From ghudson at mit.edu  Mon Oct  6 12:42:43 2025
From: ghudson at mit.edu (ghudson at mit.edu)
Date: Mon,  6 Oct 2025 12:42:43 -0400 (EDT)
Subject: krb5 commit: Add paChecksum2 to PKINIT ASN.1 tests
Message-ID: <20251006164243.5CCEF103FAC@krbdev.mit.edu>

https://github.com/krb5/krb5/commit/34d661676b1db04d870be3d7ad26616aa69d1f3d
commit 34d661676b1db04d870be3d7ad26616aa69d1f3d
Author: Greg Hudson <ghudson at mit.edu>
Date:   Sun Sep 28 15:39:10 2025 -0400

    Add paChecksum2 to PKINIT ASN.1 tests
    
    Commit 310793ba63782af5ffa3a95d20e41f8f03ca7e00 added the paChecksum2
    field to krb5_pk_authenticator.  ktest_make_sample_pk_authenticator()
    does not initialize this field, leading to undefined behavior in the
    tests.  Initialize the field with a sample paChecksum2 value, and
    amend the expected output to include its encoding.
    
    Reported by Michael Osipov.

 src/tests/asn.1/krb5_decode_test.c |  2 +-
 src/tests/asn.1/ktest.c            | 42 ++++++++++++++++++++++++++++----------
 src/tests/asn.1/ktest_equal.c      | 15 +++++++++++++-
 src/tests/asn.1/pkinit_encode.out  |  2 +-
 src/tests/asn.1/pkinit_trval.out   |  6 ++++++
 5 files changed, 53 insertions(+), 14 deletions(-)

diff --git a/src/tests/asn.1/krb5_decode_test.c b/src/tests/asn.1/krb5_decode_test.c
index 25ed30e42..daeab87c3 100644
--- a/src/tests/asn.1/krb5_decode_test.c
+++ b/src/tests/asn.1/krb5_decode_test.c
@@ -1178,7 +1178,7 @@ main(int argc, char **argv)
     /* decode_krb5_auth_pack */
     {
         setup(krb5_auth_pack,ktest_make_sample_auth_pack);
-        decode_run("krb5_auth_pack","","30 81 89 A0 39 30 37 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61",
+        decode_run("krb5_auth_pack","","30 81 B0 A0 60 30 5E A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A5 25 30 23 A0 0A 04 08 6B 72 62 35 64 61 74 61 A1 15 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61",
                    acc.decode_krb5_auth_pack,
                    ktest_equal_auth_pack,ktest_free_auth_pack);
         ktest_empty_auth_pack(&ref);
diff --git a/src/tests/asn.1/ktest.c b/src/tests/asn.1/ktest.c
index 20360c8ff..d607891d3 100644
--- a/src/tests/asn.1/ktest.c
+++ b/src/tests/asn.1/ktest.c
@@ -694,17 +694,6 @@ ktest_make_maximal_pa_otp_req(krb5_pa_otp_req *p)
 
 #ifndef DISABLE_PKINIT
 
-static void
-ktest_make_sample_pk_authenticator(krb5_pk_authenticator *p)
-{
-    p->cusec = SAMPLE_USEC;
-    p->ctime = SAMPLE_TIME;
-    p->nonce = SAMPLE_NONCE;
-    ktest_make_sample_data(&p->paChecksum);
-    p->freshnessToken = ealloc(sizeof(krb5_data));
-    ktest_make_sample_data(p->freshnessToken);
-}
-
 static void
 ktest_make_sample_oid(krb5_data *p)
 {
@@ -726,6 +715,26 @@ ktest_make_sample_algorithm_identifier_no_params(krb5_algorithm_identifier *p)
     p->parameters = empty_data();
 }
 
