Update changelog for 1:4.19.3-1 release

Gbp-Dch: ignore

AUTHORS.md

@@ -3,11 +3,20 @@ reports and various comments. This list may be incomplete, I received
 a lot of mail...
 
 # Maintainers
+* Marek Michałkiewicz <marekm72@gmail.com> (1995-2000)
 * Tomasz Kłoczko <kloczek@pld.org.pl> (2000-2007)
 * Nicolas François <nicolas.francois@centraliens.net> (2007-2014)
 * Serge E. Hallyn <serge@hallyn.com> (2014-now)
 * Christian Brauner <christian@brauner.io> (2019-now)
 * Iker Pedrosa <ipedrosa@redhat.com> (2022-now)
+* Alejandro Colomar <alx@kernel.org> (2023-now) (4.14 stable)
+
+To verify signatures on releases, use the following keys under keys/ :
+
+* Serge Hallyn: keys/66D0387DB85D320F8408166DB175CFA98F192AF2.asc
+* Christian Brauner: keys/4880B8C9BD0E5106FC070F4F7B3C391EFEA93624.asc
+* Iker Pedrosa: keys/4E80EF49C7987B6DE2F81F5005079C6C3A653E57.asc
+* Alejandro Colomar: keys/A9348594CE31283A826FBDD8D57633D441E25BB5.asc
 
 # Authors and contributors
 * Adam Rudnicki <adam@v-lo.krakow.pl>

ChangeLog

@@ -9558,7 +9558,7 @@
 	* NEWS: release date corrected.
 
 	* NEWS, src/su.c:
-	fixed set enviroment too early when using PAM, so move it to !USE_PAM
+	fixed set environment too early when using PAM, so move it to !USE_PAM
 	(patch submitted by Mike Frysinger <vapier@gentoo.org>).
 
 2006-07-30  Tomasz Kłoczko  <kloczek@pld.org.pl>
@@ -10245,7 +10245,7 @@
 	* NEWS: cleanups.
 
 	* autogen.sh:
-	by default in development enviroment use CFLAGS="-O2 -Wall".
+	by default in development environment use CFLAGS="-O2 -Wall".
 
 	* src/chgpasswd.c (main): remove two unused variables (newgr and now).
 
@@ -11654,7 +11654,7 @@
 	in OPTIONS section). Describe -a and -k options.
 
 	* NEWS, src/su.c:
-	fixed twice copy enviroment which causes auth problems (bug was introduced in 4.0.12;
+	fixed twice copy environment which causes auth problems (bug was introduced in 4.0.12;
 	fix by Nicolas François <nicolas.francois@centraliens.net>).
 
 	* src/passwd.c, po/ja.po, po/ko.po, po/nb.po, po/nl.po, po/nn.po, po/pl.po, po/pt.po, po/pt_BR.po, po/ro.po, po/ru.po, po/sk.po, po/sq.po, po/sv.po, po/tl.po, po/tr.po, po/uk.po, po/vi.po, po/zh_CN.po, po/zh_TW.po, po/bs.po, po/ca.po, po/cs.po, po/da.po, po/de.po, po/el.po, po/es.po, po/eu.po, po/fi.po, po/fr.po, po/he.po, po/id.po, po/it.po:
@@ -12584,7 +12584,7 @@
 	http://bugs.debian.org/48002
 
 	* src/login.c, NEWS:
-	fixed loggin of username on succesful login (was using the normal username,
+	fixed loggin of username on successful login (was using the normal username,
 	when it should have used pam_user) http://bugs.debian.org/47819
 
 2005-06-02  Tomasz Kłoczko  <kloczek@pld.org.pl>
@@ -13029,7 +13029,7 @@
 	* man/pl/usermod.8: finish sync with english version.
 
 	* man/hu/login.1, man/pl/login.1, NEWS, man/Attic/login.1, man/de/login.1:
-	removed fragment about abilities pass enviroment variables in login prompt.
+	removed fragment about abilities pass environment variables in login prompt.
 
 	* man/Attic/gpasswd.1, man/Attic/newgrp.1:
 	fixes by Nicolas Nicolas François <nicolas.francois@centraliens.net> (not all
@@ -13508,7 +13508,7 @@
 	removed not used translations.
 
 	* NEWS, src/su.c:
-	fix adding of pam_env env variables to enviroment (Martin Schlemmer <azarah@nosferatu.za.org>).
+	fix adding of pam_env env variables to environment (Martin Schlemmer <azarah@nosferatu.za.org>).
 
 	* NEWS, configure.in:
 	fixed filling MAIL_SPOOL_DIR and MAIL_SPOOL_FILE variables which was allways
@@ -13605,7 +13605,7 @@
 
 	* NEWS, src/su.c:
 	add pam_open_session() support. If builded without PAM support
-	propagate $DISPLAY and $XAUTHORITY enviroment variables.
+	propagate $DISPLAY and $XAUTHORITY environment variables.
 	Based on http://www.gentoo.org/cgi-bin/viewcvs.cgi/sys-apps/shadow/files/shadow-4.0.4.1-su-pam_open_session.patch?rev=1.1
 
 2004-10-23  Tomasz Kłoczko  <kloczek@pld.org.pl>

Makefile.am

@@ -1,15 +1,28 @@
 ## Process this file with automake to produce Makefile.in
+ACLOCAL_AMFLAGS = -I m4
 
-EXTRA_DIST = NEWS README TODO shadow.spec.in
-
-SUBDIRS = libmisc lib
+SUBDIRS = lib
 
 if ENABLE_SUBIDS
 SUBDIRS += libsubid
 endif
 
-SUBDIRS += src po contrib doc etc
+SUBDIRS += src po doc etc tests/unit
 
 if ENABLE_REGENERATE_MAN
 SUBDIRS += man
 endif
+
+CLEANFILES = man/8.out man/po/remove-potcdate.* man/*/login.defs.d man/*/*.mo
+
+EXTRA_DIST = NEWS README tests/
+
+dist-hook:
+	chmod -R u+w $(distdir)/tests
+	chmod u+w $(distdir)
+	mv $(distdir)/tests/unit $(distdir)/realunittest
+	mv $(distdir)/tests/tests $(distdir)/realtests
+	rm -rf $(distdir)/tests
+	mv $(distdir)/realtests $(distdir)/tests
+	rm -rf $(distdir)/tests/unit $(distdir)/tests/Makefile*
+	mv $(distdir)/realunittest $(distdir)/tests/unit

Makefile.in

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.16.5 from Makefile.am.
+# Makefile.in generated by automake 1.18.1 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2021 Free Software Foundation, Inc.
+# Copyright (C) 1994-2025 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -69,6 +69,8 @@ am__make_running_with_option = \
   test $$has_opt = yes
 am__make_dryrun = (target_option=n; $(am__make_running_with_option))
 am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+am__rm_f = rm -f $(am__rm_f_notfound)
+am__rm_rf = rm -rf $(am__rm_f_notfound)
 pkgdatadir = $(datadir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
 pkglibdir = $(libdir)/@PACKAGE@
@@ -108,7 +110,7 @@ am__CONFIG_DISTCLEAN_FILES = config.status config.cache config.log \
  configure.lineno config.status.lineno
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = config.h
-CONFIG_CLEAN_FILES = man/po/Makefile shadow.spec
+CONFIG_CLEAN_FILES = man/po/Makefile
 CONFIG_CLEAN_VPATH_FILES =
 AM_V_P = $(am__v_P_@AM_V@)
 am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
@@ -163,19 +165,26 @@ am__define_uniq_tagged_files = \
   unique=`for i in $$list; do \
     if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
   done | $(am__uniquify_input)`
-DIST_SUBDIRS = libmisc lib libsubid src po contrib doc etc man
+DIST_SUBDIRS = lib libsubid src po doc etc tests/unit man
 am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/config.h.in \
-	$(srcdir)/shadow.spec.in $(top_srcdir)/man/po/Makefile.in \
-	ABOUT-NLS AUTHORS.md COPYING ChangeLog NEWS README TODO \
-	compile config.guess config.rpath config.sub install-sh \
-	ltmain.sh missing
+	$(top_srcdir)/build-aux/compile \
+	$(top_srcdir)/build-aux/config.guess \
+	$(top_srcdir)/build-aux/config.rpath \
+	$(top_srcdir)/build-aux/config.sub \
+	$(top_srcdir)/build-aux/install-sh \
+	$(top_srcdir)/build-aux/ltmain.sh \
+	$(top_srcdir)/build-aux/missing \
+	$(top_srcdir)/man/po/Makefile.in ABOUT-NLS AUTHORS.md COPYING \
+	ChangeLog NEWS README build-aux/compile build-aux/config.guess \
+	build-aux/config.rpath build-aux/config.sub \
+	build-aux/install-sh build-aux/ltmain.sh build-aux/missing
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 distdir = $(PACKAGE)-$(VERSION)
 top_distdir = $(distdir)
 am__remove_distdir = \
   if test -d "$(distdir)"; then \
-    find "$(distdir)" -type d ! -perm -200 -exec chmod u+w {} ';' \
-      && rm -rf "$(distdir)" \
+    find "$(distdir)" -type d ! -perm -700 -exec chmod u+rwx {} ';' \
+      ; rm -rf "$(distdir)" \
       || { sleep 5 && rm -rf "$(distdir)"; }; \
   else :; fi
 am__post_remove_distdir = $(am__remove_distdir)
@@ -205,17 +214,20 @@ am__relativize = \
   done; \
   reldir="$$dir2"
 DIST_ARCHIVES = $(distdir).tar.gz $(distdir).tar.xz
-GZIP_ENV = --best
+GZIP_ENV = -9
 DIST_TARGETS = dist-xz dist-gzip
 # Exists only to be overridden by the user if desired.
 AM_DISTCHECK_DVI_TARGET = dvi
 distuninstallcheck_listfiles = find . -type f -print
 am__distuninstallcheck_listfiles = $(distuninstallcheck_listfiles) \
   | sed 's|^\./|$(prefix)/|' | grep -v '$(infodir)/dir$$'
-distcleancheck_listfiles = find . -type f -print
+distcleancheck_listfiles = \
+  find . \( -type f -a \! \
+            \( -name .nfs* -o -name .smb* -o -name .__afs* \) \) -print
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
 AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+AM_DISTCHECK_CONFIGURE_FLAGS = @AM_DISTCHECK_CONFIGURE_FLAGS@
 AR = @AR@
 AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
@@ -224,6 +236,8 @@ AWK = @AWK@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
+CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
+CMOCKA_LIBS = @CMOCKA_LIBS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CSCOPE = @CSCOPE@
@@ -242,6 +256,7 @@ EGREP = @EGREP@
 ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
 GMSGFMT = @GMSGFMT@
 GMSGFMT_015 = @GMSGFMT_015@
@@ -257,9 +272,15 @@ INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
 LD = @LD@
 LDFLAGS = @LDFLAGS@
 LIBACL = @LIBACL@
+LIBADD_DL = @LIBADD_DL@
+LIBADD_DLD_LINK = @LIBADD_DLD_LINK@
+LIBADD_DLOPEN = @LIBADD_DLOPEN@
+LIBADD_SHL_LOAD = @LIBADD_SHL_LOAD@
 LIBATTR = @LIBATTR@
 LIBAUDIT = @LIBAUDIT@
-LIBCRACK = @LIBCRACK@
+LIBBSD = @LIBBSD@
+LIBBSD_CFLAGS = @LIBBSD_CFLAGS@
+LIBBSD_LIBS = @LIBBSD_LIBS@
 LIBCRYPT = @LIBCRYPT@
 LIBECONF = @LIBECONF@
 LIBICONV = @LIBICONV@
@@ -275,14 +296,16 @@ LIBSUBID_ABI = @LIBSUBID_ABI@
 LIBSUBID_ABI_MAJOR = @LIBSUBID_ABI_MAJOR@
 LIBSUBID_ABI_MICRO = @LIBSUBID_ABI_MICRO@
 LIBSUBID_ABI_MINOR = @LIBSUBID_ABI_MINOR@
+LIBSYSTEMD = @LIBSYSTEMD@
 LIBTCB = @LIBTCB@
 LIBTOOL = @LIBTOOL@
 LIPO = @LIPO@
-LIYESCRYPT = @LIYESCRYPT@
 LN_S = @LN_S@
 LTLIBICONV = @LTLIBICONV@
 LTLIBINTL = @LTLIBINTL@
 LTLIBOBJS = @LTLIBOBJS@
+LT_DLLOADERS = @LT_DLLOADERS@
+LT_DLPREOPEN = @LT_DLPREOPEN@
 LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
@@ -305,6 +328,9 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
 POSUB = @POSUB@
 RANLIB = @RANLIB@
 SED = @SED@
@@ -320,8 +346,6 @@ XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
 XMLCATALOG = @XMLCATALOG@
 XML_CATALOG_FILE = @XML_CATALOG_FILE@
 XSLTPROC = @XSLTPROC@
-YACC = @YACC@
-YFLAGS = @YFLAGS@
 abs_builddir = @abs_builddir@
 abs_srcdir = @abs_srcdir@
 abs_top_builddir = @abs_top_builddir@
@@ -332,8 +356,10 @@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
 am__quote = @am__quote@
+am__rm_f_notfound = @am__rm_f_notfound@
 am__tar = @am__tar@
 am__untar = @am__untar@
+am__xargs_n = @am__xargs_n@
 bindir = @bindir@
 build = @build@
 build_alias = @build_alias@
@@ -376,9 +402,11 @@ target_alias = @target_alias@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-EXTRA_DIST = NEWS README TODO shadow.spec.in
-SUBDIRS = libmisc lib $(am__append_1) src po contrib doc etc \
+ACLOCAL_AMFLAGS = -I m4
+SUBDIRS = lib $(am__append_1) src po doc etc tests/unit \
 	$(am__append_2)
+CLEANFILES = man/8.out man/po/remove-potcdate.* man/*/login.defs.d man/*/*.mo
+EXTRA_DIST = NEWS README tests/
 all: config.h
 	$(MAKE) $(AM_MAKEFLAGS) all-recursive
 
@@ -422,19 +450,17 @@ config.h: stamp-h1
 	@test -f $@ || $(MAKE) $(AM_MAKEFLAGS) stamp-h1
 
 stamp-h1: $(srcdir)/config.h.in $(top_builddir)/config.status
-	@rm -f stamp-h1
-	cd $(top_builddir) && $(SHELL) ./config.status config.h
+	$(AM_V_at)rm -f stamp-h1
+	$(AM_V_GEN)cd $(top_builddir) && $(SHELL) ./config.status config.h
 $(srcdir)/config.h.in: @MAINTAINER_MODE_TRUE@ $(am__configure_deps) 
-	($(am__cd) $(top_srcdir) && $(AUTOHEADER))
-	rm -f stamp-h1
-	touch $@
+	$(AM_V_GEN)($(am__cd) $(top_srcdir) && $(AUTOHEADER))
+	$(AM_V_at)rm -f stamp-h1
+	$(AM_V_at)touch $@
 
 distclean-hdr:
 	-rm -f config.h stamp-h1
 man/po/Makefile: $(top_builddir)/config.status $(top_srcdir)/man/po/Makefile.in
 	cd $(top_builddir) && $(SHELL) ./config.status $@
-shadow.spec: $(top_builddir)/config.status $(srcdir)/shadow.spec.in
-	cd $(top_builddir) && $(SHELL) ./config.status $@
 
 mostlyclean-libtool:
 	-rm -f *.lo
@@ -550,12 +576,13 @@ cscopelist-am: $(am__tagged_files)
 distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
 	-rm -f cscope.out cscope.in.out cscope.po.out cscope.files
+
 distdir: $(BUILT_SOURCES)
 	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
 distdir-am: $(DISTFILES)
 	$(am__remove_distdir)
-	test -d "$(distdir)" || mkdir "$(distdir)"
+	$(AM_V_at)$(MKDIR_P) "$(distdir)"
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -610,6 +637,9 @@ distdir-am: $(DISTFILES)
 	      || exit 1; \
 	  fi; \
 	done
+	$(MAKE) $(AM_MAKEFLAGS) \
+	  top_distdir="$(top_distdir)" distdir="$(distdir)" \
+	  dist-hook
 	-test -n "$(am__skip_mode_fix)" \
 	|| find "$(distdir)" -type d ! -perm -755 \
 		-exec chmod u+rwx,go+rx {} \; -o \
@@ -625,6 +655,10 @@ dist-bzip2: distdir
 	tardir=$(distdir) && $(am__tar) | BZIP2=$${BZIP2--9} bzip2 -c >$(distdir).tar.bz2
 	$(am__post_remove_distdir)
 
+dist-bzip3: distdir
+	tardir=$(distdir) && $(am__tar) | bzip3 -c >$(distdir).tar.bz3
+	$(am__post_remove_distdir)
+
 dist-lzip: distdir
 	tardir=$(distdir) && $(am__tar) | lzip -c $${LZIP_OPT--9} >$(distdir).tar.lz
 	$(am__post_remove_distdir)
@@ -665,9 +699,11 @@ dist dist-all:
 distcheck: dist
 	case '$(DIST_ARCHIVES)' in \
 	*.tar.gz*) \
-	  eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).tar.gz | $(am__untar) ;;\
+	  eval GZIP= gzip -dc $(distdir).tar.gz | $(am__untar) ;;\
 	*.tar.bz2*) \
 	  bzip2 -dc $(distdir).tar.bz2 | $(am__untar) ;;\
+	*.tar.bz3*) \
+	  bzip3 -dc $(distdir).tar.bz3 | $(am__untar) ;;\
 	*.tar.lz*) \
 	  lzip -dc $(distdir).tar.lz | $(am__untar) ;;\
 	*.tar.xz*) \
@@ -675,7 +711,7 @@ distcheck: dist
 	*.tar.Z*) \
 	  uncompress -c $(distdir).tar.Z | $(am__untar) ;;\
 	*.shar.gz*) \
-	  eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).shar.gz | unshar ;;\
+	  eval GZIP= gzip -dc $(distdir).shar.gz | unshar ;;\
 	*.zip*) \
 	  unzip $(distdir).zip ;;\
 	*.tar.zst*) \
@@ -773,10 +809,11 @@ install-strip:
 mostlyclean-generic:
 
 clean-generic:
+	-$(am__rm_f) $(CLEANFILES)
 
 distclean-generic:
-	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+	-$(am__rm_f) $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || $(am__rm_f) $(CONFIG_CLEAN_VPATH_FILES)
 
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
@@ -856,9 +893,9 @@ uninstall-am:
 .PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am \
 	am--refresh check check-am clean clean-cscope clean-generic \
 	clean-libtool cscope cscopelist-am ctags ctags-am dist \
-	dist-all dist-bzip2 dist-gzip dist-lzip dist-shar dist-tarZ \
-	dist-xz dist-zip dist-zstd distcheck distclean \
-	distclean-generic distclean-hdr distclean-libtool \
+	dist-all dist-bzip2 dist-bzip3 dist-gzip dist-hook dist-lzip \
+	dist-shar dist-tarZ dist-xz dist-zip dist-zstd distcheck \
+	distclean distclean-generic distclean-hdr distclean-libtool \
 	distclean-tags distcleancheck distdir distuninstallcheck dvi \
 	dvi-am html html-am info info-am install install-am \
 	install-data install-data-am install-dvi install-dvi-am \
@@ -873,6 +910,23 @@ uninstall-am:
 .PRECIOUS: Makefile
 
 
+dist-hook:
+	chmod -R u+w $(distdir)/tests
+	chmod u+w $(distdir)
+	mv $(distdir)/tests/unit $(distdir)/realunittest
+	mv $(distdir)/tests/tests $(distdir)/realtests
+	rm -rf $(distdir)/tests
+	mv $(distdir)/realtests $(distdir)/tests
+	rm -rf $(distdir)/tests/unit $(distdir)/tests/Makefile*
+	mv $(distdir)/realunittest $(distdir)/tests/unit
+
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
+
+# Tell GNU make to disable its built-in pattern rules.
+%:: %,v
+%:: RCS/%,v
+%:: RCS/%
+%:: s.%
+%:: SCCS/s.%

NEWS

@@ -696,7 +696,7 @@ shadow-4.0.18 -> shadow-4.0.18.1					03-08-2006
 shadow-4.0.17 -> shadow-4.0.18						01-08-2006
 
 *** general:
-- su: fixed set enviroment too early when using PAM, so move it to !USE_PAM
+- su: fixed set environment too early when using PAM, so move it to !USE_PAM
   (patch submitted by Mike Frysinger <vapier@gentoo.org>),
 - groupadd, groupmod, useradd, usermod: fixed UID/GID overflow (fixed
   http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198920)
@@ -855,7 +855,7 @@ shadow-4.0.14 -> shadow-4.0.15						13-03-2006
 - su: move exit() outside libmisc/shell.c::shell() for handle shell() errors
   on higher level (now is better visable where some programs exit with 126
   and 127 exit codes); added new shell() parameter (char *const envp[])
-  which allow fix preserving enviroment in su on using -p, (patch by
+  which allow fix preserving environment in su on using -p, (patch by
   Alexander Gattin <xrgtn@yandex.ru>),
 - su: added handle -c,--command option for GNU su compliance (merge
   437_su_-c_option Debian patch),
@@ -966,7 +966,7 @@ shadow-4.0.12 -> shadow-4.0.13						10-10-2005
   to example described in ident(1) man page (modern compilers like latest GCC
   removes not used functions by global optimization).
   So "ident /usr/bin/passwd" will show again some useable informations
-- su: fixed twice copy enviroment which causes auth problems
+- su: fixed twice copy environment which causes auth problems
   (bug was introduced in 4.0.12; fix by Nicolas François <nicolas.francois@centraliens.net>),
 - chage: differentiate the different failure causes by the exit value
   This will permit to adduser Debian script to detect if chage failed because the
@@ -1133,7 +1133,7 @@ shadow-4.0.9 -> shadow-4.0.10						28-06-2005
   http://bugs.debian.org/53702
 - login: check for hushed login and pass PAM_SILENT if true,
   http://bugs.debian.org/48002
-- login: fixed username on succesful login (was using the normal username,
+- login: fixed username on successful login (was using the normal username,
   when it should have used pam_user) http://bugs.debian.org/47819
 - remove using SHADOWPWD #define so now shadow is always built with shadow
   password support,
@@ -1212,7 +1212,7 @@ shadow-4.0.7 -> shadow-4.0.8						26-04-2005
   (without gshadow) doesn't permit to use newgrp,
 - newgrp(1): newgrp uses /bin/sh (not bash),
 - faillog(8): updated after rewritten faillog command for use getopt_long(),
-- login(1): removed fragment about abilities pass enviroment variables in login prompt,
+- login(1): removed fragment about abilities pass environment variables in login prompt,
 - gshadow(5): new file (by Nicolas Nicolas François <nicolas.francois@centraliens.net>),
 - usermod(8): fixed #302388 Debian bug: added separated -o option description,
 
@@ -1242,7 +1242,7 @@ shadow-4.0.6 -> shadow-4.0.7						26-01-2005
 
 shadow-4.0.5 -> shadow-4.0.6						08-11-2004
 
-- su: fixed adding of pam_env env variables to enviroment
+- su: fixed adding of pam_env env variables to environment
   (Martin Schlemmer <azarah@nosferatu.za.org>),
 - autoconf: fixed filling MAIL_SPOOL_DIR and MAIL_SPOOL_FILE variables
   which was always empty (Gregorio Guidi <g.guidi@sns.it>),
@@ -1275,7 +1275,7 @@ shadow-4.0.4.1 -> shadow-4.0.5						27-10-2004
   including symlinks placed into /etc/skel/public_html for example.
   http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=66819
 - su: add pam_open_session() support. If built without PAM support
-  propagate $DISPLAY and $XAUTHORITY enviroment variables.
+  propagate $DISPLAY and $XAUTHORITY environment variables.
   Based on http://www.gentoo.org/cgi-bin/viewcvs.cgi/sys-apps/shadow/files/shadow-4.0.4.1-su-pam_open_session.patch?rev=1.1
 - applied 036_pam_access_with_preauth.patch Debian patch submited by Bjorn
   Torkelsson <Bjorn.Torkelsson@hpc2n.umu.se>: add support for PAM account

README

@@ -17,6 +17,12 @@ are used for managing group accounts.
 * [Issue tracker](https://github.com/shadow-maint/shadow/issues)
 * [Releases](https://github.com/shadow-maint/shadow/releases)
 
+## Code
+
+The main development branch is at [https://github.com/shadow-maint/shadow.git](https://github.com/shadow-maint/shadow)
+
+See [STABLE.md](https://github.com/shadow-maint/shadow/blob/master/STABLE.md) for a list of supported stable branches.
+
 ## Contacts
 There are several ways to contact us:
 * [the general discussion mailing list](
@@ -31,6 +37,11 @@ There are several ways to contact us:
   https://alioth-lists-archive.debian.net/pipermail/pkg-shadow-commits/),
   only used for historical purposes
 
+## Contributions
+
+Contributions are welcome. Follow the
+[guidelines](doc/contributions/introduction.md) before posting any patches.
+
 ## Authors and maintainers
 Authors and maintainers are listed in [AUTHORS.md](
 https://github.com/shadow-maint/shadow/blob/master/AUTHORS.md).

TODO

@@ -1,127 +0,0 @@
- * Create a common usage function that'd take the array of
-   long options and an array of descriptions and output that so things would
-   be standardized across the utils.
-   Usage strings should be normalized and split first.
-   Investigate optparse.
-
-
-/etc/default/useradd
- * GROUP=1000 should accept a group name.
-
-Check when RLOGIN is enabled if ruserok() exists
-
-Move selinux_file_context out of libmisc/copydir.c
-
-Review hardcoded root account?
-
-review all call to strto
-
-libmisc/cleanup_user.c
-	cleanup needed (cleanup_report_add_user* not used)
-
-
-libxcrypt support
- * http://wiki.linuxfromscratch.org/patches/browser/trunk/shadow/shadow-4.0.18.1-owl_blowfish-1.patch
-
-implement getlong, getulong.
-	avoid atoi, atol, atoul, strtol, strtoul, ...
-
-manpages: comment the RLOGIN parts
-
-Replace build_list (in lib/gshadow.c) and list (in lib/sgetgrent.c) by
-comma_to_list()
-
-Revert the modified files if all files could not be changed.
-  * or warn and indicate which files were modified and which were not.
-  * check the order the files are modified.
-
-report nscd_flush_cache failures?
-call nscd from the programs or from lib (commonio?)
-
-PAM: check if a non-interactive conversation function could be used to set
-the password in chpasswd and newusers
-
-WITH_SELINUX
-  - review all tools to check that the strategies are consistent
-
-chage, chfn, chsh: same change needed as in passwd.
-  - probably need moving check_selinux_access to a separate file.
-
-testsuite
- - newgrp
-   - test with unknown user's GID
-
-newusers
- - add logging to SYSLOG & AUDIT
- - use CREATE_HOME
- - Add a -Z option (see useradd / usermod)
-
-Document when/where option appeared, document whether an option is standard
-or not.
-
-Check all the expiry semantics
-
-ALL:
-- move base passwd/shadow/group/gshadow operation to module for allow write
-  different backend modules for db, NIS, LDAP and others. Default backend it
-  will be goot if will be chosen depending on /etc/nsswitch.conf and allow
-  override this by -r <repository> options (where the <repository> can be
-  file, db, nis nisplus, ldap .. like on /etc/nsswitch.conf in service column).
-  passwd have old piece of code with handling -r option and it will be good
-  finish this and propagate on other shadow tools for allow operate on other
-  user databases by well known tools.
-- Protect against signals. Register do_cleanups in a signal handler.
-
-- login.defs
-  - generate depending on configuration
-
-- useradd:
-  - add handle create user mail spool in maildir format.
-  - Add support for -k in -D mode
-  - Add support for -K in -D mode
-  - Add option to create or not the mail spool (and set the default in -D
-    mode)
-  - Change -l to reset the entry if an entry was already there
-  - set the mask in mkdir?
-
-- userdel:
-  - add backup option for the removal of user resources,
-  - user_busy: check that the user is not running any processes.
-  - missing "deleting group" FAILED
-  - home dir removed, but userdel may fail and may leave the user
-    => warning needed
-
-- usermod
-  - add an option equivalent to useradd's -l (only when uid is changed)
-  - the mode of new home directories should be set according to the
-    original mode. Does copy_tree does this?
-  - user renamed, order is not kept in /etc/group (see
-    47_usermod-l_no_shadow_file). This is a problem when the first user is
-    considered as the admin.
-  - see mail "user ID change" on  April, 15
-    + fix call to chown (combination of -m and -u/-g)
-    + add tests
-
-- passwd:
-  - check combination of options (e.g. -u/-l)
-  - when -u refuse to unlock because it would create an empty password, it
-    should not display "Password changed."
-    exit instead?
-
-- newgrp: check the USE_PAM section.
-
-- pwck
-  - Add check to move passwd passwords to shadow if there is a shadow
-    entry (with a password).
-  - Add check to move passwd passwords to shadow if there is a shadow
-    file.
-  - Support an alternative /etc/tcb directory as second parameter.
-  - add options -g / -G to specify alternative group / gshadow files
-
-- su
-  - add a login.defs configuration parameter to add variables to keep in
-    the environment with "su -l" (TERM/TERMCOLOR/...)
-
-- vipw
-  - set ACLs and XATTRs on the temporary file (and backups?)
-  - vipw + selinux -> use lib/selinux.c

build-aux/compile

@@ -1,9 +1,9 @@
 #! /bin/sh
 # Wrapper for compilers which do not understand '-c -o'.
 
-scriptversion=2018-03-07.03; # UTC
+scriptversion=2025-06-18.21; # UTC
 
-# Copyright (C) 1999-2021 Free Software Foundation, Inc.
+# Copyright (C) 1999-2025 Free Software Foundation, Inc.
 # Written by Tom Tromey <tromey@cygnus.com>.
 #
 # This program is free software; you can redistribute it and/or modify
@@ -37,11 +37,11 @@ IFS=" ""	$nl"
 
 file_conv=
 
-# func_file_conv build_file lazy
+# func_file_conv build_file unneeded_conversions
 # Convert a $build file to $host form and store it in $file
 # Currently only supports Windows hosts. If the determined conversion
-# type is listed in (the comma separated) LAZY, no conversion will
-# take place.
+# type is listed in (the comma separated) UNNEEDED_CONVERSIONS, no
+# conversion will take place.
 func_file_conv ()
 {
   file=$1
@@ -51,9 +51,20 @@ func_file_conv ()
 	# lazily determine how to convert abs files
 	case `uname -s` in
 	  MINGW*)
-	    file_conv=mingw
+	    if test -n "$MSYSTEM" && (cygpath --version) >/dev/null 2>&1; then
+	      # MSYS2 environment.
+	      file_conv=cygwin
+	    else
+	      # Original MinGW environment.
+	      file_conv=mingw
+	    fi
 	    ;;
-	  CYGWIN* | MSYS*)
+	  MSYS*)
+	    # Old MSYS environment, or MSYS2 with 32-bit MSYS2 shell.
+	    file_conv=cygwin
+	    ;;
+	  CYGWIN*)
+	    # Cygwin environment.
 	    file_conv=cygwin
 	    ;;
 	  *)
@@ -63,12 +74,14 @@ func_file_conv ()
       fi
       case $file_conv/,$2, in
 	*,$file_conv,*)
+	  # This is the optimization mentioned above:
+	  # If UNNEEDED_CONVERSIONS contains $file_conv, don't convert.
 	  ;;
 	mingw/*)
 	  file=`cmd //C echo "$file " | sed -e 's/"\(.*\) " *$/\1/'`
 	  ;;
-	cygwin/* | msys/*)
-	  file=`cygpath -m "$file" || echo "$file"`
+	cygwin/*)
+	  file=`cygpath -w "$file" || echo "$file"`
 	  ;;
 	wine/*)
 	  file=`winepath -w "$file" || echo "$file"`
@@ -143,7 +156,7 @@ func_cl_wrapper ()
 	  # configure might choose to run compile as 'compile cc -o foo foo.c'.
 	  eat=1
 	  case $2 in
-	    *.o | *.[oO][bB][jJ])
+	    *.o | *.lo | *.[oO][bB][jJ])
 	      func_file_conv "$2"
 	      set x "$@" -Fo"$file"
 	      shift
@@ -248,14 +261,17 @@ If you are trying to build a whole package this is not the
 right script to run: please start by reading the file 'INSTALL'.
 
 Report bugs to <bug-automake@gnu.org>.
+GNU Automake home page: <https://www.gnu.org/software/automake/>.
+General help using GNU software: <https://www.gnu.org/gethelp/>.
 EOF
     exit $?
     ;;
   -v | --v*)
-    echo "compile $scriptversion"
+    echo "compile (GNU Automake) $scriptversion"
     exit $?
     ;;
   cl | *[/\\]cl | cl.exe | *[/\\]cl.exe | \
+  clang-cl | *[/\\]clang-cl | clang-cl.exe | *[/\\]clang-cl.exe | \
   icl | *[/\\]icl | icl.exe | *[/\\]icl.exe )
     func_cl_wrapper "$@"      # Doesn't return...
     ;;
@@ -340,9 +356,9 @@ exit $ret
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'before-save-hook 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp nil t)
 # time-stamp-start: "scriptversion="
-# time-stamp-format: "%:y-%02m-%02d.%02H"
+# time-stamp-format: "%Y-%02m-%02d.%02H"
 # time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:

build-aux/config.guess

@@ -1,10 +1,10 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
-#   Copyright 1992-2022 Free Software Foundation, Inc.
+#   Copyright 1992-2024 Free Software Foundation, Inc.
 
 # shellcheck disable=SC2006,SC2268 # see below for rationale
 
-timestamp='2022-01-09'
+timestamp='2024-07-27'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -47,7 +47,7 @@ me=`echo "$0" | sed -e 's,.*/,,'`
 usage="\
 Usage: $0 [OPTION]
 
-Output the configuration name of the system \`$me' is run on.
+Output the configuration name of the system '$me' is run on.
 
 Options:
   -h, --help         print this help, then exit
@@ -60,13 +60,13 @@ version="\
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright 1992-2022 Free Software Foundation, Inc.
+Copyright 1992-2024 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
 
 help="
-Try \`$me --help' for more information."
+Try '$me --help' for more information."
 
 # Parse command line
 while test $# -gt 0 ; do
@@ -102,8 +102,8 @@ GUESS=
 # temporary files to be created and, as you can see below, it is a
 # headache to deal with in a portable fashion.
 
-# Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still
-# use `HOST_CC' if defined, but it is deprecated.
+# Historically, 'CC_FOR_BUILD' used to be named 'HOST_CC'. We still
+# use 'HOST_CC' if defined, but it is deprecated.
 
 # Portable tmp directory creation inspired by the Autoconf team.
 
@@ -123,7 +123,7 @@ set_cc_for_build() {
     dummy=$tmp/dummy
     case ${CC_FOR_BUILD-},${HOST_CC-},${CC-} in
 	,,)    echo "int x;" > "$dummy.c"
-	       for driver in cc gcc c89 c99 ; do
+	       for driver in cc gcc c17 c99 c89 ; do
 		   if ($driver -c -o "$dummy.o" "$dummy.c") >/dev/null 2>&1 ; then
 		       CC_FOR_BUILD=$driver
 		       break
@@ -155,6 +155,9 @@ Linux|GNU|GNU/*)
 
 	set_cc_for_build
 	cat <<-EOF > "$dummy.c"
+	#if defined(__ANDROID__)
+	LIBC=android
+	#else
 	#include <features.h>
 	#if defined(__UCLIBC__)
 	LIBC=uclibc
@@ -162,6 +165,8 @@ Linux|GNU|GNU/*)
 	LIBC=dietlibc
 	#elif defined(__GLIBC__)
 	LIBC=gnu
+	#elif defined(__LLVM_LIBC__)
+	LIBC=llvm
 	#else
 	#include <stdarg.h>
 	/* First heuristic to detect musl libc.  */
@@ -169,6 +174,7 @@ Linux|GNU|GNU/*)
 	LIBC=musl
 	#endif
 	#endif
+	#endif
 	EOF
 	cc_set_libc=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
 	eval "$cc_set_libc"
@@ -459,7 +465,7 @@ case $UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION in
 		UNAME_RELEASE=`uname -v`
 		;;
 	esac
-	# Japanese Language versions have a version number like `4.1.3-JL'.
+	# Japanese Language versions have a version number like '4.1.3-JL'.
 	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/-/_/'`
 	GUESS=sparc-sun-sunos$SUN_REL
 	;;
@@ -628,7 +634,8 @@ EOF
 		sed 's/^		//' << EOF > "$dummy.c"
 		#include <sys/systemcfg.h>
 
-		main()
+		int
+		main ()
 			{
 			if (!__power_pc())
 				exit(1);
@@ -712,7 +719,8 @@ EOF
 		#include <stdlib.h>
 		#include <unistd.h>
 
-		int main ()
+		int
+		main ()
 		{
 		#if defined(_SC_KERNEL_BITS)
 		    long bits = sysconf(_SC_KERNEL_BITS);
@@ -904,7 +912,7 @@ EOF
 	fi
 	;;
     *:FreeBSD:*:*)
-	UNAME_PROCESSOR=`/usr/bin/uname -p`
+	UNAME_PROCESSOR=`uname -p`
 	case $UNAME_PROCESSOR in
 	    amd64)
 		UNAME_PROCESSOR=x86_64 ;;
@@ -966,11 +974,37 @@ EOF
 	GNU_REL=`echo "$UNAME_RELEASE" | sed -e 's/[-(].*//'`
 	GUESS=$UNAME_MACHINE-unknown-$GNU_SYS$GNU_REL-$LIBC
 	;;
+    x86_64:[Mm]anagarm:*:*|i?86:[Mm]anagarm:*:*)
+	GUESS="$UNAME_MACHINE-pc-managarm-mlibc"
+	;;
+    *:[Mm]anagarm:*:*)
+	GUESS="$UNAME_MACHINE-unknown-managarm-mlibc"
+	;;
     *:Minix:*:*)
 	GUESS=$UNAME_MACHINE-unknown-minix
 	;;
     aarch64:Linux:*:*)
-	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	set_cc_for_build
+	CPU=$UNAME_MACHINE
+	LIBCABI=$LIBC
+	if test "$CC_FOR_BUILD" != no_compiler_found; then
+	    ABI=64
+	    sed 's/^	    //' << EOF > "$dummy.c"
+	    #ifdef __ARM_EABI__
+	    #ifdef __ARM_PCS_VFP
+	    ABI=eabihf
+	    #else
+	    ABI=eabi
+	    #endif
+	    #endif
+EOF
+	    cc_set_abi=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^ABI' | sed 's, ,,g'`
+	    eval "$cc_set_abi"
+	    case $ABI in
+		eabi | eabihf) CPU=armv8l; LIBCABI=$LIBC$ABI ;;
+	    esac
+	fi
+	GUESS=$CPU-unknown-linux-$LIBCABI
 	;;
     aarch64_be:Linux:*:*)
 	UNAME_MACHINE=aarch64_be
@@ -1036,7 +1070,16 @@ EOF
     k1om:Linux:*:*)
 	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
 	;;
-    loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*)
+    kvx:Linux:*:*)
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
+    kvx:cos:*:*)
+	GUESS=$UNAME_MACHINE-unknown-cos
+	;;
+    kvx:mbr:*:*)
+	GUESS=$UNAME_MACHINE-unknown-mbr
+	;;
+    loongarch32:Linux:*:* | loongarch64:Linux:*:*)
 	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
 	;;
     m32r*:Linux:*:*)
@@ -1151,16 +1194,27 @@ EOF
 	;;
     x86_64:Linux:*:*)
 	set_cc_for_build
+	CPU=$UNAME_MACHINE
 	LIBCABI=$LIBC
 	if test "$CC_FOR_BUILD" != no_compiler_found; then
-	    if (echo '#ifdef __ILP32__'; echo IS_X32; echo '#endif') | \
-		(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
-		grep IS_X32 >/dev/null
-	    then
-		LIBCABI=${LIBC}x32
-	    fi
+	    ABI=64
+	    sed 's/^	    //' << EOF > "$dummy.c"
+	    #ifdef __i386__
+	    ABI=x86
+	    #else
+	    #ifdef __ILP32__
+	    ABI=x32
+	    #endif
+	    #endif
+EOF
+	    cc_set_abi=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^ABI' | sed 's, ,,g'`
+	    eval "$cc_set_abi"
+	    case $ABI in
+		x86) CPU=i686 ;;
+		x32) LIBCABI=${LIBC}x32 ;;
+	    esac
 	fi
-	GUESS=$UNAME_MACHINE-pc-linux-$LIBCABI
+	GUESS=$CPU-pc-linux-$LIBCABI
 	;;
     xtensa*:Linux:*:*)
 	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
@@ -1180,7 +1234,7 @@ EOF
 	GUESS=$UNAME_MACHINE-pc-sysv4.2uw$UNAME_VERSION
 	;;
     i*86:OS/2:*:*)
-	# If we were able to find `uname', then EMX Unix compatibility
+	# If we were able to find 'uname', then EMX Unix compatibility
 	# is probably installed.
 	GUESS=$UNAME_MACHINE-pc-os2-emx
 	;;
@@ -1321,7 +1375,7 @@ EOF
 		GUESS=ns32k-sni-sysv
 	fi
 	;;
-    PENTIUM:*:4.0*:*)	# Unisys `ClearPath HMP IX 4000' SVR4/MP effort
+    PENTIUM:*:4.0*:*)	# Unisys 'ClearPath HMP IX 4000' SVR4/MP effort
 			# says <Richard.M.Bartel@ccMail.Census.GOV>
 	GUESS=i586-unisys-sysv4
 	;;
@@ -1367,8 +1421,11 @@ EOF
     BePC:Haiku:*:*)	# Haiku running on Intel PC compatible.
 	GUESS=i586-pc-haiku
 	;;
-    x86_64:Haiku:*:*)
-	GUESS=x86_64-unknown-haiku
+    ppc:Haiku:*:*)	# Haiku running on Apple PowerPC
+	GUESS=powerpc-apple-haiku
+	;;
+    *:Haiku:*:*)	# Haiku modern gcc (not bound by BeOS compat)
+	GUESS=$UNAME_MACHINE-unknown-haiku
 	;;
     SX-4:SUPER-UX:*:*)
 	GUESS=sx4-nec-superux$UNAME_RELEASE
@@ -1540,6 +1597,9 @@ EOF
     *:Unleashed:*:*)
 	GUESS=$UNAME_MACHINE-unknown-unleashed$UNAME_RELEASE
 	;;
+    *:Ironclad:*:*)
+	GUESS=$UNAME_MACHINE-unknown-ironclad
+	;;
 esac
 
 # Do we have a guess based on uname results?
@@ -1563,6 +1623,7 @@ cat > "$dummy.c" <<EOF
 #endif
 #endif
 #endif
+int
 main ()
 {
 #if defined (sony)

build-aux/depcomp

@@ -1,9 +1,9 @@
 #! /bin/sh
 # depcomp - compile a program generating dependencies as side-effects
 
-scriptversion=2018-03-07.03; # UTC
+scriptversion=2025-06-18.21; # UTC
 
-# Copyright (C) 1999-2021 Free Software Foundation, Inc.
+# Copyright (C) 1999-2025 Free Software Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -47,11 +47,13 @@ Environment variables:
   libtool     Whether libtool is used (yes/no).
 
