Update changelog for 1:4.17.3-1 release

Avoids upstream hacks in configure.

Gbp-Dch: full

Makefile.in

@@ -167,7 +167,7 @@ DIST_SUBDIRS = lib libsubid src po contrib doc etc tests/unit man
 am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/config.h.in \
 	$(top_srcdir)/man/po/Makefile.in ABOUT-NLS AUTHORS.md COPYING \
 	ChangeLog NEWS README compile config.guess config.rpath \
-	config.sub install-sh ltmain.sh missing ylwrap
+	config.sub install-sh ltmain.sh missing
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 distdir = $(PACKAGE)-$(VERSION)
 top_distdir = $(distdir)

config.h.in

@@ -20,10 +20,6 @@
 /* Path for faillog file. */
 #undef FAILLOG_FILE
 
-/* Define to the type of elements in the array set by `getgroups'. Usually
-   this is either `int' or `gid_t'. */
-#undef GETGROUPS_T
-
 /* max group name length */
 #undef GROUP_NAME_MAX_LENGTH
 
@@ -53,9 +49,6 @@
    the CoreFoundation framework. */
 #undef HAVE_CFPREFERENCESCOPYAPPVALUE
 
-/* Define to 1 if you have the <crypt.h> header file. */
-#undef HAVE_CRYPT_H
-
 /* Define if the GNU dcgettext() function is already present or preinstalled.
    */
 #undef HAVE_DCGETTEXT
@@ -119,24 +112,15 @@
 /* Define to 1 if you have the `getusershell' function. */
 #undef HAVE_GETUSERSHELL
 
-/* Define to 1 if you have the <gshadow.h> header file. */
-#undef HAVE_GSHADOW_H
-
 /* Define if you have the iconv() function and it works. */
 #undef HAVE_ICONV
 
-/* Define to 1 if you have the `initgroups' function. */
-#undef HAVE_INITGROUPS
-
 /* Define to 1 if you have the `innetgr' function. */
 #undef HAVE_INNETGR
 
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H
 
-/* Define to 1 if you have the <lastlog.h> header file. */
-#undef HAVE_LASTLOG_H
-
 /* Define to 1 if you have the `lckpwdf' function. */
 #undef HAVE_LCKPWDF
 
@@ -164,9 +148,6 @@
 /* Define to 1 if you have the <minix/config.h> header file. */
 #undef HAVE_MINIX_CONFIG_H
 
-/* Define to 1 if you have the <paths.h> header file. */
-#undef HAVE_PATHS_H
-
 /* Define to 1 if you have the `putgrent' function. */
 #undef HAVE_PUTGRENT
 
@@ -179,9 +160,6 @@
 /* Define to 1 if you have the <readpassphrase.h> header file. */
 #undef HAVE_READPASSPHRASE_H
 
-/* Define to 1 if you have the <rpc/key_prot.h> header file. */
-#undef HAVE_RPC_KEY_PROT_H
-
 /* Define to 1 if you have the `rpmatch' function. */
 #undef HAVE_RPMATCH
 
@@ -197,9 +175,6 @@
 /* Define to 1 if you have the <semanage/semanage.h> header file. */
 #undef HAVE_SEMANAGE_SEMANAGE_H
 
-/* Define to 1 if you have the `setgroups' function. */
-#undef HAVE_SETGROUPS
-
 /* Define to 1 if you have the `sgetgrent' function. */
 #undef HAVE_SGETGRENT
 
@@ -209,12 +184,6 @@
 /* Define to 1 if you have the `sgetspent' function. */
 #undef HAVE_SGETSPENT
 
-/* Define to 1 if you have the <sgtty.h> header file. */
-#undef HAVE_SGTTY_H
-
-/* Have working shadow group support in libc */
-#undef HAVE_SHADOWGRP
-
 /* Define if you have the shl_load function. */
 #undef HAVE_SHL_LOAD
 
@@ -260,15 +229,6 @@
 /* Define to 1 if `ut_xtime' is a member of `struct utmpx'. */
 #undef HAVE_STRUCT_UTMPX_UT_XTIME
 
-/* Define to 1 if you have the <sys/capability.h> header file. */
-#undef HAVE_SYS_CAPABILITY_H
-
-/* Define to 1 if you have the <sys/ioctl.h> header file. */
-#undef HAVE_SYS_IOCTL_H
-
-/* Define to 1 if you have the <sys/random.h> header file. */
-#undef HAVE_SYS_RANDOM_H
-
 /* Define to 1 if you have the <sys/statfs.h> header file. */
 #undef HAVE_SYS_STATFS_H
 
@@ -281,9 +241,6 @@
 /* Define to 1 if you have the <tcb.h> header file. */
 #undef HAVE_TCB_H
 
-/* Define to 1 if you have the <termio.h> header file. */
-#undef HAVE_TERMIO_H
-
 /* Define to 1 if you have the <unistd.h> header file. */
 #undef HAVE_UNISTD_H
 
@@ -296,9 +253,6 @@
 /* Define to 1 if `utime(file, NULL)' sets file's timestamp to the present. */
 #undef HAVE_UTIME_NULL
 
-/* Define to 1 if you have the <utmp.h> header file. */
-#undef HAVE_UTMP_H
-
 /* Define to support vendor settings. */
 #undef HAVE_VENDORDIR
 
@@ -517,9 +471,3 @@
 
 /* Path for wtmp file. */
 #undef _WTMP_FILE
-
-/* Define to `int' if <sys/types.h> doesn't define. */
-#undef gid_t
-
-/* Define to `int' if <sys/types.h> doesn't define. */
-#undef uid_t

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for shadow 4.17.0-rc1.
+# Generated by GNU Autoconf 2.71 for shadow 4.17.3.
 #
 # Report bugs to <pkg-shadow-devel@lists.alioth.debian.org>.
 #
@@ -621,8 +621,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='shadow'
 PACKAGE_TARNAME='shadow'
-PACKAGE_VERSION='4.17.0-rc1'
-PACKAGE_STRING='shadow 4.17.0-rc1'
+PACKAGE_VERSION='4.17.3'
+PACKAGE_STRING='shadow 4.17.3'
 PACKAGE_BUGREPORT='pkg-shadow-devel@lists.alioth.debian.org'
 PACKAGE_URL='https://github.com/shadow-maint/shadow'
 
@@ -671,6 +671,7 @@ INTLLIBS
 LTLIBICONV
 LIBICONV
 INTL_MACOSX_LIBS
+CPP
 XGETTEXT_EXTRA_OPTIONS
 MSGMERGE
 XGETTEXT_015
@@ -744,7 +745,6 @@ USE_SHA_CRYPT_FALSE
 USE_SHA_CRYPT_TRUE
 GROUP_NAME_MAX_LENGTH
 LIBOBJS
-CPP
 LIBADD_DL
 LT_DLPREOPEN
 LIBADD_DLD_LINK
@@ -932,14 +932,14 @@ CPPFLAGS
 YACC
 YFLAGS
 LT_SYS_LIBRARY_PATH
-CPP
 PKG_CONFIG
 PKG_CONFIG_PATH
 PKG_CONFIG_LIBDIR
 CMOCKA_CFLAGS
 CMOCKA_LIBS
 LIBBSD_CFLAGS
-LIBBSD_LIBS'
+LIBBSD_LIBS
+CPP'
 
 
 # Initialize some variables set by options.
@@ -1488,7 +1488,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures shadow 4.17.0-rc1 to adapt to many kinds of systems.
+\`configure' configures shadow 4.17.3 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1559,7 +1559,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of shadow 4.17.0-rc1:";;
+     short | recursive ) echo "Configuration of shadow 4.17.3:";;
    esac
   cat <<\_ACEOF
 
@@ -1657,7 +1657,6 @@ Some influential environment variables:
               default value of `-d' given by some make applications.
   LT_SYS_LIBRARY_PATH
               User-defined run-time library search path.
-  CPP         C preprocessor
   PKG_CONFIG  path to pkg-config utility
   PKG_CONFIG_PATH
               directories to add to pkg-config's search path
@@ -1669,6 +1668,7 @@ Some influential environment variables:
   LIBBSD_CFLAGS
               C compiler flags for LIBBSD, overriding pkg-config
   LIBBSD_LIBS linker flags for LIBBSD, overriding pkg-config
+  CPP         C preprocessor
 
 Use these variables to override the choices made by `configure' or to help
 it to find libraries and programs with nonstandard names/locations.
@@ -1738,7 +1738,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-shadow configure 4.17.0-rc1
+shadow configure 4.17.3
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2045,44 +2045,6 @@ printf "%s\n" "$ac_res" >&6; }
 
 } # ac_fn_c_check_member
 
-# ac_fn_c_try_cpp LINENO
-# ----------------------
-# Try to preprocess conftest.$ac_ext, and return whether this succeeded.
-ac_fn_c_try_cpp ()
-{
-  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  if { { ac_try="$ac_cpp conftest.$ac_ext"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-printf "%s\n" "$ac_try_echo"; } >&5
-  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err
-  ac_status=$?
-  if test -s conftest.err; then
-    grep -v '^ *+' conftest.err >conftest.er1
-    cat conftest.er1 >&5
-    mv -f conftest.er1 conftest.err
-  fi
-  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; } > conftest.i && {
-	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       }
-then :
-  ac_retval=0
-else $as_nop
-  printf "%s\n" "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-    ac_retval=1
-fi
-  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-  as_fn_set_status $ac_retval
-
-} # ac_fn_c_try_cpp
-
 # ac_fn_c_try_run LINENO
 # ----------------------
 # Try to run conftest.$ac_ext, and return whether this succeeded. Assumes that
@@ -2314,6 +2276,44 @@ rm -f conftest.val
   as_fn_set_status $ac_retval
 
 } # ac_fn_c_compute_int
+
+# ac_fn_c_try_cpp LINENO
+# ----------------------
+# Try to preprocess conftest.$ac_ext, and return whether this succeeded.
+ac_fn_c_try_cpp ()
+{
+  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+  if { { ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+printf "%s\n" "$ac_try_echo"; } >&5
+  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err
+  ac_status=$?
+  if test -s conftest.err; then
+    grep -v '^ *+' conftest.err >conftest.er1
+    cat conftest.er1 >&5
+    mv -f conftest.er1 conftest.err
+  fi
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; } > conftest.i && {
+	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       }
+then :
+  ac_retval=0
+else $as_nop
+  printf "%s\n" "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+    ac_retval=1
+fi
+  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+  as_fn_set_status $ac_retval
+
+} # ac_fn_c_try_cpp
 ac_configure_args_raw=
 for ac_arg
 do
@@ -2338,7 +2338,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by shadow $as_me 4.17.0-rc1, which was
+It was created by shadow $as_me 4.17.3, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -3611,7 +3611,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='shadow'
- VERSION='4.17.0-rc1'
+ VERSION='4.17.3'
 
 
 printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -14700,92 +14700,6 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
 
-ac_fn_c_check_header_compile "$LINENO" "crypt.h" "ac_cv_header_crypt_h" "$ac_includes_default"
-if test "x$ac_cv_header_crypt_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_CRYPT_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "utmp.h" "ac_cv_header_utmp_h" "$ac_includes_default"
-if test "x$ac_cv_header_utmp_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_UTMP_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "termio.h" "ac_cv_header_termio_h" "$ac_includes_default"
-if test "x$ac_cv_header_termio_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_TERMIO_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "sgtty.h" "ac_cv_header_sgtty_h" "$ac_includes_default"
-if test "x$ac_cv_header_sgtty_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_SGTTY_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "sys/ioctl.h" "ac_cv_header_sys_ioctl_h" "$ac_includes_default"
-if test "x$ac_cv_header_sys_ioctl_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_SYS_IOCTL_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "paths.h" "ac_cv_header_paths_h" "$ac_includes_default"
-if test "x$ac_cv_header_paths_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_PATHS_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "sys/capability.h" "ac_cv_header_sys_capability_h" "$ac_includes_default"
-if test "x$ac_cv_header_sys_capability_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_SYS_CAPABILITY_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "sys/random.h" "ac_cv_header_sys_random_h" "$ac_includes_default"
-if test "x$ac_cv_header_sys_random_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_SYS_RANDOM_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "gshadow.h" "ac_cv_header_gshadow_h" "$ac_includes_default"
-if test "x$ac_cv_header_gshadow_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_GSHADOW_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "lastlog.h" "ac_cv_header_lastlog_h" "$ac_includes_default"
-if test "x$ac_cv_header_lastlog_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_LASTLOG_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "rpc/key_prot.h" "ac_cv_header_rpc_key_prot_h" "$ac_includes_default"
-if test "x$ac_cv_header_rpc_key_prot_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_RPC_KEY_PROT_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "acl/libacl.h" "ac_cv_header_acl_libacl_h" "$ac_includes_default"
-if test "x$ac_cv_header_acl_libacl_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_ACL_LIBACL_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "attr/libattr.h" "ac_cv_header_attr_libattr_h" "$ac_includes_default"
-if test "x$ac_cv_header_attr_libattr_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_ATTR_LIBATTR_H 1" >>confdefs.h
-
-fi
-ac_fn_c_check_header_compile "$LINENO" "attr/error_context.h" "ac_cv_header_attr_error_context_h" "$ac_includes_default"
-if test "x$ac_cv_header_attr_error_context_h" = xyes
-then :
-  printf "%s\n" "#define HAVE_ATTR_ERROR_CONTEXT_H 1" >>confdefs.h
-
-fi
-
-
 ac_fn_c_check_header_compile "$LINENO" "shadow.h" "ac_cv_header_shadow_h" "$ac_includes_default"
 if test "x$ac_cv_header_shadow_h" = xyes
 then :
@@ -14830,12 +14744,6 @@ if test "x$ac_cv_func_getusershell" = xyes
 then :
   printf "%s\n" "#define HAVE_GETUSERSHELL 1" >>confdefs.h
 
-fi
-ac_fn_c_check_func "$LINENO" "initgroups" "ac_cv_func_initgroups"
-if test "x$ac_cv_func_initgroups" = xyes
-then :
-  printf "%s\n" "#define HAVE_INITGROUPS 1" >>confdefs.h
-
 fi
 ac_fn_c_check_func "$LINENO" "lckpwdf" "ac_cv_func_lckpwdf"
 if test "x$ac_cv_func_lckpwdf" = xyes
@@ -14848,12 +14756,6 @@ if test "x$ac_cv_func_lutimes" = xyes
 then :
   printf "%s\n" "#define HAVE_LUTIMES 1" >>confdefs.h
 
-fi
-ac_fn_c_check_func "$LINENO" "setgroups" "ac_cv_func_setgroups"
-if test "x$ac_cv_func_setgroups" = xyes
-then :
-  printf "%s\n" "#define HAVE_SETGROUPS 1" >>confdefs.h
-
 fi
 ac_fn_c_check_func "$LINENO" "updwtmpx" "ac_cv_func_updwtmpx"
 if test "x$ac_cv_func_updwtmpx" = xyes
@@ -15175,240 +15077,6 @@ printf "%s\n" "#define HAVE_STRUCT_UTMPX_UT_XTIME 1" >>confdefs.h
 fi
 
 
-ac_ext=c
-ac_cpp='$CPP $CPPFLAGS'
-ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
-ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
-ac_compiler_gnu=$ac_cv_c_compiler_gnu
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5
-printf %s "checking how to run the C preprocessor... " >&6; }
-# On Suns, sometimes $CPP names a directory.
-if test -n "$CPP" && test -d "$CPP"; then
-  CPP=
-fi
-if test -z "$CPP"; then
-  if test ${ac_cv_prog_CPP+y}
-then :
-  printf %s "(cached) " >&6
-else $as_nop
-      # Double quotes because $CC needs to be expanded
-    for CPP in "$CC -E" "$CC -E -traditional-cpp" cpp /lib/cpp
-    do
-      ac_preproc_ok=false
-for ac_c_preproc_warn_flag in '' yes
-do
-  # Use a header file that comes with gcc, so configuring glibc
-  # with a fresh cross-compiler works.
-  # On the NeXT, cc -E runs the code through the compiler's parser,
-  # not just through cpp. "Syntax error" is here to catch this case.
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <limits.h>
-		     Syntax error
-_ACEOF
-if ac_fn_c_try_cpp "$LINENO"
-then :
-
-else $as_nop
-  # Broken: fails on valid input.
-continue
-fi
-rm -f conftest.err conftest.i conftest.$ac_ext
-
-  # OK, works on sane cases.  Now check whether nonexistent headers
-  # can be detected and how.
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <ac_nonexistent.h>
-_ACEOF
-if ac_fn_c_try_cpp "$LINENO"
-then :
-  # Broken: success on invalid input.
-continue
-else $as_nop
-  # Passes both tests.
-ac_preproc_ok=:
-break
-fi
-rm -f conftest.err conftest.i conftest.$ac_ext
-
-done
-# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
-rm -f conftest.i conftest.err conftest.$ac_ext
-if $ac_preproc_ok
-then :
-  break
-fi
-
-    done
-    ac_cv_prog_CPP=$CPP
-
-fi
-  CPP=$ac_cv_prog_CPP
-else
-  ac_cv_prog_CPP=$CPP
-fi
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5
-printf "%s\n" "$CPP" >&6; }
-ac_preproc_ok=false
-for ac_c_preproc_warn_flag in '' yes
-do
-  # Use a header file that comes with gcc, so configuring glibc
-  # with a fresh cross-compiler works.
-  # On the NeXT, cc -E runs the code through the compiler's parser,
-  # not just through cpp. "Syntax error" is here to catch this case.
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <limits.h>
-		     Syntax error
-_ACEOF
-if ac_fn_c_try_cpp "$LINENO"
-then :
-
-else $as_nop
-  # Broken: fails on valid input.
-continue
-fi
-rm -f conftest.err conftest.i conftest.$ac_ext
-
-  # OK, works on sane cases.  Now check whether nonexistent headers
-  # can be detected and how.
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <ac_nonexistent.h>
-_ACEOF
-if ac_fn_c_try_cpp "$LINENO"
-then :
-  # Broken: success on invalid input.
-continue
-else $as_nop
-  # Passes both tests.
-ac_preproc_ok=:
-break
-fi
-rm -f conftest.err conftest.i conftest.$ac_ext
-
-done
-# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
-rm -f conftest.i conftest.err conftest.$ac_ext
-if $ac_preproc_ok
-then :
-
-else $as_nop
-  { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error $? "C preprocessor \"$CPP\" fails sanity check
-See \`config.log' for more details" "$LINENO" 5; }
-fi
-
-ac_ext=c
-ac_cpp='$CPP $CPPFLAGS'
-ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
-ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
-ac_compiler_gnu=$ac_cv_c_compiler_gnu
-
-
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for uid_t in sys/types.h" >&5
-printf %s "checking for uid_t in sys/types.h... " >&6; }
-if test ${ac_cv_type_uid_t+y}
-then :
-  printf %s "(cached) " >&6
-else $as_nop
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <sys/types.h>
-
-_ACEOF
-if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
-  $EGREP "uid_t" >/dev/null 2>&1
-then :
-  ac_cv_type_uid_t=yes
-else $as_nop
-  ac_cv_type_uid_t=no
-fi
-rm -rf conftest*
-
-fi
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uid_t" >&5
-printf "%s\n" "$ac_cv_type_uid_t" >&6; }
-if test $ac_cv_type_uid_t = no; then
-
-printf "%s\n" "#define uid_t int" >>confdefs.h
-
-
-printf "%s\n" "#define gid_t int" >>confdefs.h
-
-fi
-
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking type of array argument to getgroups" >&5
-printf %s "checking type of array argument to getgroups... " >&6; }
-if test ${ac_cv_type_getgroups+y}
-then :
-  printf %s "(cached) " >&6
-else $as_nop
-  if test "$cross_compiling" = yes
-then :
-  ac_cv_type_getgroups=cross
-else $as_nop
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-/* Thanks to Mike Rendell for this test.  */
-$ac_includes_default
-#define NGID 256
-#undef MAX
-#define MAX(x, y) ((x) > (y) ? (x) : (y))
-
-int
-main (void)
-{
-  gid_t gidset[NGID];
-  int i, n;
-  union { gid_t gval; long int lval; }  val;
-
-  val.lval = -1;
-  for (i = 0; i < NGID; i++)
-    gidset[i] = val.gval;
-  n = getgroups (sizeof (gidset) / MAX (sizeof (int), sizeof (gid_t)) - 1,
-		 gidset);
-  /* Exit non-zero if getgroups seems to require an array of ints.  This
-     happens when gid_t is short int but getgroups modifies an array
-     of ints.  */
-  return n > 0 && gidset[n] != val.gval;
-}
-_ACEOF
-if ac_fn_c_try_run "$LINENO"
-then :
-  ac_cv_type_getgroups=gid_t
-else $as_nop
-  ac_cv_type_getgroups=int
-fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-  conftest.$ac_objext conftest.beam conftest.$ac_ext
-fi
-
-if test $ac_cv_type_getgroups = cross; then
-        cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <unistd.h>
-
-_ACEOF
-if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
-  $EGREP "getgroups.*int.*gid_t" >/dev/null 2>&1
-then :
-  ac_cv_type_getgroups=gid_t
-else $as_nop
-  ac_cv_type_getgroups=int
-fi
-rm -rf conftest*
-
-fi
-fi
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_getgroups" >&5
-printf "%s\n" "$ac_cv_type_getgroups" >&6; }
-
-printf "%s\n" "#define GETGROUPS_T $ac_cv_type_getgroups" >>confdefs.h
-
-
 
 
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether utime accepts a null argument" >&5
@@ -15559,56 +15227,6 @@ printf "%s\n" "#define HAS_SECURE_GETENV 1" >>confdefs.h
 fi
 
 
-if test "$ac_cv_header_shadow_h" = "yes"; then
-	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for working shadow group support" >&5
-printf %s "checking for working shadow group support... " >&6; }
-if test ${ac_cv_libc_shadowgrp+y}
-then :
-  printf %s "(cached) " >&6
-else $as_nop
-  if test "$cross_compiling" = yes
-then :
-  ac_cv_libc_shadowgrp=no
-
-else $as_nop
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-				#include <shadow.h>
-				#ifdef HAVE_GSHADOW_H
-				#include <gshadow.h>
-				#endif
-				int
-				main()
-				{
-					struct sgrp *sg = sgetsgent("test:x::");
-					/* NYS libc on Red Hat 3.0.3 has broken shadow group support */
-					return !sg || !sg->sg_adm || !sg->sg_mem;
-				}
-
-_ACEOF
-if ac_fn_c_try_run "$LINENO"
-then :
-  ac_cv_libc_shadowgrp=yes
-else $as_nop
-  ac_cv_libc_shadowgrp=no
-fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-  conftest.$ac_objext conftest.beam conftest.$ac_ext
-fi
-
-
-fi
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_libc_shadowgrp" >&5
-printf "%s\n" "$ac_cv_libc_shadowgrp" >&6; }
-
-	if test "$ac_cv_libc_shadowgrp" = "yes"; then
-
-printf "%s\n" "#define HAVE_SHADOWGRP 1" >>confdefs.h
-
-	fi
-fi
-
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking location of shared mail directory" >&5
 printf %s "checking location of shared mail directory... " >&6; }
 if test ${shadow_cv_maildir+y}
@@ -18612,6 +18230,139 @@ else $as_nop
 fi
 
 
+ac_ext=c
+ac_cpp='$CPP $CPPFLAGS'
+ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5
+printf %s "checking how to run the C preprocessor... " >&6; }
+# On Suns, sometimes $CPP names a directory.
+if test -n "$CPP" && test -d "$CPP"; then
+  CPP=
+fi
+if test -z "$CPP"; then
+  if test ${ac_cv_prog_CPP+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+      # Double quotes because $CC needs to be expanded
+    for CPP in "$CC -E" "$CC -E -traditional-cpp" cpp /lib/cpp
+    do
+      ac_preproc_ok=false
+for ac_c_preproc_warn_flag in '' yes
+do
+  # Use a header file that comes with gcc, so configuring glibc
+  # with a fresh cross-compiler works.
+  # On the NeXT, cc -E runs the code through the compiler's parser,
+  # not just through cpp. "Syntax error" is here to catch this case.
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <limits.h>
+		     Syntax error
+_ACEOF
+if ac_fn_c_try_cpp "$LINENO"
+then :
+
+else $as_nop
+  # Broken: fails on valid input.
+continue
+fi
+rm -f conftest.err conftest.i conftest.$ac_ext
+
+  # OK, works on sane cases.  Now check whether nonexistent headers
+  # can be detected and how.
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <ac_nonexistent.h>
+_ACEOF
+if ac_fn_c_try_cpp "$LINENO"
+then :
+  # Broken: success on invalid input.
+continue
+else $as_nop
+  # Passes both tests.
+ac_preproc_ok=:
+break
+fi
+rm -f conftest.err conftest.i conftest.$ac_ext
+
+done
+# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
+rm -f conftest.i conftest.err conftest.$ac_ext
+if $ac_preproc_ok
+then :
+  break
+fi
+
+    done
+    ac_cv_prog_CPP=$CPP
+
+fi
+  CPP=$ac_cv_prog_CPP
+else
+  ac_cv_prog_CPP=$CPP
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5
+printf "%s\n" "$CPP" >&6; }
+ac_preproc_ok=false
+for ac_c_preproc_warn_flag in '' yes
+do
+  # Use a header file that comes with gcc, so configuring glibc
+  # with a fresh cross-compiler works.
+  # On the NeXT, cc -E runs the code through the compiler's parser,
+  # not just through cpp. "Syntax error" is here to catch this case.
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <limits.h>
+		     Syntax error
+_ACEOF
+if ac_fn_c_try_cpp "$LINENO"
+then :
+
+else $as_nop
+  # Broken: fails on valid input.
+continue
+fi
+rm -f conftest.err conftest.i conftest.$ac_ext
+
+  # OK, works on sane cases.  Now check whether nonexistent headers
+  # can be detected and how.
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <ac_nonexistent.h>
+_ACEOF
+if ac_fn_c_try_cpp "$LINENO"
+then :
+  # Broken: success on invalid input.
+continue
+else $as_nop
+  # Passes both tests.
+ac_preproc_ok=:
+break
+fi
+rm -f conftest.err conftest.i conftest.$ac_ext
+
+done
+# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
+rm -f conftest.i conftest.err conftest.$ac_ext
+if $ac_preproc_ok
+then :
+
+else $as_nop
+  { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "C preprocessor \"$CPP\" fails sanity check
+See \`config.log' for more details" "$LINENO" 5; }
+fi
+
+ac_ext=c
+ac_cpp='$CPP $CPPFLAGS'
+ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+
+
 
 
   acl_libdirstem=lib
@@ -20846,7 +20597,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by shadow $as_me 4.17.0-rc1, which was
+This file was extended by shadow $as_me 4.17.3, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -20915,7 +20666,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-shadow config.status 4.17.0-rc1
+shadow config.status 4.17.3
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 

configure.ac

@@ -4,7 +4,7 @@ m4_define([libsubid_abi_major], 5)
 m4_define([libsubid_abi_minor], 0)
 m4_define([libsubid_abi_micro], 0)
 m4_define([libsubid_abi], [libsubid_abi_major.libsubid_abi_minor.libsubid_abi_micro])
-AC_INIT([shadow], [4.17.0-rc1], [pkg-shadow-devel@lists.alioth.debian.org], [],
+AC_INIT([shadow], [4.17.3], [pkg-shadow-devel@lists.alioth.debian.org], [],
 	[https://github.com/shadow-maint/shadow])
 AM_INIT_AUTOMAKE([1.11 foreign dist-xz subdir-objects tar-pax])
 AC_CONFIG_MACRO_DIRS([m4])
@@ -36,20 +36,13 @@ LT_LIB_DLLOAD
 
 dnl Checks for libraries.
 
