Pierre Warnier acc1771bc2 tests: exercise the PAM stack against known permit and deny services (#281) ...

The only PAM coverage was the deployment image authenticating a real
account. That cannot exercise a *refusal* without relying on a wrong
password being wrong, and it cannot tell a refusal apart from a
conversation that never reached the stack -- which is exactly the failure
that broke password changes earlier this week and took three rounds to
find.

The glibc images now define two throwaway services, one backed by
pam_permit and one by pam_deny, and shadow-core tests the wrapper against
both: the permit stack authenticates and passes account management, the
deny stack refuses with the stack's own answer rather than a conversation
error, and a service with no configuration at all does not authenticate.
The tests skip where the services are absent, which is any machine but
the containers.

CI also gains an all-features clippy pass. The completions feature and
the shadow-core feature gates were compiled by no job, so a lint or a
compile error in them could reach main unnoticed. make check runs it too.

2026-09-04 18:25:33 +02:00

..

scripts

ci: run the root suite on pull requests, fix the trace guard's false positives (#259)

2026-09-04 11:55:11 +02:00

workflows

tests: exercise the PAM stack against known permit and deny services (#281)

2026-09-04 18:25:33 +02:00