nixpkgs master build: openssh/krb5 build error

[nh2]

https://buildkite.com/nh2/static-haskell-nix/builds/158#eae147db-3177-4ab0-9a49-3140285d13fa/23-10930

In file included from ../openbsd-compat/openbsd-compat.h:193,
                 from ../includes.h:174,
                 from port-aix.c:27:
../openbsd-compat/bsd-misc.h:134:39: error: expected identifier or ‘(’ before ‘do’
 # define krb5_free_error_message(a,b) do { } while(0)
                                       ^~
../openbsd-compat/bsd-misc.h:134:46: error: expected identifier or ‘(’ before ‘while’
 # define krb5_free_error_message(a,b) do { } while(0)
                                              ^~~~~
In file included from /nix/store/ivxdscf0zmi2jjkjmhj5dxk0zmrxvv2x-libkrb5-1.17-dev/include/krb5/krb5.h:8598,
                 from /nix/store/ivxdscf0zmi2jjkjmhj5dxk0zmrxvv2x-libkrb5-1.17-dev/include/krb5.h:8,
                 from ../auth.h:40,
                 from port-aix.c:34:
/nix/store/ivxdscf0zmi2jjkjmhj5dxk0zmrxvv2x-libkrb5-1.17-dev/include/com_err.h:54:65: error: conflicting types for ‘error_message’
 extern /*@observer@*//*@dependent@*/ const char * KRB5_CALLCONV error_message
                                                                 ^~~~~~~~~~~~~
In file included from ../includes.h:171,
                 from port-aix.c:27:
../defines.h:665:43: note: previous declaration of ‘error_message’ was here
 #  define krb5_get_err_text(context,code) error_message(code)
                                           ^~~~~~~~~~~~~
make[1]: *** [Makefile:99: port-aix.o] Error 1
make[1]: Leaving directory '/build/openssh-8.1p1/openbsd-compat'
make: *** [Makefile:170: openbsd-compat/libopenbsd-compat.a] Error 2
builder for '/nix/store/ll53yyymwwflgj5l4i5gpk6bwlh7dh9d-openssh-8.1p1.drv' failed with exit code 2

Explanation: https://gist.github.com/stumbles/67c54b228df0a5d2b65d53190e4cbea4#gistcomment-3097757

Ah, I've got it: this is the error message you get when you define function with the same name as a macro that already exists. Example:

# define krb5_free_error_message(a,b) do { } while(0)

void krb5_free_error_message(a,b) {}

So this must mean that after https://github.com/openssh/openssh-portable/blob/2ff822eabd7d4461743f22d3b9ba35ab76069df5/openbsd-compat/bsd-misc.h#L134-L136

#ifndef HAVE_KRB5_FREE_ERROR_MESSAGE
# define krb5_free_error_message(a,b) do { } while(0)
#endif

is executed, something #includes the krb5.h header file that defines krb5_free_error_message as a function.

---

Doing grep -R krb5_free_error_message . in the --keep-failed dir I seen in config.log:

  $ ./configure --prefix=/nix/store/ndgg2ayi185j5r12s66fgi1937l462s9-openssh-8.1p1 --sbindir=${out}/bin --localstatedir=/var --with-pid-dir=/run --with-mantype=man --with-libedit=yes --disable-strip --with-pam --sysconfdir=/etc/ssh --with-kerberos5=/nix/store/4ra3djsv1shbx2ycwjfgjvj0l1fz06fg-libkrb5-1.17
...
... lots more krb5 linker errors ...
...
/nix/store/jj5wh2i04zqjmsqiw2kq3fdzm0sl97d7-binutils-2.31.1/bin/ld: /nix/store/4ra3djsv1shbx2ycwjfgjvj0l1fz06fg-libkrb5-1.17/lib/libkrb5.a(kerrs.o): in function `krb5_free_error_message':
(.text+0x4ad): undefined reference to `k5_free_error'
...
... lots more krb5 linker errors ...
...
ac_cv_func_krb5_free_error_message=no

and in the configure output:

checking for krb5_free_error_message... no
...
                 KerberosV support: yes

So it enabled kerberos support (yes), but its internal checks for e.g. ac_cv_func_krb5_free_error_message failed, but not because (as was probably intended) the function isn't defined in the header, but because of a linker error.

So then autoconf silently continues (as usual :-1:), with krb5 support on but the HAVE_ set to false, does its own define of krb5_free_error_message, includes krb.h and then fails.

So I think 2 (IMO) garbage behaviours of autoconf are at play:

• Enabling krb5 support when it clearly doesn't work (maybe the configure.ac of openssh is written incorrectly?)
• Claiming that a linker error indicates absence of a function, as opposed to a programmer error.

[nh2]

Adding openssh = previous.openssh.override { withKerberos = false; }; is one fix.

The alternative would be to somehow fix it so that the configure test links correctly.

[nh2]

I fixed this in current static-haskell-nix versions, in some cases by disabling krb5 where necessary.