ignore_realm not available with older Heimdal

[UnitedMarsupials]

The older versions of Heimdal, such as that in FreeBSD base OS, do not declare the KRB5_PRINCIPAL_PARSE_IGNORE_REALM at all.

Currently, the security/py-krb5 port patches the two _principal.py[ix] files to remove any mention of the identifier.

This allows the code to compile, but the tests involving the ignore_realm fail. They, probably, should not -- the test suit should be able to detect the older Hemdal implementation and skip these tests instead of failing them.

Also: how would I run the bundled self-tests non-interactively? When I invoke python3.11 -m pytest -v --junitxml junit/test-results.xml < /dev/null I still get prompted for "Master key":

========================================================= test session starts =========================================================
platform freebsd14 -- Python 3.11.11, pytest-8.1.1, pluggy-1.5.0 -- /opt/bin/python3.11
cachedir: .pytest_cache
rootdir: /envy/ports/security/py-krb5/work-py311/krb5-0.7.1
configfile: pyproject.toml
testpaths: tests
plugins: anyio-4.8.0
collected 94 items                                                                                                                    

tests/test_ccache.py::test_cc_default Master key: 

[jborean93]

The version of Heimdal used by the base FreeBSD is quite old (IIRC it's from 2012) and not something I test or guarantee to work. If FreeBSD wants to get that working then they'll have to continue patching the code and tests and any other changes to get it working. Otherwise you really should be using their port pkg which is based on the currently latest 7.8 version which is tested and supported.

Also: how would I run the bundled self-tests non-interactively? When I invoke python3.11 -m pytest -v --junitxml junit/test-results.xml < /dev/null I still get prompted for "Master key":

I'm not sure what is causing that prompt, most like the commands run by k5test are calling things like setting up the KDC in a way that isn't supported by the old version of Heimdal.

[UnitedMarsupials]

they'll have to continue patching the code

The ultimate goal of every patch is for it to eventually make its way to the upstream :-)

[jborean93]

The issue I see is;

• The version is from 2012, we should not be helping people use security software from that time, there's been so many improvements and fixes since then
• We cannot test this out in CI so any changes could be reverted in the future or made worse in the future
• The burden will now be on me to ensure that any future additions don't break the older version, without CI this is just too hard to do

The packager is really the one who will be testing these changes on the OS they are packaging for and how they are modified to do so. Maybe I would accept tiny patches to make their life easier but it would be a case by case thing and dependent on what the actual PR is changing.