CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

net/samba419 4.19.9_14

Free SMB/CIFS and AD/DC server and client for Unix

Port info

Maintainer
samba@FreeBSD.org
Packages
latest: 4.19.9_14
Upstream
up to date
Last update
to 4.19.9_14 · d5267ac859
Quarterly
2026Q4: 4.19.9_13 3 unaddressed
WWW
https://gitlab.com/samba-freebsd/
Links
cgit · VuXML

Install

Package
# pkg install samba419
installs 4.19.9_14 from latest; from quarterly (2026Q4) 4.19.9_13
Port
# cd /usr/ports/net/samba419 && make install clean
# make -C /usr/ports/net/samba419 config  # change options first
Size
15 MiB download · 85 MiB installed
Depends on
archivers/libarchive 3.8.8,1, converters/libiconv 1.18_1, databases/ldb28 2.8.2_4, databases/openldap26-client 2.6.16, databases/tdb 1.4.9_1,1, devel/gamin 0.1.10_10, devel/gettext-runtime 1.0_1, devel/jansson 2.15.1_1, devel/libinotify 20240724_3, devel/libunwind 20250904, devel/popt 1.19,2, devel/readline 8.3.6, devel/talloc 2.4.1_1, devel/tevent 0.15.0_2, dns/py-dnspython 2.9.0,1, lang/python312 3.12.15, net/avahi-app 0.8_6, security/gnutls 3.8.13, security/libgcrypt 1.12.4, security/libtasn1 4.21.0, sysutils/libsunacl 1.0.1_1, textproc/py-markdown 3.10.3
License
GPLv3+
Options
14 of 21 on in the package: ADS AD_DC AVAHI DOCS FAM FRUIT GSSAPI_BUILTIN LDAP MANPAGES PROFILE PYTHON3 QUOTAS SYSLOG UTMP
Show the 7 options that are off
CLUSTER CUPS GLUSTERFS GPGME GSSAPI_MIT MDNSRESPONDER ZEROCONF_NONE
pkg-message
Shown after installing
How to start: http://wiki.samba.org/index.php/Samba4/HOWTO

* Your configuration is: /usr/local/etc/smb4.conf

* All the relevant databases are under: /var/db/samba4

* All the logs are under: /var/log/samba4

* Provisioning script is: /usr/local/bin/samba-tool

For the working DNS updates you will need to either build dns/bind9*
with the enabled GSSAPI(GSSAPI_MIT5 is recommended) or install
dns/samba-nsupdate package, which is preconfigured with such a support.

You will need to specify location of the 'nsupdate' command in the
smb4.conf file:

    nsupdate command = /usr/local/bin/samba-nsupdate -g

For additional documentation check: https://wiki.samba.org/index.php/User_Documentation

Port related bug reports can go to the https://gitlab.com/samba-freebsd/ports/-/issues or
to the FreeBSD Bugzilla https://bugs.freebsd.org/

All Samba related bug reports should go to the: https://bugzilla.samba.org/
Shown always
===>   NOTICE:

This port is deprecated; you may wish to reconsider installing it:

Discontinued upstream; transition to a supported versions of Samba (refer to https://wiki.samba.org/index.php/Samba_Release_Planning).

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 164.19.9_144.19.9_13–
FreeBSD 154.19.9_144.19.9_13–
FreeBSD 14✗4.19.9_134.19.9_14

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 154.19.9_134.19.9_13–
FreeBSD 144.19.9_134.19.9_134.19.9_13

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (3)

The CVE record lists the packaged version 4.19.9_14 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-44089.02026-05-28A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" fea…
CVE-2026-30128.02026-05-27A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an u…
CVE-2026-23406.52026-05-27A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a confi…

VuXML only (0)

Listed in VuXML, the packaged version 4.19.9_14 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (5) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
251730maintainer-feedback? net/samba419: [RFE] add support for vfs_shadow_copy_zfsOpen2026-02-20
284734maintainer-feedback? net/samba419 is reporting missing libraryOpen2026-02-19
289294maintainer-feedback? net/samba419: DeprecateIn Progress2025-12-18
280781maintainer-feedback? net/samba419 - winbindd does not startOpen2025-11-10
282136maintainer-feedback? net/samba416 net/samba419: Remove reachable assertion in ACL parserOpen2025-02-18

Commits (41)

Xavier Beaudouin (kiwi) · 4.19.9_14
net/samba4*: fix lmdb breakage

PR:		299660
Reported by:	Matthew Wener <matthew@wener.org>
Sponsored by:	Klara, Inc.
d5267ac859
Baptiste Daroussin (bapt) · 4.19.9_14
databases/lmdb: allow to install both 0.x and 1.x together

LMDB 1.0 and the legacy 0.9 ABI cannot be mixed, the datanase format are
incompatibles as well.

