this is old beer...krb5* stuff is one of the few packages which has a static search path compiled in in the binary/object. reason is that some stuff exist both in aix and in the toolbox universe.

for example:

root@nimvie: /root # dump -Xany -TvH /opt/freeware/lib/libcom_err.a

/opt/freeware/lib/libcom_err.a[libcom_err.so]:

                        ***Loader Section***
                      Loader Header Information
VERSION#         #SYMtableENT     #RELOCent        LENidSTR
0x00000001       0x00000028       0x00000050       0x00000111

#IMPfilID        OFFidSTR         LENstrTBL        OFFstrTBL
0x00000007       0x000007a0       0x00000209       0x000008b1


                        ***Import File Strings***
INDEX  PATH                          BASE                MEMBER
0      ../../lib:/opt/freeware/lib:/opt/freeware/lib/gcc/powerpc-ibm-aix6.1.0.0/8.3.0:/opt/freeware/lib/gcc/powerpc-ibm-aix6.1.0.0/8.3.0/../../..:/usr/lib:/lib
1                                    libkrb5support.so
2                                    libintl.a           libintl.so.8
3                                    libpthreads.a       shr_xpg5.o
4                                    libc.a              shr.o
5                                    libgcc_s.a          shr.o
6                                    librtl.a            shr.o
​

root@nimvie: /root # dump -Xany -TvH /opt/freeware/bin/curl

/opt/freeware/bin/curl:

                        ***Loader Section***
                      Loader Header Information
VERSION#         #SYMtableENT     #RELOCent        LENidSTR
0x00000001       0x00000090       0x00000676       0x000001cc

#IMPfilID        OFFidSTR         LENstrTBL        OFFstrTBL
0x0000000c       0x00007518       0x00000889       0x000076e4


                        ***Import File Strings***
INDEX  PATH                          BASE                MEMBER
0      /opt/freeware/lib64:/opt/freeware/lib64:/opt/freeware/lib:/usr/lib:/lib
1                                    libc.a              shr_64.o
2                                    libpthreads.a       shr_xpg5_64.o
3                                    libcurl.a           libcurl.so.4
4                                    libz.a              libz.so.1
5                                    libssh2.a           libssh2.so.1
6      /opt/freeware/lib             libgssapi_krb5.a    libgssapi_krb5.so
7      /opt/freeware/lib             libkrb5.a           libkrb5.so
8      /opt/freeware/lib             libk5crypto.a       libk5crypto.so
9      /opt/freeware/lib             libcom_err.a        libcom_err.so
10     /opt/freeware/lib             liblber.a           liblber-2.4.so.2
11     /opt/freeware/lib             libldap.a           libldap-2.4.so.2
​

------------------------------
I regret starting this entire conversation
------------------------------

Original Message:
Sent: Mon October 03, 2022 06:44 PM
From: Ben Cowan
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

I'm not sure I understand this yet, but here is what I'm seeing:

After upgrading to krb5-libs-1.18.5-1, curl generates the following error under certain circumstances:

exec(): 0509-036 Cannot load program curl because of the following errors:

        0509-130 Symbol resolution failed for /opt/freeware/lib64/libkrb5support.so because:

        0509-136   Symbol _GLOBAL__AIXI_libintl_so (number 58) is not exported from

                   dependent module /usr/lib/libintl.a[libintl.so.8].

        0509-136   Symbol _GLOBAL__AIXD_libintl_so (number 59) is not exported from

                   dependent module /usr/lib/libintl.a[libintl.so.8].

        0509-192 Examine .loader section symbols with the

                 'dump -Tv' command.

This only occurs if one of the following is true:

1. LIBPATH includes /usr/lib, but not /opt/freeware/lib
2. LIBPATH includes /usr/lib, and it precedes /opt/freeware/lib

Obviously, the solution is to place /opt/freeware/lib ahead of /usr/lib, however, I don't understand why this did not occur before.  If I downgrade krb5-libs to 1.18.4-1, I do not get the error.

