MFC: r343011

Use ${SRCTOP}/contrib/com_err/com_err.h instead of the installed com_err.h.
This fixes build when com_err.h is not installed.

PR: 234691

MFC r337665: krb5-config build: Remove gratuitous escaping

MFC r336151:

Remove redundant space.

MFC r326276:

various: general adoption of SPDX licensing ID tags.

Mainly focus on files that use BSD 2-Clause license, however the tool I
was using misidentified many licenses so this was mostly a manual - error
prone - task.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

No functional change intended.

MFC r322112:

krb5_err.h is generated from a .et file in kerberos5/lib/libkrb5.
As kerberos5/lib/krb5 include files are already referenced it makes
no sense to generate it again here.

MFC r322749:

Replace the include path using CURDIR with KRB5DIR. This is consistent
with the rest of the Makefiles in kerberos5/.

MFC r322113:

Remove dead target introduced in r178828.

MFC r318514-r318515, r318517, r318917

r318514:
Use size_t.

Inspired by: OpenBSD src/lib/libc/stdlib/qsort.c,v 1.11

r318515:
The current qsort(3) implementation ignores the sizes of partitions, and
always perform recursion on the left partition, then use a tail call to
handle the right partition. In the worst case this could require O(N)
levels of recursions.

Reduce the possible recursion level to log2(N) by always recursing on the
smaller partition instead.

Obtained from: PostgreSQL 9d6077abf9d6efd992a59f05ef5aba981ea32096

r318517:
Sync qsort.c with userland r318515.

(Note that MIN macro is removed in favor of sys/param.h's version).

PR: 213922

r318917:
Disconnect heimdal version of qsort.c from build because we are already
using libc's version of qsort.

PR: bin/213922

MFC r314657:

kerberos5: normalize paths using SRCTOP-relative paths or :H when possible

This simplifies make logic/output

MFC r311114:

Build libexec/kadmind when MK_GSSAPI != no because it requires gssapi

MFC r311112,r311115:

r311112:

libgssapi_{krb5,ntlm,spnego} requires MK_GSSAPI != no; conditionalize
their building on the knob

r311115:

Conditionalize adding ${KRB5DIR}/lib/gssapi/krb5/gkrb5_err.et to ETSRCS
if MK_GSSAPI != "no"

Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

DIRDEPS_BUILD: Update dependencies

Approved by: re (gjb)
Sponsored by: EMC / Isilon Storage Division

Define targets in same order as .ORDER

This is a NOP but is done for style and to reduce confusion.

Approved by: re (implicit)
Sponsored by: EMC / Isilon Storage Division

WITH_META_MODE: Don't expect meta files for side-effect generated files.

The first file in these lists will generate everything else so only
it should be getting a .meta file. With bmake's missing=yes meta
feature these would otherwise cause a rebuild without the
.NOMETA hint.

Sponsored by: EMC / Isilon Storage Division

DIRDEPS_BUILD: Connect new directories and update dependencies.

Sponsored by: EMC / Isilon Storage Division

Remove the old depend (mkdep) code and make FAST_DEPEND the one true way.

Reviewed by: emaste, hselasky (partial), brooks (brief)
Discussed on: arch@
Sponsored by: EMC / Isilon Storage Division
Differential Revision: https://reviews.freebsd.org/D5742

We don't have a CPPFLAGS, COPTS or CPUFLAGS.

Sponsored by: EMC / Isilon Storage Division

DIRDEPS_BUILD: Regenerate without local dependencies.

These are no longer needed after the recent 'beforebuild: depend' changes
and hooking DIRDEPS_BUILD into a subset of FAST_DEPEND which supports
skipping 'make depend'.

Sponsored by: EMC / Isilon Storage Division

FAST_DEPEND: Always run depend via beforebuild which removes many hacks.

This will generate dependencies rather than depending on the previous behavior
of depending on the guessed OBJS: *.h dependecies or a user running
'make depend'.

Experimentation showed that depending only on headers was not enough and
prone to .ORDER errors. Downstream users may also have added
dependencies into beforedepend or afterdepend targets. The safest way to
ensure dependencies are generated before build is to run 'make depend'
beforehand rather than just depending on DPSRCS+SRCS.

Note that the OBJS_DEPEND_GUESS mechanism (a.k.a .if !exists(.depend) then
foo.o: *.h) is still useful as it improves incremental builds with missing
.depend.* files and allows 'make foo.o' to usually work, while this
'beforebuild: depend' ensures that the build will always find all dependencies.
The 'make foo.o' case has no means of a 'beforebuild' hook.

This also removes several hacks in the DIRDEPS_BUILD:
- NO_INSTALL_INCLUDES is no longer needed as it mostly was to work around
.ORDER problems with building the needed headers early.
- DIRDEPS_BUILD: It is no longer necesarry to track "local dependencies" in
Makefile.depend.

These were only in Makefile.depend for 'clean builds' since nothing would
generate the files due to skipping 'make depend' and early dependency
bugs that have been fixed, such as adding headers into SRCS for the
OBJS_DEPEND_GUESS mechanism. Normally if a .depend file does not exist then
a dependency is added by bsd.lib.mk/bsd.prog.mk from OBJS: *.h. However,
meta.autodep.mk creates a .depend file from created meta files and inserts
that into Makefile.depend. It also only tracks *.[ch] files though which can
miss some dependencies that are hooked into 'make depend'. This .depend
that is created then breaks incremental builds due to the !exists(.depend)
checks for OBJS_DEPEND_GUESS. The goal was to skip 'make depend' yet it only
really works the first time. After that files are not generated as expected,
which r288966 tried to address but was using buildfiles: rather than
beforebuild: and was reverted in r291725. As noted previously,
depending only on headers in beforebuild: would create .ORDER errors
in some cases.

meta.autodep.mk is still used to generate Makefile.depend though via:
gendirdeps: Makefile.depend
.END: gendirdeps

This commit allows removing all of the "local dependencies" in
Makefile.depend which cuts down on churn and removes some of the
arch-dependent Makefile.depend files.

