Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package shadow for openSUSE:Factory checked in at 2026-08-05 17:45:57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/shadow (Old) and /work/SRC/openSUSE:Factory/.shadow.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "shadow" Wed Aug 5 17:45:57 2026 rev:88 rq:1369407 version:4.20.0 Changes: -------- --- /work/SRC/openSUSE:Factory/shadow/shadow.changes 2026-05-07 15:42:59.850287746 +0200 +++ /work/SRC/openSUSE:Factory/.shadow.new.16738/shadow.changes 2026-08-05 17:45:59.128755763 +0200 @@ -1,0 +2,54 @@ +Thu Jul 30 07:55:32 UTC 2026 - Michael Vetter <[email protected]> + +- Update to 4.20.0: + * Removals: + The following programs and features were deprecated in 4.19 + or earlier, and have been removed in 4.20. + + expiry(1) (deprecated in 4.19). See #1481 and #1432. + + login.defs(5): ENCRYPT_METHOD: DES (deprecated in 4.19). See #1456. + + login.defs(5): ENCRYPT_METHOD: MD5 (deprecated in 4.19). See #1457. + + login.defs(5): MD5_CRPYT_ENAB (deprecated since the dinosaurs were around). See #1455. + + shadow(5): .sp_min (deprecated in 4.19). See #1482. + This also includes the following removals: + - chage(1): -m,--mindays (also the interactive version) + - passwd(1): -n,--mindays + - login.defs(5): PASS_MIN_DAYS + This feature is considered a vulnerability, and was removed without replacement. + Programs will now fail when any of those flags or variable are specified. + This is intentional, and should help identify any scripts that rely on + these. + + groupmems(8) (deprecated in 4.19). See #1343 and #1601. Use usermod(8) instead. + + logoutd(8) (deprecated in 4.19). See #999 and #1344. + * Defaults: + The following default values were changed. + + login.defs(5): Remove defaults for password expiration (PASS_MAX_DAYS, PASS_WARN_AGE). See #1428. + + login.defs(5): ENCRYPT_METHOD: Default to SHA512 (previously, it was DES). See #1278 and #1454. + Users should still explicitly specify it, since other programs that read login.defs(5) may still default to DES. + * Features: + The following features that were optional in 4.19 are now unconditionally supported in 4.20. + + SHA256, SHA512 See #1278 and #1452. + * Regressions: + Some regressions have been introduced (as side effects of bug fixes) and they're here to stay. Users must adapt. + + `su - <USERNAME>` as root brings inappropriate ioctl for device #1704 + + `usermod --unlock` on an account without valid password will exit with status 20 instead of print a warning #1706 + * Dependencies: + + We've removed an unused dependency (libattr). See #1473. + * Deprecations: + No new deprecations since 4.19. However, we maintain the deprecations from then. +- Refresh patches: + * shadow-login_defs-comments.patch + Line offsets and dropping MD5_CRYPT_ENAB. + * shadow-login_defs-suse.patch + Drop PASS_MAX_DAYS/PASS_MIN_DAYS/PASS_WARN_AGE. We set them to 0 earlier to + disable them because PAM handles it. So we have the same effect still. + Drop PASS_MAX_LEN since DES support