30 changed files with 4669 additions and 1080 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
-1
--- a/.gitignore
+++ b/.gitignore
@ -5,52 +5,3 @@ shadow-4.1.4.2.tar.bz2
 /shadow-4.1.5.1.tar.bz2.sig
 /shadow-4.2.1.tar.xz
 /shadow-4.2.1.tar.xz.sig
-/shadow-4.3.1.tar.gz
-/shadow-4.5.tar.xz
-/shadow-4.5.tar.xz.asc
-/shadow-4.6.tar.xz
-/shadow-4.6.tar.xz.asc
-/shadow-4.8.tar.xz
-/shadow-4.8.tar.xz.asc
-/shadow-4.8.1.tar.xz
-/shadow-4.8.1.tar.xz.asc
-/shadow-4.9.tar.xz
-/shadow-4.9.tar.xz.asc
-/shadow-4.11.1.tar.xz
-/shadow-4.11.1.tar.xz.asc
-/shadow-4.12.3.tar.xz
-/shadow-4.12.3.tar.xz.asc
-/shadow-4.13.tar.xz
-/shadow-4.13.tar.xz.asc
-/shadow-4.14.0.tar.xz
-/shadow-4.14.0.tar.xz.asc
-/shadow-4.15.0rc2.tar.xz
-/shadow-4.15.0rc2.tar.xz.asc
-/shadow-4.15.0rc3.tar.xz
-/shadow-4.15.0rc3.tar.xz.asc
-/shadow-4.15.0.tar.xz
-/shadow-4.15.0.tar.xz.asc
-/shadow-4.15.1.tar.xz
-/shadow-4.15.1.tar.xz.asc
-/shadow-4.16.0.tar.xz
-/shadow-4.16.0.tar.xz.asc
-/shadow-4.17.0-rc1.tar.xz
-/shadow-4.17.0-rc1.tar.xz.asc
-/shadow-4.17.0.tar.xz
-/shadow-4.17.0.tar.xz.asc
-/shadow-4.17.4.tar.xz
-/shadow-4.17.4.tar.xz.asc
-/shadow-4.18.0.tar.xz
-/shadow-4.18.0.tar.xz.asc
-/shadow-4.19.0.tar.xz
-/shadow-4.19.0.tar.xz.asc
-/shadow-4.19.2.tar.xz
-/shadow-4.19.2.tar.xz.asc
-/shadow-4.19.3.tar.xz
-/shadow-4.19.3.tar.xz.asc
-/shadow-4.20.0-rc2.tar.xz
-/shadow-4.20.0-rc2.tar.xz.asc
-/shadow-4.20.0-rc3.tar.xz
-/shadow-4.20.0-rc3.tar.xz.asc
-/shadow-4.20.0.tar.xz
-/shadow-4.20.0.tar.xz.asc
--- a/passwd.pamd
+++ b/passwd.pamd
@ -1,5 +0,0 @@
-#%PAM-1.0
-# This tool only uses the password stack.
-password   substack	system-auth
-password   optional	pam_gnome_keyring.so use_authtok
-password   substack	postlogin
--- a/plans/tier0-functional.fmf
+++ b/plans/tier0-functional.fmf
@ -1,51 +0,0 @@
-summary: Tier 0 functional tests for shadow-utils
-description: |
-    Run comprehensive system tests for shadow-utils. These tests validate user and group
-    account management functionality by testing actual system operations including user
-    creation, password management, group operations, and verification of system files
-    (i.e. /etc/passwd, /etc/shadow).
-
-provision:
-    how: virtual
-    image: fedora
-
-prepare:
-    - name: Install general dependencies
-      how: install
-      package:
-        - expect
-        - gcc
-        - git
-        - libssh-devel
-        - python3-devel
-        - python3-pip
-
-    - name: Setup SSH keys for localhost testing
-      how: shell
-      script:
-        - ssh-keygen -t rsa -f /root/.ssh/id_rsa -N "" -q
-        - cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys
-        - chmod 600 /root/.ssh/authorized_keys
-        - ssh-keyscan -H localhost >> /root/.ssh/known_hosts
-
-    - name: Clone shadow repository
-      how: shell
-      script:
-        - git clone https://github.com/shadow-maint/shadow.git /tmp/shadow-test
-
-    - name: Copy test topology for Fedora CI
-      how: shell
-      script:
-        - cp tests/mhc-fedora-ci.yaml /tmp/shadow-test/tests/system
-
-    - name: Install test dependencies
-      how: shell
-      script:
-        - pip3 install -r /tmp/shadow-test/tests/system/requirements.txt
-
-execute:
-    how: tmt
-    duration: 30m
-    script: |
-        cd /tmp/shadow-test/tests/system
-        pytest --mh-config=mhc-fedora-ci.yaml --mh-lazy-ssh -v
--- a/shadow-4.1.5-2ndskip.patch
+++ b/shadow-4.1.5-2ndskip.patch
@ -0,0 +1,100 @@
+diff -up shadow-4.1.5/src/grpconv.c.2ndskip shadow-4.1.5/src/grpconv.c
+--- shadow-4.1.5/src/grpconv.c.2ndskip	2012-06-18 13:08:34.438910815 +0200
+++ shadow-4.1.5/src/grpconv.c	2012-06-18 13:12:51.270764552 +0200
+@@ -143,6 +143,7 @@ int main (int argc, char **argv)
+ 	struct group grent;
+ 	const struct sgrp *sg;
+ 	struct sgrp sgent;
+	char *np;
+ 
+ 	Prog = Basename (argv[0]);
+ 
+@@ -184,20 +185,25 @@ int main (int argc, char **argv)
+ 	 * Remove /etc/gshadow entries for groups not in /etc/group.
+ 	 */
+ 	(void) sgr_rewind ();
+-	while ((sg = sgr_next ()) != NULL) {
+-		if (gr_locate (sg->sg_name) != NULL) {
+-			continue;
+-		}
+-
+-		if (sgr_remove (sg->sg_name) == 0) {
+-			/*
+-			 * This shouldn't happen (the entry exists) but...
+-			 */
+-			fprintf (stderr,
+-			         _("%s: cannot remove entry '%s' from %s\n"),
+-			         Prog, sg->sg_name, sgr_dbname ());
+-			fail_exit (3);
+	sg = sgr_next ();
+	np=NULL;
+	while (sg != NULL) {
+		np = strdup(sg->sg_name);
+		sg = sgr_next ();
+
+		if(gr_locate (np) == NULL) {
+			if (sgr_remove (np) == 0) {
+				/*
+				 * This shouldn't happen (the entry exists) but...
+				 */
+				fprintf (stderr,
+					 _("%s: cannot remove entry '%s' from %s\n"),
+					 Prog, np, sgr_dbname ());
+				free(np);
+				fail_exit (3);
+			}
+ 		}
+		free(np);
+ 	}
+ 
+ 	/*
+diff -up shadow-4.1.5/src/pwconv.c.2ndskip shadow-4.1.5/src/pwconv.c
+--- shadow-4.1.5/src/pwconv.c.2ndskip	2012-06-18 11:23:33.938511797 +0200
+++ shadow-4.1.5/src/pwconv.c	2012-06-18 12:57:18.396426194 +0200
+@@ -173,6 +173,7 @@ int main (int argc, char **argv)
+ 	struct passwd pwent;
+ 	const struct spwd *sp;
+ 	struct spwd spent;
+	char *np;
+ 
+ 	Prog = Basename (argv[0]);
+ 
+@@ -223,20 +224,25 @@ int main (int argc, char **argv)
+ 	 * Remove /etc/shadow entries for users not in /etc/passwd.
+ 	 */
+ 	(void) spw_rewind ();
+-	while ((sp = spw_next ()) != NULL) {
+-		if (pw_locate (sp->sp_namp) != NULL) {
+-			continue;
+-		}
+-
+-		if (spw_remove (sp->sp_namp) == 0) {
+-			/*
+-			 * This shouldn't happen (the entry exists) but...
+-			 */
+-			fprintf (stderr,
+-			         _("%s: cannot remove entry '%s' from %s\n"),
+-			         Prog, sp->sp_namp, spw_dbname ());
+-			fail_exit (E_FAILURE);
+	sp = spw_next ();
+	np = NULL;
+	while (sp != NULL) {
+		np = strdup(sp->sp_namp);
+		sp = spw_next ();
+
+		if (pw_locate (np) == NULL) {
+			if (spw_remove (np) == 0) {
+				/*
+				 * This shouldn't happen (the entry exists) but...
+				 */
+				fprintf (stderr,
+					 _("%s: cannot remove entry '%s' from %s\n"),
+					 Prog, np, spw_dbname ());
+				free(np);
+				fail_exit (E_FAILURE);
+			}
+ 		}
+		free(np);
+ 	}
+ 
+ 	/*
--- a/shadow-4.1.5-grremove.patch
+++ b/shadow-4.1.5-grremove.patch
@ -0,0 +1,45 @@
+diff -up shadow-4.1.5/src/userdel.c.grremove shadow-4.1.5/src/userdel.c
+--- shadow-4.1.5/src/userdel.c.grremove	2012-03-20 12:19:13.260854838 +0100
+++ shadow-4.1.5/src/userdel.c	2012-03-20 12:38:26.235622957 +0100
+@@ -333,22 +333,22 @@ static void remove_usergroup (void)
+ 		 * We can remove this group, it is not the primary
+ 		 * group of any remaining user.
+ 		 */
+-		if (gr_remove (grp->gr_name) == 0) {
+		if (gr_remove (user_name) == 0) {
+ 			fprintf (stderr,
+ 			         _("%s: cannot remove entry '%s' from %s\n"),
+-			         Prog, grp->gr_name, gr_dbname ());
+			         Prog, user_name, gr_dbname ());
+ 			fail_exit (E_GRP_UPDATE);
+ 		}
+ 
+ #ifdef WITH_AUDIT
+ 		audit_logger (AUDIT_DEL_GROUP, Prog,
+ 		              "deleting group",
+-		              grp->gr_name, AUDIT_NO_ID,
+		              user_name, AUDIT_NO_ID,
+ 		              SHADOW_AUDIT_SUCCESS);
+ #endif				/* WITH_AUDIT */
+ 		SYSLOG ((LOG_INFO,
+ 		         "removed group '%s' owned by '%s'\n",
+-		         grp->gr_name, user_name));
+		         user_name, user_name));
+ 
+ #ifdef	SHADOWGRP
+ 		if (sgr_locate (user_name) != NULL) {
+@@ -361,12 +361,12 @@ static void remove_usergroup (void)
+ #ifdef WITH_AUDIT
+ 			audit_logger (AUDIT_DEL_GROUP, Prog,
+ 			              "deleting shadow group",
+-			              grp->gr_name, AUDIT_NO_ID,
+			              user_name, AUDIT_NO_ID,
+ 			              SHADOW_AUDIT_SUCCESS);
+ #endif				/* WITH_AUDIT */
+ 			SYSLOG ((LOG_INFO,
+ 			         "removed shadow group '%s' owned by '%s'\n",
+-			         grp->gr_name, user_name));
+			         user_name, user_name));
+ 
+ 		}
+ #endif				/* SHADOWGRP */
--- a/shadow-4.1.5-redhat.patch
+++ b/shadow-4.1.5-redhat.patch
@ -0,0 +1,42 @@
+diff -up shadow-4.1.5/man/useradd.8.redhat shadow-4.1.5/man/useradd.8
+diff -up shadow-4.1.5/src/useradd.c.redhat shadow-4.1.5/src/useradd.c
+--- shadow-4.1.5/src/useradd.c.redhat	2011-12-09 23:23:15.000000000 +0100
+++ shadow-4.1.5/src/useradd.c	2012-03-19 09:50:05.227588669 +0100
+@@ -93,7 +93,7 @@ const char *Prog;
+ static gid_t def_group = 100;
+ static const char *def_gname = "other";
+ static const char *def_home = "/home";
+-static const char *def_shell = "";
+static const char *def_shell = "/sbin/nologin";
+ static const char *def_template = SKEL_DIR;
+ static const char *def_create_mail_spool = "no";
+ 
+@@ -103,7 +103,7 @@ static const char *def_expire = "";
+ #define	VALID(s)	(strcspn (s, ":\n") == strlen (s))
+ 
+ static const char *user_name = "";
+-static const char *user_pass = "!";
+static const char *user_pass = "!!";
+ static uid_t user_id;
+ static gid_t user_gid;
+ static const char *user_comment = "";
+@@ -1011,9 +1011,9 @@ static void process_flags (int argc, cha
+ 		};
+ 		while ((c = getopt_long (argc, argv,
+ #ifdef WITH_SELINUX
+-		                         "b:c:d:De:f:g:G:hk:K:lmMNop:rR:s:u:UZ:",
+		                         "b:c:d:De:f:g:G:hk:K:lmMnNop:rR:s:u:UZ:",
+ #else				/* !WITH_SELINUX */
+-		                         "b:c:d:De:f:g:G:hk:K:lmMNop:rR:s:u:U",
+		                         "b:c:d:De:f:g:G:hk:K:lmMnNop:rR:s:u:U",
+ #endif				/* !WITH_SELINUX */
+ 		                         long_options, NULL)) != -1) {
+ 			switch (c) {
+@@ -1164,6 +1164,7 @@ static void process_flags (int argc, cha
+ 			case 'M':
+ 				Mflg = true;
+ 				break;
+			case 'n':
+ 			case 'N':
+ 				Nflg = true;
+ 				break;
--- a/shadow-4.1.5-uflg.patch
+++ b/shadow-4.1.5-uflg.patch
@ -0,0 +1,23 @@
+diff -up shadow-4.1.5/libmisc/find_new_gid.c.uflg shadow-4.1.5/libmisc/find_new_gid.c
+--- shadow-4.1.5/libmisc/find_new_gid.c.uflg	2011-07-30 01:10:27.000000000 +0200
+++ shadow-4.1.5/libmisc/find_new_gid.c	2012-03-19 12:51:46.090554116 +0100
+@@ -68,7 +68,7 @@ int find_new_gid (bool sys_group,
+ 			return -1;
+ 		}
+ 	} else {
+-		gid_min = (gid_t) getdef_ulong ("SYS_GID_MIN", 101UL);
+		gid_min = (gid_t) 1;
+ 		gid_max = (gid_t) getdef_ulong ("GID_MIN", 1000UL) - 1;
+ 		gid_max = (gid_t) getdef_ulong ("SYS_GID_MAX", (unsigned long) gid_max);
+ 		if (gid_max < gid_min) {
+@@ -100,6 +100,10 @@ int find_new_gid (bool sys_group,
+ 		return 0;
+ 	}
+ 
+        /* if we did not find free preffered system gid, we start to look for
+         * one in the range assigned to dynamic system IDs */
+        if (sys_group)
+                gid_min = (gid_t) getdef_ulong ("SYS_GID_MIN", 101UL);
+ 
+ 	/*
+ 	 * Search the entire group file,
--- a/shadow-4.1.5.1-audit-owner.patch
+++ b/shadow-4.1.5.1-audit-owner.patch
@ -0,0 +1,32 @@
+diff -up shadow-4.1.5.1/src/usermod.c.audit shadow-4.1.5.1/src/usermod.c
+--- shadow-4.1.5.1/src/usermod.c.audit	2011-11-21 23:02:16.000000000 +0100
+++ shadow-4.1.5.1/src/usermod.c	2013-06-14 14:54:20.237026550 +0200
+@@ -1513,6 +1513,14 @@ static void move_home (void)
+ 			fail_exit (E_HOMEDIR);
+ 		}
+ 
+#ifdef WITH_AUDIT
+		if (uflg || gflg) {
+			audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
+				      "changing home directory owner",
+				      user_newname, (unsigned int) user_newid, 1);
+		}
+#endif
+
+ 		if (rename (user_home, user_newhome) == 0) {
+ 			/* FIXME: rename above may have broken symlinks
+ 			 *        pointing to the user's home directory
+@@ -1947,6 +1955,13 @@ int main (int argc, char **argv)
+ 			 * ownership.
+ 			 *
+ 			 */
+#ifdef WITH_AUDIT
+			if (uflg || gflg) {
+				audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
+					      "changing home directory owner",
+					      user_newname, (unsigned int) user_newid, 1);
+			}
+#endif
+ 			if (chown_tree (dflg ? user_newhome : user_home,
+ 			                user_id,
+ 			                uflg ? user_newid  : (uid_t)-1,
--- a/shadow-4.1.5.1-backup-mode.patch
+++ b/shadow-4.1.5.1-backup-mode.patch
@ -0,0 +1,20 @@
+diff -up shadow-4.1.5.1/lib/commonio.c.backup-mode shadow-4.1.5.1/lib/commonio.c
+--- shadow-4.1.5.1/lib/commonio.c.backup-mode	2012-05-18 21:44:54.000000000 +0200
+++ shadow-4.1.5.1/lib/commonio.c	2012-09-19 20:27:16.089444234 +0200
+@@ -301,15 +301,12 @@ static int create_backup (const char *ba
+ 	struct utimbuf ub;
+ 	FILE *bkfp;
+ 	int c;
+-	mode_t mask;
+ 
+ 	if (fstat (fileno (fp), &sb) != 0) {
+ 		return -1;
+ 	}
+ 
+-	mask = umask (077);
+-	bkfp = fopen (backup, "w");
+-	(void) umask (mask);
+	bkfp = fopen_set_perms (backup, "w", &sb);
+ 	if (NULL == bkfp) {
+ 		return -1;
+ 	}
--- a/shadow-4.1.5.1-default-range.patch
+++ b/shadow-4.1.5.1-default-range.patch
@ -0,0 +1,35 @@
+diff -up shadow-4.1.5.1/lib/semanage.c.default-range shadow-4.1.5.1/lib/semanage.c
+--- shadow-4.1.5.1/lib/semanage.c.default-range	2012-01-08 17:35:44.000000000 +0100
+++ shadow-4.1.5.1/lib/semanage.c	2013-06-14 15:14:51.970237594 +0200
+@@ -143,6 +143,7 @@ static int semanage_user_mod (semanage_h
+ 		goto done;
+ 	}
+ 
+#if 0
+ 	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
+ 	if (ret != 0) {
+ 		fprintf (stderr,
+@@ -150,6 +151,7 @@ static int semanage_user_mod (semanage_h
+ 		ret = 1;
+ 		goto done;
+ 	}
+#endif
+ 
+ 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
+ 	if (ret != 0) {
+@@ -200,6 +202,7 @@ static int semanage_user_add (semanage_h
+ 		goto done;
+ 	}
+ 
+#if 0
+ 	ret = semanage_seuser_set_mlsrange (handle, seuser, DEFAULT_SERANGE);
+ 	if (ret != 0) {
+ 		fprintf (stderr,
+@@ -208,6 +211,7 @@ static int semanage_user_add (semanage_h
+ 		ret = 1;
+ 		goto done;
+ 	}
+#endif
+ 
+ 	ret = semanage_seuser_set_sename (handle, seuser, seuser_name);
+ 	if (ret != 0) {
--- a/shadow-4.1.5.1-errmsg.patch
+++ b/shadow-4.1.5.1-errmsg.patch
@ -0,0 +1,23 @@
+diff -up shadow-4.1.5.1/src/useradd.c.logmsg shadow-4.1.5.1/src/useradd.c
+--- shadow-4.1.5.1/src/useradd.c.logmsg	2013-02-20 15:41:44.000000000 +0100
+++ shadow-4.1.5.1/src/useradd.c	2013-06-14 14:22:59.529661095 +0200
+@@ -1760,6 +1760,9 @@ static void create_home (void)
+ 	if (access (user_home, F_OK) != 0) {
+ #ifdef WITH_SELINUX
+ 		if (set_selinux_file_context (user_home, NULL) != 0) {
+			fprintf (stderr,
+			         _("%s: cannot set SELinux context for home directory %s\n"),
+			         Prog, user_home);
+ 			fail_exit (E_HOMEDIR);
+ 		}
+ #endif
+@@ -1789,6 +1792,9 @@ static void create_home (void)
+ #ifdef WITH_SELINUX
+ 		/* Reset SELinux to create files with default contexts */
+ 		if (reset_selinux_file_context () != 0) {
+			fprintf (stderr,
+			         _("%s: cannot reset SELinux file creation context\n"),
+			         Prog);
+ 			fail_exit (E_HOMEDIR);
+ 		}
+ #endif
--- a/shadow-4.1.5.1-goodname.patch
+++ b/shadow-4.1.5.1-goodname.patch
@ -0,0 +1,99 @@
+diff -up shadow-4.1.5.1/libmisc/chkname.c.goodname shadow-4.1.5.1/libmisc/chkname.c
+--- shadow-4.1.5.1/libmisc/chkname.c.goodname	2009-07-13 00:24:45.000000000 +0200
+++ shadow-4.1.5.1/libmisc/chkname.c	2014-09-09 17:35:17.207303124 +0200
+@@ -47,27 +47,42 @@
+ #include "chkname.h"
+ 
+ static bool is_valid_name (const char *name)
+-{
+{      
+ 	/*
+-	 * User/group names must match [a-z_][a-z0-9_-]*[$]
+-	 */
+-	if (('\0' == *name) ||
+-	    !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
+         * User/group names must match gnu e-regex:
+         *    [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?
+         *
+         * as a non-POSIX, extension, allow "$" as the last char for
+         * sake of Samba 3.x "add machine script"
+         *
+         * Also do not allow fully numeric names.
+         */
+	int numeric;
+
+	if ( ('\0' == *name) ||
+             !((*name >= 'a' && *name <= 'z') ||
+               (*name >= 'A' && *name <= 'Z') ||
+               (*name >= '0' && *name <= '9') ||
+               (*name == '_') || (*name == '.') 
+	      )) {
+ 		return false;
+ 	}
+ 
+	numeric = isdigit(*name);
+
+ 	while ('\0' != *++name) {
+-		if (!(( ('a' <= *name) && ('z' >= *name) ) ||
+-		      ( ('0' <= *name) && ('9' >= *name) ) ||
+-		      ('_' == *name) ||
+-		      ('-' == *name) ||
+-		      ( ('$' == *name) && ('\0' == *(name + 1)) )
+-		     )) {
+                if (!(  (*name >= 'a' && *name <= 'z') ||
+                        (*name >= 'A' && *name <= 'Z') ||
+                        (*name >= '0' && *name <= '9') ||
+                        (*name == '_') || (*name == '.') || (*name == '-') ||
+                        (*name == '$' && *(name + 1) == '\0') 
+                     )) {
+ 			return false;
+ 		}
+		numeric &= isdigit(*name);
+ 	}
+ 
+-	return true;
+	return !numeric;
+ }
+ 
+ bool is_valid_user_name (const char *name)
+diff -up shadow-4.1.5.1/man/groupadd.8.xml.goodname shadow-4.1.5.1/man/groupadd.8.xml
+--- shadow-4.1.5.1/man/groupadd.8.xml.goodname	2012-05-25 13:45:27.000000000 +0200
+++ shadow-4.1.5.1/man/groupadd.8.xml	2014-09-09 17:28:46.330300342 +0200
+@@ -259,12 +259,6 @@
+    <refsect1 id='caveats'>
+      <title>CAVEATS</title>
+      <para>
+-       Groupnames must start with a lower case letter or an underscore,
+-       followed by lower case letters, digits, underscores, or dashes.
+-       They can end with a dollar sign.
+-       In regular expression terms: [a-z_][a-z0-9_-]*[$]?
+-     </para>
+-     <para>
+        Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
+      </para>
+      <para>
+diff -up shadow-4.1.5.1/man/useradd.8.xml.goodname shadow-4.1.5.1/man/useradd.8.xml
+--- shadow-4.1.5.1/man/useradd.8.xml.goodname	2012-05-25 13:45:29.000000000 +0200
+++ shadow-4.1.5.1/man/useradd.8.xml	2014-09-09 17:28:46.330300342 +0200
+@@ -366,7 +366,7 @@
+ 	</term>
+ 	<listitem>
+ 	  <para>
+-	    Do no create the user's home directory, even if the system
+	    Do not create the user's home directory, even if the system
+ 	    wide setting from <filename>/etc/login.defs</filename>
+ 	    (<option>CREATE_HOME</option>) is set to
+ 	    <replaceable>yes</replaceable>.
+@@ -654,12 +654,6 @@
+     </para>
+ 
+     <para>
+-      Usernames must start with a lower case letter or an underscore,
+-      followed by lower case letters, digits, underscores, or dashes.
+-      They can end with a dollar sign.
+-      In regular expression terms: [a-z_][a-z0-9_-]*[$]?
+-    </para>
+-    <para>
+       Usernames may only be up to 32 characters long.
+     </para>
+   </refsect1>
--- a/shadow-4.1.5.1-id-alloc.patch
+++ b/shadow-4.1.5.1-id-alloc.patch
--- a/shadow-4.1.5.1-info-parent-dir.patch
+++ b/shadow-4.1.5.1-info-parent-dir.patch
@ -0,0 +1,20 @@
+diff -up shadow-4.1.5.1/man/newusers.8.xml.info-parent-dir shadow-4.1.5.1/man/newusers.8.xml
+--- shadow-4.1.5.1/man/newusers.8.xml.info-parent-dir	2012-05-25 13:45:28.000000000 +0200
+++ shadow-4.1.5.1/man/newusers.8.xml	2012-09-19 18:46:35.651613365 +0200
+@@ -216,7 +216,15 @@
+ 	  <para>
+ 	    If this field does not specify an existing directory, the
+ 	    specified directory is created, with ownership set to the
+-	    user being created or updated and its primary group.
+	    user being created or updated and its primary group. Note 
+            that newusers does not create parent directories of the new 
+            user's home directory. The newusers command will fail to 
+            create the home directory if the parent directories do not 
+            exist, and will send a message to stderr informing the user 
+            of the failure. The newusers command will not halt or return 
+            a failure to the calling shell if it fails to create the home 
