shadow,tcpreplay,stress-ng: bump versions

[commodo]

📦 Package Details

Maintainer: me

Description:

---

🧪 Run Testing Details

• OpenWrt Version:
• OpenWrt Target/Subtarget:
• OpenWrt Device:

---

✅ Formalities

• I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

[openwrt]

Formality Check: Failed

We checked this pull request against the contribution guidelines. Here is what needs your attention:

🛑 CRITICAL ERRORS

Commit 119603e - shadow: update to 4.20.2:

• Embedded patch file 'utils/shadow/patches/004-fix-su-controoling-term.patch' violates standard guidelines. Missing required Git header parameters ('From Mon Sep 17 00:00:00 2001' / 'From:' / 'Date:' / 'Subject:') to ensure 'git am' application compatibility

Tip

Do not close this pull request to make corrections. Instead, modify your existing commits (e.g. git commit --amend) and update the branch using git push --force-with-lease --force-if-includes. The checks will re-run automatically.

---

_{Something broken? Consider reporting an issue.
Running version 5c87cab deployed on 2026-08-07 23:35:13 CEST}

[openwrt-ai]

Reviewed 3 new commits. PKG_RELEASE is correctly reset to 1 in all three, and I verified the shadow and tcpreplay PKG_HASH values against the upstream release tarballs — both match. (The stress-ng codeload tarball was not reachable from this environment, so its hash is unverified.)

The two shadow findings inline look like merge blockers; the stress-ng one is a packaging correctness issue rather than a build break. tcpreplay 4.6.0 looks clean — all CONFIGURE_ARGS/CONFIGURE_VARS options still exist in 4.6.0's configure.ac, and bin_PROGRAMS still matches TCPREPLAY_MODULES.

Commit checks

• 119603e "shadow: update to 4.20.2" — the message body continues after the Signed-off-by: trailer ("Refresh 004-fix-su-controoling-term.patch for the shifted su.c line numbers in 4.20.2 (hunk offset only)."), so the sign-off is no longer the last line. Move that paragraph above the trailer. The claim itself is accurate: the refreshed hunk header applies to 4.20.2's src/su.c with zero fuzz and zero offset. The message does not mention that this bump also drops three applets, though — see the inline comment.

---

Generated by Claude Code

[openwrt-ai]

shadow 4.20 dropped three of the applets this package still builds, so this bump breaks the build.

src/expiry.c, src/groupmems.c and src/logoutd.c are gone from the 4.20.2 release tarball (tar tJf shadow-4.20.2.tar.xz | grep -E 'src/(expiry|groupmems|logoutd)\.c' returns nothing; they are all present in 4.19.4), and src/Makefile.am no longer lists them:

-ubin_PROGRAMS  = faillog chage chfn chsh expiry gpasswd newgrp passwd
+ubin_PROGRAMS  = faillog chage chfn chsh gpasswd newgrp passwd
 usbin_PROGRAMS = \
-	groupmems \
-	logoutd \

They are still in SHADOW_APPLETS, so GenPlugin/BuildPlugin still emit shadow-expiry, shadow-groupmems and shadow-logoutd, and their install recipe falls through to $(CP) $(PKG_INSTALL_DIR)/usr/bin/$(1) with no such file. shadow-all defaults to y, so this is hit in a default build. Please drop expiry, groupmems and logoutd from SHADOW_APPLETS in this commit (and mention the removed packages in the commit message).

---

Generated by Claude Code

[openwrt-ai]

With the 4.20.2 tarball the bcrypt sed becomes a silent no-op, so the shipped login.defs loses ENCRYPT_METHOD entirely.

In 4.19.4 etc/login.defs carried #ENCRYPT_METHOD DES; in 4.20.2 the commented default is #ENCRYPT_METHOD SHA512 (line 366 of the tarball's etc/login.defs), and etc/Makefile.am installs the file verbatim (sysconf_DATA = login.defs, no substitution). So $(SED) 's,#ENCRYPT_METHOD DES,ENCRYPT_METHOD BCRYPT,g' matches nothing and /etc/login.defs ends up with every ENCRYPT_METHOD line commented out — the package silently stops defaulting to bcrypt even though --with-bcrypt is still configured. The pattern needs to be updated to the new commented line (#ENCRYPT_METHOD SHA512).

(The SU_NAME sed above it is unaffected — SU_NAME su is still at line 123.)

---

Generated by Claude Code

[openwrt-ai]

0.21.04 adds two new library probes this package doesn't pin, which makes the resulting binary depend on what else happens to be in staging_dir.

Makefile.config in 0.21.04 gained:

LIB_NL := -lnl-3 -lnl-genl-3
LIB_GENL := -lnl-genl-3
...
libraries: ... LIB_LZMA LIB_NL LIB_GENL
LIB_NL:
	$(call check_lib,test-lnl,HAVE_LIB_NL,-lnl-3 -lnl-genl-3,$(LIB_NL),$(CFLAGS_NL))

Neither NL nor GENL is in STRESS_NG_LIBS or in the "never probe for them" block, so the probe runs with its default non-empty value. libnl is available in OpenWrt and stages both the headers and libnl-3.so/libnl-genl-3.so via Build/InstallDev in package/libs/libnl, so in a feed-wide build the check succeeds and stress-ng links -lnl-3 -lnl-genl-3 while DEPENDS names no libnl package — a broken runtime dependency, and a build whose output differs depending on whether libnl was staged.

Either add them to the never-probe block (LIB_NL= / LIB_GENL=), or give them STRESS_NG_LIB_NL / STRESS_NG_LIB_GENL symbols in Config.in with +libnl-genl in DEPENDS, consistent with the other optional libraries.

(FWIW the patch drop in this commit checks out: check_lib and check_lib_apparmor are both present in upstream Makefile.config at tag V0.21.04, and every LIB_* this package empties goes through them.)

---

Generated by Claude Code