From: Greg Hudson <ghudson@mit.edu>
Date: Sat, 5 Jul 2014 15:50:58 +0000 (-0400)
Subject: Include autoconf.h before system headers
X-Git-Tag: krb5-1.13-alpha1~64
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=02a1123cf44381690c28f18ab2c4ba8036200539;p=thirdparty%2Fkrb5.git

Include autoconf.h before system headers

Include autoconf.h (either directly or via proxy) before system
headers, so that feature test macros defined there can affect the
system namespace.  Where include order was changed, eliminate some
redundant or unnecessary includes.

ticket: 7961
---

diff --git a/src/appl/gss-sample/gss-misc.c b/src/appl/gss-sample/gss-misc.c
index 3a87fcd042..080ac4d0c6 100644
--- a/src/appl/gss-sample/gss-misc.c
+++ b/src/appl/gss-sample/gss-misc.c
@@ -44,6 +44,8 @@
  * or implied warranty.
  */
 
+#include <autoconf.h>
+
 #include <stdio.h>
 #ifdef _WIN32
 #include <windows.h>
@@ -55,8 +57,6 @@
 #endif
 #include <errno.h>
 
-#include <autoconf.h>
-
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
diff --git a/src/appl/simple/client/sim_client.c b/src/appl/simple/client/sim_client.c
index 835d85f88c..aaa6446c67 100644
--- a/src/appl/simple/client/sim_client.c
+++ b/src/appl/simple/client/sim_client.c
@@ -29,25 +29,20 @@
  * This program performs no useful function.
  */
 
+#include <k5-int.h>
+#include "com_err.h"
+
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <netdb.h>
-#include <stdio.h>
-#include <string.h>
 #include <ctype.h>
-#include <errno.h>
-
-#include <k5-int.h>
-#include "com_err.h"
-
-#include "simple.h"
-
-#include <stdlib.h>
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
 
+#include "simple.h"
+
 /* for old Unixes and friends ... */
 #ifndef MAXHOSTNAMELEN
 #define MAXHOSTNAMELEN 64
diff --git a/src/appl/user_user/client.c b/src/appl/user_user/client.c
index 3d5fc51f12..28901a6370 100644
--- a/src/appl/user_user/client.c
+++ b/src/appl/user_user/client.c
@@ -24,17 +24,14 @@
  * or implied warranty.
  */
 
+#include "k5-int.h"
+#include "com_err.h"
+
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <netdb.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-
-#include "k5-int.h"
-#include "com_err.h"
 
 int main (int argc, char *argv[])
 {
diff --git a/src/appl/user_user/server.c b/src/appl/user_user/server.c
index dbff68e64a..09ea4e0ed7 100644
--- a/src/appl/user_user/server.c
+++ b/src/appl/user_user/server.c
@@ -1,3 +1,4 @@
+
 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 /* appl/user_user/server.c - One end of user-user client-server pair */
 /*
@@ -24,20 +25,17 @@
  * or implied warranty.
  */
 
+#include "k5-int.h"
+#include "port-sockets.h"
+#include "com_err.h"
+
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <netdb.h>
-#include <stdio.h>
-#include <string.h>
 #include <unistd.h>
 #include <fcntl.h>
-#include <errno.h>
-
-#include "port-sockets.h"
-#include "k5-int.h"
-#include "com_err.h"
 
 /* fd 0 is a tcp socket used to talk to the client */
 
diff --git a/src/clients/kpasswd/kpasswd.c b/src/clients/kpasswd/kpasswd.c
index 9f4952bb82..efc596edf7 100644
--- a/src/clients/kpasswd/kpasswd.c
+++ b/src/clients/kpasswd/kpasswd.c
@@ -1,8 +1,7 @@
 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+#include "k5-platform.h"
 #include <locale.h>
-#include <stdio.h>
 #include <sys/types.h>
-#include "k5-platform.h"
 
 #ifndef _WIN32
 #include <unistd.h>
diff --git a/src/clients/kpasswd/ksetpwd.c b/src/clients/kpasswd/ksetpwd.c
index 9719905062..5f9c982614 100644
--- a/src/clients/kpasswd/ksetpwd.c
+++ b/src/clients/kpasswd/ksetpwd.c
@@ -1,10 +1,8 @@
 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+#include <k5-platform.h>
 #include <krb5.h>
-#include <string.h>
 #include <unistd.h>
-#include <stdio.h>
 #include <time.h>
-#include <k5-platform.h>
 
 #define TKTTIMELEFT     60*10   /* ten minutes */
 
diff --git a/src/clients/ksu/setenv.c b/src/clients/ksu/setenv.c
index 33ac1e3030..a7895c6b47 100644
--- a/src/clients/ksu/setenv.c
+++ b/src/clients/ksu/setenv.c
@@ -34,11 +34,11 @@
 
 /* based on @(#)setenv.c        5.2 (Berkeley) 6/27/88 */
 
+#include "autoconf.h"
 #include <sys/types.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include "autoconf.h"
 
 static char *_findenv(char *, int *);
 
diff --git a/src/clients/ksu/xmalloc.c b/src/clients/ksu/xmalloc.c
index 9e3e98db23..430a6b3bf4 100644
--- a/src/clients/ksu/xmalloc.c
+++ b/src/clients/ksu/xmalloc.c
@@ -24,9 +24,8 @@
  * or implied warranty.
  */
 
-#include "ksu.h"
-#include <stdarg.h>
 #include "k5-platform.h"
+#include "ksu.h"
 
 void *xmalloc (size_t sz)
 {
diff --git a/src/clients/kswitch/kswitch.c b/src/clients/kswitch/kswitch.c
index b64947972c..6ad470b099 100644
--- a/src/clients/kswitch/kswitch.c
+++ b/src/clients/kswitch/kswitch.c
@@ -24,8 +24,8 @@
  * or implied warranty.
  */
 
-#include <locale.h>
 #include "k5-int.h"
+#include <locale.h>
 
 extern int optind;
 extern char *optarg;
diff --git a/src/clients/kvno/kvno.c b/src/clients/kvno/kvno.c
index 134accbd7b..377d4f3451 100644
--- a/src/clients/kvno/kvno.c
+++ b/src/clients/kvno/kvno.c
@@ -25,10 +25,8 @@
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
-#include <locale.h>
-#include <stdio.h>
-#include <stdlib.h>
 #include "k5-platform.h"
+#include <locale.h>
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
diff --git a/src/kadmin/cli/keytab.c b/src/kadmin/cli/keytab.c
index cd52da58b2..6c0c92c221 100644
--- a/src/kadmin/cli/keytab.c
+++ b/src/kadmin/cli/keytab.c
@@ -32,11 +32,6 @@
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <errno.h>
-
 #include "k5-int.h"
 #include <kadm5/admin.h>
 #include <adm_proto.h>
diff --git a/src/kadmin/cli/ss_wrapper.c b/src/kadmin/cli/ss_wrapper.c
index 54f56716bb..bd368a8066 100644
--- a/src/kadmin/cli/ss_wrapper.c
+++ b/src/kadmin/cli/ss_wrapper.c
@@ -23,8 +23,8 @@
  * or implied warranty.
  */
 
-#include <krb5.h>
 #include <k5-platform.h>
+#include <krb5.h>
 #include <locale.h>
 #include <ss/ss.h>
 #include "kadmin.h"
diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c
index acdb6791bb..9f5d26aa8f 100644
--- a/src/kadmin/dbutil/dump.c
+++ b/src/kadmin/dbutil/dump.c
@@ -28,7 +28,6 @@
  * Use is subject to license terms.
  */
 
-#include <stdio.h>
 #include <k5-int.h>
 #include <kadm5/admin.h>
 #include <kadm5/server_internal.h>
diff --git a/src/kadmin/dbutil/kadm5_create.c b/src/kadmin/dbutil/kadm5_create.c
index 5d2854ad2e..fffc64df18 100644
--- a/src/kadmin/dbutil/kadm5_create.c
+++ b/src/kadmin/dbutil/kadm5_create.c
@@ -31,11 +31,8 @@
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <ctype.h>
 #include <k5-int.h>
+#include <ctype.h>
 #include <kdb.h>
 #include <kadm5/admin.h>
 #include <adm_proto.h>
diff --git a/src/kadmin/dbutil/kdb5_create.c b/src/kadmin/dbutil/kdb5_create.c
index 385dfb931f..3698d57193 100644
--- a/src/kadmin/dbutil/kdb5_create.c
+++ b/src/kadmin/dbutil/kdb5_create.c
@@ -53,7 +53,6 @@
  * Use is subject to license terms.
  */
 
-#include <stdio.h>
 #include <k5-int.h>
 #include <kdb.h>
 #include <kadm5/server_internal.h>
diff --git a/src/kadmin/dbutil/kdb5_mkey.c b/src/kadmin/dbutil/kdb5_mkey.c
index ba8716be04..bc10b44ffc 100644
--- a/src/kadmin/dbutil/kdb5_mkey.c
+++ b/src/kadmin/dbutil/kdb5_mkey.c
@@ -4,14 +4,13 @@
  * Use is subject to license terms.
  */
 
-#include <stdio.h>
-#include <time.h>
 #include <k5-int.h>
 #include <kdb.h>
 #include <kadm5/server_internal.h>
 #include <kadm5/admin.h>
 #include <adm_proto.h>
 #include "kdb5_util.h"
+#include <time.h>
 
 #if defined(HAVE_COMPILE) && defined(HAVE_STEP)
 #define SOLARIS_REGEXPS
diff --git a/src/kadmin/dbutil/kdb5_util.c b/src/kadmin/dbutil/kdb5_util.c
index 4f04d782bc..e2bb36c895 100644
--- a/src/kadmin/dbutil/kdb5_util.c
+++ b/src/kadmin/dbutil/kdb5_util.c
@@ -53,7 +53,6 @@
  * Use is subject to license terms.
  */
 
