diff --git a/appl/afsutil/afslog.c b/appl/afsutil/afslog.c
index 0ae61b3ae..f2ade9425 100644
--- a/appl/afsutil/afslog.c
+++ b/appl/afsutil/afslog.c
@@ -104,12 +104,12 @@ expand_cell_name(const char *cell)
 {
     FILE *f;
     const char *c;
-    const char **fn, *files[] = { _PATH_CELLSERVDB,
-				  _PATH_ARLA_CELLSERVDB,
-				  _PATH_OPENAFS_DEBIAN_CELLSERVDB,
-				  _PATH_ARLA_DEBIAN_CELLSERVDB,
-				  NULL };
-    for(fn = files; *fn; fn++) {
+    const char **fn, *fns[] = { _PATH_CELLSERVDB,
+				_PATH_ARLA_CELLSERVDB,
+				_PATH_OPENAFS_DEBIAN_CELLSERVDB,
+				_PATH_ARLA_DEBIAN_CELLSERVDB,
+				NULL };
+    for(fn = fns; *fn; fn++) {
 	f = fopen(*fn, "r");
 	if(f == NULL)
 	    continue;
@@ -212,7 +212,7 @@ log_func(void *ctx, const char *str)
 int
 main(int argc, char **argv)
 {
-    int optind = 0;
+    int optidx = 0;
     int i;
     int num;
     int ret = 0;
@@ -221,7 +221,7 @@ main(int argc, char **argv)
 
     setprogname(argv[0]);
 
-    if(getarg(args, num_args, argc, argv, &optind))
+    if(getarg(args, num_args, argc, argv, &optidx))
 	usage(1);
     if(help_flag)
 	usage(0);
@@ -278,7 +278,7 @@ main(int argc, char **argv)
 	num++;
     }
     free_getarg_strings (&cells);
-    for(i = optind; i < argc; i++){
+    for(i = optidx; i < argc; i++){
 	num++;
 	if(strcmp(argv[i], ".") == 0 ||
 	   strcmp(argv[i], "..") == 0 ||
diff --git a/appl/afsutil/pagsh.c b/appl/afsutil/pagsh.c
index 5801441d7..5c5d09185 100644
--- a/appl/afsutil/pagsh.c
+++ b/appl/afsutil/pagsh.c
@@ -104,10 +104,10 @@ main(int argc, char **argv)
     char *path;
     char **args;
     unsigned int i;
-    int optind = 0;
+    int optidx = 0;
 
     setprogname(argv[0]);
-    if(getarg(getargs, num_args, argc, argv, &optind))
+    if(getarg(getargs, num_args, argc, argv, &optidx))
 	usage(1);
     if(help_flag)
 	usage(0);
@@ -116,8 +116,8 @@ main(int argc, char **argv)
 	exit(0);
     }
 
-    argc -= optind;
-    argv += optind;
+    argc -= optidx;
+    argv += optidx;
 
 #ifdef KRB5
     {
diff --git a/appl/ftp/ftpd/Makefile.am b/appl/ftp/ftpd/Makefile.am
index efcff1392..8bf2855b3 100644
--- a/appl/ftp/ftpd/Makefile.am
+++ b/appl/ftp/ftpd/Makefile.am
@@ -4,6 +4,8 @@ include $(top_srcdir)/Makefile.am.common
 
 AM_CPPFLAGS += -I$(srcdir)/../common -DFTP_SERVER
 
+WFLAGS += $(WFLAGS_LITE)
+
 libexec_PROGRAMS = ftpd
 
 CHECK_LOCAL = 
diff --git a/appl/gssmask/gssmaestro.c b/appl/gssmask/gssmaestro.c
index 90fa43536..054e3a378 100644
--- a/appl/gssmask/gssmaestro.c
+++ b/appl/gssmask/gssmaestro.c
@@ -667,8 +667,6 @@ connect_client(const char *slave)
     }
 
     if (logfile) {
-	int fd;
-
 	printf("starting log socket to client %s\n", c->moniker);
 
 	fd = wait_log(c);
diff --git a/appl/kf/kf.c b/appl/kf/kf.c
index bce958b98..ff1db31c3 100644
--- a/appl/kf/kf.c
+++ b/appl/kf/kf.c
@@ -58,31 +58,31 @@ static struct getargs args[] = {
 static int num_args = sizeof(args) / sizeof(args[0]);
 
 static void
-usage(int code, struct getargs *args, int num_args)
+usage(int code, struct getargs *inargs, int num_inargs)
 {
-    arg_printusage(args, num_args, NULL, "hosts");
+    arg_printusage(inargs, num_inargs, NULL, "hosts");
     exit(code);
 }
 
 static int
-client_setup(krb5_context *context, int *argc, char **argv)
+client_setup(krb5_context *ctx, int *argc, char **argv)
 {
-    int optind = 0;
+    int optidx = 0;
     int port = 0;
     int status;
 
     setprogname (argv[0]);
 
-    status = krb5_init_context (context);
+    status = krb5_init_context (ctx);
     if (status)
 	errx(1, "krb5_init_context failed: %d", status);
 
-    forwardable = krb5_config_get_bool (*context, NULL,
+    forwardable = krb5_config_get_bool (*ctx, NULL,
 					"libdefaults",
 					"forwardable",
 					NULL);
 
-    if (getarg (args, num_args, *argc, argv, &optind))
+    if (getarg (args, num_args, *argc, argv, &optidx))
 	usage(1, args, num_args);
 
     if(help_flag)
@@ -107,11 +107,11 @@ client_setup(krb5_context *context, int *argc, char **argv)
     }
 
     if (port == 0)
-	port = krb5_getportbyname (*context, KF_PORT_NAME, "tcp", KF_PORT_NUM);
+	port = krb5_getportbyname (*ctx, KF_PORT_NAME, "tcp", KF_PORT_NUM);
 
-    if(*argc - optind < 1)
+    if(*argc - optidx < 1)
         usage(1, args, num_args);
-    *argc = optind;
+    *argc = optidx;
 
     return port;
 }
@@ -122,7 +122,7 @@ client_setup(krb5_context *context, int *argc, char **argv)
  */
 
 static int
-proto (int sock, const char *hostname, const char *service,
+proto (int sock, const char *hostname, const char *svc,
        char *message, size_t len)
 {
     krb5_auth_context auth_context;
@@ -153,7 +153,7 @@ proto (int sock, const char *hostname, const char *service,
 
     status = krb5_sname_to_principal (context,
 				      hostname,
-				      service,
+				      svc,
 				      KRB5_NT_SRV_HST,
 				      &server);
     if (status) {
@@ -281,7 +281,7 @@ proto (int sock, const char *hostname, const char *service,
 }
 
 static int
-doit (const char *hostname, int port, const char *service,
+doit (const char *hostname, int port, const char *svc,
       char *message, size_t len)
 {
     struct addrinfo *ai, *a;
@@ -312,7 +312,7 @@ doit (const char *hostname, int port, const char *service,
 	    continue;
 	}
 	freeaddrinfo (ai);
-	return proto (s, hostname, service, message, len);
+	return proto (s, hostname, svc, message, len);
     }
     warnx ("failed to contact %s", hostname);
     freeaddrinfo (ai);
diff --git a/appl/kf/kfd.c b/appl/kf/kfd.c
index ee76a260c..9099bab9b 100644
--- a/appl/kf/kfd.c
+++ b/appl/kf/kfd.c
@@ -56,19 +56,19 @@ static struct getargs args[] = {
 static int num_args = sizeof(args) / sizeof(args[0]);
 
 static void
-usage(int code, struct getargs *args, int num_args)
+usage(int code, struct getargs *inargs, int num_inargs)
 {
-    arg_printusage(args, num_args, NULL, "");
+    arg_printusage(inargs, num_inargs, NULL, "");
     exit(code);
 }
 
 static int
-server_setup(krb5_context *context, int argc, char **argv)
+server_setup(krb5_context *ctx, int argc, char **argv)
 {
     int port = 0;
     int local_argc;
 
