开源软件构建与测试

_service:extract_file:shadow.spec Deleted

@@ -1,324 +0,0 @@
-Name: shadow
-Version: 4.9
-Release: 1
-Epoch: 2
-License: BSD and GPLv2+
-Summary: Tools for managing accounts and shadow password files
-URL: http://pkg-shadow.alioth.debian.org/
-Source0: https://github.com/shadow-maint/shadow/releases/download/v%{version}/shadow-%{version}.tar.xz
-Source2: shadow-utils.useradd
-Source3: shadow-utils.login.defs
-Source4: shadow-bsd.txt
-Source5: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
-Source6: chpasswd
-Source7: newusers
-
-%global includesubiddir %{_includedir}/shadow
-
-# fix unknown item 'LASTLOG_MAX_UID'
-Patch0:  shadow-4.8-goodname.patch
-Patch1:  shadow-4.9-null-tm.patch
-Patch2:  shadow-4.8-long-entry.patch
-Patch3:  usermod-unlock.patch
-Patch4:  useradd-create-directories-after-the-SELinux-user.patch
-Patch5:  shadow-4.1.5.1-var-lock.patch
-Patch6:  shadow-utils-fix-lock-file-residue.patch
-Patch7:  Makefile-include-libeconf-dependency-in-new-idmap.patch 
-Patch8:  usermod-allow-all-group-types-with-G-option.patch
-Patch9:  useradd-avoid-generating-an-empty-subid-range.patch
-Patch10: libmisc-fix-default-value-in-SHA_get_salt_rounds.patch
-Patch11: semanage-close-the-selabel-handle.patch
-Patch12: Revert-useradd.c-fix-memleaks-of-grp.patch
-Patch13: useradd-change-SELinux-labels-for-home-files.patch
-Patch14: libsubid-link-to-PAM-libraries.patch
-Patch15: Fix-out-of-tree-builds-with-respect-to-libsubid-incl.patch
-Patch16: Respect-enable-static-no-in-libsubid.patch
-Patch17: Fixes-the-linking-issues-when-libsubid-is-static-and.patch
-Patch18: pwck-fix-segfault-when-calling-fprintf.patch
-Patch19: newgrp-fix-segmentation-fault.patch
-Patch20: groupdel-fix-SIGSEGV-when-passwd-does-not-exist.patch
-Patch21: backport-useradd-modify-check-ID-range-for-system-users.patch
-
-BuildRequires: gcc, libselinux-devel, audit-libs-devel, libsemanage-devel
-BuildRequires: libacl-devel, libattr-devel
-BuildRequires: bison, flex, gnome-doc-utils, docbook-style-xsl, docbook-dtds
-BuildRequires: autoconf, automake, libtool, gettext-devel, itstool, pam-devel
-Requires: libselinux
-Requires: audit-libs
-Requires: setup
-Requires(pre): coreutils
-Requires(post): coreutils
-Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-
-Provides: shadow-utils
-Obsoletes: shadow-utils
-
-%description
-This package includes the necessary programs for converting plain
-password files to the shadow password format and to manage user and
-group accounts.
-
-%package subid-devel
-Summary: Development package for shadow-utils-subid
-License: BSD and GPLv2+
-
-%description subid-devel
-Development files for shadow-utils-subid.
-
-%package_help
-
-%prep
-%autosetup -n shadow-%{version} -p1
-
-iconv -f ISO88591 -t utf-8  doc/HOWTO > doc/HOWTO.utf8
-cp -f doc/HOWTO.utf8 doc/HOWTO
-
-cp -a %{SOURCE4} %{SOURCE5} .
-
-%build
-export CFLAGS="$RPM_OPT_FLAGS -fpie"
-export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
-
-autoreconf -fiv
-%configure \
-        --enable-shadowgrp \
-        --enable-man \
-        --with-audit \
-        --with-sha-crypt \
-        --with-selinux \
-        --without-libcrack \
-        --with-libpam \
-        --enable-shared \
-        --with-group-name-max-length=32
-%make_build
-
-%install
-rm -rf $RPM_BUILD_ROOT
-%make_install gnulocaledir=$RPM_BUILD_ROOT/%{_datadir}/locale MKINSTALLDIRS=`pwd`/mkinstalldirs
-install -d -m 755 $RPM_BUILD_ROOT/%{_sysconfdir}/default
-install -p -c -m 0644 %{SOURCE3} $RPM_BUILD_ROOT/%{_sysconfdir}/login.defs
-install -p -c -m 0600 %{SOURCE2} $RPM_BUILD_ROOT/%{_sysconfdir}/default/useradd
-install -p -c -m 0644 %{SOURCE6} $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/chpasswd
-install -p -c -m 0644 %{SOURCE7} $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/newusers
-
-ln -s useradd $RPM_BUILD_ROOT%{_sbindir}/adduser
-ln -s useradd.8 $RPM_BUILD_ROOT/%{_mandir}/man8/adduser.8
-for subdir in $RPM_BUILD_ROOT/%{_mandir}/{??,??_??,??_??.*}/man* ; do
-        test -d $subdir && test -e $subdir/useradd.8 && echo ".so man8/useradd.8" > $subdir/adduser.8
-done
-
-# Remove binaries we don't use.
-rm $RPM_BUILD_ROOT/%{_bindir}/chfn
-rm $RPM_BUILD_ROOT/%{_bindir}/chsh
-rm $RPM_BUILD_ROOT/%{_bindir}/expiry
-rm $RPM_BUILD_ROOT/%{_bindir}/groups
-rm $RPM_BUILD_ROOT/%{_bindir}/login
-rm $RPM_BUILD_ROOT/%{_bindir}/passwd
-rm $RPM_BUILD_ROOT/%{_bindir}/su
-rm $RPM_BUILD_ROOT/%{_bindir}/faillog
-rm $RPM_BUILD_ROOT/%{_sbindir}/logoutd
-rm $RPM_BUILD_ROOT/%{_sbindir}/nologin
-rm $RPM_BUILD_ROOT/%{_mandir}/man1/chfn.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/chfn.*
-rm $RPM_BUILD_ROOT/%{_mandir}/man1/chsh.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/chsh.*
-rm $RPM_BUILD_ROOT/%{_mandir}/man1/expiry.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/expiry.*
-rm $RPM_BUILD_ROOT/%{_mandir}/man1/groups.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/groups.*
-rm $RPM_BUILD_ROOT/%{_mandir}/man1/login.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/login.*
-rm $RPM_BUILD_ROOT/%{_mandir}/man1/passwd.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/passwd.*
-rm $RPM_BUILD_ROOT/%{_mandir}/man1/su.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/su.*
-rm $RPM_BUILD_ROOT/%{_mandir}/man5/passwd.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/passwd.*
-rm $RPM_BUILD_ROOT/%{_mandir}/man5/suauth.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/suauth.*
-rm $RPM_BUILD_ROOT/%{_mandir}/man8/logoutd.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man8/logoutd.*
-rm $RPM_BUILD_ROOT/%{_mandir}/man8/nologin.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man8/nologin.*
-rm $RPM_BUILD_ROOT/%{_mandir}/man3/getspnam.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man3/getspnam.*
-rm $RPM_BUILD_ROOT/%{_mandir}/man5/faillog.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/faillog.*
-rm $RPM_BUILD_ROOT/%{_mandir}/man8/faillog.*
-rm $RPM_BUILD_ROOT/%{_mandir}/*/man8/faillog.*
-rm $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/chfn
-rm $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/chsh
-rm $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/login
-rm $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/passwd
-rm $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/su
-
-find $RPM_BUILD_ROOT%{_mandir} -depth -type d -empty -delete
-%find_lang shadow
-for dir in $(ls -1d $RPM_BUILD_ROOT%{_mandir}/{??,??_??}) ; do
-    dir=$(echo $dir | sed -e "s|^$RPM_BUILD_ROOT||")
-    lang=$(basename $dir)
-done
-
-# Move subid.h to its own folder
-echo $(ls)
-mkdir -p $RPM_BUILD_ROOT/%{includesubiddir}
-install -m 644 libsubid/subid.h $RPM_BUILD_ROOT/%{includesubiddir}/
-
-# Remove .la files created by libsubid
-rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.la
-
-%files -f shadow.lang
-%doc NEWS doc/HOWTO README
-%{!?_licensedir:%global license %%doc}
-%license gpl-2.0.txt shadow-bsd.txt
-%attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/login.defs
-%attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/default/useradd
-%{_bindir}/sg
-%attr(4755,root,root) %{_bindir}/chage
-%attr(4755,root,root) %{_bindir}/gpasswd
-%{_bindir}/lastlog
-%attr(4755,root,root) %{_bindir}/newgrp
-%attr(4755,root,root) %{_bindir}/newgidmap
-%attr(4755,root,root) %{_bindir}/newuidmap
-%{_sbindir}/adduser
-%attr(0755,root,root)   %{_sbindir}/user*
-%attr(0755,root,root)   %{_sbindir}/group*
-%{_sbindir}/grpck
-%{_sbindir}/pwck
-%{_sbindir}/*conv
-%{_sbindir}/chpasswd
-%{_sbindir}/chgpasswd
-%{_sbindir}/newusers
-%{_sbindir}/vipw
-%{_sbindir}/vigr
-%{_sysconfdir}/pam.d/chpasswd
-%{_sysconfdir}/pam.d/groupmems
-%{_sysconfdir}/pam.d/newusers
-
-%files subid-devel
-%{_libdir}/libsubid.so.*

_service:tar_scm:shadow.spec Added

@@ -0,0 +1,350 @@
+Name: shadow
+Version: 4.9
+Release: 8
+Epoch: 2
+License: BSD and GPLv2+
+Summary: Tools for managing accounts and shadow password files
+URL: http://pkg-shadow.alioth.debian.org/
+Source0: https://github.com/shadow-maint/shadow/releases/download/v%{version}/shadow-%{version}.tar.xz
+Source2: shadow-utils.useradd
+Source3: shadow-utils.login.defs
+Source4: shadow-bsd.txt
+Source5: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
+Source6: chpasswd
+Source7: newusers
+
+%global includesubiddir %{_includedir}/shadow
+
+# fix unknown item 'LASTLOG_MAX_UID'
+Patch0:  shadow-4.8-goodname.patch
+Patch1:  shadow-4.9-null-tm.patch
+Patch2:  shadow-4.8-long-entry.patch
+Patch3:  usermod-unlock.patch
+Patch4:  useradd-create-directories-after-the-SELinux-user.patch
+Patch5:  Makefile-include-libeconf-dependency-in-new-idmap.patch 
+Patch6:  usermod-allow-all-group-types-with-G-option.patch
+Patch7:  useradd-avoid-generating-an-empty-subid-range.patch
+Patch8: libmisc-fix-default-value-in-SHA_get_salt_rounds.patch
+Patch9: semanage-close-the-selabel-handle.patch
+Patch10: Revert-useradd.c-fix-memleaks-of-grp.patch
+Patch11: useradd-change-SELinux-labels-for-home-files.patch
+Patch12: libsubid-link-to-PAM-libraries.patch
+Patch13: Fix-out-of-tree-builds-with-respect-to-libsubid-incl.patch
+Patch14: Respect-enable-static-no-in-libsubid.patch
+Patch15: Fixes-the-linking-issues-when-libsubid-is-static-and.patch
+Patch16: pwck-fix-segfault-when-calling-fprintf.patch
+Patch17: newgrp-fix-segmentation-fault.patch
+Patch18: groupdel-fix-SIGSEGV-when-passwd-does-not-exist.patch
+Patch19: backport-useradd-modify-check-ID-range-for-system-users.patch
+Patch20: shadow-add-sm3-crypt-support.patch
+Patch21: backport-Add-header-guards.patch
+Patch22: backport-Change-to-strncat.patch
+Patch23: backport-Do-not-return-garbage-in-run_parts.patch
+Patch24: backport-Handle-ERANGE-error-correctly.patch
+Patch25: backport-Initialize-local-variables.patch
+Patch26: backport-Remove-commented-out-code-and-FIXMEs.patch
+Patch27: backport-Remove-redeclared-variable.patch
+Patch28: backport-libmisc-add-check-fopen-return-value-in-read_random_.patch
+Patch29: backport-passwd-erase-password-copy-on-all-error-branches.patch
+Patch30: backport-chpasswd-add-get_salt-for-generating-salt-value.patch
+Patch31: backport-chpasswd-fix-function-problem-with-R-parameter.patch
+Patch32: backport-useradd-check-if-subid-range-exists-for-user.patch
+
+BuildRequires: gcc, libselinux-devel, audit-libs-devel, libsemanage-devel
+BuildRequires: libacl-devel, libattr-devel
+BuildRequires: bison, flex, gnome-doc-utils, docbook-style-xsl, docbook-dtds
+BuildRequires: autoconf, automake, libtool, gettext-devel, itstool, pam-devel
+Requires: libselinux
+Requires: audit-libs
+Requires: setup
+Requires(pre): coreutils
+Requires(post): coreutils
+Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+
+Provides: shadow-utils
+Obsoletes: shadow-utils
+
+%description
+This package includes the necessary programs for converting plain
+password files to the shadow password format and to manage user and
+group accounts.
+
+%package subid-devel
+Summary: Development package for shadow-utils-subid
+License: BSD and GPLv2+
+
+%description subid-devel
+Development files for shadow-utils-subid.
+
+%package_help
+
+%prep
+%autosetup -n shadow-%{version} -p1
+
+iconv -f ISO88591 -t utf-8  doc/HOWTO > doc/HOWTO.utf8
+cp -f doc/HOWTO.utf8 doc/HOWTO
+
+cp -a %{SOURCE4} %{SOURCE5} .
+
+%build
+export CFLAGS="$RPM_OPT_FLAGS -fpie"
+export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
+
+autoreconf -fiv
+%configure \
+        --enable-shadowgrp \
+        --enable-man \
+        --with-audit \
+        --with-sha-crypt \
+        --with-selinux \
+        --without-libcrack \
+        --with-libpam \
+        --enable-shared \
+        --with-group-name-max-length=32
+%make_build
+
+%install
+rm -rf $RPM_BUILD_ROOT
+%make_install gnulocaledir=$RPM_BUILD_ROOT/%{_datadir}/locale MKINSTALLDIRS=`pwd`/mkinstalldirs
+install -d -m 755 $RPM_BUILD_ROOT/%{_sysconfdir}/default
+install -p -c -m 0644 %{SOURCE3} $RPM_BUILD_ROOT/%{_sysconfdir}/login.defs
+install -p -c -m 0600 %{SOURCE2} $RPM_BUILD_ROOT/%{_sysconfdir}/default/useradd
+install -p -c -m 0644 %{SOURCE6} $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/chpasswd
+install -p -c -m 0644 %{SOURCE7} $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/newusers
+
+ln -s useradd $RPM_BUILD_ROOT%{_sbindir}/adduser
+ln -s useradd.8 $RPM_BUILD_ROOT/%{_mandir}/man8/adduser.8
+for subdir in $RPM_BUILD_ROOT/%{_mandir}/{??,??_??,??_??.*}/man* ; do
+        test -d $subdir && test -e $subdir/useradd.8 && echo ".so man8/useradd.8" > $subdir/adduser.8
+done
+
+# Remove binaries we don't use.
+rm $RPM_BUILD_ROOT/%{_bindir}/chfn
+rm $RPM_BUILD_ROOT/%{_bindir}/chsh
+rm $RPM_BUILD_ROOT/%{_bindir}/expiry
+rm $RPM_BUILD_ROOT/%{_bindir}/groups
+rm $RPM_BUILD_ROOT/%{_bindir}/login
+rm $RPM_BUILD_ROOT/%{_bindir}/passwd
+rm $RPM_BUILD_ROOT/%{_bindir}/su
+rm $RPM_BUILD_ROOT/%{_bindir}/faillog
+rm $RPM_BUILD_ROOT/%{_sbindir}/logoutd
+rm $RPM_BUILD_ROOT/%{_sbindir}/nologin
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/chfn.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/chfn.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/chsh.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/chsh.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/expiry.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/expiry.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/groups.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/groups.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/login.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/login.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/passwd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/passwd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man1/su.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man1/su.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man5/passwd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/passwd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man5/suauth.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/suauth.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man8/logoutd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man8/logoutd.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man8/nologin.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man8/nologin.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man3/getspnam.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man3/getspnam.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man5/faillog.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man5/faillog.*
+rm $RPM_BUILD_ROOT/%{_mandir}/man8/faillog.*
+rm $RPM_BUILD_ROOT/%{_mandir}/*/man8/faillog.*
+rm $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/chfn
+rm $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/chsh
+rm $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/login
+rm $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/passwd
+rm $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/su
+
+find $RPM_BUILD_ROOT%{_mandir} -depth -type d -empty -delete
+%find_lang shadow
+for dir in $(ls -1d $RPM_BUILD_ROOT%{_mandir}/{??,??_??}) ; do
+    dir=$(echo $dir | sed -e "s|^$RPM_BUILD_ROOT||")
+    lang=$(basename $dir)
+done
+
+# Move subid.h to its own folder
+echo $(ls)
+mkdir -p $RPM_BUILD_ROOT/%{includesubiddir}
+install -m 644 libsubid/subid.h $RPM_BUILD_ROOT/%{includesubiddir}/
+
+# Remove .la files created by libsubid
+rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.la
+
+%files -f shadow.lang
+%doc NEWS doc/HOWTO README
+%{!?_licensedir:%global license %%doc}
+%license gpl-2.0.txt shadow-bsd.txt
+%attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/login.defs
+%attr(0644,root,root)   %config(noreplace) %{_sysconfdir}/default/useradd
+%{_bindir}/sg
+%attr(4755,root,root) %{_bindir}/chage
+%attr(4755,root,root) %{_bindir}/gpasswd
+%{_bindir}/lastlog
+%attr(4755,root,root) %{_bindir}/newgrp
+%attr(4755,root,root) %{_bindir}/newgidmap
+%attr(4755,root,root) %{_bindir}/newuidmap
+%{_sbindir}/adduser
+%attr(0755,root,root)   %{_sbindir}/user*
+%attr(0755,root,root)   %{_sbindir}/group*
+%{_sbindir}/grpck
+%{_sbindir}/pwck
+%{_sbindir}/*conv

_service:extract_file:Fix-out-of-tree-builds-with-respect-to-libsubid-incl.patch Deleted

