new file mode 100644
@@ -0,0 +1,43 @@
+From ba4419c57b222b0d34a2b933e7ee92914a51b596 Mon Sep 17 00:00:00 2001
+From: ojab <ojab@ojab.ru>
+Date: Wed, 29 Jul 2026 15:07:43 +0000
+Subject: [PATCH] subid: Add `<stdint.h>` for `uintmax_t`
+
+```
+find_new_sub_uids.c:80:27: error: 'uintmax_t' undeclared (first use in this function)
+find_new_sub_gids.c:80:27: error: 'uintmax_t' undeclared (first use in this function)
+```
+
+Fixes: 4d800cf2eb9e (2026-04-09; "subid: Add deterministic subid ranges")
+
+Upstream-Status: Backport [https://github.com/shadow-maint/shadow/commit/ba4419c57b222b0d34a2b933e7ee92914a51b596]
+Signed-off-by: ojab <ojab@ojab.ru>
+---
+ lib/find_new_sub_gids.c | 1 +
+ lib/find_new_sub_uids.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/lib/find_new_sub_gids.c b/lib/find_new_sub_gids.c
+index 3971ce922e..de514d6b09 100644
+--- a/lib/find_new_sub_gids.c
++++ b/lib/find_new_sub_gids.c
+@@ -8,6 +8,7 @@
+
+ #ifdef ENABLE_SUBIDS
+
++#include <stdint.h>
+ #include <stdio.h>
+ #include <errno.h>
+
+diff --git a/lib/find_new_sub_uids.c b/lib/find_new_sub_uids.c
+index 65f6815467..f0b4328387 100644
+--- a/lib/find_new_sub_uids.c
++++ b/lib/find_new_sub_uids.c
+@@ -8,6 +8,7 @@
+
+ #ifdef ENABLE_SUBIDS
+
++#include <stdint.h>
+ #include <stdio.h>
+ #include <errno.h>
+
deleted file mode 100644
@@ -1,23 +0,0 @@
-When building images using shadow-native, we shouldn't be spamming the host's
-log with lots of syslog messages which aren't relavent. Disable syslog use
-in the native case.
-
-Upstream-Status: Inappropriate [upstream has accepted a better patch at https://github.com/shadow-maint/shadow/pull/1618]
-Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-Signed-off-by: Dmitry Sakhonchik <frezidok1@gmail.com>
-
-Index: shadow-4.17.2/lib/defines.h
-===================================================================
---- shadow-4.17.2.orig/lib/defines.h
-+++ shadow-4.17.2/lib/defines.h
-@@ -88,7 +88,9 @@
-
- /* cleaner than lots of #ifdefs everywhere - use this as follows:
- SYSLOG((LOG_CRIT, "user %s cracked root", user)); */
--#ifdef ENABLE_NLS
-+#if 1
-+#define SYSLOG(x)
-+#elif ENABLE_NLS
- /* Temporarily set LC_TIME to "C" to avoid strange dates in syslog.
- This is a workaround for a more general syslog(d) design problem -
- syslogd should log the current system time for each event, and not
deleted file mode 100644
@@ -1,38 +0,0 @@
-Give unused function arguments names as GCC 10 will fail otherwise.
-
-This is a continuation of a PR that has been merged upstream[1] but
-this merged after expiry.c[2] and logout.c[3] were removed.
-
-[1] shadow cb0ec030 ("Fix build failure on hosts with gcc 10")
-[2] shadow 2bb1b984 ("*/: expiry(1): Remove program")
-[3] shadow eec97ce4 ("Remove unused `logoutd` utility")
-
-Upstream-Status: Inappropriate [code no longer exists upstream]
-Signed-off-by: Ross Burton <ross.burton@arm.com>
-
-diff --git a/src/expiry.c b/src/expiry.c
-index 8da89bd..0abf011 100644
---- a/src/expiry.c
-+++ b/src/expiry.c
-@@ -37,7 +37,7 @@ static void process_flags (int argc, char **argv);
- * catch_signals - signal catcher
- */
- static void
--catch_signals(int)
-+catch_signals(MAYBE_UNUSED int _1)
- {
- _exit (10);
- }
-diff --git a/src/logoutd.c b/src/logoutd.c
-index c87b75c..09a24b3 100644
---- a/src/logoutd.c
-+++ b/src/logoutd.c
-@@ -116,7 +116,7 @@ static void send_mesg_to_tty (int tty_fd)
- * off from the system.
- */
- int
--main(int argc, char *[])
-+main(int argc, char *argv[])
- {
- pid_t pid;
-
deleted file mode 100644
@@ -1,110 +0,0 @@
-From eb17cd91d8e4d76ee95de9c0c9f4938ba2e3e82a Mon Sep 17 00:00:00 2001
-From: Kang Kai <kai.kang@windriver.com>
-Date: Wed, 20 Jul 2011 19:18:14 +0800
-Subject: [PATCH] shadow: update pam related configure files
-
-The system-auth in the configure files is from Fedora which put all the 4 pam type rules
-in one file.
-In yocto it obey the way with Debian/Ubuntu, and the names are common-auth, common-account,
-common-password and common-session.
-So update them with oe way.