-dnl Checks for header files.
-AC_CHECK_HEADERS(crypt.h utmp.h \
-	termio.h sgtty.h sys/ioctl.h paths.h \
-	sys/capability.h sys/random.h \
-	gshadow.h lastlog.h rpc/key_prot.h acl/libacl.h \
-	attr/libattr.h attr/error_context.h)
-
 dnl shadow now uses the libc's shadow implementation
 AC_CHECK_HEADER([shadow.h],,[AC_MSG_ERROR([You need a libc with shadow.h])])
 
 AC_CHECK_FUNCS(arc4random_buf futimes \
 	getentropy getrandom getspnam getusershell \
-	initgroups lckpwdf lutimes \
-	setgroups updwtmpx innetgr \
+	lckpwdf lutimes \
+	updwtmpx innetgr \
 	getspnam_r \
 	rpmatch \
 	memset_explicit explicit_bzero stpecpy stpeprintf)
@@ -66,7 +59,6 @@ AC_CHECK_MEMBERS([struct utmpx.ut_name,
                   struct utmpx.ut_xtime],,,[[#include <utmpx.h>]])
 
 dnl Checks for library functions.
-AC_TYPE_GETGROUPS
 AC_FUNC_UTIME_NULL
 AC_REPLACE_FUNCS(putgrent putpwent putspent)
 AC_REPLACE_FUNCS(sgetgrent sgetpwent sgetspent)
@@ -76,33 +68,6 @@ AC_CHECK_FUNC(secure_getenv, [AC_DEFINE(HAS_SECURE_GETENV,
                                         1,
                                         [Defined to 1 if you have the declaration of 'secure_getenv'])])
 
-if test "$ac_cv_header_shadow_h" = "yes"; then
-	AC_CACHE_CHECK(for working shadow group support,
-		ac_cv_libc_shadowgrp,
-		AC_RUN_IFELSE([AC_LANG_SOURCE([
-				#include <shadow.h>
-				#ifdef HAVE_GSHADOW_H
-				#include <gshadow.h>
-				#endif
-				int
-				main()
-				{
-					struct sgrp *sg = sgetsgent("test:x::");
-					/* NYS libc on Red Hat 3.0.3 has broken shadow group support */
-					return !sg || !sg->sg_adm || !sg->sg_mem;
-				}]
-			)],
-			[ac_cv_libc_shadowgrp=yes],
-			[ac_cv_libc_shadowgrp=no],
-			[ac_cv_libc_shadowgrp=no]
-		)
-	)
-
-	if test "$ac_cv_libc_shadowgrp" = "yes"; then
-		AC_DEFINE(HAVE_SHADOWGRP, 1, [Have working shadow group support in libc])
-	fi
-fi
-
 AC_CACHE_CHECK([location of shared mail directory], shadow_cv_maildir,
 [for shadow_cv_maildir in /var/mail /var/spool/mail /usr/spool/mail /usr/mail none; do
 	if test -d $shadow_cv_maildir; then

debian/NEWS

@@ -0,0 +1,78 @@
+shadow (1:4.17.0~rc1-1) unstable; urgency=medium
+
+  Username checking now once again follows the upstream rules, for
+  an ecosystem-wide ruleset and security.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sun, 22 Dec 2024 20:12:35 +0100
+
+shadow (1:4.16.0-5) unstable; urgency=medium
+
+  /var/log/faillog and the programs to read it are no longer part since
+  1:4.15.2-2.
+  The file isn't cleaned up automatically, which should be done manually,
+  unless it is still needed for special reasons.
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Sat, 16 Nov 2024 15:48:35 +0100
+
+shadow (1:4.13+dfsg1-2) unstable; urgency=medium
+
+  The previous entry falsely states that PREVENT_NO_AUTH in /etc/login.defs
+  affects authentication.  The historical default of letting all users with
+  empty password field in without authentication is still in effect.
+
+ -- Balint Reczey <balint@balintreczey.hu>  Mon, 25 Sep 2023 17:04:09 +0200
+
+shadow (1:4.11.1+dfsg1-0exp1) experimental; urgency=medium
+
+  Login now prevents an empty password field to be interpreted as
+  "no authentication required" for UID 0 (root account).
+  The historical default of letting all users with empty password field
+  in without authentication can be restored in /etc/login.defs setting
+  PREVENT_NO_AUTH to "no".
+
+ -- Balint Reczey <balint@balintreczey.hu>  Sun, 07 Nov 2021 21:51:46 +0100
+
+shadow (1:4.7-1) unstable; urgency=medium
+
+  * /etc/securetty is no longer shipped by this package and it is no longer
+    honored in login's PAM configuration by default. Please see #731656 for the
+    details.
+
+ -- Balint Reczey <rbalint@ubuntu.com>  Thu, 20 Jun 2019 13:46:52 +0200
+
+shadow (1:4.0.15-5) unstable; urgency=low
+
+  * commands passed in argument to su must use su's -c option and must quote
+    the command if it contains a space, as in:
+        su - root -c "ls -l /"
+    The following commands won't work anymore:
+        su - root -c ls -l /
+        su - root "ls -l /"
+        su - root ls -l /
+
+ -- Christian Perrier <bubulle@debian.org>  Sat,  8 Apr 2006 20:11:38 +0200
+
+shadow (1:4.0.14-1) unstable; urgency=low
+
+  * passwd does not support the -f, -s, and -g options anymore. You should use
+    the chfn, chsh and gpasswd utilities instead.
+  * login now distributes the nologin utility, which can be used as a shell
+    to politely refuse a login
+
+ -- Christian Perrier <bubulle@debian.org>  Thu,  5 Jan 2006 08:47:44 +0100
+
+shadow (1:4.0.12-1) unstable; urgency=low
+
+  CLOSE_SESSIONS and other variables are not used anymore in
+  /etc/login/defs.
+  As shadow utilities which use this file now warn about unknown
+  entries there, administrators should remove such unknown entries.
+  The supplied login.defs file does not include them anymore.
+
+  dpasswd is no more distributed by upstream. Login do not support
+  dialup password anymore.  Re-introducing this functionality in
+  upstream is not trivial.
+
+
+ -- Christian Perrier <bubulle@debian.org>  Thu, 25 Aug 2005 08:38:47 +0200
+

debian/README.Debian

@@ -0,0 +1,63 @@
+Read this file first for a brief overview of the current version
+of passwd.
+
+
+---Shadow passwords
+
+The command `shadowconfig on' will turn on shadow password support.
+This is the default. Turning off shadow passwords is not supported
+anymore.
+Together with shadow passwords, you get the ability to set password ages
+and expirations with chage(1).
+
+NOTE: If you use the nscd package, you may have problems with a
+slight delay in updating the password information. You may notice
+this during upgrades of certain packages that try to add a system
+user and then access the users information immediately afterwards.
+To avoid this, it is suggested that you stop the nscd daemon before
+upgrades, then restart it again.
+
+---General configuration
+
+Most of the configuration for the shadow utilities is in
+/etc/login.defs.  See login.defs(5).  The defaults are quite
+reasonable.
+
+Also see the /etc/pam.d/* files for each program to configure the PAM
+support. PAM documentation is available in several formats in the
+libpam-doc package.
+
+
+---Encryption
+
+This is enabled now using the /etc/pam.d/* files. Examples are given.
+
+
+---Adding users and groups
+
+Though you may add users and groups with the SysV type commands,
+useradd and groupadd, I recommend you add them with Debian adduser
+version 3+.  adduser gives you more configuration and conforms to the
+Debian UID and GID allocation.
+
+Editing user and group parameters can be done with usermod and
+groupmod.  Removing users and groups can be done with userdel and
+groupdel.
+
+
+--- Group administration
+
+Local group allocation is much easier.  With gpasswd(1) you can
+designate users to administer groups.  They can then securely add or
+remove users from the group.
+
+
+--- What to read next?
+
+Read the manpages, the other files in this directory, and the Shadow
+Password HOWTO (included in the doc-linux package).  A large portion
+of these files deals with getting shadow installed.  You can, of
+course, ignore those parts.
+
+Also, the libpam-doc package will go a long way to allowing you to take
+full advantage of the PAM authentication scheme.

debian/README.source

@@ -0,0 +1,8 @@
+If you update the translation of upsteam files (thank you for that!) please
+submit a pull request upstream instead of filing a bug in the Debian BTS
+to get it reviewed and accepted faster.
+
+A testsuite is also available. Instruction on how to run this testsuite
+are available in tests/README
+
+ -- Balint Reczey <balint@balintreczey.hu>, Mon, 31 Jan 2022 14:07:11 +0100

debian/TODO

@@ -0,0 +1,19 @@
+Things that should be done:
+ * Verify the files left in debian/tmp
+   + e.g. /etc/default/adduser should be installed
+ * Check the build system: rebuilding the package twoce in the same tree
+   doubles the size of the diff.gz file
+
+Other points (not related to the release of a syncronized shadow):
+ * compare the source with the usages and man pages
+   + probably add a sentence to chsh/chfn's manpages about authentication
+     required for ordinary users
+ * do something (a tool) for the variables in login.defs
+   In Debian, some tools are not compiled with the PAM support, so upstream
+   getdef.c won't be OK.
+   It should be nice to see in each man page the set of variables used.
+   The Debian package can now compile (export DEB_BUILD_OPTIONS='nostrip debug')
+   with the debugging informations. This may be used to extract the set of
+   variables used in Debian/for each tools.
+ * verify all the patches around (I've found patches for at least RedHat,
+   OWL, LFS, Mandriva, Gentoo; are they already applied?)

debian/bugs-usertags

@@ -0,0 +1,25 @@
+This described the usertags used by the team.
+
+For usertags documentation, see
+http://lists.debian.org/debian-devel-announce/2005/09/msg00002.html
+
+All bugs tagged by team members must be tagged with 
+"user pkg-shadow-devel@lists.alioth.debian.org"
+
+Tags list
+---------
+
+toclose:         This bug has been announced to be closed in case no more news
+                 or information is received from the bug submitter or someone
+                 else until the delay specified in the limits_YYYYMMDD tag
+
+limits-YYYYMMDD: combine it with "toclose". Specifies the date after which
+                 bugs can be closed without other action in case no news 
+                 is received
+
+manpages-replace A bug reported angainst a manpages-xx package to indicate
+                 conflicting man pages. This tag can be used to tune the
+                 Replaces fields.
+
+su-transition:   This bug is related to the su transition (#276419)
+

debian/control

@@ -0,0 +1,91 @@
+Source: shadow
+Maintainer: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
+Uploaders:
+ Serge Hallyn <serge@hallyn.com>,
+ Chris Hofstaedtler <zeha@debian.org>
+Section: admin
+Priority: required
+Build-Depends:
+ bison,
+ debhelper-compat (= 13),
+ dh-package-notes,
+ dh-sequence-zz-debputy-rrr (>= 0.1.23~),
+ docbook-xml <!nodoc>,
+ docbook-xsl <!nodoc>,
+ gettext,
+ itstool <!nodoc>,
+ libacl1-dev,
+ libattr1-dev,
+ libaudit-dev [linux-any],
+ libbsd-dev,
+ libcrypt-dev,
+ libltdl-dev,
+ libpam0g-dev,
+ libselinux1-dev [linux-any],
+ libsemanage-dev [linux-any],
+ libxml2-utils <!nodoc>,
+ pkgconf,
+ systemd-dev [linux-any],
+ xsltproc <!nodoc>
+Standards-Version: 4.7.0
+Vcs-Git: https://salsa.debian.org/debian/shadow.git -b master
+Vcs-Browser: https://salsa.debian.org/debian/shadow
+Homepage: https://github.com/shadow-maint/shadow
+Rules-Requires-Root: no
+
+Package: passwd
+Architecture: any
+Multi-Arch: foreign
+Depends:
+ base-passwd (>= 3.6.4),
+ libpam-modules,
+ login.defs
+Recommends:
+ sensible-utils
+Replaces:
+ login (<< 1:4.16.0-2~)
+Description: change and administer password and group data
+ This package includes passwd, chsh, chfn, and many other programs to
+ maintain password and group data.
+ .
+ Shadow passwords are supported.  See /usr/share/doc/passwd/README.Debian
+
+Package: login.defs
+Architecture: all
+Multi-Arch: foreign
+Replaces:
+ login (<< 1:4.16.0-2~)
+Description: system user management configuration
+ This package provides the login.defs configuration file,
+ used by otherwise unrelated tools managing system users.
+
+Package: uidmap
+Architecture: any
+Multi-Arch: foreign
+Priority: optional
+Description: programs to help use subuids
+ These programs help unprivileged users to create uid and gid mappings in
+ user namespaces.
+
+Package: libsubid5
+Section: libs
+Priority: optional
+Architecture: any
+Multi-Arch: same
+Description: subordinate id handling library -- shared library
+ The library provides an interface for querying, granding and ungranting
+ subordinate user and group ids.
+
+Package: libsubid-dev
+Section: libdevel
+Priority: optional
+Architecture: any
+Multi-Arch: same
+Depends:
+ libsubid5 (= ${binary:Version})
+Description: subordinate id handling library -- shared library
+ The library provides an interface for querying, granding and ungranting
+ subordinate user and group ids.
+ .
+ This package contains the C header files that are
+ needed for applications to use the libsubid library.

debian/copyright

@@ -0,0 +1,185 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: Shadow
+Source: https://github.com/shadow-maint/shadow
+
+Files: *
+Copyright: 1989-1994, Julianne Frances Haugh
+           2016-2024, Serge Hallyn <serge@hallyn.com>
+License: BSD-3-clause
+
+Files: man/po/da.po
+       man/po/de.po
+       man/tr/man1/su.1
+       po/da.po
+       po/de.po
+       po/es.po
+       po/eu.po
+       po/fi.po
+       po/gl.po
+       po/it.po
+       po/kk.po
+       po/nb.po
+       po/nl.po
+       po/nn.po
+       po/pl.po
+       po/pt_BR.po
+       po/ru.po
+       po/sq.po
+       po/sv.po
+       po/vi.po
+Copyright: 1999-2015, Free Software Foundation, Inc
+License: BSD-3-clause
+
+Files: man/fi/man1/chfn.1
+       man/id/man1/*
+       man/ko/man1/chfn.1
+       man/ko/man1/chsh.1
+       man/tr/man1/chfn.1
+       man/zh_TW/man1/chfn.1
+       man/zh_TW/man1/chsh.1
+Copyright: 1994, salvatore valente <svalente@athena.mit.edu>
+License: GPL-1
+
+Files: man/pt_BR/man8/*
+       man/zh_TW/man8/usermod.8
+Copyright: 1991-1994, Julianne Frances Haugh
+License: BSD-3-clause
+
+Files: man/hu/man1/gpasswd.1
+       man/ja/man1/gpasswd.1
+       man/pt_BR/man1/*
+Copyright: 1996, Rafal Maszkowski <rzm@pdi.net>
+License: BSD-3-clause
+
+Files: man/id/man1/login.1
+       man/ko/man1/login.1
+       man/tr/man1/login.1
+Copyright: 1993, Rickard E. Faith <faith@cs.unc.edu>
+License: BSD-3-clause
+
+Files: man/ja/man5/limits.5
+       man/ja/man8/vipw.8
+Copyright: 2001, Maki KURODA
+License: BSD-3-clause
+
+Files: man/pt_BR/man5/passwd.5
+       man/tr/man5/passwd.5
+Copyright: 1993, Michael Haardt <michael@moria.de>
+License: GPL-2+
+
+Files: man/ja/man1/chage.1
+       man/ja/man5/suauth.5
+Copyright: 1997, Kazuyoshi Furutaka
+License: BSD-3-clause
+
+Files: man/po/fr.po
+       po/fr.po
+Copyright: 2011-2013, Debian French l10n team <debian-l10n-french@lists.debian.org>
+License: BSD-3-clause
+
+Files: man/shadowconfig.8
+Copyright: 2025 Alejandro Colomar <alx@kernel.org>
+License: BSD-3-clause
+
+Files: man/zh_TW/man5/*
+Copyright: 1993, Michael Haardt <michael@moria.de>
+           1993, Scorpio, www.linuxforum.net
+License: GPL-2+
+
+Files: man/hu/man5/*
+Copyright: 1993, Michael Haardt <u31b3hs@pool.informatik.rwth-aachen.de>
+License: GPL-2+
+
+Files: contrib/adduser2.sh
+Copyright: 1996, Petri Mattila, Prihateam Networks <petri@prihateam.fi>
+License: GPL-2+
+
+Files: lib/subordinateio.h
+Copyright: 2012, Eric W. Biederman
+License: BSD-3-clause
+
+Files: man/hu/man1/su.1
+Copyright: 1999, Ragnar Hojland Espinosa <ragnar@macula.net>
+License: BSD-3-clause
+
+Files: man/ja/man8/pwconv.8
+Copyright: 2001, Yuichi SATO
+License: BSD-3-clause
+
+Files: src/login_nopam.c
+Copyright: 1995, Wietse Venema
+License: BSD-3-clause
+
+Files: src/su.c
+Copyright: 1989 - 1994, Julianne Frances Haugh
+           1996 - 2000, Marek Michałkiewicz
+           2000 - 2006, Tomasz Kłoczko
+           2007 - 2013, Nicolas François
+License: GPL-2+
+
+Files: src/vipw.c
+Copyright: 1997, Guy Maor <maor@ece.utexas.edu>
+           1999 - 2000, Marek Michałkiewicz
+           2002 - 2006, Tomasz Kłoczko
+           2007 - 2013, Nicolas François
+License: GPL-2+
+
+Files: man/ko/man5/*
+Copyright: 2000, ASPLINUX <man@asp-linux.co.kr>
+License: GPL-2+
+
+Files: debian/*
+Copyright: 1999-2001, Ben Collins <bcollins@debian.org>
+           2001-2004 Karl Ramm <kcr@debian.org>
+           2004-2014 Christian Perrier <bubulle@debian.org>
+           2006-2012 Nicolas Francois (Nekral) <nicolas.francois@centraliens.net>
+           2017-2022 Balint Reczey <balint@balintreczey.hu>
+License: BSD-3-clause
+
+Files: debian/passwd.expire.cron
+Copyright: 1999, Ben Collins <bcollins@debian.org>
+License: BSD-3-clause
+
+License: BSD-3-clause
+ All rights reserved.
+ .
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+ 1. Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+ 2. Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+ 3. Neither the name of the University nor the names of its contributors
+    may be used to endorse or promote products derived from this software
+    without specific prior written permission.
+ .
+ THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ SUCH DAMAGE.
+
+License: GPL-1
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 1
+ .
+ On Debian systems, the complete text of version 1 of the GNU General
+ Public License can be found in '/usr/share/common-licenses/GPL-1'.
+
+License: GPL-2+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 2 dated June, 1991, or (at
+ your option) any later version.
+ .
+ On Debian systems, the complete text of version 2 of the GNU General
+ Public License can be found in '/usr/share/common-licenses/GPL-2'.

debian/debputy.manifest

@@ -0,0 +1,24 @@
+manifest-version: '0.1'
+packages:
+  passwd:
+    transformations:
+    - path-metadata:
+        paths:
+        - usr/bin/chfn
+        - usr/bin/chsh
+        - usr/bin/gpasswd
+        - usr/bin/passwd
+        mode: "u=rwxs,go=rx"
+    - path-metadata:
+        paths:
+        - usr/bin/chage
+        - usr/bin/expiry
+        group: "shadow"
+        mode: "u=rwx,go=rxs"
+  uidmap:
+    transformations:
+    - path-metadata:
+        paths:
+        - usr/bin/newgidmap
+        - usr/bin/newuidmap
+        mode: "u=rwxs,go=rx"

debian/default/useradd

@@ -0,0 +1,37 @@
+# Default values for useradd(8)
+#
+# The SHELL variable specifies the default login shell on your
+# system.
+# Similar to DSHELL in adduser. However, we use "sh" here because
+# useradd is a low level utility and should be as general
+# as possible
+SHELL=/bin/sh
+#
+# The default group for users
+# 100=users on Debian systems
+# Same as USERS_GID in adduser
+# This argument is used when the -n flag is specified.
+# The default behavior (when -n and -g are not specified) is to create a
+# primary user group with the same name as the user being added to the
+# system.
+# GROUP=100
+#
+# The default home directory. Same as DHOME for adduser
+# HOME=/home
+#
+# The number of days after a password expires until the account 
+# is permanently disabled
+# INACTIVE=-1
+#
+# The default expire date
+# EXPIRE=
+#
+# The SKEL variable specifies the directory containing "skeletal" user
+# files; in other words, files such as a sample .profile that will be
+# copied to the new user's home directory when it is created.
+# SKEL=/etc/skel
+#
+# Defines whether the mail spool should be created while
+# creating the account
+# CREATE_MAIL_SPOOL=no
+

debian/dependencies

@@ -0,0 +1,16 @@
+Build-Depends:
+==============
+ * gettext
+   POT, PO, GMO regenerated?
+ * xsltproc
+   used to generate the manpages
+ * docbook-xsl
+   needed for /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl
+ * docbook-xml
+   manpages/docbook.xsl includes html/docbook.xsl
+   (But it is not strictly needed. The generated manpages are identical.
+   Without it, a warning is generated.)
+   Needed by JH_CHECK_XML_CATALOG([-//OASIS//DTD DocBook XML V4.1.2//EN], [DocBook XML DTD V4.1.2], [], enable_man=no)
+ * libxml2-utils
+   needed by the JH_CHECK_XML_CATALOG macros
+

debian/gbp.conf

@@ -0,0 +1,2 @@
+[pq]
+patch-numbers = False

debian/gitlab-ci.yml

@@ -0,0 +1,7 @@
+variables:
+  RELEASE: 'unstable'
+  # workaround for https://salsa.debian.org/salsa-ci-team/pipeline/-/issues/259
+  SALSA_CI_REPROTEST_ARGS: --vary=domain_host.use_sudo=1
+include:
+ - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
+ - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml

debian/libsubid-dev.install

@@ -0,0 +1,3 @@
+usr/include/*
+usr/lib/*/libsubid.a
+usr/lib/*/libsubid.so

debian/libsubid5.install

@@ -0,0 +1 @@
+usr/lib/*/libsubid.so.*

debian/libsubid5.symbols

@@ -0,0 +1,11 @@
+libsubid.so.5 libsubid5 #MINVER#
+ subid_free@Base 1:4.16.0
+ subid_get_gid_owners@Base 1:4.16.0
+ subid_get_gid_ranges@Base 1:4.16.0
+ subid_get_uid_owners@Base 1:4.16.0
+ subid_get_uid_ranges@Base 1:4.16.0
+ subid_grant_gid_range@Base 1:4.16.0
+ subid_grant_uid_range@Base 1:4.16.0
+ subid_init@Base 1:4.16.0
+ subid_ungrant_gid_range@Base 1:4.16.0
+ subid_ungrant_uid_range@Base 1:4.16.0

debian/login.defs.install

@@ -0,0 +1 @@
+etc/login.defs etc

debian/login.defs.manpages

@@ -0,0 +1,2 @@
+usr/share/man/*/man5/login.defs.5
+usr/share/man/man5/login.defs.5

debian/login.defs.postinst

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -e
+
+_adopt_conffile() {
+    conffile=$1
+    pkg=$2
+
+    [ -f ${conffile}.dpkg-bak ] || return 0
+
+    md5sum="$(md5sum ${conffile} | sed -e 's/ .*//')"
+    old_md5sum="$(dpkg-query -W -f='${Conffiles}' $pkg | \
+                        sed -n -e "\' ${conffile} ' { s/ obsolete$//; s/.* //; p }")"
+    # On new installs, if the conffile was preserved on upgrade by
+    # dpkg-maintscript helper, copy it back if the new file has not been
+    # modified yet
+    if [ "$md5sum" = "$old_md5sum" ]; then
+        mv ${conffile}.dpkg-bak ${conffile}
+    fi
+}
+
+if [ "$1" = configure ] && [ -z "$2" ]; then
+    _adopt_conffile /etc/login.defs login.defs
+fi
+
+#DEBHELPER#

debian/not-installed

@@ -0,0 +1,54 @@
+bin/groups
+bin/login
+# Workaround debhelper complaining about login.defs, although we install it.
+etc/login.defs
+etc/pam.d/chfn
+etc/pam.d/chage
+etc/pam.d/chpasswd
+etc/pam.d/chsh
+etc/pam.d/groupadd
+etc/pam.d/groupdel
+etc/pam.d/groupmems
+etc/pam.d/groupmod
+etc/pam.d/login
+etc/pam.d/newusers
+etc/pam.d/passwd
+etc/pam.d/useradd
+etc/pam.d/userdel
+etc/pam.d/usermod
+sbin/nologin
+usr/bin/newgrp
+usr/bin/faillog
+usr/bin/sg
+usr/lib/*/libsubid.la
+usr/sbin/groupmems
+usr/sbin/logoutd
+usr/sbin/vigr
+usr/share/man/*/man1/groups.1
+usr/share/man/*/man1/login.1
+usr/share/man/*/man1/logoutd.1
+usr/share/man/*/man1/newgrp.1
+usr/share/man/*/man1/sg.1
+usr/share/man/*/man1/su.1
+usr/share/man/*/man3/getspnam.3
+usr/share/man/*/man3/shadow.3
+usr/share/man/*/man5/faillog.5
+usr/share/man/*/man5/suauth.5
+usr/share/man/*/man8/faillog.8
+usr/share/man/*/man8/groupmems.8
+usr/share/man/*/man8/logoutd.8
+usr/share/man/*/man8/nologin.8
+usr/share/man/man1/groups.1
+usr/share/man/man1/login.1
+usr/share/man/man1/logoutd.1
+usr/share/man/man1/newgrp.1
+usr/share/man/man1/sg.1
+usr/share/man/man1/su.1
+usr/share/man/man3/getspnam.3
+usr/share/man/man3/shadow.3
+usr/share/man/man5/faillog.5
+usr/share/man/man5/suauth.5
+usr/share/man/man8/faillog.8
+usr/share/man/man8/groupmems.8
+usr/share/man/man8/logoutd.8
+usr/share/man/man8/nologin.8

debian/passwd.chage.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'chage' service
+#
+
+# This allows root to change password aging being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/passwd.chfn.pam

@@ -0,0 +1,16 @@
+#
+# The PAM configuration file for the Shadow `chfn' service
+#
+
+# This allows root to change user infomation without being
+# prompted for a password
+auth		sufficient	pam_rootok.so
+
+# The standard Unix authentication modules, used with
+# NIS (man nsswitch) as well as normal /etc/passwd and
+# /etc/shadow entries.
+@include common-auth
+@include common-account
+@include common-session
+
+

debian/passwd.chpasswd.pam

@@ -0,0 +1,5 @@
+# The PAM configuration file for the Shadow 'chpasswd' service
+#
+
+@include common-password
+

debian/passwd.chsh.pam

@@ -0,0 +1,20 @@
+#
+# The PAM configuration file for the Shadow `chsh' service
+#
+
+# This will not allow a user to change their shell unless
+# their current one is listed in /etc/shells. This keeps
+# accounts with special shells from changing them.
+auth       required   pam_shells.so
+
+# This allows root to change user shell without being
+# prompted for a password
+auth		sufficient	pam_rootok.so
+
+# The standard Unix authentication modules, used with
+# NIS (man nsswitch) as well as normal /etc/passwd and
+# /etc/shadow entries.
+@include common-auth
+@include common-account
+@include common-session
+

debian/passwd.dirs

@@ -0,0 +1,2 @@
+etc/default
+usr/share/lintian/overrides

debian/passwd.examples

@@ -0,0 +1 @@
+debian/passwd.expire.cron

debian/passwd.expire.cron

@@ -0,0 +1,57 @@
+#!/usr/bin/perl
+#
+# passwd.expire.cron: sample expiry notification script for use as a cronjob
+#
+# Copyright 1999 by Ben Collins <bcollins@debian.org>, complete rights granted
+# for use, distribution, modification, etc.
+#
+# Usage:
+#	edit the listed options, including the actual email, then rename to
+#	/etc/cron.daily/passwd
+#
+#	If your users don't have a valid login shell (ie. they are ftp or mail
+#	users only), they will need some other way to change their password
+#	(telnet will work since login will handle password aging, or a poppasswd
+#	program, if they are mail users).
+
+# <CONFIG> #
+
+# should be same as /etc/adduser.conf
+$LOW_UID=1000;
+$HIGH_UID=29999;
+
+# this let's the MTA handle the domain,
+# set it manually if you want. Make sure
+# you also add the @ like "\@domain.com"
+$MAIL_DOM="";
+
+# </CONFIG> #
+
+# Set the current day reference
+$curdays = int(time() / (60 * 60 * 24));
+
+# Now go through the list
+
+open(SH, "< /etc/shadow");
+while (<SH>) {
+    @shent = split(':', $_);
+    @userent = getpwnam($shent[0]);
+    if ($userent[2] >= $LOW_UID && $userent[2] <= $HIGH_UID) {
+	if ($curdays > $shent[2] + $shent[4] - $shent[5] &&
+		$shent[4] != -1 && $shent[4] != 0 &&
+		$shent[5] != -1 && $shent[5] != 0) {
+	    $daysleft = ($shent[2] + $shent[4]) - $curdays;
+	    if ($daysleft == 1) { $days = "day"; } else {$days = "days"; }
+            if ($daysleft < 0) { next; }
+	    open (MAIL, "| mail -s '[WARNING] account will expire in $daysleft $days' $shent[0]${MAIL_DOM}");
+	    print MAIL <<EOF;
+Your account will expire in $daysleft $days. Please change your password before
+then or your account will expire
+EOF
+	    close (MAIL);
+	    # This makes sure we also get a list of almost expired users
+	    print "$shent[0]'s account will expire in $daysleft days\n";
+	}
+    }
+    @userent = getpwent();
+}

debian/passwd.groupadd.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'groupadd' service
+#
+
+# This allows root to add groups without being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/passwd.groupdel.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'groupdel' service
+#
+
+# This allows root to remove groups without being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/passwd.groupmod.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'groupmod' service
+#
+
+# This allows root to modify groups without being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/passwd.install

