Date: Tue, 24 Jun 2025 18:06:53 +0100 From: Lexi Winter <ivy@freebsd.org> To: Cy Schubert <Cy.Schubert@cschubert.com> Cc: Dima Panov <fluffy@freebsd.org>, Cy Schubert <cy@freebsd.org>, src-committers@freebsd.org, dev-commits-src-all@freebsd.org, dev-commits-src-main@freebsd.org Subject: Re: git: 7e35117eb07f - main - Makefile: Hook MIT KRB5 into the build Message-ID: <aFrbLUEohuXAhZ8W@freefall.freebsd.org> In-Reply-To: <20250624165402.5B759112@slippy.cwsent.com> References: <202506160251.55G2pwx4063231@gitrepo.freebsd.org> <cc9222b0-8745-48cf-988c-4206287a7a7b@FreeBSD.org> <20250620073050.7f03f74e@slippy> <3742e37c-bca9-4778-881a-94c09aefdb32@FreeBSD.org> <20250623093010.71b18c87@slippy> <5fa53b5b-6c66-4195-8c89-1fc9d7b165bd@FreeBSD.org> <20250624083004.6de66e53@slippy> <aFrSQUqsTI4pRASQ@freefall.freebsd.org> <20250624165402.5B759112@slippy.cwsent.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--wl1wY8zqm+zZ4JUH Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Cy Schubert: > In message <aFrSQUqsTI4pRASQ@freefall.freebsd.org>, Lexi Winter writes: > > i'm hoping with MIT krb5 in base, we might be able to find a better > > solution to this, but i haven't had a chance to actually try it. > > it may be we have to go with a glib-style "bootstrap port" solution. =20 > It may help bootstrap but you can't rely on it to supply your KDC needs a= s=20 > it doesn't and will never use LDAP, unless we import OpenLDAP into base,= =20 > and that's another matter of discussion. i am thinking purely in terms of ports here, e.g.: - krb5-ldap requires openldap26@bootstrap - openldap26@bootstrap builds OpenLDAP without Kerberos support - after building krb5-ldap you then build openldap26 with Kerberos support which is a drop-in replacement for openldap26@bootstrap. then you install krb5-ldap and openldap26-server and the openldap26@bootstrap port is never used after the package build is done. the exact details of how this works might be more complicated but my understanding is that this is how devel/glib20 and devel/gobject-introspection manage to depend on each other. i was hoping MIT krb5 in base would avoid the need for this, but i don't think it does: if ports openldap links to base krb5, and ports krb5 links to ports openldap, you'd end up with the KDC binary linking to both base and ports krb5. so in practice, you'd still need to ignore base Kerberos entirely (other than for NFS) and build everything against ports krb5, like we do now. --wl1wY8zqm+zZ4JUH Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQSyjTg96lp3RifySyn1nT63mIK/YAUCaFrbKgAKCRD1nT63mIK/ YAjqAQDBz63Fwkodgt/MFpL4U5Mb9dCJ3K5C47HRpIRgu8J8HgEAjRz+VpMHS9JN eKv2NarpPZReSXTeFCRfRCVjY+EhPgQ= =PHx+ -----END PGP SIGNATURE----- --wl1wY8zqm+zZ4JUH--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?aFrbLUEohuXAhZ8W>