*/*: Switch to USES=kde
All these ports use only the ECM module shipped with KDE Frameworks.
ECM from Frameworks 5 has been replaced by Frameworks 6 counterpart
a while ago. While here, drop runtime dependency on ECM.
Differential: D58578
Reviewed by: adridg, arrowd, jhale
devel/*pygobject*: install missed header (+)
Install missed pygobject-types.h
It needed to unbreak consumers, e.g. multimedia/py-gstreamer1
In file included from ../gi/overrides/gstanalyticsmodule.c:27:
/usr/local/include/pygobject-3.0/pygobject.h:23:10: fatal error: 'pygobject-types.h' file not found
23 | #include <pygobject-types.h>
| ^~~~~~~~~~~~~~~~~~~
1 error generated.
Reported by: bulk -t
security/dogtag-pki: bound the rc onestop call during pkidestroy
The Tomcat stop path called `service <instance> onestop` and blocked on
rc.subr's wait_for_pids() indefinitely when the jsvc/JVM did not exit
(e.g. a wedged webapp during pkidestroy). Bound the call with a timeout
and fall back to SIGKILL so pkidestroy/uninstall can never hang.
Sponsored by: Netzkommune GmbH
net/py-lib389: pass the process environment when starting dirsrv
Extend the FreeBSD start patch so lib389 launches the ns-slapd process
with a copy of the current environment (env = dict(os.environ)) instead
of an empty one. This lets the Kerberos settings (e.g. KRB5_KTNAME) reach
the directory server process, which is required for GSSAPI/GSS-SPNEGO binds
on FreeBSD.
Sponsored by: Netzkommune GmbH
net/389-ds-base: build against MIT Kerberos; fix GSSAPI SASL on FreeBSD
Add USES=gssapi:mit so ns-slapd links the ports MIT Kerberos
(security/krb5) used by the rest of the FreeIPA stack, plus two
FreeBSD-specific fixes so GSSAPI/GSS-SPNEGO binds work:
- ldaputil.c: locate the SASL plugins under ${LOCALBASE}/lib/sasl2 on
FreeBSD (upstream only handles the Linux path).
- saslbind.c: register the GSSAPI acceptor keytab explicitly via
krb5_gss_register_acceptor_identity(). ns-slapd starts as root and
then drops privileges, so issetugid() is true and MIT Kerberos ignores
KRB5_KTNAME; without this every GSSAPI bind fails with a permission
error on the default keytab.
Sponsored by: Netzkommune GmbH
net/slapi-nis: Add new Port
slapi-nis provides the Schema Compatibility plugin for 389 Directory
Server. The plugin presents alternate LDAP views required by FreeIPA
compatibility features, including SSSD ID mapping and ID views. The NIS
plugin itself is disabled; only the schema-compat plugin is built.
WWW: https://codeberg.org/freeipa/slapi-nis
Sponsored by: Netzkommune GmbH
Required for: FreeIPA server port
sysutils/oddjob: Add new Port
oddjob is a D-Bus service (oddjobd) that runs a fixed set of privileged
jobs on behalf of unprivileged client applications. FreeIPA uses it for
oddjob-mkhomedir, which creates a user's home directory on first login.
The port disables the systemd, sysvinit, Python and SELinux features
that do not apply on FreeBSD and ships a native rc script.
WWW: https://codeberg.org/freeipa/oddjob
Sponsored by: Netzkommune GmbH
Required for: FreeIPA server port
www/freeipa-auth-gssapi: Add new Port
mod_auth_gssapi is the Apache module FreeIPA uses for SPNEGO/GSSAPI
authentication of the Web UI and API. www/mod_auth_gssapi defaults to
the base-system GSSAPI on FreeBSD, which mixes base and ports MIT krb5
in one httpd process and breaks gssproxy interposition. This port is an
independent build hard-wired to the ports MIT krb5 (security/krb5) so it
matches the rest of the FreeIPA stack (net/freeipa-server,
security/gssproxy). It conflicts with ap24-mod_auth_gssapi.
Sponsored by: Netzkommune GmbH
Mk/Uses/npm.mk: Always use X' for denoting BLOB data type
SQLite's .dump always uses X' (capital X) for BLOB. So it's better we
use X' in the code for securing reproducibility of node modules
tarball created by pnpm.
Also, conversion from x' to X' in output dump file in case x' is
accidentally mixed in.
Reported by: pkg-fallout