@@ -1,112 +0,0 @@
-From 537b8cd90be7b47b45c45cfd27765ef85eb0ebf1 Mon Sep 17 00:00:00 2001
-From: Serge Hallyn <serge@hallyn.com>
-Date: Fri, 23 Jul 2021 17:51:13 -0500
-Subject: PATCH Fix out of tree builds with respect to libsubid includes
-
-There's a better way to do this, and I hope to clean that up,
-but this fixes out of tree builds for me right now.
-
-Closes #386
-
-Signed-off-by: Serge Hallyn <serge@hallyn.com>
----
- lib/Makefile.am      | 2 ++
- libmisc/Makefile.am  | 2 +-
- libsubid/Makefile.am | 4 ++--
- src/Makefile.am      | 6 ++++++
- 4 files changed, 11 insertions(+), 3 deletions(-)
-
-diff --git a/lib/Makefile.am b/lib/Makefile.am
-index ecf3ee2..5ac2e11 100644
---- a/lib/Makefile.am
-+++ b/lib/Makefile.am
-@@ -10,6 +10,8 @@ if HAVE_VENDORDIR
- libshadow_la_CPPFLAGS += -DVENDORDIR=\"$(VENDORDIR)\"
- endif
- 
-+libshadow_la_CPPFLAGS += -I$(top_srcdir)
-+
- libshadow_la_SOURCES = \
- 	commonio.c \
- 	commonio.h \
-diff --git a/libmisc/Makefile.am b/libmisc/Makefile.am
-index 9766a7e..9f237e0 100644
---- a/libmisc/Makefile.am
-+++ b/libmisc/Makefile.am
-@@ -1,7 +1,7 @@
- 
- EXTRA_DIST = .indent.pro xgetXXbyYY.c
- 
--AM_CPPFLAGS = -I$(top_srcdir)/lib $(ECONF_CPPFLAGS)
-+AM_CPPFLAGS = -I$(top_srcdir)/lib -I$(top_srcdir) $(ECONF_CPPFLAGS)
- 
- noinst_LTLIBRARIES = libmisc.la
- 
-diff --git a/libsubid/Makefile.am b/libsubid/Makefile.am
-index 8305156..99308c1 100644
---- a/libsubid/Makefile.am
-+++ b/libsubid/Makefile.am
-@@ -20,8 +20,8 @@ MISCLIBS = \
- 	$(LIBPAM)
- 
- libsubid_la_LIBADD = \
--	$(top_srcdir)/lib/libshadow.la \
--	$(top_srcdir)/libmisc/libmisc.la \
-+	$(top_builddir)/lib/libshadow.la \
-+	$(top_builddir)/libmisc/libmisc.la \
- 	$(MISCLIBS) -ldl
- 
- AM_CPPFLAGS = \
-diff --git a/src/Makefile.am b/src/Makefile.am
-index 3502701..7c1a349 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -10,6 +10,7 @@ sgidperms = 2755
- AM_CPPFLAGS = \
- 	-I${top_srcdir}/lib \
- 	-I$(top_srcdir)/libmisc \
-+	-I$(top_srcdir) \
- 	-DLOCALEDIR=\"$(datadir)/locale\"
- 
- # XXX why are login and su in /bin anyway (other than for
-@@ -183,6 +184,7 @@ list_subid_ranges_LDADD = \
- list_subid_ranges_CPPFLAGS = \
- 	-I$(top_srcdir)/lib \
- 	-I$(top_srcdir)/libmisc \
-+	-I$(top_srcdir) \
- 	-I$(top_srcdir)/libsubid
- 
- get_subid_owners_LDADD = \
-@@ -194,11 +196,13 @@ get_subid_owners_LDADD = \
- get_subid_owners_CPPFLAGS = \
- 	-I$(top_srcdir)/lib \
- 	-I$(top_srcdir)/libmisc \
-+	-I$(top_srcdir) \
- 	-I$(top_srcdir)/libsubid
- 
- new_subid_range_CPPFLAGS = \
- 	-I$(top_srcdir)/lib \
- 	-I$(top_srcdir)/libmisc \
-+	-I$(top_srcdir) \
- 	-I$(top_srcdir)/libsubid
- 
- new_subid_range_LDADD = \
-@@ -210,6 +214,7 @@ new_subid_range_LDADD = \
- free_subid_range_CPPFLAGS = \
- 	-I$(top_srcdir)/lib \
- 	-I$(top_srcdir)/libmisc \
-+	-I$(top_srcdir) \
- 	-I$(top_srcdir)/libsubid
- 
- free_subid_range_LDADD = \
-@@ -220,6 +225,7 @@ free_subid_range_LDADD = \
- 
- check_subid_range_CPPFLAGS = \
- 	-I$(top_srcdir)/lib \
-+	-I$(top_srcdir) \
- 	-I$(top_srcdir)/libmisc
- 
- check_subid_range_LDADD = \
--- 
-1.8.3.1
-

_service:extract_file:Fixes-the-linking-issues-when-libsubid-is-static-and.patch Deleted

_service:extract_file:Makefile-include-libeconf-dependency-in-new-idmap.patch Deleted

@@ -1,32 +0,0 @@
-From c6847011e8b656adacd9a0d2a78418cad0de34cb Mon Sep 17 00:00:00 2001
-From: Iker Pedrosa <ipedrosa@redhat.com>
-Date: Mon, 2 Aug 2021 15:54:20 +0200
-Subject: PATCH Makefile: include libeconf dependency in new*idmap
-
-new*idmap has a dependency with libeconf since commit
-c464ec55709dc931ba2f24073b8b1a86d5209ab0. I'm just adding it to the
-Makefile to be able to compile in distributions that include libeconf.
-
-Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
----
- src/Makefile.am | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/Makefile.am b/src/Makefile.am
-index 7c1a349..6cc873b 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -96,8 +96,8 @@ LIBCRYPT_NOPAM = $(LIBCRYPT)
- endif
- 
- chage_LDADD    = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBECONF)
--newuidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) -ldl
--newgidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) -ldl
-+newuidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) $(LIBECONF) -ldl
-+newgidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) $(LIBECONF) -ldl
- chfn_LDADD     = $(LDADD) $(LIBPAM) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD) $(LIBECONF)
- chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT) $(LIBECONF)
- chsh_LDADD     = $(LDADD) $(LIBPAM) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD) $(LIBECONF)
--- 
-1.8.3.1
-

_service:extract_file:Respect-enable-static-no-in-libsubid.patch Deleted

@@ -1,45 +0,0 @@
-From fa986b1d73605ecca54a4f19249227aeab827bf6 Mon Sep 17 00:00:00 2001
-From: Serge Hallyn <shallyn@cisco.com>
-Date: Sun, 25 Jul 2021 17:18:02 +0000
-Subject: PATCH Respect --enable-static=no in libsubid
-
-libsubid's Makefile.am was always setting enable-shared in its LDFLAGS.
-Do that only if not building static.
-
-Closes #387
-
-Signed-off-by: Serge Hallyn <shallyn@cisco.com>
----
- configure.ac         | 2 ++
- libsubid/Makefile.am | 2 ++
- 2 files changed, 4 insertions(+)
-
-diff --git a/configure.ac b/configure.ac
-index 0f237cc..994836b 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -321,6 +321,8 @@ if test "$with_sha_crypt" = "yes"; then
- 	AC_DEFINE(USE_SHA_CRYPT, 1, Define to allow the SHA256 and SHA512 password encryption algorithms)
- fi
- 
-+AM_CONDITIONAL(ENABLE_SHARED, test "x$enable_shared" = "xyes")
-+
- AM_CONDITIONAL(USE_BCRYPT, test "x$with_bcrypt" = "xyes")
- if test "$with_bcrypt" = "yes"; then
- 	AC_DEFINE(USE_BCRYPT, 1, Define to allow the bcrypt password encryption algorithm)
-diff --git a/libsubid/Makefile.am b/libsubid/Makefile.am
-index 99308c1..8bba02a 100644
---- a/libsubid/Makefile.am
-+++ b/libsubid/Makefile.am
-@@ -1,6 +1,8 @@
- lib_LTLIBRARIES = libsubid.la
-+if ENABLE_SHARED
- libsubid_la_LDFLAGS = -Wl,-soname,libsubid.so.@LIBSUBID_ABI@ \
- 	-shared -version-info @LIBSUBID_ABI_MAJOR@
-+endif
- libsubid_la_SOURCES = api.c
- 
- pkginclude_HEADERS = subid.h
--- 
-1.8.3.1
-

_service:extract_file:Revert-useradd.c-fix-memleaks-of-grp.patch Deleted

_service:extract_file:backport-useradd-modify-check-ID-range-for-system-users.patch Deleted

@@ -1,42 +0,0 @@
-From f1f1678e13aa3ae49bdb139efaa2c5bc53dcfe92 Mon Sep 17 00:00:00 2001
-From: Iker Pedrosa <ipedrosa@redhat.com>
-Date: Tue, 4 Jan 2022 13:06:00 +0100
-Subject: PATCH useradd: modify check ID range for system users
-
-useradd warns that a system user ID less than SYS_UID_MIN is outside the
-expected range, even though that ID has been specifically selected with
-the "-u" option.
-
-In my opinion all the user ID's below SYS_UID_MAX are for the system,
-thus I change the condition to take that into account.
-
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2004911
-
-Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
-
-Conflict: context adaptation
----
- src/useradd.c | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-
-diff --git a/src/useradd.c b/src/useradd.c
-index 34376fa..4c71c38 100644
---- a/src/useradd.c
-+++ b/src/useradd.c
-@@ -2409,11 +2409,9 @@ static void check_uid_range(int rflg, uid_t user_id)
- 	uid_t uid_min ;
- 	uid_t uid_max ;
- 	if(rflg){
--		uid_min = (uid_t)getdef_ulong("SYS_UID_MIN",101UL);
- 		uid_max = (uid_t)getdef_ulong("SYS_UID_MAX",getdef_ulong("UID_MIN",1000UL)-1);
--		if(uid_min <= uid_max){
--			if(user_id < uid_min || user_id >uid_max)
--				fprintf(stderr, _("%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d range.\n"), Prog, user_name, user_id, uid_min, uid_max);
-+		if (user_id > uid_max) {
-+			fprintf(stderr, _("%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"), Prog, user_name, user_id, uid_max);
- 		}
- 	}else{
- 		uid_min = (uid_t)getdef_ulong("UID_MIN", 1000UL);
--- 
-1.8.3.1
-

_service:extract_file:groupdel-fix-SIGSEGV-when-passwd-does-not-exist.patch Deleted

_service:extract_file:libmisc-fix-default-value-in-SHA_get_salt_rounds.patch Deleted

@@ -1,60 +0,0 @@
-From 234e8fa7b134d1ebabfdad980a3ae5b63c046c62 Mon Sep 17 00:00:00 2001
-From: Mike Gilbert <floppym@gentoo.org>
-Date: Sat, 14 Aug 2021 13:24:34 -0400
-Subject: PATCH libmisc: fix default value in SHA_get_salt_rounds()
-
-If SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS are both unspecified,
-use SHA_ROUNDS_DEFAULT.
-
-Previously, the code fell through, calling shadow_random(-1, -1). This
-ultimately set rounds = (unsigned long) -1, which ends up being a very
-large number! This then got capped to SHA_ROUNDS_MAX later in the
-function.
-
-The new behavior matches BCRYPT_get_salt_rounds().
-
-Bug: https://bugs.gentoo.org/808195
-Fixes: https://github.com/shadow-maint/shadow/issues/393
----
- libmisc/salt.c | 21 +++++++++++----------
- 1 file changed, 11 insertions(+), 10 deletions(-)
-
-diff --git a/libmisc/salt.c b/libmisc/salt.c
-index 91d528f..30eefb9 100644
---- a/libmisc/salt.c
-+++ b/libmisc/salt.c
-@@ -223,20 +223,21 @@ static /*@observer@*/const unsigned long SHA_get_salt_rounds (/*@null@*/int *pre
- 		if ((-1 == min_rounds) && (-1 == max_rounds)) {
- 			rounds = SHA_ROUNDS_DEFAULT;
- 		}
-+		else {
-+			if (-1 == min_rounds) {
-+				min_rounds = max_rounds;
-+			}
- 
--		if (-1 == min_rounds) {
--			min_rounds = max_rounds;
--		}
-+			if (-1 == max_rounds) {
-+				max_rounds = min_rounds;
-+			}
- 
--		if (-1 == max_rounds) {
--			max_rounds = min_rounds;
--		}
-+			if (min_rounds > max_rounds) {
-+				max_rounds = min_rounds;
-+			}
- 
--		if (min_rounds > max_rounds) {
--			max_rounds = min_rounds;
-+			rounds = (unsigned long) shadow_random (min_rounds, max_rounds);
- 		}
--
--		rounds = (unsigned long) shadow_random (min_rounds, max_rounds);
- 	} else if (0 == *prefered_rounds) {
- 		rounds = SHA_ROUNDS_DEFAULT;
- 	} else {
--- 
-1.8.3.1
-

_service:extract_file:libsubid-link-to-PAM-libraries.patch Deleted

_service:extract_file:newgrp-fix-segmentation-fault.patch Deleted

@@ -1,35 +0,0 @@
-From 497e90751bc0d95cc998b0f06305040563903948 Mon Sep 17 00:00:00 2001
-From: Iker Pedrosa <ipedrosa@redhat.com>
-Date: Wed, 10 Nov 2021 12:02:04 +0100
-Subject: PATCH newgrp: fix segmentation fault
-
-Fix segmentation fault in newgrp when xgetspnam() returns a NULL value
-that is immediately freed.
-
-The error was committed in
-https://github.com/shadow-maint/shadow/commit/e65cc6aebcb4132fa413f00a905216a5b35b3d57
-
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2019553
-
-Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
----
- src/newgrp.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/newgrp.c b/src/newgrp.c
-index 730f47e..566f1c8 100644
---- a/src/newgrp.c
-+++ b/src/newgrp.c
-@@ -163,8 +163,8 @@ static void check_perms (const struct group *grp,
- 	spwd = xgetspnam (pwd->pw_name);
- 	if (NULL != spwd) {
- 		pwd->pw_passwd = xstrdup (spwd->sp_pwdp);
-+		spw_free (spwd);
- 	}
--	spw_free (spwd);
- 
- 	if ((pwd->pw_passwd0 == '\0') && (grp->gr_passwd0 != '\0')) {
- 		needspasswd = true;
--- 
-1.8.3.1
-

_service:extract_file:pwck-fix-segfault-when-calling-fprintf.patch Deleted

_service:extract_file:semanage-close-the-selabel-handle.patch Deleted

@@ -1,61 +0,0 @@
-From 234af5cf67fc1a3ba99fc246ba65869a3c416545 Mon Sep 17 00:00:00 2001
-From: Iker Pedrosa <ipedrosa@redhat.com>
-Date: Fri, 8 Oct 2021 13:13:13 +0200
-Subject: PATCH semanage: close the selabel handle
-
-Close the selabel handle to update the file_context. This means that the
-file_context will be remmaped and used by selabel_lookup() to return
-the appropriate context to label the home folder.
-
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1993081
-
-Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
----
- lib/prototypes.h | 1 +
- lib/selinux.c    | 5 +++++
- lib/semanage.c   | 1 +
- 3 files changed, 7 insertions(+)
-
-diff --git a/lib/prototypes.h b/lib/prototypes.h
-index 1d1586d..b697e0e 100644
---- a/lib/prototypes.h
-+++ b/lib/prototypes.h
-@@ -392,6 +392,7 @@ extern /*@observer@*/const char *crypt_make_salt (/*@null@*//*@observer@*/const
- /* selinux.c */
- #ifdef WITH_SELINUX
- extern int set_selinux_file_context (const char *dst_name, mode_t mode);
-+extern void reset_selinux_handle (void);
- extern int reset_selinux_file_context (void);
- extern int check_selinux_permit (const char *perm_name);
- #endif
-diff --git a/lib/selinux.c b/lib/selinux.c
-index c83545f..b075d4c 100644
---- a/lib/selinux.c
-+++ b/lib/selinux.c
-@@ -50,6 +50,11 @@ static void cleanup(void)
- 	}
- }
- 
-+void reset_selinux_handle (void)
-+{
-+    cleanup();
-+}
-+
- /*
-  * set_selinux_file_context - Set the security context before any file or
-  *                            directory creation.
-diff --git a/lib/semanage.c b/lib/semanage.c
-index 0d30456..a5bf921 100644
---- a/lib/semanage.c
-+++ b/lib/semanage.c
-@@ -293,6 +293,7 @@ int set_seuser (const char *login_name, const char *seuser_name)
- 	}
- 
- 	ret = 0;
-+	reset_selinux_handle();
- 
- done:
- 	semanage_seuser_key_free (key);
--- 
-1.8.3.1
-

_service:extract_file:shadow-4.1.5.1-var-lock.patch Deleted

@@ -1,47 +0,0 @@
-From 19efe574cd394a769672dac951e650c14a730e77 Mon Sep 17 00:00:00 2001
-From: hanzhijun <hanzhijun1@huawei.com>
-Date: Wed, 6 Mar 2019 10:15:19 +0800
-Subject: PATCH change VAR_DIR
-
-reason: change VAR_DIR
-
-Signed-off-by: hanzhijun <hanzhijun1@huawei.com>
----
- lib/commonio.c | 11 +++++++----
- 1 file changed, 7 insertion(+), 4 deletion(-)
-
-diff -Nur shadow-4.6.old/lib/commonio.c shadow-4.6/lib/commonio.c
---- shadow-4.6.old/lib/commonio.c	2019-03-05 06:42:27.620509161 -0500
-+++ shadow-4.6/lib/commonio.c	2019-03-05 06:48:05.048509161 -0500
-@@ -51,6 +51,8 @@
- #include "prototypes.h"
- #include "commonio.h"
- 
-+#define VAR_DIR "/var/run/"
-+
- /* local function prototypes */
- static int lrename (const char *, const char *);
- static int check_link_count (const char *file);
-@@ -399,9 +401,10 @@
- 	if(lock == NULL) {
- 		goto cleanup_ENOMEM;
- 	}
--	snprintf (file, file_len, "%s.%lu",
--	          db->filename, (unsigned long) getpid ());
--	snprintf (lock, lock_file_len, "%s.lock", db->filename);
-+	snprintf (file, file_len, "%s%s.%lu",
-+                 VAR_DIR, basename(db->filename), (unsigned long) getpid ());
-+       snprintf (lock, lock_file_len, "%s%s.lock", VAR_DIR, basename(db->filename));
-+
- 	if (do_lock_file (file, lock, log) != 0) {
- 		db->locked = true;
- 		lock_count++;
-@@ -517,7 +520,7 @@
- 		 * then call ulckpwdf() (if used) on last unlock.
- 		 */
- 		db->locked = false;
--		snprintf (lock, sizeof lock, "%s.lock", db->filename);
-+		snprintf (lock, sizeof lock, "%s%s.lock", VAR_DIR, basename(db->filename));
- 		unlink (lock);
- 		dec_lock_count ();
- 		return 1;

_service:extract_file:shadow-4.8-goodname.patch Deleted

@@ -1,100 +0,0 @@
-diff -up shadow-4.8/libmisc/chkname.c.goodname shadow-4.8/libmisc/chkname.c
---- shadow-4.8/libmisc/chkname.c.goodname	2020-01-13 09:44:41.968507996 +0100
-+++ shadow-4.8/libmisc/chkname.c	2020-01-13 09:46:27.863727732 +0100
-@@ -55,26 +55,44 @@ static bool is_valid_name (const char *n
- 	}
- 
- 	/*
--	 * User/group names must match a-z_a-z0-9_-*$
--	 */
-+         * User/group names must match gnu e-regex:
-+         *    a-zA-Z0-9_.a-zA-Z0-9_.-{0,30}a-zA-Z0-9_.$-?
-+         *
-+         * as a non-POSIX, extension, allow "$" as the last char for
-+         * sake of Samba 3.x "add machine script"
-+         *
-+         * Also do not allow fully numeric names or just "." or "..".
-+         */
-+	int numeric;
- 
--	if (('\0' == *name) ||
--	    !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
-+	if ('\0' == *name ||
-+	    ('.' == *name && (('.' == name1 && '\0' == name2) ||
-+			      '\0' == name1)) ||
-+	    !((*name >= 'a' && *name <= 'z') ||
-+	      (*name >= 'A' && *name <= 'Z') ||
-+	      (*name >= '0' && *name <= '9') ||
-+	      *name == '_' ||
-+	      *name == '.')) {
- 		return false;
- 	}
- 
-+	numeric = isdigit(*name);
-+
- 	while ('\0' != *++name) {
--		if (!(( ('a' <= *name) && ('z' >= *name) ) ||
--		      ( ('0' <= *name) && ('9' >= *name) ) ||
--		      ('_' == *name) ||
--		      ('-' == *name) ||
--		      ( ('$' == *name) && ('\0' == *(name + 1)) )
-+		if (!((*name >= 'a' && *name <= 'z') ||
-+		      (*name >= 'A' && *name <= 'Z') ||
-+		      (*name >= '0' && *name <= '9') ||
-+		      *name == '_' ||
-+		      *name == '.' ||
-+		      *name == '-' ||
-+		      (*name == '$' && name1 == '\0')
- 		     )) {
- 			return false;
- 		}
-+		numeric &= isdigit(*name);
- 	}
- 
--	return true;
-+	return !numeric;
- }
- 
- bool is_valid_user_name (const char *name)
-diff -up shadow-4.8/man/groupadd.8.xml.goodname shadow-4.8/man/groupadd.8.xml
---- shadow-4.8/man/groupadd.8.xml.goodname	2019-07-23 17:26:08.000000000 +0200
-+++ shadow-4.8/man/groupadd.8.xml	2020-01-13 09:44:41.968507996 +0100
-@@ -273,10 +273,12 @@
-    <refsect1 id='caveats'>
-      <title>CAVEATS</title>
-      <para>
--       Groupnames must start with a lower case letter or an underscore,
--       followed by lower case letters, digits, underscores, or dashes.
--       They can end with a dollar sign.
--       In regular expression terms: a-z_a-z0-9_-*$?
-+       Groupnames may contain only lower and upper case letters, digits,
-+       underscores, or dashes. They can end with a dollar sign.
-+
-+       Dashes are not allowed at the beginning of the groupname.
-+       Fully numeric groupnames and groupnames . or .. are
-+       also disallowed.
-      </para>
-      <para>
-        Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
-diff -up shadow-4.8/man/useradd.8.xml.goodname shadow-4.8/man/useradd.8.xml
---- shadow-4.8/man/useradd.8.xml.goodname	2019-10-05 03:23:58.000000000 +0200
-+++ shadow-4.8/man/useradd.8.xml	2020-01-13 09:44:41.968507996 +0100
-@@ -661,10 +661,14 @@
-     </para>
- 
-     <para>
--      Usernames must start with a lower case letter or an underscore,
--      followed by lower case letters, digits, underscores, or dashes.
--      They can end with a dollar sign.
--      In regular expression terms: a-z_a-z0-9_-*$?
-+      Usernames may contain only lower and upper case letters, digits,
-+      underscores, or dashes. They can end with a dollar sign.
-+
-+      Dashes are not allowed at the beginning of the username.
-+      Fully numeric usernames and usernames . or .. are
-+      also disallowed. It is not recommended to use usernames beginning
-+      with . character as their home directories will be hidden in
-+      the <command>ls</command> output.
-     </para>
-     <para>
-       Usernames may only be up to 32 characters long.