The "local dependencies" were also problematic for bootstrapping.

Sponsored by: EMC / Isilon Storage Division

DIRDEPS_BUILD: Add some missing build dependencies for kerberos5.

Sponsored by: EMC / Isilon Storage Division

DIRDEPS_BUILD: Update dependencies.

Sponsored by: EMC / Isilon Storage Division

META MODE: Prefer INSTALL=tools/install.sh to lessen the need for xinstall.host.

This both avoids some dependencies on xinstall.host and allows
bootstrapping on older releases to work due to lack of at least 'install -l'
support.

Sponsored by: EMC / Isilon Storage Division

Partially revert r288266: Remove SUBDIR_PARALLEL from kerberos5/lib.

I intended to remove this before committing r288266. It works but is clearly
wrong and working by accident due to the dependencies listed in the root
Makefile.inc1 file.

Add more SUBDIR_PARALLEL.

MFC after: 3 weeks
Sponsored by: EMC / Isilon Storage Division

Remove unneeded dependency of '.o: .h' that bsd.prog.mk already handles.

MFC after: 2 weeks
X-MFC-With: r288198
Sponsored by: EMC / Isilon Storage Division

Add missing CLEANFILES.

MFC after: 1 week
Sponsored by: EMC / Isilon Storage Division

Remove unneeded dependency line.

bsd.prog.mk adds 'ktutil-commands.o: ktutil-commands.h' already.

MFC after: 2 weeks
Sponsored by: EMC / Isilon Storage Division

Move setting of LDFLAGS to the modules which require it actually, as
other kerberos5 modules do so.

Make it buildable with WITH_OPENLDAP, again.

MFC after: 1 week

Fix a typo introduced in r262209.

MFC after: 3 days

new depends

Add META_MODE support.

Off by default, build behaves normally.
WITH_META_MODE we get auto objdir creation, the ability to
start build from anywhere in the tree.

Still need to add real targets under targets/ to build packages.

Differential Revision: D2796
Reviewed by: brooks imp

Misc fixes from projects/bmake

Differential Revision: D2748
Reviewed by: brooks imp

Make kerberos use the same sqlite libraries as other sqlite consumer.

This reduces the number of copy of sqlite we have to just one and easier
tracking version of sqlite

Differential Revision: https://reviews.freebsd.org/D2443
Reviewed by: imp, stas, bjk

Add a ${CP} alias for copying files in the build.

Some users build FreeBSD as non-root in Perforce workspaces. By default,
Perforce sets files read-only unless they're explicitly being edited.
As a result, the -f argument must be used to cp in order to override the
read-only flag when copying source files to object directories. Bare use of
'cp' should be avoided in the future.

Update all current users of 'cp' in the src tree.

Reviewed by: emaste
MFC after: 1 week
Sponsored by: Spectra Logic

Remove GNU texinfo from base along with all info pages.

To be able to info pages consider installing texinfo from ports print/texinfo or
via pkg: pkg install texinfo

Differential Revision: https://reviews.freebsd.org/D1409
Reviewed by: emaste, imp (previous version)
Relnotes: yes

Remove now useless USEPRIVATELIB

Convert kerberos to LIBADD and reduce overlinking of the kerberos binaries and
libraries

Fix incremental builds involving non-root users with read-only source files.
This is a followup commit to r271771.

MFC after: 1 month

Revert r267233 for now. PIE support needs to be reworked.

1. 50+% of NO_PIE use is fixed by adding -fPIC to INTERNALLIB and other
build-only utility libraries.
2. Another 40% is fixed by generating _pic.a variants of various libraries.
3. Some of the NO_PIE use is a bit absurd as it is disabling PIE (and ASLR)
where it never would work anyhow, such as csu or loader. This suggests
there may be better ways of adding support to the tree. Many of these
cases can be fixed such that -fPIE will work but there is really no
reason to have it in those cases.
4. Some of the uses are working around hacks done to some Makefiles that are
really building libraries but have been using bsd.prog.mk because the code
is cleaner. Had they been using bsd.lib.mk then NO_PIE would not have
been needed.

We likely do want to enable PIE by default (opt-out) for non-tree consumers
(such as ports). For in-tree though we probably want to only enable PIE
(opt-in) for common attack targets such as remote service daemons and setuid
utilities. This is also a great performance compromise since ASLR is expected
to reduce performance. As such it does not make sense to enable it in all
utilities such as ls(1) that have little benefit to having it enabled.

Reported by: kib

Rework privatelib/internallib

Make sure everything linking to a privatelib and/or an internallib does it directly
from the OBJDIR rather than DESTDIR.
Add src.libnames.mk so bsd.libnames.mk is not polluted by libraries not existsing
in final installation
Introduce the LD* variable which is what ld(1) is expecting (via LDADD) to link to
internal/privatelib
Directly link to the .so in case of private library to avoid having to complexify
LDFLAGS.

Phabric: https://phabric.freebsd.org/D553
Reviewed by: imp, emaste

Replace all uses of libncurses and libtermcap with their wide character
variants. This allows usable file system images (i.e. those with both a
shell and an editor) to be created with only one copy of the curses library.

Exp-run: antoine
PR: 189842
Discussed with: bapt
Sponsored by: DARPA, AFRL

In preparation for ASLR [1] support add WITH_PIE to support building with -fPIE.