 Report bugs to <bug-automake@gnu.org>.
+GNU Automake home page: <https://www.gnu.org/software/automake/>.
+General help using GNU software: <https://www.gnu.org/gethelp/>.
 EOF
     exit $?
     ;;
   -v | --v*)
-    echo "depcomp $scriptversion"
+    echo "depcomp (GNU Automake) $scriptversion"
     exit $?
     ;;
 esac
@@ -113,7 +115,6 @@ nl='
 # These definitions help.
 upper=ABCDEFGHIJKLMNOPQRSTUVWXYZ
 lower=abcdefghijklmnopqrstuvwxyz
-digits=0123456789
 alpha=${upper}${lower}
 
 if test -z "$depmode" || test -z "$source" || test -z "$object"; then
@@ -128,7 +129,7 @@ tmpdepfile=${tmpdepfile-`echo "$depfile" | sed 's/\.\([^.]*\)$/.T\1/'`}
 
 rm -f "$tmpdepfile"
 
-# Avoid interferences from the environment.
+# Avoid interference from the environment.
 gccflag= dashmflag=
 
 # Some modes work just like other modes, but use different flags.  We
@@ -198,8 +199,8 @@ gcc3)
   ;;
 
 gcc)
-## Note that this doesn't just cater to obsosete pre-3.x GCC compilers.
-## but also to in-use compilers like IMB xlc/xlC and the HP C compiler.
+## Note that this doesn't just cater to obsolete pre-3.x GCC compilers.
+## but also to in-use compilers like IBM xlc/xlC and the HP C compiler.
 ## (see the conditional assignment to $gccflag above).
 ## There are various ways to get dependency output from gcc.  Here's
 ## why we pick this rather obscure method:
@@ -783,9 +784,9 @@ exit 0
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'before-save-hook 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp nil t)
 # time-stamp-start: "scriptversion="
-# time-stamp-format: "%:y-%02m-%02d.%02H"
+# time-stamp-format: "%Y-%02m-%02d.%02H"
 # time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:

build-aux/install-sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2020-11-14.01; # UTC
+scriptversion=2025-06-18.21; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -124,9 +124,9 @@ it's up to you to specify -f if you want it.
 
 If -S is not specified, no backups are attempted.
 
-Email bug reports to bug-automake@gnu.org.
-Automake home page: https://www.gnu.org/software/automake/
-"
+Report bugs to <bug-automake@gnu.org>.
+GNU Automake home page: <https://www.gnu.org/software/automake/>.
+General help using GNU software: <https://www.gnu.org/gethelp/>."
 
 while test $# -ne 0; do
   case $1 in
@@ -170,7 +170,7 @@ while test $# -ne 0; do
 
     -T) is_target_a_directory=never;;
 
-    --version) echo "$0 $scriptversion"; exit $?;;
+    --version) echo "$0 (GNU Automake) $scriptversion"; exit $?;;
 
     --) shift
         break;;
@@ -345,7 +345,7 @@ do
 	' 0
 
 	# Because "mkdir -p" follows existing symlinks and we likely work
-	# directly in world-writeable /tmp, make sure that the '$tmpdir'
+	# directly in world-writable /tmp, make sure that the '$tmpdir'
 	# directory is successfully created first before we actually test
 	# 'mkdir -p'.
 	if (umask $mkdir_umask &&
@@ -353,7 +353,7 @@ do
 	    exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 2>&1
 	then
 	  if test -z "$dir_arg" || {
-	       # Check for POSIX incompatibilities with -m.
+	       # Check for POSIX incompatibility with -m.
 	       # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
 	       # other-writable bit of parent directory when it shouldn't.
 	       # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
@@ -533,9 +533,9 @@ do
 done
 
 # Local variables:
-# eval: (add-hook 'before-save-hook 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp nil t)
 # time-stamp-start: "scriptversion="
-# time-stamp-format: "%:y-%02m-%02d.%02H"
+# time-stamp-format: "%Y-%02m-%02d.%02H"
 # time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:

build-aux/missing

@@ -1,9 +1,11 @@
 #! /bin/sh
-# Common wrapper for a few potentially missing GNU programs.
+# Common wrapper for a few potentially missing GNU and other programs.
 
-scriptversion=2018-03-07.03; # UTC
+scriptversion=2025-06-18.21; # UTC
 
-# Copyright (C) 1996-2021 Free Software Foundation, Inc.
+# shellcheck disable=SC2006,SC2268 # we must support pre-POSIX shells
+
+# Copyright (C) 1996-2025 Free Software Foundation, Inc.
 # Originally written by Fran,cois Pinard <pinard@iro.umontreal.ca>, 1996.
 
 # This program is free software; you can redistribute it and/or modify
@@ -54,18 +56,20 @@ Options:
   -v, --version   output version information and exit
 
 Supported PROGRAM values:
-  aclocal   autoconf  autoheader   autom4te  automake  makeinfo
-  bison     yacc      flex         lex       help2man
+aclocal autoconf autogen  autoheader autom4te automake autoreconf
+bison   flex     help2man lex        makeinfo perl     yacc
 
 Version suffixes to PROGRAM as well as the prefixes 'gnu-', 'gnu', and
 'g' are ignored when checking the name.
 
-Send bug reports to <bug-automake@gnu.org>."
+Report bugs to <bug-automake@gnu.org>.
+GNU Automake home page: <https://www.gnu.org/software/automake/>.
+General help using GNU software: <https://www.gnu.org/gethelp/>."
     exit $?
     ;;
 
   -v|--v|--ve|--ver|--vers|--versi|--versio|--version)
-    echo "missing $scriptversion (GNU Automake)"
+    echo "missing (GNU Automake) $scriptversion"
     exit $?
     ;;
 
@@ -108,7 +112,7 @@ gnu_software_URL=https://www.gnu.org/software
 program_details ()
 {
   case $1 in
-    aclocal|automake)
+    aclocal|automake|autoreconf)
       echo "The '$1' program is part of the GNU Automake package:"
       echo "<$gnu_software_URL/automake>"
       echo "It also requires GNU Autoconf, GNU m4 and Perl in order to run:"
@@ -123,6 +127,9 @@ program_details ()
       echo "<$gnu_software_URL/m4/>"
       echo "<$perl_URL>"
       ;;
+    *)
+      :
+      ;;
   esac
 }
 
@@ -137,48 +144,55 @@ give_advice ()
   printf '%s\n' "'$1' is $msg."
 
   configure_deps="'configure.ac' or m4 files included by 'configure.ac'"
+  autoheader_deps="'acconfig.h'"
+  automake_deps="'Makefile.am'"
+  aclocal_deps="'acinclude.m4'"
   case $normalized_program in
+    aclocal*)
+      echo "You should only need it if you modified $aclocal_deps or"
+      echo "$configure_deps."
+      ;;
     autoconf*)
-      echo "You should only need it if you modified 'configure.ac',"
-      echo "or m4 files included by it."
-      program_details 'autoconf'
+      echo "You should only need it if you modified $configure_deps."
+      ;;
+    autogen*)
+      echo "You should only need it if you modified a '.def' or '.tpl' file."
+      echo "You may want to install the GNU AutoGen package:"
+      echo "<$gnu_software_URL/autogen/>"
       ;;
     autoheader*)
-      echo "You should only need it if you modified 'acconfig.h' or"
+      echo "You should only need it if you modified $autoheader_deps or"
       echo "$configure_deps."
-      program_details 'autoheader'
       ;;
     automake*)
-      echo "You should only need it if you modified 'Makefile.am' or"
+      echo "You should only need it if you modified $automake_deps or"
       echo "$configure_deps."
-      program_details 'automake'
       ;;
-    aclocal*)
-      echo "You should only need it if you modified 'acinclude.m4' or"
-      echo "$configure_deps."
-      program_details 'aclocal'
-      ;;
-   autom4te*)
+    autom4te*)
       echo "You might have modified some maintainer files that require"
       echo "the 'autom4te' program to be rebuilt."
-      program_details 'autom4te'
+      ;;
+    autoreconf*)
+      echo "You should only need it if you modified $aclocal_deps or"
+      echo "$automake_deps or $autoheader_deps or $automake_deps or"
+      echo "$configure_deps."
       ;;
     bison*|yacc*)
       echo "You should only need it if you modified a '.y' file."
       echo "You may want to install the GNU Bison package:"
       echo "<$gnu_software_URL/bison/>"
       ;;
-    lex*|flex*)
-      echo "You should only need it if you modified a '.l' file."
-      echo "You may want to install the Fast Lexical Analyzer package:"
-      echo "<$flex_URL>"
-      ;;
     help2man*)
       echo "You should only need it if you modified a dependency" \
            "of a man page."
       echo "You may want to install the GNU Help2man package:"
       echo "<$gnu_software_URL/help2man/>"
     ;;
+    lex*|flex*)
+      echo "You should only need it if you modified a '.l' file."
+      echo "You may want to install the Fast Lexical Analyzer package:"
+      echo "<$flex_URL>"
+      ;;
     makeinfo*)
       echo "You should only need it if you modified a '.texi' file, or"
       echo "any other file indirectly affecting the aspect of the manual."
@@ -189,6 +203,12 @@ give_advice ()
       echo "want to install GNU make:"
       echo "<$gnu_software_URL/make/>"
       ;;
+    perl*)
+      echo "You should only need it to run GNU Autoconf, GNU Automake, "
+      echo "  assorted other tools, or if you modified a Perl source file."
+      echo "You may want to install the Perl 5 language interpreter:"
+      echo "<$perl_URL>"
+      ;;
     *)
       echo "You might have modified some files without having the proper"
       echo "tools for further handling them.  Check the 'README' file, it"
@@ -197,6 +217,7 @@ give_advice ()
       echo "case some other package contains this missing '$1' program."
       ;;
   esac
+  program_details "$normalized_program"
 }
 
 give_advice "$1" | sed -e '1s/^/WARNING: /' \
@@ -207,9 +228,9 @@ give_advice "$1" | sed -e '1s/^/WARNING: /' \
 exit $st
 
 # Local variables:
-# eval: (add-hook 'before-save-hook 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp nil t)
 # time-stamp-start: "scriptversion="
-# time-stamp-format: "%:y-%02m-%02d.%02H"
+# time-stamp-format: "%Y-%02m-%02d.%02H"
 # time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:

build-aux/test-driver

@@ -0,0 +1,160 @@
+#! /bin/sh
+# test-driver - basic testsuite driver script.
+
+scriptversion=2025-06-18.21; # UTC
+
+# Copyright (C) 2011-2025 Free Software Foundation, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2, or (at your option)
+# any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# As a special exception to the GNU General Public License, if you
+# distribute this file as part of a program that contains a
+# configuration script generated by Autoconf, you may include it under
+# the same distribution terms that you use for the rest of that program.
+
+# This file is maintained in Automake, please report
+# bugs to <bug-automake@gnu.org> or send patches to
+# <automake-patches@gnu.org>.
+
+# Make unconditional expansion of undefined variables an error.  This
+# helps a lot in preventing typo-related bugs.
+set -u
+
+usage_error ()
+{
+  echo "$0: $*" >&2
+  print_usage >&2
+  exit 2
+}
+
+print_usage ()
+{
+  cat <<END
+Usage:
+  test-driver --test-name NAME --log-file PATH --trs-file PATH
+              [--expect-failure {yes|no}] [--color-tests {yes|no}]
+              [--collect-skipped-logs {yes|no}]
+              [--enable-hard-errors {yes|no}] [--]
+              TEST-SCRIPT [TEST-SCRIPT-ARGUMENTS]
+
+The '--test-name', '--log-file' and '--trs-file' options are mandatory.
+See the GNU Automake documentation for information.
+
+Report bugs to <bug-automake@gnu.org>.
+GNU Automake home page: <https://www.gnu.org/software/automake/>.
+General help using GNU software: <https://www.gnu.org/gethelp/>.
+END
+}
+
+test_name= # Used for reporting.
+log_file=  # Where to save the output of the test script.
+trs_file=  # Where to save the metadata of the test run.
+expect_failure=no
+color_tests=no
+collect_skipped_logs=yes
+enable_hard_errors=yes
+while test $# -gt 0; do
+  case $1 in
+  --help) print_usage; exit $?;;
+  --version) echo "test-driver (GNU Automake) $scriptversion"; exit $?;;
+  --test-name) test_name=$2; shift;;
+  --log-file) log_file=$2; shift;;
+  --trs-file) trs_file=$2; shift;;
+  --color-tests) color_tests=$2; shift;;
+  --collect-skipped-logs) collect_skipped_logs=$2; shift;;
+  --expect-failure) expect_failure=$2; shift;;
+  --enable-hard-errors) enable_hard_errors=$2; shift;;
+  --) shift; break;;
+  -*) usage_error "invalid option: '$1'";;
+   *) break;;
+  esac
+  shift
+done
+
+missing_opts=
+test x"$test_name" = x && missing_opts="$missing_opts --test-name"
+test x"$log_file"  = x && missing_opts="$missing_opts --log-file"
+test x"$trs_file"  = x && missing_opts="$missing_opts --trs-file"
+if test x"$missing_opts" != x; then
+  usage_error "the following mandatory options are missing:$missing_opts"
+fi
+
+if test $# -eq 0; then
+  usage_error "missing argument"
+fi
+
+if test $color_tests = yes; then
+  # Keep this in sync with 'lib/am/check.am:$(am__tty_colors)'.
+  red='' # Red.
+  grn='' # Green.
+  lgn='' # Light green.
+  blu='' # Blue.
+  mgn='' # Magenta.
+  std=''     # No color.
+else
+  red= grn= lgn= blu= mgn= std=
+fi
+
+do_exit='rm -f $log_file $trs_file; (exit $st); exit $st'
+trap "st=129; $do_exit" 1
+trap "st=130; $do_exit" 2
+trap "st=141; $do_exit" 13
+trap "st=143; $do_exit" 15
+
+# Test script is run here. We create the file first, then append to it,
+# to ameliorate tests themselves also writing to the log file. Our tests
+# don't, but others can (automake bug#35762).
+: >"$log_file"
+"$@" >>"$log_file" 2>&1
+estatus=$?
+
+if test $enable_hard_errors = no && test $estatus -eq 99; then
+  tweaked_estatus=1
+else
+  tweaked_estatus=$estatus
+fi
+
+case $tweaked_estatus:$expect_failure in
+  0:yes) col=$red res=XPASS recheck=yes gcopy=yes;;
+  0:*)   col=$grn res=PASS  recheck=no  gcopy=no;;
+  77:*)  col=$blu res=SKIP  recheck=no  gcopy=$collect_skipped_logs;;
+  99:*)  col=$mgn res=ERROR recheck=yes gcopy=yes;;
+  *:yes) col=$lgn res=XFAIL recheck=no  gcopy=yes;;
+  *:*)   col=$red res=FAIL  recheck=yes gcopy=yes;;
+esac
+
+# Report the test outcome and exit status in the logs, so that one can
+# know whether the test passed or failed simply by looking at the '.log'
+# file, without the need of also peaking into the corresponding '.trs'
+# file (automake bug#11814).
+echo "$res $test_name (exit status: $estatus)" >>"$log_file"
+
+# Report outcome to console.
+echo "${col}${res}${std}: $test_name"
+
+# Register the test result, and other relevant metadata.
+echo ":test-result: $res" > $trs_file
+echo ":global-test-result: $res" >> $trs_file
+echo ":recheck: $recheck" >> $trs_file
+echo ":copy-in-global-log: $gcopy" >> $trs_file
+
+# Local Variables:
+# mode: shell-script
+# sh-indentation: 2
+# eval: (add-hook 'before-save-hook 'time-stamp nil t)
+# time-stamp-start: "scriptversion="
+# time-stamp-format: "%Y-%02m-%02d.%02H"
+# time-stamp-time-zone: "UTC0"
+# time-stamp-end: "; # UTC"
+# End:

config.h.in

@@ -4,6 +4,12 @@
    authenticate the callers */
 #undef ACCT_TOOLS_SETUID
 
+/* Define to support lastlog. */
+#undef ENABLE_LASTLOG
+
+/* Define to manage session support with logind. */
+#undef ENABLE_LOGIND
+
 /* Define to 1 if translation of program messages to the user's native
    language is requested. */
 #undef ENABLE_NLS
@@ -14,10 +20,6 @@
 /* Path for faillog file. */
 #undef FAILLOG_FILE
 
-/* Define to the type of elements in the array set by `getgroups'. Usually
-   this is either `int' or `gid_t'. */
-#undef GETGROUPS_T
-
 /* max group name length */
 #undef GROUP_NAME_MAX_LENGTH
 
@@ -30,7 +32,7 @@
 /* Define to 1 if you have the <acl/libacl.h> header file. */
 #undef HAVE_ACL_LIBACL_H
 
-/* Define to 1 if you have the `arc4random_buf' function. */
+/* Define to 1 if you have the 'arc4random_buf' function. */
 #undef HAVE_ARC4RANDOM_BUF
 
 /* Define to 1 if you have the <attr/error_context.h> header file. */
@@ -47,121 +49,77 @@
    the CoreFoundation framework. */
 #undef HAVE_CFPREFERENCESCOPYAPPVALUE
 
-/* Define to 1 if you have the <crypt.h> header file. */
-#undef HAVE_CRYPT_H
-
 /* Define if the GNU dcgettext() function is already present or preinstalled.
    */
 #undef HAVE_DCGETTEXT
 
-/* Define to 1 if you have the declaration of `PAM_DATA_SILENT', and to 0 if
+/* Define to 1 if you have the declaration of 'cygwin_conv_path', and to 0 if
+   you don't. */
+#undef HAVE_DECL_CYGWIN_CONV_PATH
+
+/* Define to 1 if you have the declaration of 'PAM_DATA_SILENT', and to 0 if
    you don't. */
 #undef HAVE_DECL_PAM_DATA_SILENT
 
-/* Define to 1 if you have the declaration of `PAM_DELETE_CRED', and to 0 if
+/* Define to 1 if you have the declaration of 'PAM_DELETE_CRED', and to 0 if
    you don't. */
 #undef HAVE_DECL_PAM_DELETE_CRED
 
-/* Define to 1 if you have the declaration of `PAM_ESTABLISH_CRED', and to 0
+/* Define to 1 if you have the declaration of 'PAM_ESTABLISH_CRED', and to 0
    if you don't. */
 #undef HAVE_DECL_PAM_ESTABLISH_CRED
 
-/* Define to 1 if you have the declaration of `PAM_NEW_AUTHTOK_REQD', and to 0
+/* Define to 1 if you have the declaration of 'PAM_NEW_AUTHTOK_REQD', and to 0
    if you don't. */
 #undef HAVE_DECL_PAM_NEW_AUTHTOK_REQD
 
+/* Define if you have the GNU dld library. */
+#undef HAVE_DLD
+
+/* Define to 1 if you have the 'dlerror' function. */
+#undef HAVE_DLERROR
+
 /* Define to 1 if you have the <dlfcn.h> header file. */
 #undef HAVE_DLFCN_H
 
-/* Define to 1 if you have the <errno.h> header file. */
-#undef HAVE_ERRNO_H
+/* Define if you have the _dyld_func_lookup function. */
+#undef HAVE_DYLD
 
-/* Define to 1 if you have the `explicit_bzero' function. */
+/* Define to 1 if you have the 'explicit_bzero' function. */
 #undef HAVE_EXPLICIT_BZERO
 
-/* Define to 1 if you have the `fchmod' function. */
-#undef HAVE_FCHMOD
+/* Defined to 1 if you have the declaration of 'fgetpwent_r' */
+#undef HAVE_FGETPWENT_R
 
-/* Define to 1 if you have the `fchown' function. */
-#undef HAVE_FCHOWN
-
-/* Define to 1 if you have the <fcntl.h> header file. */
-#undef HAVE_FCNTL_H
-
-/* Define to 1 if you have the `fsync' function. */
-#undef HAVE_FSYNC
-
-/* Define to 1 if you have the `futimes' function. */
-#undef HAVE_FUTIMES
-
-/* Define to 1 if you have the `getentropy' function. */
+/* Define to 1 if you have the 'getentropy' function. */
 #undef HAVE_GETENTROPY
 
-/* Define to 1 if you have the `getgrgid_r' function. */
-#undef HAVE_GETGRGID_R
-
-/* Define to 1 if you have the `getgrnam_r' function. */
-#undef HAVE_GETGRNAM_R
-
-/* Define to 1 if you have the `getpwnam_r' function. */
-#undef HAVE_GETPWNAM_R
-
-/* Define to 1 if you have the `getpwuid_r' function. */
-#undef HAVE_GETPWUID_R
-
-/* Define to 1 if you have the `getrandom' function. */
+/* Define to 1 if you have the 'getrandom' function. */
 #undef HAVE_GETRANDOM
 
-/* Define to 1 if you have the `getspnam' function. */
-#undef HAVE_GETSPNAM
-
-/* Define to 1 if you have the `getspnam_r' function. */
+/* Define to 1 if you have the 'getspnam_r' function. */
 #undef HAVE_GETSPNAM_R
 
 /* Define if the GNU gettext() function is already present or preinstalled. */
 #undef HAVE_GETTEXT
 
-/* Define to 1 if you have the `getusershell' function. */
-#undef HAVE_GETUSERSHELL
-
-/* Define to 1 if you have the `getutent' function. */
-#undef HAVE_GETUTENT
-
-/* Define to 1 if you have the <gshadow.h> header file. */
-#undef HAVE_GSHADOW_H
-
 /* Define if you have the iconv() function and it works. */
 #undef HAVE_ICONV
 
-/* Define to 1 if you have the `initgroups' function. */
-#undef HAVE_INITGROUPS
-
-/* Define to 1 if you have the `innetgr' function. */
+/* Define to 1 if you have the 'innetgr' function. */
 #undef HAVE_INNETGR
 
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H
 
-/* Define to 1 if you have the `l64a' function. */
-#undef HAVE_L64A
-
-/* Define to 1 if you have the <lastlog.h> header file. */
-#undef HAVE_LASTLOG_H
-
-/* Define to 1 if you have the `lckpwdf' function. */
+/* Define to 1 if you have the 'lckpwdf' function. */
 #undef HAVE_LCKPWDF
 
-/* Defined if you have libcrack. */
-#undef HAVE_LIBCRACK
+/* Define if you have the libdl library or equivalent. */
+#undef HAVE_LIBDL
 
-/* Defined if you have the ts&szs cracklib. */
-#undef HAVE_LIBCRACK_HIST
-
-/* Defined if it includes *Pw functions. */
-#undef HAVE_LIBCRACK_PW
-
-/* Define to 1 if you have the <limits.h> header file. */
-#undef HAVE_LIMITS_H
+/* Define if libdlloader will be built on this platform */
+#undef HAVE_LIBDLLOADER
 
 /* Define to 1 if you have the <linux/btrfs_tree.h> header file. */
 #undef HAVE_LINUX_BTRFS_TREE_H
@@ -172,44 +130,29 @@
 /* Define if struct lastlog has ll_host */
 #undef HAVE_LL_HOST
 
-/* Define to 1 if you have the <locale.h> header file. */
-#undef HAVE_LOCALE_H
-
-/* Define to 1 if you have the `lutimes' function. */
+/* Define to 1 if you have the 'lutimes' function. */
 #undef HAVE_LUTIMES
 
-/* Define to 1 if you have the `memset_s' function. */
-#undef HAVE_MEMSET_S
+/* Define to 1 if you have the 'memset_explicit' function. */
+#undef HAVE_MEMSET_EXPLICIT
 
 /* Define to 1 if you have the <minix/config.h> header file. */
 #undef HAVE_MINIX_CONFIG_H
 
-/* Define to 1 if you have the `mkdir' function. */
-#undef HAVE_MKDIR
-
-/* Define to 1 if you have the <netdb.h> header file. */
-#undef HAVE_NETDB_H
-
-/* Define to 1 if you have the <paths.h> header file. */
-#undef HAVE_PATHS_H
-
-/* Define to 1 if you have the `putgrent' function. */
+/* Define to 1 if you have the 'putgrent' function. */
 #undef HAVE_PUTGRENT
 
-/* Define to 1 if you have the `putpwent' function. */
+/* Define to 1 if you have the 'putpwent' function. */
 #undef HAVE_PUTPWENT
 
-/* Define to 1 if you have the `putspent' function. */
+/* Define to 1 if you have the 'putspent' function. */
 #undef HAVE_PUTSPENT
 
-/* Define to 1 if you have the `rename' function. */
-#undef HAVE_RENAME
+/* Define to 1 if you have the <readpassphrase.h> header file. */
+#undef HAVE_READPASSPHRASE_H
 
-/* Define to 1 if you have the `rmdir' function. */
-#undef HAVE_RMDIR
-
-/* Define to 1 if you have the <rpc/key_prot.h> header file. */
-#undef HAVE_RPC_KEY_PROT_H
+/* Define to 1 if you have the 'rpmatch' function. */
+#undef HAVE_RPMATCH
 
 /* Define to 1 if you have the <security/openpam.h> header file. */
 #undef HAVE_SECURITY_OPENPAM_H
@@ -223,29 +166,17 @@
 /* Define to 1 if you have the <semanage/semanage.h> header file. */
 #undef HAVE_SEMANAGE_SEMANAGE_H
 
-/* Define to 1 if you have the `setgroups' function. */
-#undef HAVE_SETGROUPS
-
-/* Define to 1 if you have the `sgetgrent' function. */
+/* Define to 1 if you have the 'sgetgrent' function. */
 #undef HAVE_SGETGRENT
 
-/* Define to 1 if you have the `sgetpwent' function. */
+/* Define to 1 if you have the 'sgetpwent' function. */
 #undef HAVE_SGETPWENT
 
-/* Define to 1 if you have the `sgetspent' function. */
+/* Define to 1 if you have the 'sgetspent' function. */
 #undef HAVE_SGETSPENT
 
-/* Define to 1 if you have the <sgtty.h> header file. */
-#undef HAVE_SGTTY_H
-
-/* Have working shadow group support in libc */
-#undef HAVE_SHADOWGRP
-
-/* Define to 1 if you have the `snprintf' function. */
-#undef HAVE_SNPRINTF
-
-/* Define to 1 if stdbool.h conforms to C99. */
-#undef HAVE_STDBOOL_H
+/* Define if you have the shl_load function. */
+#undef HAVE_SHL_LOAD
 
 /* Define to 1 if you have the <stdint.h> header file. */
 #undef HAVE_STDINT_H
@@ -256,14 +187,11 @@
 /* Define to 1 if you have the <stdlib.h> header file. */
 #undef HAVE_STDLIB_H
 
-/* Define to 1 if you have the `strcasecmp' function. */
-#undef HAVE_STRCASECMP
+/* Define to 1 if you have the 'stpecpy' function. */
+#undef HAVE_STPECPY
 
-/* Define to 1 if you have the `strdup' function. */
-#undef HAVE_STRDUP
-
-/* Define to 1 if you have the `strerror' function. */
-#undef HAVE_STRERROR
+/* Define to 1 if you have the 'stpeprintf' function. */
+#undef HAVE_STPEPRINTF
 
 /* Define to 1 if you have the <strings.h> header file. */
 #undef HAVE_STRINGS_H
@@ -271,144 +199,57 @@
 /* Define to 1 if you have the <string.h> header file. */
 #undef HAVE_STRING_H
 
-/* Define to 1 if you have the `strstr' function. */
-#undef HAVE_STRSTR
-
-/* Define to 1 if `st_atim' is a member of `struct stat'. */
-#undef HAVE_STRUCT_STAT_ST_ATIM
-
-/* Define to 1 if `st_atimensec' is a member of `struct stat'. */
-#undef HAVE_STRUCT_STAT_ST_ATIMENSEC
-
-/* Define to 1 if `st_mtim' is a member of `struct stat'. */
-#undef HAVE_STRUCT_STAT_ST_MTIM
-
-/* Define to 1 if `st_mtimensec' is a member of `struct stat'. */
-#undef HAVE_STRUCT_STAT_ST_MTIMENSEC
-
-/* Define to 1 if `ut_addr' is a member of `struct utmpx'. */
+/* Define to 1 if 'ut_addr' is a member of 'struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_ADDR
 
-/* Define to 1 if `ut_addr_v6' is a member of `struct utmpx'. */
+/* Define to 1 if 'ut_addr_v6' is a member of 'struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_ADDR_V6
 
-/* Define to 1 if `ut_host' is a member of `struct utmpx'. */
+/* Define to 1 if 'ut_host' is a member of 'struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_HOST
 
-/* Define to 1 if `ut_name' is a member of `struct utmpx'. */
+/* Define to 1 if 'ut_name' is a member of 'struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_NAME
 
-/* Define to 1 if `ut_syslen' is a member of `struct utmpx'. */
+/* Define to 1 if 'ut_syslen' is a member of 'struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_SYSLEN
 
-/* Define to 1 if `ut_time' is a member of `struct utmpx'. */
+/* Define to 1 if 'ut_time' is a member of 'struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_TIME
 
-/* Define to 1 if `ut_xtime' is a member of `struct utmpx'. */
+/* Define to 1 if 'ut_xtime' is a member of 'struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_XTIME
 
-/* Define to 1 if `ut_addr' is a member of `struct utmp'. */
-#undef HAVE_STRUCT_UTMP_UT_ADDR
-
-/* Define to 1 if `ut_addr_v6' is a member of `struct utmp'. */
-#undef HAVE_STRUCT_UTMP_UT_ADDR_V6
-
-/* Define to 1 if `ut_host' is a member of `struct utmp'. */
-#undef HAVE_STRUCT_UTMP_UT_HOST
-
-/* Define to 1 if `ut_id' is a member of `struct utmp'. */
-#undef HAVE_STRUCT_UTMP_UT_ID
-
-/* Define to 1 if `ut_name' is a member of `struct utmp'. */
-#undef HAVE_STRUCT_UTMP_UT_NAME
-
-/* Define to 1 if `ut_syslen' is a member of `struct utmp'. */
-#undef HAVE_STRUCT_UTMP_UT_SYSLEN
-
-/* Define to 1 if `ut_time' is a member of `struct utmp'. */
-#undef HAVE_STRUCT_UTMP_UT_TIME
-
-/* Define to 1 if `ut_tv' is a member of `struct utmp'. */
-#undef HAVE_STRUCT_UTMP_UT_TV
-
-/* Define to 1 if `ut_type' is a member of `struct utmp'. */
-#undef HAVE_STRUCT_UTMP_UT_TYPE
-
-/* Define to 1 if `ut_user' is a member of `struct utmp'. */
-#undef HAVE_STRUCT_UTMP_UT_USER
-
-/* Define to 1 if `ut_xtime' is a member of `struct utmp'. */
-#undef HAVE_STRUCT_UTMP_UT_XTIME
-
-/* Define to 1 if you have the <syslog.h> header file. */
-#undef HAVE_SYSLOG_H
-
-/* Define to 1 if you have the <sys/capability.h> header file. */
-#undef HAVE_SYS_CAPABILITY_H
-
-/* Define to 1 if you have the <sys/ioctl.h> header file. */
-#undef HAVE_SYS_IOCTL_H
-
-/* Define to 1 if you have the <sys/random.h> header file. */
-#undef HAVE_SYS_RANDOM_H
-
-/* Define to 1 if you have the <sys/resource.h> header file. */
-#undef HAVE_SYS_RESOURCE_H
-
 /* Define to 1 if you have the <sys/statfs.h> header file. */
 #undef HAVE_SYS_STATFS_H
 
 /* Define to 1 if you have the <sys/stat.h> header file. */
 #undef HAVE_SYS_STAT_H
 
-/* Define to 1 if you have the <sys/time.h> header file. */
-#undef HAVE_SYS_TIME_H
-
 /* Define to 1 if you have the <sys/types.h> header file. */
 #undef HAVE_SYS_TYPES_H
 
 /* Define to 1 if you have the <tcb.h> header file. */
 #undef HAVE_TCB_H
 
-/* Define to 1 if you have the <termios.h> header file. */
-#undef HAVE_TERMIOS_H
-
-/* Define to 1 if you have the <termio.h> header file. */
-#undef HAVE_TERMIO_H
-
-/* Define to 1 if you have the <ulimit.h> header file. */
-#undef HAVE_ULIMIT_H
-
 /* Define to 1 if you have the <unistd.h> header file. */
 #undef HAVE_UNISTD_H
 
-/* Define to 1 if you have the `updwtmp' function. */
-#undef HAVE_UPDWTMP
-
-/* Define to 1 if you have the `updwtmpx' function. */
+/* Define to 1 if you have the 'updwtmpx' function. */
 #undef HAVE_UPDWTMPX
 
 /* Define to 1 if you have the <utime.h> header file. */
 #undef HAVE_UTIME_H
 
-/* Define to 1 if `utime(file, NULL)' sets file's timestamp to the present. */
+/* Define to 1 if 'utime(file, NULL)' sets file's timestamp to the present. */
 #undef HAVE_UTIME_NULL
 
-/* Define to 1 if you have the <utmpx.h> header file. */
-#undef HAVE_UTMPX_H
-
-/* Define to 1 if you have the <utmp.h> header file. */
-#undef HAVE_UTMP_H
+/* Define to support vendor settings. */
+#undef HAVE_VENDORDIR
 
 /* Define to 1 if you have the <wchar.h> header file. */
 #undef HAVE_WCHAR_H
 
-/* Define to 1 if the system has the type `_Bool'. */
-#undef HAVE__BOOL
-
-/* Path for lastlog file. */
-#undef LASTLOG_FILE
-
 /* Define to the sub-directory where libtool stores uninstalled libraries. */
 #undef LT_OBJDIR
 
@@ -442,12 +283,6 @@
 /* Path to passwd program. */
 #undef PASSWD_PROGRAM
 
-/* Define if login should support the -r flag for rlogind. */
-#undef RLOGIN
-
-/* Define to the ruserok() "success" return value (0 or 1). */
-#undef RUSEROK
-
 /* Define to support the shadow group file. */
 #undef SHADOWGRP
 
@@ -457,10 +292,10 @@
 /* The default shell. */
 #undef SHELL
 
-/* The size of `gid_t', as computed by sizeof. */
+/* The size of 'gid_t', as computed by sizeof. */
 #undef SIZEOF_GID_T
 
-/* The size of `uid_t', as computed by sizeof. */
+/* The size of 'uid_t', as computed by sizeof. */
 #undef SIZEOF_UID_T
 
 /* Define to support S/Key logins. */
@@ -469,7 +304,7 @@
 /* Define to support newer BSD S/Key API */
 #undef SKEY_BSD_STYLE
 
-/* Define to 1 if all of the C90 standard headers exist (not just the ones
+/* Define to 1 if all of the C89 standard headers exist (not just the ones
    required in a freestanding environment). This macro is provided for
    backward compatibility; new code need not use it. */
 #undef STDC_HEADERS
@@ -477,9 +312,6 @@
 /* Define to support /etc/suauth su access control. */
 #undef SU_ACCESS
 
-/* Define to 1 if your <sys/time.h> declares `struct tm'. */
-#undef TM_IN_SYS_TIME
-
 /* Define to allow the bcrypt password encryption algorithm */
 #undef USE_BCRYPT
 
@@ -495,10 +327,7 @@
 /* Define to support flushing of sssd caches */
 #undef USE_SSSD
 
-/* Define to use syslog(). */
-#undef USE_SYSLOG
-
-/* Enable extensions on AIX 3, Interix.  */
+/* Enable extensions on AIX, Interix, z/OS.  */
 #ifndef _ALL_SOURCE
 # undef _ALL_SOURCE
 #endif
@@ -559,11 +388,15 @@
 #ifndef __STDC_WANT_IEC_60559_DFP_EXT__
 # undef __STDC_WANT_IEC_60559_DFP_EXT__
 #endif
+/* Enable extensions specified by C23 Annex F.  */
+#ifndef __STDC_WANT_IEC_60559_EXT__
+# undef __STDC_WANT_IEC_60559_EXT__
+#endif
 /* Enable extensions specified by ISO/IEC TS 18661-4:2015.  */
 #ifndef __STDC_WANT_IEC_60559_FUNCS_EXT__
 # undef __STDC_WANT_IEC_60559_FUNCS_EXT__
 #endif
-/* Enable extensions specified by ISO/IEC TS 18661-3:2015.  */
+/* Enable extensions specified by C23 Annex H and ISO/IEC TS 18661-3:2015.  */
 #ifndef __STDC_WANT_IEC_60559_TYPES_EXT__
 # undef __STDC_WANT_IEC_60559_TYPES_EXT__
 #endif
@@ -586,12 +419,12 @@
 #endif
 
 
-/* Define if utmpx should be used */
-#undef USE_UTMPX
-
 /* Define to allow the yescrypt password encryption algorithm */
 #undef USE_YESCRYPT
 
+/* Directory for distribution provided configuration files */
+#undef VENDORDIR
+
 /* Version number of package */
 #undef VERSION
 
@@ -607,6 +440,9 @@
 /* Build shadow with BtrFS support */
 #undef WITH_BTRFS
 
+/* Build shadow without libbsd support */
+#undef WITH_LIBBSD
+
 /* Build shadow with SELinux support */
 #undef WITH_SELINUX
 
@@ -619,17 +455,11 @@
 /* Number of bits in a file offset, on hosts where this is settable. */
 #undef _FILE_OFFSET_BITS
 
-/* Define for large files, on AIX-style hosts. */
+/* Define to 1 on platforms where this makes off_t a 64-bit type. */
 #undef _LARGE_FILES
 
-/* Path for utmp file. */
-#undef _UTMP_FILE
+/* Number of bits in time_t, on hosts where this is settable. */
+#undef _TIME_BITS
 
