K5Wiki - User contributions [en]

Kerberos for Windows (KfW) Build Environment

2016-02-25T22:00:36Z

Sarah:

Directions for producing an environment in which to build
Kerberos for Windows version 4

Start with a clean Windows 7 installation (64-bit necessary?)

(0) get a browser that you like/trust to validate SSL certs/etc.

(1) Install MS Visual Studio 2010 Professional
grab the Visual C++ 10.0 runtime for x86 and x64
also the 64-bit prerequisites
Documentation files not necessary
Choose 'Visual C++ Development Settings' (probably doesn't matter)
You should now have an 'HTML Help Workshop' entry within
Program Files (x86). This will get added to the path, later.
(2) Install the Windows SDK version 7.1
http://www.microsoft.com/en-us/download/details.aspx?displaylang=en&id=8279
The download is over a non-https url by default, though the installer
is signed by a Microsoft certificate.
[Select all components (add application verifier, debugging tools,
windows performance toolkit)]
Finishing the installation brings up the Help Library Manager (installer?)
but nothing should be necessary from that utility.
If you have an error mentioning "Please refer to Samples\Setup\HTML\ConfigDetails.htm"
then uninstall any existing Visual Studio 2010 Redistributable packages installed on
your system and try again.
(3) Install the Utilities and SDK for UNIX-based Applications (amd64 if on a 64-bit system)
First, enable the Windows feature "Subsystem for UNIX-based Applications"
from the Control Panel. (Programs [and Features] menu, "Turn on or off
Windows features", or similar.)
Then visit (also available from the All Programs menu)
http://www.microsoft.com/en-us/download/details.aspx?id=23754
Again, this is a http-default page, and attempting to use SSL causes
an error due to Akamai configuration.
I have Version 10.0.6030.0 of the SUA, which claims to be for
Windows Vista RTM/Windows Vista SP1/Windows Server 2008 RTM
but appears to work fine on Windows 7.
[The standard installation gives us awk, which may be all we need?]
(4) Install the Windows Installer XML Toolkit
Tested with version 3.5; there is a 3.6 beta available as well.
wix.sourceforge.net --> wix.codeplex.com/releases/view/60102
These default to non-SSL urls; try to get
https://download-codeplex.sec.s-msft.com/Download/Release?ProjectName=wix&DownloadId=204417&FileTime=129409234222130000&Build=19194
Install all components (the default setting).
(5) Update the system path to include some necessary utilities.
This is something like
Control Panel->System->Advanced System Settings->Environment
awk is in C:\Windows\SUA\bin
But, you will need to make a *copy* (not link) of it named awk.exe in
order for things to work properly. Check the permissions so that everyone
can read and execute it.
Add the directory containing hhc.exe to the path:
C:\Program Files (x86)\HTML Help Workshop
Add C:\Program Files (x86)\Windows Installer XML v3.5\bin to the path
to get candle.exe.
(6) Install a real Perl that can handle both forward-slash and backward-slash as path separators, e.g., ActivePerl or Strawberry Perl.
I used Strawberry Perl, since its installer was downloadable over SSL and
was digitally signed.
I have strawberry_perl-5.14.2.1-64bit.msi
Note that you may not have spaces in the path to the installation, so
it installs to c:\strawberry by default.

That should be enough for the build environment.

To actually build an installer, first get the source. If you are using git
to get the source, don't set it to convert the line endings to native. The
SUA version of awk expects the files to have unix line endings.

Next, fire up the Windows SDK 7.1 command prompt.

