Wiki: https://fedoraproject.org/wiki/Changes/UsePAMInChpasswdNewusers
Discussion Thread: https://discussion.fedoraproject.org/t/184241
**This is a proposed Change for Fedora Linux.**
This document represents a proposed Change. As part of the Changes process,
proposals are publicly announced in order to receive community feedback.
This proposal will only be implemented if approved by the Fedora
Engineering Steering Committee.
== Summary ==
Enable PAM (Pluggable Authentication Modules) support for the `chpasswd`
and `newusers` utilities. This ensures that these tools follow the
system-wide authentication and password policies (such as password
complexity, history, and auditing) defined in the Fedora PAM stack.
== Owner ==
* Name: [[User:Ipedrosa| Iker Pedrosa]]
* Email: <ipedrosa(a)redhat.com>
== Detailed Description ==
Currently, the `chpasswd` and `newusers` binaries (provided by the
`shadow-utils` package) update passwords directly without interacting with
PAM. This means they can bypass security constraints defined in
`/etc/pam.d/system-auth`, such as:
* Password quality requirements (`pam_pwquality`).
* Password history (`pam_pwhistory`).
* Account locking/unlocking logic.
* Centralized logging and auditing of password changes.
This proposal aims to modify these utilities to initialize a PAM session,
allowing them to be "good citizens" within the Fedora security ecosystem
and ensuring that administrative bulk updates respect the same rules as the
`passwd` command.
This change addresses the issue reported in
https://bugzilla.redhat.com/show_bug.cgi?id=2283963
== Feedback ==
N/A
== Benefit to Fedora ==
* Consistency: centralizes password policy enforcement. Administrators can
be sure that policies set in PAM apply when using bulk update tools.
* Security: prevents the accidental setting of weak passwords via
automation scripts that use `chpasswd`.
* Auditing: provides better traceability of password changes through
standard PAM logging.
== Scope ==
* Proposal owners: modify `shadow-utils` dist-git to enable PAM support for
`chpasswd` and `newusers`. Provide and package the corresponding PAM
service files: `/etc/pam.d/chpasswd` and `/etc/pam.d/newusers`. Probably
basing them on the existing `passwd` stack.
* Other developers: N/A
* Release engineering: N/A
* Policies and guidelines: N/A
* Trademark approval: N/A
* Alignment with the Fedora Strategy: N/A
== Upgrade/compatibility impact ==
Minimal. Scripts that rely on setting passwords that violate current PAM
policies might fail (which is the intended security behavior).
Administrators might need to adjust their PAM configurations if they want
specific "relaxed" rules for these tools.
== Early Testing (Optional) ==
N/A
== How To Test ==
No special hardware or configuration is required to test this change.
# Install the updated `shadow-utils` package.
# Define a strict password policy in `/etc/security/pwquality.conf` (e.g.,
`minlen = 20`).
# Attempt to change a password using `echo "user:short" | chpasswd`.
# Expected result: The command should fail, citing that the password does
not meet the complexity requirements.
== User Experience ==
End-users won't notice a change. System administrators will have a more
robust and predictable environment where security policies are enforced
consistently across all tools.
== Dependencies ==
This is an update to `shadow-utils` package and there are no external
dependencies
== Contingency Plan ==
* Contingency mechanism: revert the changes in `shadow-utils` to the
previous behaviour
* Contingency deadline: Beta Freeze.
* Blocks release? No
== Documentation ==
No documentation update.
== Release Notes ==
The `chpasswd` and `newusers` utilities now support PAM. This ensures that
bulk password updates and user creations respect system-wide password
policies, such as complexity and history requirements.
Wiki: https://fedoraproject.org/wiki/Changes/Setuptools_82+
Discussion Thread: https://discussion.fedoraproject.org/t/184240
**This is a proposed Change for Fedora Linux.**
This document represents a proposed Change. As part of the Changes process,
proposals are publicly announced in order to receive community feedback.
This proposal will only be implemented if approved by the Fedora
Engineering Steering Committee.
