kerberos5 @1.19.2 needs corrected configure options

[ballapete (Peter "Pete" Dyballa)]

While trying to see whether kerberos5 can work with Python 3.8 I saw this report:

configure: WARNING: unrecognized options: --with-pkinit-crypto-impl

This configure option is gone.

Another configure option is obsolete: --mandir=/opt/local/share/man. Form help (a bit edited):

Installation directories:
  --prefix=PREFIX         install architecture-independent files in PREFIX
                          [/usr/local]
Fine tuning of the installation directories:

  --datarootdir=DIR       read-only arch.-independent data root [PREFIX/share]

  --mandir=DIR            man documentation [DATAROOTDIR/man]

--prefix is set to /opt/local so datarootdir becomes /opt/local/share and mandir automatically /opt/local/share/man which the option --mandir=/opt/local/share/man dictates uselessly.

---

From a first failed try to run make check it seems that src/Makefile needs to be patched. It contains explicitly:

  335	COM_ERR_LIB = -L/opt/local/lib -lcom_err
  379	RL_LIBS		= -L/opt/local/lib -ledit

while this line only has

  179	LIBS = -lcrypto -lintl -lresolv 

without any other occurrence of -L/opt/local/lib. These lines also look suspicious:

  442	# TLS implementation selection
  443	TLS_IMPL	= openssl
  444	TLS_IMPL_CFLAGS = 
  445	TLS_IMPL_LIBS	= -lssl -lcrypto

The only other occurrence that the LIBS macros is used is:

  406	KRB5_BASE_LIBS	= $(KRB5_LIB) $(K5CRYPTO_LIB) $(COM_ERR_LIB) $(SUPPORT_LIB) $(GEN_LIB) $(LIBS) $(DL_LIB)

So when the port is built it inherits from $(COM_ERR_LIB) the path argument -L/opt/local/lib and all is fine. For the test/check target something similar needs to be constructed for cases when libcom_err is not used with $(LIBS). For example here:

making check in util/profile/testmod...
[...]
building dynamic proftest object
set -x; objlist=`set -x && perl -p -e 'BEGIN { $SIG{__WARN__} = sub {die @_} }; $e=$ARGV; $e =~ s/OBJS\...$//; s/^/ /; s/ $//; s/ / $e/g;' OBJS.SH` && /opt/local/bin/gcc-apple-4.2 -std=gnu99 -bundle -pipe -Os -arch ppc -fno-common -Wl,-headerpad_max_install_names -arch ppc -Wl,-search_paths_first -o proftest.so $objlist -L../../../lib -lkrb5support -lcrypto -lintl -lresolv  -Wl,-headerpad_max_install_names -arch ppc -Wl,-search_paths_first -exported_symbols_list darwin.exports
++ set -x
++ perl -p -e 'BEGIN { $SIG{__WARN__} = sub {die @_} }; $e=$ARGV; $e =~ s/OBJS\...$//; s/^/ /; s/ $//; s/ / $e/g;' OBJS.SH
+ objlist= testmod_main.so
+ /opt/local/bin/gcc-apple-4.2 -std=gnu99 -bundle -pipe -Os -arch ppc -fno-common -Wl,-headerpad_max_install_names -arch ppc -Wl,-search_paths_first -o proftest.so testmod_main.so -L../../../lib -lkrb5support -lcrypto -lintl -lresolv -Wl,-headerpad_max_install_names -arch ppc -Wl,-search_paths_first -exported_symbols_list darwin.exports
ld: library not found for -lintl
collect2: ld returned 1 exit status
make[3]: *** [proftest.so] Error 1
make[3]: Target `check' not remade because of errors.
make[2]: *** [check-recurse] Error 1

