kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/security/heimdal/Makefile

126 lines
3.5 KiB
Makefile
Raw Normal View History

Revbump after updating libwebp and icu
2014-10-07 18:47:10 +02:00
# $NetBSD: Makefile,v 1.114 2014/10/07 16:47:14 adam Exp $
Initial import of heimdal-0.6 into security/heimdal. Heimdal is a free implementation of Kerberos 5. Kerberos is a system for authenticating users and services on a network. It is built upon the assumption that the network is "unsafe". Kerberos is a trusted third-party service. That means that there is a third party (the Kerberos server) that is trusted by all the entities on the network (users and services, usually called "principals"). All principals share a secret password (or key) with the Kerberos server and this enables principals to verify that the messages from the Kerberos server are authentic. Thus trusting the Kerberos server, users and services can authenticate each other.
2004-01-10 15:56:44 +01:00
Changes 1.5.3: Bug fixes - Fix leaking file descriptors in KDC - Better socket/timeout handling in libkrb5 - General bug fixes - Build fixes
2013-08-16 10:30:14 +02:00
DISTNAME= heimdal-1.5.3
Revbump after updating libwebp and icu
2014-10-07 18:47:10 +02:00
PKGREVISION= 8
Whitespace nits.
2004-06-25 17:42:52 +02:00
CATEGORIES= security
Update security/heimdal to version 1.1. Changes from version 0.7.2 include: * Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28 09:14:41 +01:00
MASTER_SITES= http://www.h5l.org/dist/src/
Initial import of heimdal-0.6 into security/heimdal. Heimdal is a free implementation of Kerberos 5. Kerberos is a system for authenticating users and services on a network. It is built upon the assumption that the network is "unsafe". Kerberos is a trusted third-party service. That means that there is a third party (the Kerberos server) that is trusted by all the entities on the network (users and services, usually called "principals"). All principals share a secret password (or key) with the Kerberos server and this enables principals to verify that the messages from the Kerberos server are authentic. Thus trusting the Kerberos server, users and services can authenticate each other.
2004-01-10 15:56:44 +01:00
Reset maintainer, lost his commit bit.
2010-03-23 16:37:56 +01:00
MAINTAINER= pkgsrc-users@NetBSD.org
Update security/heimdal to version 1.1. Changes from version 0.7.2 include: * Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28 09:14:41 +01:00
HOMEPAGE= http://www.h5l.org/
Whitespace nits.
2004-06-25 17:42:52 +02:00
COMMENT= Kerberos 5 implementation
Use standard location for LICENSE line (in MAINTAINER/HOMEPAGE/COMMENT block). Uncomment some commented out LICENSE lines while here.
2009-05-19 10:59:00 +02:00
LICENSE= modified-bsd
Initial import of heimdal-0.6 into security/heimdal. Heimdal is a free implementation of Kerberos 5. Kerberos is a system for authenticating users and services on a network. It is built upon the assumption that the network is "unsafe". Kerberos is a trusted third-party service. That means that there is a third party (the Kerberos server) that is trusted by all the entities on the network (users and services, usually called "principals"). All principals share a secret password (or key) with the Kerberos server and this enables principals to verify that the messages from the Kerberos server are authentic. Thus trusting the Kerberos server, users and services can authenticate each other.
2004-01-10 15:56:44 +01:00
security/heimdal and arla conflict with each other because of: bin/mk_cmds lib/libroken.la lib/libsl.la lib/libss.la man/man3/arg_printusage.3 man/man3/getarg.3 Addresses PR 32610 and PR 32611 by Ola Eriksson.
2006-01-24 19:55:21 +01:00
CONFLICTS+= arla-[0-9]*
Whitespace nits.
2004-06-25 17:42:52 +02:00
CONFLICTS+= mit-krb5-[0-9]*
security/heimdal and net/openafs conflict because of: bin/compile_et bin/kpasswd bin/pagsh Addresses PR 32610 and PR 32612 by Ola Eriksson.
2006-01-24 19:56:23 +01:00
CONFLICTS+= openafs-[0-9]*
heimdal and gss conflict because they install a common set of manpages for the gss_* functions.