-/* Path for wtmp file. */
-#undef _WTMP_FILE
-
-/* Define to `int' if <sys/types.h> doesn't define. */
-#undef gid_t
-
-/* Define to `int' if <sys/types.h> doesn't define. */
-#undef uid_t
+/* Define to 1 on platforms where this makes time_t a 64-bit type. */
+#undef __MINGW_USE_VC2005_COMPAT

contrib/Makefile.am

@@ -1,6 +0,0 @@
-# This is a dummy Makefile.am to get automake work flawlessly,
-# and also cooperate to make a distribution for `make dist'
-
-EXTRA_DIST = README adduser.c adduser.sh adduser2.sh \
- atudel groupmems.shar pwdauth.c shadow-anonftp.patch \
- udbachk.tgz

contrib/Makefile.in

@@ -1,496 +0,0 @@
-# Makefile.in generated by automake 1.16.5 from Makefile.am.
-# @configure_input@
-
-# Copyright (C) 1994-2021 Free Software Foundation, Inc.
-
-# This Makefile.in is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
-# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
-# PARTICULAR PURPOSE.
-
-@SET_MAKE@
-
-# This is a dummy Makefile.am to get automake work flawlessly,
-# and also cooperate to make a distribution for `make dist'
-VPATH = @srcdir@
-am__is_gnu_make = { \
-  if test -z '$(MAKELEVEL)'; then \
-    false; \
-  elif test -n '$(MAKE_HOST)'; then \
-    true; \
-  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
-    true; \
-  else \
-    false; \
-  fi; \
-}
-am__make_running_with_option = \
-  case $${target_option-} in \
-      ?) ;; \
-      *) echo "am__make_running_with_option: internal error: invalid" \
-              "target option '$${target_option-}' specified" >&2; \
-         exit 1;; \
-  esac; \
-  has_opt=no; \
-  sane_makeflags=$$MAKEFLAGS; \
-  if $(am__is_gnu_make); then \
-    sane_makeflags=$$MFLAGS; \
-  else \
-    case $$MAKEFLAGS in \
-      *\\[\ \	]*) \
-        bs=\\; \
-        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
-          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
-    esac; \
-  fi; \
-  skip_next=no; \
-  strip_trailopt () \
-  { \
-    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
-  }; \
-  for flg in $$sane_makeflags; do \
-    test $$skip_next = yes && { skip_next=no; continue; }; \
-    case $$flg in \
-      *=*|--*) continue;; \
-        -*I) strip_trailopt 'I'; skip_next=yes;; \
-      -*I?*) strip_trailopt 'I';; \
-        -*O) strip_trailopt 'O'; skip_next=yes;; \
-      -*O?*) strip_trailopt 'O';; \
-        -*l) strip_trailopt 'l'; skip_next=yes;; \
-      -*l?*) strip_trailopt 'l';; \
-      -[dEDm]) skip_next=yes;; \
-      -[JT]) skip_next=yes;; \
-    esac; \
-    case $$flg in \
-      *$$target_option*) has_opt=yes; break;; \
-    esac; \
-  done; \
-  test $$has_opt = yes
-am__make_dryrun = (target_option=n; $(am__make_running_with_option))
-am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
-pkgdatadir = $(datadir)/@PACKAGE@
-pkgincludedir = $(includedir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
-pkglibexecdir = $(libexecdir)/@PACKAGE@
-am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
-install_sh_DATA = $(install_sh) -c -m 644
-install_sh_PROGRAM = $(install_sh) -c
-install_sh_SCRIPT = $(install_sh) -c
-INSTALL_HEADER = $(INSTALL_DATA)
-transform = $(program_transform_name)
-NORMAL_INSTALL = :
-PRE_INSTALL = :
-POST_INSTALL = :
-NORMAL_UNINSTALL = :
-PRE_UNINSTALL = :
-POST_UNINSTALL = :
-build_triplet = @build@
-host_triplet = @host@
-subdir = contrib
-ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
-	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
-	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
-	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
-	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
-	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
-	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
-	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/acinclude.m4 \
-	$(top_srcdir)/configure.ac
-am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
-	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
-mkinstalldirs = $(install_sh) -d
-CONFIG_HEADER = $(top_builddir)/config.h
-CONFIG_CLEAN_FILES =
-CONFIG_CLEAN_VPATH_FILES =
-AM_V_P = $(am__v_P_@AM_V@)
-am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
-am__v_P_0 = false
-am__v_P_1 = :
-AM_V_GEN = $(am__v_GEN_@AM_V@)
-am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
-am__v_GEN_0 = @echo "  GEN     " $@;
-am__v_GEN_1 = 
-AM_V_at = $(am__v_at_@AM_V@)
-am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
-am__v_at_0 = @
-am__v_at_1 = 
-SOURCES =
-DIST_SOURCES =
-am__can_run_installinfo = \
-  case $$AM_UPDATE_INFO_DIR in \
-    n|no|NO) false;; \
-    *) (install-info --version) >/dev/null 2>&1;; \
-  esac
-am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
-am__DIST_COMMON = $(srcdir)/Makefile.in README
-DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
-ACLOCAL = @ACLOCAL@
-AMTAR = @AMTAR@
-AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
-AR = @AR@
-AUTOCONF = @AUTOCONF@
-AUTOHEADER = @AUTOHEADER@
-AUTOMAKE = @AUTOMAKE@
-AWK = @AWK@
-CC = @CC@
-CCDEPMODE = @CCDEPMODE@
-CFLAGS = @CFLAGS@
-CPP = @CPP@
-CPPFLAGS = @CPPFLAGS@
-CSCOPE = @CSCOPE@
-CTAGS = @CTAGS@
-CYGPATH_W = @CYGPATH_W@
-DEFS = @DEFS@
-DEPDIR = @DEPDIR@
-DLLTOOL = @DLLTOOL@
-DSYMUTIL = @DSYMUTIL@
-DUMPBIN = @DUMPBIN@
-ECHO_C = @ECHO_C@
-ECHO_N = @ECHO_N@
-ECHO_T = @ECHO_T@
-ECONF_CPPFLAGS = @ECONF_CPPFLAGS@
-EGREP = @EGREP@
-ETAGS = @ETAGS@
-EXEEXT = @EXEEXT@
-FGREP = @FGREP@
-GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
-GMSGFMT = @GMSGFMT@
-GMSGFMT_015 = @GMSGFMT_015@
-GREP = @GREP@
-GROUP_NAME_MAX_LENGTH = @GROUP_NAME_MAX_LENGTH@
-INSTALL = @INSTALL@
-INSTALL_DATA = @INSTALL_DATA@
-INSTALL_PROGRAM = @INSTALL_PROGRAM@
-INSTALL_SCRIPT = @INSTALL_SCRIPT@
-INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-INTLLIBS = @INTLLIBS@
-INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
-LD = @LD@
-LDFLAGS = @LDFLAGS@
-LIBACL = @LIBACL@
-LIBATTR = @LIBATTR@
-LIBAUDIT = @LIBAUDIT@
-LIBCRACK = @LIBCRACK@
-LIBCRYPT = @LIBCRYPT@
-LIBECONF = @LIBECONF@
-LIBICONV = @LIBICONV@
-LIBINTL = @LIBINTL@
-LIBMD = @LIBMD@
-LIBOBJS = @LIBOBJS@
-LIBPAM = @LIBPAM@
-LIBS = @LIBS@
-LIBSELINUX = @LIBSELINUX@
-LIBSEMANAGE = @LIBSEMANAGE@
-LIBSKEY = @LIBSKEY@
-LIBSUBID_ABI = @LIBSUBID_ABI@
-LIBSUBID_ABI_MAJOR = @LIBSUBID_ABI_MAJOR@
-LIBSUBID_ABI_MICRO = @LIBSUBID_ABI_MICRO@
-LIBSUBID_ABI_MINOR = @LIBSUBID_ABI_MINOR@
-LIBTCB = @LIBTCB@
-LIBTOOL = @LIBTOOL@
-LIPO = @LIPO@
-LIYESCRYPT = @LIYESCRYPT@
-LN_S = @LN_S@
-LTLIBICONV = @LTLIBICONV@
-LTLIBINTL = @LTLIBINTL@
-LTLIBOBJS = @LTLIBOBJS@
-LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
-MAINT = @MAINT@
-MAKEINFO = @MAKEINFO@
-MANIFEST_TOOL = @MANIFEST_TOOL@
-MKDIR_P = @MKDIR_P@
-MSGFMT = @MSGFMT@
-MSGFMT_015 = @MSGFMT_015@
-MSGMERGE = @MSGMERGE@
-NM = @NM@
-NMEDIT = @NMEDIT@
-OBJDUMP = @OBJDUMP@
-OBJEXT = @OBJEXT@
-OTOOL = @OTOOL@
-OTOOL64 = @OTOOL64@
-PACKAGE = @PACKAGE@
-PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
-PACKAGE_NAME = @PACKAGE_NAME@
-PACKAGE_STRING = @PACKAGE_STRING@
-PACKAGE_TARNAME = @PACKAGE_TARNAME@
-PACKAGE_URL = @PACKAGE_URL@
-PACKAGE_VERSION = @PACKAGE_VERSION@
-PATH_SEPARATOR = @PATH_SEPARATOR@
-POSUB = @POSUB@
-RANLIB = @RANLIB@
-SED = @SED@
-SET_MAKE = @SET_MAKE@
-SHELL = @SHELL@
-STRIP = @STRIP@
-USE_NLS = @USE_NLS@
-VENDORDIR = @VENDORDIR@
-VERSION = @VERSION@
-XGETTEXT = @XGETTEXT@
-XGETTEXT_015 = @XGETTEXT_015@
-XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
-XMLCATALOG = @XMLCATALOG@
-XML_CATALOG_FILE = @XML_CATALOG_FILE@
-XSLTPROC = @XSLTPROC@
-YACC = @YACC@
-YFLAGS = @YFLAGS@
-abs_builddir = @abs_builddir@
-abs_srcdir = @abs_srcdir@
-abs_top_builddir = @abs_top_builddir@
-abs_top_srcdir = @abs_top_srcdir@
-ac_ct_AR = @ac_ct_AR@
-ac_ct_CC = @ac_ct_CC@
-ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
-am__include = @am__include@
-am__leading_dot = @am__leading_dot@
-am__quote = @am__quote@
-am__tar = @am__tar@
-am__untar = @am__untar@
-bindir = @bindir@
-build = @build@
-build_alias = @build_alias@
-build_cpu = @build_cpu@
-build_os = @build_os@
-build_vendor = @build_vendor@
-builddir = @builddir@
-capcmd = @capcmd@
-datadir = @datadir@
-datarootdir = @datarootdir@
-docdir = @docdir@
-dvidir = @dvidir@
-exec_prefix = @exec_prefix@
-host = @host@
-host_alias = @host_alias@
-host_cpu = @host_cpu@
-host_os = @host_os@
-host_vendor = @host_vendor@
-htmldir = @htmldir@
-includedir = @includedir@
-infodir = @infodir@
-install_sh = @install_sh@
-libdir = @libdir@
-libexecdir = @libexecdir@
-localedir = @localedir@
-localstatedir = @localstatedir@
-mandir = @mandir@
-mkdir_p = @mkdir_p@
-oldincludedir = @oldincludedir@
-pdfdir = @pdfdir@
-prefix = @prefix@
-program_transform_name = @program_transform_name@
-psdir = @psdir@
-runstatedir = @runstatedir@
-sbindir = @sbindir@
-sharedstatedir = @sharedstatedir@
-srcdir = @srcdir@
-sysconfdir = @sysconfdir@
-target_alias = @target_alias@
-top_build_prefix = @top_build_prefix@
-top_builddir = @top_builddir@
-top_srcdir = @top_srcdir@
-EXTRA_DIST = README adduser.c adduser.sh adduser2.sh \
- atudel groupmems.shar pwdauth.c shadow-anonftp.patch \
- udbachk.tgz
-
-all: all-am
-
-.SUFFIXES:
-$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am  $(am__configure_deps)
-	@for dep in $?; do \
-	  case '$(am__configure_deps)' in \
-	    *$$dep*) \
-	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
-	        && { if test -f $@; then exit 0; else break; fi; }; \
-	      exit 1;; \
-	  esac; \
-	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign contrib/Makefile'; \
-	$(am__cd) $(top_srcdir) && \
-	  $(AUTOMAKE) --foreign contrib/Makefile
-Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
-	@case '$?' in \
-	  *config.status*) \
-	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
-	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
-	esac;
-
-$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-
-$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-$(am__aclocal_m4_deps):
-
-mostlyclean-libtool:
-	-rm -f *.lo
-
-clean-libtool:
-	-rm -rf .libs _libs
-tags TAGS:
-
-ctags CTAGS:
-
-cscope cscopelist:
-
-distdir: $(BUILT_SOURCES)
-	$(MAKE) $(AM_MAKEFLAGS) distdir-am
-
-distdir-am: $(DISTFILES)
-	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
-	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
-	list='$(DISTFILES)'; \
-	  dist_files=`for file in $$list; do echo $$file; done | \
-	  sed -e "s|^$$srcdirstrip/||;t" \
-	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
-	case $$dist_files in \
-	  */*) $(MKDIR_P) `echo "$$dist_files" | \
-			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
-			   sort -u` ;; \
-	esac; \
-	for file in $$dist_files; do \
-	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
-	  if test -d $$d/$$file; then \
-	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
-	    if test -d "$(distdir)/$$file"; then \
-	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
-	    fi; \
-	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
-	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
-	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
-	    fi; \
-	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
-	  else \
-	    test -f "$(distdir)/$$file" \
-	    || cp -p $$d/$$file "$(distdir)/$$file" \
-	    || exit 1; \
-	  fi; \
-	done
-check-am: all-am
-check: check-am
-all-am: Makefile
-installdirs:
-install: install-am
-install-exec: install-exec-am
-install-data: install-data-am
-uninstall: uninstall-am
-
-install-am: all-am
-	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
-
-installcheck: installcheck-am
-install-strip:
-	if test -z '$(STRIP)'; then \
-	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
-	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
-	      install; \
-	else \
-	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
-	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
-	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
-	fi
-mostlyclean-generic:
-
-clean-generic:
-
-distclean-generic:
-	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
-
-maintainer-clean-generic:
-	@echo "This command is intended for maintainers to use"
-	@echo "it deletes files that may require special tools to rebuild."
-clean: clean-am
-
-clean-am: clean-generic clean-libtool mostlyclean-am
-
-distclean: distclean-am
-	-rm -f Makefile
-distclean-am: clean-am distclean-generic
-
-dvi: dvi-am
-
-dvi-am:
-
-html: html-am
-
-html-am:
-
-info: info-am
-
-info-am:
-
-install-data-am:
-
-install-dvi: install-dvi-am
-
-install-dvi-am:
-
-install-exec-am:
-
-install-html: install-html-am
-
-install-html-am:
-
-install-info: install-info-am
-
-install-info-am:
-
-install-man:
-
-install-pdf: install-pdf-am
-
-install-pdf-am:
-
-install-ps: install-ps-am
-
-install-ps-am:
-
-installcheck-am:
-
-maintainer-clean: maintainer-clean-am
-	-rm -f Makefile
-maintainer-clean-am: distclean-am maintainer-clean-generic
-
-mostlyclean: mostlyclean-am
-
-mostlyclean-am: mostlyclean-generic mostlyclean-libtool
-
-pdf: pdf-am
-
-pdf-am:
-
-ps: ps-am
-
-ps-am:
-
-uninstall-am:
-
-.MAKE: install-am install-strip
-
-.PHONY: all all-am check check-am clean clean-generic clean-libtool \
-	cscopelist-am ctags-am distclean distclean-generic \
-	distclean-libtool distdir dvi dvi-am html html-am info info-am \
-	install install-am install-data install-data-am install-dvi \
-	install-dvi-am install-exec install-exec-am install-html \
-	install-html-am install-info install-info-am install-man \
-	install-pdf install-pdf-am install-ps install-ps-am \
-	install-strip installcheck installcheck-am installdirs \
-	maintainer-clean maintainer-clean-generic mostlyclean \
-	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
-	tags-am uninstall uninstall-am
-
-.PRECIOUS: Makefile
-
-
-# Tell versions [3.59,3.63) of GNU make to not export all variables.
-# Otherwise a system limit (for SysV at least) may be exceeded.
-.NOEXPORT:

contrib/README

@@ -1,10 +0,0 @@
-People keep sending various adduser programs and scripts...  They are
-all in this directory.  I haven't tested them, use at your own risk.
-Anyway, the best one I've seen so far is adduser-3.x from Debian.
-
-atudel is a perl script to remove at jobs owned by the specified user
-(atrm in at-2.9 for Linux can't do that).
-
-udbachk.tgz is a passwd/group/shadow file integrity checker.
-
---marekm

contrib/adduser.c

@@ -1,502 +0,0 @@
-/****
-** 04/21/96
-** hacked even more, replaced gets() with something slightly harder to buffer
-** overflow. Added support for setting a default quota on new account, with
-** edquota -p. Other cleanups for security, I let some users run adduser suid
-** root to add new accounts. (overflow checks, clobber environment, valid 
-** shell checks, restrictions on gid + home dir settings).
-
-** Added max. username length. Used syslog() a bit for important events. 
-** Support to immediately expire account with passwd -e.
-
-** Called it version 2.0! Because I felt like it!
-
-** -- Chris, chris@ferret.lmh.ox.ac.uk
-
-** 03/17/96
-** hacked a bit more, removed unused code, cleaned up for gcc -Wall.
-** --marekm
-**
-** 02/26/96
-** modified to call shadow utils (useradd,chage,passwd) on shadowed 
-** systems - Cristian Gafton, gafton@sorosis.ro
-**
-** 6/27/95
-** shadow-adduser 1.4:
-**
-** now it copies the /etc/skel dir into the person's dir, 
-** makes the mail folders, changed some defaults and made a 'make 
-** install' just for the hell of it.
-**
-** Greg Gallagher
-** CIN.Net
-**
-** 1/28/95
-** shadow-adduser 1.3:
-** 
-** Basically a bug-fix on my additions in 1.2.  Thanks to Terry Stewart 
-** (stew@texas.net) for pointing out one of the many idiotic bugs I introduced.
-** It was such a stupid bug that I would have never seen it myself.
-**
-**                                Brandon
-*****
-** 01/27/95
-** 
-** shadow-adduser 1.2:
-** I took the C source from adduser-shadow (credits are below) and made
-** it a little more worthwhile.  Many small changes... Here's
-** the ones I can remember:
-** 
-** Removed support for non-shadowed systems (if you don't have shadow,
-**     use the original adduser, don't get this shadow version!)
-** Added support for the correct /etc/shadow fields (Min days before
-**     password change, max days before password change, Warning days,
-**     and how many days from expiry date does the account go invalid)
-**     The previous version just left all of those fields blank.
-**     There is still one field left (expiry date for the account, period)
-**     which I have left blank because I do not use it and didn't want to
-**     spend any more time on this.  I'm sure someone will put it in and
-**     tack another plethora of credits on here. :)
-** Added in the password date field, which should always reflect the last
-**     date the password was changed, for expiry purposes.  "passwd" always
-**     updates this field, so the adduser program should set it up right
-**     initially (or a user could keep thier initial password forever ;)
-**     The number is in days since Jan 1st, 1970.
-**
-**                       Have fun with it, and someone please make
-**                       a real version(this is still just a hack)
-**                       for us all to use (and Email it to me???)
-**
-**                               Brandon
-**                                  photon@usis.com
-**
-***** 
-** adduser 1.0: add a new user account (For systems not using shadow)
-** With a nice little interface and a will to do all the work for you.
-**
-** Craig Hagan
-** hagan@opine.cs.umass.edu
-**
-** Modified to really work, look clean, and find unused uid by Chris Cappuccio
-** chris@slinky.cs.umass.edu
-**
-*****
-**
-** 01/19/95
-**
-** FURTHER modifications to enable shadow passwd support (kludged, but
-** no more so than the original)  by Dan Crowson - dcrowson@mo.net
-**
-** Search on DAN for all changes...
-**
-*****
-**
-** cc -O -o adduser adduser.c
-** Use gcc if you have it... (political reasons beyond my control) (chris)
-**
-** I've gotten this program to work with success under Linux (without
-** shadow) and SunOS 4.1.3. I would assume it should work pretty well
-** on any system that uses no shadow. (chris)
-**
-** If you have no crypt() then try
-** cc -DNO_CRYPT -O -o adduser adduser.c xfdes.c
-** I'm not sure how login operates with no crypt()... I guess
-** the same way we're doing it here.
-*/
-
-#include <unistd.h>
-#include <stdlib.h>
-#include <pwd.h>
-#include <grp.h>
-#include <ctype.h>
-#include <stdio.h>
-#include <string.h>
-#include <time.h>
-#include <sys/types.h>
-#include <sys/timeb.h>
-#include <sys/time.h>
-#include <sys/stat.h>
-#include <syslog.h>
-
-#define IMMEDIATE_CHANGE	/* Expire newly created password, must be changed
-				 * immediately upon next login */
-#define HAVE_QUOTAS		/* Obvious */
-#define EXPIRE_VALS_SET		/* If defined, 'normal' users can't change 
-				 * password expiry values (if running suid root) */
-
-#define HAVE_GETUSERSHELL	/* FIXME: Isn't this defined in config.h too? */
-#define LOGGING			/* If we want to log various things to syslog */
-#define MAX_USRNAME  8		/* Longer usernames seem to work on my system....
-				 * But they're probably a poor idea */
-
-
-#define DEFAULT_SHELL	"/bin/bash"	/* because BASH is your friend */
-#define DEFAULT_HOME	"/home"
-#define USERADD_PATH	"/usr/sbin/useradd"
-#define CHAGE_PATH	"/usr/bin/chage"
-#define PASSWD_PATH	"/usr/bin/passwd"
-#define EDQUOTA_PATH	"/usr/sbin/edquota"
-#define QUOTA_DEFAULT	"defuser"
-#define DEFAULT_GROUP	100
-
-#define DEFAULT_MIN_PASS 0
-#define DEFAULT_MAX_PASS 100
-#define DEFAULT_WARN_PASS 14
-#define DEFAULT_USER_DIE 366
-
-void safeget (char *, int);
-
-void 
-main (void)
-{
-  char foo[32];
-  char usrname[32], person[32], dir[32], shell[32];
-  unsigned int group, min_pass, max_pass, warn_pass, user_die;
-  /* the group and uid of the new user */
-  int bad = 0, done = 0, correct = 0, olduid;
-  char cmd[255];
-  struct group *grp;
-
-  /* flags, in order:
-   * bad to see if the username is in /etc/passwd, or if strange stuff has
-   * been typed if the user might be put in group 0
-   * done allows the program to exit when a user has been added
-   * correct loops until a username is found that isn't in /etc/passwd
-   */
-
-  /* The real program starts HERE! */
-
-  if (geteuid () != 0)
-    {
-      printf ("It seems you don't have access to add a new user.  Try\n");
-      printf ("logging in as root or su root to gain superuser access.\n");
-      exit (1);
-    }
-
-  /* Sanity checks
-   */
-
-#ifdef LOGGING
-  openlog ("adduser", LOG_PID | LOG_CONS | LOG_NOWAIT, LOG_AUTH);
-  syslog (LOG_INFO, "invoked by user %s\n", getpwuid (getuid ())->pw_name);
-#endif
-
-  if (!(grp = getgrgid (DEFAULT_GROUP)))
-    {
-      printf ("Error: the default group %d does not exist on this system!\n",
-	      DEFAULT_GROUP);
-      printf ("adduser must be recompiled.\n");
-#ifdef LOGGING
-      syslog (LOG_ERR, "warning: failed. no such default group\n");
-      closelog ();
-#endif
-      exit (1);
-    };
-
-  while (!correct)
-    {				/* loop until a "good" usrname is chosen */
-      while (!done)
-	{
-	  printf ("\nLogin to add (^C to quit): ");
-	  fflush (stdout);
-
-	  safeget (usrname, sizeof (usrname));
-
-	  if (!strlen (usrname))
-	    {
-	      printf ("Empty input.\n");
-	      done = 0;
-	      continue;
-	    };
-
-	  /* what I saw here before made me think maybe I was running DOS */
-	  /* might this be a solution? (chris) */
-	  if (strlen (usrname) > MAX_USRNAME)
-	    {
-	      printf ("That name is longer than the maximum of %d characters. Choose another.\n", MAX_USRNAME);
-	      done = 0;
-	    }
-	  else if (getpwnam (usrname) != NULL)
-	    {
-	      printf ("That name is in use, choose another.\n");
-	      done = 0;
-	    }
-	  else if (strchr (usrname, ' ') != NULL)
-	    {
-	      printf ("No spaces in username!!\n");
-	      done = 0;
-	    }
-	  else
-	    done = 1;
-	};			/* done, we have a valid new user name */
-
-      /* all set, get the rest of the stuff */
-      printf ("\nEditing information for new user [%s]\n", usrname);
-
-      printf ("\nFull Name [%s]: ", usrname);
-      fflush (stdout);
-      safeget (person, sizeof (person));
-      if (!strlen (person))
-	{
-	  bzero (person, sizeof (person));
-	  strcpy (person, usrname);
-	};
-
-      if (getuid () == 0)
-	{
-	  do
-	    {
-	      bad = 0;
-	      printf ("GID [%d]: ", DEFAULT_GROUP);
-	      fflush (stdout);
-	      safeget (foo, sizeof (foo));
-	      if (!strlen (foo))
-		group = DEFAULT_GROUP;
-	      else if (isdigit (*foo))
-		{
-		  group = atoi (foo);
-		  if (!(grp = getgrgid (group)))
-		    {
-		      printf ("unknown gid %s\n", foo);
-		      group = DEFAULT_GROUP;
-		      bad = 1;
-		    };
-		}
-	      else if ((grp = getgrnam (foo)))
-		group = grp->gr_gid;
-	      else
-		{
-		  printf ("unknown group %s\n", foo);
-		  group = DEFAULT_GROUP;
-		  bad = 1;
-		}
-	      if (group == 0)
-		{		/* You're not allowed to make root group users! */
-		  printf ("Creation of root group users not allowed (must be done by hand)\n");
-		  group = DEFAULT_GROUP;
-		  bad = 1;
-		};
-	    }
-	  while (bad);
-	}
-      else
-	{
-	  printf ("Group will be default of: %d\n", DEFAULT_GROUP);
-	  group = DEFAULT_GROUP;
-	}
-
-      if (getuid () == 0)
-	{
-	  printf ("\nIf home dir ends with a / then '%s' will be appended to it\n", usrname);
-	  printf ("Home Directory [%s/%s]: ", DEFAULT_HOME, usrname);
-	  fflush (stdout);
-	  safeget (dir, sizeof (dir));
-	  if (!strlen (dir))
-	    {			/* hit return */
-	      sprintf (dir, "%s/%s", DEFAULT_HOME, usrname);
-	    }
-	  else if (dir[strlen (dir) - 1] == '/')
-	    sprintf (dir+strlen(dir), "%s", usrname);
-	}
-      else
-	{
-	  printf ("\nHome directory will be %s/%s\n", DEFAULT_HOME, usrname);
-	  sprintf (dir, "%s/%s", DEFAULT_HOME, usrname);
-	}
-
-      printf ("\nShell [%s]: ", DEFAULT_SHELL);
-      fflush (stdout);
-      safeget (shell, sizeof (shell));
-      if (!strlen (shell))
-	sprintf (shell, "%s", DEFAULT_SHELL);
-      else
-	{
-	  char *sh;
-	  int ok = 0;
-#ifdef HAVE_GETUSERSHELL
-	  setusershell ();
-	  while ((sh = getusershell ()) != NULL)
-	    if (!strcmp (shell, sh))
-	      ok = 1;
-	  endusershell ();
-#endif
-	  if (!ok)
-	    {
-	      if (getuid () == 0)
-		printf ("Warning: root allowed non standard shell\n");
-	      else
-		{
-		  printf ("Shell NOT in /etc/shells, DEFAULT used\n");
-		  sprintf (shell, "%s", DEFAULT_SHELL);
-		}
-	    }
-	}
-
-#ifdef EXPIRE_VALS_SET
-      if (getuid () == 0)
-	{
-#endif
-	  printf ("\nMin. Password Change Days [%d]: ", DEFAULT_MIN_PASS);
-	  fflush (stdout);
-	  safeget (foo, sizeof (foo));
-	  if (strlen (foo) > 1)
-	    min_pass = DEFAULT_MIN_PASS;
-	  else
-	    min_pass = atoi (foo);
-
-	  printf ("Max. Password Change Days [%d]: ", DEFAULT_MAX_PASS);
-	  fflush (stdout);
-	  safeget (foo, sizeof (foo));
-	  if (strlen (foo) > 1)
-	    max_pass = atoi (foo);
-	  else
-	    max_pass = DEFAULT_MAX_PASS;
-
-	  printf ("Password Warning Days [%d]: ", DEFAULT_WARN_PASS);
-	  fflush (stdout);
-	  safeget (foo, sizeof (foo));
-	  warn_pass = atoi (foo);
-	  if (warn_pass == 0)
-
-	    warn_pass = DEFAULT_WARN_PASS;
-
-	  printf ("Days after Password Expiry for Account Locking [%d]: ", DEFAULT_USER_DIE);
-	  fflush (stdout);
-	  safeget (foo, sizeof (foo));
-	  user_die = atoi (foo);
-	  if (user_die == 0)
-	    user_die = DEFAULT_USER_DIE;
-
-#ifdef EXPIRE_VALS_SET
-	}
-      else
-	{
-	  printf ("\nSorry, account expiry values are set.\n");
-	  user_die = DEFAULT_USER_DIE;
-	  warn_pass = DEFAULT_WARN_PASS;
-	  max_pass = DEFAULT_MAX_PASS;
-	  min_pass = DEFAULT_MIN_PASS;
-	}
-#endif
-
-      printf ("\nInformation for new user [%s] [%s]:\n", usrname, person);
-      printf ("Home directory: [%s] Shell: [%s]\n", dir, shell);
-      printf ("GID: [%d]\n", group);
-      printf ("MinPass: [%d] MaxPass: [%d] WarnPass: [%d] UserExpire: [%d]\n",
-	      min_pass, max_pass, warn_pass, user_die);
-      printf ("\nIs this correct? [y/N]: ");
-      fflush (stdout);
-      safeget (foo, sizeof (foo));
-
-      done = bad = correct = (foo[0] == 'y' || foo[0] == 'Y');
-
-      if (bad != 1)
-	printf ("\nUser [%s] not added\n", usrname);
-    }
-
-  /* Clobber the environment, I run this suid root sometimes to let 
-   * non root privileged accounts add users --chris */
-
-  *environ = NULL;
-
-  bzero (cmd, sizeof (cmd));
-  sprintf (cmd, "%s -g %d -d %s -s %s -c \"%s\" -m -k /etc/skel %s",
-	   USERADD_PATH, group, dir, shell, person, usrname);
-  printf ("Calling useradd to add new user:\n%s\n", cmd);
-  if (system (cmd))
-    {
-      printf ("User add failed!\n");
-#ifdef LOGGING
-      syslog (LOG_ERR, "could not add new user\n");
-      closelog ();
-#endif
-      exit (errno);
-    };
-
-  olduid = getuid ();	/* chage, passwd, edquota etc. require ruid = root
-			 */
-  setuid (0);
-
-  bzero (cmd, sizeof (cmd));
-
-  /* Chage runs suid root. => we need ruid root to run it with
-   * anything other than chage -l
-   */
-
-  sprintf (cmd, "%s -m %d -M %d -W %d -I %d %s", CHAGE_PATH,
-	   min_pass, max_pass, warn_pass, user_die, usrname);
-  printf ("%s\n", cmd);
-  if (system (cmd))
-    {
-      printf ("There was an error setting password expire values\n");
-#ifdef LOGGING
-      syslog (LOG_ERR, "password expire values could not be set\n");
-#endif
-    };
-
-  /* I want to add a user completely with one easy command --chris */
-
-#ifdef HAVE_QUOTAS
-  bzero (cmd, sizeof (cmd));
-  sprintf (cmd, "%s -p %s -u %s", EDQUOTA_PATH, QUOTA_DEFAULT, usrname);
-  printf ("%s\n", cmd);
-  if (system (cmd))
-    {
-      printf ("\nWarning: error setting quota\n");
-#ifdef LOGGING
-      syslog (LOG_ERR, "warning: account created but NO quotas set!\n");
-#endif /* LOGGING */
-    }
-  else
-    printf ("\nDefault quota set.\n");
-#endif /* HAVE_QUOTAS */
-
-  bzero (cmd, sizeof (cmd));
-  sprintf (cmd, "%s %s", PASSWD_PATH, usrname);
-  if (system (cmd))
-    {
-      printf ("\nWarning: error setting password\n");
-#ifdef LOGGING
-      syslog (LOG_ERR, "warning: password set failed!\n");
-#endif
-    }
-#ifdef IMMEDIATE_CHANGE
-  bzero (cmd, sizeof (cmd));
-  sprintf (cmd, "%s -e %s", PASSWD_PATH, usrname);
-  if (system (cmd))
-    {
-      printf ("\nWarning: error expiring password\n");
-#ifdef LOGGING
-      syslog (LOG_ERR, "warning: password expire failed!\n");
-#endif /* LOGGING */
-    }
-#endif /* IMMEDIATE_CHANGE */
-
-  setuid (olduid);
-
-#ifdef LOGGING
-  closelog ();
-#endif
-
-  printf ("\nDone.\n");
-}
-
-void 
-safeget (char *buf, int maxlen)
-{
-  int c, i = 0, bad = 0;
-  char *bstart = buf;
-  while ((c = getc (stdin)) != EOF && (c != '\n') && (++i < maxlen))
-    {
-      bad = (!isalnum (c) && (c != '_') && (c != ' '));
-      *(buf++) = (char) c;
-    }
-  *buf = '\0';
-
-  if (bad)
-    {
-      printf ("\nString contained banned character. Please stick to alphanumerics.\n");
-      *bstart = '\0';
-    }
-}
-

contrib/adduser.sh

@@ -1,90 +0,0 @@
-#!/bin/sh
-# adduser script for use with shadow passwords and useradd command.
-# by Hrvoje Dogan <hdogan@student.math.hr>, Dec 1995.
-
-echo -n "Login name for new user []:"
-read LOGIN
-if [ -z $LOGIN ]
-then echo "Come on, man, you can't leave the login field empty...";exit
-fi
-echo
-echo -n "User id for $LOGIN [ defaults to next available]:"
-read ID
-GUID="-u $ID"
-if [ -z $ID ] 
-then GUID=""
-fi
-
-echo
-echo -n "Initial group for $LOGIN [users]:"
-read GID
-GGID="-g $GID"
-if [ -z $GID ]
-then GGID=""
-fi
-
-echo
-echo -n "Additional groups for $LOGIN []:"
-read AGID
-GAGID="-G $AGID"
-if [ -z $AGID ]
-then GAGID=""
-fi
-
-echo
-echo -n "$LOGIN's home directory [/home/$LOGIN]:"
-read HME
-GHME="-d $HME"
-if [ -z $HME ]
-then GHME=""
-fi
-
-echo
-echo -n "$LOGIN's shell [/bin/bash]:"
-read SHL
-GSHL="-s $SHL"
-if [ -z $SHL ]
-then GSHL=""
-fi
-
-echo
-echo -n "$LOGIN's account expiry date (MM/DD/YY) []:"
-read EXP
-GEXP="-e $EXP"
-if [ -z $EXP ]
-then GEXP=""
-fi
-echo
-echo OK, I'm about to make a new account. Here's what you entered so far:
-echo New login name: $LOGIN
-if [ -z $GUID ] 
-then echo New UID: [Next available]
-else echo New UID: $UID
-fi
-if [ -z $GGID ]
-then echo Initial group: users
-else echo Initial group: $GID
-fi
-if [ -z $GAGID ]
-then echo Additional groups: [none]
-else echo Additional groups: $AGID
-fi
-if [ -z $GHME ]
-then echo Home directory: /home/$LOGIN
-else echo Home directory: $HME
-fi
-if [ -z $GSHL ]
-then echo Shell: /bin/bash
-else echo Shell: $SHL
-fi
-if [ -z $GEXP ]
-then echo Expiry date: [no expiration]
-else echo Expiry date: $EXP
-fi
-echo "This is it... if you want to bail out, you'd better do it now."
-read FOO
-echo Making new account...
-/usr/sbin/useradd $GHME -m $GEXP $GGID $GAGID $GSHL $GUID $LOGIN
-/usr/bin/chfn $LOGIN
-/usr/bin/passwd $LOGIN
-echo "Done..."

contrib/adduser2.sh

@@ -1,743 +0,0 @@
-#!/bin/bash
-#
-#  adduser			Interactive user adding program.
-#
-#  Copyright (C) 1996		Petri Mattila, Prihateam Networks
-#				petri@prihateam.fi
-#	
-#  This program is free software; you can redistribute it and/or modify
-#  it under the terms of the GNU General Public License as published by
-#  the Free Software Foundation; either version 2, or (at your option)
-#  any later version.
-#
-# Changes:
-#	220496	v0.01	Initial version
-#	230496	v0.02	More checks, embolden summary
-#	240496		Even more checks
-#	250496 		Help with ?
-#	040596	v0.03	Cleanups
-#	050596	v0.04	Bug fixes, expire date checks
-#	070596	v0.05	Iso-latin-1 names
-#
-
-## Defaults
-
-# default groups
-def_group="users"
-def_other_groups=""
-
-# default home directory
-def_home_dir=/home/users
-
-# default shell
-def_shell=/bin/tcsh
-
-# Default expiration date (mm/dd/yy)
-def_expire=""
-
-# default dates
-def_pwd_min=0
-def_pwd_max=90
-def_pwd_warn=14
-def_pwd_iact=14
-
-
-# possible UIDs
-uid_low=1000
-uid_high=64000
-
-# skel directory
-skel=/etc/skel
-
-# default mode for home directory
-def_mode=711
-
-# Regex, that the login name must meet, only ANSI characters
-login_regex='^[0-9a-zA-Z_-]*$'
-
-# Regex, that the user name must meet
-# ANSI version
-##name_regex='^[0-9a-zA-Z_-\ ]*$'
-# ISO-LATIN-1 version
-name_regex='^[0-9a-zA-ZÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõöùúûüýþÿ_-\ ]*$'
-
-# set PATH
-export PATH="/bin:/sbin:/usr/bin:/usr/sbin"
-
-# Some special characters
-case "$TERM" in
-   vt*|ansi*|con*|xterm*|linux*)
-	S=''	# start embolden
-	E=''	# end embolden
-	;;
-   *)	
-	S=''
-	E=''
-	;;
-esac
-
-
-## Functions
-
-check_root() {
-	if test "$EUID" -ne 0
-	then
-		echo "You must be root to run this program."
-		exit 1
-	fi
-}
-
-check_user() {
-	local usr pwd uid gid name home sh
-
-	cat /etc/passwd | (
-		while IFS=":" read usr pwd uid gid name home sh
-		do
-			if test "$1" = "${usr}"
-			then
-				return 1
-			fi
-		done
-		return 0
-	)
-}
-
-check_group() {
-	local read grp pwd gid members
-
-	cat /etc/group | (
-		while IFS=":" read grp pwd gid members
-		do
-			if test "$1" = "${grp}"
-			then
-				return 1
-			fi
-		done
-		return 0
-	)
-}
-
-check_other_groups() {
-	local grp check IFS
-
-	check="$1"
-	IFS=","
-
-	set ${check}
-	for grp
-	do
-		if check_group "${grp}"
-		then
-			echo "Group ${grp} does not exist."
-			return 1
-		fi
-	done
-	return 0
-}		
-
-check_uid() {
-	local usr pwd uid gid name home sh
-	
-	cat /etc/passwd | (
-		while IFS=":" read usr pwd uid gid name home sh
-		do
-			if test "$1" = "${uid}"
-			then
-				return 1
-			fi
-		done
-		return 0
-	)
-}
-
-read_yn() {
-	local ans ynd
-	
-	ynd="$1"
-	
-	while :
-	do
-		read ans	
-		case "${ans}" in
-		      "") return ${ynd} ;;
-		    [nN]) return 1 ;;
-		    [yY]) return 0 ;;
-		       *) echo -n "Y or N, please ? " ;;
-		esac
-	done
-}
-
-read_login() {
-	echo
-	while :
-	do
-		echo -n "Login: ${def_login:+[${def_login}] }"
-		read login
-		
-		if test "${login}" = '?'
-		then
-			less /etc/passwd
-			echo
-			continue
-		fi
-
-		if test -z "${login}" -a -n "${def_login}"
-		then
-			login="${def_login}"
-			echo "Using ${login}"
-			return
-		fi
-		
-		if test "${#login}" -gt 8
-		then
-			echo "Login must be at most 8 characters long"
-			continue
-		fi
-		
-		if test "${#login}" -lt 2
-		then
-			echo "Login must be at least 2 characters long"
-			continue
-		fi
-		
-		if ! expr "${login}" : "${login_regex}" &> /dev/null
-		then
-			echo "Please use letters, numbers and special characters _-,."
-			continue
-		fi
-		
-		if ! check_user "${login}"
-		then
-			echo "Username ${login} is already in use"
-			continue
-		fi
-		
-		def_login="${login}"
-		return
-	done
-}
-
-read_name () {
-	echo
-	while :
-	do
-		echo -n "Real name: ${def_name:+[${def_name}] }"
-		read name
-		
-		if test "${name}" = '?'
-		then
-			less /etc/passwd
-			echo
-			continue
-		fi
-
-		if test -z "${name}" -a -n "${def_name}"
-		then
-			name="${def_name}"
-			echo "Using ${name}"
-		fi
-
-		if test "${#name}" -gt 32
-		then
-			echo "Name should be at most 32 characters long"
-			continue
-		fi
-
-		if ! expr "${name}" : "${name_regex}" &> /dev/null
-		then
-			echo "Please use letters, numbers, spaces and special characters ,._-"
-			continue
-		fi
-		
-		def_name="${name}"
-		return
-	done
-}
-
-read_home() {
-	local x
-	
-	echo
-	while :
-	do
-		echo -n "Home Directory: [${def_home_dir}/${login}] "
-		read home
-		
-		if test -z "${home}"
-		then
-			home="${def_home_dir}/${login}"
-			echo "Using ${home}"
-		fi
-		
-		if ! expr "${home}" : '^[0-9a-zA-Z,._-\/]*$' &> /dev/null
-		then
-			echo "Please use letters, numbers, spaces and special characters ,._-/"
-			continue
-		fi
-		
-		x="$(basename ${home})"
-		if test "${x}" != "${login}"
-		then
-			echo "Warning: you are about to use different login name and home directory."
-		fi
-		
-		x="$(dirname ${home})"
-		if ! test -d "${x}"
-		then
-			echo "Directory ${x} does not exist."
-			echo "If you still want to use it, please make it manually."
-			continue
-		fi
-		
-		def_home_dir="${x}"
-		return
-	done
-}
-
-read_shell () {
-	local x
-
-	echo
-	while :
-	do
-		echo -n "Shell: [${def_shell}] "
-		read shell
-		
-		if test -z "${shell}"
-		then
-			shell="${def_shell}"
-			echo "Using ${shell}"
-		fi
-		
-		for x in $(cat /etc/shells)
-		do
-			if test "${x}" = "${shell}"
-			then
-				def_shell="${shell}"
-				return
-			fi
-		done
-
-		echo "Possible shells are:"
-		cat /etc/shells
-	done
-}
-
-read_group () {
-	echo
-	while :
-	do
-		echo -n "Group: [${def_group}] "
-		read group
-		
-		if test -z "${group}"
-		then
-			group="${def_group}"
-			echo "Using ${group}"
-		fi
-		
-		if test "${group}" = '?'
-		then
-			less /etc/group
-			echo
-			continue
-		fi
-
-		if check_group "${group}"
-		then
-			echo "Group ${group} does not exist."
-			continue
-		fi
-		
-		def_group="${group}"
-		return
-	done
-}
-
-read_other_groups () {
-	echo
-	while :
-	do
-		echo -n "Other groups: [${def_og:-none}] "
-		read other_groups
-		
-		if test "${other_groups}" = '?'
-		then
-			less /etc/group
-			echo
-			continue
-		fi
-
-		if test -z "${other_groups}"
-		then
-			if test -n "${def_og}"
-			then
-				other_groups="${def_og}"
-				echo "Using ${other_groups}"
-			else	
-				echo "No other groups"
-				return
-			fi
-		fi
-		
-		
-		if ! check_other_groups "${other_groups}"
-		then
-			continue
-		fi
-		
-		def_og="${other_groups}"
-		return
-	done
-}
-
-read_uid () {
-	echo
-	while :
-	do
-		echo -n "uid: [first free] "
-		read uid
-			
-		if test -z "${uid}"
-		then
-			echo "Using first free UID."
-			return
-		fi
-		
-		if test "${uid}" = '?'
-		then
-			less /etc/passwd
-			echo
-			continue
-		fi
-
-		if ! expr "${uid}" : '^[0-9]+$' &> /dev/null
-		then
-			echo "Please use numbers only."
-			continue
-		fi
-		if test "${uid}" -lt "${uid_low}"
-		then
-			echo "UID must be greater than ${uid_low}"
-			continue
-		fi
-		if test "${uid}" -gt "${uid_high}"
-		then
-			echo "UID must be smaller than ${uid_high}"
-			continue
-		fi
-		if ! check_uid "${uid}"
-		then
-			echo "UID ${uid} is already in use"
-			continue
-		fi
-		
-		return
-	done
-}
-
-read_max_valid_days() {
-	echo
-	while :
-	do
-		echo -en "Maximum days between password changes: [${def_pwd_max}] "
-		read max_days
-		
-		if test -z "${max_days}"
-		then
-			max_days="${def_pwd_max}"
-			echo "Using ${max_days}"
-			return
-		fi
-		
-		if ! expr "${max_days}" : '^[0-9]+$' &> /dev/null
-		then
-			echo "Please use numbers only."
-			continue
-		fi
-		if test "${max_days}" -lt 7
-		then
-			echo "Warning: you are using a value shorter than a week."
-		fi
-		
-		def_pwd_max="${max_days}"
-		return	
-	done
-}
-
-read_min_valid_days() {
-	echo
-	while :
-	do
-		echo -en "Minimum days between password changes: [${def_pwd_min}] "
-		read min_days
-		
-		if test -z "${min_days}"
-		then
-			min_days="${def_pwd_min}"
-			echo "Using ${min_days}"
-			return
-		fi
-		
-		if ! expr "${min_days}" : '^[0-9]+$' &> /dev/null
-		then
-			echo "Please use numbers only."
-			continue
-		fi
-		if test "${min_days}" -gt 7
-		then
-			echo "Warning: you are using a value longer than a week."
-		fi
-		
-		def_pwd_min="${min_days}"
-		return	
-	done
-}
-
-read_warning_days() {
-	echo
-	while :
-	do
-		echo -en "Number of warning days before password expires: [${def_pwd_warn}] "
-		read warn_days
-		
-		if test -z "${warn_days}"
-		then
-			warn_days="${def_pwd_warn}"
-			echo "Using ${warn_days}"
-		fi
-
-		if ! expr "${warn_days}" : '^[0-9]+$' &> /dev/null
-		then
-			echo "Please use numbers only."
-			continue
-		fi
-		if test "${warn_days}" -gt 14
-		then
-			echo "Warning: you are using a value longer than two week."
-		fi
-		
-		def_pwd_warn="${warn_days}"
-		return	
-	done
-}
-
-
-read_inactive_days() {
-	echo
-	while :
-	do
-		echo -en "Number of usable days after expiration: [${def_pwd_iact}] "
-		read iact_days
-		
-		if test -z "${iact_days}"
-		then
-			iact_days="${def_pwd_iact}"
-			echo "Using ${iact_days}"
-			return
-		fi
-		if ! expr "${iact_days}" : '^[0-9]+$' &> /dev/null
-		then
-			echo "Please use numbers only."
-			continue
-		fi
-		if test "${iact_days}" -gt 14
-		then
-			echo "Warning: you are using a value that is more than two weeks."
-		fi
-		
-		def_pwd_iact="${iact_days}"
-		return	
-	done
-}
-
-read_expire_date() {
-	local ans
-	
-	echo
-	while :
-	do
-		echo -en "Expire date of this account (mm/dd/yy): [${def_expire:-never}] "
-		read ans
-		
-		if test -z "${ans}"
-		then
-			if test -z "${def_expire}"
-			then
-				ans="never"
-			else
-				ans="${def_expire}"
-				echo "Using ${def_expire}"
-			fi
-		fi
-		
-		if test "${ans}" = "never"
-		then
-			echo "Account will never expire."
-			def_expire=""
-			expire=""
-			return
-		fi
-
-		if ! expr "${ans}" : '^[0-9][0-9]/[0-9][0-9]/[0-9][0-9]$' &> /dev/null
-		then
-			echo "Please use format mm/dd/yy"
-			continue
-		fi
-		
-		if ! expire_date="$(date -d ${ans} '+%A, %B %d %Y')"
-		then
-			continue
-		fi
-		
-		def_expire="${expire}"
-		return	
-	done
-}
-
-read_passwd_yn() {
-	echo -en "\nDo you want to set password [Y/n] ? "
-	if read_yn 0
-	then
-		set_pwd="YES"
-	else
-		set_pwd=""
-	fi
-}
-
-
-print_values() {
-
-clear
-cat << EOM
-
-Login:        ${S}${login}${E}
-Group:        ${S}${group}${E}
-Other groups: ${S}${other_groups:-[none]}${E}
-
-Real Name:    ${S}${name}${E}
-
-uid:          ${S}${uid:-[first free]}${E}
-home:         ${S}${home}${E}
-shell:        ${S}${shell}${E}
-
-Account expiration date:                   ${S}${expire_date:-never}${E}
-Minimum days between password changes:     ${S}${min_days}${E}
-Maximum days between password changes:     ${S}${max_days}${E}
-Number of usable days after expiration:    ${S}${iact_days}${E}
-Number of warning days before expiration:  ${S}${warn_days}${E}
-
-${S}${set_pwd:+Set password for this account.}${E}
-
-EOM
-}
-
-set_user() {
-	if ! useradd \
-		-c "${name}" \
-		-d "${home}" \
-		-g "${group}" \
-		-s "${shell}" \
-		${expire:+-e ${expire}} \
-		${uid:+-u ${uid}} \
-		${other_groups:+-G ${other_groups}} \
-		${login}
-	then
-		echo "Error ($?) in useradd...exiting..."
-		exit 1
-	fi
-}
-
-set_aging() {
-	if ! passwd \
-		-x ${max_days} \
-		-n ${min_days} \
-		-w ${warn_days} \
-		-i ${iact_days} \
-		${login}
-	then
-		echo "Error ($?) in setting password aging...exiting..." 
-		exit 1
-	fi
-}
-
-set_password() {
-	if test -n "${set_pwd}"
-	then
-		echo
-		passwd ${login}
-		echo
-	fi
-}	
-
-set_system() {
-	if test -d "${home}"
-	then
-		echo "Directory ${home} already exists."
-		echo "Skeleton files not copied."
-		return
-	fi
-	
-	echo -n "Copying skeleton files..."
-	( 
-	  mkdir ${home}
-	  cd ${skel} && cp -af . ${home}
-	  chmod ${def_mode} ${home}
-	  chown -R ${login}:${group} ${home}
-	)
-	echo "done."
-
-	## Add your own stuff here:
-	echo -n "Setting up other files..."
-	(
-	  mailbox="/var/spool/mail/${login}"
-	  touch ${mailbox}
-	  chown "${login}:mail" ${mailbox}
-	  chmod 600 ${mailbox}
-	)
-	echo "done."
-}
-
-
-read_values() {
-	clear
-	echo -e "\nPlease answer the following questions about the new user to be added."
-	
-	while :
-	do
-		read_login
-		read_name
-		read_group
-		read_other_groups
-		read_home
-		read_shell
-		read_uid
-		read_expire_date
-		read_max_valid_days
-		read_min_valid_days
-		read_warning_days
-		read_inactive_days
-		read_passwd_yn
-
-		print_values
-		
-		echo -n "Is this correct [N/y] ? "
-		read_yn 1 && return
-	done
-}
-
-
-main() {
-	check_root
-	read_values
-	set_user
-	set_aging
-	set_system
-	set_password
-}
-
-
-## Run it 8-)
-main
-
-# End.

