[SSSD] [RFC on PATCH] drop krb5-config and use pkg-config

Sumit Bose sbose at redhat.com
Wed Mar 25 16:14:16 UTC 2015


On Wed, Mar 25, 2015 at 11:48:42AM -0400, Simo Sorce wrote:
> On Wed, 2015-03-25 at 16:33 +0100, Lukas Slebodnik wrote:
> > On (25/03/15 11:15), Simo Sorce wrote:
> > >Hello team!
> > >So ... :)
> > >... yesterday I had to work around a bug in the rawhide build of libkrb5
> > >that rendered krb5-config buggy and broke gssproxy 0.4.0 build.
> > >At the end I decided to avoid the problem completely by switching the
> > >gssproxy packages to build using pkg-config instead of krb5-config.
> > >
> > >Given other packages are in the same boat wrt rawhide and my general
> > >dislike for the non-standard krb5-config I have made a patch to let SSSD
> > >also drop the use of krbn5-config.
> > >
> > We would need to fallback to krb5-config anyway,
> > because krb5 on CentOS 6.6 and 7.0 does not provide pkg config files :-(
> 
> Ok, the old code could be retained in the if/else/fi branches of the
> current code, feel free to take over.
> 
> > >I am not entirely sure we want/can switch immediately if we want to keep
> > >building on older krb5 releases, but the patch was simple and so I am
> > >throwing it here for consideration.
> > >
> > >Simo.
> > >
> > >-- 
> > >Simo Sorce * Red Hat, Inc * New York
> > 
> > >From cd2ed8cd14f3d113345a7c9e2271d9ffa38afbe1 Mon Sep 17 00:00:00 2001
> > >From: Simo Sorce <simo at redhat.com>
> > >Date: Wed, 25 Mar 2015 10:52:43 -0400
> > >Subject: [PATCH] BUILD: Use pkg-config for krb5
> > >
> > >Since a few versions now libkrb5 provide proper pkg-config support, at the
> > >same time krb5-config is less than optimal because in some cases it pulls
> > >in additional LDFLAGS in --libs instead of just the list of libraries.
> > >
> > >Signed-off-by: Simo Sorce <simo at redhat.com>
> > >---
> > > contrib/ci/deps.sh            |  1 -
> > > src/external/krb5.m4          | 17 +++++++----------
> > > src/external/pac_responder.m4 | 22 +++++-----------------
> > > 3 files changed, 12 insertions(+), 28 deletions(-)
> > >
> > 
> > >diff --git a/src/external/pac_responder.m4 b/src/external/pac_responder.m4
> > >index b57305c1d7b90b59e023b1645188f20b9be88677..1e6346b638dfdea7d4f709484f24371c2f6d4680 100644
> > >--- a/src/external/pac_responder.m4
> > >+++ b/src/external/pac_responder.m4
> > >@@ -14,23 +14,11 @@ then
> > >     PKG_CHECK_MODULES(NDR_KRB5PAC, ndr_krb5pac, ndr_krb5pac_ok=yes,
> > >         AC_MSG_WARN([Cannot build pac responder without libndr_krb5pac]))
> > > 
> > >-    AC_PATH_PROG(KRB5_CONFIG, krb5-config)
> > >-    AC_MSG_CHECKING(for supported MIT krb5 version)
> > >-    KRB5_VERSION="`$KRB5_CONFIG --version`"
> > >-    case $KRB5_VERSION in
> > >-        Kerberos\ 5\ release\ 1.9* | \
> > >-        Kerberos\ 5\ release\ 1.10* | \
> > >-        Kerberos\ 5\ release\ 1.11* | \
> > >-        Kerberos\ 5\ release\ 1.12* | \
> > >-        Kerberos\ 5\ release\ 1.13*)
> > >-            krb5_version_ok=yes
> > >-            AC_MSG_RESULT([yes])
> > >-            ;;
> > >-        *)
> > >-            AC_MSG_RESULT([no])
> > >-            AC_MSG_WARN([Cannot build authdata plugin with this version of
> > >-                         MIT Kerberos, please use 1.9.x or later])
> > >-    esac
> > >+    PKG_CHECK_MODULES([KRB5], [krb5 >= 1.9.0], [krb5_version_ok=yes], [krb5_version_ok=])
> > >+    if test x$krb5_version_ok = x; then
> > >+        AC_MSG_WARN([Cannot build authdata plugin with this version of
> > >+                     MIT Kerberos, please use 1.9.x or later])
> > >+    fi
> > > fi
> > 
> > I wanted to simplify detection in this file a year ago
> > and Sumit wanted to explicitly check each version separately,
> > because private krb5 interface is used and it could be changed
> > in never releases of mit-krb5.
> 
> It can be done with pkg-config too, you have an example of testing that
> in configure.ac, it is used with the dbus-1 detection, the code would be
> sligfhtly different.
> I do not see the utility of preserving explicit cases if the just fall
> back into each other tbh though.

The case block is a reminder to check the authdata plugin interface for
every new major release. Unfortunately this plugin interface is still
not public and SSSD has to maintain its own definition of it. If the
interface changes (I would expect it never will) there is a fair chance
we will cause issues in application processing Kerberos tickets with a
PAC. I think an occasional build failure in rawhide is easier to detect
than this kind of issues hence I asked Lukas to keep it this way.

bye,
Sumit

> 
> Simo.
> 
> -- 
> Simo Sorce * Red Hat, Inc * New York
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list