2006-04-01 01:44:39 +02:00
CONFLICTS+= gss-[0-9]*
Add CONFLICTS with kth-krb4 (lib/libsl.so)
2012-09-09 11:23:06 +02:00
CONFLICTS+= kth-krb4-[0-9]*
Note CONFLICT with forthcoming mit-krb5 package.
2004-01-11 01:00:28 +01:00
At least on my systems glob and vis are not installed, so introduce PLIST conditional. Please fix up the setting on your systems. Mark as not MAKE_JOBS_SAFE.
2013-08-22 23:17:00 +02:00
MAKE_JOBS_SAFE= no
Initial import of heimdal-0.6 into security/heimdal. Heimdal is a free implementation of Kerberos 5. Kerberos is a system for authenticating users and services on a network. It is built upon the assumption that the network is "unsafe". Kerberos is a trusted third-party service. That means that there is a third party (the Kerberos server) that is trusted by all the entities on the network (users and services, usually called "principals"). All principals share a secret password (or key) with the Kerberos server and this enables principals to verify that the messages from the Kerberos server are authentic. Thus trusting the Kerberos server, users and services can authenticate each other.
2004-01-10 15:56:44 +01:00
USE_LIBTOOL= yes
Add runtime dependency on flex (in bin/compile_et). Bump PKGREVISION.
2014-07-30 13:05:04 +02:00
USE_TOOLS+= bison flex:run
Update security/heimdal to version 1.1. Changes from version 0.7.2 include: * Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28 09:14:41 +01:00
PKGCONFIG_OVERRIDE+= tools/heimdal-gssapi.pc.in
Update security/heimdal to 0.7.1 (approved by lha). We drop support for the "db4" option and just rely on the appropriate BDB_* settings via bdb.buildlink3.mk. Also, we tweak the builtin.mk file so use krb5-config, if it's available, to check the version of the built-in heimdal. Patches patch-ab, patch-ae and patch-af have been sent back upstream and will be incorporated into future Heimdal releases. Changes between version 0.6.5 and version 0.7.1 include: * Support for KCM, a process based credential cache * Support CCAPI credential cache * SPNEGO support * AES (and the gssapi conterpart, CFX) support * Adding new and improve old documentation * Bug fixes
2005-10-26 17:12:45 +02:00
MAKE_ENV+= INSTALL_CATPAGES=no
Initial import of heimdal-0.6 into security/heimdal. Heimdal is a free implementation of Kerberos 5. Kerberos is a system for authenticating users and services on a network. It is built upon the assumption that the network is "unsafe". Kerberos is a trusted third-party service. That means that there is a third party (the Kerberos server) that is trusted by all the entities on the network (users and services, usually called "principals"). All principals share a secret password (or key) with the Kerberos server and this enables principals to verify that the messages from the Kerberos server are authentic. Thus trusting the Kerberos server, users and services can authenticate each other.
2004-01-10 15:56:44 +01:00
Update security/heimdal to version 1.1. Changes from version 0.7.2 include: * Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28 09:14:41 +01:00
.include "../../mk/bsd.prefs.mk"
.include "options.mk"
HEIMDAL_HDB_DIR= ${VARBASE}/heimdal
Initial import of heimdal-0.6 into security/heimdal. Heimdal is a free implementation of Kerberos 5. Kerberos is a system for authenticating users and services on a network. It is built upon the assumption that the network is "unsafe". Kerberos is a trusted third-party service. That means that there is a third party (the Kerberos server) that is trusted by all the entities on the network (users and services, usually called "principals"). All principals share a secret password (or key) with the Kerberos server and this enables principals to verify that the messages from the Kerberos server are authentic. Thus trusting the Kerberos server, users and services can authenticate each other.
