- note RT numbers for reference

- include but don't apply the other suggested patch for
    kpasswd-doesn't-use-tcp

krb5-1.6.2-key_exp.patch

@@ -1,5 +1,5 @@
 Sadique Puthen notes that the warning on the client side seems to be correspond
-to the wrong attribute on the KDC.  Do what RFC4120 says we should do.
+to the wrong attribute on the KDC.  Do what RFC4120 says we should do.  RT#5755.
 --- krb5-1.6.2/src/kdc/do_as_req.c	2007-06-25 15:49:06.000000000 -0400
 +++ krb5-1.6.2/src/kdc/do_as_req.c	2007-06-25 15:49:08.000000000 -0400
 @@ -371,7 +371,14 @@ process_as_req(krb5_kdc_req *request, kr

krb5-trunk-kpasswd_tcp.patch

@@ -1,4 +1,5 @@
-Fall back to TCP on kdc-unresolvable/unreachable errors.
+Fall back to TCP on kdc-unresolvable/unreachable errors.  We still have
+to wait for UDP to fail, so this might not be ideal.  RT #5868.
 
 Index: src/lib/krb5/os/changepw.c
 ===================================================================

krb5-trunk-seqnum.patch

@@ -5,6 +5,7 @@ messages will mess with the counters in the auth_context.  Because the
 current code attempts to reuse auth_context structures (and changing that
 would be more invasive), we'll just save the sequence number values as they
 are after we build the AP-REQ, and restore them before generating requests.
+RT#5867.
 
 Index: src/lib/krb5/os/changepw.c
 ===================================================================

krb5.spec

@@ -93,6 +93,7 @@ Patch63: krb5-1.6.1-selinux-label.patch
 Patch64: krb5-ok-as-delegate.patch
 Patch68: krb5-trunk-spnego_delegation.patch
 Patch69: krb5-trunk-seqnum.patch
+Patch70: krb5-trunk-kpasswd_tcp2.patch
 
 License: MIT, freely distributable.
 URL: http://web.mit.edu/kerberos/www/
@@ -1281,6 +1282,7 @@ popd
 #%patch64 -p0 -b .ok-as-delegate
 #%patch68 -p0 -b .spnego_delegation
 #%patch69 -p0 -b .seqnum
+#%patch70 -p0 -b .kpasswd_tcp2
 cp src/krb524/README README.krb524
 gzip doc/*.ps