 

The only reason I discovered this is that our Oracle Peoplesoft process scheduler runs curl and it generates a LIBPATH that contains /usr/lib, but not /opt/freeware/lib.  It never had a problem until now.

 

Help me understand...

 

Regards,

Ben Cowan

PUBLIC RECORDS NOTICE: In accordance with NRS Chapter 239, this email and responses, unless otherwise made confidential by law, may be subject to the Nevada Public Records laws and may be disclosed to the public upon request.

AIX toolbox packages provides library search path inside them but if a LIBPATH is set then it is overwritten and LIBPATH is followed.
libintl.a is provided both by base AIX (in /usr/lib) and by AIX toolbox (in /opt/freeware/lib). If LIBPATH is not set then krb libraries picks /opt/freeware/lib/libintl.a 
that is used to build it and tested against. But if LIBPATH is set to /usr/lib then /usr/lib/libintl.a is used and that does not have symbol needed for krb5.
We always recommend to not to set any LIBPATH when using AIX toolbox packages as we try to set those in objects.
But I am still wondering why 1.18.4-1 is working as both has same loader section.

------------------------------
SANKET RATHI
------------------------------

Original Message:
Sent: Mon October 03, 2022 06:44 PM
From: Ben Cowan
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

I'm not sure I understand this yet, but here is what I'm seeing:

After upgrading to krb5-libs-1.18.5-1, curl generates the following error under certain circumstances:

exec(): 0509-036 Cannot load program curl because of the following errors:

        0509-130 Symbol resolution failed for /opt/freeware/lib64/libkrb5support.so because:

        0509-136   Symbol _GLOBAL__AIXI_libintl_so (number 58) is not exported from

                   dependent module /usr/lib/libintl.a[libintl.so.8].

        0509-136   Symbol _GLOBAL__AIXD_libintl_so (number 59) is not exported from

                   dependent module /usr/lib/libintl.a[libintl.so.8].

        0509-192 Examine .loader section symbols with the

                 'dump -Tv' command.

This only occurs if one of the following is true:

1. LIBPATH includes /usr/lib, but not /opt/freeware/lib
2. LIBPATH includes /usr/lib, and it precedes /opt/freeware/lib

Obviously, the solution is to place /opt/freeware/lib ahead of /usr/lib, however, I don't understand why this did not occur before.  If I downgrade krb5-libs to 1.18.4-1, I do not get the error.

The only reason I discovered this is that our Oracle Peoplesoft process scheduler runs curl and it generates a LIBPATH that contains /usr/lib, but not /opt/freeware/lib.  It never had a problem until now.

Help me understand...

Regards,

Ben Cowan

PUBLIC RECORDS NOTICE: In accordance with NRS Chapter 239, this email and responses, unless otherwise made confidential by law, may be subject to the Nevada Public Records laws and may be disclosed to the public upon request.

So before this gets swept into the dust bin of history...

Can we confirm that this behavior by krb5-libs honoring a mis-configured LIBPATH is working properly as designed and previous versions were broken (disregarding LIBPATH)?   ...or is there a problem?

My Oracle Peoplesoft applications folks can't seem to tell me where the process scheduler is getting it's LIBPATH.  It looks like it is coming from a table entry that I don't have access to.  I was able to provide a workaround for them (curl = '/bin/sh LIBPATH=; curl'), but they won't let me update krb5-libs, until I  explain why they never had this issue before.

------------------------------
Ben Cowan
------------------------------

Original Message:
Sent: Tue October 04, 2022 04:26 AM
From: SANKET RATHI
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

AIX toolbox packages provides library search path inside them but if a LIBPATH is set then it is overwritten and LIBPATH is followed.
libintl.a is provided both by base AIX (in /usr/lib) and by AIX toolbox (in /opt/freeware/lib). If LIBPATH is not set then krb libraries picks /opt/freeware/lib/libintl.a 
that is used to build it and tested against. But if LIBPATH is set to /usr/lib then /usr/lib/libintl.a is used and that does not have symbol needed for krb5.
We always recommend to not to set any LIBPATH when using AIX toolbox packages as we try to set those in objects.
But I am still wondering why 1.18.4-1 is working as both has same loader section.