+static void
+ktest_make_sample_pa_checksum2(krb5_pachecksum2 *p)
+{
+    ktest_make_sample_data(&p->checksum);
+    ktest_make_sample_algorithm_identifier(&p->algorithmIdentifier);
+}
+
+static void
+ktest_make_sample_pk_authenticator(krb5_pk_authenticator *p)
+{
+    p->cusec = SAMPLE_USEC;
+    p->ctime = SAMPLE_TIME;
+    p->nonce = SAMPLE_NONCE;
+    ktest_make_sample_data(&p->paChecksum);
+    p->freshnessToken = ealloc(sizeof(krb5_data));
+    ktest_make_sample_data(p->freshnessToken);
+    p->paChecksum2 = ealloc(sizeof(krb5_pachecksum2));
+    ktest_make_sample_pa_checksum2(p->paChecksum2);
+}
+
 static void
 ktest_make_sample_external_principal_identifier(
     krb5_external_principal_identifier *p)
@@ -1599,12 +1608,23 @@ ktest_empty_pa_otp_req(krb5_pa_otp_req *p)
 
 #ifndef DISABLE_PKINIT
 
+static void
+ktest_empty_pa_checksum2(krb5_pachecksum2 *p)
+{
+    ktest_empty_data(&p->checksum);
+    ktest_empty_algorithm_identifier(&p->algorithmIdentifier);
+}
+
 static void
 ktest_empty_pk_authenticator(krb5_pk_authenticator *p)
 {
     ktest_empty_data(&p->paChecksum);
     krb5_free_data(NULL, p->freshnessToken);
     p->freshnessToken = NULL;
+    if (p->paChecksum2 != NULL)
+        ktest_empty_pa_checksum2(p->paChecksum2);
+    free(p->paChecksum2);
+    p->paChecksum2 = NULL;
 }
 
 static void
diff --git a/src/tests/asn.1/ktest_equal.c b/src/tests/asn.1/ktest_equal.c
index 13786dd1e..72aa1ff6c 100644
--- a/src/tests/asn.1/ktest_equal.c
+++ b/src/tests/asn.1/ktest_equal.c
@@ -834,6 +834,18 @@ ktest_equal_sequence_of_spake_factor(krb5_spake_factor **ref,
 
 #ifndef DISABLE_PKINIT
 
+static int
+ktest_equal_pachecksum2(krb5_pachecksum2 *ref, krb5_pachecksum2 *var)
+{
+    int p = TRUE;
+    if (ref == var) return TRUE;
+    else if (ref == NULL || var == NULL) return FALSE;
+    p = p && equal_str(checksum);
+    p = p && struct_equal(algorithmIdentifier,
+                          ktest_equal_algorithm_identifier);
+    return p;
+}
+
 static int
 ktest_equal_pk_authenticator(krb5_pk_authenticator *ref,
                              krb5_pk_authenticator *var)
@@ -844,7 +856,8 @@ ktest_equal_pk_authenticator(krb5_pk_authenticator *ref,
     p = p && scalar_equal(cusec);
     p = p && scalar_equal(ctime);
     p = p && scalar_equal(nonce);
-    p = p && data_eq(ref->paChecksum, var->paChecksum);
+    p = p && equal_str(paChecksum);
+    p = p && ptr_equal(paChecksum2, ktest_equal_pachecksum2);
     return p;
 }
 