_service:extract_file:shadow-4.8-long-entry.patch Deleted

@@ -1,86 +0,0 @@
-diff -up shadow-4.8/lib/defines.h.long-entry shadow-4.8/lib/defines.h
---- shadow-4.8/lib/defines.h.long-entry	2020-01-13 10:29:45.288957339 +0100
-+++ shadow-4.8/lib/defines.h	2020-01-13 10:30:47.482902954 +0100
-@@ -388,6 +388,9 @@ extern char *strerror ();
- # endif
- #endif
- 
-+/* Maximum length of passwd entry */
-+#define PASSWD_ENTRY_MAX_LENGTH 32768
-+
- #ifdef HAVE_SECURE_GETENV
- #  define shadow_getenv(name) secure_getenv(name)
- # else
-diff -up shadow-4.8/lib/pwio.c.long-entry shadow-4.8/lib/pwio.c
---- shadow-4.8/lib/pwio.c.long-entry	2019-07-23 17:26:08.000000000 +0200
-+++ shadow-4.8/lib/pwio.c	2020-01-13 10:29:45.288957339 +0100
-@@ -79,7 +79,10 @@ static int passwd_put (const void *ent,
- 	    || (pw->pw_gid == (gid_t)-1)
- 	    || (valid_field (pw->pw_gecos, ":\n") == -1)
- 	    || (valid_field (pw->pw_dir, ":\n") == -1)
--	    || (valid_field (pw->pw_shell, ":\n") == -1)) {
-+	    || (valid_field (pw->pw_shell, ":\n") == -1)
-+	    || (strlen (pw->pw_name) + strlen (pw->pw_passwd) +
-+	        strlen (pw->pw_gecos) + strlen (pw->pw_dir) +
-+	        strlen (pw->pw_shell) + 100 > PASSWD_ENTRY_MAX_LENGTH)) {
- 		return -1;
- 	}
- 
-diff -up shadow-4.8/lib/sgetpwent.c.long-entry shadow-4.8/lib/sgetpwent.c
---- shadow-4.8/lib/sgetpwent.c.long-entry	2019-10-05 03:23:58.000000000 +0200
-+++ shadow-4.8/lib/sgetpwent.c	2020-01-13 10:29:45.288957339 +0100
-@@ -57,7 +57,7 @@
- struct passwd *sgetpwent (const char *buf)
- {
- 	static struct passwd pwent;
--	static char pwdbuf1024;
-+	static char pwdbufPASSWD_ENTRY_MAX_LENGTH;
- 	register int i;
- 	register char *cp;
- 	char *fieldsNFIELDS;
-@@ -67,8 +67,10 @@ struct passwd *sgetpwent (const char *bu
- 	 * the password structure remain valid.
- 	 */
- 
--	if (strlen (buf) >= sizeof pwdbuf)
-+	if (strlen (buf) >= sizeof pwdbuf) {
-+		fprintf (stderr, "Too long passwd entry encountered, file corruption?\n");
- 		return 0;	/* fail if too long */
-+	}
- 	strcpy (pwdbuf, buf);
- 
- 	/*
-diff -up shadow-4.8/lib/sgetspent.c.long-entry shadow-4.8/lib/sgetspent.c
---- shadow-4.8/lib/sgetspent.c.long-entry	2019-07-23 17:26:08.000000000 +0200
-+++ shadow-4.8/lib/sgetspent.c	2020-01-13 10:29:45.289957322 +0100
-@@ -48,7 +48,7 @@
-  */
- struct spwd *sgetspent (const char *string)
- {
--	static char spwbuf1024;
-+	static char spwbufPASSWD_ENTRY_MAX_LENGTH;
- 	static struct spwd spwd;
- 	char *fieldsFIELDS;
- 	char *cp;
-@@ -61,6 +61,7 @@ struct spwd *sgetspent (const char *stri
- 	 */
- 
- 	if (strlen (string) >= sizeof spwbuf) {
-+		fprintf (stderr, "Too long shadow entry encountered, file corruption?\n");
- 		return 0;	/* fail if too long */
- 	}
- 	strcpy (spwbuf, string);
-diff -up shadow-4.8/lib/shadowio.c.long-entry shadow-4.8/lib/shadowio.c
---- shadow-4.8/lib/shadowio.c.long-entry	2019-07-23 17:26:08.000000000 +0200
-+++ shadow-4.8/lib/shadowio.c	2020-01-13 10:29:45.289957322 +0100
-@@ -79,7 +79,9 @@ static int shadow_put (const void *ent,
- 
- 	if (   (NULL == sp)
- 	    || (valid_field (sp->sp_namp, ":\n") == -1)
--	    || (valid_field (sp->sp_pwdp, ":\n") == -1)) {
-+	    || (valid_field (sp->sp_pwdp, ":\n") == -1)
-+	    || (strlen (sp->sp_namp) + strlen (sp->sp_pwdp) +
-+	        1000 > PASSWD_ENTRY_MAX_LENGTH)) {
- 		return -1;
- 	}
-

_service:extract_file:shadow-4.9-null-tm.patch Deleted

@@ -1,70 +0,0 @@
-Index: shadow-4.5/src/chage.c
-===================================================================
---- shadow-4.5.orig/src/chage.c
-+++ shadow-4.5/src/chage.c
-@@ -168,6 +168,10 @@ static void date_to_str (char *buf, size
- 	struct tm *tp;
- 
- 	tp = gmtime (&date);
-+	if (tp == NULL) {
-+		(void) snprintf (buf, maxsize, "(unknown)");
-+		return;
-+	}
- #ifdef HAVE_STRFTIME
- 	(void) strftime (buf, maxsize, "%Y-%m-%d", tp);
- #else
-Index: shadow-4.5/src/lastlog.c
-===================================================================
---- shadow-4.5.orig/src/lastlog.c
-+++ shadow-4.5/src/lastlog.c
-@@ -158,13 +158,17 @@ static void print_one (/*@null@*/const s
- 
- 	ll_time = ll.ll_time;
- 	tm = localtime (&ll_time);
-+	if (tm == NULL) {
-+		cp = "(unknown)";
-+	} else {
- #ifdef HAVE_STRFTIME
--	strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
--	cp = ptime;
-+		strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
-+		cp = ptime;
- #else
--	cp = asctime (tm);
--	cp24 = '\0';
-+		cp = asctime (tm);
-+		cp24 = '\0';
- #endif
-+	}
- 
- 	if (ll.ll_time == (time_t) 0) {
- 		cp = _("**Never logged in**\0");
-Index: shadow-4.5/src/passwd.c
-===================================================================
---- shadow-4.5.orig/src/passwd.c
-+++ shadow-4.5/src/passwd.c
-@@ -455,6 +455,9 @@ static /*@observer@*/const char *date_to
- 	struct tm *tm;
- 
- 	tm = gmtime (&t);
-+	if (tm == NULL) {
-+		return "(unknown)";
-+	}
- #ifdef HAVE_STRFTIME
- 	(void) strftime (buf, sizeof buf, "%m/%d/%Y", tm);
- #else				/* !HAVE_STRFTIME */
-Index: shadow-4.5/src/usermod.c
-===================================================================
---- shadow-4.5.orig/src/usermod.c
-+++ shadow-4.5/src/usermod.c
-@@ -210,6 +210,10 @@ static void date_to_str (/*@unique@*//*@
- 	} else {
- 		time_t t = (time_t) date;
- 		tp = gmtime (&t);
-+		if (tp == NULL) {
-+			strncpy (buf, "unknown", maxsize);
-+			return;
-+		}
- #ifdef HAVE_STRFTIME
- 		strftime (buf, maxsize, "%Y-%m-%d", tp);
- #else

_service:extract_file:shadow-utils-fix-lock-file-residue.patch Deleted

@@ -1,31 +0,0 @@
-From f0c78e7ba1e2721398ff811b709cc1d46ae31386 Mon Sep 17 00:00:00 2001
-From: lubing <lubing@localhost.localdomain>
-Date: Fri, 3 May 2019 16:46:45 +0800
-Subject: PATCH shadow-utils: fix lock file residue
-
-reason: fix lock file residue
-
-Signed-off-by: lubing <lubing@localhost.localdomain>
----
- lib/commonio.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/lib/commonio.c b/lib/commonio.c
-index 2c223e4..a110ca9 100644
---- a/lib/commonio.c
-+++ b/lib/commonio.c
-@@ -389,8 +389,9 @@ int commonio_lock_nowait (struct commonio_db *db, bool log)
- 	if (db->locked) {
- 		return 1;
- 	}
--	file_len = strlen(db->filename) + 11;/* %lu max size */
--	lock_file_len = strlen(db->filename) + 6; /* sizeof ".lock" */
-+	/* files moved from /etc/ to /var/run/, change malloc size */
-+	file_len = strlen(db->filename) + 15;/* %lu max size */
-+	lock_file_len = strlen(db->filename) + 15; /* sizeof ".lock" */
- 	file = (char*)malloc(file_len);
- 	if(file == NULL) {
- 		goto cleanup_ENOMEM;
--- 
-1.8.3.1
-

_service:extract_file:useradd-avoid-generating-an-empty-subid-range.patch Deleted

@@ -1,107 +0,0 @@
-From 9dd720a28578eef5be8171697aae0906e4c53249 Mon Sep 17 00:00:00 2001
-From: Iker Pedrosa <ipedrosa@redhat.com>
-Date: Tue, 10 Aug 2021 09:07:03 +0200
-Subject: PATCH useradd: avoid generating an empty subid range
-
-useradd generates an empty subid range when adding a new user. This is
-caused because there are two variables, one local and the other one
-global, that have a very similar name and they are used indistinctly in
-the code. The local variable loads the SUB_*ID_COUNT configuration from
-the login.defs file, while the global variable, which holds a value of
-0, is used to generate the subid range. Causing the empty subid range
-problem.
-
-I've merged the two variables in the local one and removed the global
-variable. I prefer to do it this way to reduce the scope of it but I'm
-open to doing it the other way round.
-
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1990653
-
-Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
-Conflict: context adaptation
----
- src/useradd.c | 20 +++++++++-----------
- 1 file changed, 9 insertions(+), 11 deletions(-)
-
-diff --git a/src/useradd.c b/src/useradd.c
-index baeffb3..9abeea6 100644
---- a/src/useradd.c
-+++ b/src/useradd.c
-@@ -142,9 +142,7 @@ static bool is_sub_gid = false;
- static bool sub_uid_locked = false;
- static bool sub_gid_locked = false;
- static uid_t sub_uid_start;	/* New subordinate uid range */
--static unsigned long sub_uid_count;
- static gid_t sub_gid_start;	/* New subordinate gid range */
--static unsigned long sub_gid_count;
- #endif				/* ENABLE_SUBIDS */
- static bool pw_locked = false;
- static bool gr_locked = false;
-@@ -234,7 +232,7 @@ static void open_shadow (void);
- static void faillog_reset (uid_t);
- static void lastlog_reset (uid_t);
- static void tallylog_reset (const char *);
--static void usr_update (void);
-+static void usr_update (unsigned long subuid_count, unsigned long subgid_count);
- static void create_home (void);
- static void create_mail (void);
- static void check_uid_range(int rflg, uid_t user_id);
-@@ -2092,7 +2090,7 @@ static void tallylog_reset (const char *user_name)
-  *	usr_update() creates the password file entries for this user
-  *	and will update the group entries if required.
-  */
--static void usr_update (void)
-+static void usr_update (unsigned long subuid_count, unsigned long subgid_count)
- {
- 	struct passwd pwent;
- 	struct spwd spent;
-@@ -2155,14 +2153,14 @@ static void usr_update (void)
- 	}
- #ifdef ENABLE_SUBIDS
- 	if (is_sub_uid &&
--	    (sub_uid_add(user_name, sub_uid_start, sub_uid_count) == 0)) {
-+	    (sub_uid_add(user_name, sub_uid_start, subuid_count) == 0)) {
- 		fprintf (stderr,
- 		         _("%s: failed to prepare the new %s entry\n"),
- 		         Prog, sub_uid_dbname ());
- 		fail_exit (E_SUB_UID_UPDATE);
- 	}
- 	if (is_sub_gid &&
--	    (sub_gid_add(user_name, sub_gid_start, sub_gid_count) == 0)) {
-+	    (sub_gid_add(user_name, sub_gid_start, subgid_count) == 0)) {
- 		fprintf (stderr,
- 		         _("%s: failed to prepare the new %s entry\n"),
- 		         Prog, sub_uid_dbname ());
-@@ -2624,16 +2622,16 @@ int main (int argc, char **argv)
- 	}
- 
- #ifdef ENABLE_SUBIDS
--	if (is_sub_uid && sub_uid_count != 0) {
--		if (find_new_sub_uids(&sub_uid_start, &sub_uid_count) < 0) {
-+	if (is_sub_uid && subuid_count != 0) {
-+		if (find_new_sub_uids(&sub_uid_start, &subuid_count) < 0) {
- 			fprintf (stderr,
- 			         _("%s: can't create subordinate user IDs\n"),
- 			         Prog);
- 			fail_exit(E_SUB_UID_UPDATE);
- 		}
- 	}
--	if (is_sub_gid && sub_gid_count != 0) {
--		if (find_new_sub_gids(&sub_gid_start, &sub_gid_count) < 0) {
-+	if (is_sub_gid && subgid_count != 0) {
-+		if (find_new_sub_gids(&sub_gid_start, &subgid_count) < 0) {
- 			fprintf (stderr,
- 			         _("%s: can't create subordinate group IDs\n"),
- 			         Prog);
-@@ -2642,7 +2640,7 @@ int main (int argc, char **argv)
- 	}
- #endif				/* ENABLE_SUBIDS */
- 
--	usr_update ();
-+	usr_update (subuid_count, subgid_count);
- 
- 	close_files ();
-
--- 
-1.8.3.1
-

_service:extract_file:useradd-change-SELinux-labels-for-home-files.patch Deleted

@@ -1,34 +0,0 @@
-From 06eb4e4d76ac7f1ac86e68a89b2dc9be7c7323a2 Mon Sep 17 00:00:00 2001
-From: Iker Pedrosa <ipedrosa@redhat.com>
-Date: Fri, 12 Nov 2021 15:23:30 +0100
-Subject: PATCH useradd: change SELinux labels for home files
-
-Change SELinux labels for files copied from the skeleton directory to
-the home directory.
-
-This could cause gnome's graphical user adding to fail without copying
-the full skeleton files.
-
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2022658
-
-Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
----
- src/useradd.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/useradd.c b/src/useradd.c
-index b463a17..f7c9795 100644
---- a/src/useradd.c
-+++ b/src/useradd.c
-@@ -2704,7 +2704,7 @@ int main (int argc, char **argv)
- 	if (mflg) {
- 		create_home ();
- 		if (home_added) {
--			copy_tree (def_template, prefix_user_home, false, false,
-+			copy_tree (def_template, prefix_user_home, false, true,
- 			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
- 		} else {
- 			fprintf (stderr,
--- 
-1.8.3.1
-

_service:extract_file:useradd-create-directories-after-the-SELinux-user.patch Deleted

@@ -1,89 +0,0 @@
-From 09c752f00f9dfc610f66d68be38c9e5be8ca7f15 Mon Sep 17 00:00:00 2001
-From: Iker Pedrosa <ipedrosa@redhat.com>
-Date: Fri, 8 Oct 2021 13:09:59 +0200
-Subject: PATCH useradd: create directories after the SELinux user
-
-Create the home and mail folders after the SELinux user has been set for
-the added user. This will allow the folders to be created with the
-SELinux user label.
-
-Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
-Conflict: context adaptation
----
- src/useradd.c | 46 +++++++++++++++++++++++-----------------------
- 1 file changed, 23 insertions(+), 23 deletions(-)
-
-diff --git a/src/useradd.c b/src/useradd.c
-index 6269c01..b463a17 100644
---- a/src/useradd.c
-+++ b/src/useradd.c
-@@ -2670,27 +2670,12 @@ int main (int argc, char **argv)
- 
- 	usr_update ();
- 
--	if (mflg) {
--		create_home ();
--		if (home_added) {
--			copy_tree (def_template, prefix_user_home, false, false,
--			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
--		} else {
--			fprintf (stderr,
--			         _("%s: warning: the home directory %s already exists.\n"
--			           "%s: Not copying any file from skel directory into it.\n"),
--			         Prog, user_home, Prog);
--		}
--
--	}
--
--	/* Do not create mail directory for system accounts */
--	if (!rflg) {
--		create_mail ();
--	}
--
- 	close_files ();
- 
-+	nscd_flush_cache ("passwd");
-+	nscd_flush_cache ("group");
-+	sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
-+
- 	/*
- 	 * tallylog_reset needs to be able to lookup
- 	 * a valid existing user name,
-@@ -2716,15 +2701,30 @@ int main (int argc, char **argv)
- 	}
- #endif				/* WITH_SELINUX */
- 
-+	if (mflg) {
-+		create_home ();
-+		if (home_added) {
-+			copy_tree (def_template, prefix_user_home, false, false,
-+			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
-+		} else {
-+			fprintf (stderr,
-+			         _("%s: warning: the home directory %s already exists.\n"
-+			           "%s: Not copying any file from skel directory into it.\n"),
-+			         Prog, user_home, Prog);
-+		}
-+
-+	}
-+
-+	/* Do not create mail directory for system accounts */
-+	if (!rflg) {
-+		create_mail ();
-+	}
-+
- 	if (run_parts ("/etc/shadow-maint/useradd-post.d", (char*)user_name,
- 			"useradd")) {
- 		exit(1);
- 	}
- 
--	nscd_flush_cache ("passwd");
--	nscd_flush_cache ("group");
--	sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
--
- 	return E_SUCCESS;
- }
- 
--- 
-1.8.3.1
-

