Compiling Samba with system Heimdal?

Tue Jul 2 05:18:12 UTC 2019

On Tue, Jul 02, 2019 at 11:11:02AM +1000, Martin Schwenke wrote:
> Hi Christof,
> 
> On Fri, 28 Jun 2019 14:10:46 -0700, Christof Schmitt <cs at samba.org>
> wrote:
> 
> > On Fri, Jun 28, 2019 at 02:29:46PM +1000, Martin Schwenke via samba-technical wrote:
> > > I'm trying to build Samba with system Heimdal on Debian testing...
> > > 
> > > $ CFLAGS="-O3" ./configure --picky-developer --abi-check-disable \
> > >     --without-ad-dc  --without-json \
> > >     --with-system-heimdalkrb5
> > > ...
> > > 'configure' finished successfully (1m1.668s)
> > > 
> > > $ make
> > > [184/187] Compiling source4/heimdal_build/version.c
> > > [185/187] Compiling source4/heimdal/lib/vers/print_version.c
> > > In file included from ../../source4/heimdal_build/roken.h:156,
> > >                  from ../../source4/heimdal/lib/vers/print_version.c:39:
> > > ../../source4/heimdal/lib/roken/roken.h.in:282:10: fatal error: roken-common.h: No such file or directory
> > >  #include <roken-common.h>
> > >           ^~~~~~~~~~~~~~~~
> > > compilation terminated.
> > > 
> > > Waf: Leaving directory `/home/martins/samba/samba/bin/default'
> > > Build failed  
> > >  -> task in 'HEIMDAL_VERS_HOSTCC' failed with exit status 1 (run with -v to display more information)  
> > > make: *** [Makefile:7: all] Error 1  
> > 
> > Hi Martin,
> > 
> > i see the same also on Ubuntu 18.04. Samba 4.10 has the same problem,
> > Samba 4.9 compiles. 4.10 started using Python3 for the build. Then i
> > came across this comment from metze, that there might be a problem with
> > parsing the output of krb5-config with Python3:
> > 
> > commit 8061983d4882f3ba3f12da71443b035d7b672eec
> > Author: Stefan Metzmacher <metze at samba.org>
> > Date:   Thu Jan 24 02:31:10 2019 +0100
> > 
> >     wscript: separate embedded_heimdal from system_heimdal
> >     
> >     This allows to default (embedded_heimdal) to build even with a
> >     broken krb5-config file from Heimdal.
> >     
> >     In the system_heimdal case we parse the content of krb5-config
> >     instead of just executing it. This fails on FreeBSD 12 as
> >     krb5-config contains iso-8859-1 characters, which can't be parsed
> >     as unicode python buffers when using python3.
> >     
> >     Fixing the system_heimdal case is a task for another day,
> >     I guess it will only work once we imported a current heimdal version
> >     and actually tested the system_heimdal case.
> >     
> >     Signed-off-by: Stefan Metzmacher <metze at samba.org>
> >     Reviewed-by: Andreas Schneider <asn at samba.org>
> > 
> > I am not sure if that is the exact problem, but it would seem worthwhile
> > to look closer in that area.
> 
> Thanks for this idea.
> 
> Unfortunately, the problem doesn't seem to be iso-8859-1 characters
> that can't be parsed using python3.
> 
> I hacked wscript_configure_system_heimdal to grep the desired lines
> of krb5-config.heimdal and then read only those lines in Python.  This
> avoids any non-ASCII characters.  However, the same
> bin/c4che/default_cache.py file is produced with or without the hack.
> 
> On my Debian testing system I see:
> 
>   $ file /usr/bin/krb5-config.heimdal 
>   /usr/bin/krb5-config.heimdal: POSIX shell script, UTF-8 Unicode text executable
> 
> compared with:
> 
>   $ file /usr/bin/krb5-config.mit 
>   /usr/bin/krb5-config.mit: POSIX shell script, ASCII text executable
> 
> So, I don't think the iso-8859-1 character problem exists on my system.
> 
> I don't think my problem is that I have both kerberos flavours
> installed.  wscript_configure_system_heimdal explicitly looks for
> krb5-config.heimdal.  When I saw this problem 6 months ago I didn't
> have MIT kerberos installed.
> 
> Potentially relevant lines from default_cache.py are:
> 
> CFLAGS_roken = []
> CPPPATH_ASN1 = ['/usr/include/heimdal']
> CPPPATH_COM_ERR = ['/usr/include/heimdal']
> CPPPATH_GSSAPI = ['/usr/include/heimdal']
> CPPPATH_HCRYPTO = ['/usr/include/heimdal']