@@ -0,0 +1,25 @@
+debian/default/useradd etc/default
+debian/shadowconfig usr/sbin
+usr/bin/chage
+usr/bin/chfn
+usr/bin/chsh
+usr/bin/expiry
+usr/bin/gpasswd
+usr/bin/passwd
+usr/sbin/chgpasswd
+usr/sbin/chpasswd
+usr/sbin/groupadd
+usr/sbin/groupdel
+usr/sbin/groupmod
+usr/sbin/grpck
+usr/sbin/grpconv
+usr/sbin/grpunconv
+usr/sbin/newusers
+usr/sbin/pwck
+usr/sbin/pwconv
+usr/sbin/pwunconv
+usr/sbin/useradd
+usr/sbin/userdel
+usr/sbin/usermod
+usr/sbin/vipw
+usr/share/locale/*/LC_MESSAGES/shadow.mo

debian/passwd.links

@@ -0,0 +1 @@
+usr/sbin/vipw usr/sbin/vigr

debian/passwd.lintian-overrides

@@ -0,0 +1,6 @@
+passwd: elevated-privileges 2755 root/shadow [usr/bin/chage]
+passwd: elevated-privileges 4755 root/root [usr/bin/chfn]
+passwd: elevated-privileges 4755 root/root [usr/bin/chsh]
+passwd: elevated-privileges 2755 root/shadow [usr/bin/expiry]
+passwd: elevated-privileges 4755 root/root [usr/bin/gpasswd]
+passwd: elevated-privileges 4755 root/root [usr/bin/passwd]

debian/passwd.maintscript

@@ -0,0 +1 @@
+rm_conffile /etc/cron.daily/passwd 1:4.7-2~

debian/passwd.manpages

@@ -0,0 +1,57 @@
+usr/share/man/*/man1/chage.1
+usr/share/man/*/man1/chfn.1
+usr/share/man/*/man1/chsh.1
+usr/share/man/*/man1/expiry.1
+usr/share/man/*/man1/gpasswd.1
+usr/share/man/*/man1/passwd.1
+usr/share/man/*/man5/gshadow.5
+usr/share/man/*/man5/passwd.5
+usr/share/man/*/man5/shadow.5
+usr/share/man/*/man5/subgid.5
+usr/share/man/*/man5/subuid.5
+usr/share/man/*/man8/chgpasswd.8
+usr/share/man/*/man8/chpasswd.8
+usr/share/man/*/man8/groupadd.8
+usr/share/man/*/man8/groupdel.8
+usr/share/man/*/man8/groupmod.8
+usr/share/man/*/man8/grpck.8
+usr/share/man/*/man8/grpconv.8
+usr/share/man/*/man8/grpunconv.8
+usr/share/man/*/man8/newusers.8
+usr/share/man/*/man8/pwck.8
+usr/share/man/*/man8/pwconv.8
+usr/share/man/*/man8/pwunconv.8
+usr/share/man/*/man8/useradd.8
+usr/share/man/*/man8/userdel.8
+usr/share/man/*/man8/usermod.8
+usr/share/man/*/man8/vigr.8
+usr/share/man/*/man8/vipw.8
+usr/share/man/man1/chage.1
+usr/share/man/man1/chfn.1
+usr/share/man/man1/chsh.1
+usr/share/man/man1/expiry.1
+usr/share/man/man1/gpasswd.1
+usr/share/man/man1/passwd.1
+usr/share/man/man5/gshadow.5
+usr/share/man/man5/passwd.5
+usr/share/man/man5/shadow.5
+usr/share/man/man5/subgid.5
+usr/share/man/man5/subuid.5
+usr/share/man/man8/chgpasswd.8
+usr/share/man/man8/chpasswd.8
+usr/share/man/man8/groupadd.8
+usr/share/man/man8/groupdel.8
+usr/share/man/man8/groupmod.8
+usr/share/man/man8/grpck.8
+usr/share/man/man8/grpconv.8
+usr/share/man/man8/grpunconv.8
+usr/share/man/man8/newusers.8
+usr/share/man/man8/pwck.8
+usr/share/man/man8/pwconv.8
+usr/share/man/man8/pwunconv.8
+usr/share/man/man8/shadowconfig.8
+usr/share/man/man8/useradd.8
+usr/share/man/man8/userdel.8
+usr/share/man/man8/usermod.8
+usr/share/man/man8/vigr.8
+usr/share/man/man8/vipw.8

debian/passwd.newusers.pam

@@ -0,0 +1,5 @@
+# The PAM configuration file for the Shadow 'newusers' service
+#
+
+@include common-password
+

debian/passwd.passwd.pam

@@ -0,0 +1,6 @@
+#
+# The PAM configuration file for the Shadow `passwd' service
+#
+
+@include common-password
+

debian/passwd.postinst

@@ -0,0 +1,30 @@
+#!/bin/sh
+
+set -e
+
+case "$1" in
+configure)
+	if ! getent group shadow | grep -q '^shadow:[^:]*:42'
+	then
+		groupadd -g 42 shadow || (
+    			cat <<EOF
+Group ID 42 has been allocated for the shadow group.  You have either
+used 42 yourself or created a shadow group with a different ID.
+Please correct this problem and reconfigure with ``dpkg --configure passwd''.
+
+Note that both user and group IDs in the range 0-99 are globally
+allocated by the Debian project and must be the same on every Debian
+system.
+EOF
+    			exit 1
+		)
+	fi
+    ;;
+esac
+
+# Run shadowconfig only on new installs
+[ -z "$2" ] && shadowconfig on
+
+#DEBHELPER#
+
+exit 0

debian/passwd.tmpfiles

@@ -0,0 +1,8 @@
+# If a password operation is in progress and we lose power, stale lockfiles
+# can be left behind.  Clear them on boot.
+r! /etc/gshadow.lock
+r! /etc/shadow.lock
+r! /etc/passwd.lock
+r! /etc/group.lock
+r! /etc/subuid.lock
+r! /etc/subgid.lock

debian/passwd.useradd.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'useradd' service
+#
+
+# This allows root to add users without being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/passwd.userdel.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'userdel' service
+#
+
+# This allows root to remove users without being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/passwd.usermod.pam

@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'groupdel' service
+#
+
+# This allows root to remove groups without being prompted for a password
+auth		sufficient	pam_rootok.so
+
+# checks for account validity
+account	required	pam_permit.so

debian/patches/debian/Adapt-login.defs-for-Debian.patch

@@ -0,0 +1,517 @@
+From: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
+Date: Sun, 7 Jul 2024 14:06:39 +0200
+Subject: Adapt login.defs for Debian
+
+Remove settings only applicable to shadow's su, which we do not use.
+Remove settings only applicable without PAM support enabled.
+Remove obscure commented-out settings.
+Remove explanation about write(1), which Debian does not ship anymore.
+---
+ etc/login.defs | 375 ++++++++-------------------------------------------------
+ 1 file changed, 47 insertions(+), 328 deletions(-)
+
+diff --git a/etc/login.defs b/etc/login.defs
+index 33622c2..91d3ec4 100644
+--- a/etc/login.defs
++++ b/etc/login.defs
+@@ -1,24 +1,38 @@
+ #
+ # /etc/login.defs - Configuration control definitions for the shadow package.
+ #
+-#	$Id$
+-#
+ 
+-#
+-# Delay in seconds before being allowed another attempt after a login failure
+-# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
+-#       pam_unix(8) enforces a 2s delay)
+-#
+-FAIL_DELAY		3
+-
+-#
+-# Enable logging and display of /var/log/faillog login(1) failure info.
+-#
+-FAILLOG_ENAB		yes
++# REQUIRED for useradd/userdel/usermod
++#   Directory where mailboxes reside, _or_ name of file, relative to the
++#   home directory.  If you _do_ define MAIL_DIR and MAIL_FILE,
++#   MAIL_DIR takes precedence.
++#
++#   Essentially:
++#      - MAIL_DIR defines the location of users mail spool files
++#        (for mbox use) by appending the username to MAIL_DIR as defined
++#        below.
++#      - MAIL_FILE defines the location of the users mail spool files as the
++#        fully-qualified filename obtained by prepending the user home
++#        directory before $MAIL_FILE
++#
++# NOTE: This is no more used for setting up users MAIL environment variable
++#       which is, starting from shadow 4.0.12-1 in Debian, entirely the
++#       job of the pam_mail PAM modules
++#       See default PAM configuration files provided for
++#       login, su, etc.
++#
++# This is a temporary situation: setting these variables will soon
++# move to /etc/default/useradd and the variables will then be
++# no more supported
++MAIL_DIR        /var/mail
++#MAIL_FILE      .mail
+ 
+ #
+ # Enable display of unknown usernames when login(1) failures are recorded.
+ #
++# WARNING: Unknown usernames may become world readable.
++# See #290803 and #298773 for details about how this could become a security
++# concern
+ LOG_UNKFAIL_ENAB	no
+ 
+ #
+@@ -26,110 +40,12 @@ LOG_UNKFAIL_ENAB	no
+ #
+ LOG_OK_LOGINS		no
+ 
+-#
+-# Enable logging and display of /var/log/lastlog login(1) time info.
+-#
+-LASTLOG_ENAB		yes
+-
+-#
+-# Limit the highest user ID number for which the lastlog entries should
+-# be updated.
+-#
+-# No LASTLOG_UID_MAX means that there is no user ID limit for writing
+-# lastlog entries.
+-#
+-#LASTLOG_UID_MAX
+-
+-#
+-# Enable checking and display of mailbox status upon login.
+-#
+-# Disable if the shell startup files already check for mail
+-# ("mailx -e" or equivalent).
+-#
+-MAIL_CHECK_ENAB		yes
+-
+-#
+-# Enable additional checks upon password changes.
+-#
+-OBSCURE_CHECKS_ENAB	yes
+-
+-#
+-# Enable checking of time restrictions specified in /etc/porttime.
+-#
+-PORTTIME_CHECKS_ENAB	yes
+-
+-#
+-# Enable setting of ulimit, umask, and niceness from passwd(5) gecos field.
+-#
+-QUOTAS_ENAB		yes
+-
+-#
+-# Enable "syslog" logging of su(1) activity - in addition to sulog file logging.
+-# SYSLOG_SG_ENAB does the same for newgrp(1) and sg(1).
+-#
+-SYSLOG_SU_ENAB		yes
+-SYSLOG_SG_ENAB		yes
+-
+-#
+-# If defined, either full pathname of a file containing device names or
+-# a ":" delimited list of device names.  Root logins will be allowed only
+-# from these devices.
+-#
+-CONSOLE		/etc/securetty
+-#CONSOLE	console:tty01:tty02:tty03:tty04
+-
+-#
+-# If defined, all su(1) activity is logged to this file.
+-#
+-#SULOG_FILE	/var/log/sulog
+-
+-#
+-# If defined, ":" delimited list of "message of the day" files to
+-# be displayed upon login.
+-#
+-MOTD_FILE	/etc/motd
+-#MOTD_FILE	/etc/motd:/usr/lib/news/news-motd
+-
+-#
+-# If defined, this file will be output before each login(1) prompt.
+-#
+-#ISSUE_FILE	/etc/issue
+-
+ #
+ # If defined, file which maps tty line to TERM environment parameter.
+ # Each line of the file is in a format similar to "vt100  tty01".
+ #
+ #TTYTYPE_FILE	/etc/ttytype
+ 
+-#
+-# If defined, login(1) failures will be logged here in a utmp format.
+-# last(1), when invoked as lastb(1), will read /var/log/btmp, so...
+-#
+-FTMP_FILE	/var/log/btmp
+-
+-#
+-# If defined, name of file whose presence will inhibit non-root
+-# logins.  The content of this file should be a message indicating
+-# why logins are inhibited.
+-#
+-NOLOGINS_FILE	/etc/nologin
+-
+-#
+-# If defined, the command name to display when running "su -".  For
+-# example, if this is defined as "su" then ps(1) will display the
+-# command as "-su".  If not defined, then ps(1) will display the
+-# name of the shell actually being run, e.g. something like "-sh".
+-#
+-SU_NAME		su
+-
+-#
+-# *REQUIRED*
+-#   Directory where mailboxes reside, _or_ name of file, relative to the
+-#   home directory.  If you _do_ define both, MAIL_DIR takes precedence.
+-#
+-MAIL_DIR	/var/spool/mail
+-#MAIL_FILE	.mail
+-
+ #
+ # If defined, file which inhibits all the usual chatter during the login
+ # sequence.  If a full pathname, then hushed mode will be enabled if the
+@@ -139,40 +55,21 @@ MAIL_DIR	/var/spool/mail
+ HUSHLOGIN_FILE	.hushlogin
+ #HUSHLOGIN_FILE	/etc/hushlogins
+ 
+-#
+-# If defined, either a TZ environment parameter spec or the
+-# fully-rooted pathname of a file containing such a spec.
+-#
+-#ENV_TZ		TZ=CST6CDT
+-#ENV_TZ		/etc/tzname
+-
+-#
+-# If defined, an HZ environment parameter spec.
+-#
+-# for Linux/x86
+-ENV_HZ		HZ=100
+-# For Linux/Alpha...
+-#ENV_HZ		HZ=1024
+-
+ #
+ # *REQUIRED*  The default PATH settings, for superuser and normal users.
+ #
+ # (they are minimal, add the rest in the shell startup files)
+-ENV_SUPATH	PATH=/sbin:/bin:/usr/sbin:/usr/bin
+-ENV_PATH	PATH=/bin:/usr/bin
++ENV_SUPATH	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
++ENV_PATH	PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
+ 
+ #
+-# Terminal permissions
++# Terminal permissions for terminals after login(1).
++# These settings are ignored for remote and other logins.
+ #
+ #	TTYGROUP	Login tty will be assigned this group ownership.
+ #	TTYPERM		Login tty will be set to this permission.
+ #
+-# If you have a write(1) program which is "setgid" to a special group
+-# which owns the terminals, define TTYGROUP as the number of such group
+-# and TTYPERM as 0620.  Otherwise leave TTYGROUP commented out and
+-# set TTYPERM to either 622 or 600.
+-#
+-TTYGROUP	tty
++#TTYGROUP	tty
+ TTYPERM		0600
+ 
+ #
+@@ -180,61 +77,35 @@ TTYPERM		0600
+ #
+ #	ERASECHAR	Terminal ERASE character ('\010' = backspace).
+ #	KILLCHAR	Terminal KILL character ('\025' = CTRL/U).
+-#	ULIMIT		Default "ulimit" value.
+ #
+ # The ERASECHAR and KILLCHAR are used only on System V machines.
+-# The ULIMIT is used only if the system supports it.
+-# (now it works with setrlimit too; ulimit is in 512-byte units)
+-#
+-# Prefix these values with "0" to get octal, "0x" to get hexadecimal.
+ #
+ ERASECHAR	0177
+ KILLCHAR	025
+-#ULIMIT		2097152
+-
+-# Default initial "umask" value used by login(1) on non-PAM enabled systems.
+-# Default "umask" value for pam_umask(8) on PAM enabled systems.
+-# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
+-# home directories if HOME_MODE is not set.
+-# 022 is the default value, but 027, or even 077, could be considered
+-# for increased privacy. There is no One True Answer here: each sysadmin
+-# must make up their mind.
+-UMASK		022
+ 
+ # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
+ # home directories.
+-# If HOME_MODE is not set, the value of UMASK is used to create the mode.
+-#HOME_MODE	0700
++HOME_MODE	0700
+ 
+ #
+ # Password aging controls:
+ #
+ #	PASS_MAX_DAYS	Maximum number of days a password may be used.
+ #	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
+-#	PASS_MIN_LEN	Minimum acceptable password length.
+ #	PASS_WARN_AGE	Number of days warning given before a password expires.
+ #
+ PASS_MAX_DAYS	99999
+ PASS_MIN_DAYS	0
+-PASS_MIN_LEN	5
+ PASS_WARN_AGE	7
+ 
+-#
+-# If "yes", the user must be listed as a member of the first gid 0 group
+-# in /etc/group (called "root" on most Linux systems) to be able to "su"
+-# to uid 0 accounts.  If the group doesn't exist or is empty, no one
+-# will be able to "su" to uid 0.
+-#
+-SU_WHEEL_ONLY	no
+-
+ #
+ # Min/max values for automatic uid selection in useradd(8)
+ #
+ UID_MIN			 1000
+ UID_MAX			60000
+ # System accounts
+-SYS_UID_MIN		  101
+-SYS_UID_MAX		  999
++#SYS_UID_MIN		  101
++#SYS_UID_MAX		  999
+ # Extra per user uids
+ SUB_UID_MIN		   100000
+ SUB_UID_MAX		600100000
+@@ -246,8 +117,8 @@ SUB_UID_COUNT		    65536
+ GID_MIN			 1000
+ GID_MAX			60000
+ # System accounts
+-SYS_GID_MIN		  101
+-SYS_GID_MAX		  999
++#SYS_GID_MIN		  101
++#SYS_GID_MAX		  999
+ # Extra per user group ids
+ SUB_GID_MIN		   100000
+ SUB_GID_MAX		600100000
+@@ -255,6 +126,9 @@ SUB_GID_COUNT		    65536
+ 
+ #
+ # Max number of login(1) retries if password is bad
++# This will most likely be overriden by PAM, since the default pam_unix module
++# has it's own built in of 3 retries. However, this is a safe fallback in case
++# you are using an authentication module that does not enforce PAM_MAXTRIES.
+ #
+ LOGIN_RETRIES		5
+ 
+@@ -263,28 +137,6 @@ LOGIN_RETRIES		5
+ #
+ LOGIN_TIMEOUT		60
+ 
+-#
+-# Maximum number of attempts to change password if rejected (too easy)
+-#
+-PASS_CHANGE_TRIES	5
+-
+-#
+-# Warn about weak passwords (but still allow them) if you are root.
+-#
+-PASS_ALWAYS_WARN	yes
+-
+-#
+-# Number of significant characters in the password for crypt().
+-# Default is 8, don't change unless your crypt() is better.
+-# Ignored if MD5_CRYPT_ENAB set to "yes".
+-#
+-#PASS_MAX_LEN		8
+-
+-#
+-# Require password before chfn(1)/chsh(1) can make any changes.
+-#
+-CHFN_AUTH		yes
+-
+ #
+ # Which fields may be changed by regular users using chfn(1) - use
+ # any combination of letters "frwh" (full name, room number, work
+@@ -294,29 +146,6 @@ CHFN_AUTH		yes
+ CHFN_RESTRICT		rwh
+ 
+ #
+-# Password prompt (%s will be replaced by user name).
+-#
+-# XXX - it doesn't work correctly yet, for now leave it commented out
+-# to use the default which is just "Password: ".
+-#LOGIN_STRING		"%s's Password: "
+-
+-#
+-# Only works if compiled with MD5_CRYPT defined:
+-# If set to "yes", new passwords will be encrypted using the MD5-based
+-# algorithm compatible with the one used by recent releases of FreeBSD.
+-# It supports passwords of unlimited length and longer salt strings.
+-# Set to "no" if you need to copy encrypted passwords to other systems
+-# which don't understand the new algorithm.  Default is "no".
+-#
+-# Note: If you use PAM, it is recommended to use a value consistent with
+-# the PAM modules configuration.
+-#
+-# This variable is deprecated. You should use ENCRYPT_METHOD instead.
+-#
+-#MD5_CRYPT_ENAB	no
+-
+-#
+-# Only works if compiled with ENCRYPTMETHOD_SELECT defined:
+ # If set to MD5, MD5-based algorithm will be used for encrypting password
+ # If set to SHA256, SHA256-based algorithm will be used for encrypting password
+ # If set to SHA512, SHA512-based algorithm will be used for encrypting password
+@@ -326,66 +155,10 @@ CHFN_RESTRICT		rwh
+ # MD5 and DES should not be used for new hashes, see crypt(5) for recommendations.
+ # Overrides the MD5_CRYPT_ENAB option
+ #
+-# Note: If you use PAM, it is recommended to use a value consistent with
++# Note: It is recommended to use a value consistent with
+ # the PAM modules configuration.
+ #
+-#ENCRYPT_METHOD DES
+-
+-#
+-# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
+-#
+-# Define the number of SHA rounds.
+-# With a lot of rounds, it is more difficult to brute-force the password.
+-# However, more CPU resources will be needed to authenticate users if
+-# this value is increased.
+-#
+-# If not specified, the libc will choose the default number of rounds (5000),
+-# which is orders of magnitude too low for modern hardware.
+-# The values must be within the 1000-999999999 range.
+-# If only one of the MIN or MAX values is set, then this value will be used.
+-# If MIN > MAX, the highest value will be used.
+-#
+-#SHA_CRYPT_MIN_ROUNDS 5000
+-#SHA_CRYPT_MAX_ROUNDS 5000
+-
+-#
+-# Only works if ENCRYPT_METHOD is set to BCRYPT.
+-#
+-# Define the number of BCRYPT rounds.
+-# With a lot of rounds, it is more difficult to brute-force the password.
+-# However, more CPU resources will be needed to authenticate users if
+-# this value is increased.
+-#
+-# If not specified, 13 rounds will be attempted.
+-# If only one of the MIN or MAX values is set, then this value will be used.
+-# If MIN > MAX, the highest value will be used.
+-#
+-#BCRYPT_MIN_ROUNDS 13
+-#BCRYPT_MAX_ROUNDS 13
+-
+-#
+-# Only works if ENCRYPT_METHOD is set to YESCRYPT.
+-#
+-# Define the YESCRYPT cost factor.
+-# With a higher cost factor, it is more difficult to brute-force the password.
+-# However, more CPU time and more memory will be needed to authenticate users
+-# if this value is increased.
+-#
+-# If not specified, a cost factor of 5 will be used.
+-# The value must be within the 1-11 range.
+-#
+-#YESCRYPT_COST_FACTOR 5
+-
+-#
+-# List of groups to add to the user's supplementary group set
+-# when logging in from the console (as determined by the CONSOLE
+-# setting).  Default is none.
+-#
+-# Use with caution - it is possible for users to gain permanent
+-# access to these groups, even when not logged in from the console.
+-# How to do it is left as an exercise for the reader...
+-#
+-#CONSOLE_GROUPS		floppy:audio:cdrom
++ENCRYPT_METHOD YESCRYPT
+ 
+ #
+ # Should login be allowed if we can't cd to the home directory?
+@@ -401,12 +174,6 @@ DEFAULT_HOME	yes
+ #
+ NONEXISTENT	/nonexistent
+ 
+-#
+-# If this file exists and is readable, login environment will be
+-# read from it.  Every line should be in the form name=value.
+-#
+-ENVIRON_FILE	/etc/environment
+-
+ #
+ # If defined, this command is run when removing a user.
+ # It should remove any at/cron/print jobs etc. owned by
+@@ -415,59 +182,11 @@ ENVIRON_FILE	/etc/environment
+ #USERDEL_CMD	/usr/sbin/userdel_local
+ 
+ #
+-# Enable setting of the umask group bits to be the same as owner bits
+-# (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid is
+-# the same as gid, and username is the same as the primary group name.
++# If set to yes, userdel(8) will remove the user's group if it contains no more
++# members, and useradd(8) will create by default a group with the name of the
++# user.
+ #
+-# This also enables userdel(8) to remove user groups if no members exist.
++# Other former uses of this variable are not used in PAM environments, such as
++# Debian.
+ #
+ USERGROUPS_ENAB yes
+-
+-#
+-# If set to a non-zero number, the shadow utilities will make sure that
+-# groups never have more than this number of users on one line.
+-# This permits to support split groups (groups split into multiple lines,
+-# with the same group ID, to avoid limitation of the line length in the
+-# group file).
+-#
+-# 0 is the default value and disables this feature.
+-#
+-#MAX_MEMBERS_PER_GROUP	0
+-
+-#
+-# If useradd(8) should create home directories for users by default (non
+-# system users only).
+-# This option is overridden with the -M or -m flags on the useradd(8)
+-# command-line.
+-#
+-#CREATE_HOME     yes
+-
+-#
+-# Force use shadow, even if shadow passwd & shadow group files are
+-# missing.
+-#
+-#FORCE_SHADOW    yes
+-
+-#
+-# Allow newuidmap and newgidmap when running under an alternative
+-# primary group.
+-#
+-#GRANT_AUX_GROUP_SUBIDS yes
+-
+-#
+-# Prevents an empty password field to be interpreted as "no authentication
+-# required".
+-# Set to "yes" to prevent for all accounts
+-# Set to "superuser" to prevent for UID 0 / root (default)
+-# Set to "no" to not prevent for any account (dangerous, historical default)
+-PREVENT_NO_AUTH superuser
+-
+-#
+-# Select the HMAC cryptography algorithm.
+-# Used in pam_timestamp module to calculate the keyed-hash message
+-# authentication code.
+-#
+-# Note: It is recommended to check hmac(3) to see the possible algorithms
+-# that are available in your system.
+-#
+-#HMAC_CRYPTO_ALGO SHA512

debian/patches/debian/Define-LOGIN_NAME_MAX-on-HURD.patch

@@ -0,0 +1,25 @@
+From: Chris Hofstaedtler <zeha@debian.org>
+Date: Tue, 6 Aug 2024 00:16:59 +0200
+Subject: Define LOGIN_NAME_MAX on HURD
+
+---
+ lib/chkname.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/lib/chkname.c b/lib/chkname.c
+index 57d6d96..6af55a9 100644
+--- a/lib/chkname.c
++++ b/lib/chkname.c
+@@ -29,6 +29,12 @@
+ #include <stddef.h>
+ #include <unistd.h>
+ 
++#ifdef __GNU__
++#ifndef LOGIN_NAME_MAX
++#define LOGIN_NAME_MAX 256
++#endif
++#endif
++
+ #include "defines.h"
+ #include "chkname.h"
+ #include "string/ctype/strisascii/strisdigit.h"

debian/patches/debian/Document-the-shadowconfig-utility.patch

@@ -0,0 +1,65 @@
+From: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
+Date: Sat, 22 Jun 2024 17:39:41 +0200
+Subject: Document the shadowconfig utility
+
+Status wrt upstream: The shadowconfig utility is Debian-specific.
+The man page is Debian-specific, but it used to be distributed by
+upstream.
+---
+ man/Makefile.am         |  1 +
+ man/man8/shadowconfig.8 | 34 ++++++++++++++++++++++++++++++++++
+ 2 files changed, 35 insertions(+)
+ create mode 100644 man/man8/shadowconfig.8
+
+diff --git a/man/Makefile.am b/man/Makefile.am
+index f34ed7a..2523e84 100644
+--- a/man/Makefile.am
++++ b/man/Makefile.am
+@@ -36,6 +36,7 @@ man_MANS = \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
++	man8/shadowconfig.8 \
+ 	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+diff --git a/man/man8/shadowconfig.8 b/man/man8/shadowconfig.8
+new file mode 100644
+index 0000000..a463a92
+--- /dev/null
++++ b/man/man8/shadowconfig.8
+@@ -0,0 +1,34 @@
++.TH shadowconfig 8 2025-02-17 "Debian shadow-utils"
++.SH Name
++shadowconfig \- turn shadow passwords on
++.
++.
++.SH Synopsis
++.SY shadowconfig on
++.YS
++.
++.
++.SH Description
++.I shadowconfig\ on
++will turn shadow passwords on.
++.
++.
++.SH Errors
++.B shadowconfig
++will print an error message and exit with a nonzero code
++if it finds anything awry.
++If that happens,
++you should correct the error and run it again.
++Turning shadow passwords on when they are already on
++is harmless.
++.
++.
++.SH Caveats
++Turning shadow passwords off using shadowconfig
++is not supported anymore.
++.
++.
++.SH See also
++Read
++.I /usr/share/doc/passwd/README.Debian
++for a brief introduction to shadow passwords and related features.

