[PATCH 0/2] shadow: upgrade to 4.20.0

[PATCH 0/2] shadow: upgrade to 4.20.0

[Jaipaul Cheernam]

Upgrade shadow from 4.19.4 to 4.20.0.

Release notes: https://github.com/shadow-maint/shadow/releases/tag/4.20.0

This is a breaking release that removes several programs deprecated in
4.19, notably groupmems(8), expiry(1), and logoutd(8). The upstream
recommendation is to use usermod(8) in place of groupmems.

Patch 1 handles the recipe upgrade itself - three patches are dropped
(the code they patched no longer exists) and one backport is added for a
build fix that landed in master after the release.

Patch 2 is a follow-up to remove groupmems from the useradd.bbclass
sysroot setup, since the binary no longer ships. The class was already
emulating groupmems via usermod, so this just removes the dead code path
that was triggering warnings.

Tested with a full core-image-sysext build on qemux86-64.

Jaipaul Cheernam (2):
  shadow: upgrade 4.19.4 -> 4.20.0
  useradd.bbclass: drop groupmems from sysroot setup

 meta/classes/useradd.bbclass                  |   7 +-
 ...001-subid-Add-stdint.h-for-uintmax_t.patch |  43 +++++++
 .../shadow/files/disable_syslog.patch         |  23 ----
 .../shadow/files/prototypes.patch             |  38 ------
 .../shadow/files/shadow-update-pam-conf.patch | 110 ------------------
 .../{shadow_4.19.4.bb => shadow_4.20.0.bb}    |   8 +-
 6 files changed, 47 insertions(+), 182 deletions(-)
 create mode 100644 meta/recipes-extended/shadow/files/0001-subid-Add-stdint.h-for-uintmax_t.patch
 delete mode 100644 meta/recipes-extended/shadow/files/disable_syslog.patch
 delete mode 100644 meta/recipes-extended/shadow/files/prototypes.patch
 delete mode 100644 meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch
 rename meta/recipes-extended/shadow/{shadow_4.19.4.bb => shadow_4.20.0.bb} (97%)

[PATCH 1/2] shadow: upgrade 4.19.4 -> 4.20.0

[Jaipaul Cheernam]

Changelog: https://github.com/shadow-maint/shadow/releases/tag/4.20.0

Notable upstream changes:
- expiry(1): removed (deprecated in 4.19)
- groupmems(8): removed, use usermod(8) instead (deprecated in 4.19)
- logoutd(8): removed (deprecated in 4.19)
- PAM configs for setuid account tools removed (08f27babeb2c)
- login.defs(5): ENCRYPT_METHOD now defaults to SHA512
- Removed unused dependency on libattr
- New --disable-syslog configure option

Patches removed:
- prototypes.patch: patched src/expiry.c and src/logoutd.c which were
  removed upstream in commits 2bb1b984 and eec97ce4.
- disable_syslog.patch: shadow now supports --disable-syslog configure
  option natively. Added to EXTRA_OECONF for class-native instead.
- shadow-update-pam-conf.patch: the files it patched (chgpasswd,
  groupadd, groupdel, groupmod, useradd, userdel, usermod) were removed
  upstream in commit 08f27babeb2c. The remaining pam.d files in the
  tarball are all overridden by the recipe's own PAM files.

Patches added:
- 0001-subid-Add-stdint.h-for-uintmax_t.patch: backport of upstream
  commit ba4419c57b22 fixing missing <stdint.h> include causing build
  failure in find_new_sub_uids.c and find_new_sub_gids.c.

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 ...001-subid-Add-stdint.h-for-uintmax_t.patch |  43 +++++++
 .../shadow/files/disable_syslog.patch         |  23 ----
 .../shadow/files/prototypes.patch             |  38 ------
 .../shadow/files/shadow-update-pam-conf.patch | 110 ------------------
 .../{shadow_4.19.4.bb => shadow_4.20.0.bb}    |   8 +-
 5 files changed, 46 insertions(+), 176 deletions(-)
 create mode 100644 meta/recipes-extended/shadow/files/0001-subid-Add-stdint.h-for-uintmax_t.patch
 delete mode 100644 meta/recipes-extended/shadow/files/disable_syslog.patch
 delete mode 100644 meta/recipes-extended/shadow/files/prototypes.patch
 delete mode 100644 meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch
 rename meta/recipes-extended/shadow/{shadow_4.19.4.bb => shadow_4.20.0.bb} (97%)

