                       User-Visible kstart Changes

kstart 3.10 (2007-04-10)

    Fix compilation error with a new enough MIT Kerberos to support
    krb5_get_error_message and with et/com_err.h instead of com_err.h
    (such as Fedora Core 6).  Thanks, Stefan Foerster.

    Rework the configure script to use AS_IF instead of explicit if
    statements, which allows Autoconf to do better dependency analysis.

kstart 3.9 (2007-03-02)

    Separate authenticating from running aklog in k4start, k5start, and
    krenew.  Just because we have a valid ticket cache doesn't mean that
    we already have a token since we just created a new PAG.  If running
    aklog was requested, always do so even if we didn't get new tickets.

kstart 3.8 (2007-03-02)

    Allow -H to be used with a command in k4start and k5start.  In this
    case, check the existing ticket cache and authenticate if it's stale,
    then run the command in either case.  This is useful when running
    several commands with the same credentials at near the same time.  It
    reduces Kerberos traffic and avoids service ticket requests being
    rejected as possible relay attacks.

    Support the new MIT Kerberos error message functions.

    Overhaul the build system.  Use Automake, use a better strategy for
    dealing with portability issues, and factor duplicate code out into
    shared files.

kstart 3.7 (2007-01-28)

    Correctly honor the argument to -H for k4start and k5start.  This was
    lost during an earlier code restructuring.  Thanks to Thomas Weiss for
    the bug report.

    Document that -K will renew a ticket if it will expire within two
    minutes of the next wakeup, not just if it will expire before the next
    wakeup.

kstart 3.6 (2006-10-04)

    Call k_hasafs before k_setpag in builds with the kafs functions.
    Without calling k_hasafs first, k_setpag may fail or die with a
    signal.  Thanks to Thomas Kula for the bug report.

    Document in the man pages when a new PAG is created.

    Avoid $< in non-pattern rules.  This doesn't work with some non-GNU
    makes.

kstart 3.5 (2006-06-13)

    When invoked to run a command, k4start, k5start, and krenew now
    propagate HUP, TERM, and QUIT signals to the child process rather than
    just exiting.  These signals do not terminate k4start, k5start, or
    krenew any longer, but of course they will exit if the signal causes
    the child process to exit.  Patch from Adam Megacz.

    Minor Makefile updates to support Autoconf 2.60.

kstart 3.4 (2006-05-05)

    k5start now rechecks the ticket cache and possibly reauthenticates
    after backgrounding itself when running as a daemon.  This works
    around the loss of the ticket cache after backgrounding on Mac OS X
    with the default ticket cache type.

    Force the use of a file ticket cache in k5start and krenew if the -k
    option is given.  The code was assuming that a file ticket cache was
    the default, which may not always be the case.

    Document in the krenew man page that the -b option may not do what one
    desires on Mac OS X and suggest an alternative that doesn't detach
    from the current session.

    krenew no longer runs aklog unless the -t flag was given.  Previously,
    due to a bug, it would skip running aklog the first time unless -t was
    given but would then always run aklog if either a compiled-in default
    or a default from the environment were available.

kstart 3.3 (2006-04-10)

    Add a missing <stdarg.h> include that caused compilation failures on
    OS X in krenew and could have led to latent problems on other
    platforms.

    Clarify that the DIR argument to --with-afs-setpag is optional in
    configure --help output.

kstart 3.2 (2006-03-05)

    Revert the -g feature.  MIT Kerberos refuses to use ticket caches not
    owned by the running process, removing the usefulness of the feature,
    and a bug in its implementation was causing k5start and krenew to not
    run aklog when they should.

kstart 3.1 (2006-02-23)

    Add the -g flag to k5start and krenew to make the ticket cache
    group-readable.  This is useful for maintaining a ticket cache shared
    by multiple automated processes on the same host running as different
    users (such as Mailman).

kstart 3.0 (2006-01-22)

    Add a krenew command that acts like k5start except that it uses an
    existing ticket cache and just renews it.

    Don't check the executability of the aklog program before running it,
    as this prevents people from configuring aklog programs that include
    flags.

    Add a -h flag to all programs to display the usage message and exit.

    Report the compiled aklog path in usage output.

kstart 2.9 (2006-01-01)

    Improved error handling when using Heimdal and clearer formatting with
    any Kerberos implementation.  Use krb5_err and krb5_warn functions
    always and provide replacements when using MIT Kerberos.

    Significantly improved Kerberos library probes.  Use krb5-config where
    available to get Kerberos libraries and compiler flags unless
    --enable-reduced-depends or --enable-static are used, and support MIT
    Kerberos 1.4 with --enable-static.

    Add the --enable-reduced-depends configure option to try to minimize
    the shared library dependencies of the resulting binaries on platforms
    with proper shared library dependencies.  This is of interest
    primarily to people building packages for distributions.