debian/patches/debian/Keep-using-Debian-adduser-defaults.patch

@@ -0,0 +1,52 @@
+From: Balint Reczey <balint@balintreczey.hu>
+Date: Sat, 22 Jun 2024 17:39:41 +0200
+Subject: Keep using Debian's adduser defaults
+
+Bug: https://github.com/shadow-maint/shadow/issues/501
+Bug-Debian: https://bugs.debian.org/1004710
+Forwarded: not-needed
+
+Upstream's bbf4b79bc49fd1826eb41f6629669ef0b647267b commit
+in 4.9 merged those values from upstream's default configuration file
+which is not shipped in Debian.
+This patch keeps the program's compiled in defaults in sync with the
+configuration files shipped in Debian (debian/default/useradd).
+---
+ man/useradd.8.xml | 2 +-
+ src/useradd.c     | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/man/useradd.8.xml b/man/useradd.8.xml
+index eda1fef..38f2c68 100644
+--- a/man/useradd.8.xml
++++ b/man/useradd.8.xml
+@@ -248,7 +248,7 @@
+ 	    command line), useradd will set the primary group of the new
+ 	    user to the value specified by the <option>GROUP</option>
+ 	    variable in <filename>/etc/default/useradd</filename>, or
+-	    1000 by default.
++	    100 by default.
+ 	  </para>
+ 	</listitem>
+       </varlistentry>
+diff --git a/src/useradd.c b/src/useradd.c
+index ee52aaf..5e4eb2c 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -97,14 +97,14 @@ static const char Prog[] = "useradd";
+ /*
+  * These defaults are used if there is no defaults file.
+  */
+-static gid_t def_group = 1000;
++static gid_t def_group = 100;
+ static const char *def_groups = "";
+ static const char *def_gname = "other";
+ static const char *def_home = "/home";
+ static const char *def_shell = "/bin/bash";
+ static const char *def_template = SKEL_DIR;
+ static const char *def_usrtemplate = USRSKELDIR;
+-static const char *def_create_mail_spool = "yes";
++static const char *def_create_mail_spool = "no";
+ static const char *def_log_init = "yes";
+ 
+ static long def_inactive = -1;

debian/patches/debian/Recommend-using-adduser-and-deluser.patch

@@ -0,0 +1,46 @@
+From: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
+Date: Sat, 22 Jun 2024 17:39:41 +0200
+Subject: Recommend using adduser and deluser
+
+Fixes: #406046
+
+Status wrt upstream: Debian specific patch.
+---
+ man/useradd.8.xml | 6 ++++++
+ man/userdel.8.xml | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/man/useradd.8.xml b/man/useradd.8.xml
+index 38f2c68..9009d83 100644
+--- a/man/useradd.8.xml
++++ b/man/useradd.8.xml
+@@ -82,6 +82,12 @@
+ 
+   <refsect1 id='description'>
+     <title>DESCRIPTION</title>
++      <para>
++	<command>useradd</command> is a low level utility for adding
++	users.  On Debian, administrators should usually use
++	<citerefentry><refentrytitle>adduser</refentrytitle>
++	<manvolnum>8</manvolnum></citerefentry> instead.
++      </para>
+       <para>
+ 	When invoked without the <option>-D</option> option, the
+ 	<command>useradd</command> command creates a new user account using
+diff --git a/man/userdel.8.xml b/man/userdel.8.xml
+index 32851f1..4373cd8 100644
+--- a/man/userdel.8.xml
++++ b/man/userdel.8.xml
+@@ -58,6 +58,12 @@
+ 
+   <refsect1 id='description'>
+     <title>DESCRIPTION</title>
++    <para>
++      <command>userdel</command> is a low level utility for removing
++      users.  On Debian, administrators should usually use
++      <citerefentry><refentrytitle>deluser</refentrytitle>
++      <manvolnum>8</manvolnum></citerefentry> instead.
++    </para>
+     <para>
+       The <command>userdel</command> command modifies the system account
+       files, deleting all entries that refer to the user name <emphasis

debian/patches/debian/Set-group-and-mode-for-g-shadow-files.patch

@@ -0,0 +1,75 @@
+From: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
+Date: Sat, 22 Jun 2024 17:39:41 +0200
+Subject: Set group and mode for [g]shadow files
+
+Set group 'shadow' and mode 0400.
+
+Fixes: #166793
+---
+ lib/commonio.c | 12 ++++++++++++
+ lib/sgroupio.c |  2 +-
+ lib/shadowio.c |  2 +-
+ 3 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/lib/commonio.c b/lib/commonio.c
+index b7c9a2d..309efa0 100644
+--- a/lib/commonio.c
++++ b/lib/commonio.c
+@@ -21,6 +21,7 @@
+ #include <sys/stat.h>
+ #include <stdlib.h>
+ #include <utime.h>
++#include <grp.h>
+ 
+ #include "alloc/malloc.h"
+ #include "alloc/reallocf.h"
+@@ -953,12 +954,23 @@ int commonio_close (struct commonio_db *db)
+ 		if (errors)
+ 			goto fail;
+ 	} else {
++		struct group *grp;
+ 		/*
+ 		 * Default permissions for new [g]shadow files.
+ 		 */
+ 		sb.st_mode = db->st_mode;
+ 		sb.st_uid = db->st_uid;
+ 		sb.st_gid = db->st_gid;
++
++		/*
++		 * Try to retrieve the shadow's GID, and fall back to GID 0.
++		 */
++		if (sb.st_gid == 0) {
++			if ((grp = getgrnam("shadow")) != NULL)
++				sb.st_gid = grp->gr_gid;
++			else
++				sb.st_gid = 0;
++		}
+ 	}
+ 
+ 	if (SNPRINTF(buf, "%s+", db->filename) == -1)
+diff --git a/lib/sgroupio.c b/lib/sgroupio.c
+index 9805761..e3c0458 100644
+--- a/lib/sgroupio.c
++++ b/lib/sgroupio.c
+@@ -210,7 +210,7 @@ static struct commonio_db gshadow_db = {
+ #ifdef WITH_SELINUX
+ 	NULL,			/* scontext */
+ #endif
+-	0400,                   /* st_mode */
++	0440,                   /* st_mode */
+ 	0,                      /* st_uid */
+ 	0,                      /* st_gid */
+ 	NULL,			/* head */
+diff --git a/lib/shadowio.c b/lib/shadowio.c
+index d2c3b47..53dac0b 100644
+--- a/lib/shadowio.c
++++ b/lib/shadowio.c
+@@ -85,7 +85,7 @@ static struct commonio_db shadow_db = {
+ #ifdef WITH_SELINUX
+ 	NULL,			/* scontext */
+ #endif				/* WITH_SELINUX */
+-	0400,                   /* st_mode */
++	0440,                   /* st_mode */
+ 	0,                      /* st_uid */
+ 	0,                      /* st_gid */
+ 	NULL,			/* head */

debian/patches/debian/Stop-building-programs-we-do-not-install.patch

@@ -0,0 +1,561 @@
+From: Chris Hofstaedtler <zeha@debian.org>
+Date: Tue, 6 Aug 2024 00:27:13 +0200
+Subject: Stop building programs we do not install
+
+---
+ man/Makefile.am       | 15 ---------------
+ man/cs/Makefile.am    |  9 ---------
+ man/da/Makefile.am    |  3 ---
+ man/de/Makefile.am    | 10 ----------
+ man/fr/Makefile.am    | 10 ----------
+ man/hu/Makefile.am    |  3 ---
+ man/id/Makefile.am    |  1 -
+ man/it/Makefile.am    | 10 ----------
+ man/ja/Makefile.am    |  8 --------
+ man/ko/Makefile.am    |  2 --
+ man/pl/Makefile.am    |  6 ------
+ man/ru/Makefile.am    |  9 ---------
+ man/sv/Makefile.am    |  8 --------
+ man/tr/Makefile.am    |  2 --
+ man/uk/Makefile.am    |  9 ---------
+ man/zh_CN/Makefile.am | 10 ----------
+ man/zh_TW/Makefile.am |  2 --
+ src/Makefile.am       |  7 +++----
+ 18 files changed, 3 insertions(+), 121 deletions(-)
+
+diff --git a/man/Makefile.am b/man/Makefile.am
+index 2523e84..05a0c86 100644
+--- a/man/Makefile.am
++++ b/man/Makefile.am
+@@ -13,8 +13,6 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+@@ -25,19 +23,14 @@ man_MANS = \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+ 	man8/shadowconfig.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+ 	man8/useradd.8 \
+@@ -82,8 +75,6 @@ man_XMANS = \
+ 	chpasswd.8.xml \
+ 	chsh.1.xml \
+ 	expiry.1.xml \
+-	faillog.5.xml \
+-	faillog.8.xml \
+ 	getsubids.1.xml \
+ 	gpasswd.1.xml \
+ 	groupadd.8.xml \
+@@ -96,12 +87,9 @@ man_XMANS = \
+ 	login.1.xml \
+ 	login.access.5.xml \
+ 	login.defs.5.xml \
+-	logoutd.8.xml \
+ 	newgidmap.1.xml \
+-	newgrp.1.xml \
+ 	newuidmap.1.xml \
+ 	newusers.8.xml \
+-	nologin.8.xml \
+ 	passwd.1.xml \
+ 	passwd.5.xml \
+ 	porttime.5.xml \
+@@ -109,9 +97,6 @@ man_XMANS = \
+ 	pwconv.8.xml \
+ 	shadow.3.xml \
+ 	shadow.5.xml \
+-	sg.1.xml \
+-	su.1.xml \
+-	suauth.5.xml \
+ 	subgid.5.xml \
+ 	subuid.5.xml \
+ 	useradd.8.xml \
+diff --git a/man/cs/Makefile.am b/man/cs/Makefile.am
+index 45aec38..e1f9f87 100644
+--- a/man/cs/Makefile.am
++++ b/man/cs/Makefile.am
+@@ -3,25 +3,16 @@ mandir = @mandir@/cs
+ 
+ man_MANS = \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man5/gshadow.5 \
+-	man8/nologin.8 \
+ 	man5/passwd.5 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+ 	man8/vipw.8
+ 
+ if ENABLE_LASTLOG
+ man_MANS += man8/lastlog.8
+ endif
+-
+-EXTRA_DIST = $(man_MANS) \
+-	man8/groupmems.8 \
+-	man8/logoutd.8
+-
+diff --git a/man/da/Makefile.am b/man/da/Makefile.am
+index c61b787..12234cb 100644
+--- a/man/da/Makefile.am
++++ b/man/da/Makefile.am
+@@ -6,10 +6,7 @@ man_MANS = \
+ 	man1/chfn.1 \
+ 	man8/groupdel.8 \
+ 	man5/gshadow.5 \
+-	man8/logoutd.8 \
+ 	man1/newgrp.1 \
+-	man8/nologin.8 \
+-	man1/sg.1 \
+ 	man8/vigr.8 \
+ 	man8/vipw.8
+ 
+diff --git a/man/de/Makefile.am b/man/de/Makefile.am
+index d3a6d6c..59602aa 100644
+--- a/man/de/Makefile.am
++++ b/man/de/Makefile.am
+@@ -8,34 +8,24 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/fr/Makefile.am b/man/fr/Makefile.am
+index 2365e23..6cbaadc 100644
+--- a/man/fr/Makefile.am
++++ b/man/fr/Makefile.am
+@@ -8,34 +8,24 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/hu/Makefile.am b/man/hu/Makefile.am
+index 6bf68e8..2930da3 100644
+--- a/man/hu/Makefile.am
++++ b/man/hu/Makefile.am
+@@ -4,11 +4,8 @@ mandir = @mandir@/hu
+ man_MANS = \
+ 	man1/chsh.1 \
+ 	man1/gpasswd.1 \
+-	man1/login.1 \
+-	man1/newgrp.1 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+-	man1/sg.1 \
+ 	man1/su.1
+ 
+ if ENABLE_LASTLOG
+diff --git a/man/id/Makefile.am b/man/id/Makefile.am
+index 21f3dbe..566fa8b 100644
+--- a/man/id/Makefile.am
++++ b/man/id/Makefile.am
+@@ -3,7 +3,6 @@ mandir = @mandir@/id
+ 
+ man_MANS = \
+ 	man1/chsh.1 \
+-	man1/login.1 \
+ 	man8/useradd.8
+ 
+ EXTRA_DIST = $(man_MANS)
+diff --git a/man/it/Makefile.am b/man/it/Makefile.am
+index 736576c..3312232 100644
+--- a/man/it/Makefile.am
++++ b/man/it/Makefile.am
+@@ -8,34 +8,24 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/ja/Makefile.am b/man/ja/Makefile.am
+index b759726..1e22da2 100644
+--- a/man/ja/Makefile.am
++++ b/man/ja/Makefile.am
+@@ -7,8 +7,6 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+@@ -16,20 +14,14 @@ man_MANS = \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/ko/Makefile.am b/man/ko/Makefile.am
+index 4f73651..0f17a17 100644
+--- a/man/ko/Makefile.am
++++ b/man/ko/Makefile.am
+@@ -4,9 +4,7 @@ mandir = @mandir@/ko
+ man_MANS = \
+ 	man1/chfn.1 \
+ 	man1/chsh.1 \
+-	man1/login.1 \
+ 	man5/passwd.5 \
+-	man1/su.1 \
+ 	man8/vigr.8 \
+ 	man8/vipw.8
+ # newgrp.1 must be updated
+diff --git a/man/pl/Makefile.am b/man/pl/Makefile.am
+index 2a015f3..02f4533 100644
+--- a/man/pl/Makefile.am
++++ b/man/pl/Makefile.am
+@@ -6,17 +6,11 @@ man_MANS = \
+ 	man1/chage.1 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/ru/Makefile.am b/man/ru/Makefile.am
+index 845a603..9afcb22 100644
+--- a/man/ru/Makefile.am
++++ b/man/ru/Makefile.am
+@@ -8,22 +8,16 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+ 	man8/nologin.8 \
+ 	man1/passwd.1 \
+@@ -31,11 +25,8 @@ man_MANS = \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/sv/Makefile.am b/man/sv/Makefile.am
+index 1918af7..d572c36 100644
+--- a/man/sv/Makefile.am
++++ b/man/sv/Makefile.am
+@@ -5,24 +5,16 @@ man_MANS = \
+ 	man1/chage.1 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man5/gshadow.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+-	man5/suauth.5 \
+ 	man8/userdel.8 \
+ 	man8/vigr.8 \
+ 	man8/vipw.8
+diff --git a/man/tr/Makefile.am b/man/tr/Makefile.am
+index 8d8b916..8b2aa2d 100644
+--- a/man/tr/Makefile.am
++++ b/man/tr/Makefile.am
+@@ -6,11 +6,9 @@ man_MANS = \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+ 	man8/groupmod.8 \
+-	man1/login.1 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8
+diff --git a/man/uk/Makefile.am b/man/uk/Makefile.am
+index a0f106d..f069eea 100644
+--- a/man/uk/Makefile.am
++++ b/man/uk/Makefile.am
+@@ -8,34 +8,25 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+ 	man1/newgrp.1 \
+ 	man8/newusers.8 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/zh_CN/Makefile.am b/man/zh_CN/Makefile.am
+index 59d1072..9402a9e 100644
+--- a/man/zh_CN/Makefile.am
++++ b/man/zh_CN/Makefile.am
+@@ -8,34 +8,24 @@ man_MANS = \
+ 	man8/chpasswd.8 \
+ 	man1/chsh.1 \
+ 	man1/expiry.1 \
+-	man5/faillog.5 \
+-	man8/faillog.8 \
+ 	man3/getspnam.3 \
+ 	man1/gpasswd.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+-	man8/groupmems.8 \
+ 	man8/groupmod.8 \
+ 	man8/grpck.8 \
+ 	man8/grpconv.8 \
+ 	man8/grpunconv.8 \
+ 	man5/gshadow.5 \
+-	man1/login.1 \
+ 	man5/login.defs.5 \
+-	man8/logoutd.8 \
+-	man1/newgrp.1 \
+ 	man8/newusers.8 \
+-	man8/nologin.8 \
+ 	man1/passwd.1 \
+ 	man5/passwd.5 \
+ 	man8/pwck.8 \
+ 	man8/pwconv.8 \
+ 	man8/pwunconv.8 \
+-	man1/sg.1 \
+ 	man3/shadow.3 \
+ 	man5/shadow.5 \
+-	man1/su.1 \
+-	man5/suauth.5 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8 \
+diff --git a/man/zh_TW/Makefile.am b/man/zh_TW/Makefile.am
+index c36ed2c..6fb6a15 100644
+--- a/man/zh_TW/Makefile.am
++++ b/man/zh_TW/Makefile.am
+@@ -5,12 +5,10 @@ man_MANS = \
+ 	man1/chfn.1 \
+ 	man1/chsh.1 \
+ 	man8/chpasswd.8 \
+-	man1/newgrp.1 \
+ 	man8/groupadd.8 \
+ 	man8/groupdel.8 \
+ 	man8/groupmod.8 \
+ 	man5/passwd.5 \
+-	man1/su.1 \
+ 	man8/useradd.8 \
+ 	man8/userdel.8 \
+ 	man8/usermod.8
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 6981815..5ca78ed 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -26,8 +26,8 @@ AM_CFLAGS = $(LIBBSD_CFLAGS)
+ # and installation would be much simpler (just two directories,
+ # $prefix/bin and $prefix/sbin, no install-data hacks...)
+ 
+-bin_PROGRAMS   = login
+-sbin_PROGRAMS  = nologin
++bin_PROGRAMS   =
++sbin_PROGRAMS  =
+ ubin_PROGRAMS  = faillog chage chfn chsh expiry gpasswd newgrp passwd
+ if ENABLE_SUBIDS
+ ubin_PROGRAMS += newgidmap newuidmap
+@@ -48,7 +48,6 @@ usbin_PROGRAMS = \
+ 	grpck \
+ 	grpconv \
+ 	grpunconv \
+-	logoutd \
+ 	newusers \
+ 	pwck \
+ 	pwconv \
+@@ -59,7 +58,7 @@ usbin_PROGRAMS = \
+ 	vipw
+ 
+ # sulogin from sysvinit
+-noinst_PROGRAMS = sulogin
++noinst_PROGRAMS =
+ 
+ suidusbins     =
+ suidbins       =

debian/patches/debian/Warn-when-badname-and-variants-are-given.patch

@@ -0,0 +1,104 @@
+From: Chris Hofstaedtler <zeha@debian.org>
+Date: Mon, 17 Feb 2025 18:17:15 +0100
+Subject: Warn when --badname (and variants) are given
+
+Upstream PR 1158 will remove them, probably in the forky timeframe.
+---
+ src/newusers.c | 5 ++++-
+ src/pwck.c     | 5 ++++-
+ src/useradd.c  | 5 ++++-
+ src/usermod.c  | 5 ++++-
+ 4 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/src/newusers.c b/src/newusers.c
+index e3685ef..16abd81 100644
+--- a/src/newusers.c
++++ b/src/newusers.c
+@@ -127,7 +127,7 @@ static void usage (int status)
+ 	                  "\n"
+ 	                  "Options:\n"),
+ 	                Prog);
+-	(void) fputs (_("  -b, --badname                 allow bad names\n"), usageout);
++	(void) fputs (_("  -b, --badname                 allow bad names (DEPRECATED)\n"), usageout);
+ #ifndef USE_PAM
+ 	(void) fprintf (usageout,
+ 	                _("  -c, --crypt-method METHOD     the crypt method (one of %s)\n"),
+@@ -660,6 +660,9 @@ static void process_flags (int argc, char **argv)
+ 		switch (c) {
+ 		case 'b':
+ 			allow_bad_names = true;
++			fprintf (stderr,
++					 _("%s: WARNING: -b and --badname are deprecated and will be removed\n"),
++					 Prog);
+ 			break;
+ #ifndef USE_PAM
+ 		case 'c':
+diff --git a/src/pwck.c b/src/pwck.c
+index b485a5a..e20be0f 100644
+--- a/src/pwck.c
++++ b/src/pwck.c
+@@ -133,7 +133,7 @@ usage (int status)
+ 		                  "Options:\n"),
+ 		                Prog);
+ 	}
+-	(void) fputs (_("  -b, --badname                 allow bad names\n"), usageout);
++	(void) fputs (_("  -b, --badname                 allow bad names (DEPRECATED)\n"), usageout);
+ 	(void) fputs (_("  -h, --help                    display this help message and exit\n"), usageout);
+ 	(void) fputs (_("  -q, --quiet                   report errors only\n"), usageout);
+ 	(void) fputs (_("  -r, --read-only               display errors and warnings\n"
+@@ -175,6 +175,9 @@ static void process_flags (int argc, char **argv)
+ 		switch (c) {
+ 		case 'b':
+ 			allow_bad_names = true;
++			fprintf (stderr,
++					 _("%s: WARNING: --badname is deprecated and will be removed\n"),
++					 Prog);
+ 			break;
+ 		case 'h':
+ 			usage (E_SUCCESS);
+diff --git a/src/useradd.c b/src/useradd.c
+index 5e4eb2c..be9ec2e 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -895,7 +895,7 @@ static void usage (int status)
+ 	                  "\n"
+ 	                  "Options:\n"),
+ 	                Prog, Prog, Prog);
+-	(void) fputs (_("      --badname                 do not check for bad names\n"), usageout);
++	(void) fputs (_("      --badname                 do not check for bad names (DEPRECATED)\n"), usageout);
+ 	(void) fputs (_("  -b, --base-dir BASE_DIR       base directory for the home directory of the\n"
+ 	                "                                new account\n"), usageout);
+ #ifdef WITH_BTRFS
+@@ -1241,6 +1241,9 @@ static void process_flags (int argc, char **argv)
+ 				break;
+ 			case 201:
+ 				allow_bad_names = true;
++				fprintf (stderr,
++					     _("%s: WARNING: --badname is deprecated and will be removed\n"),
++					     Prog);
+ 				break;
+ 			case 'c':
+ 				if (!VALID (optarg)) {
+diff --git a/src/usermod.c b/src/usermod.c
+index 7ea1a72..3e9e046 100644
+--- a/src/usermod.c
++++ b/src/usermod.c
+@@ -383,7 +383,7 @@ usage (int status)
+ 	(void) fputs (_("  -a, --append                  append the user to the supplemental GROUPS\n"
+ 	                "                                mentioned by the -G option without removing\n"
+ 	                "                                the user from other groups\n"), usageout);
+-	(void) fputs (_("  -b, --badname                 allow bad names\n"), usageout);
++	(void) fputs (_("  -b, --badname                 allow bad names (DEPRECATED)\n"), usageout);
+ 	(void) fputs (_("  -c, --comment COMMENT         new value of the GECOS field\n"), usageout);
+ 	(void) fputs (_("  -d, --home HOME_DIR           new home directory for the user account\n"), usageout);
+ 	(void) fputs (_("  -e, --expiredate EXPIRE_DATE  set account expiration date to EXPIRE_DATE\n"), usageout);
+@@ -1043,6 +1043,9 @@ process_flags(int argc, char **argv)
+ 				break;
+ 			case 'b':
+ 				allow_bad_names = true;
++				fprintf (stderr,
++					     _("%s: WARNING: -b, --badname and --badnames are deprecated and will be removed\n"),
++					     Prog);
+ 				break;
+ 			case 'c':
+ 				if (!VALID (optarg)) {

debian/patches/debian/configure.ac-align-exec_prefix-with-prefix.patch

@@ -0,0 +1,23 @@
+From: Chris Hofstaedtler <zeha@debian.org>
+Date: Mon, 24 Feb 2025 23:24:41 +0100
+Subject: configure.ac: align exec_prefix with prefix
+
+Hopefully upstream will fix this one day.
+Reported as https://github.com/shadow-maint/shadow/issues/1229
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 36c57d8..8a9c05a 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -18,7 +18,7 @@ AC_SUBST([LIBSUBID_ABI], [libsubid_abi])
+ 
+ dnl Some hacks...
+ test "$prefix" = "NONE" && prefix="/usr"
+-test "$prefix" = "/usr" && exec_prefix=""
++test "$prefix" = "/usr" && exec_prefix="/usr"
+ 
+ AC_USE_SYSTEM_EXTENSIONS
+ 

debian/patches/debian/configure.ac-be-deterministic-about-passwd-location.patch

@@ -0,0 +1,30 @@
+From: Chris Hofstaedtler <zeha@debian.org>
+Date: Mon, 24 Feb 2025 12:01:18 +0100
+Subject: configure.ac: be deterministic about passwd location
+
+Improve reproducibility, without Build-Depend:ing on ourselves.
+
+Forwarded: https://github.com/shadow-maint/shadow/issues/1224
+---
+ configure.ac | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 8a9c05a..b7cc59c 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -115,13 +115,7 @@ AC_DEFINE_UNQUOTED(LASTLOG_FILE, "$shadow_cv_logdir/lastlog",
+ AC_DEFINE_UNQUOTED(FAILLOG_FILE, "$shadow_cv_logdir/faillog",
+ 	[Path for faillog file.])
+ 
+-AC_CACHE_CHECK([location of the passwd program], shadow_cv_passwd_dir,
+-[if test -f /usr/bin/passwd; then
+-	shadow_cv_passwd_dir=/usr/bin
+-else
+-	shadow_cv_passwd_dir=/bin
+-fi])
+-AC_DEFINE_UNQUOTED(PASSWD_PROGRAM, "$shadow_cv_passwd_dir/passwd",
++AC_DEFINE_UNQUOTED(PASSWD_PROGRAM, "$exec_prefix/bin/passwd",
+ 	[Path to passwd program.])
+ 
+ AC_ARG_ENABLE(shadowgrp,

debian/patches/debian/tests-disable-su.patch

@@ -0,0 +1,89 @@
+From: Serge Hallyn <serge@hallyn.com>
+Date: Thu, 27 Jun 2024 01:23:05 +0200
+Subject: upstream testsuite: disable su tests
+
+Debian uses su from util-linux, pointless/impossible to test shadow's su
+here.
+---
+ tests/run_some | 68 ----------------------------------------------------------
+ 1 file changed, 68 deletions(-)
+
+diff --git a/tests/run_some b/tests/run_some
+index c58f59b..46317eb 100755
+--- a/tests/run_some
++++ b/tests/run_some
+@@ -79,74 +79,6 @@ echo "-: test failed"
+ find "${build_path}" -name "*.gcda" -delete
+ # ignore the result of the first test.  ~magic~
+ run_test ./su/01/su_user.test ignore_failure
+-run_test ./su/01/su_user.test
+-run_test ./su/01/su_root.test
+-find "${build_path}" -name "*.gcda" -exec chmod a+rw {} \;
+-run_test ./su/02/env_FOO-options_--login
+-run_test ./su/02/env_FOO-options_--login_bash
+-run_test ./su/02/env_FOO-options_--preserve-environment
+-run_test ./su/02/env_FOO-options_--preserve-environment_bash
+-run_test ./su/02/env_FOO-options_-
+-run_test ./su/02/env_FOO-options_-_bash
+-run_test ./su/02/env_FOO-options_-l-m
+-run_test ./su/02/env_FOO-options_-l-m_bash
+-run_test ./su/02/env_FOO-options_-l
+-run_test ./su/02/env_FOO-options_-l_bash
+-run_test ./su/02/env_FOO-options_-m_bash
+-run_test ./su/02/env_FOO-options_-m
+-run_test ./su/02/env_FOO-options_-p
+-run_test ./su/02/env_FOO-options_-p_bash
+-run_test ./su/02/env_FOO-options__bash
+-run_test ./su/02/env_FOO-options_
+-run_test ./su/02/env_FOO-options_-p-
+-run_test ./su/02/env_FOO-options_-p-_bash
+-run_test ./su/02/env_special-options_-l-p
+-run_test ./su/02/env_special-options_-l
+-run_test ./su/02/env_special-options_-l-p_bash
+-run_test ./su/02/env_special-options_-l_bash
+-run_test ./su/02/env_special-options_-p
+-run_test ./su/02/env_special-options_-p_bash
+-run_test ./su/02/env_special-options_
+-run_test ./su/02/env_special-options__bash
+-run_test ./su/02/env_special_root-options_-l-p
+-run_test ./su/02/env_special_root-options_-l-p_bash
+-run_test ./su/02/env_special_root-options_-l
+-run_test ./su/02/env_special_root-options_-l_bash
+-run_test ./su/02/env_special_root-options_-p
+-run_test ./su/02/env_special_root-options_-p_bash
+-run_test ./su/02/env_special_root-options_
+-run_test ./su/02/env_special_root-options__bash
+-run_test ./su/03/su_run_command01.test
+-run_test ./su/03/su_run_command02.test
+-run_test ./su/03/su_run_command03.test
+-run_test ./su/03/su_run_command04.test
+-run_test ./su/03/su_run_command05.test
+-run_test ./su/03/su_run_command06.test
+-run_test ./su/03/su_run_command07.test
+-run_test ./su/03/su_run_command08.test
+-run_test ./su/03/su_run_command09.test
+-run_test ./su/03/su_run_command10.test
+-run_test ./su/03/su_run_command11.test
+-run_test ./su/03/su_run_command12.test
+-run_test ./su/03/su_run_command13.test
+-run_test ./su/03/su_run_command14.test
+-run_test ./su/03/su_run_command15.test
+-run_test ./su/03/su_run_command16.test
+-run_test ./su/03/su_run_command17.test
+-run_test ./su/04/su_wrong_user.test
+-run_test ./su/04/su_user_wrong_passwd.test
+-run_test ./su/04/su_user_wrong_passwd_syslog.test
+-run_test ./su/05/su_user_wrong_passwd_syslog.test
+-run_test ./su/06/su_user_syslog.test
+-run_test ./su/07/su_user_syslog.test
+-run_test ./su/08/env_special-options_
+-run_test ./su/08/env_special_root-options_
+-run_test ./su/09/env_special-options_
+-run_test ./su/09/env_special_root-options_
+-run_test ./su/10_su_sulog_success/su.test
+-run_test ./su/11_su_sulog_failure/su.test
+-run_test ./su/12_su_child_failure/su.test
+-run_test ./su/13_su_child_success/su.test
+ run_test ./libsubid/01_list_ranges/list_ranges.test
+ run_test ./libsubid/02_get_subid_owners/get_subid_owners.test
+ run_test ./libsubid/03_add_remove/add_remove_subids.test

debian/patches/series

@@ -0,0 +1,17 @@
+debian/Set-group-and-mode-for-g-shadow-files.patch
+debian/Keep-using-Debian-adduser-defaults.patch
+debian/Document-the-shadowconfig-utility.patch
+debian/Recommend-using-adduser-and-deluser.patch
+debian/tests-disable-su.patch
+debian/Adapt-login.defs-for-Debian.patch
+debian/Define-LOGIN_NAME_MAX-on-HURD.patch
+debian/Stop-building-programs-we-do-not-install.patch
+debian/Warn-when-badname-and-variants-are-given.patch
+debian/configure.ac-align-exec_prefix-with-prefix.patch
+debian/configure.ac-be-deterministic-about-passwd-location.patch
+upstream/Revert-lib-src-Use-local-time-for-human-readable-dates.patch
+upstream/src-chfn.c-Partially-revert-lib-src-Use-strsep-3-instead-.patch
+upstream/src-chfn.c-Use-stpsep-instead-of-its-pattern.patch
+upstream/src-chfn.c-Add-local-variable-to-refer-to-the-separated-f.patch
+upstream/src-chfn.c-copy_field-Rename-local-variable.patch
+upstream/lib-getdate.y-Ignore-time-zone-information-and-use-UTC.patch

debian/patches/upstream/Revert-lib-src-Use-local-time-for-human-readable-dates.patch