Rename or relocate everything databases/lmdb0 installs so that it no
longer overlaps with databases/lmdb:
- the utilities are now mdb_copy0, mdb_dump0, mdb_load0 and mdb_stat0
- the header is include/lmdb0/lmdb.h
- the linker name is liblmdb0.so, the shared object keeps its ABI name
  liblmdb.so.0 so already linked programs are unaffected
- the pkg-config file is lmdb0.pc

A compatibility prefix holding the previous layout is also installed
under ${PREFIX}/lmdb0/ (include/, lib/ and libdata/pkgconfig/) so that
build systems which expect to find lmdb.h and -llmdb relative to a
single directory only need a path change.

Now all ports should migrate to lmdb 1.X and use the lmdb 0.9 port to ease
in the migration path, lmdb, the lmdb 0.x is supposed to get removed at
some point.

Approved by:	mat (portmgr)
Reviewed by:	mat
Differential Revision:	https://reviews.freebsd.org/D60741
85ba298b7e
Gleb Popov (arrowd) · 4.19.9_13
*: Fix dependency on lmdb0
7a7dea4414
Xin LI (delphij) · 4.19.9_13
databases/lmdb0: Add port for LMDB 0.9.x legacy ABI

LMDB 1.0 introduced an incompatible on-disk format change and subtle
API breakage: applications that compiled cleanly against 1.0 headers
could fail silently at run time. Known affected ports include dns/knot3,
mail/bogofilter, and mail/postfix; the postfix issue has been confirmed
upstream. Linux distributions such as Arch Linux have observed the same
breakage. Samba can also be affected in certain configurations.

Because the regression is not detectable in an -exp build run -- the
postfix failure only manifests at run time, and bogofilter was caught
only because post-build self-tests happen to exercise this path -- we
cannot rely on package builds to validate the 1.0 upgrade.

This commit introduces databases/lmdb0 as a holding port for the 0.9.35
release, pinned to the 0.x branch with PORTSCOUT=limit:^0. and mutually
conflicting with databases/lmdb, which retains 1.0. The two packages
cannot be installed simultaneously, but having lmdb0 available means:

* Ports known to require the 0.9 ABI can declare an explicit dependency
  on databases/lmdb0 until they are validated against 1.0.
* Users with existing databases in the 0.9 format can still access the
  mdb_dump and mdb_load utilities to migrate data before upgrading.
* The package conflict prevents accidental mixing.

All 50 direct dependents of databases/lmdb are redirected to
databases/lmdb0 for now with a PORTREVISION bump, effectively restoring
the tree to the state prior to the LMDB 1.0 update. Once all dependent
ports are validated against LMDB 1.0, they will be moved back to
databases/lmdb and databases/lmdb0 will be removed.

PR:             ports/296530
5f9d389f29
Rene Ladan (rene) · 4.19.9_12
all: drop support for FreeBSD 13, mips and risc64sf

Reviewed by:            many (*)
Differential Revision:  https://reviews.freebsd.org/D55624
Differential Revision:  https://reviews.freebsd.org/D55642 (merged in from bofh)

many (*)
  acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga
  jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka
  nobutaka pkubaj se tagattie thj

  Anton Saietskii
  GenericRikka
  Gert Doering
  Jan Bramkamp
  Oleh Hushchenkov
  Oleksandr Kryvulia
  Ralf van der Enden
  Yamagi

  desktop kde python tcltk office
2a7c056120
Gleb Popov (arrowd) · 4.19.9_12
net/samba419: Add patches to fix ndr.h consumers (i.e. SSSD)

This is the same change that was applied to net/samba416 in
fd6a710e199bdba2b2df37a481038e743da895dd

PR:		293566
Approved by:	samba (maintainer timeout)
4ab6b6bf9b
Mateusz Piotrowski (0mp) · 4.19.9_11
net/samba419: opt out from Features/fortify.mk

[...]
Checking for freebsd sendfile support                                                           : not found
sendfile support not found but it was requested !
(complete log in /wrkdirs/usr/ports/net/samba419/work/samba-4.19.9/bin/config.log)
===>  Script "configure" failed unexpectedly.
[...]

PR:	292389
ed93436abf
Daniel Engberg (diizzy) · 4.19.9_11
treewide: Remove references to USES= fam and move to LIB_DEPENDS

Only a handful of ports in tree uses this helper which
used to make a switch between devel/fam and devel/gamin more
convenient. With devel/fam going away there's no need to maintain
this any further for a handful of ports.