_service:extract_file:usermod-allow-all-group-types-with-G-option.patch Deleted

@@ -1,322 +0,0 @@
-From e481437ab9ebe9a8bf8fbaabe986d42b2f765991 Mon Sep 17 00:00:00 2001
-From: Iker Pedrosa <ipedrosa@redhat.com>
-Date: Tue, 3 Aug 2021 08:57:20 +0200
-Subject: PATCH usermod: allow all group types with -G option
-
-The only way of removing a group from the supplementary list is to use
--G option, and list all groups that the user is a member of except for
-the one that wants to be removed. The problem lies when there's a user
-that contains both local and remote groups, and the group to be removed
-is a local one. As we need to include the remote group with -G option
-the command will fail.
-
-This reverts commit 140510de9de4771feb3af1d859c09604043a4c9b. This way,
-it would be possible to remove the remote groups from the supplementary
-list.
-
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1967641
-Resolves: https://github.com/shadow-maint/shadow/issues/338
-
-Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
----
- src/usermod.c | 220 ++++++++++++++++++++--------------------------------------
- 1 file changed, 77 insertions(+), 143 deletions(-)
-
-diff --git a/src/usermod.c b/src/usermod.c
-index 03bb9b9..a0c03af 100644
---- a/src/usermod.c
-+++ b/src/usermod.c
-@@ -187,7 +187,6 @@ static bool sub_gid_locked = false;
- static void date_to_str (/*@unique@*//*@out@*/char *buf, size_t maxsize,
-                          long int date);
- static int get_groups (char *);
--static struct group * get_local_group (char * grp_name);
- static /*@noreturn@*/void usage (int status);
- static void new_pwent (struct passwd *);
- static void new_spent (struct spwd *);
-@@ -201,9 +200,7 @@ static void grp_update (void);
- 
- static void process_flags (int, char **);
- static void close_files (void);
--static void close_group_files (void);
- static void open_files (void);
--static void open_group_files (void);
- static void usr_update (void);
- static void move_home (void);
- static void update_lastlog (void);
-@@ -261,11 +258,6 @@ static int get_groups (char *list)
- 	}
- 
- 	/*
--	 * Open the group files
--	 */
--	open_group_files ();
--
--	/*
- 	 * So long as there is some data to be converted, strip off each
- 	 * name and look it up. A mix of numerical and string values for
- 	 * group identifiers is permitted.
-@@ -284,7 +276,7 @@ static int get_groups (char *list)
- 		 * Names starting with digits are treated as numerical GID
- 		 * values, otherwise the string is looked up as is.
- 		 */
--		grp = get_local_group (list);
-+		grp = prefix_getgr_nam_gid (list);
- 
- 		/*
- 		 * There must be a match, either by GID value or by
-@@ -334,8 +326,6 @@ static int get_groups (char *list)
- 		gr_free ((struct group *)grp);
- 	} while (NULL != list);
- 
--	close_group_files ();
--
- 	user_groupsngroups = (char *) 0;
- 
- 	/*
-@@ -348,44 +338,6 @@ static int get_groups (char *list)
- 	return 0;
- }
- 
--/*
-- * get_local_group - checks if a given group name exists locally
-- *
-- *	get_local_group() checks if a given group name exists locally.
-- *	If the name exists the group information is returned, otherwise NULL is
-- *	returned.
-- */
--static struct group * get_local_group(char * grp_name)
--{
--	const struct group *grp;
--	struct group *result_grp = NULL;
--	long long int gid;
--	char *endptr;
--
--	gid = strtoll (grp_name, &endptr, 10);
--	if (   ('\0' != *grp_name)
--		&& ('\0' == *endptr)
--		&& (ERANGE != errno)
--		&& (gid == (gid_t)gid)) {
--		grp = gr_locate_gid ((gid_t) gid);
--	}
--	else {
--		grp = gr_locate(grp_name);
--	}
--
--	if (grp != NULL) {
--		result_grp = __gr_dup (grp);
--		if (NULL == result_grp) {
--			fprintf (stderr,
--					_("%s: Out of memory. Cannot find group '%s'.\n"),
--					Prog, grp_name);
--			fail_exit (E_GRP_UPDATE);
--		}
--	}
--
--	return result_grp;
--}
--
- #ifdef ENABLE_SUBIDS
- struct ulong_range
- {
-@@ -1523,7 +1475,50 @@ static void close_files (void)
- 	}
- 
- 	if (Gflg || lflg) {
--		close_group_files ();
-+		if (gr_close () == 0) {
-+			fprintf (stderr,
-+			         _("%s: failure while writing changes to %s\n"),
-+			         Prog, gr_dbname ());
-+			SYSLOG ((LOG_ERR,
-+			         "failure while writing changes to %s",
-+			         gr_dbname ()));
-+			fail_exit (E_GRP_UPDATE);
-+		}
-+#ifdef SHADOWGRP
-+		if (is_shadow_grp) {
-+			if (sgr_close () == 0) {
-+				fprintf (stderr,
-+				         _("%s: failure while writing changes to %s\n"),
-+				         Prog, sgr_dbname ());
-+				SYSLOG ((LOG_ERR,
-+				         "failure while writing changes to %s",
-+				         sgr_dbname ()));
-+				fail_exit (E_GRP_UPDATE);
-+			}
-+		}
-+#endif
-+#ifdef SHADOWGRP
-+		if (is_shadow_grp) {
-+			if (sgr_unlock () == 0) {
-+				fprintf (stderr,
-+				         _("%s: failed to unlock %s\n"),
-+				         Prog, sgr_dbname ());
-+				SYSLOG ((LOG_ERR,
-+				         "failed to unlock %s",
-+				         sgr_dbname ()));
-+				/* continue */
-+			}
-+		}
-+#endif
-+		if (gr_unlock () == 0) {
-+			fprintf (stderr,
-+			         _("%s: failed to unlock %s\n"),
-+			         Prog, gr_dbname ());
-+			SYSLOG ((LOG_ERR,
-+			         "failed to unlock %s",
-+			         gr_dbname ()));
-+			/* continue */
-+		}
- 	}
- 
- 	if (is_shadow_pwd) {
-@@ -1593,60 +1588,6 @@ static void close_files (void)
- }
- 
- /*
-- * close_group_files - close all of the files that were opened
-- *
-- *	close_group_files() closes all of the files that were opened related
-- *  with groups. This causes any modified entries to be written out.
-- */
--static void close_group_files (void)
--{
--	if (gr_close () == 0) {
--		fprintf (stderr,
--					_("%s: failure while writing changes to %s\n"),
--					Prog, gr_dbname ());
--		SYSLOG ((LOG_ERR,
--					"failure while writing changes to %s",
--					gr_dbname ()));
--		fail_exit (E_GRP_UPDATE);
--	}
--#ifdef SHADOWGRP
--	if (is_shadow_grp) {
--		if (sgr_close () == 0) {
--			fprintf (stderr,
--						_("%s: failure while writing changes to %s\n"),
--						Prog, sgr_dbname ());

_service:extract_file:usermod-unlock.patch Deleted

@@ -1,65 +0,0 @@
-Index: shadow-4.5/src/usermod.c
-===================================================================
---- a/src/usermod.c
-+++ b/src/usermod.c
-@@ -466,14 +466,17 @@ static char *new_pw_passwd (char *pw_pass)
- 		strcat (buf, pw_pass);
- 		pw_pass = buf;
- 	} else if (Uflg && pw_pass0 == '!') {
--		char *s;
-+		char *s = pw_pass;
- 
--		if (pw_pass1 == '\0') {
-+		while ('!' == *s)
-+			++s;
-+
-+		if (*s == '\0') {
- 			fprintf (stderr,
- 			         _("%s: unlocking the user's password would result in a passwordless account.\n"
- 			           "You should set a password with usermod -p to unlock this user's password.\n"),
- 			         Prog);
--			return pw_pass;
-+			return NULL;
- 		}
- 
- #ifdef WITH_AUDIT
-@@ -482,12 +485,15 @@ static char *new_pw_passwd (char *pw_pass)
- 		              user_newname, (unsigned int) user_newid, 0);
- #endif
- 		SYSLOG ((LOG_INFO, "unlock user '%s' password", user_newname));
--		s = pw_pass;
--		while ('\0' != *s) {
--			*s = *(s + 1);
--			s++;
--		}
-+		memmove (pw_pass, s, strlen (s) + 1);
- 	} else if (pflg) {
-+		if (strchr (user_pass, ':') != NULL) {
-+			fprintf (stderr,
-+			         _("%s: The password field cannot contain a colon character.\n"),
-+			         Prog);
-+			return NULL;
-+
-+		}
- #ifdef WITH_AUDIT
- 		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
- 		              "changing password",
-@@ -536,6 +542,8 @@ static void new_pwent (struct passwd *pwent)
- 	if (   (!is_shadow_pwd)
- 	    || (strcmp (pwent->pw_passwd, SHADOW_PASSWD_STRING) != 0)) {
- 		pwent->pw_passwd = new_pw_passwd (pwent->pw_passwd);
-+		if (pwent->pw_passwd == NULL)
-+			fail_exit (E_PW_UPDATE);
- 	}
- 
- 	if (uflg) {
-@@ -650,6 +658,8 @@ static void new_spent (struct spwd *spent)
- 	 *  + aging has been requested
- 	 */
- 	spent->sp_pwdp = new_pw_passwd (spent->sp_pwdp);
-+	if (spent->sp_pwdp == NULL)
-+		fail_exit(E_PW_UPDATE);
- 
- 	if (pflg) {
- 		spent->sp_lstchg = (long) gettime () / SCALE;
-

_service:tar_scm:Fix-out-of-tree-builds-with-respect-to-libsubid-incl.patch Added

@@ -0,0 +1,112 @@
+From 537b8cd90be7b47b45c45cfd27765ef85eb0ebf1 Mon Sep 17 00:00:00 2001
+From: Serge Hallyn <serge@hallyn.com>
+Date: Fri, 23 Jul 2021 17:51:13 -0500
+Subject: PATCH Fix out of tree builds with respect to libsubid includes
+
+There's a better way to do this, and I hope to clean that up,
+but this fixes out of tree builds for me right now.
+
+Closes #386
+
+Signed-off-by: Serge Hallyn <serge@hallyn.com>
+---
+ lib/Makefile.am      | 2 ++
+ libmisc/Makefile.am  | 2 +-
+ libsubid/Makefile.am | 4 ++--
+ src/Makefile.am      | 6 ++++++
+ 4 files changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/lib/Makefile.am b/lib/Makefile.am
+index ecf3ee2..5ac2e11 100644
+--- a/lib/Makefile.am
++++ b/lib/Makefile.am
+@@ -10,6 +10,8 @@ if HAVE_VENDORDIR
+ libshadow_la_CPPFLAGS += -DVENDORDIR=\"$(VENDORDIR)\"
+ endif
+ 
++libshadow_la_CPPFLAGS += -I$(top_srcdir)
++
+ libshadow_la_SOURCES = \
+ 	commonio.c \
+ 	commonio.h \
+diff --git a/libmisc/Makefile.am b/libmisc/Makefile.am
+index 9766a7e..9f237e0 100644
+--- a/libmisc/Makefile.am
++++ b/libmisc/Makefile.am
+@@ -1,7 +1,7 @@
+ 
+ EXTRA_DIST = .indent.pro xgetXXbyYY.c
+ 
+-AM_CPPFLAGS = -I$(top_srcdir)/lib $(ECONF_CPPFLAGS)
++AM_CPPFLAGS = -I$(top_srcdir)/lib -I$(top_srcdir) $(ECONF_CPPFLAGS)
+ 
+ noinst_LTLIBRARIES = libmisc.la
+ 
+diff --git a/libsubid/Makefile.am b/libsubid/Makefile.am
+index 8305156..99308c1 100644
+--- a/libsubid/Makefile.am
++++ b/libsubid/Makefile.am
+@@ -20,8 +20,8 @@ MISCLIBS = \
+ 	$(LIBPAM)
+ 
+ libsubid_la_LIBADD = \
+-	$(top_srcdir)/lib/libshadow.la \
+-	$(top_srcdir)/libmisc/libmisc.la \
++	$(top_builddir)/lib/libshadow.la \
++	$(top_builddir)/libmisc/libmisc.la \
+ 	$(MISCLIBS) -ldl
+ 
+ AM_CPPFLAGS = \
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 3502701..7c1a349 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -10,6 +10,7 @@ sgidperms = 2755
+ AM_CPPFLAGS = \
+ 	-I${top_srcdir}/lib \
+ 	-I$(top_srcdir)/libmisc \
++	-I$(top_srcdir) \
+ 	-DLOCALEDIR=\"$(datadir)/locale\"
+ 
+ # XXX why are login and su in /bin anyway (other than for
+@@ -183,6 +184,7 @@ list_subid_ranges_LDADD = \
+ list_subid_ranges_CPPFLAGS = \
+ 	-I$(top_srcdir)/lib \
+ 	-I$(top_srcdir)/libmisc \
++	-I$(top_srcdir) \
+ 	-I$(top_srcdir)/libsubid
+ 
+ get_subid_owners_LDADD = \
+@@ -194,11 +196,13 @@ get_subid_owners_LDADD = \
+ get_subid_owners_CPPFLAGS = \
+ 	-I$(top_srcdir)/lib \
+ 	-I$(top_srcdir)/libmisc \
++	-I$(top_srcdir) \
+ 	-I$(top_srcdir)/libsubid
+ 
+ new_subid_range_CPPFLAGS = \
+ 	-I$(top_srcdir)/lib \
+ 	-I$(top_srcdir)/libmisc \
++	-I$(top_srcdir) \
+ 	-I$(top_srcdir)/libsubid
+ 
+ new_subid_range_LDADD = \
+@@ -210,6 +214,7 @@ new_subid_range_LDADD = \
+ free_subid_range_CPPFLAGS = \
+ 	-I$(top_srcdir)/lib \
+ 	-I$(top_srcdir)/libmisc \
++	-I$(top_srcdir) \
+ 	-I$(top_srcdir)/libsubid
+ 
+ free_subid_range_LDADD = \
+@@ -220,6 +225,7 @@ free_subid_range_LDADD = \
+ 
+ check_subid_range_CPPFLAGS = \
+ 	-I$(top_srcdir)/lib \
++	-I$(top_srcdir) \
+ 	-I$(top_srcdir)/libmisc
+ 
+ check_subid_range_LDADD = \
+-- 
+1.8.3.1
+

_service:tar_scm:Fixes-the-linking-issues-when-libsubid-is-static-and.patch Added

_service:tar_scm:Makefile-include-libeconf-dependency-in-new-idmap.patch Added

@@ -0,0 +1,32 @@
+From c6847011e8b656adacd9a0d2a78418cad0de34cb Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Mon, 2 Aug 2021 15:54:20 +0200
+Subject: PATCH Makefile: include libeconf dependency in new*idmap
+
+new*idmap has a dependency with libeconf since commit
+c464ec55709dc931ba2f24073b8b1a86d5209ab0. I'm just adding it to the
+Makefile to be able to compile in distributions that include libeconf.
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+---
+ src/Makefile.am | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 7c1a349..6cc873b 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -96,8 +96,8 @@ LIBCRYPT_NOPAM = $(LIBCRYPT)
+ endif
+ 
+ chage_LDADD    = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBECONF)
+-newuidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) -ldl
+-newgidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) -ldl
++newuidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) $(LIBECONF) -ldl
++newgidmap_LDADD    = $(LDADD) $(LIBAUDIT) $(LIBSELINUX) $(LIBCAP) $(LIBECONF) -ldl
+ chfn_LDADD     = $(LDADD) $(LIBPAM) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD) $(LIBECONF)
+ chgpasswd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT) $(LIBECONF)
+ chsh_LDADD     = $(LDADD) $(LIBPAM) $(LIBAUDIT) $(LIBSELINUX) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD) $(LIBECONF)
+-- 
+1.8.3.1
+

_service:tar_scm:Respect-enable-static-no-in-libsubid.patch Added

@@ -0,0 +1,45 @@
+From fa986b1d73605ecca54a4f19249227aeab827bf6 Mon Sep 17 00:00:00 2001
+From: Serge Hallyn <shallyn@cisco.com>
+Date: Sun, 25 Jul 2021 17:18:02 +0000
+Subject: PATCH Respect --enable-static=no in libsubid
+
+libsubid's Makefile.am was always setting enable-shared in its LDFLAGS.
+Do that only if not building static.
+
+Closes #387
+
+Signed-off-by: Serge Hallyn <shallyn@cisco.com>
+---
+ configure.ac         | 2 ++
+ libsubid/Makefile.am | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/configure.ac b/configure.ac
+index 0f237cc..994836b 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -321,6 +321,8 @@ if test "$with_sha_crypt" = "yes"; then
+ 	AC_DEFINE(USE_SHA_CRYPT, 1, Define to allow the SHA256 and SHA512 password encryption algorithms)
+ fi
+ 
++AM_CONDITIONAL(ENABLE_SHARED, test "x$enable_shared" = "xyes")
++
+ AM_CONDITIONAL(USE_BCRYPT, test "x$with_bcrypt" = "xyes")
+ if test "$with_bcrypt" = "yes"; then
+ 	AC_DEFINE(USE_BCRYPT, 1, Define to allow the bcrypt password encryption algorithm)
+diff --git a/libsubid/Makefile.am b/libsubid/Makefile.am
+index 99308c1..8bba02a 100644
+--- a/libsubid/Makefile.am
++++ b/libsubid/Makefile.am
+@@ -1,6 +1,8 @@
+ lib_LTLIBRARIES = libsubid.la
++if ENABLE_SHARED
+ libsubid_la_LDFLAGS = -Wl,-soname,libsubid.so.@LIBSUBID_ABI@ \
+ 	-shared -version-info @LIBSUBID_ABI_MAJOR@
++endif
+ libsubid_la_SOURCES = api.c
+ 
+ pkginclude_HEADERS = subid.h
+-- 
+1.8.3.1
+

_service:tar_scm:Revert-useradd.c-fix-memleaks-of-grp.patch Added

_service:tar_scm:backport-Add-header-guards.patch Added

@@ -0,0 +1,48 @@
+From 0c7ded471fdd2a130edfb265279663c68cfd2a3c Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Tue, 10 May 2022 15:26:15 +0200
+Subject: PATCH Add header guards
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+
+Reference: https://github.com/shadow-maint/shadow/commit/0c7ded471fdd2a130edfb265279663c68cfd2a3c
+Conflict: shadowlog_internal.h is not currently available, and run_part.h is adapted
+---
+ lib/pwauth.h             | 5 +++++
+ lib/run_part.h           | 5 +++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/lib/pwauth.h b/lib/pwauth.h
+index fb205b71..b610025d 100644
+--- a/lib/pwauth.h
++++ b/lib/pwauth.h
+@@ -34,6 +34,9 @@
+  *	$Id$
+  */
+ 
++#ifndef _PWAUTH_H
++#define _PWAUTH_H
++
+ #ifndef USE_PAM
+ int pw_auth (const char *cipher,
+              const char *user,
+@@ -64,3 +67,5 @@ int pw_auth (const char *cipher,
+ #define	PW_RLOGIN	202
+ #define	PW_FTP		203
+ #define	PW_REXEC	204
++
++#endif /* _PWAUTH_H */
+diff --git a/lib/run_part.h b/lib/run_part.h
+index 0b68dbfc..6422134c 100644
+--- a/lib/run_part.h
++++ b/lib/run_part.h
+@@ -1,2 +1,7 @@
++#ifndef _RUN_PART_H
++#define _RUN_PART_H
++
+ int run_part (char *script_path, char *name, char *action);
+ int run_parts (char *directory, char *name, char *action);
++
++#endif /* _RUN_PART_H */
+-- 
+2.23.0

_service:tar_scm:backport-Change-to-strncat.patch Added

_service:tar_scm:backport-Do-not-return-garbage-in-run_parts.patch Added

_service:tar_scm:backport-Handle-ERANGE-error-correctly.patch Added

@@ -0,0 +1,38 @@
+From e9bf727253e13968c4c61d71f4725e668cd49881 Mon Sep 17 00:00:00 2001
+From: Niko <2089413+NikoDelarich@users.noreply.github.com>
+Date: Tue, 1 Mar 2022 14:43:07 +0100
+Subject: PATCH Handle ERANGE error correctly
+ 
+The reentrant functions getgrgid_r, getgrnam_r, getpwnam_r, etc. all return an error code instead of setting errno. Adapt the error check accordingly.
+ 
+Reference: https://github.com/shadow-maint/shadow/commit/e9bf727253e13968c4c61d71f4725e668cd49881
+Conflict: NA
+ 
+---
+ libmisc/xgetXXbyYY.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+ 
+diff --git a/libmisc/xgetXXbyYY.c b/libmisc/xgetXXbyYY.c
+index db010224..6a3f9693 100644
+--- a/libmisc/xgetXXbyYY.c
++++ b/libmisc/xgetXXbyYY.c
+@@ -66,7 +66,6 @@
+ 			         "x" STRINGIZE(FUNCTION_NAME));
+ 			exit (13);
+ 		}
+-		errno = 0;
+ 		status = REENTRANT_NAME(ARG_NAME, result, buffer,
+ 		                        length, &resbuf);
+ 		if ((0 == status) && (resbuf == result)) {
+@@ -78,7 +77,7 @@
+ 			return ret_result;
+ 		}
+ 
+-		if (ERANGE != errno) {
++		if (ERANGE != status) {
+ 			free (buffer);
+ 			free (result);
+ 			return NULL;
+-- 
+2.27.0
+