+            directory, it will continue to process the batch of new users 
+            specified.
+ 	  </para>
+ 	  <para>
+ 	    If the home directory of an existing user is changed,
--- a/shadow-4.1.5.1-ingroup.patch
+++ b/shadow-4.1.5.1-ingroup.patch
@ -0,0 +1,63 @@
+diff -up shadow-4.1.5.1/src/newgrp.c.ingroup shadow-4.1.5.1/src/newgrp.c
+--- shadow-4.1.5.1/src/newgrp.c.ingroup	2014-08-29 13:31:38.000000000 +0200
+++ shadow-4.1.5.1/src/newgrp.c	2014-08-29 14:04:57.183849650 +0200
+@@ -83,15 +83,29 @@ static void usage (void)
+ 	}
+ }
+ 
+static bool ingroup(const char *name, struct group *gr)
+{
+	char **look;
+	bool notfound = true;
+
+	look = gr->gr_mem;
+	while (*look && notfound)
+		notfound = strcmp (*look++, name);
+
+	return !notfound;
+}
+
+ /*
+- * find_matching_group - search all groups of a given group id for
+ * find_matching_group - search all groups of a gr's group id for
+  *                       membership of a given username
+ *                       but check gr itself first
+  */
+-static /*@null@*/struct group *find_matching_group (const char *name, gid_t gid)
+static /*@null@*/struct group *find_matching_group (const char *name, struct group *gr)
+ {
+-	struct group *gr;
+-	char **look;
+-	bool notfound = true;
+	gid_t gid = gr->gr_gid;
+
+	if (ingroup(name, gr))
+		return gr;
+ 
+ 	setgrent ();
+ 	while ((gr = getgrent ()) != NULL) {
+@@ -103,14 +117,8 @@ static /*@null@*/struct group *find_matc
+ 		 * A group with matching GID was found.
+ 		 * Test for membership of 'name'.
+ 		 */
+-		look = gr->gr_mem;
+-		while ((NULL != *look) && notfound) {
+-			notfound = (strcmp (*look, name) != 0);
+-			look++;
+-		}
+-		if (!notfound) {
+		if (ingroup(name, gr))
+ 			break;
+-		}
+ 	}
+ 	endgrent ();
+ 	return gr;
+@@ -616,7 +624,7 @@ int main (int argc, char **argv)
+ 	 * groups of the same GID like the requested group for
+ 	 * membership of the current user.
+ 	 */
+-	grp = find_matching_group (name, grp->gr_gid);
+	grp = find_matching_group (name, grp);
+ 	if (NULL == grp) {
+ 		/*
+ 		 * No matching group found. As we already know that
--- a/shadow-4.1.5.1-logmsg.patch
+++ b/shadow-4.1.5.1-logmsg.patch
@ -0,0 +1,12 @@
+diff -up shadow-4.1.5.1/src/useradd.c.logmsg shadow-4.1.5.1/src/useradd.c
+--- shadow-4.1.5.1/src/useradd.c.logmsg	2013-02-20 15:41:44.000000000 +0100
+++ shadow-4.1.5.1/src/useradd.c	2013-03-19 18:40:04.908292810 +0100
+@@ -275,7 +275,7 @@ static void fail_exit (int code)
+ 	              user_name, AUDIT_NO_ID,
+ 	              SHADOW_AUDIT_FAILURE);
+ #endif
+-	SYSLOG ((LOG_INFO, "failed adding user '%s', data deleted", user_name));
+	SYSLOG ((LOG_INFO, "failed adding user '%s', exit code: %d", user_name, code));
+ 	exit (code);
+ }
+ 
--- a/shadow-4.1.5.1-move-home.patch
+++ b/shadow-4.1.5.1-move-home.patch
@ -0,0 +1,15 @@
+diff -up shadow-4.1.5.1/src/usermod.c.move-home shadow-4.1.5.1/src/usermod.c
+--- shadow-4.1.5.1/src/usermod.c.move-home	2014-08-29 13:31:38.000000000 +0200
+++ shadow-4.1.5.1/src/usermod.c	2014-08-29 14:14:13.860671177 +0200
+@@ -1571,6 +1571,11 @@ static void move_home (void)
+ 			         Prog, user_home, user_newhome);
+ 			fail_exit (E_HOMEDIR);
+ 		}
+	} else {
+		fprintf (stderr,
+		         _("%s: The previous home directory (%s) does "
+		           "not exist or is inaccessible. Move cannot be completed.\n"),
+		         Prog, user_home);
+ 	}
+ }
+ 
--- a/shadow-4.1.5.1-orig-context.patch
+++ b/shadow-4.1.5.1-orig-context.patch
@ -0,0 +1,128 @@
+diff -up shadow-4.1.5.1/lib/commonio.c.orig-context shadow-4.1.5.1/lib/commonio.c
+--- shadow-4.1.5.1/lib/commonio.c.orig-context	2012-09-19 20:27:16.000000000 +0200
+++ shadow-4.1.5.1/lib/commonio.c	2013-02-20 15:20:55.064962324 +0100
+@@ -941,7 +941,7 @@ int commonio_close (struct commonio_db *
+ 		snprintf (buf, sizeof buf, "%s-", db->filename);
+ 
+ #ifdef WITH_SELINUX
+-		if (set_selinux_file_context (buf) != 0) {
+		if (set_selinux_file_context (buf, db->filename) != 0) {
+ 			errors++;
+ 		}
+ #endif
+@@ -975,7 +975,7 @@ int commonio_close (struct commonio_db *
+ 	snprintf (buf, sizeof buf, "%s+", db->filename);
+ 
+ #ifdef WITH_SELINUX
+-	if (set_selinux_file_context (buf) != 0) {
+	if (set_selinux_file_context (buf, db->filename) != 0) {
+ 		errors++;
+ 	}
+ #endif
+diff -up shadow-4.1.5.1/libmisc/copydir.c.orig-context shadow-4.1.5.1/libmisc/copydir.c
+--- shadow-4.1.5.1/libmisc/copydir.c.orig-context	2012-02-13 20:16:32.000000000 +0100
+++ shadow-4.1.5.1/libmisc/copydir.c	2013-02-20 15:19:01.495623232 +0100
+@@ -484,7 +484,7 @@ static int copy_dir (const char *src, co
+ 	 */
+ 
+ #ifdef WITH_SELINUX
+-	if (set_selinux_file_context (dst) != 0) {
+	if (set_selinux_file_context (dst, NULL) != 0) {
+ 		return -1;
+ 	}
+ #endif				/* WITH_SELINUX */
+@@ -605,7 +605,7 @@ static int copy_symlink (const char *src
+ 	}
+ 
+ #ifdef WITH_SELINUX
+-	if (set_selinux_file_context (dst) != 0) {
+	if (set_selinux_file_context (dst, NULL) != 0) {
+ 		free (oldlink);
+ 		return -1;
+ 	}
+@@ -684,7 +684,7 @@ static int copy_special (const char *src
+ 	int err = 0;
+ 
+ #ifdef WITH_SELINUX
+-	if (set_selinux_file_context (dst) != 0) {
+	if (set_selinux_file_context (dst, NULL) != 0) {
+ 		return -1;
+ 	}
+ #endif				/* WITH_SELINUX */
+@@ -744,7 +744,7 @@ static int copy_file (const char *src, c
+ 		return -1;
+ 	}
+ #ifdef WITH_SELINUX
+-	if (set_selinux_file_context (dst) != 0) {
+	if (set_selinux_file_context (dst, NULL) != 0) {
+ 		return -1;
+ 	}
+ #endif				/* WITH_SELINUX */
+diff -up shadow-4.1.5.1/lib/prototypes.h.orig-context shadow-4.1.5.1/lib/prototypes.h
+--- shadow-4.1.5.1/lib/prototypes.h.orig-context	2012-01-08 17:04:29.000000000 +0100
+++ shadow-4.1.5.1/lib/prototypes.h	2013-02-20 15:24:17.251126575 +0100
+@@ -295,7 +295,7 @@ extern /*@observer@*/const char *crypt_m
+ 
+ /* selinux.c */
+ #ifdef WITH_SELINUX
+-extern int set_selinux_file_context (const char *dst_name);
+extern int set_selinux_file_context (const char *dst_name, const char *orig_name);
+ extern int reset_selinux_file_context (void);
+ #endif
+ 
+diff -up shadow-4.1.5.1/lib/selinux.c.orig-context shadow-4.1.5.1/lib/selinux.c
+--- shadow-4.1.5.1/lib/selinux.c.orig-context	2012-01-08 17:35:44.000000000 +0100
+++ shadow-4.1.5.1/lib/selinux.c	2013-02-20 15:16:40.383716877 +0100
+@@ -50,7 +50,7 @@ static bool selinux_enabled;
+  *	Callers may have to Reset SELinux to create files with default
+  *	contexts with reset_selinux_file_context
+  */
+-int set_selinux_file_context (const char *dst_name)
+int set_selinux_file_context (const char *dst_name, const char *orig_name)
+ {
+ 	/*@null@*/security_context_t scontext = NULL;
+ 
+@@ -62,19 +62,23 @@ int set_selinux_file_context (const char
+ 	if (selinux_enabled) {
+ 		/* Get the default security context for this file */
+ 		if (matchpathcon (dst_name, 0, &scontext) < 0) {
+-			if (security_getenforce () != 0) {
+-				return 1;
+-			}
+			/* We could not get the default, copy the original */
+			if (orig_name == NULL)
+				goto error;
+			if (getfilecon (orig_name, &scontext) < 0)
+				goto error;
+ 		}
+ 		/* Set the security context for the next created file */
+-		if (setfscreatecon (scontext) < 0) {
+-			if (security_getenforce () != 0) {
+-				return 1;
+-			}
+-		}
+		if (setfscreatecon (scontext) < 0)
+			goto error;
+ 		freecon (scontext);
+ 	}
+ 	return 0;
+    error:
+	if (security_getenforce () != 0) {
+		return 1;
+	}
+	return 0;
+ }
+ 
+ /*
+diff -up shadow-4.1.5.1/src/useradd.c.orig-context shadow-4.1.5.1/src/useradd.c
+--- shadow-4.1.5.1/src/useradd.c.orig-context	2012-09-19 20:23:33.000000000 +0200
+++ shadow-4.1.5.1/src/useradd.c	2013-02-20 15:19:31.221235459 +0100
+@@ -1759,7 +1759,7 @@ static void create_home (void)
+ {
+ 	if (access (user_home, F_OK) != 0) {
+ #ifdef WITH_SELINUX
+-		if (set_selinux_file_context (user_home) != 0) {
+		if (set_selinux_file_context (user_home, NULL) != 0) {
+ 			fail_exit (E_HOMEDIR);
+ 		}
+ #endif
--- a/shadow-4.1.5.1-selinux.patch
+++ b/shadow-4.1.5.1-selinux.patch
@ -0,0 +1,99 @@
+diff -up shadow-4.1.5.1/lib/semanage.c.selinux shadow-4.1.5.1/lib/semanage.c
+--- shadow-4.1.5.1/lib/semanage.c.selinux	2012-01-08 17:35:44.000000000 +0100
+++ shadow-4.1.5.1/lib/semanage.c	2014-09-10 10:11:55.417506128 +0200
+@@ -294,6 +294,9 @@ int set_seuser (const char *login_name,
+ 
+ 	ret = 0;
+ 
+        /* drop obsolete matchpathcon cache */
+        matchpathcon_fini();
+
+ done:
+ 	semanage_seuser_key_free (key);
+ 	semanage_handle_destroy (handle);
+@@ -369,6 +372,10 @@ int del_seuser (const char *login_name)
+ 	}
+ 
+ 	ret = 0;
+
+        /* drop obsolete matchpathcon cache */
+        matchpathcon_fini();
+
+ done:
+ 	semanage_handle_destroy (handle);
+ 	return ret;
+diff -up shadow-4.1.5.1/src/useradd.c.selinux shadow-4.1.5.1/src/useradd.c
+--- shadow-4.1.5.1/src/useradd.c.selinux	2014-09-10 10:10:18.791280619 +0200
+++ shadow-4.1.5.1/src/useradd.c	2014-09-10 10:10:18.798280781 +0200
+@@ -1850,6 +1850,7 @@ static void create_mail (void)
+  */
+ int main (int argc, char **argv)
+ {
+	int rv = E_SUCCESS;
+ #ifdef ACCT_TOOLS_SETUID
+ #ifdef USE_PAM
+ 	pam_handle_t *pamh = NULL;
+@@ -2037,10 +2038,33 @@ int main (int argc, char **argv)
+ 
+ 	usr_update ();
+ 
+	close_files ();
+
+	nscd_flush_cache ("passwd");
+	nscd_flush_cache ("group");
+
+#ifdef WITH_SELINUX
+	if (Zflg && *user_selinux) {
+		if (is_selinux_enabled () > 0) {
+		    if (set_seuser (user_name, user_selinux) != 0) {
+			fprintf (stderr,
+			         _("%s: warning: the user name %s to %s SELinux user mapping failed.\n"),
+			         Prog, user_name, user_selinux);
+#ifdef WITH_AUDIT
+			audit_logger (AUDIT_ADD_USER, Prog,
+			              "adding SELinux user mapping",
+			              user_name, (unsigned int) user_id, 0);
+#endif				/* WITH_AUDIT */
+			rv = E_SE_UPDATE;
+		    }
+		}
+	}
+#endif
+
+ 	if (mflg) {
+ 		create_home ();
+ 		if (home_added) {
+-			copy_tree (def_template, user_home, false, false,
+			copy_tree (def_template, user_home, false, true,
+ 			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
+ 		} else {
+ 			fprintf (stderr,
+@@ -2056,27 +2080,6 @@ int main (int argc, char **argv)
+ 		create_mail ();
+ 	}
+ 
+-	close_files ();
+-
+-#ifdef WITH_SELINUX
+-	if (Zflg) {
+-		if (set_seuser (user_name, user_selinux) != 0) {
+-			fprintf (stderr,
+-			         _("%s: warning: the user name %s to %s SELinux user mapping failed.\n"),
+-			         Prog, user_name, user_selinux);
+-#ifdef WITH_AUDIT
+-			audit_logger (AUDIT_ADD_USER, Prog,
+-			              "adding SELinux user mapping",
+-			              user_name, (unsigned int) user_id, 0);
+-#endif				/* WITH_AUDIT */
+-			fail_exit (E_SE_UPDATE);
+-		}
+-	}
+-#endif				/* WITH_SELINUX */
+-
+-	nscd_flush_cache ("passwd");
+-	nscd_flush_cache ("group");
+-
+-	return E_SUCCESS;
+	return rv;
+ }
+ 
--- a/shadow-4.1.5.1-userdel-helpfix.patch
+++ b/shadow-4.1.5.1-userdel-helpfix.patch
@ -0,0 +1,15 @@
+diff -up shadow-4.1.5.1/src/userdel.c.userdel shadow-4.1.5.1/src/userdel.c
+--- shadow-4.1.5.1/src/userdel.c.userdel	2012-05-25 13:51:55.000000000 +0200
+++ shadow-4.1.5.1/src/userdel.c	2014-02-12 11:40:30.707686132 +0100
+@@ -130,8 +130,9 @@ static void usage (int status)
+ 	                  "\n"
+ 	                  "Options:\n"),
+ 	                Prog);
+-	(void) fputs (_("  -f, --force                   force removal of files,\n"
+-	                "                                even if not owned by user\n"),
+	(void) fputs (_("  -f, --force                   force some actions that would fail otherwise\n"
+			"                                e.g. removal of user still logged in\n"
+			"                                or files, even if not owned by the user\n"),
+ 	              usageout);
+ 	(void) fputs (_("  -h, --help                    display this help message and exit\n"), usageout);
+ 	(void) fputs (_("  -r, --remove                  remove home directory and mail spool\n"), usageout);
--- a/shadow-4.2.1-audit-update.patch
+++ b/shadow-4.2.1-audit-update.patch
--- a/shadow-4.2.1-date-parsing.patch
+++ b/shadow-4.2.1-date-parsing.patch
@ -0,0 +1,68 @@
+diff -up shadow-4.2.1/libmisc/getdate.y.date-parsing shadow-4.2.1/libmisc/getdate.y
+--- shadow-4.2.1/libmisc/getdate.y.date-parsing	2014-03-01 18:50:05.000000000 +0100
+++ shadow-4.2.1/libmisc/getdate.y	2014-11-26 14:58:21.208153924 +0100
+@@ -152,6 +152,7 @@ static int	yyHaveDay;
+ static int	yyHaveRel;
+ static int	yyHaveTime;
+ static int	yyHaveZone;
+static int      yyHaveYear;
+ static int	yyTimezone;
+ static int	yyDay;
+ static int	yyHour;
+@@ -293,18 +294,21 @@ date	: tUNUMBER '/' tUNUMBER {
+ 	      yyDay = $3;
+ 	      yyYear = $5;
+ 	    }
+	    yyHaveYear++;
+ 	}
+ 	| tUNUMBER tSNUMBER tSNUMBER {
+ 	    /* ISO 8601 format.  yyyy-mm-dd.  */
+ 	    yyYear = $1;
+ 	    yyMonth = -$2;
+ 	    yyDay = -$3;
+	    yyHaveYear++;
+ 	}
+ 	| tUNUMBER tMONTH tSNUMBER {
+ 	    /* e.g. 17-JUN-1992.  */
+ 	    yyDay = $1;
+ 	    yyMonth = $2;
+ 	    yyYear = -$3;
+	    yyHaveYear++;
+ 	}
+ 	| tMONTH tUNUMBER {
+ 	    yyMonth = $1;
+@@ -314,6 +318,7 @@ date	: tUNUMBER '/' tUNUMBER {
+ 	    yyMonth = $1;
+ 	    yyDay = $2;
+ 	    yyYear = $4;
+	    yyHaveYear++;
+ 	}
+ 	| tUNUMBER tMONTH {
+ 	    yyMonth = $2;
+@@ -323,6 +328,7 @@ date	: tUNUMBER '/' tUNUMBER {
+ 	    yyMonth = $2;
+ 	    yyDay = $1;
+ 	    yyYear = $3;
+	    yyHaveYear++;
+ 	}
+ 	;
+ 
+@@ -395,7 +401,8 @@ relunit	: tUNUMBER tYEAR_UNIT {
+ 
+ number	: tUNUMBER
+           {
+-	    if ((yyHaveTime != 0) && (yyHaveDate != 0) && (yyHaveRel == 0))
+	    if ((yyHaveTime != 0 || $1 >= 100) && !yyHaveYear
+		&& (yyHaveDate != 0) && (yyHaveRel == 0))
+ 	      yyYear = $1;
+ 	    else
+ 	      {
+@@ -802,7 +809,7 @@ yylex (void)
+ 	  return LookupWord (buff);
+ 	}
+       if (c != '(')
+-	return *yyInput++;
+	return (unsigned char)*yyInput++;
+       Count = 0;
+       do
+ 	{
--- a/shadow-4.2.1-manfix.patch
+++ b/shadow-4.2.1-manfix.patch
@ -0,0 +1,78 @@
+diff -up shadow-4.2.1/man/chage.1.xml.manfix shadow-4.2.1/man/chage.1.xml
+--- shadow-4.2.1/man/chage.1.xml.manfix	2014-03-01 19:59:51.000000000 +0100
+++ shadow-4.2.1/man/chage.1.xml	2014-11-26 15:34:51.256978960 +0100
+@@ -102,6 +102,9 @@
+ 	    Set the number of days since January 1st, 1970 when the password
+ 	    was last changed. The date may also be expressed in the format
+ 	    YYYY-MM-DD (or the format more commonly used in your area).
+	    If the <replaceable>LAST_DAY</replaceable> is set to
+	    <emphasis>0</emphasis> the user is forced to change his password
+	    on the next log on.
+ 	  </para>
+ 	</listitem>
+       </varlistentry>
+diff -up shadow-4.2.1/man/login.defs.5.xml.manfix shadow-4.2.1/man/login.defs.5.xml
+--- shadow-4.2.1/man/login.defs.5.xml.manfix	2014-03-13 06:52:55.000000000 +0100
+++ shadow-4.2.1/man/login.defs.5.xml	2014-11-26 15:34:51.257978963 +0100
+@@ -162,6 +162,17 @@
+       long numeric parameters is machine-dependent.
+     </para>
+ 
+    <para>
+      Please note that the parameters in this configuration file control the
+      behavior of the tools from the shadow-utils component. None of these
+      tools uses the PAM mechanism, and the utilities that use PAM (such as the
+      passwd command) should be configured elsewhere. The only values that
+      affect PAM modules are <emphasis>ENCRYPT_METHOD</emphasis> and <emphasis>SHA_CRYPT_MAX_ROUNDS</emphasis>
+      for pam_unix module, <emphasis>FAIL_DELAY</emphasis> for pam_faildelay module,
+      and <emphasis>UMASK</emphasis> for pam_umask module. Refer to
+      pam(8) for more information.
+    </para>
+
+     <para>The following configuration items are provided:</para>
+ 
+     <variablelist remap='IP'>
+diff -up shadow-4.2.1/man/useradd.8.xml.manfix shadow-4.2.1/man/useradd.8.xml
+--- shadow-4.2.1/man/useradd.8.xml.manfix	2014-11-26 15:34:51.234978891 +0100
+++ shadow-4.2.1/man/useradd.8.xml	2014-11-26 15:34:51.257978963 +0100
+@@ -347,11 +347,16 @@
+ 	    <option>CREATE_HOME</option> is not enabled, no home
+ 	    directories are created.
+ 	  </para>
+	  <para>
+	    The directory where the user's home directory is created must
+	    exist and have proper SELinux context and permissions. Otherwise
+	    the user's home directory cannot be created or accessed.
+	  </para>
+ 	</listitem>
+       </varlistentry>
+       <varlistentry>
+ 	<term>
+-	  <option>-M</option>
+	  <option>-M</option>, <option>--no-create-home</option>
+ 	</term>
+ 	<listitem>
+ 	  <para>
+diff -up shadow-4.2.1/man/usermod.8.xml.manfix shadow-4.2.1/man/usermod.8.xml
+--- shadow-4.2.1/man/usermod.8.xml.manfix	2014-03-01 19:59:51.000000000 +0100
+++ shadow-4.2.1/man/usermod.8.xml	2014-11-26 15:34:51.257978963 +0100
+@@ -132,7 +132,8 @@
+ 	    If the <option>-m</option>
+ 	    option is given, the contents of the current home directory will
+ 	    be moved to the new home directory, which is created if it does
+-	    not already exist.
+	    not already exist. If the current home directory does not exist
+	    the new home directory will not be created.
+ 	  </para>
+ 	</listitem>
+       </varlistentry>
+@@ -256,7 +257,8 @@
+ 	<listitem>
+ 	  <para>
+ 	    Move the content of the user's home directory to the new
+-	    location.
+	    location. If the current home directory does not exist
+	    the new home directory will not be created.
+ 	  </para>
+ 	  <para>
+ 	    This option is only valid in combination with the
--- a/shadow-4.2.1-merge-group.patch
+++ b/shadow-4.2.1-merge-group.patch
@ -0,0 +1,13 @@
+diff -up shadow-4.2.1/lib/groupio.c.merge-group shadow-4.2.1/lib/groupio.c
+--- shadow-4.2.1/lib/groupio.c.merge-group	2014-11-26 14:33:54.039581662 +0100
+++ shadow-4.2.1/lib/groupio.c	2014-11-26 14:46:02.841852886 +0100
+@@ -335,8 +335,7 @@ static /*@null@*/struct commonio_entry *
+ 		errno = ENOMEM;
+ 		return NULL;
+ 	}
+-	snprintf(new_line, new_line_len, "%s\n%s", gr1->line, gr2->line);
+-	new_line[new_line_len] = '\0';
+	snprintf(new_line, new_line_len + 1, "%s\n%s", gr1->line, gr2->line);
+ 
+ 	/* Concatenate the 2 list of members */
+ 	for (i=0; NULL != gptr1->gr_mem[i]; i++);
--- a/shadow-utils.HOME_MODE.xml
+++ b/shadow-utils.HOME_MODE.xml
@ -1,43 +0,0 @@
-<!--
-   Copyright (c) 1991 - 1993, Julianne Frances Haugh
-   Copyright (c) 1991 - 1993, Chip Rosenthal
-   Copyright (c) 2007 - 2009, Nicolas François
-   All rights reserved.
-  
-   Redistribution and use in source and binary forms, with or without
-   modification, are permitted provided that the following conditions
-   are met:
-   1. Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-   2. Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-   3. The name of the copyright holders or contributors may not be used to
-      endorse or promote products derived from this software without
-      specific prior written permission.
-  
-   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
-   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
-   HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-->
-<varlistentry>
-  <term><option>HOME_MODE</option> (number)</term>
-  <listitem>
-    <para>
-      The mode for new home directories. If not specified,
-      the <option>UMASK</option> is used to create the mode.
-    </para>
-    <para>
-      <command>useradd</command> and <command>newusers</command> use this
-      to set the mode of the home directory they create.
-    </para>
-  </listitem>
-</varlistentry>
--- a/shadow-utils.login.defs
+++ b/shadow-utils.login.defs
@ -6,121 +6,15 @@
 # /etc/pam.d/system-auth for more information.
 #