This is currently an opt-in build flag. Once ASLR support is ready and stable
it should changed to opt-out and be enabled by default along with ASLR.

Each application Makefile uses opt-out to ensure that ASLR will be enabled by
default in new directories when the system is compiled with PIE/ASLR. [2]

Mark known build failures as NO_PIE for now.

The only known runtime failure was rtld.

[1] http://www.bsdcan.org/2014/schedule/events/452.en.html
Submitted by: Shawn Webb <lattera@gmail.com>
Discussed between: des@ and Shawn Webb [2]

Use src.opts.mk in preference to bsd.own.mk except where we need stuff
from the latter.

Use MK_OPENLDAP in preference to WITH_OPENLDAP and make it a default
NO option to match the opt-in nature of the historical nature of this
option.

Fix installworld failure when kerberos source files have new timestamps

If a kerberos .hx source file is newer than the .h copy, but the content
is the same, then during buildworld the "cmp -s || cp" command in the
.hx.h rule would do nothing, leaving the .h copy with the older
timestamp. During installworld the rule would again be invoked, causing
a failure as neither cmp or cp would exist in the temporary path.

As the underlying issue should be resolved by r262209, unconditionally
copy the file.

No objection: peter@
Tested by: gjb@
Sponsored by: The FreeBSD Foundation

NO_MAN= has been deprecated in favor of MAN= for some time, go ahead
and finish the job. ncurses is now the only Makefile in the tree that
uses it since it wasn't a simple mechanical change, and will be
addressed in a future commit.

use MK_KERBEROS=no in preference to WITHOUT_KERBEROS

Revert my commit in r261253; the real problem was tackled in r262209.

Really (I think) fix the sporadic heimdal build failures with high -j
levels. The root of the problem was that make was attempting to run up
to three concurrent asn1_compile commands to produce the three outputs
that it was declared to produce. The failure was caused when the
asn1_compiles were started out of sync and a later one was truncating
the files that another thread was trying to copy. In reality it is
supposed to be run exactly once and all three outputs are produced in
one pass.

Use the same hack as for the parent's Makefile.inc for the compile_et
multi-output rule.

Speculatively replace a cp with a cat for gathering data on a
sporadic parallel build failure in the FreeBSD cluster on many-core
systems with ZFS. cp uses mmap in this scenario, cat does not.

Try and fix the dependency/bootstrap issues in kerberos5

libkafs5 needs a header from libkrb5, it includes this from
${.OBJDIR}/mumble, this used to work fine as long as you happen to have
a krb_err.h in your base system, this doesn't work for bootstrapping or
using a cross-compiler with a different sysroot. This is just a
best-effort bandaid, sufficient parallelism can still break it.

Fix a SRCS override that dropped krb5_err.h.

Discussed with: stas

Clean up the Kerberos build by turning libheimipcc and libheimipcs into
private shared libraries, instead of hacked-together archives of PIC
objects. This makes it possible to build a static libkrb5 that works.

Reviewed by: stas
Approved by: re (gjb)

Fix the getpwnam_r() call in the pname_to_uid() kerberos library function so
that it handles the ERANGE error return case. Without this fix, authentication
of users for certain system setups could fail unexpectedly.

Reported by: Elias Martenson (lokedhs@gmail.com)
Tested by: Elias Martenson (earlier version)
MFC after: 2 weeks

Add -lheimntlm to LDADD directly.

With the current binutils, symbols from libheimtlm.so are loaded because
it is referenced by DT_NEEDED. This feature is not implemented in
mclinker (https://code.google.com/p/mclinker/issues/detail?id=104).
I encountered the same issue when linking with a recent devel/binutils
invoked via clang. This was the only use of DT_NEEDED in the tree so
removing it simplifies toolchain requirements.

Submitted by: Pete Chou <petechou@gmail.com> (mclinker issue)

Only try to install one link at each path.

Don't install verify_krb5_conf.8. It is installed in
kerberos5/usr.bin/verify_krb5_conf.

Add support for bmake. This includes:
1. Don't do upgrade_checks when using bmake. As long as we have WITH_BMAKE,
there's a bootstrap complication in ths respect. Avoid it. Make the
necessary changes to have upgrade_checks work wth bmake anyway.
2. Remove the use of -E. It's not needed in our build because we use ?= for
the respective variables, which means that we'll take the environment
value (if any) anyway.
3. Properly declare phony targets as phony as bmake is a lot smarter (and
thus agressive) about build avoidance.
4. Make sure CLEANFILES is complete and use it on .NOPATH. bmake is a lot
smarter about build avoidance and should not find files we generate in
the source tree. We should not have files in the repository we want to
generate, but this is an easier way to cross this hurdle.
5. Have behavior under bmake the same as it is under make with respect to
halting when sub-commands fail. Add "set -e" to compound commands so
that bmake is informed when sub-commands fail.
6. Make sure crunchgen uses the same make as the rest of the build. This
is important when the make utility isn't called make (but bmake for
example).
7. While here, add support for using MAKEOBJDIR to set the object tree
location. It's the second alternative bmake looks for when determining
the actual object directory (= .OBJDIR).

Submitted by: Simon Gerraty <sjg@juniper.net>
Submitted by: John Van Horne <jvanhorne@juniper.net>

Centralize the specification of the krb5 build tools.

* Remove headers from SRCS that are not generated
(and are in /usr/src/crypto/heimdal/).

* Avoid race conditions with 'make -j<N>'.

- Update FreeBSD's Heimdal distribution to 1.5.2. This is a bugfix
release, which fixes a DoS issue in libkrb5.