diff --git a/src/tests/asn.1/pkinit_encode.out b/src/tests/asn.1/pkinit_encode.out
index a764182e1..9ab0aee77 100644
--- a/src/tests/asn.1/pkinit_encode.out
+++ b/src/tests/asn.1/pkinit_encode.out
@@ -1,7 +1,7 @@
 encode_krb5_pa_pk_as_req: 30 38 80 08 6B 72 62 35 64 61 74 61 A1 22 30 20 30 1E 80 08 6B 72 62 35 64 61 74 61 81 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61
 encode_krb5_pa_pk_as_rep(dhInfo): A0 28 30 26 80 08 6B 72 62 35 64 61 74 61 A1 0A 04 08 6B 72 62 35 64 61 74 61 A2 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
 encode_krb5_pa_pk_as_rep(encKeyPack): 81 08 6B 72 62 35 64 61 74 61
-encode_krb5_auth_pack: 30 81 89 A0 39 30 37 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
+encode_krb5_auth_pack: 30 81 B0 A0 60 30 5E A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A5 25 30 23 A0 0A 04 08 6B 72 62 35 64 61 74 61 A1 15 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
 encode_krb5_kdc_dh_key_info: 30 25 A0 0B 03 09 00 6B 72 62 35 64 61 74 61 A1 03 02 01 2A A2 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A
 encode_krb5_reply_key_pack: 30 26 A0 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
 encode_krb5_sp80056a_other_info: 30 81 81 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A0 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A2 0A 04 08 6B 72 62 35 64 61 74 61
diff --git a/src/tests/asn.1/pkinit_trval.out b/src/tests/asn.1/pkinit_trval.out
index c47bd71f6..418be6354 100644
--- a/src/tests/asn.1/pkinit_trval.out
+++ b/src/tests/asn.1/pkinit_trval.out
@@ -40,6 +40,12 @@ encode_krb5_auth_pack:
 .  .  [2] [Integer] 42
 .  .  [3] [Octet String] "krb5data"
 .  .  [4] [Octet String] "krb5data"
+.  .  [5] [Sequence/Sequence Of]
+.  .  .  [0] [Octet String] "krb5data"
+.  .  .  [1] [Sequence/Sequence Of]
+.  .  .  .  [Object Identifier] <9>
+               2a 86 48 86 f7 12 01 02 02                    *.H......
+.  .  .  .  [Octet String] "params"
 .  [1] [Octet String] "pvalue"
 .  [2] [Sequence/Sequence Of]
 .  .  [Sequence/Sequence Of]

From ghudson at mit.edu  Mon Oct  6 13:45:54 2025
From: ghudson at mit.edu (ghudson at mit.edu)
Date: Mon,  6 Oct 2025 13:45:54 -0400 (EDT)
Subject: krb5 commit: Use configured awk in libdb2 tests
Message-ID: <20251006174554.ACE0E103FA7@krbdev.mit.edu>

https://github.com/krb5/krb5/commit/081d329beae207ee8110bb18bb2e938d3c683568
commit 081d329beae207ee8110bb18bb2e938d3c683568
Author: Greg Hudson <ghudson at mit.edu>
Date:   Mon Sep 29 02:24:33 2025 -0400

    Use configured awk in libdb2 tests

 src/plugins/kdb/db2/libdb2/test/Makefile.in |  2 +-
 src/plugins/kdb/db2/libdb2/test/run.test    | 70 ++++++++++++++---------------
 2 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/src/plugins/kdb/db2/libdb2/test/Makefile.in b/src/plugins/kdb/db2/libdb2/test/Makefile.in
index d7a22b1fc..654d9684a 100644
--- a/src/plugins/kdb/db2/libdb2/test/Makefile.in
+++ b/src/plugins/kdb/db2/libdb2/test/Makefile.in
@@ -23,7 +23,7 @@ t.be.db t.le.db:
 	$(PERL) -ne 'chomp; print pack("H*", $$_);' $? > $@
 
 check: dbtest t.be.db t.le.db runenv.sh
-	$(RUN_SETUP) srcdir=$(srcdir) TMPDIR=$(TMPDIR) $(VALGRIND) $(FCTSH) $(srcdir)/run.test
+	$(RUN_SETUP) srcdir=$(srcdir) TMPDIR=$(TMPDIR) AWK=$(AWK) $(VALGRIND) $(FCTSH) $(srcdir)/run.test
 
