(In reply to comment #0)
> Needing to download PolicyKit in order to attempt packaging it for Mac OS X
> (libvirt client dependency).

Please don't do that. While PolicyKit probably *can* be used for this, it isn't really intended to be an abstraction layer for all kinds of native authorization frameworks.

For starters, on OS X, it would require having a system message bus running and I don't think you want to require that - it would only make installation really painful as you would need the user to be an administrator. Instead, you really want to deliver your client-side libvirt software as an AppFolder inside a .dmg that the user can simply drag to his Applications folder. Without any "please enter your password" prompts to slow him down. </ramble>

Let me get this straight - you only need this for the client-side bits of libvirt, right? E.g. you are not attempting to run virtd on OS X are you?

Anyway, if you really need to, I think libvirt should use native authorization libraries on OS X (but if it's only the client-side bits you need then, hey, you probably don't even need that). In any case, this page might be helpful...

 http://developer.apple.com/library/mac/#documentation/Security/Conceptual/authorization_concepts/01introduction/introduction.html


> But... there aren't any links to download PolicyKit on the PolicyKit front
> page.
> 
> While closing down windows after giving up, one of them stood out as actually
> having downloads on it:
> 
>     http://cgit.freedesktop.org/PolicyKit/
> 
> *PLEASE* put a "Downloads" link on the front page of the PolicyKit website, so
> people that have a need to download it can.  (git is not suitable for
> packagers)
> 
> Even better would be having a list of directly clickable links.  i.e.:
> 
>   Downloads
>   *********
>   PolicyKit 1.00 - "Download link"
>   PolicyKit 0.99 - "Download link"
>   PolicyKit 0.98 - "Download link"
>   PolicyKit 0.97 - "Download link"
>   Older Releases - "Download link"
> 
> But that's me being wistful. ;)

Do you mean this page?

 http://freedesktop.org/wiki/Software/PolicyKit

FWIW, I just haven't spend a lot of time on the softer aspects of PolicyKit - e.g. community building, web pages and so on. Just haven't had the time for this.

> Please don't do that. While PolicyKit probably *can* be used for this, it isn't
> really intended to be an abstraction layer for all kinds of native
> authorization frameworks.

No worries.  The attempt to package it, for libvirt, was after noticing that libvirt client software (ie virsh) without PolicyKit support would not auth successfully to a libvirt daemon that was using PolicyKit.  Even on Linux.

The same client software, with PolicyKit enabled, connects and operates fine.

Seeing that behaviour, I'd drawn the mental link of "Guess we need PolicyKit support compiled into clients for them to work."

Having beaten my head against the wall for several hours trying to get PolicyKit working on Mac OS X, from git, without success I then looked at the auth failure thing again.

My suspicion here is that it may be a bug in the the libvirt side of things.  I'm thinking that having, or not having, PolicyKit support compiled in to the client shouldn't affect the connection.  The libvirt daemon appears to actually be getting the connection, then dropping it.

PolicyKit is kind of hard to debug, to see if it's actually getting the connection.  But it's not spitting out an auth rejection message, and the libvirt daemon is acknowledging "something", so I'm guessing the auth worked. i.e. my original problem problem here is more likely a libvirt daemon issue I need to look at.


> For starters, on OS X, it would require having a system message bus running and
> I don't think you want to require that - it would only make installation really
> painful as you would need the user to be an administrator.

Yeah, agreed.  The "Homebrew" package system on Mac OS X already has dbus packaged, which means that bit might have been workable anyway.


> Instead, you really want to deliver your client-side libvirt software as an AppFolder inside a .dmg
> that the user can simply drag to his Applications folder. Without any "please
> enter your password" prompts to slow him down. </ramble>

Semi-agreement here.  ;)

Offering people downloads of the libvirt client tools, as a .dmg file, is definitely something I feel would be optimal.  It's also something I'd like to get happening in the near future too.

But, I need to get the libvirt client to "work properly" to start with, so am leveraging from the existing Mac OS X package management systems to get there.

Since I'm doing that, I figured I might as well create the "libvirt" client package for the package management systems too, as it'll "probably be useful" for people. :)


> http://developer.apple.com/library/mac/#documentation/Security/Conceptual/authorization_concepts/01introduction/introduction.html

Thanks for the link.  Definitely agree that we should use "native OS" authentication if we ever look to get the libvirt daemon running on OSX, instead of just the client libraries.


>  http://freedesktop.org/wiki/Software/PolicyKit
> 
> FWIW, I just haven't spend a lot of time on the softer aspects of PolicyKit -
> e.g. community building, web pages and so on. Just haven't had the time for
> this.

Oh wow.  That's the page I needed.  Looked at it previously, but the first thing that shows up is PolicyKit* related (ie the previous non polkit-* stuff) so it just looked like an outdated link.

Are you able to give me Edit access to the PolicyKit freedesktop front page?  I'll add direct clickable download links on it for the current releases. (0.92-present).

http://freedesktop.org/wiki/Software/PolicyKit now has a link to where releases can be found