- Add a "real" symbol version map to libasn1. The upstream version
of the version map just exported all the symbols, which caused a
binutils bug being triggered when ld fails to link two objects, one
of which exports a versioned version of the symbol, and another --
unversioned. [1]
- Also add version map for libkafs5.

Submitted by: jchandra@ (based on)

Assume a big-endian default on MIPS and drop the "eb" suffix from MACHINE_ARCH.
This makes our naming scheme more closely match other systems and the
expectations of much third-party software. MIPS builds which are little-endian
should require and exhibit no changes. Big-endian TARGET_ARCHes must be
changed:
From: To:
mipseb mips
mipsn32eb mipsn32
mips64eb mips64

An entry has been added to UPDATING and some foot-shooting protection (complete
with warnings which should become errors in the near future) to the top-level
base system Makefile.

- Apply binutils workaround on mips.mips as well. Though this TARGET_ARCH
is deprecated, tinderbox uses it.

- Update FreeBSD Heimdal distribution to version 1.5.1. This also brings
several new kerberos related libraries and applications to FreeBSD:
o kgetcred(1) allows one to manually get a ticket for a particular service.
o kf(1) securily forwards ticket to another host through an authenticated
and encrypted stream.
o kcc(1) is an umbrella program around klist(1), kswitch(1), kgetcred(1)
and other user kerberos operations. klist and kswitch are just symlinks
to kcc(1) now.
o kswitch(1) allows you to easily switch between kerberos credentials if
you're running KCM.
o hxtool(1) is a certificate management tool to use with PKINIT.
o string2key(1) maps a password into key.
o kdigest(8) is a userland tool to access the KDC's digest interface.
o kimpersonate(8) creates a "fake" ticket for a service.

We also now install manpages for some lirbaries that were not installed
before, libheimntlm and libhx509.

- The new HEIMDAL version no longer supports Kerberos 4. All users are
recommended to switch to Kerberos 5.

- Weak ciphers are now disabled by default. To enable DES support (used
by telnet(8)), use "allow_weak_crypto" option in krb5.conf.

- libtelnet, pam_ksu and pam_krb5 are now compiled with error on warnings
disabled due to the function they use (krb5_get_err_text(3)) being
deprecated. I plan to work on this next.

- Heimdal's KDC now require sqlite to operate. We use the bundled version
and install it as libheimsqlite. If some other FreeBSD components will
require it in the future we can rename it to libbsdsqlite and use for these
components as well.

- This is not a latest Heimdal version, the new one was released while I was
working on the update. I will update it to 1.5.2 soon, as it fixes some
important bugs and security issues.

Don't support OpenLDAP during lib32 build.

- Make heimdal buildable with WITH_OPENLDAP defined, again.
- Our heimdal uses the deprecated OpenLDAP functions.

Link with -ledit instead of -lreadline.

- Add missing interdependencies to kerberos libraries. Some of the
kerberos libraries were not linked properly (missing dependencies),
which causes 3rd party applications linking to fail when --as-needed
ld flag is used. I also added the --no-undefined ld(1) flag to make
sure that there're no missing dependencies.

MFC after: 3 days

The kerberos5 tools are only used as build tools but not otherwise and
didn't get installed either.

MFC after: 1 week

Fix a typo.

MFC after: 1 month

Fix a typo.

MFC after: 1 month

Link GSS mechanics modules against libgssapi so they will not fail due
unresolved symbol errors when in turn libgssapi was loaded with RTLD_LOCAL
flag set (which is the default).

Reviewed by: dfr, jhb
MFC after: 3 days

Disconnect closefrom.c as we have it as a system call.

Now we have closefrom().

Add strndup(3) prototype to string.h.

This change was erronously ommitted from the r185690, and attempt
to simply add the prototype to string.h has revealed that several
contributed programs defined local prototypes for strndup(), controlled
by autoconfed config.h. So, manually change #undef HAVE_STRNDUP to
#define HAVE_STRNDUP 1. Next import of the corresponding program would
regenerate config.h, overriding the changes in this commit.

No objections from: kan

Add an implementation of the RPCSEC_GSS authentication protocol for RPC. This
is based on an old implementation from the University of Michigan with lots of
changes and fixes by me and the addition of a Solaris-compatible API.

Sponsored by: Isilon Systems
Reviewed by: alfred

Add roken.h to SRCS. This fixes the compilation of slc during a
buildworld on a host running a world built with WITHOUT_KERBEROS
defined.

Add the hx509 error table.

Add manpage links to krb5_principal.3.

Don't try to make links to manpages that no longer exist. Fixes installworld

Submitted by: phk

Update magic sed script for heimdal-1.1

Update heimdal_version.

Pointed out by: antoine@

Fix conflicts after heimdal-1.1 import and add build infrastructure. Import
all non-style changes made by heimdal to our own libgssapi.

While checking over the libraries for 7.0-REL Kris found the following
libraries had not had their versions bumped relative to 6.3-REL but
had indeed been changed. We need to bump their version so they can be
properly added to the compat6x port:

libasn1.so.8 libgssapi.so.8 libhdb.so.8 libkadm5clnt.so.8
libkadm5srv.so.8 libkafs5.so.8 libkrb5.so.8 libobjc.so.2

MFC After: 1 day

Remove _FREEFALL_CONFIG hacks

Fix generator glue to only expose extern struct units %s_units[] is
struct units defintition it known. The above construct is treated
as an incorrect C by GCC 4.2 otherwise.

Kerberos/Heimdal doesn't really depend on the INET6 macro.
In the Heimdal distro, only kerberized telnet refers to INET6,
but we don't build it, we use contrib/telnet linked with the
Kerberos libs instead.

