate(wasm-bindgen-macro-support)) = 0.2.122
-Provides:  bundled(crate(wasm-bindgen-shared)) = 0.2.122
+Provides:  bundled(crate(wasm-bindgen)) = 0.2.118
+Provides:  bundled(crate(wasm-bindgen-macro)) = 0.2.118
+Provides:  bundled(crate(wasm-bindgen-macro-support)) = 0.2.118
+Provides:  bundled(crate(wasm-bindgen-shared)) = 0.2.118
 Provides:  bundled(crate(wasm-encoder)) = 0.244.0
 Provides:  bundled(crate(wasm-metadata)) = 0.244.0
 Provides:  bundled(crate(wasmparser)) = 0.244.0
@@ -183,7 +194,7 @@ Provides:  bundled(crate(winapi-util)) = 0.1.11
 Provides:  bundled(crate(winapi-x86_64-pc-windows-gnu)) = 0.4.0
 Provides:  bundled(crate(windows-link)) = 0.2.1
 Provides:  bundled(crate(windows-sys)) = 0.61.2
-Provides:  bundled(crate(wit-bindgen)) = 0.57.1
+Provides:  bundled(crate(wit-bindgen)) = 0.51.0
 Provides:  bundled(crate(wit-bindgen-core)) = 0.51.0
 Provides:  bundled(crate(wit-bindgen-rust)) = 0.51.0
 Provides:  bundled(crate(wit-bindgen-rust-macro)) = 0.51.0
@@ -295,7 +306,8 @@ Provides:  bundled(npm(victory-voronoi-container)) = 37.3.6
 Provides:  bundled(npm(victory-zoom-container)) = 37.3.6
 ##### Bundled cargo crates list - END #####
 
-# Attach the buildrequires to the top level package:
+
+# BuildRequires for the main package:
 BuildRequires:    nspr-devel
 BuildRequires:    nss-devel >= 3.34
 BuildRequires:    openldap-clients
@@ -308,6 +320,7 @@ BuildRequires:    pcre2-devel
 BuildRequires:    cracklib-devel
 BuildRequires:    json-c-devel
 BuildRequires:    libxcrypt-devel
+BuildRequires:    zlib-devel
 %if %{with clang}
 BuildRequires:    libatomic
 BuildRequires:    clang
@@ -332,35 +345,39 @@ BuildRequires:    libdb-devel
 %endif
 %endif
 
-# The following are needed to build the snmp ldap-agent
+# For SNMP ldap-agent
 BuildRequires:    net-snmp-devel
 BuildRequires:    bzip2-devel
 BuildRequires:    openssl-devel
+# For HIBP password breach checking
 %if %{with hibp}
 BuildRequires:    libcurl-devel
 %endif
-# the following is for the pam passthru auth plug-in
+# For PAM passthru auth plug-in
 BuildRequires:    pam-devel
 BuildRequires:    systemd-units
 BuildRequires:    systemd-devel
 BuildRequires:    systemd-rpm-macros
 %{?sysusers_requires_compat}
+%if %{with usdt}
+BuildRequires:    systemtap-sdt-devel
+%endif
 BuildRequires:    cargo
 BuildRequires:    rust
 BuildRequires:    pkgconfig
 BuildRequires:    pkgconfig(systemd)
 BuildRequires:    pkgconfig(krb5)
 BuildRequires:    pkgconfig(libpcre2-8)
-# Needed to support regeneration of the autotool artifacts.
+# For autotools regeneration
 BuildRequires:    autoconf
 BuildRequires:    automake
 BuildRequires:    libtool
 BuildRequires:    make
-# For our documentation
+# For doxygen documentation
 BuildRequires:    doxygen
-# For tests!
+# For cmocka unit tests
 BuildRequires:    libcmocka-devel
-# For lib389 and related components.
+# For lib389
 BuildRequires:    python%{python3_pkgversion}-devel
 