contrib/groupmems.shar

@@ -1,465 +0,0 @@
-#!/bin/sh
-# This is a shell archive (produced by GNU sharutils 4.2.1).
-# To extract the files from this archive, save it to some FILE, remove
-# everything before the `!/bin/sh' line above, then type `sh FILE'.
-#
-# Made on 2000-05-25 14:41 CDT by <gk4@gnu.austin.ibm.com>.
-# Source directory was `/home/gk4/src/groupmem'.
-#
-# Existing files will *not* be overwritten unless `-c' is specified.
-#
-# This shar contains:
-# length mode       name
-# ------ ---------- ------------------------------------------
-#   1960 -rw-r--r-- Makefile
-#   6348 -rw-r--r-- groupmems.c
-#   3372 -rw------- groupmems.8
-#
-save_IFS="${IFS}"
-IFS="${IFS}:"
-gettext_dir=FAILED
-locale_dir=FAILED
-first_param="$1"
-for dir in $PATH
-do
-  if test "$gettext_dir" = FAILED && test -f $dir/gettext \
-     && ($dir/gettext --version >/dev/null 2>&1)
-  then
-    set `$dir/gettext --version 2>&1`
-    if test "$3" = GNU
-    then
-      gettext_dir=$dir
-    fi
-  fi
-  if test "$locale_dir" = FAILED && test -f $dir/shar \
-     && ($dir/shar --print-text-domain-dir >/dev/null 2>&1)
-  then
-    locale_dir=`$dir/shar --print-text-domain-dir`
-  fi
-done
-IFS="$save_IFS"
-if test "$locale_dir" = FAILED || test "$gettext_dir" = FAILED
-then
-  echo=echo
-else
-  TEXTDOMAINDIR=$locale_dir
-  export TEXTDOMAINDIR
-  TEXTDOMAIN=sharutils
-  export TEXTDOMAIN
-  echo="$gettext_dir/gettext -s"
-fi
-if touch -am -t 200112312359.59 $$.touch >/dev/null 2>&1 && test ! -f 200112312359.59 -a -f $$.touch; then
-  shar_touch='touch -am -t $1$2$3$4$5$6.$7 "$8"'
-elif touch -am 123123592001.59 $$.touch >/dev/null 2>&1 && test ! -f 123123592001.59 -a ! -f 123123592001.5 -a -f $$.touch; then
-  shar_touch='touch -am $3$4$5$6$1$2.$7 "$8"'
-elif touch -am 1231235901 $$.touch >/dev/null 2>&1 && test ! -f 1231235901 -a -f $$.touch; then
-  shar_touch='touch -am $3$4$5$6$2 "$8"'
-else
-  shar_touch=:
-  echo
-  $echo 'WARNING: not restoring timestamps.  Consider getting and'
-  $echo "installing GNU \`touch', distributed in GNU File Utilities..."
-  echo
-fi
-rm -f 200112312359.59 123123592001.59 123123592001.5 1231235901 $$.touch
-#
-if mkdir _sh10937; then
-  $echo 'x -' 'creating lock directory'
-else
-  $echo 'failed to create lock directory'
-  exit 1
-fi
-# ============= Makefile ==============
-if test -f 'Makefile' && test "$first_param" != -c; then
-  $echo 'x -' SKIPPING 'Makefile' '(file already exists)'
-else
-  $echo 'x -' extracting 'Makefile' '(text)'
-  sed 's/^X//' << 'SHAR_EOF' > 'Makefile' &&
-/*
-# SPDX-FileCopyrightText: 2000, International Business Machines, Inc.
-# SPDX-FileCopyrightText: 2000, George Kraft IV, gk4@us.ibm.com
-# SPDX-License-Identifier: BSD-3-Clause
-# 
-X
-all: groupmems
-X
-groupmems: groupmems.c
-X	cc -g -o groupmems groupmems.c -L. -lshadow
-X
-install: groupmems
-X	-/usr/sbin/groupadd groups
-X	install -o root -g groups -m 4770 groupmems /usr/bin
-X
-install.man: groupmems.8
-X	install -o root -g root -m 644 groupmems.8 /usr/man/man8
-X
-SHAR_EOF
-  (set 20 00 05 25 14 40 28 'Makefile'; eval "$shar_touch") &&
-  chmod 0644 'Makefile' ||
-  $echo 'restore of' 'Makefile' 'failed'
-  if ( md5sum --help 2>&1 | grep 'sage: md5sum \[' ) >/dev/null 2>&1 \
-  && ( md5sum --version 2>&1 | grep -v 'textutils 1.12' ) >/dev/null; then
-    md5sum -c << SHAR_EOF >/dev/null 2>&1 \
-    || $echo 'Makefile:' 'MD5 check failed'
-b46cf7ef8d59149093c011ced3f3103c  Makefile
-SHAR_EOF
-  else
-    shar_count="`LC_ALL= LC_CTYPE= LANG= wc -c < 'Makefile'`"
-    test 1960 -eq "$shar_count" ||
-    $echo 'Makefile:' 'original size' '1960,' 'current size' "$shar_count!"
-  fi
-fi
-# ============= groupmems.c ==============
-if test -f 'groupmems.c' && test "$first_param" != -c; then
-  $echo 'x -' SKIPPING 'groupmems.c' '(file already exists)'
-else
-  $echo 'x -' extracting 'groupmems.c' '(text)'
-  sed 's/^X//' << 'SHAR_EOF' > 'groupmems.c' &&
-/*
-X * SPDX-FileCopyrightText: 2000, International Business Machines, Inc.
-X * SPDX-FileCopyrightText: 2000, George Kraft IV, gk4@us.ibm.com
-X * SPDX-License-Identifier: BSD-3-Clause
-X */
-/*
-**
-**	Utility "groupmem" adds and deletes members from a user's group.
-**	
-**	Setup (as "root"):
-**	
-**		groupadd -r groups 
-**		chmod 2770 groupmems
-**		chown root.groups groupmems
-**		groupmems -g groups -a gk4
-**	
-**	Usage (as "gk4"):
-**	
-**		groupmems -a olive
-**		groupmems -a jordan
-**		groupmems -a meghan
-**		groupmems -a morgan
-**		groupmems -a jake
-**		groupmems -l 
-**		groupmems -d jake
-**		groupmems -l 
-*/
-X
-#include <stdio.h>
-#include <pwd.h>
-#include <grp.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include "defines.h"
-#include "groupio.h"
-X
-/* Exit Status Values */
-X
-#define EXIT_SUCCESS		0	/* success */
-#define EXIT_USAGE		1	/* invalid command syntax */
-#define EXIT_GROUP_FILE		2	/* group file access problems */
-#define EXIT_NOT_ROOT		3	/* not superuser  */
-#define EXIT_NOT_EROOT		4	/* not effective superuser  */
-#define EXIT_NOT_PRIMARY	5	/* not primary owner of group  */
-#define EXIT_NOT_MEMBER		6	/* member of group does not exist */
-#define EXIT_MEMBER_EXISTS	7	/* member of group already exists */
-X
-#define TRUE 1
-#define FALSE 0
-X
-/* Globals */
-X
-extern int optind;
-extern char *optarg;
-static char *adduser = NULL;
-static char *deluser = NULL;
-static char *thisgroup = NULL;
-static int purge = FALSE;
-static int list = FALSE;
-static int exclusive = 0;
-X
-static int isroot(void) {
-X	return getuid() ? FALSE : TRUE;
-}
-X
-static int isgroup(void) {
-X	gid_t g = getgid();
-X	struct group *grp = getgrgid(g);
-X
-X	return TRUE;
-}
-X
-static char *whoami(void) {
-X	struct group *grp = getgrgid(getgid());
-X	struct passwd *usr = getpwuid(getuid());
-X
-X	if (0 == strcmp(usr->pw_name, grp->gr_name)) {
-X		return (char *)strdup(usr->pw_name);
-X	} else {
-X		return NULL;
-X	} 
-}
-X
-static void
-addtogroup(char *user, char **members) {
-X	int i;
-X	char **pmembers;
-X
-X	for (i = 0; NULL != members[i]; i++ ) {
-X		if (0 == strcmp(user, members[i])) {
-X			fprintf(stderr, "Member already exists\n");
-X			exit(EXIT_MEMBER_EXISTS);
-X		}
-X	}
-X
-X	if (0 == i) {
-X		pmembers = (char **)calloc(2, sizeof(char *));
-X	} else {
-X		pmembers = (char **)realloc(members, sizeof(char *)*(i+1));
-X	}
-X
-X	*members = *pmembers;
-X	members[i] = user;
-X	members[i+1] = NULL;
-}
-X
-static void
-rmfromgroup(char *user, char **members) {
-X	int i;
-X	int found = FALSE;
-X
-X	i = 0;
-X	while (!found && NULL != members[i]) {
-X		if (0 == strcmp(user, members[i])) {
-X			found = TRUE;
-X		} else {
-X			i++;
-X		}
-X	}
-X
-X	while (found && NULL != members[i]) {
-X		members[i] = members[++i];
-X	}
-X
-X	if (!found) {
-X		fprintf(stderr, "Member to remove could not be found\n");
-X		exit(EXIT_NOT_MEMBER);
-X	}
-}
-X
-static void
-nomembers(char **members) {
-X	int i;
-X
-X	for (i = 0; NULL != members[i]; i++ ) {
-X		members[i] = NULL;
-X	}
-}
-X
-static void
-members(char **members) {
-X	int i;
-X
-X	for (i = 0; NULL != members[i]; i++ ) {
-X		printf("%s ", members[i]);
-X
-X		if (NULL == members[i+1]) {
-X			printf("\n");
-X		} else {
-X			printf(" ");
-X		}
-X	}
-}
-X
-static void usage(void) {
-X	fprintf(stderr, "usage: groupmems -a username | -d username | -D | -l [-g groupname]\n");
-X	exit(EXIT_USAGE);
-}
-X
-main(int argc, char **argv) {
-X	int arg, i;
-X	char *name;
-X	struct group *grp;
-X
-X	while ((arg = getopt(argc, argv, "a:d:g:Dl")) != EOF) {
-X		switch (arg) {
-X		case 'a':
-X			adduser = strdup(optarg);
-X			++exclusive;
-X			break;
-X		case 'd':
-X			deluser = strdup(optarg);
-X			++exclusive;
-X			break;
-X		case 'g':
-X			thisgroup = strdup(optarg);
-X			break;
-X		case 'D':
-X			purge = TRUE;
-X			++exclusive;
-X			break;
-X		case 'l':
-X			list = TRUE;
-X			++exclusive;
-X			break;
-X		default:
-X			usage();
-X		}
-X	}
-X
-X	if (exclusive > 1 || optind < argc) {
-X		usage();
-X	}
-X
-X	if (!isroot() && NULL != thisgroup) {
-X		fprintf(stderr, "Only root can add members to different groups\n");
-X		exit(EXIT_NOT_ROOT);
-X	} else if (isroot() && NULL != thisgroup) {
-X		name = thisgroup;
-X	} else if (!isgroup()) {
-X		fprintf(stderr, "Group access is required\n");
-X		exit(EXIT_NOT_EROOT);
-X	} else if (NULL == (name = whoami())) {
-X		fprintf(stderr, "Not primary owner of current group\n");
-X		exit(EXIT_NOT_PRIMARY);
-X	}
-X
-X	if (!gr_lock()) {
-X		fprintf(stderr, "Unable to lock group file\n");
-X		exit(EXIT_GROUP_FILE);
-X	}
-X
-X	if (!gr_open(O_RDWR)) {
-X		fprintf(stderr, "Unable to open group file\n");
-X		exit(EXIT_GROUP_FILE);
-X	}
-X
-X	grp = (struct group *)gr_locate(name);
-X
-X	if (NULL != adduser) {
-X		addtogroup(adduser, grp->gr_mem);
-X		gr_update(grp);
-X	} else if (NULL != deluser) {
-X		rmfromgroup(deluser, grp->gr_mem);
-X		gr_update(grp);
-X	} else if (purge) {
-X		nomembers(grp->gr_mem);
-X		gr_update(grp);
-X	} else if (list) {
-X		members(grp->gr_mem);
-X	}
-X
-X	if (!gr_close()) {
-X		fprintf(stderr, "Cannot close group file\n");
-X		exit(EXIT_GROUP_FILE);
-X	}
-X
-X	gr_unlock();
-X
-X	exit(EXIT_SUCCESS);
-}
-X
-/* EOF */
-SHAR_EOF
-  (set 20 00 05 25 14 36 38 'groupmems.c'; eval "$shar_touch") &&
-  chmod 0644 'groupmems.c' ||
-  $echo 'restore of' 'groupmems.c' 'failed'
-  if ( md5sum --help 2>&1 | grep 'sage: md5sum \[' ) >/dev/null 2>&1 \
-  && ( md5sum --version 2>&1 | grep -v 'textutils 1.12' ) >/dev/null; then
-    md5sum -c << SHAR_EOF >/dev/null 2>&1 \
-    || $echo 'groupmems.c:' 'MD5 check failed'
-f0dd68f8d762d89d24d3ce1f4141f981  groupmems.c
-SHAR_EOF
-  else
-    shar_count="`LC_ALL= LC_CTYPE= LANG= wc -c < 'groupmems.c'`"
-    test 6348 -eq "$shar_count" ||
-    $echo 'groupmems.c:' 'original size' '6348,' 'current size' "$shar_count!"
-  fi
-fi
-# ============= groupmems.8 ==============
-if test -f 'groupmems.8' && test "$first_param" != -c; then
-  $echo 'x -' SKIPPING 'groupmems.8' '(file already exists)'
-else
-  $echo 'x -' extracting 'groupmems.8' '(text)'
-  sed 's/^X//' << 'SHAR_EOF' > 'groupmems.8' &&
-X.\"
-X.\" SPDX-FileCopyrightText: 2000, International Business Machines, Inc.
-X.\" SPDX-FileCopyrightText: 2000, George Kraft IV, gk4@us.ibm.com
-X.\" SPDX-License-Identifier: BSD-3-Clause
-X.\"
-X.\" $Id$
-X.\"
-X.TH GROUPMEMS 8
-X.SH NAME
-groupmems \- Administer members of a user's primary group
-X.SH SYNOPSIS
-X.B groupmems
-\fB-a\fI user_name \fR |
-\fB-d\fI user_name \fR |
-\fB-l\fR |
-\fB-D\fR |
-[\fB-g\fI group_name \fR]
-X.SH DESCRIPTION
-The \fBgroupmems\fR utility allows a user to administer their own
-group membership list without the requirement of superuser privileges.
-The \fBgroupmems\fR utility is for systems that configure its users to
-be in their own name sake primary group (i.e., guest / guest).
-X.P
-Only the superuser, as administrator, can use \fBgroupmems\fR to alter
-the memberships of other groups.
-X.IP "\fB-a \fIuser_name\fR"
-Add a new user to the group membership list.
-X.IP "\fB-d \fIuser_name\fR"
-Delete a user from the group membership list.
-X.IP "\fB-l\fR"
-List the group membership list.
-X.IP "\fB-D\fR"
-Delete all users from the group membership list.
-X.IP "\fB-g \fIgroup_name\fR"
-The superuser can specify which group membership list to modify.
-X.SH SETUP
-The \fBgroupmems\fR executable should be in mode \fB2770\fR as user \fBroot\fR
-and in group \fBgroups\fR.   The system administrator can add users to
-group groups to allow or disallow them using the  \fBgroupmems\fR utility
-to manager their own group membership list.
-X.P
-X     $ groupadd -r groups
-X.br
-X     $ chmod 2770 groupmems
-X.br
-X     $ chown root.groups groupmems
-X.br
-X     $ groupmems -g groups -a gk4
-X.SH FILES
-/etc/group
-X.br
-/etc/gshadow
-X.SH SEE ALSO
-X.BR chfn (1),
-X.BR chsh (1),
-X.BR useradd (8),
-X.BR userdel (8),
-X.BR usermod (8),
-X.BR passwd (1),
-X.BR groupadd (8),
-X.BR groupdel (8)
-X.SH AUTHOR
-George Kraft IV (gk4@us.ibm.com)
-X.\" EOF
-SHAR_EOF
-  (set 20 00 05 25 14 38 23 'groupmems.8'; eval "$shar_touch") &&
-  chmod 0600 'groupmems.8' ||
-  $echo 'restore of' 'groupmems.8' 'failed'
-  if ( md5sum --help 2>&1 | grep 'sage: md5sum \[' ) >/dev/null 2>&1 \
-  && ( md5sum --version 2>&1 | grep -v 'textutils 1.12' ) >/dev/null; then
-    md5sum -c << SHAR_EOF >/dev/null 2>&1 \
-    || $echo 'groupmems.8:' 'MD5 check failed'
-181e6cd3a3c9d3df320197fa2cde2b4a  groupmems.8
-SHAR_EOF
-  else
-    shar_count="`LC_ALL= LC_CTYPE= LANG= wc -c < 'groupmems.8'`"
-    test 3372 -eq "$shar_count" ||
-    $echo 'groupmems.8:' 'original size' '3372,' 'current size' "$shar_count!"
-  fi
-fi
-rm -fr _sh10937
-exit 0

contrib/pwdauth.c

@@ -1,308 +0,0 @@
-/*
- * pwdauth.c - program to verify a given username/password pair.
- *
- * Run it with username in argv[1] (may be omitted - default is the
- * current user), and send it the password over a pipe on stdin.
- * Exit status: 0 - correct password, 1 - wrong password, >1 - other
- * errors.  For use with shadow passwords, this program should be
- * installed setuid root.
- *
- * This can be used, for example, by xlock - you don't have to install
- * this large and complex (== possibly insecure) program setuid root,
- * just modify it to run this simple program to do the authentication.
- *
- * Recent versions (xlockmore-3.9) are cleaner, and drop privileges as
- * soon as possible after getting the user's encrypted password.
- * Using this program probably doesn't make it more secure, and has one
- * disadvantage: since we don't get the encrypted user's password at
- * startup (but at the time the user is authenticated), it is not clear
- * how we should handle errors (like getpwnam() returning NULL).
- * - fail the authentication?  Problem: no way to unlock (other than kill
- *   the process from somewhere else) if the NIS server stops responding.
- * - succeed and unlock?  Problem: it's too easy to unlock by unplugging
- *   the box from the network and waiting until NIS times out...
- *
- * This program is Copyright (C) 1996 Marek Michalkiewicz
- * <marekm@i17linuxb.ists.pwr.wroc.pl>.
- *
- * It may be used and distributed freely for any purposes.  There is no
- * warranty - use at your own risk.  I am not liable for any damages etc.
- * If you improve it, please send me your changes.
- */
-
-static char rcsid[] = "$Id$";
-
-/*
- * Define USE_SYSLOG to use syslog() to log successful and failed
- * authentication.  This should be safe even if your system has
- * the infamous syslog buffer overrun security problem...
- */
-#define USE_SYSLOG
-
-/*
- * Define HAVE_GETSPNAM to get shadow passwords using getspnam().
- * Some systems don't have getspnam(), but getpwnam() returns
- * encrypted passwords only if running as root.
- *
- * According to the xlock source (not tested, except Linux) -
- * define: Linux, Solaris 2.x, SVR4, ...
- * undef: HP-UX with Secured Passwords, FreeBSD, NetBSD, QNX.
- * Known not supported (yet): Ultrix, OSF/1, SCO.
- */
-#define HAVE_GETSPNAM
-
-/*
- * Define HAVE_PW_ENCRYPT to use pw_encrypt() instead of crypt().
- * pw_encrypt() is like the standard crypt(), except that it may
- * support better password hashing algorithms.
- *
- * Define if linking with libshadow.a from the shadow password
- * suite (Linux, SunOS 4.x?).
- */
-#undef HAVE_PW_ENCRYPT
-
-/*
- * Define HAVE_AUTH_METHODS to support the shadow suite specific
- * extension: the encrypted password field contains a list of
- * administrator defined authentication methods, separated by
- * semicolons.  This program only supports the standard password
- * authentication method (a string that doesn't start with '@').
- */
-#undef HAVE_AUTH_METHODS
-
-/*
- * FAIL_DELAY - number of seconds to sleep before exiting if the
- * password was wrong, to slow down password guessing attempts.
- */
-#define FAIL_DELAY 2
-
-/* No user-serviceable parts below :-).  */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <unistd.h>
-#include <pwd.h>
-
-#ifdef USE_SYSLOG
-#include <syslog.h>
-#ifndef LOG_AUTHPRIV
-#define LOG_AUTHPRIV LOG_AUTH
-#endif
-#endif
-
-#ifdef HAVE_GETSPNAM
-#include <shadow.h>
-#endif
-
-#ifdef HAVE_PW_ENCRYPT
-extern char *pw_encrypt();
-#define crypt pw_encrypt
-#endif
-
-/*
- * Read the password (one line) from fp.  We don't turn off echo
- * because we expect input from a pipe.
- */
-static char *
-get_line(fp)
-	FILE *fp;
-{
-	static char buf[128];
-	char *cp;
-	int ch;
-
-	cp = buf;
-	while ((ch = getc(fp)) != EOF && ch != '\0' && ch != '\n') {
-		if (cp >= buf + sizeof buf - 1)
-			break;
-		*cp++ = ch;
-	}
-	*cp = '\0';
-	return buf;
-}
-
-/*
- * Get the password file entry for the current user.  If the name
- * returned by getlogin() is correct (matches the current real uid),
- * return the entry for that user.  Otherwise, return the entry (if
- * any) matching the current real uid.  Return NULL on failure.
- */
-static struct passwd *
-get_my_pwent()
-{
-	uid_t uid = getuid();
-	char *name = getlogin();
-
-	if (name && *name) {
-		struct passwd *pw = getpwnam(name);
-
-		if (pw && pw->pw_uid == uid)
-			return pw;
-	}
-	return getpwuid(uid);
-}
-
-/*
- * Verify the password.  The system-dependent shadow support is here.
- */
-static int
-password_auth_ok(pw, pass)
-	const struct passwd *pw;
-	const char *pass;
-{
-	int result;
-	char *cp;
-#ifdef HAVE_AUTH_METHODS
-	char *buf;
-#endif
-#ifdef HAVE_GETSPNAM
-	struct spwd *sp;
-#endif
-
-	if (pw) {
-#ifdef HAVE_GETSPNAM
-		sp = getspnam(pw->pw_name);
-		if (sp)
-			cp = sp->sp_pwdp;
-		else
-#endif
-			cp = pw->pw_passwd;
-	} else
-		cp = "xx";
-
-#ifdef HAVE_AUTH_METHODS
-	buf = strdup(cp);  /* will be modified by strtok() */
-	if (!buf) {
-		fprintf(stderr, "Out of memory.\n");
-		exit(13);
-	}
-	cp = strtok(buf, ";");
-	while (cp && *cp == '@')
-		cp = strtok(NULL, ";");
-
-	/* fail if no password authentication for this user */
-	if (!cp)
-		cp = "xx";
-#endif
-
-	if (*pass || *cp)
-		result = (strcmp(crypt(pass, cp), cp) == 0);
-	else
-		result = 1;  /* user with no password */
-
-#ifdef HAVE_AUTH_METHODS
-	free(buf);
-#endif
-	return result;
-}
-
-/*
- * Main program.
- */
-int
-main(argc, argv)
-	int argc;
-	char **argv;
-{
-	struct passwd *pw;
-	char *pass, *name;
-	char myname[32];
-
-#ifdef USE_SYSLOG
-	openlog("pwdauth", LOG_PID | LOG_CONS, LOG_AUTHPRIV);
-#endif
-	pw = get_my_pwent();
-	if (!pw) {
-#ifdef USE_SYSLOG
-		syslog(LOG_ERR, "can't get login name for uid %d.\n",
-		       (int) getuid());
-#endif
-		fprintf(stderr, "Who are you?\n");
-		exit(2);
-	}
-	strncpy(myname, pw->pw_name, sizeof myname - 1);
-	myname[sizeof myname - 1] = '\0';
-	name = myname;
-
-	if (argc > 1) {
-		name = argv[1];
-		pw = getpwnam(name);
-	}
-
-	pass = get_line(stdin);
-	if (password_auth_ok(pw, pass)) {
-#ifdef USE_SYSLOG
-		syslog(pw->pw_uid ? LOG_INFO : LOG_NOTICE,
-		       "user `%s' entered correct password for `%.32s'.\n",
-		       myname, name);
-#endif
-		exit(0);
-	}
-#ifdef USE_SYSLOG
-	/* be careful not to overrun the syslog buffer */
-	syslog((!pw || pw->pw_uid) ? LOG_NOTICE : LOG_WARNING,
-	       "user `%s' entered incorrect password for `%.32s'.\n",
-	       myname, name);
-#endif
-#ifdef FAIL_DELAY
-	sleep(FAIL_DELAY);
-#endif
-	fprintf(stderr, "Wrong password.\n");
-	exit(1);
-}
-
-#if 0
-/*
- * You can use code similar to the following to run this program.
- * Return values: >=0 - program exit status (use the <sys/wait.h>
- * macros to get the exit code, it is shifted left by 8 bits),
- * -1 - check errno.
- */
-int
-verify_password(const char *username, const char *password)
-{
-	int pipe_fd[2];
-	int pid, wpid, status;
-
-	if (pipe(pipe_fd))
-		return -1;
-	
-	if ((pid = fork()) == 0) {
-		char *arg[3];
-		char *env[1];
-
-		/* child */
-		close(pipe_fd[1]);
-		if (pipe_fd[0] != 0) {
-			if (dup2(pipe_fd[0], 0) != 0)
-				_exit(127);
-			close(pipe_fd[0]);
-		}
-		arg[0] = "/usr/bin/pwdauth";
-		arg[1] = username;
-		arg[2] = NULL;
-		env[0] = NULL;
-		execve(arg[0], arg, env);
-		_exit(127);
-	} else if (pid == -1) {
-		/* error */
-		close(pipe_fd[0]);
-		close(pipe_fd[1]);
-		return -1;
-	}
-	/* parent */
-	close(pipe_fd[0]);
-	write(pipe_fd[1], password, strlen(password));
-	write(pipe_fd[1], "\n", 1);
-	close(pipe_fd[1]);
-
-	while ((wpid = wait(&status)) != pid) {
-		if (wpid == -1)
-			return -1;
-	}
-	return status;
-}
-#endif

contrib/shadow-anonftp.patch

@@ -1,147 +0,0 @@
-Hello Marek,
-
-I have created a diffile against the 980403 release that adds
-functionality to newusers for automatic handling of users with only
-anonymous ftp login (using the guestgroup feature in ftpaccess, which
-means that the users home directory looks like '/home/user/./'). It also
-adds a commandline argument to specify an initial directory structure
-for such users, with a tarball normally containing the bin,lib,etc
-directories used in the chrooted environment.
-
-I am using it to automatically create chunks of users with only ftp
-access for a webserver.
-
-I have tried to follow your coding standards and I believe it is bug
-free but.. well, who knows. :) It's not much code however.
-
-I hope you find it useful. Do what you like with it, feel free to ask if
-anything is unclear.
-
-Best rgds,
-  Calle Karlsson
-  ckn@kash.se
-
-diff -uNr shadow-980403.orig/src/newusers.c shadow-980403/src/newusers.c
---- shadow-980403.orig/src/newusers.c	Fri Jan 30 00:22:43 1998
-+++ shadow-980403/src/newusers.c	Fri Apr 17 16:55:33 1998
-@@ -76,11 +76,35 @@
- static void
- usage(void)
- {
--	fprintf(stderr, "Usage: %s [ input ]\n", Prog);
-+	fprintf (stderr, "Usage: %s [-p prototype tarfile] [ input ]\n", Prog);
-+	fprintf (stderr, "The prototype tarfile is only used for users\n");
-+	fprintf (stderr, "marked as anonymous ftp users. It must be a full pathname.\n");
- 	exit(1);
- }
- 
- /*
-+ * createuserdir - create a directory and chmod it
-+ */
-+
-+static int
-+createuserdir (char * dir, int uid, int gid, int line)
-+{
-+	if (mkdir (dir, 0777 & ~getdef_num("UMASK", 077))) {
-+		fprintf (stderr, "%s: line %d: mkdir %s failed\n",
-+			 Prog, line, dir);
-+		return -1;
-+	}
-+
-+	if (chown (dir, uid, gid)) {
-+		fprintf (stderr, "%s: line %d: chown %s failed\n",
-+			 Prog, line, dir);
-+		return -1;
-+	}
-+
-+	return 0;
-+}
-+
-+/*
-  * add_group - create a new group or add a user to an existing group
-  */
- 
-@@ -328,6 +352,8 @@
- main(int argc, char **argv)
- {
- 	char	buf[BUFSIZ];
-+	char	anonproto[BUFSIZ];
-+	int	flag;
- 	char	*fields[8];
- 	int	nfields;
- 	char	*cp;
-@@ -340,12 +366,23 @@
- 
- 	Prog = Basename(argv[0]);
- 
--	if (argc > 1 && argv[1][0] == '-')
--		usage ();
-+	* anonproto = '\0';
-+
-+	while ((flag = getopt (argc, argv, "p:h")) != EOF) {
-+		switch (flag) {
-+		case 'p':
-+			STRFCPY(anonproto, optarg);
-+			break;
-+		case 'h':
-+		default:
-+			usage ();
-+			break;
-+		}
-+	}
- 
--	if (argc == 2) {
--		if (! freopen (argv[1], "r", stdin)) {
--			snprintf(buf, sizeof buf, "%s: %s", Prog, argv[1]);
-+	if (optind < argc) {
-+		if (! freopen (argv[optind], "r", stdin)) {
-+			snprintf(buf, sizeof buf, "%s: %s", Prog, argv[optind]);
- 			perror (buf);
- 			exit (1);
- 		}
-@@ -499,15 +536,36 @@
- 		if (fields[6][0])
- 			newpw.pw_shell = fields[6];
- 
--		if (newpw.pw_dir[0] && access(newpw.pw_dir, F_OK)) {
--			if (mkdir (newpw.pw_dir,
--					0777 & ~getdef_num("UMASK", 077)))
--				fprintf (stderr, "%s: line %d: mkdir failed\n",
--					Prog, line);
--			else if (chown (newpw.pw_dir,
--					newpw.pw_uid, newpw.pw_gid))
--				fprintf (stderr, "%s: line %d: chown failed\n",
--					Prog, line);
-+		if (newpw.pw_dir[0]) {
-+		        char * userdir = strdup (newpw.pw_dir);
-+			char * anonpart;
-+			int rc;
-+
-+			if ((anonpart = strstr (userdir, "/./"))) {
-+			        * anonpart = '\0';
-+				anonpart += 2;
-+			}
-+			
-+			if (access(userdir, F_OK))
-+				rc = createuserdir (userdir, newpw.pw_uid, newpw.pw_gid, line);
-+			else
-+				rc = 0;
-+
-+			if (rc == 0 && anonpart) {
-+				if (* anonproto) {
-+					char cmdbuf [BUFSIZ];
-+					snprintf(cmdbuf, sizeof cmdbuf,
-+						 "cd %s; tar xf %s",
-+						 userdir, anonproto);
-+					system (cmdbuf);
-+				}
-+				if (strlen (anonpart) > 1) {
-+					strcat (userdir, anonpart);
-+					if (access (userdir, F_OK))
-+						createuserdir (userdir, newpw.pw_uid, newpw.pw_gid, line);
-+				}
-+			}
-+			free (userdir);
- 		}
- 
- 		/*

debian/HOME_MODE.xml

@@ -1,43 +0,0 @@
-<!--
-   Copyright (c) 1991 - 1993, Julianne Frances Haugh
-   Copyright (c) 1991 - 1993, Chip Rosenthal
-   Copyright (c) 2007 - 2009, Nicolas François
-   All rights reserved.
-  
-   Redistribution and use in source and binary forms, with or without
-   modification, are permitted provided that the following conditions
-   are met:
-   1. Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-   2. Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-   3. The name of the copyright holders or contributors may not be used to
-      endorse or promote products derived from this software without
-      specific prior written permission.
-  
-   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
-   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
-   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--->
-<varlistentry>
-  <term><option>HOME_MODE</option> (number)</term>
-  <listitem>
-    <para>
-      The mode for new home directories. If not specified,
-      the <option>UMASK</option> is used to create the mode.
-    </para>
-    <para>
-      <command>useradd</command> and <command>newusers</command> use this
-      to set the mode of the home directory they create.
-    </para>
-  </listitem>
-</varlistentry>

debian/Makefile

@@ -1,16 +0,0 @@
-PKG=shadow
-SITE=ftp://pkg-shadow.alioth.debian.org/pub/pkg-shadow/
-
-deb:: check_cheese
-
-include /usr/share/quilt/quilt.debbuild.mk
-
-check_cheese:
-	@dpkg-parsechangelog | grep -q "\* The \".*\".* release\." || { \
-		echo ""; \
-		echo " **                                  **"; \
-		echo " **  Warning: not a cheesy release!  **"; \
-		echo " **                                  **"; \
-		echo ""; \
-		exit 1; \
-	}

debian/NEWS

@@ -1,3 +1,19 @@
+shadow (1:4.17.0~rc1-1) unstable; urgency=medium
+
+  Username checking now once again follows the upstream rules, for
+  an ecosystem-wide ruleset and security.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sun, 22 Dec 2024 20:12:35 +0100
+
+shadow (1:4.16.0-5) unstable; urgency=medium
+
+  /var/log/faillog and the programs to read it are no longer part since
+  1:4.15.2-2.
+  The file isn't cleaned up automatically, which should be done manually,
+  unless it is still needed for special reasons.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sat, 16 Nov 2024 15:48:35 +0100
+
 shadow (1:4.13+dfsg1-2) unstable; urgency=medium
 
   The previous entry falsely states that PREVENT_NO_AUTH in /etc/login.defs

debian/README.Debian

@@ -0,0 +1,63 @@
+Read this file first for a brief overview of the current version
+of passwd.
+
+
+---Shadow passwords
+
+The command `shadowconfig on' will turn on shadow password support.
+This is the default. Turning off shadow passwords is not supported
+anymore.
+Together with shadow passwords, you get the ability to set password ages
+and expirations with chage(1).
+
+NOTE: If you use the nscd package, you may have problems with a
+slight delay in updating the password information. You may notice
+this during upgrades of certain packages that try to add a system
+user and then access the users information immediately afterwards.
+To avoid this, it is suggested that you stop the nscd daemon before
+upgrades, then restart it again.
+
+---General configuration
+
+Most of the configuration for the shadow utilities is in
+/etc/login.defs.  See login.defs(5).  The defaults are quite
+reasonable.
+
+Also see the /etc/pam.d/* files for each program to configure the PAM
+support. PAM documentation is available in several formats in the
+libpam-doc package.
+
+
+---Encryption
+
+This is enabled now using the /etc/pam.d/* files. Examples are given.
+
+
+---Adding users and groups
+
+Though you may add users and groups with the SysV type commands,
+useradd and groupadd, I recommend you add them with Debian adduser
+version 3+.  adduser gives you more configuration and conforms to the
+Debian UID and GID allocation.
+
+Editing user and group parameters can be done with usermod and
+groupmod.  Removing users and groups can be done with userdel and
+groupdel.
+
+
+--- Group administration
+
+Local group allocation is much easier.  With gpasswd(1) you can
+designate users to administer groups.  They can then securely add or
+remove users from the group.
+
+
+--- What to read next?
+
+Read the manpages, the other files in this directory, and the Shadow
+Password HOWTO (included in the doc-linux package).  A large portion
+of these files deals with getting shadow installed.  You can, of
+course, ignore those parts.
+
+Also, the libpam-doc package will go a long way to allowing you to take
+full advantage of the PAM authentication scheme.

debian/README.debian

@@ -1,62 +0,0 @@
-Read this file first for a brief overview of the new versions of login
-and passwd.
-
-
----Shadow passwords
-
-The command `shadowconfig on' will turn on shadow password support.
-`shadowconfig off' will turn it back off.  If you turn on shadow
-password support, you'll gain the ability to set password ages and
-expirations with chage(1).
-
-NOTE: If you use the nscd package, you may have problems with a
-slight delay in updating the password information. You may notice
-this during upgrades of certain packages that try to add a system
-user and then access the users information immediately afterwards.
-To avoid this, it is suggested that you stop the nscd daemon before
-upgrades, then restart it again.
-
----General configuration
-
-Most of the configuration for the shadow utilities is in
-/etc/login.defs.  See login.defs(5).  The defaults are quite
-reasonable.
-
-Also see the /etc/pam.d/* files for each program to configure the PAM
-support. PAM documentation is available in several formats in the
-libpam-doc package.
-
-
----MD5 Encryption
-
-This is enabled now using the /etc/pam.d/* files. Examples are given.
-
-
----Adding users and groups
-
-Though you may add users and groups with the SysV type commands,
-useradd and groupadd, I recommend you add them with Debian adduser
-version 3+.  adduser gives you more configuration and conforms to the
-Debian UID and GID allocation.
-
-Editing user and group parameters can be done with usermod and
-groupmod.  Removing users and groups can be done with userdel and
-groupdel.
-
-
---- Group administration
-
-Local group allocation is much easier.  With gpasswd(1) you can
-designate users to administer groups.  They can then securely add or
-remove users from the group.
-
-
---- What to read next?
-
-Read the manpages, the other files in this directory, and the Shadow
-Password HOWTO (included in the doc-linux package).  A large portion
-of these files deals with getting shadow installed.  You can, of
-course, ignore those parts.
-
-Also, the libpam-doc package will go a long way to allowing you to take
-full advantage of the PAM authentication scheme.

