diff --git a/debian/patches/debian/Adapt-login.defs-for-Debian.patch b/debian/patches/debian/Adapt-login.defs-for-Debian.patch
index 9ca4e3ee..4cf0182c 100644
--- a/debian/patches/debian/Adapt-login.defs-for-Debian.patch
+++ b/debian/patches/debian/Adapt-login.defs-for-Debian.patch
@@ -7,52 +7,31 @@ Remove settings only applicable without PAM support enabled.
Remove obscure commented-out settings.
Remove explanation about write(1), which Debian does not ship anymore.
---
- etc/login.defs | 369 +++++++--------------------------------------------------
- 1 file changed, 44 insertions(+), 325 deletions(-)
+ etc/login.defs | 360 ++++-----------------------------------------------------
+ 1 file changed, 25 insertions(+), 335 deletions(-)
diff --git a/etc/login.defs b/etc/login.defs
-index 33622c2..91d3ec4 100644
+index 966724c..9a73539 100644
--- a/etc/login.defs
+++ b/etc/login.defs
-@@ -1,24 +1,38 @@
+@@ -1,133 +1,20 @@
#
# /etc/login.defs - Configuration control definitions for the shadow package.
#
-# $Id$
-#
-
-+# REQUIRED for useradd/userdel/usermod
-+# Directory where mailboxes reside, _or_ name of file, relative to the
-+# home directory. If you _do_ define MAIL_DIR and MAIL_FILE,
-+# MAIL_DIR takes precedence.
- #
+-
+-#
-# Delay in seconds before being allowed another attempt after a login failure
--# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
+-# Note: when PAM is used, some modules may enforce a minimum delay (e.g.
-# pam_unix(8) enforces a 2s delay)
-+# Essentially:
-+# - MAIL_DIR defines the location of users mail spool files
-+# (for mbox use) by appending the username to MAIL_DIR as defined
-+# below.
-+# - MAIL_FILE defines the location of the users mail spool files as the
-+# fully-qualified filename obtained by prepending the user home
-+# directory before $MAIL_FILE
- #
+-#
-FAIL_DELAY 3
-
-+# NOTE: This is no more used for setting up users MAIL environment variable
-+# which is, starting from shadow 4.0.12-1 in Debian, entirely the
-+# job of the pam_mail PAM modules
-+# See default PAM configuration files provided for
-+# login, su, etc.
- #
+-#
-# Enable logging and display of /var/log/faillog login(1) failure info.
-#
-FAILLOG_ENAB yes
-+# This is a temporary situation: setting these variables will soon
-+# move to /etc/default/useradd and the variables will then be
-+# no more supported
-+MAIL_DIR /var/mail
-+#MAIL_FILE .mail
#
# Enable display of unknown usernames when login(1) failures are recorded.
@@ -62,11 +41,11 @@ index 33622c2..91d3ec4 100644
+# concern
LOG_UNKFAIL_ENAB no
- #
-@@ -26,110 +40,12 @@ LOG_UNKFAIL_ENAB no
- #
- LOG_OK_LOGINS no
-
+-#
+-# Enable logging of successful logins
+-#
+-LOG_OK_LOGINS no
+-
-#
-# Enable logging and display of /var/log/lastlog login(1) time info.
-#
@@ -136,12 +115,12 @@ index 33622c2..91d3ec4 100644
-#
-#ISSUE_FILE /etc/issue
-
- #
- # If defined, file which maps tty line to TERM environment parameter.
- # Each line of the file is in a format similar to "vt100 tty01".
- #
- #TTYTYPE_FILE /etc/ttytype
-
+-#
+-# If defined, file which maps tty line to TERM environment parameter.
+-# Each line of the file is in a format similar to "vt100 tty01".
+-#
+-#TTYTYPE_FILE /etc/ttytype
+-
-#
-# If defined, login(1) failures will be logged here in a utmp format.
-# last(1), when invoked as lastb(1), will read /var/log/btmp, so...
@@ -165,16 +144,16 @@ index 33622c2..91d3ec4 100644
-
-#
-# *REQUIRED*
--# Directory where mailboxes reside, _or_ name of file, relative to the
--# home directory. If you _do_ define both, MAIL_DIR takes precedence.
