Skip to content

build/deps: upgrade krb5 to 1.22.2#30628

Merged
tyson-redpanda merged 4 commits into
devfrom
fix/upgrade-kerberos-1.22
Jun 3, 2026
Merged

build/deps: upgrade krb5 to 1.22.2#30628
tyson-redpanda merged 4 commits into
devfrom
fix/upgrade-kerberos-1.22

Conversation

@tyson-redpanda

@tyson-redpanda tyson-redpanda commented May 28, 2026

Copy link
Copy Markdown
Contributor

Upgrades krb5 from 1.21.3 to 1.22.2. The memory leak fixes previously applied via patch are included in 1.22 upstream, so that patch is dropped. The NegoEx CVE patches (CVE-2026-40355, CVE-2026-40356) still apply cleanly to 1.22.2 and are retained.

Backports Required

  • none - not a bug fix
  • none - this is a backport
  • none - issue does not exist in previous branches
  • none - papercut/not impactful enough to backport
  • v26.1.x
  • v25.3.x
  • v25.2.x

Release Notes

  • none

Replace krb5 1.21.3 with 1.22.2. The memory leak fixes previously
applied via patch are included in 1.22 upstream. The NegoEx CVE fixes
(CVE-2026-40355, CVE-2026-40356) patch still applies cleanly and is
retained until they land upstream.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@dotnwat

dotnwat commented May 28, 2026

Copy link
Copy Markdown
Member

ERROR: @seastar//:stack_guards :: Error loading option @seastar//:stack_guards: MODULE.bazel.lock is no longer up-to-date because the implementation of the extension '@@//bazel:extensions.bzl%non_module_dependencies' or one of its transitive .bzl files has changed. Please run `bazel mod deps --lockfile_mode=update` to update your lockfile.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
dotnwat
dotnwat previously approved these changes May 28, 2026
krb5 1.22.2 has a bug where struct kdclist and kdclist_entry are defined
inside a KRB5_DNS_LOOKUP conditional, but the functions using them are
outside it. When configure doesn't define KRB5_DNS_LOOKUP (as in the
Bazel sandbox), the structs are incomplete at compile time.

Cherry-pick the upstream fix from master (3c672ca).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@vbotbuildovich

Copy link
Copy Markdown
Collaborator

Retry command for Build#85135

please wait until all jobs are finished before running the slash command

/ci-repeat 1
skip-redpanda-build
skip-units
skip-rebase
tests/rptest/tests/cluster_linking_e2e_test.py::ShadowLinkingReplicationTests.test_with_restart@{"storage_mode":"cloud"}

@vbotbuildovich

vbotbuildovich commented May 29, 2026

Copy link
Copy Markdown
Collaborator

CI test results

test results on build#85135
test_status test_class test_method test_arguments test_kind job_url passed reason test_history
FLAKY(FAIL) ShadowLinkingReplicationTests test_with_restart {"storage_mode": "cloud"} integration https://buildkite.com/redpanda/redpanda/builds/85135#019e7428-0b03-4c20-a28f-186ee6e13215 24/31 Test FAILS after retries.Significant increase in flaky rate(baseline=0.0509, p0=0.0036, reject_threshold=0.0100) https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=ShadowLinkingReplicationTests&test_method=test_with_restart
FLAKY(PASS) WriteCachingFailureInjectionE2ETest test_crash_all {"use_transactions": false} integration https://buildkite.com/redpanda/redpanda/builds/85135#019e7428-0aff-41f5-9571-b08b0210c536 17/21 Test PASSES after retries.No significant increase in flaky rate(baseline=0.0925, p0=0.2807, reject_threshold=0.0100. adj_baseline=0.2527, p1=0.2171, trust_threshold=0.5000) https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=WriteCachingFailureInjectionE2ETest&test_method=test_crash_all
test results on build#85269
test_status test_class test_method test_arguments test_kind job_url passed reason test_history
FLAKY(PASS) NodeWiseRecoveryTest test_recovery_local_data_missing {"wait_for_final_manifest_uploads": true} integration https://buildkite.com/redpanda/redpanda/builds/85269#019e89b2-72ed-4266-9627-b2f7eaccc2de 19/21 Test PASSES after retries.No significant increase in flaky rate(baseline=0.0183, p0=0.3083, reject_threshold=0.0100. adj_baseline=0.1000, p1=0.3917, trust_threshold=0.5000) https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=NodeWiseRecoveryTest&test_method=test_recovery_local_data_missing

@tyson-redpanda tyson-redpanda enabled auto-merge June 2, 2026 18:35
@tyson-redpanda

Copy link
Copy Markdown
Contributor Author

ERROR: @seastar//:stack_guards :: Error loading option @seastar//:stack_guards: MODULE.bazel.lock is no longer up-to-date because the implementation of the extension '@@//bazel:extensions.bzl%non_module_dependencies' or one of its transitive .bzl files has changed. Please run `bazel mod deps --lockfile_mode=update` to update your lockfile.

@dotnwat fixed. The CI failures are resolved as well, just some flakes. Ready for another review please. No rush.

@tyson-redpanda tyson-redpanda requested a review from dotnwat June 2, 2026 18:36
@tyson-redpanda tyson-redpanda merged commit 35f50a3 into dev Jun 3, 2026
18 checks passed
@tyson-redpanda tyson-redpanda deleted the fix/upgrade-kerberos-1.22 branch June 3, 2026 23:49
@vbotbuildovich

Copy link
Copy Markdown
Collaborator

/backport v26.1.x

@vbotbuildovich

Copy link
Copy Markdown
Collaborator

/backport v25.3.x

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants