packages/utils/shadow/Makefile, branch master

shadow: update to 4.19.4

2026-05-22T03:57:39Z

Large version jump from 4.8.1 to 4.19.4 (latest upstream LTS). Build changes: - Refresh patches/004-fix-su-controoling-term.patch: su.c moved the ioctl() call from line 1122 to 1169 and changed (char *) 0 to (char *) NULL; update patch context and re-canonicalise through quilt (blank context line spacing). - New CONFIGURE_ARGS: * --disable-logind: 4.19.4 added an optional libsystemd-based logind integration which OpenWrt doesn't ship. * --without-libbsd: shadow's configure now hard-fails on missing readpassphrase() unless libbsd is found; the in-tree lib/readpassphrase.c fallback is enabled by --without-libbsd. * --without-sssd: avoid dragging in an sssd build dep. * --disable-subordinate-ids: 4.19.4 builds libsubid (subuid/subgid runtime API) unconditionally when subids are enabled, and its libtool -export-symbols-regex generates a version script that binutils 2.40+ rejects against libxcrypt's versioned crypt_checksalt@@XCRYPT_4.3 symbol. Disabling subordinate-ids skips libsubid entirely; OpenWrt doesn't ship libsubid. - Drop newgidmap, newuidmap, lastlog and groups from SHADOW_APPLETS: newgidmap/newuidmap are only built when subordinate-ids are enabled, lastlog defaults to disabled in 4.19.4, and the groups binary was removed from shadow upstream (use coreutils). Test coverage: - Replace the per-applet --version check in test.sh with per-applet functional tests: pwck -> 'pwck -r' read-only consistency check; accept non-zero exit since the CI container's /etc/passwd trips minor warnings. grpck -> 'grpck -r' read-only consistency check. chage -> 'chage -l root' lists password aging info. useradd -> 'useradd -D' dumps defaults without modifying state. passwd -> 'passwd -S root' prints the password status line. faillog -> create empty /var/log/faillog then 'faillog -a' must emit a header line. login/su -> PAM-interactive; presence covered by generic tests. Other applets -> verify binary presence (CI's generic tests already check stripped, no build paths, linked-libs). - Add test-version.sh as a generic-version-check override: shadow tools don't honour --version (only --help), so the framework's probe finds no PKG_VERSION match in any binary and would otherwise fail Generic tests for every sub-package. Signed-off-by: Alexandru Ardelean

treewide: set me where PKG_MAINTAINER empty

2026-04-16T18:48:36Z

Seems a lot of packages are just getting abandoned by people. Will pick these up and see them through. Signed-off-by: Alexandru Ardelean

shadow: restore PKG_BUILD_DEPENDS to libxcrypt

2025-07-09T09:01:07Z

This reverts commit f18594a00f6324045a7019863a5278a3f6f52e64. The whole libxcrypt package was reworked in the base repo to fix libcrypto-compat and the name was restored to libxcrypt. Signed-off-by: Robert Marko

shadow: update build dependencies

2025-06-29T09:17:31Z

The package libxcrypt was renamed to xcrypt when added to the core repo [1]. 1. https://github.com/openwrt/openwrt/commit/f544392fc3c6c435e4b9acaca5744abb8ccb0a55 Signed-off-by: Tianling Shen

shadow: use libxcrypt

2020-06-23T01:33:17Z

Since size is not a problem here, use libxcrypt to avoid algorithm availability. Changed default to bcrypt as that's the strongest supported by shadow-utils. Signed-off-by: Rosen Penev

shadow: don't compile bcrypt for unsupported platforms

2020-06-16T22:23:17Z

If musl has no bcrypt: passwd: failed to crypt password with salt '$2a$13$w8EJ0Yfz5bGsG4U/0m7bk/': Function not implemented The password for root is unchanged. glibc output as it has no bcrypt: passwd: failed to crypt password with salt '$2a$13$xbpmAYmq6Q/rZN5jOlNxJZ': Invalid argument The password for root is unchanged. --without-bcrypt output: Invalid ENCRYPT_METHOD value: 'BCRYPT'. Defaulting to DES. passwd: password changed. The solution was tested on glibc despite using a musl specific variable Still works. Signed-off-by: Rosen Penev

shadow: update to 4.8.1

2020-02-02T21:07:52Z

Fixed license information. Removed patch requiring autoreconf and replaced with a configure variable. Removed faulty patch that broke systems without a disabled crypt size hack. Replaced with using a SED command as well as bcrypt, which works in musl. Removed su patch and converted it to a SED command in the Makefile. Added new shadow utilities. Signed-off-by: Rosen Penev

shadow: change default encryption method from DES to SHA512

2019-12-18T10:37:39Z

Busybox in default uses SHA512 as well. On big ditribution this default is sourced from PAM. That means that shadow reads pam settings and uses that. OpenWrt in most cases does not have PAM installed and in such case shadow fallbacks to its own default which is DES. This just changes that default to SHA512 which is consistent with rest of the system. Signed-off-by: Karel Kočí

treewide: add PKG_CPE_ID for better cvescanner coverage

2019-09-17T10:40:26Z

Signed-off-by: Jan Pavlinec

shadow: Update to 4.6

2018-08-16T01:31:34Z

Switched dead URLs to new upstream. Signed-off-by: Rosen Penev