_service:tar_scm:backport-Initialize-local-variables.patch Added

@@ -0,0 +1,89 @@
+From 3b89b71680b2eb46135439e0a7760dbe040628e5 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Mon, 16 May 2022 17:24:58 +0200
+Subject: PATCH Initialize local variables
+ 
+CWE-457 by CodeQL.
+ 
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+ 
+Reference: https://github.com/shadow-maint/shadow/commit/3b89b71680b2eb46135439e0a7760dbe040628e5
+Conflict: The number of lines is inconsistent and there is a little difference in adaptation
+ 
+---
+ lib/run_part.c |  2 +-
+ src/faillog.c  |  4 ++--
+ src/lastlog.c  | 21 ++++++++++-----------
+ 3 files changed, 13 insertions(+), 14 deletions(-)
+ 
+diff --git a/lib/run_part.c b/lib/run_part.c
+index 1e4f154b..bce11d37 100644
+--- a/lib/run_part.c
++++ b/lib/run_part.c
+@@ -43,7 +43,7 @@ int run_parts (char *directory, char *name, char *action)
+ 	struct dirent **namelist;
+ 	int scanlist;
+ 	int n;
+-	int execute_result;
++	int execute_result = 0;
+ 
+ 	scanlist = scandir (directory, &namelist, 0, alphasort);
+ 	if (scanlist<=0) {
+diff --git a/src/faillog.c b/src/faillog.c
+index d33fe9b6..0f94836f 100644
+--- a/src/faillog.c
++++ b/src/faillog.c
+@@ -565,9 +565,9 @@ static void set_locktime (long locktime)
+ 
+ int main (int argc, char **argv)
+ {
+-	long fail_locktime;
++	long fail_locktime = 0;
+ 	short fail_max = 0; // initialize to silence compiler warning
+-	long days;
++	long days = 0;
+ 
+ 	/*
+ 	 * Get the program name. The program name is used as a prefix to
+diff --git a/src/lastlog.c b/src/lastlog.c
+index 3c0fc9c6..0d4b5fd2 100644
+--- a/src/lastlog.c
++++ b/src/lastlog.c
+@@ -114,7 +114,16 @@ static void print_one (/*@null@*/const struct passwd *pw)
+ #endif
+ 
+ #ifdef HAVE_LL_HOST
+-	int maxIPv6Addrlen;
++	/*
++	 * ll_host is in minimized form, thus the maximum IPv6 address possible is
++	 * 8*4+7 = 39 characters.
++	 * RFC 4291 2.5.6 states that for LL-addresses fe80+only the interface ID is set,
++	 * thus having a maximum size of 25+1+IFNAMSIZ.
++	 * POSIX says IFNAMSIZ should be 16 characters long including the null byte, thus
++	 * 25+1+IFNAMSIZ >= 42 > 39
++	 */
++	/* Link-Local address + % + Interfacename */
++	const int maxIPv6Addrlen = 25+1+IFNAMSIZ;
+ #endif
+ 
+ 	if (NULL == pw) {
+@@ -158,16 +167,6 @@ static void print_one (/*@null@*/const struct passwd *pw)
+ 	/* Print the header only once */
+ 	if (!once) {
+ #ifdef HAVE_LL_HOST
+-		/*
+-		 * ll_host is in minimized form, thus the maximum IPv6 address possible is
+-		 * 8*4+7 = 39 characters.
+-		 * RFC 4291 2.5.6 states that for LL-addresses fe80+only the interface ID is set,
+-		 * thus having a maximum size of 25+1+IFNAMSIZ.
+-		 * POSIX says IFNAMSIZ should be 16 characters long including the null byte, thus
+-		 * 25+1+IFNAMSIZ >= 42 > 39
+-		 */
+-		/* Link-Local address + % + Interfacename */
+-		maxIPv6Addrlen = 25+1+IFNAMSIZ;
+ 		printf (_("Username         Port     From%*sLatest\n"), maxIPv6Addrlen-3, " ");
+ #else
+ 		puts (_("Username                Port     Latest"));
+-- 
+2.27.0
+

_service:tar_scm:backport-Remove-commented-out-code-and-FIXMEs.patch Added

@@ -0,0 +1,79 @@
+From 0b51cde162322ad1c6d162be0bc1b97065ff25c8 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Tue, 10 May 2022 15:01:21 +0200
+Subject: PATCH Remove commented out code and FIXMEs
+ 
+In order to remove some of the FIXMEs it was necessary to change the
+code and call getulong() instead of getlong().
+ 
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+ 
+Reference: https://github.com/shadow-maint/shadow/commit/0b51cde162322ad1c6d162be0bc1b97065ff25c8
+Conflict: NA
+ 
+---
+ lib/getdef.c    | 1 -
+ lib/sgetspent.c | 3 +--
+ lib/shadow.c    | 3 +--
+ libmisc/salt.c  | 3 ++-
+ 4 files changed, 4 insertions(+), 6 deletions(-)
+ 
+diff --git a/lib/getdef.c b/lib/getdef.c
+index fbaea2e1..2e6022fa 100644
+--- a/lib/getdef.c
++++ b/lib/getdef.c
+@@ -345,7 +345,6 @@ unsigned long getdef_ulong (const char *item, unsigned long dflt)
+ 	}
+ 
+ 	if (getulong (d->value, &val) == 0) {
+-		/* FIXME: we should have a getulong */
+ 		fprintf (shadow_logfd,
+ 		         _("configuration error - cannot parse %s value: '%s'"),
+ 		         item, d->value);
+diff --git a/lib/sgetspent.c b/lib/sgetspent.c
+index a35b6759..cbadb7e6 100644
+--- a/lib/sgetspent.c
++++ b/lib/sgetspent.c
+@@ -171,8 +171,7 @@ struct spwd *sgetspent (const char *string)
+ 
+ 	if (fields80 == '\0') {
+ 		spwd.sp_flag = SHADOW_SP_FLAG_UNSET;
+-	} else if (getlong (fields8, &spwd.sp_flag) == 0) {
+-		/* FIXME: add a getulong function */
++	} else if (getulong (fields8, &spwd.sp_flag) == 0) {
+ 		return 0;
+ 	}
+ 
+diff --git a/lib/shadow.c b/lib/shadow.c
+index 9e86b908..b628b657 100644
+--- a/lib/shadow.c
++++ b/lib/shadow.c
+@@ -305,8 +305,7 @@ static struct spwd *my_sgetspent (const char *string)
+ 	if (fields80 == '\0') {
+ 		spwd.sp_flag = SHADOW_SP_FLAG_UNSET;
+ 	} else {
+-		if (getlong (fields8, &spwd.sp_flag) == 0) {
+-			/* FIXME: add a getulong function */
++		if (getulong (fields8, &spwd.sp_flag) == 0) {
+ #ifdef	USE_NIS
+ 			if (nis_used) {
+ 				spwd.sp_flag = SHADOW_SP_FLAG_UNSET;
+diff --git a/libmisc/salt.c b/libmisc/salt.c
+index ebf162fc..450293d7 100644
+--- a/libmisc/salt.c
++++ b/libmisc/salt.c
+@@ -341,9 +341,10 @@ static /*@observer@*/const unsigned long BCRYPT_get_salt_rounds (/*@null@*/int *
+ 	/*
+ 	 * Use 19 as an upper bound for now,
+ 	 * because musl doesn't allow rounds >= 20.
++	 * If musl ever supports > 20 rounds,
++	 * rounds should be set to B_ROUNDS_MAX.
+ 	 */
+ 	if (rounds > 19) {
+-		/* rounds = B_ROUNDS_MAX; */
+ 		rounds = 19;
+ 	}
+ #endif /* USE_XCRYPT_GENSALT */
+-- 
+2.27.0
+

_service:tar_scm:backport-Remove-redeclared-variable.patch Added

@@ -0,0 +1,31 @@
+From 23baa40d9d96743dd3377de0de8e422b7ec3ed94 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Tue, 10 May 2022 13:23:07 +0200
+Subject: PATCH Remove redeclared variable
+ 
+No need to redeclare a variable with the same name and type. Just keep
+the one with the biggest scope.
+ 
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+ 
+Reference: https://github.com/shadow-maint/shadow/commit/23baa40d9d96743dd3377de0de8e422b7ec3ed94
+Conflict: NA
+ 
+---
+ src/vipw.c | 1 -
+ 1 file changed, 1 deletion(-)
+ 
+diff --git a/src/vipw.c b/src/vipw.c
+index 8c97f4bc..488a97d9 100644
+--- a/src/vipw.c
++++ b/src/vipw.c
+@@ -293,7 +293,6 @@ vipwedit (const char *file, int (*file_lock) (void), int (*file_unlock) (void))
+ 		/* use the system() call to invoke the editor so that it accepts
+ 		   command line args in the EDITOR and VISUAL environment vars */
+ 		char *buf;
+-		int status;
+ 
+ 		/* Wait for parent to make us the foreground pgrp. */
+ 		if (orig_pgrp != -1) {
+-- 
+2.27.0

_service:tar_scm:backport-chpasswd-add-get_salt-for-generating-salt-value.patch Added

@@ -0,0 +1,117 @@
+From 6d1b10b9e516bd88fa34392395b0a7c6e6f54fd7 Mon Sep 17 00:00:00 2001
+From: juyin <zhuyan34@huawei.com>
+Date: Thu, 31 Mar 2022 16:45:19 +0800
+Subject: PATCH chpasswd: add get_salt for generating salt value
+ 
+The function that generates the salt value is extracted separately, and it is more convenient to modify it later.
+ 
+Reference: https://github.com/shadow-maint/shadow/commit/a026154c6fca7c7e5d6d0723e0cc29d6cd9fa00a
+Conflict: The EulerOS supports SM3. As a result, the patch is different.
+---
+ src/chpasswd.c | 73 +++++++++++++++++++++++++++-----------------------
+ 1 file changed, 39 insertions(+), 34 deletions(-)
+ 
+diff --git a/src/chpasswd.c b/src/chpasswd.c
+index 5dfb995..708f973 100644
+--- a/src/chpasswd.c
++++ b/src/chpasswd.c
+@@ -430,12 +430,54 @@ static void close_files (void)
+ 	pw_locked = false;
+ }
+ 
++static const char *get_salt(void)
++{
++	if (   !eflg
++		&& (   (NULL == crypt_method)
++			|| (0 != strcmp (crypt_method, "NONE")))) {
++		void *arg = NULL;
++
++		if (md5flg) {
++			crypt_method = "MD5";
++		}
++#if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT)
++		if (sflg) {
++#if defined(USE_SHA_CRYPT)
++			if (   (0 == strcmp (crypt_method, "SHA256"))
++				|| (0 == strcmp (crypt_method, "SHA512"))) {
++				arg = &sha_rounds;
++			}
++#endif				/* USE_SHA_CRYPT */
++#if defined(USE_BCRYPT)
++			if (0 == strcmp (crypt_method, "BCRYPT")) {
++				arg = &bcrypt_rounds;
++			}
++#endif				/* USE_BCRYPT */
++#if defined(USE_YESCRYPT)
++			if (0 == strcmp (crypt_method, "YESCRYPT")) {
++				arg = &yescrypt_cost;
++			}
++#endif				/* USE_YESCRYPT */
++#if defined(USE_SM3_CRYPT)
++			if (0 == strcmp (crypt_method, "SM3")) {
++				arg = &sm3_rounds;
++			}
++#endif				/* USE_SM3_CRYPT */
++		}
++#endif
++		return crypt_make_salt (crypt_method, arg);
++	}
++
++	return NULL;
++}
++
+ int main (int argc, char **argv)
+ {
+ 	char bufBUFSIZ;
+ 	char *name;
+ 	char *newpwd;
+ 	char *cp;
++	const char *salt;
+ 
+ #ifdef USE_PAM
+ 	bool use_pam = true;
+@@ -545,40 +587,8 @@ int main (int argc, char **argv)
+ 		const struct passwd *pw;
+ 		struct passwd newpw;
+ 
+-		if (   !eflg
+-		    && (   (NULL == crypt_method)
+-		        || (0 != strcmp (crypt_method, "NONE")))) {
+-			void *arg = NULL;
+-			const char *salt;
+-			if (md5flg) {
+-				crypt_method = "MD5";
+-			}
+-#if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT)
+-			if (sflg) {
+-#if defined(USE_SHA_CRYPT)
+-				if (   (0 == strcmp (crypt_method, "SHA256"))
+-					|| (0 == strcmp (crypt_method, "SHA512"))) {
+-					arg = &sha_rounds;
+-				}
+-#endif				/* USE_SHA_CRYPT */
+-#if defined(USE_BCRYPT)
+-				if (0 == strcmp (crypt_method, "BCRYPT")) {
+-					arg = &bcrypt_rounds;
+-				}
+-#endif				/* USE_BCRYPT */
+-#if defined(USE_YESCRYPT)
+-				if (0 == strcmp (crypt_method, "YESCRYPT")) {
+-					arg = &yescrypt_cost;
+-				}
+-#endif				/* USE_YESCRYPT */
+-#if defined(USE_SM3_CRYPT)
+-				if (0 == strcmp (crypt_method, "SM3")) {
+-					arg = &sm3_rounds;
+-				}
+-#endif				/* USE_SM3_CRYPT */
+-			}
+-#endif
+-			salt = crypt_make_salt (crypt_method, arg);
++		salt = get_salt();
++		if (salt) {
+ 			cp = pw_encrypt (newpwd, salt);
+ 			if (NULL == cp) {
+ 				fprintf (stderr,
+-- 
+2.33.0

_service:tar_scm:backport-chpasswd-fix-function-problem-with-R-parameter.patch Added

@@ -0,0 +1,48 @@
+From 3732cf72d6f05fcd9d9f301eac84c1a61443e379 Mon Sep 17 00:00:00 2001
+From: juyin <zhuyan34@huawei.com>
+Date: Thu, 31 Mar 2022 16:48:52 +0800
+Subject: PATCH chpasswd: fix function problem with -R parameter
+ 
+Generating salt value depends on /dev/urandom. But after the
+function process_root_flag changed the root directory, It does
+not exist.
+ 
+So, generate salt value before changeing the directory.
+ 
+Fixes: #514
+ 
+Reference: https://github.com/shadow-maint/shadow/commit/3732cf72d6f05fcd9d9f301eac84c1a61443e379
+Conflict: NA
+---
+ src/chpasswd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+ 
+diff --git a/src/chpasswd.c b/src/chpasswd.c
+index 94e923ab..d0da14c6 100644
+--- a/src/chpasswd.c
++++ b/src/chpasswd.c
+@@ -451,10 +451,11 @@ int main (int argc, char **argv)
+ 	(void) bindtextdomain (PACKAGE, LOCALEDIR);
+ 	(void) textdomain (PACKAGE);
+ 
+-	process_root_flag ("-R", argc, argv);
+-
+ 	process_flags (argc, argv);
+ 
++	salt = get_salt();
++	process_root_flag ("-R", argc, argv);
++
+ #ifdef USE_PAM
+ 	if (md5flg || eflg || cflg) {
+ 		use_pam = false;
+@@ -545,7 +546,6 @@ int main (int argc, char **argv)
+ 		const struct passwd *pw;
+ 		struct passwd newpw;
+ 
+-		salt = get_salt();
+ 		if (salt) {
+ 			cp = pw_encrypt (newpwd, salt);
+ 			if (NULL == cp) {
+-- 
+2.23.0
+

_service:tar_scm:backport-libmisc-add-check-fopen-return-value-in-read_random_.patch Added

_service:tar_scm:backport-passwd-erase-password-copy-on-all-error-branches.patch Added

@@ -0,0 +1,35 @@
+From 58b6e97a9eef866e9e479fb781aaaf59fb11ef36 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
+Date: Mon, 25 Apr 2022 12:17:40 +0200
+Subject: PATCH passwd: erase password copy on all error branches
+ 
+Reference: https://github.com/shadow-maint/shadow/commit/58b6e97a9eef866e9e479fb781aaaf59fb11ef36
+Conflict: NA
+ 
+---
+ src/passwd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+ 
+diff --git a/src/passwd.c b/src/passwd.c
+index 80531ec6..8c6f81a9 100644
+--- a/src/passwd.c
++++ b/src/passwd.c
+@@ -289,6 +289,7 @@ static int new_password (const struct passwd *pw)
+ 		cp = getpass (_("New password: "));
+ 		if (NULL == cp) {
+ 			memzero (orig, sizeof orig);
++			memzero (pass, sizeof pass);
+ 			return -1;
+ 		}
+ 		if (warned && (strcmp (pass, cp) != 0)) {
+@@ -316,6 +317,7 @@ static int new_password (const struct passwd *pw)
+ 		cp = getpass (_("Re-enter new password: "));
+ 		if (NULL == cp) {
+ 			memzero (orig, sizeof orig);
++			memzero (pass, sizeof pass);
+ 			return -1;
+ 		}
+ 		if (strcmp (cp, pass) != 0) {
+-- 
+2.27.0
+

_service:tar_scm:backport-useradd-check-if-subid-range-exists-for-user.patch Added

@@ -0,0 +1,41 @@
+From e0524e813a3bae2891b33a66f35876841c11cee7 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Mon, 24 Oct 2022 10:46:36 +0200
+Subject: PATCH 1/4 useradd: check if subid range exists for user
+
+Check if a user already has a subid range before assigning one.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2012929
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+
+Reference: https://github.com/shadow-maint/shadow/commit/e0524e813a3bae2891b33a66f35876841c11cee7
+Conflict: NA
+---
+ src/useradd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/useradd.c b/src/useradd.c
+index 7ea0a9c4..e784d602 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -2188,14 +2188,14 @@ static void usr_update (unsigned long subuid_count, unsigned long subgid_count)
+ 		fail_exit (E_PW_UPDATE);
+ 	}
+ #ifdef ENABLE_SUBIDS
+-	if (is_sub_uid &&
++	if (is_sub_uid && !local_sub_uid_assigned(user_name) &&
+ 	    (sub_uid_add(user_name, sub_uid_start, subuid_count) == 0)) {
+ 		fprintf (stderr,
+ 		         _("%s: failed to prepare the new %s entry\n"),
+ 		         Prog, sub_uid_dbname ());
+ 		fail_exit (E_SUB_UID_UPDATE);
+ 	}
+-	if (is_sub_gid &&
++	if (is_sub_gid && !local_sub_gid_assigned(user_name) &&
+ 	    (sub_gid_add(user_name, sub_gid_start, subgid_count) == 0)) {
+ 		fprintf (stderr,
+ 		         _("%s: failed to prepare the new %s entry\n"),
+-- 
+2.12.3
+

_service:tar_scm:backport-useradd-modify-check-ID-range-for-system-users.patch Added

@@ -0,0 +1,42 @@
+From f1f1678e13aa3ae49bdb139efaa2c5bc53dcfe92 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Tue, 4 Jan 2022 13:06:00 +0100
+Subject: PATCH useradd: modify check ID range for system users
+
+useradd warns that a system user ID less than SYS_UID_MIN is outside the
+expected range, even though that ID has been specifically selected with
+the "-u" option.
+
+In my opinion all the user ID's below SYS_UID_MAX are for the system,
+thus I change the condition to take that into account.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2004911
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+
+Conflict: context adaptation
+---
+ src/useradd.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/src/useradd.c b/src/useradd.c
+index 34376fa..4c71c38 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -2409,11 +2409,9 @@ static void check_uid_range(int rflg, uid_t user_id)
+ 	uid_t uid_min ;
+ 	uid_t uid_max ;
+ 	if(rflg){
+-		uid_min = (uid_t)getdef_ulong("SYS_UID_MIN",101UL);
+ 		uid_max = (uid_t)getdef_ulong("SYS_UID_MAX",getdef_ulong("UID_MIN",1000UL)-1);
+-		if(uid_min <= uid_max){
+-			if(user_id < uid_min || user_id >uid_max)
+-				fprintf(stderr, _("%s warning: %s's uid %d outside of the SYS_UID_MIN %d and SYS_UID_MAX %d range.\n"), Prog, user_name, user_id, uid_min, uid_max);
++		if (user_id > uid_max) {
++			fprintf(stderr, _("%s warning: %s's uid %d is greater than SYS_UID_MAX %d\n"), Prog, user_name, user_id, uid_max);
+ 		}
+ 	}else{
+ 		uid_min = (uid_t)getdef_ulong("UID_MIN", 1000UL);
+-- 
+1.8.3.1
+

