Is this accurate? On my system the ticket cache is configured to use a keyring, so there is no file in /tmp.

This is what original code does, that does not handle the case using keyring. How about use another issue to track this new case?

Is koji.ClientSession able to read credential from keyring?

It seems to be working fine, just the comment is a little misleading.

Got it. It's related to credential cache collection. I'll update it.

I tested this with rhpkg scratch-build --srpm and it works correctly. I also played with the code in ipython console and it works as expected with and without a kerberos ticket.

The only concern I have is that the original code did not have a hard dependency. It could manage without krbV module. This patch requires gssapi to be always present. I'm not sure how much value there is in making it work without the dependency.

Comment is updated. I'm also confused why krbV is optional in original code. It makes no sense for rhpkg.

For rhpkg kerberos is always needed, but in fedpkg it would not be used. Potentially rfpkg (for RPM Fusion) also does not need kerberos.

fedora is moving to kerberos, I think always needing it is okay, koji pulls it in as well and is moving to gssapi also as it lets you transparently work with multiple tgt's I generally have 3 tgts one for fedora, one for internal and one for my own setup. I could possibly have a 4th for stg fedora infra. not having to run kswitch all the time will be needed.

@cqi its optional because Fedora used ssl auth. the code made an assumption krb would not work if the import failed and some other auth would be used

Please do not require kerberos in rpkg. It is fine to check this i fedpkg. This is unnecessary requirement for rpkg clients which doesn't use Kerberos auth.

@pbabinca koji already requires and pulls it in, it is not something that does not already exist for users, replacing the legacy krb5 code that is not portable or flexible is a must

@ausil, I see. Ok then.

@ausil Could you try this patch for your use case at your convenience? Please let me know what issues need to fix. Thanks.

@lsedlar How about merge this patch first, and fix any Kerberos related issues reported in the future?

Sure, merge it.