shadow: update to 4.19.4

2026-05-22T03:57:39Z

Large version jump from 4.8.1 to 4.19.4 (latest upstream LTS). Build changes: - Refresh patches/004-fix-su-controoling-term.patch: su.c moved the ioctl() call from line 1122 to 1169 and changed (char *) 0 to (char *) NULL; update patch context and re-canonicalise through quilt (blank context line spacing). - New CONFIGURE_ARGS: * --disable-logind: 4.19.4 added an optional libsystemd-based logind integration which OpenWrt doesn't ship. * --without-libbsd: shadow's configure now hard-fails on missing readpassphrase() unless libbsd is found; the in-tree lib/readpassphrase.c fallback is enabled by --without-libbsd. * --without-sssd: avoid dragging in an sssd build dep. * --disable-subordinate-ids: 4.19.4 builds libsubid (subuid/subgid runtime API) unconditionally when subids are enabled, and its libtool -export-symbols-regex generates a version script that binutils 2.40+ rejects against libxcrypt's versioned crypt_checksalt@@XCRYPT_4.3 symbol. Disabling subordinate-ids skips libsubid entirely; OpenWrt doesn't ship libsubid. - Drop newgidmap, newuidmap, lastlog and groups from SHADOW_APPLETS: newgidmap/newuidmap are only built when subordinate-ids are enabled, lastlog defaults to disabled in 4.19.4, and the groups binary was removed from shadow upstream (use coreutils). Test coverage: - Replace the per-applet --version check in test.sh with per-applet functional tests: pwck -> 'pwck -r' read-only consistency check; accept non-zero exit since the CI container's /etc/passwd trips minor warnings. grpck -> 'grpck -r' read-only consistency check. chage -> 'chage -l root' lists password aging info. useradd -> 'useradd -D' dumps defaults without modifying state. passwd -> 'passwd -S root' prints the password status line. faillog -> create empty /var/log/faillog then 'faillog -a' must emit a header line. login/su -> PAM-interactive; presence covered by generic tests. Other applets -> verify binary presence (CI's generic tests already check stripped, no build paths, linked-libs). - Add test-version.sh as a generic-version-check override: shadow tools don't honour --version (only --help), so the framework's probe finds no PKG_VERSION match in any binary and would otherwise fail Generic tests for every sub-package. Signed-off-by: Alexandru Ardelean

packages/utils/shadow/test.sh, branch master

shadow: update to 4.19.4