-#include <stdio.h>
 #include <k5-int.h>
 #include <kadm5/admin.h>
 #include <locale.h>
diff --git a/src/kadmin/dbutil/ovload.c b/src/kadmin/dbutil/ovload.c
index add58c0f96..15a5ab3005 100644
--- a/src/kadmin/dbutil/ovload.c
+++ b/src/kadmin/dbutil/ovload.c
@@ -1,13 +1,7 @@
 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+#include    <k5-int.h>
 #include    <unistd.h>
-#include    <string.h>
-#include    <stdlib.h>
-#include    "autoconf.h"
-#ifdef HAVE_MEMORY_H
-#include    <memory.h>
-#endif
 
-#include    <k5-int.h>
 #include <kadm5/admin.h>
 #include <kadm5/server_internal.h>
 #include    <kdb.h>
diff --git a/src/kadmin/server/ipropd_svc.c b/src/kadmin/server/ipropd_svc.c
index 955acb9c47..bc760fa5f8 100644
--- a/src/kadmin/server/ipropd_svc.c
+++ b/src/kadmin/server/ipropd_svc.c
@@ -7,14 +7,12 @@
 /* #pragma ident	"@(#)ipropd_svc.c	1.2	04/02/20 SMI" */
 
 
-#include <stdio.h>
-#include <stdlib.h> /* getenv, exit */
+#include "k5-platform.h"
 #include <signal.h>
 #include <sys/types.h>
 #include <sys/resource.h> /* rlimit */
 #include <syslog.h>
 
-#include "k5-platform.h"
 #include <kadm5/admin.h>
 #include <kadm5/kadm_rpc.h>
 #include <kadm5/server_internal.h>
diff --git a/src/kadmin/server/ovsec_kadmd.c b/src/kadmin/server/ovsec_kadmd.c
index bc9e3c7e0d..7318e630c0 100644
--- a/src/kadmin/server/ovsec_kadmd.c
+++ b/src/kadmin/server/ovsec_kadmd.c
@@ -30,6 +30,7 @@
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
+#include <k5-platform.h>
 #include <errno.h>
 #include <locale.h>
 #include <stdio.h>
diff --git a/src/kdc/kdc_transit.c b/src/kdc/kdc_transit.c
index c540ad26cb..61aef99edd 100644
--- a/src/kdc/kdc_transit.c
+++ b/src/kdc/kdc_transit.c
@@ -30,8 +30,6 @@
  * OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <stddef.h>
-
 #include "k5-int.h"
 #include "kdc_util.h"
 
diff --git a/src/kdc/main.c b/src/kdc/main.c
index c3b7b802e4..82dfc0e863 100644
--- a/src/kdc/main.c
+++ b/src/kdc/main.c
@@ -23,16 +23,6 @@
  * or implied warranty.
  */
 
-#include <locale.h>
-#include <stdio.h>
-#include <syslog.h>
-#include <signal.h>
-#include <errno.h>
-#include <netdb.h>
-#include <unistd.h>
-#include <ctype.h>
-#include <sys/wait.h>
-
 #include "k5-int.h"
 #include "com_err.h"
 #include <kadm5/admin.h>
@@ -47,6 +37,14 @@
 #include <netinet/in.h>
 #endif
 
+#include <locale.h>
+#include <syslog.h>
+#include <signal.h>
+#include <netdb.h>
+#include <unistd.h>
+#include <ctype.h>
+#include <sys/wait.h>
+
 #if defined(NEED_DAEMON_PROTO)
 extern int daemon(int, int);
 #endif
diff --git a/src/lib/crypto/crypto_tests/t_pkcs5.c b/src/lib/crypto/crypto_tests/t_pkcs5.c
index 7ab078df7a..8e87a802a9 100644
--- a/src/lib/crypto/crypto_tests/t_pkcs5.c
+++ b/src/lib/crypto/crypto_tests/t_pkcs5.c
@@ -26,11 +26,6 @@
 
 /* Test vectors for PBKDF2 (from PKCS #5v2), based on RFC 3211. */
 
-#include <assert.h>
-#include <stdio.h>
-#include <string.h>
-#include <ctype.h>
-
 #include "k5-int.h"
 
 static void printhex (size_t len, const char *p)
diff --git a/src/lib/crypto/nss/hash_provider/hash_gen.h b/src/lib/crypto/nss/hash_provider/hash_gen.h
index 95e29002fe..2b84da58cb 100644
--- a/src/lib/crypto/nss/hash_provider/hash_gen.h
+++ b/src/lib/crypto/nss/hash_provider/hash_gen.h
@@ -33,8 +33,8 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "sechash.h"
 #include "k5-int.h"
+#include "sechash.h"
 
 krb5_error_code k5_nss_gen_hash(HASH_HashType hashType, unsigned int icount,
                                 const krb5_data *input, krb5_data *output);
diff --git a/src/lib/gssapi/krb5/k5sealiov.c b/src/lib/gssapi/krb5/k5sealiov.c
index 0b99a77e95..a1296700ec 100644
--- a/src/lib/gssapi/krb5/k5sealiov.c
+++ b/src/lib/gssapi/krb5/k5sealiov.c
@@ -24,11 +24,8 @@
  * or implied warranty.
  */
 
-#include <assert.h>
-#include "k5-platform.h"        /* for 64-bit support */
-#include "k5-int.h"          /* for zap() */
+#include "k5-int.h"
 #include "gssapiP_krb5.h"
-#include <stdarg.h>
 
 static krb5_error_code
 make_seal_token_v1_iov(krb5_context context,
diff --git a/src/lib/gssapi/krb5/k5sealv3.c b/src/lib/gssapi/krb5/k5sealv3.c
index f3ade5e79f..1a5c14c271 100644
--- a/src/lib/gssapi/krb5/k5sealv3.c
+++ b/src/lib/gssapi/krb5/k5sealv3.c
@@ -26,11 +26,8 @@
 
 /* draft-ietf-krb-wg-gssapi-cfx-05 */
 
-#include <assert.h>
-#include "k5-platform.h"        /* for 64-bit support */
-#include "k5-int.h"             /* for zap() */
+#include "k5-int.h"
 #include "gssapiP_krb5.h"
-#include <stdarg.h>
 
 int
 gss_krb5int_rotate_left (void *ptr, size_t bufsiz, size_t rc)
diff --git a/src/lib/gssapi/krb5/k5sealv3iov.c b/src/lib/gssapi/krb5/k5sealv3iov.c
index 960f31b7e4..a73edb6a4f 100644
--- a/src/lib/gssapi/krb5/k5sealv3iov.c
+++ b/src/lib/gssapi/krb5/k5sealv3iov.c
@@ -24,11 +24,8 @@
  * or implied warranty.
  */
 
-#include <assert.h>
-#include "k5-platform.h"        /* for 64-bit support */
-#include "k5-int.h"          /* for zap() */
+#include "k5-int.h"
 #include "gssapiP_krb5.h"
-#include <stdarg.h>
 
 krb5_error_code
 gss_krb5int_make_seal_token_v3_iov(krb5_context context,
diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c
index b654c66c5b..f34d802bd9 100644
--- a/src/lib/gssapi/krb5/k5unsealiov.c
+++ b/src/lib/gssapi/krb5/k5unsealiov.c
@@ -24,11 +24,8 @@
  * or implied warranty.
  */
 
-#include <assert.h>
-#include "k5-platform.h"        /* for 64-bit support */
-#include "k5-int.h"          /* for zap() */
+#include "k5-int.h"
 #include "gssapiP_krb5.h"
-#include <stdarg.h>
 
 static OM_uint32
 kg_unseal_v1_iov(krb5_context context,
diff --git a/src/lib/gssapi/krb5/naming_exts.c b/src/lib/gssapi/krb5/naming_exts.c
index 10dbe321a1..6062a6dd80 100644
--- a/src/lib/gssapi/krb5/naming_exts.c
+++ b/src/lib/gssapi/krb5/naming_exts.c
@@ -24,10 +24,8 @@
  * or implied warranty.
  */
 
-#include <assert.h>
-#include "k5-int.h"          /* for zap() */
+#include "k5-int.h"
 #include "gssapiP_krb5.h"
-#include <stdarg.h>
 
 krb5_error_code
 kg_init_name(krb5_context context, krb5_principal principal,
diff --git a/src/lib/gssapi/krb5/prf.c b/src/lib/gssapi/krb5/prf.c
index bfca89b4c6..e19291f348 100644
--- a/src/lib/gssapi/krb5/prf.c
+++ b/src/lib/gssapi/krb5/prf.c
@@ -24,10 +24,8 @@
  * or implied warranty.
  */
 
-#include <assert.h>
-#include "k5-int.h"          /* for zap() */
+#include "k5-int.h"
 #include "gssapiP_krb5.h"
-#include <stdarg.h>
 
 #ifndef MIN             /* Usually found in <sys/param.h>. */
 #define MIN(_a,_b)  ((_a)<(_b)?(_a):(_b))
diff --git a/src/lib/gssapi/krb5/store_cred.c b/src/lib/gssapi/krb5/store_cred.c
index 0a020d7573..a6becf333d 100644
--- a/src/lib/gssapi/krb5/store_cred.c
+++ b/src/lib/gssapi/krb5/store_cred.c
@@ -24,10 +24,8 @@
  * or implied warranty.
  */
 
-#include <assert.h>
-#include "k5-int.h"          /* for zap() */
+#include "k5-int.h"
 #include "gssapiP_krb5.h"
-#include <stdarg.h>
 
 static int
 has_unexpired_creds(krb5_gss_cred_id_t kcred,
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index c9c1b11653..173c6d2939 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -59,10 +59,6 @@
  */
 /* #pragma ident	"@(#)spnego_mech.c	1.7	04/09/28 SMI" */
 
