23.40.4: wants to fetch stuff (libgpg-error) during build

[tgurr]

Expected behavior

Do not try to fecht stuff during compile phase.

Actual behavior

error: failed to run custom build command for libgcrypt-sys v0.1.0 (/var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/crates/nasl-c-lib/libgcrypt-sys)

Our build sandbox prevents fetching stuff during the build process. This is something distributions generally do not allow.

[...]
   Compiling tower-layer v0.3.3
   Compiling libgcrypt-sys v0.1.0 (/var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/crates/nasl-c-lib/libgcrypt-sys)
   Compiling netsnmp-sys-nocrypto v0.1.3
   Compiling simd-adler32 v0.3.8
   Compiling sha1collisiondetection v0.3.4
   Compiling adler2 v2.0.1
   Compiling rustc-hash v1.1.0
   Compiling capnp v0.25.1
   Compiling miniz_oxide v0.8.9
sydbox: 8< -- Access Violation! --     ] 459/716: libsqlite3-sys(build), libsqlite3-sys(build), aws-lc-sys(build), zstd-sys(build), capnp, bindgen, openssl-sys(build), libgcrypt-sys(build)                                              
sydbox: connect(-1, inet:192.168.0.50@53)
sydbox: proc: curl[236674] (parent:236669)
sydbox: cwd: `/var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/crates/nasl-c-lib/tmp'
sydbox: cmdline: `curl --fail -O https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.54.tar.'
sydbox: >8 --
sydbox: 8< -- Access Violation! --
sydbox: connect(-1, inet:10.132.159.40@53)
sydbox: proc: curl[236674] (parent:236669)
sydbox: cwd: `/var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/crates/nasl-c-lib/tmp'
sydbox: cmdline: `curl --fail -O https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.54.tar.'
sydbox: >8 --
sydbox: 8< -- Access Violation! --
sydbox: connect(-1, inet:192.168.0.50@53)
sydbox: proc: curl[236674] (parent:236669)
sydbox: cwd: `/var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/crates/nasl-c-lib/tmp'
sydbox: cmdline: `curl --fail -O https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.54.tar.'
sydbox: >8 --
sydbox: 8< -- Access Violation! --
sydbox: connect(-1, inet:10.132.159.40@53)
sydbox: proc: curl[236674] (parent:236669)
sydbox: cwd: `/var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/crates/nasl-c-lib/tmp'
sydbox: cmdline: `curl --fail -O https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.54.tar.'
sydbox: >8 --
sydbox: 8< -- Access Violation! --
sydbox: connect(-1, inet:192.168.0.50@53)
sydbox: proc: curl[236674] (parent:236669)
sydbox: cwd: `/var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/crates/nasl-c-lib/tmp'
sydbox: cmdline: `curl --fail -O https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.54.tar.'
sydbox: >8 --
sydbox: 8< -- Access Violation! --
sydbox: connect(-1, inet:10.132.159.40@53)
sydbox: proc: curl[236674] (parent:236669)
sydbox: cwd: `/var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/crates/nasl-c-lib/tmp'
sydbox: cmdline: `curl --fail -O https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.54.tar.'
sydbox: >8 --
sydbox: 8< -- Access Violation! --
sydbox: connect(-1, inet:192.168.0.50@53)
sydbox: proc: curl[236674] (parent:236669)
sydbox: cwd: `/var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/crates/nasl-c-lib/tmp'
sydbox: cmdline: `curl --fail -O https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.54.tar.'
sydbox: >8 --
sydbox: 8< -- Access Violation! --
sydbox: connect(-1, inet:10.132.159.40@53)
sydbox: proc: curl[236674] (parent:236669)
sydbox: cwd: `/var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/crates/nasl-c-lib/tmp'
sydbox: cmdline: `curl --fail -O https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.54.tar.'
sydbox: >8 --
error: failed to run custom build command for `libgcrypt-sys v0.1.0 (/var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/crates/nasl-c-lib/libgcrypt-sys)`

Caused by:
  process didn't exit successfully: `/var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/target/release/build/libgcrypt-sys-d98553ca9c19b88f/build-script-build` (exit status: 101)
  --- stdout
  cargo:rerun-if-changed=install-gcrypt.sh