Tested with: cmp(1)

Bump library majro version for gethostbyaddr(3).

Reimplementation of world/kernel build options. For details, see:

http://lists.freebsd.org/pipermail/freebsd-current/2006-March/061725.html

The src.conf(5) manpage is to follow in a few days.

Brought to you by: imp, jhb, kris, phk, ru (all bugs are mine)

NO_MAN is not needed here.

Add a new extensible GSS-API layer which can support GSS-API plugins,
similar the the Solaris implementation. Repackage the krb5 GSS mechanism
as a plugin library for the new implementation. This also includes a
comprehensive set of manpages for the GSS-API functions with text mostly
taken from the RFC.

Reviewed by: Love Hörnquist Åstrand <lha@it.su.se>, ru (build system), des (openssh parts)

Apply the .PHONY attribute to the ../make*/make* targets. This
causes them to be recreated (if needed) early, when doing "make
depend" here, before generating headers that depend on them.
This should fix breakages often seen while doing incremental
(NO_CLEAN) cross-builds.

Bump the shared library version number of all libraries that have not
been bumped since RELENG_5.

Reviewed by: ru
Approved by: re (not needed for commit check but in principle...)

This is sort of an MFS. Peter made these changes to the RELENG_*
branches but missed HEAD. This patch extends his a little bit,
setting it up via the Makefiles so that adding _FREEFALL_CONFIG
to /etc/make.conf is the only thing needed to cluster-ize things
(current setup also requires overriding CFLAGS).

From Peter's commit to the RELENG_* branches:
> Add the freebsd.org custer's source modifications under #ifdefs to aid
> keeping things in sync. For ksu:
> * install suid-root by default
> * don't fall back to asking for a unix password (ie: be pure kerberos)
> * allow custom user instances for things like www and not just root

The Makefile tweaks will be MFC-ed, the rest is already done.

MFC after: 3 days
Approved by: re (dwhite)

Remove kludges intended to support src trees with partial obj trees.

Discussed with: ru

Cope with the (unwise?) incompatible changes with make by adding
a comment before defined(SRCS).

Update Heimdal 0.6.1 -> 0.6.3.

NODOCCOMPRESS -> NO_DOCCOMPRESS
NOINFO -> NO_INFO
NOINFOCOMPRESS -> NO_INFOCOMPRESS
NOLINT -> NO_LINT
NOPIC -> NO_PIC
NOPROFILE -> NO_PROFILE

Start the dreaded NOFOO -> NO_FOO conversion.

OK'ed by: core

Introduce the PRECIOUSPROG knob in bsd.prog.mk, similar
to PRECIOUSLIB from bsd.lib.mk. The side effect of this
is making installing the world under jail(8) possible by
using another knob, NOFSCHG.

Reviewed by: oliver

Join the 21st century: Cryptography is no longer an optional component
of releases. The -DNOCRYPT build option still exists for anyone who
really wants to build non-cryptographic binaries, but the "crypto"
release distribution is now part of "base", and anyone installing from a
release will get cryptographic binaries.

Approved by: re (scottl), markm
Discussed on: freebsd-current, in late April 2004

Update version strings for Heimdal: 0.6 -> 0.6.1

Hookup `arcfour.c' to the build (missed during upgrade to heimdal 0.6.1).

style.Makefile(5).

OK'ed by: nectar

Try harder to pick up the correct print_version.c. The old version
works before bsd.dep.mk,v 1.44, whether .depend file exists or not,
but the contents of .depend file is wrong. With bsd.dep.mk,v 1.44,
the contents of .depend file is always broken, and build without a
.depend file is broken too. With this change it works reliably in
all cases. Ugh.

Unbreak build with OpenLDAP.

Forgotten by: mr

Put libraries in the link order.

Reported by: lorder(1) (modified to work with libraries)

Take signal.c out of sources.

Reviewed by: nectar

Put generated headers into SRCS so that we pick them up even if
"make depend" was not run.

asn1_compile needs roken.h.

Overhaul of kerberos5/ makefiles. Most significant changes are:

- Dropped support for standalone builds, this was only partially
supported anyway, and required so much magic in makefiles that
made life dangerous (e.g., by using the custom yacc rules).

- Got rid of .OBJDIR in makefiles -- makes building of individual
files possible again.

- Made the .x.c transformations -j safe.

- Reprogrammed LDADD to fix static build of some utilities that
was broken.

- Fixed LDFLAGS and DPADD in the WITH_OPENLDAP case -- positively
affects the contents of .depend files.

- Removed redundant .h's from SRCS, only kept those that are
generated.

- libkrb5/ INCS were bogusly installed again with libgssapi/.

- Made build-tools real tools with their own makefiles in
separate directories. This allows us to properly track
their dependencies, etc.

- Faster build, 21% less of makefile code!

Approved by: nectar
Reviewed by: markm
Silence on: arch

add hprop to the build and add LDAP mods to hprop.
add kadmind.8

Submitted by: Alex Deiter <tiamat@komi.mts.ru>

Fixed "make clean".

Set RPATH when the Kerberos KDC is linked with the LDAP backend
(`WITH_OPENLDAP'). Previously, the KDC could fail to start if it was
invoked before `ldconfig'.

This solution was chosen rather than adding an `ldconfig' dependency
to `kerberos' in rcNG, because it is more robust and there is no
guarantee that the LDAP libraries will be in ldconfig's path anyway.

Problem reported by: Sean McNeil <sean@mcneil.com>

No need for two copies of this file; there is already a distribution
copy in src/crypto/heimdal/...

Reported by: ru

The header files hdb_asn1.h, hdb_err.h, and kadm5_err.h are generated,
and must be installed from ${.OBJDIR}.

Pointy hat: nectar

Build and install the verify_krb5_conf(8) utility, which checks
krb5.conf(5) for obvious errors.

Install Kerberos- and GSSAPI-related man pages.

Install additional headers for Kerberos (libkafs, libkadm5*, and
libhdb).

Update build infrastructure for Heimdal 0.6.

Try a lot harder to get dependancies right. This involves some ugly
looking ${.OBJDIR} work that has the up-side of actually working
in upgrade and make -jN cases.

This needs to be revisited further, and it is conceivable that
the ${.OBJDIR} stuff can be simplified, but the sheer number of
edge cases and other causes make this Hard(tm). For now, this works.

Try a lot harder to get dependancies right. This involves some ugly
looking ${.OBJDIR} work that has the up-side of actually working
in upgrade and make -jN cases.

This needs to be revisited further, and it is conceivable that
the ${.OBJDIR} stuff can be simplified, but the sheer number of
edge cases and other causes make this Hard(tm). For now, this works.

Big fixup of the makefiles. Sort out the dependancies so that "make"
without "make depend" works, "make -j N" works, and lists of source
files are made vertical to reduce future diffs.

Very big makeover in the way telnet, telnetd and libtelnet are built.

Previously, there were two copies of telnet; a non-crypto version
that lived in the usual places, and a crypto version that lived in
crypto/telnet/. The latter was built in a broken manner somewhat akin
to other "contribified" sources. This meant that there were 4 telnets
competing with each other at build time - KerberosIV, Kerberos5,
plain-old-secure and base. KerberosIV is no longer in the running, but
the other three took it in turns to jump all over each other during a
"make buildworld".

As the crypto issue has been clarified, and crypto _calls_ are not
a problem, crypto/telnet has been repo-copied to contrib/telnet,
and with this commit, all telnets are now "contribified". The contrib
path was chosen to not destroy history in the repository, and differs
from other contrib/ entries in that it may be worked on as "normal"
BSD code. There is no dangerous crypto in these sources, only a
very weak system less strong than enigma(1).

Kerberos5 telnet and Secure telnet are now selected by using the usual
macros in /etc/make.conf, and the build process is unsurprising and
less treacherous.

Fixed "make checkdpadd".

OK'ed by: markm

s/USE_OPENLDAP/WITH_OPENLDAP/ per request from kris.

Add (optional, default off) support to kerberos5 for supporting openldap.
Tests with openldap20 where successful whereas openldap21 didn't like
the way hdb-ldap accessed openldap (doesn't like non-bind access).
To activate the support put a USE_OPENLDAP=yes in your make.conf.
The OPENLDAPBASE is also optional and points to /usr/local as default.

Approved by: markm
MFC after: 2 weeks

Remove some KRB4 scraps, and allow NOSHARED make worlds to
complete.

OK'ed by: re(scottl)

Turn MAKE_KERBEROS5 into NO_KERBEROS by negating the logic. Some extra
cleanups were necessary in release/Makefile, and the tinderbox code
was syntax checked, not run checked.

Trasmute moer "krb5" distibutions into "crypto".

Migrate to a new way of dealing with building from old revisions of
FreeBSD. This method attempts to centralize all the necessary hacks
or work arounds in one of two places in the tree (src/Makefile.inc1
and src/tools/build). We build a small compatibility library
(libbuild.a) as well as selectively installing necessary include
files. We then include this directory when building host binaries.

This removes all the past release compatibilty hacks from various
places in the tree. We still build on tip of stable and current. I
will work with those that want to support more, although I anticipate
it will just work.

Many thanks to ru@, obrien@ and jhb@ for providing valuable input at
various stage of implementation, as well as for working together to
positively effect a change for the better.

Post KerberosIV de-orbit: Clean up Kerberos5. We dont need KerberosIV
compatiblity mode anymore. Rename the k5foo utils to kfoo (after
repo-copy).

Don't copy headers from the source tree to the object tree without
making sure the copies in the object tree are writable. When files
in the source tree are not writable (as would be the case for a p4
tree) then a buildworld -DNOCLEAN will try to copy over the existing
non-writable headers. This fails. Instead we cat the headers with
redirection. This is just one of the possibilities.

Unbreak Kerberos 5 authentication in telnet.
(Credential forwarding is still broken.)

PR: bin/45397

Define OPENSSL_DES_LIBDES_COMPATIBILITY so that Heimdal will build with
OpenSSL 0.9.7 when it is imported. (This currently has no effect.)

Update version numbers after import of Heimdal 0.5.1.

Approved by: re

Repair buglet introduced with the last import of Heimdal:
`krb5-config --cflags' spewed an erroneous argument.

Reported by: Gabor@Zahemszky.HU
Approved by: re (jhb)

Take __FreeBSD_version into account when BOOTSTRAPPING.

Correct path in previous commit. libssh lives under src/secure/lib, not
under src/lib.

Reported by: phk

Unbreak 'make release' by adding libssh to KPROGS.

Suggested by: jhay

update version numbers to (consistenly):

krb4 1.0.5 fb1 (including the kadmind fix)
heimdal 0.5 fb1 (including the kadmind fix)

Build kerberized versions of the PAM library, and install them
into corresponding distributions during "make release". (This
also cleans the "slib" distribution up from the .o files.)

PR: misc/43825 (inspired by)

Zap now-unused SHLIB_MINOR

Don't lint contrib'ed sources, even if the builder gas asked for it.
Its Just Too Noisy.

Fix k5admind by dropping libkadm5clnt from LDADD.

Reorder libraries in LDADD in case some wants to statically
link these applications.