@@ -0,0 +1,70 @@
+From: Alejandro Colomar <alx@kernel.org>
+Date: Fri, 14 Feb 2025 21:25:01 +0100
+Subject: Revert "lib/, src/: Use local time for human-readable dates"
+
+This reverts commit 3f5b4b56268269fefed55aa106f382037297d663.
+
+The dates are stored as UTC, and are stored as a number of days since
+Epoch.  We don't have enough precision to translate it into local time.
+Using local time has caused endless issues in users.
+
+This patch is not enough for fixing this issue completely, since
+printing a date without time-zone information means that the date is a
+local date, but what we're printing is a UTC date.  A future patch
+should add time-zone information to the date.
+
+For now, let's revert this change that has caused so many issues.
+
+Fixes: 3f5b4b562682 (2024-08-01; "lib/, src/: Use local time for human-readable dates")
+Link: <https://github.com/ansible/ansible/blob/devel/test/integration/targets/user/tasks/test_expires.yml#L2-L20>
+Link: <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1095430>
+Link: <https://lists.iana.org/hyperkitty/list/tz@iana.org/message/ENE5IFV3GAH6WK22UJ6YU57D6TQINSP5/>
+Link: <https://github.com/shadow-maint/shadow/issues/1202>
+Link: <https://github.com/shadow-maint/shadow/issues/1057>
+Link: <https://github.com/shadow-maint/shadow/issues/939>
+Link: <https://github.com/shadow-maint/shadow/pull/1058>
+Link: <https://github.com/shadow-maint/shadow/pull/1059#issuecomment-2309888519>
+Link: <https://github.com/shadow-maint/shadow/pull/952>
+Link: <https://github.com/shadow-maint/shadow/pull/942>
+Reported-by: Chris Hofstaedtler <zeha@debian.org>
+Reported-by: Gus Kenion <https://github.com/kenion>
+Reported-by: Alejandro Colomar <alx@kernel.org>
+Reported-by: Michael Vetter <jubalh@iodoru.org>
+Reported-by: Lee Garrett <lgarrett@rocketjump.eu>
+Cc: Paul Eggert <eggert@cs.ucla.edu>
+Cc: Tim Parenti <tim@timtimeonline.com>
+Cc: Iker Pedrosa <ipedrosa@redhat.com>
+Cc: "Serge E. Hallyn" <serge@hallyn.com>
+Cc: Brian Inglis <Brian.Inglis@SystematicSW.ab.ca>
+Signed-off-by: Alejandro Colomar <alx@kernel.org>
+---
+ lib/time/day_to_str.h | 2 +-
+ src/chage.c           | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/time/day_to_str.h b/lib/time/day_to_str.h
+index b70e989..fe3308d 100644
+--- a/lib/time/day_to_str.h
++++ b/lib/time/day_to_str.h
+@@ -38,7 +38,7 @@ day_to_str(size_t size, char buf[size], long day)
+ 		return;
+ 	}
+ 
+-	if (localtime_r(&date, &tm) == NULL) {
++	if (gmtime_r(&date, &tm) == NULL) {
+ 		strtcpy(buf, "future", size);
+ 		return;
+ 	}
+diff --git a/src/chage.c b/src/chage.c
+index aed8e5b..e2902a7 100644
+--- a/src/chage.c
++++ b/src/chage.c
+@@ -238,7 +238,7 @@ print_day_as_date(long day)
+ 		return;
+ 	}
+ 
+-	if (localtime_r(&date, &tm) == NULL) {
++	if (gmtime_r(&date, &tm) == NULL) {
+ 		puts(_("future"));
+ 		return;
+ 	}

debian/patches/upstream/lib-getdate.y-Ignore-time-zone-information-and-use-UTC.patch

@@ -0,0 +1,375 @@
+From: Alejandro Colomar <alx@kernel.org>
+Date: Tue, 18 Feb 2025 00:41:56 +0100
+Subject: lib/getdate.y: Ignore time-zone information and use UTC
+
+There is exactly one caller of this function, and it wants a date, not a
+time.  It is useless to be able to parse local dates, because we
+ultimately store a UTC date.  To avoid confusion, unconditionally use
+UTC.  Since this code had important bugs regarding offset, we can safely
+assume that no existing users rely on being able to use their local
+date (this never worked correctly).
+
+Also, the code parsing time zones was quite bad.
+
+Link: <https://github.com/shadow-maint/shadow/issues/1202>
+Link: <https://github.com/shadow-maint/shadow/issues/1209>
+Reported-by: Chris Hofstaedtler <zeha@debian.org>
+Reported-by: Tim Parenti <tim@timtimeonline.com>
+Reported-by: Lee Garrett <lgarrett@rocketjump.eu>
+Cc: Gus Kenion <https://github.com/kenion>
+Cc: Michael Vetter <jubalh@iodoru.org>
+Cc: Paul Eggert <eggert@cs.ucla.edu>
+Cc: Iker Pedrosa <ipedrosa@redhat.com>
+Cc: "Serge E. Hallyn" <serge@hallyn.com>
+Cc: Brian Inglis <Brian.Inglis@SystematicSW.ab.ca>
+Signed-off-by: Alejandro Colomar <alx@kernel.org>
+---
+ lib/getdate.y | 225 +++-------------------------------------------------------
+ 1 file changed, 10 insertions(+), 215 deletions(-)
+
+diff --git a/lib/getdate.y b/lib/getdate.y
+index 20b1f5f..5b1d88d 100644
+--- a/lib/getdate.y
++++ b/lib/getdate.y
+@@ -92,8 +92,6 @@
+ static int yylex (void);
+ static int yyerror (const char *s);
+ 
+-#define EPOCH		1970
+-#define HOUR(x)		((x) * 60)
+ 
+ #define MAX_BUFF_LEN    128   /* size of buffer to read the date into */
+ 
+@@ -128,8 +126,6 @@ static int	yyHaveDate;
+ static int	yyHaveDay;
+ static int	yyHaveRel;
+ static int	yyHaveTime;
+-static int	yyHaveZone;
+-static int	yyTimezone;
+ static int	yyDay;
+ static int	yyHour;
+ static int	yyMinutes;
+@@ -151,13 +147,13 @@ static int	yyRelYear;
+     enum _MERIDIAN	Meridian;
+ }
+ 
+-%token	tAGO tDAY tDAY_UNIT tDAYZONE tDST tHOUR_UNIT tID
++%token	tAGO tDAY tDAY_UNIT tHOUR_UNIT tID
+ %token	tMERIDIAN tMINUTE_UNIT tMONTH tMONTH_UNIT
+-%token	tSEC_UNIT tSNUMBER tUNUMBER tYEAR_UNIT tZONE
++%token	tSEC_UNIT tSNUMBER tUNUMBER tYEAR_UNIT
+ 
+-%type	<Number>	tDAY tDAY_UNIT tDAYZONE tHOUR_UNIT tMINUTE_UNIT
++%type	<Number>	tDAY tDAY_UNIT tHOUR_UNIT tMINUTE_UNIT
+ %type	<Number>	tMONTH tMONTH_UNIT
+-%type	<Number>	tSEC_UNIT tSNUMBER tUNUMBER tYEAR_UNIT tZONE
++%type	<Number>	tSEC_UNIT tSNUMBER tUNUMBER tYEAR_UNIT
+ %type	<Meridian>	tMERIDIAN o_merid
+ 
+ %%
+@@ -169,9 +165,6 @@ spec	: /* NULL */
+ item	: time {
+ 	    yyHaveTime++;
+ 	}
+-	| zone {
+-	    yyHaveZone++;
+-	}
+ 	| date {
+ 	    yyHaveDate++;
+ 	}
+@@ -200,10 +193,6 @@ time	: tUNUMBER tMERIDIAN {
+ 	    yyHour = $1;
+ 	    yyMinutes = $3;
+ 	    yyMeridian = MER24;
+-	    yyHaveZone++;
+-	    yyTimezone = ($4 < 0
+-			  ? -$4 % 100 + (-$4 / 100) * 60
+-			  : - ($4 % 100 + ($4 / 100) * 60));
+ 	}
+ 	| tUNUMBER ':' tUNUMBER ':' tUNUMBER o_merid {
+ 	    yyHour = $1;
+@@ -216,22 +205,6 @@ time	: tUNUMBER tMERIDIAN {
+ 	    yyMinutes = $3;
+ 	    yySeconds = $5;
+ 	    yyMeridian = MER24;
+-	    yyHaveZone++;
+-	    yyTimezone = ($6 < 0
+-			  ? -$6 % 100 + (-$6 / 100) * 60
+-			  : - ($6 % 100 + ($6 / 100) * 60));
+-	}
+-	;
+-
+-zone	: tZONE {
+-	    yyTimezone = $1;
+-	}
+-	| tDAYZONE {
+-	    yyTimezone = $1 - 60;
+-	}
+-	|
+-	  tZONE tDST {
+-	    yyTimezone = $1 - 60;
+ 	}
+ 	;
+ 
+@@ -484,91 +457,6 @@ static TABLE const OtherTable[] = {
+     { NULL, 0, 0 }
+ };
+ 
+-/* The timezone table. */
+-static TABLE const TimezoneTable[] = {
+-    { "gmt",	tZONE,     HOUR ( 0) },	/* Greenwich Mean */
+-    { "ut",	tZONE,     HOUR ( 0) },	/* Universal (Coordinated) */
+-    { "utc",	tZONE,     HOUR ( 0) },
+-    { "wet",	tZONE,     HOUR ( 0) },	/* Western European */
+-    { "bst",	tDAYZONE,  HOUR ( 0) },	/* British Summer */
+-    { "wat",	tZONE,     HOUR ( 1) },	/* West Africa */
+-    { "at",	tZONE,     HOUR ( 2) },	/* Azores */
+-    { "ast",	tZONE,     HOUR ( 4) },	/* Atlantic Standard */
+-    { "adt",	tDAYZONE,  HOUR ( 4) },	/* Atlantic Daylight */
+-    { "est",	tZONE,     HOUR ( 5) },	/* Eastern Standard */
+-    { "edt",	tDAYZONE,  HOUR ( 5) },	/* Eastern Daylight */
+-    { "cst",	tZONE,     HOUR ( 6) },	/* Central Standard */
+-    { "cdt",	tDAYZONE,  HOUR ( 6) },	/* Central Daylight */
+-    { "mst",	tZONE,     HOUR ( 7) },	/* Mountain Standard */
+-    { "mdt",	tDAYZONE,  HOUR ( 7) },	/* Mountain Daylight */
+-    { "pst",	tZONE,     HOUR ( 8) },	/* Pacific Standard */
+-    { "pdt",	tDAYZONE,  HOUR ( 8) },	/* Pacific Daylight */
+-    { "yst",	tZONE,     HOUR ( 9) },	/* Yukon Standard */
+-    { "ydt",	tDAYZONE,  HOUR ( 9) },	/* Yukon Daylight */
+-    { "hst",	tZONE,     HOUR (10) },	/* Hawaii Standard */
+-    { "hdt",	tDAYZONE,  HOUR (10) },	/* Hawaii Daylight */
+-    { "cat",	tZONE,     HOUR (10) },	/* Central Alaska */
+-    { "ahst",	tZONE,     HOUR (10) },	/* Alaska-Hawaii Standard */
+-    { "nt",	tZONE,     HOUR (11) },	/* Nome */
+-    { "idlw",	tZONE,     HOUR (12) },	/* International Date Line West */
+-    { "cet",	tZONE,     -HOUR (1) },	/* Central European */
+-    { "met",	tZONE,     -HOUR (1) },	/* Middle European */
+-    { "mewt",	tZONE,     -HOUR (1) },	/* Middle European Winter */
+-    { "mest",	tDAYZONE,  -HOUR (1) },	/* Middle European Summer */
+-    { "mesz",	tDAYZONE,  -HOUR (1) },	/* Middle European Summer */
+-    { "swt",	tZONE,     -HOUR (1) },	/* Swedish Winter */
+-    { "sst",	tDAYZONE,  -HOUR (1) },	/* Swedish Summer */
+-    { "fwt",	tZONE,     -HOUR (1) },	/* French Winter */
+-    { "fst",	tDAYZONE,  -HOUR (1) },	/* French Summer */
+-    { "eet",	tZONE,     -HOUR (2) },	/* Eastern Europe, USSR Zone 1 */
+-    { "bt",	tZONE,     -HOUR (3) },	/* Baghdad, USSR Zone 2 */
+-    { "zp4",	tZONE,     -HOUR (4) },	/* USSR Zone 3 */
+-    { "zp5",	tZONE,     -HOUR (5) },	/* USSR Zone 4 */
+-    { "zp6",	tZONE,     -HOUR (6) },	/* USSR Zone 5 */
+-    { "wast",	tZONE,     -HOUR (7) },	/* West Australian Standard */
+-    { "wadt",	tDAYZONE,  -HOUR (7) },	/* West Australian Daylight */
+-    { "cct",	tZONE,     -HOUR (8) },	/* China Coast, USSR Zone 7 */
+-    { "jst",	tZONE,     -HOUR (9) },	/* Japan Standard, USSR Zone 8 */
+-    { "east",	tZONE,     -HOUR (10) },	/* Eastern Australian Standard */
+-    { "eadt",	tDAYZONE,  -HOUR (10) },	/* Eastern Australian Daylight */
+-    { "gst",	tZONE,     -HOUR (10) },	/* Guam Standard, USSR Zone 9 */
+-    { "nzt",	tZONE,     -HOUR (12) },	/* New Zealand */
+-    { "nzst",	tZONE,     -HOUR (12) },	/* New Zealand Standard */
+-    { "nzdt",	tDAYZONE,  -HOUR (12) },	/* New Zealand Daylight */
+-    { "idle",	tZONE,     -HOUR (12) },	/* International Date Line East */
+-    { NULL, 0, 0 }
+-};
+-
+-/* Military timezone table. */
+-static TABLE const MilitaryTable[] = {
+-    { "a",	tZONE,	HOUR (  1) },
+-    { "b",	tZONE,	HOUR (  2) },
+-    { "c",	tZONE,	HOUR (  3) },
+-    { "d",	tZONE,	HOUR (  4) },
+-    { "e",	tZONE,	HOUR (  5) },
+-    { "f",	tZONE,	HOUR (  6) },
+-    { "g",	tZONE,	HOUR (  7) },
+-    { "h",	tZONE,	HOUR (  8) },
+-    { "i",	tZONE,	HOUR (  9) },
+-    { "k",	tZONE,	HOUR ( 10) },
+-    { "l",	tZONE,	HOUR ( 11) },
+-    { "m",	tZONE,	HOUR ( 12) },
+-    { "n",	tZONE,	HOUR (- 1) },
+-    { "o",	tZONE,	HOUR (- 2) },
+-    { "p",	tZONE,	HOUR (- 3) },
+-    { "q",	tZONE,	HOUR (- 4) },
+-    { "r",	tZONE,	HOUR (- 5) },
+-    { "s",	tZONE,	HOUR (- 6) },
+-    { "t",	tZONE,	HOUR (- 7) },
+-    { "u",	tZONE,	HOUR (- 8) },
+-    { "v",	tZONE,	HOUR (- 9) },
+-    { "w",	tZONE,	HOUR (-10) },
+-    { "x",	tZONE,	HOUR (-11) },
+-    { "y",	tZONE,	HOUR (-12) },
+-    { "z",	tZONE,	HOUR (  0) },
+-    { NULL, 0, 0 }
+-};
+-
+ 
+ 
+ 
+@@ -621,7 +509,6 @@ static int ToYear (int Year)
+ static int LookupWord (char *buff)
+ {
+   register char *p;
+-  register char *q;
+   register const TABLE *tp;
+   int i;
+   bool abbrev;
+@@ -670,16 +557,6 @@ static int LookupWord (char *buff)
+ 	}
+     }
+ 
+-  for (tp = TimezoneTable; tp->name; tp++)
+-    if (streq(buff, tp->name))
+-      {
+-	yylval.Number = tp->value;
+-	return tp->type;
+-      }
+-
+-  if (streq(buff, "dst"))
+-    return tDST;
+-
+   for (tp = UnitsTable; tp->name; tp++)
+     if (streq(buff, tp->name))
+       {
+@@ -708,32 +585,6 @@ static int LookupWord (char *buff)
+ 	return tp->type;
+       }
+ 
+-  /* Military timezones. */
+-  if (buff[1] == '\0' && isalpha (*buff))
+-    {
+-      for (tp = MilitaryTable; tp->name; tp++)
+-	if (streq(buff, tp->name))
+-	  {
+-	    yylval.Number = tp->value;
+-	    return tp->type;
+-	  }
+-    }
+-
+-  /* Drop out any periods and try the timezone table again. */
+-  for (i = 0, p = q = buff; !streq(q, ""); q++)
+-    if (*q != '.')
+-      *p++ = *q;
+-    else
+-      i++;
+-  stpcpy(p, "");
+-  if (0 != i)
+-    for (tp = TimezoneTable; NULL != tp->name; tp++)
+-      if (streq(buff, tp->name))
+-	{
+-	  yylval.Number = tp->value;
+-	  return tp->type;
+-	}
+-
+   return tID;
+ }
+ 
+@@ -796,34 +647,14 @@ yylex (void)
+ 
+ #define TM_YEAR_ORIGIN 1900
+ 
+-/* Yield A - B, measured in seconds.  */
+-static long difftm (struct tm *a, struct tm *b)
+-{
+-  int ay = a->tm_year + (TM_YEAR_ORIGIN - 1);
+-  int by = b->tm_year + (TM_YEAR_ORIGIN - 1);
+-  long days = (
+-  /* difference in day of year */
+-		a->tm_yday - b->tm_yday
+-  /* + intervening leap days */
+-		+ ((ay >> 2) - (by >> 2))
+-		- (ay / 100 - by / 100)
+-		+ ((ay / 100 >> 2) - (by / 100 >> 2))
+-  /* + difference in years * 365 */
+-		+ (long) (ay - by) * 365
+-  );
+-  return (60 * (60 * (24 * days + (a->tm_hour - b->tm_hour))
+-		+ (a->tm_min - b->tm_min))
+-	  + (a->tm_sec - b->tm_sec));
+-}
+-
+ time_t get_date (const char *p, const time_t *now)
+ {
+-  struct tm tm, tm0, *tmp;
++  struct tm  tm, *tmp;
+   time_t Start;
+ 
+   yyInput = p;
+   Start = now ? *now : time(NULL);
+-  tmp = localtime (&Start);
++  tmp = gmtime(&Start);
+   yyYear = tmp->tm_year + TM_YEAR_ORIGIN;
+   yyMonth = tmp->tm_mon + 1;
+   yyDay = tmp->tm_mday;
+@@ -841,10 +672,9 @@ time_t get_date (const char *p, const time_t *now)
+   yyHaveDay = 0;
+   yyHaveRel = 0;
+   yyHaveTime = 0;
+-  yyHaveZone = 0;
+ 
+   if (yyparse ()
+-      || yyHaveTime > 1 || yyHaveZone > 1 || yyHaveDate > 1 || yyHaveDay > 1)
++      || yyHaveTime > 1 || yyHaveDate > 1 || yyHaveDay > 1)
+     return -1;
+ 
+   tm.tm_year = ToYear (yyYear) - TM_YEAR_ORIGIN + yyRelYear;
+@@ -866,39 +696,12 @@ time_t get_date (const char *p, const time_t *now)
+   tm.tm_hour += yyRelHour;
+   tm.tm_min += yyRelMinutes;
+   tm.tm_sec += yyRelSeconds;
+-  tm.tm_isdst = -1;
+-  tm0 = tm;
++  tm.tm_isdst = 0;
+ 
+-  Start = mktime (&tm);
++  Start = timegm(&tm);
+ 
+   if (Start == (time_t) -1)
+     {
+-
+-      /* Guard against falsely reporting errors near the time_t boundaries
+-         when parsing times in other time zones.  For example, if the min
+-         time_t value is 1970-01-01 00:00:00 UTC and we are 8 hours ahead
+-         of UTC, then the min localtime value is 1970-01-01 08:00:00; if
+-         we apply mktime to 1970-01-01 00:00:00 we will get an error, so
+-         we apply mktime to 1970-01-02 08:00:00 instead and adjust the time
+-         zone by 24 hours to compensate.  This algorithm assumes that
+-         there is no DST transition within a day of the time_t boundaries.  */
+-      if (yyHaveZone)
+-	{
+-	  tm = tm0;
+-	  if (tm.tm_year <= EPOCH - TM_YEAR_ORIGIN)
+-	    {
+-	      tm.tm_mday++;
+-	      yyTimezone -= 24 * 60;
+-	    }
+-	  else
+-	    {
+-	      tm.tm_mday--;
+-	      yyTimezone += 24 * 60;
+-	    }
+-	  Start = mktime (&tm);
+-	}
+-
+-      if (Start == (time_t) -1)
+ 	return Start;
+     }
+ 
+@@ -906,19 +709,11 @@ time_t get_date (const char *p, const time_t *now)
+     {
+       tm.tm_mday += ((yyDayNumber - tm.tm_wday + 7) % 7
+ 		     + 7 * (yyDayOrdinal - (0 < yyDayOrdinal)));
+-      Start = mktime (&tm);
++      Start = timegm(&tm);
+       if (Start == (time_t) -1)
+ 	return Start;
+     }
+ 
+-  if (yyHaveZone)
+-    {
+-      long delta = yyTimezone * 60L + difftm (&tm, gmtime (&Start));
+-      if ((Start + delta < Start) != (delta < 0))
+-	return -1;		/* time_t overflow */
+-      Start += delta;
+-    }
+-
+   return Start;
+ }
+ 

debian/patches/upstream/src-chfn.c-Add-local-variable-to-refer-to-the-separated-f.patch

@@ -0,0 +1,37 @@
+From: Alejandro Colomar <alx@kernel.org>
+Date: Mon, 17 Feb 2025 13:44:55 +0100
+Subject: src/chfn.c: Add local variable to refer to the separated field
+
+Signed-off-by: Alejandro Colomar <alx@kernel.org>
+---
+ src/chfn.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/src/chfn.c b/src/chfn.c
+index 1799d6b..3fc94dc 100644
+--- a/src/chfn.c
++++ b/src/chfn.c
+@@ -220,18 +220,20 @@ static char *copy_field (char *in, char *out, char *extra)
+ 	char *cp = NULL;
+ 
+ 	while (NULL != in) {
++		const char  *f;
++
++		f = in;
+ 		cp = stpsep(in, ",");
+ 
+-		if (strchr (in, '=') == NULL) {
++		if (strchr(f, '=') == NULL)
+ 			break;
+-		}
+ 
+ 		if (NULL != extra) {
+ 			if (!streq(extra, "")) {
+ 				strcat (extra, ",");
+ 			}
+ 
+-			strcat (extra, in);
++			strcat(extra, f);
+ 		}
+ 		in = cp;
+ 	}

debian/patches/upstream/src-chfn.c-Partially-revert-lib-src-Use-strsep-3-instead-.patch