2004-01-10 15:56:44 +01:00
GNU_CONFIGURE= yes
Update security/heimdal to 0.7.1 (approved by lha). We drop support for the "db4" option and just rely on the appropriate BDB_* settings via bdb.buildlink3.mk. Also, we tweak the builtin.mk file so use krb5-config, if it's available, to check the version of the built-in heimdal. Patches patch-ab, patch-ae and patch-af have been sent back upstream and will be incorporated into future Heimdal releases. Changes between version 0.6.5 and version 0.7.1 include: * Support for KCM, a process based credential cache * Support CCAPI credential cache * SPNEGO support * AES (and the gssapi conterpart, CFX) support * Adding new and improve old documentation * Bug fixes
2005-10-26 17:12:45 +02:00
CONFIGURE_ARGS+= --enable-kcm
Changes 1.4: New features * Support for reading MIT database file directly * KCM is polished up and now used in production * NTLM first class citizen, credentials stored in KCM * Table driven ASN.1 compiler, smaller!, not enabled by default * Native Windows client support Notes * Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Changes 1.3.3: Bug fixes * Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] * Check NULL pointers before dereference them [kdc] Changes 1.3.2: Bug fixes * Don't mix length when clearing hmac (could memset too much) * More paranoid underrun checking when decrypting packets * Check the password change requests and refuse to answer empty packets * Build on OpenSolaris * Renumber AD-SIGNED-TICKET since it was stolen from US * Don't cache /dev/*random file descriptor, it doesn't get unloaded * Make C++ safe * Misc warnings
2011-07-08 11:49:21 +02:00
CONFIGURE_ARGS+= --enable-pthread-support
CONFIGURE_ARGS+= --includedir=${PREFIX}/include/krb5
CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFDIR}
PR/39656 -- Use /var/heimdal as hdbdir, not /var.
2012-03-11 12:30:06 +01:00
CONFIGURE_ARGS+= --with-hdbdir=${HEIMDAL_HDB_DIR}
Update security/heimdal to version 1.1. Changes from version 0.7.2 include: * Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28 09:14:41 +01:00
CONFIGURE_ARGS+= --with-openssl=${SSLBASE:Q}
Changes 1.4: New features * Support for reading MIT database file directly * KCM is polished up and now used in production * NTLM first class citizen, credentials stored in KCM * Table driven ASN.1 compiler, smaller!, not enabled by default * Native Windows client support Notes * Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Changes 1.3.3: Bug fixes * Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] * Check NULL pointers before dereference them [kdc] Changes 1.3.2: Bug fixes * Don't mix length when clearing hmac (could memset too much) * More paranoid underrun checking when decrypting packets * Check the password change requests and refuse to answer empty packets * Build on OpenSolaris * Renumber AD-SIGNED-TICKET since it was stolen from US * Don't cache /dev/*random file descriptor, it doesn't get unloaded * Make C++ safe * Misc warnings
2011-07-08 11:49:21 +02:00
CONFIGURE_ARGS+= --with-sqlite3=${BUILDLINK_PREFIX.sqlite3}
CONFIGURE_ARGS+= --without-x
Update security/heimdal to version 1.1. Changes from version 0.7.2 include: * Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28 09:14:41 +01:00
CONFIGURE_ARGS+= ${ABI:D--with-mips-abi=${ABI}}
CONFIGURE_ENV+= COMPILE_ET=no # build Heimdal's compile_et(1)
Changes 1.4: New features * Support for reading MIT database file directly * KCM is polished up and now used in production * NTLM first class citizen, credentials stored in KCM * Table driven ASN.1 compiler, smaller!, not enabled by default * Native Windows client support Notes * Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Changes 1.3.3: Bug fixes * Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] * Check NULL pointers before dereference them [kdc] Changes 1.3.2: Bug fixes * Don't mix length when clearing hmac (could memset too much) * More paranoid underrun checking when decrypting packets * Check the password change requests and refuse to answer empty packets * Build on OpenSolaris * Renumber AD-SIGNED-TICKET since it was stolen from US * Don't cache /dev/*random file descriptor, it doesn't get unloaded * Make C++ safe * Misc warnings
2011-07-08 11:49:21 +02:00
# XXX Grand Central Dispatch is broken in 1.4
CONFIGURE_ENV+= ac_cv_funclib_dispatch_async_f=no
Initial import of heimdal-0.6 into security/heimdal. Heimdal is a free implementation of Kerberos 5. Kerberos is a system for authenticating users and services on a network. It is built upon the assumption that the network is "unsafe". Kerberos is a trusted third-party service. That means that there is a third party (the Kerberos server) that is trusted by all the entities on the network (users and services, usually called "principals"). All principals share a secret password (or key) with the Kerberos server and this enables principals to verify that the messages from the Kerberos server are authentic. Thus trusting the Kerberos server, users and services can authenticate each other.
