libkrad: implement support for Message-Authenticator (CVE-2024-3596)
Fix various issues detected by static analysis
Remove RSA protocol for PKINIT
Make TCP waiting time configurable

New upstream version (1.21.3)
CVE-2024-26458: Memory leak in src/lib/rpc/pmap_rmt.c
CVE-2024-26461: Memory leak in src/lib/gssapi/krb5/k5sealv3.c
CVE-2024-26462: Memory leak in src/kdc/ndr.c
Add missing SPDX license identifiers

CVE-2024-37370 CVE-2024-37371: GSS message token handling
Fix double free in klist's show_ccache()
Do not include files with "~" termination in krb5-tests

Fix double free in klist's show_ccache()
Store krb5-tests files in architecture-specific directories

Use SPDX expression for license tag
Fix unimportant memory leaks

New upstream version (1.21.2)
Fix double-free in KDC TGS processing (CVE-2023-39975)
Make tests compatible with Python 3.12

Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

Replace file dependency with package name

New upstream version (1.21)
Do not disable PKINIT if some of the well-known DH groups are unavailable
Make PKINIT CMS SHA-1 signature verification available in FIPS mode
Allow to set PAC ticket signature as optional
Add support for MS-PAC extended KDC signature (CVE-2022-37967)
Fix syntax error in aclocal.m4

Add support for MS-PAC extended KDC signature (CVE-2022-37967)

Bypass FIPS restrictions to use KRB5KDF in case AES SHA-1 HMAC is enabled
Lazily load MD4/5 from OpenSSL if using RADIUS or RC4 enctype in FIPS mode

Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

Set aes256-cts-hmac-sha384-192 as EXAMLE.COM master key in kdc.conf
Add AES SHA-2 HMAC family as EXAMPLE.COM supported etypes in kdc.conf

Strip debugging data from ksu executable file

Include missing OpenSSL FIPS header
Make tests compatible with sssd_krb5_locator_plugin.so

Enable TMT integration with Fedora CI