 # For cockpit
@@ -370,29 +387,36 @@ BuildRequires:    /usr/bin/npm
 BuildRequires:    /usr/bin/node
 %endif
 
-# For autosetup -S git
-BuildRequires:    git
-
+# Runtime requires for the main package
 Requires:         %{name}-libs = %{version}-%{release}
 Requires:         python%{python3_pkgversion}-lib389 = %{version}-%{release}
 
-# this is needed for using semanage from our setup scripts
+# For semanage in setup scripts
 Requires:         policycoreutils-python-utils
 Requires:         libsemanage-python%{python3_pkgversion}
-# the following are needed for some of our scripts
+# NoNewPrivileges support in dirsrv service units requires
+# selinux-policy with init_nnp_daemon_domain for dirsrv_t.
+# See: https://bugzilla.redhat.com/show_bug.cgi?id=2457951
+%if 0%{?rhel} == 10
+Requires:         selinux-policy >= 42.1.22-1
+%endif
+%if 0%{?fedora} == 43
+Requires:         selinux-policy >= 43.7-1
+%endif
+%if 0%{?fedora} == 44
+Requires:         selinux-policy >= 44.1-1
+%endif
+# For CLI scripts
 Requires:         openldap-clients
 Requires:         acl
-# this is needed to setup SSL if you are not using the
-# administration server package
+# For SSL/TLS setup
 Requires:         nss-tools
 %dirsrv_requires_ge nss
-# these are not found by the auto-dependency method
-# they are required to support the mandatory LDAP SASL mechs
+# Mandatory LDAP SASL mechanisms
 Requires:         cyrus-sasl-gssapi
 Requires:         cyrus-sasl-md5
-# This is optionally supported by us, as we use it in our tests
 Requires:         cyrus-sasl-plain
-# this is needed for backldbm
+# For back-ldbm
 %if %{with libbdb_ro}
 Requires:         %{name}-robdb-libs = %{version}-%{release}
 %else
@@ -401,44 +425,41 @@ Requires:         libdb
 %endif
 %endif
 Requires:         lmdb-libs
-# Needed by logconv.pl
-%if %{without libbdb_ro}
-%if %{without bundle_libdb}
-Requires:         perl-DB_File
-%endif
-%endif
-Requires:         perl-Archive-Tar
-%if 0%{?fedora} >= 33 || 0%{?rhel} >= 9
-Requires:         perl-debugger
-Requires:         perl-sigtrap
-%endif
+
 # Needed for password dictionary checks
 Requires:         cracklib-dicts
 Requires:         json-c
-# Log compression
-Requires:         zlib-devel
 # logconv.py, MIME type
 Requires:         python3-file-magic
 # Picks up our systemd deps.
 %{?systemd_requires}
+# Ensure sysusers are created
+%{?sysusers_requires_compat}
+
+%if %{with usdt}
+# Optional eBPF tracer for the shipped USDT bpftrace scripts.
+# Use Suggests so it is not installed by default (debug-only, pulls in gcc).
+Suggests:         bpftrace
+%endif
+
 
-Source0:          https://github.com/389ds/%{name}/releases/download/%{name}-%{version}/%{name}-%{version}.tar.bz2
+Source0:          %{name}-%{version}.tar.bz2
 Source2:          %{name}-devel.README
 %if %{with bundle_jemalloc}
 Source3:          https://github.com/jemalloc/%{jemalloc_name}/releases/download/%{jemalloc_ver}/%{jemalloc_name}-%{jemalloc_ver}.tar.bz2
-Source10:          jemalloc-5.3.0_throw_bad_alloc.patch
-%endif
-Source4:          389-ds-base.sysusers
-%if %{with bundle_libdb}
-Source5:          https://fedorapeople.org/groups/389ds/libdb-5.3.28-59.tar.bz2
+Source5:          jemalloc-5.3.0_throw_bad_alloc.patch
 %endif
+Source4:          https://fedorapeople.org/groups/389ds/libdb-5.3.28-59.tar.bz2
 