-#include	<assert.h>
-#include	<stdio.h>
-#include	<stdlib.h>
-#include	<string.h>
 #include	<k5-int.h>
 #include	<krb5.h>
 #include	<mglueP.h>
diff --git a/src/lib/kadm5/alt_prof.c b/src/lib/kadm5/alt_prof.c
index 9ebcb738a5..205333be4a 100644
--- a/src/lib/kadm5/alt_prof.c
+++ b/src/lib/kadm5/alt_prof.c
@@ -29,8 +29,8 @@
  */
 
 /* Implement alternate profile file handling. */
-#include "fake-addrinfo.h"
 #include "k5-int.h"
+#include "fake-addrinfo.h"
 #include <kadm5/admin.h>
 #include "adm_proto.h"
 #include <stdio.h>
diff --git a/src/lib/kadm5/chpass_util.c b/src/lib/kadm5/chpass_util.c
index 7a75136658..408b0eb31f 100644
--- a/src/lib/kadm5/chpass_util.c
+++ b/src/lib/kadm5/chpass_util.c
@@ -4,11 +4,8 @@
  */
 
 
-#include <stdio.h>
 #include "autoconf.h"
-#ifdef HAVE_MEMORY_H
-#include <memory.h>
-#endif
+#include <stdio.h>
 #include <time.h>
 #include <string.h>
 
diff --git a/src/lib/kadm5/clnt/client_init.c b/src/lib/kadm5/clnt/client_init.c
index 48d93882a6..7fac2a8e7a 100644
--- a/src/lib/kadm5/clnt/client_init.c
+++ b/src/lib/kadm5/clnt/client_init.c
@@ -29,23 +29,14 @@
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
-#include <stdio.h>
+#include <k5-int.h>
 #include <netdb.h>
-#include "autoconf.h"
-#ifdef HAVE_MEMORY_H
-#include <memory.h>
-#endif
-#include <string.h>
 #include <com_err.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <fake-addrinfo.h>
-#include <k5-int.h> /* for KRB5_ADM_DEFAULT_PORT */
 #include <krb5.h>
-#ifdef __STDC__
-#include <stdlib.h>
-#endif
 
 #include <kadm5/admin.h>
 #include <kadm5/kadm_rpc.h>
diff --git a/src/lib/kadm5/srv/server_acl.c b/src/lib/kadm5/srv/server_acl.c
index b2aeb7daa4..044b0e9860 100644
--- a/src/lib/kadm5/srv/server_acl.c
+++ b/src/lib/kadm5/srv/server_acl.c
@@ -24,11 +24,10 @@
  * or implied warranty.
  */
 
-#include <stdio.h>
+#include "k5-int.h"
 #include <syslog.h>
 #include <sys/param.h>
 #include <gssapi/gssapi_generic.h>
-#include "k5-int.h"
 #include <kadm5/server_internal.h>
 #include <kadm5/admin.h>
 #include "adm_proto.h"
diff --git a/src/lib/kadm5/srv/server_init.c b/src/lib/kadm5/srv/server_init.c
index f46f89d988..c0e0b78c82 100644
--- a/src/lib/kadm5/srv/server_init.c
+++ b/src/lib/kadm5/srv/server_init.c
@@ -10,11 +10,8 @@
  * Use is subject to license terms.
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <errno.h>
+#include "k5-int.h"
 #include <com_err.h>
-#include "k5-int.h"             /* needed for gssapiP_krb5.h */
 #include <kadm5/admin.h>
 #include <krb5.h>
 #include <kdb_log.h>
diff --git a/src/lib/kadm5/srv/server_kdb.c b/src/lib/kadm5/srv/server_kdb.c
index 6db5229e35..f99bf5855e 100644
--- a/src/lib/kadm5/srv/server_kdb.c
+++ b/src/lib/kadm5/srv/server_kdb.c
@@ -10,8 +10,6 @@
  * Use is subject to license terms.
  */
 
-#include <stdio.h>
-#include <stdlib.h>
 #include "k5-int.h"
 #include <kadm5/admin.h>
 #include "server_internal.h"
diff --git a/src/lib/kadm5/unit-test/setkey-test.c b/src/lib/kadm5/unit-test/setkey-test.c
index 4da236e093..28364b6e08 100644
--- a/src/lib/kadm5/unit-test/setkey-test.c
+++ b/src/lib/kadm5/unit-test/setkey-test.c
@@ -1,5 +1,4 @@
 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-#include <stdio.h>
 #include <k5-int.h>
 #include <kadm5/admin.h>
 
diff --git a/src/lib/kdb/kdb5.c b/src/lib/kdb/kdb5.c
index 4b4bb49a7e..7541b1ec45 100644
--- a/src/lib/kdb/kdb5.c
+++ b/src/lib/kdb/kdb5.c
@@ -37,10 +37,7 @@
  * Include files
  */
 
-#include <stdio.h>
-#include <string.h>
 #include <k5-int.h>
-#include <osconf.h>
 #include "kdb5.h"
 #include "kdb_log.h"
 #include "kdb5int.h"
diff --git a/src/lib/kdb/kdb5.h b/src/lib/kdb/kdb5.h
index 33bc49cca0..9a43046bdd 100644
--- a/src/lib/kdb/kdb5.h
+++ b/src/lib/kdb/kdb5.h
@@ -2,14 +2,14 @@
 #ifndef _KRB5_KDB5_H_
 #define _KRB5_KDB5_H_
 
+#include <k5-int.h>
+
 #if HAVE_UNISTD_H
 #include <unistd.h>
 #endif
 
 #include <errno.h>
 #include <utime.h>
-#include <utime.h>
-#include <k5-int.h>
 #include "kdb.h"
 
 #define KRB5_DB_GET_DB_CONTEXT(kcontext) (((kdb5_dal_handle*) (kcontext)->dal_handle)->db_context)
diff --git a/src/lib/kdb/kdb_convert.c b/src/lib/kdb/kdb_convert.c
index ee3e984ec7..1370395c8d 100644
--- a/src/lib/kdb/kdb_convert.c
+++ b/src/lib/kdb/kdb_convert.c
@@ -10,13 +10,12 @@
  * This file contains api's for conversion of the kdb_incr_update_t
  * struct(s) into krb5_db_entry struct(s) and vice-versa.
  */
+#include <k5-int.h>
 #include <sys/types.h>
 #include <com_err.h>
 #include <locale.h>
-#include <errno.h>
 #include <iprop_hdr.h>
 #include "iprop.h"
-#include <k5-int.h>
 #include <kdb.h>
 #include <kdb_log.h>
 
diff --git a/src/lib/krb5/krb/appdefault.c b/src/lib/krb5/krb/appdefault.c
index e3d14be378..73fd2605e8 100644
--- a/src/lib/krb5/krb/appdefault.c
+++ b/src/lib/krb5/krb/appdefault.c
@@ -4,8 +4,6 @@
  *               handle the [appdefaults] profile section
  */
 
-#include <stdio.h>
-#include <string.h>
 #include "k5-int.h"
 
 
diff --git a/src/lib/krb5/krb/bld_princ.c b/src/lib/krb5/krb/bld_princ.c
index 3dbe3561d5..ab6fed897f 100644
--- a/src/lib/krb5/krb/bld_princ.c
+++ b/src/lib/krb5/krb/bld_princ.c
@@ -24,7 +24,6 @@
  * or implied warranty.
  */
 
-#include <stdarg.h>
 #include "k5-int.h"
 
 static krb5_error_code
diff --git a/src/lib/krb5/krb/chpw.c b/src/lib/krb5/krb/chpw.c
index b67a58831f..463ce643e5 100644
--- a/src/lib/krb5/krb/chpw.c
+++ b/src/lib/krb5/krb/chpw.c
@@ -2,7 +2,6 @@
 /*
 ** set password functions added by Paul W. Nelson, Thursby Software Systems, Inc.
 */
-#include <string.h>
 
 #include "k5-int.h"
 #include "k5-unicode.h"
diff --git a/src/lib/krb5/krb/deltat.c b/src/lib/krb5/krb/deltat.c
index cf6e289d17..0169da8e61 100644
--- a/src/lib/krb5/krb/deltat.c
+++ b/src/lib/krb5/krb/deltat.c
@@ -75,9 +75,8 @@
 #pragma GCC diagnostic ignored "-Wmaybe-uninitialized"
 #endif
 
-#include <ctype.h>
-#include <errno.h>
 #include "k5-int.h"
+#include <ctype.h>
 
 struct param {
     krb5_int32 delta;
diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index 88bad4c09d..5a2b8d8b22 100644
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -24,8 +24,6 @@
  * or implied warranty.
  */
 
-#include <string.h>
-
 #include "k5-int.h"
 #include "int-proto.h"
 #include "os-proto.h"
diff --git a/src/lib/krb5/krb/kerrs.c b/src/lib/krb5/krb/kerrs.c
index 16e7267e0b..c5d6c81010 100644
--- a/src/lib/krb5/krb/kerrs.c
+++ b/src/lib/krb5/krb/kerrs.c
@@ -24,7 +24,6 @@
  * or implied warranty.
  */
 
-#include <stdarg.h>
 #include "k5-int.h"
 #include "int-proto.h"
 
diff --git a/src/lib/krb5/krb/t_kerb.c b/src/lib/krb5/krb/t_kerb.c
index 0f27ce9cec..60cfb5b151 100644
--- a/src/lib/krb5/krb/t_kerb.c
+++ b/src/lib/krb5/krb/t_kerb.c
@@ -4,8 +4,8 @@
  * routines.
  */
 
-#include "krb5.h"
 #include "autoconf.h"
+#include "krb5.h"
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
diff --git a/src/lib/krb5/krb/x-deltat.y b/src/lib/krb5/krb/x-deltat.y
index 5d5f2f8879..0fb0078ea0 100644
--- a/src/lib/krb5/krb/x-deltat.y
+++ b/src/lib/krb5/krb/x-deltat.y
@@ -47,9 +47,8 @@
 #pragma GCC diagnostic ignored "-Wmaybe-uninitialized"
 #endif
 
