[packages/postgresql] Make krb5 only features optional for now (until we switch to krb5)
arekm
arekm at pld-linux.org
Wed Aug 12 21:27:25 CEST 2026
commit 34fccc3104fb10bd8270c59ea5bdbc6b6631c4da
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Wed Aug 12 21:27:06 2026 +0200
Make krb5 only features optional for now (until we switch to krb5)
postgresql-gssapi-delegation-optional.patch | 163 ++++++++++++++++++++++++++++
postgresql.spec | 4 +-
2 files changed, 166 insertions(+), 1 deletion(-)
---
diff --git a/postgresql.spec b/postgresql.spec
index 01f373f..f674cfa 100644
--- a/postgresql.spec
+++ b/postgresql.spec
@@ -52,6 +52,7 @@ Patch2: %{name}-ecpg-includedir.patch
Patch3: ac.patch
Patch5: %{name}-heimdal.patch
Patch6: %{name}-link.patch
+Patch7: %{name}-gssapi-delegation-optional.patch
URL: https://www.postgresql.org/
BuildRequires: autoconf >= 2.69
BuildRequires: automake
@@ -66,7 +67,7 @@ BuildRequires: docbook-style-xsl-nons
BuildRequires: flex >= 2.5.31
BuildRequires: gettext-tools
BuildRequires: gnome-doc-tools
-%{?with_kerberos5:BuildRequires: heimdal-devel >= 8.0}
+%{?with_kerberos5:BuildRequires: heimdal-devel}
BuildRequires: libicu-devel
%{?with_selinux:BuildRequires: libselinux-devel >= 2.1.10}
BuildRequires: libtool
@@ -824,6 +825,7 @@ Różne moduły dołączone do PostgreSQL-a.
%patch -P3 -p1
%patch -P5 -p1
%patch -P6 -p1
+%patch -P7 -p1
# force rebuild of bison/flex files
find src -name \*.l -o -name \*.y | xargs touch
diff --git a/postgresql-gssapi-delegation-optional.patch b/postgresql-gssapi-delegation-optional.patch
new file mode 100644
index 0000000..6e3bc0d
--- /dev/null
+++ b/postgresql-gssapi-delegation-optional.patch
@@ -0,0 +1,163 @@
+diff -urNp -x '*.orig' postgresql-18.4.base/configure.ac postgresql-18.4/configure.ac
+--- postgresql-18.4.orig/configure.ac 2026-08-12 21:06:20.724222260 +0200
++++ postgresql-18.4/configure.ac 2026-08-12 21:10:06.639571524 +0200
+@@ -1364,8 +1364,8 @@ fi
+
+ if test "$with_gssapi" = yes ; then
+ if test "$PORTNAME" != "win32"; then
+- AC_SEARCH_LIBS(gss_store_cred_into, [gssapi 'gssapi -lkrb5 -lcrypto' gssapi_krb5 gss], [],
+- [AC_MSG_ERROR([could not find function 'gss_store_cred_into' required for GSSAPI])])
++ AC_SEARCH_LIBS(gss_init_sec_context, [gssapi 'gssapi -lkrb5 -lcrypto' gssapi_krb5 gss], [],
++ [AC_MSG_ERROR([could not find function 'gss_init_sec_context' required for GSSAPI])])
+ else
+ LIBS="$LIBS -lgssapi32"
+ fi
+@@ -1576,8 +1576,12 @@ fi
+ if test "$with_gssapi" = yes ; then
+ AC_CHECK_HEADERS(gssapi/gssapi.h, [],
+ [AC_CHECK_HEADERS(gssapi.h, [], [AC_MSG_ERROR([gssapi.h header file is required for GSSAPI])])])
+- AC_CHECK_HEADERS(gssapi/gssapi_ext.h, [],
+- [AC_CHECK_HEADERS(gssapi_ext.h, [], [AC_MSG_ERROR([gssapi_ext.h header file is required for GSSAPI])])])
++ dnl gssapi_ext.h and gss_store_cred_into() are only needed to accept
++ dnl delegated credentials, which is optional; Heimdal 7.x has neither.