making check in util/verto...
make[1]: *** [check-recurse] Error 1
make[1]: Target `check' not remade because of errors.
making check in include...
making check in lib...
making check in lib/crypto...
making check in lib/crypto/krb...
/opt/local/bin/gcc-apple-4.2 -std=gnu99 -DHAVE_CONFIG_H  -I../../../include -I../../../include -I./../openssl -DKRB5_DEPRECATED=1 -DKRB5_PRIVATE -I/opt/local/include -pipe -Os -arch ppc -fno-common -Wall -Wcast-align -Wshadow -Wmissing-prototypes -Wno-format-zero-length -Woverflow -Wstrict-overflow -Wmissing-format-attribute -Wmissing-prototypes -Wreturn-type -Wmissing-braces -Wparentheses -Wswitch -Wunused-function -Wunused-label -Wunused-variable -Wunused-value -Wunknown-pragmas -Wsign-compare -Wnewline-eof -Wdeclaration-after-statement -pthread  -c t_fortuna.c
/opt/local/bin/gcc-apple-4.2 -std=gnu99 -L../../../lib -dynamic -pipe -Os -arch ppc -fno-common -Wl,-headerpad_max_install_names -arch ppc -Wl,-search_paths_first  -o t_fortuna t_fortuna.o -lk5crypto -lkrb5support -lcrypto -lintl -lresolv 
ld: library not found for -lintl
collect2: ld returned 1 exit status
make[3]: *** [t_fortuna] Error 1
make[3]: Target `check' not remade because of errors.

making check in tests/misc...
/opt/local/bin/g++-apple-4.2 -DHAVE_CONFIG_H  -I../../include -I../../include  -DKRB5_DEPRECATED=1 -DKRB5_PRIVATE -I/opt/local/include -pipe -Os -arch ppc -Wall -Wcast-align -Wshadow -pthread  -c test_cxx_krb5.cpp
/opt/local/bin/g++-apple-4.2 -L../../lib -dynamic -pipe -Os -arch ppc -Wl,-headerpad_max_install_names -arch ppc -Wl,-search_paths_first  -DHAVE_CONFIG_H  -I../../include -I../../include  -DKRB5_DEPRECATED=1 -DKRB5_PRIVATE -I/opt/local/include -pipe -Os -arch ppc -Wall -Wcast-align -Wshadow -pthread  -o test_cxx_krb5 test_cxx_krb5.o -lkrb5 -lk5crypto -L/opt/local/lib -lcom_err -lkrb5support  -lcrypto -lintl -lresolv   -lcrypto -lintl -lresolv 
ld: warning: object file compiled with -mlong-branch which is no longer needed. To remove this warning, recompile without -mlong-branch: /opt/local/lib/apple-gcc42/gcc/powerpc-apple-darwin8/4.2.4/crt3.o
/opt/local/bin/g++-apple-4.2 -DHAVE_CONFIG_H  -I../../include -I../../include  -DKRB5_DEPRECATED=1 -DKRB5_PRIVATE -I/opt/local/include -pipe -Os -arch ppc -Wall -Wcast-align -Wshadow -pthread  -c test_cxx_gss.cpp
/opt/local/bin/g++-apple-4.2 -L../../lib -dynamic -pipe -Os -arch ppc -Wl,-headerpad_max_install_names -arch ppc -Wl,-search_paths_first  -DHAVE_CONFIG_H  -I../../include -I../../include  -DKRB5_DEPRECATED=1 -DKRB5_PRIVATE -I/opt/local/include -pipe -Os -arch ppc -Wall -Wcast-align -Wshadow -pthread  -o test_cxx_gss test_cxx_gss.o -lcrypto -lintl -lresolv 
ld: library not found for -lintl
collect2: ld returned 1 exit status
make[2]: *** [test_cxx_gss] Error 1

Actually src/util/profile/testmod/Makefile, src/util/verto/Makefile, and src/tests/misc/Makefile seem to be the candidates, which I'll check when kerberos5 will be built again. Possibly src/build-tools/krb5-config is the cause, it contains

   45	LIBS='-lcrypto -lintl -lresolv '

because src/build-tools/krb5-config.in has

   45	LIBS='@LIBS@'

So there must be some tool invocation to create krb5-config from krb5-config.in…

[ballapete (Peter "Pete" Dyballa)]

It makes some difference when -L/opt/local/lib is given. I'll attach the logs. In the end make check fails because some Python modules seem to be missing. I'll to update Python and its modules tomorrow…

[ballapete (Peter "Pete" Dyballa)]

"make check" without -L/opt/local/lib

[ballapete (Peter "Pete" Dyballa)]

"make check" with -L/opt/local/lib

[ryandesign (Ryan Carsten Schmidt)]

Replying to ballapete:

While trying to see whether kerberos5 can work with Python 3.8 I saw this report:

configure: WARNING: unrecognized options: --with-pkinit-crypto-impl

This configure option is gone.

Indeed upstream ​removed it in in 2017.

