Horton
Menu

Thread

  1. kerberos/001_auth test fails on arm CPU darwin

    Nazir Bilal Yavuz <byavuz81@gmail.com> — 2022-09-26T10:45:59Z

    Hi hackers,

I wanted to add ARM CPU darwin to the CI but it seems
that kerberos/001_auth fails on ARM CPU darwin.

OS:
Darwin admins-Virtual-Machine.local 21.6.0 Darwin Kernel Version 21.6.0:
Wed Aug 10 14:26:07 PDT 2022; root:xnu-8020.141.5~2/RELEASE_ARM64_VMAPPLE
arm64

Error message:
Can't exec "kdb5_util": No such file or directory at
/Users/admin/pgsql/src/test/perl/PostgreSQL/Test/Utils.pm line 338.
[02:53:37.177](0.043s) Bail out!  failed to execute command "kdb5_util
create -s -P secret0": No such file or directory

It seems that kerberos is installed at the '/opt/homebrew/opt/krb5' path on
ARM CPU darwin instances instead of the '/usr/local/opt/krb5' path.

I attached two patches:
0001-ci-Add-arm-CPU-for-darwin.patch is about adding ARM CPU darwin to the
CI.
0002-fix-darwin-ARM-CPU-darwin-krb5-path-fix.patch is about fixing the
error.

CI run after ARM CPU darwin is added:
https://cirrus-ci.com/build/5772792711872512

CI run after fix applied:
https://cirrus-ci.com/build/5686842363215872

Regards,
Nazir Bilal Yavuz

  2. Re: kerberos/001_auth test fails on arm CPU darwin

    Tom Lane <tgl@sss.pgh.pa.us> — 2022-09-26T11:14:16Z

    Bilal Yavuz <byavuz81@gmail.com> writes:
> It seems that kerberos is installed at the '/opt/homebrew/opt/krb5' path on
> ARM CPU darwin instances instead of the '/usr/local/opt/krb5' path.

I think this also needs to account for MacPorts, which would likely
put it under /opt/local/sbin.  (I wonder where /usr/local/opt/krb5
came from at all -- that sounds like somebody's manual installation
rather than a packaged one.)  Maybe we should first try
"krb5-config --prefix" to see if that gives an answer.

			regards, tom lane

  3. Re: kerberos/001_auth test fails on arm CPU darwin

    Peter Eisentraut <peter.eisentraut@enterprisedb.com> — 2022-09-26T14:39:36Z

    On 26.09.22 13:14, Tom Lane wrote:
> Bilal Yavuz<byavuz81@gmail.com>  writes:
>> It seems that kerberos is installed at the '/opt/homebrew/opt/krb5' path on
>> ARM CPU darwin instances instead of the '/usr/local/opt/krb5' path.
> I think this also needs to account for MacPorts, which would likely
> put it under /opt/local/sbin.  (I wonder where /usr/local/opt/krb5
> came from at all -- that sounds like somebody's manual installation
> rather than a packaged one.)

/usr/local/opt/ is used by Homebrew on Intel macOS.

  4. Re: kerberos/001_auth test fails on arm CPU darwin

    Nazir Bilal Yavuz <byavuz81@gmail.com> — 2022-09-26T16:39:41Z

    Hi,


On 9/26/2022 2:14 PM, Tom Lane wrote:
>
> Maybe we should first try "krb5-config --prefix" to see if that gives an answer.


I tested that command on multiple OSes and it was correct for freeBSD, 
debian and openSUSE.

I don't have macOS so I tried to use CI for running macOS VMs(both arm 
and Intel CPU):
When "krb5-config" binary is used from brew or MacPorts installations' 
path it gives the correct path but there is another "krb5-config" binary 
at "/usr/bin/krb5-config" path on the macOS VMs, when this binary is 
used while running "krb5-config --prefix" command run it gives "/" as 
output. This issue can be related about the CI VMs but I couldn't check it.

