shadow-4.20.3

Regression fixes:

• Build error when using '--with-nscd=no' (bug introduced in v4.19.0).

Shell history of the build of the tarballs:

 1962  2026-09-23 20:15:45+0200 git clean -dffx
 1963  2026-09-23 20:16:18+0200 ./autogen.sh 
 1964  2026-09-23 20:16:37+0200 make -j4
 1965  2026-09-23 20:17:31+0200 make dist
 1966  2026-09-23 20:19:43+0200 gpg --detach-sign --armor shadow-4.20.3.tar.gz 
 1967  2026-09-23 20:19:47+0200 gpg --detach-sign --armor shadow-4.20.3.tar.xz 
 1968  2026-09-23 20:20:16+0200 git archive -o shadow-4.20.3_src.tar 4.20.3
 1969  2026-09-23 20:20:23+0200 gpg --detach-sign --armor shadow-4.20.3_src.tar 
 1970  2026-09-23 20:20:34+0200 gzip -nk shadow-4.20.3_src.tar
 1971  2026-09-23 20:20:43+0200 xz -k shadow-4.20.3_src.tar
 1972  2026-09-23 20:22:05+0200 history

#1715

Historical release.

@marekm72 said:

This is the oldest version of this code I could find, mostly of historical interest. I'd suggest to archive it here as well.

https://ftp.funet.fi/pub/linux/tools/shadow-3.3.1.tar.gz
md5sum: ed517f66e99d9e27f01fcbfd05111ef1

I think the original author (whose name has changed) and a few very early contributors mentioned there deserve special mention in AUTHORS.md - this was before the license change, and me becoming the maintainer of the Linux port in 1995. Oldest copyright notices date back to 1988, older than the Linux kernel.

shadow-4.20.2

Regression fixes:

• lib/: Add missing include.

Other changes:

• Remove unused build flag

Binary tarballs produced and signed with:

$ ./autogen.sh 
$ make -j4
$ make dist
$ gpg --detach-sign --armor shadow-4.20.2.tar.gz 
$ gpg --detach-sign --armor shadow-4.20.2.tar.xz

Source tarballs produced and signed with:

$ git archive -o shadow-4.20.2_src.tar 4.20.2
$ gpg --detach-sign --armor shadow-4.20.2_src.tar 
$ gzip -nk shadow-4.20.2_src.tar
$ xz -k shadow-4.20.2_src.tar

shadow-4.20.0 (Ibores) - shadow utils

Breaking changes:

• Removals:

  The following programs and features were deprecated in 4.19 (Herve)
  or earlier, and have been removed in 4.20.

  • expiry(1) (deprecated in 4.19)

    See #1481
    and #1432.

  • login.defs(5): ENCRYPT_METHOD: DES (deprecated in 4.19)

    See #1456.

  • login.defs(5): ENCRYPT_METHOD: MD5 (deprecated in 4.19)

    See #1457.

  • login.defs(5): MD5_CRPYT_ENAB (deprecated since the dinosaurs were around)

    See #1455.

  • shadow(5): .sp_min (deprecated in 4.19)

    See #1482.

    This also includes the following removals:

    • chage(1): -m,--mindays (also the interactive version)
    • passwd(1): -n,--mindays
    • login.defs(5): PASS_MIN_DAYS

    This feature is considered a vulnerability, and was removed
    without replacement.

    Programs will now fail when any of those flags or variable are
    specified. This is intentional, and should help identify any
    scripts that rely on these.

  • groupmems(8) (deprecated in 4.19)

    See #1343
    and #1601.

    Use usermod(8) instead.

  • logoutd(8) (deprecated in 4.19)

    See #999
    and #1344.

• Defaults:

  The following default values were changed.

  • login.defs(5): Remove defaults for password expiration
    (PASS_MAX_DAYS, PASS_WARN_AGE)

    See #1428.

  • login.defs(5): ENCRYPT_METHOD: Default to SHA512 (previously, it was DES)

    See #1278
    and #1454.

