Add packages: krb5 for php and krb5-user CLI utils

[mmattel]

For the ownCloud Server Docker container, we need the:

• krb5.so php extension installed and enabled (also for Apache) and the
• krb5-user command line binaries which includes the kvno tool

These dependencies are required by the Kerberos-App and WND depends on it.

@DeepDiver1975 as discussed.

[DeepDiver1975]

this will blow up our image for very little help. kerberos is an enterprise feature with very limited usage.

@mmattel for the time being please add a note to the docs to reach out to our support to help in migrating their setups ....

[mmattel]

Compromise, I can add a comment, as I did somewhere else, that these components need to be installed manually via an own Dockerfile.

[DeepDiver1975]

Investigation: krb5 PHP extension + krb5-user (Ubuntu 24.04 / php8.3)

Package availability findings

Requirement	Availability in Ubuntu 24.04 (noble)	Verdict
krb5-user CLI (incl. kvno)	apt package krb5-user 1.20.1, provides /usr/bin/kvno, kinit, klist, etc.	✅ trivial apt add
krb5 PHP extension	No apt package exists (no php-krb5 / php8.3-krb5). All 36 krb5 apt packages are libs/KDC/PAM — none is a PHP binding.	⚠️ must build from PECL
Build header	apt libkrb5-dev 1.20.1	✅ available
PECL krb5	latest stable 1.2.4 (2025-03-16), requires PHP ≥ 7.0 → compatible with 8.3	✅

The complication: the current v24.04/Dockerfile.multiarch installs all extensions as apt packages and then purges the entire build toolchain (*-dev, g++, make, cmake, …) at the end of the same RUN. The krb5 extension has no apt package, so it requires phpize/pecl + libkrb5-dev + a compiler — exactly the tooling that gets purged. So this is a build-then-purge change, not a one-line package add.

Proposed plan (v24.04 only for now)

1. Add CLI utils — append krb5-user to the --no-install-recommends install list. This alone delivers kvno.

2. Build & enable the PHP extension via PECL, inside the existing RUN before the purge step:

   • Add build-only deps: php-pear, php8.3-dev, libkrb5-dev (plus gcc/make/autoconf, present in the base image but later purged).
   • pecl install krb5-1.2.4 (pinned for reproducibility, matching the repo's digest-pinning habit).
   • Enable for both SAPIs the Ubuntu-native way:

     echo "extension=krb5.so" > /etc/php/8.3/mods-available/krb5.ini
     phpenmod krb5
     

     phpenmod symlinks it into both /etc/php/8.3/cli/conf.d/ and /etc/php/8.3/apache2/conf.d/, satisfying "enabled for CLI and Apache."

3. Extend the purge list to also drop php-pear php8.3-dev so build tooling doesn't bloat the final image. libkrb5-dev is covered by the existing '*-dev' glob; the runtime libkrb5-3 / libgssapi-krb5-2 libs stay (deps of krb5-user), so the extension keeps its shared libs.

4. Update the CI smoke test in .github/workflows/main.yml for 24.04 — also assert php -m | grep -qF krb5 and command -v kvno, giving CI coverage that the build actually worked.

5. Add a CHANGELOG.md entry under a new dated section.

Open decisions

• Pin vs. float the PECL version? Recommendation: pin krb5-1.2.4 (consistent with this repo's digest-pinning + Renovate setup), accepting that Renovate won't auto-bump a PECL pin.
• v22.04 (php7.4 / Freexian mirror) deliberately excluded from this scope. It'd be harder there: PHP 7.4 comes from the auth'd Freexian mirror and the build-dep story is messier (PECL 1.2.4 does still support 7.4). Can spec separately if wanted.