Approved by:	blanket
97f98ba45c
Mateusz Piotrowski (0mp) · 4.19.9_11
net/samba419: Deprecate without expiration date

This is meant to give notice to Samba users that 4.19 is not supported
anymore. The default Samba in the tree is 4.16 currently, so removing
4.19 most likely will not be a big task.

PR:	289294
8925562b65
Juraj Lutter (otis) · 4.19.9_11
net/samba419: Fix generated README.FreeBSD

Fix the substitution variable (AC_DC -> AD_DC)

Approved by:	arrowd
136ae68191
Cy Schubert (cy) · 4.19.9_10
net/samba419: Add support for MIT KRB5 in base

FreeBSD 15 will ship with MIT KRB5 in base. Detect this accordingly.

PR:             287597
exp-run by:     antoine
afec98c003
Jason E. Hale (jhale) · 4.19.9_9
*/*: Bump security/gpgme consumers
dbab074be0
Jason E. Hale (jhale) · 4.19.9_8
security/gpgme: Update to 2.0.0

Upstream has split most of the bindings out into separate projects with
this release, so the child ports that were previously providing various
bindings are now autonomous and have new origins. The python bindings
should have been called py-gpg for many years now, since 'gpg' is the
actual module name, so this also corrects that issue.

security/gpgme-cpp -> security/gpgmepp
security/gpgme-qt -> security/qgpgme
security/py-gpgme -> security/py-gpg

gpgmepp and qgpgme have been converted to CMake. py-gpg is now a "fun"
autotools and FreeBSD ports system hybrid. Gpgme, itself, still uses
autotools, but with much less parenting (patching) to do for its
emancipated children.

Adjust several ports to fix API incompatibility with upstream patches
and with some of my own. Adjust all consumers to use the new port
origins of the former child ports.

https://dev.gnupg.org/T7673
217815b0af
Charlie Li (vishwin) · 4.19.9_8
python.mk: rename PYTHON_EXT_SUFFIX to PYTHON_TAG, document, etc

EXT_SUFFIX, according to PEP 3149, refers to the full tag and
extension for compiled extension module objects, eg .cpython-311.so,
.cpython-313t.so, etc. We do not use the correct semantic meaning,
and this usage becomes ambiguous and confusing when tags do not
match between bytecode and compiled extension module objects.

Rename our PYTHON_EXT_SUFFIX to PYTHON_TAG to align with PEP 3147's
specification of a magic tag, which consists of implementation name
and shorthand version only. This is meant for bytecode and other
files containing this tag in their filename that do not depend on
a specific Python ABI for the same version. Chase all existing
consumers.

Introduce PYTHON_SOABI to align with PEP 3149's specification of a
tag, which consists of implementation name, shorthand version and
any ABI flags present (this and PYTHON_TAG are identical without
ABI flags). This is meant for compiled extension module objects and
other files that depend on a specific Python ABI for the same
version.

Add documentation for these variables that our PYTHON_EXT_SUFFIX
never had.

PR: 274671
Event: Kitchener-Waterloo Hackathon 202506
4f0eba1efd
Michael Osipov (michaelo) · 4.19.9_8
net/samba4{19,20}: Rework manpages handling

* Rename option MANDOC to MANPAGES to match with other ports and
  Mk/bsd.options.desc.mk.
* Remove outdated, incorrect, precompiled manpages from ${FILESDIR}/files/man.
* Properly disable manpages generation since XSLTPROC was set to true(1) WAF
  always assumed xsltproc(1) to work and if any automatic dependency pulled in
  textproc/docbook-xsl, manpages were generated even if explicitly disabled.

PR:		281415
Approved by:	jrm (mentor), mikael, 0mp
Differential Revision:	https://reviews.freebsd.org/D49299
6cbfa0518c
Gleb Popov (arrowd) · 4.19.9_7
*: Bump revisions after dbus update

PR:		285253
Reported by:	Martin Birgmeier <d8zNeCFG@aon.at>
a347a92e6e
Baptiste Daroussin (bapt) · 4.19.9_6
net/samba*: fix plist after removal of SPOTLIGHT option
326940989c
Baptiste Daroussin (bapt) · 4.19.9_6
gnome: remove tracker2

Tracker2 has long ago been replaced by tracker3 which is also gone now
and replaced by tinysparql.