diff --git a/meta/recipes-extended/shadow/files/0001-subid-Add-stdint.h-for-uintmax_t.patch b/meta/recipes-extended/shadow/files/0001-subid-Add-stdint.h-for-uintmax_t.patch
new file mode 100644
index 0000000000..5679be0e61
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/0001-subid-Add-stdint.h-for-uintmax_t.patch
@@ -0,0 +1,43 @@
+From ba4419c57b222b0d34a2b933e7ee92914a51b596 Mon Sep 17 00:00:00 2001
+From: ojab <ojab@ojab.ru>
+Date: Wed, 29 Jul 2026 15:07:43 +0000
+Subject: [PATCH] subid: Add `<stdint.h>` for `uintmax_t`
+
+```
+find_new_sub_uids.c:80:27: error: 'uintmax_t' undeclared (first use in this function)
+find_new_sub_gids.c:80:27: error: 'uintmax_t' undeclared (first use in this function)
+```
+
+Fixes: 4d800cf2eb9e (2026-04-09; "subid: Add deterministic subid ranges")
+
+Upstream-Status: Backport [https://github.com/shadow-maint/shadow/commit/ba4419c57b222b0d34a2b933e7ee92914a51b596]
+Signed-off-by: ojab <ojab@ojab.ru>
+---
+ lib/find_new_sub_gids.c | 1 +
+ lib/find_new_sub_uids.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/lib/find_new_sub_gids.c b/lib/find_new_sub_gids.c
+index 3971ce922e..de514d6b09 100644
+--- a/lib/find_new_sub_gids.c
++++ b/lib/find_new_sub_gids.c
+@@ -8,6 +8,7 @@
+ 
+ #ifdef ENABLE_SUBIDS
+ 
++#include <stdint.h>
+ #include <stdio.h>
+ #include <errno.h>
+ 
+diff --git a/lib/find_new_sub_uids.c b/lib/find_new_sub_uids.c
+index 65f6815467..f0b4328387 100644
+--- a/lib/find_new_sub_uids.c
++++ b/lib/find_new_sub_uids.c
+@@ -8,6 +8,7 @@
+ 
+ #ifdef ENABLE_SUBIDS
+ 
++#include <stdint.h>
+ #include <stdio.h>
+ #include <errno.h>
+ 
diff --git a/meta/recipes-extended/shadow/files/disable_syslog.patch b/meta/recipes-extended/shadow/files/disable_syslog.patch
deleted file mode 100644
index 9f8ffcd379..0000000000
--- a/meta/recipes-extended/shadow/files/disable_syslog.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-When building images using shadow-native, we shouldn't be spamming the host's
-log with lots of syslog messages which aren't relavent. Disable syslog use
-in the native case.
-
-Upstream-Status: Inappropriate [upstream has accepted a better patch at https://github.com/shadow-maint/shadow/pull/1618]
-Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-Signed-off-by: Dmitry Sakhonchik <frezidok1@gmail.com>
-
-Index: shadow-4.17.2/lib/defines.h
-===================================================================
---- shadow-4.17.2.orig/lib/defines.h
-+++ shadow-4.17.2/lib/defines.h
-@@ -88,7 +88,9 @@
- 
- /* cleaner than lots of #ifdefs everywhere - use this as follows:
-    SYSLOG((LOG_CRIT, "user %s cracked root", user)); */
--#ifdef ENABLE_NLS
-+#if 1
-+#define SYSLOG(x)
-+#elif ENABLE_NLS
- /* Temporarily set LC_TIME to "C" to avoid strange dates in syslog.
-    This is a workaround for a more general syslog(d) design problem -
-    syslogd should log the current system time for each event, and not
diff --git a/meta/recipes-extended/shadow/files/prototypes.patch b/meta/recipes-extended/shadow/files/prototypes.patch
deleted file mode 100644
index dfdfc9b47a..0000000000
--- a/meta/recipes-extended/shadow/files/prototypes.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-Give unused function arguments names as GCC 10 will fail otherwise.
-
-This is a continuation of a PR that has been merged upstream[1] but
-this merged after expiry.c[2] and logout.c[3] were removed.
-
-[1] shadow cb0ec030 ("Fix build failure on hosts with gcc 10")
-[2] shadow 2bb1b984 ("*/: expiry(1): Remove program")
-[3] shadow eec97ce4 ("Remove unused `logoutd` utility")
-
-Upstream-Status: Inappropriate [code no longer exists upstream]
-Signed-off-by: Ross Burton <ross.burton@arm.com>
-
-diff --git a/src/expiry.c b/src/expiry.c
-index 8da89bd..0abf011 100644
---- a/src/expiry.c
-+++ b/src/expiry.c
-@@ -37,7 +37,7 @@ static void process_flags (int argc, char **argv);
-  * catch_signals - signal catcher
-  */
- static void
--catch_signals(int)
-+catch_signals(MAYBE_UNUSED int _1)
- {
- 	_exit (10);
- }
-diff --git a/src/logoutd.c b/src/logoutd.c
-index c87b75c..09a24b3 100644
---- a/src/logoutd.c
-+++ b/src/logoutd.c
-@@ -116,7 +116,7 @@ static void send_mesg_to_tty (int tty_fd)
-  *	off from the system.
-  */
- int
--main(int argc, char *[])
-+main(int argc, char *argv[])
- {
- 	pid_t  pid;
- 
diff --git a/meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch b/meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch
deleted file mode 100644
index 318e2665c2..0000000000
--- a/meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From eb17cd91d8e4d76ee95de9c0c9f4938ba2e3e82a Mon Sep 17 00:00:00 2001
-From: Kang Kai <kai.kang@windriver.com>
-Date: Wed, 20 Jul 2011 19:18:14 +0800
-Subject: [PATCH] shadow: update pam related configure files
-
-The system-auth in the configure files is from Fedora which put all the 4 pam type rules
-in one file.
-In yocto it obey the way with Debian/Ubuntu, and the names are common-auth, common-account,
-common-password and common-session.
-So update them with oe way.
-
-See meta/recipes-extended/pam/libpam/pam.d/common-password
-
-Upstream-Status: Inappropriate [oe-core specific]
-
-Signed-off-by: Kang Kai <kai.kang@windriver.com>
----
- etc/pam.d/chgpasswd | 2 +-
- etc/pam.d/groupadd  | 2 +-
- etc/pam.d/groupdel  | 2 +-
- etc/pam.d/groupmems | 2 +-
- etc/pam.d/groupmod  | 2 +-
- etc/pam.d/useradd   | 2 +-
- etc/pam.d/userdel   | 2 +-
- etc/pam.d/usermod   | 2 +-
- 8 files changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/etc/pam.d/chgpasswd b/etc/pam.d/chgpasswd
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/chgpasswd
-+++ b/etc/pam.d/chgpasswd
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth		sufficient	pam_rootok.so
- account		required	pam_permit.so
--password	include		system-auth
-+password	include		common-password
-diff --git a/etc/pam.d/groupadd b/etc/pam.d/groupadd
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/groupadd
-+++ b/etc/pam.d/groupadd
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth		sufficient	pam_rootok.so
- account		required	pam_permit.so
--password	include		system-auth
-+password	include		common-password
-diff --git a/etc/pam.d/groupdel b/etc/pam.d/groupdel
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/groupdel
-+++ b/etc/pam.d/groupdel
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth		sufficient	pam_rootok.so
- account		required	pam_permit.so
--password	include		system-auth
-+password	include		common-password
-diff --git a/etc/pam.d/groupmems b/etc/pam.d/groupmems
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/groupmems
-+++ b/etc/pam.d/groupmems
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth		sufficient	pam_rootok.so
- account		required	pam_permit.so
--password	include		system-auth
-+password	include		common-password
-diff --git a/etc/pam.d/groupmod b/etc/pam.d/groupmod
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/groupmod
-+++ b/etc/pam.d/groupmod
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth		sufficient	pam_rootok.so
- account		required	pam_permit.so
--password	include		system-auth
-+password	include		common-password
-diff --git a/etc/pam.d/useradd b/etc/pam.d/useradd
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/useradd
-+++ b/etc/pam.d/useradd
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth		sufficient	pam_rootok.so
- account		required	pam_permit.so
--password	include		system-auth
-+password	include		common-password
-diff --git a/etc/pam.d/userdel b/etc/pam.d/userdel
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/userdel
-+++ b/etc/pam.d/userdel
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth		sufficient	pam_rootok.so
- account		required	pam_permit.so
--password	include		system-auth
-+password	include		common-password
-diff --git a/etc/pam.d/usermod b/etc/pam.d/usermod
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/usermod
-+++ b/etc/pam.d/usermod
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth		sufficient	pam_rootok.so
- account		required	pam_permit.so
--password	include		system-auth
-+password	include		common-password
--- 
-2.43.0
-
diff --git a/meta/recipes-extended/shadow/shadow_4.19.4.bb b/meta/recipes-extended/shadow/shadow_4.20.0.bb
similarity index 97%
rename from meta/recipes-extended/shadow/shadow_4.19.4.bb
rename to meta/recipes-extended/shadow/shadow_4.20.0.bb
index d9ff20c22c..bb247cee9d 100644
--- a/meta/recipes-extended/shadow/shadow_4.19.4.bb
+++ b/meta/recipes-extended/shadow/shadow_4.20.0.bb
@@ -14,19 +14,17 @@ GITHUB_BASE_URI = "https://github.com/shadow-maint/shadow/releases"
 SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BP}.tar.gz \
            ${@bb.utils.contains('PACKAGECONFIG', 'pam', '${PAM_SRC_URI}', '', d)} \
            file://useradd \
-		   file://prototypes.patch \
+           file://0001-subid-Add-stdint.h-for-uintmax_t.patch \
            "
 
