oath-toolkit 2.6.7 fails to build on Darwin due to lack of pam_modutil.h

[jbg]

The oath-toolkit package doesn't build on Darwin due to a dependency on pam_modutil.h which doesn't exist in OpenPAM:

checking security/pam_modutil.h usability... no
checking security/pam_modutil.h presence... no
checking for security/pam_modutil.h... no
configure: error: PAM header files not found, install libpam-dev.
configure: error: ./configure failed for pam_oath
builder for '/nix/store/vh071q2g59dqc97mshxh104kmjdjqf65-oath-toolkit-2.6.7.drv' failed with exit code 1

There is an upstream issue to potentially replace the use of functions from pam_modutil.h with something else on platforms where it doesn't exist.

Based on this, I think the intention is not to use PAM on Darwin anyway:

let
  securityDependency =
    if stdenv.isDarwin then xmlsec
    else pam;

So a reasonable fix could be simply to pass --disable-pam when building on Darwin, which solves the build failure.

Notify maintainers @schnusch

Metadata

 - system: `"aarch64-darwin"`
 - host os: `Darwin 20.5.0, macOS 11.4`
 - multi-user?: `no`
 - sandbox: `no`
 - version: `nix-env (Nix) 2.3.14`
 - channels: `"nixpkgs-21.11pre301805.dac74fead87"`
 - nixpkgs: `~/.nix-defexpr/channels/nixpkgs`

Maintainer information:

# a list of nixpkgs attributes affected by the problem
attribute:
# a list of nixos modules affected by the problem
module:

[Artturin]

test this

diff --git a/pkgs/tools/security/oath-toolkit/default.nix b/pkgs/tools/security/oath-toolkit/default.nix
index a925d07cb7c..fd6a938b2f2 100644
--- a/pkgs/tools/security/oath-toolkit/default.nix
+++ b/pkgs/tools/security/oath-toolkit/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, fetchurl, pam, xmlsec }:

 let
+  #TODO Switch to OpenPAM once https://gitlab.com/oath-toolkit/oath-toolkit/-/issues/26 is addressed
   securityDependency =
     if stdenv.isDarwin then xmlsec
     else pam;
@@ -16,6 +17,8 @@ in stdenv.mkDerivation rec {

   buildInputs = [ securityDependency ];

+  configureFlags = lib.optional stdenv.isDarwin [ "--disable-pam" ];
+
   passthru.updateScript = ./update.sh;

   meta = with lib; {

[jbg]

Yup, works.