build: Use -f when copying sources
If one of the source files we copy is non-writeable, cp will create a
non-writeable copy. If the original is later modified, cp will fail to
overwrite the copy since it is not writeable. Using cp -f ensures the
copy always succeeds, as long as the object directory is writeable.
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
www/mod_auth_mysql2: Deprecate and set expiration date
Abandoned upstream (1.11 from 2016 was explicitly the final release).
"Require group" authorization is silently non-functional with Apache
2.4, and the SSL option no longer builds against MySQL 8.x. All functionality
is covered by mod_authn_dbd / mod_authz_dbd shipped with Apache itself.
PR: 245911
Sponsored by: Netzkommune GmbH
*/*: Switch to USES=kde
All these ports use only the ECM module shipped with KDE Frameworks.
ECM from Frameworks 5 has been replaced by Frameworks 6 counterpart
a while ago. While here, drop runtime dependency on ECM.
Differential: D58578
Reviewed by: adridg, arrowd, jhale
sys/limits.h: Add BOOL_MAX, BITINT_MAXWIDTH, and C23 feature test macro
Add BOOL_MAX and BITINT_MAXWIDTH macros for C23 compliance, and
define the __STDC_VERSION_LIMITS_H__ feature test macro now that
the header fully conforms to C23.
Reviewed by: fuz
Approved by: fuz (mentor)
MFC after: 1 month
Pull Request: https://github.com/freebsd/freebsd-src/pull/2352
devel/*pygobject*: install missed header (+)
Install missed pygobject-types.h
It needed to unbreak consumers, e.g. multimedia/py-gstreamer1
In file included from ../gi/overrides/gstanalyticsmodule.c:27:
/usr/local/include/pygobject-3.0/pygobject.h:23:10: fatal error: 'pygobject-types.h' file not found
23 | #include <pygobject-types.h>
| ^~~~~~~~~~~~~~~~~~~
1 error generated.
Reported by: bulk -t
security/dogtag-pki: bound the rc onestop call during pkidestroy
The Tomcat stop path called `service <instance> onestop` and blocked on
rc.subr's wait_for_pids() indefinitely when the jsvc/JVM did not exit
(e.g. a wedged webapp during pkidestroy). Bound the call with a timeout
and fall back to SIGKILL so pkidestroy/uninstall can never hang.
Sponsored by: Netzkommune GmbH
net/py-lib389: pass the process environment when starting dirsrv
Extend the FreeBSD start patch so lib389 launches the ns-slapd process
with a copy of the current environment (env = dict(os.environ)) instead
of an empty one. This lets the Kerberos settings (e.g. KRB5_KTNAME) reach
the directory server process, which is required for GSSAPI/GSS-SPNEGO binds
on FreeBSD.
Sponsored by: Netzkommune GmbH
net/389-ds-base: build against MIT Kerberos; fix GSSAPI SASL on FreeBSD
Add USES=gssapi:mit so ns-slapd links the ports MIT Kerberos
(security/krb5) used by the rest of the FreeIPA stack, plus two
FreeBSD-specific fixes so GSSAPI/GSS-SPNEGO binds work:
- ldaputil.c: locate the SASL plugins under ${LOCALBASE}/lib/sasl2 on
FreeBSD (upstream only handles the Linux path).
- saslbind.c: register the GSSAPI acceptor keytab explicitly via
krb5_gss_register_acceptor_identity(). ns-slapd starts as root and
then drops privileges, so issetugid() is true and MIT Kerberos ignores
KRB5_KTNAME; without this every GSSAPI bind fails with a permission
error on the default keytab.
Sponsored by: Netzkommune GmbH
net/slapi-nis: Add new Port
slapi-nis provides the Schema Compatibility plugin for 389 Directory
Server. The plugin presents alternate LDAP views required by FreeIPA
compatibility features, including SSSD ID mapping and ID views. The NIS
plugin itself is disabled; only the schema-compat plugin is built.
WWW: https://codeberg.org/freeipa/slapi-nis
Sponsored by: Netzkommune GmbH
Required for: FreeIPA server port
sysutils/oddjob: Add new Port
oddjob is a D-Bus service (oddjobd) that runs a fixed set of privileged
jobs on behalf of unprivileged client applications. FreeIPA uses it for
oddjob-mkhomedir, which creates a user's home directory on first login.
The port disables the systemd, sysvinit, Python and SELinux features
that do not apply on FreeBSD and ships a native rc script.
WWW: https://codeberg.org/freeipa/oddjob
Sponsored by: Netzkommune GmbH
Required for: FreeIPA server port
www/freeipa-auth-gssapi: Add new Port
mod_auth_gssapi is the Apache module FreeIPA uses for SPNEGO/GSSAPI
authentication of the Web UI and API. www/mod_auth_gssapi defaults to
the base-system GSSAPI on FreeBSD, which mixes base and ports MIT krb5
in one httpd process and breaks gssproxy interposition. This port is an
independent build hard-wired to the ports MIT krb5 (security/krb5) so it
matches the rest of the FreeIPA stack (net/freeipa-server,
security/gssproxy). It conflicts with ap24-mod_auth_gssapi.
Sponsored by: Netzkommune GmbH