(0) cmd /v to get delayed expansion of variables

(1) Environment set-up
set KRB_INSTALL_DIR=/path/to/an/obj/dir
[set MIT_INTERNAL=1]
[set NODEBUG=1]
\Program Files\Microsoft SDKs\Windows\v7.1\Bin\SetEnv.cmd /x86 [/release]
set CPU=i386
(2) Build the 32-bit binaries
cd /path/to/krb5-tree/src
[nmake clean]
nmake -f Makefile.in prep-windows
nmake
nmake install
(3) Build 32-bit installer
cd windows/installer/wix
[nmake clean]
nmake
rename kfw.msi kfw32.msi
(4) 64-bit build
\Program Files\Microsoft SDKs\Windows\v7.1\Bin\SetEnv.cmd /x64 [/release]
set CPU=AMD64
cd /path/to/krb5-tree/src
nmake clean
nmake -f Makefile.in prep-windows [?]
nmake
nmake install
(5) Build 64-bit installer
cd windows/installer/wix
nmake clean
nmake
rename kfw.msi kfw64.msi

Code signing

signtool sign /a /t http://timestamp.verisign.com/scripts/timstamp.dll foo.msi

You might need to add <code>/i Verisign</code> or something to select the right signing cert.

Kerberos for Windows (KfW) Build Environment

2016-02-25T16:07:29Z

Sarah:

Directions for producing an environment in which to build
Kerberos for Windows version 4

Start with a clean Windows 7 installation (64-bit necessary?)

(0) get a browser that you like/trust to validate SSL certs/etc.

(1) Install MS Visual Studio 2010 Professional
grab the Visual C++ 10.0 runtime for x86 and x64
also the 64-bit prerequisites
Documentation files not necessary
Choose 'Visual C++ Development Settings' (probably doesn't matter)
You should now have an 'HTML Help Workshop' entry within
Program Files (x86). This will get added to the path, later.
(2) Install the Windows SDK version 7.1
http://www.microsoft.com/en-us/download/details.aspx?displaylang=en&id=8279
The download is over a non-https url by default, though the installer
is signed by a Microsoft certificate.
[Select all components (add application verifier, debugging tools,
windows performance toolkit)]
Finishing the installation brings up the Help Library Manager (installer?)
but nothing should be necessary from that utility.
If you have an error mentioning "Please refer to Samples\Setup\HTML\ConfigDetails.htm"
then uninstall any existing Visual Studio 2010 Redistributable packages installed on
your system and try again.
(3) Install the Utilities and SDK for UNIX-based Applications (amd64 if on a 64-bit system)
First, enable the Windows feature "Subsystem for UNIX-based Applications"
from the Control Panel. (Programs [and Features] menu, "Turn on or off
Windows features", or similar.)
Then visit (also available from the All Programs menu)
http://www.microsoft.com/en-us/download/details.aspx?id=23754
Again, this is a http-default page, and attempting to use SSL causes
an error due to Akamai configuration.
I have Version 10.0.6030.0 of the SUA, which claims to be for
Windows Vista RTM/Windows Vista SP1/Windows Server 2008 RTM
but appears to work fine on Windows 7.
[The standard installation gives us awk, which may be all we need?]
(4) Install the Windows Installer XML Toolkit
Tested with version 3.5; there is a 3.6 beta available as well.
wix.sourceforge.net --> wix.codeplex.com/releases/view/60102
These default to non-SSL urls; try to get
https://download-codeplex.sec.s-msft.com/Download/Release?ProjectName=wix&DownloadId=204417&FileTime=129409234222130000&Build=19194
Install all components (the default setting).
(5) Update the system path to include some necessary utilities.
This is something like
Control Panel->System->Advanced System Settings->Environment
awk is in C:\Windows\SUA\bin
But, you will need to make a *copy* (not link) of it named awk.exe in
order for things to work properly. Check the permissions so that everyone
can read and execute it.
Add the directory containing hhc.exe to the path:
C:\Program Files (x86)\HTML Help Workshop
Add C:\Program Files (x86)\Windows Installer XML v3.5\bin to the path
to get candle.exe.
(6) Install a real Perl that can handle both forward-slash and backward-slash as path separators, e.g., ActivePerl or Strawberry Perl.
I used Strawberry Perl, since its installer was downloadable over SSL and
was digitally signed.
I have strawberry_perl-5.14.2.1-64bit.msi
Note that you may not have spaces in the path to the installation, so
it installs to c:\strawberry by default.