------------------------------
SANKET RATHI

Original Message:
Sent: Mon October 03, 2022 06:44 PM
From: Ben Cowan
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

I'm not sure I understand this yet, but here is what I'm seeing:

After upgrading to krb5-libs-1.18.5-1, curl generates the following error under certain circumstances:

exec(): 0509-036 Cannot load program curl because of the following errors:

        0509-130 Symbol resolution failed for /opt/freeware/lib64/libkrb5support.so because:

        0509-136   Symbol _GLOBAL__AIXI_libintl_so (number 58) is not exported from

                   dependent module /usr/lib/libintl.a[libintl.so.8].

        0509-136   Symbol _GLOBAL__AIXD_libintl_so (number 59) is not exported from

                   dependent module /usr/lib/libintl.a[libintl.so.8].

        0509-192 Examine .loader section symbols with the

                 'dump -Tv' command.

This only occurs if one of the following is true:

1. LIBPATH includes /usr/lib, but not /opt/freeware/lib
2. LIBPATH includes /usr/lib, and it precedes /opt/freeware/lib

Obviously, the solution is to place /opt/freeware/lib ahead of /usr/lib, however, I don't understand why this did not occur before.  If I downgrade krb5-libs to 1.18.4-1, I do not get the error.

The only reason I discovered this is that our Oracle Peoplesoft process scheduler runs curl and it generates a LIBPATH that contains /usr/lib, but not /opt/freeware/lib.  It never had a problem until now.

Help me understand...

Regards,

Ben Cowan

PUBLIC RECORDS NOTICE: In accordance with NRS Chapter 239, this email and responses, unless otherwise made confidential by law, may be subject to the Nevada Public Records laws and may be disclosed to the public upon request.

Hi Ben,

I could not find a difference at first go. Will dig more and let you know if we find something.

------------------------------
SANKET RATHI
------------------------------

Original Message:
Sent: Thu October 06, 2022 09:27 AM
From: Ben Cowan
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

So before this gets swept into the dust bin of history...

Can we confirm that this behavior by krb5-libs honoring a mis-configured LIBPATH is working properly as designed and previous versions were broken (disregarding LIBPATH)?   ...or is there a problem?

My Oracle Peoplesoft applications folks can't seem to tell me where the process scheduler is getting it's LIBPATH.  It looks like it is coming from a table entry that I don't have access to.  I was able to provide a workaround for them (curl = '/bin/sh LIBPATH=; curl'), but they won't let me update krb5-libs, until I  explain why they never had this issue before.

------------------------------
Ben Cowan

Original Message:
Sent: Tue October 04, 2022 04:26 AM
From: SANKET RATHI
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

AIX toolbox packages provides library search path inside them but if a LIBPATH is set then it is overwritten and LIBPATH is followed.
libintl.a is provided both by base AIX (in /usr/lib) and by AIX toolbox (in /opt/freeware/lib). If LIBPATH is not set then krb libraries picks /opt/freeware/lib/libintl.a 
that is used to build it and tested against. But if LIBPATH is set to /usr/lib then /usr/lib/libintl.a is used and that does not have symbol needed for krb5.
We always recommend to not to set any LIBPATH when using AIX toolbox packages as we try to set those in objects.
But I am still wondering why 1.18.4-1 is working as both has same loader section.

