Skip to content

fix(plugin-mssql): build FreeTDS with Kerberos so Windows Auth works (#1918) #1922

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
datlechin merged 1 commit into from
Jul 21, 2026
Merged

fix(plugin-mssql): build FreeTDS with Kerberos so Windows Auth works (#1918) #1922

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

- SSH tunnels can authenticate with no password or key, for hosts that handle SSH auth themselves like Tailscale SSH. Pick **None** as the SSH auth method. (#1907)

### Fixed

- Windows Authentication (Kerberos) to SQL Server now works on macOS. The bundled SQL Server driver was built without Kerberos support, so every Windows-auth connect failed as if the credentials were wrong. (#1918)

## [0.58.0] - 2026-07-18

### Added
Expand Down
20 changes: 15 additions & 5 deletions scripts/build-freetds.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,11 +122,21 @@ cp "$LIBS_DIR/libcrypto_arm64.a" "$MACOS_OPENSSL_ARM64/lib/libcrypto.a"
cp "$LIBS_DIR/libssl_x86_64.a" "$MACOS_OPENSSL_X86_64/lib/libssl.a"
cp "$LIBS_DIR/libcrypto_x86_64.a" "$MACOS_OPENSSL_X86_64/lib/libcrypto.a"

# macOS slices enable Kerberos/GSS (Windows Authentication). --enable-krb5 links the system
# Heimdal GSS via the SDK libgssapi_krb5 stub (Kerberos.framework); the plugin adds -framework GSS
# at link time to resolve the symbols. iOS slices stay krb5-free (Windows auth is macOS only).
build_slice "macos-arm64" "macosx" "arm64" "aarch64-apple-darwin" "-mmacosx-version-min=${MACOS_DEPLOYMENT_TARGET}" "$MACOS_OPENSSL_ARM64" "--enable-krb5"
build_slice "macos-x86_64" "macosx" "x86_64" "x86_64-apple-darwin" "-mmacosx-version-min=${MACOS_DEPLOYMENT_TARGET}" "$MACOS_OPENSSL_X86_64" "--enable-krb5"
# macOS slices enable Kerberos/GSS (Windows Authentication). The explicit --enable-krb5=gssapi_krb5
# form makes FreeTDS define ENABLE_KRB5 unconditionally; plain --enable-krb5 only defines it when an
# auto link probe succeeds and skips it silently otherwise, which shipped an empty gssapi.o once.
# The symbols resolve against the SDK's libgssapi_krb5 stub (Kerberos.framework); the plugin adds
# -framework GSS at link time. iOS slices stay krb5-free (Windows auth is macOS only).
build_slice "macos-arm64" "macosx" "arm64" "aarch64-apple-darwin" "-mmacosx-version-min=${MACOS_DEPLOYMENT_TARGET}" "$MACOS_OPENSSL_ARM64" "--enable-krb5=gssapi_krb5"
build_slice "macos-x86_64" "macosx" "x86_64" "x86_64-apple-darwin" "-mmacosx-version-min=${MACOS_DEPLOYMENT_TARGET}" "$MACOS_OPENSSL_X86_64" "--enable-krb5=gssapi_krb5"
Comment on lines +130 to +131

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Publish the rebuilt FreeTDS archive with this change

Normal app and plugin builds never run this script: .github/workflows/build-plugin.yml downloads libs-v1 through scripts/download-libs.sh, which verifies it against the unchanged Libs/checksums.sha256. Since this commit neither updates that archive/checksum baseline nor triggers a rebuild, every subsequently built MSSQL plugin still links the old GSS-less libsybdb.a, so Windows Authentication remains broken despite the changelog entry. Publish the rebuilt artifacts, update the committed checksums, and release a new plugin binary as part of this fix.

Useful? React with 👍 / 👎.


for slice in macos-arm64 macos-x86_64; do
if ! nm "$LIBS_DIR/libsybdb_${slice}.a" 2>/dev/null | grep -q 'T _tds_gss_get_auth'; then
echo "ERROR: libsybdb_${slice}.a has no tds_gss_get_auth; Kerberos/GSS was not compiled in." >&2
echo " configure did not define ENABLE_KRB5. Check --enable-krb5=gssapi_krb5 and the SDK gssapi headers." >&2
exit 1
fi
done

# iOS slices link OpenSSL statically from the existing xcframeworks; reconstruct a unix-style prefix
# for FreeTDS's --with-openssl which expects include/ and lib/ siblings.
Expand Down