 bttest.o: $(srcdir)/btree.tests/main.c
 	$(CC) $(ALL_CFLAGS) -c $(srcdir)/btree.tests/main.c -o $@
diff --git a/src/plugins/kdb/db2/libdb2/test/run.test b/src/plugins/kdb/db2/libdb2/test/run.test
index ebce8e27c..92b9fd6c5 100644
--- a/src/plugins/kdb/db2/libdb2/test/run.test
+++ b/src/plugins/kdb/db2/libdb2/test/run.test
@@ -104,7 +104,7 @@ test1()
 	done
 	echo "Test 1: recno: small key, small data pairs"
 	rm -f $TMP2 $TMP3
-	awk '{ 
+	$AWK '{
 		++i;
 		printf("p\nk%d\nd%s\ng\nk%d\n", i, $0, i);
 	}' < $TMP1 > $TMP2
@@ -123,7 +123,7 @@ test2()
 	echo "Test 2: btree, hash: small key, medium data pairs"
 	mdata=abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz
 	echo $mdata |
-	awk '{ for (i = 1; i < 201; ++i) print $0 }' > $TMP1
+	$AWK '{ for (i = 1; i < 201; ++i) print $0 }' > $TMP1
 	for type in hash btree; do
 		rm -f $TMP2 $TMP3
 		for i in `getnwords 200`; do
@@ -143,7 +143,7 @@ test2()
 	echo "Test 2: recno: small key, medium data pairs"
 	rm -f $TMP2 $TMP3
 	echo $mdata | 
-	awk '{  for (i = 1; i < 201; ++i)
+	$AWK '{  for (i = 1; i < 201; ++i)
 		printf("p\nk%d\nd%s\ng\nk%d\n", i, $0, i);
 	}' > $TMP2
 	$PROG -o $TMP3 recno $TMP2
@@ -198,7 +198,7 @@ test3()
 	done
 	echo "Test 3: recno: big data pairs"
 	rm -f $TMP2 $TMP3
-	awk '{
+	$AWK '{
 		++i;
 		printf("p\nk%d\nD%s\ng\nk%d\n", i, $0, i);
 	}' < $BINFILES > $TMP2
@@ -218,7 +218,7 @@ test4()
 {
 	echo "Test 4: recno: random entries"
 	echo "abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg" |
-	awk '{
+	$AWK '{
 		for (i = 37; i <= 37 + 88 * 17; i += 17) {
 			if (i % 41)
 				s = substr($0, 1, i % 41);
@@ -244,7 +244,7 @@ test4()
 	}' > $TMP1
 	rm -f $TMP2 $TMP3
 	cat $TMP1 |
-	awk 'BEGIN {
+	$AWK 'BEGIN {
 			i = 37;
 			incr = 17;
 		}
@@ -282,7 +282,7 @@ test5()
 {
 	echo "Test 5: recno: reverse order entries"
 	echo "abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg" |
-	awk ' {
+	$AWK ' {
 		for (i = 1500; i; --i) {
 			if (i % 34)
 				s = substr($0, 1, i % 34);
@@ -294,7 +294,7 @@ test5()
 	}' > $TMP1
 	rm -f $TMP2 $TMP3
 	cat $TMP1 |
-	awk 'BEGIN {
+	$AWK 'BEGIN {
 			i = 1500;
 		}
 		{
@@ -318,7 +318,7 @@ test6()
 {
 	echo "Test 6: recno: alternating order entries"
 	echo "abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg" |
-	awk ' {
+	$AWK ' {
 		for (i = 1; i < 1200; i += 2) {
 			if (i % 34)
 				s = substr($0, 1, i % 34);
@@ -337,7 +337,7 @@ test6()
 	}' > $TMP1
 	rm -f $TMP2 $TMP3
 	cat $TMP1 |
-	awk 'BEGIN {
+	$AWK 'BEGIN {
 			i = 1;
 			even = 0;
 		}
@@ -370,7 +370,7 @@ test7()
 {
 	echo "Test 7: btree, recno: delete cursor record"
 	echo "abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg" |
-	awk '{
+	$AWK '{
 		for (i = 1; i <= 120; ++i)
 			printf("%05d: input key %d: %s\n", i, i, $0);
 		printf("%05d: input key %d: %s\n", 120, 120, $0);
@@ -383,7 +383,7 @@ test7()
 
 	for type in btree recno; do
 		cat $TMP1 |
-		awk '{
+		$AWK '{
 			if (i == 120)
 				exit;
 			printf("p\nk%d\nd%s\n", ++i, $0);
@@ -426,7 +426,7 @@ test8()
 	    exit 1
 	fi
 	echo "" | 
-	awk 'BEGIN {
+	$AWK 'BEGIN {
 		for (i = 1; i <= 10; ++i) {
 			printf("p\nkkey1\nD/bin/sh\n");
 			printf("p\nkkey2\nD'$tfile'\n");
@@ -454,7 +454,7 @@ test9()
 {
 	echo "Test 9: btree: duplicate keys"
 	echo "abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg" |
-	awk '{
+	$AWK '{
 		for (i = 1; i <= 543; ++i)
 			printf("%05d: input key %d: %s\n", i, i, $0);
 		exit;
@@ -463,7 +463,7 @@ test9()
 