--#
--MAIL_DIR /var/spool/mail
--#MAIL_FILE .mail
--
++# REQUIRED for useradd/userdel/usermod
+ # Directory where mailboxes reside, _or_ name of file, relative to the
+ # home directory. If you _do_ define both, MAIL_DIR takes precedence.
#
- # If defined, file which inhibits all the usual chatter during the login
- # sequence. If a full pathname, then hushed mode will be enabled if the
-@@ -139,40 +55,21 @@ MAIL_DIR /var/spool/mail
+-MAIL_DIR /var/spool/mail
++MAIL_DIR /var/mail
+ #MAIL_FILE .mail
+
+ #
+@@ -139,40 +26,21 @@ MAIL_DIR /var/spool/mail
HUSHLOGIN_FILE .hushlogin
#HUSHLOGIN_FILE /etc/hushlogins
@@ -220,7 +199,7 @@ index 33622c2..91d3ec4 100644
TTYPERM 0600
#
-@@ -180,61 +77,35 @@ TTYPERM 0600
+@@ -180,61 +48,35 @@ TTYPERM 0600
#
# ERASECHAR Terminal ERASE character ('\010' = backspace).
# KILLCHAR Terminal KILL character ('\025' = CTRL/U).
@@ -285,7 +264,7 @@ index 33622c2..91d3ec4 100644
# Extra per user uids
SUB_UID_MIN 100000
SUB_UID_MAX 600100000
-@@ -246,8 +117,8 @@ SUB_UID_COUNT 65536
+@@ -246,8 +88,8 @@ SUB_UID_COUNT 65536
GID_MIN 1000
GID_MAX 60000
# System accounts
@@ -296,7 +275,7 @@ index 33622c2..91d3ec4 100644
# Extra per user group ids
SUB_GID_MIN 100000
SUB_GID_MAX 600100000
-@@ -255,6 +126,9 @@ SUB_GID_COUNT 65536
+@@ -255,6 +97,9 @@ SUB_GID_COUNT 65536
#
# Max number of login(1) retries if password is bad
@@ -306,7 +285,7 @@ index 33622c2..91d3ec4 100644
#
LOGIN_RETRIES 5
-@@ -263,28 +137,6 @@ LOGIN_RETRIES 5
+@@ -263,28 +108,6 @@ LOGIN_RETRIES 5
#
LOGIN_TIMEOUT 60
@@ -323,7 +302,7 @@ index 33622c2..91d3ec4 100644
-#
-# Number of significant characters in the password for crypt().
-# Default is 8, don't change unless your crypt() is better.
--# Ignored if MD5_CRYPT_ENAB set to "yes".
+-# Only used for DES encryption algorithm.
-#
-#PASS_MAX_LEN 8
-
@@ -335,7 +314,7 @@ index 33622c2..91d3ec4 100644
#
# Which fields may be changed by regular users using chfn(1) - use
# any combination of letters "frwh" (full name, room number, work
-@@ -294,29 +146,6 @@ CHFN_AUTH yes
+@@ -294,29 +117,6 @@ CHFN_AUTH yes
CHFN_RESTRICT rwh
#
@@ -353,7 +332,7 @@ index 33622c2..91d3ec4 100644
-# Set to "no" if you need to copy encrypted passwords to other systems
-# which don't understand the new algorithm. Default is "no".
-#
--# Note: If you use PAM, it is recommended to use a value consistent with
+-# Note: if you use PAM, it is recommended to use a value consistent with
-# the PAM modules configuration.
-#
-# This variable is deprecated. You should use ENCRYPT_METHOD instead.