-Source6:          vendor-%{version}-1.tar.gz
-Source7:          Cargo-%{version}-1.lock
-Source8:          cockpit_dist-%{version}-1.tar.bz2
+# To override vendor/Cargo.lock/cockpit_dist from the upstream tarball
+# with separately uploaded sources
+# uncomment and replace double percent with a single one
+#Source6:          vendor-%%{version}-1.tar.gz
+#Source7:          Cargo-%%{version}-1.lock
+#Source8:          cockpit_dist-%%{version}-1.tar.bz2
 
 %description
-389 Directory Server is an LDAPv3 compliant server.  The base package includes
+389 Directory Server is an LDAPv3 compliant server. The base package includes
 the LDAP server and command line utilities for server administration.
 %if %{with asan}
 WARNING! This build is linked to Address Sanitisation libraries. This probably
@@ -449,7 +470,7 @@ Please see http://seclists.org/oss-sec/2016/q1/363 for more information.
 %if %{with libbdb_ro}
 %package        robdb-libs
 Summary:        Read-only Berkeley Database Library
-License:          GPL-3.0-or-later WITH GPL-3.0-389-ds-base-exception AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR LGPL-2.1-or-later OR MIT) AND (Apache-2.0 OR MIT) AND (CC-BY-4.0 AND MIT) AND (MIT OR Apache-2.0) AND Unicode-3.0 AND (MIT OR Unlicense) AND 0BSD AND Apache-2.0 AND BSD-3-Clause AND ISC AND MIT AND MIT AND ISC AND MPL-2.0 AND Zlib
+License:          GPL-3.0-or-later WITH GPL-3.0-389-ds-base-exception AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR LGPL-2.1-or-later OR MIT) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT) AND Unicode-3.0 AND (CC-BY-4.0 AND MIT) AND (MIT OR Unlicense) AND 0BSD AND Apache-2.0 AND BSD-3-Clause AND ISC AND MIT AND MIT AND ISC AND MPL-2.0 AND Zlib
 
 %description    robdb-libs
 The %{name}-robdb-lib package contains a library derived from rpm
@@ -460,16 +481,13 @@ some basic functions to search and read Berkeley Database records
 
 %package          libs
 Summary:          Core libraries for 389 Directory Server (%{variant})
-Provides:         svrcore = 4.1.4
-Obsoletes:        svrcore <= 4.1.3
-Conflicts:        svrcore
 %dirsrv_requires_ge nss
 Requires:         nspr
 Requires:         openldap
 Requires:         systemd-libs
-# Pull in sasl
+# SASL
 Requires:         cyrus-sasl-lib
-# KRB
+# Kerberos
 Requires:         krb5-libs
 %if %{with clang}
 Requires:         llvm
@@ -493,60 +511,90 @@ package to be installed with just the -libs package and without the main package
 
 %package          devel
 Summary:          Development libraries for 389 Directory Server (%{variant})
-Provides:         svrcore-devel = 4.1.4
-Obsoletes:        svrcore-devel <= 4.1.3
-Conflicts:        svrcore-devel
 Requires:         %{name}-libs = %{version}-%{release}
 Requires:         pkgconfig
 Requires:         nspr-devel
 Requires:         nss-devel >= 3.34
 Requires:         openldap-devel
-# systemd-libs contains the headers iirc.
+# For systemd headers
 Requires:         systemd-libs
 
 %description      devel
 Development Libraries and headers for the 389 Directory Server base package.
 
+
 %package          snmp
 Summary:          SNMP Agent for 389 Directory Server
 Requires:         %{name} = %{version}-%{release}
 
-Obsoletes:        %{name} <= 1.4.0.0
-
 %description      snmp
 SNMP Agent for the 389 Directory Server base package.
 