Regards,
Nazir Bilal Yavuz

  5. Re: kerberos/001_auth test fails on arm CPU darwin

    Larry Rosenman <ler@lerctr.org> — 2022-09-26T16:47:32Z

    On 09/26/2022 11:39 am, Nazir Bilal Yavuz wrote:
> Hi,
> 
> 
> On 9/26/2022 2:14 PM, Tom Lane wrote:
>> 
>> Maybe we should first try "krb5-config --prefix" to see if that gives 
>> an answer.
> 
> 
> I tested that command on multiple OSes and it was correct for freeBSD, 
> debian and openSUSE.
> 
> I don't have macOS so I tried to use CI for running macOS VMs(both arm 
> and Intel CPU):
> When "krb5-config" binary is used from brew or MacPorts installations' 
> path it gives the correct path but there is another "krb5-config" 
> binary at "/usr/bin/krb5-config" path on the macOS VMs, when this 
> binary is used while running "krb5-config --prefix" command run it 
> gives "/" as output. This issue can be related about the CI VMs but I 
> couldn't check it.
> 
> Regards,
> Nazir Bilal Yavuz

on macOS monterey 12.6:
~ via 💎 v3.1.2 on ☁️  (us-east-1) on ﴃ WhereTo - Prod
❯ krb5-config --prefix
/

~ via 💎 v3.1.2 on ☁️  (us-east-1) on ﴃ WhereTo - Prod
❯
-- 
Larry Rosenman                     http://www.lerctr.org/~ler
Phone: +1 214-642-9640                 E-Mail: ler@lerctr.org
US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

  6. Re: kerberos/001_auth test fails on arm CPU darwin

    Tom Lane <tgl@sss.pgh.pa.us> — 2022-09-26T17:41:30Z

    Larry Rosenman <ler@lerctr.org> writes:
> On 09/26/2022 11:39 am, Nazir Bilal Yavuz wrote:
>> When "krb5-config" binary is used from brew or MacPorts installations' 
>> path it gives the correct path but there is another "krb5-config" 
>> binary at "/usr/bin/krb5-config" path on the macOS VMs, when this 
>> binary is used while running "krb5-config --prefix" command run it 
>> gives "/" as output. This issue can be related about the CI VMs but I 
>> couldn't check it.

> [ yup, it gives "/" ]

Yeah, I see the same on my laptop.  So we can't trust krb5-config
unconditionally.  But we could do something like checking
"-x $config_prefix . '/bin/kinit'" before believing it's good,
and maybe also check sbin/krb5kdc.  We'd want to use similar
probes to decide which of the fallback directories to use, anyway.

			regards, tom lane

  7. Re: kerberos/001_auth test fails on arm CPU darwin

    Michael Paquier <michael@paquier.xyz> — 2022-09-27T01:25:07Z

    On Mon, Sep 26, 2022 at 04:39:36PM +0200, Peter Eisentraut wrote:
> On 26.09.22 13:14, Tom Lane wrote:
>> Bilal Yavuz<byavuz81@gmail.com>  writes:
>> > It seems that kerberos is installed at the '/opt/homebrew/opt/krb5' path on
>> > ARM CPU darwin instances instead of the '/usr/local/opt/krb5' path.
>> I think this also needs to account for MacPorts, which would likely
>> put it under /opt/local/sbin.  (I wonder where /usr/local/opt/krb5
>> came from at all -- that sounds like somebody's manual installation
>> rather than a packaged one.)
> 
> /usr/local/opt/ is used by Homebrew on Intel macOS.

Hmm.  Is that the case with new setups under x86_64?  I have a M1
where everything goes through /opt/homebrew/, though it has been set
very recently.
--
Michael

  8. Re: kerberos/001_auth test fails on arm CPU darwin

    Larry Rosenman <ler@lerctr.org> — 2022-09-27T01:30:33Z

    On 09/26/2022 8:25 pm, Michael Paquier wrote:
> On Mon, Sep 26, 2022 at 04:39:36PM +0200, Peter Eisentraut wrote:
>> On 26.09.22 13:14, Tom Lane wrote:
>>> Bilal Yavuz<byavuz81@gmail.com>  writes:
>>> > It seems that kerberos is installed at the '/opt/homebrew/opt/krb5' path on
>>> > ARM CPU darwin instances instead of the '/usr/local/opt/krb5' path.
>>> I think this also needs to account for MacPorts, which would likely
>>> put it under /opt/local/sbin.  (I wonder where /usr/local/opt/krb5
>>> came from at all -- that sounds like somebody's manual installation
>>> rather than a packaged one.)
>> 
>> /usr/local/opt/ is used by Homebrew on Intel macOS.
> 
> Hmm.  Is that the case with new setups under x86_64?  I have a M1
> where everything goes through /opt/homebrew/, though it has been set
> very recently.
> --
> Michael

Intel:
wf-corporate-chef on  master +6 -420 [✘!] on ☁️  (us-east-1) on ﴃ 
WhereTo - Prod
❯  /usr/local/opt/krb5/bin/krb5-config  --prefix
/usr/local/Cellar/krb5/1.20

wf-corporate-chef on  master +6 -420 [✘!] on ☁️  (us-east-1) on ﴃ 
WhereTo - Prod
❯