 	for type in btree; do
 		cat $TMP1 | 
-		awk '{
+		$AWK '{
 			if (i++ % 2)
 				printf("p\nkduplicatekey\nd%s\n", $0);
 			else
@@ -487,7 +487,7 @@ test10()
 {
 	echo "Test 10: btree, recno: test cursor flag use"
 	echo "abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg" |
-	awk '{
+	$AWK '{
 		for (i = 1; i <= 20; ++i)
 			printf("%05d: input key %d: %s\n", i, i, $0);
 		exit;
@@ -497,7 +497,7 @@ test10()
 	# Test that R_CURSOR doesn't succeed before cursor initialized
 	for type in btree recno; do
 		cat $TMP1 |
-		awk '{
+		$AWK '{
 			if (i == 10)
 				exit;
 			printf("p\nk%d\nd%s\n", ++i, $0);
@@ -514,7 +514,7 @@ test10()
 	done
 	for type in btree recno; do
 		cat $TMP1 |
-		awk '{
+		$AWK '{
 			if (i == 10)
 				exit;
 			printf("p\nk%d\nd%s\n", ++i, $0);
@@ -536,7 +536,7 @@ test11()
 {
 	echo "Test 11: recno: reverse order insert"
 	echo "abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg" |
-	awk '{
+	$AWK '{
 		for (i = 1; i <= 779; ++i)
 			printf("%05d: input key %d: %s\n", i, i, $0);
 		exit;
@@ -545,7 +545,7 @@ test11()
 
 	for type in recno; do
 		cat $TMP1 |
-		awk '{
+		$AWK '{
 			if (i == 0) {
 				i = 1;
 				printf("p\nk1\nd%s\n", $0);
@@ -585,7 +585,7 @@ test12()
 	echo "Test 12: btree: lots of keys, small page size"
 	mdata=abcdefghijklmnopqrstuvwxy
 	echo $mdata |
-	awk '{ for (i = 1; i < 20001; ++i) print $0 }' > $TMP1
+	$AWK '{ for (i = 1; i < 20001; ++i) print $0 }' > $TMP1
 	for type in btree; do
 		rm -f $TMP2 $TMP3
 		for i in `getnwords 20000 | rev`; do
@@ -654,7 +654,7 @@ test20()
 	echo\
     "Test 20: hash: bucketsize, fill factor; nelem 25000 cachesize 65536"
 	echo "abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg" |
-	awk '{
+	$AWK '{
 		for (i = 1; i <= 10000; ++i) {
 			if (i % 34)
 				s = substr($0, 1, i % 34);
@@ -665,7 +665,7 @@ test20()
 		exit;
 	}' > $TMP1
 	getnwords 10000 |
-	awk 'BEGIN {
+	$AWK 'BEGIN {
 		ds="abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg"
 	}
 	{
@@ -676,7 +676,7 @@ test20()
 		printf("p\nk%s\nd%s\n", $0, s);
 	}' > $TMP2
 	getnwords 10000 |
-	awk '{
+	$AWK '{
 		++i;
 		printf("g\nk%s\n", $0);
 	}' >> $TMP2
@@ -770,7 +770,7 @@ test40 () {
 	e=:
 	for psize in 512 1024 2048 4096 8192; do
 		echo "    page size $psize"
-		kdsizes=`awk 'BEGIN {
+		kdsizes=`$AWK 'BEGIN {
 			psize = '$psize'; hsize = int(psize/2);
 			for (kdsize = hsize-40; kdsize <= hsize; kdsize++) {
 				print kdsize;
@@ -786,7 +786,7 @@ test40 () {
 		# for a split on index 0.
 