-#include <ctype.h>
-#include <errno.h>
 #include "k5-int.h"
+#include <ctype.h>
 
 struct param {
     krb5_int32 delta;
diff --git a/src/lib/krb5/krb5_libinit.c b/src/lib/krb5/krb5_libinit.c
index f2382d1d8c..b72bc58c79 100644
--- a/src/lib/krb5/krb5_libinit.c
+++ b/src/lib/krb5/krb5_libinit.c
@@ -1,8 +1,5 @@
 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-#include <assert.h>
 
-#include "autoconf.h"
-#include "com_err.h"
 #include "k5-int.h"
 
 #if defined(_WIN32) || defined(USE_CCAPI)
diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c
index 0ee427d2ed..dde84367ef 100644
--- a/src/lib/krb5/os/changepw.c
+++ b/src/lib/krb5/os/changepw.c
@@ -31,8 +31,8 @@
  *  infrastructure
  */
 
-#include "fake-addrinfo.h"
 #include "k5-int.h"
+#include "fake-addrinfo.h"
 #include "os-proto.h"
 #include "../krb/auth_con.h"
 #include "../krb/int-proto.h"
diff --git a/src/lib/krb5/os/locate_kdc.c b/src/lib/krb5/os/locate_kdc.c
index 2fade13eec..1f2039c780 100644
--- a/src/lib/krb5/os/locate_kdc.c
+++ b/src/lib/krb5/os/locate_kdc.c
@@ -24,10 +24,9 @@
  * or implied warranty.
  */
 
-#include "fake-addrinfo.h"
 #include "k5-int.h"
+#include "fake-addrinfo.h"
 #include "os-proto.h"
-#include <stdio.h>
 #ifdef KRB5_DNS_LOOKUP
 #ifdef WSHELPER
 #include <wshelper.h>
diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
index a7fa4612c8..4555321f7a 100644
--- a/src/lib/krb5/os/sendto_kdc.c
+++ b/src/lib/krb5/os/sendto_kdc.c
@@ -53,8 +53,8 @@
 /* Send packet to KDC for realm; wait for response, retransmitting
  * as necessary. */
 
-#include "fake-addrinfo.h"
 #include "k5-int.h"
+#include "fake-addrinfo.h"
 
 #include "os-proto.h"
 
diff --git a/src/lib/krb5/os/t_locate_kdc.c b/src/lib/krb5/os/t_locate_kdc.c
index dd609fda60..e986ae9d9c 100644
--- a/src/lib/krb5/os/t_locate_kdc.c
+++ b/src/lib/krb5/os/t_locate_kdc.c
@@ -1,8 +1,7 @@
 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-#include <stdio.h>
-#include <string.h>
-#include <sys/types.h>
+#include "k5-platform.h"
 #include "port-sockets.h"
+#include <sys/types.h>
 #include <com_err.h>
 
 #define TEST
diff --git a/src/lib/krb5/os/t_std_conf.c b/src/lib/krb5/os/t_std_conf.c
index 6ee54d5be9..72021c3626 100644
--- a/src/lib/krb5/os/t_std_conf.c
+++ b/src/lib/krb5/os/t_std_conf.c
@@ -4,8 +4,8 @@
  *      values from the krb5 config file(s).
  */
 
-#include "fake-addrinfo.h"
 #include "k5-int.h"
+#include "fake-addrinfo.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/src/lib/krb5/os/t_trace.c b/src/lib/krb5/os/t_trace.c
index 4cb2bd022b..5aea68e8d2 100644
--- a/src/lib/krb5/os/t_trace.c
+++ b/src/lib/krb5/os/t_trace.c
@@ -30,15 +30,10 @@
  * OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <stdio.h>
-#include <string.h>
-#include <sys/types.h>
-#include "port-sockets.h"
-#include <com_err.h>
-
-#define TEST
 #include "k5-int.h"
+#include "port-sockets.h"
 #include "os-proto.h"
+#include <com_err.h>
 
 const char *prog;
 
diff --git a/src/lib/krb5/rcache/rc_dfl.c b/src/lib/krb5/rcache/rc_dfl.c
index 70d98c19d7..8f517d0c8b 100644
--- a/src/lib/krb5/rcache/rc_dfl.c
+++ b/src/lib/krb5/rcache/rc_dfl.c
@@ -9,10 +9,10 @@
 /*
  * An implementation for the default replay cache type.
  */
+#include "k5-int.h"
 #include "rc_base.h"
 #include "rc_dfl.h"
 #include "rc_io.h"
-#include "k5-int.h"
 #include "rc-int.h"
 
 /*
diff --git a/src/lib/krb5/rcache/t_replay.c b/src/lib/krb5/rcache/t_replay.c
index 0e108bf4e8..db273ec2f2 100644
--- a/src/lib/krb5/rcache/t_replay.c
+++ b/src/lib/krb5/rcache/t_replay.c
@@ -24,11 +24,6 @@
  * or implied warranty.
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <errno.h>
-
 #include "k5-int.h"
 
 static void
diff --git a/src/lib/rpc/auth_unix.c b/src/lib/rpc/auth_unix.c
index c09b5248ee..6cb998dc5a 100644
--- a/src/lib/rpc/auth_unix.c
+++ b/src/lib/rpc/auth_unix.c
@@ -45,6 +45,7 @@ static char sccsid[] = "@(#)auth_unix.c 1.19 87/08/11 Copyr 1984 Sun Micro";
  *
  */
 
+#include "autoconf.h"
 #include <stdio.h>
 #include <unistd.h>
 #include <string.h>
@@ -54,8 +55,6 @@ static char sccsid[] = "@(#)auth_unix.c 1.19 87/08/11 Copyr 1984 Sun Micro";
 #include <gssrpc/auth.h>
 #include <gssrpc/auth_unix.h>
 
-#include "autoconf.h"
-
 /*
  * Unix authenticator operations vector
  */
diff --git a/src/lib/rpc/clnt_generic.c b/src/lib/rpc/clnt_generic.c
index da3e8e8ba7..595c5f2ac3 100644
--- a/src/lib/rpc/clnt_generic.c
+++ b/src/lib/rpc/clnt_generic.c
@@ -36,12 +36,12 @@
 static char sccsid[] = "@(#)clnt_generic.c 1.4 87/08/11 (C) 1987 SMI";
 #endif
 
+#include "autoconf.h"
 #include <string.h>
 #include <gssrpc/rpc.h>
 #include <sys/socket.h>
 #include <sys/errno.h>
 #include <netdb.h>
-#include "autoconf.h"
 
 /*
  * Generic client creation: takes (hostname, program-number, protocol) and
diff --git a/src/lib/rpc/clnt_perror.c b/src/lib/rpc/clnt_perror.c
index b21ea8abdf..fcc3657464 100644
--- a/src/lib/rpc/clnt_perror.c
+++ b/src/lib/rpc/clnt_perror.c
@@ -38,6 +38,7 @@ static char sccsid[] = "@(#)clnt_perror.c 1.15 87/10/07 Copyr 1984 Sun Micro";
 /*
  * clnt_perror.c
  */
+#include "autoconf.h"
 #include <stdio.h>
 #include <string.h>
 #include <errno.h>
@@ -46,8 +47,6 @@ static char sccsid[] = "@(#)clnt_perror.c 1.15 87/10/07 Copyr 1984 Sun Micro";
 #include <gssrpc/auth.h>
 #include <gssrpc/clnt.h>
 
-#include "autoconf.h"
-
 #ifndef HAVE_STRERROR
 #ifdef NEED_SYS_ERRLIST
 extern char *sys_errlist[];
diff --git a/src/lib/rpc/clnt_simple.c b/src/lib/rpc/clnt_simple.c
index df8f246f21..4ec99edd80 100644
--- a/src/lib/rpc/clnt_simple.c
+++ b/src/lib/rpc/clnt_simple.c
@@ -40,6 +40,7 @@ static char sccsid[] = "@(#)clnt_simple.c 1.35 87/08/11 Copyr 1984 Sun Micro";
  * Simplified front end to rpc.
  */
 
+#include "autoconf.h"
 #include <stdio.h>
 /* for close() */
 #include <unistd.h>
@@ -48,7 +49,6 @@ static char sccsid[] = "@(#)clnt_simple.c 1.35 87/08/11 Copyr 1984 Sun Micro";
 #include <netdb.h>
 #include <string.h>
 #include <port-sockets.h>
-#include "autoconf.h"
 
 static struct callrpc_private {
 	CLIENT	*client;
diff --git a/src/lib/rpc/getrpcport.c b/src/lib/rpc/getrpcport.c
index 32ff739fd7..e2817544db 100644
--- a/src/lib/rpc/getrpcport.c
+++ b/src/lib/rpc/getrpcport.c
@@ -32,13 +32,13 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "autoconf.h"
 #include <stdio.h>
 #include <string.h>
 #include <gssrpc/rpc.h>
 #include <gssrpc/pmap_clnt.h>
 #include <netdb.h>
 #include <sys/socket.h>
-#include "autoconf.h"
 
 int
 gssrpc_getrpcport(
diff --git a/src/lib/rpc/pmap_rmt.c b/src/lib/rpc/pmap_rmt.c
index 10d9e3f62b..cd0b3095ae 100644
--- a/src/lib/rpc/pmap_rmt.c
+++ b/src/lib/rpc/pmap_rmt.c
@@ -41,6 +41,7 @@ static char sccsid[] = "@(#)pmap_rmt.c 1.21 87/08/27 Copyr 1984 Sun Micro";
  * remote call and broadcast service
  */
 