+%if %{with logconvpl}
+%package          logconv-perl
+Summary:          Legacy Perl log analyzer for 389 Directory Server
+Requires:         %{name} = %{version}-%{release}
+%if %{without libbdb_ro}
+%if %{without bundle_libdb}
+Requires:         perl-DB_File
+%endif
+%endif
+Requires:         perl-Archive-Tar
+Requires:         perl-debugger
+Requires:         perl-sigtrap
+Provides:         deprecated()
+
+%description      logconv-perl
+Legacy Perl log analyzer (logconv.pl) for 389 Directory Server.
+This tool is deprecated, use logconv.py instead.
+%endif
+
 %if %{with bundle_libdb}
 %package          bdb
 Summary:          Berkeley Database backend for 389 Directory Server
-%description      bdb
-Berkeley Database backend for 389 Directory Server
-Warning! This backend is deprecated in favor of lmdb and its support
-may be removed in future versions.
 
 Requires:         %{name} = %{version}-%{release}
+Requires:         %{name}-libs = %{version}-%{release}
 # Berkeley DB database libdb was marked as deprecated since F40:
 # https://fedoraproject.org/wiki/Changes/389_Directory_Server_3.0.0
 # because libdb was marked as deprecated since F33
 # https://fedoraproject.org/wiki/Changes/Libdb_deprecated
 Provides:         deprecated()
-%endif
 
+%description      bdb
+Berkeley Database backend for 389 Directory Server
+Warning! This backend is deprecated in favor of lmdb and its support
+may be removed in future versions.
+%endif
 
 %package -n python%{python3_pkgversion}-lib389
 Summary:  A library for accessing, testing, and configuring the 389 Directory Server
 BuildArch:        noarch
 Requires: %{name} = %{version}-%{release}
 Requires: openssl
-# This is for /usr/bin/c_rehash tool, only needed for openssl < 1.1.0
-Requires: openssl-perl
 Requires: iproute
 Requires: python%{python3_pkgversion}-libselinux
 Recommends: bash-completion
 
 %description -n python%{python3_pkgversion}-lib389
 This module contains tools and libraries for accessing, testing,
- and configuring the 389 Directory Server.
+and configuring the 389 Directory Server.
+
+%if %{with repl_reports}
+%package -n python%{python3_pkgversion}-lib389-repl-reports
+Summary: HTML and PNG report generation for 389 Directory Server replication monitoring tools
+BuildArch: noarch
+Requires: python%{python3_pkgversion}-lib389 = %{version}-%{release}
+Requires: python%{python3_pkgversion}-plotly
+Requires: python%{python3_pkgversion}-matplotlib
+
+%description -n python%{python3_pkgversion}-lib389-repl-reports
+Extended reporting capabilities for 389 Directory Server replication analysis.
+This package provides additional report formats (HTML and PNG) with interactive
+visualizations and graphs for replication lag analysis. These formats require
+additional dependencies and are optional - the base package supports CSV
+reports without this extension.
+%endif
 
 %if %{with cockpit}
 %package -n cockpit-389-ds
@@ -568,7 +616,7 @@ cd src/lib389
 %pyproject_buildrequires -g test
 
 %prep
-%autosetup -S git -p1 -n %{name}-%{version}
+%autosetup -p1 -n %{name}-%{version}
 %if %{defined SOURCE6}
 rm -rf vendor
 tar xzf %{SOURCE6}
@@ -582,7 +630,7 @@ cp %{SOURCE7} src/Cargo.lock
 %endif
 
 %if %{with bundle_libdb}
-%setup -q -n %{name}-%{version} -T -D -b 5
+%setup -q -n %{name}-%{version} -T -D -b 4
 %endif
 
 %if %{defined SOURCE8}
@@ -593,15 +641,10 @@ tar xvjf %{SOURCE8} -C src/cockpit/389-console
 cp %{SOURCE2} README.devel
 
 %build
-# Workaround until https://github.com/389ds/389-ds-base/issues/6476 is fixed
-export CFLAGS="%{optflags} -std=gnu17"
-
 %if %{with clang}
 CLANG_FLAGS="--enable-clang"
 %endif
 
