From: Ken Raeburn <raeburn@mit.edu>
Date: Sun, 24 May 2009 19:58:47 +0000 (+0000)
Subject: If --enable-pkinit is explicitly given, and OpenSSL is too old, error out instead of
X-Git-Tag: krb5-1.8-alpha1~456
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=c429f806fe5230762151f2b290175a671e87c711;p=krb5.git

If --enable-pkinit is explicitly given, and OpenSSL is too old, error out instead of
ignoring the option and disabling pkinit.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22370 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/configure.in b/src/configure.in
index b0d362489..94775f136 100644
--- a/src/configure.in
+++ b/src/configure.in
@@ -884,8 +884,8 @@ AC_SUBST(PASS)
 dnl for pkinit
 AC_ARG_ENABLE([pkinit],
 [  --disable-pkinit        disable PKINIT plugin support],,
-enable_pkinit=yes)
-if test "$enable_pkinit" = yes; then
+enable_pkinit=try)
+if test "$enable_pkinit" = yes || test "$enable_pkinit" = try; then
   AC_CACHE_CHECK(for a recent enough OpenSSL, k5_cv_openssl_version_okay,
 [AC_COMPILE_IFELSE([#include <openssl/opensslv.h>
 #if OPENSSL_VERSION_NUMBER < 0x00908000L
@@ -897,8 +897,10 @@ int i = 1;
   AC_CHECK_LIB(crypto, PKCS7_get_signer_info)
   LIBS="$old_LIBS"
 fi
-if test "$k5_cv_openssl_version_okay" = yes && test "$enable_pkinit" = yes; then
+if test "$k5_cv_openssl_version_okay" = yes && (test "$enable_pkinit" = yes || test "$enable_pkinit" = try); then
   K5_GEN_MAKEFILE(plugins/preauth/pkinit)
+elif test "$k5_cv_openssl_version_okay" = no && test "$enable_pkinit" = yes; then
+  AC_MSG_ERROR([Version of OpenSSL is too old; cannot enable PKINIT.])
 else
   AC_DEFINE([DISABLE_PKINIT], 1, [Define to disable PKINIT plugin support])
   AC_MSG_NOTICE([Disabling PKINIT support.])