------------------------------
SANKET RATHI

Original Message:
Sent: Mon October 03, 2022 06:44 PM
From: Ben Cowan
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

I'm not sure I understand this yet, but here is what I'm seeing:

After upgrading to krb5-libs-1.18.5-1, curl generates the following error under certain circumstances:

exec(): 0509-036 Cannot load program curl because of the following errors:

        0509-130 Symbol resolution failed for /opt/freeware/lib64/libkrb5support.so because:

        0509-136   Symbol _GLOBAL__AIXI_libintl_so (number 58) is not exported from

                   dependent module /usr/lib/libintl.a[libintl.so.8].

        0509-136   Symbol _GLOBAL__AIXD_libintl_so (number 59) is not exported from

                   dependent module /usr/lib/libintl.a[libintl.so.8].

        0509-192 Examine .loader section symbols with the

                 'dump -Tv' command.

This only occurs if one of the following is true:

1. LIBPATH includes /usr/lib, but not /opt/freeware/lib
2. LIBPATH includes /usr/lib, and it precedes /opt/freeware/lib

Obviously, the solution is to place /opt/freeware/lib ahead of /usr/lib, however, I don't understand why this did not occur before.  If I downgrade krb5-libs to 1.18.4-1, I do not get the error.

The only reason I discovered this is that our Oracle Peoplesoft process scheduler runs curl and it generates a LIBPATH that contains /usr/lib, but not /opt/freeware/lib.  It never had a problem until now.

Help me understand...

Regards,

Ben Cowan

PUBLIC RECORDS NOTICE: In accordance with NRS Chapter 239, this email and responses, unless otherwise made confidential by law, may be subject to the Nevada Public Records laws and may be disclosed to the public upon request.

The latest krb5 version is built against the latest gettext version 0.21. This version of gettext is built using gcc which introduced these _GLOBAL__AIXI_libintl_so & _GLOBAL__AIXD_libintl_so symbols in it's libintl library. And krb5 library links to it. 
# dump -X64 -Tov /opt/freeware/lib64/libkrb5support.so | grep intl
[58] 0x00000000 undef IMP DS EXTref libintl.a(libintl.so.8) _GLOBAL__AIXI_libintl_so
[59] 0x00000000 undef IMP DS EXTref libintl.a(libintl.so.8) _GLOBAL__AIXD_libintl_so
[60] 0x00000000 undef IMP DS EXTref libintl.a(libintl.so.8) libintl_dgettext

The previous krb5 version 1.18.4 rpm was built in a machine where gettext 0.19.8.1 was installed. That version of gettext is built using xlc and hence these symbols are not there and hence krb5 library has no reference to it. 
# dump -X64 -Tov /opt/freeware/lib64/libkrb5support.so | grep intl
[57] 0x00000000 undef IMP DS EXTref libintl.a(libintl.so.8) libintl_dgettext

In both cases, because of the peopleSoft application setting the LIBPATH to /usr/lib, the krb5 library is loading /usr/lib/libintl.a but with 1.18.5 krb5 it fails because if the _GLOBAL_AIX.. symbols are not present in /usr/lib/libintl.a ( rpm.rte libraries & binaries are built using xlc). 

We are harcoding the libpath of the certain libraries (provided by both rpm.rte & AIX Toolbox) in recent times to avoid these kind of issues. We somehow missed this one. We will update krb5 rpm with the hardcoded libpath of libintl and any other such libraries.

------------------------------
Ayappan P
------------------------------

Original Message:
Sent: Thu October 06, 2022 09:27 AM
From: Ben Cowan
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

So before this gets swept into the dust bin of history...

Can we confirm that this behavior by krb5-libs honoring a mis-configured LIBPATH is working properly as designed and previous versions were broken (disregarding LIBPATH)?   ...or is there a problem?

My Oracle Peoplesoft applications folks can't seem to tell me where the process scheduler is getting it's LIBPATH.  It looks like it is coming from a table entry that I don't have access to.  I was able to provide a workaround for them (curl = '/bin/sh LIBPATH=; curl'), but they won't let me update krb5-libs, until I  explain why they never had this issue before.

