Compiling Samba with system Heimdal?

Tue Jul 2 01:11:02 UTC 2019

Hi Christof,

On Fri, 28 Jun 2019 14:10:46 -0700, Christof Schmitt <cs at samba.org>
wrote:

> On Fri, Jun 28, 2019 at 02:29:46PM +1000, Martin Schwenke via samba-technical wrote:
> > I'm trying to build Samba with system Heimdal on Debian testing...
> > 
> > $ CFLAGS="-O3" ./configure --picky-developer --abi-check-disable \
> >     --without-ad-dc  --without-json \
> >     --with-system-heimdalkrb5
> > ...
> > 'configure' finished successfully (1m1.668s)
> > 
> > $ make
> > [184/187] Compiling source4/heimdal_build/version.c
> > [185/187] Compiling source4/heimdal/lib/vers/print_version.c
> > In file included from ../../source4/heimdal_build/roken.h:156,
> >                  from ../../source4/heimdal/lib/vers/print_version.c:39:
> > ../../source4/heimdal/lib/roken/roken.h.in:282:10: fatal error: roken-common.h: No such file or directory
> >  #include <roken-common.h>
> >           ^~~~~~~~~~~~~~~~
> > compilation terminated.
> > 
> > Waf: Leaving directory `/home/martins/samba/samba/bin/default'
> > Build failed  
> >  -> task in 'HEIMDAL_VERS_HOSTCC' failed with exit status 1 (run with -v to display more information)  
> > make: *** [Makefile:7: all] Error 1  
> 
> Hi Martin,
> 
> i see the same also on Ubuntu 18.04. Samba 4.10 has the same problem,
> Samba 4.9 compiles. 4.10 started using Python3 for the build. Then i
> came across this comment from metze, that there might be a problem with
> parsing the output of krb5-config with Python3:
> 
> commit 8061983d4882f3ba3f12da71443b035d7b672eec
> Author: Stefan Metzmacher <metze at samba.org>
> Date:   Thu Jan 24 02:31:10 2019 +0100
> 
>     wscript: separate embedded_heimdal from system_heimdal
>     
>     This allows to default (embedded_heimdal) to build even with a
>     broken krb5-config file from Heimdal.
>     
>     In the system_heimdal case we parse the content of krb5-config
>     instead of just executing it. This fails on FreeBSD 12 as
>     krb5-config contains iso-8859-1 characters, which can't be parsed
>     as unicode python buffers when using python3.
>     
>     Fixing the system_heimdal case is a task for another day,
>     I guess it will only work once we imported a current heimdal version
>     and actually tested the system_heimdal case.
>     
>     Signed-off-by: Stefan Metzmacher <metze at samba.org>
>     Reviewed-by: Andreas Schneider <asn at samba.org>
> 
> I am not sure if that is the exact problem, but it would seem worthwhile
> to look closer in that area.

Thanks for this idea.

Unfortunately, the problem doesn't seem to be iso-8859-1 characters
that can't be parsed using python3.

I hacked wscript_configure_system_heimdal to grep the desired lines
of krb5-config.heimdal and then read only those lines in Python.  This
avoids any non-ASCII characters.  However, the same
bin/c4che/default_cache.py file is produced with or without the hack.

On my Debian testing system I see:

  $ file /usr/bin/krb5-config.heimdal 
  /usr/bin/krb5-config.heimdal: POSIX shell script, UTF-8 Unicode text executable

compared with:

  $ file /usr/bin/krb5-config.mit 
  /usr/bin/krb5-config.mit: POSIX shell script, ASCII text executable

So, I don't think the iso-8859-1 character problem exists on my system.

I don't think my problem is that I have both kerberos flavours
installed.  wscript_configure_system_heimdal explicitly looks for
krb5-config.heimdal.  When I saw this problem 6 months ago I didn't
have MIT kerberos installed.

Potentially relevant lines from default_cache.py are:

