[PECL-CVS] [pecl-authentication-krb5] master: config.m4: switch to pkg-config for clean LDFLAGS/LIBS separation

Author: David Härdeman (Alphix)
Committer: Moritz Bechler (mbechler)
Date: 2026-06-08T17:26:38+02:00

Commit: https://github.com/php/pecl-authentication-krb5/commit/4a2f6d0ef5a6de3e7de9a16d892b63fb6f48f89b
Raw diff: https://github.com/php/pecl-authentication-krb5/commit/4a2f6d0ef5a6de3e7de9a16d892b63fb6f48f89b.diff

config.m4: switch to pkg-config for clean LDFLAGS/LIBS separation

pkg-config supports --libs-only-L and --libs-only-l which cleanly
separate -L path flags (LDFLAGS) from -l library flags (LIBS) without
any shell parsing.  autoconf places LDFLAGS before the test object and
LIBS after it; with --as-needed (Debian default) a library in LDFLAGS
is scanned before references are visible and gets silently dropped,
causing all AC_CHECK_FUNCS calls to return "no".  The split fixes this.

Both mit-krb5-gssapi and mit-krb5 are queried: the former only lists
-lgssapi_krb5 directly; adding mit-krb5 brings in -lkrb5 -lk5crypto
-lcom_err which are needed for functions like krb5_free_string.

Removes the --with-krb5config option; users with non-standard install
paths can set PKG_CONFIG_PATH instead.

Changed paths:
  M  config.m4


Diff:

diff --git a/config.m4 b/config.m4
index 40f2e7c..ea63987 100644
--- a/config.m4
+++ b/config.m4
@@ -2,11 +2,6 @@ PHP_ARG_WITH(krb5, for kerberos support,
  [  --with-krb5             Include generic kerberos5/GSSAPI support]
  )
 
-PHP_ARG_WITH(krb5config, path to krb5config tool,
- [  --with-krb5config       Path to krb5config tool],
- no, no
- )
-
 PHP_ARG_WITH(krb5kadm, for kerberos KADM5 support,
  [  --with-krb5kadm[=S]      Include KADM5 Kerberos Administration Support - MIT only],
  no, no
@@ -14,40 +9,44 @@ PHP_ARG_WITH(krb5kadm, for kerberos KADM5 support,
 
 if test "$PHP_KRB5" != "no" -o "$PHP_KRB5KADM" != "no"; then
 
-
-	if test "$PHP_KRB5CONFIG" == "no"; then
-		PHP_KRB5CONFIG=`which krb5-config`
+	AC_PATH_PROG(PKG_CONFIG, pkg-config, no)
+	if test "${PKG_CONFIG}" = "no"; then
+		AC_MSG_ERROR([pkg-config is required to build the krb5 extension])
 	fi
 
-	AC_MSG_CHECKING([whether we have krb5config])
-
-	if test -x $PHP_KRB5CONFIG; then
-		AC_MSG_RESULT($PHP_KRB5CONFIG)
+	AC_MSG_CHECKING([for mit-krb5-gssapi via pkg-config])
+	if ${PKG_CONFIG} --exists mit-krb5-gssapi mit-krb5; then
+		AC_MSG_RESULT([yes])
 	else
-		AC_MSG_ERROR([no])
-		exit
+		AC_MSG_ERROR([mit-krb5-gssapi or mit-krb5 not found -- install libkrb5-dev or equivalent])
 	fi
 
-
-
 	if test "$PHP_KRB5KADM" != "no"; then
-		KRB5_LDFLAGS=`$PHP_KRB5CONFIG --libs krb5 gssapi kadm-client`
-		KRB5_CFLAGS=`$PHP_KRB5CONFIG --cflags krb5 gssapi kadm-client`
+		dnl Try kadm-client via pkg-config; fall back to the MIT library name.
+		if ${PKG_CONFIG} --exists kadm-client 2>/dev/null; then
+			KRB5_LDFLAGS=`${PKG_CONFIG} --libs-only-L mit-krb5-gssapi mit-krb5 kadm-client`
+			KRB5_LIBS=`${PKG_CONFIG} --libs-only-l mit-krb5-gssapi mit-krb5 kadm-client`
+			KRB5_CFLAGS=`${PKG_CONFIG} --cflags mit-krb5-gssapi mit-krb5 kadm-client`
+		else
+			KRB5_LDFLAGS=`${PKG_CONFIG} --libs-only-L mit-krb5-gssapi mit-krb5`
+			KRB5_LIBS="`${PKG_CONFIG} --libs-only-l mit-krb5-gssapi mit-krb5` -lkadm5clnt_mit"
+			KRB5_CFLAGS=`${PKG_CONFIG} --cflags mit-krb5-gssapi mit-krb5`
+		fi
 	else
-		KRB5_LDFLAGS=`$PHP_KRB5CONFIG --libs krb5 gssapi`
-		KRB5_CFLAGS=`$PHP_KRB5CONFIG --cflags krb5 gssapi`
+		KRB5_LDFLAGS=`${PKG_CONFIG} --libs-only-L mit-krb5-gssapi mit-krb5`
+		KRB5_LIBS=`${PKG_CONFIG} --libs-only-l mit-krb5-gssapi mit-krb5`
+		KRB5_CFLAGS=`${PKG_CONFIG} --cflags mit-krb5-gssapi mit-krb5`
 	fi
 
 	AC_MSG_CHECKING([for required linker flags])
-	AC_MSG_RESULT($KRB5_LDFLAGS)
+	AC_MSG_RESULT([$KRB5_LDFLAGS $KRB5_LIBS])
 
 	AC_MSG_CHECKING([for required compiler flags])
-	AC_MSG_RESULT($KRB5_CFLAGS)
-
-	KRB5_VERSION=`$PHP_KRB5CONFIG --version`
+	AC_MSG_RESULT([$KRB5_CFLAGS])
 
+	KRB5_VERSION=`${PKG_CONFIG} --modversion mit-krb5-gssapi`
 	AC_MSG_CHECKING([for kerberos library version])
-	AC_MSG_RESULT($KRB5_VERSION)
+	AC_MSG_RESULT([$KRB5_VERSION])
 	AC_DEFINE_UNQUOTED(KRB5_VERSION, ["$KRB5_VERSION"], [Kerberos library version])
 
 	SOURCE_FILES="krb5.c negotiate_auth.c gssapi.c channel.c"
@@ -59,6 +58,7 @@ if test "$PHP_KRB5" != "no" -o "$PHP_KRB5KADM" != "no"; then
 
 	CFLAGS="-Wall ${CFLAGS} ${KRB5_CFLAGS}"
 	LDFLAGS="${LDFLAGS} ${KRB5_LDFLAGS}"
+	LIBS="${LIBS} ${KRB5_LIBS}"
 
 	AC_CHECK_FUNCS(krb5_free_string)
 	AC_CHECK_FUNCS(gss_acquire_cred_from)