-#
-# Delay in seconds before being allowed another attempt after a login failure
-# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
-#       pam_unix(8) enforces a 2s delay)
-#
-#FAIL_DELAY		3
-
-# Currently FAILLOG_ENAB is not supported
-
-#
-# Enable display of unknown usernames when login(1) failures are recorded.
-#
-#LOG_UNKFAIL_ENAB	no
-
-# Currently LOG_OK_LOGINS is not supported
-
-# Currently LASTLOG_ENAB is not supported
-
-#
-# Limit the highest user ID number for which the lastlog entries should
-# be updated.
-#
-# No LASTLOG_UID_MAX means that there is no user ID limit for writing
-# lastlog entries.
-#
-#LASTLOG_UID_MAX
-
-# Currently MAIL_CHECK_ENAB is not supported
-
-# Currently OBSCURE_CHECKS_ENAB is not supported
-
-# Currently PORTTIME_CHECKS_ENAB is not supported
-
-# Currently QUOTAS_ENAB is not supported
-
-# Currently SYSLOG_SU_ENAB is not supported
-
-#
-# Enable "syslog" logging of newgrp(1) and sg(1) activity.
-#
-#SYSLOG_SG_ENAB		yes
-
-# Currently CONSOLE is not supported
-
-# Currently SULOG_FILE is not supported
-
-# Currently MOTD_FILE is not supported
-
-# Currently ISSUE_FILE is not supported
-
-# Currently TTYTYPE_FILE is not supported
-
-# Currently FTMP_FILE is not supported
-
-# Currently NOLOGINS_FILE is not supported
-
-# Currently SU_NAME is not supported
-
 # *REQUIRED*
 #   Directory where mailboxes reside, _or_ name of file, relative to the
 #   home directory.  If you _do_ define both, MAIL_DIR takes precedence.
+#   QMAIL_DIR is for Qmail
 #
+#QMAIL_DIR	Maildir
 MAIL_DIR	/var/spool/mail
 #MAIL_FILE	.mail