2004-01-10 15:56:44 +01:00
Changes 1.5.3: Bug fixes - Fix leaking file descriptors in KDC - Better socket/timeout handling in libkrb5 - General bug fixes - Build fixes
2013-08-16 10:30:14 +02:00
.include "../../mk/bdb.buildlink3.mk"
# XXX Don't detect db1 when a newer version is available; otherwise build fails
.if ${BDB_TYPE} != "db1"
CONFIGURE_ENV+= ac_cv_funclib_dbopen=no
.endif
Update security/heimdal to 0.7.1 (approved by lha). We drop support for the "db4" option and just rely on the appropriate BDB_* settings via bdb.buildlink3.mk. Also, we tweak the builtin.mk file so use krb5-config, if it's available, to check the version of the built-in heimdal. Patches patch-ab, patch-ae and patch-af have been sent back upstream and will be incorporated into future Heimdal releases. Changes between version 0.6.5 and version 0.7.1 include: * Support for KCM, a process based credential cache * Support CCAPI credential cache * SPNEGO support * AES (and the gssapi conterpart, CFX) support * Adding new and improve old documentation * Bug fixes
2005-10-26 17:12:45 +02:00
CFLAGS.Darwin+= -DBIND_8_COMPAT
Make this build on Darwin. This fixes PR pkg/29147.
2005-06-01 04:49:39 +02:00
Solaris 9 has a <vis.h> header, but it is very different to the BSD <vis.h> header, which is expected by heimdal. Now the package builds on Solaris 9.
2005-10-25 03:17:57 +02:00
# Though Solaris has a <vis.h> header, it does something very unrelated
# to the BSD <vis.h> header.
OPSYSVARS+= CONFIGURE_ENV
CONFIGURE_ENV.SunOS+= ac_cv_header_vis_h=no
Attempt to fix readline fallout. Tested with both READLINE_TYPE on SmartOS.
2013-08-15 13:15:11 +02:00
.include "../../mk/readline.buildlink3.mk"
.if ${READLINE_TYPE} == "readline"
* .include "../../devel/readline/buildlink3.mk" with USE_GNU_READLINE=yes are replaced with .include "../../devel/readline/buildlink3.mk", and USE_GNU_READLINE are removed, * .include "../../devel/readline/buildlink3.mk" without USE_GNU_READLINE are replaced with .include "../../mk/readline.buildlink3.mk".
2013-07-15 04:02:17 +02:00
CONFIGURE_ARGS+= --with-readline=${BUILDLINK_PREFIX.editlinereadline}
Attempt to fix readline fallout. Tested with both READLINE_TYPE on SmartOS.
2013-08-15 13:15:11 +02:00
.elif ${READLINE_TYPE} == "editline"
CONFIGURE_ARGS+= --with-libedit=${BUILDLINK_PREFIX.editlinereadline}
.endif
Initial import of heimdal-0.6 into security/heimdal. Heimdal is a free implementation of Kerberos 5. Kerberos is a system for authenticating users and services on a network. It is built upon the assumption that the network is "unsafe". Kerberos is a trusted third-party service. That means that there is a third party (the Kerberos server) that is trusted by all the entities on the network (users and services, usually called "principals"). All principals share a secret password (or key) with the Kerberos server and this enables principals to verify that the messages from the Kerberos server are authentic. Thus trusting the Kerberos server, users and services can authenticate each other.
2004-01-10 15:56:44 +01:00
At least on my systems glob and vis are not installed, so introduce PLIST conditional. Please fix up the setting on your systems. Mark as not MAKE_JOBS_SAFE.
2013-08-22 23:17:00 +02:00
PLIST_VARS+= glob vis
fix PLIST options for solaris, including builtin openssl support
2013-08-24 18:45:08 +02:00
.if ${OPSYS} == "SunOS"
PLIST.vis= yes
PLIST.glob= yes
.endif
At least on my systems glob and vis are not installed, so introduce PLIST conditional. Please fix up the setting on your systems. Mark as not MAKE_JOBS_SAFE.
2013-08-22 23:17:00 +02:00
Fix pakaging on Linux. vis.h and glob.h are installed on Linux (Debian GNU/Linux 7.1 and CentOS 6.4 at least) * Makefile of Rev 1.100 removes vis.h and glob.h hack. My two Linux environments require vis.h and glob.h entries for PLIST. Set PLIST.vis and PLIST.glob for Linux.
