Source Mage code commit list

[Jeremy Blosser <scm AT mail.sourcemage.org>]

GIT changes to stable-rc-0.7 grimoire by Jeremy Blosser 
<jblosser-smgl AT firinn.org>:

 security/shadow/CONFIGURE                                          |   22 
+++++++++-
 security/shadow/DETAILS                                            |    2 
 security/shadow/FINAL                                              |    8 ++-
 security/shadow/HISTORY                                            |   22 
+++++++++-
 security/shadow/PRE_REMOVE                                         |    9 
+++-
 security/shadow/REPAIR^acad95bdda57e3a157ee57a47035a0d5^PRE_REMOVE |    8 +++
 6 files changed, 61 insertions(+), 10 deletions(-)

New commits:
commit 78a7791a16295833db8ab65174b3f21c1408260a
Author: Jeremy Blosser <jblosser-smgl AT firinn.org>
Commit: Jeremy Blosser <jblosser-smgl AT firinn.org>

    shadow: Don't try to chk non-existant files.
    (cherry picked from commit ac992cbabf4dbf0cb6eccb5392401f4b37fd2a84)

commit 78ce7a16baa67619d8d76a52a0f8b0c06332bf4b
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Jeremy Blosser <jblosser-smgl AT firinn.org>

    shadow: making the query about restoring shadows an extra one-timer, as 
Jeremy suggested
    (cherry picked from commit 37a38d2e3b991e47fc2b4cf2e4836dacea0c2ab9)

commit 36af02e07ff80b93e887c9033653cb1129fff2aa
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Jeremy Blosser <jblosser-smgl AT firinn.org>

    shadow: fixing the unpleasant result of saying n to the account files 
conversion but still having pwunconv in PRE_REMOVE
    (cherry picked from commit fe545c4b24abdeb7177efbab4a650469f4d6a284)

diff --git a/security/shadow/CONFIGURE b/security/shadow/CONFIGURE
index 6c97b30..b2b6f03 100755
--- a/security/shadow/CONFIGURE
+++ b/security/shadow/CONFIGURE
@@ -1,18 +1,36 @@
-config_query SHADOW_CONV "Attempt to convert/fix accounts (with installed 
shadow utils)" n &&
-if [[ "$SHADOW_CONV" == y ]]; then
+# There's a bug introduced by the solution of bug 8834:
+# if you said "n" to $SHADOW_CONV, you ended up with the state pw/grpunconv
+# left on dispelling old shadow.
+# Introducing the temporary SHADOW_RECONV to support fixing that situation.
+
+if [[ "$SHADOW_CONV" == n ]] && [[ -z "$SHADOW_RECONV" ]]; then
+  message "Checking passwd for shadowness (there could have been an unwanted 
run of pwunconv/grpunconv, see bug #8834)." &&
+  if ! grep -q '^root:x:' "$INSTALL_ROOT/etc/passwd"; then
+    message "${PROBLEM_COLOR}Your passwd file contains password hashes, 
resuggesting conversion to shadow." &&
+    message "${MESSAGE_COLOR}You can still say n to the upcoming query but 
make sure to run pwconv / grpconv yourself if you want existing passwords 
shadowed." &&
+    config_query SHADOW_RECONV "One-time query: convert/fix accounts (with 
installed shadow utils) this time" n
+  fi
+else
+  config_query SHADOW_CONV "Attempt to convert/fix accounts (with installed 
shadow utils)" n
+fi &&
+if [[ "$SHADOW_CONV" == y ]] || [[ "$SHADOW_RECONV" == y ]]; then
   message "OK, checking your user and group accounts" &&
+ if [ -f "$INSTALL_ROOT/etc/gshadow" ]; then
   grpck -r "$INSTALL_ROOT/etc/group" "$INSTALL_ROOT/etc/gshadow" ||
   {
     message "there are problems with group... runinng grpck 
 interactively" &&
     grpck "$INSTALL_ROOT/etc/group" "$INSTALL_ROOT/etc/gshadow"
   }
+ fi
+ if [ -f "$INSTALL_ROOT/etc/shadow" ]; then 
   pwck -q -r "$INSTALL_ROOT/etc/passwd" "$INSTALL_ROOT/etc/shadow" ||
   {
     message "there are problems with passwd... runinng grpck 
 interactively" &&
     grpck "$INSTALL_ROOT/etc/passwd" "$INSTALL_ROOT/etc/shadow"
   }
+ fi
 fi
 # the tools give negative return even after successfully fixing stuff
 true
diff --git a/security/shadow/DETAILS b/security/shadow/DETAILS
index 223eace..797de76 100755
--- a/security/shadow/DETAILS
+++ b/security/shadow/DETAILS
@@ -7,7 +7,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL
         WEB_SITE=http://shadow.pld.org.pl/
          ENTERED=20050303
       PATCHLEVEL=3
-  SECURITY_PATCH=1
+  SECURITY_PATCH=2
         KEYWORDS="security password"
            SHORT="Shadow password file utilities"
 
