···2020, pam
2121, etcDir ? null
2222, withKerberos ? true
2323-, kerberos
2323+, libkrb5
2424, libfido2
2525, withFIDO ? stdenv.hostPlatform.isUnix && !stdenv.hostPlatform.isMusl
2626, linkOpenssl ? true
···4545 '';
46464747 nativeBuildInputs = [ pkg-config ]
4848- # This is not the same as the kerberos from the inputs! pkgs.kerberos is
4848+ # This is not the same as the libkrb5 from the inputs! pkgs.libkrb5 is
4949 # needed here to access krb5-config in order to cross compile. See:
5050 # https://github.com/NixOS/nixpkgs/pull/107606
5151- ++ optional withKerberos pkgs.kerberos
5151+ ++ optional withKerberos pkgs.libkrb5
5252 ++ extraNativeBuildInputs;
5353 buildInputs = [ zlib openssl libedit ]
5454 ++ optional withFIDO libfido2
5555- ++ optional withKerberos kerberos
5555+ ++ optional withKerberos libkrb5
5656 ++ optional stdenv.isLinux pam;
57575858 preConfigure = ''
···7070 # Kerberos can be found either by krb5-config or by fall-back shell
7171 # code in openssh's configure.ac. Neither of them support static
7272 # build, but patching code for krb5-config is simpler, so to get it
7373- # into PATH, kerberos.dev is added into buildInputs.
7373+ # into PATH, libkrb5.dev is added into buildInputs.
7474 + optionalString stdenv.hostPlatform.isStatic ''
7575 sed -i "s,PKGCONFIG --libs,PKGCONFIG --libs --static,g" configure
7676 sed -i 's#KRB5CONF --libs`#KRB5CONF --libs` -lkrb5support -lkeyutils#g' configure
···8989 (if stdenv.isLinux then "--with-pam" else "--without-pam")
9090 ] ++ optional (etcDir != null) "--sysconfdir=${etcDir}"
9191 ++ optional withFIDO "--with-security-key-builtin=yes"
9292- ++ optional withKerberos (assert kerberos != null; "--with-kerberos5=${kerberos}")
9292+ ++ optional withKerberos (assert libkrb5 != null; "--with-kerberos5=${libkrb5}")
9393 ++ optional stdenv.isDarwin "--disable-libutil"
9494 ++ optional (!linkOpenssl) "--without-openssl";
9595