-#
-# If defined, file which inhibits all the usual chatter during the login
-# sequence.  If a full pathname, then hushed mode will be enabled if the
-# user's name or shell are found in the file.  If not a full pathname, then
-# hushed mode will be enabled if the file exists in the user's home directory.
-#
-#HUSHLOGIN_FILE	.hushlogin
-#HUSHLOGIN_FILE	/etc/hushlogins
-
-# Currently ENV_TZ is not supported
-
-# Currently ENV_HZ is not supported
-
-#
-# The default PATH settings, for superuser and normal users.
-#
-# (they are minimal, add the rest in the shell startup files)
-#ENV_SUPATH	PATH=/sbin:/bin:/usr/sbin:/usr/bin
-#ENV_PATH	PATH=/bin:/usr/bin
-
-#
-# Terminal permissions
-#
-#	TTYGROUP	Login tty will be assigned this group ownership.
-#	TTYPERM		Login tty will be set to this permission.
-#
-# If you have a write(1) program which is "setgid" to a special group
-# which owns the terminals, define TTYGROUP as the number of such group
-# and TTYPERM as 0620.  Otherwise leave TTYGROUP commented out and
-# set TTYPERM to either 622 or 600.
-#
-#TTYGROUP	tty
-#TTYPERM		0600
-
-# Currently ERASECHAR, KILLCHAR and ULIMIT are not supported
-
-# Default initial "umask" value used by login(1) on non-PAM enabled systems.
-# Default "umask" value for pam_umask(8) on PAM enabled systems.
-# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
-# home directories if HOME_MODE is not set.
-# 022 is the default value, but 027, or even 077, could be considered
-# for increased privacy. There is no One True Answer here: each sysadmin
-# must make up their mind.
-UMASK		022
-
-# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
-# home directories.
-# If HOME_MODE is not set, the value of UMASK is used to create the mode.
-HOME_MODE	0700
-
 # Password aging controls:
 #
 #	PASS_MAX_DAYS	Maximum number of days a password may be used.
@ -130,142 +24,26 @@ HOME_MODE	0700
 #
 PASS_MAX_DAYS	99999
 PASS_MIN_DAYS	0
-PASS_MIN_LEN	8
+PASS_MIN_LEN	5
 PASS_WARN_AGE	7

