Date: Mon, 15 Nov 2010 23:08:14 +0100 (CET) From: Joerg Pulz <Joerg.Pulz@frm2.tum.de> To: freebsd-hackers@freebsd.org Subject: [CFT+RFC] patch to buildworld with heimdal from ports Message-ID: <alpine.BSF.2.00.1011152143390.51792@unqrf.nqzva.sez2>
next in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, after the security/heimdal port was updated to the current heimdal release and i added one missing function from base it is now possible to completely buildworld src/ using the port for all Kerberos5/GSSAPI enabled parts. The patches for src/ are here: ftp://ftp.frm2.tum.de/pub/jpulz/FreeBSD/patches/CURRENT_use_kerberos_port.patch ftp://ftp.frm2.tum.de/pub/jpulz/FreeBSD/patches/8-STABLE_use_kerberos_port.patch ftp://ftp.frm2.tum.de/pub/jpulz/FreeBSD/patches/8.1-RELENG_use_kerberos_port.patch Here are the necessary steps - - install security/heimdal - - download the patch - - cd /usr/src && patch -p0 < patchfile - - add WITH_KERBEROS_PORT=1 to /etc/src.conf - - add HEIMDAL_HOME=<prefix> (usually /usr/local) to /etc/make.conf - - make buildworld as usual To get a clean system you should add WITHOUT_KERBEROS=1 to /etc/src.conf otherwise you will still build and install the base Kerberos5/GSSAPI implementation. If you decide to add this to /etc/src.conf, don't forget to run 'make delete-old delete-old-libs' to get rid of all the old stuff. If you try this on 8-STABLE or 8.1-RELENG there will still be leftovers but as soon as tools/build/mk/OptionalObsoleteFiles.inc gets MFC'd it should at least on 8-STABLE no longer be a problem. There is one drawback. As the port installs no 32bit libraries on amd64 or powerpc64 there is no chance to build and install the following 32bit compat libraries: librpcsec_gss, pam_krb5, pam_ksu. The 32bit libssh will be build and installed but without Kerberos5/GSSAPI support. You should rebuild all ports which make use of the base Kerberos5/GSSAPI libraries. See ports/152029 and ports/152071 for additional ports related patches. I use all this stuff on several machines right now and didn't found any problem, it rather solved the problems i had with the broken stuff in base, especially OpenLDAP with Cyrus-Sasl or Cyrus-Imapd and so on. So everyone, please test and comment as i would really like to see this functionality in base to provide people with an easy to use solution to work around the old and partially broken Kerberos5/GSSAPI stuff in base. Kind regards Joerg - -- The beginning is the most important part of the work. -Plato -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (FreeBSD) iD8DBQFM4a9RSPOsGF+KA+MRAgnFAJ9s26Insh0AJkxCBgSsEALrMuN5nQCgyxYL fUNRYFwA+t+ozBF2U74uYhY= =aKfM -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?alpine.BSF.2.00.1011152143390.51792>