Index: /third_tags/openafs/+invirt3/invirtify-openafs
===================================================================
--- /third_tags/openafs/+invirt3/invirtify-openafs	(revision 2375)
+++ /third_tags/openafs/+invirt3/invirtify-openafs	(revision 2375)
@@ -0,0 +1,29 @@
+#!/bin/sh
+set -e
+
+name=openafs
+ivversionappend=+invirt3
+
+dir=$(cd "$(dirname "$0")"; pwd)
+
+hack_package () {
+    append_description <<EOF
+ .
+ This package was rebuilt for the Invirt project to allow
+ encrypting communication with the ptserver, and to include
+ PIC versions of the AFS libraries.
+EOF
+
+    QUILT_PATCHES=debian/patches quilt import "$dir/secure-pts"
+    add_changelog 'Allow encrypting requests to the ptserver.'
+
+    QUILT_PATCHES=debian/patches quilt import "$dir/pic-afs-libs"
+    echo 'debian/tmp/usr/lib/libafsauthent_pic.a  usr/lib' >>debian/libopenafs-dev.install
+    echo 'debian/tmp/usr/lib/libafsrpc_pic.a      usr/lib' >>debian/libopenafs-dev.install
+    add_changelog 'Install PIC versions of libraries.'
+
+    add_invirt_provides
+    munge_sections
+}
+
+. ../common/invirtificator.sh
Index: /third_tags/openafs/+invirt3/pic-afs-libs
===================================================================
--- /third_tags/openafs/+invirt3/pic-afs-libs	(revision 2375)
+++ /third_tags/openafs/+invirt3/pic-afs-libs	(revision 2375)
@@ -0,0 +1,139 @@
+From bbab48b047000db0d1821e2f65917c2e8c2c7768 Mon Sep 17 00:00:00 2001
+From: Russ Allbery <rra@stanford.edu>
+Date: Mon, 6 Jul 2009 18:41:39 -0700
+Subject: [PATCH] Build and install PIC versions of libafsrpc and libafsauthent
+
+To include AFS code in loadable modules such as PAM modules, NSS modules,
+or Perl/Python/PHP/Ruby extensions, it needs to be built PIC or one must
+link with the AFS shared libraries.  Since we haven't historically been
+that great about maintaining the shared library ABI, it's nice to have
+static libraries built with PIC code that can be linked into such modules.
+
+Based on a patch by Garrett Wollman updated with the build system changes
+that happened after 1.4.
+
+Make shlib makefiles have clean rules for PIC libraries.
+Make RedHat specfile know how to deal with PIC libraries.
+
+Reviewed-on: http://gerrit.openafs.org/8
+Verified-by: Derrick Brashear <shadow@dementia.org>
+Reviewed-by: Derrick Brashear <shadow@dementia.org>
+Backported-by: Evan Broder <broder@mit.edu>
+---
+ src/packaging/RedHat/openafs.spec.in |    2 ++
+ src/shlibafsauthent/Makefile.in      |   20 ++++++++++++++++----
+ src/shlibafsrpc/Makefile.in          |   18 ++++++++++++++----
+ 3 files changed, 32 insertions(+), 8 deletions(-)
+
+Index: openafs-1.4.6.dfsg1/src/packaging/RedHat/openafs.spec.in
+===================================================================
+--- openafs-1.4.6.dfsg1.orig/src/packaging/RedHat/openafs.spec.in	2007-10-18 00:14:18.000000000 -0400
++++ openafs-1.4.6.dfsg1/src/packaging/RedHat/openafs.spec.in	2009-07-27 01:23:51.000000000 -0400
+@@ -1443,6 +1443,8 @@
+ %defattr(-,root,root)
+ %{_libdir}/libafsauthent.a
