shadow-4.20.2

[Bruce Dubbs]

New point version.

[Bruce Dubbs]

shadow-4.20.2

Regression fixes:

• lib/: Add missing include.

Other changes:

• Remove unused build flag

4.20.0

    Removals:

    The following programs and features were deprecated in 4.19 (Herve)
    or earlier, and have been removed in 4.20.

        expiry(1) (deprecated in 4.19)

        login.defs(5): ENCRYPT_METHOD: DES (deprecated in 4.19)

        login.defs(5): ENCRYPT_METHOD: MD5 (deprecated in 4.19)

        login.defs(5): MD5_CRPYT_ENAB (deprecated since the dinosaurs were around)

        shadow(5): .sp_min (deprecated in 4.19)

        This also includes the following removals:
            chage(1): -m,--mindays (also the interactive version)
            passwd(1): -n,--mindays
            login.defs(5): PASS_MIN_DAYS

        This feature is considered a vulnerability, and was removed
        without replacement.

        Programs will now fail when any of those flags or variable are
        specified. This is intentional, and should help identify any
        scripts that rely on these.

        groupmems(8) (deprecated in 4.19)

        Use usermod(8) instead.

        logoutd(8) (deprecated in 4.19)

    Defaults:

    The following default values were changed.

        login.defs(5): Remove defaults for password expiration
        (PASS_MAX_DAYS, PASS_WARN_AGE)

        login.defs(5): ENCRYPT_METHOD: Default to SHA512 (previously, it was DES)

        Users should still explicitly specify it, since other programs
        that read login.defs(5) may still default to DES.

    Features

    The following features that were optional in 4.19 are now
    unconditionally supported in 4.20.

        SHA256, SHA512

    Regressions

    Some regressions have been introduced (as side effects of bug fixes)
    and they're here to stay. Users must adapt.
        su(1) as root can be dangerous because of an ioctl (TIOCSTI),
        and if that ioctl is not disabled, su(1) will now fail and
        report an error.

        usermod(8) doesn't produce any effects if it fails to unlock a
        password because there was no password. Previously, this was just
        a warning, and thus produced effects.

Dependencies:

    We've removed an unused dependency (libattr).

Deprecations

No new deprecations since 4.19. However, we maintain the
deprecations from then. Here's a reminder of deprecated features
that have not been removed yet (they will eventually be removed):

    Password aging:
        chage(1):
        -I,--inactive (also the interactive version)
        -M,--maxdays (also the interactive version)
        -W,--warndays (also the interactive version)
        passwd(1):
        -k,--keep-tokens
        -x,--maxdays
        -i,--inactive
        -w,--warndays
        useradd(8):
        -f,--inactive
        usermod(8):
        -f,--inactive
        login.defs(5):
        PASS_MAX_DAYS
        PASS_WARN_AGE
        /etc/default/useradd:
        INACTIVE
        shadow(5):
        .sp_lstchg: Restrict to just the values 0 and empty.
        .sp_max
        .sp_warn
        .sp_inact

[Bruce Dubbs]

Fixed at commit 88e6ea998d.

    Update to iana-etc-20260805.
    Update to libffi-3.8.0.
    Update to linux-7.1.8.
    Update to meson-1.12.0.
    Update to procps-ng-4.0.7.
    Update to setuptools-84.0.0 (Python module).
    Update to shadow-4.20.2.
    Update to vim-9.2.0954.
    Update to wheel-0.48.0 (Python module).