== Summary ==
Update to a new upstream release of <code>python-setuptools</code> that is
not completely compatible with previous releases. Most notably,
pkg_resources module was removed. This is a breaking change and Fedora
packages that use pkg_resources should use the [
https://docs.python.org/3/library/importlib.resources.html
importlib.resources] and [
https://docs.python.org/3/library/importlib.metadata.html
importlib.metadata] projects for common use cases. There might be other
breaking changes. We estimate about ~130 Fedora Rawhide packages to fail to
build due to this upgrade (as of March 2026), more packages might be
affected if they use pkg_resources on runtime. A deprecated compatibility
package <code>python-setuptools80</code> will be provided for packages that
cannot migrate away from pkg_resources yet.
== Owner ==
* Name: [[User:thrnciar|Tomáš Hrnčiar]]
* Email: thrnciar(a)redhat.com
== Detailed Description ==
[https://setuptools.pypa.io/ Setuptools] is a package development process
library designed to facilitate packaging Python projects by enhancing the
former Python standard library distutils (distribution utilities). It
changes fast and it often introduces breaking changes such as the removal
of pkg_resources in version 82.x.x which was deprecated since April 2021.
There is no straightforward migration guide, the codebase needs to be
adapted to modern standards. As a temporary workaround, we plan to package
setuptools compat package, which will provide pkg_resources for packages
that haven't updated their codebase yet. Alternatively, there is an ongoing
upstream discussion about releasing pkg_resources as a standalone package.
If it ever happens, we might consider packaging it into Fedora.
With the compat package in place, maintainers can add `BuildRequires:
python3-pkg_resources` to use the pkg_resources module on build time or
`Requires: python3-pkg_resources` for runtime. Alternatively, if the
comapt package is needed for other reasons than pkg_resources, packages can
(Build)Require `python3-setuptools < 82`, `python3dist(setuptools) < 82~~`
or similar. We strongly recommend working with the upstream and migrating
projects to more modern tools.
List of packages that failed in our testing copr but did not fail in a
control copr as of 2026-02-17:
See more up-to-date results at
https://copr.fedorainfracloud.org/coprs/thrnciar/python-setuptools/packages/
Maintainers by package:
TurboGears2 cverna ondrejj
arandr mrc0mmand
azure-cli jcline
beaker martstyk
bodhi-server abompard humaton lenkaseg
buildstream atim jjardon
collectd jonathanspw kevin mhlavink
compose-utils carlwgeorge lsedlar
dogtag-pki abbra cfu edewata jmagne mfargett vakwetu
emacs-jedi melmorabity
gau2grid jussilehtola
gnome-todo amigadave kalev mclasen mcrha
gns3-net-converter kwizart
grpc defolos neil
home-assistant-cli thebeanogamer
input-remapper alexpl
lammps cz4rs junghans rberger
libgda limb lkundrak
libmodulemd asamalik nphilipp ppisar sgallagh
libpeas amigadave kalev mclasen
linux-system-roles ngompa pcahyna rmeggins spetros till
nicotine+ melmorabity
nmstate cathay4t ffmancera ihuguet till
oci-cli mhayden neil
onnxruntime aalvarez dherrera
packit lachmanfrantisek lbarczio mfocko mmassari nforro
nikromen ttomecek
petsc sagitter
pl jjames pampelmuse
protobuf adrian jonathanspw mizdebsk orion salimma
pygame jskarvad limb
pyp2rpm gordonmessmer
python-TestSlide dcavalca salimma
python-XStatic nikromen rdopiera
python-XStatic-Angular-UUID rdopiera
python-XStatic-Angular-Vis rdopiera
python-XStatic-Bootstrap-SCSS nikromen rdopiera
python-XStatic-DataTables dmsimard
python-XStatic-FileSaver rdopiera
python-XStatic-JS-Yaml rdopiera
python-XStatic-Json2yaml rdopiera
python-XStatic-Patternfly dmsimard
python-XStatic-Patternfly-Bootstrap-Treeview dmsimard
python-aiosmtpd abompard psimovec
python-astroid bcl limb mrunge orion
python-astroquery sergiopr
python-asyncpg music
python-binary-manager dcavalca
python-catkin_tools ankursinha cottsay
python-cerberus ngompa rcallicotte
python-click-plugins qulogic
python-coincurve peter
