freebsd 15/16 GSSAPI openssl & kerberos

drsnx60

drsnx60

The build options for ports is somewhat inconsitent / surprising .....

Why do we now have both GSSAPI from Base as OPTION
And then GSSAPI from Security/MIT Kerberos as OPTION ?

Isnt this supposed to be the same thing after Security HEIMDAL has ben deprecated ?

maybe cy@ can give us some guidance ?
 
from ${PORTSDIR}/Mk/bsd.options.desc.mk:

GSSAPI_BASE_DESC?= GSSAPI support via base system
GSSAPI_HEIMDAL_DESC?= GSSAPI support via security/heimdal
GSSAPI_MIT_DESC?= GSSAPI support via security/krb5
GSSAPI_MIT_DEVEL_DESC?= GSSAPI support via security/krb5-devel

Are these explanations sufficient?
 
Forgot to mention.
Things would become simple again once all of 13.x and 14.x are EoL'ed.
It makes base kerberos / GSSAPI to be MIT only on all "supported" releases, and ports infrastructure basically drops supports specific for EoL'ed releases / branches.
 
Hi , to try to explain my question further:

We have a number of ports including:
database/evolution_data_server
devel/libsoup
devel/libsoup3
dns/bind-tools
net/wireshark
security/libssh
security/putty
security/sudo

where it is possible to select from list of options : GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE

My question was , What is the difference between GSSAPI_BASE and GSSAPI_MIT as MIT Kerberos is included in the BASE ? for Freebsd 15 and 16 .
in /usr/src/kerberos5
 
drsnx60 said:
where it is possible to select from list of options : GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE
Click to expand...
Via make config on each wanted ports if you want to set using menu. If you don't want interactions and apply all ports, "usually" adding any of the one you want to OPTIONS_SET_FORCE variable in your /etc/make.conf (I think you should already know of it through your posts.)

What making things difficult is that GSSAPI in base can be either MIT or heimdal depending on the major release and (cannot recall actually which did, though) some ports (temporarily?) dropped GSSAPI_BASE support, maybe not to make maintainance difficult.

drsnx60 said:
My question was , What is the difference between GSSAPI_BASE and GSSAPI_MIT as MIT Kerberos is included in the BASE ? for Freebsd 15 and 16 .
in /usr/src/kerberos5
Click to expand...
GSSAPI_BASE requires GSSAPI in base regardless it's MIT or heimdal.
GSSAPI_MIT forces MIT kerberos from ports, IIUC, regardless MIT kerberos is in base or not.
 
drsnx60 said:
where it is possible to select from list of options : GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE

My question was , What is the difference between GSSAPI_BASE and GSSAPI_MIT as MIT Kerberos is included in the BASE ? for Freebsd 15 and 16 .
in /usr/src/kerberos5
Click to expand...

The GSSAPI option can be selected via make config in ports or poudriere options if you are using poudriere.
If you want to skip this part, you can set, for example:
devel_libsoup_SET= GSSAPI_MIT
Click to expand...
and so on in /etc/make.conf or /usr/local/etc/poudriere.d/make.conf.
There seems to be no DEFAULT_VERSIONS setting for GSSAPI.

Currently, there should be no difference between base Kerbeeros (in 15-stable and 16-current) and ports MIT kerberos.
In the future, considering the case of Heimdal in base and ports, base Kerberos may stay a bit older (not so frequently updated) than ports MIT kerberos.
There is another restriction that if you choose OpenSSL from ports, you have to select GSSAPI from ports (MIT or Heimdal).
 
You must log in or register to reply here.
Back
Top