Remove MK_GSSAPI

For MIT Kerberos, MK_GSSAPI has no meaning: GSSAPI is a required part of
Kerberos and is always built if MK_KERBEROS is enabled.  Backport this
behaviour to Heimdal so it works the same way.

While here, change Heimdal's libcom_err and compile_et to be selected by
MK_KERBEROS, not MK_KERBEROS_SUPPORT, since these are part of Kerberos
and third-party users might need it even if Kerberos support is disabled
in the base system.  This means MK_KERBEROS_SUPPORT installs the same
files with both MIT and Heimdal.

Reviewed by:	cy
Differential Revision:	https://reviews.freebsd.org/D51859

Author: llfw

Makefile.inc1

@@ -3387,7 +3387,7 @@ secure/lib/libssh__L: lib/libz__L secure/lib/libcrypto__L lib/libcrypt__L
 secure/lib/libssh__L: lib/libldns__L
 .endif
 
-.if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
+.if ${MK_KERBEROS_SUPPORT} != "no"
 .if ${MK_MITKRB5} != "no"
 secure/lib/libssh__L: krb5/lib/gssapi__L krb5/lib/krb5__L \
      krb5/lib/crypto__L krb5/util/et__L lib/libmd__L krb5/util/support__L
@@ -3446,11 +3446,9 @@ kerberos5/lib/libheimipcc__L: kerberos5/lib/libroken__L kerberos5/lib/libheimbas
 
 lib/libsqlite3__L: lib/libthr__L
 
-.if ${MK_GSSAPI} != "no"
-.if ${MK_MITKRB5} == "no"
+.if ${MK_KERBEROS} != "no" && ${MK_MITKRB5} == "no"
 _lib_libgssapi=	lib/libgssapi
 .endif
-.endif
 
 .if ${MK_KERBEROS} != "no"
 .if ${MK_MITKRB5} != "no"

UPDATING

@@ -27,6 +27,15 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 15.x IS SLOW:
 	world, or to merely disable the most expensive debugging functionality
 	at runtime, run "ln -s 'abort:false,junk:false' /etc/malloc.conf".)
 
+20250820:
+	The WITHOUT_GSSAPI src.conf knob has been removed.  This was already
+	a no-op for MIT Kerberos, so this only affects builds which set
+	WITHOUT_MITKRB5=1, in which case you now always get libgssapi.
+
+	Also, Heimdal's compile_et and libcom_err are now controlled by
+	WITHOUT_KERBEROS, not WITHOUT_KERBEROS_SUPPORT.  This matches
+	the behaviour of the MIT Kerberos versions.
+
 20250820:
 	Commits 08c7dd2fbe4f and a4197ea47777 have changed the ABI between
 	libvmmapi and the vmm device. If using a custom kernel configuration,

include/Makefile

@@ -293,7 +293,7 @@ LSUBSUBDIRS+=	netgraph/bluetooth/include
 LSUBDIRS+=	fs/cuse
 .endif
 
-.if ${MK_GSSAPI} != "no" && ${MK_MITKRB5} == "no"
+.if ${MK_KERBEROS} != "no" && ${MK_MITKRB5} == "no"
 SUBDIR+=	gssapi
 INCS+=		gssapi.h
 .endif

kerberos5/Makefile.inc

@@ -29,9 +29,7 @@ ETSRCS=	\
 	${KRB5DIR}/lib/wind/wind_err.et \
 	${KRB5DIR}/lib/ntlm/ntlm_err.et
 
-.if ${MK_GSSAPI} != "no"
 ETSRCS+=	${KRB5DIR}/lib/gssapi/krb5/gkrb5_err.et
-.endif
 
 .for ET in ${ETSRCS}
 .for _ET in ${ET:T:R}

kerberos5/lib/Makefile

@@ -7,10 +7,8 @@ SUBDIR=	libasn1 libhdb \
 SUBDIR+= libkafs5  # requires krb_err.h from libkrb5
 SUBDIR_DEPEND_libkafs5=	libkrb5
 
-.if ${MK_GSSAPI} != "no"
 SUBDIR+=	libgssapi_krb5
 SUBDIR+=	libgssapi_ntlm
 SUBDIR+=	libgssapi_spnego
-.endif
 
 .include <bsd.subdir.mk>

kerberos5/libexec/Makefile

@@ -4,8 +4,6 @@ SUBDIR=	digest-service ipropd-master ipropd-slave hprop hpropd kdc \
 	kdigest kfd kimpersonate kpasswdd kcm
 SUBDIR_PARALLEL=
 
-.if ${MK_GSSAPI} != "no"
 SUBDIR+=	kadmind
-.endif
 
 .include <bsd.subdir.mk>

lib/Makefile

@@ -179,12 +179,12 @@ SUBDIR.${MK_FDT}+=	libfdt
 SUBDIR.${MK_FILE}+=	libmagic
 SUBDIR.${MK_GPIO}+=	libgpio
 .if ${MK_MITKRB5} == "no"
-SUBDIR.${MK_GSSAPI}+=	libgssapi
+SUBDIR.${MK_KERBEROS}+=	libgssapi
 .endif
-SUBDIR.${MK_GSSAPI}+=	librpcsec_gss
+SUBDIR.${MK_KERBEROS}+=	librpcsec_gss
 SUBDIR.${MK_ICONV}+=	libiconv_modules
 .if ${MK_MITKRB5} == "no"
-SUBDIR.${MK_KERBEROS_SUPPORT}+=	libcom_err
+SUBDIR.${MK_KERBEROS}+=	libcom_err
 .endif
 SUBDIR.${MK_LDNS}+=	libldns
 SUBDIR.${MK_STATS}+=	libstats

libexec/rc/rc.d/Makefile

@@ -215,7 +215,7 @@ FTPD=		ftpd
 FTPDPACKAGE=	ftpd
 .endif
 
-.if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
+.if ${MK_KERBEROS_SUPPORT} != "no"
 CONFGROUPS+=	GSSD
 GSSD=		gssd
 GSSDPACKAGE=	gssd

secure/libexec/sshd-session/Makefile

@@ -38,7 +38,7 @@ LIBADD+= blacklist
 LDFLAGS+=-L${LIBBLACKLISTDIR}
 .endif
 
-.if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
+.if ${MK_KERBEROS_SUPPORT} != "no"
 .if ${MK_MITKRB5} != "no"
 LIBADD+=	gssapi_krb5 krb5
 .include "../../krb5/Makefile.inc"

secure/ssh.mk

@@ -9,12 +9,11 @@ SKSRCS=	ssh-sk-client.c
 
 CFLAGS+= -I${SSHDIR} -include ssh_namespace.h
 
-.if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
+.if ${MK_KERBEROS_SUPPORT} != "no"
 CFLAGS+= -include krb5_config.h
 .if ${MK_MITKRB5} == "no"
 CFLAGS+= -DHEIMDAL=1
 .endif
-
 .endif
 
 CFLAGS+= -DXAUTH_PATH=\"${LOCALBASE:U/usr/local}/bin/xauth\"