fix(plugin-mssql): build FreeTDS with Kerberos so Windows Auth works (#1918)

[datlechin]

Fixes #1918.

Root cause

Windows Authentication (Kerberos) to SQL Server fails on macOS because the FreeTDS library that ships in the registry MSSQL plugin was compiled without Kerberos support. nm Libs/libsybdb.a shows tds_gss_get_auth is absent and gssapi.o is an empty stub (only NTLM, tds_ntlm_get_auth, is present). Every Windows-auth connect fails inside dbopen() because FreeTDS has no GSS code to run; it then falls back to an empty-username TDS login, which the server rejects, and the app surfaces it as a credentials error. Both reported flows (reuse an existing kinit ticket, and type principal + password) fail at that same call for the same reason.

The Windows Auth feature (#1890/#1892) added correct Swift plumbing and patched build-freetds.sh with --enable-krb5, but the libraries were never rebuilt or republished, and the plugin binary (plugin-mssql-v1.0.30) still links the old GSS-less libsybdb.a from libs-v1.

This is a build/release gap, not a driver-logic bug, so the fix is a library rebuild plus guard-rails, not a code refactor. The Swift driver, the -framework GSS link, and the docs were already correct.

Why a naive rebuild could ship broken again

FreeTDS's --enable-krb5 in auto mode defines ENABLE_KRB5 only if the AC_SEARCH_LIBS(gss_init_sec_context, ...) link probe succeeds, and skips it with no error or warning on failure. That silent path produces exactly the empty gssapi.o we see. So this PR also makes the build deterministic.

Changes in this PR

• scripts/build-freetds.sh: macOS slices build with --enable-krb5=gssapi_krb5. The explicit-library form defines ENABLE_KRB5 unconditionally, removing the silent auto-detect fallback. No CPPFLAGS/LDFLAGS changes are needed: the macOS SDK sysroot already supplies <gssapi/gssapi_krb5.h> and libgssapi_krb5.tbd, and the plugin already links -framework GSS.
• scripts/build-freetds.sh: a post-build nm assertion fails the build if the macOS archives lack tds_gss_get_auth, so a GSS-less libsybdb.a can never ship silently again.
• CHANGELOG.md: one Fixed entry under [Unreleased].

Not changed (verified correct)

• Plugin link flags: -force_load Libs/libsybdb.a + -framework GSS (both Debug and Release).
• Swift driver: username/password blanking for Windows auth, KRB5CCNAME FILE-ccache handling, gss_aapl_initial_cred ticket acquisition, and the Kerberos classifier.
• Docs: docs/databases/mssql.mdx already documents the kinit single sign-on flow, the typed-principal flow, and troubleshooting.

Follow-up steps required to release the fix (not automatable in this PR)

The code change alone does not fix users. After merge, someone with the build/publish environment must:

1. bash scripts/build-freetds.sh (needs brew install autoconf automake libtool openssl@3). The new assertion verifies GSS is compiled in.
2. Verify: nm Libs/libsybdb.a | grep tds_gss_get_auth prints T _tds_gss_get_auth.
3. scripts/publish-libs.sh libsybdb_arm64.a libsybdb_x86_64.a libsybdb_universal.a libsybdb.a, then re-pack and upload the iOS xcframework archive per CLAUDE.md.
4. Commit the updated Libs/checksums.sha256.
5. Re-release the registry plugin (tag plugin-mssql-v1.0.31, or gh workflow run build-plugin.yml) so its binary links the rebuilt lib. No PluginKit ABI bump: currentPluginKitVersion stays 18.
6. Verify end-to-end against a real Kerberos SQL Server, both flows.

Testing

The library/GSS path can't be unit-tested in the Swift suite (the lib isn't rebuilt in CI, and the C-bridge tests run zero rows in that target). The build-script nm assertion is the automated verification, self-checking at build time. No Swift behavior changes, so the existing MSSQLKerberosClassifierTests and MSSQLConnectionOptionsAuthMethodTests still hold.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 417187e4a4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Publish the rebuilt FreeTDS archive with this change

Normal app and plugin builds never run this script: .github/workflows/build-plugin.yml downloads libs-v1 through scripts/download-libs.sh, which verifies it against the unchanged Libs/checksums.sha256. Since this commit neither updates that archive/checksum baseline nor triggers a rebuild, every subsequently built MSSQL plugin still links the old GSS-less libsybdb.a, so Windows Authentication remains broken despite the changelog entry. Publish the rebuilt artifacts, update the committed checksums, and release a new plugin binary as part of this fix.

Useful? React with 👍 / 👎.