-    local_argc = krb5_program_setup(context, argc, argv, args, num_args, usage);
+    local_argc = krb5_program_setup(ctx, argc, argv, args, num_args, usage);
 
     if(help_flag)
 	(*usage)(0, args, num_args);
@@ -92,7 +92,7 @@ server_setup(krb5_context *context, int argc, char **argv)
     }
 
     if (port == 0)
-	port = krb5_getportbyname (*context, KF_PORT_NAME, "tcp", KF_PORT_NUM);
+	port = krb5_getportbyname (*ctx, KF_PORT_NAME, "tcp", KF_PORT_NUM);
 
     if(argv[local_argc] != NULL)
         usage(1, args, num_args);
@@ -120,7 +120,7 @@ kfd_match_version(const void *arg, const char *version)
 }
 
 static int
-proto (int sock, const char *service)
+proto (int sock, const char *svc)
 {
     krb5_auth_context auth_context;
     krb5_error_code status;
@@ -151,7 +151,7 @@ proto (int sock, const char *service)
 
     status = krb5_sname_to_principal (context,
 				      hostname,
-				      service,
+				      svc,
 				      KRB5_NT_SRV_HST,
 				      &server);
     if (status)
@@ -281,11 +281,11 @@ proto (int sock, const char *service)
 }
 
 static int
-doit (int port, const char *service)
+doit (int port, const char *svc)
 {
     if (do_inetd)
 	mini_inetd(port, NULL);
-    return proto (STDIN_FILENO, service);
+    return proto (STDIN_FILENO, svc);
 }
 
 int
diff --git a/appl/otp/otp.c b/appl/otp/otp.c
index 320646f7e..6f34d3e47 100644
--- a/appl/otp/otp.c
+++ b/appl/otp/otp.c
@@ -73,7 +73,7 @@ usage(int code)
  */
 
 static int
-renew (int argc, char **argv, OtpAlgorithm *alg, char *user)
+renew (int argc, char **argv, OtpAlgorithm *alg, char *inuser)
 {
     OtpContext newctx, *ctx;
     char prompt[128];
@@ -82,7 +82,7 @@ renew (int argc, char **argv, OtpAlgorithm *alg, char *user)
     int ret;
 
     newctx.alg = alg;
-    newctx.user = user;
+    newctx.user = inuser;
     newctx.n = atoi (argv[0]);
     strlcpy (newctx.seed, argv[1], sizeof(newctx.seed));
     strlwr(newctx.seed);
@@ -136,7 +136,7 @@ verify_user_otp(char *username)
  */
 
 static int
-set (int argc, char **argv, OtpAlgorithm *alg, char *user)
+set (int argc, char **argv, OtpAlgorithm *alg, char *inuser)
 {
     void *db;
     OtpContext ctx;
@@ -145,7 +145,7 @@ set (int argc, char **argv, OtpAlgorithm *alg, char *user)
     int i;
 
     ctx.alg = alg;
-    ctx.user = strdup (user);
+    ctx.user = strdup (inuser);
     if (ctx.user == NULL)
 	err (1, "out of memory");
 
@@ -178,7 +178,7 @@ set (int argc, char **argv, OtpAlgorithm *alg, char *user)
  */
 
 static int
-delete_otp (int argc, char **argv, char *user)
+delete_otp (int argc, char **argv, char *inuser)
 {
     void *db;
     OtpContext ctx;
@@ -188,7 +188,7 @@ delete_otp (int argc, char **argv, char *user)
     if(db == NULL)
 	errx (1, "otp_db_open failed");
 
-    ctx.user = user;
+    ctx.user = inuser;
     ret = otp_delete(db, &ctx);
     otp_db_close (db);
     return ret;
@@ -199,7 +199,7 @@ delete_otp (int argc, char **argv, char *user)
  */
 
 static int
-has_an_otp(char *user)
+has_an_otp(char *inuser)
 {
     void *db;
     OtpContext ctx;
@@ -211,7 +211,7 @@ has_an_otp(char *user)
 	return 0; /* if no db no otp! */
     }
 
-    ctx.user = user;
+    ctx.user = inuser;
     ret = otp_simple_get(db, &ctx);
 
     otp_db_close (db);
@@ -223,11 +223,11 @@ has_an_otp(char *user)
  */
 
 static void
-print_otp_entry_for_name (void *db, char *user)
+print_otp_entry_for_name (void *db, char *inuser)
 {
     OtpContext ctx;
 
-    ctx.user = user;
+    ctx.user = inuser;
     if (!otp_simple_get(db, &ctx)) {
 	fprintf(stdout,
 		"%s\totp-%s %d %s",
@@ -242,7 +242,7 @@ print_otp_entry_for_name (void *db, char *user)
 }
 
 static int
-open_otp (int argc, char **argv, char *user)
+open_otp (int argc, char **argv, char *inuser)
 {
     void *db;
     OtpContext ctx;
@@ -252,7 +252,7 @@ open_otp (int argc, char **argv, char *user)
     if (db == NULL)
 	errx (1, "otp_db_open failed");
 
-    ctx.user = user;
+    ctx.user = inuser;
     ret = otp_simple_get (db, &ctx);
     if (ret == 0)
 	ret = otp_put (db, &ctx);
@@ -265,7 +265,7 @@ open_otp (int argc, char **argv, char *user)
  */
 
 static int
-list_otps (int argc, char **argv, char *user)
+list_otps (int argc, char **argv, char *inuser)
 {
     void *db;
     struct passwd *pw;
@@ -274,8 +274,8 @@ list_otps (int argc, char **argv, char *user)
     if(db == NULL)
 	errx (1, "otp_db_open failed");
 
-    if (user)
-	print_otp_entry_for_name(db, user);
+    if (inuser)
+	print_otp_entry_for_name(db, inuser);
     else
 	/* scans all users... so as to get a deterministic order */
 	while ((pw = getpwent()))
@@ -291,10 +291,10 @@ main (int argc, char **argv)
     int defaultp = 0;
     int uid = getuid();
     OtpAlgorithm *alg = otp_find_alg (OTP_ALG_DEFAULT);
-    int optind = 0;
+    int optidx = 0;
 
     setprogname (argv[0]);
-    if(getarg(args, num_args, argc, argv, &optind))
+    if(getarg(args, num_args, argc, argv, &optidx))
 	usage(1);
     if(help_flag)
 	usage(0);
@@ -312,8 +312,8 @@ main (int argc, char **argv)
     }
     if (user && uid != 0)
 	errx (1, "Only root can use `-u'");
-    argc -= optind;
-    argv += optind;
+    argc -= optidx;
+    argv += optidx;
 
     if (!(listp || deletep || renewp || openp))
 	defaultp = 1;
diff --git a/appl/otp/otpprint.c b/appl/otp/otpprint.c
index 056309d3d..1c9c33930 100644
--- a/appl/otp/otpprint.c
+++ b/appl/otp/otpprint.c
@@ -66,7 +66,7 @@ usage(int code)
 static int
 print (int argc,
        char **argv,
-       int count,
+       int incount,
        OtpAlgorithm *alg,
        void (*print_fn)(OtpKey, char *, size_t))
 {
@@ -87,7 +87,7 @@ print (int argc,
     char s[64];
 
     alg->next (key);
-    if (i >= n - count) {
+    if (i >= n - incount) {
       (*print_fn)(key, s, sizeof(s));
       printf ("%d: %s\n", i + 1, s);
     }
@@ -98,12 +98,12 @@ print (int argc,
 int
 main (int argc, char **argv)
 {
-    int optind = 0;
+    int optidx = 0;
     void (*fn)(OtpKey, char *, size_t);
     OtpAlgorithm *alg = otp_find_alg (OTP_ALG_DEFAULT);
 
     setprogname (argv[0]);
-    if(getarg(args, num_args, argc, argv, &optind))
+    if(getarg(args, num_args, argc, argv, &optidx))
 	usage(1);
     if(help_flag)
 	usage(0);
@@ -117,8 +117,8 @@ main (int argc, char **argv)
 	if (alg == NULL)
 	    errx(1, "Unknown algorithm: %s", alg_string);
     }
-    argc -= optind;
-    argv += optind;
+    argc -= optidx;
+    argv += optidx;
 
     if (hexp) {
 	if (extendedp)
diff --git a/appl/push/Makefile.am b/appl/push/Makefile.am
index a1b46ed6b..06b6c3f50 100644
--- a/appl/push/Makefile.am
+++ b/appl/push/Makefile.am
@@ -4,6 +4,8 @@ include $(top_srcdir)/Makefile.am.common
 
 AM_CPPFLAGS += $(INCLUDE_hesiod)
 
+WFLAGS += $(WFLAGS_LITE)
+
 bin_SCRIPTS		= pfrom
 
 libexec_PROGRAMS	= push
diff --git a/appl/su/su.c b/appl/su/su.c
index 578ee1c78..697a262a3 100644
--- a/appl/su/su.c
+++ b/appl/su/su.c
@@ -145,7 +145,7 @@ static krb5_ccache ccache;
 static int
 krb5_verify(const struct passwd *login_info,
 	    const struct passwd *su_info,
-	    const char *kerberos_instance)
+	    const char *instance)
 {
     krb5_error_code ret;
     krb5_principal p;
@@ -176,7 +176,7 @@ krb5_verify(const struct passwd *login_info,
 	if (strcmp (su_info->pw_name, "root") == 0)
 	    ret = krb5_make_principal(context, &p, *r,
 				      login_name,
-				      kerberos_instance,
+				      instance,
 				      NULL);
 	else
 	    ret = krb5_make_principal(context, &p, *r,
@@ -327,7 +327,7 @@ verify_unix(struct passwd *login, struct passwd *su)
 int
 main(int argc, char **argv)
 {
-    int i, optind = 0;
+    int i, optidx = 0;
     char *su_user;
     struct passwd *su_info;
     struct passwd *login_info;
@@ -340,10 +340,10 @@ main(int argc, char **argv)
 
     setprogname (argv[0]);
 
-    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind))
+    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 	usage(1);
 
-    for (i=0; i < optind; i++)
+    for (i=0; i < optidx; i++)
       if (strcmp(argv[i], "-") == 0) {
 	 full_login = 1;
 	 break;
@@ -355,10 +355,10 @@ main(int argc, char **argv)
 	print_version(NULL);
 	exit(0);
     }
-    if(optind >= argc)
+    if(optidx >= argc)
 	su_user = "root";
     else
-	su_user = argv[optind++];
+	su_user = argv[optidx++];
 
     if (!issuid() && getuid() != 0)
 	warnx("Not setuid and you are not root, expect this to fail");
@@ -446,7 +446,7 @@ main(int argc, char **argv)
 	if(full_login) {
 	    char *t = getenv ("TERM");
 	    char **newenv = NULL;
-	    int i, j;
+	    int j;
 
 	    i = read_environment(_PATH_ETC_ENVIRONMENT, &newenv);
 
@@ -477,8 +477,7 @@ main(int argc, char **argv)
     }
 
     {
-	int i;
-	char **args;
+	char **new_argv;
 	char *p;
 
 	p = strrchr(shell, '/');
@@ -490,26 +489,27 @@ main(int argc, char **argv)
 	if (strcmp(p, "csh") != 0)
 	    csh_f_flag = 0;
 
-        args = malloc(((cmd ? 2 : 0) + 1 + argc - optind + 1 + csh_f_flag) * sizeof(*args));
-	if (args == NULL)
+        new_argv = malloc(((cmd ? 2 : 0) + 1 + argc - optidx + 1 + csh_f_flag)
+	    * sizeof(*new_argv));
+	if (new_argv == NULL)
 	    err (1, "malloc");
 	i = 0;
 	if(full_login) {
-	    if (asprintf(&args[i++], "-%s", p) == -1)
+	    if (asprintf(&new_argv[i++], "-%s", p) == -1)
 		errx (1, "malloc");
 	} else
-	    args[i++] = p;
+	    new_argv[i++] = p;
 	if (cmd) {
-	   args[i++] = "-c";
-	   args[i++] = cmd;
+	   new_argv[i++] = "-c";
+	   new_argv[i++] = cmd;
 	}
 
 	if (csh_f_flag)
-	    args[i++] = "-f";
+	    new_argv[i++] = "-f";
 
-	for (argv += optind; *argv; ++argv)
-	   args[i++] = *argv;
-	args[i] = NULL;
+	for (argv += optidx; *argv; ++argv)
+	   new_argv[i++] = *argv;
+	new_argv[i] = NULL;
 
 	if(setgid(su_info->pw_gid) < 0)
 	    err(1, "setgid");
@@ -523,7 +523,7 @@ main(int argc, char **argv)
         if (ok == 5)
            krb5_start_session();
 #endif
-	execve(shell, args, environ);
+	execve(shell, new_argv, environ);
     }
 
     exit(1);
diff --git a/appl/xnlock/xnlock.c b/appl/xnlock/xnlock.c
index c19066f33..a4fd682ba 100644
--- a/appl/xnlock/xnlock.c
+++ b/appl/xnlock/xnlock.c
@@ -263,15 +263,15 @@ init_words (int argc, char **argv)
 static void
 ScreenSaver(int save)
 {
-    static int timeout, interval, prefer_blank, allow_exp;
+    static int timeout, ival, prefer_blank, allow_exp;
     if(!appres.no_screensaver){
 	if (save) {
-	    XGetScreenSaver(dpy, &timeout, &interval,
+	    XGetScreenSaver(dpy, &timeout, &ival,
 			    &prefer_blank, &allow_exp);
-	    XSetScreenSaver(dpy, 0, interval, prefer_blank, allow_exp);
+	    XSetScreenSaver(dpy, 0, ival, prefer_blank, allow_exp);
 	} else
 	    /* restore state */
-	    XSetScreenSaver(dpy, timeout, interval, prefer_blank, allow_exp);
+	    XSetScreenSaver(dpy, timeout, ival, prefer_blank, allow_exp);
     }
 }
 
@@ -504,11 +504,11 @@ post_prompt_box(Window window)
 static void
 RaiseWindow(Widget w, XEvent *ev, String *s, Cardinal *n)
 {
-  Widget x;
+  Widget new;
   if(!XtIsRealized(w))
     return;
-  x = XtParent(w);
-  XRaiseWindow(dpy, XtWindow(x));
+  new = XtParent(w);
+  XRaiseWindow(dpy, XtWindow(new));
 }
 
 
diff --git a/base/db.c b/base/db.c
index 0bc769f1d..13eab5115 100644
--- a/base/db.c
+++ b/base/db.c
@@ -439,7 +439,7 @@ heim_db_create(const char *dbtype, const char *dbname,
 heim_db_t
 heim_db_clone(heim_db_t db, heim_error_t *error)
 {
-    heim_db_t clone;
+    heim_db_t result;
     int ret;
 
     if (heim_get_tid(db) != HEIM_TID_DB)
@@ -453,25 +453,25 @@ heim_db_clone(heim_db_t db, heim_error_t *error)
 			      db->options, error);
     }
 
-    clone = _heim_alloc_object(&db_object, sizeof(*clone));
-    if (clone == NULL) {
+    result = _heim_alloc_object(&db_object, sizeof(*result));
+    if (result == NULL) {
 	if (error)
 	    *error = heim_error_enomem();
 	return NULL;
     }
 
-    clone->set_keys = NULL;
-    clone->del_keys = NULL;
-    ret = db->plug->clonef(db->db_data, &clone->db_data, error);
+    result->set_keys = NULL;
+    result->del_keys = NULL;
+    ret = db->plug->clonef(db->db_data, &result->db_data, error);
     if (ret) {
-	heim_release(clone);
+	heim_release(result);
 	if (error && !*error)
 	    *error = heim_error_create(ENOENT,
 				       N_("Could not re-open DB while cloning", ""));
 	return NULL;
     }
     db->db_data = NULL;
-    return clone;
+    return result;
 }
 
 /**
@@ -1550,7 +1550,7 @@ json_db_copy_value(void *db, heim_string_t table, heim_data_t key,
     heim_string_t key_string;
     const heim_octet_string *key_data = heim_data_get_data(key);
     struct stat st;
-    heim_data_t ret;
+    heim_data_t result;
 
     if (error)
 	*error = NULL;
@@ -1592,9 +1592,9 @@ json_db_copy_value(void *db, heim_string_t table, heim_data_t key,
 	return NULL;
     }
 
-    ret = heim_path_copy(jsondb->dict, error, table, key_string, NULL);
+    result = heim_path_copy(jsondb->dict, error, table, key_string, NULL);
     heim_release(key_string);
-    return ret;
+    return result;
 }
 
 static int
diff --git a/base/json.c b/base/json.c
index 6cf04733c..1ebff209e 100644
--- a/base/json.c
+++ b/base/json.c
@@ -71,10 +71,10 @@ base2json(heim_object_t, struct twojson *);
 static void
 indent(struct twojson *j)
 {
-    size_t indent = j->indent;
+    size_t i = j->indent;
     if (j->flags & HEIM_JSON_F_ONE_LINE)
 	return;
-    while (indent--)
+    while (i--)
 	j->out(j->ctx, "\t");
 }
 
diff --git a/cf/roken-frag.m4 b/cf/roken-frag.m4
index 3a06bb4a2..5c82d27ee 100644
--- a/cf/roken-frag.m4
+++ b/cf/roken-frag.m4
@@ -28,7 +28,10 @@ dnl C characteristics
 AC_REQUIRE([AC_C___ATTRIBUTE__])
 AC_REQUIRE([AC_C_INLINE])
 AC_REQUIRE([AC_C_CONST])
-rk_WFLAGS(-Wall -Wextra -Wno-sign-compare -Wno-unused-parameter -Wmissing-prototypes -Wpointer-arith -Wbad-function-cast -Wmissing-declarations -Wnested-externs)
+rk_WFLAGS(-Wall -Wextra -Wno-sign-compare -Wno-unused-parameter -Wmissing-prototypes -Wpointer-arith -Wbad-function-cast -Wmissing-declarations -Wnested-externs -Wshadow)
+
+dnl -Wmissing-prototypes -Wpointer-arith -Wreturn-type -Wstrict-prototypes
+dnl -Wcast-qual -Wswitch -Wformat=2 -Wwrite-strings
 
 AC_REQUIRE([rk_DB])
 
diff --git a/cf/wflags.m4 b/cf/wflags.m4
index 53472b8cf..016d1bd30 100644
--- a/cf/wflags.m4
+++ b/cf/wflags.m4
@@ -27,7 +27,7 @@ if test -z "$WFLAGS" -a "$GCC" = "yes"; then
   # that fail for various bits of older code in appl/.  Let's not use it
   # for the main libraries, though.
 
-  WFLAGS_LITE="-Wno-extra -Wno-missing-field-initializers -Wno-strict-aliasing -Wno-unused-result"
+  WFLAGS_LITE="-Wno-extra -Wno-missing-field-initializers -Wno-strict-aliasing -Wno-unused-result -Wno-shadow"
 fi
 AC_SUBST(WFLAGS)dnl
 AC_SUBST(WFLAGS_LITE)dnl
diff --git a/kadmin/add-random-users.c b/kadmin/add-random-users.c
index 64f22f5d1..c84479b57 100644
--- a/kadmin/add-random-users.c
+++ b/kadmin/add-random-users.c
@@ -77,8 +77,7 @@ read_words (const char *filename, char ***ret_w)
 }
 
 static void
-add_user (krb5_context context, void *kadm_handle,
-	  unsigned nwords, char **words)
+add_user (krb5_context ctx, void *hndl, unsigned nwords, char **words)
 {
     kadm5_principal_ent_rec princ;
     char name[64];
@@ -94,14 +93,14 @@ add_user (krb5_context context, void *kadm_handle,
     mask = KADM5_PRINCIPAL;
 
     memset(&princ, 0, sizeof(princ));
-    ret = krb5_parse_name(context, name, &princ.principal);
+    ret = krb5_parse_name(ctx, name, &princ.principal);
     if (ret)
-	krb5_err(context, 1, ret, "krb5_parse_name");
+	krb5_err(ctx, 1, ret, "krb5_parse_name");
 
-    ret = kadm5_create_principal (kadm_handle, &princ, mask, name);
+    ret = kadm5_create_principal (hndl, &princ, mask, name);
     if (ret)
-	krb5_err (context, 1, ret, "kadm5_create_principal");
-    kadm5_free_principal_ent(kadm_handle, &princ);
+	krb5_err (ctx, 1, ret, "kadm5_create_principal");
+    kadm5_free_principal_ent(hndl, &princ);
     printf ("%s\n", name);
 }
 
@@ -110,29 +109,29 @@ add_users (const char *filename, unsigned n)
 {
     krb5_error_code ret;
     int i;
-    void *kadm_handle;
-    krb5_context context;
+    void *hndl;
+    krb5_context ctx;
     unsigned nwords;
     char **words;
 
-    ret = krb5_init_context(&context);
+    ret = krb5_init_context(&ctx);
     if (ret)
 	errx (1, "krb5_init_context failed: %d", ret);
-    ret = kadm5_s_init_with_password_ctx(context,
+    ret = kadm5_s_init_with_password_ctx(ctx,
 					 KADM5_ADMIN_SERVICE,
 					 NULL,
 					 KADM5_ADMIN_SERVICE,
 					 NULL, 0, 0,
-					 &kadm_handle);
+					 &hndl);
     if(ret)
-	krb5_err(context, 1, ret, "kadm5_init_with_password");
+	krb5_err(ctx, 1, ret, "kadm5_init_with_password");
 
     nwords = read_words (filename, &words);
 
     for (i = 0; i < n; ++i)
-	add_user (context, kadm_handle, nwords, words);
-    kadm5_destroy(kadm_handle);
-    krb5_free_context(context);
+	add_user (ctx, hndl, nwords, words);
+    kadm5_destroy(hndl);
+    krb5_free_context(ctx);
 }
 
 static int version_flag	= 0;
diff --git a/kadmin/mod.c b/kadmin/mod.c
index 143201e26..48c999007 100644
--- a/kadmin/mod.c
+++ b/kadmin/mod.c
@@ -186,7 +186,7 @@ add_pkinit_acl(krb5_context contextp, kadm5_principal_ent_rec *princ,
 }
 
 static void
-add_kvno_diff(krb5_context context, kadm5_principal_ent_rec *princ,
+add_kvno_diff(krb5_context contextp, kadm5_principal_ent_rec *princ,
 	      int is_svc_diff, krb5_kvno kvno_diff)
 {
     krb5_error_code ret;
diff --git a/kadmin/stash.c b/kadmin/stash.c
index 9585535e1..1691e8860 100644
--- a/kadmin/stash.c
+++ b/kadmin/stash.c
@@ -110,7 +110,6 @@ stash(struct stash_options *opt, int argc, char **argv)
 
     {
 	char *new = NULL, *old = NULL;
-	int aret;
 
 	aret = asprintf(&old, "%s.old", opt->key_file_string);
 	if (aret == -1) {
diff --git a/kcm/config.c b/kcm/config.c
index 8659c0a99..bb4530a21 100644
--- a/kcm/config.c
+++ b/kcm/config.c
@@ -328,11 +328,11 @@ void
 kcm_configure(int argc, char **argv)
 {
     krb5_error_code ret;
-    int optind = 0;
+    int optidx = 0;
     const char *p;
 
-    while(getarg(args, num_args, argc, argv, &optind))
-	warnx("error at argument `%s'", argv[optind]);
+    while(getarg(args, num_args, argc, argv, &optidx))
+	warnx("error at argument `%s'", argv[optidx]);
 
     if(help_flag)
 	usage (0);
@@ -342,8 +342,8 @@ kcm_configure(int argc, char **argv)
 	exit(0);
     }
 
-    argc -= optind;
-    argv += optind;
+    argc -= optidx;
+    argv += optidx;
 
     if (argc != 0)
 	usage(1);
diff --git a/kcm/events.c b/kcm/events.c
index 99ef556ac..cbbe58ac2 100644
--- a/kcm/events.c
+++ b/kcm/events.c
@@ -61,10 +61,10 @@ kcm_enqueue_event(krb5_context context,
 }
 
 static void
-print_times(time_t time, char buf[64])
+print_times(time_t t, char buf[64])
 {
-    if (time)
-	strftime(buf, 64, "%m-%dT%H:%M", gmtime(&time));
+    if (t)
+	strftime(buf, 64, "%m-%dT%H:%M", gmtime(&t));
     else
 	strlcpy(buf, "never", 64);
 }
diff --git a/kcm/log.c b/kcm/log.c
index 34f1bbf79..c77d1ffe0 100644
--- a/kcm/log.c
+++ b/kcm/log.c
@@ -35,30 +35,30 @@
 
 RCSID("$Id$");
 
-static krb5_log_facility *logf;
+static krb5_log_facility *logfac;
 
 void
 kcm_openlog(void)
 {
     char **s = NULL, **p;
-    krb5_initlog(kcm_context, "kcm", &logf);
+    krb5_initlog(kcm_context, "kcm", &logfac);
     s = krb5_config_get_strings(kcm_context, NULL, "kcm", "logging", NULL);
     if(s == NULL)
 	s = krb5_config_get_strings(kcm_context, NULL, "logging", "kcm", NULL);
     if(s){
 	for(p = s; *p; p++)
-	    krb5_addlog_dest(kcm_context, logf, *p);
+	    krb5_addlog_dest(kcm_context, logfac, *p);
 	krb5_config_free_strings(s);
     }else
-	krb5_addlog_dest(kcm_context, logf, DEFAULT_LOG_DEST);
-    krb5_set_warn_dest(kcm_context, logf);
+	krb5_addlog_dest(kcm_context, logfac, DEFAULT_LOG_DEST);
+    krb5_set_warn_dest(kcm_context, logfac);
 }
 
 char*
 kcm_log_msg_va(int level, const char *fmt, va_list ap)
 {
     char *msg;
-    krb5_vlog_msg(kcm_context, logf, &msg, level, fmt, ap);
+    krb5_vlog_msg(kcm_context, logfac, &msg, level, fmt, ap);
     return msg;
 }
 
diff --git a/kcm/protocol.c b/kcm/protocol.c
index 5d7a63503..ce547506f 100644
--- a/kcm/protocol.c
+++ b/kcm/protocol.c
@@ -1497,7 +1497,7 @@ kcm_op_do_ntlm(krb5_context context,
      */
 
     if (1 || type2.targetinfo.length == 0) {
-	struct ntlm_buf sessionkey;
+	struct ntlm_buf tmpsesskey;
 
 	if (type2.flags & NTLM_NEG_NTLM2_SESSION) {
 	    unsigned char nonce[8];
@@ -1524,7 +1524,7 @@ kcm_op_do_ntlm(krb5_context context,
 
 	ret = heim_ntlm_build_ntlm1_master(c->nthash.data,
 					   c->nthash.length,
-					   &sessionkey,
+					   &tmpsesskey,
 					   &type3.sessionkey);
 	if (ret) {
 	    if (type3.lm.data)
@@ -1534,7 +1534,7 @@ kcm_op_do_ntlm(krb5_context context,
 	    goto error;
 	}
 
-	free(sessionkey.data);
+	free(tmpsesskey.data);
 	if (ret) {
 	    if (type3.lm.data)
 		free(type3.lm.data);
diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index 970b5dca8..d688d847c 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -1709,7 +1709,6 @@ _kdc_as_rep(kdc_request_t r,
 
     if(req->padata){
 	unsigned int n;
-	int i;
 
 	log_patypes(context, config, req->padata);
 
@@ -2038,7 +2037,7 @@ _kdc_as_rep(kdc_request_t r,
     if (f.canonicalize) {
 	PA_ClientCanonicalized canon;
 	krb5_data data;
-	PA_DATA pa;
+	PA_DATA tmppa;
 	krb5_crypto cryptox;
 	size_t len = 0;
 
@@ -2078,9 +2077,9 @@ _kdc_as_rep(kdc_request_t r,
 	if (data.length != len)
 	    krb5_abortx(context, "internal asn.1 error");
 
-	pa.padata_type = KRB5_PADATA_CLIENT_CANONICALIZED;
-	pa.padata_value = data;
-	ret = add_METHOD_DATA(&r->outpadata, &pa);
+	tmppa.padata_type = KRB5_PADATA_CLIENT_CANONICALIZED;
+	tmppa.padata_value = data;
+	ret = add_METHOD_DATA(&r->outpadata, &tmppa);
 	free(data.data);
 	if (ret)
 	    goto out;
diff --git a/kdc/krb5tgs.c b/kdc/krb5tgs.c
index be42b1ab2..43a677271 100644
--- a/kdc/krb5tgs.c
+++ b/kdc/krb5tgs.c
@@ -2405,7 +2405,6 @@ _kdc_tgs_rep(krb5_context context,
     }
 
     {
-	int i = 0;
 	const PA_DATA *pa = _kdc_find_padata(req, &i, KRB5_PADATA_FX_FAST);
 	if (pa)
 	    kdc_log(context, config, 10, "Got TGS FAST request"); 
diff --git a/kdc/kstash.c b/kdc/kstash.c
index 4aad28e3a..c389ff326 100644
--- a/kdc/kstash.c
+++ b/kdc/kstash.c
@@ -137,7 +137,6 @@ main(int argc, char **argv)
 
     {
 	char *new = NULL, *old = NULL;
-	int aret;
 
 	aret = asprintf(&old, "%s.old", keyfile);
 	if (aret == -1) {
diff --git a/kdc/kx509.c b/kdc/kx509.c
index 8d683d50a..8ead1169f 100644
--- a/kdc/kx509.c
+++ b/kdc/kx509.c
@@ -381,15 +381,15 @@ _kdc_do_kx509(krb5_context context,
 
     /* Verify that the key is encoded RSA key */
     {
-	RSAPublicKey key;
-	size_t size;
+	RSAPublicKey rsapkey;
+	size_t rsapkeysize;
 
 	ret = decode_RSAPublicKey(req->pk_key.data, req->pk_key.length,
-				  &key, &size);
+				  &rsapkey, &rsapkeysize);
 	if (ret)
 	    goto out;
-	free_RSAPublicKey(&key);
-	if (size != req->pk_key.length) {
+	free_RSAPublicKey(&rsapkey);
+	if (rsapkeysize != req->pk_key.length) {
 	    ret = ASN1_EXTRA_DATA;
 	    goto out;
 	}
diff --git a/kpasswd/kpasswd-generator.c b/kpasswd/kpasswd-generator.c
index 1db0bc9af..d0d908d66 100644
--- a/kpasswd/kpasswd-generator.c
+++ b/kpasswd/kpasswd-generator.c
@@ -185,12 +185,12 @@ usage (int ret)
 int
 main(int argc, char **argv)
 {
-    int optind = 0;
+    int optidx = 0;
     int nreq;
     char *end;
 
     setprogname(argv[0]);
-    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind))
+    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 	usage(1);
     if (help_flag)
 	usage (0);
@@ -198,8 +198,8 @@ main(int argc, char **argv)
 	print_version(NULL);
 	return 0;
     }
-    argc -= optind;
-    argv += optind;
+    argc -= optidx;
+    argv += optidx;
 
     if (argc != 2)
 	usage (1);
diff --git a/lib/asn1/asn1_print.c b/lib/asn1/asn1_print.c
index 59b9af3b2..81415c0b2 100644
--- a/lib/asn1/asn1_print.c
+++ b/lib/asn1/asn1_print.c
@@ -174,12 +174,11 @@ loop (unsigned char *buf, size_t len, int indent)
 		printf ("(length %lu), ", (unsigned long)length);
 
 		if (inner_flag) {
-		    Der_class class;
-		    Der_type type;
-		    unsigned int tag;
+		    Der_class c;
+		    Der_type ty;
+		    unsigned int ta;
 
-		    ret = der_get_tag(str.data, str.length,
-				      &class, &type, &tag, &sz);
+		    ret = der_get_tag(str.data, str.length, &c, &ty, &ta, &sz);
 		    if (ret || sz > str.length ||
 			type != CONS || tag != UT_Sequence)
 			goto just_an_octet_string;
diff --git a/lib/asn1/gen_template.c b/lib/asn1/gen_template.c
index cdd180c00..f6cdab0dd 100644
--- a/lib/asn1/gen_template.c
+++ b/lib/asn1/gen_template.c
@@ -807,7 +807,7 @@ generate_template_type(const char *varname,
 		       int optional, int isstruct, int need_offset)
 {
     struct tlist *tl;
-    const char *dup;
+    const char *d;
     int have_ellipsis = 0;
 
     tl = tlist_new(varname);
@@ -831,11 +831,11 @@ generate_template_type(const char *varname,
 		 have_ellipsis ? "|A1_HF_ELLIPSIS" : "",
 		 isstruct ? "struct " : "", basetype, tlist_count(tl));
 
-    dup = tlist_find_dup(tl);
-    if (dup) {
-	if (strcmp(dup, tl->name) == 0)
+    d = tlist_find_dup(tl);
+    if (d) {
+	if (strcmp(d, tl->name) == 0)
 	    errx(1, "found dup of ourself");
-	*dupname = dup;
+	*dupname = d;
     } else {
 	*dupname = tl->name;
 	tlist_print(tl);
diff --git a/lib/asn1/template.c b/lib/asn1/template.c
index bc76d4151..d3b2c07f0 100644
--- a/lib/asn1/template.c
+++ b/lib/asn1/template.c
@@ -150,7 +150,7 @@ bmember_put_bit(unsigned char *p, const void *data, unsigned int bit,
 
 int
 _asn1_decode(const struct asn1_template *t, unsigned flags,
-	     const unsigned char *p, size_t len, void *data, size_t *size)
+	     const unsigned char *p, size_t len, void *data, size_t *retsize)
 {
     size_t elements = A1_HEADER_LEN(t);
     size_t oldlen = len;
@@ -348,7 +348,7 @@ _asn1_decode(const struct asn1_template *t, unsigned flags,
 	case A1_OP_BMEMBER: {
 	    const struct asn1_template *bmember = t->ptr;
 	    size_t size = bmember->offset;
-	    size_t elements = A1_HEADER_LEN(bmember);
+	    size_t els = A1_HEADER_LEN(bmember);
 	    size_t pos = 0;
 
 	    bmember++;
@@ -359,7 +359,7 @@ _asn1_decode(const struct asn1_template *t, unsigned flags,
 		return ASN1_OVERRUN;
 	    p++; len--;
 
-	    while (elements && len) {
+	    while (els && len) {
 		while (bmember->offset / 8 > pos / 8) {
 		    if (len < 1)
 			break;
@@ -368,7 +368,7 @@ _asn1_decode(const struct asn1_template *t, unsigned flags,
 		}
 		if (len) {
 		    bmember_get_bit(p, data, bmember->offset, size);
-		    elements--; bmember++;
+		    els--; bmember++;
 		}
 	    }
 	    len = 0;
@@ -419,8 +419,8 @@ _asn1_decode(const struct asn1_template *t, unsigned flags,
 
     oldlen -= len;
 
-    if (size)
-	*size = oldlen;
+    if (retsize)
+	*retsize = oldlen;
 
     /*
      * saved the raw bits if asked for it, useful for signature
@@ -441,7 +441,8 @@ _asn1_decode(const struct asn1_template *t, unsigned flags,
 }
 
 int
-_asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const void *data, size_t *size)
+_asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len,
+	     const void *data, size_t *retsize)
 {
     size_t elements = A1_HEADER_LEN(t);
     int ret = 0;
@@ -616,20 +617,20 @@ _asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const
 	case A1_OP_BMEMBER: {
 	    const struct asn1_template *bmember = t->ptr;
 	    size_t size = bmember->offset;
-	    size_t elements = A1_HEADER_LEN(bmember);
+	    size_t els = A1_HEADER_LEN(bmember);
 	    size_t pos;
 	    unsigned char c = 0;
 	    unsigned int bitset = 0;
 	    int rfc1510 = (bmember->tt & A1_HBF_RFC1510);
 
-	    bmember += elements;
+	    bmember += els;
 
 	    if (rfc1510)
 		pos = 31;
 	    else
 		pos = bmember->offset;
 
-	    while (elements && len) {
+	    while (els && len) {
 		while (bmember->offset / 8 < pos / 8) {
 		    if (rfc1510 || bitset || c) {
 			if (len < 1)
@@ -640,7 +641,7 @@ _asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const
 		    pos -= 8;
 		}
 		bmember_put_bit(&c, data, bmember->offset, size, &bitset);
-		elements--; bmember--;
+		els--; bmember--;
 	    }
 	    if (rfc1510 || bitset) {
 		if (len < 1)
@@ -690,8 +691,8 @@ _asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const
 	t--;
 	elements--;
     }
-    if (size)
-	*size = oldlen - len;
+    if (retsize)
+	*retsize = oldlen - len;
 
     return 0;
 }
@@ -773,7 +774,7 @@ _asn1_length(const struct asn1_template *t, const void *data)
 	case A1_OP_BMEMBER: {
 	    const struct asn1_template *bmember = t->ptr;
 	    size_t size = bmember->offset;
-	    size_t elements = A1_HEADER_LEN(bmember);
+	    size_t els = A1_HEADER_LEN(bmember);
 	    int rfc1510 = (bmember->tt & A1_HBF_RFC1510);
 
 	    if (rfc1510) {
@@ -782,14 +783,14 @@ _asn1_length(const struct asn1_template *t, const void *data)
 
 		ret += 1;
 
-		bmember += elements;
+		bmember += els;
 
-		while (elements) {
+		while (els) {
 		    if (bmember_isset_bit(data, bmember->offset, size)) {
 			ret += (bmember->offset / 8) + 1;
 			break;
 		    }
-		    elements--; bmember--;
+		    els--; bmember--;
 		}
 	    }
 	    break;
diff --git a/lib/gssapi/test_context.c b/lib/gssapi/test_context.c
index 5bdf474d9..37a09f6f4 100644
--- a/lib/gssapi/test_context.c
+++ b/lib/gssapi/test_context.c
@@ -501,7 +501,7 @@ usage (int ret)
 int
 main(int argc, char **argv)
 {
-    int optind = 0;
+    int optidx = 0;
     OM_uint32 min_stat, maj_stat;
     gss_ctx_id_t cctx, sctx;
     void *ctx;
@@ -519,7 +519,7 @@ main(int argc, char **argv)
 
     cctx = sctx = GSS_C_NO_CONTEXT;
 
-    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind))
+    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 	usage(1);
 
     if (help_flag)
@@ -530,8 +530,8 @@ main(int argc, char **argv)
 	exit(0);
     }
 
-    argc -= optind;
-    argv += optind;
+    argc -= optidx;
+    argv += optidx;
 
     if (argc != 1)
 	usage(1);
@@ -644,7 +644,7 @@ main(int argc, char **argv)
 
     /* XXX should be actual_mech */
     if (gss_oid_equal(mechoid, GSS_KRB5_MECHANISM)) {
-	time_t time;
+	time_t sc_time;
 	gss_buffer_desc authz_data;
 	gss_buffer_desc in, out1, out2;
 	krb5_keyblock *keyblock, *keyblock2;
@@ -685,15 +685,15 @@ main(int argc, char **argv)
 
  	maj_stat = gsskrb5_extract_authtime_from_sec_context(&min_stat,
 							     sctx,
-							     &time);
+							     &sc_time);
 	if (maj_stat != GSS_S_COMPLETE)
 	    errx(1, "gsskrb5_extract_authtime_from_sec_context failed: %s",
 		     gssapi_err(maj_stat, min_stat, actual_mech));
 
-	if (time > now)
+	if (sc_time > now)
 	    errx(1, "gsskrb5_extract_authtime_from_sec_context failed: "
 		 "time authtime is before now: %ld %ld",
-		 (long)time, (long)now);
+		 (long)sc_time, (long)now);
 
  	maj_stat = gsskrb5_extract_service_keyblock(&min_stat,
 						    sctx,
diff --git a/lib/gssapi/test_ntlm.c b/lib/gssapi/test_ntlm.c
index 9b289c27b..85ef7d114 100644
--- a/lib/gssapi/test_ntlm.c
+++ b/lib/gssapi/test_ntlm.c
@@ -309,11 +309,11 @@ usage (int ret)
 int
 main(int argc, char **argv)
 {
-    int ret = 0, optind = 0;
+    int ret = 0, optidx = 0;
 
     setprogname(argv[0]);
 
