core/krb5/PKGBUILD

# Maintainer (Arch): Levente Polyak <anthraxx[at]archlinux[dot]org>
# Contributor (Artix): artoo <artoo@cromnix.org>
# Maintainer: André Silva <emulatorman@hyperbola.info>
# Contributor: Márcio Silva <coadde@hyperbola.info>
# Contributor: Tobias Dausend <throgh@hyperbola.info>

pkgname=krb5
pkgver=1.17
_debver=$pkgver
_debrel=10
pkgrel=4
pkgdesc="The Kerberos network authentication system"
arch=('i686' 'x86_64')
url='https://web.mit.edu/kerberos/'
license=('Simplified-BSD' 'CC-BY-SA-3.0')
depends=('libldap' 'keyutils')
makedepends=('perl' 'quilt')
backup=('etc/krb5.conf'
        'var/lib/krb5kdc/kdc.conf')
options=('!emptydirs')
source=("https://web.mit.edu/kerberos/dist/krb5/${pkgver}/${pkgname}-${pkgver}.tar.gz"
        "https://repo.hyperbola.info:50000/sources/krb5/krb5_${_debver}-${_debrel}.debian.tar.xz"{,.sig}
        "krb5-config_LDFLAGS.patch"
        "libressl.patch"
        "krb5kadmind.initd"
        "krb5kdc.initd"
        "krb5kpropd.initd"
        "kadmind.run"
        "krb5kdc.run"
        "CVE-2024-37371.patch"
        "k5der-include.patch")
sha512sums=('7462a578b936bd17f155a362dbb5d388e157a80a096549028be6c55400b11361c7f8a28e424fd5674801873651df4e694d536cae66728b7ae5e840e532358c52'
            '79f7b8f7ca4fb481c1b4f8b229c411e5400c9add8b95c3d22f162f5d1a22f1a947f1d16eda6cdf9e897c129ffca7af35d9553335d9081e7ffa5dd573d040615d'
            'SKIP'
            '5a3782ff17b383f8cd0415fd13538ab56afd788130d6ad640e9f2682b7deaae7f25713ce358058ed771091040dccf62a3bc87e6fd473d505ec189a95debcc801'
            '366e298e343dd1c56111ac92821a27a8ace913609004592612eb51b7a34cfffe67225fba6fca47d272c599daa95f2314391bc592d07f353a8c486381a6ab57f6'
            '014843225f170767156983b7a348aa1215313b6b9922d4ba4ecc6c51224731ad411785e56c339ca29ad22d0c3ce177313aada17c46e0f95d8184cb8b038e7adf'
            '42cbc315a4e28a78cd29ee6f9aa9401ac6185cc78d39528f0c498d6b04a8edba7b7efadaaeae52ac2c4f89faa846787da9aee645f9ef0bdb79cd6289454586a3'
            '7989ef6e30df862c9d25e0f9ff0ddb9a0c5076f085eae9cbc910579bd885784547b7faa037f2cc5214aabe72ad34a895e4639b8b04dff32e6d1311f74c56aff3'
            '522060c3d96b48855e7af9779ce5022ea121b0b6c76183694e8eff7afe17cb7746d8a1b670ce26c2c779b1f7e4e4da69692a9766653760eca1f50754b0c60d6a'
            '5912400acc5e6544f6847bf22fce17454f3b3d392f5ce7341caa0d74c76f31219b7516fe84c9c95753dc33218e22c9404ed538a1e6ceac2f44fad7045e2a1f26'
            '6066a47404c5f19dd6860ee5862dbc145c5138fed10343bc7beaaefa81e2c8e664aacea86a513b5cdaf2323f02e060b53a5cb5b2675e6fbf26789c98053e721f'
            '56598cb836efbf7ca5774b2764034d06601a4542298daee4ab112b6e71f75ca1b2270643eedde7880c76b396d4c2cb92d6242bfccb151f23bbfe175a6024fa90')
validpgpkeys=('C92BAA713B8D53D3CAE63FC9E6974752F9704456') # André Silva

prepare() {
  cd ${pkgname}-${pkgver}

  if [[ ${pkgver%.*} = ${_debver%.*} ]]; then
    # Debian patches
    export QUILT_PATCHES=debian/patches
    export QUILT_REFRESH_ARGS='-p ab --no-timestamps --no-index'
    export QUILT_DIFF_ARGS='--no-timestamps'

    mv "$srcdir"/debian .

    # Doesn't apply
    rm -rv debian/patches/debian-local || true

    quilt push -av
  fi

  patch -p1 -i "${srcdir}"/krb5-config_LDFLAGS.patch
  sed -i "/KRB5ROOT=/s/\/local//" src/util/ac_check_krb5.m4

  # add LibreSSL support
  patch -p0 -i $srcdir/libressl.patch

  # fixing CVE-2024-37371
  patch -Np1 -i $srcdir/CVE-2024-37371.patch
  patch -Np1 -i $srcdir/k5der-include.patch
}

build() {
   cd ${pkgname}-${pkgver}/src
   export CFLAGS+=" -fPIC -fno-strict-aliasing -fstack-protector-all"
   export CPPFLAGS+=" -I/usr/include/et"
   ./configure --prefix=/usr \
               --sysconfdir=/etc \
               --localstatedir=/var/lib \
               --enable-shared \
               --with-system-et \
               --with-system-ss \
               --disable-rpath \
               --without-tcl \
               --enable-dns-for-realm \
               --with-ldap \
               --without-system-verto
   make
}

package() {
   cd ${pkgname}-${pkgver}/src
   make DESTDIR="${pkgdir}" EXAMPLEDIR=/usr/share/doc/${pkgname}/examples install

   install -m 644 plugins/kdb/ldap/libkdb_ldap/kerberos.{ldif,schema} "${pkgdir}"/usr/share/doc/${pkgname}/examples

   # Sample KDC config file
   install -dm 755 "${pkgdir}"/var/lib/krb5kdc
   install -pm 644 config-files/kdc.conf "${pkgdir}"/var/lib/krb5kdc/kdc.conf

   # Default configuration file
   install -dm 755 "${pkgdir}"/etc
   install -pm 644 config-files/krb5.conf "${pkgdir}"/etc/krb5.conf

   install -dm 755 "${pkgdir}"/usr/share/aclocal
   install -m 644 util/ac_check_krb5.m4 "${pkgdir}"/usr/share/aclocal

   install -Dm644 "${srcdir}"/${pkgname}-${pkgver}/NOTICE "${pkgdir}"/usr/share/licenses/${pkgname}/NOTICE

   # openrc
   for f in krb5kadmind krb5kdc krb5kpropd; do
     install -Dm755 "${srcdir}"/$f.initd "${pkgdir}"/etc/init.d/$f
   done

   # runit
   install -Dm755 "${srcdir}"/kadmind.run "${pkgdir}"/etc/sv/kadmind/run
   install -Dm755 "${srcdir}"/krb5kdc.run "${pkgdir}"/etc/sv/krb5kdc/run
}