Install $(SYSCONFDIR)/gss/mech automatically with DEB/RPM package

[Stefan Paetow]

To make things more 'automated' with less manual configuration, it would be nice to have the "mech" file automatically installed into the right location for the platform.

On RHEL/CentOS: /etc/gss
On Debian/Ubuntu: /usr/etc/gss

Just raising it in Launchpad so that we remember to do this at some point or another :-)

Optional: This *could* also include radsec.conf?

[Sam Hartman (hartmans)]

It's generally a bad idea for a package to directly include a
configuration file of broader scope than itself.
/etc/gss/mech really belongs to the krb5-libs package on Centos.

It seems fine though for the %post action on moonshot-gss-eap to
add the appropriate lines to /etc/gss/mech if they are not already
there.

We can do a similar thing for Debian as an interim measure, but the
correct fix from Debian policy standpoint is to create /etc/gss/mech.d
and drop a file there.
That will require a patch to krb5.

[Stefan Paetow (stefan-paetow)]

Ok, If the %post action in moonshot-gss-eap were to add lines to the file if they don't exist, would it make sense to add the file with those lines in place if the file itself does not exist? Or do we remain stuck with the "the file is not moonshot-gss-eap's to create" situation?

[Sam Hartman (hartmans)]

This is fixed for Centos/RPM in 2707e7473b8b85fa46033a8ff7cfa126384ac8d9 which is 0.9-7 coming to a repo near you soon. Not yet fixed for deb .

[Sam Hartman (hartmans)]

Recently (krb5 1.12.1+dfsg-2), the infrastructure in debian for dealing with this gracefully was added. That opens the way for fixing this in the moonshot debian package. We plan two approaches
1) if you have a new enough krb5 it will just drop a file in /etc/gss/mech.d
2) for older krb5, we'll handle /usr/etc/gss/mech

[Sam Hartman (hartmans)]

As mentioned, already fixed for rpm. The moonshot-gss-eap 0.9.2-1 Debian package checks the presence of /etc/gss/mech.d/README. Sufficiently new krb5 will create that file and will honor /etc/gss/mech.d/moonshot-gss-eap populated by this package. However if that's not present then we will manipulate /usr/etc/gss/mech