got removed. + Drop MD5_CRYPT_ENAB. + PASS_CHANGE_TRIES got dropped upstream. + * shadow-login_defs-unused-by-pam.patch + Drop PASS_MAX_DAYS, PASS_MIN_DAYS, PASS_WARN_AGE, PASS_MAX_LEN, and PASS_MIN_LEN. + * shadow-util-linux.patch +- Add PASS_ALWAYS_WARN, PASS_CHANGE_TRIES, PASS_MAX_DAYS, PASS_MIN_LEN, + PASS_WARN_AGE, OBSCURE_CHECKS_ENAB to false positives in shadow-login_defs-check.sh +- Add shadow-4.20-stdint.patch to fix an include + +------------------------------------------------------------------- Old: ---- shadow-4.19.4.tar.xz shadow-4.19.4.tar.xz.asc New: ---- shadow-4.20-stdint.patch shadow-4.20.0.tar.xz shadow-4.20.0.tar.xz.asc ----------(New B)---------- New: PASS_WARN_AGE, OBSCURE_CHECKS_ENAB to false positives in shadow-login_defs-check.sh - Add shadow-4.20-stdint.patch to fix an include ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ shadow.spec ++++++ --- /var/tmp/diff_new_pack.7g8HJd/_old 2026-08-05 17:46:00.192793074 +0200 +++ /var/tmp/diff_new_pack.7g8HJd/_new 2026-08-05 17:46:00.192793074 +0200 @@ -22,7 +22,7 @@ %define no_config 1 %endif Name: shadow -Version: 4.19.4 +Version: 4.20.0 Release: 0 Summary: Utilities to Manage User and Group Accounts License: BSD-3-Clause AND GPL-2.0-or-later @@ -50,6 +50,8 @@ Patch4: shadow-login_defs-suse.patch # PATCH-FIX-SUSE disable_new_audit_function.patch [email protected] -- Disable newer libaudit functionality for older distributions. Patch5: disable_new_audit_function.patch +# PATCH-FIX-UPSTREAM shadow-4.20-stdint.patch [email protected] -- gh/shadow-maint/shadow#1699 +Patch6: shadow-4.20-stdint.patch BuildRequires: audit-devel > 2.3 BuildRequires: autoconf BuildRequires: automake @@ -99,20 +101,20 @@ This package contains the default login.defs configuration file as used by util-linux, pam and shadow. -%package -n libsubid5 +%package -n libsubid6 Summary: A library to manage subordinate uid and gid ranges Group: System/Base -%description -n libsubid5 +%description -n libsubid6 Utility library that provides a way to manage subid ranges. %package -n libsubid-devel -Summary: Development files for libsubid5 +Summary: Development files for libsubid6 Group: System/Base -Requires: libsubid5 = %{version} +Requires: libsubid6 = %{version} %description -n libsubid-devel -Development files for libsubid5. +Development files for libsubid6. %package pw-mgmt Summary: Tools to manage user account data @@ -122,7 +124,7 @@ %description pw-mgmt This sub-package contains utilities to manage user account -information like chage, chfn, chsh, expiry and passwd. This +information like chage, chfn, chsh and passwd. This binaries all need setuid rights to work correct. %prep @@ -135,6 +137,7 @@ %if 0%{?suse_version} < 1330 %patch -P 5 -p1 %endif +%patch -P 6 -p1 iconv -c -f ISO88591 -t utf-8 doc/HOWTO > doc/HOWTO.utf8 mv -v doc/HOWTO.utf8 doc/HOWTO @@ -186,11 +189,6 @@ rm %{buildroot}/%{_mandir}/man8/grpunconv.* rm %{buildroot}/%{_mandir}/*/man8/grpunconv.* -rm %{buildroot}/%{_sbindir}/groupmems -rm %{buildroot}/%{_mandir}/man8/groupmems.