[request] krb5/1.18.3

[SpaceIm]

Package Details

• Package Name/Version: krb5/1.18.3
• Website: https://web.mit.edu/kerberos
• Source code: https://kerberos.org/dist/krb5/1.18/krb5-1.18.3.tar.gz (or https://github.com/krb5/krb5)

Description Of The Library / Tool

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. A free implementation of this protocol is available from the Massachusetts Institute of Technology.

depends on OpenSSL

[madebr]

I have a wip recipe on my recipes_wip branch, if this is urgent.

[SpaceIm]

Not urgent for me, mainly to improve cyrus-sasl recipe: #3466 (comment)

[ericLemanissier]

it's also used by qt network module. do you need some help @madebr ? Maybe we could start with linux-only recipe ?

[ericLemanissier]

it's also used by qt network module. do you need some help @madebr ? Maybe we could start with linux-only recipe ?

friendly ping @madebr

[jiggersplat]

+1

[friendlyanon]

This is blocking #8901 from building on MacOS. @madebr can you give an update on that WIP recipe?

[ericLemanissier]

ow, It's right there https://github.com/madebr/conan-center-index/tree/recipes_wip/recipes/krb5/all !

[friendlyanon]

That appears to be in a near complete condition. Hope to see it in CCI sooner than later!

[ofiriluz]

+1 on KRB5 Library

[kexianda]

+1
krb5 is heavily used in production.

[xakod]

@madebr are there any chances to see krb5 in cci?

[madebr]

Fork https://github.com/madebr/conan-center-index/tree/recipes_wip/recipes/krb5/all, and make it conan v2 compatible.
I did some modifications to make it compile to static libraries, but I would remove it and only allow shared libraries.
Since this is a security focused library, such modifications might be dangerous.

[vlebourl]

+1
any news on this? Cheers

[xakod]

Hi, @vlebourl, please look at related pr error. Maybe you have any ideas how to fix it.

[fpoirotte]

Hi,

The error is caused by the ksu program, which needs to be installed (and subsequently run) with the setuid bit set, to allow users to switch to a different Kerberos identity.

Apparently, in the CI environment, the packages are built with a non-privileged account, therefore the install command for that program fails.

You could patch the following line:
src/config/pre.in:187:INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root
to instead read:
src/config/pre.in:187:INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 755
This will allow the package to be built successfully, although the installed ksu program will be broken.

To fix it completely, end-users would have to install the package as root, which seems unreasonable in most situations.

[xakod]

@fpoirotte what do you think about removing ksu from cci package?

[fpoirotte]

From my point of view, it would be fine, but maybe someone more accustomed with CCI could voice in on the subject.