  --- stderr

  thread 'main' (236668) panicked at crates/nasl-c-lib/libgcrypt-sys/build.rs:25:21:
  Script exited with 5:
  stdout:

  stderr:
  + '[' x86_64-unknown-linux-gnu = aarch64-unknown-linux-gnu ']'
  + '[' 0 -ne 0 ']'
  + '[' '!' -d '' ']'
  + mkdir -p /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/crates/nasl-c-lib/libgcrypt-sys/../tmp
  + install_gnu libgpg-error 1.54
  + VERSION=1.54
  + NAME=libgpg-error
  + cd /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.40.4/work/openvas-scanner-23.40.4/rust/crates/nasl-c-lib/libgcrypt-sys/../tmp
  + '[' '!' -f libgpg-error-1.54.tar.bz2 ']'
  + curl --fail -O https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.54.tar.bz2
    % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
                                   Dload  Upload  Total   Spent   Left   Speed
  0      0   0      0   0      0      0      0                              0curl: (5) Could not resolve proxy: proxy.corporate.local

  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
warning: build failed, waiting for other jobs to finish...
    Building [===============>         ] 466/716: openssl-sys(build)                                                                                                                                                                      
Error:
  * In program cave perform install --hooks --managed-output --output-exclusivity with-others =net-analyzer/openvas-scanner-23.40.4:0::net --destination installed --replacing =net-analyzer/openvas-scanner-23.40.3:0::installed --x-of-y 1 of 1:
  * When installing 'net-analyzer/openvas-scanner-23.40.4:0::net' replacing { 'net-analyzer/openvas-scanner-23.40.3:0::installed' }:
  * When running an ebuild command on 'net-analyzer/openvas-scanner-23.40.4:0::net':
  * Install failed for 'net-analyzer/openvas-scanner-23.40.4:0::net' (paludis::ActionFailedError)


!!! ERROR in net-analyzer/openvas-scanner-23.40.4::net:
!!! In edo at line 1750
!!! cargo build --frozen --release failed

It should use the system installed libgpg-error & libgcrypt instead of trying to download its own versions. Interestingly this issue appears to be arch specific as our aarch64 CI runner build succeeded without hitting that issue:
https://gitlab.exherbo.org/tgurr/net/-/jobs/198865 probably related to the [' x86_64-unknown-linux-gnu = aarch64-unknown-linux-gnu ']' seen in the error message above?. Edit: Reason is that our sandbox doesn't currently run on aarch64.

Steps to reproduce

1. run cargo vendor
2. go offline
3. try to build openvas-scanner 23.40.4 rust part (cargo build --frozen --release)

Environment

GCC: 14.3.0
Operating system: Exherbo Linux
Installation method / source: source-based packages

Logfiles

Complete build log: openvas-scanner-23.40.4_build.log

[tgurr]

A workaround is to download the versions of libgpg-error & libgcrypt specified in rust/crates/nasl-c-lib/libgcrypt-sys/install-gcrypt.sh and put them under rust/crates/nasl-c-lib/tmp.

[tgurr]

Failed sandboxed (not allowed to download stuff during build time) CI run for 23.43.2: https://gitlab.exherbo.org/tgurr/net/-/jobs/203206

This now regressed even more with the latest change to use build.rs 64c6044 which downloads the tarballs into for example rust/target/release/build/libcrypt-sys-800be1183c967461/out/ so it's no longer possible to use the previously mentioned workaround #2146 (comment) to pre-download the tarballs into at least a rather convenient single directory without it becoming even more cumbersome to workaround now:

    edo pushd "${CMAKE_SOURCE}"/rust
    ecargo_fetch
    # https://github.com/greenbone/openvas-scanner/issues/2146
    edo mkdir -p target/release/build/libcrypt-sys-800be1183c967461/out
    edo cp "${FETCHEDDIR}"/libgpg-error-${LIBGPG_ERROR_VER}.tar.bz2 target/release/build/libcrypt-sys-800be1183c967461/out/
    edo cp "${FETCHEDDIR}"/libgcrypt-${LIBGCRYPT_VER}.tar.bz2 target/release/build/libcrypt-sys-800be1183c967461/out/
    edo mkdir -p target/release/build/libopenvas-krb5-sys-3c2eaff12c3f9a99/out
    edo cp "${FETCHEDDIR}"/krb5-${KRB5_VER}.tar.gz target/release/build/libopenvas-krb5-sys-3c2eaff12c3f9a99/out/
    edo popd

[nichtsfrei]

Hello,

thank you for filing this bug.