debian/changelog

@@ -1,3 +1,382 @@
+shadow (1:4.19.3-1) unstable; urgency=medium
+
+  * New upstream version 4.19.3
+  * Update Upstream signing keys
+  * d/watch: enable pgpmode=auto
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Mon, 23 Feb 2026 09:54:37 +0100
+
+shadow (1:4.19.2-1) unstable; urgency=medium
+
+  * New upstream version 4.19.2
+  * Refresh patches, drop upstream-applied chkhask patches
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sun, 25 Jan 2026 14:18:54 +0100
+
+shadow (1:4.19.0-4) unstable; urgency=medium
+
+  * Import upstream patches to fix hash check (Closes: #1124835)
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Thu, 08 Jan 2026 00:01:00 +0100
+
+shadow (1:4.19.0-3) unstable; urgency=medium
+
+  * chpasswd: Disable broken hash check, bug #1124835
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Wed, 07 Jan 2026 11:11:24 +0100
+
+shadow (1:4.19.0-2) unstable; urgency=medium
+
+  * Disable logind integration on !linux
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Tue, 06 Jan 2026 02:38:50 +0100
+
+shadow (1:4.19.0-1) unstable; urgency=medium
+
+  * New upstream version 4.19.0
+  * Refresh patches
+  * Drop upstream-applied patches
+  * Add new build-dependency on libsystemd-dev [linux-any]
+  * login.defs: Remove commented out USERDEL_CMD
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Tue, 06 Jan 2026 01:16:37 +0100
+
+shadow (1:4.18.0-2) unstable; urgency=medium
+
+  [ Frans Spiesschaert ]
+  * Update Dutch translations (Closes: #1115411)
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Wed, 17 Sep 2025 00:46:09 +0200
+
+shadow (1:4.18.0-1) unstable; urgency=medium
+
+  * New upstream version 4.18.0
+  * Refresh patches
+  * d/copyright: update for upstream-deleted code
+  * Drop newly unnecessay Build-Depends: bison
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Tue, 26 Aug 2025 23:05:38 +0200
+
+shadow (1:4.17.4-2) unstable; urgency=medium
+
+  * Allow LOGIN_ENV_SAFELIST (from util-linux) in /etc/login.defs.
+    Using patch from upstream.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sat, 19 Apr 2025 12:20:28 +0200
+
+shadow (1:4.17.4-1) unstable; urgency=medium
+
+  * New upstream version 4.17.4
+  * Rebase patches
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sat, 29 Mar 2025 13:28:35 +0100
+
+shadow (1:4.17.3-3) unstable; urgency=medium
+
+  * Accept /usr/sbin/nologin as an alternate to /sbin/nologin.
+    Thanks to Marc Haber
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Fri, 28 Mar 2025 12:13:03 +0100
+
+shadow (1:4.17.3-2) unstable; urgency=medium
+
+  * Do not warn about useradd --system with Debian-globally allocated uids
+    (Closes: #1100563)
+  * Refresh patches
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sun, 16 Mar 2025 13:39:58 +0100
+
+shadow (1:4.17.3-1) unstable; urgency=medium
+
+  * New upstream version 4.17.3
+  * Refresh patches and include upstream patch for getdate.
+    Include https://github.com/shadow-maint/shadow/pull/1214 to fix
+    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1095430 in the
+    way upstream intends to fix it.
+  * Explicitly pass {s,}bindir to configure.
+    Avoids upstream hacks in configure.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Mon, 24 Feb 2025 23:09:52 +0100
+
+shadow (1:4.17.2-6) unstable; urgency=medium
+
+  * d/rules: ensure lib/getdate.c gets rebuilt
+  * configure: always pick /usr/bin/passwd.
+    Thanks to Jochen Sprickerhof <jspricke@debian.org>
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Mon, 24 Feb 2025 12:16:49 +0100
+
+shadow (1:4.17.2-5) unstable; urgency=medium
+
+  * Warn about future --badname removal.
+    Upstream PR 1158 plans to remove this flag, probably in the forky
+    timeframe. Warn users now.
+  * Import upstream patch to fix chfn (#1096187)
+  * Add regression test for #1096187
+  * Add regression test for #1095430
+  * Remove "shadowconfig off"
+    If needed please run pwunconv, grpunconv manually, but please understand
+    you are on your own.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Mon, 17 Feb 2025 19:54:09 +0100
+
+shadow (1:4.17.2-4) unstable; urgency=medium
+
+  * Revert upstreams chfn.c strsep change (Closes: #1096187)
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Mon, 17 Feb 2025 12:28:56 +0100
+
+shadow (1:4.17.2-3) unstable; urgency=medium
+
+  * Revert upstreams strtoday calculation "fix" (Closes: #1095430)
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sun, 16 Feb 2025 20:24:35 +0100
+
+shadow (1:4.17.2-2) unstable; urgency=medium
+
+  * Upload to unstable.
+  * Apply upstream revert of "Use local time for human-readable dates"
+    (Closes: #1095430)
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sat, 15 Feb 2025 17:21:17 +0100
+
+shadow (1:4.17.2-1) experimental; urgency=medium
+
+  * New upstream version 4.17.2
+  * Apply upstream patch from Marc Haber to document E_BAD_NAME
+  * Refresh patches
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sun, 09 Feb 2025 18:14:51 +0100
+
+shadow (1:4.17.1-2) experimental; urgency=medium
+
+  * Rewrite shadowconfig(8) manpage.
+    Thanks to Alejandro Colomar <alx@kernel.org>
+  * Remove unnecessary Build-Depends: quilt.
+    Thanks to Bastian Germann (Closes: #1092461)
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Wed, 08 Jan 2025 12:40:10 +0100
+
+shadow (1:4.17.1-1) experimental; urgency=medium
+
+  * New upstream version 4.17.1
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sat, 04 Jan 2025 12:41:51 +0100
+
+shadow (1:4.17.0-1) experimental; urgency=medium
+
+  * New upstream version 4.17.0
+  * Refresh patches.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sat, 28 Dec 2024 13:14:16 +0100
+
+shadow (1:4.17.0~rc1-2) experimental; urgency=medium
+
+  * Remove Debian patch to relax username checks.
+    Per discussion on d-devel, with upstream, and with the
+    adduser maintainer.
+    Thanks: Marc Haber
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sun, 22 Dec 2024 20:15:16 +0100
+
+shadow (1:4.17.0~rc1-1) experimental; urgency=medium
+
+  * New upstream version 4.17.0~rc1
+  * Add upstream patch for new return-code for bad usernames
+  * Refresh patches
+  * d/copyright: update
+  * Forbid purely numeric user/group names, and "." and ".."
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Fri, 06 Dec 2024 19:55:32 +0100
+
+shadow (1:4.16.0-7) unstable; urgency=medium
+
+  [ Florent 'Skia' Jacquet ]
+  * d/patches: fix 'upstream' test suite
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Fri, 06 Dec 2024 13:51:40 +0100
+
+shadow (1:4.16.0-6) unstable; urgency=medium
+
+  * Add NEWS entry about faillog (Closes: #1074320)
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Fri, 06 Dec 2024 13:29:54 +0100
+
+shadow (1:4.16.0-5) unstable; urgency=medium
+
+  [ Chris Hofstaedtler ]
+  * Always build with btrfs support on linux-any (Closes: #856557)
+  * debputy.manifest: merge path-metadata entries
+  * login.defs: remove info about write(1)
+    Which is not part of Debian trixie. (Closes: #1087519)
+
+  [ Pino Toscano ]
+  * Include <utmpx.h>, fixing the build on GNU/Hurd
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Fri, 15 Nov 2024 20:30:32 +0100
+
+shadow (1:4.16.0-4) unstable; urgency=medium
+
+  * Drop Debian-only cppw, cpgr tools (Closes: #750752)
+  * Stop patching login, not installed anymore
+  * Define LOGIN_NAME_MAX on HURD
+  * Remove libsystemd-dev Build-Depends.
+    Only necessary for login(1).
+  * Stop building programs we do not install
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Tue, 06 Aug 2024 00:29:18 +0200
+
+shadow (1:4.16.0-3) unstable; urgency=medium
+
+  * Upload to unstable.
+  * Fix FTBFS on hurd.
+    DEB_HOST_ARCH_OS was unset.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Mon, 05 Aug 2024 17:21:27 +0200
+
+shadow (1:4.16.0-2) experimental; urgency=medium
+
+  * passwd: switch Depends from login to login.defs
+    login will again be installed on fewer systems, but existing installs
+    will retain it (it is Protected: yes).
+  * Drop login package, to allow takeover by util-linux.
+    Move shadow.mo to Package: passwd, have passwd Replaces: older login.
+  * login.defs: ship manpage
+  * Re-add workarounds for tests in tests/tests directory.
+    4.15.3 fixed this, but 4.16.0 happened earlier.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Mon, 05 Aug 2024 02:36:29 +0200
+
+shadow (1:4.16.0-1) experimental; urgency=medium
+
+  * New upstream version 4.16.0
+    * Rebase patches
+  * Split /etc/login.defs into its own binary package (Closes: #1074394)
+  * Rename libsubid4 to libsubid5 (soname bump)
+  * d/watch: add versionmangle for -rc
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Fri, 02 Aug 2024 17:35:29 +0200
+
+shadow (1:4.15.3-3) unstable; urgency=medium
+
+  * Forbid backslashes in user/group-names.
+    They can still be used with --force-badname, but it's a start. In the
+    long run I want to remove our relax patch, and upstream should fix the
+    line continuation too. For #1076619.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sun, 21 Jul 2024 21:05:32 +0200
+
+shadow (1:4.15.3-2) unstable; urgency=medium
+
+  [ Pino Toscano ]
+  * d/rules: actually enable Linux-only options on Linux
+    This enables --enable-logind and --with-audit.
+
+  [ Chris Hofstaedtler ]
+  * Stop installing groupmems(8) (Closes: #1004472, LP: #2039541)
+  * login.defs: remove obsolete/confusing comments
+  * login.defs: resync comments with upstream
+  * login.defs: remove incomplete list of unused vars
+  * login.defs: remove obscure, defaulted vars
+  * login.defs: remove vars ignored by su(1)
+  * login.defs: remove CONSOLE_GROUPS, ignored with PAM
+  * login.defs: remove CONSOLE, ignored with PAM
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sun, 07 Jul 2024 15:30:38 +0200
+
+shadow (1:4.15.3-1) unstable; urgency=medium
+
+  * New upstream version 4.15.3
+  * tests: follow upstream subdir fix
+  * Fix setup of test libsubid-04_nss
+  * Drop login.postinst, obsoleted by #1074121
+  * Bump Standards-Version to 4.7.0
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sat, 06 Jul 2024 23:50:36 +0200
+
+shadow (1:4.15.2-3) unstable; urgency=medium
+
+  * d/watch: add versionmangle for -rc
+  * Revert "Use upstream's restrictions on user- and group names again".
+    Breaks adduser's tests, see #1074306.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Wed, 26 Jun 2024 12:40:34 +0200
+
+shadow (1:4.15.2-2) unstable; urgency=medium
+
+  * useradd(8): Fix missing paragraph on username length
+  * d/rules: explicitly set --with-audit and --enable-subordinate-ids
+  * Remove faillog support.
+    Stop installing faillog binary and man pages. Stop creating
+    /var/log/faillog in login.postinst.
+    PAM has removed support for /var/log/faillog by dropping pam_tally, and
+    login itself cannot write to it either.
+  * Use upstream's restrictions on user- and group names again.
+    Upstream started supporting mixed-case names some time ago.
+    Purely numeric names (#79682) are now forbidden again, as there is no
+    way of distinguishing them from user/group IDs otherwise.
+  * Drop useradd's backwards-compatibility -O flag
+  * Remove our copy of HOME_MODE.xml, identical upstream
+  * shadowconfig.8: actually install again
+  * passwd: add Depends: login.
+    Stop-gap until passwd can takeover /etc/login.defs from login.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Tue, 25 Jun 2024 19:42:24 +0200
+
+shadow (1:4.15.2-1) unstable; urgency=medium
+
+  * New upstream version 4.15.2
+    Includes fix for csrand_uniform().
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sat, 22 Jun 2024 17:37:34 +0200
+
+shadow (1:4.15.1-1) unstable; urgency=medium
+
+  * New upstream version 4.15.1
+    Closes: #832047, #812127, #1034312, #856902, #791806
+    Closes: #1006216, #1006225, #1006208
+    * contrib/atudel, non-DFSG-compliant was removed upstream
+    * Remove obsolete configure flag --without-libcrack
+    * Use functions from libbsd (Closes: #1032393)
+    * Build-Depend: libltdl-dev for LT_LIB_DLLOAD
+      (Closes: #1065350)
+    * Build-Depend: pkgconf
+    * Drop upstream applied patches
+    * Disable FTMP_FILE by default, drop login failure logging
+    * Rebase patch 401_cppw_src.dpatch
+    * Rename patch 402_cppw_selinux
+    * Use upstream FAILLOG_ENAB code, incompatible with PAM
+      (Closes: #776314)
+    * Rebase patch 463_login_delay_obeys_to_PAM
+    * Rebase patch 501_commonio_group_shadow
+    * Rebase patch 502_debian_useradd_defaults
+    * Rebase patch 506_relaxed_usernames
+    * Rebase patch 542_useradd-O_option
+  * Update upstream signing keys
+  * Tag build with dh-package-notes
+  * Turn off --enable-lastlog, drop lastlog from not-installed
+  * Explicitly enable logind on linux-any
+  * Update default ENCRYPT_METHOD (Closes: #1043236)
+  * login: switch from Essential to Protected: yes (Closes: #960638)
+    Moves Pre-Depends to Depends.
+  * Enable acl, xattr support (Closes: #745796)
+  * login.defs: remove PAM-unsupported crypt settings (Closes: #1055582)
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sat, 22 Jun 2024 16:08:41 +0200
+
+shadow (1:4.13+dfsg1-5) unstable; urgency=medium
+
+  * Add myself to Uploaders, per discussion with Serge Hallyn
+  * Apply wrap-and-sort -kas style
+  * Use debputy to avoid Rules-Requires-Root: binary-targets
+  * libsubid4: tighten package-internal dependencies
+
+  [ Serge Hallyn ]
+  * Drop pam_lastlog.so from config. (Closes: #1068229)
+  * Stop installing lastlog binary.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sun, 02 Jun 2024 20:01:51 +0200
+
 shadow (1:4.13+dfsg1-4) unstable; urgency=medium
 
   [ Helmut Grohne ]

debian/control

@@ -1,75 +1,78 @@
 Source: shadow
 Maintainer: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
-Uploaders: Serge Hallyn <serge@hallyn.com>
+Uploaders:
+ Serge Hallyn <serge@hallyn.com>,
+ Chris Hofstaedtler <zeha@debian.org>,
 Section: admin
 Priority: required
-Build-Depends: debhelper-compat (= 13),
-               gettext,
-               libcrypt-dev,
-               libpam0g-dev,
-               quilt,
-               xsltproc <!nodoc>,
-               docbook-xsl <!nodoc>,
-               docbook-xml <!nodoc>,
-               libxml2-utils <!nodoc>,
-               libselinux1-dev [linux-any],
-               libsemanage-dev [linux-any],
-               itstool <!nodoc>,
-               bison,
-               libaudit-dev [linux-any]
-Standards-Version: 4.6.1
+Build-Depends:
+ debhelper-compat (= 13),
+ dh-package-notes,
+ dh-sequence-zz-debputy-rrr (>= 0.1.23~),
+ docbook-xml <!nodoc>,
+ docbook-xsl <!nodoc>,
+ gettext,
+ itstool <!nodoc>,
+ libacl1-dev,
+ libattr1-dev,
+ libaudit-dev [linux-any],
+ libbsd-dev,
+ libcrypt-dev,
+ libltdl-dev,
+ libpam0g-dev,
+ libselinux1-dev [linux-any],
+ libsemanage-dev [linux-any],
+ libsystemd-dev [linux-any],
+ libxml2-utils <!nodoc>,
+ pkgconf,
+ systemd-dev [linux-any],
+ xsltproc <!nodoc>,
+Standards-Version: 4.7.0
 Vcs-Git: https://salsa.debian.org/debian/shadow.git -b master
 Vcs-Browser: https://salsa.debian.org/debian/shadow
 Homepage: https://github.com/shadow-maint/shadow
-Rules-Requires-Root: binary-targets
+Rules-Requires-Root: no
+X-Style: black
 
 Package: passwd
 Architecture: any
 Multi-Arch: foreign
-Depends: ${shlibs:Depends},
-         ${misc:Depends},
-         libpam-modules
-Recommends: sensible-utils
+Depends:
+ base-passwd (>= 3.6.4),
+ libpam-modules,
+ login.defs,
+Recommends:
+ sensible-utils,
+Replaces:
+ login (<< 1:4.16.0-2~),
 Description: change and administer password and group data
  This package includes passwd, chsh, chfn, and many other programs to
  maintain password and group data.
  .
  Shadow passwords are supported.  See /usr/share/doc/passwd/README.Debian
 
-Package: login
-Architecture: any
+Package: login.defs
+Architecture: all
 Multi-Arch: foreign
-Essential: yes
-Pre-Depends: ${shlibs:Depends},
-             ${misc:Depends},
-             libpam-runtime,
-             libpam-modules
-Breaks: hurd (<< 20140206~) [hurd-any]
-Conflicts: python-4suite (<< 0.99cvs20060405-1)
-Replaces: hurd (<< 20140206~) [hurd-any]
-Description: system login tools
- This package provides some required infrastructure for logins and for
- changing effective user or group IDs, including:
-  * login, the program that invokes a user shell on a virtual terminal;
-  * nologin, a dummy shell for disabled user accounts;
+Replaces:
+ login (<< 1:4.16.0-2~),
+Description: system user management configuration
+ This package provides the login.defs configuration file,
+ used by otherwise unrelated tools managing system users.
 
 Package: uidmap
 Architecture: any
 Multi-Arch: foreign
 Priority: optional
-Depends: ${shlibs:Depends},
-         ${misc:Depends}
 Description: programs to help use subuids
  These programs help unprivileged users to create uid and gid mappings in
  user namespaces.
 
-Package: libsubid4
+Package: libsubid5
 Section: libs
 Priority: optional
 Architecture: any
 Multi-Arch: same
-Pre-Depends: ${misc:Pre-Depends}
-Depends: ${shlibs:Depends}, ${misc:Depends}
 Description: subordinate id handling library -- shared library
  The library provides an interface for querying, granding and ungranting
  subordinate user and group ids.
@@ -79,10 +82,11 @@ Section: libdevel
 Priority: optional
 Architecture: any
 Multi-Arch: same
-Depends: ${misc:Depends}, libsubid4 (= ${binary:Version})
+Depends:
+ libsubid5 (= ${binary:Version}),
 Description: subordinate id handling library -- shared library
  The library provides an interface for querying, granding and ungranting
  subordinate user and group ids.
  .
  This package contains the C header files that are
- needed for applications to use the libsubid4 library.
+ needed for applications to use the libsubid library.

debian/copyright

@@ -1,12 +1,10 @@
 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Upstream-Name: Shadow
 Source: https://github.com/shadow-maint/shadow
-Note: atudel is licensed under BSD-4-Clause which is not DFSG compatible
-Files-Excluded: contrib/atudel
 
 Files: *
 Copyright: 1989-1994, Julianne Frances Haugh
-           2016-2022, Serge Hallyn <serge@hallyn.com>
+           2016-2024, Serge Hallyn <serge@hallyn.com>
 License: BSD-3-clause
 
 Files: man/po/da.po
@@ -59,8 +57,7 @@ Files: man/id/man1/login.1
 Copyright: 1993, Rickard E. Faith <faith@cs.unc.edu>
 License: BSD-3-clause
 
-Files: man/ja/man1/groups.1
-       man/ja/man5/limits.5
+Files: man/ja/man5/limits.5
        man/ja/man8/vipw.8
 Copyright: 2001, Maki KURODA
 License: BSD-3-clause
@@ -85,38 +82,18 @@ Copyright: 1993, Michael Haardt <michael@moria.de>
            1993, Scorpio, www.linuxforum.net
 License: GPL-2+
 
-Files: contrib/udbachk.tgz
-Copyright: 1999, Sami Kerola and Janne Riihijärvi
-License: GPL-2+
-
 Files: man/hu/man5/*
 Copyright: 1993, Michael Haardt <u31b3hs@pool.informatik.rwth-aachen.de>
 License: GPL-2+
 
-Files: contrib/adduser2.sh
-Copyright: 1996, Petri Mattila, Prihateam Networks <petri@prihateam.fi>
-License: GPL-2+
-
-Files: contrib/pwdauth.c
-Copyright: 1996, Marek Michalkiewicz
-License: BSD-3-clause
-
 Files: lib/subordinateio.h
 Copyright: 2012, Eric W. Biederman
 License: BSD-3-clause
 
-Files: libmisc/date_to_str.c
-Copyright: 2021, Alejandro Colomar <alx.manpages@gmail.com>
-License: BSD-3-clause
-
 Files: man/hu/man1/su.1
 Copyright: 1999, Ragnar Hojland Espinosa <ragnar@macula.net>
 License: BSD-3-clause
 
-Files: man/ja/man1/id.1
-Copyright: 2000, ISHIKAWA Keisuke
-License: BSD-3-clause
-
 Files: man/ja/man8/pwconv.8
 Copyright: 2001, Yuichi SATO
 License: BSD-3-clause
@@ -139,16 +116,6 @@ Copyright: 1997, Guy Maor <maor@ece.utexas.edu>
            2007 - 2013, Nicolas François
 License: GPL-2+
 
-Files: libmisc/getdate.y
-Copyright: Steven M. Bellovin <smb@research.att.com>
-License: public-domain
- Originally written by Steven M. Bellovin <smb@research.att.com> while
- at the University of North Carolina at Chapel Hill.  Later tweaked by
- a couple of people on Usenet.  Completely overhauled by Rich $alz
- <rsalz@bbn.com> and Jim Berets <jberets@bbn.com> in August, 1990;
- .
- This code is in the public domain and has no copyright.
-
 Files: man/ko/man5/*
 Copyright: 2000, ASPLINUX <man@asp-linux.co.kr>
 License: GPL-2+
@@ -161,17 +128,6 @@ Copyright: 1999-2001, Ben Collins <bcollins@debian.org>
            2017-2022 Balint Reczey <balint@balintreczey.hu>
 License: BSD-3-clause
 
-Files: debian/HOME_MODE.xml
-Copyright: 1991-1993, Chip Rosenthal
-           1991-1993, Julianne Frances Haugh
-           2007-2009, Nicolas François
-License: BSD-3-clause
-
-Files: debian/patches/401_cppw_src.dpatch
-Copyright: 1997, Guy Maor <maor@ece.utexas.edu>
-           1999, Stephen Frost <sfrost@snowman.net>
-License: GPL-2+
-
 Files: debian/passwd.expire.cron
 Copyright: 1999, Ben Collins <bcollins@debian.org>
 License: BSD-3-clause

debian/cpgr.8

@@ -1 +0,0 @@
-.so man8/cppw.8

debian/cppw.8

@@ -1,27 +0,0 @@
-.TH CPPW 8 "7 Apr 2005"
-.SH NAME
-cppw, cpgr \- copy with locking the given file to the password or group file
-.SH SYNOPSIS
-\fBcppw\fR [\fB\-h\fR] [\fB\-s\fR] password_file
-.br
-\fBcpgr\fR [\fB\-h\fR] [\fB\-s\fR] group_file
-
-.SH DESCRIPTION
-.BR cppw " and " cpgr
-will copy, with locking, the given file to
-.IR /etc/passwd " and " /etc/group ", respectively."
-With the \fB\-s\fR flag, they will copy the shadow versions of those files,
-.IR /etc/shadow " and " /etc/gshadow ", respectively."
-
-With the \fB\-h\fR flag, the commands display a short help message and exit
-silently.
-.SH "SEE ALSO"
-.BR vipw (8),
-.BR vigr (8),
-.BR group (5),
-.BR passwd (5),
-.BR shadow (5),
-.BR gshadow (5)
-.SH AUTHOR
-\fBcppw\fR and \fBcpgr\fR were written by Stephen Frost, based on
-\fBvipw\fR and \fBvigr\fR written by Guy Maor.

debian/debputy.manifest

@@ -0,0 +1,24 @@
+manifest-version: '0.1'
+packages:
+  passwd:
+    transformations:
+    - path-metadata:
+        paths:
+        - usr/bin/chfn
+        - usr/bin/chsh
+        - usr/bin/gpasswd
+        - usr/bin/passwd
+        mode: "u=rwxs,go=rx"
+    - path-metadata:
+        paths:
+        - usr/bin/chage
+        - usr/bin/expiry
+        group: "shadow"
+        mode: "u=rwx,go=rxs"
+  uidmap:
+    transformations:
+    - path-metadata:
+        paths:
+        - usr/bin/newgidmap
+        - usr/bin/newuidmap
+        mode: "u=rwxs,go=rx"

debian/dependencies

@@ -1,19 +1,7 @@
 Build-Depends:
 ==============
- * autoconf
- * automake1.9
-   works with 1.7 or 1.9 (at least)
- * libtool
  * gettext
    POT, PO, GMO regenerated?
- * libpam0g-dev
-   OK
- * debhelper (>= 4.1.16)
- * po-debconf
-   OK
- * quilt
-   patch system
- * dpkg-dev (>= 1.13.5)
  * xsltproc
    used to generate the manpages
  * docbook-xsl
@@ -25,70 +13,4 @@ Build-Depends:
    Needed by JH_CHECK_XML_CATALOG([-//OASIS//DTD DocBook XML V4.1.2//EN], [DocBook XML DTD V4.1.2], [], enable_man=no)
  * libxml2-utils
    needed by the JH_CHECK_XML_CATALOG macros
- * cdbs
-   used in debian/rules
- * libselinux1-dev [!hurd-i386 !kfreebsd-i386 !kfreebsd-amd64]
- * gnome-doc-utils (>= 0.4.3-1)
-   xml2po, 0.4.3-1 needed for the -l switch.
-
-passwd Depends:
-===============
- * ${shlibs:Depends}
-   OK
- * ${loginpam}
-   - hurd
-     login
-     libpam-modules (>= 0.72-5)
-   - other archs
-     + login (>= 970502-1)
-       login is needed because some passwd utils need /etc/login.defs
-       login is Essential, so this is just to enforce the version
-     + libpam-modules (>= 0.72-5)
- * debianutils (>= 2.15.2)
-   After 1:4.0.12-6, {add,remove}-shell are distributed in debianutils (2.15)
-   /etc/shell was forgotten and introduced in debianutils in 2.15.2
-
-passwd Conflicts:
-=================
-
-passwd Replaces:
-================
-   Some of the passwd man pages are also distributed in some manpages* packages.
-   Look at the debian/02/run test to optimize these dependencies.
-   NOTE: Not all maintainers have been notified.
- * manpages-de (<< 0.4-9), manpages-fi (<< 0.2-4), manpages-fr (<<1.64.0-1), manpages-hu (<< 20010119-5), manpages-it (<< 0.3.4-3), manpages-ja (<< 0.5.0.0.20050915-1), manpages-ko (<< 20050219-2), manpages-es (<< 1.55-4), manpages-es-extra (<< 0.8a-15), manpages-ru (<< 0.98-3)
-   All those packages have been updated during sarge->etch. So these Replaces
-   should be removed after lenny release
- * manpages-tr, manpages-zh
-   Those packages are still in etch, so the Replaces should be kept even
-   after lenny release
-
-login Pre-Depends:
-==================
- * ${shlibs:Depends}
- * libpam-runtime (>= 0.76-14)
-   sarge contained 0.76-22
-
-Why Pre-Depends? (because it's an essential package?)
-
-login Depends:
-==============
- * libpam-modules (>= 0.72-5)
-   libpam-modules is needed.
-   potato contained 0.72-9
-
-login Conflicts:
-================
-
-login Replaces:
-===============
- * Some of the login man pages are also distributed in some manpages* packages.
-   Look at the debian/02/run test to optimize these dependencies.
-   NOTE: Not all maintainers have been notified.
-   - manpages-fi, manpages-fr (<<1.64.0-1), manpages-hu, manpages-it, manpages-ko, manpages-ja (<< 0.5.0.0.20050915-1), manpages-de (<< 0.4-10), manpages-es-extra (<<0.8a-15) 
-     Those are packages that have been updated during sarge->etch. These
-     Replaces should be removed after lenny
-   - manpages-tr, manpages-zh
-     Those packages are still in etch, so the Replaces should be kept even
-     after lenny release
 

debian/gbp.conf

@@ -0,0 +1,7 @@
+[DEFAULT]
+upstream-branch = upstream
+pristine-tar = True
+sign-tags = True
+
+[pq]
+patch-numbers = False

debian/libsubid4.symbols

@@ -1,10 +0,0 @@
-libsubid.so.4 libsubid4 #MINVER#
- subid_get_gid_owners@Base 1:4.11.1
- subid_get_gid_ranges@Base 1:4.11.1
- subid_get_uid_owners@Base 1:4.11.1
- subid_get_uid_ranges@Base 1:4.11.1
- subid_grant_gid_range@Base 1:4.11.1
- subid_grant_uid_range@Base 1:4.11.1
- subid_init@Base 1:4.11.1
- subid_ungrant_gid_range@Base 1:4.11.1
- subid_ungrant_uid_range@Base 1:4.11.1

debian/libsubid5.symbols

@@ -0,0 +1,11 @@
+libsubid.so.5 libsubid5 #MINVER#
+ subid_free@Base 1:4.16.0
+ subid_get_gid_owners@Base 1:4.16.0
+ subid_get_gid_ranges@Base 1:4.16.0
+ subid_get_uid_owners@Base 1:4.16.0
+ subid_get_uid_ranges@Base 1:4.16.0
+ subid_grant_gid_range@Base 1:4.16.0
+ subid_grant_uid_range@Base 1:4.16.0
+ subid_init@Base 1:4.16.0
+ subid_ungrant_gid_range@Base 1:4.16.0
+ subid_ungrant_uid_range@Base 1:4.16.0

debian/login.defs

@@ -1,394 +0,0 @@
-#
-# /etc/login.defs - Configuration control definitions for the login package.
-#
-# Three items must be defined:  MAIL_DIR, ENV_SUPATH, and ENV_PATH.
-# If unspecified, some arbitrary (and possibly incorrect) value will
-# be assumed.  All other items are optional - if not specified then
-# the described action or option will be inhibited.
-#
-# Comment lines (lines beginning with "#") and blank lines are ignored.
-#
-# Modified for Linux.  --marekm
-
-# REQUIRED for useradd/userdel/usermod
-#   Directory where mailboxes reside, _or_ name of file, relative to the
-#   home directory.  If you _do_ define MAIL_DIR and MAIL_FILE,
-#   MAIL_DIR takes precedence.
-#
-#   Essentially:
-#      - MAIL_DIR defines the location of users mail spool files
-#        (for mbox use) by appending the username to MAIL_DIR as defined
-#        below.
-#      - MAIL_FILE defines the location of the users mail spool files as the
-#        fully-qualified filename obtained by prepending the user home
-#        directory before $MAIL_FILE
-#
-# NOTE: This is no more used for setting up users MAIL environment variable
-#       which is, starting from shadow 4.0.12-1 in Debian, entirely the
-#       job of the pam_mail PAM modules
-#       See default PAM configuration files provided for
-#       login, su, etc.
-#
-# This is a temporary situation: setting these variables will soon
-# move to /etc/default/useradd and the variables will then be
-# no more supported
-MAIL_DIR        /var/mail
-#MAIL_FILE      .mail
-
-#
-# Enable logging and display of /var/log/faillog login failure info.
-# This option conflicts with the pam_tally PAM module.
-#
-FAILLOG_ENAB		yes
-
-#
-# Enable display of unknown usernames when login failures are recorded.
-#
-# WARNING: Unknown usernames may become world readable. 
-# See #290803 and #298773 for details about how this could become a security
-# concern
-LOG_UNKFAIL_ENAB	no
-
-#
-# Enable logging of successful logins
-#
-LOG_OK_LOGINS		no
-
-#
-# Enable "syslog" logging of su activity - in addition to sulog file logging.
-# SYSLOG_SG_ENAB does the same for newgrp and sg.
-#
-SYSLOG_SU_ENAB		yes
-SYSLOG_SG_ENAB		yes
-
-#
-# If defined, all su activity is logged to this file.
-#
-#SULOG_FILE	/var/log/sulog
-
-#
-# If defined, file which maps tty line to TERM environment parameter.
-# Each line of the file is in a format something like "vt100  tty01".
-#
-#TTYTYPE_FILE	/etc/ttytype
-
-#
-# If defined, login failures will be logged here in a utmp format
-# last, when invoked as lastb, will read /var/log/btmp, so...
-#
-FTMP_FILE	/var/log/btmp
-
-#
-# If defined, the command name to display when running "su -".  For
-# example, if this is defined as "su" then a "ps" will display the
-# command is "-su".  If not defined, then "ps" would display the
-# name of the shell actually being run, e.g. something like "-sh".
-#
-SU_NAME		su
-
-#
-# If defined, file which inhibits all the usual chatter during the login
-# sequence.  If a full pathname, then hushed mode will be enabled if the
-# user's name or shell are found in the file.  If not a full pathname, then
-# hushed mode will be enabled if the file exists in the user's home directory.
-#
-HUSHLOGIN_FILE	.hushlogin
-#HUSHLOGIN_FILE	/etc/hushlogins
-
-#
-# *REQUIRED*  The default PATH settings, for superuser and normal users.
-#
-# (they are minimal, add the rest in the shell startup files)
-ENV_SUPATH	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-ENV_PATH	PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
-
-#
-# Terminal permissions
-#
-#	TTYGROUP	Login tty will be assigned this group ownership.
-#	TTYPERM		Login tty will be set to this permission.
-#
-# If you have a "write" program which is "setgid" to a special group
-# which owns the terminals, define TTYGROUP to the group number and
-# TTYPERM to 0620.  Otherwise leave TTYGROUP commented out and assign
-# TTYPERM to either 622 or 600.
-#
-# In Debian /usr/bin/bsd-write or similar programs are setgid tty
-# However, the default and recommended value for TTYPERM is still 0600
-# to not allow anyone to write to anyone else console or terminal
-
-# Users can still allow other people to write them by issuing 
-# the "mesg y" command.
-
-TTYGROUP	tty
-TTYPERM		0600
-
-#
-# Login configuration initializations:
-#
-#	ERASECHAR	Terminal ERASE character ('\010' = backspace).
-#	KILLCHAR	Terminal KILL character ('\025' = CTRL/U).
-#	UMASK		Default "umask" value.
-#
-# The ERASECHAR and KILLCHAR are used only on System V machines.
-# 
-# UMASK is the default umask value for pam_umask and is used by
-# useradd and newusers to set the mode of the new home directories.
-# 022 is the "historical" value in Debian for UMASK
-# 027, or even 077, could be considered better for privacy
-# There is no One True Answer here : each sysadmin must make up his/her
-# mind.
-#
-# If USERGROUPS_ENAB is set to "yes", that will modify this UMASK default value
-# for private user groups, i. e. the uid is the same as gid, and username is
-# the same as the primary group name: for these, the user permissions will be
-# used as group permissions, e. g. 022 will become 002.
-#
-# Prefix these values with "0" to get octal, "0x" to get hexadecimal.
-#
-ERASECHAR	0177
-KILLCHAR	025
-UMASK		022
-
-# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
-# home directories.
-# If HOME_MODE is not set, the value of UMASK is used to create the mode.
-#HOME_MODE	0700
-
-#
-# Password aging controls:
-#
-#	PASS_MAX_DAYS	Maximum number of days a password may be used.
-#	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
-#	PASS_WARN_AGE	Number of days warning given before a password expires.
-#
-PASS_MAX_DAYS	99999
-PASS_MIN_DAYS	0
-PASS_WARN_AGE	7
-
-#
-# Min/max values for automatic uid selection in useradd
-#
-UID_MIN			 1000
-UID_MAX			60000
-# System accounts
-#SYS_UID_MIN		  100
-#SYS_UID_MAX		  999
-# Extra per user uids
-SUB_UID_MIN		   100000
-SUB_UID_MAX		600100000
-SUB_UID_COUNT		    65536
-
-#
-# Min/max values for automatic gid selection in groupadd
-#
-GID_MIN			 1000
-GID_MAX			60000
-# System accounts
-#SYS_GID_MIN		  100
-#SYS_GID_MAX		  999
-# Extra per user group ids
-SUB_GID_MIN		   100000
-SUB_GID_MAX		600100000
-SUB_GID_COUNT		    65536
-
-#
-# Max number of login retries if password is bad. This will most likely be
-# overriden by PAM, since the default pam_unix module has it's own built
-# in of 3 retries. However, this is a safe fallback in case you are using
-# an authentication module that does not enforce PAM_MAXTRIES.
-#
-LOGIN_RETRIES		5
-
-#
-# Max time in seconds for login
-#
-LOGIN_TIMEOUT		60
-
-#
-# Which fields may be changed by regular users using chfn - use
-# any combination of letters "frwh" (full name, room number, work
-# phone, home phone).  If not defined, no changes are allowed.
-# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
-# 
-CHFN_RESTRICT		rwh
-
-#
-# Should login be allowed if we can't cd to the home directory?
-# Default is no.
-#
-DEFAULT_HOME	yes
-
-#
-# If defined, this command is run when removing a user.
-# It should remove any at/cron/print jobs etc. owned by
-# the user to be removed (passed as the first argument).
-#
-#USERDEL_CMD	/usr/sbin/userdel_local
-
-#
-# If set to yes, userdel will remove the user's group if it contains no
-# more members, and useradd will create by default a group with the name
-# of the user.
-#
-# Other former uses of this variable such as setting the umask when
-# user==primary group are not used in PAM environments, such as Debian
-#
-USERGROUPS_ENAB yes
-
-#
-# Instead of the real user shell, the program specified by this parameter
-# will be launched, although its visible name (argv[0]) will be the shell's.
-# The program may do whatever it wants (logging, additional authentification,
-# banner, ...) before running the actual shell.
-#
-# FAKE_SHELL /bin/fakeshell
-
-#
-# If defined, either full pathname of a file containing device names or
-# a ":" delimited list of device names.  Root logins will be allowed only
-# upon these devices.
-#
-# This variable is used by login and su.
-#
-#CONSOLE	/etc/consoles
-#CONSOLE	console:tty01:tty02:tty03:tty04
-
-#
-# List of groups to add to the user's supplementary group set
-# when logging in on the console (as determined by the CONSOLE
-# setting).  Default is none.
-#
-# Use with caution - it is possible for users to gain permanent
-# access to these groups, even when not logged in on the console.
-# How to do it is left as an exercise for the reader...
-#
-# This variable is used by login and su.
-#
-#CONSOLE_GROUPS		floppy:audio:cdrom
-
-#
-# If set to "yes", new passwords will be encrypted using the MD5-based
-# algorithm compatible with the one used by recent releases of FreeBSD.
-# It supports passwords of unlimited length and longer salt strings.
-# Set to "no" if you need to copy encrypted passwords to other systems
-# which don't understand the new algorithm.  Default is "no".
-#
-# This variable is deprecated. You should use ENCRYPT_METHOD.
-#
-#MD5_CRYPT_ENAB	no
-
-#
-# If set to MD5, MD5-based algorithm will be used for encrypting password
-# If set to SHA256, SHA256-based algorithm will be used for encrypting password
-# If set to SHA512, SHA512-based algorithm will be used for encrypting password
-# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
-# If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
-# If set to DES, DES-based algorithm will be used for encrypting password (default)
-# MD5 and DES should not be used for new hashes, see crypt(5) for recommendations.
-# Overrides the MD5_CRYPT_ENAB option
-#
-# Note: It is recommended to use a value consistent with
-# the PAM modules configuration.
-#
-ENCRYPT_METHOD SHA512
-
-#
-# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
-#
-# Define the number of SHA rounds.
-# With a lot of rounds, it is more difficult to brute-force the password.
-# However, more CPU resources will be needed to authenticate users if
-# this value is increased.
-#
-# If not specified, the libc will choose the default number of rounds (5000),
-# which is orders of magnitude too low for modern hardware.
-# The values must be within the 1000-999999999 range.
-# If only one of the MIN or MAX values is set, then this value will be used.
-# If MIN > MAX, the highest value will be used.
-#
-#SHA_CRYPT_MIN_ROUNDS 5000
-#SHA_CRYPT_MAX_ROUNDS 5000
-
-#
-# Only works if ENCRYPT_METHOD is set to YESCRYPT.
-#
-# Define the YESCRYPT cost factor.
-# With a higher cost factor, it is more difficult to brute-force the password.
-# However, more CPU time and more memory will be needed to authenticate users
-# if this value is increased.
-#
-# If not specified, a cost factor of 5 will be used.
-# The value must be within the 1-11 range.
-#
-#YESCRYPT_COST_FACTOR 5
-
-#
-# The pwck(8) utility emits a warning for any system account with a home
-# directory that does not exist.  Some system accounts intentionally do
-# not have a home directory.  Such accounts may have this string as
-# their home directory in /etc/passwd to avoid a spurious warning.
-#
-NONEXISTENT	/nonexistent
-
-#
-# Allow newuidmap and newgidmap when running under an alternative
-# primary group.
-#
-#GRANT_AUX_GROUP_SUBIDS yes
-
-#
-# Select the HMAC cryptography algorithm.
-# Used in pam_timestamp module to calculate the keyed-hash message
-# authentication code.
-#
-# Note: It is recommended to check hmac(3) to see the possible algorithms
-# that are available in your system.
-#
-#HMAC_CRYPTO_ALGO SHA512
-
-################# OBSOLETED BY PAM ##############
-#						#
-# These options are now handled by PAM. Please	#
-# edit the appropriate file in /etc/pam.d/ to	#
-# enable the equivelants of them.
-#
-###############
-
-#MOTD_FILE
-#DIALUPS_CHECK_ENAB
-#LASTLOG_ENAB
-#MAIL_CHECK_ENAB
-#OBSCURE_CHECKS_ENAB
-#PORTTIME_CHECKS_ENAB
-#SU_WHEEL_ONLY
-#CRACKLIB_DICTPATH
-#PASS_CHANGE_TRIES
-#PASS_ALWAYS_WARN
-#ENVIRON_FILE
-#NOLOGINS_FILE
-#ISSUE_FILE
-#PASS_MIN_LEN
-#PASS_MAX_LEN
-#ULIMIT
-#ENV_HZ
-#CHFN_AUTH
-#CHSH_AUTH
-#FAIL_DELAY
-
-################# OBSOLETED #######################
-#						  #
-# These options are no more handled by shadow.    #
-#                                                 #
-# Shadow utilities will display a warning if they #
-# still appear.                                   #
-#                                                 #
-###################################################
-
-# CLOSE_SESSIONS
-# LOGIN_STRING
-# NO_PASSWORD_CONSOLE
-# QMAIL_DIR
-
-
-

