NO-JIRA: Fix oc builds on Mac OS X Apple Silicon machines

[tchap]

Homebrew uses a different prefix path than is hard-coded in the gssapi library.

This change sets the include path dynamically based on Homebrew, when available.

Fixes #2136

I also cleaned up the Makefile a bit in a separate commit.

Summary by CodeRabbit

• Chores
  • Updated the GSSAPI integration to a newer implementation, improving compatibility and maintenance without changing user-facing functionality.

[openshift-ci-robot]

@tchap: This pull request explicitly references no jira issue.

Details

In response to this:

Homebrew uses a different prefix path than is hard-coded in the gssapi library.

This change sets the include path dynamically based on Homebrew, when available.

Fixes #2136

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 9f76a2b9-1392-4653-88ef-661caaa81895

📥 Commits

Reviewing files that changed from the base of the PR and between 4b0a124 and 11e9104.

⛔ Files ignored due to path filters (3)

• go.sum is excluded by !**/*.sum
• vendor/github.com/apcera/gssapi/name.go is excluded by !vendor/**, !**/vendor/**
• vendor/modules.txt is excluded by !vendor/**, !**/vendor/**

📒 Files selected for processing (1)

• go.mod

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The go.mod replacement for github.com/apcera/gssapi now uses a newer github.com/openshift/gssapi version.

Changes

GSSAPI dependency update

Layer / File(s)	Summary
Update GSSAPI replacement version go.mod	Changed the replacement version from the 2016 pseudo-version to v0.0.0-20260819120910-d6b72669a11e. The replacement module remains github.com/openshift/gssapi.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: 🔵 Low · up to 11e91

The change dynamically selects the Homebrew include path for Apple Silicon macOS builds and updates the vendored dependency metadata. The PR is mergeable with owner awareness that the vendor tree should be regenerated or verified and the Darwin/arm64 build confirmed, since inconsistency could cause affected builds to fail.

Suggested reviewers: atiratree, ingvagabund, ardaguclu

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The dependency update may provide the fix, but the excluded vendored gssapi files prevent verification of the required Homebrew include-path change.	Confirm that the updated github.com/openshift/gssapi dependency fixes the macOS Apple Silicon header-resolution failure.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary change: fixing oc builds on macOS Apple Silicon.
Out of Scope Changes check	✅ Passed	The reviewed change only updates the gssapi dependency, which is directly related to the macOS build failure.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Stable And Deterministic Test Names	✅ Passed	The diff changes dependency metadata and a static cgo include path; it adds no Ginkgo test titles or other test-name expressions.
Test Structure And Quality	✅ Passed	The diff changes only go.mod, go.sum, vendor metadata, and vendored gssapi code; it introduces no Ginkgo tests or It blocks to assess.
Microshift Test Compatibility	✅ Passed	The parent-to-HEAD diff changes only dependency metadata and vendored gssapi files; it adds no Ginkgo tests or *_test.go files.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only dependency metadata and vendored gssapi code; it adds no Ginkgo e2e tests or multi-node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	HEAD changes only the gssapi dependency, checksum, vendor code, and module metadata; no deployment, operator, controller, or scheduling constraint changed.
Ote Binary Stdout Contract	✅ Passed	The PR changes only dependency metadata and a gssapi CFLAGS line; no OTE process-level stdout write or suite setup code changed.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The diff changes only go.mod, go.sum, vendor gssapi code, and vendor metadata; it adds no Ginkgo e2e tests or network connectivity logic.
No-Weak-Crypto	✅ Passed	The patch only updates the gssapi version, checksums, vendoring metadata, and a Darwin Homebrew include path; no weak crypto, custom crypto, or secret-comparison code is added.
Container-Privileges	✅ Passed	The parent-to-HEAD patch changes Go dependency metadata and vendored gssapi code only; it adds no container/K8s manifests or privilege-related settings.
No-Sensitive-Data-In-Logs	✅ Passed	The diff only updates gssapi versions, checksums, vendoring metadata, and a macOS C include path; it adds no logging or sensitive-data output.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@Makefile`:
- Around line 47-50: The Makefile currently overwrites CGO_CFLAGS when setting
the Heimdal include path; update the assignment so it appends the brew-provided
include directory instead of replacing existing flags. Locate the
export/assignment that references CGO_CFLAGS and the Heimdal path (the line
using brew --prefix and opt/heimdal/include) and change it to append the
-I$(shell brew --prefix)/opt/heimdal/include to the existing CGO_CFLAGS value
(preserving any caller/CI-provided flags) and keep the export so CGO_CFLAGS
remains exported.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 2fadb9a2-bc1b-4bde-a702-1726062f5781