Make ipropd-slave/ipropd-master actually work. These applications
were being linked against the client Kerberos administration library,
when they must be linked against the server library, resulting in
segfaults early in the game. I suspect these have never been tested
before :-(

This is Heimdal 0.5.

This is Heimdal 0.5.

Update build infrastructure after import of Heimdal Kerberos 2002/09/16.

= The prefix should be `/usr', not `/'.
= Correct the Heimdal version number hiding in here.

Update build infrastructure after import of Heimdal Kerberos 2002/08/29.

Bootstrapping aid for pre-getprogname(3) systems.

Spotted by: Gareth Hopkins <gareth@za.uu.net>
Approved by: nectar
MFC after: 3 days

Kerberos 5 no longer needs -lmd

Approved by: nectar

Heimdal Texinfo manual.

Give k5admin a manpage.

Make this -j safe.

MAN[1-9] -> MAN.

Removed now unused INTERNALSTATICLIB.
INTERNALLIB now implies NOPIC and NOPROFILE.
Removed gratuitous NOMAN.

Added new bsd.incs.mk which handles installing of header files
via INCS. Implemented INCSLINKS (equivalent to SYMLINKS) to
handle symlinking include files. Allow for multiple groups of
include files to be installed, with the powerful INCSGROUPS knob.
Documentation to follow.

Added standard `includes' and `incsinstall' targets, use them
in Makefile.inc1. Headers from the following makefiles were
not installed before (during `includes' in Makefile.inc1):

kerberos5/lib/libtelnet/Makefile
lib/libbz2/Makefile
lib/libdevinfo/Makefile
lib/libform/Makefile
lib/libisc/Makefile
lib/libmenu/Makefile
lib/libmilter/Makefile
lib/libpanel/Makefile

Replaced all `beforeinstall' targets for installing includes
with the INCS stuff.

Renamed INCDIR to INCSDIR, for consistency with FILES and SCRIPTS,
and for compatibility with NetBSD. Similarly for INCOWN, INCGRP,
and INCMODE.

Consistently use INCLUDEDIR instead of /usr/include.

gnu/lib/libstdc++/Makefile and gnu/lib/libsupc++/Makefile changes
were only lightly tested due to the missing contrib/libstdc++-v3.
I fully tested the pre-WIP_GCC31 version of this patch with the
contrib/libstdc++.295 stuff.

These changes have been tested on i386 with the -DNO_WERROR "make
world" and "make release".

Turn on the set-user-ID bit for k5su if ENABLE_SUID_K5SU is defined.

Do not install this with set-user-ID bit set. This utility does not
grok the `wheel' group.

Noticed by: jmallett

= We need `-lcrypt' and `-lcom_err' to when building Kerberos
applications.
= The Heimdal version number is hiding here also. Correct it.

Don't emulate INTERNALLIB.

Update Heimdal version string to 0.4e. This should have been done when that
version was imported on 2002/02/19.

Milestone #1 in cross-arch make releases.

Do not install games and profiled libraries to the ${CHROOTDIR}
with the initial installworld.

Eliminate the need in the second installworld. For that, make sure
_everything_ is built in the "world" environment, using the right
tool chain.

Added SUBDIR_OVERRIDE helper stuff to Makefile.inc1. Split the
buildworld process into stages, and skip some stages when
SUBDIR_OVERRIDE is set (used to build crypto, krb4, and krb5
dists).

Added NO_MAKEDB_RUN knob to Makefile.inc1 to avoid running
makewhatis(1) at the end of installworld (used when making crypto,
krb4, and krb5 dists).

In release/scripts/doFS.sh, ensure that the correct boot blocks are
used.

Moved the creation of the "crypto" dist from release.5 to
release.2.

In release.3 and doMFSKERN, build kernels in the "world"
environment. KERNELS now means "additional" kernels, GENERIC is
always built.

Ensure we build crunched binaries in the "world" environment.
Obfuscate release/Makefile some more (WMAKEENV) to achieve this.

Inline createBOOTMFS target.

Use already built GENERIC kernel modules to augment mfsfd's
/stand/modules. GC doMODULES as such.

Assorted fixes:

Get rid of the "afterdistribute" target by moving the single use
of it from sys/Makefile to etc/Makefile's "distribute".

Makefile.inc1: apparently "etc" no longer needs to be last for
"distribute" to succeed.

gnu/usr.bin/perl/library/Makefile.inc: do not override the
"install" and "distribute" targets, do it the "canonical" way.

release/scripts/{man,cat}pages-make.sh: make sure Perl manpages and
catpages appear in the right dists. Note that because Perl does
not respect the MANBUILDCAT (and NOMAN), this results in a loss of
/usr/share/perl/man/cat* empty directories. This will be fixed
soon.

Turn MAKE_KERBEROS4 into a plain boolean variable (if it is set it
means "make KerberosIV"), as documented in the make.conf(5)
manpage. Most of the userland makefiles did not test it for "YES"
anyway.

XXX Should specialized kerberized libpam versions be included into
the krb4 and krb5 dists? (libpam.a would be incorrect anyway if
both krb4 and krb5 dists were choosen.)

Make sure "games" dist is made before "catpages", otherwise games
catpages settle in the wrong dist.

Fast build machine provided by: Igor Kucherenko <kivvy@sunbay.com>

Replaced hacks in previous revision with the "standard" way of
building internal libraries. This also unbreaks this makefile
after recent share/mk changes.

Fix build when MAKE_KERBEROS4 is not requested. This was broken with
the last Heimdal import.

Reported by: jhay, roam
(both the same day!)

Bump major library version of all Heimdal Kerberos libraries
after import from KTH repository circa 2002/02/17.