debian/login.defs.install

@@ -0,0 +1 @@
+etc/login.defs etc

debian/login.defs.manpages

@@ -0,0 +1,2 @@
+usr/share/man/*/man5/login.defs.5
+usr/share/man/man5/login.defs.5

debian/login.defs.postinst

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -e
+
+_adopt_conffile() {
+    conffile=$1
+    pkg=$2
+
+    [ -f ${conffile}.dpkg-bak ] || return 0
+
+    md5sum="$(md5sum ${conffile} | sed -e 's/ .*//')"
+    old_md5sum="$(dpkg-query -W -f='${Conffiles}' $pkg | \
+                        sed -n -e "\' ${conffile} ' { s/ obsolete$//; s/.* //; p }")"
+    # On new installs, if the conffile was preserved on upgrade by
+    # dpkg-maintscript helper, copy it back if the new file has not been
+    # modified yet
+    if [ "$md5sum" = "$old_md5sum" ]; then
+        mv ${conffile}.dpkg-bak ${conffile}
+    fi
+}
+
+if [ "$1" = configure ] && [ -z "$2" ]; then
+    _adopt_conffile /etc/login.defs login.defs
+fi
+
+#DEBHELPER#

debian/login.dirs

@@ -1 +0,0 @@
-usr/share/lintian/overrides

debian/login.install

@@ -1,7 +0,0 @@
-debian/login.defs etc
-usr/share/locale/*/LC_MESSAGES/shadow.mo
-sbin/nologin usr/sbin
-usr/bin/faillog
-usr/bin/lastlog
-usr/bin/newgrp
-bin/login usr/bin

debian/login.links

@@ -1 +0,0 @@
-usr/bin/newgrp usr/bin/sg

debian/login.lintian-overrides

@@ -1 +0,0 @@
-login: elevated-privileges 4755 root/root [usr/bin/newgrp]

debian/login.maintscript

@@ -1 +0,0 @@
-rm_conffile /etc/securetty 1:4.7-1~

debian/login.manpages

@@ -1,16 +0,0 @@
-usr/share/man/*/man1/login.1
-usr/share/man/*/man1/newgrp.1
-usr/share/man/*/man1/sg.1
-usr/share/man/*/man5/faillog.5
-usr/share/man/*/man5/login.defs.5
-usr/share/man/*/man8/faillog.8
-usr/share/man/*/man8/lastlog.8
-usr/share/man/*/man8/nologin.8
-usr/share/man/man1/login.1
-usr/share/man/man1/newgrp.1
-usr/share/man/man1/sg.1
-usr/share/man/man5/faillog.5
-usr/share/man/man5/login.defs.5
-usr/share/man/man8/faillog.8
-usr/share/man/man8/lastlog.8
-usr/share/man/man8/nologin.8

debian/login.pam

@@ -1,100 +0,0 @@
-#
-# The PAM configuration file for the Shadow `login' service
-#
-
-# Enforce a minimal delay in case of failure (in microseconds).
-# (Replaces the `FAIL_DELAY' setting from login.defs)
-# Note that other modules may require another minimal delay. (for example,
-# to disable any delay, you should add the nodelay option to pam_unix)
-auth       optional   pam_faildelay.so  delay=3000000
-
-# Outputs an issue file prior to each login prompt (Replaces the
-# ISSUE_FILE option from login.defs). Uncomment for use
-# auth       required   pam_issue.so issue=/etc/issue
-
-# Disallows other than root logins when /etc/nologin exists
-# (Replaces the `NOLOGINS_FILE' option from login.defs)
-auth       requisite  pam_nologin.so
-
-# SELinux needs to be the first session rule. This ensures that any
-# lingering context has been cleared. Without this it is possible
-# that a module could execute code in the wrong domain.
-# When the module is present, "required" would be sufficient (When SELinux
-# is disabled, this returns success.)
-session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
-
-# Sets the loginuid process attribute
-session    required     pam_loginuid.so
-
-# Prints the message of the day upon successful login.
-# (Replaces the `MOTD_FILE' option in login.defs)
-# This includes a dynamically generated part from /run/motd.dynamic
-# and a static (admin-editable) part from /etc/motd.
-session    optional   pam_motd.so motd=/run/motd.dynamic
-session    optional   pam_motd.so noupdate
-
-# SELinux needs to intervene at login time to ensure that the process
-# starts in the proper default security context. Only sessions which are
-# intended to run in the user's context should be run after this.
-# pam_selinux.so changes the SELinux context of the used TTY and configures
-# SELinux in order to transition to the user context with the next execve()
-# call.
-session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
-# When the module is present, "required" would be sufficient (When SELinux
-# is disabled, this returns success.)
-
-# This module parses environment configuration file(s)
-# and also allows you to use an extended config
-# file /etc/security/pam_env.conf.
-# 
-# parsing /etc/environment needs "readenv=1"
-session       required   pam_env.so readenv=1
-# locale variables can also be set in /etc/default/locale
-# reading this file *in addition to /etc/environment* does not hurt
-session       required   pam_env.so readenv=1 envfile=/etc/default/locale
-
-# Standard Un*x authentication.
-@include common-auth
-
-# This allows certain extra groups to be granted to a user
-# based on things like time of day, tty, service, and user.
-# Please edit /etc/security/group.conf to fit your needs
-# (Replaces the `CONSOLE_GROUPS' option in login.defs)
-auth       optional   pam_group.so
-
-# Uncomment and edit /etc/security/time.conf if you need to set
-# time restraint on logins.
-# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
-# as well as /etc/porttime)
-# account    requisite  pam_time.so
-
-# Uncomment and edit /etc/security/access.conf if you need to
-# set access limits.
-# (Replaces /etc/login.access file)
-# account  required       pam_access.so
-
-# Sets up user limits according to /etc/security/limits.conf
-# (Replaces the use of /etc/limits in old login)
-session    required   pam_limits.so
-
-# Prints the last login info upon successful login
-# (Replaces the `LASTLOG_ENAB' option from login.defs)
-session    optional   pam_lastlog.so
-
-# Prints the status of the user's mailbox upon successful login
-# (Replaces the `MAIL_CHECK_ENAB' option from login.defs). 
-#
-# This also defines the MAIL environment variable
-# However, userdel also needs MAIL_DIR and MAIL_FILE variables
-# in /etc/login.defs to make sure that removing a user 
-# also removes the user's mail spool file.
-# See comments in /etc/login.defs
-session    optional   pam_mail.so standard
-
-# Create a new session keyring.
-session    optional   pam_keyinit.so force revoke
-
-# Standard Un*x account and session
-@include common-account
-@include common-session
-@include common-password

debian/login.postinst

@@ -1,30 +0,0 @@
-#!/bin/sh
-
-set -e
-
-
-if [ "$1" = "configure" ]; then
-	# Install faillog during initial installs only
-	if [ "$2" = "" ] && [ ! -f "$DPKG_ROOT/var/log/faillog" ] ; then
-		touch "$DPKG_ROOT/var/log/faillog"
-		chown 0:0 "$DPKG_ROOT/var/log/faillog"
-		chmod 644 "$DPKG_ROOT/var/log/faillog"
-	fi
-
-	# Create subuid/subgid if missing
-	if [ ! -e "$DPKG_ROOT/etc/subuid" ]; then
-		touch "$DPKG_ROOT/etc/subuid"
-		chown 0:0 "$DPKG_ROOT/etc/subuid"
-		chmod 644 "$DPKG_ROOT/etc/subuid"
-	fi
-
-	if [ ! -e "$DPKG_ROOT/etc/subgid" ]; then
-		touch "$DPKG_ROOT/etc/subgid"
-		chown 0:0 "$DPKG_ROOT/etc/subgid"
-		chmod 644 "$DPKG_ROOT/etc/subgid"
-	fi
-fi
-
-#DEBHELPER#
-
-exit 0

debian/not-installed

@@ -1,5 +1,6 @@
 bin/groups
-etc/default/useradd
+bin/login
+# Workaround debhelper complaining about login.defs, although we install it.
 etc/login.defs
 etc/pam.d/chfn
 etc/pam.d/chage
@@ -15,22 +16,39 @@ etc/pam.d/passwd
 etc/pam.d/useradd
 etc/pam.d/userdel
 etc/pam.d/usermod
+sbin/nologin
+usr/bin/newgrp
+usr/bin/faillog
 usr/bin/sg
 usr/lib/*/libsubid.la
+usr/sbin/groupmems
 usr/sbin/logoutd
 usr/sbin/vigr
 usr/share/man/*/man1/groups.1
+usr/share/man/*/man1/login.1
 usr/share/man/*/man1/logoutd.1
+usr/share/man/*/man1/newgrp.1
+usr/share/man/*/man1/sg.1
 usr/share/man/*/man1/su.1
 usr/share/man/*/man3/getspnam.3
 usr/share/man/*/man3/shadow.3
+usr/share/man/*/man5/faillog.5
 usr/share/man/*/man5/suauth.5
+usr/share/man/*/man8/faillog.8
+usr/share/man/*/man8/groupmems.8
 usr/share/man/*/man8/logoutd.8
+usr/share/man/*/man8/nologin.8
 usr/share/man/man1/groups.1
+usr/share/man/man1/login.1
 usr/share/man/man1/logoutd.1
+usr/share/man/man1/newgrp.1
+usr/share/man/man1/sg.1
 usr/share/man/man1/su.1
 usr/share/man/man3/getspnam.3
 usr/share/man/man3/shadow.3
+usr/share/man/man5/faillog.5
 usr/share/man/man5/suauth.5
+usr/share/man/man8/faillog.8
+usr/share/man/man8/groupmems.8
 usr/share/man/man8/logoutd.8
-
+usr/share/man/man8/nologin.8

debian/passwd.dirs

@@ -1,2 +1,2 @@
-usr/share/lintian/overrides
 etc/default
+usr/share/lintian/overrides

debian/passwd.install

@@ -6,13 +6,11 @@ usr/bin/chsh
 usr/bin/expiry
 usr/bin/gpasswd
 usr/bin/passwd
-usr/sbin/chpasswd
 usr/sbin/chgpasswd
-usr/sbin/cppw
+usr/sbin/chpasswd
 usr/sbin/groupadd
 usr/sbin/groupdel
 usr/sbin/groupmod
-usr/sbin/groupmems
 usr/sbin/grpck
 usr/sbin/grpconv
 usr/sbin/grpunconv
@@ -24,3 +22,4 @@ usr/sbin/useradd
 usr/sbin/userdel
 usr/sbin/usermod
 usr/sbin/vipw
+usr/share/locale/*/LC_MESSAGES/shadow.mo

debian/passwd.links

@@ -1,2 +1 @@
 usr/sbin/vipw usr/sbin/vigr
-usr/sbin/cppw usr/sbin/cpgr

debian/passwd.manpages

@@ -1,22 +1,19 @@
-debian/cpgr.8
-debian/cppw.8
 usr/share/man/*/man1/chage.1
 usr/share/man/*/man1/chfn.1
 usr/share/man/*/man1/chsh.1
 usr/share/man/*/man1/expiry.1
 usr/share/man/*/man1/gpasswd.1
 usr/share/man/*/man1/passwd.1
+usr/share/man/*/man5/gshadow.5
 usr/share/man/*/man5/passwd.5
+usr/share/man/*/man5/shadow.5
 usr/share/man/*/man5/subgid.5
 usr/share/man/*/man5/subuid.5
-usr/share/man/*/man5/shadow.5
-usr/share/man/*/man5/gshadow.5
-usr/share/man/*/man8/chpasswd.8
 usr/share/man/*/man8/chgpasswd.8
+usr/share/man/*/man8/chpasswd.8
 usr/share/man/*/man8/groupadd.8
 usr/share/man/*/man8/groupdel.8
 usr/share/man/*/man8/groupmod.8
-usr/share/man/*/man8/groupmems.8
 usr/share/man/*/man8/grpck.8
 usr/share/man/*/man8/grpconv.8
 usr/share/man/*/man8/grpunconv.8
@@ -35,16 +32,15 @@ usr/share/man/man1/chsh.1
 usr/share/man/man1/expiry.1
 usr/share/man/man1/gpasswd.1
 usr/share/man/man1/passwd.1
+usr/share/man/man5/gshadow.5
 usr/share/man/man5/passwd.5
 usr/share/man/man5/shadow.5
-usr/share/man/man5/gshadow.5
-usr/share/man/man5/subuid.5
 usr/share/man/man5/subgid.5
+usr/share/man/man5/subuid.5
 usr/share/man/man8/chgpasswd.8
 usr/share/man/man8/chpasswd.8
 usr/share/man/man8/groupadd.8
 usr/share/man/man8/groupdel.8
-usr/share/man/man8/groupmems.8
 usr/share/man/man8/groupmod.8
 usr/share/man/man8/grpck.8
 usr/share/man/man8/grpconv.8
@@ -53,6 +49,7 @@ usr/share/man/man8/newusers.8
 usr/share/man/man8/pwck.8
 usr/share/man/man8/pwconv.8
 usr/share/man/man8/pwunconv.8
+usr/share/man/man8/shadowconfig.8
 usr/share/man/man8/useradd.8
 usr/share/man/man8/userdel.8
 usr/share/man/man8/usermod.8

debian/patches/0001-gpasswd-1-Fix-password-leak.patch

@@ -1,137 +0,0 @@
-From 65c88a43a23c2391dcc90c0abda3e839e9c57904 Mon Sep 17 00:00:00 2001
-From: Alejandro Colomar <alx@kernel.org>
-Date: Sat, 10 Jun 2023 16:20:05 +0200
-Subject: [PATCH] gpasswd(1): Fix password leak
-
-How to trigger this password leak?
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-When gpasswd(1) asks for the new password, it asks twice (as is usual
-for confirming the new password).  Each of those 2 password prompts
-uses agetpass() to get the password.  If the second agetpass() fails,
-the first password, which has been copied into the 'static' buffer
-'pass' via STRFCPY(), wasn't being zeroed.
-
-agetpass() is defined in <./libmisc/agetpass.c> (around line 91), and
-can fail for any of the following reasons:
-
--  malloc(3) or readpassphrase(3) failure.
-
-   These are going to be difficult to trigger.  Maybe getting the system
-   to the limits of memory utilization at that exact point, so that the
-   next malloc(3) gets ENOMEM, and possibly even the OOM is triggered.
-   About readpassphrase(3), ENFILE and EINTR seem the only plausible
-   ones, and EINTR probably requires privilege or being the same user;
-   but I wouldn't discard ENFILE so easily, if a process starts opening
-   files.
-
--  The password is longer than PASS_MAX.
-
-   The is plausible with physical access.  However, at that point, a
-   keylogger will be a much simpler attack.
-
-And, the attacker must be able to know when the second password is being
-introduced, which is not going to be easy.
-
-How to read the password after the leak?
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Provoking the leak yourself at the right point by entering a very long
-password is easy, and inspecting the process stack at that point should
-be doable.  Try to find some consistent patterns.
-
-Then, search for those patterns in free memory, right after the victim
-leaks their password.
-
-Once you get the leak, a program should read all the free memory
-searching for patterns that gpasswd(1) leaves nearby the leaked
-password.
-
-On 6/10/23 03:14, Seth Arnold wrote:
-> An attacker process wouldn't be able to use malloc(3) for this task.
-> There's a handful of tools available for userspace to allocate memory:
->
-> -  brk / sbrk
-> -  mmap MAP_ANONYMOUS
-> -  mmap /dev/zero
-> -  mmap some other file
-> -  shm_open
-> -  shmget
->
-> Most of these return only pages of zeros to a process.  Using mmap of an
-> existing file, you can get some of the contents of the file demand-loaded
-> into the memory space on the first use.
->
-> The MAP_UNINITIALIZED flag only works if the kernel was compiled with
-> CONFIG_MMAP_ALLOW_UNINITIALIZED.  This is rare.
->
-> malloc(3) doesn't zero memory, to our collective frustration, but all the
-> garbage in the allocations is from previous allocations in the current
-> process.  It isn't leftover from other processes.
->
-> The avenues available for reading the memory:
-> -  /dev/mem and /dev/kmem (requires root, not available with Secure Boot)
-> -  /proc/pid/mem (requires ptrace privileges, mediated by YAMA)
-> -  ptrace (requires ptrace privileges, mediated by YAMA)
-> -  causing memory to be swapped to disk, and then inspecting the swap
->
-> These all require a certain amount of privileges.
-
-How to fix it?
-~~~~~~~~~~~~~~
-
-memzero(), which internally calls explicit_bzero(3), or whatever
-alternative the system provides with a slightly different name, will
-make sure that the buffer is zeroed in memory, and optimizations are not
-allowed to impede this zeroing.
-
-This is not really 100% effective, since compilers may place copies of
-the string somewhere hidden in the stack.  Those copies won't get zeroed
-by explicit_bzero(3).  However, that's arguably a compiler bug, since
-compilers should make everything possible to avoid optimizing strings
-that are later passed to explicit_bzero(3).  But we all know that
-sometimes it's impossible to have perfect knowledge in the compiler, so
-this is plausible.  Nevertheless, there's nothing we can do against such
-issues, except minimizing the time such passwords are stored in plain
-text.
-
-Security concerns
-~~~~~~~~~~~~~~~~~
-
-We believe this isn't easy to exploit.  Nevertheless, and since the fix
-is trivial, this fix should probably be applied soon, and backported to
-all supported distributions, to prevent someone else having more
-imagination than us to find a way.
-
-Affected versions
-~~~~~~~~~~~~~~~~~
-
-All.  Bug introduced in shadow 19990709.  That's the second commit in
-the git history.
-
-Fixes: 45c6603cc86c ("[svn-upgrade] Integrating new upstream version, shadow (19990709)")
-Reported-by: Alejandro Colomar <alx@kernel.org>
-Cc: Serge Hallyn <serge@hallyn.com>
-Cc: Iker Pedrosa <ipedrosa@redhat.com>
-Cc: Seth Arnold <seth.arnold@canonical.com>
-Cc: Christian Brauner <christian@brauner.io>
-Cc: Balint Reczey <rbalint@debian.org>
-Cc: Sam James <sam@gentoo.org>
-Cc: David Runge <dvzrv@archlinux.org>
-Cc: Andreas Jaeger <aj@suse.de>
-Cc: <~hallyn/shadow@lists.sr.ht>
-Signed-off-by: Alejandro Colomar <alx@kernel.org>
----
- src/gpasswd.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/src/gpasswd.c
-+++ b/src/gpasswd.c
-@@ -896,6 +896,7 @@
- 		strzero (cp);
- 		cp = getpass (_("Re-enter new password: "));
- 		if (NULL == cp) {
-+			memzero (pass, sizeof pass);
- 			exit (1);
- 		}
- 

debian/patches/0002-Added-control-character-check.patch

@@ -1,45 +0,0 @@
-From e5905c4b84d4fb90aefcd96ee618411ebfac663d Mon Sep 17 00:00:00 2001
-From: tomspiderlabs <128755403+tomspiderlabs@users.noreply.github.com>
-Date: Thu, 23 Mar 2023 23:39:38 +0000
-Subject: [PATCH] Added control character check
-
-Added control character check, returning -1 (to "err") if control characters are present.
----
- lib/fields.c | 11 +++++++----
- 1 file changed, 7 insertions(+), 4 deletions(-)
-
-diff --git a/lib/fields.c b/lib/fields.c
-index 640be931..fb51b582 100644
---- a/lib/fields.c
-+++ b/lib/fields.c
-@@ -21,9 +21,9 @@
-  *
-  * The supplied field is scanned for non-printable and other illegal
-  * characters.
-- *  + -1 is returned if an illegal character is present.
-- *  +  1 is returned if no illegal characters are present, but the field
-- *       contains a non-printable character.
-+ *  + -1 is returned if an illegal or control character is present.
-+ *  +  1 is returned if no illegal or control characters are present,
-+ *       but the field contains a non-printable character.
-  *  +  0 is returned otherwise.
-  */
- int valid_field (const char *field, const char *illegal)
-@@ -45,10 +45,13 @@ int valid_field (const char *field, const char *illegal)
- 	}
- 
- 	if (0 == err) {
--		/* Search if there are some non-printable characters */
-+		/* Search if there are non-printable or control characters */
- 		for (cp = field; '\0' != *cp; cp++) {
- 			if (!isprint (*cp)) {
- 				err = 1;
-+			}
-+			if (!iscntrl (*cp)) {
-+				err = -1;
- 				break;
- 			}
- 		}
--- 
-2.34.1
-

debian/patches/0003-Overhaul-valid_field.patch

@@ -1,61 +0,0 @@
-From 2eaea70111f65b16d55998386e4ceb4273c19eb4 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
-Date: Fri, 31 Mar 2023 14:46:50 +0200
-Subject: [PATCH] Overhaul valid_field()
-
-e5905c4b ("Added control character check") introduced checking for
-control characters but had the logic inverted, so it rejects all
-characters that are not control ones.
-
-Cast the character to `unsigned char` before passing to the character
-checking functions to avoid UB.
-
-Use strpbrk(3) for the illegal character test and return early.
----
- lib/fields.c | 24 ++++++++++--------------
- 1 file changed, 10 insertions(+), 14 deletions(-)
-
-diff --git a/lib/fields.c b/lib/fields.c
-index fb51b582..53929248 100644
---- a/lib/fields.c
-+++ b/lib/fields.c
-@@ -37,26 +37,22 @@ int valid_field (const char *field, const char *illegal)
- 
- 	/* For each character of field, search if it appears in the list
- 	 * of illegal characters. */
-+	if (illegal && NULL != strpbrk (field, illegal)) {
-+		return -1;
-+	}
-+
-+	/* Search if there are non-printable or control characters */
- 	for (cp = field; '\0' != *cp; cp++) {
--		if (strchr (illegal, *cp) != NULL) {
-+		unsigned char c = *cp;
-+		if (!isprint (c)) {
-+			err = 1;
-+		}
-+		if (iscntrl (c)) {
- 			err = -1;
- 			break;
- 		}
- 	}
- 
--	if (0 == err) {
--		/* Search if there are non-printable or control characters */
--		for (cp = field; '\0' != *cp; cp++) {
--			if (!isprint (*cp)) {
--				err = 1;
--			}
--			if (!iscntrl (*cp)) {
--				err = -1;
--				break;
--			}
--		}
--	}
--
- 	return err;
- }
- 
--- 
-2.34.1
-

debian/patches/008_login_log_failure_in_FTMP

@@ -1,51 +0,0 @@
-Goal: Log login failures to the btmp file
-
-Notes:
- * I'm not sure login should add an entry in the FTMP file when PAM is used.
-   (but nothing in /etc/login.defs indicates that the failure is not logged)
-
---- a/src/login.c
-+++ b/src/login.c
-@@ -827,6 +827,24 @@
- 			(void) puts ("");
- 			(void) puts (_("Login incorrect"));
- 
-+			if (getdef_str("FTMP_FILE") != NULL) {
-+#ifdef USE_UTMPX
-+				struct utmpx *failent =
-+					prepare_utmpx (failent_user,
-+					               tty,
-+					/* FIXME: or fromhost? */hostname,
-+					               utent);
-+#else				/* !USE_UTMPX */
-+				struct utmp *failent =
-+					prepare_utmp (failent_user,
-+					              tty,
-+					              hostname,
-+					              utent);
-+#endif				/* !USE_UTMPX */
-+				failtmp (failent_user, failent);
-+				free (failent);
-+			}
-+
- 			if (failcount >= retries) {
- 				SYSLOG ((LOG_NOTICE,
- 				         "TOO MANY LOGIN TRIES (%u)%s FOR '%s'",
---- a/lib/getdef.c
-+++ b/lib/getdef.c
-@@ -38,7 +38,6 @@
- 	{"ENVIRON_FILE", NULL},			\
- 	{"ENV_TZ", NULL},			\
- 	{"FAILLOG_ENAB", NULL},			\
--	{"FTMP_FILE", NULL},			\
- 	{"HMAC_CRYPTO_ALGO", NULL},		\
- 	{"ISSUE_FILE", NULL},			\
- 	{"LASTLOG_ENAB", NULL},			\
-@@ -80,6 +79,7 @@
- 	{"ERASECHAR", NULL},
- 	{"FAIL_DELAY", NULL},
- 	{"FAKE_SHELL", NULL},
-+	{"FTMP_FILE", NULL},
- 	{"GID_MAX", NULL},
- 	{"GID_MIN", NULL},
- 	{"HOME_MODE", NULL},

debian/patches/401_cppw_src.dpatch

@@ -1,276 +0,0 @@
-#! /bin/sh /usr/share/dpatch/dpatch-run
-## 401_cppw_src.dpatch by  Nicolas FRANCOIS <nicolas.francois@centraliens.net>
-##
-## All lines beginning with `## DP:' are a description of the patch.
-## DP: Add cppw / cpgr
-
-@DPATCH@
---- /dev/null
-+++ b/src/cppw.c
-@@ -0,0 +1,238 @@
-+/*
-+  cppw, cpgr  copy with locking given file over the password or group file
-+  with -s will copy with locking given file over shadow or gshadow file
-+
-+  Copyright (C) 1999 Stephen Frost <sfrost@snowman.net>
-+
-+  Based on vipw, vigr by:
-+  Copyright (C) 1997 Guy Maor <maor@ece.utexas.edu>
-+
-+  This program is free software; you can redistribute it and/or modify
-+  it under the terms of the GNU General Public License as published by
-+  the Free Software Foundation; either version 2 of the License, or
-+  (at your option) any later version.
-+
-+  This program is distributed in the hope that it will be useful, but
-+  WITHOUT ANY WARRANTY; without even the implied warranty of
-+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+  General Public License for more details.
-+
-+  You should have received a copy of the GNU General Public License
-+  along with this program; if not, write to the Free Software
-+  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-+
-+  */
-+
-+#include <config.h>
-+#include "defines.h"
-+
-+#include <errno.h>
-+#include <sys/stat.h>
-+#include <unistd.h>
-+#include <stdio.h>
-+#include <stdlib.h>
-+#include <sys/types.h>
-+#include <signal.h>
-+#include <utime.h>
-+#include "exitcodes.h"
-+#include "prototypes.h"
-+#include "pwio.h"
-+#include "shadowio.h"
-+#include "groupio.h"
-+#include "sgroupio.h"
-+
-+
-+const char *Prog;
-+
-+const char *filename, *filenewname;
-+static bool filelocked = false;
-+static int (*unlock) (void);
-+
-+/* local function prototypes */
-+static int create_copy (FILE *fp, const char *dest, struct stat *sb);
-+static void cppwexit (const char *msg, int syserr, int ret);
-+static void cppwcopy (const char *file,
-+                      const char *in_file,
-+                      int (*file_lock) (void),
-+                      int (*file_unlock) (void));
-+
-+static int create_copy (FILE *fp, const char *dest, struct stat *sb)
-+{
-+	struct utimbuf ub;
-+	FILE *bkfp;
-+	int c;
-+	mode_t mask;
-+
-+	mask = umask (077);
-+	bkfp = fopen (dest, "w");
-+	(void) umask (mask);
-+	if (NULL == bkfp) {
-+		return -1;
-+	}
-+
-+	rewind (fp);
-+	while ((c = getc (fp)) != EOF) {
-+		if (putc (c, bkfp) == EOF) {
-+			break;
-+		}
-+	}
-+
-+	if (   (c != EOF)
-+	    || (fflush (bkfp) != 0)) {
-+		(void) fclose (bkfp);
-+		(void) unlink (dest);
-+		return -1;
-+	}
-+	if (   (fsync (fileno (bkfp)) != 0)
-+	    || (fclose (bkfp) != 0)) {
-+		(void) unlink (dest);
-+		return -1;
-+	}
-+
-+	ub.actime = sb->st_atime;
-+	ub.modtime = sb->st_mtime;
-+	if (   (utime (dest, &ub) != 0)
-+	    || (chmod (dest, sb->st_mode) != 0)
-+	    || (chown (dest, sb->st_uid, sb->st_gid) != 0)) {
-+		(void) unlink (dest);
-+		return -1;
-+	}
-+	return 0;
-+}
-+
-+static void cppwexit (const char *msg, int syserr, int ret)
-+{
-+	int err = errno;
-+	if (filelocked) {
-+		(*unlock) ();
-+	}
-+	if (NULL != msg) {
-+		fprintf (stderr, "%s: %s", Prog, msg);
-+		if (0 != syserr) {
-+			fprintf (stderr, ": %s", strerror (err));
-+		}
-+		(void) fputs ("\n", stderr);
-+	}
-+	if (NULL != filename) {
-+		fprintf (stderr, _("%s: %s is unchanged\n"), Prog, filename);
-+	} else {
-+		fprintf (stderr, _("%s: no changes\n"), Prog);
-+	}
-+
-+	exit (ret);
-+}
-+
-+static void cppwcopy (const char *file,
-+                      const char *in_file,
-+                      int (*file_lock) (void),
-+                      int (*file_unlock) (void))
-+{
-+	struct stat st1;
-+	FILE *f;
-+	char filenew[1024];
-+
-+	snprintf (filenew, sizeof filenew, "%s.new", file);
-+	unlock = file_unlock;
-+	filename = file;
-+	filenewname = filenew;
-+
-+	if (access (file, F_OK) != 0) {
-+		cppwexit (file, 1, 1);
-+	}
-+	if (file_lock () == 0) {
-+		cppwexit (_("Couldn't lock file"), 0, 5);
-+	}
-+	filelocked = true;
-+
-+	/* file to copy has same owners, perm */
-+	if (stat (file, &st1) != 0) {
-+		cppwexit (file, 1, 1);
-+	}
-+	f = fopen (in_file, "r");
-+	if (NULL == f) {
-+		cppwexit (in_file, 1, 1);
-+	}
-+	if (create_copy (f, filenew, &st1) != 0) {
-+		cppwexit (_("Couldn't make copy"), errno, 1);
-+	}
-+
-+	/* XXX - here we should check filenew for errors; if there are any,
-+	 * fail w/ an appropriate error code and let the user manually fix
-+	 * it. Use pwck or grpck to do the check.  - Stephen (Shamelessly
-+	 * stolen from '--marekm's comment) */
-+
-+	if (rename (filenew, file) != 0) {
-+		fprintf (stderr, _("%s: can't copy %s: %s)\n"),
-+                         Prog, filenew, strerror (errno));
-+		cppwexit (NULL,0,1);
-+	}
-+
-+	(*file_unlock) ();
-+}
-+
-+int main (int argc, char **argv)
-+{
-+	int flag;
-+	bool cpshadow = false;
-+	char *in_file;
-+	int e = E_USAGE;
-+	bool do_cppw = true;
-+
-+	(void) setlocale (LC_ALL, "");
-+	(void) bindtextdomain (PACKAGE, LOCALEDIR);
-+	(void) textdomain (PACKAGE);
-+
-+	Prog = Basename (argv[0]);
-+	if (strcmp (Prog, "cpgr") == 0) {
-+		do_cppw = false;
-+	}
-+
-+	while ((flag = getopt (argc, argv, "ghps")) != EOF) {
-+		switch (flag) {
-+		case 'p':
-+			do_cppw = true;
-+			break;
-+		case 'g':
-+			do_cppw = false;
-+			break;
-+		case 's':
-+			cpshadow = true;
-+			break;
-+		case 'h':
-+			e = E_SUCCESS;
-+			/*pass through*/
-+		default:
-+			(void) fputs (_("Usage:\n\
-+`cppw <file>' copys over /etc/passwd   `cppw -s <file>' copys over /etc/shadow\n\
-+`cpgr <file>' copys over /etc/group    `cpgr -s <file>' copys over /etc/gshadow\n\
-+"), (E_SUCCESS != e) ? stderr : stdout);
-+			exit (e);
-+		}
-+	}
-+
-+	if (argc != optind + 1) {
-+		cppwexit (_("wrong number of arguments, -h for usage"),0,1);
-+	}
-+
-+	in_file = argv[optind];
-+
-+	if (do_cppw) {
-+		if (cpshadow) {
-+			cppwcopy (SHADOW_FILE, in_file, spw_lock, spw_unlock);
-+		} else {
-+			cppwcopy (PASSWD_FILE, in_file, pw_lock, pw_unlock);
-+		}
-+	} else {
-+#ifdef SHADOWGRP
-+		if (cpshadow) {
-+			cppwcopy (SGROUP_FILE, in_file, sgr_lock, sgr_unlock);
-+		} else
-+#endif				/* SHADOWGRP */
-+		{
-+			cppwcopy (GROUP_FILE, in_file, gr_lock, gr_unlock);
-+		}
-+	}
-+
-+	return 0;
-+}
-+
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -34,6 +34,7 @@
- bin_PROGRAMS  += su
- endif
- usbin_PROGRAMS = \
-+	cppw \
- 	chgpasswd \
- 	chpasswd \
- 	groupadd \
-@@ -102,6 +103,7 @@
- chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT) $(LIBECONF)
- chsh_LDADD     = $(LDADD) $(LIBPAM) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD) $(LIBECONF)
- chpasswd_LDADD = $(LDADD) $(LIBPAM) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT) $(LIBECONF)
-+cppw_LDADD     = $(LDADD) $(LIBSELINUX) $(LIBAUDIT)
- expiry_LDADD = $(LDADD) $(LIBECONF)
- gpasswd_LDADD  = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT) $(LIBECONF)
- groupadd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBECONF) -ldl
---- a/po/POTFILES.in
-+++ b/po/POTFILES.in
-@@ -91,6 +91,7 @@
- src/chgpasswd.c
- src/chpasswd.c
- src/chsh.c
-+src/cppw.c
- src/expiry.c
- src/faillog.c
- src/gpasswd.c

debian/patches/402_cppw_selinux

@@ -1,64 +0,0 @@
-Goal: Add selinux support to cppw
-
-Fix:
-
-Status wrt upstream: cppw is not available upstream.
-                     The patch was made based on the
-                     302_vim_selinux_support patch. It needs to be
-                     reviewed by an SE-Linux aware person.
-
-Depends on 401_cppw_src.dpatch
-
-Index: git/src/cppw.c
-===================================================================
---- git.orig/src/cppw.c
-+++ git/src/cppw.c
-@@ -34,6 +34,9 @@
- #include <sys/types.h>
- #include <signal.h>
- #include <utime.h>
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+#endif				/* WITH_SELINUX */
- #include "exitcodes.h"
- #include "prototypes.h"
- #include "pwio.h"
-@@ -139,6 +142,22 @@
- 	if (access (file, F_OK) != 0) {
- 		cppwexit (file, 1, 1);
- 	}
-+#ifdef WITH_SELINUX
-+	/* if SE Linux is enabled then set the context of all new files
-+	 * to be the context of the file we are editing */
-+	if (is_selinux_enabled () > 0) {
-+		security_context_t passwd_context=NULL;
-+		int ret = 0;
-+		if (getfilecon (file, &passwd_context) < 0) {
-+			cppwexit (_("Couldn't get file context"), errno, 1);
-+		}
-+		ret = setfscreatecon (passwd_context);
-+		freecon (passwd_context);
-+		if (0 != ret) {
-+			cppwexit (_("setfscreatecon () failed"), errno, 1);
-+		}
-+	}
-+#endif				/* WITH_SELINUX */
- 	if (file_lock () == 0) {
- 		cppwexit (_("Couldn't lock file"), 0, 5);
- 	}
-@@ -167,6 +186,15 @@
- 		cppwexit (NULL,0,1);
- 	}
- 
-+#ifdef WITH_SELINUX
-+	/* unset the fscreatecon */
-+	if (is_selinux_enabled () > 0) {
-+		if (setfscreatecon (NULL)) {
-+		cppwexit (_("setfscreatecon() failed"), errno, 1);
-+		}
-+	}
-+#endif				/* WITH_SELINUX */
-+
- 	(*file_unlock) ();
- }
- 

debian/patches/429_login_FAILLOG_ENAB

@@ -1,84 +0,0 @@
-Goal: Re-enable logging and displaying failures on login when login is
-      compiled with PAM and when FAILLOG_ENAB is set to yes. And create the
-      faillog file if it does not exist on postinst (as on Woody).
-Depends: 008_login_more_LOG_UNKFAIL_ENAB
-Fixes: #192849
-
-Note: It could be removed if pam_tally could report the number of failures
-      preceding a successful login.
-
---- a/src/login.c
-+++ b/src/login.c
-@@ -114,9 +114,9 @@
- #endif
- 			);
- 
--#ifndef USE_PAM
- static struct faillog faillog;
- 
-+#ifndef USE_PAM
- static void bad_time_notify (void);
- static void check_nologin (bool login_to_root);
- #else
-@@ -787,6 +787,9 @@
- 				SYSLOG ((LOG_NOTICE,
- 				         "TOO MANY LOGIN TRIES (%u)%s FOR '%s'",
- 				         failcount, fromhost, failent_user));
-+				if ((NULL != pwd) && getdef_bool("FAILLOG_ENAB")) {
-+					failure (pwd->pw_uid, tty, &faillog);
-+				}
- 				fprintf (stderr,
- 				         _("Maximum number of tries exceeded (%u)\n"),
- 				         failcount);
-@@ -804,6 +807,14 @@
- 				         pam_strerror (pamh, retcode)));
- 				failed = true;
- 			}
-+			if (   (NULL != pwd)
-+			    && getdef_bool("FAILLOG_ENAB")
-+			    && ! failcheck (pwd->pw_uid, &faillog, failed)) {
-+				SYSLOG((LOG_CRIT,
-+				        "exceeded failure limit for `%s' %s",
-+				        failent_user, fromhost));
-+				failed = 1;
-+			}
- 
- 			if (!failed) {
- 				break;
-@@ -827,6 +838,10 @@
- 			(void) puts ("");
- 			(void) puts (_("Login incorrect"));
- 
-+			if ((NULL != pwd) && getdef_bool("FAILLOG_ENAB")) {
-+				failure (pwd->pw_uid, tty, &faillog);
-+			}
-+
- 			if (getdef_str("FTMP_FILE") != NULL) {
- #ifdef USE_UTMPX
- 				struct utmpx *failent =
-@@ -1295,6 +1310,7 @@
- 		 */
- #ifndef USE_PAM
- 		motd ();	/* print the message of the day */
-+#endif
- 		if (   getdef_bool ("FAILLOG_ENAB")
- 		    && (0 != faillog.fail_cnt)) {
- 			failprint (&faillog);
-@@ -1307,6 +1323,7 @@
- 				         username, (int) faillog.fail_cnt));
- 			}
- 		}
-+#ifndef USE_PAM
- 		if (   getdef_bool ("LASTLOG_ENAB")
- 		    && pwd->pw_uid <= (uid_t) getdef_ulong ("LASTLOG_UID_MAX", 0xFFFFFFFFUL)
- 		    && (ll.ll_time != 0)) {
---- a/lib/getdef.c
-+++ b/lib/getdef.c
-@@ -78,6 +78,7 @@
- 	{"ENV_SUPATH", NULL},
- 	{"ERASECHAR", NULL},
- 	{"FAIL_DELAY", NULL},
-+	{"FAILLOG_ENAB", NULL},
- 	{"FAKE_SHELL", NULL},
- 	{"FTMP_FILE", NULL},
- 	{"GID_MAX", NULL},

debian/patches/463_login_delay_obeys_to_PAM

@@ -1,97 +0,0 @@
-Goal: Do not hardcode pam_fail_delay and let pam_unix do its
-      job to set a delay...or not
-
-Fixes: #87648
-
-Status wrt upstream: Forwarded but not applied yet
-
-Note: If removed, FAIL_DELAY must be re-added to /etc/login.defs
-
---- a/src/login.c
-+++ b/src/login.c
-@@ -512,7 +512,6 @@
- #if !defined(USE_PAM)
- 	char ptime[80];
- #endif
--	unsigned int delay;
- 	unsigned int retries;
- 	bool subroot = false;
- #ifndef USE_PAM
-@@ -537,6 +536,7 @@
- 	pid_t child;
- 	char *pam_user = NULL;
- #else
-+	unsigned int delay;
- 	struct spwd *spwd = NULL;
- #endif
- 	/*
-@@ -701,7 +701,6 @@
- 	}
- 
- 	environ = newenvp;	/* make new environment active */
--	delay   = getdef_unum ("FAIL_DELAY", 1);
- 	retries = getdef_unum ("LOGIN_RETRIES", RETRIES);
- 
- #ifdef USE_PAM
-@@ -717,8 +716,7 @@
- 
- 	/*
- 	 * hostname & tty are either set to NULL or their correct values,
--	 * depending on how much we know. We also set PAM's fail delay to
--	 * ours.
-+	 * depending on how much we know.
- 	 *
- 	 * PAM_RHOST and PAM_TTY are used for authentication, only use
- 	 * information coming from login or from the caller (e.g. no utmp)
-@@ -727,10 +725,6 @@
- 	PAM_FAIL_CHECK;
- 	retcode = pam_set_item (pamh, PAM_TTY, tty);
- 	PAM_FAIL_CHECK;
--#ifdef HAS_PAM_FAIL_DELAY
--	retcode = pam_fail_delay (pamh, 1000000 * delay);
--	PAM_FAIL_CHECK;
--#endif
- 	/* if fflg, then the user has already been authenticated */
- 	if (!fflg) {
- 		unsigned int failcount = 0;
-@@ -771,12 +765,6 @@
- 			bool failed = false;
- 
- 			failcount++;
--#ifdef HAS_PAM_FAIL_DELAY
--			if (delay > 0) {
--				retcode = pam_fail_delay(pamh, 1000000*delay);
--				PAM_FAIL_CHECK;
--			}
--#endif
- 
- 			retcode = pam_authenticate (pamh, 0);
- 
-@@ -1110,14 +1098,17 @@
- 		free (username);
- 		username = NULL;
- 
-+#ifndef USE_PAM
- 		/*
- 		 * Wait a while (a la SVR4 /usr/bin/login) before attempting
- 		 * to login the user again. If the earlier alarm occurs
- 		 * before the sleep() below completes, login will exit.
- 		 */
-+		delay = getdef_unum ("FAIL_DELAY", 1);
- 		if (delay > 0) {
- 			(void) sleep (delay);
- 		}
-+#endif
- 
- 		(void) puts (_("Login incorrect"));
- 
---- a/lib/getdef.c
-+++ b/lib/getdef.c
-@@ -77,7 +77,6 @@
- 	{"ENV_PATH", NULL},
- 	{"ENV_SUPATH", NULL},
- 	{"ERASECHAR", NULL},
--	{"FAIL_DELAY", NULL},
- 	{"FAILLOG_ENAB", NULL},
- 	{"FAKE_SHELL", NULL},
- 	{"FTMP_FILE", NULL},

