gpasswd: added implementation of gpasswd

[jlesage]

Added implementation of gpasswd.

Mostly done by AI :)

[pierre-warnier]

Thanks for this — it is a complete piece of work: the tool, a man page, unit
tests, deployment assertions and an entry in the GNU comparison suite. The
option grammar, the exclusivity rules and the -d-prints-then-fails quirk all
match what GNU actually does; I checked each against the packaged binary rather
than against my expectations, and found no behavioural disagreement.

Unfortunately main moved a long way under you between Thursday and Friday —
fourteen pull requests, several of which rewrote files you also touch — so this
no longer merges. None of that is your fault, and the single failing check
(pre-commit.ci) is reporting error during mergeable check, i.e. the
conflict, not your code.

I have rebased it and pushed the result to gpasswd-rebased in this
repository. Your commit is unchanged and still authored by you; everything I
did is a second commit on top. I could not push it to your fork directly:
GitHub refuses any push from this account that would create a workflow file,
and the rebase carries main's .github/workflows/. If you would rather keep
the PR as yours, git fetch upstream gpasswd-rebased and reset your branch
onto it; otherwise say the word and I will open it as a separate PR that closes
this one, with you credited.

What the rebase had to resolve

• shadow-rs.spec and debian/ came back with the merge. Both were deleted in
  Install layout, aarch64 archives, pinned images, and a pre-push hook worth keeping #272 because neither could build — debian/ has no changelog at all, so
  dpkg-buildpackage stops before it starts.
• The standalone dispatch() and the hand-written --list predate shadow-rs: drop the setuid privilege for applets that are not meant to have it #239, where
  one applets() table started driving both. gpasswd joins the table.
• The five shadow-core parser features you asked for were removed in shadow-core: remove duplicated lookups, fix login.defs radices, allocate around NSS #271;
  only crypt is left of the ones you needed.
• The fourteen [[test]] targets became one in tests: one binary, spawn the real tool, and assert on what it prints #273.
• README, Makefile and PLATFORM-SUPPORT describe the pre-shadow-rs: drop the setuid privilege for applets that are not meant to have it #239 privilege
  model in your branch, where every applet ran with euid=0.

Four things worth your attention

1. gpasswd would have lost its privilege in the multicall build. You
correctly add it to SETUID_TOOLS, so make install marks it setuid. But
src/bin/shadow-rs.rs has a separate SETUID_APPLETS list — added in #239 —
and every applet not on it drops to the caller's uid before running. gpasswd
was not on it, so in the multicall layout a group administrator would have got
a permission error with nothing to explain it. It is on the list now, and the
test that pins the privilege model covers it.

2. Comments in /etc/group were being erased. The code reads with
read_group_file, which returns entries only, and writes them back. Every
comment, blank line and +/- NIS compatibility line in the file disappears
on the first gpasswd -a. This is #241, and the fix is the locked-file
transaction from #278/#279: LockedFile keeps the layout, and commit_all
writes group and gshadow together so a bad value cannot leave the pair
disagreeing. Ported.

3. println!/eprintln!. They panic when the stream is closed, which a
setuid-root tool must not do part way through changing an account file.
CONTRIBUTING says so but nothing enforced it — yours were the only five in
the repository. Replaced with writeln!, keeping GNU's choice of stream
(Adding user… on stdout). I also turned clippy::print_stdout and
print_stderr on workspace-wide so the next one is a build failure rather than
something a reviewer has to notice.

4. The duplicated EchoGuard and password reader. These matched newgrp's
copy, which is exactly right for when you wrote it — shadow_core::tty only
landed on Thursday. It now also blocks SIGINT/SIGQUIT/SIGTSTP for the
read, so Ctrl-C at the prompt cannot leave the terminal with echo off, and it
falls back to stderr/stdin where there is no controlling terminal.

Verified

Against a --prefix tree: -a adds and prints on stdout, an unknown user
gives exit 3 with nothing written, -d on a non-member prints then fails with
3, -M and -A write both files, -r clears the password, and the comment at
the top of /etc/group survives all of it. The four error exit codes match the
GNU binary, which the comparison suite now checks on every pull request.

make check              exit 0
GNU comparison          42 passed, 0 unexpected
Deployment suite        223 passed, 0 failed

One small thing for next time, and only because it cost me a minute: the
project asks for Fixes #N and a branch named feat/N-…, which means opening
an issue first. Not worth redoing here.

[jlesage]

I adjusted the PR. Everything should be good now :)

[pierre-warnier]

Verified and merged — thank you.

Your branch is byte-identical to what I had reviewed on the gpasswd-specific
files; the only delta is the 0.3.0/0.3.1 release work that landed on main in
between, so nothing needed re-reading.

Re-ran everything on your tip rather than assuming:

make check              exit 0    (98 test binaries)
GNU comparison          42 passed, 0 unexpected
CI                      14/14

And the one path CI does not cover — a real group administrator using the
setuid multicall binary, which is what the SETUID_APPLETS fix was for:

$ su admin1 -c 'gpasswd -a member1 team'
Adding user member1 to group team          exit 0
$ su member1 -c 'gpasswd -a admin1 team'
gpasswd: Permission denied                 exit 1
$ su member1 -c 'gpasswd -A member1 team'
gpasswd: Permission denied                 exit 1

I will add that last case to the deployment suite in a follow-up so it does
not depend on someone remembering to check it by hand. Nice work.

[pierre-warnier]

Shipped in 0.4.0, credited to you in the release notes.

gpasswd is in all three archives — x86-64 glibc, arm64 glibc and static musl — and I checked each after publishing rather than trusting the pipeline:

Archive	Applets	Notes
x86_64 glibc	15	GLIBC_2.34 floor, libpam linked
aarch64 glibc	15	ARM aarch64, libpam linked
x86_64 musl static	15	no dynamic dependencies

One thing worth knowing for the musl archive: gpasswd keeps working there for a group administrator, because it checks the group password through crypt(3) rather than PAM — unlike chfn and chsh, which become root-only. It cannot handle a yescrypt group password there, the same gap newgrp has. I updated docs/PLATFORM-SUPPORT.md to say so, since it still described a fourteen-tool world.

Thanks again.