Tracker2 is creating some complication for many ports (including
grilo-plugins) when installed, considering it not supported anymore,
just remove it instead of fighting it in each related port
493e48d247
Michael Osipov (michaelo) · 4.19.9_6
net/samba4{19,20}: "samba-tool domain backup offline" hangs

PR:		250906
Tested by:	ml@netfence.it
Approved by:	otis (mentor), kiwi, vvd, allanjude
MFH:		2025Q1
Differential Revision:	https://reviews.freebsd.org/D49044
1db23ed5ef
Xavier Beaudouin (kiwi) · 4.19.9_5
net/samba419: Fix plist for ad_dc replication

PR:		281672
Reported by:	Oljas Kuzembaev <oljas@oml.su>
Approved by:	0mp (mentor)
Approved by:	samba (0mp, kiwi)
Differential Revision:	https://reviews.freebsd.org/D48827
ff0a14ef5f
Vladimir Druzenko (vvd) · 4.19.9_5
net/samba419: add support of dns/bind920 for option AD_DC

PR:		284031
Approved by:	0mp (samba)
81b7938f65
Michael Osipov (michaelo) · 4.19.9_4
net/samba419: Dynamically calculate FreeBSD proc_fd_pattern

Port timur's patch for dynamic calcuation of the proc fd (fdescfs)
pattern mounted by the samba_server RC script from net/samba416.

Tested by:	michaelo
Approved by:	jrm (mentor), mikael, timur
MFH:		2025Q1
Differential Revision:	https://reviews.freebsd.org/D48416
f3ab3f3b2b
Michael Osipov (michaelo) · 4.19.9_3
net/samba419: Use a simple approach to reconcile O_PATH and vfs_zfsacl

The current, sophisticated approach does not fully cover all usecases and flag
twiddling around O_EMPTY_PATH, resort to use working fdescfs(5) magic for now.

PR:		277878
Tested by:	michaelo, vvd, Peter Eriksson
Approved by:	jrm (mentor), vvd, mikael (samba)
MFH:		2025Q1
Differential Revision:	https://reviews.freebsd.org/D48399
24fbb52094
Michael Osipov (michaelo) · 4.19.9_2
net/samba419: Fix procfd search patterns for FreeBSD

PR:		277878
Approved by:	jrm (mentor)
Tested by:	michaelo, Antti Rasinen
MFH:		2025Q1
Differential Revision:	https://reviews.freebsd.org/D48313
39b0576274
Rene Ladan (rene) · 4.19.9_1
all: remove support for expired FreeBSD 13.3

Reviewed by:	bofh, brnrd, jbeich, nobutaka
Approved by:	portmgr (implicit)
Differential Revision: https://reviews.freebsd.org/D48247
8777dde246
Yasuhiro Kimura (yasu) · 4.19.9_1
net/samba419: Update to 4.19.9

ReleaseNotes:	https://www.samba.org/samba/history/samba-4.19.9.html

PR:		282254
Reviewed by:	0mp
Differential Revision:	https://reviews.freebsd.org/D47183
f8c19ed2ce
Dimitry Andric (dim) · 4.19.8_1
net/samba419: fix rl_completion_func_t detection and usage

After a recent devel/readline update, net/samba419 fails to compile with
clang 19, resulting in errors similar to:

  ../../libcli/smbreadline/smbreadline.c:139:38: warning: 'CPPFunction' is deprecated [-Wdeprecated-declarations]
    139 |                 rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn;
        |                                                    ^
  ../../lib/replace/system/readline.h:50:31: note: expanded from macro 'RL_COMPLETION_CAST'
     50 | #  define RL_COMPLETION_CAST (CPPFunction *)
        |                               ^
  /usr/local/include/readline/rltypedefs.h:38:50: note: 'CPPFunction' has been explicitly marked deprecated here
     38 | typedef char **CPPFunction (void) __attribute__((deprecated));
        |                                                  ^
  ../../libcli/smbreadline/smbreadline.c:139:36: error: incompatible function pointer types assigning to 'rl_completion_func_t *' (aka 'char **(*)(const char *, int, int)') from 'CPPFunction *' (aka 'char **(*)(void)') [-Wincompatible-function-pointer-types]
    139 |                 rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn;
        |                                                  ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

There are two reasons: samba checks for `rl_completion_t`, while the
actual readline type is `rl_completion_func_t`, and samba's wrapper
`readline.h` header prefers the `CPPFunction` type which is deprecated,
while it should use `rl_completion_func_t` instead.

Fix the `wscript_configure` check to detect `rl_completion_func_t`, and
reverse the `HAVE_RL_COMPLETION_T` and `HAVE_CPPFUNCTION` checks in the
wrapper header.