@@ -0,0 +1,67 @@
+From: Alejandro Colomar <alx@kernel.org>
+Date: Mon, 17 Feb 2025 13:23:37 +0100
+Subject: src/chfn.c: Partially revert "lib/,
+ src/: Use strsep(3) instead of its pattern"
+
+This partially reverts commit 16cb664865541162c504a6f5ef5ca4b38b5e0c9a.
+
+I'll try to reintroduce this change more carefully.
+For now, let's revert to a known-good state.
+
+The problem was due to accidentally ignoring the effects of the 'break'
+on the 'cp' variable.
+
+Fixes: 16cb66486554 (2024-07-01; "lib/, src/: Use strsep(3) instead of its pattern")
+Closes: <https://github.com/shadow-maint/shadow/issues/1210>
+Link: <https://github.com/shadow-maint/shadow/pull/1213>
+Link: <https://github.com/shadow-maint/shadow/pull/1212>
+Reported-by: Chris Hofstaedtler <zeha@debian.org>
+Suggested-by: Chris Hofstaedtler <zeha@debian.org>
+Signed-off-by: Alejandro Colomar <alx@kernel.org>
+---
+ src/chfn.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/src/chfn.c b/src/chfn.c
+index 4c96fba..f06cb44 100644
+--- a/src/chfn.c
++++ b/src/chfn.c
+@@ -216,27 +216,32 @@ static void new_fields (void)
+  */
+ static char *copy_field (char *in, char *out, char *extra)
+ {
+-	while (NULL != in) {
+-		char  *f;
++	char *cp = NULL;
+ 
+-		f = strsep(&in, ",");
++	while (NULL != in) {
++		cp = strchr (in, ',');
++		if (NULL != cp) {
++			*cp++ = '\0';
++		}
+ 
+-		if (strchr(f, '=') == NULL)
++		if (strchr (in, '=') == NULL) {
+ 			break;
++		}
+ 
+ 		if (NULL != extra) {
+ 			if (!streq(extra, "")) {
+ 				strcat (extra, ",");
+ 			}
+ 
+-			strcat(extra, f);
++			strcat (extra, in);
+ 		}
++		in = cp;
+ 	}
+ 	if ((NULL != in) && (NULL != out)) {
+ 		strcpy (out, in);
+ 	}
+ 
+-	return in;
++	return cp;
+ }
+ 
+ /*

debian/patches/upstream/src-chfn.c-Use-stpsep-instead-of-its-pattern.patch

@@ -0,0 +1,33 @@
+From: Alejandro Colomar <alx@kernel.org>
+Date: Mon, 17 Feb 2025 13:40:02 +0100
+Subject: src/chfn.c: Use stpsep() instead of its pattern
+
+Signed-off-by: Alejandro Colomar <alx@kernel.org>
+---
+ src/chfn.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/src/chfn.c b/src/chfn.c
+index f06cb44..1799d6b 100644
+--- a/src/chfn.c
++++ b/src/chfn.c
+@@ -36,6 +36,7 @@
+ #include "string/strcmp/streq.h"
+ #include "string/strcpy/strtcpy.h"
+ #include "string/strdup/xstrdup.h"
++#include "string/strtok/stpsep.h"
+ 
+ 
+ /*
+@@ -219,10 +220,7 @@ static char *copy_field (char *in, char *out, char *extra)
+ 	char *cp = NULL;
+ 
+ 	while (NULL != in) {
+-		cp = strchr (in, ',');
+-		if (NULL != cp) {
+-			*cp++ = '\0';
+-		}
++		cp = stpsep(in, ",");
+ 
+ 		if (strchr (in, '=') == NULL) {
+ 			break;

debian/patches/upstream/src-chfn.c-copy_field-Rename-local-variable.patch

@@ -0,0 +1,47 @@
+From: Alejandro Colomar <alx@kernel.org>
+Date: Mon, 17 Feb 2025 15:33:46 +0100
+Subject: src/chfn.c: copy_field(): Rename local variable
+
+This makes it more obvious what that pointer is.
+
+Signed-off-by: Alejandro Colomar <alx@kernel.org>
+---
+ src/chfn.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/chfn.c b/src/chfn.c
+index 3fc94dc..d62bb8a 100644
+--- a/src/chfn.c
++++ b/src/chfn.c
+@@ -217,13 +217,13 @@ static void new_fields (void)
+  */
+ static char *copy_field (char *in, char *out, char *extra)
+ {
+-	char *cp = NULL;
++	char *next = NULL;
+ 
+ 	while (NULL != in) {
+ 		const char  *f;
+ 
+ 		f = in;
+-		cp = stpsep(in, ",");
++		next = stpsep(in, ",");
+ 
+ 		if (strchr(f, '=') == NULL)
+ 			break;
+@@ -235,13 +235,13 @@ static char *copy_field (char *in, char *out, char *extra)
+ 
+ 			strcat(extra, f);
+ 		}
+-		in = cp;
++		in = next;
+ 	}
+ 	if ((NULL != in) && (NULL != out)) {
+ 		strcpy (out, in);
+ 	}
+ 
+-	return cp;
++	return next;
+ }
+ 
+ /*

debian/rules

@@ -0,0 +1,62 @@
+#!/usr/bin/make -f
+# -*- mode: makefile; coding: utf-8 -*-
+
+# Enable PIE, BINDNOW, and possible future flags.
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+DPKG_EXPORT_BUILDFLAGS = 1
+include /usr/share/dpkg/architecture.mk
+include /usr/share/dpkg/buildflags.mk
+include /usr/share/debhelper/dh_package_notes/package-notes.mk
+
+# Adds extra options when calling the configure script:
+DEB_CONFIGURE_EXTRA_FLAGS := \
+	--bindir=/usr/bin \
+	--sbindir=/usr/sbin \
+	--mandir=/usr/share/man \
+	--with-libpam \
+	--with-yescrypt \
+	--enable-shadowgrp \
+	--enable-subordinate-ids \
+	--enable-lastlog=no \
+	--enable-man \
+	--disable-account-tools-setuid \
+	--with-group-name-max-length=32 \
+	--with-acl \
+	--with-attr \
+	--without-su \
+	--without-tcb \
+
+
+ifeq ($(DEB_HOST_ARCH_OS),linux)
+DEB_CONFIGURE_EXTRA_FLAGS += --with-audit
+DEB_CONFIGURE_EXTRA_FLAGS += --with-btrfs
+endif
+
+ifneq ($(filter nodoc,$(DEB_BUILD_PROFILES)),)
+DEB_CONFIGURE_EXTRA_FLAGS += --disable-man
+endif
+
+DEB_CONFIGURE_EXTRA_FLAGS += SHELL=/bin/sh
+
+# Set the default editor for vipw/vigr
+CFLAGS += -DDEFAULT_EDITOR="\"sensible-editor\""
+
+%:
+	dh $@
+
+execute_after_dh_auto_clean:
+	# rebuild lib/getdate.c
+	rm -f lib/getdate.c
+
+override_dh_auto_configure:
+	dh_auto_configure -- $(DEB_CONFIGURE_EXTRA_FLAGS)
+
+override_dh_installpam:
+	# Distribute the pam.d files; unless for the commands with disabled PAM
+	# support
+	dh_installpam -p passwd --name=passwd
+	dh_installpam -p passwd --name=chfn
+	dh_installpam -p passwd --name=chsh
+	dh_installpam -p passwd --name=chpasswd
+	dh_installpam -p passwd --name=newusers
+

debian/salsa-ci.yml

@@ -0,0 +1,40 @@
+---
+include: https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
+
+extract-source:
+  extends: .provisioning-extract-source
+
+variables:
+  RELEASE: 'unstable'
+
+build:
+  extends: .build-package
+
+test-build-any:
+  extends: .test-build-package-any
+
+test-build-all:
+  extends: .test-build-package-all
+
+lintian:
+  extends: .test-lintian
+
+autopkgtest:
+  extends: .test-autopkgtest
+
+blhc:
+  extends: .test-blhc
+
+reprotest:
+  extends: .test-reprotest
+
+variables:
+  SALSA_CI_ENABLE_BUILD_PACKAGE_PROFILES: 1
+
+test-build-profiles:
+  extends: .test-build-package-profiles
+  parallel:
+    matrix:
+      - BUILD_PROFILES: nocheck
+      - BUILD_PROFILES: nodoc
+

debian/shadowconfig

@@ -0,0 +1,56 @@
+#!/bin/sh
+# turn shadow passwords on on a Debian system
+
+set -e
+
+shadowon () {
+    set -e
+
+    if [ -n "$DPKG_ROOT" ] \
+        && cmp "${DPKG_ROOT}/etc/passwd" "${DPKG_ROOT}/usr/share/base-passwd/passwd.master" 2>/dev/null \
+        && cmp "${DPKG_ROOT}/etc/group" "${DPKG_ROOT}/usr/share/base-passwd/group.master" 2>/dev/null; then
+        # If dpkg is run with --force-script-chrootless and if /etc/passwd
+        # and /etc/group are unchanged, we avoid the chroot() call by manually
+        # processing the files. This produces bit-by-bit identical results
+        # compared to the normal case as shown by the CI setup at
+        # https://salsa.debian.org/helmutg/dpkg-root-demo/-/jobs
+        for f in passwd group; do
+            cp -a "${DPKG_ROOT}/etc/$f" "${DPKG_ROOT}/etc/$f-"
+        done
+        chmod 600 "${DPKG_ROOT}/etc/passwd-"
+        sed -i 's/^\([^:]\+\):\*:/\1:x:/' "${DPKG_ROOT}/etc/group" "${DPKG_ROOT}/etc/passwd"
+        [ -n "$SOURCE_DATE_EPOCH" ] && epoch=$SOURCE_DATE_EPOCH || epoch=$(date +%s)
+        sed "s/^\([^:]\+\):.*/\1:*:$((epoch/60/60/24)):0:99999:7:::/" "${DPKG_ROOT}/etc/passwd" > "${DPKG_ROOT}/etc/shadow"
+        sed "s/^\([^:]\+\):.*/\1:*::/" "${DPKG_ROOT}/etc/group" > "${DPKG_ROOT}/etc/gshadow"
+        touch "${DPKG_ROOT}/etc/.pwd.lock"
+        chmod 600 "${DPKG_ROOT}/etc/.pwd.lock"
+    else
+        pwck -q -r
+        grpck -r
+        pwconv
+        grpconv
+    fi
+    chown root:root "${DPKG_ROOT}/etc/passwd" "${DPKG_ROOT}/etc/group"
+    chmod 644 "${DPKG_ROOT}/etc/passwd" "${DPKG_ROOT}/etc/group"
+    chown root:shadow "${DPKG_ROOT}/etc/shadow" "${DPKG_ROOT}/etc/gshadow"
+    chmod 640 "${DPKG_ROOT}/etc/shadow" "${DPKG_ROOT}/etc/gshadow"
+}
+
+
+case "$1" in
+    "on")
+	if shadowon ; then
+	    echo Shadow passwords are now on.
+	else
+	    echo Please correct the error and rerun \`$0 on\'
+	    exit 1
+	fi
+	;;
+    "off")
+	echo E: Turning shadow passwords off is no longer supported.
+	exit 1
+	;;
+     *)
+	echo Usage: $0 on
+	;;
+esac

debian/shlibs.local

@@ -0,0 +1 @@
+deb: libsubid 5 libsubid5 (= ${binary:Version})

debian/source/format

@@ -0,0 +1 @@
+3.0 (quilt)

debian/source/lintian-overrides

@@ -0,0 +1,6 @@
+# debputy does not need misc:Depends
+debhelper-but-no-misc-depends libsubid-dev
+debhelper-but-no-misc-depends libsubid5
+debhelper-but-no-misc-depends login.defs
+debhelper-but-no-misc-depends passwd
+debhelper-but-no-misc-depends uidmap

debian/tests/control

@@ -0,0 +1,10 @@
+Tests: smoke
+Restrictions: needs-root, superficial
+
+Tests: upstream
+Depends:
+ expect,
+ procps,
+ @,
+ @builddeps@
+Restrictions: needs-root, build-needed, breaks-testbed, allow-stderr, isolation-machine

debian/tests/smoke

@@ -0,0 +1,24 @@
+#!/bin/sh
+
+set -e
+
+echo "Adding a user works"
+useradd shadow-test-user
+grep '^shadow-test-user:x:' /etc/passwd
+grep '^shadow-test-user:!:' /etc/shadow
+
+# Regression test for #1096187. adduser uses this sequence.
+echo "Changing a users name and work phone number works"
+chfn "-f" "foo" "-r" "" shadow-test-user
+chfn -w "" shadow-test-user
+
+# Regression test for #1095430
+TZ=Asia/Tokyo usermod --expiredate 1970-01-02 shadow-test-user
+TZ=Asia/Tokyo LC_ALL=C chage -l shadow-test-user | grep 'Account expires'
+# We expect 1970-01-02, as passed.
+TZ=Asia/Tokyo LC_ALL=C chage -l shadow-test-user | grep -P '^Account expires.*Jan 02, 1970'
+
+echo "Removing a user works"
+userdel shadow-test-user
+! grep 'shadow-test-user' /etc/passwd
+! grep 'shadow-test-user' /etc/shadow

debian/tests/upstream

@@ -0,0 +1,15 @@
+#!/bin/sh
+useradd ubuntu
+
+export BUILD_BASE_DIR=$(pwd)
+
+cd tests
+
+cleanup() {
+  cp testsuite.log $AUTOPKGTEST_ARTIFACTS/
+  cat testsuite.log
+}
+
+trap cleanup TERM EXIT
+
+./run_some 2>&1

debian/uidmap.install

@@ -0,0 +1,3 @@
+usr/bin/getsubids
+usr/bin/newgidmap
+usr/bin/newuidmap

debian/uidmap.lintian-overrides

@@ -0,0 +1,2 @@
+uidmap: elevated-privileges 4755 root/root [usr/bin/newgidmap]
+uidmap: elevated-privileges 4755 root/root [usr/bin/newuidmap]

debian/uidmap.manpages

@@ -0,0 +1,5 @@
+usr/share/man/*/man1/newgidmap.1
+usr/share/man/*/man1/newuidmap.1
+usr/share/man/man1/getsubids.1
+usr/share/man/man1/newgidmap.1
+usr/share/man/man1/newuidmap.1

debian/upstream/metadata

@@ -0,0 +1,4 @@
+---
+Bug-Database: https://github.com/shadow-maint/shadow/issues
+Bug-Submit: https://github.com/shadow-maint/shadow/issues/new
+Repository-Browse: https://github.com/shadow-maint/shadow

debian/watch

@@ -0,0 +1,7 @@
+version=4
+opts=downloadurlmangle=s/archive\/refs\/tags\/(.*)\.tar\.gz/releases\/download\/$1\/@PACKAGE@-$1\.tar\.xz/,\
+    pgpsigurlmangle=s/$/.asc/,\
+    versionmangle=s/-(alpha|beta|rc)/~$1/,\
+    dversionmangle=s/\+dfsg1//,repacksuffix=+dfsg1 \
+    https://github.com/shadow-maint/@PACKAGE@/tags \
+    /shadow-maint/@PACKAGE@/archive/refs/tags/([^v].*)\.tar\.gz

doc/HOWTO

@@ -1751,7 +1751,7 @@
       }
   #ifdef HAS_SHADOW
       if ((pw->pw_passwd && pw->pw_passwd[0] == '@'
-           && pw_auth (pw->pw_passwd+1, pw->pw_name, PW_LOGIN, NULL))
+           && pw_auth(pw->pw_passwd+1, pw->pw_name))
           || !valid (passwd, pw)) {
           return (UPAP_AUTHNAK);
       }

etc/pam.d/Makefile.am

@@ -11,7 +11,6 @@ pamd_files = \
 	passwd
 
 pamd_acct_tools_files = \
-	chage \
 	chgpasswd \
 	groupadd \
 	groupdel \

etc/pam.d/Makefile.in

@@ -342,7 +342,6 @@ top_srcdir = @top_srcdir@
 pamd_files = chpasswd chfn chsh groupmems login newusers passwd \
 	$(am__append_2)
 pamd_acct_tools_files = \
-	chage \
 	chgpasswd \
 	groupadd \
 	groupdel \

etc/pam.d/chage

@@ -1,4 +0,0 @@
-#%PAM-1.0
-auth		sufficient	pam_rootok.so
-account		required	pam_permit.so
-password	include		system-auth

lib/Makefile.am

@@ -155,6 +155,14 @@ libshadow_la_SOURCES = \
 	run_part.h \
 	run_part.c \
 	salt.c \
+	search/cmp/cmp.c \
+	search/cmp/cmp.h \
+	search/l/lfind.c \
+	search/l/lfind.h \
+	search/l/lsearch.c \
+	search/l/lsearch.h \
+	search/sort/qsort.c \
+	search/sort/qsort.h \
 	selinux.c \
 	semanage.c \
 	setugid.c \
@@ -165,6 +173,8 @@ libshadow_la_SOURCES = \
 	sgroupio.c \
 	sgroupio.h\
 	shadow.c \
+	shadow/grp/agetgroups.c \
+	shadow/grp/agetgroups.h \
 	shadowio.c \
 	shadowio.h \
 	shadowlog.c \
@@ -176,6 +186,8 @@ libshadow_la_SOURCES = \
 	spawn.c \
 	sssd.c \
 	sssd.h \
+	string/ctype/strisascii/strisdigit.c \
+	string/ctype/strisascii/strisdigit.h \
 	string/memset/memzero.c \
 	string/memset/memzero.h \
 	string/sprintf/snprintf.c \
@@ -186,12 +198,12 @@ libshadow_la_SOURCES = \
 	string/sprintf/xasprintf.h \
 	string/strchr/strchrcnt.c \
 	string/strchr/strchrcnt.h \
-	string/strchr/stpspn.c \
-	string/strchr/stpspn.h \
+	string/strchr/strchrscnt.c \
+	string/strchr/strchrscnt.h \
 	string/strchr/strnul.c \
 	string/strchr/strnul.h \
-	string/strchr/strrspn.c \
-	string/strchr/strrspn.h \
+	string/strcmp/strcaseeq.c \
+	string/strcmp/strcaseeq.h \
 	string/strcmp/streq.c \
 	string/strcmp/streq.h \
 	string/strcpy/stpecpy.c \
@@ -210,6 +222,16 @@ libshadow_la_SOURCES = \
 	string/strdup/xstrndup.h \
 	string/strftime.c \
 	string/strftime.h \
+	string/strspn/stpspn.c \
+	string/strspn/stpspn.h \
+	string/strspn/stprcspn.c \
+	string/strspn/stprcspn.h \
+	string/strspn/stprspn.c \
+	string/strspn/stprspn.h \
+	string/strspn/strrcspn.c \
+	string/strspn/strrcspn.h \
+	string/strspn/strrspn.c \
+	string/strspn/strrspn.h \
 	string/strtok/stpsep.c \
 	string/strtok/stpsep.h \
 	strtoday.c \

lib/Makefile.in

@@ -151,19 +151,24 @@ am__libshadow_la_SOURCES_DIST = addgrps.c adds.c adds.h age.c \
 	pam_defs.h pam_pass.c pam_pass_non_interactive.c port.c port.h \
 	prefix_flag.c prototypes.h pwauth.c pwauth.h pwio.c pwio.h \
 	pwd_init.c pwd2spwd.c pwdcheck.c pwmem.c remove_tree.c \
-	root_flag.c run_part.h run_part.c salt.c selinux.c semanage.c \
-	setugid.c setupenv.c sgetgrent.c sgetpwent.c sgetspent.c \
-	sgroupio.c sgroupio.h shadow.c shadowio.c shadowio.h \
-	shadowlog.c shadowlog.h shadowlog_internal.h shadowmem.c \
-	shell.c sizeof.h spawn.c sssd.c sssd.h string/memset/memzero.c \
+	root_flag.c run_part.h run_part.c salt.c search/cmp/cmp.c \
+	search/cmp/cmp.h search/l/lfind.c search/l/lfind.h \
+	search/l/lsearch.c search/l/lsearch.h search/sort/qsort.c \
+	search/sort/qsort.h selinux.c semanage.c setugid.c setupenv.c \
+	sgetgrent.c sgetpwent.c sgetspent.c sgroupio.c sgroupio.h \
+	shadow.c shadow/grp/agetgroups.c shadow/grp/agetgroups.h \
+	shadowio.c shadowio.h shadowlog.c shadowlog.h \
+	shadowlog_internal.h shadowmem.c shell.c sizeof.h spawn.c \
+	sssd.c sssd.h string/ctype/strisascii/strisdigit.c \
+	string/ctype/strisascii/strisdigit.h string/memset/memzero.c \
 	string/memset/memzero.h string/sprintf/snprintf.c \
 	string/sprintf/snprintf.h string/sprintf/stpeprintf.c \
 	string/sprintf/stpeprintf.h string/sprintf/xasprintf.c \
 	string/sprintf/xasprintf.h string/strchr/strchrcnt.c \
-	string/strchr/strchrcnt.h string/strchr/stpspn.c \
-	string/strchr/stpspn.h string/strchr/strnul.c \
-	string/strchr/strnul.h string/strchr/strrspn.c \
-	string/strchr/strrspn.h string/strcmp/streq.c \
+	string/strchr/strchrcnt.h string/strchr/strchrscnt.c \
+	string/strchr/strchrscnt.h string/strchr/strnul.c \
+	string/strchr/strnul.h string/strcmp/strcaseeq.c \
+	string/strcmp/strcaseeq.h string/strcmp/streq.c \
 	string/strcmp/streq.h string/strcpy/stpecpy.c \
 	string/strcpy/stpecpy.h string/strcpy/strncat.c \
 	string/strcpy/strncat.h string/strcpy/strncpy.c \
@@ -172,6 +177,11 @@ am__libshadow_la_SOURCES_DIST = addgrps.c adds.c adds.h age.c \
 	string/strdup/strndupa.h string/strdup/xstrdup.c \
 	string/strdup/xstrdup.h string/strdup/xstrndup.c \
 	string/strdup/xstrndup.h string/strftime.c string/strftime.h \
+	string/strspn/stpspn.c string/strspn/stpspn.h \
+	string/strspn/stprcspn.c string/strspn/stprcspn.h \
+	string/strspn/stprspn.c string/strspn/stprspn.h \
+	string/strspn/strrcspn.c string/strspn/strrcspn.h \
+	string/strspn/strrspn.c string/strspn/strrspn.h \
 	string/strtok/stpsep.c string/strtok/stpsep.h strtoday.c sub.c \
 	subordinateio.h subordinateio.c sulog.c time/day_to_str.c \
 	time/day_to_str.h ttytype.c typetraits.h tz.c ulimit.c \
@@ -235,22 +245,27 @@ am_libshadow_la_OBJECTS = libshadow_la-addgrps.lo libshadow_la-adds.lo \
 	libshadow_la-pwd2spwd.lo libshadow_la-pwdcheck.lo \
 	libshadow_la-pwmem.lo libshadow_la-remove_tree.lo \
 	libshadow_la-root_flag.lo libshadow_la-run_part.lo \
-	libshadow_la-salt.lo libshadow_la-selinux.lo \
+	libshadow_la-salt.lo search/cmp/libshadow_la-cmp.lo \
+	search/l/libshadow_la-lfind.lo \
+	search/l/libshadow_la-lsearch.lo \
+	search/sort/libshadow_la-qsort.lo libshadow_la-selinux.lo \
 	libshadow_la-semanage.lo libshadow_la-setugid.lo \
 	libshadow_la-setupenv.lo libshadow_la-sgetgrent.lo \
 	libshadow_la-sgetpwent.lo libshadow_la-sgetspent.lo \
 	libshadow_la-sgroupio.lo libshadow_la-shadow.lo \
-	libshadow_la-shadowio.lo libshadow_la-shadowlog.lo \
-	libshadow_la-shadowmem.lo libshadow_la-shell.lo \
-	libshadow_la-spawn.lo libshadow_la-sssd.lo \
+	shadow/grp/libshadow_la-agetgroups.lo libshadow_la-shadowio.lo \
+	libshadow_la-shadowlog.lo libshadow_la-shadowmem.lo \
+	libshadow_la-shell.lo libshadow_la-spawn.lo \
+	libshadow_la-sssd.lo \
+	string/ctype/strisascii/libshadow_la-strisdigit.lo \
 	string/memset/libshadow_la-memzero.lo \
 	string/sprintf/libshadow_la-snprintf.lo \
 	string/sprintf/libshadow_la-stpeprintf.lo \
 	string/sprintf/libshadow_la-xasprintf.lo \
 	string/strchr/libshadow_la-strchrcnt.lo \
-	string/strchr/libshadow_la-stpspn.lo \
+	string/strchr/libshadow_la-strchrscnt.lo \
 	string/strchr/libshadow_la-strnul.lo \
-	string/strchr/libshadow_la-strrspn.lo \
+	string/strcmp/libshadow_la-strcaseeq.lo \
 	string/strcmp/libshadow_la-streq.lo \
 	string/strcpy/libshadow_la-stpecpy.lo \
 	string/strcpy/libshadow_la-strncat.lo \
@@ -260,6 +275,11 @@ am_libshadow_la_OBJECTS = libshadow_la-addgrps.lo libshadow_la-adds.lo \
 	string/strdup/libshadow_la-xstrdup.lo \
 	string/strdup/libshadow_la-xstrndup.lo \
 	string/libshadow_la-strftime.lo \
+	string/strspn/libshadow_la-stpspn.lo \
+	string/strspn/libshadow_la-stprcspn.lo \
+	string/strspn/libshadow_la-stprspn.lo \
+	string/strspn/libshadow_la-strrcspn.lo \
+	string/strspn/libshadow_la-strrspn.lo \
 	string/strtok/libshadow_la-stpsep.lo libshadow_la-strtoday.lo \
 	libshadow_la-sub.lo libshadow_la-subordinateio.lo \
 	libshadow_la-sulog.lo time/libshadow_la-day_to_str.lo \
@@ -420,15 +440,21 @@ am__depfiles_remade = ./$(DEPDIR)/libshadow_la-addgrps.Plo \
 	atoi/strtoi/$(DEPDIR)/libshadow_la-strtou_noneg.Plo \
 	fs/readlink/$(DEPDIR)/libshadow_la-areadlink.Plo \
 	fs/readlink/$(DEPDIR)/libshadow_la-readlinknul.Plo \
+	search/cmp/$(DEPDIR)/libshadow_la-cmp.Plo \
+	search/l/$(DEPDIR)/libshadow_la-lfind.Plo \
+	search/l/$(DEPDIR)/libshadow_la-lsearch.Plo \
+	search/sort/$(DEPDIR)/libshadow_la-qsort.Plo \
+	shadow/grp/$(DEPDIR)/libshadow_la-agetgroups.Plo \
 	string/$(DEPDIR)/libshadow_la-strftime.Plo \
+	string/ctype/strisascii/$(DEPDIR)/libshadow_la-strisdigit.Plo \
 	string/memset/$(DEPDIR)/libshadow_la-memzero.Plo \
 	string/sprintf/$(DEPDIR)/libshadow_la-snprintf.Plo \
 	string/sprintf/$(DEPDIR)/libshadow_la-stpeprintf.Plo \
 	string/sprintf/$(DEPDIR)/libshadow_la-xasprintf.Plo \
-	string/strchr/$(DEPDIR)/libshadow_la-stpspn.Plo \
 	string/strchr/$(DEPDIR)/libshadow_la-strchrcnt.Plo \
+	string/strchr/$(DEPDIR)/libshadow_la-strchrscnt.Plo \
 	string/strchr/$(DEPDIR)/libshadow_la-strnul.Plo \
-	string/strchr/$(DEPDIR)/libshadow_la-strrspn.Plo \
+	string/strcmp/$(DEPDIR)/libshadow_la-strcaseeq.Plo \
 	string/strcmp/$(DEPDIR)/libshadow_la-streq.Plo \
 	string/strcpy/$(DEPDIR)/libshadow_la-stpecpy.Plo \
 	string/strcpy/$(DEPDIR)/libshadow_la-strncat.Plo \
@@ -437,6 +463,11 @@ am__depfiles_remade = ./$(DEPDIR)/libshadow_la-addgrps.Plo \
 	string/strdup/$(DEPDIR)/libshadow_la-strndupa.Plo \
 	string/strdup/$(DEPDIR)/libshadow_la-xstrdup.Plo \
 	string/strdup/$(DEPDIR)/libshadow_la-xstrndup.Plo \
+	string/strspn/$(DEPDIR)/libshadow_la-stprcspn.Plo \
+	string/strspn/$(DEPDIR)/libshadow_la-stprspn.Plo \
+	string/strspn/$(DEPDIR)/libshadow_la-stpspn.Plo \
+	string/strspn/$(DEPDIR)/libshadow_la-strrcspn.Plo \
+	string/strspn/$(DEPDIR)/libshadow_la-strrspn.Plo \
 	string/strtok/$(DEPDIR)/libshadow_la-stpsep.Plo \
 	time/$(DEPDIR)/libshadow_la-day_to_str.Plo
 am__mv = mv -f
@@ -712,19 +743,24 @@ libshadow_la_SOURCES = addgrps.c adds.c adds.h age.c agetpass.c \
 	pam_defs.h pam_pass.c pam_pass_non_interactive.c port.c port.h \
 	prefix_flag.c prototypes.h pwauth.c pwauth.h pwio.c pwio.h \
 	pwd_init.c pwd2spwd.c pwdcheck.c pwmem.c remove_tree.c \
-	root_flag.c run_part.h run_part.c salt.c selinux.c semanage.c \
-	setugid.c setupenv.c sgetgrent.c sgetpwent.c sgetspent.c \
-	sgroupio.c sgroupio.h shadow.c shadowio.c shadowio.h \
-	shadowlog.c shadowlog.h shadowlog_internal.h shadowmem.c \
-	shell.c sizeof.h spawn.c sssd.c sssd.h string/memset/memzero.c \
+	root_flag.c run_part.h run_part.c salt.c search/cmp/cmp.c \
+	search/cmp/cmp.h search/l/lfind.c search/l/lfind.h \
+	search/l/lsearch.c search/l/lsearch.h search/sort/qsort.c \
+	search/sort/qsort.h selinux.c semanage.c setugid.c setupenv.c \
+	sgetgrent.c sgetpwent.c sgetspent.c sgroupio.c sgroupio.h \
+	shadow.c shadow/grp/agetgroups.c shadow/grp/agetgroups.h \
+	shadowio.c shadowio.h shadowlog.c shadowlog.h \
+	shadowlog_internal.h shadowmem.c shell.c sizeof.h spawn.c \
+	sssd.c sssd.h string/ctype/strisascii/strisdigit.c \
+	string/ctype/strisascii/strisdigit.h string/memset/memzero.c \
 	string/memset/memzero.h string/sprintf/snprintf.c \
 	string/sprintf/snprintf.h string/sprintf/stpeprintf.c \
 	string/sprintf/stpeprintf.h string/sprintf/xasprintf.c \
 	string/sprintf/xasprintf.h string/strchr/strchrcnt.c \
-	string/strchr/strchrcnt.h string/strchr/stpspn.c \
-	string/strchr/stpspn.h string/strchr/strnul.c \
-	string/strchr/strnul.h string/strchr/strrspn.c \
-	string/strchr/strrspn.h string/strcmp/streq.c \
+	string/strchr/strchrcnt.h string/strchr/strchrscnt.c \
+	string/strchr/strchrscnt.h string/strchr/strnul.c \
+	string/strchr/strnul.h string/strcmp/strcaseeq.c \
+	string/strcmp/strcaseeq.h string/strcmp/streq.c \
 	string/strcmp/streq.h string/strcpy/stpecpy.c \
 	string/strcpy/stpecpy.h string/strcpy/strncat.c \
 	string/strcpy/strncat.h string/strcpy/strncpy.c \
@@ -733,6 +769,11 @@ libshadow_la_SOURCES = addgrps.c adds.c adds.h age.c agetpass.c \
 	string/strdup/strndupa.h string/strdup/xstrdup.c \
 	string/strdup/xstrdup.h string/strdup/xstrndup.c \
 	string/strdup/xstrndup.h string/strftime.c string/strftime.h \
+	string/strspn/stpspn.c string/strspn/stpspn.h \
+	string/strspn/stprcspn.c string/strspn/stprcspn.h \
+	string/strspn/stprspn.c string/strspn/stprspn.h \
+	string/strspn/strrcspn.c string/strspn/strrcspn.h \
+	string/strspn/strrspn.c string/strspn/strrspn.h \
 	string/strtok/stpsep.c string/strtok/stpsep.h strtoday.c sub.c \
 	subordinateio.h subordinateio.c sulog.c time/day_to_str.c \
 	time/day_to_str.h ttytype.c typetraits.h tz.c ulimit.c \
@@ -883,6 +924,49 @@ fs/readlink/libshadow_la-areadlink.lo: fs/readlink/$(am__dirstamp) \
 	fs/readlink/$(DEPDIR)/$(am__dirstamp)
 fs/readlink/libshadow_la-readlinknul.lo: fs/readlink/$(am__dirstamp) \
 	fs/readlink/$(DEPDIR)/$(am__dirstamp)
+search/cmp/$(am__dirstamp):
+	@$(MKDIR_P) search/cmp
+	@: > search/cmp/$(am__dirstamp)
+search/cmp/$(DEPDIR)/$(am__dirstamp):
+	@$(MKDIR_P) search/cmp/$(DEPDIR)
+	@: > search/cmp/$(DEPDIR)/$(am__dirstamp)
+search/cmp/libshadow_la-cmp.lo: search/cmp/$(am__dirstamp) \
+	search/cmp/$(DEPDIR)/$(am__dirstamp)
+search/l/$(am__dirstamp):
+	@$(MKDIR_P) search/l
+	@: > search/l/$(am__dirstamp)
+search/l/$(DEPDIR)/$(am__dirstamp):
+	@$(MKDIR_P) search/l/$(DEPDIR)
+	@: > search/l/$(DEPDIR)/$(am__dirstamp)
+search/l/libshadow_la-lfind.lo: search/l/$(am__dirstamp) \
+	search/l/$(DEPDIR)/$(am__dirstamp)
+search/l/libshadow_la-lsearch.lo: search/l/$(am__dirstamp) \
+	search/l/$(DEPDIR)/$(am__dirstamp)
+search/sort/$(am__dirstamp):
+	@$(MKDIR_P) search/sort
+	@: > search/sort/$(am__dirstamp)
+search/sort/$(DEPDIR)/$(am__dirstamp):
+	@$(MKDIR_P) search/sort/$(DEPDIR)
+	@: > search/sort/$(DEPDIR)/$(am__dirstamp)
+search/sort/libshadow_la-qsort.lo: search/sort/$(am__dirstamp) \
+	search/sort/$(DEPDIR)/$(am__dirstamp)
+shadow/grp/$(am__dirstamp):
+	@$(MKDIR_P) shadow/grp
+	@: > shadow/grp/$(am__dirstamp)
+shadow/grp/$(DEPDIR)/$(am__dirstamp):
+	@$(MKDIR_P) shadow/grp/$(DEPDIR)
+	@: > shadow/grp/$(DEPDIR)/$(am__dirstamp)
+shadow/grp/libshadow_la-agetgroups.lo: shadow/grp/$(am__dirstamp) \
+	shadow/grp/$(DEPDIR)/$(am__dirstamp)
+string/ctype/strisascii/$(am__dirstamp):
+	@$(MKDIR_P) string/ctype/strisascii
+	@: > string/ctype/strisascii/$(am__dirstamp)
+string/ctype/strisascii/$(DEPDIR)/$(am__dirstamp):
+	@$(MKDIR_P) string/ctype/strisascii/$(DEPDIR)
+	@: > string/ctype/strisascii/$(DEPDIR)/$(am__dirstamp)
+string/ctype/strisascii/libshadow_la-strisdigit.lo:  \
+	string/ctype/strisascii/$(am__dirstamp) \
+	string/ctype/strisascii/$(DEPDIR)/$(am__dirstamp)
 string/memset/$(am__dirstamp):
 	@$(MKDIR_P) string/memset
 	@: > string/memset/$(am__dirstamp)
@@ -915,18 +999,20 @@ string/strchr/$(DEPDIR)/$(am__dirstamp):
 string/strchr/libshadow_la-strchrcnt.lo:  \
 	string/strchr/$(am__dirstamp) \
 	string/strchr/$(DEPDIR)/$(am__dirstamp)
-string/strchr/libshadow_la-stpspn.lo: string/strchr/$(am__dirstamp) \
+string/strchr/libshadow_la-strchrscnt.lo:  \
+	string/strchr/$(am__dirstamp) \
 	string/strchr/$(DEPDIR)/$(am__dirstamp)
 string/strchr/libshadow_la-strnul.lo: string/strchr/$(am__dirstamp) \
 	string/strchr/$(DEPDIR)/$(am__dirstamp)
-string/strchr/libshadow_la-strrspn.lo: string/strchr/$(am__dirstamp) \
-	string/strchr/$(DEPDIR)/$(am__dirstamp)
 string/strcmp/$(am__dirstamp):
 	@$(MKDIR_P) string/strcmp
 	@: > string/strcmp/$(am__dirstamp)
 string/strcmp/$(DEPDIR)/$(am__dirstamp):
 	@$(MKDIR_P) string/strcmp/$(DEPDIR)
 	@: > string/strcmp/$(DEPDIR)/$(am__dirstamp)
+string/strcmp/libshadow_la-strcaseeq.lo:  \
+	string/strcmp/$(am__dirstamp) \
+	string/strcmp/$(DEPDIR)/$(am__dirstamp)
 string/strcmp/libshadow_la-streq.lo: string/strcmp/$(am__dirstamp) \
 	string/strcmp/$(DEPDIR)/$(am__dirstamp)
 string/strcpy/$(am__dirstamp):
@@ -963,6 +1049,22 @@ string/$(DEPDIR)/$(am__dirstamp):
 	@: > string/$(DEPDIR)/$(am__dirstamp)
 string/libshadow_la-strftime.lo: string/$(am__dirstamp) \
 	string/$(DEPDIR)/$(am__dirstamp)
+string/strspn/$(am__dirstamp):
+	@$(MKDIR_P) string/strspn
+	@: > string/strspn/$(am__dirstamp)
+string/strspn/$(DEPDIR)/$(am__dirstamp):
+	@$(MKDIR_P) string/strspn/$(DEPDIR)
+	@: > string/strspn/$(DEPDIR)/$(am__dirstamp)
+string/strspn/libshadow_la-stpspn.lo: string/strspn/$(am__dirstamp) \
+	string/strspn/$(DEPDIR)/$(am__dirstamp)
+string/strspn/libshadow_la-stprcspn.lo: string/strspn/$(am__dirstamp) \
+	string/strspn/$(DEPDIR)/$(am__dirstamp)
+string/strspn/libshadow_la-stprspn.lo: string/strspn/$(am__dirstamp) \
+	string/strspn/$(DEPDIR)/$(am__dirstamp)
+string/strspn/libshadow_la-strrcspn.lo: string/strspn/$(am__dirstamp) \
+	string/strspn/$(DEPDIR)/$(am__dirstamp)
+string/strspn/libshadow_la-strrspn.lo: string/strspn/$(am__dirstamp) \
+	string/strspn/$(DEPDIR)/$(am__dirstamp)
 string/strtok/$(am__dirstamp):
 	@$(MKDIR_P) string/strtok
 	@: > string/strtok/$(am__dirstamp)
@@ -999,8 +1101,18 @@ mostlyclean-compile:
 	-rm -f atoi/strtoi/*.lo
 	-rm -f fs/readlink/*.$(OBJEXT)
 	-rm -f fs/readlink/*.lo
+	-rm -f search/cmp/*.$(OBJEXT)
+	-rm -f search/cmp/*.lo
+	-rm -f search/l/*.$(OBJEXT)
+	-rm -f search/l/*.lo
+	-rm -f search/sort/*.$(OBJEXT)
+	-rm -f search/sort/*.lo
+	-rm -f shadow/grp/*.$(OBJEXT)
+	-rm -f shadow/grp/*.lo
 	-rm -f string/*.$(OBJEXT)
 	-rm -f string/*.lo
+	-rm -f string/ctype/strisascii/*.$(OBJEXT)
+	-rm -f string/ctype/strisascii/*.lo
 	-rm -f string/memset/*.$(OBJEXT)
 	-rm -f string/memset/*.lo
 	-rm -f string/sprintf/*.$(OBJEXT)
@@ -1013,6 +1125,8 @@ mostlyclean-compile:
 	-rm -f string/strcpy/*.lo
 	-rm -f string/strdup/*.$(OBJEXT)
 	-rm -f string/strdup/*.lo
+	-rm -f string/strspn/*.$(OBJEXT)
+	-rm -f string/strspn/*.lo
 	-rm -f string/strtok/*.$(OBJEXT)
 	-rm -f string/strtok/*.lo
 	-rm -f time/*.$(OBJEXT)
@@ -1146,15 +1260,21 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@atoi/strtoi/$(DEPDIR)/libshadow_la-strtou_noneg.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@fs/readlink/$(DEPDIR)/libshadow_la-areadlink.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@fs/readlink/$(DEPDIR)/libshadow_la-readlinknul.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@search/cmp/$(DEPDIR)/libshadow_la-cmp.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@search/l/$(DEPDIR)/libshadow_la-lfind.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@search/l/$(DEPDIR)/libshadow_la-lsearch.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@search/sort/$(DEPDIR)/libshadow_la-qsort.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@shadow/grp/$(DEPDIR)/libshadow_la-agetgroups.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@string/$(DEPDIR)/libshadow_la-strftime.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@string/ctype/strisascii/$(DEPDIR)/libshadow_la-strisdigit.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@string/memset/$(DEPDIR)/libshadow_la-memzero.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@string/sprintf/$(DEPDIR)/libshadow_la-snprintf.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@string/sprintf/$(DEPDIR)/libshadow_la-stpeprintf.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@string/sprintf/$(DEPDIR)/libshadow_la-xasprintf.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@string/strchr/$(DEPDIR)/libshadow_la-stpspn.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@string/strchr/$(DEPDIR)/libshadow_la-strchrcnt.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@string/strchr/$(DEPDIR)/libshadow_la-strchrscnt.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@string/strchr/$(DEPDIR)/libshadow_la-strnul.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@string/strchr/$(DEPDIR)/libshadow_la-strrspn.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@string/strcmp/$(DEPDIR)/libshadow_la-strcaseeq.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@string/strcmp/$(DEPDIR)/libshadow_la-streq.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@string/strcpy/$(DEPDIR)/libshadow_la-stpecpy.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@string/strcpy/$(DEPDIR)/libshadow_la-strncat.Plo@am__quote@ # am--include-marker
@@ -1163,6 +1283,11 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@string/strdup/$(DEPDIR)/libshadow_la-strndupa.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@string/strdup/$(DEPDIR)/libshadow_la-xstrdup.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@string/strdup/$(DEPDIR)/libshadow_la-xstrndup.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@string/strspn/$(DEPDIR)/libshadow_la-stprcspn.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@string/strspn/$(DEPDIR)/libshadow_la-stprspn.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@string/strspn/$(DEPDIR)/libshadow_la-stpspn.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@string/strspn/$(DEPDIR)/libshadow_la-strrcspn.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@string/strspn/$(DEPDIR)/libshadow_la-strrspn.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@string/strtok/$(DEPDIR)/libshadow_la-stpsep.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@time/$(DEPDIR)/libshadow_la-day_to_str.Plo@am__quote@ # am--include-marker
 
