#1645 neon27-shlibs fails on Yosemite/HalfDome

[atlauren]

Compiling neon27-shlibs (required by cadaver-ssl) fails with HalfDome branch on Yosemite/14A261i. Log attached.

[atlauren]

Apologies, I forgot to select the package owner.

[Daniel Macks]

No actual error message from the build itself? Just:

/bin/sh ../libtool --quiet --mode=link gcc -no-undefined -rpath /sw/lib -version-info 30:0:3 -export-symbols-regex '^ne_[^_]' -o libneon.la ne_request.lo ne_session.lo ne_basic.lo ne_string.lo ne_uri.lo ne_dates.lo ne_alloc.lo ne_md5.lo ne_utils.lo ne_socket.lo ne_auth.lo ne_redirect.lo ne_compress.lo ne_i18n.lo ne_pkcs11.lo ne_socks.lo ne_ntlm.lo ne_207.lo ne_xml.lo ne_props.lo ne_locks.lo ne_xmlreq.lo ne_oldacl.lo ne_acl3744.lo ne_openssl.lo -lintl -lz -L/sw/lib -lssl -lcrypto -framework GSS -L/sw/lib -lproxy -L/sw/lib -lxml2 -lz -lpthread -L/sw/lib -liconv -lm

(and nothing that I see higher up in the log either). Maybe "--quiet" is hiding it?

[atlauren]

Sorry, that first file didn't have all the output. Here's another.

[Daniel Macks]

Ahah!

Undefined symbols for architecture x86_64:
"_GSS_C_NT_HOSTBASED_SERVICE", referenced from:
_auth_register in ne_auth.o
ld: symbol(s) not found for architecture x86_64

I don't know about this specifically, but googling finds that the headers needed for this symbol/token (or maybe gss generally) are a bit of a moving target:(

Not sure how you're generating logfiles, but using the "-l" flag for the fink commandline tool (for example, 'fink -l build neon27-shlibs') automatically saves a full build transcript in /tmp for you.

[Daniel Johnson]

The build is mixing up two different versions of Kerberos. Can you give me the results of these 2 commands?
krb5-config --libs gssapi
krb5-config --cflags gssapi

[atlauren]

As requested...

bash-3.2# krb5-config --libs gssapi
-framework GSS
bash-3.2# krb5-config --cflags gssapi

bash-3.2#

-Andrew

[Daniel Johnson]

I've just committed an attempt to fix neon27 on 10.10. Let me know if it works. It looks like Apple has broken gssapi use everywhere and we're going to have to patch around it. Sigh.

[atlauren]

As requested...

bash-3.2# krb5-config --libs gssapi
-framework GSS
bash-3.2# krb5-config --cflags gssapi

bash-3.2#

-Andrew

[atlauren]

Build log from a fresh download.

[Daniel Johnson]

Thanks, but that's the old file. The new version may not have propagated yet.

In any case, it doesn't look like it will work anyway. Apple has really screwed up Kerberos on 10.10 it seems. There are two different implementations on OS X. Up to 10.9, Kerberos.framework was the default but it looks like they've now switched to GSS.framework instead. The problem is that while they changed krb5-config to return -framework GSS, they've left the old headers in /usr/include/gssapi and every package I know will always look there first for headers. The result is that things like neon27 use the old headers but link to the new library which ends poorly as you've seen. I'm not sure how to work around this.

If I were you, I'd file a bug report with Apple about this. This is going to break a lot of software that uses Kerberos.

[atlauren]

I filed 17553755: UNIX packages fail against Kerberos, recyling much of
your eplanation text.

-Andrew

[Daniel Johnson]

Thanks to Apple making the Xcode 6 beta publicly available, I've been able to come up with a fix. Let me know if neon27 builds now.

[atlauren]

Should I pull from the 10.10 branch? What's the package number?

-Andrew

[atlauren]

Update: It builds successfully!

10.10/14A238x

bash-3.2# xcode-select -p
/Library/Developer/CommandLineTools [July 2014]​

HalfDome [2014-07-11]

neon27-shlibs-0.30.0-1

[atlauren]

Confirming, still works on 14A299l and HalfDome 2014-07-28.