python-cornice mattia
python-decopatch zbyszek
python-deprecated mfocko phracek ttomecek
python-dijitso limb
python-django-configurations dcavalca salimma
python-dropbox limb
python-eccodes jdekloe
python-edgegrid carlwgeorge
python-envisage orion
python-fastprogress sergiopr
python-flufl-bounce abompard
python-gearbox kevin ondrejj
python-genshi fschwarz
python-geotiler iztokf
python-gitlab stevetraylen
python-google-cloud-core fkolwa jonathanspw
python-google-cloud-dns jorti
python-html5lib churchyard pjp sagitter salimma
python-jenkins-job-builder ignatenkobrain ktdreyer sicherha
python-jupyter-server lbalhar
python-launchpadlib churchyard opohorel
python-lazr-config abompard
python-lazr-delegates abompard
python-lazr-uri churchyard opohorel
python-lesscpy abbra
python-libsass jonathanspw music
python-linuxdoc ankursinha
python-llvmlite ankursinha
python-lsp-black gui1ty jonathanspw
python-makefun orion zbyszek
python-mathics-scanner dcavalca
python-migen somlo
python-moddb bunnyapocalypse farchord
python-mpmath jussilehtola kkeithle zbyszek
python-mwclient adamwill
python-nagiosplugin aekoroglu slaanesh
python-opcodes trix
python-openstep-plist music
python-opfunu iztokf
python-paste abompard ondrejj
python-peachpy trix
python-phply sshil
python-plaster-pastedeploy abompard
python-platformio dcavalca music
python-pluginlib aviso
python-psutil salimma
python-pybtex-docutils jjames
python-pymediainfo vascom
python-pyramid kevin
python-pyramid-mako kevin
python-pyramid-tm kevin
python-pysb zbyszek
python-pyspike ankursinha
python-pytest-cases zbyszek
python-pytest-harvest zbyszek
python-pytest-tornado qulogic
python-qudida thunderbirdtr
python-repoze-sphinx-autointerface jjames lbalhar
python-repoze-who cverna ondrejj
python-requirements-parser gotmax23
python-robosignatory mattia
python-rpmautospec nphilipp sgallagh
python-scales lbalhar lkundrak
python-sentry-sdk orange-kao pwouters rominf rommell
python-sphinx-kr-theme dcavalca salimma
python-sphinxcontrib-autoprogram maha
python-sphinxcontrib-chapeldomain fed500
python-sport-activities-features gui1ty
python-ssdeep suve
python-stone limb
python-streamlink melmorabity
python-subliminal jorti
python-sushy amoralej divius
python-tgext-tw2 ondrejj
python-tilestache cottsay
python-torchvision trix
python-traitsui ignatenkobrain orion
python-vcstool cottsay
python-vsts jcline
python-wadllib churchyard opohorel
python-webob ondrejj
python-wheel0.37 churchyard
python-wxpython4 swt2c
python-xbout davidsch
python-xlib orion rcallicotte
python-zope-event abompard orion
python3-mallard-ducktype amigadave
roca-detect sdgathman
rrdtool jskarvad
scap-security-guide evgenyz jcerny marcusburghardt mburket mmarhefk
vpolasek
spectrographic orphan
supervisor aekoroglu
sympy cbm jjames jussilehtola kkeithle orion
systemd daandemeyer lnykryn yuwata zbyszek
thefuck principis
tito frostyx maxamillion
vdirsyncer astra mathstuf salimma
whipper mavit
xtensor-python sergesanspaille
Packages by maintainer:
aalvarez onnxruntime
abbra dogtag-pki python-lesscpy
abompard bodhi-server python-aiosmtpd python-flufl-bounce
python-lazr-config python-lazr-delegates python-paste
python-plaster-pastedeploy python-zope-event
adamwill python-mwclient
adrian protobuf
aekoroglu python-nagiosplugin supervisor
alexpl input-remapper
amigadave gnome-todo libpeas python3-mallard-ducktype
amoralej python-sushy
ankursinha python-catkin_tools python-linuxdoc python-llvmlite
python-pyspike
asamalik libmodulemd
astra vdirsyncer
atim buildstream
aviso python-pluginlib
bcl python-astroid
bunnyapocalypse python-moddb
carlwgeorge compose-utils python-edgegrid
cathay4t nmstate
cbm sympy
cfu dogtag-pki
churchyard python-html5lib python-launchpadlib python-lazr-uri
python-wadllib python-wheel0.37
cottsay python-catkin_tools python-tilestache python-vcstool
cverna TurboGears2 python-repoze-who
cz4rs lammps
daandemeyer systemd
davidsch python-xbout
dcavalca python-TestSlide python-binary-manager
python-django-configurations python-mathics-scanner python-platformio
python-sphinx-kr-theme
defolos grpc
dherrera onnxruntime