+ %{_libdir}/libafsrpc.a
++%{_libdir}/libafsauthent_pic.a
++%{_libdir}/libafsrpc_pic.a
+ %if %{build_authlibs}
+ %{_libdir}/libafsauthent.so
+ %{_libdir}/libafsrpc.so
+Index: openafs-1.4.6.dfsg1/src/shlibafsauthent/Makefile.in
+===================================================================
+--- openafs-1.4.6.dfsg1.orig/src/shlibafsauthent/Makefile.in	2006-08-20 16:17:25.000000000 -0400
++++ openafs-1.4.6.dfsg1/src/shlibafsauthent/Makefile.in	2009-07-27 01:35:11.000000000 -0400
+@@ -104,9 +104,9 @@
+ 	-ln -f -s ${LIBAFSAUTHENT} ${DEST}/lib/libafsauthent.${SHLIB_SUFFIX}
+ 	-ln -f -s ${LIBAFSAUTHENT} ${DEST}/lib/libafsauthent.${SHLIB_SUFFIX}.${LIBAFSAUTHENTMAJOR}
+ 
+-all: ${TOP_LIBDIR}/${LIBAFSAUTHENT}
++all: ${TOP_LIBDIR}/${LIBAFSAUTHENT} ${TOP_LIBDIR}/libafsauthent_pic.a
+ 
+-install: ${DESTDIR}${libdir}/${LIBAFSAUTHENT}
++install: ${DESTDIR}${libdir}/${LIBAFSAUTHENT} ${DESTDIR}${libdir}/libafsauthent_pic.a
+ 
+ ${LIBAFSAUTHENT}: ${LIBOBJS}
+ 	case ${SYS_NAME} in \
+@@ -120,6 +120,11 @@
+ 		${SHLIB_LINKER} -o ${LIBAFSAUTHENT} ${LIBOBJS} -L${TOP_LIBDIR} -lafsrpc ${MT_LIBS};; \
+ 	esac
+ 
++libafsauthent_pic.a: ${LIBOBJS}
++	$(RM) -f $@
++	$(AR) crv $@ ${LIBOBJS}
++	$(RANLIB) $@
++
+ audit.o: ${AUDIT}/audit.c
+ 	${CCRULE}
+ 
+@@ -276,9 +281,15 @@
+ 	-ln -f -s ${LIBAFSAUTHENT} ${DESTDIR}${libdir}/libafsauthent.${SHLIB_SUFFIX}
+ 	-ln -f -s ${LIBAFSAUTHENT} ${DESTDIR}${libdir}/libafsauthent.${SHLIB_SUFFIX}.${LIBAFSAUTHENTMAJOR}
+ 
++${DESTDIR}${libdir}/libafsauthent_pic.a: libafsauthent_pic.a
++	${INSTALL} libafsauthent_pic.a $@
++
+ ${TOP_LIBDIR}/${LIBAFSAUTHENT}: ${LIBAFSAUTHENT}
+ 	${INSTALL} ${LIBAFSAUTHENT} ${TOP_LIBDIR}/${LIBAFSAUTHENT}
+ 	-ln -f -s ${LIBAFSAUTHENT} ${TOP_LIBDIR}/libafsauthent.${SHLIB_SUFFIX}
+ 	-ln -f -s ${LIBAFSAUTHENT} ${TOP_LIBDIR}/libafsauthent.${SHLIB_SUFFIX}.${LIBAFSAUTHENTMAJOR}
+ 
+-dest: ${DEST}/lib/${LIBAFSAUTHENT}
++${TOP_LIBDIR}/libafsauthent_pic.a: libafsauthent_pic.a
++	${INSTALL} libafsauthent_pic.a $@
++
++dest: ${DEST}/lib/${LIBAFSAUTHENT} ${DEST}/lib/libafsauthent_pic.a
+Index: openafs-1.4.6.dfsg1/src/shlibafsrpc/Makefile.in
+===================================================================
+--- openafs-1.4.6.dfsg1.orig/src/shlibafsrpc/Makefile.in	2006-08-20 18:24:10.000000000 -0400
++++ openafs-1.4.6.dfsg1/src/shlibafsrpc/Makefile.in	2009-07-27 01:34:39.000000000 -0400
+@@ -134,15 +134,17 @@
+ 
+ LIBAFSRPC = libafsrpc.${SHLIB_SUFFIX}.${LIBAFSRPCMAJOR}.${LIBAFSRPCMINOR}
+ 
+-all: ${TOP_LIBDIR}/${LIBAFSRPC}
++all: ${TOP_LIBDIR}/${LIBAFSRPC} ${TOP_LIBDIR}/libafsrpc_pic.a
+ 
+-install: ${DESTDIR}${libdir}/${LIBAFSRPC}
++install: ${DESTDIR}${libdir}/${LIBAFSRPC} ${DESTDIR}${libdir}/libafsrpc_pic.a
+ 
+ ${DEST}/lib/${LIBAFSRPC}: ${LIBAFSRPC}
+ 	${INSTALL} ${LIBAFSRPC} ${DEST}/lib/${LIBAFSRPC}
+ 	-ln -f -s ${LIBAFSRPC} ${DEST}/lib/libafsrpc.${SHLIB_SUFFIX}
+ 	-ln -f -s ${LIBAFSRPC} ${DEST}/lib/libafsrpc.${SHLIB_SUFFIX}.${LIBAFSRPCMAJOR}
+ 
++${DEST}/lib/libafsrpc_pic.a: libafsrpc_pic.a
++
+ ${LIBAFSRPC}: ${LIBOBJS}
