[t-lo]

Gentoo stabilised mit-krb5-1.22.2, no need to carry user patches anymore (also patches fail to apply now, breaking the build).

This fixes

05:06:09  >>> Preparing source in /var/tmp/portage/app-crypt/mit-krb5-1.22.3/work/krb5-1.22.3/src ...
05:06:09   �[32m*�[0m Applying mit-krb5-1.12_warn_cflags.patch ...
05:06:09  �[A�[72C �[34;01m[ �[32;01mok�[34;01m ]�[0m
05:06:09   �[32m*�[0m Applying mit-krb5_dont_create_rundir.patch ...
05:06:09  �[A�[72C �[34;01m[ �[32;01mok�[34;01m ]�[0m
05:06:09   �[32m*�[0m Applying mit-krb5-1.18.2-krb5-config.patch ...
05:06:09  �[A�[72C �[34;01m[ �[32;01mok�[34;01m ]�[0m
05:06:09   �[32m*�[0m Applying mit-krb5-1.22-socket-too-long.patch ...
05:06:09  �[A�[72C �[34;01m[ �[32;01mok�[34;01m ]�[0m
05:06:09   �[32m*�[0m Applying mit-krb5-1.22-check-pytests-dep.patch ...
05:06:09  patching file lib/krb5/krb/Makefile.in
05:06:09  Hunk #1 succeeded at 518 with fuzz 2 (offset 6 lines).
05:06:09  �[A�[72C �[34;01m[ �[32;01mok�[34;01m ]�[0m
05:06:09   �[32m*�[0m �[32m=============================================================================�[0m
05:06:09   �[32m*�[0m Applying user patches from /etc/portage/patches ...
05:06:09   �[32m*�[0m Applying 0001-Fix-two-NegoEx-parsing-vulnerabilities.patch ...
05:06:09  patching file lib/gssapi/spnego/negoex_util.c
05:06:09  Hunk #1 FAILED at 253.
05:06:09  Hunk #2 FAILED at 391.
05:06:09  2 out of 2 hunks FAILED -- saving rejects to file lib/gssapi/spnego/negoex_util.c.rej
05:06:09  �[A�[72C �[34;01m[ �[31;01m!!�[34;01m ]�[0m
05:06:09   �[31;01m*�[0m ERROR: app-crypt/mit-krb5-1.22.3::gentoo failed (prepare phase):

seen in #4373.

[Copilot]

🔵 Needs a closer look

Removing the NegoEx patch while the pinned Gentoo version lacks equivalent fixes reintroduces CVE-2026-40355 and CVE-2026-40356, so the patch must be retained or the Gentoo update included.

No open issues 🎉

What changed in this PR

Removes Flatcar’s mit-krb5 user patch to avoid patch-application failures with the 1.22.3 upgrade proposed in #4373.

Changes:

• Deletes the NegoEx security backport.
• Deletes the README documenting when that backport can be removed.

File	Description
sdk_container/​src/​third_party/​coreos-overlay/​coreos/​user-patches/​app-crypt/​mit-krb5/​README.md	Removes the backport’s version-removal guidance.
sdk_container/​src/​third_party/​coreos-overlay/​coreos/​user-patches/​app-crypt/​mit-krb5/​0001-Fix-two-NegoEx-parsing-vulnerabilities.patch	Removes the backport for two NegoEx parsing vulnerabilities.

_{Review effort: Balanced}

[t-lo]

Preparing source in /var/tmp/portage/app-crypt/mit-krb5-1.22.3/work/krb5-1.22.3/src

Bad bot! The log clearly states:

...
Preparing source in /var/tmp/portage/app-crypt/mit-krb5-1.22.3/work/krb5-1.22.3/src 
...

implying Gentoo ships mit-krb5-1.22.3, which includes the fixes and thus is not vulnerable.

[chewi]

Right, but that's not true in main? You should add this to the other PR.

[t-lo]

Merged into the buildbot branch.