CFLAGS_roken = []
CPPPATH_ASN1 = ['/usr/include/heimdal']
CPPPATH_COM_ERR = ['/usr/include/heimdal']
CPPPATH_GSSAPI = ['/usr/include/heimdal']
CPPPATH_HCRYPTO = ['/usr/include/heimdal']
CPPPATH_HDB = ['/usr/include/heimdal']
CPPPATH_HEIMBASE = ['/usr/include/heimdal']
CPPPATH_HEIMNTLM = ['/usr/include/heimdal']
CPPPATH_HX509 = ['/usr/include/heimdal']
CPPPATH_KDC = ['/usr/include/heimdal']
CPPPATH_KRB5 = ['/usr/include/heimdal']
CPPPATH_ROKEN = ['/usr/include/heimdal']
CPPPATH_ROKEN_HOSTCC = ['/usr/include/heimdal']
CPPPATH_WIND = ['/usr/include/heimdal']
FOUND_SYSTEMLIB_roken = True
HAVE_LIBROKEN = 1
HAVE_ROKEN_H = 1
HEIMDAL_KRB5_CONFIG = ['/usr/bin/krb5-config.heimdal']
HEIMDAL_KRB5_TYPES_PATH = '/usr/include/heimdal/krb5-types.h'
LDFLAGS_roken = ['-lpthread', '-Wl,-no-undefined']
LIBPATH_ASN1 = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
LIBPATH_COM_ERR = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
LIBPATH_GSSAPI = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
LIBPATH_HCRYPTO = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
LIBPATH_HDB = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
LIBPATH_HEIMBASE = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
LIBPATH_HEIMNTLM = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
LIBPATH_HX509 = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
LIBPATH_KDC = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
LIBPATH_KRB5 = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
LIBPATH_ROKEN = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
LIBPATH_ROKEN_HOSTCC = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
LIBPATH_WIND = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
LIB_ROKEN = 'roken'
LIB_ROKEN_HOSTCC = 'roken'
LIB_roken = ['roken']
SAMBA4_USES_HEIMDAL = 1
SYSTEM_LIBS = ('heimdal', 'asn1', 'com_err', 'roken', 'hx509', 'wind', 'gssapi', 'hcrypto', 'krb5', 'heimbase', 'asn1_compile', 'compile_et', 'kdc', 'hdb', 'heimntlm')
TARGET_TYPE = {'inotify': 'EMPTY', 'tirpc': 'EMPTY', 'nsl': 'SYSLIB', 'socket': 'EMPTY', 'bsd': 'SYSLIB', 'setproctitle': 'EMPTY', 'attr': 'EMPTY', 'dl': 'SYSLIB', 'rt': 'SYSLIB', 'resolv': 'SYSLIB', 'intl': 'EMPTY', 'pthread': 'SYSLIB', 'crypt': 'SYSLIB', 'popt': 'SYSLIB', 'z': 'SYSLIB', 'pam': 'SYSLIB', 'com_err': 'SYSLIB', 'roken': 'SYSLIB', 'ROKEN_HOSTCC': 'SYSLIB', 'wind': 'SYSLIB', 'hx509': 'SYSLIB', 'asn1': 'SYSLIB', 'heimbase': 'SYSLIB', 'hcrypto': 'SYSLIB', 'krb5': 'SYSLIB', 'gssapi': 'SYSLIB', 'heimntlm': 'SYSLIB', 'hdb': 'SYSLIB', 'kdc': 'SYSLIB', 'gnutls': 'SYSLIB', 'gpgme': 'EMPTY', 'execinfo': 'EMPTY', 'systemd-daemon': 'EMPTY', 'systemd-journal': 'EMPTY', 'systemd': 'SYSLIB', 'lttng-ust': 'EMPTY', 'iconv': 'EMPTY', 'ncurses': 'SYSLIB', 'readline': 'EMPTY', 'jansson': 'EMPTY', 'inet': 'EMPTY', 'archive': 'SYSLIB', 'dm': 'EMPTY', 'jfsdm': 'EMPTY', 'dmapi': 'EMPTY', 'xdsm': 'EMPTY', 'cap': 'EMPTY', 'sunacl': 'EMPTY', 'acl': 'SYSLIB', 'cups': 'EMPTY', 'lber': 'SYSLIB', 'ld
 ap': 'SYSLIB', 'avahi-client': 'EMPTY', 'avahi-common': 'EMPTY', 'sendfile': 'EMPTY', 'gen': 'EMPTY', 'security': 'EMPTY', 'sec': 'EMPTY', 'gfapi': 'EMPTY', 'menu': 'SYSLIB', 'panel': 'SYSLIB', 'form': 'SYSLIB', 'crypto': 'SYSLIB', 'glib-2.0': 'SYSLIB', 'nscd': 'EMPTY', 'util': 'SYSLIB', 'pcap': 'EMPTY', 'libtasn1': 'SYSLIB'}
USING_SYSTEM_ROKEN = 1

Despite all of those lovely variables containing
"/usr/include/heimdal", I don't see that in the compilation command.

In fact, as-per Andrew's comment a year ago, I'm guessing that we
shouldn't even be trying to build anything in source4/heimdal/.
However, it isn't as simple as commenting out

  bld.RECURSE('source4/heimdal_build')

in wscript_build_system_heimdal as is done in
wscript_build_system_mitkrb5.  That results in:

  Unknown dependency 'gssapi_krb5' in 'KRB5_PAC'

... and then I'm too far into dependencies that I don't understand well
enough to unravel.  :-(

peace & happiness,
martin