* -rm %{buildroot}/%{_mandir}/*/man8/groupmems.* -rm %{buildroot}%{_sysconfdir}/pam.d/groupmems - rm %{buildroot}/%{_bindir}/login rm %{buildroot}/%{_mandir}/man1/login.* rm %{buildroot}/%{_mandir}/*/man1/login.* @@ -207,9 +205,6 @@ rm %{buildroot}/%{_mandir}/man8/faillog.* rm %{buildroot}/%{_mandir}/*/man8/faillog.* -rm %{buildroot}/%{_sbindir}/logoutd -rm %{buildroot}/%{_mandir}/man8/logoutd.* -rm %{buildroot}/%{_mandir}/*/man8/logoutd.* rm %{buildroot}/%{_sbindir}/nologin rm %{buildroot}/%{_mandir}/man8/nologin.* rm %{buildroot}/%{_mandir}/*/man8/nologin.* @@ -257,7 +252,6 @@ %set_permissions %{_bindir}/chage %set_permissions %{_bindir}/chfn %set_permissions %{_bindir}/chsh -%set_permissions %{_bindir}/expiry %set_permissions %{_bindir}/newgidmap %set_permissions %{_bindir}/newuidmap %set_permissions %{_bindir}/passwd @@ -272,7 +266,6 @@ %verify_permissions %{_bindir}/chage %verify_permissions %{_bindir}/chfn %verify_permissions %{_bindir}/chsh -%verify_permissions %{_bindir}/expiry %verify_permissions %{_bindir}/newgrp %verify_permissions %{_bindir}/newgidmap %verify_permissions %{_bindir}/newuidmap @@ -298,8 +291,8 @@ # - Migration to /usr/etc (after SLE15 and Leap 15) test -f %{_sysconfdir}/login.defs.rpmsave && mv -v %{_sysconfdir}/login.defs.rpmsave %{_sysconfdir}/login.defs ||: -%post -n libsubid5 -p /sbin/ldconfig -%postun -n libsubid5 -p /sbin/ldconfig +%post -n libsubid6 -p /sbin/ldconfig +%postun -n libsubid6 -p /sbin/ldconfig %files -f shadow.lang %license COPYING @@ -370,7 +363,6 @@ %verify(not mode) %attr(2755,root,shadow) %{_bindir}/chage %verify(not mode) %attr(4755,root,shadow) %{_bindir}/chfn %verify(not mode) %attr(4755,root,shadow) %{_bindir}/chsh -%verify(not mode) %attr(4755,root,shadow) %{_bindir}/expiry %verify(not mode caps) %attr(0755,root,root) %{_bindir}/newgidmap %verify(not mode caps) %attr(0755,root,root) %{_bindir}/newuidmap %verify(not mode) %attr(4755,root,shadow) %{_bindir}/passwd @@ -379,7 +371,6 @@ %{_mandir}/man1/chage.1%{?ext_man} %{_mandir}/man1/chfn.1%{?ext_man} %{_mandir}/man1/chsh.1%{?ext_man} -%{_mandir}/man1/expiry.1%{?ext_man} %{_mandir}/man1/newgidmap.1%{?ext_man} %{_mandir}/man1/newuidmap.1%{?ext_man} %{_mandir}/man1/passwd.1%{?ext_man} @@ -393,7 +384,7 @@ %endif %{_mandir}/man5/login.defs.5%{?ext_man} -%files -n libsubid5 +%files -n libsubid6 %{_libdir}/libsubid.so.* %files -n libsubid-devel ++++++ shadow-4.20-stdint.patch ++++++ >From ba4419c57b222b0d34a2b933e7ee92914a51b596 Mon Sep 17 00:00:00 2001 From: ojab <[email protected]> Date: Wed, 29 Jul 2026 15:07:43 +0000 Subject: [PATCH] subid: Add `<stdint.h>` for `uintmax_t` ``` find_new_sub_uids.c:80:27: error: 'uintmax_t' undeclared (first use in this function) find_new_sub_gids.c:80:27: error: 'uintmax_t' undeclared (first use in this function) ``` Fixes: 4d800cf2eb9e (2026-04-09; "subid: Add deterministic subid ranges") --- lib/find_new_sub_gids.c | 1 + lib/find_new_sub_uids.c | 1 + 2 files changed, 2 insertions(+) diff --git a/lib/find_new_sub_gids.c