_service:tar_scm:groupdel-fix-SIGSEGV-when-passwd-does-not-exist.patch Added

_service:tar_scm:libmisc-fix-default-value-in-SHA_get_salt_rounds.patch Added

@@ -0,0 +1,60 @@
+From 234e8fa7b134d1ebabfdad980a3ae5b63c046c62 Mon Sep 17 00:00:00 2001
+From: Mike Gilbert <floppym@gentoo.org>
+Date: Sat, 14 Aug 2021 13:24:34 -0400
+Subject: PATCH libmisc: fix default value in SHA_get_salt_rounds()
+
+If SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS are both unspecified,
+use SHA_ROUNDS_DEFAULT.
+
+Previously, the code fell through, calling shadow_random(-1, -1). This
+ultimately set rounds = (unsigned long) -1, which ends up being a very
+large number! This then got capped to SHA_ROUNDS_MAX later in the
+function.
+
+The new behavior matches BCRYPT_get_salt_rounds().
+
+Bug: https://bugs.gentoo.org/808195
+Fixes: https://github.com/shadow-maint/shadow/issues/393
+---
+ libmisc/salt.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/libmisc/salt.c b/libmisc/salt.c
+index 91d528f..30eefb9 100644
+--- a/libmisc/salt.c
++++ b/libmisc/salt.c
+@@ -223,20 +223,21 @@ static /*@observer@*/const unsigned long SHA_get_salt_rounds (/*@null@*/int *pre
+ 		if ((-1 == min_rounds) && (-1 == max_rounds)) {
+ 			rounds = SHA_ROUNDS_DEFAULT;
+ 		}
++		else {
++			if (-1 == min_rounds) {
++				min_rounds = max_rounds;
++			}
+ 
+-		if (-1 == min_rounds) {
+-			min_rounds = max_rounds;
+-		}
++			if (-1 == max_rounds) {
++				max_rounds = min_rounds;
++			}
+ 
+-		if (-1 == max_rounds) {
+-			max_rounds = min_rounds;
+-		}
++			if (min_rounds > max_rounds) {
++				max_rounds = min_rounds;
++			}
+ 
+-		if (min_rounds > max_rounds) {
+-			max_rounds = min_rounds;
++			rounds = (unsigned long) shadow_random (min_rounds, max_rounds);
+ 		}
+-
+-		rounds = (unsigned long) shadow_random (min_rounds, max_rounds);
+ 	} else if (0 == *prefered_rounds) {
+ 		rounds = SHA_ROUNDS_DEFAULT;
+ 	} else {
+-- 
+1.8.3.1
+

_service:tar_scm:libsubid-link-to-PAM-libraries.patch Added

_service:tar_scm:newgrp-fix-segmentation-fault.patch Added

@@ -0,0 +1,35 @@
+From 497e90751bc0d95cc998b0f06305040563903948 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Wed, 10 Nov 2021 12:02:04 +0100
+Subject: PATCH newgrp: fix segmentation fault
+
+Fix segmentation fault in newgrp when xgetspnam() returns a NULL value
+that is immediately freed.
+
+The error was committed in
+https://github.com/shadow-maint/shadow/commit/e65cc6aebcb4132fa413f00a905216a5b35b3d57
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2019553
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+---
+ src/newgrp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/newgrp.c b/src/newgrp.c
+index 730f47e..566f1c8 100644
+--- a/src/newgrp.c
++++ b/src/newgrp.c
+@@ -163,8 +163,8 @@ static void check_perms (const struct group *grp,
+ 	spwd = xgetspnam (pwd->pw_name);
+ 	if (NULL != spwd) {
+ 		pwd->pw_passwd = xstrdup (spwd->sp_pwdp);
++		spw_free (spwd);
+ 	}
+-	spw_free (spwd);
+ 
+ 	if ((pwd->pw_passwd0 == '\0') && (grp->gr_passwd0 != '\0')) {
+ 		needspasswd = true;
+-- 
+1.8.3.1
+

_service:tar_scm:pwck-fix-segfault-when-calling-fprintf.patch Added

_service:tar_scm:semanage-close-the-selabel-handle.patch Added

@@ -0,0 +1,61 @@
+From 234af5cf67fc1a3ba99fc246ba65869a3c416545 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Fri, 8 Oct 2021 13:13:13 +0200
+Subject: PATCH semanage: close the selabel handle
+
+Close the selabel handle to update the file_context. This means that the
+file_context will be remmaped and used by selabel_lookup() to return
+the appropriate context to label the home folder.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1993081
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+---
+ lib/prototypes.h | 1 +
+ lib/selinux.c    | 5 +++++
+ lib/semanage.c   | 1 +
+ 3 files changed, 7 insertions(+)
+
+diff --git a/lib/prototypes.h b/lib/prototypes.h
+index 1d1586d..b697e0e 100644
+--- a/lib/prototypes.h
++++ b/lib/prototypes.h
+@@ -392,6 +392,7 @@ extern /*@observer@*/const char *crypt_make_salt (/*@null@*//*@observer@*/const
+ /* selinux.c */
+ #ifdef WITH_SELINUX
+ extern int set_selinux_file_context (const char *dst_name, mode_t mode);
++extern void reset_selinux_handle (void);
+ extern int reset_selinux_file_context (void);
+ extern int check_selinux_permit (const char *perm_name);
+ #endif
+diff --git a/lib/selinux.c b/lib/selinux.c
+index c83545f..b075d4c 100644
+--- a/lib/selinux.c
++++ b/lib/selinux.c
+@@ -50,6 +50,11 @@ static void cleanup(void)
+ 	}
+ }
+ 
++void reset_selinux_handle (void)
++{
++    cleanup();
++}
++
+ /*
+  * set_selinux_file_context - Set the security context before any file or
+  *                            directory creation.
+diff --git a/lib/semanage.c b/lib/semanage.c
+index 0d30456..a5bf921 100644
+--- a/lib/semanage.c
++++ b/lib/semanage.c
+@@ -293,6 +293,7 @@ int set_seuser (const char *login_name, const char *seuser_name)
+ 	}
+ 
+ 	ret = 0;
++	reset_selinux_handle();
+ 
+ done:
+ 	semanage_seuser_key_free (key);
+-- 
+1.8.3.1
+

_service:tar_scm:shadow-4.8-goodname.patch Added

@@ -0,0 +1,100 @@
+diff -up shadow-4.8/libmisc/chkname.c.goodname shadow-4.8/libmisc/chkname.c
+--- shadow-4.8/libmisc/chkname.c.goodname	2020-01-13 09:44:41.968507996 +0100
++++ shadow-4.8/libmisc/chkname.c	2020-01-13 09:46:27.863727732 +0100
+@@ -55,26 +55,44 @@ static bool is_valid_name (const char *n
+ 	}
+ 
+ 	/*
+-	 * User/group names must match a-z_a-z0-9_-*$
+-	 */
++         * User/group names must match gnu e-regex:
++         *    a-zA-Z0-9_.a-zA-Z0-9_.-{0,30}a-zA-Z0-9_.$-?
++         *
++         * as a non-POSIX, extension, allow "$" as the last char for
++         * sake of Samba 3.x "add machine script"
++         *
++         * Also do not allow fully numeric names or just "." or "..".
++         */
++	int numeric;
+ 
+-	if (('\0' == *name) ||
+-	    !((('a' <= *name) && ('z' >= *name)) || ('_' == *name))) {
++	if ('\0' == *name ||
++	    ('.' == *name && (('.' == name1 && '\0' == name2) ||
++			      '\0' == name1)) ||
++	    !((*name >= 'a' && *name <= 'z') ||
++	      (*name >= 'A' && *name <= 'Z') ||
++	      (*name >= '0' && *name <= '9') ||
++	      *name == '_' ||
++	      *name == '.')) {
+ 		return false;
+ 	}
+ 
++	numeric = isdigit(*name);
++
+ 	while ('\0' != *++name) {
+-		if (!(( ('a' <= *name) && ('z' >= *name) ) ||
+-		      ( ('0' <= *name) && ('9' >= *name) ) ||
+-		      ('_' == *name) ||
+-		      ('-' == *name) ||
+-		      ( ('$' == *name) && ('\0' == *(name + 1)) )
++		if (!((*name >= 'a' && *name <= 'z') ||
++		      (*name >= 'A' && *name <= 'Z') ||
++		      (*name >= '0' && *name <= '9') ||
++		      *name == '_' ||
++		      *name == '.' ||
++		      *name == '-' ||
++		      (*name == '$' && name1 == '\0')
+ 		     )) {
+ 			return false;
+ 		}
++		numeric &= isdigit(*name);
+ 	}
+ 
+-	return true;
++	return !numeric;
+ }
+ 
+ bool is_valid_user_name (const char *name)
+diff -up shadow-4.8/man/groupadd.8.xml.goodname shadow-4.8/man/groupadd.8.xml
+--- shadow-4.8/man/groupadd.8.xml.goodname	2019-07-23 17:26:08.000000000 +0200
++++ shadow-4.8/man/groupadd.8.xml	2020-01-13 09:44:41.968507996 +0100
+@@ -273,10 +273,12 @@
+    <refsect1 id='caveats'>
+      <title>CAVEATS</title>
+      <para>
+-       Groupnames must start with a lower case letter or an underscore,
+-       followed by lower case letters, digits, underscores, or dashes.
+-       They can end with a dollar sign.
+-       In regular expression terms: a-z_a-z0-9_-*$?
++       Groupnames may contain only lower and upper case letters, digits,
++       underscores, or dashes. They can end with a dollar sign.
++
++       Dashes are not allowed at the beginning of the groupname.
++       Fully numeric groupnames and groupnames . or .. are
++       also disallowed.
+      </para>
+      <para>
+        Groupnames may only be up to &GROUP_NAME_MAX_LENGTH; characters long.
+diff -up shadow-4.8/man/useradd.8.xml.goodname shadow-4.8/man/useradd.8.xml
+--- shadow-4.8/man/useradd.8.xml.goodname	2019-10-05 03:23:58.000000000 +0200
++++ shadow-4.8/man/useradd.8.xml	2020-01-13 09:44:41.968507996 +0100
+@@ -661,10 +661,14 @@
+     </para>
+ 
+     <para>
+-      Usernames must start with a lower case letter or an underscore,
+-      followed by lower case letters, digits, underscores, or dashes.
+-      They can end with a dollar sign.
+-      In regular expression terms: a-z_a-z0-9_-*$?
++      Usernames may contain only lower and upper case letters, digits,
++      underscores, or dashes. They can end with a dollar sign.
++
++      Dashes are not allowed at the beginning of the username.
++      Fully numeric usernames and usernames . or .. are
++      also disallowed. It is not recommended to use usernames beginning
++      with . character as their home directories will be hidden in
++      the <command>ls</command> output.
+     </para>
+     <para>
+       Usernames may only be up to 32 characters long.

_service:tar_scm:shadow-4.8-long-entry.patch Added

@@ -0,0 +1,86 @@
+diff -up shadow-4.8/lib/defines.h.long-entry shadow-4.8/lib/defines.h
+--- shadow-4.8/lib/defines.h.long-entry	2020-01-13 10:29:45.288957339 +0100
++++ shadow-4.8/lib/defines.h	2020-01-13 10:30:47.482902954 +0100
+@@ -388,6 +388,9 @@ extern char *strerror ();
+ # endif
+ #endif
+ 
++/* Maximum length of passwd entry */
++#define PASSWD_ENTRY_MAX_LENGTH 32768
++
+ #ifdef HAVE_SECURE_GETENV
+ #  define shadow_getenv(name) secure_getenv(name)
+ # else
+diff -up shadow-4.8/lib/pwio.c.long-entry shadow-4.8/lib/pwio.c
+--- shadow-4.8/lib/pwio.c.long-entry	2019-07-23 17:26:08.000000000 +0200
++++ shadow-4.8/lib/pwio.c	2020-01-13 10:29:45.288957339 +0100
+@@ -79,7 +79,10 @@ static int passwd_put (const void *ent,
+ 	    || (pw->pw_gid == (gid_t)-1)
+ 	    || (valid_field (pw->pw_gecos, ":\n") == -1)
+ 	    || (valid_field (pw->pw_dir, ":\n") == -1)
+-	    || (valid_field (pw->pw_shell, ":\n") == -1)) {
++	    || (valid_field (pw->pw_shell, ":\n") == -1)
++	    || (strlen (pw->pw_name) + strlen (pw->pw_passwd) +
++	        strlen (pw->pw_gecos) + strlen (pw->pw_dir) +
++	        strlen (pw->pw_shell) + 100 > PASSWD_ENTRY_MAX_LENGTH)) {
+ 		return -1;
+ 	}
+ 
+diff -up shadow-4.8/lib/sgetpwent.c.long-entry shadow-4.8/lib/sgetpwent.c
+--- shadow-4.8/lib/sgetpwent.c.long-entry	2019-10-05 03:23:58.000000000 +0200
++++ shadow-4.8/lib/sgetpwent.c	2020-01-13 10:29:45.288957339 +0100
+@@ -57,7 +57,7 @@
+ struct passwd *sgetpwent (const char *buf)
+ {
+ 	static struct passwd pwent;
+-	static char pwdbuf1024;
++	static char pwdbufPASSWD_ENTRY_MAX_LENGTH;
+ 	register int i;
+ 	register char *cp;
+ 	char *fieldsNFIELDS;
+@@ -67,8 +67,10 @@ struct passwd *sgetpwent (const char *bu
+ 	 * the password structure remain valid.
+ 	 */
+ 
+-	if (strlen (buf) >= sizeof pwdbuf)
++	if (strlen (buf) >= sizeof pwdbuf) {
++		fprintf (stderr, "Too long passwd entry encountered, file corruption?\n");
+ 		return 0;	/* fail if too long */
++	}
+ 	strcpy (pwdbuf, buf);
+ 
+ 	/*
+diff -up shadow-4.8/lib/sgetspent.c.long-entry shadow-4.8/lib/sgetspent.c
+--- shadow-4.8/lib/sgetspent.c.long-entry	2019-07-23 17:26:08.000000000 +0200
++++ shadow-4.8/lib/sgetspent.c	2020-01-13 10:29:45.289957322 +0100
+@@ -48,7 +48,7 @@
+  */
+ struct spwd *sgetspent (const char *string)
+ {
+-	static char spwbuf1024;
++	static char spwbufPASSWD_ENTRY_MAX_LENGTH;
+ 	static struct spwd spwd;
+ 	char *fieldsFIELDS;
+ 	char *cp;
+@@ -61,6 +61,7 @@ struct spwd *sgetspent (const char *stri
+ 	 */
+ 
+ 	if (strlen (string) >= sizeof spwbuf) {
++		fprintf (stderr, "Too long shadow entry encountered, file corruption?\n");
+ 		return 0;	/* fail if too long */
+ 	}
+ 	strcpy (spwbuf, string);
+diff -up shadow-4.8/lib/shadowio.c.long-entry shadow-4.8/lib/shadowio.c
+--- shadow-4.8/lib/shadowio.c.long-entry	2019-07-23 17:26:08.000000000 +0200
++++ shadow-4.8/lib/shadowio.c	2020-01-13 10:29:45.289957322 +0100
+@@ -79,7 +79,9 @@ static int shadow_put (const void *ent,
+ 
+ 	if (   (NULL == sp)
+ 	    || (valid_field (sp->sp_namp, ":\n") == -1)
+-	    || (valid_field (sp->sp_pwdp, ":\n") == -1)) {
++	    || (valid_field (sp->sp_pwdp, ":\n") == -1)
++	    || (strlen (sp->sp_namp) + strlen (sp->sp_pwdp) +
++	        1000 > PASSWD_ENTRY_MAX_LENGTH)) {
+ 		return -1;
+ 	}
+

_service:tar_scm:shadow-4.9-null-tm.patch Added

@@ -0,0 +1,70 @@
+Index: shadow-4.5/src/chage.c
+===================================================================
+--- shadow-4.5.orig/src/chage.c
++++ shadow-4.5/src/chage.c
+@@ -168,6 +168,10 @@ static void date_to_str (char *buf, size
+ 	struct tm *tp;
+ 
+ 	tp = gmtime (&date);
++	if (tp == NULL) {
++		(void) snprintf (buf, maxsize, "(unknown)");
++		return;
++	}
+ #ifdef HAVE_STRFTIME
+ 	(void) strftime (buf, maxsize, "%Y-%m-%d", tp);
+ #else
+Index: shadow-4.5/src/lastlog.c
+===================================================================
+--- shadow-4.5.orig/src/lastlog.c
++++ shadow-4.5/src/lastlog.c
+@@ -158,13 +158,17 @@ static void print_one (/*@null@*/const s
+ 
+ 	ll_time = ll.ll_time;
+ 	tm = localtime (&ll_time);
++	if (tm == NULL) {
++		cp = "(unknown)";
++	} else {
+ #ifdef HAVE_STRFTIME
+-	strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
+-	cp = ptime;
++		strftime (ptime, sizeof (ptime), "%a %b %e %H:%M:%S %z %Y", tm);
++		cp = ptime;
+ #else
+-	cp = asctime (tm);
+-	cp24 = '\0';
++		cp = asctime (tm);
++		cp24 = '\0';
+ #endif
++	}
+ 
+ 	if (ll.ll_time == (time_t) 0) {
+ 		cp = _("**Never logged in**\0");
+Index: shadow-4.5/src/passwd.c
+===================================================================
+--- shadow-4.5.orig/src/passwd.c
++++ shadow-4.5/src/passwd.c
+@@ -455,6 +455,9 @@ static /*@observer@*/const char *date_to
+ 	struct tm *tm;
+ 
+ 	tm = gmtime (&t);
++	if (tm == NULL) {
++		return "(unknown)";
++	}
+ #ifdef HAVE_STRFTIME
+ 	(void) strftime (buf, sizeof buf, "%m/%d/%Y", tm);
+ #else				/* !HAVE_STRFTIME */
+Index: shadow-4.5/src/usermod.c
+===================================================================
+--- shadow-4.5.orig/src/usermod.c
++++ shadow-4.5/src/usermod.c
+@@ -210,6 +210,10 @@ static void date_to_str (/*@unique@*//*@
+ 	} else {
+ 		time_t t = (time_t) date;
+ 		tp = gmtime (&t);
++		if (tp == NULL) {
++			strncpy (buf, "unknown", maxsize);
++			return;
++		}
+ #ifdef HAVE_STRFTIME
+ 		strftime (buf, maxsize, "%Y-%m-%d", tp);
+ #else

