curl: add optional krb5 support - #30416
Conversation
Enable Kerberos authentication support in curl by including krb5-libs. This allows curl to handle GSSAPI/Kerberos authentication protocols, enhancing compatibility with enterprise environments. The feature is disabled by default to avoid unnecessary dependencies. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
openwrt-ai
left a comment
openwrt-ai
left a comment
There was a problem hiding this comment.
Reviewed 1 new commit.
The shape of the change is right: opt-in symbol defaulting to n, conditional +LIBCURL_KERBEROS_AUTH:krb5-libs dependency, --with-gssapi=$(STAGING_DIR)/usr / --without-gssapi pair, and PKG_RELEASE bumped to 2 for a build-logic-only change. net/krb5 stages headers and a prefix-rewritten krb5-config in its Build/InstallDev, so curl's configure should pick the GSS-API flags up correctly when cross-compiling.
One finding I'd consider a blocker: the new config symbol is missing from PKG_CONFIG_DEPENDS, so toggling it does not force a reconfigure. Details inline. The other inline comment is a cosmetic nit and can be ignored.
Generated by Claude Code
| $(if $(CONFIG_LIBCURL_ZSTD),--with-zstd="$(STAGING_DIR)/usr",--without-zstd) \ | ||
| $(if $(CONFIG_LIBCURL_HTTP2),--with-nghttp2="$(STAGING_DIR)/usr",--without-nghttp2) \ | ||
| $(if $(CONFIG_LIBCURL_HTTP3),--with-nghttp3="$(STAGING_DIR)/usr" --with-ngtcp2="$(STAGING_DIR)/usr",--without-nghttp3 --without-ngtcp2) \ | ||
| $(if $(CONFIG_LIBCURL_KERBEROS_AUTH),--with-gssapi="$(STAGING_DIR)/usr",--without-gssapi) \ |
There was a problem hiding this comment.
This new symbol feeds CONFIGURE_ARGS but is not listed in PKG_CONFIG_DEPENDS (lines 28-75 of this file). The configure stamp is keyed on a hash of exactly those symbols — STAMP_CONFIGURED in include/package.mk:126 — so toggling LIBCURL_KERBEROS_AUTH on an existing build tree will not invalidate .configured and curl will silently keep the old --without-gssapi build. Every other option consumed here (CONFIG_LIBCURL_TLS_SRP, CONFIG_LIBCURL_HTTP3, CONFIG_LIBCURL_NTLM, …) is registered there, and the same is done in sibling packages, e.g. CONFIG_BIND_ENABLE_GSSAPI in net/bind/Makefile:36.
Please add CONFIG_LIBCURL_KERBEROS_AUTH to the PKG_CONFIG_DEPENDS list (the miscellaneous group starting at CONFIG_LIBCURL_COOKIES looks like the right place). No suggestion block here since the edit belongs to a hunk this comment is not anchored to.
Generated by Claude Code
| default n | ||
|
|
||
| config LIBCURL_KERBEROS_AUTH | ||
| bool "Enable kerberos authentication" |
There was a problem hiding this comment.
nit: "Kerberos" is a proper noun and every other prompt in this file capitalises the protocol/technology name it refers to (Enable TLS-SRP authentication, Enable IDN2 support, Enable NTLM support). Purely cosmetic, not a merge blocker.
| bool "Enable kerberos authentication" | |
| bool "Enable Kerberos authentication" |
Generated by Claude Code
2 participants
📦 Package Details
Maintainer: @hnyman @BKPepe ?
Description:
Enable Kerberos authentication support in curl by including krb5-libs. This allows curl to handle GSSAPI/Kerberos authentication protocols, enhancing compatibility with enterprise environments.
The feature is disabled by default to avoid unnecessary dependencies.
🧪 Run Testing Details
✅ Formalities
If your PR contains a patch:
git am(e.g., subject line, commit description, etc.)
We must try to upstream patches to reduce maintenance burden.