Thread: kerberos/001_auth test fails on arm CPU darwin

Bilal Yavuz <byavuz81@gmail.com> writes:
> It seems that kerberos is installed at the '/opt/homebrew/opt/krb5' path on
> ARM CPU darwin instances instead of the '/usr/local/opt/krb5' path.

I think this also needs to account for MacPorts, which would likely
put it under /opt/local/sbin.  (I wonder where /usr/local/opt/krb5
came from at all -- that sounds like somebody's manual installation
rather than a packaged one.)  Maybe we should first try
"krb5-config --prefix" to see if that gives an answer.

            regards, tom lane

On 26.09.22 13:14, Tom Lane wrote:
> Bilal Yavuz<byavuz81@gmail.com>  writes:
>> It seems that kerberos is installed at the '/opt/homebrew/opt/krb5' path on
>> ARM CPU darwin instances instead of the '/usr/local/opt/krb5' path.
> I think this also needs to account for MacPorts, which would likely
> put it under /opt/local/sbin.  (I wonder where /usr/local/opt/krb5
> came from at all -- that sounds like somebody's manual installation
> rather than a packaged one.)

/usr/local/opt/ is used by Homebrew on Intel macOS.

Hi,


On 9/26/2022 2:14 PM, Tom Lane wrote:
>
> Maybe we should first try "krb5-config --prefix" to see if that gives an answer.


I tested that command on multiple OSes and it was correct for freeBSD, 
debian and openSUSE.

I don't have macOS so I tried to use CI for running macOS VMs(both arm 
and Intel CPU):
When "krb5-config" binary is used from brew or MacPorts installations' 
path it gives the correct path but there is another "krb5-config" binary 
at "/usr/bin/krb5-config" path on the macOS VMs, when this binary is 
used while running "krb5-config --prefix" command run it gives "/" as 
output. This issue can be related about the CI VMs but I couldn't check it.

Regards,
Nazir Bilal Yavuz

On 09/26/2022 11:39 am, Nazir Bilal Yavuz wrote:
> Hi,
> 
> 
> On 9/26/2022 2:14 PM, Tom Lane wrote:
>> 
>> Maybe we should first try "krb5-config --prefix" to see if that gives 
>> an answer.
> 
> 
> I tested that command on multiple OSes and it was correct for freeBSD, 
> debian and openSUSE.
> 
> I don't have macOS so I tried to use CI for running macOS VMs(both arm 
> and Intel CPU):
> When "krb5-config" binary is used from brew or MacPorts installations' 
> path it gives the correct path but there is another "krb5-config" 
> binary at "/usr/bin/krb5-config" path on the macOS VMs, when this 
> binary is used while running "krb5-config --prefix" command run it 
> gives "/" as output. This issue can be related about the CI VMs but I 
> couldn't check it.
> 
> Regards,
> Nazir Bilal Yavuz

on macOS monterey 12.6:
~ via 💎 v3.1.2 on ☁️  (us-east-1) on ﴃ WhereTo - Prod
❯ krb5-config --prefix
/

~ via 💎 v3.1.2 on ☁️  (us-east-1) on ﴃ WhereTo - Prod
❯
-- 
Larry Rosenman                     http://www.lerctr.org/~ler
Phone: +1 214-642-9640                 E-Mail: ler@lerctr.org
US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

Larry Rosenman <ler@lerctr.org> writes:
> On 09/26/2022 11:39 am, Nazir Bilal Yavuz wrote:
>> When "krb5-config" binary is used from brew or MacPorts installations' 
>> path it gives the correct path but there is another "krb5-config" 
>> binary at "/usr/bin/krb5-config" path on the macOS VMs, when this 
>> binary is used while running "krb5-config --prefix" command run it 
>> gives "/" as output. This issue can be related about the CI VMs but I 
>> couldn't check it.

> [ yup, it gives "/" ]

Yeah, I see the same on my laptop.  So we can't trust krb5-config
unconditionally.  But we could do something like checking
"-x $config_prefix . '/bin/kinit'" before believing it's good,
and maybe also check sbin/krb5kdc.  We'd want to use similar
probes to decide which of the fallback directories to use, anyway.

            regards, tom lane

On Mon, Sep 26, 2022 at 04:39:36PM +0200, Peter Eisentraut wrote:
> On 26.09.22 13:14, Tom Lane wrote:
>> Bilal Yavuz<byavuz81@gmail.com>  writes:
>> > It seems that kerberos is installed at the '/opt/homebrew/opt/krb5' path on
>> > ARM CPU darwin instances instead of the '/usr/local/opt/krb5' path.
>> I think this also needs to account for MacPorts, which would likely
>> put it under /opt/local/sbin.  (I wonder where /usr/local/opt/krb5
>> came from at all -- that sounds like somebody's manual installation
>> rather than a packaged one.)
>
> /usr/local/opt/ is used by Homebrew on Intel macOS.