    Users should still explicitly specify it, since other programs that read login.defs(5) may still default to DES.

• Features

  The following features that were optional in 4.19 are now
  unconditionally supported in 4.20.

  • SHA256, SHA512

    See #1278
    and #1452.

• Regressions

  Some regressions have been introduced (as side effects of bug fixes) and they're here to stay. Users must adapt.

  • #1704
    su(1) as root can be dangerous because of an ioctl (TIOCSTI), and if that ioctl is not disabled, su(1) will now fail and report an error.
  • #1706
    usermod(8) doesn't produce any effects if it fails to unlock a password because there was no password. Previously, this was just a warning, and thus produced effects.

Dependencies:

• We've removed an unused dependency (libattr).
  See #1473.

Deprecations

No new deprecations since 4.19. However, we maintain the
deprecations from then. Here's a reminder of deprecated features
that have not been removed yet (they will eventually be removed):

• Password aging:

  • chage(1):
    -I,--inactive (also the interactive version)
    -M,--maxdays (also the interactive version)
    -W,--warndays (also the interactive version)
  • passwd(1):
    -k,--keep-tokens
    -x,--maxdays
    -i,--inactive
    -w,--warndays
  • useradd(8):
    -f,--inactive
  • usermod(8):
    -f,--inactive
  • login.defs(5):
    PASS_MAX_DAYS
    PASS_WARN_AGE
  • /etc/default/useradd:
    INACTIVE
  • shadow(5):
    .sp_lstchg: Restrict to just the values 0 and empty.
    .sp_max
    .sp_warn
    .sp_inact

Binary tarballs produced and signed with:

$ ./autogen.sh 
$ make -j4
$ make dist
$ gpg --detach-sign --armor shadow-4.20.0.tar.gz 
$ gpg --detach-sign --armor shadow-4.20.0.tar.xz

Source tarballs produced and signed with:

$ git archive -o shadow-4.20.0_src.tar 4.20.0
$ gpg --detach-sign --armor shadow-4.20.0_src.tar 
$ gzip -nk shadow-4.20.0_src.tar
$ xz -k shadow-4.20.0_src.tar

This should be the last RC before the actual release (expected by next Monday).

Binary tarballs produced and signed with:

$ ./autogen.sh 
$ make dist
$ gpg --detach-sign --armor shadow-4.20.0-rc3.tar.gz 
$ gpg --detach-sign --armor shadow-4.20.0-rc3.tar.xz

Source tarballs produced and signed with:

$ git archive -o shadow-4.20.0-rc3_src.tar 4.20.0-rc3
$ gpg --detach-sign --armor shadow-4.20.0-rc3_src.tar 
$ gzip -nk shadow-4.20.0-rc3_src.tar
$ xz -k shadow-4.20.0-rc3_src.tar

This pre-release is mainly intended as a test of translation template improvements.

Pre-release for 4.20.0.

Binary tarballs produced and signed with:

$ ./autogen.sh
$ make -j4 dist
$ gpg --detach-sign --armor shadow-4.19.4.tar.xz
$ gpg --detach-sign --armor shadow-4.19.4.tar.gz

Source tarballs produced and signed with:

$ git archive -o shadow-4.19.4_src.tar 4.19.4
$ gpg --detach-sign --armor shadow-4.19.4_src.tar
$ gzip -nk shadow-4.19.4_src.tar
$ xz -k shadow-4.19.4_src.tar

Edit:

Oh, and something I forgot to mention in the release commit:

There's a change to the makefile, which I needed to be able to run make dist.
(I already used this change in 4.19.3 even though it wasn't included in the release --I had also forgotten to include it--; I patched the source code after the 4.19.3 tag and before the make dist. This time I have included it in the git repository, but I forgot to mention it in the release notes.)

shadow-4.19.2

Regression fixes:

• usermod(8):
  • Revert an incorrect commit.
    See #1509
    and #1510.