That should be enough for the build environment.

To actually build an installer, fire up the Windows SDK 7.1 command prompt.

(0) cmd /v to get delayed expansion of variables

(1) Environment set-up
set KRB_INSTALL_DIR=/path/to/an/obj/dir
[set MIT_INTERNAL=1]
[set NODEBUG=1]
\Program Files\Microsoft SDKs\Windows\v7.1\Bin\SetEnv.cmd /x86 [/release]
set CPU=i386
(2) Build the 32-bit binaries
cd /path/to/krb5-tree/src
[nmake clean]
nmake -f Makefile.in prep-windows
nmake
nmake install
(3) Build 32-bit installer
cd windows/installer/wix
[nmake clean]
nmake
rename kfw.msi kfw32.msi
(4) 64-bit build
\Program Files\Microsoft SDKs\Windows\v7.1\Bin\SetEnv.cmd /x64 [/release]
set CPU=AMD64
cd /path/to/krb5-tree/src
nmake clean
nmake -f Makefile.in prep-windows [?]
nmake
nmake install
(5) Build 64-bit installer
cd windows/installer/wix
nmake clean
nmake
rename kfw.msi kfw64.msi

Code signing

signtool sign /a /t http://timestamp.verisign.com/scripts/timstamp.dll foo.msi

You might need to add <code>/i Verisign</code> or something to select the right signing cert.

Main Page

2016-01-28T15:16:41Z

Sarah: Remove the Kerberos Consortium link.

__NOTOC__
'''K5Wiki''' is a wiki supporting the development of [[MIT Kerberos]], a reference implementation of [[wp:Kerberos (protocol)|the Kerberos network authentication protocol]].

This wiki serves both as a place for coordination of development efforts on MIT Kerberos and as a means for potential contributors and other interested people to become more involved with MIT Kerberos development. This wiki does not focus on the needs for the average end user, but it may nevertheless contain information that is useful to advanced users, such as system administrators who wish to make customizations.

What can this wiki do for you?
* I have a [[Asking questions|question]]
* I want to [[Writing applications|write Kerberos application software]]
* I want to [[Reporting bugs|report bugs]]
* I want to [[Fixing bugs|fix bugs]]
* I want to [[Learning about the code|learn more about the code]]
* I have [[Suggesting enhancements|ideas for enhancements]]
* I want to [[Contributing code|contribute code]]
* I want to [[K5Wiki:Todo|help to improve this wiki]]

== Releases ==

The current release is [http://web.mit.edu/kerberos/krb5-latest/ krb5-1.13].

* [[Release 1.13 | Release 1.13 goals]]

Additional information on future releases:

* Development [[roadmap]]
* [[Release 1.14 | Release 1.14 goals]]

== Users ==

We recommend that end users use MIT Kerberos software packages built by their operating system vendor if possible, and use support resources provided by their site or by their vendor. For those users (typically system administrators) who have a need to build MIT Kerberos from source code, we have some resources available on this wiki.

* [[Building]] the MIT Kerberos software
* [[Reporting bugs]]
* [[Suggesting enhancements]]
* More [[user resources]]

== System administrators ==

We also recommend that most system administrators use MIT Kerberos software packages from their operating system vendor if possible.

* [[Building]] the MIT Kerberos software
* [[Reporting bugs]]
* [[Suggesting enhancements]]
* [[IPv6]] support status
* Monthly [[ops feedback teleconference]]
* More [[sysadmin resources]]

== Developers ==

Developers can include end users who have a need to customize the MIT Kerberos source code, or who would like to contribute patches for new features or for bug fixes.

* [[Developer resources]]
* [[Getting source code]]
* [[Committer resources]] -- only really useful for people with commit access.

