Horton

Re: longfin missing gssapi_ext.h

Stephen Frost <sfrost@snowman.net>

View thread View on postgr.es
From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-hackers@lists.postgresql.org
Date: 2023-04-08T02:34:22Z
Lists: pgsql-hackers

Attachments

Greetings,

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Stephen Frost <sfrost@snowman.net> writes:
> > * Tom Lane (tgl@sss.pgh.pa.us) wrote:
> >> It's whatever Apple is shipping, or was shipping last year or so.
> 
> > Sadly they've not been maintaining the Kerberos libraries at all on
> > their systems.
> 
> Indeed :-(.  I wouldn't be surprised if there are security issues in
> their version.  Perhaps what we really ought to do is refuse to build
> with their version --- but if so, we need some clearer error message
> about it.

The attached should (I believe?) at least add the needed check for
gssapi_ext.h which will cause builds to fail and complain about the
header being missing from their installation.

I'm certainly open to ideas about how to provide a better error message,
particularly on OSX systems which have an ancient version, to make it
clear that people need to install an updated version.  I don't have an
OSX system at hand though.

Should I push this to at least address the header check ... ?

Thanks,

Stephen

Commits

  1. Further cleanup of autoconf output files for GSSAPI changes.

  2. Update Kerberos/GSSAPI configure/meson check

  3. Explicitly require MIT Kerberos for GSSAPI

  4. De-Revert "Add support for Kerberos credential delegation"

  5. Revert "Add support for Kerberos credential delegation"