+#include "k5-platform.h"
 #include <unistd.h>
 #include <gssrpc/rpc.h>
 #include <gssrpc/pmap_prot.h>
@@ -50,8 +51,6 @@ static char sccsid[] = "@(#)pmap_rmt.c 1.21 87/08/27 Copyr 1984 Sun Micro";
 #ifdef sun
 #include <sys/sockio.h>
 #endif
-#include <stdio.h>
-#include <errno.h>
 #ifdef OSF1
 #include <net/route.h>
 #include <sys/mbuf.h>
@@ -60,9 +59,7 @@ static char sccsid[] = "@(#)pmap_rmt.c 1.21 87/08/27 Copyr 1984 Sun Micro";
 #include <sys/ioctl.h>
 #include <arpa/inet.h>
 #define MAX_BROADCAST_SIZE 1400
-#include <string.h>
 #include <port-sockets.h>
-#include "k5-platform.h"	/* set_cloexec_fd */
 
 static struct timeval timeout = { 3, 0 };
 
diff --git a/src/lib/rpc/svc_auth_gss.c b/src/lib/rpc/svc_auth_gss.c
index 8da70032a1..09a353412f 100644
--- a/src/lib/rpc/svc_auth_gss.c
+++ b/src/lib/rpc/svc_auth_gss.c
@@ -34,9 +34,7 @@
   Id: svc_auth_gss.c,v 1.28 2002/10/15 21:29:36 kwc Exp
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include "k5-platform.h"
 #include <gssrpc/rpc.h>
 #include <gssrpc/auth_gssapi.h>
 #ifdef HAVE_HEIMDAL
@@ -46,7 +44,6 @@
 #include <gssapi/gssapi.h>
 #include <gssapi/gssapi_generic.h>
 #endif
-#include "k5-platform.h"	/* SIZE_MAX */
 
 #ifdef DEBUG_GSSAPI
 int svc_debug_gss = DEBUG_GSSAPI;
diff --git a/src/lib/rpc/svc_tcp.c b/src/lib/rpc/svc_tcp.c
index f05220316f..d78cf55a74 100644
--- a/src/lib/rpc/svc_tcp.c
+++ b/src/lib/rpc/svc_tcp.c
@@ -43,15 +43,10 @@ static char sccsid[] = "@(#)svc_tcp.c 1.21 87/08/11 Copyr 1984 Sun Micro";
  * and a record/tcp stream.
  */
 
-#include <stdio.h>
-#include <string.h>
+#include "k5-platform.h"
 #include <unistd.h>
 #include <gssrpc/rpc.h>
 #include <sys/socket.h>
-#include <errno.h>
-#include <stdlib.h>
-#include "autoconf.h"
-#include "k5-platform.h"	/* set_cloexec_fd */
 #include <port-sockets.h>
 #include <socket-utils.h>
 /*extern bool_t abort();
diff --git a/src/lib/rpc/svc_udp.c b/src/lib/rpc/svc_udp.c
index 928006164d..f70bf0146b 100644
--- a/src/lib/rpc/svc_udp.c
+++ b/src/lib/rpc/svc_udp.c
@@ -41,19 +41,15 @@ static char sccsid[] = "@(#)svc_udp.c 1.24 87/08/11 Copyr 1984 Sun Micro";
  * achieving execute-at-most-once semantics.)
  */
 
-#include <stdio.h>
-#include <string.h>
+#include "k5-platform.h"
 #include <unistd.h>
 #include <gssrpc/rpc.h>
 #include <sys/socket.h>
-#include <errno.h>
-#include "autoconf.h"
 #ifdef HAVE_SYS_UIO_H
 #include <sys/uio.h>
 #endif
 #include <port-sockets.h>
 #include <socket-utils.h>
-#include "k5-platform.h"
 
 
 #ifndef GETSOCKNAME_ARG3_TYPE
diff --git a/src/lib/rpc/unit-test/client.c b/src/lib/rpc/unit-test/client.c
index 646477f3dc..06b0863f62 100644
--- a/src/lib/rpc/unit-test/client.c
+++ b/src/lib/rpc/unit-test/client.c
@@ -5,11 +5,11 @@
  *
  */
 
+#include "autoconf.h"
 #include <stdio.h>
 #include <string.h>
 #include <netdb.h>
 #include <sys/socket.h>
-#include "autoconf.h"
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
diff --git a/src/plugins/audit/kdc_j_encode.c b/src/plugins/audit/kdc_j_encode.c
index da5a9d8393..c3f913cd29 100755
--- a/src/plugins/audit/kdc_j_encode.c
+++ b/src/plugins/audit/kdc_j_encode.c
@@ -30,12 +30,12 @@
  * OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <syslog.h>
 #include <k5-int.h>
 #include <k5-json.h>
 #include "kdc_j_encode.h"
 #include "j_dict.h"
 #include <krb5/audit_plugin.h>
+#include <syslog.h>
 
 static krb5_error_code
 string_to_value(const char *in, k5_json_object obj, const char *key);
diff --git a/src/plugins/authdata/greet_client/greet.c b/src/plugins/authdata/greet_client/greet.c
index 499d0edb39..2aae2ddd63 100644
--- a/src/plugins/authdata/greet_client/greet.c
+++ b/src/plugins/authdata/greet_client/greet.c
@@ -23,8 +23,6 @@
  * or implied warranty.
  */
 
-#include <string.h>
-#include <errno.h>
 #include "k5-int.h"
 #include <krb5/authdata_plugin.h>
 #include <assert.h>
diff --git a/src/plugins/authdata/greet_server/greet_auth.c b/src/plugins/authdata/greet_server/greet_auth.c
index b26c860759..9d8444bb9f 100644
--- a/src/plugins/authdata/greet_server/greet_auth.c
+++ b/src/plugins/authdata/greet_server/greet_auth.c
@@ -28,8 +28,6 @@
  * Sample authorization data plugin
  */
 
-#include <string.h>
-#include <errno.h>
 #include <k5-int.h>
 #include <krb5/authdata_plugin.h>
 #include <kdb.h>
diff --git a/src/plugins/kdb/db2/adb_openclose.c b/src/plugins/kdb/db2/adb_openclose.c
index 447a395f8f..9bad905055 100644
--- a/src/plugins/kdb/db2/adb_openclose.c
+++ b/src/plugins/kdb/db2/adb_openclose.c
@@ -5,10 +5,10 @@
  * $Header$
  */
 
+#include        <k5-int.h>
 #include        <sys/file.h>
 #include        <fcntl.h>
 #include        <unistd.h>
-#include        <k5-int.h>
 #include        "policy_db.h"
 #include        <stdlib.h>
 #include        <db.h>
diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_open.c b/src/plugins/kdb/db2/libdb2/btree/bt_open.c
index 069b2dfde0..2977b17f3a 100644
--- a/src/plugins/kdb/db2/libdb2/btree/bt_open.c
+++ b/src/plugins/kdb/db2/libdb2/btree/bt_open.c
@@ -46,6 +46,8 @@ static char sccsid[] = "@(#)bt_open.c	8.11 (Berkeley) 11/2/95";
  * is wholly independent of the Postgres code.
  */
 
+#include "k5-platform.h"
+
 #include <sys/param.h>
 #include <sys/stat.h>
 
@@ -58,8 +60,6 @@ static char sccsid[] = "@(#)bt_open.c	8.11 (Berkeley) 11/2/95";
 #include <string.h>
 #include <unistd.h>
 
-#include "k5-platform.h"	/* mkstemp? */
-
 #include "db-int.h"
 #include "btree.h"
 
diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c
index 6ec711f551..5de04948a5 100644
--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c
+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c
@@ -31,8 +31,6 @@
  * Create / Delete / Modify / View / List policy objects.
  */
 
-#include <stdio.h>
-#include <time.h>
 #include <k5-int.h>
 #include <kadm5/admin.h>
 #include "kdb5_ldap_util.h"
diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
index 7494928647..ba8c12b0d8 100644
--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
@@ -81,7 +81,6 @@
  * Create / Modify / Destroy / View / List realm(s)
  */
 
-#include <stdio.h>
 #include <k5-int.h>
 #include <kadm5/admin.h>
 #include <adm_proto.h>
diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
index 05fac49765..64d0f917ab 100644
--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
@@ -36,7 +36,6 @@
  * functions manage the service objects.
  */
 
-#include <stdio.h>
 #include <k5-int.h>
 #include "kdb5_ldap_util.h"
 #include "kdb5_ldap_list.h"
diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c
index fe1b70eaa3..8d6f3752d8 100644
--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c
+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c
@@ -75,11 +75,9 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include <k5-int.h>
 #include <locale.h>
-#include <stdio.h>
 #include <time.h>
-
-#include <k5-int.h>
 #include <kadm5/admin.h>
 #include <adm_proto.h>
 #include "kdb5_ldap_util.h"
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
index dcd313b91b..aa8e7cef1c 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
+++ b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
@@ -32,6 +32,12 @@
 #ifndef _KDB_LDAP_H
 #define _KDB_LDAP_H 1
 
+#include "k5-int.h"
+#include <k5-thread.h>
+#include <kdb5.h>
+#include "ldap_krbcontainer.h"
+#include "ldap_realm.h"
+
 /* We want the interfaces marked "deprecated" in OpenLDAP.  */
 #define LDAP_DEPRECATED 1
 #include <ldap.h>
@@ -51,12 +57,6 @@
 # endif
 #endif /* BUILD_WITH_BROKEN_LDAP */
 
-#include <k5-thread.h>
-#include <kdb5.h>
-#include "k5-int.h"
-#include "ldap_krbcontainer.h"
-#include "ldap_realm.h"
-
 extern struct timeval timelimit;
 
