From: Alexandru Ardelean <redacted>
Date: Sun, 9 Aug 2026 09:35:35 +0000 (+0300)
Subject: shadow: update to 4.20.2
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=dfd046a6b71b1707c70882af4cf4cf1c570e71a7;p=openwrt-packages.git

shadow: update to 4.20.2

Refresh PKG_HASH from the release tarball.

Drop expiry, groupmems and logoutd from SHADOW_APPLETS: shadow 4.20
removed these applets (their sources are gone from the tarball and
src/Makefile.am no longer builds them), so shadow-expiry,
shadow-groupmems and shadow-logoutd have no binary to install.

Update the login.defs bcrypt sed: 4.20's etc/login.defs ships the
commented default "#ENCRYPT_METHOD SHA512" instead of
"#ENCRYPT_METHOD DES", so the old pattern matched nothing and left
ENCRYPT_METHOD unset.

Refresh 004-fix-su-controoling-term.patch for the shifted su.c line
numbers and add the missing git-am header.

Signed-off-by: Alexandru Ardelean <redacted>
---

diff --git a/utils/shadow/Makefile b/utils/shadow/Makefile
index b114a0fa8..2139626e4 100644
--- a/utils/shadow/Makefile
+++ b/utils/shadow/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=shadow
-PKG_VERSION:=4.19.4
-PKG_RELEASE:=2
+PKG_VERSION:=4.20.2
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://github.com/shadow-maint/shadow/releases/download/$(PKG_VERSION)
-PKG_HASH:=ce57a313e315a0a7cb04a8f50cc20753e994e487bbe9b78a2a824ca75cb486c0
+PKG_HASH:=b89f432b75ae55a2d852b446d0365484795fdf533ab97d550e325fa15594a224
 
 PKG_MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>
 PKG_LICENSE:=BSD-3-Clause
@@ -28,9 +28,9 @@ include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/nls.mk
 
 SHADOW_APPLETS := \
-	chage chfn chgpasswd chpasswd chsh expiry faillog gpasswd \
-	groupadd groupdel groupmems groupmod grpck grpconv grpunconv \
-	login logoutd newgrp newgidmap newuidmap newusers nologin \
+	chage chfn chgpasswd chpasswd chsh faillog gpasswd \
+	groupadd groupdel groupmod grpck grpconv grpunconv \
+	login newgrp newgidmap newuidmap newusers nologin \
 	passwd pwck pwconv pwunconv su \
 	useradd userdel usermod vipw
 
@@ -138,7 +138,7 @@ define Package/shadow-common/install
 	$(INSTALL_DIR) $(1)/etc
 	$(INSTALL_CONF) $(PKG_INSTALL_DIR)/etc/login.defs $(1)/etc/
 	$(SED) 's,SU_NAME,#SU_NAME,g' $(1)/etc/login.defs
-	$(SED) 's,#ENCRYPT_METHOD DES,ENCRYPT_METHOD BCRYPT,g' $(1)/etc/login.defs
+	$(SED) 's,#ENCRYPT_METHOD SHA512,ENCRYPT_METHOD BCRYPT,g' $(1)/etc/login.defs
 endef
 
 define Package/shadow-utils/install
diff --git a/utils/shadow/patches/004-fix-su-controoling-term.patch b/utils/shadow/patches/004-fix-su-controoling-term.patch
index eb536c1cf..2b598bc3c 100644
--- a/utils/shadow/patches/004-fix-su-controoling-term.patch
+++ b/utils/shadow/patches/004-fix-su-controoling-term.patch
@@ -1,6 +1,19 @@
+From d4399c664ec1f1c9fc2c2e19a3db1e0948d37859 Mon Sep 17 00:00:00 2001
+From: Alexandru Ardelean <alex@shruggie.ro>
+Date: Wed, 20 Aug 2026 09:00:00 +0300
+Subject: [PATCH] su: tolerate the absence of a controlling terminal
+
+su drops the controlling terminal when running a command, treating a
+missing one (ENXIO from open) as success. On musl, open("/dev/tty")
+can fail with EACCES instead, or TIOCNOTTY can fail with ENOTTY;
+handle both so "su <user> -c <cmd>" works without a controlling
+terminal (init scripts, service supervisors). OpenWrt issue #1521.
+
+Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
+---
 --- a/src/su.c
 +++ b/src/su.c
-@@ -1169,8 +1169,12 @@ int main (int argc, char **argv)
+@@ -1165,8 +1165,12 @@ int main (int argc, char **argv)
  
  		if (fd >= 0) {
  			err = ioctl (fd, TIOCNOTTY, (char *) NULL);