Same on my M1 iMac (migrated from an Intel iMac however)

-- 
Larry Rosenman                     http://www.lerctr.org/~ler
Phone: +1 214-642-9640                 E-Mail: ler@lerctr.org
US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

  9. Re: kerberos/001_auth test fails on arm CPU darwin

    Andres Freund <andres@anarazel.de> — 2022-09-27T01:37:14Z

    Hi,

On 2022-09-27 10:25:07 +0900, Michael Paquier wrote:
> On Mon, Sep 26, 2022 at 04:39:36PM +0200, Peter Eisentraut wrote:
> > On 26.09.22 13:14, Tom Lane wrote:
> >> Bilal Yavuz<byavuz81@gmail.com>  writes:
> >> > It seems that kerberos is installed at the '/opt/homebrew/opt/krb5' path on
> >> > ARM CPU darwin instances instead of the '/usr/local/opt/krb5' path.
> >> I think this also needs to account for MacPorts, which would likely
> >> put it under /opt/local/sbin.  (I wonder where /usr/local/opt/krb5
> >> came from at all -- that sounds like somebody's manual installation
> >> rather than a packaged one.)
> > 
> > /usr/local/opt/ is used by Homebrew on Intel macOS.
> 
> Hmm.  Is that the case with new setups under x86_64?  I have a M1
> where everything goes through /opt/homebrew/, though it has been set
> very recently.

Yes, it's hardware dependent:

https://docs.brew.sh/Installation
"This script installs Homebrew to its preferred prefix (/usr/local for macOS
Intel, /opt/homebrew for Apple Silicon and /home/linuxbrew/.linuxbrew for
Linux"


Maybe we should rely on PATH, rather than hardcoding OS dependent locations?
Or at least fall back to seach binaries in PATH? Seems pretty odd to hardcode
all these locations without a way to influence it from outside the test.

There has to be something similar to python's shutil.which() in perl.

Greetings,

Andres Freund

  10. Re: kerberos/001_auth test fails on arm CPU darwin

    Tom Lane <tgl@sss.pgh.pa.us> — 2022-09-27T02:21:06Z

    Andres Freund <andres@anarazel.de> writes:
> Maybe we should rely on PATH, rather than hardcoding OS dependent locations?

My suggestion to consult krb5-config first was meant to allow PATH
to influence the results.  However, if that doesn't work, it's important
IMO to have a sane list of hardwired places to look in.  Personally,
I do not like to have MacPorts or Homebrew's bin directory in the
PATH -- at least not for a buildfarm animal -- because there tends
to be an enormous amount of non-Mac-ish clutter there.  So for this
purpose, I'd like us to be able to find the standard places that
MacPorts and Homebrew install Kerberos in even if they are not in PATH.

			regards, tom lane

  11. Re: kerberos/001_auth test fails on arm CPU darwin

    Peter Eisentraut <peter.eisentraut@enterprisedb.com> — 2022-09-27T10:29:31Z

    On 27.09.22 03:37, Andres Freund wrote:
> Maybe we should rely on PATH, rather than hardcoding OS dependent locations?
> Or at least fall back to seach binaries in PATH? Seems pretty odd to hardcode
> all these locations without a way to influence it from outside the test.

Homebrew intentionally does not install the krb5 and openldap packages 
into the path, because they conflict with macOS-provided software. 
However, those macOS-provided variants don't provide all the pieces we 
need for the tests.

Also, on Linux you need /usr/sbin, which is often not in the path.

So I think there is no good way around hardcoding a lot of these paths.

  12. Re: kerberos/001_auth test fails on arm CPU darwin

    Nazir Bilal Yavuz <byavuz81@gmail.com> — 2022-09-27T15:35:45Z

    Hi,

Thanks for the reviews!


On 9/27/2022 5:21 AM, Tom Lane wrote:
> Andres Freund <andres@anarazel.de> writes:
>> Maybe we should rely on PATH, rather than hardcoding OS dependent locations?
> My suggestion to consult krb5-config first was meant to allow PATH
> to influence the results.  However, if that doesn't work, it's important
> IMO to have a sane list of hardwired places to look in.


I updated my patch regarding these reviews.

The current logic is it will try to find all executables in that 
order(if it finds all executables, it won't try remaining steps):


1 - 'krb5-config --prefix'

2 - hardcoded paths(I added arm and MacPorts paths for darwin)

3 - from PATH

Also, I tried to do some refactoring for adding another paths to search 
in the future and being sure about all executables are found.

