(define-module (gnu packages kdc)
  #:use-module ((guix licenses) #:prefix license:)
  #:use-module (gnu packages tls)
  #:use-module (gnu packages bison)
  #:use-module (gnu packages readline)
  #:use-module (gnu packages perl)
  #:use-module (gnu packages tcl)
  #:use-module (gnu packages slapd)
  #:use-module (gnu packages)
  #:use-module (guix packages)
  #:use-module (guix download)
  #:use-module (guix utils)
  #:use-module (guix build-system gnu)
  #:use-module (guix gexp)

  #:export (mit-krb5-ldap))

(define-public mit-krb5-ldap
  (package
    (name "mit-krb5-ldap")
    (version "1.20")
    (source (origin
              (method url-fetch)
              (uri (list (string-append
                          "https://web.mit.edu/kerberos/dist/krb5/"
                          (version-major+minor version) "/krb5-" version
                          ".tar.gz")
                         (string-append "https://kerberos.org/dist/krb5/"
                                        (version-major+minor version) "/krb5-"
                                        version ".tar.gz")))
              (patches (search-patches "mit-krb5-hurd.patch"))
              (sha256
               (base32
                "0bz16sh0vgzlpy2kx5acmpyy181hl83a1alz7wbk06457kfjn0ky"))))
    (build-system gnu-build-system)
    (native-inputs (list bison perl tcl openldap-slapd)) ;required for some tests, openldap is required to compile kldap.so
    (inputs (list openssl readline))
    (arguments
     `( ;XXX: On 32-bit systems, 'kdb5_util' hangs on an fcntl/F_SETLKW call
       ;; while running the tests in 'src/tests'. Also disable tests when
       ;; cross-compiling.
       #:tests? ,(and (not (%current-target-system))
                      (string=? (%current-system) "x86_64-linux"))

       ,@(if (%current-target-system)
             '(#:configure-flags (list "--localstatedir=/var"
                                  "--with-readline"
                                  "--with-ldap"
                                  "krb5_cv_attr_constructor_destructor=yes"
                                  "ac_cv_func_regcomp=yes"
                                  "ac_cv_printf_positional=yes"
                                  "ac_cv_file__etc_environment=yes"
                                  "ac_cv_file__etc_TIMEZONE=no")
               #:make-flags (list "CFLAGS+=-DDESTRUCTOR_ATTR_WORKS=1"))
             '(#:configure-flags (list "--with-tls-impl=openssl"
                                       "--with-readline" "--with-ldap"
                                       "--localstatedir=/var")))
       #:phases (modify-phases %standard-phases
                  (add-after 'unpack 'enter-source-directory
                    (lambda _
                      (chdir "src")))
                  (add-before 'check 'pre-check
                    (lambda* (#:key inputs native-inputs #:allow-other-keys)
                      (let ((perl (search-input-file (or native-inputs inputs)
                                                     "bin/perl")))
                        (substitute* "plugins/kdb/db2/libdb2/test/run.test"
                          (("/bin/cat")
                           perl)
                          (("D/bin/sh")
                           (string-append "D"
                                          (which "sh")))
                          (("bindir=/bin/.")
                           (string-append "bindir="
                                          (dirname perl))))))))))
    (synopsis "MIT Kerberos 5")
    (description
     "Massachusetts Institute of Technology implementation of Kerberos.
                   Kerberos is a network authentication protocol designed to provide strong
                   authentication for client/server applications by using secret-key
                   cryptography.")
    (license (license:non-copyleft "file://NOTICE"
                                   "See NOTICE in the distribution."))
    (home-page "https://web.mit.edu/kerberos/")
    (properties '((cpe-name . "kerberos")))))