------------------------------
Ben Cowan

Original Message:
Sent: Tue October 04, 2022 04:26 AM
From: SANKET RATHI
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

AIX toolbox packages provides library search path inside them but if a LIBPATH is set then it is overwritten and LIBPATH is followed.
libintl.a is provided both by base AIX (in /usr/lib) and by AIX toolbox (in /opt/freeware/lib). If LIBPATH is not set then krb libraries picks /opt/freeware/lib/libintl.a 
that is used to build it and tested against. But if LIBPATH is set to /usr/lib then /usr/lib/libintl.a is used and that does not have symbol needed for krb5.
We always recommend to not to set any LIBPATH when using AIX toolbox packages as we try to set those in objects.
But I am still wondering why 1.18.4-1 is working as both has same loader section.

------------------------------
SANKET RATHI

Original Message:
Sent: Mon October 03, 2022 06:44 PM
From: Ben Cowan
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

I'm not sure I understand this yet, but here is what I'm seeing:

After upgrading to krb5-libs-1.18.5-1, curl generates the following error under certain circumstances:

exec(): 0509-036 Cannot load program curl because of the following errors:

        0509-130 Symbol resolution failed for /opt/freeware/lib64/libkrb5support.so because:

        0509-136   Symbol _GLOBAL__AIXI_libintl_so (number 58) is not exported from

                   dependent module /usr/lib/libintl.a[libintl.so.8].

        0509-136   Symbol _GLOBAL__AIXD_libintl_so (number 59) is not exported from

                   dependent module /usr/lib/libintl.a[libintl.so.8].

        0509-192 Examine .loader section symbols with the

                 'dump -Tv' command.

This only occurs if one of the following is true:

1. LIBPATH includes /usr/lib, but not /opt/freeware/lib
2. LIBPATH includes /usr/lib, and it precedes /opt/freeware/lib

Obviously, the solution is to place /opt/freeware/lib ahead of /usr/lib, however, I don't understand why this did not occur before.  If I downgrade krb5-libs to 1.18.4-1, I do not get the error.

The only reason I discovered this is that our Oracle Peoplesoft process scheduler runs curl and it generates a LIBPATH that contains /usr/lib, but not /opt/freeware/lib.  It never had a problem until now.

Help me understand...

Regards,

Ben Cowan

PUBLIC RECORDS NOTICE: In accordance with NRS Chapter 239, this email and responses, unless otherwise made confidential by law, may be subject to the Nevada Public Records laws and may be disclosed to the public upon request.

We have rebuilt and published krb5 libs with hardcoding the libpath so that it will not be affected by the env LIBPATH. 
Please update the latest krb5-libs and let us know if that fixes your issues.

------------------------------
SANKET RATHI
------------------------------

Original Message:
Sent: Mon October 10, 2022 07:19 AM
From: Ayappan P
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

The latest krb5 version is built against the latest gettext version 0.21. This version of gettext is built using gcc which introduced these _GLOBAL__AIXI_libintl_so & _GLOBAL__AIXD_libintl_so symbols in it's libintl library. And krb5 library links to it. 
# dump -X64 -Tov /opt/freeware/lib64/libkrb5support.so | grep intl
[58] 0x00000000 undef IMP DS EXTref libintl.a(libintl.so.8) _GLOBAL__AIXI_libintl_so
[59] 0x00000000 undef IMP DS EXTref libintl.a(libintl.so.8) _GLOBAL__AIXD_libintl_so
[60] 0x00000000 undef IMP DS EXTref libintl.a(libintl.so.8) libintl_dgettext

The previous krb5 version 1.18.4 rpm was built in a machine where gettext 0.19.8.1 was installed. That version of gettext is built using xlc and hence these symbols are not there and hence krb5 library has no reference to it. 
# dump -X64 -Tov /opt/freeware/lib64/libkrb5support.so | grep intl
[57] 0x00000000 undef IMP DS EXTref libintl.a(libintl.so.8) libintl_dgettext

In both cases, because of the peopleSoft application setting the LIBPATH to /usr/lib, the krb5 library is loading /usr/lib/libintl.a but with 1.18.5 krb5 it fails because if the _GLOBAL_AIX.. symbols are not present in /usr/lib/libintl.a ( rpm.rte libraries & binaries are built using xlc). 