debian/patches/501_commonio_group_shadow

@@ -1,60 +0,0 @@
-Goal: save the [g]shadow files with the 'shadow' group and mode 0440
-
-Fixes: #166793
-
---- a/lib/commonio.c
-+++ b/lib/commonio.c
-@@ -21,6 +21,7 @@
- #include <errno.h>
- #include <stdio.h>
- #include <signal.h>
-+#include <grp.h>
- #include "nscd.h"
- #include "sssd.h"
- #ifdef WITH_TCB
-@@ -970,12 +971,23 @@
- 			goto fail;
- 		}
- 	} else {
-+		struct group *grp;
- 		/*
- 		 * Default permissions for new [g]shadow files.
- 		 */
- 		sb.st_mode = db->st_mode;
- 		sb.st_uid = db->st_uid;
- 		sb.st_gid = db->st_gid;
-+
-+		/*
-+		 * Try to retrieve the shadow's GID, and fall back to GID 0.
-+		 */
-+		if (sb.st_gid == 0) {
-+			if ((grp = getgrnam("shadow")) != NULL)
-+				sb.st_gid = grp->gr_gid;
-+			else
-+				sb.st_gid = 0;
-+		}
- 	}
- 
- 	snprintf (buf, sizeof buf, "%s+", db->filename);
---- a/lib/sgroupio.c
-+++ b/lib/sgroupio.c
-@@ -206,7 +206,7 @@
- #ifdef WITH_SELINUX
- 	NULL,			/* scontext */
- #endif
--	0400,                   /* st_mode */
-+	0440,                   /* st_mode */
- 	0,                      /* st_uid */
- 	0,                      /* st_gid */
- 	NULL,			/* head */
---- a/lib/shadowio.c
-+++ b/lib/shadowio.c
-@@ -84,7 +84,7 @@
- #ifdef WITH_SELINUX
- 	NULL,			/* scontext */
- #endif				/* WITH_SELINUX */
--	0400,                   /* st_mode */
-+	0440,                   /* st_mode */
- 	0,                      /* st_uid */
- 	0,                      /* st_gid */
- 	NULL,			/* head */

debian/patches/502_debian_useradd_defaults

@@ -1,41 +0,0 @@
-From: Balint Reczey <balint@balintreczey.hu>
-Description: Keep using Debian's adduser defaults
- Upstream's bbf4b79bc49fd1826eb41f6629669ef0b647267b commit
- in 4.9 merged those values from upstream's default configuration file
- which is not shipped in Debian.
- This patch keeps the program's compiled in defaults in sync with the
- configuration files shipped in Debian (debian/default/useradd).
-Bug: https://github.com/shadow-maint/shadow/issues/501
-Bug-Debian: https://bugs.debian.org/1004710
-Forwarded: not-needed
-
---- a/src/useradd.c
-+++ b/src/useradd.c
-@@ -79,12 +79,12 @@
- /*
-  * These defaults are used if there is no defaults file.
-  */
--static gid_t def_group = 1000;
-+static gid_t def_group = 100;
- static const char *def_gname = "other";
- static const char *def_home = "/home";
- static const char *def_shell = "/bin/bash";
- static const char *def_template = SKEL_DIR;
--static const char *def_create_mail_spool = "yes";
-+static const char *def_create_mail_spool = "no";
- static const char *def_log_init = "yes";
- 
- static long def_inactive = -1;
-diff --git a/man/useradd.8.xml b/man/useradd.8.xml
-index af02a23f..c7f95b47 100644
---- a/man/useradd.8.xml
-+++ b/man/useradd.8.xml
-@@ -248,7 +248,7 @@
- 	    command line), useradd will set the primary group of the new
- 	    user to the value specified by the <option>GROUP</option>
- 	    variable in <filename>/etc/default/useradd</filename>, or
--	    1000 by default.
-+	    100 by default.
- 	  </para>
- 	</listitem>
-       </varlistentry>

debian/patches/503_shadowconfig.8

@@ -1,201 +0,0 @@
-Goal: Document the shadowconfig utility
-
-Status wrt upstream: The shadowconfig utility is debian specific.
-                     Its man page also (but it used to be distributed)
-
-Index: git/man/shadowconfig.8
-===================================================================
---- /dev/null
-+++ git/man/shadowconfig.8
-@@ -0,0 +1,41 @@
-+.\"Generated by db2man.xsl. Don't modify this, modify the source.
-+.de Sh \" Subsection
-+.br
-+.if t .Sp
-+.ne 5
-+.PP
-+\fB\\$1\fR
-+.PP
-+..
-+.de Sp \" Vertical space (when we can't use .PP)
-+.if t .sp .5v
-+.if n .sp
-+..
-+.de Ip \" List item
-+.br
-+.ie \\n(.$>=3 .ne \\$3
-+.el .ne 3
-+.IP "\\$1" \\$2
-+..
-+.TH "SHADOWCONFIG" 8 "19 Apr 1997" "" ""
-+.SH NAME
-+shadowconfig \- toggle shadow passwords on and off
-+.SH "SYNOPSIS"
-+.ad l
-+.hy 0
-+.HP 13
-+\fBshadowconfig\fR \fB\fIon\fR\fR | \fB\fIoff\fR\fR
-+.ad
-+.hy
-+
-+.SH "DESCRIPTION"
-+
-+.PP
-+\fBshadowconfig\fR on will turn shadow passwords on; \fIshadowconfig off\fR will turn shadow passwords off\&. \fBshadowconfig\fR will print an error message and exit with a nonzero code if it finds anything awry\&. If that happens, you should correct the error and run it again\&. Turning shadow passwords on when they are already on, or off when they are already off, is harmless\&.
-+
-+.PP
-+Read \fI/usr/share/doc/passwd/README\&.Debian\fR for a brief introduction to shadow passwords and related features\&.
-+
-+.PP
-+Note that turning shadow passwords off and on again will lose all password aging information\&.
-+
-Index: git/man/shadowconfig.8.xml
-===================================================================
---- /dev/null
-+++ git/man/shadowconfig.8.xml
-@@ -0,0 +1,52 @@
-+<?xml version="1.0" encoding="UTF-8"?>
-+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
-+		"http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-+<refentry id='shadowconfig.8'>
-+  <!-- $Id: shadowconfig.8.xml,v 1.6 2005/06/15 12:39:27 kloczek Exp $ -->
-+  <refentryinfo>
-+    <date>19 Apr 1997</date>
-+  </refentryinfo>
-+  <refmeta>
-+    <refentrytitle>shadowconfig</refentrytitle>
-+    <manvolnum>8</manvolnum>
-+    <refmiscinfo class='date'>19 Apr 1997</refmiscinfo>
-+    <refmiscinfo class='source'>Debian GNU/Linux</refmiscinfo>
-+  </refmeta>
-+  <refnamediv id='name'>
-+    <refname>shadowconfig</refname>
-+    <refpurpose>toggle shadow passwords on and off</refpurpose>
-+  </refnamediv>
-+
-+  <refsynopsisdiv id='synopsis'>
-+    <cmdsynopsis>
-+      <command>shadowconfig</command>
-+      <group choice='plain'>
-+        <arg choice='plain'><replaceable>on</replaceable></arg>
-+        <arg choice='plain'><replaceable>off</replaceable></arg>
-+      </group>
-+    </cmdsynopsis>
-+  </refsynopsisdiv>
-+
-+  <refsect1 id='description'>
-+    <title>DESCRIPTION</title>
-+    <para><command>shadowconfig</command> on will turn shadow passwords on;
-+      <emphasis remap='B'>shadowconfig off</emphasis> will turn shadow
-+      passwords off. <command>shadowconfig</command> will print an error
-+      message and exit with a nonzero code if it finds anything awry. If
-+      that happens, you should correct the error and run it again. Turning
-+      shadow passwords on when they are already on, or off when they are
-+      already off, is harmless.
-+    </para>
-+
-+    <para>
-+      Read <filename>/usr/share/doc/passwd/README.Debian</filename> for a
-+      brief introduction
-+      to shadow passwords and related features.
-+    </para>
-+
-+    <para>Note that turning shadow passwords off and on again will lose all
-+      password
-+      aging information.
-+    </para>
-+  </refsect1>
-+</refentry>
-Index: git/man/fr/shadowconfig.8
-===================================================================
---- /dev/null
-+++ git/man/fr/shadowconfig.8
-@@ -0,0 +1,26 @@
-+.\" This file was generated with po4a. Translate the source file.
-+.\"
-+.\"$Id: shadowconfig.8,v 1.4 2001/08/23 23:10:48 kloczek Exp $
-+.TH SHADOWCONFIG 8 "19 avril 1997" "Debian GNU/Linux"
-+.SH NOM
-+shadowconfig \- active ou désactive les mots de passe cachés
-+.SH SYNOPSIS
-+\fBshadowconfig\fP \fIon\fP | \fIoff\fP
-+.SH DESCRIPTION
-+.PP
-+\fBshadowconfig on\fP active les mots de passe cachés («\ shadow passwords\ »)\ ; \fBshadowconfig off\fP les désactive. \fBShadowconfig\fP affiche un message
-+d'erreur et quitte avec une valeur de retour non nulle s'il rencontre
-+quelque chose d'inattendu. Dans ce cas, vous devrez corriger l'erreur avant
-+de recommencer.
-+
-+Activer les mots de passe cachés lorsqu'ils sont déjà activés, ou les
-+désactiver lorsqu'ils ne sont pas actifs est sans effet.
-+
-+Lisez \fI/usr/share/doc/passwd/README.Debian\fP pour une brève introduction aux
-+mots de passe cachés et à leurs fonctionnalités.
-+
-+Notez que désactiver puis réactiver les mots de passe cachés aura pour
-+conséquence la perte des informations d'âge sur les mots de passe.
-+.SH TRADUCTION
-+Nicolas FRANÇOIS, 2004.
-+Veuillez signaler toute erreur à <\fIdebian\-l10\-french@lists.debian.org\fR>.
-Index: git/man/ja/shadowconfig.8
-===================================================================
---- /dev/null
-+++ git/man/ja/shadowconfig.8
-@@ -0,0 +1,25 @@
-+.\"     all right reserved,
-+.\" Translated Tue Oct 30 11:59:11 JST 2001
-+.\" by Maki KURODA <mkuroda@aisys-jp.com>
-+.\"
-+.TH SHADOWCONFIG 8 "19 Apr 1997" "Debian GNU/Linux"
-+.SH 名前
-+shadowconfig \- shadow パスワードの設定をオン及びオフに切替える
-+.SH 書式
-+.B "shadowconfig"
-+.IR on " | " off
-+.SH 説明
-+.PP
-+.B shadowconfig on
-+は shadow パスワードを有効にする。
-+.B shadowconfig off
-+は shadow パスワードを無効にする。
-+.B shadowconfig
-+は何らかの間違いがあると、エラーメッセージを表示し、
-+ゼロではない返り値を返す。
-+もしそのようなことが起こった場合、エラーを修正し、再度実行しなければならない。
-+shadow パスワードの設定がすでにオンの場合にオンに設定したり、
-+すでにオフの場合にオフに設定しても、何の影響もない。
-+
-+.I /usr/share/doc/passwd/README.debian.gz
-+には shadow パスワードとそれに関する特徴の簡単な紹介が書かれている。
-Index: git/man/pl/shadowconfig.8
-===================================================================
---- /dev/null
-+++ git/man/pl/shadowconfig.8
-@@ -0,0 +1,27 @@
-+.\" $Id: shadowconfig.8,v 1.3 2001/08/23 23:10:51 kloczek Exp $
-+.\" {PTM/WK/1999-09-14}
-+.TH SHADOWCONFIG 8 "19 kwietnia 1997" "Debian GNU/Linux"
-+.SH NAZWA
-+shadowconfig - przełącza ochronę haseł i grup przez pliki shadow
-+.SH SKŁADNIA
-+.B "shadowconfig"
-+.IR on " | " off
-+.SH OPIS
-+.PP
-+.B shadowconfig on
-+włącza ochronę haseł i grup przez dodatkowe, przesłaniane pliki (shadow);
-+.B shadowconfig off
-+wyłącza dodatkowe pliki haseł i grup.
-+.B shadowconfig
-+wyświetla komunikat o błędzie i kończy pracę z niezerowym kodem jeśli
-+znajdzie coś nieprawidłowego. W takim wypadku powinieneś poprawić błąd
-+.\" if it finds anything awry.
-+i uruchomić program ponownie.
-+
-+Włączenie ochrony haseł, gdy jest ona już włączona lub jej wyłączenie,
-+gdy jest wyłączona jest nieszkodliwe.
-+
-+Przeczytaj
-+.IR /usr/share/doc/passwd/README.debian.gz ,
-+gdzie znajdziesz krótkie wprowadzenie do ochrony haseł z użyciem dodatkowych
-+plików haseł przesłanianych (shadow passwords) i związanych tematów.

debian/patches/505_useradd_recommend_adduser

@@ -1,36 +0,0 @@
-Goal: Recommend using adduser and deluser.
-
-Fixes: #406046
-
-Status wrt upstream: Debian specific patch.
-
---- a/man/useradd.8.xml
-+++ b/man/useradd.8.xml
-@@ -83,6 +83,12 @@
-   <refsect1 id='description'>
-     <title>DESCRIPTION</title>
-       <para>
-+	<command>useradd</command> is a low level utility for adding
-+	users.  On Debian, administrators should usually use
-+	<citerefentry><refentrytitle>adduser</refentrytitle>
-+	<manvolnum>8</manvolnum></citerefentry> instead.
-+      </para>
-+      <para>
- 	When invoked without the <option>-D</option> option, the
- 	<command>useradd</command> command creates a new user account using
- 	the values specified on the command line plus the default values from
---- a/man/userdel.8.xml
-+++ b/man/userdel.8.xml
-@@ -59,6 +59,12 @@
-   <refsect1 id='description'>
-     <title>DESCRIPTION</title>
-     <para>
-+      <command>userdel</command> is a low level utility for removing
-+      users.  On Debian, administrators should usually use
-+      <citerefentry><refentrytitle>deluser</refentrytitle>
-+      <manvolnum>8</manvolnum></citerefentry> instead.
-+    </para>
-+    <para>
-       The <command>userdel</command> command modifies the system account
-       files, deleting all entries that refer to the user name <emphasis
-       remap='I'>LOGIN</emphasis>. The named user must exist.

debian/patches/506_relaxed_usernames

@@ -1,111 +0,0 @@
-Goal: Relaxed usernames/groupnames checking patch.
-
-Status wrt upstream: Debian specific. Not to be used upstream
-
-Details:
- Allows any non-empty user/grounames that don't contain ':', ',' or '\n'
- characters and don't start with '-', '+', or '~'. This patch is more
- restrictive than original Karl's version. closes: #264879
- Also closes: #377844
- 
- Comments from Karl Ramm (shadow 1:4.0.3-9, 20 Aug 2003 02:06:50 -0400):
- 
- I can't come up with a good justification as to why characters other
- than ':'s and '\0's should be disallowed in group and usernames (other
- than '-' as the leading character).  Thus, the maintenance tools don't
- anymore.  closes: #79682, #166798, #171179
-
---- a/libmisc/chkname.c
-+++ b/libmisc/chkname.c
-@@ -32,44 +32,26 @@
- 	}
- 
- 	/*
--         * User/group names must match gnu e-regex:
--         *    [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
--         *
--         * as a non-POSIX, extension, allow "$" as the last char for
--         * sake of Samba 3.x "add machine script"
--         *
--         * Also do not allow fully numeric names or just "." or "..".
--         */
--	int numeric;
--
--	if ('\0' == *name ||
--	    ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
--			      '\0' == name[1])) ||
--	    !((*name >= 'a' && *name <= 'z') ||
--	      (*name >= 'A' && *name <= 'Z') ||
--	      (*name >= '0' && *name <= '9') ||
--	      *name == '_' ||
--	      *name == '.')) {
-+	 * POSIX indicate that usernames are composed of characters from the
-+	 * portable filename character set [A-Za-z0-9._-], and that the hyphen
-+	 * should not be used as the first character of a portable user name.
-+	 *
-+	 * Allow more relaxed user/group names in Debian -- ^[^-~+:,\s][^:,\s]*$
-+	 */
-+	if (   ('\0' == *name)
-+	    || ('-'  == *name)
-+	    || ('~'  == *name)
-+	    || ('+'  == *name)) {
- 		return false;
- 	}
--
--	numeric = isdigit(*name);
--
--	while ('\0' != *++name) {
--		if (!((*name >= 'a' && *name <= 'z') ||
--		      (*name >= 'A' && *name <= 'Z') ||
--		      (*name >= '0' && *name <= '9') ||
--		      *name == '_' ||
--		      *name == '.' ||
--		      *name == '-' ||
--		      (*name == '$' && name[1] == '\0')
--		     )) {
-+	do {
-+		if ((':' == *name) || (',' == *name) || isspace(*name)) {
- 			return false;
- 		}
--		numeric &= isdigit(*name);
--	}
-+		name++;
-+	} while ('\0' != *name);
- 
--	return !numeric;
-+	return true;
- }
- 
- bool is_valid_user_name (const char *name)
---- a/man/useradd.8.xml
-+++ b/man/useradd.8.xml
-@@ -708,6 +708,14 @@
-       the <command>ls</command> output.
-     </para>
-     <para>
-+      On Debian, the only constraints are that usernames must neither start
-+      with a dash ('-') nor plus ('+') nor tilde ('~') nor contain a
-+      colon (':'), a comma (','), or a whitespace (space: ' ',
-+      end of line: '\n', tabulation: '\t', etc.). Note that using a slash
-+      ('/') may break the default algorithm for the definition of the
-+      user's home directory.
-+    </para>
-+    <para>
-       Usernames may only be up to 32 characters long.
-     </para>
-   </refsect1>
---- a/man/groupadd.8.xml
-+++ b/man/groupadd.8.xml
-@@ -72,6 +72,12 @@
-        also disallowed.
-      </para>
-      <para>
-+       On Debian, the only constraints are that groupnames must neither start
-+       with a dash ('-') nor plus ('+') nor tilde ('~') nor contain a
-+       colon (':'), a comma (','), or a whitespace (space:' ',
-+       end of line: '\n', tabulation: '\t', etc.).
-+     </para>
-+     <para>
-        Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
-      </para>
-   </refsect1>

debian/patches/542_useradd-O_option

@@ -1,40 +0,0 @@
-Goal: accepts the -O flag for backward compatibility. (was used by adduser?)
-
-Note: useradd.8 needs to be regenerated.
-
-Status wrt upstream: not included as this is just specific 
-                     backward compatibility for Debian
-
---- a/man/useradd.8.xml
-+++ b/man/useradd.8.xml
-@@ -326,6 +326,11 @@
- 	    =<replaceable>100</replaceable>&nbsp;<option>-K</option>&nbsp;
- 	    <replaceable>UID_MAX</replaceable>=<replaceable>499</replaceable>
- 	  </para>
-+          <para>
-+            For the compatibility with previous Debian's
-+            <command>useradd</command>, the <option>-O</option> option is
-+            also supported.
-+          </para>
- 	  <!--para>
- 	    Note: <option>-K</option>&nbsp;<replaceable>UID_MIN</replaceable>=<replaceable>10</replaceable>,<replaceable>UID_MAX</replaceable>=<replaceable>499</replaceable>
- 	    doesn't work yet.
---- a/src/useradd.c
-+++ b/src/useradd.c
-@@ -1227,7 +1227,7 @@
- 			{NULL, 0, NULL, '\0'}
- 		};
- 		while ((c = getopt_long (argc, argv,
--					 "b:c:d:De:f:g:G:hk:K:lmMNop:rR:P:s:u:U"
-+					 "b:c:d:De:f:g:G:hk:O:K:lmMNop:rR:P:s:u:U"
- #ifdef WITH_SELINUX
- 		                         "Z:"
- #endif				/* WITH_SELINUX */
-@@ -1367,6 +1367,7 @@
- 				kflg = true;
- 				break;
- 			case 'K':
-+			case 'O': /* compatibility with previous Debian useradd */
- 				/*
- 				 * override login.defs defaults (-K name=value)
- 				 * example: -K UID_MIN=100 -K UID_MAX=499

debian/patches/900_testsuite_groupmems

@@ -1,81 +0,0 @@
---- a/debian/passwd.install
-+++ b/debian/passwd.install
-@@ -9,6 +9,7 @@
- usr/sbin/cppw
- usr/sbin/groupadd
- usr/sbin/groupdel
-+usr/sbin/groupmems
- usr/sbin/groupmod
- usr/sbin/grpck
- usr/sbin/grpconv
-@@ -33,6 +34,7 @@
- usr/share/man/*/man8/chpasswd.8
- usr/share/man/*/man8/groupadd.8
- usr/share/man/*/man8/groupdel.8
-+usr/share/man/*/man8/groupmems.8
- usr/share/man/*/man8/groupmod.8
- usr/share/man/*/man8/grpck.8
- usr/share/man/*/man8/grpconv.8
-@@ -59,6 +61,7 @@
- usr/share/man/man8/chpasswd.8
- usr/share/man/man8/groupadd.8
- usr/share/man/man8/groupdel.8
-+usr/share/man/man8/groupmems.8
- usr/share/man/man8/groupmod.8
- usr/share/man/man8/grpck.8
- usr/share/man/man8/grpconv.8
---- a/debian/passwd.postinst
-+++ b/debian/passwd.postinst
-@@ -31,6 +31,24 @@
-     			exit 1
- 		)
- 	fi
-+	if ! getent group groupmems | grep -q '^groupmems:[^:]*:99'
-+	then
-+		groupadd -g 99 groupmems || (
-+    			cat <<EOF
-+************************  TESTSUITE  *****************************
-+Group ID 99 has been allocated for the groupmems group.  You have either
-+used 99 yourself or created a groupmems group with a different ID.
-+Please correct this problem and reconfigure with ``dpkg --configure passwd''.
-+
-+Note that both user and group IDs in the range 0-99 are globally
-+allocated by the Debian project and must be the same on every Debian
-+system.
-+EOF
-+    			exit 1
-+		)
-+# FIXME
-+		chgrp groupmems /usr/sbin/groupmems
-+	fi
-     ;;
- esac
- 
---- a/debian/rules
-+++ b/debian/rules
-@@ -60,6 +60,7 @@
- 	dh_installpam -p passwd --name=chsh
- 	dh_installpam -p passwd --name=chpasswd
- 	dh_installpam -p passwd --name=newusers
-+	dh_installpam -p passwd --name=groupmems
- ifeq ($(DEB_HOST_ARCH_OS),hurd)
- # login is not built on The Hurd, but some utilities of passwd depends on
- # /etc/login.defs.
-@@ -87,3 +88,6 @@
- 	chgrp shadow debian/passwd/usr/bin/expiry
- 	chmod g+s debian/passwd/usr/bin/chage
- 	chmod g+s debian/passwd/usr/bin/expiry
-+	chgrp groupmems debian/passwd/usr/sbin/groupmems
-+	chmod u+s debian/passwd/usr/sbin/groupmems
-+	chmod o-x debian/passwd/usr/sbin/groupmems
---- /dev/null
-+++ b/debian/passwd.groupmems.pam
-@@ -0,0 +1,8 @@
-+# The PAM configuration file for the Shadow 'groupmod' service
-+#
-+
-+# This allows root to modify groups without being prompted for a password
-+auth		sufficient	pam_rootok.so
-+
-+@include common-auth
-+@include common-account

debian/patches/901_testsuite_gcov

@@ -1,76 +0,0 @@
---- a/lib/Makefile.am
-+++ b/lib/Makefile.am
-@@ -1,6 +1,8 @@
- 
- AUTOMAKE_OPTIONS = 1.0 foreign
- 
-+CFLAGS += -fprofile-arcs -ftest-coverage
-+
- DEFS = 
- 
- noinst_LTLIBRARIES = libshadow.la
---- a/libmisc/Makefile.am
-+++ b/libmisc/Makefile.am
-@@ -1,6 +1,8 @@
- 
- EXTRA_DIST = .indent.pro xgetXXbyYY.c
- 
-+CFLAGS += -fprofile-arcs -ftest-coverage
-+
- INCLUDES = -I$(top_srcdir)/lib
- 
- noinst_LIBRARIES = libmisc.a
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -7,6 +7,8 @@
- suidperms = 4755
- sgidperms = 2755
- 
-+CFLAGS += -fprofile-arcs -ftest-coverage
-+
- INCLUDES = \
- 	-I${top_srcdir}/lib \
- 	-I$(top_srcdir)/libmisc
---- a/debian/rules
-+++ b/debian/rules
-@@ -40,6 +40,12 @@
- endif
- export CFLAGS
- 
-+clean:: clean_gcov
-+
-+clean_gcov:
-+	find . -name "*.gcda" -delete
-+	find . -name "*.gcno" -delete
-+
- # Add extras to the install process:
- binary-install/login::
- 	dh_installpam -p login
---- a/lib/defines.h
-+++ b/lib/defines.h
-@@ -174,23 +174,9 @@
-    trust the formatted time received from the unix domain (or worse,
-    UDP) socket.  -MM */
- /* Avoid translated PAM error messages: Set LC_ALL to "C".
-+ * This is disabled for coverage testing
-  * --Nekral */
--#define SYSLOG(x)							\
--	do {								\
--		char *old_locale = setlocale (LC_ALL, NULL);		\
--		char *saved_locale = NULL;				\
--		if (NULL != old_locale) {				\
--			saved_locale = strdup (old_locale);		\
--		}							\
--		if (NULL != saved_locale) {				\
--			(void) setlocale (LC_ALL, "C");			\
--		}							\
--		syslog x ;						\
--		if (NULL != saved_locale) {				\
--			(void) setlocale (LC_ALL, saved_locale);	\
--			free (saved_locale);				\
--		}							\
--	} while (false)
-+#define SYSLOG(x) syslog x
- #else				/* !ENABLE_NLS */
- #define SYSLOG(x) syslog x
- #endif				/* !ENABLE_NLS */

debian/patches/README.patches

@@ -1,22 +0,0 @@
-Small intro to the system for numbering the patches here...
-
--The 00xx-... patches are forwarded to upstream's git repository
-
--The 0xx_... series of patches are patches isolated from the latest
- version of the shadow Debian package not using quilt in order to
- separate upstream from Debian-specific stuff.
-
- NO MORE PATCHES SHOULD BE ADDED IN THESE SERIES
-
--The 4xx series are patches which have been applied to Debian's shadow
- and have NOT been accepted and/or applied upstream. These patches MUST be kept
- even after resynced with upstream
-
--The 5xx series are patches which are applied to Debian's shadow
- and will never be proposed upstream because they're too specific
- This list SHOULD BE AS SHORT AS POSSIBLE
-
-In short, while we are working towards synchronisation with upstream,
-our goal is to make 0xx patches disappear by moving them either to 3xx
-series (things already implemented upstream) or to 4xx series
-(Debian-specific patches).

debian/patches/debian/Adapt-login.defs-for-Debian.patch

@@ -0,0 +1,493 @@
+From: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
+Date: Sun, 7 Jul 2024 14:06:39 +0200
+Subject: Adapt login.defs for Debian
+
+Remove settings only applicable to shadow's su, which we do not use.
+Remove settings only applicable without PAM support enabled.
+Remove obscure commented-out settings.
+Remove explanation about write(1), which Debian does not ship anymore.
+---
+ etc/login.defs | 367 ++++-----------------------------------------------------
+ 1 file changed, 25 insertions(+), 342 deletions(-)
+
+diff --git a/etc/login.defs b/etc/login.defs
+index 966724c..94c6af1 100644
+--- a/etc/login.defs
++++ b/etc/login.defs
+@@ -1,133 +1,20 @@
+ #
+ # /etc/login.defs - Configuration control definitions for the shadow package.
+ #
+-#	$Id$
+-#
+-
+-#
+-# Delay in seconds before being allowed another attempt after a login failure
+-# Note: when PAM is used, some modules may enforce a minimum delay (e.g.
+-#       pam_unix(8) enforces a 2s delay)
+-#
+-FAIL_DELAY		3
+-
+-#
+-# Enable logging and display of /var/log/faillog login(1) failure info.
+-#
+-FAILLOG_ENAB		yes
+ 
+ #
+ # Enable display of unknown usernames when login(1) failures are recorded.
+ #
++# WARNING: Unknown usernames may become world readable.
++# See #290803 and #298773 for details about how this could become a security
++# concern
+ LOG_UNKFAIL_ENAB	no
+ 
+-#
+-# Enable logging of successful logins
+-#
+-LOG_OK_LOGINS		no
+-
+-#
+-# Enable logging and display of /var/log/lastlog login(1) time info.
+-#
+-LASTLOG_ENAB		yes
+-
+-#
+-# Limit the highest user ID number for which the lastlog entries should
+-# be updated.
+-#
+-# No LASTLOG_UID_MAX means that there is no user ID limit for writing
+-# lastlog entries.
+-#
+-#LASTLOG_UID_MAX
+-
+-#
+-# Enable checking and display of mailbox status upon login.
+-#
+-# Disable if the shell startup files already check for mail
+-# ("mailx -e" or equivalent).
+-#
+-MAIL_CHECK_ENAB		yes
+-
+-#
+-# Enable additional checks upon password changes.
+-#
+-OBSCURE_CHECKS_ENAB	yes
+-
+-#
+-# Enable checking of time restrictions specified in /etc/porttime.
+-#
+-PORTTIME_CHECKS_ENAB	yes
+-
+-#
+-# Enable setting of ulimit, umask, and niceness from passwd(5) gecos field.
+-#
+-QUOTAS_ENAB		yes
+-
+-#
+-# Enable "syslog" logging of su(1) activity - in addition to sulog file logging.
+-# SYSLOG_SG_ENAB does the same for newgrp(1) and sg(1).
+-#
+-SYSLOG_SU_ENAB		yes
+-SYSLOG_SG_ENAB		yes
+-
+-#
+-# If defined, either full pathname of a file containing device names or
+-# a ":" delimited list of device names.  Root logins will be allowed only
+-# from these devices.
+-#
+-CONSOLE		/etc/securetty
+-#CONSOLE	console:tty01:tty02:tty03:tty04
+-
+-#
+-# If defined, all su(1) activity is logged to this file.
+-#
+-#SULOG_FILE	/var/log/sulog
+-
+-#
+-# If defined, ":" delimited list of "message of the day" files to
+-# be displayed upon login.
+-#
+-MOTD_FILE	/etc/motd
+-#MOTD_FILE	/etc/motd:/usr/lib/news/news-motd
+-
+-#
+-# If defined, this file will be output before each login(1) prompt.
+-#
+-#ISSUE_FILE	/etc/issue
+-
+-#
+-# If defined, file which maps tty line to TERM environment parameter.
+-# Each line of the file is in a format similar to "vt100  tty01".
+-#
+-#TTYTYPE_FILE	/etc/ttytype
+-
+-#
+-# If defined, login(1) failures will be logged here in a utmp format.
+-# last(1), when invoked as lastb(1), will read /var/log/btmp, so...
+-#
+-FTMP_FILE	/var/log/btmp
+-
+-#
+-# If defined, name of file whose presence will inhibit non-root
+-# logins.  The content of this file should be a message indicating
+-# why logins are inhibited.
+-#
+-NOLOGINS_FILE	/etc/nologin
+-
+-#
+-# If defined, the command name to display when running "su -".  For
+-# example, if this is defined as "su" then ps(1) will display the
+-# command as "-su".  If not defined, then ps(1) will display the
+-# name of the shell actually being run, e.g. something like "-sh".
+-#
+-SU_NAME		su
+-
+-#
+-# *REQUIRED*
++# REQUIRED for useradd/userdel/usermod
+ #   Directory where mailboxes reside, _or_ name of file, relative to the
+ #   home directory.  If you _do_ define both, MAIL_DIR takes precedence.
+ #
+-MAIL_DIR	/var/spool/mail
++MAIL_DIR	/var/mail
+ #MAIL_FILE	.mail
+ 
+ #
+@@ -139,40 +26,21 @@ MAIL_DIR	/var/spool/mail
+ HUSHLOGIN_FILE	.hushlogin
+ #HUSHLOGIN_FILE	/etc/hushlogins
+ 
+-#
+-# If defined, either a TZ environment parameter spec or the
+-# fully-rooted pathname of a file containing such a spec.
+-#
+-#ENV_TZ		TZ=CST6CDT
+-#ENV_TZ		/etc/tzname
+-
+-#
+-# If defined, an HZ environment parameter spec.
+-#
+-# for Linux/x86
+-ENV_HZ		HZ=100
+-# For Linux/Alpha...
+-#ENV_HZ		HZ=1024
+-
+ #
+ # *REQUIRED*  The default PATH settings, for superuser and normal users.
+ #
+ # (they are minimal, add the rest in the shell startup files)
+-ENV_SUPATH	PATH=/sbin:/bin:/usr/sbin:/usr/bin
+-ENV_PATH	PATH=/bin:/usr/bin
++ENV_SUPATH	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
++ENV_PATH	PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
+ 
+ #
+-# Terminal permissions
++# Terminal permissions for terminals after login(1).
++# These settings are ignored for remote and other logins.
+ #
+ #	TTYGROUP	Login tty will be assigned this group ownership.
+ #	TTYPERM		Login tty will be set to this permission.
+ #
+-# If you have a write(1) program which is "setgid" to a special group
+-# which owns the terminals, define TTYGROUP as the number of such group
+-# and TTYPERM as 0620.  Otherwise leave TTYGROUP commented out and
+-# set TTYPERM to either 622 or 600.
+-#
+-TTYGROUP	tty
++#TTYGROUP	tty
+ TTYPERM		0600
+ 
+ #
+@@ -180,61 +48,35 @@ TTYPERM		0600
+ #
+ #	ERASECHAR	Terminal ERASE character ('\010' = backspace).
+ #	KILLCHAR	Terminal KILL character ('\025' = CTRL/U).
+-#	ULIMIT		Default "ulimit" value.
+ #
+ # The ERASECHAR and KILLCHAR are used only on System V machines.
+-# The ULIMIT is used only if the system supports it.
+-# (now it works with setrlimit too; ulimit is in 512-byte units)
+-#
+-# Prefix these values with "0" to get octal, "0x" to get hexadecimal.
+ #
+ ERASECHAR	0177
+ KILLCHAR	025
+-#ULIMIT		2097152
+-
+-# Default initial "umask" value used by login(1) on non-PAM enabled systems.
+-# Default "umask" value for pam_umask(8) on PAM enabled systems.
+-# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
+-# home directories if HOME_MODE is not set.
+-# 022 is the default value, but 027, or even 077, could be considered
+-# for increased privacy. There is no One True Answer here: each sysadmin
+-# must make up their mind.
+-UMASK		022
+ 
+ # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
+ # home directories.
+-# If HOME_MODE is not set, the value of UMASK is used to create the mode.
+-#HOME_MODE	0700
++HOME_MODE	0700
+ 
+ #
+ # Password aging controls:
+ #
+ #	PASS_MAX_DAYS	Maximum number of days a password may be used.
+ #	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
+-#	PASS_MIN_LEN	Minimum acceptable password length.
+ #	PASS_WARN_AGE	Number of days warning given before a password expires.
+ #
+ PASS_MAX_DAYS	99999
+ PASS_MIN_DAYS	0
+-PASS_MIN_LEN	5
+ PASS_WARN_AGE	7
+ 
+-#
+-# If "yes", the user must be listed as a member of the first gid 0 group
+-# in /etc/group (called "root" on most Linux systems) to be able to "su"
+-# to uid 0 accounts.  If the group doesn't exist or is empty, no one
+-# will be able to "su" to uid 0.
+-#
+-SU_WHEEL_ONLY	no
+-
+ #
+ # Min/max values for automatic uid selection in useradd(8)
+ #
+ UID_MIN			 1000
+ UID_MAX			60000
+ # System accounts
+-SYS_UID_MIN		  101
+-SYS_UID_MAX		  999
++#SYS_UID_MIN		  101
++#SYS_UID_MAX		  999
+ # Extra per user uids
+ SUB_UID_MIN		   100000
+ SUB_UID_MAX		600100000
+@@ -246,8 +88,8 @@ SUB_UID_COUNT		    65536
+ GID_MIN			 1000
+ GID_MAX			60000
+ # System accounts
+-SYS_GID_MIN		  101
+-SYS_GID_MAX		  999
++#SYS_GID_MIN		  101
++#SYS_GID_MAX		  999
+ # Extra per user group ids
+ SUB_GID_MIN		   100000
+ SUB_GID_MAX		600100000
+@@ -255,6 +97,9 @@ SUB_GID_COUNT		    65536
+ 
+ #
+ # Max number of login(1) retries if password is bad
++# This will most likely be overriden by PAM, since the default pam_unix module
++# has it's own built in of 3 retries. However, this is a safe fallback in case
++# you are using an authentication module that does not enforce PAM_MAXTRIES.
+ #
+ LOGIN_RETRIES		5
+ 
+@@ -263,28 +108,6 @@ LOGIN_RETRIES		5
+ #
+ LOGIN_TIMEOUT		60
+ 
+-#
+-# Maximum number of attempts to change password if rejected (too easy)
+-#
+-PASS_CHANGE_TRIES	5
+-
+-#
+-# Warn about weak passwords (but still allow them) if you are root.
+-#
+-PASS_ALWAYS_WARN	yes
+-
+-#
+-# Number of significant characters in the password for crypt().
+-# Default is 8, don't change unless your crypt() is better.
+-# Only used for DES encryption algorithm.
+-#
+-#PASS_MAX_LEN		8
+-
+-#
+-# Require password before chfn(1)/chsh(1) can make any changes.
+-#
+-CHFN_AUTH		yes
+-
+ #
+ # Which fields may be changed by regular users using chfn(1) - use
+ # any combination of letters "frwh" (full name, room number, work
+@@ -294,29 +117,6 @@ CHFN_AUTH		yes
+ CHFN_RESTRICT		rwh
+ 
+ #
+-# Password prompt (%s will be replaced by user name).
+-#
+-# XXX - it doesn't work correctly yet, for now leave it commented out
+-# to use the default which is just "Password: ".
+-#LOGIN_STRING		"%s's Password: "
+-
+-#
+-# Only works if compiled with MD5_CRYPT defined:
+-# If set to "yes", new passwords will be encrypted using the MD5-based
+-# algorithm compatible with the one used by recent releases of FreeBSD.
+-# It supports passwords of unlimited length and longer salt strings.
+-# Set to "no" if you need to copy encrypted passwords to other systems
+-# which don't understand the new algorithm.  Default is "no".
+-#
+-# Note: if you use PAM, it is recommended to use a value consistent with
+-# the PAM modules configuration.
+-#
+-# This variable is deprecated. You should use ENCRYPT_METHOD instead.
+-#
+-#MD5_CRYPT_ENAB	no
+-
+-#
+-# Only works if compiled with ENCRYPTMETHOD_SELECT defined:
+ # If set to MD5, MD5-based algorithm will be used for encrypting password
+ # If set to SHA256, SHA256-based algorithm will be used for encrypting password
+ # If set to SHA512, SHA512-based algorithm will be used for encrypting password
+@@ -326,66 +126,10 @@ CHFN_RESTRICT		rwh
+ # MD5 and DES should not be used for new hashes, see crypt(5) for recommendations.
+ # Overrides the MD5_CRYPT_ENAB option
+ #
+-# Note: if you use PAM, it is recommended to use a value consistent with
++# Note: It is recommended to use a value consistent with
+ # the PAM modules configuration.
+ #
+-#ENCRYPT_METHOD DES
+-
+-#
+-# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
+-#
+-# Define the number of SHA rounds.
+-# With a lot of rounds, it is more difficult to brute-force the password.
+-# However, more CPU resources will be needed to authenticate users if
+-# this value is increased.
+-#
+-# If not specified, the libc will choose the default number of rounds (5000),
+-# which is orders of magnitude too low for modern hardware.
+-# The values must be within the 1000-999999999 range.
+-# If only one of the MIN or MAX values is set, then this value will be used.
+-# If MIN > MAX, the highest value will be used.
+-#
+-#SHA_CRYPT_MIN_ROUNDS 5000
+-#SHA_CRYPT_MAX_ROUNDS 5000
+-
+-#
+-# Only works if ENCRYPT_METHOD is set to BCRYPT.
+-#
+-# Define the number of BCRYPT rounds.
+-# With a lot of rounds, it is more difficult to brute-force the password.
+-# However, more CPU resources will be needed to authenticate users if
+-# this value is increased.
+-#
+-# If not specified, 13 rounds will be attempted.
+-# If only one of the MIN or MAX values is set, then this value will be used.
+-# If MIN > MAX, the highest value will be used.
+-#
+-#BCRYPT_MIN_ROUNDS 13
+-#BCRYPT_MAX_ROUNDS 13
+-
+-#
+-# Only works if ENCRYPT_METHOD is set to YESCRYPT.
+-#
+-# Define the YESCRYPT cost factor.
+-# With a higher cost factor, it is more difficult to brute-force the password.
+-# However, more CPU time and more memory will be needed to authenticate users
+-# if this value is increased.
+-#
+-# If not specified, a cost factor of 5 will be used.
+-# The value must be within the 1-11 range.
+-#
+-#YESCRYPT_COST_FACTOR 5
+-
+-#
+-# List of groups to add to the user's supplementary group set
+-# when logging in from the console (as determined by the CONSOLE
+-# setting).  Default is none.
+-#
+-# Use with caution - it is possible for users to gain permanent
+-# access to these groups, even when not logged in from the console.
+-# How to do it is left as an exercise for the reader...
+-#
+-#CONSOLE_GROUPS		floppy:audio:cdrom
++ENCRYPT_METHOD YESCRYPT
+ 
+ #
+ # Should login be allowed if we can't cd to the home directory?
+@@ -402,72 +146,11 @@ DEFAULT_HOME	yes
+ NONEXISTENT	/nonexistent
+ 
+ #
+-# If this file exists and is readable, login environment will be
+-# read from it.  Every line should be in the form name=value.
++# If set to yes, userdel(8) will remove the user's group if it contains no more
++# members, and useradd(8) will create by default a group with the name of the
++# user.
+ #
+-ENVIRON_FILE	/etc/environment
+-
+-#
+-# If defined, this command is run when removing a user.
+-# It should remove any at/cron/print jobs etc. owned by
+-# the user to be removed (passed as the first argument).
+-#
+-#USERDEL_CMD	/usr/sbin/userdel_local
+-
+-#
+-# Enable setting of the umask group bits to be the same as owner bits
+-# (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid is
+-# the same as gid, and username is the same as the primary group name.
+-#
+-# This also enables userdel(8) to remove user groups if no members exist.
++# Other former uses of this variable are not used in PAM environments, such as
++# Debian.
+ #
+ USERGROUPS_ENAB yes
+-
+-#
+-# If set to a non-zero number, the shadow utilities will make sure that
+-# groups never have more than this number of users on one line.
+-# This permits to support split groups (groups split into multiple lines,
+-# with the same group ID, to avoid limitation of the line length in the
+-# group file).
+-#
+-# 0 is the default value and disables this feature.
+-#
+-#MAX_MEMBERS_PER_GROUP	0
+-
+-#
+-# If useradd(8) should create home directories for users by default (non
+-# system users only).
+-# This option is overridden with the -M or -m flags on the useradd(8)
+-# command-line.
+-#
+-#CREATE_HOME     yes
+-
+-#
+-# Force use shadow, even if shadow passwd & shadow group files are
+-# missing.
+-#
+-#FORCE_SHADOW    yes
+-
+-#
+-# Allow newuidmap and newgidmap when running under an alternative
+-# primary group.
+-#
+-#GRANT_AUX_GROUP_SUBIDS yes
+-
+-#
+-# Prevents an empty password field to be interpreted as "no authentication
+-# required".
+-# Set to "yes" to prevent for all accounts
+-# Set to "superuser" to prevent for UID 0 / root (default)
+-# Set to "no" to not prevent for any account (dangerous, historical default)
+-PREVENT_NO_AUTH superuser
+-
+-#
+-# Select the HMAC cryptography algorithm.
+-# Used in pam_timestamp module to calculate the keyed-hash message
+-# authentication code.
+-#
+-# Note: it is recommended to check hmac(3) to see the possible algorithms
+-# that are available in your system.
+-#
+-#HMAC_CRYPTO_ALGO SHA512

debian/patches/debian/Document-the-shadowconfig-utility.patch

@@ -0,0 +1,65 @@
+From: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
+Date: Sat, 22 Jun 2024 17:39:41 +0200
+Subject: Document the shadowconfig utility
+
+Status wrt upstream: The shadowconfig utility is Debian-specific.
+The man page is Debian-specific, but it used to be distributed by
+upstream.
+---
+ man/Makefile.am         |  1 +
+ man/man8/shadowconfig.8 | 34 ++++++++++++++++++++++++++++++++++
+ 2 files changed, 35 insertions(+)
+ create mode 100644 man/man8/shadowconfig.8
+
+diff --git a/man/Makefile.am b/man/Makefile.am
+index f34ed7a..2523e84 100644
+--- a/man/Makefile.am
++++ b/man/Makefile.am
+@@ -36,6 +36,7 @@ man_MANS = \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
++	man8/shadowconfig.8 \
+ 	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+diff --git a/man/man8/shadowconfig.8 b/man/man8/shadowconfig.8
+new file mode 100644
+index 0000000..a463a92
+--- /dev/null
++++ b/man/man8/shadowconfig.8
+@@ -0,0 +1,34 @@
++.TH shadowconfig 8 2025-02-17 "Debian shadow-utils"
++.SH Name
++shadowconfig \- turn shadow passwords on
++.
++.
++.SH Synopsis
++.SY shadowconfig on
++.YS
++.
++.
++.SH Description
++.I shadowconfig\ on
++will turn shadow passwords on.
++.
++.
++.SH Errors
++.B shadowconfig
++will print an error message and exit with a nonzero code
++if it finds anything awry.
++If that happens,
++you should correct the error and run it again.
++Turning shadow passwords on when they are already on
++is harmless.
++.
++.
++.SH Caveats
++Turning shadow passwords off using shadowconfig
++is not supported anymore.
++.
++.
++.SH See also
++Read
++.I /usr/share/doc/passwd/README.Debian
++for a brief introduction to shadow passwords and related features.