PR:		281818
Reviewed by:	0mp
Approved by:	samba (0mp)
MFH:		2024Q3
c81f658808
Mateusz Piotrowski (0mp) · 4.19.8_1
net/samba419: Update to 4.19.8

Changelog:	https://www.samba.org/samba/history/samba-4.19.8.html

PR:		280861
Approved by:	samba (mikael, yasu, 0mp)
5a2b8d2797
Mateusz Piotrowski (0mp) · 4.19.7_1
net/samba419: Use external dependencies by default

The Samba package can be built with the following dependencies bundled
in: cmocka, talloc, tevent, tdb, and ldb. This is a handy way of getting
the right versions of all those dependencies. Unfortunately, the bundled
dependencies conflict with their packaged counterparts, which leads to
the build and installation issues with packages like security/sssd2 and
net/freeradius3. Building Samba without the bundled dependencies
resolves those issues, so let's do that.

PR:		280557
Approved by:	samba (mikael, 0mp)
Sponsored by:	Klara, Inc.
e75af545d1
Mateusz Piotrowski (0mp) · 4.19.7
*/*: Let samba@ maintain ldb, tdb, talloc, tevent, and Samba

PR:		280556
Approved by:	portmgr
b6ec64a9a2
Mateusz Piotrowski (0mp) · 4.19.7
net/samba419: Allow setting *_BUNDLED_* via make.conf

PR:		280557
Approved by:	portmgr blanket
a852ac5ac0
Mateusz Piotrowski (0mp) · 4.19.7
net/samba419: Update version checks for ldb; switch to ldb28

Samba 4.19 requires ldb 2.8.1 or newer to build without bundled
dependencies.

PR:		280510
Approved by:	portmgr blanket
Sponsored by:	Klara, Inc.
cdfadb1ecc
Mateusz Piotrowski (0mp) · 4.19.7
net/samba419: Update required version for tevent

The configure step fails with:

> Checking for system tevent (>=0.15.0) : not found
> ERROR: System library tevent of version 0.15.0 not found, and bundling disabled
> ===>  Script "configure" failed unexpectedly.

PR:		280510, 280511
Approved by:	portmgr blanket
Sponsored by:	Klara, Inc.
7378f1a62f
Mateusz Piotrowski (0mp) · 4.19.7
net/samba419: Update version requirements for talloc

The configure step fails with the following message:

> Checking for system talloc (>=2.4.1) : not found
> ERROR: System library talloc of version 2.4.1 not found, and bundling disabled
> ===>  Script "configure" failed unexpectedly.

Update the required talloc version accordingly in the makefile.

PR:		280510, 280509
Sponsored by:	Klara, Inc.
Approved by:	portmgr blanket
fb7abac7e1
Mateusz Piotrowski (0mp) · 4.19.7
net/samba419: Require the right version of unbundled tdb

When building with SAMBA4_BUNDLED_TDB=no, the configure target errors out with
the following message:

> Checking for system tdb (>=1.4.9) : not found
> ERROR: System library tdb of version 1.4.9 not found, and bundling disabled
> ===>  Script "configure" failed unexpectedly.

Update the version requirements in the makefile accordingly.

To address this properly, we need to bring databases/tdb 1.4.9 to the ports
tree.

Approved by:	portmgr blanket
Fixes:		b0a4fa4a12b0 net/samba419: Add new port
Sponsored by:	Klara, Inc.
b4cee81fd9
Yasuhiro Kimura (yasu) · 4.19.7
net/samba419: Update to 4.19.7

ReleaseNotes:	https://www.samba.org/samba/history/samba-4.19.7.html
PR:		279701
Approved by:	maintainer
bdc87c7a2d
Yoshihiro Takahashi (nyan) · 4.19.6_1
net/samba419: Fix startup script in a jail environment

PR:		275343
Approved by:	mikael (maintainer, ports committer)
9e9e06725b
Yasuhiro Kimura (yasu) · 4.19.6
net/samba419: Update to 4.19.6

ReleaseNotes:	https://www.samba.org/samba/history/samba-4.19.6.html
PR:		278508
Approved by:	maintainer
04d410676d
Mikael Urankar (mikael) · 4.19.5_1
net/samba419: fix conflict with talloc

PR:		276988
06b59a3047
Yasuhiro Kimura (yasu) · 4.19.5
net/samba419: Update to 4.19.5

ReleaseNotes:	https://www.samba.org/samba/history/samba-4.19.5.html
PR:		277162
Approved by:	maintainer
5e2f668373
Mikael Urankar (mikael) · 4.19.4
net/samba419: Add new port

Many thanks to Joshua Kinard, Siva Mahadevan, Yasuhiro Kimura, Andrew Walker, and Peter Eriksson for their patches.

PR:		270383
b0a4fa4a12