-    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind))
+    if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 	usage(1);
 
     if (help_flag)
@@ -324,8 +324,8 @@ main(int argc, char **argv)
 	exit(0);
     }
 
-    argc -= optind;
-    argv += optind;
+    argc -= optidx;
+    argv += optidx;
 
     ret += test_libntlm_v1(0);
     ret += test_libntlm_v1(NTLM_NEG_KEYEX);
diff --git a/lib/hdb/hdb-sqlite.c b/lib/hdb/hdb-sqlite.c
index e06358887..e5040029c 100644
--- a/lib/hdb/hdb-sqlite.c
+++ b/lib/hdb/hdb-sqlite.c
@@ -792,7 +792,7 @@ hdb_sqlite_remove(krb5_context context, HDB *db,
     krb5_error_code ret;
     char *principal_string;
     hdb_sqlite_db *hsdb = (hdb_sqlite_db*)(db->hdb_db);
-    sqlite3_stmt *remove = hsdb->remove;
+    sqlite3_stmt *rm = hsdb->remove;
 
     ret = krb5_unparse_name(context, principal, &principal_string);
     if (ret) {
@@ -800,9 +800,9 @@ hdb_sqlite_remove(krb5_context context, HDB *db,
         return ret;
     }
 
-    sqlite3_bind_text(remove, 1, principal_string, -1, SQLITE_STATIC);
+    sqlite3_bind_text(rm, 1, principal_string, -1, SQLITE_STATIC);
 
-    ret = hdb_sqlite_step(context, hsdb->db, remove);
+    ret = hdb_sqlite_step(context, hsdb->db, rm);
     if (ret != SQLITE_DONE) {
 	ret = EINVAL;
         krb5_set_error_message(context, ret,
@@ -811,8 +811,8 @@ hdb_sqlite_remove(krb5_context context, HDB *db,
     } else
         ret = 0;
 
-    sqlite3_clear_bindings(remove);
-    sqlite3_reset(remove);
+    sqlite3_clear_bindings(rm);
+    sqlite3_reset(rm);
 
     return ret;
 }
diff --git a/lib/ipc/tc.c b/lib/ipc/tc.c
index b8f8e278d..fb799bba9 100644
--- a/lib/ipc/tc.c
+++ b/lib/ipc/tc.c
@@ -60,7 +60,7 @@ usage(int ret)
 }
 
 static void
-reply(void *ctx, int errorcode, heim_idata *reply, heim_icred cred)
+reply(void *ctx, int errorcode, heim_idata *rep, heim_icred cred)
 {
     printf("got reply\n");
     heim_ipc_semaphore_signal((heim_isemaphore)ctx); /* tell caller we are done */
diff --git a/lib/kadm5/randkey_c.c b/lib/kadm5/randkey_c.c
index 9b185f6ad..6b43d1308 100644
--- a/lib/kadm5/randkey_c.c
+++ b/lib/kadm5/randkey_c.c
@@ -110,7 +110,6 @@ kadm5_c_randkey_principal(void *server_handle,
     ret = tmp;
     if(ret == 0){
 	krb5_keyblock *k;
-	int i;
 
 	krb5_ret_int32(sp, &tmp);
 	if (tmp < 0) {
diff --git a/lib/krb5/scache.c b/lib/krb5/scache.c
index 9bdc9d7d0..3ea23f705 100644
--- a/lib/krb5/scache.c
+++ b/lib/krb5/scache.c
@@ -309,7 +309,6 @@ scc_alloc(krb5_context context, const char *name)
 	char *file;
 
 	if (*name == '\0') {
-	    krb5_error_code ret;
 	    ret = get_def_name(context, &s->name);
 	    if (ret)
 		s->name = strdup(SCACHE_DEF_NAME);
diff --git a/lib/krb5/test_alname.c b/lib/krb5/test_alname.c
index a367b0aba..120143e51 100644
--- a/lib/krb5/test_alname.c
+++ b/lib/krb5/test_alname.c
@@ -138,7 +138,6 @@ main(int argc, char **argv)
     if (simple_flag) {
 	krb5_principal princ;
 	char *unparsed;
-	krb5_error_code ret;
 	int status = 0;
 
 	/* Map then print the result and exit */
diff --git a/lib/roken/ndbm_wrap.c b/lib/roken/ndbm_wrap.c
index 73a3726d0..f7b87f120 100644
--- a/lib/roken/ndbm_wrap.c
+++ b/lib/roken/ndbm_wrap.c
@@ -111,20 +111,20 @@ static datum
 dbm_get (DB *db, int flags)
 {
     DBT key, value;
-    datum datum;
+    datum d;
 #ifdef HAVE_DB3
     if(cursor == NULL)
 	db->cursor(db, NULL, &cursor, 0);
     if(cursor->c_get(cursor, &key, &value, flags) != 0) {
-	datum.dptr = NULL;
-	datum.dsize = 0;
+	d.dptr = NULL;
+	d.dsize = 0;
     } else
-	DBT2DATUM(&value, &datum);
+	DBT2DATUM(&value, &d);
 #else
     db->seq(db, &key, &value, flags);
-    DBT2DATUM(&value, &datum);
+    DBT2DATUM(&value, &d);
 #endif
-    return datum;
+    return d;
 }
 
 #ifndef DB_FIRST
diff --git a/lib/roken/resolve-test.c b/lib/roken/resolve-test.c
index 711d6e896..cf129dd8e 100644
--- a/lib/roken/resolve-test.c
+++ b/lib/roken/resolve-test.c
@@ -150,25 +150,25 @@ main(int argc, char **argv)
 	    }
 	    case rk_ns_t_sshfp : {
 		struct rk_sshfp_record *sshfp = rr->u.sshfp;
-		size_t i;
+		size_t j;
 
 		printf ("alg %u type %u length %lu data ", sshfp->algorithm,
 			sshfp->type,  (unsigned long)sshfp->sshfp_len);
-		for (i = 0; i < sshfp->sshfp_len; i++)
-		    printf("%02X", sshfp->sshfp_data[i]);
+		for (j = 0; j < sshfp->sshfp_len; j++)
+		    printf("%02X", sshfp->sshfp_data[j]);
 		printf("\n");
 
 		break;
 	    }
 	    case rk_ns_t_ds : {
 		struct rk_ds_record *ds = rr->u.ds;
-		size_t i;
+		size_t j;
 
 		printf ("key tag %u alg %u type %u length %lu data ",
 			ds->key_tag, ds->algorithm, ds->digest_type,
 			(unsigned long)ds->digest_len);
-		for (i = 0; i < ds->digest_len; i++)
-		    printf("%02X", ds->digest_data[i]);
+		for (j = 0; j < ds->digest_len; j++)
+		    printf("%02X", ds->digest_data[j]);
 		printf("\n");
 
 		break;