divius python-sushy
dmsimard python-XStatic-DataTables python-XStatic-Patternfly
python-XStatic-Patternfly-Bootstrap-Treeview
edewata dogtag-pki
evgenyz scap-security-guide
farchord python-moddb
fed500 python-sphinxcontrib-chapeldomain
ffmancera nmstate
fkolwa python-google-cloud-core
frostyx tito
fschwarz python-genshi
gordonmessmer pyp2rpm
gotmax23 python-requirements-parser
gui1ty python-lsp-black python-sport-activities-features
humaton bodhi-server
ignatenkobrain python-jenkins-job-builder python-traitsui
ihuguet nmstate
iztokf python-geotiler python-opfunu
jcerny scap-security-guide
jcline azure-cli python-vsts
jdekloe python-eccodes
jjames pl python-pybtex-docutils python-repoze-sphinx-autointerface
sympy
jjardon buildstream
jmagne dogtag-pki
jonathanspw collectd protobuf python-google-cloud-core python-libsass
python-lsp-black
jorti python-google-cloud-dns python-subliminal
jskarvad pygame rrdtool
junghans lammps
jussilehtola gau2grid python-mpmath sympy
kalev gnome-todo libpeas
kevin collectd python-gearbox python-pyramid python-pyramid-mako
python-pyramid-tm
kkeithle python-mpmath sympy
ktdreyer python-jenkins-job-builder
kwizart gns3-net-converter
lachmanfrantisek packit
lbalhar python-jupyter-server python-repoze-sphinx-autointerface
python-scales
lbarczio packit
lenkaseg bodhi-server
limb libgda pygame python-astroid python-dijitso python-dropbox
python-stone
lkundrak libgda python-scales
lnykryn systemd
lsedlar compose-utils
maha python-sphinxcontrib-autoprogram
marcusburghardt scap-security-guide
martstyk beaker
mathstuf vdirsyncer
mattia python-cornice python-robosignatory
mavit whipper
maxamillion tito
mburket scap-security-guide
mclasen gnome-todo libpeas
mcrha gnome-todo
melmorabity emacs-jedi nicotine+ python-streamlink
mfargett dogtag-pki
mfocko packit python-deprecated
mhayden oci-cli
mhlavink collectd
mizdebsk protobuf
mmarhefk scap-security-guide
mmassari packit
mrc0mmand arandr
mrunge python-astroid
music python-asyncpg python-libsass python-openstep-plist
python-platformio
neil grpc oci-cli
nforro packit
ngompa linux-system-roles python-cerberus
nikromen packit python-XStatic python-XStatic-Bootstrap-SCSS
nphilipp libmodulemd python-rpmautospec
ondrejj TurboGears2 python-gearbox python-paste python-repoze-who
python-tgext-tw2 python-webob
opohorel python-launchpadlib python-lazr-uri python-wadllib
orange-kao python-sentry-sdk
orion protobuf python-astroid python-envisage python-makefun
python-traitsui python-xlib python-zope-event sympy
orphan spectrographic
pampelmuse pl
pcahyna linux-system-roles
peter python-coincurve
phracek python-deprecated
pjp python-html5lib
ppisar libmodulemd
principis thefuck
psimovec python-aiosmtpd
pwouters python-sentry-sdk
qulogic python-click-plugins python-pytest-tornado
rberger lammps
rcallicotte python-cerberus python-xlib
rdopiera python-XStatic python-XStatic-Angular-UUID
python-XStatic-Angular-Vis python-XStatic-Bootstrap-SCSS
python-XStatic-FileSaver python-XStatic-JS-Yaml python-XStatic-Json2yaml
rmeggins linux-system-roles
rominf python-sentry-sdk
rommell python-sentry-sdk
sagitter petsc python-html5lib
salimma protobuf python-TestSlide python-django-configurations
python-html5lib python-psutil python-sphinx-kr-theme vdirsyncer
sdgathman roca-detect
sergesanspaille xtensor-python
sergiopr python-astroquery python-fastprogress
sgallagh libmodulemd python-rpmautospec
sicherha python-jenkins-job-builder
slaanesh python-nagiosplugin
somlo python-migen
spetros linux-system-roles
sshil python-phply
stevetraylen python-gitlab
suve python-ssdeep
swt2c python-wxpython4
thebeanogamer home-assistant-cli
thunderbirdtr python-qudida
till linux-system-roles nmstate
trix python-opcodes python-peachpy python-torchvision
ttomecek packit python-deprecated
vakwetu dogtag-pki
vascom python-pymediainfo
vpolasek scap-security-guide
yuwata systemd
zbyszek python-decopatch python-makefun python-mpmath python-pysb
python-pytest-cases python-pytest-harvest systemd
We will be slowly crushing the failures and opening bugzillas before we
actually update setuptools.