Hmm.  Is that the case with new setups under x86_64?  I have a M1
where everything goes through /opt/homebrew/, though it has been set
very recently.
--
Michael

On 09/26/2022 8:25 pm, Michael Paquier wrote:
> On Mon, Sep 26, 2022 at 04:39:36PM +0200, Peter Eisentraut wrote:
>> On 26.09.22 13:14, Tom Lane wrote:
>>> Bilal Yavuz<byavuz81@gmail.com>  writes:
>>> > It seems that kerberos is installed at the '/opt/homebrew/opt/krb5' path on
>>> > ARM CPU darwin instances instead of the '/usr/local/opt/krb5' path.
>>> I think this also needs to account for MacPorts, which would likely
>>> put it under /opt/local/sbin.  (I wonder where /usr/local/opt/krb5
>>> came from at all -- that sounds like somebody's manual installation
>>> rather than a packaged one.)
>> 
>> /usr/local/opt/ is used by Homebrew on Intel macOS.
> 
> Hmm.  Is that the case with new setups under x86_64?  I have a M1
> where everything goes through /opt/homebrew/, though it has been set
> very recently.
> --
> Michael

Intel:
wf-corporate-chef on  master +6 -420 [✘!] on ☁️  (us-east-1) on ﴃ 
WhereTo - Prod
❯  /usr/local/opt/krb5/bin/krb5-config  --prefix
/usr/local/Cellar/krb5/1.20

wf-corporate-chef on  master +6 -420 [✘!] on ☁️  (us-east-1) on ﴃ 
WhereTo - Prod
❯

Same on my M1 iMac (migrated from an Intel iMac however)

-- 
Larry Rosenman                     http://www.lerctr.org/~ler
Phone: +1 214-642-9640                 E-Mail: ler@lerctr.org
US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

Hi,

On 2022-09-27 10:25:07 +0900, Michael Paquier wrote:
> On Mon, Sep 26, 2022 at 04:39:36PM +0200, Peter Eisentraut wrote:
> > On 26.09.22 13:14, Tom Lane wrote:
> >> Bilal Yavuz<byavuz81@gmail.com>  writes:
> >> > It seems that kerberos is installed at the '/opt/homebrew/opt/krb5' path on
> >> > ARM CPU darwin instances instead of the '/usr/local/opt/krb5' path.
> >> I think this also needs to account for MacPorts, which would likely
> >> put it under /opt/local/sbin.  (I wonder where /usr/local/opt/krb5
> >> came from at all -- that sounds like somebody's manual installation
> >> rather than a packaged one.)
> > 
> > /usr/local/opt/ is used by Homebrew on Intel macOS.
> 
> Hmm.  Is that the case with new setups under x86_64?  I have a M1
> where everything goes through /opt/homebrew/, though it has been set
> very recently.

Yes, it's hardware dependent:

https://docs.brew.sh/Installation
"This script installs Homebrew to its preferred prefix (/usr/local for macOS
Intel, /opt/homebrew for Apple Silicon and /home/linuxbrew/.linuxbrew for
Linux"


Maybe we should rely on PATH, rather than hardcoding OS dependent locations?
Or at least fall back to seach binaries in PATH? Seems pretty odd to hardcode
all these locations without a way to influence it from outside the test.

There has to be something similar to python's shutil.which() in perl.

Greetings,

Andres Freund

Andres Freund <andres@anarazel.de> writes:
> Maybe we should rely on PATH, rather than hardcoding OS dependent locations?

My suggestion to consult krb5-config first was meant to allow PATH
to influence the results.  However, if that doesn't work, it's important
IMO to have a sane list of hardwired places to look in.  Personally,
I do not like to have MacPorts or Homebrew's bin directory in the
PATH -- at least not for a buildfarm animal -- because there tends
to be an enormous amount of non-Mac-ish clutter there.  So for this
purpose, I'd like us to be able to find the standard places that
MacPorts and Homebrew install Kerberos in even if they are not in PATH.

            regards, tom lane

On 27.09.22 03:37, Andres Freund wrote:
> Maybe we should rely on PATH, rather than hardcoding OS dependent locations?
> Or at least fall back to seach binaries in PATH? Seems pretty odd to hardcode
> all these locations without a way to influence it from outside the test.

Homebrew intentionally does not install the krb5 and openldap packages 
into the path, because they conflict with macOS-provided software. 
However, those macOS-provided variants don't provide all the pieces we 
need for the tests.