> CPPPATH_HDB = ['/usr/include/heimdal']
> CPPPATH_HEIMBASE = ['/usr/include/heimdal']
> CPPPATH_HEIMNTLM = ['/usr/include/heimdal']
> CPPPATH_HX509 = ['/usr/include/heimdal']
> CPPPATH_KDC = ['/usr/include/heimdal']
> CPPPATH_KRB5 = ['/usr/include/heimdal']
> CPPPATH_ROKEN = ['/usr/include/heimdal']
> CPPPATH_ROKEN_HOSTCC = ['/usr/include/heimdal']
> CPPPATH_WIND = ['/usr/include/heimdal']
> FOUND_SYSTEMLIB_roken = True
> HAVE_LIBROKEN = 1
> HAVE_ROKEN_H = 1
> HEIMDAL_KRB5_CONFIG = ['/usr/bin/krb5-config.heimdal']
> HEIMDAL_KRB5_TYPES_PATH = '/usr/include/heimdal/krb5-types.h'
> LDFLAGS_roken = ['-lpthread', '-Wl,-no-undefined']
> LIBPATH_ASN1 = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
> LIBPATH_COM_ERR = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
> LIBPATH_GSSAPI = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
> LIBPATH_HCRYPTO = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
> LIBPATH_HDB = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
> LIBPATH_HEIMBASE = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
> LIBPATH_HEIMNTLM = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
> LIBPATH_HX509 = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
> LIBPATH_KDC = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
> LIBPATH_KRB5 = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
> LIBPATH_ROKEN = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
> LIBPATH_ROKEN_HOSTCC = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
> LIBPATH_WIND = ['/usr/lib/x86_64-linux-gnu/heimdal', '/usr/lib/x86_64-linux-gnu/mit-krb5']
> LIB_ROKEN = 'roken'
> LIB_ROKEN_HOSTCC = 'roken'
> LIB_roken = ['roken']
> SAMBA4_USES_HEIMDAL = 1
> SYSTEM_LIBS = ('heimdal', 'asn1', 'com_err', 'roken', 'hx509', 'wind', 'gssapi', 'hcrypto', 'krb5', 'heimbase', 'asn1_compile', 'compile_et', 'kdc', 'hdb', 'heimntlm')
> TARGET_TYPE = {'inotify': 'EMPTY', 'tirpc': 'EMPTY', 'nsl': 'SYSLIB', 'socket': 'EMPTY', 'bsd': 'SYSLIB', 'setproctitle': 'EMPTY', 'attr': 'EMPTY', 'dl': 'SYSLIB', 'rt': 'SYSLIB', 'resolv': 'SYSLIB', 'intl': 'EMPTY', 'pthread': 'SYSLIB', 'crypt': 'SYSLIB', 'popt': 'SYSLIB', 'z': 'SYSLIB', 'pam': 'SYSLIB', 'com_err': 'SYSLIB', 'roken': 'SYSLIB', 'ROKEN_HOSTCC': 'SYSLIB', 'wind': 'SYSLIB', 'hx509': 'SYSLIB', 'asn1': 'SYSLIB', 'heimbase': 'SYSLIB', 'hcrypto': 'SYSLIB', 'krb5': 'SYSLIB', 'gssapi': 'SYSLIB', 'heimntlm': 'SYSLIB', 'hdb': 'SYSLIB', 'kdc': 'SYSLIB', 'gnutls': 'SYSLIB', 'gpgme': 'EMPTY', 'execinfo': 'EMPTY', 'systemd-daemon': 'EMPTY', 'systemd-journal': 'EMPTY', 'systemd': 'SYSLIB', 'lttng-ust': 'EMPTY', 'iconv': 'EMPTY', 'ncurses': 'SYSLIB', 'readline': 'EMPTY', 'jansson': 'EMPTY', 'inet': 'EMPTY', 'archive': 'SYSLIB', 'dm': 'EMPTY', 'jfsdm': 'EMPTY', 'dmapi': 'EMPTY', 'xdsm': 'EMPTY', 'cap': 'EMPTY', 'sunacl': 'EMPTY', 'acl': 'SYSLIB', 'cups': 'EMPTY', 'lber': 'SYSLIB', 'ld
>  ap': 'SYSLIB', 'avahi-client': 'EMPTY', 'avahi-common': 'EMPTY', 'sendfile': 'EMPTY', 'gen': 'EMPTY', 'security': 'EMPTY', 'sec': 'EMPTY', 'gfapi': 'EMPTY', 'menu': 'SYSLIB', 'panel': 'SYSLIB', 'form': 'SYSLIB', 'crypto': 'SYSLIB', 'glib-2.0': 'SYSLIB', 'nscd': 'EMPTY', 'util': 'SYSLIB', 'pcap': 'EMPTY', 'libtasn1': 'SYSLIB'}
> USING_SYSTEM_ROKEN = 1
> 
> 
> Despite all of those lovely variables containing
> "/usr/include/heimdal", I don't see that in the compilation command.
> 
> In fact, as-per Andrew's comment a year ago, I'm guessing that we
> shouldn't even be trying to build anything in source4/heimdal/.
> However, it isn't as simple as commenting out
> 
>   bld.RECURSE('source4/heimdal_build')
> 
> in wscript_build_system_heimdal as is done in
> wscript_build_system_mitkrb5.  That results in:
> 
>   Unknown dependency 'gssapi_krb5' in 'KRB5_PAC'
> 
> ... and then I'm too far into dependencies that I don't understand well
> enough to unravel.  :-(

As this works with Samba 4.9, one approach could be to configure Samba
4.9 and 4.10, and then compare the configure logs. I don't have time to
dig through this now, maybe later this month.

Christof