From bce9fcab106788a4d3c732e96f2270c8d210664a Mon Sep 17 00:00:00 2001
From: Bar Hofesh <bar.hofesh@gmail.com>
Date: Fri, 22 May 2026 00:01:30 +0300
Subject: [PATCH] feat: add GSSAPI/Kerberos support to libcurl build

Add the 'gssapi' vcpkg feature on non-Windows platforms to enable
SPNEGO/Negotiate authentication. On Windows, SSPI (already included)
handles Negotiate, so gssapi is skipped there.

Changes:
- scripts/vcpkg-setup.js: conditionally inject 'gssapi' feature into
  vcpkg.json on Linux/macOS (vcpkg does not support curl[gssapi] on Windows)
- install-system-packages: add krb5-dev (Alpine) and libkrb5-dev (Ubuntu)
  so vcpkg can link curl against system GSSAPI libraries

Related: NeuraLegion/bright-cli#751

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/actions/install-system-packages/action.yaml |  3 ++-
 scripts/vcpkg-setup.js                              | 13 ++++++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/actions/install-system-packages/action.yaml b/.github/actions/install-system-packages/action.yaml
index f89929f9..3a89ed3b 100644
--- a/.github/actions/install-system-packages/action.yaml
+++ b/.github/actions/install-system-packages/action.yaml
@@ -23,7 +23,7 @@ runs:
       if: runner.os == 'Linux' && steps.detect-alpine.outputs.result == 'false'
       shell: bash
       run: |
-        sudo apt-get update && sudo apt-get install -y cmake groff libtsan0
+        sudo apt-get update && sudo apt-get install -y cmake groff libtsan0 libkrb5-dev
 
     - name: Install Needed packages on Alpine
       if: steps.detect-alpine.outputs.result == 'true'
@@ -36,4 +36,5 @@ runs:
         python3 py3-pip make g++ \
         perl linux-headers \
         autoconf automake libtool \
+        krb5-dev \
         texinfo flex bison build-base libedit-dev mandoc-soelim zlib zlib-dev zlib-static
diff --git a/scripts/vcpkg-setup.js b/scripts/vcpkg-setup.js
index 9c094417..258a6ce5 100644
--- a/scripts/vcpkg-setup.js
+++ b/scripts/vcpkg-setup.js
@@ -106,10 +106,21 @@ async function createVcpkgJson() {
     )
   }
 
-  const vcpkgJson = vcpkgJsonTemplate
+  let vcpkgJson = vcpkgJsonTemplate
     .replace('$$OPENSSL_VERSION$$', opensslVersion)
     .replace('$$NODE_LIBCURL_VERSION$$', modulePackageJson.version)
 
+  // Add GSSAPI feature on non-Windows platforms for Kerberos/SPNEGO support.
+  // On Windows, SSPI (already included) handles Negotiate authentication.
+  if (process.platform !== 'win32') {
+    const parsed = JSON.parse(vcpkgJson)
+    const curlDep = parsed.dependencies.find((d) => d.name === 'curl')
+    if (curlDep && !curlDep.features.includes('gssapi')) {
+      curlDep.features.push('gssapi')
+    }
+    vcpkgJson = JSON.stringify(parsed, null, 2)
+  }
+
   fs.writeFileSync(path.join(moduleRoot, 'vcpkg.json'), vcpkgJson)
 }