-# Currently SU_WHEEL_ONLY is not supported
-
-# Currently CRACKLIB_DICTPATH is not supported
-
 #
-# Min/max values for automatic uid selection in useradd(8)
+# Min/max values for automatic uid selection in useradd
 #
 UID_MIN                  1000
 UID_MAX                 60000
 # System accounts
 SYS_UID_MIN               201
 SYS_UID_MAX               999
-# Extra per user uids
-SUB_UID_MIN		   524288
-SUB_UID_MAX		600100000
-SUB_UID_COUNT		    65536

 #
-# Min/max values for automatic gid selection in groupadd(8)
+# Min/max values for automatic gid selection in groupadd
 #
 GID_MIN                  1000
 GID_MAX                 60000
 # System accounts
 SYS_GID_MIN               201
 SYS_GID_MAX               999
-# Extra per user group ids
-SUB_GID_MIN		   524288
-SUB_GID_MAX		600100000
-SUB_GID_COUNT		    65536
-
-#
-# Max number of login(1) retries if password is bad
-#
-#LOGIN_RETRIES		3
-
-#
-# Max time in seconds for login(1)
-#
-#LOGIN_TIMEOUT		60
-
-#
-# Maximum number of attempts to change password if rejected (too easy)
-#
-PASS_CHANGE_TRIES	5
-
-#
-# Warn about weak passwords (but still allow them) if you are root.
-#
-PASS_ALWAYS_WARN	yes
-
-#
-# Number of significant characters in the password for crypt().
-# Default is 8, don't change unless your crypt() is better.
-# Ignored if MD5_CRYPT_ENAB set to "yes".
-#
-#PASS_MAX_LEN		8
-
-# Currently CHFN_AUTH is not supported
-
-#
-# Which fields may be changed by regular users using chfn(1) - use
-# any combination of letters "frwh" (full name, room number, work
-# phone, home phone).  If not defined, no changes are allowed.
-# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
-# 
-#CHFN_RESTRICT		rwh
-
-# Currently LOGIN_STRING is not supported
-
-# Currently MD5_CRYPT_ENAB is not supported
-
-#
-# If set to MD5, MD5-based algorithm will be used for encrypting password
-# If set to SHA256, SHA256-based algorithm will be used for encrypting password
-# If set to SHA512, SHA512-based algorithm will be used for encrypting password
-# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
-# If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
-# If set to DES, DES-based algorithm will be used for encrypting password (default)
-#
-ENCRYPT_METHOD YESCRYPT
-
-#
-# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
-#
-# Define the number of SHA rounds.
-# With a lot of rounds, it is more difficult to brute-force the password.
-# However, more CPU resources will be needed to authenticate users if
-# this value is increased.
-#
-# If not specified, the libc will choose the default number of rounds (5000).
-# The values must be within the 1000-999999999 range.
-#
-#SHA_CRYPT_MAX_ROUNDS 5000
-
-# Currently SHA_CRYPT_MIN_ROUNDS is not supported
-
-#
-# Only works if ENCRYPT_METHOD is set to BCRYPT.
-#
-# Define the number of BCRYPT rounds.
-# With a lot of rounds, it is more difficult to brute-force the password.
-# However, more CPU resources will be needed to authenticate users if
-# this value is increased.
-#
-# If not specified, 13 rounds will be attempted.
-# If only one of the MIN or MAX values is set, then this value will be used.
-# If MIN > MAX, the highest value will be used.
-#
-#BCRYPT_MIN_ROUNDS 13
-#BCRYPT_MAX_ROUNDS 31
-
-#
-# Only works if ENCRYPT_METHOD is set to YESCRYPT.
-#
-# Define the YESCRYPT cost factor.
-# With a higher cost factor, it is more difficult to brute-force the password.
-# However, more CPU time and more memory will be needed to authenticate users
-# if this value is increased.
-#
-# If not specified, a cost factor of 5 will be used.
-# The value must be within the 1-11 range.
-#
-#YESCRYPT_COST_FACTOR 5
-
-# Currently CONSOLE_GROUPS is not supported
-
-#
-# Should login be allowed if we can't cd to the home directory?
-# Default is yes.
-#
-#DEFAULT_HOME	yes
-
-# Currently ENVIRON_FILE is not supported

 #
 # If defined, this command is run when removing a user.
@ -275,41 +53,20 @@ ENCRYPT_METHOD YESCRYPT
 #USERDEL_CMD	/usr/sbin/userdel_local

 #
-# Enables userdel(8) to remove user groups if no members exist.
-#
-USERGROUPS_ENAB yes
-
-#
-# If set to a non-zero number, the shadow utilities will make sure that
-# groups never have more than this number of users on one line.
-# This permits to support split groups (groups split into multiple lines,
-# with the same group ID, to avoid limitation of the line length in the
-# group file).
-#
-# 0 is the default value and disables this feature.
-#
-#MAX_MEMBERS_PER_GROUP	0
-
-#
-# If useradd(8) should create home directories for users by default (non
-# system users only).
-# This option is overridden with the -M or -m flags on the useradd(8)
-# command-line.
+# If useradd should create home directories for users by default
+# On RH systems, we do. This option is overridden with the -m flag on
+# useradd command line.
 #
 CREATE_HOME	yes

-#
-# Force use shadow, even if shadow passwd & shadow group files are
-# missing.
-#
-#FORCE_SHADOW    yes
+# The permission mask is initialized to this value. If not specified, 
+# the permission mask will be initialized to 022.
+UMASK           077