Ci run after fix is applied:
https://cirrus-ci.com/build/5758254918664192

Regards,
Nazir Bilal Yavuz

  13. Re: kerberos/001_auth test fails on arm CPU darwin

    Stephen Frost <sfrost@snowman.net> — 2022-09-29T14:39:12Z

    Greetings,

* Peter Eisentraut (peter.eisentraut@enterprisedb.com) wrote:
> On 27.09.22 03:37, Andres Freund wrote:
> > Maybe we should rely on PATH, rather than hardcoding OS dependent locations?
> > Or at least fall back to seach binaries in PATH? Seems pretty odd to hardcode
> > all these locations without a way to influence it from outside the test.
> 
> Homebrew intentionally does not install the krb5 and openldap packages into
> the path, because they conflict with macOS-provided software. However, those
> macOS-provided variants don't provide all the pieces we need for the tests.

The macOS-provided versions are also old and broken, or at least that
was the case when I looked into them last.

> Also, on Linux you need /usr/sbin, which is often not in the path.
> 
> So I think there is no good way around hardcoding a lot of these paths.

Yeah, not sure what else to do.

Thanks,

Stephen

  14. Re: kerberos/001_auth test fails on arm CPU darwin

    Tom Lane <tgl@sss.pgh.pa.us> — 2022-09-29T14:49:21Z

    Stephen Frost <sfrost@snowman.net> writes:
> * Peter Eisentraut (peter.eisentraut@enterprisedb.com) wrote:
>> Homebrew intentionally does not install the krb5 and openldap packages into
>> the path, because they conflict with macOS-provided software. However, those
>> macOS-provided variants don't provide all the pieces we need for the tests.

> The macOS-provided versions are also old and broken, or at least that
> was the case when I looked into them last.

Yeah.  They also generate tons of deprecation warnings at compile time,
so it's not like Apple is encouraging you to use them.  I wonder why
they're still there at all.

			regards, tom lane

  15. Re: kerberos/001_auth test fails on arm CPU darwin

    Peter Eisentraut <peter.eisentraut@enterprisedb.com> — 2022-10-01T11:12:51Z

    On 27.09.22 17:35, Nazir Bilal Yavuz wrote:
> I updated my patch regarding these reviews.
> 
> The current logic is it will try to find all executables in that 
> order(if it finds all executables, it won't try remaining steps):
> 
> 
> 1 - 'krb5-config --prefix'
> 
> 2 - hardcoded paths(I added arm and MacPorts paths for darwin)
> 
> 3 - from PATH
> 
> Also, I tried to do some refactoring for adding another paths to search 
> in the future and being sure about all executables are found.

This patch could use some more in-code comments.  For example, this

+# get prefix for kerberos executables and try to find them at this path
+sub test_krb5_paths

is not helpful.  What does it "get", where does it put it, how does it 
"try", and what does it do if it fails?  What are the inputs and outputs 
of this function?

+   # remove '\n' since 'krb5-config --prefix' returns path ends with '\n'
+   $krb5_path =~ s/\n//g;

use chomp

  16. Re: kerberos/001_auth test fails on arm CPU darwin

    Nazir Bilal Yavuz <byavuz81@gmail.com> — 2022-10-10T14:32:16Z

    Hi,

Thanks for the review!

On 10/1/22 14:12, Peter Eisentraut wrote:
> This patch could use some more in-code comments.  For example, this
>
> +# get prefix for kerberos executables and try to find them at this path
> +sub test_krb5_paths
>
> is not helpful.  What does it "get", where does it put it, how does it 
> "try", and what does it do if it fails?  What are the inputs and 
> outputs of this function?
>
> +   # remove '\n' since 'krb5-config --prefix' returns path ends with 
> '\n'
> +   $krb5_path =~ s/\n//g;
>
> use chomp
>

I updated patch regarding these comments.

I have a question about my logic:
+    elsif ($^O eq 'linux')
+    {
+        test_krb5_paths('/usr/');
+    }
  }

Before that, test could use krb5kdc, kadmin and kdb5_util from 
'/usr/sbin/'; krb5_config and kinit from $PATH. However, now it will try 
to use all of them from $PATH or from '/usr/sbin/' and '/usr/bin/'. Does 
that cause a problem?

Ci run after fix is applied:

https://cirrus-ci.com/build/5359971746447360


Regards,
Nazir Bilal Yavuz