Update build after import of Heimdal Kerberos 2002/02/17.

Fixed -DMAKE_KERBEROS5 world breakage in kerberos5/lib/libroken
(make-roken is a build tool). This bug was hiding itself after
a just fixed bug in cross-linker (binutuils/ld/Makefile,v 1.20).

The bug was fatal for cross builds; for example, an alpha binary
(make-roken) was attempted to be run on i386.

Added make-roken to the list of build-tools in libasn1. It only
worked because another build tool needs make-roken implicitly:

(build-tools: asn1_compile: print_version.o: roken.h: make-roken).

Spotted by: nectar

Install script via SCRIPTS.

add krb4 libraries

Add the necessary paths to the kerberos libraries and includes.

This fix "make release".

Reviewed by: markm

Style clean-up, and diff-reduce WRT src/secure/*telnet*/Makefile

Lost in this commit - KerberosIV compatability. This will be
re-added later.

use cp instead of mv to get the right name of the yacc-generated
files, mv fails badly with parallel makes

Submitted by: Vincent Poy <vince@oahu.WURLDLINK.NET>

make libtelnet (and telnet, telnetd) use libkrb when required

also install roken-common.h

style fixes (by the way of bde)

sort SUBDIR

Requested by: bde

add krb5-config

Diff reduce all the crypto telnet Makefiles.

Revamp and diff-reduce the various secure telnets. Make sure that
Kerberos5 has _a_ telnet (which is not currently K5 enabled).
Incorporate BDE's static linking fixes.

add dependency for lex.o on roken.h (from "Alexander N. Kabaev"
<ak03@gte.com>)
remove duplicate build-tools target

add an explicit dependency to run yacc before lex instead of using
.ORDER

update infrastructure for heimdal 0.3f

Install this SUID root. Heck, it is su, after all.

use print_version from lib/vers instead of lib/roken

install libroken and roken.h

de-constify to make it compatible with (krb4) and make-print-version

Submitted by: Peter Pentchev <roam@orbitel.bg> (just inverted)

Fix PAMized telnet in exactly the same way as BDE did it for the other
telnet instances.

Bye-bye /usr/lib/libtelnet.a. This should fix ``make release'' brokeness.

Approved by: markm

MAN[1-9] -> MAN.

MAN[1-9] -> MAN.

*Sigh*. What I did without this, I have no idea.

try hard to make sure this does not get build as a shared library

Fix release. Just as in other kerberos5 libraries, we need to include
${.OBJDIR} in the includes list and generate a couple of headers from their
.et sources for beforedepend and all.

remove definition of KRB4, this gets defined conditionally in
kerberos5/Makefile and should not have a constant value here.

Submitted by: Jun Kuriyama <kuriyama@imgsrc.co.jp>

Fix build, and make parallel build much more robust.

update build infrastructure for heimdal 0.3e

Fix ordering for real this time.

Add a dependency needed when using parallel make.

Approved by: markm

Unbreak heimdal build: we can no longer #include <netinet6/in6.h>

Properly separate the K5-only buld from K4.

Submitted by: sheldonh

Point SDIR at ${.CURDIR}/../secure so that ssh and sshd can be found when
the krb5 versions are built during make release.

Reviewed by: markm

Oops! this macro needs to be defined for "make release".

Found by: phk

KerberosIV is no longer compulsory. This should fix "make release".

Targets and macros for "make release".

Remove largescale evidence of crack-smoking.

Where a k4 applet has a k5 namesake, rename the k5 version
from k<app> to k5<app>. (Repo copy done).

Do some repairs to dependancies to support make world properly.

Use libcrypto instead of libdes. Upgrade for Heimdal-0.2p

Use libcrypto in place of libdes.

another tcp apps IPv6 updates.(should be make world safe)
ftp, telnet, ftpd, faithd
also telnet related sync with crypto, secure, kerberosIV

Obtained from: KAME project

Another target to keep "make release" orthogonal.

Make a "do nothing" target to help "make release" look clean.

Move CFLAGS to a more obvious place and allow INET6 to work.

Move CFLAGS to a more obvious place and allow INET6 to work properly.

This commit was generated by cvs2svn to compensate for changes in r56545,
which included commits to RCS files with non-trunk default branches.

Bring in rest of K5 (AKA Heimdal) userland.

The brave amongst you may want to start playing with this (ATM
experimental) code.

This commit was generated by cvs2svn to compensate for changes in r56067,
which included commits to RCS files with non-trunk default branches.

Userland build of Kerberos5 (AKA Heimdal). More to come.

This is not ready for primetime yet! Please hold off on the bug reports.

Bring in SRA for telnet.

Submitted by: Nick Sayer

Merged src/lib/libtelnet rev.1.9 (fixed removing of obsolete shared
library: wrong library directory, wrong library extension and wrong
comment). This is mainly of historical interest, if any. The library
that gets removed is aout.

Fix for new Common Error system.

Don't -DTERMCAP or we define a few conflicting functions and cause
recursion in a rather ugly way.

$Id$ -> $FreeBSD$

Link everything against libcrypt. ELF builds complain without it.
Clean up the master makefile a bit and add a "dekerberise" target
for those who have shot themselves in the foot.

Thanks to: Randy Bush

While I am no longer making a shared library, nuke the old one to prevent
ld from picking it up spuriously.

Stop making the shared library for libtelnet (crypto version). This
should have happened years ago.

Fix a break in the includes where the build blows chunks if it is
being built in a totally clean environment.

Found by: jkh and "make release"

Initial import of the new kerberosIV Makefiles.

I will follow up with the userland sources over the next few days.
The impatient of you can play with this, but you do this without
support or blessing until I am finished ;-)