+# This enables userdel to remove user groups if no members exist.
 #
-# Select the HMAC cryptography algorithm.
-# Used in pam_timestamp module to calculate the keyed-hash message
-# authentication code.
-#
-# Note: It is recommended to check hmac(3) to see the possible algorithms
-# that are available in your system.
-#
-HMAC_CRYPTO_ALGO SHA512
+USERGROUPS_ENAB yes
+
+# Use SHA512 to encrypt password.
+ENCRYPT_METHOD SHA512 
+
--- a/shadow-utils.spec
+++ b/shadow-utils.spec
@ -1,74 +1,50 @@
 Summary: Utilities for managing accounts and shadow password files
 Name: shadow-utils
-Version: 4.20.0
+Version: 4.2.1
 Release: 1%{?dist}
 Epoch: 2
-License: BSD-3-Clause AND GPL-2.0-or-later
-URL: https://github.com/shadow-maint/shadow
-Source0: https://github.com/shadow-maint/shadow/releases/download/4.20.0/shadow-4.20.0.tar.xz
-Source1: https://github.com/shadow-maint/shadow/releases/download/4.20.0/shadow-4.20.0.tar.xz.asc
+URL: http://pkg-shadow.alioth.debian.org/
+Source0: http://pkg-shadow.alioth.debian.org/releases/shadow-%{version}.tar.xz
+Source3: http://pkg-shadow.alioth.debian.org/releases/shadow-%{version}.tar.xz.sig
+Source1: shadow-utils.login.defs
 Source2: shadow-utils.useradd
-Source3: shadow-utils.login.defs
 Source4: shadow-bsd.txt
 Source5: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
-Source6: shadow-utils.HOME_MODE.xml
-Source7: passwd.pamd
+Patch0: shadow-4.1.5-redhat.patch
+Patch1: shadow-4.1.5.1-goodname.patch
+Patch2: shadow-4.1.5.1-info-parent-dir.patch
+Patch3: shadow-4.1.5-uflg.patch
+Patch6: shadow-4.1.5.1-selinux.patch
+Patch7: shadow-4.1.5-2ndskip.patch
+Patch8: shadow-4.1.5.1-backup-mode.patch
+Patch9: shadow-4.2.1-merge-group.patch
+Patch10: shadow-4.1.5.1-orig-context.patch
+Patch11: shadow-4.1.5.1-logmsg.patch
+Patch12: shadow-4.1.5.1-errmsg.patch
+Patch13: shadow-4.1.5.1-audit-owner.patch
+Patch14: shadow-4.1.5.1-default-range.patch
+Patch15: shadow-4.2.1-manfix.patch
+Patch17: shadow-4.1.5.1-userdel-helpfix.patch
+Patch18: shadow-4.1.5.1-id-alloc.patch
+Patch19: shadow-4.2.1-date-parsing.patch
+Patch20: shadow-4.1.5.1-ingroup.patch
+Patch21: shadow-4.1.5.1-move-home.patch
+Patch22: shadow-4.2.1-audit-update.patch

-### Globals ###
-%global includesubiddir %{_includedir}/shadow
-# Fail linking if there are undefined symbols.
-%global _ld_strict_symbol_defs 1
-
-### Patches ###
-
-### Dependencies ###
-Requires: audit-libs >= 1.6.5
-Requires: libselinux >= 1.25.2-1
-Requires: pam-libs
-Requires: setup
-
-### Build Dependencies ###
-BuildRequires: audit-libs-devel >= 1.6.5
-BuildRequires: autoconf
-BuildRequires: automake
-BuildRequires: bison
-BuildRequires: docbook-dtds
-BuildRequires: docbook-style-xsl
-BuildRequires: flex
-BuildRequires: gcc
-BuildRequires: gettext-devel
-BuildRequires: git
-BuildRequires: itstool
-BuildRequires: libacl-devel
-BuildRequires: libattr-devel
-BuildRequires: libcmocka-devel
-BuildRequires: libeconf-devel
+License: BSD and GPLv2+
+Group: System Environment/Base
 BuildRequires: libselinux-devel >= 1.25.2-1
+BuildRequires: audit-libs-devel >= 1.6.5
 BuildRequires: libsemanage-devel
-BuildRequires: libtool
-BuildRequires: libxcrypt-devel
-BuildRequires: libxslt
-BuildRequires: make
-BuildRequires: pam
-BuildRequires: pam-devel
-
-### Provides ###
-Provides: shadow = %{epoch}:%{version}-%{release}
-Provides: passwd = 0.80-18
-Obsoletes: passwd <= 0.80-19
-
-%if "%{_sbindir}" == "%{_bindir}"
-# Compat symlinks for Requires in other packages.
-# We rely on filesystem to create the symlinks for us.
-Requires: filesystem(unmerged-sbin-symlinks)
-Provides: /usr/sbin/adduser
-Provides: /usr/sbin/useradd
-Provides: /usr/sbin/userdel
-Provides: /usr/sbin/usermod
-Provides: /usr/sbin/groupadd
-Provides: /usr/sbin/groupdel
-Provides: /usr/sbin/groupmod
-%endif
+BuildRequires: libacl-devel libattr-devel
+BuildRequires: bison flex gnome-doc-utils
+#BuildRequires: autoconf, automake, libtool, gettext-devel
+Requires: libselinux >= 1.25.2-1
+Requires: audit-libs >= 1.6.5
+Requires: setup
+Requires(pre): coreutils
+Requires(post): coreutils
+Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

 %description
 The shadow-utils package includes the necessary programs for
@ -77,112 +53,136 @@ programs for managing user and group accounts. The pwconv command
 converts passwords to the shadow password format. The pwunconv command
 unconverts shadow passwords and generates a passwd file (a standard
 UNIX password file). The pwck command checks the integrity of password
-and shadow files. The useradd, userdel, and usermod commands are used
-for managing user accounts. The groupadd, groupdel, and groupmod
-commands are used for managing group accounts.
-
-
-### Subpackages ###
-%package subid
-Summary: A library to manage subordinate uid and gid ranges
-
-%description subid
-Utility library that provides a way to manage subid ranges.
-
-
-%package subid-devel
-Summary: Development package for shadow-utils-subid
-Requires: shadow-utils-subid = %{epoch}:%{version}-%{release}
-
-%description subid-devel
-Development files for shadow-utils-subid.
+and shadow files. The lastlog command prints out the last login times
+for all users. The useradd, userdel, and usermod commands are used for
+managing user accounts. The groupadd, groupdel, and groupmod commands
+are used for managing group accounts.

 %prep
-%autosetup -p 1 -S git -n shadow-4.20.0
+%setup -q -n shadow-%{version}
+%patch0 -p1 -b .redhat
+%patch1 -p1 -b .goodname
+%patch2 -p1 -b .info-parent-dir
+%patch3 -p1 -b .uflg
+%patch6 -p1 -b .selinux
+%patch7 -p1 -b .2ndskip
+%patch8 -p1 -b .backup-mode
+%patch9 -p1 -b .merge-group
+%patch10 -p1 -b .orig-context
+%patch11 -p1 -b .logmsg
+%patch12 -p1 -b .errmsg
+%patch13 -p1 -b .audit-owner
+%patch14 -p1 -b .default-range
+%patch15 -p1 -b .manfix
+%patch17 -p1 -b .userdel
+%patch18 -p1 -b .id-alloc
+%patch19 -p1 -b .date-parsing
+%patch20 -p1 -b .ingroup
+%patch21 -p1 -b .move-home
+%patch22 -p1 -b .audit-update

 iconv -f ISO88591 -t utf-8  doc/HOWTO > doc/HOWTO.utf8
 cp -f doc/HOWTO.utf8 doc/HOWTO

 cp -a %{SOURCE4} %{SOURCE5} .
-cp -a %{SOURCE6} man/login.defs.d/HOME_MODE.xml
+
+rm libmisc/getdate.c
+
+#rm po/*.gmo
+#rm po/stamp-po
+#aclocal
+#libtoolize --force
+#automake -a
+#autoconf

 %build
-autoreconf
-%configure \
-        --disable-account-tools-setuid \
-        --enable-logind=no \
-        --enable-man \
-        --enable-shadowgrp \
-        --enable-shared \
-        --with-audit \
-        --with-bcrypt \
-        --with-group-name-max-length=32 \
-        --with-libpam \
-        --with-selinux \
-        --with-sha-crypt \
-        --with-yescrypt \
-        --without-libbsd \
-        --without-libcrack \
-        --without-nscd \
-        --without-sssd
-%make_build

-%check
-make check
+%ifarch sparc64
+#sparc64 need big PIE
+export CFLAGS="$RPM_OPT_FLAGS -fPIE"
+export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
+%else
+export CFLAGS="$RPM_OPT_FLAGS -fpie"
+export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
+%endif
+
+%configure \
+        --enable-shadowgrp \
+        --enable-man \
+        --with-audit \
+        --with-sha-crypt \
+        --with-selinux \
+        --without-libcrack \
+        --without-libpam \
+        --disable-shared \
+        --with-group-name-max-length=32
+make

 %install
-%make_install gnulocaledir=$RPM_BUILD_ROOT%{_datadir}/locale MKINSTALLDIRS=`pwd`/mkinstalldirs
-install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/default
-install -p -c -m 0644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/login.defs
-install -p -c -m 0600 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/default/useradd
-install -d -m 755 $RPM_BUILD_ROOT%{_pam_confdir}
-install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/chpasswd
-install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/newusers
-install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_pam_confdir}/passwd
+rm -rf $RPM_BUILD_ROOT
+make install DESTDIR=$RPM_BUILD_ROOT gnulocaledir=$RPM_BUILD_ROOT/%{_datadir}/locale MKINSTALLDIRS=`pwd`/mkinstalldirs
+install -d -m 755 $RPM_BUILD_ROOT/%{_sysconfdir}/default
+install -p -c -m 0644 %{SOURCE1} $RPM_BUILD_ROOT/%{_sysconfdir}/login.defs
+install -p -c -m 0600 %{SOURCE2} $RPM_BUILD_ROOT/%{_sysconfdir}/default/useradd


 ln -s useradd $RPM_BUILD_ROOT%{_sbindir}/adduser
-ln -s useradd.8 $RPM_BUILD_ROOT%{_mandir}/man8/adduser.8
-for subdir in $RPM_BUILD_ROOT%{_mandir}/{??,??_??,??_??.*}/man* ; do
+#ln -s %{_mandir}/man8/useradd.8 $RPM_BUILD_ROOT/%{_mandir}/man8/adduser.8
+ln -s useradd.8 $RPM_BUILD_ROOT/%{_mandir}/man8/adduser.8
+for subdir in $RPM_BUILD_ROOT/%{_mandir}/{??,??_??,??_??.*}/man* ; do
        test -d $subdir && test -e $subdir/useradd.8 && echo ".so man8/useradd.8" > $subdir/adduser.8
 done

