Make resources.rst more useful to non-devs

Reorder the IRC channel listing so #kerberos is first.  (Developers
form a smaller part of our audience for this documentation set.)
Remove some details that are available on the wiki and not of interest
to non-developers.

Add a pointer to the wiki.

Fix minor grammar errors in Archives.

ticket: 7482 (new)
target_version: 1.11
tags: pullup
Reformat RST to avoid sphinx warnings

Old versions of docutils will see inline markup (e.g., :ref:`foo`)
at the beginning of a line in the content of a directive block
and attempt to interpret that markup as options or arguments
to the directive.  RST intended as inline markup (as opposed to
modifying the behavior of the directive) will not be interpretable
in this context, and causes Sphinx to emit a warning.

Work around this behavior by always leaving a blank line before
the content of a directive block, forcing it to be interpreted
as content and not options or arguments.

The buggy behavior was only encountered in note environments, but
for consistency of style, also reformat warning and error blocks.

Note the new style constraint in doc/README.

ticket: 7469 (new)
title: doc buildslave generates sphinx warnings
tags: pullup
target_version: 1.11
Do not generate unused parts of toctree

Our css only displays up to depth 3 of the toctree, partially
because the API reference content explodes at depth 4 and that would
not be pretty to see in the sidebar.  However, we would previously
always generate HTML for the full toctree and hide parts with CSS.
For the apiref, this proved to be about 65k per html file, and we
have one html file per function/type/macro.

Limit the depth of the toctree that gets generated to save on space
in the release tarball.

Unfortunately, there seems to be a Sphinx bug wherein the toctree
will only be generated to depth 1 for a document at a depth greater
than the maxdepth of the toctree, so the sidebar table of contents
on individual apiref pages will just be the toplevel toctree.
This issue is being tracked at
https://bitbucket.org/birkenfeld/sphinx/issue/1046/

ticket: 7466 (new)
tags: pullup
target_version: 1.11
Do not include hidden files in the sidebar

We play games with hidden toctrees in the RST source to avoid
Sphinx warnings; make sure that they do not affect the rendered
output.

ticket: 7467 (new)
tags: pullup
target_version: 1.11
Note notice.txt's dependency on version.py

This dependency has been in effect since the notice build was changed
to use the main conf.py, due to its unconditional execfile('version.py').
Adding another conditional in conf.py seems to add needless complication,
it is easier to just note the dependency in the Makefile and carry on.

ticket: 7470 (new)
title: NOTICE build has unnoted dependency on version.py
tags: pullup
target_version: 1.11
Fix typo

We do not have any files with extension "rxt".

ticket: 7471 (new)
title: typo in exclude_patterns for notice build
tags: pullup
target_version: 1.11
Fix various integer issues

In kdc_util.c and spnego_mech.c, error returns from ASN.1 length
functions could be ignored because they were assigned to unsigned
values.  In spnego_mech.c, two buffer size checks could be rewritten
to reduce the likelihood of pointer overflow.  In dump.c and
kdc_preauth.c, calloc() could be used to simplify the code and avoid
multiplication overflow.  In pkinit_clnt.c, the wrong value was
checked for a null result from malloc(), and the code could be
simplified.

Reported by Nickolai Zeldovich <nickolai@csail.mit.edu>.

ticket: 7488
Don't use $(RM) in src/doc/Makefile.in

We allow these rules to be used in an unconfigured tree, and some
makes do not supply a value for RM by default.

ticket: 7492 (new)
subject: Doc build in unconfigured tree broken on some platforms
tags: pullup
target_version: 1.11
Do not document unused symbols

The macro KRB5_KEYUSAGE_PA_REFERRAL was defined in an early revision
of draft-ietf-krb-wg-kerberos-referrals but did not make it into
RFC 6806.  We retain the definition so as to not break code implementing
the early draft, but need not document it.

Likewise, the krb5_octet_data structure and krb5_free_octet_data routine
are marked as having been originally introduced for PKINIT and "Do not
use this."  They are in fact unused, and should not be documented, but
the actual definitions must remain for compatibility.

ticket: 7489 (new)
tags: pullup
target_version: 1.11
Update comments for RFC 3244 kpasswd extensions

Remove the inaccurate comments "unused" and replace them with
more useful representations of what they mean.

ticket: 7490 (new)
tags: pullup
target_version: 1.11
Make building docs easier in an unconfigured tree

Instead of requiring the user to specify srcdir, top_srcdir, PYTHON,
and possibly more in the future, make an 'htmlsrc' target that does so
for them.

This also lets us do the clean in the same step, so that only one
command is required of the user.

ticket: 7491 (new)
tags: pullup
target_version: 1.11
Make sphinx warnings fatal for doc build

We currently do not have any warnings.  Let us keep it that way by
making warnings fatal in maintainer-mode (and configurable on the
buildslaves).  Using sphinx-build -W also causes errors to be reported
in the exit status and picked up by make, which is quite useful.

In order to allow the build bot to use -W but end-users to not use it,
SPHINX_ARGS must be passed on the command line; it cannot be set by
the convenience target 'htmlsrc'.  Document this.

ticket: 7468 (new)
tags: pullup
target_version: 1.11
Update manpage version on master

Now that version.py is in place to update Sphinx's idea of the
version number in accordance reality, update the version in the
man pages that we check in; the master branch is currently a 1.12 prerelease.
Regenerate checked-in man pages

Pick up changes to kadmin.rst and krb5_conf.rst adding cross-references
for account lockout and detailing parameter expansion for keytab
and credentials cache names in krb5.conf

ticket: 7494 (new)
tags: pullup
target_version: 1.11
Don't finalize libraries in static build

In a build with static libraries, functions tagged with
__attribute__((destructor)) may be executed in any order, not in a
topologically sorted order as they are in shared libraries.  This
could result in libcom_err functions being invoked (from another
library's finalizer) after libcom_err has been finalized, which would
(at minimum) result in using a mutex after it is destroyed.  To
prevent this kind of problem, disable finalizers in the static build
regardless of whether we have compiler or linker support for them.
Reported by Mihai Serban <mihai.serban@gmail.com>.