 SRC_URI:append:class-target = " \
            file://login_defs_pam.sed \
-           file://shadow-update-pam-conf.patch \
            "
 
 SRC_URI:append:class-native = " \
-           file://disable_syslog.patch \
            file://notallylog.patch \
            "
-SRC_URI[sha256sum] = "ba7e9aed1c5420203ac549583d6e6f485a819ac7505af9c7cd8c13b2013210b8"
+SRC_URI[sha256sum] = "5e1eee2709a540ac07e4e5bb0d30f7b97d6ee1e3714ef527047fe2ffb5fdaa5c"
 UPSTREAM_CHECK_REGEX = "releases/tag/v?(?P<pver>\d+(\.\d+)+)$"
 
 # Additional Policy files for PAM
@@ -54,7 +52,7 @@ CACHED_CONFIGUREVARS += "ac_cv_lib_econf_econf_readDirs=no"
 CFLAGS:append:libc-musl = " -DLIBBSD_OVERLAY"
 
 NSCDOPT = ""
-NSCDOPT:class-native = "--without-nscd"
+NSCDOPT:class-native = "--without-nscd --disable-syslog"
 NSCDOPT:class-nativesdk = "--without-nscd"
 NSCDOPT:libc-glibc = "--with-nscd"
 

[PATCH 2/2] useradd.bbclass: drop groupmems from sysroot setup

[Jaipaul Cheernam]

groupmems was removed from shadow 4.20.0 [1]. The useradd class never
actually called the binary - perform_groupmems already uses usermod.
Drop it from the sysroot loop to silence the warnings.

[1] https://github.com/shadow-maint/shadow/pull/1601

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 meta/classes/useradd.bbclass | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/meta/classes/useradd.bbclass b/meta/classes/useradd.bbclass
index d6e1df2bd6..e9e835e1a2 100644
--- a/meta/classes/useradd.bbclass
+++ b/meta/classes/useradd.bbclass
@@ -131,10 +131,6 @@ usermod_sysroot() {
 	common_useradd_sysroot usermod
 }
 
-groupmems_sysroot() {
-	common_useradd_sysroot groupmems
-}
-
 common_useradd_sysroot() {
 	# Pseudo may (do_prepare_recipe_sysroot) or may not (do_populate_sysroot_setscene) be running 
 	# at this point so we're explicit about the environment so pseudo can load if 
@@ -168,7 +164,6 @@ common_useradd_sysroot() {
 		groupadd) GROUPADD_PARAM="${@get_all_cmd_params(d, 'groupadd')}";;
 		useradd) USERADD_PARAM="${@get_all_cmd_params(d, 'useradd')}";;
 		usermod) USERMOD_PARAM="${@get_all_cmd_params(d, 'usermod')}";;
-		groupmems) GROUPMEMS_PARAM="${@get_all_cmd_params(d, 'groupmems')}";;
 	esac
 
 	# Tell the system to use the environment vars
@@ -184,7 +179,7 @@ common_useradd_sysroot() {
 EXTRA_STAGING_FIXMES += "PSEUDO_SYSROOT PSEUDO_LOCALSTATEDIR LOGFIFO"
 
 python useradd_sysroot_sstate() {
-    for cmd, sort_prefix in [("groupadd", "01"), ("useradd", "02"), ("usermod", "03"), ("groupmems", "04")]:
+    for cmd, sort_prefix in [("groupadd", "01"), ("useradd", "02"), ("usermod", "03")]:
         scriptfile = None
         task = d.getVar("BB_CURRENTTASK")
         if task == "package_setscene":