gssapi: add support for Apple GSS Framework#22052
Closed
vszakats wants to merge 28 commits into
Closed
Conversation
vszakats
added
build
cmake
authentication
CI
vszakats
added
the
feature-window
vszakats
changed the title
There was a problem hiding this comment.
Pull request overview
Adds a new CMake-selectable GSSAPI “Apple” flavor to support Apple’s native GSS framework on Apple targets, aiming to avoid the deprecated MIT Kerberos compatibility shim on macOS.
Changes:
- Introduces
HAVE_GSSAPPLEand adjusts header selection and version string reporting to identify “AppleGSS”. - Extends the CMake GSS detection module to accept a requested flavor and wires it through the build and exported CMake package config.
- Updates macOS CI workflows and CMake install docs to exercise/document the new flavor knob.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| lib/version.c | Adds “AppleGSS” to the curl -V feature/version string when Apple GSS is selected. |
| lib/vauth/spnego_gssapi.c | Avoids Apple deprecation-warning suppression when building with AppleGSS. |
| lib/vauth/krb5_gssapi.c | Same as above for Kerberos GSSAPI auth implementation. |
| lib/urldata.h | Switches to Apple framework GSS headers when HAVE_GSSAPPLE is defined. |
| lib/socks_gssapi.c | Avoids Apple deprecation-warning suppression when building with AppleGSS. |
| lib/curl_gssapi.c | Avoids Apple deprecation-warning suppression when building with AppleGSS. |
| lib/curl_config-cmake.h.in | Adds HAVE_GSSAPPLE CMake config header define. |
| docs/INSTALL-CMAKE.md | Documents CURL_GSS_FLAVOR for selecting Apple GSS. |
| CMakeLists.txt | Passes selected GSS flavor into find_package(GSS ...) and sets HAVE_GSSAPPLE based on detected flavor. |
| CMake/FindGSS.cmake | Adds Apple-flavor selection support to GSS detection logic. |
| CMake/curl-config.in.cmake | Propagates detected GSS flavor to consumers via find_dependency(GSS ...). |
| .github/workflows/macos.yml | Enables Apple GSS flavor in macOS CI CMake jobs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
vszakats
added a commit
that referenced
this pull request
Jun 16, 2026
To match the non-pkg-config path, and also suspected user expectation. This comes with a small incompatibility in return for more consistency. Bug: #22052 (comment) Follow-up to 9e19a57 #15176 Closes #22053
Comment on lines
+72
to
+76
| if(GSS_FIND_COMPONENTS STREQUAL "Apple") | ||
| find_path(_gss_INCLUDE_DIRS NAMES "GSS/gssapi.h" PATH_SUFFIXES "include") | ||
| find_library(_gss_LIBRARIES NAMES "GSS") | ||
|
|
||
| execute_process(COMMAND ${_gss_configure_script} "--libs" "gssapi" | ||
| OUTPUT_VARIABLE _gss_lib_flags | ||
| RESULT_VARIABLE _gss_configure_failed | ||
| OUTPUT_STRIP_TRAILING_WHITESPACE) | ||
| message(STATUS "FindGSS krb5-config --libs: ${_gss_lib_flags}") | ||
|
|
||
| if(NOT _gss_configure_failed) # 0 means success | ||
| # This script gives us libraries and link directories. | ||
| string(STRIP "${_gss_lib_flags}" _gss_lib_flags) | ||
| string(REGEX REPLACE " +-(L|l)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}") | ||
| string(REGEX REPLACE " +-([^Ll][^ \\t;]*)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}") | ||
|
|
||
| foreach(_flag IN LISTS _gss_lib_flags) | ||
| if(_flag MATCHES "^-l") | ||
| string(REGEX REPLACE "^-l" "" _flag "${_flag}") | ||
| list(APPEND _gss_LIBRARIES "${_flag}") | ||
| elseif(_flag MATCHES "^-L") | ||
| string(REGEX REPLACE "^-L" "" _flag "${_flag}") | ||
| list(APPEND _gss_LIBRARY_DIRS "${_flag}") | ||
| endif() | ||
| endforeach() | ||
| if(_gss_INCLUDE_DIRS AND _gss_LIBRARIES) |
Member
Author
There was a problem hiding this comment.
Indeed, though the "unknown" comment is already not satisfied for
any of the cases. Only MIT (and likely on Windows only) would return
"MIT Unknown", but even this diverges from all other Find modules,
which return an empty string in similar cases.
I propose to fix documentation and drop the outlier fallback value
in PR #22071.
vszakats
added a commit
that referenced
this pull request
Jun 17, 2026
After this patch the `GSS_VERSION` value is left empty in all cases when there is known version number (potentially on Windows). Also: - sync `GSS_FOUND` comment with other Find modules. - sync `GSS_VERSION` comment with other Find modules, drop the promise of returning "unknown", which was not true and also not done by other Find modules. - tidy up Windows-registry-based MIT `GSS_VERSION` detection, by guarding the whole block for `WIN32`. - drop fallback version value `MIT Unknown` used for MIT. - fix vertical alignment in comment block. Changing CMake log output like so (in affected config): ``` -- Found GSS: MIT (found version "MIT Unknown") ``` -> ``` -- Found GSS: MIT ``` Spotted by Copilot Bug: #22052 (comment) Follow-up to 558814e Closes #22071
…AppleGSS is user-selected
This reverts commit 8cca323428d21fe5ba6f987301c818be9644a6eb. Using GSSAPI everywhere would be nicer IMO, since it matches macros and other symbols too, also easier to type, shorter and it's the primary name on the wiki page: https://en.wikipedia.org/wiki/Generic_Security_Services_Application_Programming_Interface on the other hand RFC's consistently say GSS-API: https://www.rfc-editor.org/info/rfc2743/ Either way, remain consistent with surrounding code for now.
It results in the exact same `--debug-find` output, as tested on a system with case-insensitive FS. Keep uppercase to maybe help case-sensitive ones, and a better convey this is a Framework. We also use case-matched framework names elsewhere in the code. (except for LDAP)
To stay within cmake line limit and to not trip pyspelling.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add support for the native GSS Framework on Apple targets, which is
Apple's fork of Heimdal. This option allows to drop Apple's deprecated
MIT Kerberos compatibility shim "mit-krb5/1.7-prerelease".
Source code uses different headers, other than that no source changes
are necessary.
You can enable by configuring with:
autotools:
--enable-gssapi-appleCMake:
-DCURL_USE_GSSAPI=ON -DCURL_GSS_FLAVOR=AppleThese options are experimental, and may receive breaking updates till
the GSS backend selection logic settles, for Apple and also for the GNU
and MIT implementation.
Version string:
Also:
Supported by:
iOS 5.0+, iPadOS 5.0+, Mac Catalyst 13.0+, macOS 10.14+, visionOS 1.0+
Ref: https://developer.apple.com/documentation/gss
Ref: #19109
https://github.com/curl/curl/pull/22052/files?w=1
MITandGSSvalues forCURL_GSS_FLAVORand the necerrary logic. [→ FUTURE PR]Possibly separate Find modules would be nice, with a clear way to manually enable one
of them, or let the build pick one automatically for compatibility.