_service:tar_scm:shadow-add-sm3-crypt-support.patch Added

@@ -0,0 +1,780 @@
+From d7fa75bbd22a08b4e0b8c7e3ccab588c87d23835 Mon Sep 17 00:00:00 2001
+From: root <root@localhost.localdomain>
+Date: Wed, 29 Dec 2021 16:05:56 +0800
+Subject: PATCH shadow add sm3 crypt support
+
+---
+ configure.ac      |   9 ++++
+ etc/login.defs    |  17 ++++++++
+ lib/encrypt.c     |   3 ++
+ lib/getdef.c      |   4 ++
+ libmisc/obscure.c |   3 ++
+ libmisc/salt.c    | 106 +++++++++++++++++++++++++++++++++++++++++++---
+ src/chgpasswd.c   |  48 +++++++++++++++------
+ src/chpasswd.c    |  44 +++++++++++++------
+ src/newusers.c    |  59 +++++++++++++++++++-------
+ src/passwd.c      |   7 ++-
+ 10 files changed, 252 insertions(+), 48 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 994836b..40348c0 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -288,6 +288,9 @@ AC_ARG_WITH(libcrack,
+ AC_ARG_WITH(sha-crypt,
+ 	AC_HELP_STRING(--with-sha-crypt, allow the SHA256 and SHA512 password encryption algorithms @<:@default=yes@:>@),
+ 	with_sha_crypt=$withval, with_sha_crypt=yes)
++AC_ARG_WITH(sm3-crypt,
++	AC_HELP_STRING(--with-sm3-crypt, allow the SM3 password encryption algorithms @<:@default=yes@:>@),
++	with_sm3_crypt=$withval, with_sm3_crypt=yes)
+ AC_ARG_WITH(bcrypt,
+ 	AC_HELP_STRING(--with-bcrypt, allow the bcrypt password encryption algorithm @<:@default=no@:>@),
+ 	with_bcrypt=$withval, with_bcrypt=no)
+@@ -321,6 +324,11 @@ if test "$with_sha_crypt" = "yes"; then
+ 	AC_DEFINE(USE_SHA_CRYPT, 1, Define to allow the SHA256 and SHA512 password encryption algorithms)
+ fi
+ 
++AM_CONDITIONAL(USE_SM3_CRYPT, test "x$with_sm3_crypt" = "xyes")
++if test "$with_sm3_crypt" = "yes"; then
++	AC_DEFINE(USE_SM3_CRYPT, 1, Define to allow the SM3 password encryption algorithms)
++fi
++
+ AM_CONDITIONAL(ENABLE_SHARED, test "x$enable_shared" = "xyes")
+ 
+ AM_CONDITIONAL(USE_BCRYPT, test "x$with_bcrypt" = "xyes")
+@@ -766,6 +774,7 @@ echo "	tcb support (incomplete):	$with_tcb"
+ echo "	shadow group support:		$enable_shadowgrp"
+ echo "	S/Key support:			$with_skey"
+ echo "	SHA passwords encryption:	$with_sha_crypt"
++echo "	SM3 passwords encryption:	$with_sm3_crypt"
+ echo "	bcrypt passwords encryption:	$with_bcrypt"
+ echo "	yescrypt passwords encryption:	$with_yescrypt"
+ echo "	nscd support:			$with_nscd"
+diff --git a/etc/login.defs b/etc/login.defs
+index 94a2b1b..6db08e1 100644
+--- a/etc/login.defs
++++ b/etc/login.defs
+@@ -353,6 +353,23 @@ CHFN_RESTRICT		rwh
+ #SHA_CRYPT_MIN_ROUNDS 5000
+ #SHA_CRYPT_MAX_ROUNDS 5000
+ 
++#
++# Only works if ENCRYPT_METHOD is set to SM3.
++#
++# Define the number of SM3 rounds.
++# With a lot of rounds, it is more difficult to brute-force the password.
++# However, more CPU resources will be needed to authenticate users if
++# this value is increased.
++#
++# If not specified, the libc will choose the default number of rounds (5000),
++# which is orders of magnitude too low for modern hardware.
++# The values must be within the 1000-999999999 range.
++# If only one of the MIN or MAX values is set, then this value will be used.
++# If MIN > MAX, the highest value will be used.
++#
++#SM3_CRYPT_MAX_ROUNDS 5000
++#SM3_CRYPT_MIN_ROUNDS 5000
++
+ #
+ # Only works if ENCRYPT_METHOD is set to BCRYPT.
+ #
+diff --git a/lib/encrypt.c b/lib/encrypt.c
+index 66c52f2..7fae31d 100644
+--- a/lib/encrypt.c
++++ b/lib/encrypt.c
+@@ -74,6 +74,9 @@
+ 			case '6':
+ 				method = "SHA512";
+ 				break;
++			case 's':   // salt = $sm3$...
++				method = "SM3";
++				break;
+ 			case 'y':
+ 				method = "YESCRYPT";
+ 				break;
+diff --git a/lib/getdef.c b/lib/getdef.c
+index 80eb18c..00459ff 100644
+--- a/lib/getdef.c
++++ b/lib/getdef.c
+@@ -124,6 +124,10 @@ static struct itemdef def_table = {
+ 	{"SHA_CRYPT_MAX_ROUNDS", NULL},
+ 	{"SHA_CRYPT_MIN_ROUNDS", NULL},
+ #endif
++#ifdef USE_SM3_CRYPT
++	{"SM3_CRYPT_MAX_ROUNDS", NULL},
++	{"SM3_CRYPT_MIN_ROUNDS", NULL},
++#endif
+ #ifdef USE_BCRYPT
+ 	{"BCRYPT_MAX_ROUNDS", NULL},
+ 	{"BCRYPT_MIN_ROUNDS", NULL},
+diff --git a/libmisc/obscure.c b/libmisc/obscure.c
+index dc69f76..3907294 100644
+--- a/libmisc/obscure.c
++++ b/libmisc/obscure.c
+@@ -269,6 +269,9 @@ static /*@observer@*//*@null@*/const char *obscure_msg (
+ 		    || (strcmp (result, "SHA256") == 0)
+ 		    || (strcmp (result, "SHA512") == 0)
+ #endif
++#ifdef USE_SM3_CRYPT
++		    || (strcmp (result, "SM3") == 0)
++#endif
+ #ifdef USE_BCRYPT
+ 		    || (strcmp (result, "BCRYPT") == 0)
+ #endif
+diff --git a/libmisc/salt.c b/libmisc/salt.c
+index 30eefb9..b108a23 100644
+--- a/libmisc/salt.c
++++ b/libmisc/salt.c
+@@ -55,6 +55,17 @@
+ #define SHA_ROUNDS_MAX 999999999
+ #endif
+ 
++#ifdef USE_SM3_CRYPT
++/* Fixed salt len for sm3 crypt. */
++#define SM3_CRYPT_SALT_SIZE 16
++/* Default number of rounds if not explicitly specified.  */
++#define SM3_ROUNDS_DEFAULT 5000
++/* Minimum number of rounds.  */
++#define SM3_ROUNDS_MIN 1000
++/* Maximum number of rounds.  */
++#define SM3_ROUNDS_MAX 999999999
++#endif
++
+ #ifdef USE_YESCRYPT
+ /*
+  * Default number of base64 characters used for the salt.
+@@ -87,13 +98,17 @@ static long read_random_bytes (void);
+ #if !USE_XCRYPT_GENSALT
+ static /*@observer@*/const char *gensalt (size_t salt_size);
+ #endif /* !USE_XCRYPT_GENSALT */
+-#if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT)
++#if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_SM3_CRYPT)
+ static long shadow_random (long min, long max);
+-#endif /* USE_SHA_CRYPT || USE_BCRYPT */
++#endif /* USE_SHA_CRYPT || USE_BCRYPT || USE_SM3_CRYPT*/
+ #ifdef USE_SHA_CRYPT
+ static /*@observer@*/const unsigned long SHA_get_salt_rounds (/*@null@*/int *prefered_rounds);
+ static /*@observer@*/void SHA_salt_rounds_to_buf (char *buf, unsigned long rounds);
+ #endif /* USE_SHA_CRYPT */
++#ifdef USE_SM3_CRYPT
++static /*@observer@*/const unsigned long SM3_get_salt_rounds (/*@null@*/int *prefered_rounds);
++static /*@observer@*/void SM3_salt_rounds_to_buf (char *buf, unsigned long rounds);
++#endif
+ #ifdef USE_BCRYPT
+ static /*@observer@*/const unsigned long BCRYPT_get_salt_rounds (/*@null@*/int *prefered_rounds);
+ static /*@observer@*/void BCRYPT_salt_rounds_to_buf (char *buf, unsigned long rounds);
+@@ -186,7 +201,7 @@ end:
+ 	return randval;
+ }
+ 
+-#if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT)
++#if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_SM3_CRYPT)
+ /*
+  * Return a random number between min and max (both included).
+  *
+@@ -208,7 +223,7 @@ static long shadow_random (long min, long max)
+ 	}
+ 	return ret;
+ }
+-#endif /* USE_SHA_CRYPT || USE_BCRYPT */
++#endif /* USE_SHA_CRYPT || USE_BCRYPT || USE_SM3_CRYPT*/
+ 
+ #ifdef USE_SHA_CRYPT
+ /* Return the the rounds number for the SHA crypt methods. */
+@@ -284,6 +299,80 @@ static /*@observer@*/void SHA_salt_rounds_to_buf (char *buf, unsigned long round
+ }
+ #endif /* USE_SHA_CRYPT */
+ 
++#ifdef USE_SM3_CRYPT
++/* Return the the rounds number for the SM3 crypt methods. */
++static /*@observer@*/const unsigned long SM3_get_salt_rounds (/*@null@*/int *prefered_rounds)
++{
++	unsigned long rounds;
++
++	if (NULL == prefered_rounds) {
++		long min_rounds = getdef_long ("SM3_CRYPT_MIN_ROUNDS", -1);
++		long max_rounds = getdef_long ("SM3_CRYPT_MAX_ROUNDS", -1);
++
++		if ((-1 == min_rounds) && (-1 == max_rounds)) {
++			rounds = SM3_ROUNDS_DEFAULT;

_service:tar_scm:useradd-avoid-generating-an-empty-subid-range.patch Added

@@ -0,0 +1,107 @@
+From 9dd720a28578eef5be8171697aae0906e4c53249 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Tue, 10 Aug 2021 09:07:03 +0200
+Subject: PATCH useradd: avoid generating an empty subid range
+
+useradd generates an empty subid range when adding a new user. This is
+caused because there are two variables, one local and the other one
+global, that have a very similar name and they are used indistinctly in
+the code. The local variable loads the SUB_*ID_COUNT configuration from
+the login.defs file, while the global variable, which holds a value of
+0, is used to generate the subid range. Causing the empty subid range
+problem.
+
+I've merged the two variables in the local one and removed the global
+variable. I prefer to do it this way to reduce the scope of it but I'm
+open to doing it the other way round.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1990653
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+Conflict: context adaptation
+---
+ src/useradd.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+diff --git a/src/useradd.c b/src/useradd.c
+index baeffb3..9abeea6 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -142,9 +142,7 @@ static bool is_sub_gid = false;
+ static bool sub_uid_locked = false;
+ static bool sub_gid_locked = false;
+ static uid_t sub_uid_start;	/* New subordinate uid range */
+-static unsigned long sub_uid_count;
+ static gid_t sub_gid_start;	/* New subordinate gid range */
+-static unsigned long sub_gid_count;
+ #endif				/* ENABLE_SUBIDS */
+ static bool pw_locked = false;
+ static bool gr_locked = false;
+@@ -234,7 +232,7 @@ static void open_shadow (void);
+ static void faillog_reset (uid_t);
+ static void lastlog_reset (uid_t);
+ static void tallylog_reset (const char *);
+-static void usr_update (void);
++static void usr_update (unsigned long subuid_count, unsigned long subgid_count);
+ static void create_home (void);
+ static void create_mail (void);
+ static void check_uid_range(int rflg, uid_t user_id);
+@@ -2092,7 +2090,7 @@ static void tallylog_reset (const char *user_name)
+  *	usr_update() creates the password file entries for this user
+  *	and will update the group entries if required.
+  */
+-static void usr_update (void)
++static void usr_update (unsigned long subuid_count, unsigned long subgid_count)
+ {
+ 	struct passwd pwent;
+ 	struct spwd spent;
+@@ -2155,14 +2153,14 @@ static void usr_update (void)
+ 	}
+ #ifdef ENABLE_SUBIDS
+ 	if (is_sub_uid &&
+-	    (sub_uid_add(user_name, sub_uid_start, sub_uid_count) == 0)) {
++	    (sub_uid_add(user_name, sub_uid_start, subuid_count) == 0)) {
+ 		fprintf (stderr,
+ 		         _("%s: failed to prepare the new %s entry\n"),
+ 		         Prog, sub_uid_dbname ());
+ 		fail_exit (E_SUB_UID_UPDATE);
+ 	}
+ 	if (is_sub_gid &&
+-	    (sub_gid_add(user_name, sub_gid_start, sub_gid_count) == 0)) {
++	    (sub_gid_add(user_name, sub_gid_start, subgid_count) == 0)) {
+ 		fprintf (stderr,
+ 		         _("%s: failed to prepare the new %s entry\n"),
+ 		         Prog, sub_uid_dbname ());
+@@ -2624,16 +2622,16 @@ int main (int argc, char **argv)
+ 	}
+ 
+ #ifdef ENABLE_SUBIDS
+-	if (is_sub_uid && sub_uid_count != 0) {
+-		if (find_new_sub_uids(&sub_uid_start, &sub_uid_count) < 0) {
++	if (is_sub_uid && subuid_count != 0) {
++		if (find_new_sub_uids(&sub_uid_start, &subuid_count) < 0) {
+ 			fprintf (stderr,
+ 			         _("%s: can't create subordinate user IDs\n"),
+ 			         Prog);
+ 			fail_exit(E_SUB_UID_UPDATE);
+ 		}
+ 	}
+-	if (is_sub_gid && sub_gid_count != 0) {
+-		if (find_new_sub_gids(&sub_gid_start, &sub_gid_count) < 0) {
++	if (is_sub_gid && subgid_count != 0) {
++		if (find_new_sub_gids(&sub_gid_start, &subgid_count) < 0) {
+ 			fprintf (stderr,
+ 			         _("%s: can't create subordinate group IDs\n"),
+ 			         Prog);
+@@ -2642,7 +2640,7 @@ int main (int argc, char **argv)
+ 	}
+ #endif				/* ENABLE_SUBIDS */
+ 
+-	usr_update ();
++	usr_update (subuid_count, subgid_count);
+ 
+ 	close_files ();
+
+-- 
+1.8.3.1
+

_service:tar_scm:useradd-change-SELinux-labels-for-home-files.patch Added

@@ -0,0 +1,34 @@
+From 06eb4e4d76ac7f1ac86e68a89b2dc9be7c7323a2 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Fri, 12 Nov 2021 15:23:30 +0100
+Subject: PATCH useradd: change SELinux labels for home files
+
+Change SELinux labels for files copied from the skeleton directory to
+the home directory.
+
+This could cause gnome's graphical user adding to fail without copying
+the full skeleton files.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2022658
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+---
+ src/useradd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/useradd.c b/src/useradd.c
+index b463a17..f7c9795 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -2704,7 +2704,7 @@ int main (int argc, char **argv)
+ 	if (mflg) {
+ 		create_home ();
+ 		if (home_added) {
+-			copy_tree (def_template, prefix_user_home, false, false,
++			copy_tree (def_template, prefix_user_home, false, true,
+ 			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
+ 		} else {
+ 			fprintf (stderr,
+-- 
+1.8.3.1
+

_service:tar_scm:useradd-create-directories-after-the-SELinux-user.patch Added

@@ -0,0 +1,89 @@
+From 09c752f00f9dfc610f66d68be38c9e5be8ca7f15 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Fri, 8 Oct 2021 13:09:59 +0200
+Subject: PATCH useradd: create directories after the SELinux user
+
+Create the home and mail folders after the SELinux user has been set for
+the added user. This will allow the folders to be created with the
+SELinux user label.
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+Conflict: context adaptation
+---
+ src/useradd.c | 46 +++++++++++++++++++++++-----------------------
+ 1 file changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/src/useradd.c b/src/useradd.c
+index 6269c01..b463a17 100644
+--- a/src/useradd.c
++++ b/src/useradd.c
+@@ -2670,27 +2670,12 @@ int main (int argc, char **argv)
+ 
+ 	usr_update ();
+ 
+-	if (mflg) {
+-		create_home ();
+-		if (home_added) {
+-			copy_tree (def_template, prefix_user_home, false, false,
+-			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
+-		} else {
+-			fprintf (stderr,
+-			         _("%s: warning: the home directory %s already exists.\n"
+-			           "%s: Not copying any file from skel directory into it.\n"),
+-			         Prog, user_home, Prog);
+-		}
+-
+-	}
+-
+-	/* Do not create mail directory for system accounts */
+-	if (!rflg) {
+-		create_mail ();
+-	}
+-
+ 	close_files ();
+ 
++	nscd_flush_cache ("passwd");
++	nscd_flush_cache ("group");
++	sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
++
+ 	/*
+ 	 * tallylog_reset needs to be able to lookup
+ 	 * a valid existing user name,
+@@ -2716,15 +2701,30 @@ int main (int argc, char **argv)
+ 	}
+ #endif				/* WITH_SELINUX */
+ 
++	if (mflg) {
++		create_home ();
++		if (home_added) {
++			copy_tree (def_template, prefix_user_home, false, false,
++			           (uid_t)-1, user_id, (gid_t)-1, user_gid);
++		} else {
++			fprintf (stderr,
++			         _("%s: warning: the home directory %s already exists.\n"
++			           "%s: Not copying any file from skel directory into it.\n"),
++			         Prog, user_home, Prog);
++		}
++
++	}
++
++	/* Do not create mail directory for system accounts */
++	if (!rflg) {
++		create_mail ();
++	}
++
+ 	if (run_parts ("/etc/shadow-maint/useradd-post.d", (char*)user_name,
+ 			"useradd")) {
+ 		exit(1);
+ 	}
+ 
+-	nscd_flush_cache ("passwd");
+-	nscd_flush_cache ("group");
+-	sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP);
+-
+ 	return E_SUCCESS;
+ }
+ 
+-- 
+1.8.3.1
+

_service:tar_scm:usermod-allow-all-group-types-with-G-option.patch Added

@@ -0,0 +1,322 @@
+From e481437ab9ebe9a8bf8fbaabe986d42b2f765991 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ipedrosa@redhat.com>
+Date: Tue, 3 Aug 2021 08:57:20 +0200
+Subject: PATCH usermod: allow all group types with -G option
+
+The only way of removing a group from the supplementary list is to use
+-G option, and list all groups that the user is a member of except for
+the one that wants to be removed. The problem lies when there's a user
+that contains both local and remote groups, and the group to be removed
+is a local one. As we need to include the remote group with -G option
+the command will fail.
+
+This reverts commit 140510de9de4771feb3af1d859c09604043a4c9b. This way,
+it would be possible to remove the remote groups from the supplementary
+list.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1967641
+Resolves: https://github.com/shadow-maint/shadow/issues/338
+
+Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
+---
+ src/usermod.c | 220 ++++++++++++++++++++--------------------------------------
+ 1 file changed, 77 insertions(+), 143 deletions(-)
+
+diff --git a/src/usermod.c b/src/usermod.c
+index 03bb9b9..a0c03af 100644
+--- a/src/usermod.c
++++ b/src/usermod.c
+@@ -187,7 +187,6 @@ static bool sub_gid_locked = false;
+ static void date_to_str (/*@unique@*//*@out@*/char *buf, size_t maxsize,
+                          long int date);
+ static int get_groups (char *);
+-static struct group * get_local_group (char * grp_name);
+ static /*@noreturn@*/void usage (int status);
+ static void new_pwent (struct passwd *);
+ static void new_spent (struct spwd *);
+@@ -201,9 +200,7 @@ static void grp_update (void);
+ 
+ static void process_flags (int, char **);
+ static void close_files (void);
+-static void close_group_files (void);
+ static void open_files (void);
+-static void open_group_files (void);
+ static void usr_update (void);
+ static void move_home (void);
+ static void update_lastlog (void);
+@@ -261,11 +258,6 @@ static int get_groups (char *list)
+ 	}
+ 
+ 	/*
+-	 * Open the group files
+-	 */
+-	open_group_files ();
+-
+-	/*
+ 	 * So long as there is some data to be converted, strip off each
+ 	 * name and look it up. A mix of numerical and string values for
+ 	 * group identifiers is permitted.
+@@ -284,7 +276,7 @@ static int get_groups (char *list)
+ 		 * Names starting with digits are treated as numerical GID
+ 		 * values, otherwise the string is looked up as is.
+ 		 */
+-		grp = get_local_group (list);
++		grp = prefix_getgr_nam_gid (list);
+ 
+ 		/*
+ 		 * There must be a match, either by GID value or by
+@@ -334,8 +326,6 @@ static int get_groups (char *list)
+ 		gr_free ((struct group *)grp);
+ 	} while (NULL != list);
+ 
+-	close_group_files ();
+-
+ 	user_groupsngroups = (char *) 0;
+ 
+ 	/*
+@@ -348,44 +338,6 @@ static int get_groups (char *list)
+ 	return 0;
+ }
+ 
+-/*
+- * get_local_group - checks if a given group name exists locally
+- *
+- *	get_local_group() checks if a given group name exists locally.
+- *	If the name exists the group information is returned, otherwise NULL is
+- *	returned.
+- */
+-static struct group * get_local_group(char * grp_name)
+-{
+-	const struct group *grp;
+-	struct group *result_grp = NULL;
+-	long long int gid;
+-	char *endptr;
+-
+-	gid = strtoll (grp_name, &endptr, 10);
+-	if (   ('\0' != *grp_name)
+-		&& ('\0' == *endptr)
+-		&& (ERANGE != errno)
+-		&& (gid == (gid_t)gid)) {
+-		grp = gr_locate_gid ((gid_t) gid);
+-	}
+-	else {
+-		grp = gr_locate(grp_name);
+-	}
+-
+-	if (grp != NULL) {
+-		result_grp = __gr_dup (grp);
+-		if (NULL == result_grp) {
+-			fprintf (stderr,
+-					_("%s: Out of memory. Cannot find group '%s'.\n"),
+-					Prog, grp_name);
+-			fail_exit (E_GRP_UPDATE);
+-		}
+-	}
+-
+-	return result_grp;
+-}
+-
+ #ifdef ENABLE_SUBIDS
+ struct ulong_range
+ {
+@@ -1523,7 +1475,50 @@ static void close_files (void)
+ 	}
+ 
+ 	if (Gflg || lflg) {
+-		close_group_files ();
++		if (gr_close () == 0) {
++			fprintf (stderr,
++			         _("%s: failure while writing changes to %s\n"),
++			         Prog, gr_dbname ());
++			SYSLOG ((LOG_ERR,
++			         "failure while writing changes to %s",
++			         gr_dbname ()));
++			fail_exit (E_GRP_UPDATE);
++		}
++#ifdef SHADOWGRP
++		if (is_shadow_grp) {
++			if (sgr_close () == 0) {
++				fprintf (stderr,
++				         _("%s: failure while writing changes to %s\n"),
++				         Prog, sgr_dbname ());
++				SYSLOG ((LOG_ERR,
++				         "failure while writing changes to %s",
++				         sgr_dbname ()));
++				fail_exit (E_GRP_UPDATE);
++			}
++		}
++#endif
++#ifdef SHADOWGRP
++		if (is_shadow_grp) {
++			if (sgr_unlock () == 0) {
++				fprintf (stderr,
++				         _("%s: failed to unlock %s\n"),
++				         Prog, sgr_dbname ());
++				SYSLOG ((LOG_ERR,
++				         "failed to unlock %s",
++				         sgr_dbname ()));
++				/* continue */
++			}
++		}
++#endif
++		if (gr_unlock () == 0) {
++			fprintf (stderr,
++			         _("%s: failed to unlock %s\n"),
++			         Prog, gr_dbname ());
++			SYSLOG ((LOG_ERR,
++			         "failed to unlock %s",
++			         gr_dbname ()));
++			/* continue */
++		}
+ 	}
+ 
+ 	if (is_shadow_pwd) {
+@@ -1593,60 +1588,6 @@ static void close_files (void)
+ }
+ 
+ /*
+- * close_group_files - close all of the files that were opened
+- *
+- *	close_group_files() closes all of the files that were opened related
+- *  with groups. This causes any modified entries to be written out.
+- */
+-static void close_group_files (void)
+-{
+-	if (gr_close () == 0) {
+-		fprintf (stderr,
+-					_("%s: failure while writing changes to %s\n"),
+-					Prog, gr_dbname ());
+-		SYSLOG ((LOG_ERR,
+-					"failure while writing changes to %s",
+-					gr_dbname ()));
+-		fail_exit (E_GRP_UPDATE);
+-	}
+-#ifdef SHADOWGRP
+-	if (is_shadow_grp) {
+-		if (sgr_close () == 0) {
+-			fprintf (stderr,
+-						_("%s: failure while writing changes to %s\n"),
+-						Prog, sgr_dbname ());