Also, on Linux you need /usr/sbin, which is often not in the path.

So I think there is no good way around hardcoding a lot of these paths.

Hi,

Thanks for the reviews!


On 9/27/2022 5:21 AM, Tom Lane wrote:
> Andres Freund <andres@anarazel.de> writes:
>> Maybe we should rely on PATH, rather than hardcoding OS dependent locations?
> My suggestion to consult krb5-config first was meant to allow PATH
> to influence the results.  However, if that doesn't work, it's important
> IMO to have a sane list of hardwired places to look in.


I updated my patch regarding these reviews.

The current logic is it will try to find all executables in that 
order(if it finds all executables, it won't try remaining steps):


1 - 'krb5-config --prefix'

2 - hardcoded paths(I added arm and MacPorts paths for darwin)

3 - from PATH

Also, I tried to do some refactoring for adding another paths to search 
in the future and being sure about all executables are found.

Ci run after fix is applied:
https://cirrus-ci.com/build/5758254918664192

Regards,
Nazir Bilal Yavuz

Greetings,

* Peter Eisentraut (peter.eisentraut@enterprisedb.com) wrote:
> On 27.09.22 03:37, Andres Freund wrote:
> > Maybe we should rely on PATH, rather than hardcoding OS dependent locations?
> > Or at least fall back to seach binaries in PATH? Seems pretty odd to hardcode
> > all these locations without a way to influence it from outside the test.
>
> Homebrew intentionally does not install the krb5 and openldap packages into
> the path, because they conflict with macOS-provided software. However, those
> macOS-provided variants don't provide all the pieces we need for the tests.

The macOS-provided versions are also old and broken, or at least that
was the case when I looked into them last.

> Also, on Linux you need /usr/sbin, which is often not in the path.
>
> So I think there is no good way around hardcoding a lot of these paths.

Yeah, not sure what else to do.

Thanks,

Stephen

Stephen Frost <sfrost@snowman.net> writes:
> * Peter Eisentraut (peter.eisentraut@enterprisedb.com) wrote:
>> Homebrew intentionally does not install the krb5 and openldap packages into
>> the path, because they conflict with macOS-provided software. However, those
>> macOS-provided variants don't provide all the pieces we need for the tests.

> The macOS-provided versions are also old and broken, or at least that
> was the case when I looked into them last.

Yeah.  They also generate tons of deprecation warnings at compile time,
so it's not like Apple is encouraging you to use them.  I wonder why
they're still there at all.

            regards, tom lane

On 27.09.22 17:35, Nazir Bilal Yavuz wrote:
> I updated my patch regarding these reviews.
> 
> The current logic is it will try to find all executables in that 
> order(if it finds all executables, it won't try remaining steps):
> 
> 
> 1 - 'krb5-config --prefix'
> 
> 2 - hardcoded paths(I added arm and MacPorts paths for darwin)
> 
> 3 - from PATH
> 
> Also, I tried to do some refactoring for adding another paths to search 
> in the future and being sure about all executables are found.

This patch could use some more in-code comments.  For example, this

+# get prefix for kerberos executables and try to find them at this path
+sub test_krb5_paths

is not helpful.  What does it "get", where does it put it, how does it 
"try", and what does it do if it fails?  What are the inputs and outputs 
of this function?

+   # remove '\n' since 'krb5-config --prefix' returns path ends with '\n'
+   $krb5_path =~ s/\n//g;

use chomp

Hi,

Thanks for the review!

On 10/1/22 14:12, Peter Eisentraut wrote:
> This patch could use some more in-code comments.  For example, this
>
> +# get prefix for kerberos executables and try to find them at this path
> +sub test_krb5_paths
>
> is not helpful.  What does it "get", where does it put it, how does it 
> "try", and what does it do if it fails?  What are the inputs and 
> outputs of this function?
>
> +   # remove '\n' since 'krb5-config --prefix' returns path ends with 
> '\n'
> +   $krb5_path =~ s/\n//g;
>
> use chomp
>

I updated patch regarding these comments.

I have a question about my logic:
+    elsif ($^O eq 'linux')
+    {
+        test_krb5_paths('/usr/');
+    }
  }

Before that, test could use krb5kdc, kadmin and kdb5_util from 
'/usr/sbin/'; krb5_config and kinit from $PATH. However, now it will try 
to use all of them from $PATH or from '/usr/sbin/' and '/usr/bin/'. Does 
that cause a problem?

Ci run after fix is applied:

https://cirrus-ci.com/build/5359971746447360


Regards,
Nazir Bilal Yavuz