-
-See meta/recipes-extended/pam/libpam/pam.d/common-password
-
-Upstream-Status: Inappropriate [oe-core specific]
-
-Signed-off-by: Kang Kai <kai.kang@windriver.com>
----
- etc/pam.d/chgpasswd | 2 +-
- etc/pam.d/groupadd | 2 +-
- etc/pam.d/groupdel | 2 +-
- etc/pam.d/groupmems | 2 +-
- etc/pam.d/groupmod | 2 +-
- etc/pam.d/useradd | 2 +-
- etc/pam.d/userdel | 2 +-
- etc/pam.d/usermod | 2 +-
- 8 files changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/etc/pam.d/chgpasswd b/etc/pam.d/chgpasswd
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/chgpasswd
-+++ b/etc/pam.d/chgpasswd
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/groupadd b/etc/pam.d/groupadd
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/groupadd
-+++ b/etc/pam.d/groupadd
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/groupdel b/etc/pam.d/groupdel
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/groupdel
-+++ b/etc/pam.d/groupdel
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/groupmems b/etc/pam.d/groupmems
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/groupmems
-+++ b/etc/pam.d/groupmems
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/groupmod b/etc/pam.d/groupmod
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/groupmod
-+++ b/etc/pam.d/groupmod
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/useradd b/etc/pam.d/useradd
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/useradd
-+++ b/etc/pam.d/useradd
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/userdel b/etc/pam.d/userdel
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/userdel
-+++ b/etc/pam.d/userdel
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-diff --git a/etc/pam.d/usermod b/etc/pam.d/usermod
-index 8f49f5c..b1f365d 100644
---- a/etc/pam.d/usermod
-+++ b/etc/pam.d/usermod
-@@ -1,4 +1,4 @@
- #%PAM-1.0
- auth sufficient pam_rootok.so
- account required pam_permit.so
--password include system-auth
-+password include common-password
-2.43.0
-
similarity index 97%
rename from meta/recipes-extended/shadow/shadow_4.19.4.bb
rename to meta/recipes-extended/shadow/shadow_4.20.0.bb
@@ -14,19 +14,17 @@ GITHUB_BASE_URI = "https://github.com/shadow-maint/shadow/releases"
SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BP}.tar.gz \
${@bb.utils.contains('PACKAGECONFIG', 'pam', '${PAM_SRC_URI}', '', d)} \
file://useradd \
- file://prototypes.patch \
+ file://0001-subid-Add-stdint.h-for-uintmax_t.patch \
"
SRC_URI:append:class-target = " \
file://login_defs_pam.sed \
- file://shadow-update-pam-conf.patch \
"
SRC_URI:append:class-native = " \
- file://disable_syslog.patch \
file://notallylog.patch \
"
-SRC_URI[sha256sum] = "ba7e9aed1c5420203ac549583d6e6f485a819ac7505af9c7cd8c13b2013210b8"
+SRC_URI[sha256sum] = "5e1eee2709a540ac07e4e5bb0d30f7b97d6ee1e3714ef527047fe2ffb5fdaa5c"
UPSTREAM_CHECK_REGEX = "releases/tag/v?(?P<pver>\d+(\.\d+)+)$"
# Additional Policy files for PAM
@@ -54,7 +52,7 @@ CACHED_CONFIGUREVARS += "ac_cv_lib_econf_econf_readDirs=no"
CFLAGS:append:libc-musl = " -DLIBBSD_OVERLAY"
NSCDOPT = ""
-NSCDOPT:class-native = "--without-nscd"
+NSCDOPT:class-native = "--without-nscd --disable-syslog"
NSCDOPT:class-nativesdk = "--without-nscd"
NSCDOPT:libc-glibc = "--with-nscd"
Changelog: https://github.com/shadow-maint/shadow/releases/tag/4.20.0 Notable upstream changes: - expiry(1): removed (deprecated in 4.19) - groupmems(8): removed, use usermod(8) instead (deprecated in 4.19) - logoutd(8): removed (deprecated in 4.19) - PAM configs for setuid account tools removed (08f27babeb2c) - login.defs(5): ENCRYPT_METHOD now defaults to SHA512 - Removed unused dependency on libattr - New --disable-syslog configure option Patches removed: - prototypes.patch: patched src/expiry.c and src/logoutd.c which were removed upstream in commits 2bb1b984 and eec97ce4. - disable_syslog.patch: shadow now supports --disable-syslog configure option natively. Added to EXTRA_OECONF for class-native instead. - shadow-update-pam-conf.patch: the files it patched (chgpasswd, groupadd, groupdel, groupmod, useradd, userdel, usermod) were removed upstream in commit 08f27babeb2c. The remaining pam.d files in the tarball are all overridden by the recipe's own PAM files. Patches added: - 0001-subid-Add-stdint.h-for-uintmax_t.patch: backport of upstream commit ba4419c57b22 fixing missing <stdint.h> include causing build failure in find_new_sub_uids.c and find_new_sub_gids.c. Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> --- ...001-subid-Add-stdint.h-for-uintmax_t.patch | 43 +++++++ .../shadow/files/disable_syslog.patch | 23 ---- .../shadow/files/prototypes.patch | 38 ------ .../shadow/files/shadow-update-pam-conf.patch | 110 ------------------ .../{shadow_4.19.4.bb => shadow_4.20.0.bb} | 8 +- 5 files changed, 46 insertions(+), 176 deletions(-) create mode 100644 meta/recipes-extended/shadow/files/0001-subid-Add-stdint.h-for-uintmax_t.patch delete mode 100644 meta/recipes-extended/shadow/files/disable_syslog.patch delete mode 100644 meta/recipes-extended/shadow/files/prototypes.patch delete mode 100644 meta/recipes-extended/shadow/files/shadow-update-pam-conf.patch rename meta/recipes-extended/shadow/{shadow_4.19.4.bb => shadow_4.20.0.bb} (97%)