shadow: Update to version 4.20.0

- Update from version 4.18.0 to 4.20.0
- Update of rootfile
- Addition of patch to fix a build error. This patch will be integrated into the next
   tarball release.
- Checked the sobump but no dependencies found.
- Changelog
4.20.0
Removals:
    The following programs and features were deprecated in 4.19 (Herve)
    or earlier, and have been removed in 4.20.
        expiry(1) (deprecated in 4.19)
         See #1481
         and #1432.
        login.defs(5): ENCRYPT_METHOD: DES (deprecated in 4.19)
         See #1456.
        login.defs(5): ENCRYPT_METHOD: MD5 (deprecated in 4.19)
         See #1457.
        login.defs(5): MD5_CRPYT_ENAB (deprecated since the dinosaurs were around)
         See #1455.
        shadow(5): .sp_min (deprecated in 4.19)
         See #1482.
         This also includes the following removals:
            chage(1): -m,--mindays (also the interactive version)
            passwd(1): -n,--mindays
            login.defs(5): PASS_MIN_DAYS
         This feature is considered a vulnerability, and was removed
          without replacement.
         Programs will now fail when any of those flags or variable are
          specified. This is intentional, and should help identify any
          scripts that rely on these.
        groupmems(8) (deprecated in 4.19)
         See #1343
         and #1601.
         Use usermod(8) instead.
        logoutd(8) (deprecated in 4.19)
         See #999
         and #1344.
Defaults:
    The following default values were changed.
        login.defs(5): Remove defaults for password expiration
         (PASS_MAX_DAYS, PASS_WARN_AGE)
         See #1428.
        login.defs(5): ENCRYPT_METHOD: Default to SHA512 (previously, it was DES)
         See #1278
         and #1454.
         Users should still explicitly specify it, since other programs that read
          login.defs(5) may still default to DES.
Features
    The following features that were optional in 4.19 are now
    unconditionally supported in 4.20.
        SHA256, SHA512
        See #1278
        and #1452.
Regressions
    Some regressions have been introduced (as side effects of bug fixes) and they're
	here to stay. Users must adapt.
         #1704
	        su(1) as root can be dangerous because of an ioctl (TIOCSTI), and if
		 that ioctl is not disabled, su(1) will now fail and report an error.
         #1706
	        usermod(8) doesn't produce any effects if it fails to unlock a
		 password because there was no password. Previously, this was just a
		 warning, and thus produced effects.
Dependencies:
    We've removed an unused dependency (libattr).
     See #1473.
Deprecations
	No new deprecations since 4.19. However, we maintain the
	 deprecations from then. Here's a reminder of deprecated features
	 that have not been removed yet (they will eventually be removed):
	    Password aging:
	        chage(1):
	        -I,--inactive (also the interactive version)
	        -M,--maxdays (also the interactive version)
	        -W,--warndays (also the interactive version)
	        passwd(1):
	        -k,--keep-tokens
	        -x,--maxdays
	        -i,--inactive
	        -w,--warndays
	        useradd(8):
	        -f,--inactive
	        usermod(8):
	        -f,--inactive
	        login.defs(5):
	        PASS_MAX_DAYS
	        PASS_WARN_AGE
	        /etc/default/useradd:
	        INACTIVE
	        shadow(5):
	        .sp_lstchg: Restrict to just the values 0 and empty.
	        .sp_max
	        .sp_warn
	        .sp_inact
4.19.4
Regression fixes:
 -  Build with GCC 10 and older.
4.19.3
Regression fixes:
 -  chpasswd(8):
    -  Don't reject hashes containing backslashes or 'n' characters
       (affected SHA-256, SHA-512, MD5).
4.19.2
Regression fixes:
 -  usermod(8):
    -  Revert an incorrect commit.
       See <https://github.com/shadow-maint/shadow/issues/1509>
       and <https://github.com/shadow-maint/shadow/pull/1510>.
4.19.1
Regression fixes:
 -  chpasswd(8):
    -  Don't reject leading '!' in password hashes or a hash consisting
       of "*".  These were accidentally rejected in 4.19.0.