Another configure option is obsolete: --mandir=/opt/local/share/man. Form help (a bit edited):

Installation directories:
  --prefix=PREFIX         install architecture-independent files in PREFIX
                          [/usr/local]
Fine tuning of the installation directories:

  --datarootdir=DIR       read-only arch.-independent data root [PREFIX/share]

  --mandir=DIR            man documentation [DATAROOTDIR/man]

--prefix is set to /opt/local so datarootdir becomes /opt/local/share and mandir automatically /opt/local/share/man which the option --mandir=/opt/local/share/man dictates uselessly.

Agreed, it is now unnecessary. It was necessary originally because the default used to be /opt/local/man but the default was changed in autoconf many years ago, and kerberos5 now ships with an updated configure script generated with a new version of autoconf that uses the new default, plus the port uses autoreconf to regenerate the configure script.

[ryandesign (Ryan Carsten Schmidt)]

In a8760300d19b118b3bbf016b417207530cc658da/macports-ports (master):

kerberos5: Remove unneeded configure args

See: #63328

[ryandesign (Ryan Carsten Schmidt)]

Replying to ballapete:

From a first failed try to run make check it seems that src/Makefile needs to be patched.

The portfile doesn't enable the test phase, so there's no way to run make check from this port. That could have been due to oversight or because the tests were found not to work. If the latter, any bugs in the test suite should be reported to the developers of kerberos5. For example I am able to reproduce this error from your log:

OSError: AF_UNIX path too long

and I have reported it to the developers: ​https://krbdev.mit.edu/rt/Ticket/Display.html?id=9019

[ballapete (Peter "Pete" Dyballa)]

Replying to ryandesign:

Replying to ballapete:

For example I am able to reproduce this error from your log:

OSError: AF_UNIX path too long

and I have reported it to the developers: ​https://krbdev.mit.edu/rt/Ticket/Display.html?id=9019

You also used Python 3.8 for your test. How is the default Python 3.9 version performing here? (I could install it on Big Sur, and remove it afterwards again…)

[ballapete (Peter "Pete" Dyballa)]

Replying to ryandesign:

Replying to ballapete:

OSError: AF_UNIX path too long

On Big Sur port was too fast for me and had installed Python 3.9 – and make check failed here too. So the test must be incorrect. (There are also some incorrect configure tests, which I'll report and provide patches for later.)

[ballapete (Peter "Pete" Dyballa)]

The configure script defines on lines #14.790–14.793

# For Python tests.  Python version 3.2.4 is required as prior
# versions do not accept string input to subprocess.Popen.communicate
# when universal_newlines is set.
PYTHON_MINVERSION=3.2.4

so Python 3.8 is fine for testing.

[ballapete (Peter "Pete" Dyballa)]

Replying to ballapete:

(There are also some incorrect configure tests, which I'll report and provide patches for later.)

The suspicious tests presumingly are just clever which I did not understand at first sight.

[ryandesign (Ryan Carsten Schmidt)]

Replying to ballapete:

You also used Python 3.8 for your test. How is the default Python 3.9 version performing here?

The test results I reported to the developers were yours. The same problem occurred for me with python39.

[ballapete (Peter "Pete" Dyballa)]

Portfile contains

 59 # kerberos5 fails to build in its own presence, see #23769, #37944
 60 # remove ${prefix}/lib from configure.ldflags to allow linking against its own libs first
 61 # adding ${worksrcpath}/lib is not necessary and pollutes krb5-config --libs and pkg-config files
 62 configure.ldflags-delete    -L${prefix}/lib

which discourages simply setting an option for ld. But doing so, adding LIBS=-L/opt/local/lib to configure.args on Big Sur, lets Kerberos5 build and make check perform as before. There is one change: configure records in config.status: S["LIBS"]="-lintl -lresolv -L/opt/local/lib" – -lcrypto is gone. If that's not the appropriate means than it seems to be necessary to edit in src/util/profile/testmod/Makefile, src/util/verto/Makefile, and src/tests/misc/Makefile the line

LIBS = -lcrypto -lintl -lresolv

to become

LIBS = -lcrypto -lintl -lresolv -L/opt/local/lib

to allow testing after configure has finished.

[ballapete (Peter "Pete" Dyballa)]

In many other ports I've seen configure reporting:

checking how to link with libintl... -lintl -Wl,-framework -Wl,CoreFoundation

Kerberos5 does not use the Apple framework with libintl. What is correct?

[ryandesign (Ryan Carsten Schmidt)]

As far as I know, libintl has nothing to do with CoreFoundation.

