Better document how to verify PGP signature

Add text clarifying our unusual packaging of the PGP signature inside
a tar file.

ticket: 7927
target_version: 1.13
tags: pullup
Fix typo in doc for krb5_get_init_creds_keytab()

ticket: 7880
target_version: 1.13.1
tags: pullup
Update mitK5features.rst for 1.13
Parse "ktadd -norandkey" in remote kadmin client

The remote kadmin client would not parse the "-norandkey" option to
the ktadd subcommand, terminating option parsing and possibly causing
options to be interpreted as principal names.

ticket: 7962
target_version: 1.13.1
tags: pullup
Report output ccache errors getting initial creds

In init_creds_step_reply, if we get an error storing output
credentials, do set ctx->complete (since retrieving creds or times
will work at this point) but don't suppress the error code.

ticket: 8028 (new)
target_version: 1.13.1
tags: pullup
Add test for kinit output ccache error

ticket: 8028
Fix cursor leak in krb5_verify_init_creds

In copy_creds_except, call krb5_cc_end_seq_get so we don't leak the
ccache cursor.

ticket: 8029 (new)
target_version: 1.13.1
tags: pullup
Remove unused variables from kprop.c

Commit 29dee7d2cece615bec4616fa9b727e77210051db removed the
need for a ccache to hold the credentials used by the process,
but did not remove the ccname and ccache variables which became
unused as a result.
Make it easier to find ASN.1 codec functions

Expand out MAKE_CODEC macro invocations into MAKE_ENCODER and
MAKE_DECODER invocations, so that the defined function names appear in
the macro calls.  This makes it easier to find the function
definitions using grep, although one still has to look up the macro to
see what it does.
Remove length limit on PKINIT PKCS#12 prompt

Long pathnames can trigger the 128-byte prompt length limit in
pkinit_get_certs_pkcs12.  Use asprintf instead of snprintf.  Also
check the result of the prompter invocation.

ticket: 8011
target_version: 1.13.1
tags: pullup
Remove KRB5_TC_OPENCLOSE handling in FILE ccache

Stop processing the KRB5_TC_OPENCLOSE flag in cc_file.c; always reopen
the file instead.  This will be replaced with more efficient cursor
handling.  Also remove some unused KRB5_TC_OPENCLOSE macros in scc.h.
Stop using KRB5_TC_OPENCLOSE

Since KRB5_TC_OPENCLOSE no longer does anything, stop setting it when
we iterate over ccaches.

ticket: 7804
Remove cc_file.c global lookup table

The FILE ccache type maintains a global reference-counted table of
handles, which is perhaps an imperfect workaround for POSIX
per-process file locks.  Remove this table, since we plan to maintain
read fds in cursors and use O_APPEND writes to render locking less
important.
Use stdio reads, O_APPEND writes in FILE ccache

Remove open file state from the cache handle, use stdio for reading,
use single O_APPEND writes for writing, and use O_CLOEXEC when
opening.  Keep the file handle open during iteration.  These changes
simplify the code, fix some concurrency issues, and reduce the
dependency on POSIX file locks.  We still acquire file locks for
compatibility with older code, and in case O_APPEND writes aren't
concurrency-atomic.

Helper functions change as follows:
* open_cache_file yields a stdio handle, and only opens and locks.
* close_cache_file takes a stdio handle.
* read_header (new) reads the file header and yields a version.
* invalidate_cache and fcc_lseek are no longer needed.
* get_size, read_bytes, and load_bytes operate on a stdio handle.
* read32, read16, load_data, load_principal, and load_cred operate on
  a stdio handle and version.
* write_bytes, store32, store16, and store_principal are no longer
  needed.

fcc_initialize now takes responsibility for writing the header and
default client principal, using a single write.  The cache cursor now
requires a mutex to serialize access to the file handle.

ticket: 8026 (new)