b/lib/find_new_sub_gids.c index 3971ce922e..de514d6b09 100644 --- a/lib/find_new_sub_gids.c +++ b/lib/find_new_sub_gids.c @@ -8,6 +8,7 @@ #ifdef ENABLE_SUBIDS +#include <stdint.h> #include <stdio.h> #include <errno.h> diff --git a/lib/find_new_sub_uids.c b/lib/find_new_sub_uids.c index 65f6815467..f0b4328387 100644 --- a/lib/find_new_sub_uids.c +++ b/lib/find_new_sub_uids.c @@ -8,6 +8,7 @@ #ifdef ENABLE_SUBIDS +#include <stdint.h> #include <stdio.h> #include <errno.h> ++++++ shadow-4.19.4.tar.xz -> shadow-4.20.0.tar.xz ++++++ ++++ 456266 lines of diff (skipped) ++++++ shadow-login_defs-check.sh ++++++ --- /var/tmp/diff_new_pack.7g8HJd/_old 2026-08-05 17:46:13.577261252 +0200 +++ /var/tmp/diff_new_pack.7g8HJd/_new 2026-08-05 17:46:13.585261532 +0200 @@ -208,6 +208,10 @@ ISSUE_FILE ) return 0 ;; # PREVENT_NO_AUTH us used only by login.c and su.c that are deleted in the spec. PREVENT_NO_AUTH ) return 0 ;; +# Deprecated and removed upstream in 4.20.0 + PASS_MAX_DAYS | PASS_MIN_LEN | PASS_WARN_AGE ) return 0 ;; +# Unused due to PAM handling + OBSCURE_CHECKS_ENAB | PASS_ALWAYS_WARN | PASS_CHANGE_TRIES ) return 0 ;; * ) return 1 ;; esac } ++++++ shadow-login_defs-comments.patch ++++++ --- /var/tmp/diff_new_pack.7g8HJd/_old 2026-08-05 17:46:13.609262373 +0200 +++ /var/tmp/diff_new_pack.7g8HJd/_new 2026-08-05 17:46:13.613262513 +0200 @@ -30,7 +30,7 @@ ALWAYS_SET_PATH no # -@@ -148,6 +149,11 @@ PASS_WARN_AGE 7 +@@ -137,6 +138,11 @@ UMASK 022 # # Min/max values for automatic uid selection in useradd(8) # @@ -42,7 +42,7 @@ UID_MIN 1000 UID_MAX 60000 # System accounts -@@ -161,6 +167,11 @@ SUB_UID_COUNT 65536 +@@ -185,6 +191,11 @@ SUB_UID_COUNT 65536 # # Min/max values for automatic gid selection in groupadd(8) # @@ -54,20 +54,12 @@ GID_MIN 1000 GID_MAX 60000 # System accounts -@@ -196,7 +207,6 @@ LOGIN_TIMEOUT 60 +@@ -255,7 +266,6 @@ LOGIN_TIMEOUT 60 CHFN_RESTRICT rwh # --# Only works if compiled with MD5_CRYPT defined: - # If set to "yes", new passwords will be encrypted using the MD5-based - # algorithm compatible with the one used by recent releases of FreeBSD. - # It supports passwords of unlimited length and longer salt strings. -@@ -211,7 +221,6 @@ CHFN_RESTRICT rwh - #MD5_CRYPT_ENAB no - - # -# Only works if compiled with ENCRYPTMETHOD_SELECT defined: - # If set to MD5, MD5-based algorithm will be used for encrypting password # If set to SHA256, SHA256-based algorithm will be used for encrypting password # If set to SHA512, SHA512-based algorithm will be used for encrypting password + # If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password ++++++ shadow-login_defs-suse.patch ++++++ --- /var/tmp/diff_new_pack.7g8HJd/_old 2026-08-05 17:46:13.641263493 +0200 +++ /var/tmp/diff_new_pack.7g8HJd/_new 2026-08-05 17:46:13.649263774 +0200 @@ -75,8 +75,8 @@ +HOME_MODE 0700 # - # Password aging controls: -@@ -157,8 +160,8 @@ PASS_WARN_AGE 7 + # Min/max values for automatic uid selection in useradd(8) +@@ -146,8 +149,8 @@ UMASK 022 UID_MIN 1000 UID_MAX 60000 # System accounts @@ -87,7 +87,7 @@ # Extra per user uids SUB_UID_MIN 100000 SUB_UID_MAX 600100000 -@@ -175,8 +178,8 @@ SUB_UID_COUNT 65536 +@@ -199,8 +202,8 @@ SUB_UID_COUNT 65536 GID_MIN 1000 GID_MAX 60000 # System accounts @@ -98,7 +98,7 @@ # Extra per user group ids SUB_GID_MIN 100000 SUB_GID_MAX 600100000 -@@ -185,7 +188,7 @@ SUB_GID_COUNT 65536 +@@ -244,7 +247,7 @@ SUB_GID_COUNT 65536 # # Max number of login(1) retries if password is bad # @@ -107,37 +107,16 @@ # # Tell login to only re-prompt for the password if authentication -@@ -207,20 +210,6 @@ LOGIN_TIMEOUT 60 - CHFN_RESTRICT rwh - - # --# If set to "yes", new passwords will be encrypted using the MD5-based --# algorithm compatible with the one used by recent releases of FreeBSD. --# It supports passwords of unlimited length and longer salt strings. --# Set to "no" if you need to copy encrypted passwords to other systems --# which don't understand the new algorithm. Default is "no". --# --# Note: if you use PAM, it is recommended to use a value consistent with --# the PAM modules configuration. --# --# This variable is deprecated. You should use ENCRYPT_METHOD instead. --# --#MD5_CRYPT_ENAB no -- --# - # If set to MD5, MD5-based algorithm will be used for encrypting password - # If set to SHA256, SHA256-based algorithm will be used for encrypting password - # If set to SHA512, SHA512-based algorithm will be used for encrypting password -@@ -233,7 +222,7 @@ CHFN_RESTRICT rwh +@@ -274,7 +277,7 @@ CHFN_RESTRICT rwh # Note: if you use PAM, it is recommended to use a value consistent with # the PAM modules configuration. # --#ENCRYPT_METHOD DES +-#ENCRYPT_METHOD SHA512 +ENCRYPT_METHOD SHA512 # # Only works if ENCRYPT_METHOD is set to SHA256 or SHA512. -@@ -299,7 +288,7 @@ USERGROUPS_ENAB yes +@@ -340,7 +343,7 @@ USERGROUPS_ENAB yes # This option is overridden with the -M or -m flags on the useradd(8) # command-line. # ++++++ shadow-login_defs-unused-by-pam.patch ++++++ --- /var/tmp/diff_new_pack.7g8HJd/_old 2026-08-05 17:46:13.665264334 +0200 +++ /var/tmp/diff_new_pack.7g8HJd/_new 2026-08-05 17:46:13.673264614 +0200 @@ -152,17 +152,8 @@ # Default initial "umask" value used by login(1) on non-PAM enabled systems. # Default "umask" value for pam_umask(8) on PAM enabled systems. -@@ -211,23 +125,13 @@ UMASK 022 - # - # PASS_MAX_DAYS Maximum number of days a password may be used. - # PASS_MIN_DAYS Minimum number of days allowed between password changes. --# PASS_MIN_LEN Minimum acceptable password length. - # PASS_WARN_AGE Number of days warning given before a password expires. - # - PASS_MAX_DAYS 99999 - PASS_MIN_DAYS 0 --PASS_MIN_LEN 5 - PASS_WARN_AGE 7 +@@ -207,14 +121,6 @@ UMASK 022 + #HOME_MODE 0700 # -# If "yes", the user must be listed as a member of the first gid 0 group @@ -176,7 +167,7 @@ # Min/max values for automatic uid selection in useradd(8) # UID_MIN 1000 -@@ -264,28 +168,6 @@ LOGIN_RETRIES 5 +@@ -321,24 +227,6 @@ LOGIN_RETRIES 5 LOGIN_TIMEOUT 60 # @@ -185,16 +176,12 @@ -PASS_CHANGE_TRIES 5 - -# --# Warn about weak passwords (but still allow them) if you are root. +-# Password strength controls: -# +-# Warn about weak passwords (but still allow them) if you are root. -PASS_ALWAYS_WARN yes -- --# --# Number of significant characters in the password for crypt(). --# Default is 8, don't change unless your crypt() is better. --# Only used for DES encryption algorithm. --# --#PASS_MAX_LEN 8 +-# Minimum acceptable password length. +-PASS_MIN_LEN 5 - -# -# Require password before chfn(1)/chsh(1) can make any changes. @@ -205,7 +192,7 @@ # Which fields may be changed by regular users using chfn(1) - use # any combination of letters "frwh" (full name, room number, work # phone, home phone). If not defined, no changes are allowed. -@@ -294,13 +176,6 @@ CHFN_AUTH yes +@@ -347,13 +235,6 @@ CHFN_AUTH yes CHFN_RESTRICT rwh # @@ -216,10 +203,10 @@ -#LOGIN_STRING "%s's Password: " - -# - # Only works if compiled with MD5_CRYPT defined: - # If set to "yes", new passwords will be encrypted using the MD5-based - # algorithm compatible with the one used by recent releases of FreeBSD. -@@ -349,45 +224,6 @@ CHFN_RESTRICT rwh + # Only works if compiled with ENCRYPTMETHOD_SELECT defined: + # If set to SHA256, SHA256-based algorithm will be used for encrypting password + # If set to SHA512, SHA512-based algorithm will be used for encrypting password +@@ -383,45 +264,6 @@ CHFN_RESTRICT rwh #SHA_CRYPT_MAX_ROUNDS 5000 # @@ -265,7 +252,7 @@ # Should login be allowed if we can't cd to the home directory? # Default is no. # -@@ -402,12 +238,6 @@ DEFAULT_HOME yes +@@ -436,12 +278,6 @@ DEFAULT_HOME yes NONEXISTENT /nonexistent # ++++++ shadow-util-linux.patch ++++++ --- /var/tmp/diff_new_pack.7g8HJd/_old 2026-08-05 17:46:13.709265875 +0200 +++ /var/tmp/diff_new_pack.7g8HJd/_new 2026-08-05 17:46:13.717266155 +0200 @@ -109,7 +109,7 @@ # Default initial "umask" value used by login(1) on non-PAM enabled systems. # Default "umask" value for pam_umask(8) on PAM enabled systems. # UMASK is also used by useradd(8) and newusers(8) to set the mode for new -@@ -163,6 +177,12 @@ SUB_GID_COUNT 65536 +@@ -222,6 +236,12 @@ SUB_GID_COUNT 65536 LOGIN_RETRIES 5 # @@ -122,7 +122,7 @@ # Max time in seconds for login(1) # LOGIN_TIMEOUT 60 -@@ -285,14 +305,6 @@ USERGROUPS_ENAB yes +@@ -325,14 +345,6 @@ USERGROUPS_ENAB yes #GRANT_AUX_GROUP_SUBIDS yes # @@ -137,7 +137,7 @@ # Select the HMAC cryptography algorithm. # Used in pam_timestamp module to calculate the keyed-hash message # authentication code. -@@ -301,3 +313,19 @@ PREVENT_NO_AUTH superuser +@@ -341,3 +353,19 @@ PREVENT_NO_AUTH superuser # that are available in your system. # #HMAC_CRYPTO_ALGO SHA512 @@ -157,16 +157,4 @@ +# +#LOGIN_SHELL_FALLBACK no + -Index: lib/getdef.c -=================================================================== ---- lib/getdef.c.orig -+++ lib/getdef.c -@@ -79,6 +79,7 @@ struct itemdef { - {"LOGIN_ENV_SAFELIST", NULL}, \ - {"LOGIN_KEEP_USERNAME", NULL}, \ - {"LOGIN_PLAIN_PROMPT", NULL}, \ -+ {"LOGIN_SHELL_FALLBACK", NULL}, \ - {"MOTD_FIRSTONLY", NULL}, \ - -