== Feedback ==
== Benefit to Fedora ==
Fedora offers cutting-edge technologies for Python and setuptools is one of
the most important Python packages. By doing this update we bring users the
latest features that setuptools offers and also we enable Fedora + to
receive future updates as well.
== Scope ==
* Proposal owners: update python-setuptools to 82.x.x or newer, package
python-setuptools80, open bugzillas, provide help
* Other developers: report problems to the upstream and backport patches to
the affected packages. The impact can be tested using [
https://copr.fedorainfracloud.org/coprs/thrnciar/python-setuptools copr
repository] where setuptools 82+ has been built.
* Release engineering: [https://pagure.io/releng/issue/ #]
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with the Fedora Strategy:
== Upgrade/compatibility impact ==
There is a clean upgrade path from current version to python-setuptools
82+. Fedora users using RPM-packaged setuptools will use setuptools 82+ by
default.
== Early Testing (Optional) ==
Do you require 'QA Blueprint' support? N
== How To Test ==
* Find the package you want to update in the [
https://copr.fedorainfracloud.org/coprs/thrnciar/python-setuptools copr
repository] and check the build logs to determine the fail cause.
* Work with the upstream to resolve the issue or drop the usage of
pkg_resources module.
* When updating the package, you can test it using the same [
https://copr.fedorainfracloud.org/coprs/thrnciar/python-setuptools copr
repository] where the latest version of setuptools has been built.
* Let us know if something doesn't work as it should.
== User Experience ==
Regular distro users shouldn't notice any change in setuptools behavior,
except for upstream-intended changes.
== Dependencies ==
== Contingency Plan ==
* Contingency mechanism: (What to do? Who will do it?) Provide a compat
package with setuptools 80.10.2
* Contingency deadline: N/A (not a System Wide Change)
* Blocks release? N/A (not a System Wide Change)
== Documentation ==
[https://setuptools.pypa.io/en/stable/history.html Setuptools changelog]
This page is the documentation.
== Release Notes ==
\n
Planned Outage - fedora.im / matrix - 2026-03-26 11:50 UTC
There will be an outage starting at 2026-03-26 11:50 UTC,
which will last approximately 30 minutes.
To convert UTC to your local time, take a look at
http://fedoraproject.org/wiki/Infrastructure/UTCHowto
or run:
date -d '2026-03-26 11:50 UTC'
Reason for outage:
Element matrix services is performing scheduled maintenance on our matrix server (fedora.im).
Affected Services:
chat.fedoraproject.org
fedora.im
matrix services
Ticket Link:
https://forge.fedoraproject.org/infra/tickets/issues/13213
Please join #admin:fedoraproject.org / #noc:fedoraproject.org on matrix.
or add comments to this ticket for more information or feedback.
Updated status for this outage may be available at
https://www.fedorastatus.org/
Planned Outage - update/reboots - 2026-03-25 22:00 UTC
There will be an outage starting at 2026-03-25 22:00 UTC,
which will last approximately 5 hours.