-%{?with_tmpfiles_d: TMPFILES_FLAG="--with-tmpfiles-d=%{with_tmpfiles_d}"}
-
 %if %{with asan}
 ASAN_FLAGS="--enable-asan --enable-debug"
 %endif
@@ -624,6 +667,12 @@ RUST_FLAGS="--enable-rust --enable-rust-offline"
 COCKPIT_FLAGS="--disable-cockpit"
 %endif
 
+%if %{with usdt}
+USDT_FLAGS="--enable-usdt"
+%else
+USDT_FLAGS="--disable-usdt"
+%endif
+
 %if %{with bundle_jemalloc}
 # Override page size, bz #1545539
 # 4K
@@ -644,7 +693,7 @@ COCKPIT_FLAGS="--disable-cockpit"
 
 # Build jemalloc
 pushd ../%{jemalloc_name}-%{jemalloc_ver}
-patch -p1 -F3 < %{SOURCE10}
+patch -p1 -F3 < %{SOURCE5}
 %configure \
         --libdir=%{_libdir}/%{pkgname}/lib \
         --bindir=%{_libdir}/%{pkgname}/bin \
@@ -657,14 +706,16 @@ popd
 %if %{with bundle_libdb}
 mkdir -p ../%{libdb_base_version}
 pushd ../%{libdb_base_version}
-tar -xjf  %{_topdir}/SOURCES/%{libdb_full_version}.tar.bz2
+tar -xjf %{_topdir}/SOURCES/%{libdb_full_version}.tar.bz2
 mv %{libdb_full_version} SOURCES
+%if 0%{?fedora}
 sed -i -e '/^CFLAGS=/s/-fno-strict-aliasing/& -std=gnu99/' %{_builddir}/%{name}-%{version}/rpm/bundle-libdb.spec.in
+%endif
 rpmbuild  --define "_topdir $PWD" -bc %{_builddir}/%{name}-%{version}/rpm/bundle-libdb.spec.in
 popd
 %endif
 
-# Rebuild the autotool artifacts now.
+# Rebuild autotools artifacts
 autoreconf -fiv
 
 %configure \
@@ -676,26 +727,15 @@ autoreconf -fiv
 %if %{with bundle_libdb}
            --with-bundle-libdb=%{_builddir}/%{libdb_base_version}/BUILD/%{libdb_base_dir}/dist/dist-tls \
 %endif
-           --with-selinux $TMPFILES_FLAG \
+           --with-selinux \
            --with-systemd \
-           --with-systemdsystemunitdir=%{_unitdir} \
-           --with-systemdsystemconfdir=%{_sysconfdir}/systemd/system \
-           --with-systemdgroupname=%{groupname} \
-           --libexecdir=%{_libexecdir}/%{pkgname} \
-           $ASAN_FLAGS $MSAN_FLAGS $TSAN_FLAGS $UBSAN_FLAGS $RUST_FLAGS $CLANG_FLAGS $COCKPIT_FLAGS \
-%if 0%{?fedora} >= 34 || 0%{?rhel} >= 9
+           $ASAN_FLAGS $MSAN_FLAGS $TSAN_FLAGS $UBSAN_FLAGS $RUST_FLAGS $CLANG_FLAGS $COCKPIT_FLAGS $USDT_FLAGS \
            --with-libldap-r=no \
-%endif
 %if %{with hibp}
-	  --enable-hibp \
+           --enable-hibp \
 %endif
            --enable-cmocka
 
-# Avoid "Unknown key name 'XXX' in section 'Service', ignoring." warnings from systemd on older releases
-%if 0%{?rhel} && 0%{?rhel} < 9
-  sed -r -i '/^(Protect(Home|Hostname|KernelLogs)|PrivateMounts)=/d' %{_builddir}/%{name}-%{version}/wrappers/*.service.in
-%endif
-
 # lib389
 pushd ./src/lib389
 %{python3} validate_version.py --update
@@ -703,7 +743,7 @@ pushd ./src/lib389
 popd
 
