[pierre-warnier]

Two parity fixes, each probed against Ubuntu 26.04's passwd 1:4.17.4-2ubuntu3 in ubuntu:26.04.

Account names (#391)

The shared check for a new name wanted a letter or _ first, no trailing dot and at most 32 characters, so usermod -l 0abc was exit 3. A batch probe of useradd, usermod -l, groupadd, groupmod -n and newusers over 40 names shows all five apply the rule pwck and grpck already follow here, plus a refused leading -:

name	upstream (all five)	before
0abc, 1e5, .abc, a., ..., 123$, 0xg, 1.5	accepted	refused
123, 0, 00, 0x1a, 0o7 (reads as an ID)	refused	refused
-x, ., .., $, a$b, a@b, é	refused	refused
33 to 255 characters	user: accepted; group: refused	refused

So a leading digit is fine, and an all-numeric name stays refused everywhere: 123 is taken for a UID.

• shadow-core: validate_username is replaced by is_valid_user_name (255) and is_valid_group_name (32), built on is_valid_account_name. pwck and grpck share the two length constants.
• Each tool prints upstream's message and exit code for a refused name: useradd 19, usermod 3, groupadd 3 ('X' is not a valid group name), groupmod 3, newusers 1 (the fault, then line N: can't create user).
• newusers checks the group it creates for a line against the group rule, as upstream does. This matters now that a user name can be longer than a group name.
• groupmod -n -x takes -x as the name, as usermod -l already does, so it is exit 3 and not a usage error.
• chfn and chsh only look up an existing account. They do not judge names: chsh/chfn on 0abc succeed upstream.

userdel -r (#392)

Upstream prints LOGIN mail spool (PATH) not found and LOGIN home directory (PATH) not found on stderr, mail spool first, and exits 0. For an empty home field it prints (). userdel -r now does the same and handles the spool before the home.

Tests

Each commit adds tests that fail on main: 5 per-tool integration tests for #391, plus probe tables in validate.rs, and one for #392 covering both missing, either one missing, and an empty home field. cargo test --workspace (1060 passed), clippy -D warnings (default, pam, all features) and cargo fmt --check are clean in the debian image. Man pages and CHANGELOG are updated.

Fixes #391
Fixes #392

[sylvestre]

thanks for working on this!
Before this can land, please confirm with upstream what useradd does with a user name over 32 characters when it also creates the user group. newusers refuses that group, but useradd creates it here.
Also, please split this into two PRs, one per issue.

[pierre-warnier]

Sorry, this was merged before CI and before your review. That was my mistake, and I've stopped using auto-merge here.

Following your comment:

• Revert "Take upstream's account names, report a missing spool or home in userdel -r (#393)" #394 reverts it.
• shadow-core: take the account names upstream takes #395 is usermod -l rejects a name starting with a digit #391 alone, and userdel: say when -r finds no mail spool or home #396 is userdel -r prints nothing when the mail spool or home is missing #392 alone.

On the 32-character question, against Ubuntu 26.04's passwd 1:4.17.4-2ubuntu3:

• useradd -U with a 33-character name creates the user and a 33-character group (exit 0);
• newusers refuses that group (invalid group name, exit 1, nothing created);
• groupadd refuses the 33-character name (exit 3).

Upstream is inconsistent there, and our build gives the same result for each tool, at both 32 and 33 characters. The details are in #395.