-%if "%{_sbindir}" == "%{_bindir}"
-# The installation script doesn't actually use the configured paths :(
-mv -v $RPM_BUILD_ROOT/usr/sbin/* $RPM_BUILD_ROOT%{_bindir}/
-%endif
-
 # Remove binaries we don't use.
-rm $RPM_BUILD_ROOT%{_bindir}/chfn
-rm $RPM_BUILD_ROOT%{_bindir}/chsh
-rm $RPM_BUILD_ROOT%{_bindir}/login
-rm $RPM_BUILD_ROOT%{_bindir}/su
-rm $RPM_BUILD_ROOT%{_bindir}/faillog
-rm $RPM_BUILD_ROOT%{_sbindir}/nologin
-rm $RPM_BUILD_ROOT%{_mandir}/man1/chfn.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man1/chfn.*
-rm $RPM_BUILD_ROOT%{_mandir}/man1/chsh.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man1/chsh.*
-rm $RPM_BUILD_ROOT%{_mandir}/man1/login.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man1/login.*
-rm $RPM_BUILD_ROOT%{_mandir}/man1/su.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man1/su.*
-rm $RPM_BUILD_ROOT%{_mandir}/man5/passwd.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man5/passwd.*
-rm $RPM_BUILD_ROOT%{_mandir}/man8/nologin.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man8/nologin.*
-rm $RPM_BUILD_ROOT%{_mandir}/man3/getspnam.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man3/getspnam.*
-rm $RPM_BUILD_ROOT%{_mandir}/man5/faillog.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man5/faillog.*
-rm $RPM_BUILD_ROOT%{_mandir}/man8/faillog.*
-rm $RPM_BUILD_ROOT%{_mandir}/*/man8/faillog.*
-
-# Remove PAM service files we don't use.
-rm $RPM_BUILD_ROOT%{_pam_confdir}/chfn
-rm $RPM_BUILD_ROOT%{_pam_confdir}/chsh
-rm $RPM_BUILD_ROOT%{_pam_confdir}/login
-rm $RPM_BUILD_ROOT%{_pam_confdir}/su
+rm $RPM_BUILD_ROOT/%{_bindir}/chfn
+rm $RPM_BUILD_ROOT/%{_bindir}/chsh
+rm $RPM_BUILD_ROOT/%{_bindir}/expiry
+rm $RPM_BUILD_ROOT/%{_bindir}/groups
+rm $RPM_BUILD_ROOT/%{_bindir}/login
+rm $RPM_BUILD_ROOT/%{_bindir}/passwd
+rm $RPM_BUILD_ROOT/%{_bindir}/su
+rm $RPM_BUILD_ROOT/%{_bindir}/faillog
+rm $RPM_BUILD_ROOT/%{_sysconfdir}/login.access
+rm $RPM_BUILD_ROOT/%{_sysconfdir}/limits
+rm $RPM_BUILD_ROOT/%{_sbindir}/logoutd
+rm $RPM_BUILD_ROOT/%{_sbindir}/nologin
+rm $RPM_BUILD_ROOT/%{_sbindir}/chgpasswd
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/chfn.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/chfn.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/chsh.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/chsh.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/expiry.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/expiry.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/groups.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/groups.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/login.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/login.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/passwd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/passwd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/su.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/su.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man5/limits.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/limits.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man5/login.access.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/login.access.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man5/passwd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/passwd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man5/porttime.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/porttime.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man5/suauth.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/suauth.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man8/logoutd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man8/logoutd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man8/nologin.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man8/nologin.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man8/chgpasswd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man8/chgpasswd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man3/getspnam.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man3/getspnam.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man5/faillog.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/faillog.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man8/faillog.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man8/faillog.*

 find $RPM_BUILD_ROOT%{_mandir} -depth -type d -empty -delete
 %find_lang shadow
@ -194,38 +194,30 @@ for dir in $(ls -1d $RPM_BUILD_ROOT%{_mandir}/{??,??_??}) ; do
    echo "%%lang($lang) $dir/man*/*" >> shadow.lang
 done

-# Move header files to its own folder
-echo $(ls)
-mkdir -p $RPM_BUILD_ROOT/%{includesubiddir}
-install -m 644 libsubid/subid.h $RPM_BUILD_ROOT/%{includesubiddir}/
-
-# Remove .la and .a files created by libsubid
-rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.la
-rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
+%clean
+rm -rf $RPM_BUILD_ROOT

 %files -f shadow.lang
+%defattr(-,root,root)
 %doc NEWS doc/HOWTO README
+%{!?_licensedir:%global license %%doc}
 %license gpl-2.0.txt shadow-bsd.txt
 %attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/login.defs
 %attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/default/useradd
-%config(noreplace) %{_pam_confdir}/chpasswd
-%config(noreplace) %{_pam_confdir}/newusers
-%config(noreplace) %{_pam_confdir}/passwd
 %{_bindir}/sg
 %attr(4755,root,root) %{_bindir}/chage
 %attr(4755,root,root) %{_bindir}/gpasswd
+%{_bindir}/lastlog
 %attr(4755,root,root) %{_bindir}/newgrp
-%attr(0755,root,root) %caps(cap_setgid=ep) %{_bindir}/newgidmap
-%attr(0755,root,root) %caps(cap_setuid=ep) %{_bindir}/newuidmap
-%attr(4755,root,root) %{_bindir}/passwd
+%attr(4755,root,root) %{_bindir}/newgidmap
+%attr(4755,root,root) %{_bindir}/newuidmap
 %{_sbindir}/adduser
-%attr(0755,root,root)   %{_sbindir}/user*
-%attr(0755,root,root)   %{_sbindir}/group*
+%attr(0750,root,root)   %{_sbindir}/user*
+%attr(0750,root,root)   %{_sbindir}/group*
 %{_sbindir}/grpck
 %{_sbindir}/pwck
 %{_sbindir}/*conv
 %{_sbindir}/chpasswd
-%{_sbindir}/chgpasswd
 %{_sbindir}/newusers
 %{_sbindir}/vipw
 %{_sbindir}/vigr
@ -235,7 +227,6 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_mandir}/man1/newgrp.1*
 %{_mandir}/man1/newgidmap.1*
 %{_mandir}/man1/newuidmap.1*
-%{_mandir}/man1/passwd.*
 %{_mandir}/man3/shadow.3*
 %{_mandir}/man5/shadow.5*
 %{_mandir}/man5/login.defs.5*
@ -248,506 +239,13 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a
 %{_mandir}/man8/pwck.8*
 %{_mandir}/man8/grpck.8*
 %{_mandir}/man8/chpasswd.8*
-%{_mandir}/man8/chgpasswd.8*
 %{_mandir}/man8/newusers.8*
 %{_mandir}/man8/*conv.8*
+%{_mandir}/man8/lastlog.8*
 %{_mandir}/man8/vipw.8*
 %{_mandir}/man8/vigr.8*