 # Generate symbolic info for debuggers
-export XCFLAGS=$RPM_OPT_FLAGS
+export XCFLAGS="%{optflags}"
 
 %make_build
 
@@ -726,11 +766,16 @@ sed -i -e "/libback-bdb/d" plugins.list
 %endif
 
 # Copy in our docs from doxygen.
-cp -r %{_builddir}/%{name}-%{version}/man/man3 $RPM_BUILD_ROOT/%{_mandir}/man3
+cp -r %{_builddir}/%{name}-%{version}/man/man3 %{buildroot}/%{_mandir}/man3
 
 # lib389
 pushd src/lib389
 %pyproject_install
+%if 0%{?fedora} <= 41 || (0%{?rhel} && 0%{?rhel} <= 10)
+for clitool in dsconf dscreate dsctl dsidm openldap_to_ds; do
+    mv %{buildroot}%{_bindir}/$clitool %{buildroot}%{_sbindir}/
+done
+%endif
 %pyproject_save_files -l lib389
 popd
 
@@ -741,26 +786,25 @@ do
     install -p -m 0644 -D -t '%{buildroot}%{bash_completions_dir}' "${clitool}"
 done
 
-mkdir -p $RPM_BUILD_ROOT/var/log/%{pkgname}
-mkdir -p $RPM_BUILD_ROOT/var/lib/%{pkgname}
-mkdir -p $RPM_BUILD_ROOT/var/lock/%{pkgname} \
-    && chmod 770 $RPM_BUILD_ROOT/var/lock/%{pkgname}
+mkdir -p %{buildroot}/var/log/%{pkgname}
+mkdir -p %{buildroot}/var/lib/%{pkgname}
+mkdir -p %{buildroot}/var/lock/%{pkgname} \
+    && chmod 770 %{buildroot}/var/lock/%{pkgname}
 
-# for systemd
-mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/%{groupname}.wants
-install -p -D -m 0644 %{SOURCE4} %{buildroot}%{_sysusersdir}/389-ds-base.conf
+# For systemd
+mkdir -p %{buildroot}%{_sysconfdir}/systemd/system/%{groupname}.wants
 
-#remove libtool and static libs
-rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/*.a
-rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/*.la
-rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/plugins/*.a
-rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/plugins/*.la
-rm -f $RPM_BUILD_ROOT%{_libdir}/libsvrcore.a
-rm -f $RPM_BUILD_ROOT%{_libdir}/libsvrcore.la
+# Remove libtool and static libs
+rm -f %{buildroot}%{_libdir}/%{pkgname}/*.a
+rm -f %{buildroot}%{_libdir}/%{pkgname}/*.la
+rm -f %{buildroot}%{_libdir}/%{pkgname}/plugins/*.a
+rm -f %{buildroot}%{_libdir}/%{pkgname}/plugins/*.la
+rm -f %{buildroot}%{_libdir}/libsvrcore.a
+rm -f %{buildroot}%{_libdir}/libsvrcore.la
 
 %if %{with bundle_jemalloc}
 pushd ../%{jemalloc_name}-%{jemalloc_ver}
-make DESTDIR="$RPM_BUILD_ROOT" install_lib install_bin
+make DESTDIR="%{buildroot}" install_lib install_bin
 cp -pa COPYING ../%{name}-%{version}/COPYING.jemalloc
 cp -pa README ../%{name}-%{version}/README.jemalloc
 popd
@@ -773,7 +817,7 @@ libdbdestdir=$PWD/../%{name}-%{version}
 cp -pa $libdbbuilddir/LICENSE $libdbdestdir/LICENSE.libdb
 cp -pa $libdbbuilddir/README $libdbdestdir/README.libdb
 cp -pa $libdbbuilddir/lgpl-2.1.txt $libdbdestdir/lgpl-2.1.txt.libdb
-cp -pa $libdbbuilddir/dist/dist-tls/.libs/%{libdb_bundle_name} $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/%{libdb_bundle_name}
+cp -pa $libdbbuilddir/dist/dist-tls/.libs/%{libdb_bundle_name} %{buildroot}%{_libdir}/%{pkgname}/%{libdb_bundle_name}
 popd
 %endif
 
@@ -794,12 +838,12 @@ popd
 %endif
 
 %check
-# This checks the code, if it fails it prints why, then re-raises the fail to shortcircuit the rpm build.
+# Run cmocka unit tests
 %if %{with tsan}
 export TSAN_OPTIONS=print_stacktrace=1:second_deadlock_stack=1:history_size=7
 %endif
 %if %{without asan} && %{without msan}
-if ! make DESTDIR="$RPM_BUILD_ROOT" check; then cat ./test-suite.log && false; fi
+if ! make DESTDIR="%{buildroot}" check; then cat ./test-suite.log && false; fi
 %endif
 
 # Check import for lib389 modules
@@ -808,19 +852,17 @@ if ! make DESTDIR="$RPM_BUILD_ROOT" check; then cat ./test-suite.log && false; f
 %post
 if [ -n "$DEBUGPOSTTRANS" ] ; then
     output=$DEBUGPOSTTRANS
-    output2=${DEBUGPOSTTRANS}.upgrade
 else
     output=/dev/null
-    output2=/dev/null
 fi
 
-# reload to pick up any changes to systemd files
+# Reload to pick up any changes to systemd files
 /bin/systemctl daemon-reload >$output 2>&1 || :
 
-# Reload our sysctl before we restart (if we can)
-sysctl --system &> $output; true
+# Reload sysctl before restarting instances
+sysctl --system &> "$output"; true
 
-# Gather running instances, stop them, run index-check, then restart
+# Gather running instances, stop and restart them
 instbase="%{_sysconfdir}/%{pkgname}"
 instances=""
 ninst=0
@@ -831,7 +873,6 @@ for dir in "$instbase"/slapd-* ; do
     case "$dir" in *.removed) continue ;; esac
     basename=$(basename "$dir")
     inst="%{pkgname}@${basename#slapd-}"
-    inst_name="${basename#slapd-}"
     echo "found instance $inst - getting status" >> "$output" 2>&1 || :
     if /bin/systemctl -q is-active "$inst" ; then
        echo "instance $inst is running - stopping for upgrade" >> "$output" 2>&1 || :
@@ -874,6 +915,7 @@ fi
 %postun snmp
 %systemd_postun_with_restart %{pkgname}-snmp.service
 
+
 %files -f plugins.list
 %if %{with bundle_jemalloc}
 %doc LICENSE LICENSE.GPLv3+ LICENSE.openssl README.jemalloc
@@ -886,7 +928,7 @@ fi
 %config(noreplace)%{_sysconfdir}/%{pkgname}/schema/*.ldif
 %dir %{_sysconfdir}/%{pkgname}/config
 %dir %{_sysconfdir}/systemd/system/%{groupname}.wants
-%{_sysusersdir}/389-ds-base.conf
+%{_sysusersdir}/%{name}.conf
 %config(noreplace)%{_sysconfdir}/%{pkgname}/config/slapd-collations.conf
 %config(noreplace)%{_sysconfdir}/%{pkgname}/config/certmap.conf
 %{_datadir}/%{pkgname}
@@ -901,8 +943,6 @@ fi
 %{_mandir}/man1/ds-logpipe.py.1.gz
 %{_bindir}/ldclt
 %{_mandir}/man1/ldclt.1.gz
-%{_bindir}/logconv.pl
-%{_mandir}/man1/logconv.pl.1.gz
 %{_bindir}/logconv.py
 %{_mandir}/man1/logconv.py.1.gz
 %{_bindir}/pwdhash
@@ -920,8 +960,6 @@ fi
 %{_mandir}/man5/dirsrv.systemd.5.gz
 %{_libdir}/%{pkgname}/python
 %dir %{_libdir}/%{pkgname}/plugins
-# This has to be hardcoded to /lib - $libdir changes between lib/lib64, but
-# sysctl.d is always in /lib.
 %{_prefix}/lib/sysctl.d/*
 %dir %{_localstatedir}/lib/%{pkgname}
 %dir %{_localstatedir}/log/%{pkgname}
@@ -929,6 +967,8 @@ fi
 %exclude %{_sbindir}/ldap-agent*
 %exclude %{_mandir}/man1/ldap-agent.1.gz
 %exclude %{_unitdir}/%{pkgname}-snmp.service
+%exclude %{_bindir}/logconv.pl
+%exclude %{_mandir}/man1/logconv.pl.1.gz
 %if %{with bundle_jemalloc}
 %{_libdir}/%{pkgname}/lib/
 %{_libdir}/%{pkgname}/bin/
@@ -985,11 +1025,19 @@ fi
 %doc src/lib389/README.md
 %license LICENSE LICENSE.GPLv3+
 # Binaries
+%if 0%{?fedora} >= 42 || 0%{?rhel} >= 11
 %{_bindir}/dsconf
 %{_bindir}/dscreate
 %{_bindir}/dsctl
 %{_bindir}/dsidm
 %{_bindir}/openldap_to_ds
+%else
+%{_sbindir}/dsconf
+%{_sbindir}/dscreate
+%{_sbindir}/dsctl
+%{_sbindir}/dsidm
+%{_sbindir}/openldap_to_ds
+%endif
 %{_libexecdir}/%{pkgname}/dscontainer
 # Man pages
 %{_mandir}/man8/dsconf.8.gz
@@ -1004,6 +1052,17 @@ fi
 %{bash_completions_dir}/dscreate
 %{bash_completions_dir}/dsidm
 
+%if %{with logconvpl}
+%files logconv-perl
+%{_bindir}/logconv.pl
+%{_mandir}/man1/logconv.pl.1.gz
+%endif
+
+%if %{with repl_reports}
+%files -n python%{python3_pkgversion}-lib389-repl-reports
+# No files needed as this is just a meta-package for dependencies
+%endif
+
 %if %{with cockpit}
 %files -n cockpit-389-ds -f cockpit.list
 %{_datarootdir}/metainfo/389-console/org.port389.cockpit_console.metainfo.xml
@@ -1023,3 +1082,4 @@ fi
 
 %changelog
 %autochangelog
+

diff --git a/389-ds-base.sysusers b/389-ds-base.sysusers
deleted file mode 100644
index 32a3452..0000000
--- a/389-ds-base.sysusers
+++ /dev/null
@@ -1,3 +0,0 @@
-#Type Name     ID             GECOS                   Home directory       Shell
-g     dirsrv   389
-u     dirsrv   389:389        "user for 389-ds-base"  /usr/share/dirsrv/   /sbin/nologin

diff --git a/sources b/sources
index a4371cf..be05611 100644
--- a/sources
+++ b/sources
@@ -4,3 +4,4 @@ SHA512 (389-ds-base-3.2.2.tar.bz2) = 392d20bd016aa47884de256085c8bc74649559f81c9
 SHA512 (vendor-3.2.2-1.tar.gz) = adc2c52745c6659d9142edb32b7077f317a2bf3e77873d4cff799ffd33b8546c3018601ebd67e1790afa5b8c4074b031fa12fa3d55af02803f5a3dc849c319d9
 SHA512 (Cargo-3.2.2-1.lock) = 3fee255f1d8aef9d15d53cc44a824dbe9a6a96142393ee1c40bfd198a84be1b91b44923f140cac10408e593da261db3a0ad7f3f72d3f9498975138b3b67341f9
 SHA512 (cockpit_dist-3.2.2-1.tar.bz2) = 24b660f79564c515b0fca3df6bca485a6fe3b05d04be86dfd579f2e5b5453970f5ffeeb183ee19ceeb2a2617b9240147b328c96328f1cbb8a53dad1360b47d1c
+SHA512 (389-ds-base-3.2.3.tar.bz2) = 00ebbe44a3c055c1049ddef0b47eb3dde1f70a05febfb7632f3a7164be5f44e788d156fcac7902b22462d60cf5f1034ce52f94244b1344a559258388767cc158