Add openldap its9295.patch to fix an ADD might conflict with an existing value.

Dockerfile

 FROM debian:buster-slim AS builder
 ADD build.sh /
+# https://rt.symas.com/rt/Ticket/Display.html?id=1628
+# Fix access log ADD/DELETE order bug
+ADD its9295.patch /
 RUN /build.sh
 
 FROM debian:buster-slim

build.sh

@@ -30,6 +30,7 @@ function apt_get_install {
     libtcmalloc-minimal4 \
     openssl \
     make \
+    patch \
     wget
 }
 
@@ -58,6 +59,9 @@ function install_cyrus_sasl {
 # Install OpenLDAP
 function install_openldap {
     cd ${WORKDIR}/${OPENLDAP_VERSION}
+    echo "patch -p1 /its9295.patch"
+    ls -l /its9295.patch
+    patch -p1 < /its9295.patch
     ./configure \
         --prefix=/usr \
         --libexecdir='${prefix}/lib' \

its9295.patch

+From 85244305392c76334d60296b2e06050935f11986 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
+Date: Thu, 1 Apr 2021 15:17:14 +0100
+Subject: [PATCH] ITS#9295 Handle add+delete on a single-value attr
+
+---
+ servers/slapd/syncrepl.c             | 17 +++++++++++++----
+ 2 files changed, 24 insertions(+), 4 deletions(-)
+
+diff --git a/servers/slapd/syncrepl.c b/servers/slapd/syncrepl.c
+index 457c6cb87..4a64b330d 100644
+--- a/servers/slapd/syncrepl.c
++++ b/servers/slapd/syncrepl.c
+@@ -2296,9 +2296,16 @@ syncrepl_accesslog_mods(
+ 			mod->sml_nvalues = NULL;
+ 			mod->sml_numvals = 0;
+ 
+-			/* Keep 'op' to reflect what we read out from accesslog */
+-			if ( op == LDAP_MOD_ADD && is_at_single_value( ad->ad_type ))
+-				mod->sml_op = LDAP_MOD_REPLACE;
++			if ( is_at_single_value( ad->ad_type ) ) {
++				if ( op == LDAP_MOD_ADD ) {
++					/* ITS#9295 an ADD might conflict with an existing value */
++					mod->sml_op = LDAP_MOD_REPLACE;
++				} else if ( op == LDAP_MOD_DELETE ) {
++					/* ITS#9295 the above REPLACE could invalidate subsequent
++					 * DELETEs */
++					mod->sml_op = SLAP_MOD_SOFTDEL;
++				}
++			}
+ 
+ 			*modtail = mod;
+ 			modtail = &mod->sml_next;
+@@ -2556,6 +2563,7 @@ syncrepl_resolve_cb( Operation *op, SlapReply *rs )
+ 						continue;
+ 					}
+ 					if ( m2->sml_op == LDAP_MOD_DELETE ||
++						m2->sml_op == SLAP_MOD_SOFTDEL ||
+ 						m2->sml_op == LDAP_MOD_REPLACE ) {
+ 						int numvals = m2->sml_numvals;
+ 						if ( m2->sml_op == LDAP_MOD_REPLACE )
+@@ -2567,7 +2575,8 @@ drop:
+ 							op->o_tmpfree( m1, op->o_tmpmemctx );
+ 							continue;
+ 						}
+-						if ( m1->sml_op == LDAP_MOD_DELETE ) {
++						if ( m1->sml_op == LDAP_MOD_DELETE ||
++							m1->sml_op == SLAP_MOD_SOFTDEL ) {
+ 							if ( m1->sml_numvals == 0 ) {
+ 								/* turn this to SOFTDEL later */
+ 								m1->sml_flags = SLAP_MOD_INTERNAL;