feat(prebuilt): add krb5-gss, a runtime-only GSSAPI shim - #4
Merged
Conversation
A payload that bundles its own Qt built with the GSSAPI feature carries a hard DT_NEEDED on libgssapi_krb5.so.2 in libQt6Network, and org.freedesktop.Platform//25.08 ships no krb5 at all — the loader fails on libQt6Network and the app never starts, whether or not anything ever authenticates with Kerberos. First consumer: com.interactivebrokers.ibkrdesktop. The stack ships only the load-time closure of libgssapi_krb5.so.2. A full `make install` also lays down the KDC and kadmin libraries, the lib/krb5 plugin tree, headers, man pages and translations; dropping them takes it from ~13 MB to 6.6 MB. Meant to be consumed as extra-data rather than as a build-time archive module, so the bytes travel over GitHub's bandwidth at install time instead of entering FlatPark's OSTree repository — documented in the README. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
com.interactivebrokers.ibkrdesktopbundles Qt 6.8.3, and IBKR's build oflibQt6Networkcarries a hardDT_NEEDEDonlibgssapi_krb5.so.2:org.freedesktop.Platform//25.08ships no krb5 at all, so without it the loader fails onlibQt6Networkand the app never draws a window — a link-time dependency, unrelated to whether anyone authenticates with Kerberos.Today that app compiles krb5 from source on every build and ships the result inside its OSTree commit. This stack replaces that.
Scope. Only the load-time closure of
libgssapi_krb5.so.2:A full
make installalso lays down the KDC/kadmin libraries (libkdb5,libkadm5srv,libkadm5clnt,libgssrpc,libkrad,libverto), thelib/krb5plugin tree, headers, man pages, pkg-config files and translations — none of which a client-side GSSAPI consumer opens. Dropping them: ~13 MB -> 6.6 MB (1.9 MB compressed).Consumed as extra-data, not as an archive build module, so the archive is fetched from this repository's release at install time and never enters FlatPark's OSTree repository. With a single consumer, content addressing has nothing to deduplicate, so keeping it out of the repo is the only way to not pay for it. The README gains a section on the two consumption modes.
Verified locally against
org.freedesktop.Sdk//25.08:NEEDEDoutside the set islibresolv/libc, both in the PlatformRPATH/RUNPATHon any library, soLD_LIBRARY_PATHgoverns cleanly/app/extra/krb5-gss/, IBKR'slibQt6Networkresolveslibgssapi_krb5.so.2 => /app/extra/krb5-gss/lib/libgssapi_krb5.so.2, and the app launches🤖 Generated with Claude Code