bug#62760: [PATCH 0/3] Two serious vulnerabilities in Heimdal Kerberos

[Maxim Cournoyer <maxim.cournoyer@gmail.com>]

Hello,

Felix Lechner <felix.lechner@lease-up.com> writes:

> This commit took several cues for the inputs from the Debian packaging for
> Heimdal. [1]
>
> First, it was not clear why the alternative implementation mit-krb5 should be
> supplied as an input to Heimdal. It was dropped.

I'm not sure why I needed to add it in the past; I think the build was
broken then without it.

> The other inputs were added to address detection attempts in ./configure that
> failed. They were evident from the build log.
>
> Also enables support for the OpenLDAP backend for the principals database.

> [1] https://tracker.debian.org/media/packages/h/heimdal/control-7.8.git20221117.28daf24dfsg-2

> * gnu/packages/kerberos.scm (darktable)[inputs, native-inputs]: Enable
> OpenLDAP; converge inputs toward Debian packaging.

I've fixed the change log to read as:

--8<---------------cut here---------------start------------->8---
gnu: heimdal: Enable OpenLDAP support.

* gnu/packages/kerberos.scm (heimdal)[native-inputs]:
Add flex, libcap-ng,  openldap and pkg-config.
[inputs]: Remove mit-krb5.  Add libcap-ng and openldap.
--8<---------------cut here---------------end--------------->8---

But then noticed that libcap-ng and openldap needed not be added to
native-inputs, so I removed those.  These are run time libraries.

> ---
>  gnu/packages/kerberos.scm | 13 +++++++++++--
>  1 file changed, 11 insertions(+), 2 deletions(-)
>
> diff --git a/gnu/packages/kerberos.scm b/gnu/packages/kerberos.scm
> index 0faf879e35..c9c86f9541 100644
> --- a/gnu/packages/kerberos.scm
> +++ b/gnu/packages/kerberos.scm
> @@ -30,10 +30,12 @@
>  
>  (define-module (gnu packages kerberos)
>    #:use-module (gnu packages)
> +  #:use-module (gnu packages admin)
>    #:use-module (gnu packages autotools)
>    #:use-module (gnu packages bash)
>    #:use-module (gnu packages bison)
>    #:use-module (gnu packages dbm)
> +  #:use-module (gnu packages flex)
>    #:use-module (gnu packages perl)
>    #:use-module (gnu packages python)
>    #:use-module (gnu packages gettext)
> @@ -41,6 +43,7 @@ (define-module (gnu packages kerberos)
>    #:use-module (gnu packages libidn)
>    #:use-module (gnu packages hurd)
>    #:use-module (gnu packages linux)
> +  #:use-module (gnu packages openldap)
>    #:use-module (gnu packages pkg-config)
>    #:use-module (gnu packages compression)
>    #:use-module (gnu packages readline)
> @@ -249,16 +252,22 @@ (define-public heimdal
>                            (format #t "#!~a~%exit 1~%" (which "sh")))))))
>         ;; Tests fail when run in parallel.
>         #:parallel-tests? #f))
> -    (native-inputs (list e2fsprogs ;for 'compile_et'
> +    (native-inputs (list bison
> +                         e2fsprogs ;for 'compile_et'
> +                         flex
> +                         libcap-ng
>                           texinfo
>                           unzip ;for tests
> +                         openldap
>                           perl
> +                         pkg-config
>                           python))
>      (inputs (list readline
>                    bash-minimal
>                    bdb
>                    e2fsprogs ;for libcom_err
> -                  mit-krb5
> +                  libcap-ng
> +                  openldap
>                    sqlite))
>      (home-page "http://www.h5l.org/")
>      (synopsis "Kerberos 5 network authentication")

Modified like:

--8<---------------cut here---------------start------------->8---
diff --git a/gnu/packages/kerberos.scm b/gnu/packages/kerberos.scm
index a97c2ac87b..9e2f6acd56 100644
--- a/gnu/packages/kerberos.scm
+++ b/gnu/packages/kerberos.scm
@@ -253,18 +253,16 @@ (define-public heimdal
        ;; Tests fail when run in parallel.
        #:parallel-tests? #f))
     (native-inputs (list bison
-                         e2fsprogs ;for 'compile_et'
+                         e2fsprogs      ;for 'compile_et'
                          flex
-                         libcap-ng
                          texinfo
-                         unzip ;for tests
-                         openldap
+                         unzip          ;for tests
                          pkg-config
                          python))
     (inputs (list readline
                   bash-minimal
                   bdb
-                  e2fsprogs ;for libcom_err
+                  e2fsprogs             ;for libcom_err
                   libcap-ng
                   openldap
                   sqlite))
--8<---------------cut here---------------end--------------->8---

And installed!

-- 
Thanks,
Maxim