 #define  DEFAULT_CONNS_PER_SERVER    5
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
index a0664bc04f..23be4a9068 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
@@ -31,9 +31,6 @@
  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
-#include <string.h>
-#include <time.h>
-#include <ctype.h>
 #include "kdb_ldap.h"
 #include "ldap_misc.h"
 #include "ldap_handle.h"
@@ -41,6 +38,8 @@
 #include "ldap_principal.h"
 #include "princ_xdr.h"
 #include "ldap_pwd_policy.h"
+#include <time.h>
+#include <ctype.h>
 
 #ifdef NEED_STRPTIME_PROTO
 extern char *strptime (const char *, const char *, struct tm *);
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index b9bd059056..21ede0bc4b 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -32,7 +32,6 @@
  * Use is subject to license terms.
  */
 
-#include <time.h>
 #include "ldap_main.h"
 #include "kdb_ldap.h"
 #include "ldap_principal.h"
@@ -41,6 +40,7 @@
 #include "ldap_pwd_policy.h"
 #include "ldap_err.h"
 #include <kadm5/admin.h>
+#include <time.h>
 
 extern char* principal_attributes[];
 extern char* max_pwd_life_attr[];
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c
index fc000497a3..94ad9c7d74 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c
@@ -28,10 +28,10 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <ctype.h>
 #include "ldap_main.h"
 #include "kdb_ldap.h"
 #include "ldap_service_stash.h"
+#include <ctype.h>
 
 /* Decode a password of the form {HEX}<hexstring>. */
 static krb5_error_code
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
index 83d79e098a..5a225d4a9b 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
@@ -24,9 +24,6 @@
  * or implied warranty.
  */
 
-#include <stdio.h>
-#include <errno.h>
-
 #include <k5-int.h>
 #include <kadm5/admin.h>
 #include <kdb.h>
diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
index 3ed43c052e..83683b3527 100644
--- a/src/plugins/preauth/pkinit/pkinit.h
+++ b/src/plugins/preauth/pkinit/pkinit.h
@@ -31,11 +31,10 @@
 #ifndef _PKINIT_H
 #define _PKINIT_H
 
+#include <k5-platform.h>
 #include <krb5/krb5.h>
 #include <krb5/preauth_plugin.h>
-#include <k5-platform.h>
 #include <k5-int-pkinit.h>
-#include <autoconf.h>
 #include <profile.h>
 #include "pkinit_accessor.h"
 #include "pkinit_trace.h"
diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c
index 6c2316298e..5ad735a126 100644
--- a/src/plugins/preauth/pkinit/pkinit_clnt.c
+++ b/src/plugins/preauth/pkinit/pkinit_clnt.c
@@ -29,20 +29,14 @@
  * SUCH DAMAGES.
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <unistd.h>
-#include <string.h>
-#include <ctype.h>
-#include <assert.h>
-#include <dlfcn.h>
-#include <sys/stat.h>
-
 #include "k5-int.h"
 #include "pkinit.h"
 #include "k5-json.h"
 
+#include <unistd.h>
+#include <dlfcn.h>
+#include <sys/stat.h>
+
 /**
  * Return true if we should use ContentInfo rather than SignedData. This
  * happens if we are talking to what might be an old (pre-6112) MIT KDC and
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
index bb9d6739fb..02261637f2 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
@@ -32,16 +32,16 @@
  *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <dirent.h>
-#include <errno.h>
-
 #include "k5-platform.h"
 #include "k5-buf.h"
 #include "k5-utf8.h"
 #include "krb5.h"
 
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <dirent.h>
+#include <errno.h>
+
 #include <prerror.h>
 #include <prmem.h>
 #include <prprf.h>
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index 7a0cac4734..246bc1b938 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -29,20 +29,13 @@
  * SUCH DAMAGES.
  */
 
-#include <errno.h>
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
+#include "pkinit_crypto_openssl.h"
+#include "k5-buf.h"
 #include <dlfcn.h>
 #include <unistd.h>
 #include <dirent.h>
 #include <arpa/inet.h>
 
-#include "k5-platform.h"
-#include "k5-buf.h"
-
-#include "pkinit_crypto_openssl.h"
-
 static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context );
 static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context );
 
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
index 1e916132fc..bfe6609a89 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
@@ -31,6 +31,8 @@
 #ifndef _PKINIT_CRYPTO_OPENSSL_H
 #define _PKINIT_CRYPTO_OPENSSL_H
 
+#include "pkinit.h"
+
 #include <openssl/bn.h>
 #include <openssl/dh.h>
 #include <openssl/x509.h>
@@ -45,8 +47,6 @@
 #include <openssl/asn1.h>
 #include <openssl/pem.h>
 
-#include "pkinit.h"
-
 #define DN_BUF_LEN  256
 #define MAX_CREDS_ALLOWED 20
 
diff --git a/src/plugins/preauth/pkinit/pkinit_kdf_constants.c b/src/plugins/preauth/pkinit/pkinit_kdf_constants.c
index 9d4f7d075e..1604f1670a 100644
--- a/src/plugins/preauth/pkinit/pkinit_kdf_constants.c
+++ b/src/plugins/preauth/pkinit/pkinit_kdf_constants.c
@@ -30,20 +30,7 @@
  * for SHA-1, SHA-256 and SHA-512.
  */
 
-#include <errno.h>
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <dlfcn.h>
-#include <unistd.h>
-#include <dirent.h>
-
-#include "k5-platform.h"
-#include "krb5.h"
-#include "k5-int-pkinit.h"
-
 #include "pkinit.h"
-#include "pkinit_crypto.h"
 
 /* statically declare OID constants for all three algorithms */
 const krb5_octet krb5_pkinit_sha1_oid[8] =
diff --git a/src/plugins/preauth/pkinit/pkinit_kdf_test.c b/src/plugins/preauth/pkinit/pkinit_kdf_test.c
index 710e1ff393..afc6029435 100644
--- a/src/plugins/preauth/pkinit/pkinit_kdf_test.c
+++ b/src/plugins/preauth/pkinit/pkinit_kdf_test.c
@@ -31,17 +31,8 @@
  * document, currently draft-ietf-krb-wg-pkinit-alg-agility-04.txt.
  */
 
-#include <errno.h>
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <dlfcn.h>
-#include <unistd.h>
-#include <dirent.h>
-
 #include "k5-platform.h"
-
-#include "pkinit_crypto_openssl.h"
+#include "pkinit.h"
 
 /**
  * Initialize a krb5_data from @a s, a constant string. Note @a s is evaluated
diff --git a/src/plugins/preauth/pkinit/pkinit_lib.c b/src/plugins/preauth/pkinit/pkinit_lib.c
index 077080afe3..2f88545da8 100644
--- a/src/plugins/preauth/pkinit/pkinit_lib.c
+++ b/src/plugins/preauth/pkinit/pkinit_lib.c
@@ -29,16 +29,6 @@
  * SUCH DAMAGES.
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <unistd.h>
-#include <string.h>
-#include <ctype.h>
-#include <assert.h>
-
-#include "k5-platform.h"
-
 #include "pkinit.h"
 
 #define FAKECERT
diff --git a/src/plugins/preauth/pkinit/pkinit_profile.c b/src/plugins/preauth/pkinit/pkinit_profile.c
index 6c22d7ea5d..334e54ab44 100644
--- a/src/plugins/preauth/pkinit/pkinit_profile.c
+++ b/src/plugins/preauth/pkinit/pkinit_profile.c
@@ -29,11 +29,6 @@
  * SUCH DAMAGES.
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <string.h>
-
 #include "k5-int.h"
 #include "pkinit.h"
 
diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
index 190e854414..5639fca951 100644
--- a/src/plugins/preauth/pkinit/pkinit_srv.c
+++ b/src/plugins/preauth/pkinit/pkinit_srv.c
@@ -29,11 +29,6 @@
  * SUCH DAMAGES.
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <string.h>
-
 #include <k5-int.h>
 #include "pkinit.h"
 
diff --git a/src/slave/kprop.c b/src/slave/kprop.c
index 7446c76efb..d28a1af40c 100644
--- a/src/slave/kprop.c
+++ b/src/slave/kprop.c
@@ -24,13 +24,10 @@
  * or implied warranty.
  */
 
-#include <errno.h>
+#include "k5-int.h"
 #include <locale.h>
-#include <stdio.h>
-#include <ctype.h>
 #include <sys/file.h>
 #include <signal.h>
-#include <string.h>
 #include <sys/types.h>
 #include <sys/time.h>
 #include <sys/stat.h>
@@ -40,7 +37,6 @@
 #include <netdb.h>
 #include <fcntl.h>
 
-#include "k5-int.h"
 #include "com_err.h"
 #include "fake-addrinfo.h"
 #include "kprop.h"
diff --git a/src/slave/kprop_sock.c b/src/slave/kprop_sock.c
index a439b378cf..1591a8b180 100644
--- a/src/slave/kprop_sock.c
+++ b/src/slave/kprop_sock.c
@@ -26,13 +26,12 @@
 
 /* sockaddr2krbaddr() utility function used by kprop and kpropd */
 
-#include <stdlib.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-
 #include "k5-int.h"
 #include "kprop.h"
 
+#include <sys/types.h>
+#include <sys/socket.h>
+
 /*
  * Convert an IPv4 or IPv6 socket address to a newly allocated krb5_address.
  * There is similar code elsewhere in the tree, so this should possibly become
diff --git a/src/slave/kpropd.c b/src/slave/kpropd.c
index 0f4a8f000a..18a8e1d2cf 100644
--- a/src/slave/kpropd.c
+++ b/src/slave/kpropd.c
@@ -51,12 +51,14 @@
  */
 
 
+#include "k5-int.h"
+#include "com_err.h"
+#include "fake-addrinfo.h"
+
 #include <locale.h>
-#include <stdio.h>
 #include <ctype.h>
 #include <sys/file.h>
 #include <signal.h>
-#include <string.h>
 #include <fcntl.h>
 #include <sys/types.h>
 #include <sys/time.h>
@@ -69,11 +71,6 @@
 #include <netdb.h>
 #include <syslog.h>
 
