#1072844 heimdal: Please build heimdal with openssl

Package:
src:heimdal
Source:
src:heimdal
Submitter:
Jarek Kamiński
Date:
2024-06-09 08:03:05 UTC
Severity:
normal
#1072844#5
Date:
2024-06-08 20:51:28 UTC
From:
To:
Hi,

While trying to use PKINIT I've got the following error:
#v+
% kinit -D DIR:/etc/ssl/certs/ -C PKCS11:/usr/lib/x86_64-linux-gnu/libykcs11.so
PIN code for Yubico YubiKey OTP+FIDO+CCID 00 00:
kinit: krb5_get_init_creds: PKINIT: ECDH not supported
#v-

Looking at the source code, the error is printed when
HAVE_HCRYPTO_W_OPENSSL is not defined, which is the case because the
source code is configured --without-openssl. Changelog explains this was
introduced to fix #440443, but disabling OpenSSL is a bit unfortunate
solution to the FTBFS.

Could you consider building with OpenSSL support enabled? For the
record, PKINIT with RSA certificates works all right.
#1072844#10
Date:
2024-06-09 08:00:32 UTC
From:
To:
Jarek Kamiński <Jarek@freeside.be> writes:

I think there was a really good reason we disabled openssl support.

Unfortunately I can't find it anymore.

I do see an old bug report about license incompatability between
libreadline (GPL) and openssl, but AFAIK we no longer use libreadline so
that shouldn't be an issue anymore.