Can you give us feedback if the instructions in https://github.com/greenbone/openvas-scanner/blob/main/rust/doc/build.md are clear enough and if it fixes your use-case?

[tgurr]

Can you give us feedback if the instructions in https://github.com/greenbone/openvas-scanner/blob/main/rust/doc/build.md are clear enough and if it fixes your use-case?

Sorry it took me a while to have another look at this, it turned out to be a little bit tricky as we're a source-based distribution, for libgcrypt, libgpg-error & libpcap it was smooth as we already additionally built the static version due to other requirements, but krb5 was a pain as it doesn't allow to pass --enable-shared --enable-static at the same time and the full static build also failed, I opted to only build a subset of things statically now as you're doing in your docker file with:

https://gitlab.exherbo.org/exherbo/net/-/commit/938223000e18fc2cd3f2a77ba529dafca1400d0e

I then however ran into the problem of openvas-scanner failing to link since it has an automagic on and picked up keyutils on the system:

scanner-23.45.6/rust/target/release/deps/openvasd-e5c1213b61aa0b70" "-Wl,--gc-sections" "-pie" "-Wl,-z,relro,-z,now" "-Wl,-O1" "-Wl,--strip-debug" "-nodefaultlibs"
  = note: some arguments are omitted. use `--verbose` to show all linker arguments
  = note: ld.lld: error: undefined symbol: keyctl_search
          >>> referenced by cc_keyring.c:339 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:339)
          >>>               cc_keyring.o:(find_or_create_keyring) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:1009 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:1009)
          >>>               cc_keyring.o:(krcc_start_seq_get) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:900 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:900)
          >>>               cc_keyring.o:(make_cache) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced 6 more times
          
          ld.lld: error: undefined symbol: add_key
          >>> referenced by cc_keyring.c:342 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:342)
          >>>               cc_keyring.o:(find_or_create_keyring) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:348 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:348)
          >>>               cc_keyring.o:(find_or_create_keyring) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:548 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:548)
          >>>               cc_keyring.o:(set_primary_name.isra.0) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced 5 more times
          
          ld.lld: error: undefined symbol: keyctl_link
          >>> referenced by cc_keyring.c:345 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:345)
          >>>               cc_keyring.o:(find_or_create_keyring) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:611 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:611)
          >>>               cc_keyring.o:(get_primary_name.isra.0) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:798 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:798)
          >>>               cc_keyring.o:(krcc_initialize) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          
          ld.lld: error: undefined symbol: keyctl_read_alloc
          >>> referenced by cc_keyring.c:994 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:994)
          >>>               cc_keyring.o:(krcc_start_seq_get) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:1047 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:1047)
          >>>               cc_keyring.o:(krcc_next_cred) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:1222 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:1222)
          >>>               cc_keyring.o:(krcc_get_principal) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced 3 more times
          
          ld.lld: error: undefined symbol: keyctl_describe_alloc
          >>> referenced by cc_keyring.c:1614 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:1614)
          >>>               cc_keyring.o:(krcc_ptcursor_next) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          
          ld.lld: error: undefined symbol: keyctl_set_timeout
          >>> referenced by cc_keyring.c:766 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:766)
          >>>               cc_keyring.o:(krcc_store) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:1345 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:1345)
          >>>               cc_keyring.o:(krcc_store) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          
          ld.lld: error: undefined symbol: keyctl_unlink
          >>> referenced by cc_keyring.c:1275 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:1275)
          >>>               cc_keyring.o:(krcc_remove_cred) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:866 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:866)
          >>>               cc_keyring.o:(krcc_destroy) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:874 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:874)
          >>>               cc_keyring.o:(krcc_destroy) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          
          ld.lld: error: undefined symbol: keyctl_clear
          >>> referenced by cc_keyring.c:845 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:845)
          >>>               cc_keyring.o:(krcc_destroy) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:845 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:845)
          >>>               cc_keyring.o:(krcc_initialize) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          
          ld.lld: error: undefined symbol: keyctl_get_keyring_ID
          >>> referenced by cc_keyring.c:321 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:321)
          >>>               cc_keyring.o:(krcc_destroy) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:322 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:322)
          >>>               cc_keyring.o:(krcc_destroy) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced by cc_keyring.c:321 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:321)
          >>>               cc_keyring.o:(krcc_initialize) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          >>> referenced 3 more times
          