=== Contributing ===

* [[How to contribute]] to the MIT Kerberos software
* [[Fixing bugs]]
* [[Suggesting enhancements]]
* [[Contributing code]]

=== Background information ===

* [[:Category:Policies|Policies for development]]
* [[:Category:Lore|Lore]]

=== Code quality ===

* [[Coding style]]
* [[Test-driven development]]
* [[Manual_Testing|Manual testing procedures]]
* [[Cleanups|Code cleanup opportunities]]

=== Planning ===

* Development [[roadmap]]
* [[Projects]]

=== Communication ===

* [[Release_Meeting_Minutes|Release Meeting Minutes]]
* [[Developer chat]]
* [http://blog.kerberos.org/ Blog]

== Additional information ==

* [[K5Wiki:Todo|A todo list for work needing doing on this wiki]]
* [[Application_Maintenance|Notes on maintenance of the krb5 telnet/rlogin/gssftp applications]]

We look forward to your contributions to K5Wiki and MIT Kerberos.

Test suite

2015-12-08T14:47:06Z

Sarah:

[[Category:Lore]]
== Additional build requirements for running "make check" ==

The following additional software (in addition to the requirements at [[Building]]) is needed to run "make check". As for the packages listed at [[Building]], the software packages are identified by their Debian / Ubuntu package names.

* csh (for some of the Berkeley DB tests)
* dejagnu (for many dejagnu-based tests)
* expect (needed by dejagnu)
* g++ (for some API sanity checks)
* tcl (needed by expect)
* tcl-dev (to build some kadm5 test programs)

== Known test suite issues ==

Prior to krb5-1.9, on Linux systems, sometimes the <code>--disable-rpath</code> option to <code>configure</code> is required in order to avoid problems with previously-installed versions of MIT krb5. Alternatively, you can run "make install" before "make check".

Prior to krb5-1.9, calls to krb5_c_random_os_entropy that pass the value 1 in the <code>strong</code> argument (which causes the library to read from the strong OS random number source) can cause stalls and timeouts in the test suite. Changing those calls to pass 0 instead will reduce the stalls. Starting in krb5-1.9, we disable the reading of strong random numbers during tests. This is primarily a problem on Linux systems.

Prior to krb5-1.9, the test suite tripped a bug where Dejagnu breaks the autoloading required by modern versions of Tcl. This manifests as errors such as:

<pre>
ERROR: (DejaGnu) proc "::tcl::tm::UnknownHandler ::tclPkgUnknown msgcat 1.4" does not exist.
</pre>

The Dejagnu maintainers are aware of this problem (http://lists.gnu.org/archive/html/dejagnu/2011-03/msg00002.html), but as of June 2011 there doesn't seem to be a release containing the fix. Since krb5-1.9, the offending piece of Tcl code (<code>clock format [clock seconds]</code>) is no longer used. A fix has been applied to the krb5-1.8 branch as well. ({{bug|6926}})

If an existing kdc.conf exists in the "installed" location, it can disrupt the automated tests, especially if it contains syntax errors.

On older Debian or Ubuntu systems, a bug in <code>expect</code> could cause stalls in the dejagnu parts of the test suite. It is documented at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=421187. Current stable releases of Debian and Ubuntu no longer have an affected version of the <code>expect</code> package.

As of July 2012, portions of the test suite will fail if the current hostname does not properly resolve (e.g., if a hostname is set, but the IP address assigned via DHCP corresponds to a different name); setting explicit entries in <code>/etc/hosts</code> should be an effective workaround (an IPv6 entry may be needed in addition to an IPv4 entry).

As of December 2015, on Fedora Linux, portions of the test suite will fail if the current hostname is not all lower-case and is not registered in the DNS. Our hostname canonicalization procedure (krb5_sname_to_principal()) downcases the result as the last step. Fedora uses nss-myhostname to ensure that the local hostname resolves, and (for reasons we're not completely certain of) nss-myhostname does not appear to work with a different case from the canonical one.

As of December 2015, running the test suite using the make flag -j9 causes the tests to fail, specifically in the kadm5 unit-test. There seems to be some issues with the test suite and parallel processing. For now make sure to run everything in sequence.