@@ -1798,6 +1923,34 @@ libshadow_la-salt.lo: salt.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o libshadow_la-salt.lo `test -f 'salt.c' || echo '$(srcdir)/'`salt.c
 
+search/cmp/libshadow_la-cmp.lo: search/cmp/cmp.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT search/cmp/libshadow_la-cmp.lo -MD -MP -MF search/cmp/$(DEPDIR)/libshadow_la-cmp.Tpo -c -o search/cmp/libshadow_la-cmp.lo `test -f 'search/cmp/cmp.c' || echo '$(srcdir)/'`search/cmp/cmp.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) search/cmp/$(DEPDIR)/libshadow_la-cmp.Tpo search/cmp/$(DEPDIR)/libshadow_la-cmp.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='search/cmp/cmp.c' object='search/cmp/libshadow_la-cmp.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o search/cmp/libshadow_la-cmp.lo `test -f 'search/cmp/cmp.c' || echo '$(srcdir)/'`search/cmp/cmp.c
+
+search/l/libshadow_la-lfind.lo: search/l/lfind.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT search/l/libshadow_la-lfind.lo -MD -MP -MF search/l/$(DEPDIR)/libshadow_la-lfind.Tpo -c -o search/l/libshadow_la-lfind.lo `test -f 'search/l/lfind.c' || echo '$(srcdir)/'`search/l/lfind.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) search/l/$(DEPDIR)/libshadow_la-lfind.Tpo search/l/$(DEPDIR)/libshadow_la-lfind.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='search/l/lfind.c' object='search/l/libshadow_la-lfind.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o search/l/libshadow_la-lfind.lo `test -f 'search/l/lfind.c' || echo '$(srcdir)/'`search/l/lfind.c
+
+search/l/libshadow_la-lsearch.lo: search/l/lsearch.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT search/l/libshadow_la-lsearch.lo -MD -MP -MF search/l/$(DEPDIR)/libshadow_la-lsearch.Tpo -c -o search/l/libshadow_la-lsearch.lo `test -f 'search/l/lsearch.c' || echo '$(srcdir)/'`search/l/lsearch.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) search/l/$(DEPDIR)/libshadow_la-lsearch.Tpo search/l/$(DEPDIR)/libshadow_la-lsearch.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='search/l/lsearch.c' object='search/l/libshadow_la-lsearch.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o search/l/libshadow_la-lsearch.lo `test -f 'search/l/lsearch.c' || echo '$(srcdir)/'`search/l/lsearch.c
+
+search/sort/libshadow_la-qsort.lo: search/sort/qsort.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT search/sort/libshadow_la-qsort.lo -MD -MP -MF search/sort/$(DEPDIR)/libshadow_la-qsort.Tpo -c -o search/sort/libshadow_la-qsort.lo `test -f 'search/sort/qsort.c' || echo '$(srcdir)/'`search/sort/qsort.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) search/sort/$(DEPDIR)/libshadow_la-qsort.Tpo search/sort/$(DEPDIR)/libshadow_la-qsort.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='search/sort/qsort.c' object='search/sort/libshadow_la-qsort.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o search/sort/libshadow_la-qsort.lo `test -f 'search/sort/qsort.c' || echo '$(srcdir)/'`search/sort/qsort.c
+
 libshadow_la-selinux.lo: selinux.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT libshadow_la-selinux.lo -MD -MP -MF $(DEPDIR)/libshadow_la-selinux.Tpo -c -o libshadow_la-selinux.lo `test -f 'selinux.c' || echo '$(srcdir)/'`selinux.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libshadow_la-selinux.Tpo $(DEPDIR)/libshadow_la-selinux.Plo
@@ -1861,6 +2014,13 @@ libshadow_la-shadow.lo: shadow.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o libshadow_la-shadow.lo `test -f 'shadow.c' || echo '$(srcdir)/'`shadow.c
 
+shadow/grp/libshadow_la-agetgroups.lo: shadow/grp/agetgroups.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT shadow/grp/libshadow_la-agetgroups.lo -MD -MP -MF shadow/grp/$(DEPDIR)/libshadow_la-agetgroups.Tpo -c -o shadow/grp/libshadow_la-agetgroups.lo `test -f 'shadow/grp/agetgroups.c' || echo '$(srcdir)/'`shadow/grp/agetgroups.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) shadow/grp/$(DEPDIR)/libshadow_la-agetgroups.Tpo shadow/grp/$(DEPDIR)/libshadow_la-agetgroups.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='shadow/grp/agetgroups.c' object='shadow/grp/libshadow_la-agetgroups.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o shadow/grp/libshadow_la-agetgroups.lo `test -f 'shadow/grp/agetgroups.c' || echo '$(srcdir)/'`shadow/grp/agetgroups.c
+
 libshadow_la-shadowio.lo: shadowio.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT libshadow_la-shadowio.lo -MD -MP -MF $(DEPDIR)/libshadow_la-shadowio.Tpo -c -o libshadow_la-shadowio.lo `test -f 'shadowio.c' || echo '$(srcdir)/'`shadowio.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libshadow_la-shadowio.Tpo $(DEPDIR)/libshadow_la-shadowio.Plo
@@ -1903,6 +2063,13 @@ libshadow_la-sssd.lo: sssd.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o libshadow_la-sssd.lo `test -f 'sssd.c' || echo '$(srcdir)/'`sssd.c
 
+string/ctype/strisascii/libshadow_la-strisdigit.lo: string/ctype/strisascii/strisdigit.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/ctype/strisascii/libshadow_la-strisdigit.lo -MD -MP -MF string/ctype/strisascii/$(DEPDIR)/libshadow_la-strisdigit.Tpo -c -o string/ctype/strisascii/libshadow_la-strisdigit.lo `test -f 'string/ctype/strisascii/strisdigit.c' || echo '$(srcdir)/'`string/ctype/strisascii/strisdigit.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) string/ctype/strisascii/$(DEPDIR)/libshadow_la-strisdigit.Tpo string/ctype/strisascii/$(DEPDIR)/libshadow_la-strisdigit.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='string/ctype/strisascii/strisdigit.c' object='string/ctype/strisascii/libshadow_la-strisdigit.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o string/ctype/strisascii/libshadow_la-strisdigit.lo `test -f 'string/ctype/strisascii/strisdigit.c' || echo '$(srcdir)/'`string/ctype/strisascii/strisdigit.c
+
 string/memset/libshadow_la-memzero.lo: string/memset/memzero.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/memset/libshadow_la-memzero.lo -MD -MP -MF string/memset/$(DEPDIR)/libshadow_la-memzero.Tpo -c -o string/memset/libshadow_la-memzero.lo `test -f 'string/memset/memzero.c' || echo '$(srcdir)/'`string/memset/memzero.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) string/memset/$(DEPDIR)/libshadow_la-memzero.Tpo string/memset/$(DEPDIR)/libshadow_la-memzero.Plo
@@ -1938,12 +2105,12 @@ string/strchr/libshadow_la-strchrcnt.lo: string/strchr/strchrcnt.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o string/strchr/libshadow_la-strchrcnt.lo `test -f 'string/strchr/strchrcnt.c' || echo '$(srcdir)/'`string/strchr/strchrcnt.c
 
-string/strchr/libshadow_la-stpspn.lo: string/strchr/stpspn.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/strchr/libshadow_la-stpspn.lo -MD -MP -MF string/strchr/$(DEPDIR)/libshadow_la-stpspn.Tpo -c -o string/strchr/libshadow_la-stpspn.lo `test -f 'string/strchr/stpspn.c' || echo '$(srcdir)/'`string/strchr/stpspn.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) string/strchr/$(DEPDIR)/libshadow_la-stpspn.Tpo string/strchr/$(DEPDIR)/libshadow_la-stpspn.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='string/strchr/stpspn.c' object='string/strchr/libshadow_la-stpspn.lo' libtool=yes @AMDEPBACKSLASH@
+string/strchr/libshadow_la-strchrscnt.lo: string/strchr/strchrscnt.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/strchr/libshadow_la-strchrscnt.lo -MD -MP -MF string/strchr/$(DEPDIR)/libshadow_la-strchrscnt.Tpo -c -o string/strchr/libshadow_la-strchrscnt.lo `test -f 'string/strchr/strchrscnt.c' || echo '$(srcdir)/'`string/strchr/strchrscnt.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) string/strchr/$(DEPDIR)/libshadow_la-strchrscnt.Tpo string/strchr/$(DEPDIR)/libshadow_la-strchrscnt.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='string/strchr/strchrscnt.c' object='string/strchr/libshadow_la-strchrscnt.lo' libtool=yes @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o string/strchr/libshadow_la-stpspn.lo `test -f 'string/strchr/stpspn.c' || echo '$(srcdir)/'`string/strchr/stpspn.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o string/strchr/libshadow_la-strchrscnt.lo `test -f 'string/strchr/strchrscnt.c' || echo '$(srcdir)/'`string/strchr/strchrscnt.c
 
 string/strchr/libshadow_la-strnul.lo: string/strchr/strnul.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/strchr/libshadow_la-strnul.lo -MD -MP -MF string/strchr/$(DEPDIR)/libshadow_la-strnul.Tpo -c -o string/strchr/libshadow_la-strnul.lo `test -f 'string/strchr/strnul.c' || echo '$(srcdir)/'`string/strchr/strnul.c
@@ -1952,12 +2119,12 @@ string/strchr/libshadow_la-strnul.lo: string/strchr/strnul.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o string/strchr/libshadow_la-strnul.lo `test -f 'string/strchr/strnul.c' || echo '$(srcdir)/'`string/strchr/strnul.c
 
-string/strchr/libshadow_la-strrspn.lo: string/strchr/strrspn.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/strchr/libshadow_la-strrspn.lo -MD -MP -MF string/strchr/$(DEPDIR)/libshadow_la-strrspn.Tpo -c -o string/strchr/libshadow_la-strrspn.lo `test -f 'string/strchr/strrspn.c' || echo '$(srcdir)/'`string/strchr/strrspn.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) string/strchr/$(DEPDIR)/libshadow_la-strrspn.Tpo string/strchr/$(DEPDIR)/libshadow_la-strrspn.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='string/strchr/strrspn.c' object='string/strchr/libshadow_la-strrspn.lo' libtool=yes @AMDEPBACKSLASH@
+string/strcmp/libshadow_la-strcaseeq.lo: string/strcmp/strcaseeq.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/strcmp/libshadow_la-strcaseeq.lo -MD -MP -MF string/strcmp/$(DEPDIR)/libshadow_la-strcaseeq.Tpo -c -o string/strcmp/libshadow_la-strcaseeq.lo `test -f 'string/strcmp/strcaseeq.c' || echo '$(srcdir)/'`string/strcmp/strcaseeq.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) string/strcmp/$(DEPDIR)/libshadow_la-strcaseeq.Tpo string/strcmp/$(DEPDIR)/libshadow_la-strcaseeq.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='string/strcmp/strcaseeq.c' object='string/strcmp/libshadow_la-strcaseeq.lo' libtool=yes @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o string/strchr/libshadow_la-strrspn.lo `test -f 'string/strchr/strrspn.c' || echo '$(srcdir)/'`string/strchr/strrspn.c
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o string/strcmp/libshadow_la-strcaseeq.lo `test -f 'string/strcmp/strcaseeq.c' || echo '$(srcdir)/'`string/strcmp/strcaseeq.c
 
 string/strcmp/libshadow_la-streq.lo: string/strcmp/streq.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/strcmp/libshadow_la-streq.lo -MD -MP -MF string/strcmp/$(DEPDIR)/libshadow_la-streq.Tpo -c -o string/strcmp/libshadow_la-streq.lo `test -f 'string/strcmp/streq.c' || echo '$(srcdir)/'`string/strcmp/streq.c
@@ -2022,6 +2189,41 @@ string/libshadow_la-strftime.lo: string/strftime.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o string/libshadow_la-strftime.lo `test -f 'string/strftime.c' || echo '$(srcdir)/'`string/strftime.c
 
+string/strspn/libshadow_la-stpspn.lo: string/strspn/stpspn.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/strspn/libshadow_la-stpspn.lo -MD -MP -MF string/strspn/$(DEPDIR)/libshadow_la-stpspn.Tpo -c -o string/strspn/libshadow_la-stpspn.lo `test -f 'string/strspn/stpspn.c' || echo '$(srcdir)/'`string/strspn/stpspn.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) string/strspn/$(DEPDIR)/libshadow_la-stpspn.Tpo string/strspn/$(DEPDIR)/libshadow_la-stpspn.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='string/strspn/stpspn.c' object='string/strspn/libshadow_la-stpspn.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o string/strspn/libshadow_la-stpspn.lo `test -f 'string/strspn/stpspn.c' || echo '$(srcdir)/'`string/strspn/stpspn.c
+
+string/strspn/libshadow_la-stprcspn.lo: string/strspn/stprcspn.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/strspn/libshadow_la-stprcspn.lo -MD -MP -MF string/strspn/$(DEPDIR)/libshadow_la-stprcspn.Tpo -c -o string/strspn/libshadow_la-stprcspn.lo `test -f 'string/strspn/stprcspn.c' || echo '$(srcdir)/'`string/strspn/stprcspn.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) string/strspn/$(DEPDIR)/libshadow_la-stprcspn.Tpo string/strspn/$(DEPDIR)/libshadow_la-stprcspn.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='string/strspn/stprcspn.c' object='string/strspn/libshadow_la-stprcspn.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o string/strspn/libshadow_la-stprcspn.lo `test -f 'string/strspn/stprcspn.c' || echo '$(srcdir)/'`string/strspn/stprcspn.c
+
+string/strspn/libshadow_la-stprspn.lo: string/strspn/stprspn.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/strspn/libshadow_la-stprspn.lo -MD -MP -MF string/strspn/$(DEPDIR)/libshadow_la-stprspn.Tpo -c -o string/strspn/libshadow_la-stprspn.lo `test -f 'string/strspn/stprspn.c' || echo '$(srcdir)/'`string/strspn/stprspn.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) string/strspn/$(DEPDIR)/libshadow_la-stprspn.Tpo string/strspn/$(DEPDIR)/libshadow_la-stprspn.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='string/strspn/stprspn.c' object='string/strspn/libshadow_la-stprspn.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o string/strspn/libshadow_la-stprspn.lo `test -f 'string/strspn/stprspn.c' || echo '$(srcdir)/'`string/strspn/stprspn.c
+
+string/strspn/libshadow_la-strrcspn.lo: string/strspn/strrcspn.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/strspn/libshadow_la-strrcspn.lo -MD -MP -MF string/strspn/$(DEPDIR)/libshadow_la-strrcspn.Tpo -c -o string/strspn/libshadow_la-strrcspn.lo `test -f 'string/strspn/strrcspn.c' || echo '$(srcdir)/'`string/strspn/strrcspn.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) string/strspn/$(DEPDIR)/libshadow_la-strrcspn.Tpo string/strspn/$(DEPDIR)/libshadow_la-strrcspn.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='string/strspn/strrcspn.c' object='string/strspn/libshadow_la-strrcspn.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o string/strspn/libshadow_la-strrcspn.lo `test -f 'string/strspn/strrcspn.c' || echo '$(srcdir)/'`string/strspn/strrcspn.c
+
+string/strspn/libshadow_la-strrspn.lo: string/strspn/strrspn.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/strspn/libshadow_la-strrspn.lo -MD -MP -MF string/strspn/$(DEPDIR)/libshadow_la-strrspn.Tpo -c -o string/strspn/libshadow_la-strrspn.lo `test -f 'string/strspn/strrspn.c' || echo '$(srcdir)/'`string/strspn/strrspn.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) string/strspn/$(DEPDIR)/libshadow_la-strrspn.Tpo string/strspn/$(DEPDIR)/libshadow_la-strrspn.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='string/strspn/strrspn.c' object='string/strspn/libshadow_la-strrspn.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -c -o string/strspn/libshadow_la-strrspn.lo `test -f 'string/strspn/strrspn.c' || echo '$(srcdir)/'`string/strspn/strrspn.c
+
 string/strtok/libshadow_la-stpsep.lo: string/strtok/stpsep.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libshadow_la_CPPFLAGS) $(CPPFLAGS) $(libshadow_la_CFLAGS) $(CFLAGS) -MT string/strtok/libshadow_la-stpsep.lo -MD -MP -MF string/strtok/$(DEPDIR)/libshadow_la-stpsep.Tpo -c -o string/strtok/libshadow_la-stpsep.lo `test -f 'string/strtok/stpsep.c' || echo '$(srcdir)/'`string/strtok/stpsep.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) string/strtok/$(DEPDIR)/libshadow_la-stpsep.Tpo string/strtok/$(DEPDIR)/libshadow_la-stpsep.Plo
@@ -2219,13 +2421,19 @@ clean-libtool:
 	-rm -rf atoi/str2i/.libs atoi/str2i/_libs
 	-rm -rf atoi/strtoi/.libs atoi/strtoi/_libs
 	-rm -rf fs/readlink/.libs fs/readlink/_libs
+	-rm -rf search/cmp/.libs search/cmp/_libs
+	-rm -rf search/l/.libs search/l/_libs
+	-rm -rf search/sort/.libs search/sort/_libs
+	-rm -rf shadow/grp/.libs shadow/grp/_libs
 	-rm -rf string/.libs string/_libs
+	-rm -rf string/ctype/strisascii/.libs string/ctype/strisascii/_libs
 	-rm -rf string/memset/.libs string/memset/_libs
 	-rm -rf string/sprintf/.libs string/sprintf/_libs
 	-rm -rf string/strchr/.libs string/strchr/_libs
 	-rm -rf string/strcmp/.libs string/strcmp/_libs
 	-rm -rf string/strcpy/.libs string/strcpy/_libs
 	-rm -rf string/strdup/.libs string/strdup/_libs
+	-rm -rf string/strspn/.libs string/strspn/_libs
 	-rm -rf string/strtok/.libs string/strtok/_libs
 	-rm -rf time/.libs time/_libs
 