📥 Commits

Reviewing files that changed from the base of the PR and between bb4c3de and f6ccb70.

📒 Files selected for processing (1)

• Makefile

[tchap]

/retest

[ardaguclu]

I know that I resisted hard to not touch https://github.com/openshift/gssapi repository and forced you updating here.

But these changes look like either we need to simply update https://github.com/openshift/gssapi/blob/5fb4217df13b8e6878046fe1e5c10e560e1b86dc/name.go#L21 as you mentioned before or leave this issue opened rather than adding a hacky change in oc.

[tchap]

/hold

until openshift/gssapi#4 is merged. I will update the dep after.

[ardaguclu]

We can't merge openshift/gssapi#4 without verifying it works. I'd recommend replace

oc/go.mod

Line 223 in 075cd27

replace github.com/apcera/gssapi => github.com/openshift/gssapi v0.0.0-20161010215902-5fb4217df13b

with your fork&branch and get the signal from CI (to ensure that there is no regression). I'd also run all payload blocking jobs.

Lastly, we should find a way to test this on darwin/arm64. Once everything is great, we can start seeking staff engineer to merge openshift/gssapi#4 :)

[tchap]

Sure, I am gonna update this PR now to match the PR in gssapi.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@go.mod`:
- Around line 223-224: The go.mod replace directive currently pointing at the
personal fork github.com/tchap/gssapi (replace github.com/apcera/gssapi =>
github.com/tchap/gssapi ...) introduces supply-chain risk; update the replace to
point to the official openshift fork (github.com/openshift/gssapi) once
openshift/gssapi#4 is merged, or add a short TODO and create/link an issue to
track migration, and ensure the replace line is removed or updated to the
released tag/commit of github.com/openshift/gssapi in go.mod (reference the
replace directive and the module name github.com/apcera/gssapi to find the
change).
- Around line 223-224: The go.mod replace directive referencing
"github.com/tchap/gssapi" is pointing to a non-public fork and will break public
builds; either confirm the fork is intentionally private and document required
access/authentication, or replace/remove the replace directive so it references
a publicly accessible module. Specifically, update the replace line in go.mod
(the "replace github.com/apcera/gssapi => github.com/tchap/gssapi
v0.0.0-...-047531cb33ea" entry) to the correct public fork/path or revert to the
upstream "github.com/apcera/gssapi", then run "go get" / "go mod tidy" to
refresh go.sum and verify builds succeed; if the private fork is required, add
documentation in the repo explaining how to authenticate and fetch that
dependency.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: d95104ee-2805-4ed3-83f2-9e1abfdcb325

📥 Commits

Reviewing files that changed from the base of the PR and between 6cde768 and bcc1b73.

⛔ Files ignored due to path filters (3)

• go.sum is excluded by !**/*.sum
• vendor/github.com/apcera/gssapi/name.go is excluded by !vendor/**, !**/vendor/**
• vendor/modules.txt is excluded by !vendor/**, !**/vendor/**

📒 Files selected for processing (2)

• Makefile
• go.mod

🚧 Files skipped from review as they are similar to previous changes (1)

• Makefile

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[tchap]

I vendored the updated openshift/gssapi, so

/unhold

[ardaguclu]

I think, it is not possible to create regression with that change.
/lgtm
/approve

[openshift-merge-bot]

Scheduling required tests:
/test e2e-agnostic-ovn-cmd
/test e2e-aws-ovn
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-aws-ovn-upgrade

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-agent-compact-ipv4

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ardaguclu, tchap

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ardaguclu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@tchap: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[tchap]

/verified by CI

[openshift-ci-robot]

@tchap: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.