debian/patches/debian/Exclude-Debian-globally-allocated-UIDs-from-sys_uid-range.patch

@@ -0,0 +1,37 @@
+From: Chris Hofstaedtler <zeha@debian.org>
+Date: Sun, 16 Mar 2025 13:29:45 +0100
+Subject: Exclude Debian-globally allocated UIDs from sys_uid range warning
+
+Bug: http://bugs.debian.org/1100563
+---
+ src/useradd.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/src/useradd.c b/src/useradd.c
+index b3ab1c4..bbc9859 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -2406,14 +2406,21 @@ static void create_mail(const struct option_flags *flags)
+ #endif
+ }
+ 
++/* See Debian Policy 9.2.2 "UID and GID classes"
++ * https://www.debian.org/doc/debian-policy/ch-opersys.html#uid-and-gid-classes
++ */
++#define DEBIAN_GLOBAL_UID_MIN ((uid_t)60000)
++#define DEBIAN_GLOBAL_UID_MAX ((uid_t)64999)
++
+ static void check_uid_range(int rflg, uid_t user_id)
+ {
+ 	uid_t uid_min ;
+ 	uid_t uid_max ;
+ 	if (rflg) {
+ 		uid_max = getdef_ulong("SYS_UID_MAX",getdef_ulong("UID_MIN",1000UL)-1);
+-		if (user_id > uid_max) {
+-			fprintf(stderr, _("%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"), Prog, user_name, user_id, uid_max);
++		if (user_id > uid_max
++			&& (!(user_id >= DEBIAN_GLOBAL_UID_MIN && user_id <= DEBIAN_GLOBAL_UID_MAX))) {
++				fprintf(stderr, _("%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"), Prog, user_name, user_id, uid_max);
+ 		}
+ 	}else{
+ 		uid_min = getdef_ulong("UID_MIN", 1000UL);

debian/patches/debian/Keep-using-Debian-adduser-defaults.patch

@@ -0,0 +1,52 @@
+From: Balint Reczey <balint@balintreczey.hu>
+Date: Sat, 22 Jun 2024 17:39:41 +0200
+Subject: Keep using Debian's adduser defaults
+
+Bug: https://github.com/shadow-maint/shadow/issues/501
+Bug-Debian: https://bugs.debian.org/1004710
+Forwarded: not-needed
+
+Upstream's bbf4b79bc49fd1826eb41f6629669ef0b647267b commit
+in 4.9 merged those values from upstream's default configuration file
+which is not shipped in Debian.
+This patch keeps the program's compiled in defaults in sync with the
+configuration files shipped in Debian (debian/default/useradd).
+---
+ man/useradd.8.xml | 2 +-
+ src/useradd.c     | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/man/useradd.8.xml b/man/useradd.8.xml
+index e6db7f6..2e83b4f 100644
+--- a/man/useradd.8.xml
++++ b/man/useradd.8.xml
+@@ -262,7 +262,7 @@
+ 	    command line), useradd will set the primary group of the new
+ 	    user to the value specified by the <option>GROUP</option>
+ 	    variable in <filename>/etc/default/useradd</filename>, or
+-	    1000 by default.
++	    100 by default.
+ 	  </para>
+ 	</listitem>
+       </varlistentry>
+diff --git a/src/useradd.c b/src/useradd.c
+index 899efe3..b3ab1c4 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -106,14 +106,14 @@ static const char Prog[] = "useradd";
+ /*
+  * These defaults are used if there is no defaults file.
+  */
+-static gid_t def_group = 1000;
++static gid_t def_group = 100;
+ static const char *def_groups = "";
+ static const char *def_gname = "other";
+ static const char *def_home = "/home";
+ static const char *def_shell = "/bin/bash";
+ static const char *def_template = SKEL_DIR;
+ static const char *def_usrtemplate = USRSKELDIR;
+-static const char *def_create_mail_spool = "yes";
++static const char *def_create_mail_spool = "no";
+ static const char *def_log_init = "yes";
+ 
+ static long def_inactive = -1;

debian/patches/debian/Recommend-using-adduser-and-deluser.patch

@@ -0,0 +1,46 @@
+From: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
+Date: Sat, 22 Jun 2024 17:39:41 +0200
+Subject: Recommend using adduser and deluser
+
+Fixes: #406046
+
+Status wrt upstream: Debian specific patch.
+---
+ man/useradd.8.xml | 6 ++++++
+ man/userdel.8.xml | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/man/useradd.8.xml b/man/useradd.8.xml
+index 2e83b4f..67c469a 100644
+--- a/man/useradd.8.xml
++++ b/man/useradd.8.xml
+@@ -82,6 +82,12 @@
+ 
+   <refsect1 id='description'>
+     <title>DESCRIPTION</title>
++      <para>
++	<command>useradd</command> is a low level utility for adding
++	users.  On Debian, administrators should usually use
++	<citerefentry><refentrytitle>adduser</refentrytitle>
++	<manvolnum>8</manvolnum></citerefentry> instead.
++      </para>
+       <para>
+ 	When invoked without the <option>-D</option> option, the
+ 	<command>useradd</command> command creates a new user account using
+diff --git a/man/userdel.8.xml b/man/userdel.8.xml
+index e10a6af..863d3f1 100644
+--- a/man/userdel.8.xml
++++ b/man/userdel.8.xml
+@@ -58,6 +58,12 @@
+ 
+   <refsect1 id='description'>
+     <title>DESCRIPTION</title>
++    <para>
++      <command>userdel</command> is a low level utility for removing
++      users.  On Debian, administrators should usually use
++      <citerefentry><refentrytitle>deluser</refentrytitle>
++      <manvolnum>8</manvolnum></citerefentry> instead.
++    </para>
+     <para>
+       The <command>userdel</command> command modifies the system account
+       files, deleting all entries that refer to the user name <emphasis

debian/patches/debian/Set-group-and-mode-for-g-shadow-files.patch

@@ -0,0 +1,75 @@
+From: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
+Date: Sat, 22 Jun 2024 17:39:41 +0200
+Subject: Set group and mode for [g]shadow files
+
+Set group 'shadow' and mode 0400.
+
+Fixes: #166793
+---
+ lib/commonio.c | 12 ++++++++++++
+ lib/sgroupio.c |  2 +-
+ lib/shadowio.c |  2 +-
+ 3 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/lib/commonio.c b/lib/commonio.c
+index 2c6a1a2..860efb9 100644
+--- a/lib/commonio.c
++++ b/lib/commonio.c
+@@ -22,6 +22,7 @@
+ #include <sys/stat.h>
+ #include <stdlib.h>
+ #include <utime.h>
++#include <grp.h>
+ 
+ #include "alloc/malloc.h"
+ #include "atoi/getnum.h"
+@@ -931,12 +932,23 @@ commonio_close(struct commonio_db *db, MAYBE_UNUSED bool process_selinux)
+ 		if (errors)
+ 			goto fail;
+ 	} else {
++		struct group *grp;
+ 		/*
+ 		 * Default permissions for new [g]shadow files.
+ 		 */
+ 		sb.st_mode = db->st_mode;
+ 		sb.st_uid = db->st_uid;
+ 		sb.st_gid = db->st_gid;
++
++		/*
++		 * Try to retrieve the shadow's GID, and fall back to GID 0.
++		 */
++		if (sb.st_gid == 0) {
++			if ((grp = getgrnam("shadow")) != NULL)
++				sb.st_gid = grp->gr_gid;
++			else
++				sb.st_gid = 0;
++		}
+ 	}
+ 
+ 	if (stprintf_a(buf, "%s+", db->filename) == -1)
+diff --git a/lib/sgroupio.c b/lib/sgroupio.c
+index ad3adc3..527f5be 100644
+--- a/lib/sgroupio.c
++++ b/lib/sgroupio.c
+@@ -213,7 +213,7 @@ static struct commonio_db gshadow_db = {
+ #ifdef WITH_SELINUX
+ 	NULL,			/* scontext */
+ #endif
+-	0400,                   /* st_mode */
++	0440,                   /* st_mode */
+ 	0,                      /* st_uid */
+ 	0,                      /* st_gid */
+ 	NULL,			/* head */
+diff --git a/lib/shadowio.c b/lib/shadowio.c
+index bf87503..be917ac 100644
+--- a/lib/shadowio.c
++++ b/lib/shadowio.c
+@@ -87,7 +87,7 @@ static struct commonio_db shadow_db = {
+ #ifdef WITH_SELINUX
+ 	NULL,			/* scontext */
+ #endif				/* WITH_SELINUX */
+-	0400,                   /* st_mode */
++	0440,                   /* st_mode */
+ 	0,                      /* st_uid */
+ 	0,                      /* st_gid */
+ 	NULL,			/* head */

debian/patches/debian/Stop-building-programs-we-do-not-install.patch

@@ -0,0 +1,561 @@
+From: Chris Hofstaedtler <zeha@debian.org>
+Date: Tue, 6 Aug 2024 00:27:13 +0200
+Subject: Stop building programs we do not install
+
+---
+ man/Makefile.am       | 15 ---------------
+ man/cs/Makefile.am    |  9 ---------
+ man/da/Makefile.am    |  3 ---
+ man/de/Makefile.am    | 10 ----------
+ man/fr/Makefile.am    | 10 ----------
+ man/hu/Makefile.am    |  3 ---
+ man/id/Makefile.am    |  1 -
+ man/it/Makefile.am    | 10 ----------
+ man/ja/Makefile.am    |  8 --------
+ man/ko/Makefile.am    |  2 --
+ man/pl/Makefile.am    |  6 ------
+ man/ru/Makefile.am    |  9 ---------
+ man/sv/Makefile.am    |  8 --------
+ man/tr/Makefile.am    |  2 --
+ man/uk/Makefile.am    |  9 ---------
+ man/zh_CN/Makefile.am | 10 ----------
+ man/zh_TW/Makefile.am |  2 --
+ src/Makefile.am       |  7 +++----
+ 18 files changed, 3 insertions(+), 121 deletions(-)
+
+diff --git a/man/Makefile.am b/man/Makefile.am
+index 2523e84..05a0c86 100644
+--- a/man/Makefile.am
++++ b/man/Makefile.am
+@@ -13,8 +13,6 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+@@ -25,19 +23,14 @@ man_MANS = \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+ 	man8/shadowconfig.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+ 	man8/useradd.8 \
+@@ -82,8 +75,6 @@ man_XMANS = \
+ 	chpasswd.8.xml \
+ 	chsh.1.xml \
+ 	expiry.1.xml \
+-	faillog.5.xml \
+-	faillog.8.xml \
+ 	getsubids.1.xml \
+ 	gpasswd.1.xml \
+ 	groupadd.8.xml \
+@@ -96,12 +87,9 @@ man_XMANS = \
+ 	login.1.xml \
+ 	login.access.5.xml \
+ 	login.defs.5.xml \
+-	logoutd.8.xml \
+ 	newgidmap.1.xml \
+-	newgrp.1.xml \
+ 	newuidmap.1.xml \
+ 	newusers.8.xml \
+-	nologin.8.xml \
+ 	passwd.1.xml \
+ 	passwd.5.xml \
+ 	porttime.5.xml \
+@@ -109,9 +97,6 @@ man_XMANS = \
+ 	pwconv.8.xml \
+ 	shadow.3.xml \
+ 	shadow.5.xml \
+-	sg.1.xml \
+-	su.1.xml \
+-	suauth.5.xml \
+ 	subgid.5.xml \
+ 	subuid.5.xml \
+ 	useradd.8.xml \
+diff --git a/man/cs/Makefile.am b/man/cs/Makefile.am
+index 45aec38..e1f9f87 100644
+--- a/man/cs/Makefile.am
++++ b/man/cs/Makefile.am
+@@ -3,25 +3,16 @@ mandir = @mandir@/cs
+ 
+ man_MANS = \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man5/gshadow.5 \
+-	man8/nologin.8 \
+ 	man5/passwd.5 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+ 	man8/vipw.8
+ 
+ if ENABLE_LASTLOG
+ man_MANS += man8/lastlog.8
+ endif
+-
+-EXTRA_DIST = $(man_MANS) \
+-	man8/groupmems.8 \
+-	man8/logoutd.8
+-
+diff --git a/man/da/Makefile.am b/man/da/Makefile.am
+index c61b787..12234cb 100644
+--- a/man/da/Makefile.am
++++ b/man/da/Makefile.am
+@@ -6,10 +6,7 @@ man_MANS = \
+ 	man1/chfn.1 \
+ 	man8/groupdel.8 \
+ 	man5/gshadow.5 \
+-	man8/logoutd.8 \
+ 	man1/newgrp.1 \
+-	man8/nologin.8 \
+-	man1/sg.1 \
+ 	man8/vigr.8 \
+ 	man8/vipw.8
+ 
+diff --git a/man/de/Makefile.am b/man/de/Makefile.am
+index d3a6d6c..59602aa 100644
+--- a/man/de/Makefile.am
++++ b/man/de/Makefile.am
+@@ -8,34 +8,24 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/fr/Makefile.am b/man/fr/Makefile.am
+index 2365e23..6cbaadc 100644
+--- a/man/fr/Makefile.am
++++ b/man/fr/Makefile.am
+@@ -8,34 +8,24 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/hu/Makefile.am b/man/hu/Makefile.am
+index 6bf68e8..2930da3 100644
+--- a/man/hu/Makefile.am
++++ b/man/hu/Makefile.am
+@@ -4,11 +4,8 @@ mandir = @mandir@/hu
+ man_MANS = \
+ 	man1/chsh.1 \
+ 	man1/gpasswd.1 \
+-	man1/login.1 \
+-	man1/newgrp.1 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+-	man1/sg.1 \
+ 	man1/su.1
+ 
+ if ENABLE_LASTLOG
+diff --git a/man/id/Makefile.am b/man/id/Makefile.am
+index 21f3dbe..566fa8b 100644
+--- a/man/id/Makefile.am
++++ b/man/id/Makefile.am
+@@ -3,7 +3,6 @@ mandir = @mandir@/id
+ 
+ man_MANS = \
+ 	man1/chsh.1 \
+-	man1/login.1 \
+ 	man8/useradd.8
+ 
+ EXTRA_DIST = $(man_MANS)
+diff --git a/man/it/Makefile.am b/man/it/Makefile.am
+index 736576c..3312232 100644
+--- a/man/it/Makefile.am
++++ b/man/it/Makefile.am
+@@ -8,34 +8,24 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/ja/Makefile.am b/man/ja/Makefile.am
+index b759726..1e22da2 100644
+--- a/man/ja/Makefile.am
++++ b/man/ja/Makefile.am
+@@ -7,8 +7,6 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+@@ -16,20 +14,14 @@ man_MANS = \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/ko/Makefile.am b/man/ko/Makefile.am
+index 4f73651..0f17a17 100644
+--- a/man/ko/Makefile.am
++++ b/man/ko/Makefile.am
+@@ -4,9 +4,7 @@ mandir = @mandir@/ko
+ man_MANS = \
+ 	man1/chfn.1 \
+ 	man1/chsh.1 \
+-	man1/login.1 \
+ 	man5/passwd.5 \
+-	man1/su.1 \
+ 	man8/vigr.8 \
+ 	man8/vipw.8
+ # newgrp.1 must be updated
+diff --git a/man/pl/Makefile.am b/man/pl/Makefile.am
+index 2a015f3..02f4533 100644
+--- a/man/pl/Makefile.am
++++ b/man/pl/Makefile.am
+@@ -6,17 +6,11 @@ man_MANS = \
+ 	man1/chage.1 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/ru/Makefile.am b/man/ru/Makefile.am
+index 845a603..9afcb22 100644
+--- a/man/ru/Makefile.am
++++ b/man/ru/Makefile.am
+@@ -8,22 +8,16 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+ 	man8/nologin.8 \
+ 	man1/passwd.1 \
+@@ -31,11 +25,8 @@ man_MANS = \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/sv/Makefile.am b/man/sv/Makefile.am
+index 1918af7..d572c36 100644
+--- a/man/sv/Makefile.am
++++ b/man/sv/Makefile.am
+@@ -5,24 +5,16 @@ man_MANS = \
+ 	man1/chage.1 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man5/gshadow.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+-	man5/suauth.5 \
+ 	man8/userdel.8 \
+ 	man8/vigr.8 \
+ 	man8/vipw.8
+diff --git a/man/tr/Makefile.am b/man/tr/Makefile.am
+index 8d8b916..8b2aa2d 100644
+--- a/man/tr/Makefile.am
++++ b/man/tr/Makefile.am
+@@ -6,11 +6,9 @@ man_MANS = \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+ 	man8/groupmod.8 \
+-	man1/login.1 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8
+diff --git a/man/uk/Makefile.am b/man/uk/Makefile.am
+index a0f106d..f069eea 100644
+--- a/man/uk/Makefile.am
++++ b/man/uk/Makefile.am
+@@ -8,34 +8,25 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+ 	man1/newgrp.1 \
+ 	man8/newusers.8 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/zh_CN/Makefile.am b/man/zh_CN/Makefile.am
+index 59d1072..9402a9e 100644
+--- a/man/zh_CN/Makefile.am
++++ b/man/zh_CN/Makefile.am
+@@ -8,34 +8,24 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/zh_TW/Makefile.am b/man/zh_TW/Makefile.am
+index c36ed2c..6fb6a15 100644
+--- a/man/zh_TW/Makefile.am
++++ b/man/zh_TW/Makefile.am
+@@ -5,12 +5,10 @@ man_MANS = \
+ 	man1/chfn.1 \
+ 	man1/chsh.1 \
+ 	man8/chpasswd.8 \
+-	man1/newgrp.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+ 	man8/groupmod.8 \
+ 	man5/passwd.5 \
+-	man1/su.1 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 6981815..5ca78ed 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -26,8 +26,8 @@ AM_CFLAGS = $(LIBBSD_CFLAGS)
+ # and installation would be much simpler (just two directories,
+ # $prefix/bin and $prefix/sbin, no install-data hacks...)
+ 
+-bin_PROGRAMS   = login
+-sbin_PROGRAMS  = nologin
++bin_PROGRAMS   =
++sbin_PROGRAMS  =
+ ubin_PROGRAMS  = faillog chage chfn chsh expiry gpasswd newgrp passwd
+ if ENABLE_SUBIDS
+ ubin_PROGRAMS += newgidmap newuidmap
+@@ -48,7 +48,6 @@ usbin_PROGRAMS = \
+ 	grpck \
+ 	grpconv \
+ 	grpunconv \
+-	logoutd \
+ 	newusers \
+ 	pwck \
+ 	pwconv \
+@@ -59,7 +58,7 @@ usbin_PROGRAMS = \
+ 	vipw
+ 
+ # sulogin from sysvinit
+-noinst_PROGRAMS = sulogin
++noinst_PROGRAMS =
+ 
+ suidusbins     =
+ suidbins       =

debian/patches/debian/Warn-when-badname-and-variants-are-given.patch

@@ -0,0 +1,104 @@
+From: Chris Hofstaedtler <zeha@debian.org>
+Date: Mon, 17 Feb 2025 18:17:15 +0100
+Subject: Warn when --badname (and variants) are given
+
+Upstream PR 1158 will remove them, probably in the forky timeframe.
+---
+ src/newusers.c | 5 ++++-
+ src/pwck.c     | 5 ++++-
+ src/useradd.c  | 5 ++++-
+ src/usermod.c  | 5 ++++-
+ 4 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/src/newusers.c b/src/newusers.c
+index e9353fd..9054373 100644
+--- a/src/newusers.c
++++ b/src/newusers.c
+@@ -135,7 +135,7 @@ static void usage (int status)
+ 	                  "\n"
+ 	                  "Options:\n"),
+ 	                Prog);
+-	(void) fputs (_("  -b, --badname                 allow bad names\n"), usageout);
++	(void) fputs (_("  -b, --badname                 allow bad names (DEPRECATED)\n"), usageout);
+ #ifndef USE_PAM
+ 	(void) fprintf (usageout,
+ 	                _("  -c, --crypt-method METHOD     the crypt method (one of %s)\n"),
+@@ -668,6 +668,9 @@ static void process_flags (int argc, char **argv, struct option_flags *flags)
+ 		switch (c) {
+ 		case 'b':
+ 			allow_bad_names = true;
++			fprintf (stderr,
++					 _("%s: WARNING: -b and --badname are deprecated and will be removed\n"),
++					 Prog);
+ 			break;
+ #ifndef USE_PAM
+ 		case 'c':
+diff --git a/src/pwck.c b/src/pwck.c
+index c35f03e..81f4ccd 100644
+--- a/src/pwck.c
++++ b/src/pwck.c
+@@ -139,7 +139,7 @@ usage (int status)
+ 		                  "Options:\n"),
+ 		                Prog);
+ 	}
+-	(void) fputs (_("  -b, --badname                 allow bad names\n"), usageout);
++	(void) fputs (_("  -b, --badname                 allow bad names (DEPRECATED)\n"), usageout);
+ 	(void) fputs (_("  -h, --help                    display this help message and exit\n"), usageout);
+ 	(void) fputs (_("  -q, --quiet                   report errors only\n"), usageout);
+ 	(void) fputs (_("  -r, --read-only               display errors and warnings\n"
+@@ -181,6 +181,9 @@ static void process_flags (int argc, char **argv, struct option_flags *flags)
+ 		switch (c) {
+ 		case 'b':
+ 			allow_bad_names = true;
++			fprintf (stderr,
++					 _("%s: WARNING: --badname is deprecated and will be removed\n"),
++					 Prog);
+ 			break;
+ 		case 'h':
+ 			usage (E_SUCCESS);
+diff --git a/src/useradd.c b/src/useradd.c
+index bbc9859..5446f35 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -877,7 +877,7 @@ static void usage (int status)
+ 	                  "\n"
+ 	                  "Options:\n"),
+ 	                Prog, Prog, Prog);
+-	(void) fputs (_("      --badname                 do not check for bad names\n"), usageout);
++	(void) fputs (_("      --badname                 do not check for bad names (DEPRECATED)\n"), usageout);
+ 	(void) fputs (_("  -b, --base-dir BASE_DIR       base directory for the home directory of the\n"
+ 	                "                                new account\n"), usageout);
+ #ifdef WITH_BTRFS
+@@ -1200,6 +1200,9 @@ static void process_flags (int argc, char **argv, struct option_flags *flags)
+ 				break;
+ 			case 201:
+ 				allow_bad_names = true;
++				fprintf (stderr,
++					     _("%s: WARNING: --badname is deprecated and will be removed\n"),
++					     Prog);
+ 				break;
+ 			case 'c':
+ 				if (!VALID (optarg)) {
+diff --git a/src/usermod.c b/src/usermod.c
+index e26f011..f0f6234 100644
+--- a/src/usermod.c
++++ b/src/usermod.c
+@@ -396,7 +396,7 @@ usage (int status)
+ 	(void) fputs (_("  -a, --append                  append the user to the supplemental GROUPS\n"
+ 	                "                                mentioned by the -G option without removing\n"
+ 	                "                                the user from other groups\n"), usageout);
+-	(void) fputs (_("  -b, --badname                 allow bad names\n"), usageout);
++	(void) fputs (_("  -b, --badname                 allow bad names (DEPRECATED)\n"), usageout);
+ 	(void) fputs (_("  -c, --comment COMMENT         new value of the GECOS field\n"), usageout);
+ 	(void) fputs (_("  -d, --home HOME_DIR           new home directory for the user account\n"), usageout);
+ 	(void) fputs (_("  -e, --expiredate EXPIRE_DATE  set account expiration date to EXPIRE_DATE\n"), usageout);
+@@ -1062,6 +1062,9 @@ process_flags(int argc, char **argv, struct option_flags *flags)
+ 				break;
+ 			case 'b':
+ 				allow_bad_names = true;
++				fprintf (stderr,
++					     _("%s: WARNING: -b, --badname and --badnames are deprecated and will be removed\n"),
++					     Prog);
+ 				break;
+ 			case 'c':
+ 				if (!VALID (optarg)) {

debian/patches/debian/configure.ac-align-exec_prefix-with-prefix.patch

@@ -0,0 +1,23 @@
+From: Chris Hofstaedtler <zeha@debian.org>
+Date: Mon, 24 Feb 2025 23:24:41 +0100
+Subject: configure.ac: align exec_prefix with prefix
+
+Hopefully upstream will fix this one day.
+Reported as https://github.com/shadow-maint/shadow/issues/1229
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 7727d1c..b5114e8 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -23,7 +23,7 @@ AC_SUBST([LIBSUBID_ABI], [libsubid_abi])
+ 
+ dnl Some hacks...
+ test "x$prefix" = "xNONE" && prefix="/usr"
+-test "X$prefix" = "X/usr" && exec_prefix=""
++test "X$prefix" = "X/usr" && exec_prefix="/usr"
+ 
+ AC_USE_SYSTEM_EXTENSIONS
+ 

debian/patches/debian/tests-disable-su.patch

@@ -0,0 +1,89 @@
+From: Serge Hallyn <serge@hallyn.com>
+Date: Thu, 27 Jun 2024 01:23:05 +0200
+Subject: upstream testsuite: disable su tests
+
+Debian uses su from util-linux, pointless/impossible to test shadow's su
+here.
+---
+ tests/run_some | 68 ----------------------------------------------------------
+ 1 file changed, 68 deletions(-)
+
+diff --git a/tests/run_some b/tests/run_some
+index c58f59b..46317eb 100755
+--- a/tests/run_some
++++ b/tests/run_some
+@@ -79,74 +79,6 @@ echo "-: test failed"
+ find "${build_path}" -name "*.gcda" -delete
+ # ignore the result of the first test.  ~magic~
+ run_test ./su/01/su_user.test ignore_failure
+-run_test ./su/01/su_user.test
+-run_test ./su/01/su_root.test
+-find "${build_path}" -name "*.gcda" -exec chmod a+rw {} \;
+-run_test ./su/02/env_FOO-options_--login
+-run_test ./su/02/env_FOO-options_--login_bash
+-run_test ./su/02/env_FOO-options_--preserve-environment
+-run_test ./su/02/env_FOO-options_--preserve-environment_bash
+-run_test ./su/02/env_FOO-options_-
+-run_test ./su/02/env_FOO-options_-_bash
+-run_test ./su/02/env_FOO-options_-l-m
+-run_test ./su/02/env_FOO-options_-l-m_bash
+-run_test ./su/02/env_FOO-options_-l
+-run_test ./su/02/env_FOO-options_-l_bash
+-run_test ./su/02/env_FOO-options_-m_bash
+-run_test ./su/02/env_FOO-options_-m
+-run_test ./su/02/env_FOO-options_-p
+-run_test ./su/02/env_FOO-options_-p_bash
+-run_test ./su/02/env_FOO-options__bash
+-run_test ./su/02/env_FOO-options_
+-run_test ./su/02/env_FOO-options_-p-
+-run_test ./su/02/env_FOO-options_-p-_bash
+-run_test ./su/02/env_special-options_-l-p
+-run_test ./su/02/env_special-options_-l
+-run_test ./su/02/env_special-options_-l-p_bash
+-run_test ./su/02/env_special-options_-l_bash
+-run_test ./su/02/env_special-options_-p
+-run_test ./su/02/env_special-options_-p_bash
+-run_test ./su/02/env_special-options_
+-run_test ./su/02/env_special-options__bash
+-run_test ./su/02/env_special_root-options_-l-p
+-run_test ./su/02/env_special_root-options_-l-p_bash
+-run_test ./su/02/env_special_root-options_-l
+-run_test ./su/02/env_special_root-options_-l_bash
+-run_test ./su/02/env_special_root-options_-p
+-run_test ./su/02/env_special_root-options_-p_bash
+-run_test ./su/02/env_special_root-options_
+-run_test ./su/02/env_special_root-options__bash
+-run_test ./su/03/su_run_command01.test
+-run_test ./su/03/su_run_command02.test
+-run_test ./su/03/su_run_command03.test
+-run_test ./su/03/su_run_command04.test
+-run_test ./su/03/su_run_command05.test
+-run_test ./su/03/su_run_command06.test
+-run_test ./su/03/su_run_command07.test
+-run_test ./su/03/su_run_command08.test
+-run_test ./su/03/su_run_command09.test
+-run_test ./su/03/su_run_command10.test
+-run_test ./su/03/su_run_command11.test
+-run_test ./su/03/su_run_command12.test
+-run_test ./su/03/su_run_command13.test
+-run_test ./su/03/su_run_command14.test
+-run_test ./su/03/su_run_command15.test
+-run_test ./su/03/su_run_command16.test
+-run_test ./su/03/su_run_command17.test
+-run_test ./su/04/su_wrong_user.test
+-run_test ./su/04/su_user_wrong_passwd.test
+-run_test ./su/04/su_user_wrong_passwd_syslog.test
+-run_test ./su/05/su_user_wrong_passwd_syslog.test
+-run_test ./su/06/su_user_syslog.test
+-run_test ./su/07/su_user_syslog.test
+-run_test ./su/08/env_special-options_
+-run_test ./su/08/env_special_root-options_
+-run_test ./su/09/env_special-options_
+-run_test ./su/09/env_special_root-options_
+-run_test ./su/10_su_sulog_success/su.test
+-run_test ./su/11_su_sulog_failure/su.test
+-run_test ./su/12_su_child_failure/su.test
+-run_test ./su/13_su_child_success/su.test
+ run_test ./libsubid/01_list_ranges/list_ranges.test
+ run_test ./libsubid/02_get_subid_owners/get_subid_owners.test
+ run_test ./libsubid/03_add_remove/add_remove_subids.test

debian/patches/series

@@ -1,23 +1,10 @@
-# CVE-2023-4641
-0001-gpasswd-1-Fix-password-leak.patch
-
-# CVE-2023-29383
-0002-Added-control-character-check.patch
-0003-Overhaul-valid_field.patch
-
-# These patches are only for the testsuite:
-#900_testsuite_groupmems
-#901_testsuite_gcov
-
-008_login_log_failure_in_FTMP
-401_cppw_src.dpatch
-# 402 should be merged in 401, but should be reviewed by SE Linux experts first
-402_cppw_selinux
-429_login_FAILLOG_ENAB
-463_login_delay_obeys_to_PAM
-501_commonio_group_shadow
-502_debian_useradd_defaults
-503_shadowconfig.8
-505_useradd_recommend_adduser
-506_relaxed_usernames
-542_useradd-O_option
+debian/Set-group-and-mode-for-g-shadow-files.patch
+debian/Keep-using-Debian-adduser-defaults.patch
+debian/Exclude-Debian-globally-allocated-UIDs-from-sys_uid-range.patch
+debian/Document-the-shadowconfig-utility.patch
+debian/Recommend-using-adduser-and-deluser.patch
+debian/tests-disable-su.patch
+debian/Adapt-login.defs-for-Debian.patch
+debian/Stop-building-programs-we-do-not-install.patch
+debian/Warn-when-badname-and-variants-are-given.patch
+debian/configure.ac-align-exec_prefix-with-prefix.patch

debian/rules

@@ -4,79 +4,61 @@
 # Enable PIE, BINDNOW, and possible future flags.
 export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 DPKG_EXPORT_BUILDFLAGS = 1
+include /usr/share/dpkg/architecture.mk
 include /usr/share/dpkg/buildflags.mk
+include /usr/share/debhelper/dh_package_notes/package-notes.mk
 
 # Adds extra options when calling the configure script:
-DEB_CONFIGURE_EXTRA_FLAGS := --without-libcrack \
+DEB_CONFIGURE_EXTRA_FLAGS := \
+	--bindir=/usr/bin \
+	--sbindir=/usr/sbin \
 	--mandir=/usr/share/man \
 	--with-libpam \
 	--with-yescrypt \
 	--enable-shadowgrp \
+	--enable-subordinate-ids \
+	--enable-lastlog=no \
 	--enable-man \
 	--disable-account-tools-setuid \
 	--with-group-name-max-length=32 \
-	--without-acl \
-	--without-attr \
+	--with-acl \
+	--with-attr \
 	--without-su \
 	--without-tcb \
-	 SHELL=/bin/sh
+
+
+ifeq ($(DEB_HOST_ARCH_OS),linux)
+DEB_CONFIGURE_EXTRA_FLAGS += --with-audit
+DEB_CONFIGURE_EXTRA_FLAGS += --with-btrfs
+else
+DEB_CONFIGURE_EXTRA_FLAGS += --disable-logind
+endif
 
 ifneq ($(filter nodoc,$(DEB_BUILD_PROFILES)),)
 DEB_CONFIGURE_EXTRA_FLAGS += --disable-man
 endif
 
+DEB_CONFIGURE_EXTRA_FLAGS += SHELL=/bin/sh
+
 # Set the default editor for vipw/vigr
 CFLAGS += -DDEFAULT_EDITOR="\"sensible-editor\""
 
 %:
 	dh $@
 
-override_dh_auto_configure:
-	cp debian/HOME_MODE.xml man/login.defs.d/HOME_MODE.xml
-	dh_auto_configure -- $(DEB_CONFIGURE_EXTRA_FLAGS)
+execute_after_dh_auto_clean:
+	# rebuild lib/getdate.c
+	rm -f lib/getdate.c
 
-override_dh_install-arch:
-ifneq ($(DEB_HOST_ARCH_OS),linux)
-	sed -i 's/session    optional   pam_keyinit.so/# Linux only # session    optional   pam_keyinit.so/' debian/login.pam
-endif
-	dh_install -a
-ifeq ($(DEB_HOST_ARCH_OS),hurd)
-	# /bin/login is provided by the hurd package.
-	rm -f debian/login/usr/bin/login
-endif
+override_dh_auto_configure:
+	dh_auto_configure -- $(DEB_CONFIGURE_EXTRA_FLAGS)
 
 override_dh_installpam:
 	# Distribute the pam.d files; unless for the commands with disabled PAM
 	# support
-	dh_installpam -p login
 	dh_installpam -p passwd --name=passwd
 	dh_installpam -p passwd --name=chfn
 	dh_installpam -p passwd --name=chsh
 	dh_installpam -p passwd --name=chpasswd
 	dh_installpam -p passwd --name=newusers
 
-override_dh_builddeb-arch:
-	# uidmap
-	chmod u+s debian/uidmap/usr/bin/newuidmap
-	chmod u+s debian/uidmap/usr/bin/newgidmap
-	# login
-	# No real need for login to be setuid root
-	# chmod u+s debian/login/bin/login
-	chmod u+s debian/login/usr/bin/newgrp
-	# passwd
-	chmod u+s debian/passwd/usr/bin/chfn
-	chmod u+s debian/passwd/usr/bin/chsh
-	chmod u+s debian/passwd/usr/bin/gpasswd
-	chmod u+s debian/passwd/usr/bin/passwd
-	chgrp shadow debian/passwd/usr/bin/chage
-	chgrp shadow debian/passwd/usr/bin/expiry
-	chmod g+s debian/passwd/usr/bin/chage
-	chmod g+s debian/passwd/usr/bin/expiry
-	dh_builddeb -a
-
-override_dh_auto_clean:
-	sed -i 's/# Linux only # //' debian/login.pam
-	dh_auto_clean
-
-override_dh_clean:
-	dh_clean ./man/login.defs.d/HOME_MODE.xml

debian/salsa-ci.yml

@@ -0,0 +1,40 @@
+---
+include: https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
+
+extract-source:
+  extends: .provisioning-extract-source
+
+variables:
+  RELEASE: 'unstable'
+
+build:
+  extends: .build-package
+
+test-build-any:
+  extends: .test-build-package-any
+
+test-build-all:
+  extends: .test-build-package-all
+
+lintian:
+  extends: .test-lintian
+
+autopkgtest:
+  extends: .test-autopkgtest
+
+blhc:
+  extends: .test-blhc
+
+reprotest:
+  extends: .test-reprotest
+
+variables:
+  SALSA_CI_ENABLE_BUILD_PACKAGE_PROFILES: 1
+
+test-build-profiles:
+  extends: .test-build-package-profiles
+  parallel:
+    matrix:
+      - BUILD_PROFILES: nocheck
+      - BUILD_PROFILES: nodoc
+

debian/shadowconfig

@@ -1,5 +1,5 @@
 #!/bin/sh
-# turn shadow passwords on or off on a Debian system
+# turn shadow passwords on on a Debian system
 
 set -e
 
@@ -36,16 +36,6 @@ shadowon () {
     chmod 640 "${DPKG_ROOT}/etc/shadow" "${DPKG_ROOT}/etc/gshadow"
 }
 
-shadowoff () {
-    set -e
-    pwck -q -r
-    grpck -r
-    pwunconv
-    grpunconv
-    # sometimes the passwd perms get munged
-    chown root:root /etc/passwd /etc/group
-    chmod 644 /etc/passwd /etc/group
-}
 
 case "$1" in
     "on")
@@ -57,14 +47,10 @@ case "$1" in
 	fi
 	;;
     "off")
-	if shadowoff ; then
-	    echo Shadow passwords are now off.
-	else
-	    echo Please correct the error and rerun \`$0 off\'
-	    exit 1
-	fi
+	echo E: Turning shadow passwords off is no longer supported.
+	exit 1
 	;;
      *)
-	echo Usage: $0 on \| off
+	echo Usage: $0 on
 	;;
 esac

debian/shlibs.local

@@ -0,0 +1 @@
+deb: libsubid 5 libsubid5 (= ${binary:Version})

debian/source/lintian-overrides

@@ -0,0 +1,6 @@
+# debputy does not need misc:Depends
+debhelper-but-no-misc-depends libsubid-dev
+debhelper-but-no-misc-depends libsubid5
+debhelper-but-no-misc-depends login.defs
+debhelper-but-no-misc-depends passwd
+debhelper-but-no-misc-depends uidmap

debian/tests/control

@@ -1,2 +1,19 @@
-Tests: smoke
-Restrictions: needs-root superficial
+Tests:
+ smoke,
+Restrictions:
+ needs-root,
+ superficial,
+
+Tests:
+ upstream,
+Depends:
+ expect,
+ procps,
+ @,
+ @builddeps@,
+Restrictions:
+ allow-stderr,
+ breaks-testbed,
+ build-needed,
+ isolation-machine,
+ needs-root,

debian/tests/smoke

@@ -2,12 +2,23 @@
 
 set -e
 
-echo "Adding an user works"
+echo "Adding a user works"
 useradd shadow-test-user
 grep '^shadow-test-user:x:' /etc/passwd
 grep '^shadow-test-user:!:' /etc/shadow
 
-echo "Removing an user works"
+# Regression test for #1096187. adduser uses this sequence.
+echo "Changing a users name and work phone number works"
+chfn "-f" "foo" "-r" "" shadow-test-user
+chfn -w "" shadow-test-user
+
+# Regression test for #1095430
+TZ=Asia/Tokyo usermod --expiredate 1970-01-02 shadow-test-user
+TZ=Asia/Tokyo LC_ALL=C chage -l shadow-test-user | grep 'Account expires'
+# We expect 1970-01-02, as passed.
+TZ=Asia/Tokyo LC_ALL=C chage -l shadow-test-user | grep -P '^Account expires.*Jan 02, 1970'
+
+echo "Removing a user works"
 userdel shadow-test-user
 ! grep 'shadow-test-user' /etc/passwd
 ! grep 'shadow-test-user' /etc/shadow

debian/tests/upstream

@@ -0,0 +1,15 @@
+#!/bin/sh
+useradd ubuntu
+
+export BUILD_BASE_DIR=$(pwd)
+
+cd tests
+
+cleanup() {
+  cp testsuite.log $AUTOPKGTEST_ARTIFACTS/
+  cat testsuite.log
+}
+
+trap cleanup TERM EXIT
+
+./run_some 2>&1