 		for kdsize in $kdsizes; do
-			awk 'BEGIN {
+			$AWK 'BEGIN {
 				kdsize = '$kdsize';
 				for (i = 8; i-- > 0; ) {
 					s = sprintf("a%03d:%09d", i, kdsize);
@@ -890,7 +890,7 @@ EOF
 	echo "$list") |
 	# awk script input:
 	# {p|g|r} key [datasize]
-	awk '/^[pgr]/{
+	$AWK '/^[pgr]/{
 		printf("%s\nk%s\n", $1, $2);
 	}
 	/^p/{
@@ -903,7 +903,7 @@ EOF
 	!/^[pgr]/{
 		print $0;
 	}' > $TMP2
-	(echo "$list"; echo "$list") | awk '{
+	(echo "$list"; echo "$list") | $AWK '{
 		s = $2;
 		for (i = 0; i < $3; i++) {
 			s = s "x";
@@ -936,9 +936,9 @@ test50 () {
 		print "u";
 		print "u";
 	}'
-	(echo $fill | awk "$script"; echo o) > $TMP2
+	(echo $fill | $AWK "$script"; echo o) > $TMP2
 	echo $fill |
-	awk '{
+	$AWK '{
 		for (i = 0; i < 20000; i++) {
 			printf("%05d%s\n", i, $0);
 		}
@@ -948,7 +948,7 @@ test50 () {
 		echo "test50: btree: unexpected success after unlinking pages"
 		exit 1
 	fi
-	(echo $fill | awk "$script"; echo O) > $TMP2
+	(echo $fill | $AWK "$script"; echo O) > $TMP2
 	$PROG -o $TMP3 -i psize=512 btree $TMP2
 	if (cmp -s $TMP1 $TMP3); then :
 	else
@@ -961,7 +961,7 @@ test60 () {
 	echo "Test 60: btree: big key, small data, byteswap unaligned access"
 	# 488 = 512 - 20 (header) - 3 ("foo") - 1 (newline)
 	(echo foo; echo bar) |
-	awk '{
+	$AWK '{
 		s = $0
 		for (i = 0; i < 488; i++) {
 			s = s "x";
@@ -977,7 +977,7 @@ test61 () {
 	echo "Test 61: btree: small key, big data, byteswap unaligned access"
 	# 484 = 512 - 20 (header) - 7 ("foo1234") - 1 (newline)
 	(echo foo1234; echo bar1234) |
-	awk '{
+	$AWK '{
 		s = $0
 		for (i = 0; i < 484; i++) {
 			s = s "x";
@@ -992,7 +992,7 @@ test61 () {
 test62 () {
 	echo "Test 62: btree: small key, big data, known byte order files"
 	(echo foo1234; echo bar1234) |
-	awk '{
+	$AWK '{
 		s = $0
 		for (i = 0; i < 484; i++) {
 			s = s "x";
@@ -1017,7 +1017,7 @@ test63 () {
 	# 223 = 232 - 8 (key pointer)
 	# 232 = bt_ovflsize = (512 - 20 (header)) / 2 (DEFMINKEYPAGE)
 	#	- (2 (indx_t) + 12 (NBLEAFDBT(0,0)))
-	awk 'BEGIN {
+	$AWK 'BEGIN {
 		s = "";
 		for (i = 0; i < 488; i++) {
 			s = s "x";

From ghudson at mit.edu  Wed Oct 15 02:07:24 2025
From: ghudson at mit.edu (ghudson at mit.edu)
Date: Wed, 15 Oct 2025 02:07:24 -0400 (EDT)
Subject: krb5 commit: Fix fallback macros in udppktinfo.c
Message-ID: <20251015060724.EE65F104166@krbdev.mit.edu>

https://github.com/krb5/krb5/commit/67abc25fa9deadd3638bb1b78373d2f08de0d54d
commit 67abc25fa9deadd3638bb1b78373d2f08de0d54d
Author: Sergey Fedorov <vital.had at gmail.com>
Date:   Fri Oct 10 13:54:40 2025 +0800

    Fix fallback macros in udppktinfo.c
    
    Commit 87b7d86676bff0b64a9eea39849abc97fdbe2972 changed the signatures
    of several udppktinfo.c functions, but did not update the fallback
    macro signatures to match.  Update the fallback macros.  Fixes a build
    error observed on macOS 10.6.8.
    