++ AC_CHECK_HEADERS(gssapi/gssapi_ext.h, [], [AC_CHECK_HEADERS(gssapi_ext.h)])
++ if test "$ac_cv_header_gssapi_gssapi_ext_h" = yes || test "$ac_cv_header_gssapi_ext_h" = yes; then
++ AC_CHECK_FUNCS([gss_store_cred_into])
++ fi
+ fi
+
+ PGAC_PATH_PROGS(OPENSSL, openssl)
+diff -urNp -x '*.orig' postgresql-18.4.base/meson.build postgresql-18.4/meson.build
+--- postgresql-18.4.orig/meson.build 2026-05-11 21:44:35.000000000 +0200
++++ postgresql-18.4/meson.build 2026-08-12 21:10:28.259571532 +0200
+@@ -681,28 +681,31 @@ if not gssapiopt.disabled()
+ have_gssapi = false
+ endif
+
++ # gssapi_ext.h and gss_store_cred_into() are only needed to accept delegated
++ # credentials, which is optional; Heimdal 7.x has neither.
++ have_gssapi_ext = false
+ if not have_gssapi
+ elif cc.check_header('gssapi/gssapi_ext.h', dependencies: gssapi_deps, required: false,
+ args: test_c_args, include_directories: postgres_inc)
+ cdata.set('HAVE_GSSAPI_GSSAPI_EXT_H', 1)
+- elif cc.check_header('gssapi_ext.h', dependencies: gssapi_deps, required: gssapiopt,
++ have_gssapi_ext = true
++ elif cc.check_header('gssapi_ext.h', dependencies: gssapi_deps, required: false,
+ args: test_c_args, include_directories: postgres_inc)
+ cdata.set('HAVE_GSSAPI_EXT_H', 1)
+- else
+- have_gssapi = false
++ have_gssapi_ext = true
+ endif
+
+- if not have_gssapi
+- elif cc.has_function('gss_store_cred_into', dependencies: gssapi_deps,
+- args: test_c_args, include_directories: postgres_inc)
++ if have_gssapi
+ cdata.set('ENABLE_GSS', 1)
+
++ if have_gssapi_ext and cc.has_function('gss_store_cred_into',
++ dependencies: gssapi_deps,
++ args: test_c_args, include_directories: postgres_inc)
++ cdata.set('HAVE_GSS_STORE_CRED_INTO', 1)
++ endif
++
+ krb_srvtab = 'FILE:/@0@/krb5.keytab)'.format(get_option('sysconfdir'))
+ cdata.set_quoted('PG_KRB_SRVTAB', krb_srvtab)
+- elif gssapiopt.enabled()
+- error('''could not find function 'gss_store_cred_into' required for GSSAPI''')
+- else
+- have_gssapi = false
+ endif
+
+ if not have_gssapi and gssapiopt.enabled()
+diff -urNp -x '*.orig' postgresql-18.4.base/src/backend/commands/variable.c postgresql-18.4/src/backend/commands/variable.c
+--- postgresql-18.4.orig/src/backend/commands/variable.c 2026-05-11 21:44:35.000000000 +0200
++++ postgresql-18.4/src/backend/commands/variable.c 2026-08-12 21:08:02.096238166 +0200
+@@ -1246,6 +1246,19 @@ check_default_with_oids(bool *newval, vo
+ }
+
+ bool
++check_gss_accept_delegation(bool *newval, void **extra, GucSource source)
++{
++#ifndef HAVE_GSS_STORE_CRED_INTO
++ if (*newval)
++ {
++ GUC_check_errmsg("GSSAPI delegation is not supported by this build");
++ return false;
++ }
++#endif
++ return true;
++}
++
++bool
+ check_ssl(bool *newval, void **extra, GucSource source)
+ {
+ #ifndef USE_SSL
+diff -urNp -x '*.orig' postgresql-18.4.base/src/backend/libpq/be-gssapi-common.c postgresql-18.4/src/backend/libpq/be-gssapi-common.c
+--- postgresql-18.4.orig/src/backend/libpq/be-gssapi-common.c 2026-05-11 21:44:35.000000000 +0200
++++ postgresql-18.4/src/backend/libpq/be-gssapi-common.c 2026-08-12 21:06:40.929571493 +0200
+@@ -103,6 +103,7 @@ pg_GSS_error(const char *errmsg,
+ void
+ pg_store_delegated_credential(gss_cred_id_t cred)
+ {
++#ifdef HAVE_GSS_STORE_CRED_INTO
+ OM_uint32 major,
+ minor;
+ gss_OID_set mech;
+@@ -144,4 +145,11 @@ pg_store_delegated_credential(gss_cred_i
+ * gss_acquire_cred will find the delegated credentials we stored.