[ballapete (Peter "Pete" Dyballa)]

I repeated the experiments with LIBS=-L/opt/local/lib on PPC Tiger and on High Sierra, Version 10.13.6. The port gets built and make check does not report errors because some dynamic libraries cannot be found. make check ends in waiting forever when the pyrad Python module is installed. It always shows the error with AF_UNIX. (I am sending bug reports to the developers.)

[ballapete (Peter "Pete" Dyballa)]

On very fast Big Sur I built the port with LDFLAGS="-Wl,-t -L/opt/local/lib". This way the binaries are built à la (a bit edited):

/usr/bin/clang -L../../lib -dynamic -pipe -Os -isysroot/Library/Developer/CommandLineTools/SDKs/MacOSX11.0.sdk -arch x86_64 -fno-common \
-Wl,-t -L/opt/local/lib -Wl,-search_paths_first  -DHAVE_CONFIG_H  -I../../include -I../../include  -DKRB5_DEPRECATED=1 -DKRB5_PRIVATE -I/opt/local/include -isysroot/Library/Developer/CommandLineTools/SDKs/MacOSX11.0.sdk -pipe -Os -isysroot/Library/Developer/CommandLineTools/SDKs/MacOSX11.0.sdk -arch x86_64 -fno-common -Werror=unknown-warning-option -Wall -Wcast-align -Wshadow -Wmissing-prototypes -Wno-format-zero-length -Woverflow -Wstrict-overflow -Wmissing-format-attribute -Wmissing-prototypes -Wreturn-type -Wmissing-braces -Wparentheses -Wswitch -Wunused-function -Wunused-label -Wunused-variable -Wunused-value -Wunknown-pragmas -Wsign-compare -Wnewline-eof -Wdeclaration-after-statement -pthread  -o test_chpw_message test_chpw_message.o -lkrb5 -lk5crypto -L/opt/local/lib -lcom_err -lkrb5support  \
-lintl -lresolv   -lintl -lresolv

which leads to using these libraries (filtered with sort -u and removed all clang invocations and then marked the Kerberos5 libraries):

 /opt/local/lib/libcom_err.dylib
 /opt/local/lib/libcrypto.dylib
 /opt/local/lib/libedit.dylib
•/opt/local/lib/libgssapi_krb5.dylib
•/opt/local/lib/libgssrpc.dylib
 /opt/local/lib/libintl.dylib
•/opt/local/lib/libk5crypto.dylib
•/opt/local/lib/libkadm5srv_mit.dylib
•/opt/local/lib/libkdb5.dylib
•/opt/local/lib/libkrad.dylib
•/opt/local/lib/libkrb5.dylib
•/opt/local/lib/libkrb5support.dylib
 /opt/local/lib/liblmdb.dylib
 /opt/local/lib/libssl.dylib
•/opt/local/lib/libverto.dylib
cat ./osconf.hin | sed -e "s\"@KRB5RCTMPDIR\"/var/tmp\"" -e "s\"@PREFIX\"/opt/local\"" -e "s\"@EXEC_PREFIX\"/opt/local\"" -e "s\"@BINDIR\"/opt/local/bin\"" -e "s\"@LIBDIR\"/opt/local/lib\"" -e "s\"@SBINDIR\"/opt/local/sbin\"" -e "s\"@MODULEDIR\"/opt/local/lib/krb5/plugins\"" -e "s\"@GSSMODULEDIR\"/opt/local/lib/gss\"" -e "s\"@LOCALSTATEDIR\"/opt/local/var\"" -e "s\"@RUNSTATEDIR\"/opt/local/var/run\"" -e "s\"@SYSCONFDIR\"/opt/local/etc\"" -e "s\"@DYNOBJEXT\".so\"" -e "s\"@SYSCONFCONF\":/opt/local/etc/krb5.conf\"" > osconf.new
ld: warning: dylib (/opt/local/lib/libcrypto.dylib) was built for newer macOS version (11.2) than being linked (11.0)
ld: warning: dylib (/opt/local/lib/libedit.dylib) was built for newer macOS version (11.2) than being linked (11.0)
ld: warning: dylib (/opt/local/lib/libintl.dylib) was built for newer macOS version (11.1) than being linked (11.0)
ld: warning: dylib (/opt/local/lib/liblmdb.dylib) was built for newer macOS version (11.2) than being linked (11.0)
ld: warning: dylib (/opt/local/lib/libssl.dylib) was built for newer macOS version (11.2) than being linked (11.0)