          ld.lld: error: undefined symbol: keyctl_get_persistent
          >>> referenced by cc_keyring.c:298 (/home/HEILBRONN/hn11022/Downloads/krb5-1.22.2/src/lib/krb5/ccache/cc_keyring.c:298)
          >>>               cc_keyring.o:(get_collection) in archive /var/tmp/paludis/build/net-analyzer-openvas-scanner-23.45.6/work/openvas-scanner-23.45.6/rust/target/release/deps/liblibopenvas_krb5_sys-0b19fea18657001b.rlib
          collect2: error: ld returned 1 exit status

The solution was to additionally pass --without-keyutils to the static build of krb5, you probably don't run into this as you're building in an isolated docker env but it might not hurt to pass that as well.

Another thing I've noticed in the doc you linked above is:

Expected bundle layout:

archives/
├── libgcrypt.a
├── libgpg-error.a
├── libpcap.a
├── libgssapi_krb5.a
├── libkrb5.a
├── libk5crypto.a
├── libcom_err.a
├── libkrb5support.a
└── include/
    ├── gcrypt.h
    ├── gpg-error.h
    ├── pcap.h
    ├── krb5.h
    ├── com_err.h
    ├── profile.h
    ├── gssapi/
    └── krb5/

it mentions the archives/include/krb5/ directory but doesn't specify which header has to be there in the guide further down below it mentiones the headers in the gssapi subdir but not in the krb5 subdir:

https://github.com/greenbone/openvas-scanner/blob/main/rust/doc/build.md#direct-configuration-without-a-bundle-directory

OPENVAS_KRB5_INCLUDE_DIR points to the directory containing:
krb5.h
gssapi/gssapi.h
gssapi/gssapi_krb5.h

My libcom_err.a is from e2fsprogs instead of krb5:

# cave owner /usr/x86_64-pc-linux-gnu/lib/libcom_err.a
sys-fs/e2fsprogs-1.47.4::installed

but it appears to with with that as well I was able to build the rust parts again as well as our CI run for openvas-scanner 23.45.6: https://gitlab.exherbo.org/exherbo/net/-/merge_requests/3027/diffs

And a final question https://docs.greenbone.net/GSM-Manual/gos-24.10/de/upgrading-openvas-os.html#notus-scanner-replaced-by-openvasd mentiones the openvasd is already used in current versions where https://github.com/greenbone/openvas-scanner/blob/main/rust/README.md#current-status still states

The current openvasd implementation does not use and internal rust scanner yet, but still uses the c implementation of the openvas-scanner

https://github.com/greenbone/openvas-scanner/blob/main/doc/full_installation_guide.md#setting-up-services-for-systemd mentiones an API key setup for openvasd:

WARNING

The systemd setup only includes the API-key setup. Please follow the instructions at https://github.com/greenbone/openvas-scanner/tree/main/rust/openvasd for more information about authentication methods.

however the link referenced https://github.com/greenbone/openvas-scanner/tree/main/rust/openvasd does not work and leads to a 404.

Also in the systemd unit example for openvasd.service the api key is referenced in ExecStart=/. It would probably beneficial to have it passed via a dedicated environment file e.g. EnvironmentFile=-/etc/openvas/openvasd.conf
https://fedoraproject.org/wiki/Packaging:Systemd#EnvironmentFiles_and_support_for_/etc/sysconfig_files or like done in ospd-openvas.service via a --config /etc/gvm/ospd-openvas.conf option/parameter.

Edit:

• Found https://greenbone.github.io/docs/latest/22.4/source-build/index.html#openvasd & https://github.com/greenbone/openvas-scanner/tree/main/rust/src/openvasd#configuration which might answer some of my questions
• PR for fixing the dead link Fix dead link to the authentication methods in the installation guide #2226

[arch-fan]

Nix is also sandboxed. Maybe this PR #2219 is useful for you to check how to build without fetching

You don't have to understand nix that much, just read how it's being built the package. I think dynamic building is the right way, but if team decided to use static libs, that should be followed.