Make security/heimdal also provide krb5-gssapi.pc? Correct include path?

["Dr. Thomas Orgis" <thomas.orgis%uni-hamburg.de@localhost>]

Hi,

for me, x11/qt5-qtbase fails to build on my Ubuntu box because it tries
to use a mismatch of gssapi headers and libraries, confused between
pkgsrc-installed heimdal (pulled in by libcups without my active
consent … just a default) and mit-krb5 from Ubuntu.

The search pattern for gssapi is visible at

	https://code.qt.io/cgit/qt/qtbase.git/tree/src/network/configure.json

in this piece:


            "sources": [
                { "libs": "-framework GSS", "condition": "config.darwin" },
                { "type": "pkgConfig", "args": "krb5-gssapi" },
                "-lgssapi_krb5"

It looks for -framework GSS on Darwin (shouldn't that also be handled
in mk/krb5.bl3?), then for krb5-gssapi.pc, then for -lgssapi_krb5. The
last straw works on Ubuntu, thinking it would be fine to use the
mit-krb5 in the system.

If devel/pkgconf would honour the default system search paths, qtbase
would have found Ubuntu's krb5-gssapi.pc (see my previous mail). In any
case, this wouldn't be what is desired if you had intentionally set up
pkgsrc to use heimdal.

With the attached patch, pkgsrc's heimdal provides krb5-gssapi.pc as a
symlink and causes this in qtbase's configure:

Trying source 0 (type inline) of library gssapi ...
  => source failed condition 'config.darwin'.
Trying source 1 (type pkgConfig) of library gssapi ...
+ /data/pkgwork/x11/qt5-qtbase/work/.tools/bin/pkg-config --exists --silence-errors krb5-gssapi
+ /data/pkgwork/x11/qt5-qtbase/work/.tools/bin/pkg-config --modversion krb5-gssapi
> 1.5.3
+ /data/pkgwork/x11/qt5-qtbase/work/.tools/bin/pkg-config --libs-only-L krb5-gssapi
> -L/data/pkg/lib 
+ /data/pkgwork/x11/qt5-qtbase/work/.tools/bin/pkg-config --libs-only-l krb5-gssapi
> -lgssapi -lheimntlm -lkrb5 -lhx509 -lcom_err -lhcrypto -lasn1 -lwind -lroken -lcrypt -ldl -lresolv -lpthread -lrt 
+ /data/pkgwork/x11/qt5-qtbase/work/.tools/bin/pkg-config --cflags krb5-gssapi
> -I/data/pkg/include 

I am not sure if the version number might confuse things between
heimdal and mit-krb5, but it's probably not further processed here.

Also … I still have doubts if this will result in the right thing
happening. The readers are off.

pkg-config --cflags krb5-gssapi

returns

-I$PREFIX/include 

Shouldn't that rather be this?

-I$PREFIX/include/krb5

There is an asymmetry. Heimdal installs this:

include/krb5/gssapi.h
include/krb5/gssapi/gssapi.h
include/krb5/gssapi/gssapi_krb5.h

But mit-krb5 installs this:

include/gssapi.h
include/gssapi/gssapi.h
include/gssapi/gssapi_krb5.h

Should the include path be fixed or the installation of heimdal to
match the header locations of mit-krb5? Aren't those supposed to be
interchangeable? I'm starting the build of qt5-qtbase now … not sure if
it will get a symbol error again at the end. It first tried to link the
system lib and got symbol errors. So somehow the heimdal headers seem
to be found in the actual build, while the test clearly favours the
system header.

Anyone with stakes in this to get this fixed up? Also, pkglint goes
crazy on security/heimdal, beginning with a big TODO for an update. I
am trying to stay clear of this krb5 stuff as long as I can (might be
forced to interact with AD auth for some uses at some point), and in
practice will always refer to the mit-krb5 of the base system. I just
rolled with defaults for pkgsrc development here.


Alrighty then,

Thomas

PS: It might be another question if the gssapi choice should be
explicit in qt5-qtbase and also the upcoming qt6 in WIP, not just
mediated by libcups pulling in krb5.

PPS: Another way of detection would be krb5-config, but I don't know
how this Qt configure infrastructure is defined and what to put in JSON
to make it call a config script like that.

-- 
Dr. Thomas Orgis
HPC @ Universität Hamburg

Index: Makefile
===================================================================
RCS file: /cvsroot/pkgsrc/security/heimdal/Makefile,v
retrieving revision 1.145
diff -u -r1.145 Makefile
--- Makefile	21 Apr 2021 11:40:36 -0000	1.145
+++ Makefile	8 May 2021 13:00:34 -0000
@@ -1,7 +1,7 @@
 # $NetBSD: Makefile,v 1.145 2021/04/21 11:40:36 adam Exp $
 
 DISTNAME=	heimdal-1.5.3
-PKGREVISION=	28
+PKGREVISION=	29
 CATEGORIES=	security
 # Original distfile is unavailable on Github
 #GITHUB_TAG=	${DISTNAME}
@@ -128,6 +128,9 @@
 PTHREAD_AUTO_VARS=	yes
 .endif
 
+post-install:
+	${LN} -s heimdal-gssapi.pc ${DESTDIR}${PREFIX}/lib/pkgconfig/krb5-gssapi.pc
+
 .include "../../mk/termcap.buildlink3.mk"
 .include "../../mk/pthread.buildlink3.mk"
 .include "../../mk/readline.buildlink3.mk"
Index: PLIST
===================================================================
RCS file: /cvsroot/pkgsrc/security/heimdal/PLIST,v
retrieving revision 1.24
diff -u -r1.24 PLIST
--- PLIST	11 Mar 2014 14:05:13 -0000	1.24
+++ PLIST	8 May 2021 13:00:34 -0000
@@ -146,6 +146,7 @@
 lib/libsl.la
 lib/libwind.la
 lib/pkgconfig/heimdal-gssapi.pc
+lib/pkgconfig/krb5-gssapi.pc
 lib/windc.la
 libexec/digest-service
 libexec/heimdal/asn1_compile