Back to the errors from ten years ago! But – using LIBS="-Wl,-t -L/opt/local/lib" instead I get:

/opt/local/lib/libcom_err.dylib
/opt/local/lib/libcrypto.dylib
/opt/local/lib/libedit.dylib
/opt/local/lib/libintl.dylib
/opt/local/lib/liblmdb.dylib
cat ./osconf.hin | sed -e "s\"@KRB5RCTMPDIR\"/var/tmp\"" -e "s\"@PREFIX\"/opt/local\"" -e "s\"@EXEC_PREFIX\"/opt/local\"" -e "s\"@BINDIR\"/opt/local/bin\"" -e "s\"@LIBDIR\"/opt/local/lib\"" -e "s\"@SBINDIR\"/opt/local/sbin\"" -e "s\"@MODULEDIR\"/opt/local/lib/krb5/plugins\"" -e "s\"@GSSMODULEDIR\"/opt/local/lib/gss\"" -e "s\"@LOCALSTATEDIR\"/opt/local/var\"" -e "s\"@RUNSTATEDIR\"/opt/local/var/run\"" -e "s\"@SYSCONFDIR\"/opt/local/etc\"" -e "s\"@DYNOBJEXT\".so\"" -e "s\"@SYSCONFCONF\":/opt/local/etc/krb5.conf\"" > osconf.new
ld: warning: dylib (/opt/local/lib/libcrypto.dylib) was built for newer macOS version (11.2) than being linked (11.0)
ld: warning: dylib (/opt/local/lib/libedit.dylib) was built for newer macOS version (11.2) than being linked (11.0)
ld: warning: dylib (/opt/local/lib/libintl.dylib) was built for newer macOS version (11.1) than being linked (11.0)
ld: warning: dylib (/opt/local/lib/liblmdb.dylib) was built for newer macOS version (11.2) than being linked (11.0)
ld: warning: dylib (/opt/local/lib/libssl.dylib) was built for newer macOS version (11.2) than being linked (11.0)

because now binaries are built this way (a bit edited):

/usr/bin/clang -L../../lib -dynamic -pipe -Os -isysroot/Library/Developer/CommandLineTools/SDKs/MacOSX11.0.sdk -arch x86_64 -fno-common \
-Wl,-headerpad_max_install_names -Wl,-syslibroot,/Library/Developer/CommandLineTools/SDKs/MacOSX11.0.sdk -arch x86_64 -Wl,-search_paths_first  -DHAVE_CONFIG_H  -I../../include -I../../include  -DKRB5_DEPRECATED=1 -DKRB5_PRIVATE -I/opt/local/include -isysroot/Library/Developer/CommandLineTools/SDKs/MacOSX11.0.sdk -pipe -Os -isysroot/Library/Developer/CommandLineTools/SDKs/MacOSX11.0.sdk -arch x86_64 -fno-common -Werror=unknown-warning-option -Wall -Wcast-align -Wshadow -Wmissing-prototypes -Wno-format-zero-length -Woverflow -Wstrict-overflow -Wmissing-format-attribute -Wmissing-prototypes -Wreturn-type -Wmissing-braces -Wparentheses -Wswitch -Wunused-function -Wunused-label -Wunused-variable -Wunused-value -Wunknown-pragmas -Wsign-compare -Wnewline-eof -Wdeclaration-after-statement -pthread  -o test_chpw_message test_chpw_message.o -lkrb5 -lk5crypto -L/opt/local/lib -lcom_err -lkrb5support  \
-lintl -lresolv -Wl,-t -L/opt/local/lib  -lintl -lresolv -Wl,-t -L/opt/local/lib

I think this approach, giving configure a means to handle the detection of dynamic libraries, looks promising. In a few hours, or tomorrow, I'll be able to test this also on PPC Leopard, where port started upgrading yesterday…

make check also does not use the kerberos5 libraries from /opt/local/lib with LIBS instead of LDFLAGS.

[ballapete (Peter "Pete" Dyballa)]

High Sierra behaves the same.

[ballapete (Peter "Pete" Dyballa)]

And so does PPC Leopard.

[ballapete (Peter "Pete" Dyballa)]

Recent kerberos5 @1.20.1 has stopped using this old configure option, so this ticket can be closed.

[kencu (Ken)]

thx