We are harcoding the libpath of the certain libraries (provided by both rpm.rte & AIX Toolbox) in recent times to avoid these kind of issues. We somehow missed this one. We will update krb5 rpm with the hardcoded libpath of libintl and any other such libraries.

------------------------------
Ayappan P

Original Message:
Sent: Thu October 06, 2022 09:27 AM
From: Ben Cowan
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

So before this gets swept into the dust bin of history...

Can we confirm that this behavior by krb5-libs honoring a mis-configured LIBPATH is working properly as designed and previous versions were broken (disregarding LIBPATH)?   ...or is there a problem?

My Oracle Peoplesoft applications folks can't seem to tell me where the process scheduler is getting it's LIBPATH.  It looks like it is coming from a table entry that I don't have access to.  I was able to provide a workaround for them (curl = '/bin/sh LIBPATH=; curl'), but they won't let me update krb5-libs, until I  explain why they never had this issue before.

------------------------------
Ben Cowan

Original Message:
Sent: Tue October 04, 2022 04:26 AM
From: SANKET RATHI
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

AIX toolbox packages provides library search path inside them but if a LIBPATH is set then it is overwritten and LIBPATH is followed.
libintl.a is provided both by base AIX (in /usr/lib) and by AIX toolbox (in /opt/freeware/lib). If LIBPATH is not set then krb libraries picks /opt/freeware/lib/libintl.a 
that is used to build it and tested against. But if LIBPATH is set to /usr/lib then /usr/lib/libintl.a is used and that does not have symbol needed for krb5.
We always recommend to not to set any LIBPATH when using AIX toolbox packages as we try to set those in objects.
But I am still wondering why 1.18.4-1 is working as both has same loader section.

------------------------------
SANKET RATHI

Original Message:
Sent: Mon October 03, 2022 06:44 PM
From: Ben Cowan
Subject: krb5-libs-1.18.5-1.ppc causing an issue with curl

I'm not sure I understand this yet, but here is what I'm seeing:

After upgrading to krb5-libs-1.18.5-1, curl generates the following error under certain circumstances:

exec(): 0509-036 Cannot load program curl because of the following errors:

        0509-130 Symbol resolution failed for /opt/freeware/lib64/libkrb5support.so because:

        0509-136   Symbol _GLOBAL__AIXI_libintl_so (number 58) is not exported from

                   dependent module /usr/lib/libintl.a[libintl.so.8].

        0509-136   Symbol _GLOBAL__AIXD_libintl_so (number 59) is not exported from

                   dependent module /usr/lib/libintl.a[libintl.so.8].

        0509-192 Examine .loader section symbols with the

                 'dump -Tv' command.

This only occurs if one of the following is true:

1. LIBPATH includes /usr/lib, but not /opt/freeware/lib
2. LIBPATH includes /usr/lib, and it precedes /opt/freeware/lib

Obviously, the solution is to place /opt/freeware/lib ahead of /usr/lib, however, I don't understand why this did not occur before.  If I downgrade krb5-libs to 1.18.4-1, I do not get the error.

The only reason I discovered this is that our Oracle Peoplesoft process scheduler runs curl and it generates a LIBPATH that contains /usr/lib, but not /opt/freeware/lib.  It never had a problem until now.

Help me understand...

Regards,

Ben Cowan

PUBLIC RECORDS NOTICE: In accordance with NRS Chapter 239, this email and responses, unless otherwise made confidential by law, may be subject to the Nevada Public Records laws and may be disclosed to the public upon request.