@@ -365,11 +344,11 @@ index 33622c2..91d3ec4 100644
# If set to MD5, MD5-based algorithm will be used for encrypting password
# If set to SHA256, SHA256-based algorithm will be used for encrypting password
# If set to SHA512, SHA512-based algorithm will be used for encrypting password
-@@ -326,66 +155,10 @@ CHFN_RESTRICT rwh
+@@ -326,66 +126,10 @@ CHFN_RESTRICT rwh
# MD5 and DES should not be used for new hashes, see crypt(5) for recommendations.
# Overrides the MD5_CRYPT_ENAB option
#
--# Note: If you use PAM, it is recommended to use a value consistent with
+-# Note: if you use PAM, it is recommended to use a value consistent with
+# Note: It is recommended to use a value consistent with
# the PAM modules configuration.
#
@@ -434,7 +413,7 @@ index 33622c2..91d3ec4 100644
#
# Should login be allowed if we can't cd to the home directory?
-@@ -401,12 +174,6 @@ DEFAULT_HOME yes
+@@ -401,12 +145,6 @@ DEFAULT_HOME yes
#
NONEXISTENT /nonexistent
@@ -447,7 +426,7 @@ index 33622c2..91d3ec4 100644
#
# If defined, this command is run when removing a user.
# It should remove any at/cron/print jobs etc. owned by
-@@ -415,59 +182,11 @@ ENVIRON_FILE /etc/environment
+@@ -415,59 +153,11 @@ ENVIRON_FILE /etc/environment
#USERDEL_CMD /usr/sbin/userdel_local
#
@@ -508,7 +487,7 @@ index 33622c2..91d3ec4 100644
-# Used in pam_timestamp module to calculate the keyed-hash message
-# authentication code.
-#
--# Note: It is recommended to check hmac(3) to see the possible algorithms
+-# Note: it is recommended to check hmac(3) to see the possible algorithms
-# that are available in your system.
-#
-#HMAC_CRYPTO_ALGO SHA512
diff --git a/debian/patches/debian/Exclude-Debian-globally-allocated-UIDs-from-sys_uid-range.patch b/debian/patches/debian/Exclude-Debian-globally-allocated-UIDs-from-sys_uid-range.patch
index f35088ec..1358b591 100644
--- a/debian/patches/debian/Exclude-Debian-globally-allocated-UIDs-from-sys_uid-range.patch
+++ b/debian/patches/debian/Exclude-Debian-globally-allocated-UIDs-from-sys_uid-range.patch
@@ -8,10 +8,10 @@ Bug: http://bugs.debian.org/1100563
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/src/useradd.c b/src/useradd.c
-index 9da533a..2f5df5f 100644
+index b3ab1c4..bbc9859 100644
--- a/src/useradd.c
+++ b/src/useradd.c
-@@ -2372,14 +2372,21 @@ static void create_mail (void)
+@@ -2406,14 +2406,21 @@ static void create_mail(const struct option_flags *flags)
#endif
}
diff --git a/debian/patches/debian/Keep-using-Debian-adduser-defaults.patch b/debian/patches/debian/Keep-using-Debian-adduser-defaults.patch
index f7b38d98..3e72c968 100644
--- a/debian/patches/debian/Keep-using-Debian-adduser-defaults.patch
+++ b/debian/patches/debian/Keep-using-Debian-adduser-defaults.patch
@@ -17,7 +17,7 @@ configuration files shipped in Debian (debian/default/useradd).
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/man/useradd.8.xml b/man/useradd.8.xml
-index fd9ff69..69126ee 100644
+index e6db7f6..2e83b4f 100644
--- a/man/useradd.8.xml
+++ b/man/useradd.8.xml
@@ -262,7 +262,7 @@
@@ -30,10 +30,10 @@ index fd9ff69..69126ee 100644
diff --git a/src/useradd.c b/src/useradd.c
-index 36b9b8f..9da533a 100644
+index 899efe3..b3ab1c4 100644
--- a/src/useradd.c
+++ b/src/useradd.c
-@@ -100,14 +100,14 @@ static const char Prog[] = "useradd";
+@@ -106,14 +106,14 @@ static const char Prog[] = "useradd";
/*
* These defaults are used if there is no defaults file.
*/
diff --git a/debian/patches/debian/Recommend-using-adduser-and-deluser.patch b/debian/patches/debian/Recommend-using-adduser-and-deluser.patch
index 2934cf07..e14ff6c6 100644
--- a/debian/patches/debian/Recommend-using-adduser-and-deluser.patch
+++ b/debian/patches/debian/Recommend-using-adduser-and-deluser.patch
@@ -11,7 +11,7 @@ Status wrt upstream: Debian specific patch.
