`jcmturner/gokrb5` is no more maintained

[khushijain21]

https://github.com/jcmturner/gokrb5 is not maintained anymore.

It also contains a bug where if the Kafka server sends multiple authentication headers - the kerberos client will only read the first header to decide if it should use kerberos authentication or not.

Ideally, it should look for "Negotiate" in all the headers received. See https://github.com/jcmturner/gokrb5/blob/master/v8/spnego/http.go#L160

[dnwe]

Yes, https://github.com/jcmturner/gokrb5 does appear to be largely unmaintained. The last significant activity was around 2023, with no new releases or major commits in recent years, and scanners like Snyk do classify it as inactive. Despite this, gokrb5 remains the most comprehensive and widely adopted pure-Go Kerberos 5 implementation and there aren't any obvious replacements to switch to right now sadly

[a-kr]

gokrb5 has lots of recent forks to choose from. https://github.com/go-krb5/krb5 might be a good choice since it is not a personal repo but belongs to a dedicated Github organization, increasing its chances of being maintained in the future. They have also updated the dependencies, including golang.org/x/crypto. I'd like to point out that using IBM/sarama presently trips some security scanners since it causes an ancient v0.6.0 of the crypto package to be pulled as an indirect dependency from gokrb5.

Sticking with https://github.com/jcmturner/gokrb5 makes little sense at this point.

[puellanivis]

Note, that we can always force a non-updated module to use a more recent dependency by updating our own dependency.

In particular, we’re already doing that, pulling in:

	golang.org/x/crypto v0.45.0 // indirect

[a-kr]

True! The go.sum file still contains a v0.6.0 entry though, and that's where some scanners look. Anyway, that is a minor inconvenience compared to other problems of using an old unmaintained package.

[puellanivis]

True! The go.sum file still contains a v0.6.0 entry though, and that's where some scanners look. Anyway, that is a minor inconvenience compared to other problems of using an old unmaintained package.

Of course at least some of them are looking at the go.sum. 🤦‍♀️ Good thing we’re actually usually cleaning it up, rather than it just being append-only like when it was originally introduced.