+ */
+ setenv("KRB5CCNAME", GSS_MEMORY_CACHE, 1);
++#else
++ /*
++ * Unreachable: gss_accept_delegation cannot be turned on in a build
++ * without gss_store_cred_into(), so no credential is ever delegated.
++ */
++ elog(ERROR, "GSSAPI delegation is not supported by this build");
++#endif
+ }
+diff -urNp -x '*.orig' postgresql-18.4.base/src/backend/utils/misc/guc_tables.c postgresql-18.4/src/backend/utils/misc/guc_tables.c
+--- postgresql-18.4.orig/src/backend/utils/misc/guc_tables.c 2026-05-11 21:44:35.000000000 +0200
++++ postgresql-18.4/src/backend/utils/misc/guc_tables.c 2026-08-12 21:07:01.459571494 +0200
+@@ -1837,7 +1837,7 @@ struct config_bool ConfigureNamesBool[]
+ },
+ &pg_gss_accept_delegation,
+ false,
+- NULL, NULL, NULL
++ check_gss_accept_delegation, NULL, NULL
+ },
+
+ {
+diff -urNp -x '*.orig' postgresql-18.4.base/src/include/libpq/pg-gssapi.h postgresql-18.4/src/include/libpq/pg-gssapi.h
+--- postgresql-18.4.orig/src/include/libpq/pg-gssapi.h 2026-05-11 21:44:35.000000000 +0200
++++ postgresql-18.4/src/include/libpq/pg-gssapi.h 2026-08-12 21:10:12.692904860 +0200
+@@ -19,11 +19,15 @@
+ /* IWYU pragma: begin_exports */
+ #if defined(HAVE_GSSAPI_H)
+ #include <gssapi.h>
++#ifdef HAVE_GSSAPI_EXT_H
+ #include <gssapi_ext.h>
++#endif
+ #else
+ #include <gssapi/gssapi.h>
++#ifdef HAVE_GSSAPI_GSSAPI_EXT_H
+ #include <gssapi/gssapi_ext.h>
+ #endif
++#endif
+ /* IWYU pragma: end_exports */
+
+ /*
+diff -urNp -x '*.orig' postgresql-18.4.base/src/include/utils/guc_hooks.h postgresql-18.4/src/include/utils/guc_hooks.h
+--- postgresql-18.4.orig/src/include/utils/guc_hooks.h 2026-05-11 21:44:35.000000000 +0200
++++ postgresql-18.4/src/include/utils/guc_hooks.h 2026-08-12 21:07:51.809571497 +0200
+@@ -61,6 +61,8 @@ extern bool check_default_text_search_co
+ extern void assign_default_text_search_config(const char *newval, void *extra);
+ extern bool check_default_with_oids(bool *newval, void **extra,
+ GucSource source);
++extern bool check_gss_accept_delegation(bool *newval, void **extra,
++ GucSource source);
+ extern bool check_huge_page_size(int *newval, void **extra, GucSource source);
+ extern void assign_io_method(int newval, void *extra);
+ extern bool check_io_max_concurrency(int *newval, void **extra, GucSource source);
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/postgresql.git/commitdiff/34fccc3104fb10bd8270c59ea5bdbc6b6631c4da
More information about the pld-cvs-commit
mailing list