[autobackport: sssd-2-12] Use macro rather than shell expansion for string processing in spec file

[sssd-bot]

This is an automatic backport of PR#8511 Use macro rather than shell expansion for string processing in spec file to branch sssd-2-12, created by @nforro.

Please make sure this backport is correct.

Note

The commits were cherry-picked without conflicts.

You can push changes to this pull request

git remote add sssd-bot git@github.com:sssd-bot/sssd.git
git fetch sssd-bot refs/heads/SSSD-sssd-backport-pr8511-to-sssd-2-12
git checkout SSSD-sssd-backport-pr8511-to-sssd-2-12
git push sssd-bot SSSD-sssd-backport-pr8511-to-sssd-2-12 --force

---

Original commits
f9697d4 - Use macro rather than shell expansion for string processing in spec file
caa0ec2 - Add a default for %samba_package_version

Backported commits

• 1a57a38 - Use macro rather than shell expansion for string processing in spec file
• 1e1d106 - Add a default for %samba_package_version

---

Original Pull Request Body

We've hardened security in Packit Service and shell expansions in spec files are now rejected as they can be used to execute arbitrary code. There is no need to use shell expansion for string processing, there is an existing macro for this very purpose.

[gemini-code-assist]

Code Review

This pull request significantly improves the security and robustness of the sssd.spec.in file. The replacement of shell expansion with the %{gsub} RPM macro directly addresses a security vulnerability by preventing arbitrary code execution during the build process. Furthermore, the addition of a default value for samba_package_version enhances the reliability of the spec file, ensuring that the build does not fail if the Samba development package version cannot be determined.

[thalman]

Build failure in rawhide is not connected with the change

[sssd-bot]

The pull request was accepted by @thalman with the following PR CI status:

---

🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-42-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-44-x86_64:upstream (success)
🔴 rpm-build:fedora-rawhide-x86_64:upstream (failure)
🟢 Build / freebsd (success)
🟢 Build / make-distcheck (success)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.

[thalman]

Build failure in rawhide is not connected with the change