diff --git a/.gitignore b/.gitignore
index 772e59ef9..e5b52468a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -150,6 +150,9 @@ asn1_*_asn1.c
 /kdc/kdc-tester
 /kdc/kstash
 /kdc/string2key
+/kdc/test_csr_authorizer
+/kdc/test_kdc_ca
+/kdc/test_token_validator
 /kpasswd/kpasswd
 /kpasswd/kpasswd-generator
 /kpasswd/kpasswdd
@@ -173,13 +176,106 @@ asn1_*_asn1.c
 /lib/asn1/check-ber
 /lib/asn1/check-der
 /lib/asn1/check-gen
+/lib/asn1/check-gen-template
 /lib/asn1/check-template
 /lib/asn1/check-timegm
-/lib/asn1/der-protos.h
+/lib/asn1/cms_asn1.json
+/lib/asn1/cms_asn1_oids.c
+/lib/asn1/cms_asn1_syms.c
+/lib/asn1/cms_template_asn1.json
+/lib/asn1/cms_template_asn1_oids.c
+/lib/asn1/cms_template_asn1_syms.c
+/lib/asn1/crmf_asn1.json
+/lib/asn1/crmf_asn1_oids.c
+/lib/asn1/crmf_asn1_syms.c
+/lib/asn1/crmf_template_asn1.json
+/lib/asn1/crmf_template_asn1_oids.c
+/lib/asn1/crmf_template_asn1_syms.c
 /lib/asn1/der-private.h
+/lib/asn1/der-protos.h
+/lib/asn1/digest_asn1.json
+/lib/asn1/digest_asn1_oids.c
+/lib/asn1/digest_asn1_syms.c
+/lib/asn1/digest_template_asn1.json
+/lib/asn1/digest_template_asn1_oids.c
+/lib/asn1/digest_template_asn1_syms.c
+/lib/asn1/krb5_asn1.json
+/lib/asn1/krb5_asn1_oids.c
+/lib/asn1/krb5_asn1_syms.c
+/lib/asn1/krb5_template_asn1.json
+/lib/asn1/krb5_template_asn1_oids.c
+/lib/asn1/krb5_template_asn1_syms.c
+/lib/asn1/kx509_asn1.json
+/lib/asn1/kx509_asn1_oids.c
+/lib/asn1/kx509_asn1_syms.c
+/lib/asn1/kx509_template_asn1.json
+/lib/asn1/kx509_template_asn1_oids.c
+/lib/asn1/kx509_template_asn1_syms.c
 /lib/asn1/lex.c
+/lib/asn1/ocsp_asn1.json
+/lib/asn1/ocsp_asn1_oids.c
+/lib/asn1/ocsp_asn1_syms.c
+/lib/asn1/ocsp_template_asn1.json
+/lib/asn1/ocsp_template_asn1_oids.c
+/lib/asn1/ocsp_template_asn1_syms.c
+/lib/asn1/pkcs10_asn1.json
+/lib/asn1/pkcs10_asn1_oids.c
+/lib/asn1/pkcs10_asn1_syms.c
+/lib/asn1/pkcs10_template_asn1.json
+/lib/asn1/pkcs10_template_asn1_oids.c
+/lib/asn1/pkcs10_template_asn1_syms.c
+/lib/asn1/pkcs12_asn1.json
+/lib/asn1/pkcs12_asn1_oids.c
+/lib/asn1/pkcs12_asn1_syms.c
+/lib/asn1/pkcs12_template_asn1.json
+/lib/asn1/pkcs12_template_asn1_oids.c
+/lib/asn1/pkcs12_template_asn1_syms.c
+/lib/asn1/pkcs8_asn1.json
+/lib/asn1/pkcs8_asn1_oids.c
+/lib/asn1/pkcs8_asn1_syms.c
+/lib/asn1/pkcs8_template_asn1.json
+/lib/asn1/pkcs8_template_asn1_oids.c
+/lib/asn1/pkcs8_template_asn1_syms.c
+/lib/asn1/pkcs9_asn1.json
+/lib/asn1/pkcs9_asn1_oids.c
+/lib/asn1/pkcs9_asn1_syms.c
+/lib/asn1/pkcs9_template_asn1.json
+/lib/asn1/pkcs9_template_asn1_oids.c
+/lib/asn1/pkcs9_template_asn1_syms.c
+/lib/asn1/pkinit_asn1.json
+/lib/asn1/pkinit_asn1_oids.c
+/lib/asn1/pkinit_asn1_syms.c
+/lib/asn1/pkinit_template_asn1.json
+/lib/asn1/pkinit_template_asn1_oids.c
+/lib/asn1/pkinit_template_asn1_syms.c
+/lib/asn1/rfc2459_asn1.json
+/lib/asn1/rfc2459_asn1_oids.c
+/lib/asn1/rfc2459_asn1_syms.c
+/lib/asn1/rfc2459_template_asn1.json
+/lib/asn1/rfc2459_template_asn1_oids.c
+/lib/asn1/rfc2459_template_asn1_syms.c
+/lib/asn1/rfc4108_asn1.json
+/lib/asn1/rfc4108_asn1_oids.c
+/lib/asn1/rfc4108_asn1_syms.c
+/lib/asn1/rfc4108_template_asn1.json
+/lib/asn1/rfc4108_template_asn1_oids.c
+/lib/asn1/rfc4108_template_asn1_syms.c
+/lib/asn1/test_asn1.json
+/lib/asn1/test_asn1_oids.c
+/lib/asn1/test_asn1_syms.c
+/lib/asn1/test_template_asn1.json
+/lib/asn1/test_template_asn1_oids.c
+/lib/asn1/test_template_asn1_syms.c
+/lib/asn1/x690sample_asn1.json
+/lib/asn1/x690sample_asn1_oids.c
+/lib/asn1/x690sample_asn1_syms.c
+/lib/asn1/x690sample_template_asn1.json
+/lib/asn1/x690sample_template_asn1_oids.c
+/lib/asn1/x690sample_template_asn1_syms.c
 /lib/auth/Makefile.in
 /lib/base/base64.c
+/lib/base/heimbase-protos.h
+/lib/base/json-journal
 /lib/base/test_base
 /lib/base/test_db.json
 /lib/com_err/compile_et
@@ -188,12 +284,31 @@ asn1_*_asn1.c
 /lib/com_err/parse.h
 /lib/com_err/snprintf.c
 /lib/com_err/strlcpy.c
-/lib/gssapi/gss
+/lib/gssapi/asn1_ContextFlags.c
+/lib/gssapi/asn1_GSSAPIContextToken.c
+/lib/gssapi/asn1_MechType.c
+/lib/gssapi/asn1_MechTypeList.c
+/lib/gssapi/asn1_NegHints.c
+/lib/gssapi/asn1_NegStateEnum.c
+/lib/gssapi/asn1_NegTokenInit.c
+/lib/gssapi/asn1_NegTokenInit2.c
+/lib/gssapi/asn1_NegTokenResp.c
+/lib/gssapi/asn1_NegotiationToken.c
+/lib/gssapi/asn1_NegotiationToken2.c
+/lib/gssapi/gss-token
+/lib/gssapi/gssapi_asn1-template.c
+/lib/gssapi/gssapi_asn1.json
+/lib/gssapi/gssapi_asn1_oids.c
+/lib/gssapi/gssapi_asn1_syms.c
 /lib/gssapi/gsstool
 /lib/gssapi/krb5/gsskrb5-private.h
 /lib/gssapi/ntlm/ntlm-private.h
 /lib/gssapi/sanon/sanon-private.h
 /lib/gssapi/spnego/spnego-private.h
+/lib/gssapi/spnego_asn1-template.c
+/lib/gssapi/spnego_asn1.json
+/lib/gssapi/spnego_asn1_oids.c
+/lib/gssapi/spnego_asn1_syms.c
 /lib/gssapi/test_acquire_cred
 /lib/gssapi/test_add_store_cred
 /lib/gssapi/test_cfx
@@ -236,12 +351,44 @@ asn1_*_asn1.c
 /lib/hcrypto/test_rsa
 /lib/hcrypto/unix
 /lib/hcrypto/libtommath/callgraph.txt
-/lib/hdb/hdb-protos.h
+/lib/hdb/asn1_Event.c
+/lib/hdb/asn1_GENERATION.c
+/lib/hdb/asn1_HDBFlags.c
+/lib/hdb/asn1_HDB_EncTypeList.c
+/lib/hdb/asn1_HDB_EntryOrAlias.c
+/lib/hdb/asn1_HDB_Ext_Aliases.c
+/lib/hdb/asn1_HDB_Ext_Constrained_delegation_acl.c
+/lib/hdb/asn1_HDB_Ext_KeyRotation.c
+/lib/hdb/asn1_HDB_Ext_KeySet.c
+/lib/hdb/asn1_HDB_Ext_Lan_Manager_OWF.c
+/lib/hdb/asn1_HDB_Ext_PKINIT_acl.c
+/lib/hdb/asn1_HDB_Ext_PKINIT_cert.c
+/lib/hdb/asn1_HDB_Ext_PKINIT_hash.c
+/lib/hdb/asn1_HDB_Ext_Password.c
+/lib/hdb/asn1_HDB_entry.c
+/lib/hdb/asn1_HDB_entry_alias.c
+/lib/hdb/asn1_HDB_extension.c
+/lib/hdb/asn1_HDB_extensions.c
+/lib/hdb/asn1_HDB_keyset.c
+/lib/hdb/asn1_Key.c
+/lib/hdb/asn1_KeyRotation.c
+/lib/hdb/asn1_KeyRotationFlags.c
+/lib/hdb/asn1_Keys.c
+/lib/hdb/asn1_Salt.c
 /lib/hdb/hdb-private.h
+/lib/hdb/hdb-protos.h
+/lib/hdb/hdb_asn1-template.c
+/lib/hdb/hdb_asn1.json
+/lib/hdb/hdb_asn1_oids.c
+/lib/hdb/hdb_asn1_syms.c
+/lib/hdb/test_concurrency
 /lib/hdb/test_dbinfo
 /lib/hdb/test_hdbkeys
-/lib/hdb/test_namespace
 /lib/hdb/test_mkey
+/lib/hdb/test_namespace
+/lib/hdb/testhdb-*-shm
+/lib/hdb/testhdb-*-wal
+/lib/hx509/actual
 /lib/hx509/PKITS_data/
 /lib/hx509/cert-ca.der
 /lib/hx509/cert-ca.pem
@@ -255,6 +402,7 @@ asn1_*_asn1.c
 /lib/hx509/data/*.srl
 /lib/hx509/data/*.req
 /lib/hx509/data/sub-ca-combined.crt
+/lib/hx509/expected
 /lib/hx509/ev.data
 /lib/hx509/ev.data.out
 /lib/hx509/hx509-private.h
@@ -338,6 +486,7 @@ asn1_*_asn1.c
 /lib/krb5/test_hostname
 /lib/krb5/test_keytab
 /lib/krb5/test_mem
+/lib/krb5/test_mkforwardable
 /lib/krb5/test_pac
 /lib/krb5/test_pkinit_dh2key
 /lib/krb5/test_pknistkdf
@@ -366,10 +515,10 @@ asn1_*_asn1.c
 /lib/otp/strlcpy.c
 /lib/otp/strlwr.c
 /lib/otp/strncasecmp.c
+/lib/roken/base32-test
 /lib/roken/base64-test
 /lib/roken/getaddrinfo-test
 /lib/roken/getifaddrs-test
-/lib/roken/glob.h
 /lib/roken/hex-test
 /lib/roken/make-roken
 /lib/roken/make-roken.c
@@ -377,10 +526,13 @@ asn1_*_asn1.c
 /lib/roken/parse_reply-test
 /lib/roken/parse_time-test
 /lib/roken/resolve-test
+/lib/roken/rkbase32
+/lib/roken/rkbase64
 /lib/roken/rkpty
+/lib/roken/rkvis
 /lib/roken/roken.h
+/lib/roken/rtbl
 /lib/roken/snprintf-test
-/lib/roken/snprintf-test.trs
 /lib/roken/strpftime-test
 /lib/roken/test-auxval
 /lib/roken/test-detach
@@ -412,6 +564,7 @@ asn1_*_asn1.c
 /lib/wind/normalize_table.h
 /lib/wind/punycode_examples.c
 /lib/wind/punycode_examples.h
+/lib/wind/__pycache__/
 /lib/wind/test-bidi
 /lib/wind/test-ldap
 /lib/wind/test-map
@@ -450,33 +603,29 @@ asn1_*_asn1.c
 /tests/gss/check-context
 /tests/gss/check-gss
 /tests/gss/check-gssmask
+/tests/gss/check-negoex
 /tests/gss/check-ntlm
 /tests/gss/check-spnego
 /tests/gss/current-db.db
 /tests/gss/foopassword
 /tests/gss/krb5.conf
-/tests/gss/krb5ccfile*
-/tests/gss/krb5ccfile2*
-/tests/gss/krb5ccfile-ds*
+/tests/gss/krb5ccfile
+/tests/gss/krb5ccfile-ds
+/tests/gss/krb5ccfile2
+/tests/gss/mech
+/tests/gss/new_clients_k5.conf
 /tests/gss/server.keytab
 /tests/gss/tempfile
-/tests/java/KerberosInit$1.class
-/tests/java/KerberosInit$TestCallBackHandler.class
-/tests/java/KerberosInit.class
 /tests/java/check-kinit
-/tests/java/current-db.db
-/tests/java/foopassword
-/tests/java/jgssapi_server.class
-/tests/java/server.keytab
 /tests/java/krb5.conf
-/tests/kdc/acache.krb5*
+/tests/kdc/acache.krb5
 /tests/kdc/barpassword
-/tests/kdc/ca.crt
-/tests/kdc/cache.krb5*
-/tests/kdc/cache1.krb5*
-/tests/kdc/cache2.krb5*
+/tests/kdc/bx509.pem
+/tests/kdc/cache.krb5
+/tests/kdc/cc_dir/
 /tests/kdc/cdigest-reply
 /tests/kdc/check-authz
+/tests/kdc/check-bx509
 /tests/kdc/check-canon
 /tests/kdc/check-cc
 /tests/kdc/check-delegation
@@ -484,6 +633,7 @@ asn1_*_asn1.c
 /tests/kdc/check-digest
 /tests/kdc/check-fast
 /tests/kdc/check-hdb-mitdb
+/tests/kdc/check-httpkadmind
 /tests/kdc/check-iprop
 /tests/kdc/check-kadmin
 /tests/kdc/check-kdc
@@ -495,51 +645,62 @@ asn1_*_asn1.c
 /tests/kdc/check-tester
 /tests/kdc/check-uu
 /tests/kdc/current-db.db
-/tests/kdc/current.log.save
 /tests/kdc/current-db.sqlite3
+/tests/kdc/current-db.sqlite3-shm
+/tests/kdc/current-db.sqlite3-wal
+/tests/kdc/current.log.save
+/tests/kdc/email.pem
 /tests/kdc/foopassword
 /tests/kdc/foopassword.rkpty
+/tests/kdc/icache.krb5
 /tests/kdc/iprop-stats
+/tests/kdc/iprop-stats2
 /tests/kdc/iprop.keytab
 /tests/kdc/ipropd.dumpfile
-/tests/kdc/kdc.crt
+/tests/kdc/k.der
 /tests/kdc/kdc-tester4.json
+/tests/kdc/kdc.pid
 /tests/kdc/krb5-authz.conf
 /tests/kdc/krb5-authz2.conf
+/tests/kdc/krb5-bx509.conf
 /tests/kdc/krb5-canon.conf
 /tests/kdc/krb5-canon2.conf
+/tests/kdc/krb5-cccol.conf
 /tests/kdc/krb5-hdb-mitdb.conf
+/tests/kdc/krb5-httpkadmind.conf
+/tests/kdc/krb5-master2.conf
 /tests/kdc/krb5-pkinit-win.conf
 /tests/kdc/krb5-pkinit.conf
+/tests/kdc/krb5-pkinit2.conf
 /tests/kdc/krb5-slave.conf
 /tests/kdc/krb5-slave2.conf
 /tests/kdc/krb5-weak.conf
 /tests/kdc/krb5.conf
-/tests/kdc/krb5-cc.conf
 /tests/kdc/krb5.conf.keys
-/tests/kdc/kx509-template.crt
-/tests/kdc/kx509.pem
 /tests/kdc/localname
+/tests/kdc/messages.log2
+/tests/kdc/mixed-issuer.pem
 /tests/kdc/notfoopassword
 /tests/kdc/o2cache.krb5
 /tests/kdc/ocache.krb5
-/tests/kdc/pkinit.crt
-/tests/kdc/pkinit2.crt
-/tests/kdc/pkinit3.crt
-/tests/kdc/pkinit4.crt
-/tests/kdc/req-kdc.der
-/tests/kdc/req-pkinit.der
-/tests/kdc/req-pkinit2.der
+/tests/kdc/pkinit-anchor.pem
+/tests/kdc/req
 /tests/kdc/s2digest-reply
+/tests/kdc/sdb
 /tests/kdc/sdigest-init
 /tests/kdc/sdigest-reply
+/tests/kdc/server-issuer.pem
 /tests/kdc/server.keytab
+/tests/kdc/server.pem
+/tests/kdc/simple_csr_authz/
 /tests/kdc/tempfile
 /tests/kdc/test-rc-file.rc
+/tests/kdc/trivial.pem
+/tests/kdc/user-issuer.pem
 /tests/ldap/check-ldap
 /tests/ldap/krb5.conf
 /tests/ldap/slapd-init
-/tests/plugin/cache.krb5*
+/tests/plugin/cache.krb5
 /tests/plugin/check-pac
 /tests/plugin/current-db.db
 /tests/plugin/foopassword