# Contributor: William Pitcock <nenolod@dereferenced.org>
# Contributor: Jakub Jirutka <jakub@jirutka.cz>
# Maintainer: Stuart Cardall <developer@it-offshore.co.uk>
pkgname=shadow
pkgver=4.5
pkgrel=2
pkgdesc="PAM-using login and passwd utilities (usermod, useradd, ...)"
url="http://pkg-shadow.alioth.debian.org/"
arch="all"
license="GPL"
depends=""
makedepends="linux-pam-dev"
subpackages="$pkgname-doc $pkgname-dbg $pkgname-uidmap"
source="https://github.com/shadow-maint/shadow/releases/download/$pkgver/shadow-$pkgver.tar.xz
	chpasswd.pamd
	login.pamd
	dots-in-usernames.patch
	useradd-usergroups.patch
	pam-useradd.patch
	"
# secfixes:
#   4.5-r0:
#   - CVE-2017-12424
#   4.2.1-r11:
#   - CVE-2017-2616
#   4.2.1-r7:
#   - CVE-2016-6252

options="suid"
builddir="$srcdir/shadow-$pkgver"

build() {
	cd "$builddir"

	./configure \
		--build=$CBUILD \
		--host=$CHOST \
		--target=$CTARGET \
		--prefix=/usr \
		--sysconfdir=/etc \
		--mandir=/usr/share/man \
		--infodir=/usr/share/info \
		--localstatedir=/var \
		--disable-nls \
		--with-libpam \
		--without-audit \
		--without-selinux \
		--without-acl \
		--without-attr \
		--without-tcb \
		--without-nscd \
		--without-group-name-max-length \
		|| return 1
	make || return 1
}

check() {
	cd "$builddir"
	make check
}

package() {
	cd "$builddir"

	make DESTDIR="$pkgdir" install || return 1

	# Do not install these pam.d files they are broken and outdated.
	rm "$pkgdir"/etc/pam.d/* || return 1

	# install some pam.d files based on a patched useradd
	for pamf in groupadd groupdel groupmems groupmod \
		 useradd userdel usermod
	do
		install -m0644 etc/pam.d/useradd \
			"$pkgdir/etc/pam.d/$pamf" || return 1
	done
	# nologin is provided by util-linux.
	rm "$pkgdir"/sbin/nologin
	rm "$pkgdir"/usr/share/man/man8/nologin.*

	# avoid conlict with coreutils-doc
	rm "$pkgdir"/usr/share/man/man1/groups.*

	# However, install our own for login.
	cp "$srcdir"/login.pamd "$pkgdir"/etc/pam.d/login || return 1

	# Also install custom pam configuration for chpasswd (see bug #10209)
	cp "$srcdir"/chpasswd.pamd "$pkgdir"/etc/pam.d/chpasswd || return 1

	# /etc/login.defs is not very useful - replace it with an *almost* blank file.
	rm "$pkgdir"/etc/login.defs
	echo "USERGROUPS_ENAB yes" > "$pkgdir"/etc/login.defs

	# Avoid conflict with man-pages.
	rm "$pkgdir"/usr/share/man/man3/getspnam.3* \
		"$pkgdir"/usr/share/man/man5/passwd.5* || return 1
}

uidmap() {
	pkgdesc="Utilities for using subordinate UIDs and GIDs"

	mkdir -p "$subpkgdir"
	cd "$subpkgdir"

	mkdir -p usr/bin
	mv "$pkgdir"/usr/bin/new*idmap usr/bin/ || return 1
	chmod 4711 usr/bin/new*idmap || return 1

	# Used e.g. for unprivileged LXC containers.
	mkdir etc
	touch etc/subuid etc/subgid
}

sha512sums="e57f8db54df23301c229d4be30d4cbb67efa1d1809cffcff79adc480b6019fb2b5fd09e112e82a3f00ad5a6b2994592adac93f70a631cf666b6f4723b61c87b5  shadow-4.5.tar.xz
38e78aade316350dc26000b35335a778f12f5deb0f54ea23f84000ad92a683c519c7814165b5ed7e63187d11677993082d35dc6c21f7f66c6aee8e3fd4b3694b  chpasswd.pamd
46a6f83f3698e101b58b8682852da749619412f75dfa85cecad03d0847f6c3dc452d984510db7094220e4570a0565b83b0556e16198ad894a3ec84b3e513d58d  login.pamd
745eea04c054226feba165b635dbb8570b8a04537d41e914400a4c54633c3a9cf350da0aabfec754fb8cf3e58fc1c8cf597b895506312f19469071760c11f31d  dots-in-usernames.patch
49f1d5ded82d2d479805c77d7cc6274c30233596e375b28306b31a33f8fbfc3611dbc77d606081b8300247908c267297dbb6c5d1a30d56095dda53c6a636fb56  useradd-usergroups.patch
0b4587e263cb6be12fa5ae6bc3b3fc4d3696dae355bc67d085dc58c52ff96edb4d163b95db2092b8c2f3310839430cac03c7af356641b42e24ee4aa6410f5cf1  pam-useradd.patch"