2013-10-14 11:55:52 +02:00
# Linux does not have include/vis.h and expected include/glob.h.
.if ${OPSYS} == "Linux"
PLIST.vis= yes
PLIST.glob= yes
.endif
libhcrypto.la only seems to get installed if we're building on 3.x or older, so make it only end up in the PLIST if that is the case.
2008-05-14 20:01:26 +02:00
PLIST_VARS+= afskauth hcrypto
Fixed the build on IRIX 6.5.
2007-02-20 11:17:14 +01:00
.if ${OPSYS} == "IRIX"
Convert to use PLIST_VARS instead of manually passing "@comment " through PLIST_SUBST to the plist module.
2008-04-13 00:42:57 +02:00
PLIST.afskauth= yes
Fixed the build on IRIX 6.5.
2007-02-20 11:17:14 +01:00
.endif
On SunOS, heimdal never builds hcrypto when pkgsrc OpenSSL used.
2012-03-13 10:04:49 +01:00
In OWN_DIRS_PERMS change ROOT_GROUP to REAL_ROOT_GROUP
2011-12-09 02:53:11 +01:00
OWN_DIRS_PERMS= ${HEIMDAL_HDB_DIR} ${REAL_ROOT_USER} ${REAL_ROOT_GROUP} 0700
Update security/heimdal to version 1.1. Changes from version 0.7.2 include: * Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28 09:14:41 +01:00
SPECIAL_PERMS+= ${PREFIX}/bin/otp ${SETUID_ROOT_PERMS}
Update security/heimdal to 0.7.1 (approved by lha). We drop support for the "db4" option and just rely on the appropriate BDB_* settings via bdb.buildlink3.mk. Also, we tweak the builtin.mk file so use krb5-config, if it's available, to check the version of the built-in heimdal. Patches patch-ab, patch-ae and patch-af have been sent back upstream and will be incorporated into future Heimdal releases. Changes between version 0.6.5 and version 0.7.1 include: * Support for KCM, a process based credential cache * Support CCAPI credential cache * SPNEGO support * AES (and the gssapi conterpart, CFX) support * Adding new and improve old documentation * Bug fixes
2005-10-26 17:12:45 +02:00
SPECIAL_PERMS= ${PREFIX}/bin/${KRB5_PREFIX}su ${SETUID_ROOT_PERMS}
RCD_SCRIPTS= kadmind kcm kdc kpasswdd
heimdal leaves empty directories after deinstallation, fix that. OK by wiz@.
2009-02-01 22:39:43 +01:00
INFO_FILES= yes
Initial import of heimdal-0.6 into security/heimdal. Heimdal is a free implementation of Kerberos 5. Kerberos is a system for authenticating users and services on a network. It is built upon the assumption that the network is "unsafe". Kerberos is a trusted third-party service. That means that there is a third party (the Kerberos server) that is trusted by all the entities on the network (users and services, usually called "principals"). All principals share a secret password (or key) with the Kerberos server and this enables principals to verify that the messages from the Kerberos server are authentic. Thus trusting the Kerberos server, users and services can authenticate each other.
2004-01-10 15:56:44 +01:00
Provide access to tests (TEST_TARGET=check).
2012-02-15 23:39:54 +01:00
TEST_TARGET= check
Changes 1.4: New features * Support for reading MIT database file directly * KCM is polished up and now used in production * NTLM first class citizen, credentials stored in KCM * Table driven ASN.1 compiler, smaller!, not enabled by default * Native Windows client support Notes * Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Changes 1.3.3: Bug fixes * Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] * Check NULL pointers before dereference them [kdc] Changes 1.3.2: Bug fixes * Don't mix length when clearing hmac (could memset too much) * More paranoid underrun checking when decrypting packets * Check the password change requests and refuse to answer empty packets * Build on OpenSolaris * Renumber AD-SIGNED-TICKET since it was stolen from US * Don't cache /dev/*random file descriptor, it doesn't get unloaded * Make C++ safe * Misc warnings
2011-07-08 11:49:21 +02:00
# remove manpages conficting with OpenSSL keeping only the important ones
pre-configure:
cd ${WRKSRC}/doc/doxyout/hcrypto && \
${GREP} -e /hcrypto_ -e /page_ manpages > manpages.new && \
mv manpages.new manpages
Fix install on at least Solaris.
2012-07-18 11:48:10 +02:00
# Avoid 'cat: cannot open ./localefiles: No such file or directory'
pre-build:
${TOUCH} ${WRKSRC}/po/localefiles
Changes 1.4: New features * Support for reading MIT database file directly * KCM is polished up and now used in production * NTLM first class citizen, credentials stored in KCM * Table driven ASN.1 compiler, smaller!, not enabled by default * Native Windows client support Notes * Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Changes 1.3.3: Bug fixes * Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] * Check NULL pointers before dereference them [kdc] Changes 1.3.2: Bug fixes * Don't mix length when clearing hmac (could memset too much) * More paranoid underrun checking when decrypting packets * Check the password change requests and refuse to answer empty packets * Build on OpenSolaris * Renumber AD-SIGNED-TICKET since it was stolen from US * Don't cache /dev/*random file descriptor, it doesn't get unloaded * Make C++ safe * Misc warnings
2011-07-08 11:49:21 +02:00
.include "../../databases/sqlite3/buildlink3.mk"
Update security/heimdal to version 1.1. Changes from version 0.7.2 include: * Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28 09:14:41 +01:00
.include "../../security/openssl/buildlink3.mk"
Move check of builtin openssl below to buildlink with openssl and exactly set as checking builtin before including openssl/builtin.mk, so that wanted openssl will be picked up (formerly, BUILTINK_API_DEPENDS.openssl is ignored). Bump PKGREVISION.
2014-02-20 09:19:43 +01:00
CHECK_BUILTIN.openssl:= yes
.include "../../security/openssl/builtin.mk"
CHECK_BUILTIN.openssl:=no
.if ${MACHINE_PLATFORM:MNetBSD-[1-3]*} != "" || \
(${OPSYS} == "SunOS" && !empty(USE_BUILTIN.openssl:Myes) && \
!empty(BUILTIN_LIB_FOUND.crypto:M[Nn][Oo]))
PLIST.hcrypto= yes
.endif
The MirBSD stanza was wrong. Moved it below the builtin.mk inclusion and made the conditional more robust. Fixes at least "make describe", let's see if it helps for the bulk build.
2014-03-22 10:05:24 +01:00
.if ${OPSYS} == "MirBSD"
.if !empty(USE_BUILTIN.openssl:Myes)
PLIST.hcrypto= yes
.endif
PLIST.vis= yes
# all of the tools need to link against pthread, force it.
PTHREAD_AUTO_VARS= yes
.endif
Heimdal really uses termcap
2013-10-11 18:21:40 +02:00
.include "../../mk/termcap.buildlink3.mk"
Changes 1.4: New features * Support for reading MIT database file directly * KCM is polished up and now used in production * NTLM first class citizen, credentials stored in KCM * Table driven ASN.1 compiler, smaller!, not enabled by default * Native Windows client support Notes * Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Changes 1.3.3: Bug fixes * Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] * Check NULL pointers before dereference them [kdc] Changes 1.3.2: Bug fixes * Don't mix length when clearing hmac (could memset too much) * More paranoid underrun checking when decrypting packets * Check the password change requests and refuse to answer empty packets * Build on OpenSolaris * Renumber AD-SIGNED-TICKET since it was stolen from US * Don't cache /dev/*random file descriptor, it doesn't get unloaded * Make C++ safe * Misc warnings
2011-07-08 11:49:21 +02:00
.include "../../mk/pthread.buildlink3.mk"
Changes 1.5.3: Bug fixes - Fix leaking file descriptors in KDC - Better socket/timeout handling in libkrb5 - General bug fixes - Build fixes
2013-08-16 10:30:14 +02:00
.include "../../mk/readline.buildlink3.mk"
Initial import of heimdal-0.6 into security/heimdal. Heimdal is a free implementation of Kerberos 5. Kerberos is a system for authenticating users and services on a network. It is built upon the assumption that the network is "unsafe". Kerberos is a trusted third-party service. That means that there is a third party (the Kerberos server) that is trusted by all the entities on the network (users and services, usually called "principals"). All principals share a secret password (or key) with the Kerberos server and this enables principals to verify that the messages from the Kerberos server are authentic. Thus trusting the Kerberos server, users and services can authenticate each other.
2004-01-10 15:56:44 +01:00
.include "../../mk/bsd.pkg.mk"
Reference in a new issue Copy permalink