-%files subid
-%{_libdir}/libsubid.so.*
-%{_bindir}/getsubids
-%{_mandir}/man1/getsubids.1*
-
-%files subid-devel
-%{includesubiddir}/subid.h
-%{_libdir}/libsubid.so
-
 %changelog
-* Wed Jul 29 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.20.0-1
- Rebase to version 4.20.0
-
-* Wed Jul 22 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.20.0-rc3-1
- Rebase to version 4.20.0-rc3
-
-* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.19.3-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
-
-* Wed May 27 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.3-3
- Enable use of PAM for chpasswd and newusers
-  Resolves: #2461179 and #2283963
-
-* Thu Apr 23 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.3-2
- btrfs: simplify checks improve useradd behavior for non-btrfs
-
-* Wed Feb 11 2026 Debarshi Ray <rishi@fedoraproject.org> - 2:4.19.3-1
- Rebase to version 4.19.3
-  Resolves: #2426288
-
-* Tue Jan 27 2026 Adam Williamson <awilliam@redhat.com> - 2:4.19.0-6
- chkhash.c: fix escaping in SHA-256 / SHA-512 / MD5 regexes
-
-* Mon Jan 26 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-5
- chkhash.c: fix support for ! and * in hashes
- usermod.c: add back optimizations
-
-* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.19.0-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
-
-* Mon Jan 12 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-3
- useradd: Support config for creating home dirs as Btrfs subvolumes
-
-* Fri Jan  9 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-2
- Enable unit-tests
-
-* Fri Jan  9 2026 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.19.0-1
- Rebase to version 4.19.0
-  Resolves: #2426288 and #2249524
-
-* Tue Nov 25 2025 Adam Williamson <awilliam@redhat.com> - 2:4.18.0-7
- Also revert changes from -4 (last known good was -3)
-
-* Tue Nov 25 2025 Adam Williamson <awilliam@redhat.com> - 2:4.18.0-6
- Revert changes from -5 (they were only meant for testing)
-
-* Tue Nov 25 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-5
- Test CI
-
-* Fri Oct 31 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-4
- Stop setting SELinux labels in chroot and prefix environments
-  Resolves: #2249524
-
-* Tue Jul 29 2025 Alexey Tikhonov <atikhono@redhat.com> - 2:4.18.0-3
- Revert "Stop assigning subids by default"
-  Resolves: #2382662
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.18.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue Jul 22 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.18.0-1
- Rebase to version 4.18.0. Resolves: #2374710
-
-* Fri Jul 18 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-5
- Stop assigning subids by default
-  Resolves: CVE-2024-56433 and #2334168
-
-* Tue Jul 15 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-4
- FSWC: Migrate to lastlog2
-  Link: <https://fedoraproject.org/wiki/Changes/Migrate_to_lastlog2>
-  Resolves: #2361588
-
-* Tue Mar 25 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-2
- Add pam dependency for _pam_confdir missing macro. Resolves: #2354806
-
-* Thu Mar 20 2025 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.4-1
- Rebase to version 4.17.4. Resolves: #2353491
- Fixes problems with expiration dates
-
-* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2:4.17.0-5
- Add explicit BR: libxcrypt-devel
-
-* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.17.0-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.17.0-3
- Rebuilt for the bin-sbin merge (2nd attempt)
-
-* Thu Dec 26 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.0
- Rebase to version 4.17.0. Resolves: #2293678
-
-* Sun Dec 22 2024 Björn Esser <besser82@fedoraproject.org> - 2:4.17.0~rc1-2
- Remove potentially dangerous {C,LD}FLAGS shenanigans
- Fail linking if there are undefined symbols at link-time
-
-* Mon Dec  9 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.17.0~rc1-1
- Rebase to version 4.17.0-rc1
-
-* Tue Nov 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-7
- SPDX license migration for subpackages
-
-* Wed Oct 16 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-6
- Rebuilt for libeconf soname bump
-
-* Mon Oct  7 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-5
- useradd: fix write_full() return value. Resolves: #2313559
-
-* Fri Sep 13 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-3
- Disable nscd
-
-* Wed Aug 28 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.16.0-2
- Rebase to version 4.16.0 (#2293678)
-
-* Tue Jul 23 2024 Kevin Fenzi <kevin@scrye.com> - 2:4.15.1-9
- Revert chpasswd: use PAM again for now.
-
-* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.15.1-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.15.1-7
- Rebuilt for the bin-sbin merge
-
-* Thu May 30 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-6
- chpasswd: use PAM again (#2283963)
-
-* Mon May 20 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-5
- Several fixes for issues detected by static analyzer tools
-
-* Thu Apr 11 2024 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 2:4.15.1-4
- Fix build with %%_bindir==%%_sbindir
- Add virtual Provides for old file paths used by other packages
-
-* Thu Mar 21 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-2
- getdef: avoid spurious error messages about unknown configuration options.
-  Resolves: #2265291
-
-* Tue Mar 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.1-1
- Wrong versioning for 4.15.0 RC releases makes the oficial release look lower than them.
-  Fix it by bumping the minor release to 4.15.1. Resolves: #2268690
-
-* Mon Mar 11 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.0-1
- Rebase to version 4.15.0
-
-* Mon Feb 12 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-6
- Build linking `libpam`
-
-* Thu Feb  1 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-5
- passwd: Provide binary from this package. Enable libpam and
-  disable account-tools-setuid. Provide passwd PAM service file.
-  Resolves: #2233275
- passwd: provide --stdin option
-
-* Mon Jan 29 2024 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-4
- Disable SSSD support. Resolves: #2253182
-
-* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.14.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Tue Oct  3 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-2
- useradd: Set proper SELinux labels for def_usrtemplate
-
-* Wed Aug 16 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-1
- Rebase to version 4.14.0. Resolves: #2229000
-
-* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.13-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Tue Jun 06 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 2:4.13-7
- Remove unused libbsd-devel dependency
-
-* Mon Mar  6 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-6
- Add libbsd-devel and libeconf-devel as build dependencies
-
-* Thu Mar  2 2023 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-5
- newuidmap and newgidmap: support passing pid as fd. Resolves: #2174752
-
-* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.13-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Wed Nov 23 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-3
- Change SUB_UID_MIN and SUB_GID_MIN to 524288. Resolves: #2144558
-
-* Mon Nov 21 2022 Florian Weimer <fweimer@redhat.com> - 2:4.13-2
- Fix gshadow configure check (switching to glibc implementation)
-
-* Wed Nov  9 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.13-1
- Rebase to version 4.13
- SPDX license migration
-
-* Wed Oct  5 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-3
- chage: Fix regression in print_date. Resolves: #2129336
-
-* Fri Sep  9 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-2
- useradd: Do not reset non-existent data in {last,fail}log
-
-* Mon Aug 22 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.12.3-1
- Rebase to version 4.12.3. Resolves: #2117809
-
-* Mon Aug  1 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.11.1-4
- useradd: modify check ID range for system users. Resolves: #2093692
-
-* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.11.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Thu Feb 10 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.11.1-2
- Fix explicit subid requirement for subid-devel
-
-* Tue Jan 25 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.11.1-1
- Rebase to version 4.11.1 (#2034038)
- Fix release sources
- Add explicit subid requirement for subid-devel
-
-* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.9-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Mon Jan 17 2022 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-9
- nss: get shadow_logfd with log_get_logfd() (#2038811)
- lib: make shadow_logfd and Prog not extern
- lib: rename Prog to shadow_progname
- lib: provide default values for shadow_progname
- libsubid: use log_set_progname in subid_init
-
-* Fri Nov 19 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-8
- getsubids: provide system binary and man page (#1980780)
- pwck: fix segfault when calling fprintf() (#2021339)
- newgrp: fix segmentation fault (#2019553)
- groupdel: fix SIGSEGV when passwd does not exist (#1986111)
-
-* Fri Nov 12 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-7
- useradd: change SELinux labels for home files (#2022658)
-
-* Thu Nov  4 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-6
- useradd: revert fix memleak of grp (#2018697)
-
-* Wed Oct 27 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-5
- useradd: generate home and mail directories with selinux user attribute
-
-* Thu Sep 23 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-4
- login.defs: include HMAC_CRYPTO_ALGO key
- Clean spec file: organize dependencies and move License location
-
-* Tue Aug 17 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-3
- libmisc: fix default value in SHA_get_salt_rounds()
-
-* Mon Aug  9 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-2
- useradd: avoid generating an empty subid range (#1990653)
-
-* Wed Aug  4 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-1
- Rebase to version 4.9
- usermod: allow all group types with -G option (#1975327)
- Clean spec file
-
-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.8.1-20
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Wed Jul 14 2021 Björn Esser <besser82@fedoraproject.org> - 2:4.8.1-19
- Add patch to fix 'fread returns element count, not element size'
-
-* Wed Jul 14 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-18
- Fix regression issues detected in rhbz#667593 and rhbz#672510
-
-* Mon Jul 12 2021 Björn Esser <besser82@fedoraproject.org> - 2:4.8.1-17
- Enable bcrypt support, as libxcrypt supports it well
-
-* Sun Jul 04 2021 Björn Esser <besser82@fedoraproject.org> - 2:4.8.1-16
- Add a patch to obtain random bytes using getentropy()
- Update shadow-4.8-crypt_h.patch with the upstreamed version
- Add a patch to make use of crypt_gensalt() from libxcrypt
-
-* Tue Jun 29 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-15
- useradd: free correct pointer (#1976809)
-
-* Mon Jun 28 2021 Björn Esser <besser82@fedoraproject.org> - 2:4.8.1-14
- Add a patch to fix the used prefix for the bcrypt hash method
- Add a patch to cleanup the code in libmisc/salt.c
- Add a patch adding some clarifying comments in libmisc/salt.c
- Add a patch to obtain random bytes from /dev/urandom
-
-* Mon Jun 28 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-13
- Covscan fixes
-
-* Mon Jun 21 2021 Björn Esser <besser82@fedoraproject.org> - 2:4.8.1-12
- Backport support for yescrypt hash method
- Add a patch to fix the parameter type of YESCRYPT_salt_cost()
-
-* Mon Jun 21 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-11
- libsubid: don't print error messages on stderr by default
- libsubid: libsubid_init return false if out of memory
- useradd: fix SUB_UID_COUNT=0
- libsubid: don't return owner in list_owner_ranges API call
- libsubid: libsubid_init don't print messages on error
- libsubid: fix newusers when nss provides subids
- man: clarify subid delegation
- libsubid: make shadow_logfd not extern
-
-* Thu May  6 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-10
- man: mention NSS in new[ug]idmap manpages
- libsubid: move development header to shadow folder
-
-* Fri Apr 16 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-9
- libsubid: creation and nsswitch support
- Creation of subid and subid-devel subpackages
-
-* Mon Mar 29 2021 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-8
- man: include lastlog file caveat (#951564)
- Upstream links to several patches
- Spec file cleanup by Robert Scheck
- Add BuildRequires: make by Tom Stellard
-
-* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.8.1-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Mon Nov  9 2020 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-6
- commonio: force lock file sync (#1862056)
-
-* Tue Nov  3 2020 Petr Lautrbach <plautrba@redhat.com> - 2:4.8.1-5
- Rebuild with libsemanage.so.2
-
-* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.8.1-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Thu May 14 2020 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-3
- check only local groups when adding new supplementary groups to a user (#1727236)
-
-* Tue Mar 24 2020 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-2
- useradd: clarify the useradd -d parameter behavior in man page
-
-* Tue Mar 17 2020 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8.1-1
- updated upstream to 4.8.1
-
-* Tue Mar 17 2020 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8-5
- synchronized login.defs with upstream file (#1261099 and #1807957)
-
-* Mon Feb 24 2020 Iker Pedrosa <ipedrosa@redhat.com> - 2:4.8-4
- fix useradd: doesn't generate spool mail with the proper SELinux user identity
-  (#1690527)
-
-* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.8-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Thu Jan 16 2020 Tomáš Mráz <tmraz@redhat.com> - 2:4.8-2
- make the invalid shell check into warning
-
-* Mon Jan 13 2020 Tomáš Mráz <tmraz@redhat.com> - 2:4.8-1
- update to current upstream release 4.8
-
-* Mon Sep  2 2019 Tomáš Mráz <tmraz@redhat.com> - 2:4.6-16
- fix SELinux related problem in chpasswd/chgpasswd when run with -R
-  (patch by Petr Lautrbach) (#1747215)
-
-* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.6-15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Fri Jun  7 2019 Tomáš Mráz <tmraz@redhat.com> - 2:4.6-14
- minor auditing fixes
-
-* Fri May  3 2019 Tomáš Mráz <tmraz@redhat.com> - 2:4.6-13
- use lckpwdf() again to disable concurrent edits of databases by
-  other applications
-
-* Tue Apr  2 2019 Tomáš Mráz <tmraz@redhat.com> - 2:4.6-12
- force regeneration of getdate.c otherwise the date parsing fix
-  is not applied
-
-* Fri Mar 22 2019 Tomáš Mráz <tmraz@redhat.com> - 2:4.6-11
- clarify chage manual page in regards to shadow and passwd
-  inconsistency (#1686440)
-
-* Thu Mar 21 2019 Tomáš Mráz <tmraz@redhat.com> - 2:4.6-10
- Ignore LOGIN_PLAIN_PROMPT variable in login.defs
-
-* Thu Mar  7 2019 Tim Landscheidt <tim@tim-landscheidt.de> - 2:4.6-9
- Remove obsolete requirements for post/pre scriptlets
-
-* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.6-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 2:4.6-7
- Rebuilt for libcrypt.so.2 (#1666033)
-
-* Tue Dec 18 2018 Tomáš Mráz <tmraz@redhat.com> - 2:4.6-6
- usermod: guard against unsafe change of ownership of
-  special home directories
-
-* Mon Nov 19 2018 Tomáš Mráz <tmraz@redhat.com> - 2:4.6-5
- use itstool instead of xml2po
-
-* Tue Nov  6 2018 Tomáš Mráz <tmraz@redhat.com> - 2:4.6-4
- use cap_setxid file capabilities for newxidmap instead of making them setuid
- limit the SYS_U/GID_MIN value to 1 as the algorithm does not work with 0
-  and the 0 is always used by root anyway
- manual page improvements
-
-* Wed Oct 10 2018 Tomáš Mráz <tmraz@redhat.com> - 2:4.6-3
- fix some issues from Coverity scan
- flush sssd caches - patch by Jakub Hrozek
-
-* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Mon May 28 2018 Tomáš Mráz <tmraz@redhat.com> - 2:4.6-1
- update to current upstream release 4.6
-
-* Fri Apr 20 2018 Tomáš Mráz <tmraz@redhat.com> - 2:4.5-10
- Raise limit for passwd and shadow entry length but also prevent
-  writing longer entries (#1422497)
-
-* Tue Feb 06 2018 Björn Esser <besser82@fedoraproject.org> - 2:4.5-9
- Add patch to include crypt.h, if present
- Use %%make_{build,install} macros
- Refresh other patches for proper alignment
-
-* Sat Jan 20 2018 Björn Esser <besser82@fedoraproject.org> - 2:4.5-8
- Rebuilt for switch to libxcrypt
-
-* Mon Nov  6 2017 Tomáš Mráz <tmraz@redhat.com> - 2:4.5-7
- fix regression caused by the userdel-chroot patch (#1509978)
-
-* Thu Nov  2 2017 Tomáš Mráz <tmraz@redhat.com> - 2:4.5-6
- fix userdel in chroot (#1316168)
- add useful chage -E example to chage manpage
-
-* Fri Sep 15 2017 Tomáš Mráz <tmraz@redhat.com> - 2:4.5-5
- do not allow "." and ".." user names
-
-* Mon Aug 14 2017 Tomáš Mráz <tmraz@redhat.com> - 2:4.5-4
- allow switching to secondary group without checking the membership
-  explicitly (patch from upstream)
-
-* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.5-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Fri Jul 21 2017 Tomáš Mráz <tmraz@redhat.com> - 2:4.5-1
- update to current upstream release 4.5
-
-* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.3.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Thu Aug 25 2016 Tomáš Mráz <tmraz@redhat.com> - 2:4.3.1-2
- fix regression in useradd - not processing defaults properly (#1369979)
-
-* Tue Aug 23 2016 Tomáš Mráz <tmraz@redhat.com> - 2:4.3.1-1
- new upstream release fixing low impact security issue
-
-* Tue Jun 14 2016 Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-11
- guard for localtime() and gmtime() failure
-
-* Mon May 30 2016 Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-10
- chpasswd, chgpasswd: open audit when starting
-
-* Thu May 26 2016 Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-9
- chgpasswd: do not remove it
- chpasswd, chgpasswd: add selinux_check_access call (#1336902)
-
-* Thu Mar 17 2016 Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-8
- userdel: fix userdel -f with /etc/subuid present (#1316168)
-
-* Tue Feb  9 2016 Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-7
- usermod: properly return error during password manipulation
-
-* Wed Feb  3 2016 Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-6
- add possibility to clear or set lastlog record for user via lastlog
-
-* Fri Jan  8 2016 Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-5
- do not use obscure permissions for binaries
- remove unused commands from login.defs(5) cross-reference
-
-* Fri Nov  6 2015 Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-4
- document that groupmems is not setuid root
- document that expiration of the password after inactivity period
-  locks the user account completely
-
-* Thu Aug 27 2015 Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-3
- unlock also passwords locked with passwd -l
- prevent breaking user entry by entering a password containing colon
- fix possible DoS when locking the database files for update
- properly use login.defs from the chroot in useradd
-
-* Fri Jun 19 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2:4.2.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
-
 * Wed Nov 26 2014 Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-1
 - new upstream release with support for subordinate uids and gids

--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (shadow-4.20.0.tar.xz) = 0b8afded372e4d37a78f38cb972c0ab877870ef6356cdd1c45be3c708af3d1496c6f87de6bf6a5b1d217d4d52d7e2d15c28b26530949cc6de0231a4028930406
-SHA512 (shadow-4.20.0.tar.xz.asc) = e4b134543768f323df30a1e450c22086d013020928d62bd3207db7f633beea3587b67802da5b575d5a794e8c2bebd7a0abeba6ed69d44bf08adc37df3bf352ac
+2bfafe7d4962682d31b5eba65dba4fc8  shadow-4.2.1.tar.xz
+6752051fb07fc4be58c3d7b929bf2341  shadow-4.2.1.tar.xz.sig
--- a/tests/mhc-fedora-ci.yaml
+++ b/tests/mhc-fedora-ci.yaml
@ -1,13 +0,0 @@
-provisioned_topologies:
- shadow
-domains:
- id: shadow
-  hosts:
-  - hostname: localhost
-    role: shadow
-    conn:
-      type: ssh
-      host: localhost
-      user: root
-    artifacts:
-    - /var/log/*