_service:tar_scm:usermod-unlock.patch Added

@@ -0,0 +1,65 @@
+Index: shadow-4.5/src/usermod.c
+===================================================================
+--- a/src/usermod.c
++++ b/src/usermod.c
+@@ -466,14 +466,17 @@ static char *new_pw_passwd (char *pw_pass)
+ 		strcat (buf, pw_pass);
+ 		pw_pass = buf;
+ 	} else if (Uflg && pw_pass0 == '!') {
+-		char *s;
++		char *s = pw_pass;
+ 
+-		if (pw_pass1 == '\0') {
++		while ('!' == *s)
++			++s;
++
++		if (*s == '\0') {
+ 			fprintf (stderr,
+ 			         _("%s: unlocking the user's password would result in a passwordless account.\n"
+ 			           "You should set a password with usermod -p to unlock this user's password.\n"),
+ 			         Prog);
+-			return pw_pass;
++			return NULL;
+ 		}
+ 
+ #ifdef WITH_AUDIT
+@@ -482,12 +485,15 @@ static char *new_pw_passwd (char *pw_pass)
+ 		              user_newname, (unsigned int) user_newid, 0);
+ #endif
+ 		SYSLOG ((LOG_INFO, "unlock user '%s' password", user_newname));
+-		s = pw_pass;
+-		while ('\0' != *s) {
+-			*s = *(s + 1);
+-			s++;
+-		}
++		memmove (pw_pass, s, strlen (s) + 1);
+ 	} else if (pflg) {
++		if (strchr (user_pass, ':') != NULL) {
++			fprintf (stderr,
++			         _("%s: The password field cannot contain a colon character.\n"),
++			         Prog);
++			return NULL;
++
++		}
+ #ifdef WITH_AUDIT
+ 		audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
+ 		              "changing password",
+@@ -536,6 +542,8 @@ static void new_pwent (struct passwd *pwent)
+ 	if (   (!is_shadow_pwd)
+ 	    || (strcmp (pwent->pw_passwd, SHADOW_PASSWD_STRING) != 0)) {
+ 		pwent->pw_passwd = new_pw_passwd (pwent->pw_passwd);
++		if (pwent->pw_passwd == NULL)
++			fail_exit (E_PW_UPDATE);
+ 	}
+ 
+ 	if (uflg) {
+@@ -650,6 +658,8 @@ static void new_spent (struct spwd *spent)
+ 	 *  + aging has been requested
+ 	 */
+ 	spent->sp_pwdp = new_pw_passwd (spent->sp_pwdp);
++	if (spent->sp_pwdp == NULL)
++		fail_exit(E_PW_UPDATE);
+ 
+ 	if (pflg) {
+ 		spent->sp_lstchg = (long) gettime () / SCALE;
+

_service Changed

_service:extract_file:chpasswd Deleted

_service:extract_file:gpl-2.0.txt Deleted

@@ -1,339 +0,0 @@
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 2, June 1991
-
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Lesser General Public License instead.)  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
-
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
-
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
-
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or

_service:extract_file:newusers Deleted

_service:extract_file:shadow-4.9.tar.xz Deleted

_service:extract_file:shadow-bsd.txt Deleted

@@ -1,32 +0,0 @@
-/*
- * Copyright (c) 1990 - 1994, Julianne Frances Haugh
- * Copyright (c) 1996 - 2000, Marek Michałkiewicz
- * Copyright (c) 2000 - 2006, Tomasz Kłoczko
- * Copyright (c) 2007 - 2011, Nicolas François
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the copyright holders or contributors may not be used to
- *    endorse or promote products derived from this software without
- *    specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
- * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
- * HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-

_service:extract_file:shadow-utils.login.defs Deleted

@@ -1,306 +0,0 @@
-#
-# Please note that the parameters in this configuration file control the
-# behavior of the tools from the shadow-utils component. None of these
-# tools uses the PAM mechanism, and the utilities that use PAM (such as the
-# passwd command) should therefore be configured elsewhere. Refer to
-# /etc/pam.d/system-auth for more information.
-#
-
-#
-# Delay in seconds before being allowed another attempt after a login failure
-# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
-#       pam_unix(8) enforces a 2s delay)
-#
-#FAIL_DELAY		3
-
-# Currently FAILLOG_ENAB is not supported
-
-#
-# Enable display of unknown usernames when login(1) failures are recorded.
-#
-#LOG_UNKFAIL_ENAB	no
-
-# Currently LOG_OK_LOGINS is not supported
-
-# Currently LASTLOG_ENAB is not supported
-
-#
-# Limit the highest user ID number for which the lastlog entries should
-# be updated.
-#
-# No LASTLOG_UID_MAX means that there is no user ID limit for writing
-# lastlog entries.
-#
-#LASTLOG_UID_MAX
-
-# Currently MAIL_CHECK_ENAB is not supported
-
-# Currently OBSCURE_CHECKS_ENAB is not supported
-
-# Currently PORTTIME_CHECKS_ENAB is not supported
-
-# Currently QUOTAS_ENAB is not supported
-
-# Currently SYSLOG_SU_ENAB is not supported
-
-#
-# Enable "syslog" logging of newgrp(1) and sg(1) activity.
-#
-#SYSLOG_SG_ENAB		yes
-
-# Currently CONSOLE is not supported
-
-# Currently SULOG_FILE is not supported
-
-# Currently MOTD_FILE is not supported
-
-# Currently ISSUE_FILE is not supported
-
-# Currently TTYTYPE_FILE is not supported
-
-# Currently FTMP_FILE is not supported
-
-# Currently NOLOGINS_FILE is not supported
-
-# Currently SU_NAME is not supported
-
-# *REQUIRED*
-#   Directory where mailboxes reside, _or_ name of file, relative to the
-#   home directory.  If you _do_ define both, MAIL_DIR takes precedence.
-#
-MAIL_DIR	/var/spool/mail
-#MAIL_FILE	.mail
-
-#
-# If defined, file which inhibits all the usual chatter during the login
-# sequence.  If a full pathname, then hushed mode will be enabled if the
-# user's name or shell are found in the file.  If not a full pathname, then
-# hushed mode will be enabled if the file exists in the user's home directory.
-#
-#HUSHLOGIN_FILE	.hushlogin
-#HUSHLOGIN_FILE	/etc/hushlogins
-
-# Currently ENV_TZ is not supported
-
-# Currently ENV_HZ is not supported
-
-#
-# The default PATH settings, for superuser and normal users.
-#
-# (they are minimal, add the rest in the shell startup files)
-#ENV_SUPATH	PATH=/sbin:/bin:/usr/sbin:/usr/bin
-#ENV_PATH	PATH=/bin:/usr/bin
-
-#
-# Terminal permissions
-#
-#	TTYGROUP	Login tty will be assigned this group ownership.
-#	TTYPERM		Login tty will be set to this permission.
-#
-# If you have a write(1) program which is "setgid" to a special group
-# which owns the terminals, define TTYGROUP as the number of such group
-# and TTYPERM as 0620.  Otherwise leave TTYGROUP commented out and
-# set TTYPERM to either 622 or 600.
-#
-#TTYGROUP	tty
-#TTYPERM		0600
-
-# Currently ERASECHAR, KILLCHAR and ULIMIT are not supported
-
-# Default initial "umask" value used by login(1) on non-PAM enabled systems.
-# Default "umask" value for pam_umask(8) on PAM enabled systems.
-# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
-# home directories if HOME_MODE is not set.
-# 022 is the default value, but 027, or even 077, could be considered
-# for increased privacy. There is no One True Answer here: each sysadmin
-# must make up their mind.
-UMASK		077
-
-# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
-# home directories.
-# If HOME_MODE is not set, the value of UMASK is used to create the mode.
-#HOME_MODE	0700
-
-# Password aging controls:
-#
-#	PASS_MAX_DAYS	Maximum number of days a password may be used.
-#	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
-#	PASS_MIN_LEN	Minimum acceptable password length.
-#	PASS_WARN_AGE	Number of days warning given before a password expires.
-#
-PASS_MAX_DAYS	99999
-PASS_MIN_DAYS	0
-PASS_MIN_LEN	5
-PASS_WARN_AGE	7
-
-# Currently PASS_MIN_LEN is not supported
-
-# Currently SU_WHEEL_ONLY is not supported
-
-# Currently CRACKLIB_DICTPATH is not supported
-
-#
-# Min/max values for automatic uid selection in useradd(8)
-#
-UID_MIN                  1000
-UID_MAX                 60000
-# System accounts
-SYS_UID_MIN               201
-SYS_UID_MAX               999
-# Extra per user uids
-SUB_UID_MIN		   100000
-SUB_UID_MAX		600100000
-SUB_UID_COUNT		    65536
-
-#
-# Min/max values for automatic gid selection in groupadd(8)
-#
-GID_MIN                  1000
-GID_MAX                 60000
-# System accounts
-SYS_GID_MIN               201
-SYS_GID_MAX               999
-# Extra per user group ids
-SUB_GID_MIN		   100000
-SUB_GID_MAX		600100000
-SUB_GID_COUNT		    65536
-
-#
-# Max number of login(1) retries if password is bad
-#
-#LOGIN_RETRIES		3
-
-#
-# Max time in seconds for login(1)
-#
-#LOGIN_TIMEOUT		60
-
-# Currently PASS_CHANGE_TRIES is not supported
-
-# Currently PASS_ALWAYS_WARN is not supported
-
-# Currently PASS_MAX_LEN is not supported
-
-# Currently CHFN_AUTH is not supported
-
-#
-# Which fields may be changed by regular users using chfn(1) - use
-# any combination of letters "frwh" (full name, room number, work
-# phone, home phone).  If not defined, no changes are allowed.
-# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
-# 
-#CHFN_RESTRICT		rwh
-
-# Currently LOGIN_STRING is not supported
-
-# Currently MD5_CRYPT_ENAB is not supported
-
-#
-# If set to MD5, MD5-based algorithm will be used for encrypting password

_service:extract_file:shadow-utils.useradd Deleted

_service:extract_file:shadow.yaml Deleted

_service:tar_scm:chpasswd Added

_service:tar_scm:gpl-2.0.txt Added

@@ -0,0 +1,339 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or

_service:tar_scm:newusers Added

_service:tar_scm:shadow-1645414072.92b6fbc.tar -> _service:tar_scm:shadow-4.9.tar.xz Changed

_service:tar_scm:shadow-bsd.txt Added

@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 1990 - 1994, Julianne Frances Haugh
+ * Copyright (c) 1996 - 2000, Marek Michałkiewicz
+ * Copyright (c) 2000 - 2006, Tomasz Kłoczko
+ * Copyright (c) 2007 - 2011, Nicolas François
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the copyright holders or contributors may not be used to
+ *    endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+

_service:tar_scm:shadow-utils.login.defs Added

@@ -0,0 +1,306 @@
+#
+# Please note that the parameters in this configuration file control the
+# behavior of the tools from the shadow-utils component. None of these
+# tools uses the PAM mechanism, and the utilities that use PAM (such as the
+# passwd command) should therefore be configured elsewhere. Refer to
+# /etc/pam.d/system-auth for more information.
+#
+
+#
+# Delay in seconds before being allowed another attempt after a login failure
+# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
+#       pam_unix(8) enforces a 2s delay)
+#
+#FAIL_DELAY		3
+
+# Currently FAILLOG_ENAB is not supported
+
+#
+# Enable display of unknown usernames when login(1) failures are recorded.
+#
+#LOG_UNKFAIL_ENAB	no
+
+# Currently LOG_OK_LOGINS is not supported
+
+# Currently LASTLOG_ENAB is not supported
+
+#
+# Limit the highest user ID number for which the lastlog entries should
+# be updated.
+#
+# No LASTLOG_UID_MAX means that there is no user ID limit for writing
+# lastlog entries.
+#
+#LASTLOG_UID_MAX
+
+# Currently MAIL_CHECK_ENAB is not supported
+
+# Currently OBSCURE_CHECKS_ENAB is not supported
+
+# Currently PORTTIME_CHECKS_ENAB is not supported
+
+# Currently QUOTAS_ENAB is not supported
+
+# Currently SYSLOG_SU_ENAB is not supported
+
+#
+# Enable "syslog" logging of newgrp(1) and sg(1) activity.
+#
+#SYSLOG_SG_ENAB		yes
+
+# Currently CONSOLE is not supported
+
+# Currently SULOG_FILE is not supported
+
+# Currently MOTD_FILE is not supported
+
+# Currently ISSUE_FILE is not supported
+
+# Currently TTYTYPE_FILE is not supported
+
+# Currently FTMP_FILE is not supported
+
+# Currently NOLOGINS_FILE is not supported
+
+# Currently SU_NAME is not supported
+
+# *REQUIRED*
+#   Directory where mailboxes reside, _or_ name of file, relative to the
+#   home directory.  If you _do_ define both, MAIL_DIR takes precedence.
+#
+MAIL_DIR	/var/spool/mail
+#MAIL_FILE	.mail
+
+#
+# If defined, file which inhibits all the usual chatter during the login
+# sequence.  If a full pathname, then hushed mode will be enabled if the
+# user's name or shell are found in the file.  If not a full pathname, then
+# hushed mode will be enabled if the file exists in the user's home directory.
+#
+#HUSHLOGIN_FILE	.hushlogin
+#HUSHLOGIN_FILE	/etc/hushlogins
+
+# Currently ENV_TZ is not supported
+
+# Currently ENV_HZ is not supported
+
+#
+# The default PATH settings, for superuser and normal users.
+#
+# (they are minimal, add the rest in the shell startup files)
+#ENV_SUPATH	PATH=/sbin:/bin:/usr/sbin:/usr/bin
+#ENV_PATH	PATH=/bin:/usr/bin
+
+#
+# Terminal permissions
+#
+#	TTYGROUP	Login tty will be assigned this group ownership.
+#	TTYPERM		Login tty will be set to this permission.
+#
+# If you have a write(1) program which is "setgid" to a special group
+# which owns the terminals, define TTYGROUP as the number of such group
+# and TTYPERM as 0620.  Otherwise leave TTYGROUP commented out and
+# set TTYPERM to either 622 or 600.
+#
+#TTYGROUP	tty
+#TTYPERM		0600
+
+# Currently ERASECHAR, KILLCHAR and ULIMIT are not supported
+
+# Default initial "umask" value used by login(1) on non-PAM enabled systems.
+# Default "umask" value for pam_umask(8) on PAM enabled systems.
+# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
+# home directories if HOME_MODE is not set.
+# 022 is the default value, but 027, or even 077, could be considered
+# for increased privacy. There is no One True Answer here: each sysadmin
+# must make up their mind.
+UMASK		077
+
+# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
+# home directories.
+# If HOME_MODE is not set, the value of UMASK is used to create the mode.
+#HOME_MODE	0700
+
+# Password aging controls:
+#
+#	PASS_MAX_DAYS	Maximum number of days a password may be used.
+#	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
+#	PASS_MIN_LEN	Minimum acceptable password length.
+#	PASS_WARN_AGE	Number of days warning given before a password expires.
+#
+PASS_MAX_DAYS	99999
+PASS_MIN_DAYS	0
+PASS_MIN_LEN	5
+PASS_WARN_AGE	7
+
+# Currently PASS_MIN_LEN is not supported
+
+# Currently SU_WHEEL_ONLY is not supported
+
+# Currently CRACKLIB_DICTPATH is not supported
+
+#
+# Min/max values for automatic uid selection in useradd(8)
+#
+UID_MIN                  1000
+UID_MAX                 60000
+# System accounts
+SYS_UID_MIN               201
+SYS_UID_MAX               999
+# Extra per user uids
+SUB_UID_MIN		   100000
+SUB_UID_MAX		600100000
+SUB_UID_COUNT		    65536
+
+#
+# Min/max values for automatic gid selection in groupadd(8)
+#
+GID_MIN                  1000
+GID_MAX                 60000
+# System accounts
+SYS_GID_MIN               201
+SYS_GID_MAX               999
+# Extra per user group ids
+SUB_GID_MIN		   100000
+SUB_GID_MAX		600100000
+SUB_GID_COUNT		    65536
+
+#
+# Max number of login(1) retries if password is bad
+#
+#LOGIN_RETRIES		3
+
+#
+# Max time in seconds for login(1)
+#
+#LOGIN_TIMEOUT		60
+
+# Currently PASS_CHANGE_TRIES is not supported
+
+# Currently PASS_ALWAYS_WARN is not supported
+
+# Currently PASS_MAX_LEN is not supported
+
+# Currently CHFN_AUTH is not supported
+
+#
+# Which fields may be changed by regular users using chfn(1) - use
+# any combination of letters "frwh" (full name, room number, work
+# phone, home phone).  If not defined, no changes are allowed.
+# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
+# 
+#CHFN_RESTRICT		rwh
+
+# Currently LOGIN_STRING is not supported
+
+# Currently MD5_CRYPT_ENAB is not supported
+
+#
+# If set to MD5, MD5-based algorithm will be used for encrypting password

_service:tar_scm:shadow-utils.useradd Added

_service:tar_scm:shadow.yaml Added

Changes of Revision 2