       See <https://github.com/shadow-maint/shadow/issues/1483>
       and <https://github.com/shadow-maint/shadow/pull/1486>.
    -  Accept a passwordless account ("" or "!").
       See <https://github.com/shadow-maint/shadow/issues/1483#issuecomment-3757398138>
       and <https://github.com/shadow-maint/shadow/pull/1505>.
4.19.0
Breaking changes:
    Remove support for escaped newlines in configuration files.
     It never worked correctly.
     b0a7ce5 (2025-12-05; "lib/, po/: Remove fgetsx() and fputsx()")
    Some user names and group names are too dangerous and are rejected,
     even with --badname.
     25aea74 (2025-12-25; "lib/chkname.c, src/: Strictly disallow really bad names")
Future breaking changes:
    SHA512 and SHA256 will be supported unconditionally in the next
     release. The build-time flag '--with-sha-crypt' will be removed.
     See #1452.
Support:
    Several years ago, there were talks about deprecating su(1) and
     login(1), back when this project was maintained as part of Debian.
     However, nothing was clearly stated, and there were doubts about the
     status of these programs. Let's clarify them now.
    Our implementations of su(1) and login(1) are fully supported, and we
     don't have any plans to remove them. They are NOT deprecated.
     See #464.
Deprecations:
    groupmems(8)
     The program will be removed in a future release.
     See #1343.
    logoutd(8)
     The program will be removed in the next release.
     See #999,
     and #1344.
    DES
     This hashing algorithm has been deprecated for a long time,
     and support for it will be removed in a future release.
     See #1456
    MD5
     This hashing algorithm has been deprecated for a long time,
     and support for it will be removed in a future release.
     See #1457
    login.defs(5): MD_CRYPT_ENAB
     This feature had been deprecated for decades. It will be
     removed in a future release.
     The command-line equivalents (-m, --md5) of this feature in
     chpasswd(8) and chgpasswd(8) will also be removed in a future
     release.
     See #1455.
    login.defs(5): PASS_MAX_LEN
     This feature is ignored except for DES. Once DES is removed,
     it makes no sense keeping it. It may be removed in a future
     release.
    Password aging
     Scientific research shows that periodic password expiration
      leads to predictable password patterns, and that even in a
      theoretical scenario where that wouldn't happen the gains in
      security are mathematically negligible.
      https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf
     Modern security standards, such as NIST SP 800-63B-4 in the USA,
      prohibit periodic password expiration.
      https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver
      https://pages.nist.gov/800-63-FAQ/#q-b05
      https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry
     To align with these, we're deprecating the ability to
      periodically expire passwords. The specifics and long-term
      roadmap are currently being discussed, and we invite feedback
      from users, particularly from those in regulated environments.
      See #1432.
     This deprecation includes the following programs and features:
      expiry(1)
      chage(1):
             -I,--inactive (also the interactive version)
             -m,--mindays (also the interactive version)
             -M,--maxdays (also the interactive version)
             -W,--warndays (also the interactive version)
      passwd(1):
             -k,--keep-tokens
             -n,--mindays
             -x,--maxdays
             -i,--inactive
             -w,--warndays
      useradd(8):
             -f,--inactive
      usermod(8):
             -f,--inactive
      login.defs(5):
             PASS_MIN_DAYS
             PASS_MAX_DAYS
             PASS_WARN_AGE
      /etc/default/useradd:
             INACTIVE
      shadow(5):
             sp_lstchg: Restrict to just the values 0 and empty.
             sp_min
             sp_max
             sp_warn
             sp_inact
     We recognize that many users operate in environments with
      regulatory or contractual requirements that still mandate
      password aging. To minimize disruption, these features will
      remain functional for a significant period. However, we
      encourage administrators to review their internal policies,
      talk to their regulators if appropriate, and participate in the
      roadmap discussion linked above.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/shadow                |  7 ++----
 lfs/shadow                                    | 10 +++++----
 ...ow-4.20.0_Add_stdint.h_for_uintmax_t.patch | 22 +++++++++++++++++++
 3 files changed, 30 insertions(+), 9 deletions(-)
 create mode 100644 src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch