Deprecating libuser and removing passwd package from Fedora
Libuser is not actively developed. Most of the depending component have build-time option to work without libuser.
- Name: Tomas Halman
- Email: <firstname.lastname@example.org>
- Targeted release: Fedora Linux 40
- Last updated: 2023-11-10
- devel thread
- FESCo issue: #3024
- Tracker bug: #2233275
- Release notes tracker: N/A
The libuser provides library and command line utilities to manipulate user and group information. The purpose of the library is/was to hide the differences between users in LDAP and files in etc (passwd, groups...). The support for LDAP is not complete and there is no plan to extend the functionality.
The LDAP integration in Fedora is nowadays done by SSSD.
In the past, the libuser was used by more component including Fedora installer. Currently the list is short
- usermode (Requires development, it is not complicated but the dependency is unconditional)
- util-linux (compile time option)
- passwd (I suggest to ship passwd utility from shadow-utils instead of passwd and drop passwd package as well)
Benefit to Fedora
The main benefit is to decrease the maintenance and packaging work on library that does not bring much value while the functionality is provided by another components.
- Proposal owners: Deprecate libuser, remove dependencies from packages listed bellow. From the discussion in Fedora mailing list I see that there are valid cases where libuser is used (puppet for example). Keeping libuser available (but deprecated) will allow people with those requirements to adapt. Removing dependencies now allows us to avoid libuser being installed everywhere. It will also allow us to drop the package easily in one of the next Fedora versions (f41).
- Other developers:
- Update usermode code to make libuser dependency configurable.
- Update usermode packaging to compile it without libuser
- Change packaging of util-linux to compile without libuser dependency
- Change packaging of shadow-utils to provide passwd utility
- Release engineering: 
Libuser is part of base image and must be removed. IMO mass rebuild is not required.
- Policies and guidelines: Since this is about dropping packages release notes must be updated.
- Trademark approval: N/A (not needed for this Change)
- Alignment with Community Initiatives: N/A
People who used libuser to manipulate users in LDAP will have to move to SSSD.
How To Test
- remove libuser, passwd, install new shadow-utils, usermode and util-linux
- try to change password of some user
- try to modify user using usermode
- expected results: everything works normally
This change should not be visible for users.
- usermode (code modification, packaging to drop libuser dependency)
- shadow-utils (packaging to provide passwd utility
- util-linux (packaging to drop libuser dependency)
- passwd (drop package)
- Contingency mechanism: Revert the shipped configuration
- Contingency deadline: final development freeze
- Blocks release? No
There is no extra documentation for this change except release notes.