To convert UTC to your local time, take a look at
http://fedoraproject.org/wiki/Infrastructure/UTCHowto
or run:
date -d '2026-03-25 22:00 UTC'
Reason for outage:
We will be applying all updates to servers and rebooting them.
Affected Services:
Many services will be affected, most should only be down for a short time as their particular resources are rebooted HOWEVER some may be down for a non-trivial amount of time due to RHEL-9 to RHEL-10 upgrades.
Ticket Link:
https://forge.fedoraproject.org/infra/tickets/issues/13207
Please join #admin:fedoraproject.org / #noc:fedoraproject.org on matrix.
or add comments to this ticket for more information or feedback.
Updated status for this outage may be available at
https://www.fedorastatus.org/
Wiki:
https://fedoraproject.org/wiki/Changes/UseSystemdForManagingPerUserEnvironm…
Discussion Thread: https://discussion.fedoraproject.org/t/182885
**This is a proposed Change for Fedora Linux.**
This document represents a proposed Change. As part of the Changes process,
proposals are publicly announced in order to receive community feedback.
This proposal will only be implemented if approved by the Fedora
Engineering Steering Committee.
== Summary ==
Rely on `systemd`'s `systemd.environment-generator` functionality for
managing per-user environment variables (such as appending `~/local/.bin`
and `~/bin` to an user's `$PATH`) instead of individual shellrc scripts
(`~/.bashrc`, `~/.zshrc` etc).
== Owner ==
* Name: [[User:Faeizmahrus| Faeiz Mahrus]]
* Email: faeizmahrus(a)proton.me, me(a)faeizmahrus.bd
== Detailed Description ==
Currently, Fedora relies on shellrc scripts (`~/.bashrc`, `~/.zshrc` files)
for modifying an user's environment variables. <br/>
An example of such a case is appending `~/.local/bin` and `~/bin`
directories to $PATH <br/>
Such shellrc scripts have only been packaged for the `bash` and `zsh`
shells. (`rpm -ql /etc/skel/{.bashrc,.zshrc}` returns packages `bash` and
`zsh`) <br/>
However, Fedora Linux also offers several alternative shells such as
`fish`, nushell (`nu`), `xonsh`, `dash` etc, for which shellrc scripts have
not been packaged. <br/>
This leads to a situation where an user might change their login shell and
be unable to directly launch scripts and programs stored in `~/.local/bin`
and `~/bin`
`systemd` provides a mechanism for applying environment variables to all
user processes via `systemd.environment-generator`. <br/>
Creating simple drop-in file(s) in the `/etc/skel/.config/environment.d/`
directory is a simpler and much cleaner way for both managing environment
variables for an user and for mitigating the `$PATH` environment variable
propagation issue for alternative shells. <br/>
Although out of scope for this specific proposal, the broader goal will be
to ultimately move as much cruft possible out of shellrc scripts scattered
across the filesystem at different places and `/etc/profile` into
`environment-generators`
== Feedback ==
Will be updated later.
== Benefit to Fedora ==
This change simplifies per-user environment variable propagation and makes
environment variable changes independant of an user's default shell.
== Scope ==
* Proposal owners:
Modify the `/etc/skel/.*rc` files located in the `bash` and `zsh` packages,
modifying them to either remove any environment variable modification parts
or splitting those parts into separate subpackages.
Search for any other packages that also modify environemt variables by
shellrc scripts.
* Other developers:
Coordinate with the respective package maintainers.
* Release engineering: [
https://forge.fedoraproject.org/releng/tickets/issues #Releng issue number]
Most likely no.
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with the Fedora Strategy:
== Upgrade/compatibility impact ==
None.
== Early Testing (Optional) ==
Do you require 'QA Blueprint' support? N
== How To Test ==
Will be added later.
== User Experience ==
Cleaner shellrc files will ease management for users.
== Dependencies ==
Will be updated later.
== Contingency Plan ==
* Contingency mechanism: (What to do? Who will do it?)
Revert the change. (not a System Wide Change)
* Contingency deadline: Beta freeze (not a System Wide Change)
* Blocks release? N/A (not a System Wide Change), Yes/No
== Documentation ==
N/A (not a System Wide Change)
== Release Notes ==
\nMoved per-user environment variable handling to
`systemd.environment-generator`\n