2 files changed, 12 insertions(+)
diff --git a/man/useradd.8.xml b/man/useradd.8.xml
-index 69126ee..e198028 100644
+index 2e83b4f..67c469a 100644
--- a/man/useradd.8.xml
+++ b/man/useradd.8.xml
@@ -82,6 +82,12 @@
@@ -28,7 +28,7 @@ index 69126ee..e198028 100644
When invoked without the option, the
useradd command creates a new user account using
diff --git a/man/userdel.8.xml b/man/userdel.8.xml
-index 32851f1..4373cd8 100644
+index e10a6af..863d3f1 100644
--- a/man/userdel.8.xml
+++ b/man/userdel.8.xml
@@ -58,6 +58,12 @@
diff --git a/debian/patches/debian/Set-group-and-mode-for-g-shadow-files.patch b/debian/patches/debian/Set-group-and-mode-for-g-shadow-files.patch
index 2dfc76a1..b503c710 100644
--- a/debian/patches/debian/Set-group-and-mode-for-g-shadow-files.patch
+++ b/debian/patches/debian/Set-group-and-mode-for-g-shadow-files.patch
@@ -12,18 +12,18 @@ Fixes: #166793
3 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/lib/commonio.c b/lib/commonio.c
-index 7304ec0..6b13f4a 100644
+index 2c6a1a2..860efb9 100644
--- a/lib/commonio.c
+++ b/lib/commonio.c
-@@ -21,6 +21,7 @@
+@@ -22,6 +22,7 @@
#include
#include
#include
+#include
#include "alloc/malloc.h"
- #include "alloc/reallocf.h"
-@@ -949,12 +950,23 @@ int commonio_close (struct commonio_db *db)
+ #include "atoi/getnum.h"
+@@ -931,12 +932,23 @@ commonio_close(struct commonio_db *db, MAYBE_UNUSED bool process_selinux)
if (errors)
goto fail;
} else {
@@ -46,12 +46,12 @@ index 7304ec0..6b13f4a 100644
+ }
}
- if (SNPRINTF(buf, "%s+", db->filename) == -1)
+ if (stprintf_a(buf, "%s+", db->filename) == -1)
diff --git a/lib/sgroupio.c b/lib/sgroupio.c
-index ef82976..53e7ecd 100644
+index ad3adc3..527f5be 100644
--- a/lib/sgroupio.c
+++ b/lib/sgroupio.c
-@@ -211,7 +211,7 @@ static struct commonio_db gshadow_db = {
+@@ -213,7 +213,7 @@ static struct commonio_db gshadow_db = {
#ifdef WITH_SELINUX
NULL, /* scontext */
#endif
@@ -61,7 +61,7 @@ index ef82976..53e7ecd 100644
0, /* st_gid */
NULL, /* head */
diff --git a/lib/shadowio.c b/lib/shadowio.c
-index 8b1c1d2..395d0c8 100644
+index bf87503..be917ac 100644
--- a/lib/shadowio.c
+++ b/lib/shadowio.c
@@ -87,7 +87,7 @@ static struct commonio_db shadow_db = {
diff --git a/debian/patches/debian/Warn-when-badname-and-variants-are-given.patch b/debian/patches/debian/Warn-when-badname-and-variants-are-given.patch
index e01d7770..7751eb47 100644
--- a/debian/patches/debian/Warn-when-badname-and-variants-are-given.patch
+++ b/debian/patches/debian/Warn-when-badname-and-variants-are-given.patch
@@ -11,10 +11,10 @@ Upstream PR 1158 will remove them, probably in the forky timeframe.
4 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/src/newusers.c b/src/newusers.c
-index 38cbddd..710c3e9 100644
+index e9353fd..9054373 100644
--- a/src/newusers.c
+++ b/src/newusers.c
-@@ -128,7 +128,7 @@ static void usage (int status)
+@@ -135,7 +135,7 @@ static void usage (int status)
"\n"
"Options:\n"),
Prog);
@@ -23,7 +23,7 @@ index 38cbddd..710c3e9 100644
#ifndef USE_PAM
(void) fprintf (usageout,
_(" -c, --crypt-method METHOD the crypt method (one of %s)\n"),
-@@ -661,6 +661,9 @@ static void process_flags (int argc, char **argv)
+@@ -668,6 +668,9 @@ static void process_flags (int argc, char **argv, struct option_flags *flags)
switch (c) {
case 'b':
allow_bad_names = true;
@@ -34,10 +34,10 @@ index 38cbddd..710c3e9 100644
#ifndef USE_PAM
case 'c':
diff --git a/src/pwck.c b/src/pwck.c
-index 6272839..a970e74 100644
