shadow: update to 4.20.2

Refresh PKG_HASH from the release tarball.

Drop expiry, groupmems and logoutd from SHADOW_APPLETS: shadow 4.20
removed these applets (their sources are gone from the tarball and
src/Makefile.am no longer builds them), so shadow-expiry,
shadow-groupmems and shadow-logoutd have no binary to install.

Update the login.defs bcrypt sed: 4.20's etc/login.defs ships the
commented default "#ENCRYPT_METHOD SHA512" instead of
"#ENCRYPT_METHOD DES", so the old pattern matched nothing and left
ENCRYPT_METHOD unset.

Refresh 004-fix-su-controoling-term.patch for the shifted su.c line
numbers and add the missing git-am header.

Signed-off-by: Alexandru Ardelean <redacted>

diff --git a/utils/shadow/Makefile b/utils/shadow/Makefile
index b114a0fa8b9a547a8f827bd8428552c53aacb4d9..2139626e45f306c61368d08e610b2079fe7c784b 100644 (file)
--- a/utils/shadow/Makefile
+++ b/utils/shadow/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=shadow
-PKG_VERSION:=4.19.4
-PKG_RELEASE:=2
+PKG_VERSION:=4.20.2
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://github.com/shadow-maint/shadow/releases/download/$(PKG_VERSION)
-PKG_HASH:=ce57a313e315a0a7cb04a8f50cc20753e994e487bbe9b78a2a824ca75cb486c0
+PKG_HASH:=b89f432b75ae55a2d852b446d0365484795fdf533ab97d550e325fa15594a224
 
 PKG_MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>
 PKG_LICENSE:=BSD-3-Clause
@@ -28,9 +28,9 @@ include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/nls.mk
 
 SHADOW_APPLETS := \
-       chage chfn chgpasswd chpasswd chsh expiry faillog gpasswd \
-       groupadd groupdel groupmems groupmod grpck grpconv grpunconv \
-       login logoutd newgrp newgidmap newuidmap newusers nologin \
+       chage chfn chgpasswd chpasswd chsh faillog gpasswd \
+       groupadd groupdel groupmod grpck grpconv grpunconv \
+       login newgrp newgidmap newuidmap newusers nologin \
        passwd pwck pwconv pwunconv su \
        useradd userdel usermod vipw
 
@@ -138,7 +138,7 @@ define Package/shadow-common/install
        $(INSTALL_DIR) $(1)/etc
        $(INSTALL_CONF) $(PKG_INSTALL_DIR)/etc/login.defs $(1)/etc/
        $(SED) 's,SU_NAME,#SU_NAME,g' $(1)/etc/login.defs
-       $(SED) 's,#ENCRYPT_METHOD DES,ENCRYPT_METHOD BCRYPT,g' $(1)/etc/login.defs
+       $(SED) 's,#ENCRYPT_METHOD SHA512,ENCRYPT_METHOD BCRYPT,g' $(1)/etc/login.defs
 endef
 
 define Package/shadow-utils/install

diff --git a/utils/shadow/patches/004-fix-su-controoling-term.patch b/utils/shadow/patches/004-fix-su-controoling-term.patch
index eb536c1cf59d6b20b9f3a578a2552867bd73774b..2b598bc3c6f5d23991e38dbcbbb0ac9011b4a63a 100644 (file)
--- a/utils/shadow/patches/004-fix-su-controoling-term.patch
+++ b/utils/shadow/patches/004-fix-su-controoling-term.patch
@@ -1,6 +1,19 @@
+From d4399c664ec1f1c9fc2c2e19a3db1e0948d37859 Mon Sep 17 00:00:00 2001
+From: Alexandru Ardelean <alex@shruggie.ro>
+Date: Wed, 20 Aug 2026 09:00:00 +0300
+Subject: [PATCH] su: tolerate the absence of a controlling terminal
+
+su drops the controlling terminal when running a command, treating a
+missing one (ENXIO from open) as success. On musl, open("/dev/tty")
+can fail with EACCES instead, or TIOCNOTTY can fail with ENOTTY;
+handle both so "su <user> -c <cmd>" works without a controlling
+terminal (init scripts, service supervisors). OpenWrt issue #1521.
+
+Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
+---
 --- a/src/su.c
 +++ b/src/su.c
-@@ -1169,8 +1169,12 @@ int main (int argc, char **argv)
+@@ -1165,8 +1165,12 @@ int main (int argc, char **argv)
  
                if (fd >= 0) {
                        err = ioctl (fd, TIOCNOTTY, (char *) NULL);