+ 	case ${SYS_NAME} in \
+ 	rs_aix4* | rs_aix5*) \
+@@ -157,6 +159,11 @@
+ 		${SHLIB_LINKER} -o ${LIBAFSRPC} ${LIBOBJS} ${MT_LIBS};; \
+ 	esac
+ 
++libafsrpc_pic.a: ${LIBOBJS}
++	$(RM) -f $@
++	$(AR) crv $@ ${LIBOBJS}
++	$(RANLIB) $@
++
+ rx_event.o: ${RX}/rx_event.c
+ 	${CCRULE}
+ 
+@@ -418,10 +425,16 @@
+ 	-ln -f -s ${LIBAFSRPC} ${DESTDIR}${libdir}/libafsrpc.${SHLIB_SUFFIX}
+ 	-ln -f -s ${LIBAFSRPC} ${DESTDIR}${libdir}/libafsrpc.${SHLIB_SUFFIX}.${LIBAFSRPCMAJOR}
+ 
++${DESTDIR}${libdir}/libafsrpc_pic.a: libafsrpc_pic.a
++	${INSTALL} libafsrpc_pic.a $@
++
+ ${TOP_LIBDIR}/${LIBAFSRPC}: ${LIBAFSRPC}
+ 	${INSTALL} ${LIBAFSRPC} ${TOP_LIBDIR}/${LIBAFSRPC}
+ 	-ln -f -s ${LIBAFSRPC} ${TOP_LIBDIR}/libafsrpc.${SHLIB_SUFFIX}
+ 	-ln -f -s ${LIBAFSRPC} ${TOP_LIBDIR}/libafsrpc.${SHLIB_SUFFIX}.${LIBAFSRPCMAJOR}
+ 
+-dest: ${DEST}/lib/${LIBAFSRPC}
++${TOP_LIBDIR}/libafsrpc_pic.a: libafsrpc_pic.a
++	${INSTALL} libafsrpc_pic.a $@
++
++dest: ${DEST}/lib/${LIBAFSRPC} ${DEST}/lib/libafsrpc_pic.a
+ 
Index: /third_tags/openafs/+invirt3/secure-pts
===================================================================
--- /third_tags/openafs/+invirt3/secure-pts	(revision 2375)
+++ /third_tags/openafs/+invirt3/secure-pts	(revision 2375)
@@ -0,0 +1,48 @@
+Index: openafs-1.4.6.dfsg1/src/ptserver/pts.c
+===================================================================
+--- openafs-1.4.6.dfsg1.orig/src/ptserver/pts.c	2007-08-11 19:54:04.000000000 -0400
++++ openafs-1.4.6.dfsg1/src/ptserver/pts.c	2008-12-19 23:54:55.000000000 -0500
+@@ -146,6 +146,8 @@
+ 	cell = 0;
+     if (as->parms[17].items)
+ 	sec = 0;
++    if (as->parms[20].items) /* -encrypt */
++	sec = 3;
+ 
+     if (as->parms[18].items) {	/* testing? */
+ 	code = pr_Initialize(sec, AFSDIR_SERVER_ETC_DIRPATH, cell);
+@@ -972,6 +974,7 @@
+     cmd_AddParm(ts, "-test", CMD_FLAG, CMD_OPTIONAL | CMD_HIDE, test_help);
+     cmd_AddParm(ts, "-force", CMD_FLAG, CMD_OPTIONAL,
+ 		"Continue oper despite reasonable errors");
++    cmd_AddParm(ts, "-encrypt", CMD_FLAG, CMD_OPTIONAL, "encrypt commands");
+ }
+ 
+ /*
+Index: openafs-1.4.6.dfsg1/src/ptserver/ptuser.c
+===================================================================
+--- openafs-1.4.6.dfsg1.orig/src/ptserver/ptuser.c	2007-04-10 14:43:45.000000000 -0400
++++ openafs-1.4.6.dfsg1/src/ptserver/ptuser.c	2008-12-19 23:56:27.000000000 -0500
+@@ -200,8 +200,11 @@
+ 	sname.instance[0] = 0;
+ 	strcpy(sname.name, "afs");
+ 	code = ktc_GetToken(&sname, &ttoken, sizeof(ttoken), NULL);
+-	if (code)
++	if (code) {
++	    if (secLevel > 1)
++		return code;
+ 	    scIndex = 0;
++	}
+ 	else {
+ 	    if (ttoken.kvno >= 0 && ttoken.kvno <= 256)
+ 		/* this is a kerberos ticket, set scIndex accordingly */
+@@ -213,7 +216,8 @@
+ 		scIndex = 2;
+ 	    }
+ 	    sc[2] =
+-		rxkad_NewClientSecurityObject(rxkad_clear, &ttoken.sessionKey,
++		rxkad_NewClientSecurityObject((secLevel > 1) ? rxkad_crypt :
++					      rxkad_clear, &ttoken.sessionKey,
+ 					      ttoken.kvno, ttoken.ticketLen,
+ 					      ttoken.ticket);
+ 	}