krb5: backport upstream SPNEGO mechListMIC parsing fix (ticket 9183)

[apurvparekh30]

Merge Checklist

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted
• LICENSE-MAP files are up-to-date
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

https://microsoft.visualstudio.com/OS/_workitems/edit/62817258
Azure Linux 3.0 ships krb5 1.21.3-4, whose get_negTokenResp() parses the SPNEGO mechListMIC field with the wrong ASN.1 context tag — [4] (0xA4) instead of the correct [3] (0xA3). Per RFC 4178 NegTokenResp, mechListMIC is [3] (and get_negTokenInit() already uses [3] correctly). The bug was introduced upstream by commit fdceb225.

As a result the acceptor/initiator fails to read the mechListMIC in a negTokenResp, breaking SPNEGO MIC verification on that path. This is observable when authenticating NTLM-over-SPNEGO to Windows hosts (e.g. PowerShell/WinRM remoting from an Azure Linux container via gss-ntlmssp), where the MIC exchange is required.

This PR backports the upstream fix krb5 commit 942c503 (ticket 9183, target_version: 1.21-next), which corrects the tag and restores the t_spnego.c reselection regression test.

Change Log

• Add SPECS/krb5/krb5-fix-SPNEGO-mechListMIC-parsing.patch (full upstream commit 942c503, code fix + regression test).
• krb5.spec: add Patch3, bump Release 4 → 5, add %changelog entry.
• Update toolchain_{x86_64,aarch64}.txt and pkggen_core_{x86_64,aarch64}.txt manifests to the new 1.21.3-5 RPM filenames (krb5 is a toolchain package).
• No Source files changed, so krb5.signatures.json is unchanged.

Does this affect the toolchain?

YES — krb5 is a toolchain package. No source/dependency changes, but its Release bump (4 → 5) requires the toolchain and pkggen_core package manifests (x86_64 + aarch64) to be updated to the new RPM filenames, which this PR does.

Associated issues

• Upstream: krb5/krb5@942c503 (MIT krb5 ticket 9183)

Test Methodology

• Full upstream patch applies cleanly to the 1.21.3 source tree (%autosetup -p1); the restored t_spnego.c reselection test runs under %check (make check).
• Fix validated end-to-end in a live Azure Linux 3.0 container: with krb5 carrying this fix, SPNEGO/NTLM PowerShell remoting to a Windows SCVMM/VMM host completes successfully.
• Pipeline build id: to be filled from the GitHub PR check run

[KavyaSree2610]

Reproduced the issue without patch: hangs indefinitely

Resolved with the patch:

[KavyaSree2610]

Looks good to me

[KavyaSree2610]

Buddy build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1145595&view=results

[KavyaSree2610]

Buddy build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1145800&view=results
The changes looks good to me except for the circular dependency check which is failing(but expected to fail since its trying to download a package version which is not yet available on pmc)

[Kanishk-Bansal]

Suggested change

	- Backport upstream fix for SPNEGO mechListMIC parsing (krb5 commit 942c503, ticket 9183)
	- Backport upstream fix for SPNEGO mechListMIC parsing (krb5 commit 942c503, ticket 9183)