-#include "k5-int.h"
-#include "com_err.h"
-#include "fake-addrinfo.h"
-#include <errno.h>
-
 #include "kprop.h"
 #include <iprop_hdr.h>
 #include "iprop.h"
diff --git a/src/slave/kproplog.c b/src/slave/kproplog.c
index ab49a0fe5e..efa1f432d0 100644
--- a/src/slave/kproplog.c
+++ b/src/slave/kproplog.c
@@ -8,15 +8,14 @@
  * This module will parse the update logs on the master or slave servers.
  */
 
+#include "k5-int.h"
 #include <locale.h>
-#include <stdio.h>
 #include <sys/types.h>
 #include <sys/mman.h>
 #include <time.h>
 #include <limits.h>
 #include <locale.h>
 #include <syslog.h>
-#include "k5-int.h"
 #include <kdb_log.h>
 #include <kadm5/admin.h>
 
diff --git a/src/tests/asn.1/krb5_decode_leak.c b/src/tests/asn.1/krb5_decode_leak.c
index 633d16af82..22601c7bf3 100644
--- a/src/tests/asn.1/krb5_decode_leak.c
+++ b/src/tests/asn.1/krb5_decode_leak.c
@@ -35,14 +35,10 @@
  * decoder code paths but won't validate the results.
  */
 
-#include <stdio.h>
 #include "k5-int.h"
 #include "com_err.h"
 #include "utility.h"
-
 #include "ktest.h"
-#include <string.h>
-
 #include "debug.h"
 
 krb5_context test_context;
diff --git a/src/tests/asn.1/krb5_encode_test.c b/src/tests/asn.1/krb5_encode_test.c
index 3ba8684a43..6c142a21dc 100644
--- a/src/tests/asn.1/krb5_encode_test.c
+++ b/src/tests/asn.1/krb5_encode_test.c
@@ -24,7 +24,6 @@
  * or implied warranty.
  */
 
-#include <stdio.h>
 #include "k5-int.h"
 #include "com_err.h"
 #include "utility.h"
diff --git a/src/tests/asn.1/utility.h b/src/tests/asn.1/utility.h
index a0e81cd922..f1cd458040 100644
--- a/src/tests/asn.1/utility.h
+++ b/src/tests/asn.1/utility.h
@@ -27,9 +27,9 @@
 #ifndef __UTILITY_H__
 #define __UTILITY_H__
 
+#include "k5-int.h"
 #include "krbasn1.h"
 #include "asn1buf.h"
-#include "k5-int.h"
 
 /* Aborts on failure.  ealloc returns zero-filled memory. */
 void *ealloc(size_t size);
diff --git a/src/tests/gss-threads/gss-client.c b/src/tests/gss-threads/gss-client.c
index cd6cd112ae..3878e09dae 100644
--- a/src/tests/gss-threads/gss-client.c
+++ b/src/tests/gss-threads/gss-client.c
@@ -44,9 +44,7 @@
  * or implied warranty.
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include "k5-platform.h"
 #ifdef _WIN32
 #include <windows.h>
 #include <winsock.h>
@@ -57,7 +55,6 @@
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <netdb.h>
-#include <errno.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <pthread.h>
@@ -67,7 +64,6 @@
 #include "gss-misc.h"
 #include "port-sockets.h"
 #include "fake-addrinfo.h"
-#include "k5-platform.h"
 
 static int verbose = 1;
 
diff --git a/src/tests/gss-threads/gss-misc.c b/src/tests/gss-threads/gss-misc.c
index 76d9528d76..5c738d3f79 100644
--- a/src/tests/gss-threads/gss-misc.c
+++ b/src/tests/gss-threads/gss-misc.c
@@ -44,6 +44,7 @@
  * or implied warranty.
  */
 
+#include "autoconf.h"
 #include <stdio.h>
 #ifdef _WIN32
 #include <windows.h>
@@ -54,7 +55,6 @@
 #include <sys/socket.h>
 #endif
 #include <errno.h>
-#include "autoconf.h"
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
diff --git a/src/tests/gss-threads/gss-server.c b/src/tests/gss-threads/gss-server.c
index bbd1c4c078..9bae196438 100644
--- a/src/tests/gss-threads/gss-server.c
+++ b/src/tests/gss-threads/gss-server.c
@@ -44,6 +44,7 @@
  * or implied warranty.
  */
 
+#include "autoconf.h"
 #include <stdio.h>
 #ifdef _WIN32
 #include <windows.h>
@@ -56,7 +57,6 @@
 #include <pthread.h>
 #include <signal.h>
 #endif
-#include "autoconf.h"
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
diff --git a/src/tests/gssapi/t_enctypes.c b/src/tests/gssapi/t_enctypes.c
index 63ca79a8ef..a2ad18f47a 100644
--- a/src/tests/gssapi/t_enctypes.c
+++ b/src/tests/gssapi/t_enctypes.c
@@ -30,9 +30,6 @@
  * OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include "k5-int.h"
 #include "common.h"
 
diff --git a/src/tests/hammer/kdc5_hammer.c b/src/tests/hammer/kdc5_hammer.c
index 5869e969b2..0934f33fd3 100644
--- a/src/tests/hammer/kdc5_hammer.c
+++ b/src/tests/hammer/kdc5_hammer.c
@@ -23,11 +23,9 @@
  * or implied warranty.
  */
 
-#include <stdio.h>
-#include <sys/time.h>
-
 #include "k5-int.h"
 #include "com_err.h"
+#include <sys/time.h>
 
 #define KRB5_DEFAULT_OPTIONS 0
 #define KRB5_DEFAULT_LIFE 60*60*8 /* 8 hours */
diff --git a/src/tests/misc/test_getsockname.c b/src/tests/misc/test_getsockname.c
index 285ea60d27..4fb875fac0 100644
--- a/src/tests/misc/test_getsockname.c
+++ b/src/tests/misc/test_getsockname.c
@@ -34,6 +34,7 @@
  * host.  On Solaris, it prints out 0.0.0.0.
  */
 
+#include "autoconf.h"
 #include <unistd.h>
 #include <stdlib.h>
 #include <errno.h>
@@ -43,7 +44,6 @@
 #include <netdb.h>
 #include <stdio.h>
 #include <string.h>
-#include "autoconf.h"
 
 int
 main(argc, argv)
diff --git a/src/tests/resolve/addrinfo-test.c b/src/tests/resolve/addrinfo-test.c
index b5c6da9420..e77640b62f 100644
--- a/src/tests/resolve/addrinfo-test.c
+++ b/src/tests/resolve/addrinfo-test.c
@@ -36,15 +36,11 @@
  *   on whether "-P" is given).
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <errno.h>
+#include <k5-platform.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <netdb.h>
 #include <netinet/in.h> /* needed for IPPROTO_* on NetBSD */
-#include <k5-platform.h>
 #ifdef USE_FAKE_ADDRINFO
 #include "fake-addrinfo.h"
 #endif
diff --git a/src/tests/responder.c b/src/tests/responder.c
index d17fdaed66..5f53a31957 100644
--- a/src/tests/responder.c
+++ b/src/tests/responder.c
@@ -55,13 +55,11 @@
  *  Any missing data or mismatches are treated as errors.
  */
 
+#include <k5-platform.h>
+#include <k5-json.h>
 #include <sys/types.h>
 #include <unistd.h>
-#include <stdio.h>
-#include <string.h>
 #include <krb5.h>
-#include <k5-platform.h>
-#include <k5-json.h>
 
 struct responder_data {
     krb5_boolean called;
diff --git a/src/tests/shlib/t_loader.c b/src/tests/shlib/t_loader.c
index 439b724c31..869be800a0 100644
--- a/src/tests/shlib/t_loader.c
+++ b/src/tests/shlib/t_loader.c
@@ -24,13 +24,9 @@
  * or implied warranty.
  */
 
-#include <stdio.h>
-#include <string.h>
-#include <assert.h>
-#include "autoconf.h"
+#include "k5-platform.h"
 #include "krb5.h"
 #include "gssapi/gssapi.h"
-#include "k5-platform.h"
 #define HAVE_DLOPEN 1
 
 static int verbose = 1;
diff --git a/src/tests/threads/init_ctx.c b/src/tests/threads/init_ctx.c
index 7a59a1dd4e..42619a913e 100644
--- a/src/tests/threads/init_ctx.c
+++ b/src/tests/threads/init_ctx.c
@@ -29,16 +29,10 @@
  * initially contributed by Ken Raeburn
  */
 
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <limits.h>
-#include <assert.h>
+#include "k5-platform.h"
 #include <unistd.h>
 #include <pthread.h>
 #include <krb5.h>
-/* for SIZE_MAX: */
-#include "k5-platform.h"
 
 #include <sys/time.h>
 #include <sys/resource.h>
diff --git a/src/tests/threads/profread.c b/src/tests/threads/profread.c
index 3909f236e5..be28ba4042 100644
--- a/src/tests/threads/profread.c
+++ b/src/tests/threads/profread.c
@@ -29,17 +29,11 @@
  * initially contributed by Ken Raeburn
  */
 
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <limits.h>
-#include <assert.h>
+#include "k5-platform.h"
 #include <unistd.h>
 #include <pthread.h>
 #include <krb5.h>
 #include <profile.h>
-/* for SIZE_MAX: */
-#include "k5-platform.h"
 
 #include <sys/time.h>
 #include <sys/resource.h>
diff --git a/src/tests/threads/t_rcache.c b/src/tests/threads/t_rcache.c
index e2d3165e1e..d6187f0615 100644
--- a/src/tests/threads/t_rcache.c
+++ b/src/tests/threads/t_rcache.c
@@ -24,10 +24,8 @@
  * or implied warranty.
  */
 