diff --git a/security/shadow/FINAL b/security/shadow/FINAL
index eca5bd2..87461c7 100755
--- a/security/shadow/FINAL
+++ b/security/shadow/FINAL
@@ -1,6 +1,8 @@
-if [ "$SHADOW_CONV" == y ]; then
+if [ "$SHADOW_CONV" == y ] || [ "$SHADOW_RECONV" == "y" ]; then
   #Create or update necessary files for shadow
-  message "running pwconv and grpconv" &&
+  message "${MESSAGE_COLOR}running pwconv and grpconv" &&
   ${INSTALL_ROOT}/usr/sbin/pwconv &&
   ${INSTALL_ROOT}/usr/sbin/grpconv
-fi
+fi &&
+# mark it off
+SHADOW_RECONV=x
diff --git a/security/shadow/HISTORY b/security/shadow/HISTORY
index 1e09e8e..4fd7db3 100644
--- a/security/shadow/HISTORY
+++ b/security/shadow/HISTORY
@@ -1,3 +1,21 @@
+2007-02-07 Jeremy Blosser <jblosser-smgl AT firinn.org>
+       * CONFIGURE: Also don't bother trying to check files that aren't there
+         and are going to fail.  May not be the best fix but for now it 
avoids
+         scary errors when we say we're trying to repair things.
+
+2007-02-07 Thomas Orgis <sobukus AT sourcemage.org>
+       * CONFIGURE,FINAL: integrated Jeremy's suggestion of making the
+         emergency query a one-timer
+       * DETAILS: patchlevel (security level is the same as before)
+
+2007-02-06 Thomas Orgis <sobukus AT sourcemage.org>
+       * CONFIGURE,PRE_REMOVE, REPAIR^...^PRE_REMOVE, FINAL: I made the 
pwconv
+         optional, but there still was unconditional pwunconv in
+         PRE_REMOVE - now the mess had to be cleaned up: no pwunconv, ever!
+         (see bug 8834)
+       * DETAILS: SECURITY_PATCH++ as there can be a state of password hashes
+         in passwd files
+
 2007-01-22 Thomas Orgis <sobukus AT sourcemage.org>
        * CONFIGURE: default the answer to "n" by default, making the account
          modification opt-in as it should be
@@ -9,8 +27,8 @@
 2007-01-20 Thomas Orgis <sobukus AT sourcemage.org>
        * pam.d/su: move that to coreutils as the su binary comes from
          there now
-        * DETAILS: a patchlevel can't hurt for having changed install
-          footprint                                     
+       * DETAILS: a patchlevel can't hurt for having changed install
+         footprint                                     
 
 2006-07-15 Flavien Bridault <vlaaad AT sourcemage.org>
        * BUILD: do not install default /etc/pam.d/* files from the tarball
diff --git a/security/shadow/PRE_REMOVE b/security/shadow/PRE_REMOVE
index 58e91bd..580de53 100755
--- a/security/shadow/PRE_REMOVE
+++ b/security/shadow/PRE_REMOVE
@@ -1,3 +1,8 @@
+message "I will NOT put your passwords back into passwd/group!" &&
+message "You'd need to run pwunconv/grpunconv before dispel for having a 
workable system without shadow."
+# do not do this unasked and on every upgrade cast
+# you normally never dispel shadow for good unless you are
+# curious to see what happens...
 #Restore /etc/passwd when dispelling shadow
-${INSTALL_ROOT}/usr/sbin/pwunconv &&
-${INSTALL_ROOT}/usr/sbin/grpunconv
+#${INSTALL_ROOT}/usr/sbin/pwunconv &&
+#${INSTALL_ROOT}/usr/sbin/grpunconv
diff --git 
a/security/shadow/REPAIR^acad95bdda57e3a157ee57a47035a0d5^PRE_REMOVE 
b/security/shadow/REPAIR^acad95bdda57e3a157ee57a47035a0d5^PRE_REMOVE
new file mode 100755
index 0000000..580de53
--- /dev/null
+++ b/security/shadow/REPAIR^acad95bdda57e3a157ee57a47035a0d5^PRE_REMOVE
@@ -0,0 +1,8 @@
+message "I will NOT put your passwords back into passwd/group!" &&
+message "You'd need to run pwunconv/grpunconv before dispel for having a 
workable system without shadow."
+# do not do this unasked and on every upgrade cast
+# you normally never dispel shadow for good unless you are
+# curious to see what happens...
+#Restore /etc/passwd when dispelling shadow
+#${INSTALL_ROOT}/usr/sbin/pwunconv &&
+#${INSTALL_ROOT}/usr/sbin/grpunconv