    [ghudson at mit.edu: fixed additional fallback macros; edited commit
    message]

 src/lib/apputils/udppktinfo.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/lib/apputils/udppktinfo.c b/src/lib/apputils/udppktinfo.c
index 8eed7a29d..2f4bb8a09 100644
--- a/src/lib/apputils/udppktinfo.c
+++ b/src/lib/apputils/udppktinfo.c
@@ -210,7 +210,7 @@ check_cmsg_ip_recvdstaddr(struct cmsghdr *cmsgptr, struct sockaddr_in *to,
 }
 
 #else /* HAVE_IP_PKTINFO || IP_RECVDSTADDR */
-#define check_cmsg_v4_pktinfo(c, t, l, a) 0
+#define check_cmsg_v4_pktinfo(c, t, a) 0
 #endif /* HAVE_IP_PKTINFO || IP_RECVDSTADDR */
 
 #ifdef HAVE_IPV6_PKTINFO
@@ -240,7 +240,7 @@ check_cmsg_ipv6_pktinfo(struct cmsghdr *cmsgptr, struct sockaddr_in6 *to,
     return 0;
 }
 #else /* HAVE_IPV6_PKTINFO */
-#define check_cmsg_v6_pktinfo(c, t, l, a) 0
+#define check_cmsg_v6_pktinfo(c, t, a) 0
 #endif /* HAVE_IPV6_PKTINFO */
 
 static int
@@ -363,7 +363,7 @@ set_msg_from_ip_sendsrcaddr(struct msghdr *msg, struct cmsghdr *cmsgptr,
 }
 
 #else /* HAVE_IP_PKTINFO || IP_SENDSRCADDR */
-#define set_msg_from_ipv4(m, c, f, l, a) EINVAL
+#define set_msg_from_ipv4(m, c, f, a) EINVAL
 #endif /* HAVE_IP_PKTINFO || IP_SENDSRCADDR */
 
 #ifdef HAVE_IPV6_PKTINFO
@@ -398,7 +398,7 @@ set_msg_from_ipv6_pktinfo(struct msghdr *msg, struct cmsghdr *cmsgptr,
 }
 
 #else /* HAVE_IPV6_PKTINFO */
-#define set_msg_from_ipv6(m, c, f, l, a) EINVAL
+#define set_msg_from_ipv6(m, c, f, a) EINVAL
 #endif /* HAVE_IPV6_PKTINFO */
 
 static krb5_error_code

From ghudson at mit.edu  Wed Oct 15 11:00:53 2025
From: ghudson at mit.edu (ghudson at mit.edu)
Date: Wed, 15 Oct 2025 11:00:53 -0400 (EDT)
Subject: krb5 commit: Ensure defined behavior in k5_kt_have_match()
Message-ID: <20251015150053.BC4E0104173@krbdev.mit.edu>

https://github.com/krb5/krb5/commit/4e5d98464e83fd90faa55c2e11bec813a28c89ee
commit 4e5d98464e83fd90faa55c2e11bec813a28c89ee
Author: Greg Hudson <ghudson at mit.edu>
Date:   Sun Oct 12 14:03:06 2025 -0400

    Ensure defined behavior in k5_kt_have_match()
    
    match_entries() in ktfns.c admits uninitialized use of match if the
    loop runs for zero iterations (the keytab is valid but contains no
    entries).  Initialize match to false to properly handle this case.
    Fixes a -Werror compilation failure on macOS 10.6.8 reported by Sergey
    Fedorov.

 src/lib/krb5/keytab/ktfns.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/krb5/keytab/ktfns.c b/src/lib/krb5/keytab/ktfns.c
index d6658b35f..f3945f9da 100644
--- a/src/lib/krb5/keytab/ktfns.c
+++ b/src/lib/krb5/keytab/ktfns.c
@@ -138,7 +138,7 @@ match_entries(krb5_context context, krb5_keytab keytab,
     krb5_error_code ret;
     krb5_keytab_entry ent;
     krb5_kt_cursor cursor;
-    krb5_boolean match;
+    krb5_boolean match = FALSE;
 
     /* Scan the keytab for host-based entries matching accprinc. */
     ret = krb5_kt_start_seq_get(context, keytab, &cursor);