@@ -2357,8 +2565,18 @@ distclean-generic:
 	-rm -f atoi/strtoi/$(am__dirstamp)
 	-rm -f fs/readlink/$(DEPDIR)/$(am__dirstamp)
 	-rm -f fs/readlink/$(am__dirstamp)
+	-rm -f search/cmp/$(DEPDIR)/$(am__dirstamp)
+	-rm -f search/cmp/$(am__dirstamp)
+	-rm -f search/l/$(DEPDIR)/$(am__dirstamp)
+	-rm -f search/l/$(am__dirstamp)
+	-rm -f search/sort/$(DEPDIR)/$(am__dirstamp)
+	-rm -f search/sort/$(am__dirstamp)
+	-rm -f shadow/grp/$(DEPDIR)/$(am__dirstamp)
+	-rm -f shadow/grp/$(am__dirstamp)
 	-rm -f string/$(DEPDIR)/$(am__dirstamp)
 	-rm -f string/$(am__dirstamp)
+	-rm -f string/ctype/strisascii/$(DEPDIR)/$(am__dirstamp)
+	-rm -f string/ctype/strisascii/$(am__dirstamp)
 	-rm -f string/memset/$(DEPDIR)/$(am__dirstamp)
 	-rm -f string/memset/$(am__dirstamp)
 	-rm -f string/sprintf/$(DEPDIR)/$(am__dirstamp)
@@ -2371,6 +2589,8 @@ distclean-generic:
 	-rm -f string/strcpy/$(am__dirstamp)
 	-rm -f string/strdup/$(DEPDIR)/$(am__dirstamp)
 	-rm -f string/strdup/$(am__dirstamp)
+	-rm -f string/strspn/$(DEPDIR)/$(am__dirstamp)
+	-rm -f string/strspn/$(am__dirstamp)
 	-rm -f string/strtok/$(DEPDIR)/$(am__dirstamp)
 	-rm -f string/strtok/$(am__dirstamp)
 	-rm -f time/$(DEPDIR)/$(am__dirstamp)
@@ -2511,15 +2731,21 @@ distclean: distclean-am
 	-rm -f atoi/strtoi/$(DEPDIR)/libshadow_la-strtou_noneg.Plo
 	-rm -f fs/readlink/$(DEPDIR)/libshadow_la-areadlink.Plo
 	-rm -f fs/readlink/$(DEPDIR)/libshadow_la-readlinknul.Plo
+	-rm -f search/cmp/$(DEPDIR)/libshadow_la-cmp.Plo
+	-rm -f search/l/$(DEPDIR)/libshadow_la-lfind.Plo
+	-rm -f search/l/$(DEPDIR)/libshadow_la-lsearch.Plo
+	-rm -f search/sort/$(DEPDIR)/libshadow_la-qsort.Plo
+	-rm -f shadow/grp/$(DEPDIR)/libshadow_la-agetgroups.Plo
 	-rm -f string/$(DEPDIR)/libshadow_la-strftime.Plo
+	-rm -f string/ctype/strisascii/$(DEPDIR)/libshadow_la-strisdigit.Plo
 	-rm -f string/memset/$(DEPDIR)/libshadow_la-memzero.Plo
 	-rm -f string/sprintf/$(DEPDIR)/libshadow_la-snprintf.Plo
 	-rm -f string/sprintf/$(DEPDIR)/libshadow_la-stpeprintf.Plo
 	-rm -f string/sprintf/$(DEPDIR)/libshadow_la-xasprintf.Plo
-	-rm -f string/strchr/$(DEPDIR)/libshadow_la-stpspn.Plo
 	-rm -f string/strchr/$(DEPDIR)/libshadow_la-strchrcnt.Plo
+	-rm -f string/strchr/$(DEPDIR)/libshadow_la-strchrscnt.Plo
 	-rm -f string/strchr/$(DEPDIR)/libshadow_la-strnul.Plo
-	-rm -f string/strchr/$(DEPDIR)/libshadow_la-strrspn.Plo
+	-rm -f string/strcmp/$(DEPDIR)/libshadow_la-strcaseeq.Plo
 	-rm -f string/strcmp/$(DEPDIR)/libshadow_la-streq.Plo
 	-rm -f string/strcpy/$(DEPDIR)/libshadow_la-stpecpy.Plo
 	-rm -f string/strcpy/$(DEPDIR)/libshadow_la-strncat.Plo
@@ -2528,6 +2754,11 @@ distclean: distclean-am
 	-rm -f string/strdup/$(DEPDIR)/libshadow_la-strndupa.Plo
 	-rm -f string/strdup/$(DEPDIR)/libshadow_la-xstrdup.Plo
 	-rm -f string/strdup/$(DEPDIR)/libshadow_la-xstrndup.Plo
+	-rm -f string/strspn/$(DEPDIR)/libshadow_la-stprcspn.Plo
+	-rm -f string/strspn/$(DEPDIR)/libshadow_la-stprspn.Plo
+	-rm -f string/strspn/$(DEPDIR)/libshadow_la-stpspn.Plo
+	-rm -f string/strspn/$(DEPDIR)/libshadow_la-strrcspn.Plo
+	-rm -f string/strspn/$(DEPDIR)/libshadow_la-strrspn.Plo
 	-rm -f string/strtok/$(DEPDIR)/libshadow_la-stpsep.Plo
 	-rm -f time/$(DEPDIR)/libshadow_la-day_to_str.Plo
 	-rm -f Makefile
@@ -2700,15 +2931,21 @@ maintainer-clean: maintainer-clean-am
 	-rm -f atoi/strtoi/$(DEPDIR)/libshadow_la-strtou_noneg.Plo
 	-rm -f fs/readlink/$(DEPDIR)/libshadow_la-areadlink.Plo
 	-rm -f fs/readlink/$(DEPDIR)/libshadow_la-readlinknul.Plo
+	-rm -f search/cmp/$(DEPDIR)/libshadow_la-cmp.Plo
+	-rm -f search/l/$(DEPDIR)/libshadow_la-lfind.Plo
+	-rm -f search/l/$(DEPDIR)/libshadow_la-lsearch.Plo
+	-rm -f search/sort/$(DEPDIR)/libshadow_la-qsort.Plo
+	-rm -f shadow/grp/$(DEPDIR)/libshadow_la-agetgroups.Plo
 	-rm -f string/$(DEPDIR)/libshadow_la-strftime.Plo
+	-rm -f string/ctype/strisascii/$(DEPDIR)/libshadow_la-strisdigit.Plo
 	-rm -f string/memset/$(DEPDIR)/libshadow_la-memzero.Plo
 	-rm -f string/sprintf/$(DEPDIR)/libshadow_la-snprintf.Plo
 	-rm -f string/sprintf/$(DEPDIR)/libshadow_la-stpeprintf.Plo
 	-rm -f string/sprintf/$(DEPDIR)/libshadow_la-xasprintf.Plo
-	-rm -f string/strchr/$(DEPDIR)/libshadow_la-stpspn.Plo
 	-rm -f string/strchr/$(DEPDIR)/libshadow_la-strchrcnt.Plo
+	-rm -f string/strchr/$(DEPDIR)/libshadow_la-strchrscnt.Plo
 	-rm -f string/strchr/$(DEPDIR)/libshadow_la-strnul.Plo
-	-rm -f string/strchr/$(DEPDIR)/libshadow_la-strrspn.Plo
+	-rm -f string/strcmp/$(DEPDIR)/libshadow_la-strcaseeq.Plo
 	-rm -f string/strcmp/$(DEPDIR)/libshadow_la-streq.Plo
 	-rm -f string/strcpy/$(DEPDIR)/libshadow_la-stpecpy.Plo
 	-rm -f string/strcpy/$(DEPDIR)/libshadow_la-strncat.Plo
@@ -2717,6 +2954,11 @@ maintainer-clean: maintainer-clean-am
 	-rm -f string/strdup/$(DEPDIR)/libshadow_la-strndupa.Plo
 	-rm -f string/strdup/$(DEPDIR)/libshadow_la-xstrdup.Plo
 	-rm -f string/strdup/$(DEPDIR)/libshadow_la-xstrndup.Plo
+	-rm -f string/strspn/$(DEPDIR)/libshadow_la-stprcspn.Plo
+	-rm -f string/strspn/$(DEPDIR)/libshadow_la-stprspn.Plo
+	-rm -f string/strspn/$(DEPDIR)/libshadow_la-stpspn.Plo
+	-rm -f string/strspn/$(DEPDIR)/libshadow_la-strrcspn.Plo
+	-rm -f string/strspn/$(DEPDIR)/libshadow_la-strrspn.Plo
 	-rm -f string/strtok/$(DEPDIR)/libshadow_la-stpsep.Plo
 	-rm -f time/$(DEPDIR)/libshadow_la-day_to_str.Plo
 	-rm -f Makefile

lib/addgrps.c

@@ -1,15 +1,14 @@
-/*
- * SPDX-FileCopyrightText: 1989 - 1994, Julianne Frances Haugh
- * SPDX-FileCopyrightText: 1996 - 1998, Marek Michałkiewicz
- * SPDX-FileCopyrightText: 2001 - 2006, Tomasz Kłoczko
- * SPDX-FileCopyrightText: 2007 - 2009, Nicolas François
- *
- * SPDX-License-Identifier: BSD-3-Clause
- */
+// SPDX-FileCopyrightText: 1989-1994, Julianne Frances Haugh
+// SPDX-FileCopyrightText: 1996-1998, Marek Michałkiewicz
+// SPDX-FileCopyrightText: 2001-2006, Tomasz Kłoczko
+// SPDX-FileCopyrightText: 2007-2009, Nicolas François
+// SPDX-FileCopyrightText: 2024, Alejandro Colomar <alx@kernel.org>
+// SPDX-License-Identifier: BSD-3-Clause
+
 
 #include <config.h>
 
-#if defined (HAVE_SETGROUPS) && ! defined (USE_PAM)
+#if !defined(USE_PAM)
 
 #include "prototypes.h"
 #include "defines.h"
@@ -18,12 +17,14 @@
 #include <grp.h>
 #include <stdio.h>
 #include <string.h>
+#include <sys/types.h>
 
-#include "alloc/malloc.h"
 #include "alloc/reallocf.h"
+#include "search/l/lsearch.h"
+#include "shadow/grp/agetgroups.h"
 #include "shadowlog.h"
+#include "string/strchr/strchrscnt.h"
 
-#ident "$Id$"
 
 /*
  * Add groups with names from LIST (separated by commas or colons)
@@ -33,48 +34,25 @@
 int
 add_groups(const char *list)
 {
-	GETGROUPS_T *grouplist;
-	size_t i;
-	int ngroups;
-	bool added;
-	char *g, *p;
-	char buf[1024];
-	int ret;
+	char    *g, *p, *dup;
 	FILE *shadow_logfd = log_get_logfd();
+	gid_t   *gids;
+	size_t  n;
 
-	if (strlen (list) >= sizeof (buf)) {
-		errno = EINVAL;
+	gids = agetgroups(&n);
+	if (gids == NULL)
 		return -1;
-	}
-	strcpy (buf, list);
 
-	i = 16;
-	for (;;) {
-		grouplist = MALLOC(i, GETGROUPS_T);
-		if (NULL == grouplist) {
-			return -1;
-		}
-		ngroups = getgroups (i, grouplist);
-		if (   (   (-1 == ngroups)
-		        && (EINVAL != errno))
-		    || (i > (size_t)ngroups)) {
-			/* Unexpected failure of getgroups or successful
-			 * reception of the groups */
-			break;
-		}
-		/* not enough room, so try allocating a larger buffer */
-		free (grouplist);
-		i *= 2;
-	}
-	if (ngroups < 0) {
-		free (grouplist);
+	gids = REALLOCF(gids, n + strchrscnt(list, ",:") + 1, gid_t);
+	if (gids == NULL)
 		return -1;
-	}
 
-	added = false;
-	p = buf;
+	p = dup = strdup(list);
+	if (dup == NULL)
+		goto free_gids;
+
 	while (NULL != (g = strsep(&p, ",:"))) {
-		struct group *grp;
+		struct group  *grp;
 
 		grp = getgrnam(g); /* local, no need for xgetgrnam */
 		if (NULL == grp) {
@@ -82,35 +60,22 @@ add_groups(const char *list)
 			continue;
 		}
 
-		for (i = 0; i < (size_t)ngroups && grouplist[i] != grp->gr_gid; i++);
+		LSEARCH(&grp->gr_gid, gids, &n);
+	}
+	free(dup);
 
-		if (i < (size_t)ngroups) {
-			continue;
-		}
-
-		if (ngroups >= sysconf (_SC_NGROUPS_MAX)) {
-			fputs (_("Warning: too many groups\n"), shadow_logfd);
-			break;
-		}
-		grouplist = REALLOCF(grouplist, (size_t) ngroups + 1, GETGROUPS_T);
-		if (grouplist == NULL) {
-			return -1;
-		}
-		grouplist[ngroups] = grp->gr_gid;
-		ngroups++;
-		added = true;
+	if (setgroups(n, gids) == -1) {
+		fprintf(shadow_logfd, "setgroups: %s\n", strerror(errno));
+		goto free_gids;
 	}
 
-	if (added) {
-		ret = setgroups (ngroups, grouplist);
-		free (grouplist);
-		return ret;
-	}
-
-	free (grouplist);
+	free(gids);
 	return 0;
-}
-#else				/* HAVE_SETGROUPS && !USE_PAM */
-extern int ISO_C_forbids_an_empty_translation_unit;
-#endif				/* HAVE_SETGROUPS && !USE_PAM */
 
+free_gids:
+	free(gids);
+	return -1;
+}
+#else				/* !USE_PAM */
+extern int ISO_C_forbids_an_empty_translation_unit;
+#endif				/* !USE_PAM */

lib/adds.c

@@ -11,5 +11,3 @@
 
 extern inline long addsl2(long a, long b);
 extern inline long addslN(size_t n, long addend[n]);
-
-extern inline int cmpl(const void *p1, const void *p2);

lib/adds.h

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2023, Alejandro Colomar <alx@kernel.org>
+// SPDX-FileCopyrightText: 2023-2024, Alejandro Colomar <alx@kernel.org>
 // SPDX-License-Identifier: BSD-3-Clause
 
 
@@ -11,8 +11,8 @@
 #include <errno.h>
 #include <limits.h>
 #include <stddef.h>
-#include <stdlib.h>
 
+#include "search/sort/qsort.h"
 #include "sizeof.h"
 
 
@@ -27,8 +27,6 @@
 inline long addsl2(long a, long b);
 inline long addslN(size_t n, long addend[n]);
 
-inline int cmpl(const void *p1, const void *p2);
-
 
 inline long
 addsl2(long a, long b)
@@ -57,7 +55,7 @@ addslN(size_t n, long addend[n])
 
 	e = errno;
 	while (n > 1) {
-		qsort(addend, n, sizeof(addend[0]), cmpl);
+		QSORT(addend, n);
 
 		errno = 0;
 		addend[0] = addsl2(addend[0], addend[--n]);
@@ -69,18 +67,4 @@ addslN(size_t n, long addend[n])
 }
 
 
-inline int
-cmpl(const void *p1, const void *p2)
-{
-	const long  *l1 = p1;
-	const long  *l2 = p2;
-
-	if (*l1 < *l2)
-		return -1;
-	if (*l1 > *l2)
-		return +1;
-	return 0;
-}
-
-
 #endif  // include guard

lib/age.c

@@ -106,7 +106,7 @@ int expire (const struct passwd *pw, /*@null@*/const struct spwd *sp)
 		 * passwd to work just like it would had they executed
 		 * it from the command line while logged in.
 		 */
-#if defined(HAVE_INITGROUPS) && ! defined(USE_PAM)
+#if !defined(USE_PAM)
 		if (setup_uid_gid (pw, false) != 0)
 #else
 		if (setup_uid_gid (pw) != 0)

lib/attr.h

@@ -5,7 +5,7 @@
 #include "config.h"
 
 
-#if defined(__GNUC__)
+#if (__GNUC__ >= 10)
 # define MAYBE_UNUSED                [[gnu::unused]]
 # define NORETURN                    [[gnu::__noreturn__]]
 # define format_attr(type, fmt, va)  [[gnu::format(type, fmt, va)]]

lib/basename.c

@@ -1,10 +1,8 @@
-/*
- * SPDX-FileCopyrightText: 1990 - 1994, Julianne Frances Haugh
- * SPDX-FileCopyrightText: 1996 - 1997, Marek Michałkiewicz
- * SPDX-FileCopyrightText: 2003 - 2005, Tomasz Kłoczko
- *
- * SPDX-License-Identifier: BSD-3-Clause
- */
+// SPDX-FileCopyrightText: 1990-1994, Julianne Frances Haugh
+// SPDX-FileCopyrightText: 1996-1997, Marek Michałkiewicz
+// SPDX-FileCopyrightText: 2003-2005, Tomasz Kłoczko
+// SPDX-FileCopyrightText: 2024, Alejandro Colomar <alx@kernel.org>
+// SPDX-License-Identifier: BSD-3-Clause
 
 /*
  * basename.c - not worth copyrighting :-).  Some versions of Linux libc
@@ -15,17 +13,19 @@
 
 #include <config.h>
 
-#ident "$Id$"
+#include <stddef.h>
+#include <stdlib.h>
 
-#include "defines.h"
 #include "prototypes.h"
-/*@observer@*/const char *Basename (const char *str)
+#include "string/strspn/stprcspn.h"
+
+
+/*@observer@*/const char *
+Basename(const char *str)
 {
 	if (str == NULL) {
 		abort ();
 	}
 
-	char *cp = strrchr (str, '/');
-
-	return (NULL != cp) ? cp + 1 : str;
+	return stprcspn(str, "/");
 }

lib/chkname.c

@@ -2,7 +2,7 @@
 // SPDX-FileCopyrightText: 1996-2000, Marek Michałkiewicz
 // SPDX-FileCopyrightText: 2001-2005, Tomasz Kłoczko
 // SPDX-FileCopyrightText: 2005-2008, Nicolas François
-// SPDX-FileCopyrightText: 2023-2024, Alejandro Colomar <alx@kernel.org>
+// SPDX-FileCopyrightText: 2023-2025, Alejandro Colomar <alx@kernel.org>
 // SPDX-License-Identifier: BSD-3-Clause
 
 
@@ -27,12 +27,17 @@
 #include <limits.h>
 #include <stdbool.h>
 #include <stddef.h>
-#include <stdint.h>
-#include <sys/param.h>
 #include <unistd.h>
 
 #include "defines.h"
 #include "chkname.h"
+#include "string/ctype/strisascii/strisdigit.h"
+#include "string/strcmp/streq.h"
+
+
+#ifndef  LOGIN_NAME_MAX
+# define LOGIN_NAME_MAX  256
+#endif
 
 
 int allow_bad_names = false;
@@ -43,12 +48,11 @@ login_name_max_size(void)
 {
 	long  conf;
 
-	errno = 0;
 	conf = sysconf(_SC_LOGIN_NAME_MAX);
-	if (conf == -1 && errno != 0)
+	if (conf == -1)
 		return LOGIN_NAME_MAX;
 
-	return MIN(conf, PTRDIFF_MAX);
+	return conf;
 }
 
 
@@ -68,11 +72,15 @@ is_valid_name(const char *name)
          *
          * Also do not allow fully numeric names or just "." or "..".
          */
-	int numeric;
 
-	if ('\0' == *name ||
-	    ('.' == *name && (('.' == name[1] && '\0' == name[2]) ||
-			      '\0' == name[1])) ||
+	if (strisdigit(name)) {
+		errno = EINVAL;
+		return false;
+	}
+
+	if (streq(name, "") ||
+	    streq(name, ".") ||
+	    streq(name, "..") ||
 	    !((*name >= 'a' && *name <= 'z') ||
 	      (*name >= 'A' && *name <= 'Z') ||
 	      (*name >= '0' && *name <= '9') ||
@@ -83,27 +91,19 @@ is_valid_name(const char *name)
 		return false;
 	}
 
-	numeric = isdigit(*name);
-
-	while ('\0' != *++name) {
+	while (!streq(++name, "")) {
 		if (!((*name >= 'a' && *name <= 'z') ||
 		      (*name >= 'A' && *name <= 'Z') ||
 		      (*name >= '0' && *name <= '9') ||
 		      *name == '_' ||
 		      *name == '.' ||
 		      *name == '-' ||
-		      (*name == '$' && name[1] == '\0')
+		      streq(name, "$")
 		     ))
 		{
 			errno = EINVAL;
 			return false;
 		}
-		numeric &= isdigit(*name);
-	}
-
-	if (numeric) {
-		errno = EINVAL;
-		return false;
 	}
 
 	return true;

lib/commonio.c

@@ -891,7 +891,7 @@ static int write_all (const struct commonio_db *db)
 
 int commonio_close (struct commonio_db *db)
 {
-	int          errors = 0;
+	bool         errors = false;
 	char         buf[1024];
 	struct stat  sb;
 
@@ -932,25 +932,25 @@ int commonio_close (struct commonio_db *db)
 
 #ifdef WITH_SELINUX
 		if (set_selinux_file_context (db->filename, S_IFREG) != 0) {
-			errors++;
+			errors = true;
 		}
 #endif
 		if (create_backup (buf, db->fp) != 0) {
-			errors++;
+			errors = true;
 		}
 
 		if (fclose (db->fp) != 0) {
-			errors++;
+			errors = true;
 		}
 
 		db->fp = NULL;
 
 #ifdef WITH_SELINUX
 		if (reset_selinux_file_context () != 0) {
-			errors++;
+			errors = true;
 		}
 #endif
-		if (errors != 0)
+		if (errors)
 			goto fail;
 	} else {
 		/*
@@ -966,7 +966,7 @@ int commonio_close (struct commonio_db *db)
 
 #ifdef WITH_SELINUX
 	if (set_selinux_file_context (db->filename, S_IFREG) != 0) {
-		errors++;
+		errors = true;
 	}
 #endif
 
@@ -976,24 +976,24 @@ int commonio_close (struct commonio_db *db)
 	}
 
 	if (write_all (db) != 0) {
-		errors++;
+		errors = true;
 	}
 
 	if (fflush (db->fp) != 0) {
-		errors++;
+		errors = true;
 	}
 
 	if (fsync (fileno (db->fp)) != 0) {
-		errors++;
+		errors = true;
 	}
 
 	if (fclose (db->fp) != 0) {
-		errors++;
+		errors = true;
 	}
 
 	db->fp = NULL;
 
-	if (errors != 0) {
+	if (errors) {
 		unlink (buf);
 		goto fail;
 	}
@@ -1011,11 +1011,11 @@ int commonio_close (struct commonio_db *db)
 	nscd_need_reload = true;
 	goto success;
       fail:
-	errors++;
+	errors = true;
       success:
 
 	free_linked_list (db);
-	return errors == 0;
+	return !errors;
 }
 
 static /*@dependent@*/ /*@null@*/struct commonio_entry *next_entry_by_name (

lib/csrand.c

@@ -10,8 +10,8 @@
 #include <stdint.h>
 #include <stdlib.h>
 #include <unistd.h>
-#if HAVE_SYS_RANDOM_H
-#include <sys/random.h>
+#if __has_include(<sys/random.h>)
+# include <sys/random.h>
 #endif
 
 #include "bit.h"

lib/defines.h

@@ -41,7 +41,7 @@
  * crypt(3), crypt_gensalt(3), and their
  * feature test macros may be defined in here.
  */
-#if HAVE_CRYPT_H
+#if __has_include(<crypt.h>)
 # include <crypt.h>
 #endif
 
@@ -50,13 +50,8 @@
 
 #include <dirent.h>
 
-/*
- * Possible cases:
- * - /usr/include/shadow.h exists and includes the shadow group stuff.
- * - /usr/include/shadow.h exists, but we use our own gshadow.h.
- */
 #include <shadow.h>
-#if defined(SHADOWGRP) && !defined(GSHADOW)
+#if defined(SHADOWGRP)
 #include "gshadow_.h"
 #endif
 

lib/encrypt.c

@@ -65,7 +65,8 @@
 		(void) fprintf (shadow_logfd,
 		                _("crypt method not supported by libcrypt? (%s)\n"),
 		                method);
-		exit (EXIT_FAILURE);
+		errno = EINVAL;
+		return NULL;
 	}
 
 	if (strlen (cp) != 13) {

lib/fields.c

@@ -16,8 +16,9 @@
 #include <stdio.h>
 
 #include "prototypes.h"
-#include "string/strchr/stpspn.h"
-#include "string/strchr/strrspn.h"
+#include "string/strcmp/streq.h"
+#include "string/strspn/stpspn.h"
+#include "string/strspn/stprspn.h"
 #include "string/strtok/stpsep.h"
 
 
@@ -47,7 +48,7 @@ int valid_field (const char *field, const char *illegal)
 	}
 
 	/* Search if there are non-printable or control characters */
-	for (cp = field; '\0' != *cp; cp++) {
+	for (cp = field; !streq(cp, ""); cp++) {
 		unsigned char c = *cp;
 		if (!isprint (c)) {
 			err = 1;
@@ -86,13 +87,13 @@ change_field(char *buf, size_t maxsize, const char *prompt)
 	if (stpsep(newf, "\n") == NULL)
 		return;
 
-	if ('\0' != newf[0]) {
+	if (!streq(newf, "")) {
 		/*
 		 * Remove leading and trailing whitespace.  This also
 		 * makes it possible to change the field to empty, by
 		 * entering a space.  --marekm
 		 */
-		stpcpy(strrspn(newf, " \t"), "");
+		stpcpy(stprspn(newf, " \t"), "");
 		cp = stpspn(newf, " \t");
 		strcpy (buf, cp);
 	}

lib/fputsx.c

@@ -14,8 +14,7 @@
 
 #include "defines.h"
 #include "prototypes.h"
-
-#ident "$Id$"
+#include "string/strcmp/streq.h"
 
 
 /*@null@*/char *
@@ -48,7 +47,7 @@ int fputsx (const char *s, FILE * stream)
 {
 	int i;
 
-	for (i = 0; '\0' != *s; i++, s++) {
+	for (i = 0; !streq(s, ""); i++, s++) {
 		if (putc (*s, stream) == EOF) {
 			return EOF;
 		}

lib/fs/readlink/readlinknul.c

@@ -7,7 +7,8 @@
 #include "fs/readlink/readlinknul.h"
 
 #include <stddef.h>
+#include <sys/types.h>
 
 
-extern inline int readlinknul(const char *restrict link, char *restrict buf,
+extern inline ssize_t readlinknul(const char *restrict link, char *restrict buf,
     size_t size);

lib/fs/readlink/readlinknul.h

@@ -22,28 +22,31 @@
 
 
 ATTR_STRING(1)
-inline int readlinknul(const char *restrict link, char *restrict buf,
+inline ssize_t readlinknul(const char *restrict link, char *restrict buf,
     size_t size);
 
 
 // Similar to readlink(2), but terminate the string.
-inline int
+inline ssize_t
 readlinknul(const char *restrict link, char *restrict buf, size_t size)
 {
-	ssize_t  len;
+	size_t   ulen;
+	ssize_t  slen;
 
-	len = readlink(link, buf, size);
-	if (len == -1)
+	slen = readlink(link, buf, size);
+	if (slen == -1)
 		return -1;
 
-	if (len == size) {
+	ulen = slen;
+	if (ulen == size) {
 		stpcpy(&buf[size-1], "");
 		errno = E2BIG;
 		return -1;
 	}
 
-	stpcpy(&buf[len], "");
-	return len;
+	stpcpy(&buf[ulen], "");
+
+	return slen;
 }