    AFS setpag support no longer requires linking with pthreads and also
    supports the Heimdal or KTH libkafs library as a source of setpag.

    Ported to systems that require sys/time.h be included instead of
    time.h (Tru64 4.0 in particular).

    Attempt better portability to KTH Kerberos installs that build their
    own DES library rather than using OpenSSL.

    Included a spec file for RPM builds, contributed by Buck Huppmann.

kstart 2.8 (2005-08-09)

    Added the -b option to both k4start and k5start to background after
    the initial authentication.  Added the -p option to both k4start and
    k5start to save the PID of the process in a file.  Both were based on
    code by Navid Golpayegani.

    -p is no longer accepted as a synonym for -s (this synonym was never
    documented).

kstart 2.7 (2005-06-04)

    Fixed a bug in k5start introduced in 2.4 that broke -H handling and
    getting a specific service ticket, and which caused k5start to make an
    additional bogus request for the wrong service on each authentication.

kstart 2.6 (2005-06-03)

    Finished the port to Heimdal.  k5start error reporting should now work
    correctly, as should handling of krb5.conf defaults.

    Added the -U flag to k5start, telling it to figure out the client
    principal by looking in the provided keytab rather than expecting it
    on the command line, making it easier to write scripts that use the
    system keytab.

    Added the --disable-k4start flag to configure to make it easier to
    build only k5start (particularly useful if one only has Heimdal and
    not KTH Kerberos).

kstart 2.5 (2005-05-01)

    Unless -k is given, k4start and k5start both now create a temporary
    ticket cache file with mkstemp and delete it on exit when running a
    command, to not interfere with other ticket caches owned by the same
    user.

    k5start now correctly sets KRB5CCNAME when running aklog or a
    command.

    Ported to Heimdal and KTH Kerberos, somewhat.  Error handling in
    k5start still won't produce good error messages because the
    differences between MIT and Heimdal are more profound than I can
    easily adjust for.

    Documentation improvements, particularly in the area of specifying
    commands to run.

kstart 2.4 (2005-04-25)

    Renamed kstart to k4start to avoid a conflict with a KDE program.
    This is more symmetric with k5start anyway.

    Added support to both k4start and k5start for running a program after
    obtaining Kerberos credentials and optionally AFS tokens.  This mode
    is like the -K mode, except that k4start or k5start will exit when the
    program it ran exits.  Added preliminary support for creating a PAG
    for the command to run in.

    Minor cleanups and bug fixes to both programs.  Exit earlier if unable
    to determine the principal, add newlines to the end of some verbose
    trace messages, and fix error reporting after Ctrl-C in k4start.

    Internal code refactoring, reorganization, and cleanup.

kstart 2.3 (2005-02-22)

    Fixed make install with a separate build directory.  The Makefile must
    look for the man pages in the source directory.

    Don't include Debian packaging rules in the standard distribution (per
    recommended best practices for maintaining Debian packages with rules
    in the upstream CVS).

kstart 2.2 (2004-07-29)

    Removed the various Stanford-specific banners that these programs
    inherited from our local kinit.  In normal use of kstart or k5start,
    there's no need to check for whether the session is encrypted (and the
    relevant environment variables are normally not set anyway).
    Similarly, since there's only one kstart and k5start, there isn't the
    need to distinguish from another by printing out a Stanford banner.

    Added Debian package build rules.

    Significantly improved the man pages.

    Substantial code cleanup of both kstart and k5start.  Both now follow
    my current C coding standards, include far less portability cruft, and
    include far fewer unnecessary headers.

kstart 2.1 (2002-12-29)

    No code changes.  Added a README file with installation instructions
    and a license.

kstart 2.0 (2002-12-29)

    First release that includes k5start, an equivalent version of kstart
    for Kerberos v5.

kstart 1.19 (2001-06-14)

    Added a fudge factor to make sure the ticket is refreshed before it
    expires.  The same factor also applies to -H, so -H will detect
    tickets that are about to expire.

kstart 1.17 (2001-01-16)

    Fixed a bug in obtaining a ticket from a srvtab.

kstart 1.16 (2000-10-17)

    Added the -H option to check whether a ticket has expired, and fix
    bugs in the detection of expired tickets.

kstart 1.13 (2000-04-19)

    Diagnose errors when running aklog.  Better portability and use of
    Autoconf.

kstart 1.10 (1999-09-01)

    Set KRBTKFILE when -k is used so that aklog can find the ticket.

kstart 1.8 (1997-10-17)

    Add support for long-term ticket maintenance as a daemon, the -K and
    -k options.

kstart 1.7 (1997-07-23)

    Change default location of aklog and documentation fixes.

kstart 1.5 (1996-04-10)

    Portability to Solaris.  Change the usage message to indicate that
    lifetime is in minutes, not seconds.

kstart 1.3 (1995-06-05)

    Add a password prompt for the -s option and remove implied -q.