+index c35f03e..81f4ccd 100644
--- a/src/pwck.c
+++ b/src/pwck.c
-@@ -134,7 +134,7 @@ usage (int status)
+@@ -139,7 +139,7 @@ usage (int status)
"Options:\n"),
Prog);
}
@@ -46,7 +46,7 @@ index 6272839..a970e74 100644
(void) fputs (_(" -h, --help display this help message and exit\n"), usageout);
(void) fputs (_(" -q, --quiet report errors only\n"), usageout);
(void) fputs (_(" -r, --read-only display errors and warnings\n"
-@@ -176,6 +176,9 @@ static void process_flags (int argc, char **argv)
+@@ -181,6 +181,9 @@ static void process_flags (int argc, char **argv, struct option_flags *flags)
switch (c) {
case 'b':
allow_bad_names = true;
@@ -57,10 +57,10 @@ index 6272839..a970e74 100644
case 'h':
usage (E_SUCCESS);
diff --git a/src/useradd.c b/src/useradd.c
-index 2f5df5f..73bf307 100644
+index bbc9859..5446f35 100644
--- a/src/useradd.c
+++ b/src/useradd.c
-@@ -874,7 +874,7 @@ static void usage (int status)
+@@ -877,7 +877,7 @@ static void usage (int status)
"\n"
"Options:\n"),
Prog, Prog, Prog);
@@ -69,7 +69,7 @@ index 2f5df5f..73bf307 100644
(void) fputs (_(" -b, --base-dir BASE_DIR base directory for the home directory of the\n"
" new account\n"), usageout);
#ifdef WITH_BTRFS
-@@ -1197,6 +1197,9 @@ static void process_flags (int argc, char **argv)
+@@ -1200,6 +1200,9 @@ static void process_flags (int argc, char **argv, struct option_flags *flags)
break;
case 201:
allow_bad_names = true;
@@ -80,10 +80,10 @@ index 2f5df5f..73bf307 100644
case 'c':
if (!VALID (optarg)) {
diff --git a/src/usermod.c b/src/usermod.c
-index a0f4d7d..2e04b09 100644
+index e8c9da6..dc88776 100644
--- a/src/usermod.c
+++ b/src/usermod.c
-@@ -384,7 +384,7 @@ usage (int status)
+@@ -396,7 +396,7 @@ usage (int status)
(void) fputs (_(" -a, --append append the user to the supplemental GROUPS\n"
" mentioned by the -G option without removing\n"
" the user from other groups\n"), usageout);
@@ -92,7 +92,7 @@ index a0f4d7d..2e04b09 100644
(void) fputs (_(" -c, --comment COMMENT new value of the GECOS field\n"), usageout);
(void) fputs (_(" -d, --home HOME_DIR new home directory for the user account\n"), usageout);
(void) fputs (_(" -e, --expiredate EXPIRE_DATE set account expiration date to EXPIRE_DATE\n"), usageout);
-@@ -1052,6 +1052,9 @@ process_flags(int argc, char **argv)
+@@ -1062,6 +1062,9 @@ process_flags(int argc, char **argv, struct option_flags *flags)
break;
case 'b':
allow_bad_names = true;
diff --git a/debian/patches/debian/configure.ac-align-exec_prefix-with-prefix.patch b/debian/patches/debian/configure.ac-align-exec_prefix-with-prefix.patch
index 12a62ea1..b75584d7 100644
--- a/debian/patches/debian/configure.ac-align-exec_prefix-with-prefix.patch
+++ b/debian/patches/debian/configure.ac-align-exec_prefix-with-prefix.patch
@@ -9,15 +9,15 @@ Reported as https://github.com/shadow-maint/shadow/issues/1229
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure.ac b/configure.ac
-index bacce98..8746683 100644
+index b3dd34d..bbda154 100644
--- a/configure.ac
+++ b/configure.ac
-@@ -18,7 +18,7 @@ AC_SUBST([LIBSUBID_ABI], [libsubid_abi])
+@@ -23,7 +23,7 @@ AC_SUBST([LIBSUBID_ABI], [libsubid_abi])
dnl Some hacks...
- test "$prefix" = "NONE" && prefix="/usr"
--test "$prefix" = "/usr" && exec_prefix=""
-+test "$prefix" = "/usr" && exec_prefix="/usr"
+ test "x$prefix" = "xNONE" && prefix="/usr"
+-test "X$prefix" = "X/usr" && exec_prefix=""
++test "X$prefix" = "X/usr" && exec_prefix="/usr"
AC_USE_SYSTEM_EXTENSIONS