-#include <stdio.h>
-#include <com_err.h>
-
 #include "k5-int.h"
+#include <com_err.h>
 #include <krb5.h>
 #include <pthread.h>
 
diff --git a/src/util/et/error_message.c b/src/util/et/error_message.c
index c4fa5693b1..d7069a9df4 100644
--- a/src/util/et/error_message.c
+++ b/src/util/et/error_message.c
@@ -20,15 +20,9 @@
  * provided "as is" without express or implied warranty.
  */
 
-#include "autoconf.h"
-#include <stdio.h>
-#ifdef HAVE_STDLIB_H
-#include <stdlib.h>
-#endif
-#include <string.h>
+#include "k5-platform.h"
 #include "com_err.h"
 #include "error_table.h"
-#include "k5-platform.h"
 
 static struct et_list *et_list;
 static k5_mutex_t et_list_lock = K5_MUTEX_PARTIAL_INITIALIZER;
diff --git a/src/util/et/test_et.c b/src/util/et/test_et.c
index ab2b2e50ea..9faf10f460 100644
--- a/src/util/et/test_et.c
+++ b/src/util/et/test_et.c
@@ -1,10 +1,10 @@
 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+#include "autoconf.h"
 #include <stdio.h>
 #include <errno.h>
 #include "com_err.h"
 #include "test1.h"
 #include "test2.h"
-#include "autoconf.h"
 
 #ifdef _WIN32
 # define EXPORT_LIST
diff --git a/src/util/profile/prof_int.h b/src/util/profile/prof_int.h
index cddc1fd9ad..38ea59a1f7 100644
--- a/src/util/profile/prof_int.h
+++ b/src/util/profile/prof_int.h
@@ -2,17 +2,17 @@
  * prof-int.h
  */
 
+#include "k5-platform.h"
+#include "k5-thread.h"
+#include "k5-plugin.h"
+
 #include <time.h>
-#include <stdio.h>
 
 #if defined(__MACH__) && defined(__APPLE__)
 #include <TargetConditionals.h>
 #define PROFILE_SUPPORTS_FOREIGN_NEWLINES
 #endif
 
-#include "k5-thread.h"
-#include "k5-platform.h"
-#include "k5-plugin.h"
 #include "com_err.h"
 #include "profile.h"
 
diff --git a/src/util/ss/error.c b/src/util/ss/error.c
index daff8497d6..6d5f69a7b7 100644
--- a/src/util/ss/error.c
+++ b/src/util/ss/error.c
@@ -29,11 +29,9 @@
  * For copyright information, see copyright.h.
  */
 
-#include <stdio.h>
-
-#include "copyright.h"
-#include "com_err.h"
 #include "ss_internal.h"
+#include "com_err.h"
+#include "copyright.h"
 
 char * ss_name(sci_idx)
     int sci_idx;
diff --git a/src/util/ss/ss_internal.h b/src/util/ss/ss_internal.h
index 400f3126be..1f5ddfff91 100644
--- a/src/util/ss/ss_internal.h
+++ b/src/util/ss/ss_internal.h
@@ -7,15 +7,8 @@
 
 #ifndef _ss_ss_internal_h
 #define _ss_ss_internal_h __FILE__
-#include <stdio.h>
-#include <string.h>
-#include <unistd.h>
-#include "autoconf.h"
-#ifdef HAVE_STDLIB_H
-#include <stdlib.h>
-#endif
-
 #include "k5-platform.h"
+#include <unistd.h>
 
 typedef void * pointer;
 
diff --git a/src/util/support/cache-addrinfo.h b/src/util/support/cache-addrinfo.h
index d4d26b14f5..a1b7fb28be 100644
--- a/src/util/support/cache-addrinfo.h
+++ b/src/util/support/cache-addrinfo.h
@@ -100,11 +100,10 @@
  *   these functions, and throw all this away.  Pleeease?  :-)
  */
 
-#include "port-sockets.h"
-#include "socket-utils.h"
 #include "k5-platform.h"
 #include "k5-thread.h"
-
+#include "port-sockets.h"
+#include "socket-utils.h"
 #include "fake-addrinfo.h"
 
 #if defined (__APPLE__) && defined (__MACH__) && 0
diff --git a/src/util/support/errors.c b/src/util/support/errors.c
index 4b1cfa0622..6c4d8bdbe4 100644
--- a/src/util/support/errors.c
+++ b/src/util/support/errors.c
@@ -4,14 +4,9 @@
  * needs to be generated with error tables, after util/et, which builds after
  * this directory.
  */
-#include <stdarg.h>
-#include <string.h>
-#include <stdlib.h>
-#include <stdio.h>
+#include "k5-platform.h"
 #include "k5-err.h"
-
 #include "k5-thread.h"
-#include "k5-platform.h"
 #include "supp-int.h"
 
 /*
diff --git a/src/util/support/fake-addrinfo.c b/src/util/support/fake-addrinfo.c
index 4824a6185c..df1cc1dec5 100644
--- a/src/util/support/fake-addrinfo.c
+++ b/src/util/support/fake-addrinfo.c
@@ -101,15 +101,12 @@
  *   these functions, and throw all this away.  Pleeease?  :-)
  */
 
-#include "port-sockets.h"
-#include "socket-utils.h"
 #include "k5-platform.h"
 #include "k5-thread.h"
+#include "port-sockets.h"
+#include "socket-utils.h"
 #include "supp-int.h"
 
-#include <stdio.h>
-#include <errno.h>
-
 #define IMPLEMENT_FAKE_GETADDRINFO
 #include "fake-addrinfo.h"
 
diff --git a/src/util/support/gmt_mktime.c b/src/util/support/gmt_mktime.c
index 7655364d9f..32fef4386c 100644
--- a/src/util/support/gmt_mktime.c
+++ b/src/util/support/gmt_mktime.c
@@ -1,8 +1,8 @@
 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 /* This code placed in the public domain by Mark W. Eichin */
 
-#include <stdio.h>
 #include "autoconf.h"
+#include <stdio.h>
 
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
diff --git a/src/util/support/init-addrinfo.c b/src/util/support/init-addrinfo.c
index 7822ce266f..68c3dd6ed7 100644
--- a/src/util/support/init-addrinfo.c
+++ b/src/util/support/init-addrinfo.c
@@ -46,13 +46,10 @@
    require pulling in socket/nsl/whatever libraries for code not using
    getaddrinfo.  */
 
-#include "port-sockets.h"
-#include "socket-utils.h"
 #include "k5-platform.h"
 #include "k5-thread.h"
-
-#include <stdio.h>
-#include <errno.h>
+#include "port-sockets.h"
+#include "socket-utils.h"
 
 #define IMPLEMENT_FAKE_GETADDRINFO
 #include "fake-addrinfo.h"
diff --git a/src/util/support/plugins.c b/src/util/support/plugins.c
index 82ef97e57c..826390976a 100644
--- a/src/util/support/plugins.c
+++ b/src/util/support/plugins.c
@@ -24,11 +24,11 @@
  * or implied warranty.
  */
 
+#include "k5-platform.h"
 #include "k5-plugin.h"
 #if USE_DLOPEN
 #include <dlfcn.h>
 #endif
-#include <stdio.h>
 #include <sys/types.h>
 #ifdef HAVE_SYS_STAT_H
 #include <sys/stat.h>
@@ -36,15 +36,10 @@
 #ifdef HAVE_SYS_PARAM_H
 #include <sys/param.h>
 #endif
-#include <errno.h>
-#include <stdlib.h>
-#include <string.h>
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
 
-#include "k5-platform.h"
-
 #if USE_DLOPEN
 #ifdef RTLD_GROUP
 #define GROUP RTLD_GROUP
diff --git a/src/util/support/t_unal.c b/src/util/support/t_unal.c
index cc2f4c92ca..f67cd31edf 100644
--- a/src/util/support/t_unal.c
+++ b/src/util/support/t_unal.c
@@ -1,6 +1,5 @@
 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 #undef NDEBUG
-#include <assert.h>
 #include "k5-platform.h"
 
 int main ()
diff --git a/src/util/support/threads.c b/src/util/support/threads.c
index a97789624e..3fd86ea8c2 100644
--- a/src/util/support/threads.c
+++ b/src/util/support/threads.c
@@ -24,12 +24,9 @@
  * or implied warranty.
  */
 
-#include <assert.h>
-#include <stdlib.h>
-#include <errno.h>
 #define THREAD_SUPPORT_IMPL
-#include "k5-thread.h"
 #include "k5-platform.h"
+#include "k5-thread.h"
 #include "supp-int.h"
 
 MAKE_INIT_FUNCTION(krb5int_thread_support_init);
diff --git a/src/util/support/utf8_conv.c b/src/util/support/utf8_conv.c
index b8bf98969f..1f6cc8f6a6 100644
--- a/src/util/support/utf8_conv.c
+++ b/src/util/support/utf8_conv.c
@@ -59,7 +59,6 @@
  * All functions return -1 if the character or string cannot be converted.
  */
 
-#include <assert.h>
 #include "k5-platform.h"
 #include "k5-utf8.h"
 #include "supp-int.h"
diff --git a/src/util/verto/verto-k5ev.c b/src/util/verto/verto-k5ev.c
index f75e8aad6c..a3a5265367 100644
--- a/src/util/verto/verto-k5ev.c
+++ b/src/util/verto/verto-k5ev.c
@@ -28,6 +28,7 @@
  * directory for reference, although it is not built here.
  */
 
+#include "autoconf.h"
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
@@ -35,7 +36,6 @@
 #include <verto.h>
 #include <verto-module.h>
 #include "rename.h"
-#include "autoconf.h"
 #define EV_STANDALONE 1
 /* Avoid using clock_gettime, which would create a dependency on librt. */
 #define EV_USE_MONOTONIC 0