From 494a1b4a17e5cfe30cf436c61c98f30171577c02 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Mon, 28 Jul 2025 14:03:59 +0200
Subject: [PATCH] shadow: use /bin/sh as default shell

See the comment in the code for the reason why using /bin/sh instead of
the runtimeShell store path.

Drop the patch and substituteInPlace in postPatch as this is much easier
to maintain than a patch.

Ldap users should now set `loginShell` to
`/run/current-system/sw/bin/bash` if they want to retain bash as the
default shell. If this is not set, the default shell for logins will be
/bin/sh which can be "turned" into a normal interactive bash by typing
"bash".
---
 nixos/tests/sssd-ldap.nix                  |  1 +
 pkgs/by-name/sh/shadow/package.nix         | 11 ++++++-----
 pkgs/by-name/sh/shadow/runtime-shell.patch | 13 -------------
 3 files changed, 7 insertions(+), 18 deletions(-)
 delete mode 100644 pkgs/by-name/sh/shadow/runtime-shell.patch

diff --git a/nixos/tests/sssd-ldap.nix b/nixos/tests/sssd-ldap.nix
index 9bc991f6ddce..9d18ef64f39d 100644
--- a/nixos/tests/sssd-ldap.nix
+++ b/nixos/tests/sssd-ldap.nix
@@ -99,6 +99,7 @@ import ./make-test-python.nix (
               objectClass: posixAccount
               userPassword: ${testPassword}
               homeDirectory: /home/${testUser}
+              loginShell: /run/current-system/sw/bin/bash
               uidNumber: 1234
               gidNumber: 1234
               cn: ""
diff --git a/pkgs/by-name/sh/shadow/package.nix b/pkgs/by-name/sh/shadow/package.nix
index 43577e3280ea..1164d803d530 100644
--- a/pkgs/by-name/sh/shadow/package.nix
+++ b/pkgs/by-name/sh/shadow/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  runtimeShell,
   nixosTests,
   autoreconfHook,
   bison,
@@ -49,8 +48,6 @@ stdenv.mkDerivation rec {
     "man"
   ];
 
-  RUNTIME_SHELL = runtimeShell;
-
   nativeBuildInputs = [
     autoreconfHook
     bison
@@ -74,13 +71,17 @@ stdenv.mkDerivation rec {
     ./keep-path.patch
     # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
     ./respect-xml-catalog-files-var.patch
-    ./runtime-shell.patch
     ./fix-install-with-tcb.patch
   ];
 
-  # The nix daemon often forbids even creating set[ug]id files.
   postPatch = ''
+    # The nix daemon often forbids even creating set[ug]id files
     sed 's/^\(s[ug]idperms\) = [0-9]755/\1 = 0755/' -i src/Makefile.am
+
+    # The default shell is not defined at build time of the package. It is
+    # decided at build time of the NixOS configration. Thus, don't decide this
+    # here but just point to the location of the shell on the system.
+    substituteInPlace configure.ac --replace-fail '$SHELL' /bin/sh
   '';
 
   # `AC_FUNC_SETPGRP' is not cross-compilation capable.
diff --git a/pkgs/by-name/sh/shadow/runtime-shell.patch b/pkgs/by-name/sh/shadow/runtime-shell.patch
deleted file mode 100644
index 0b2e68e330e4..000000000000
--- a/pkgs/by-name/sh/shadow/runtime-shell.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index e4c6aaec..03883ad7 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -682,7 +682,7 @@ if test "$enable_utmpx" = "yes"; then
- 	          [Define if utmpx should be used])
- fi
- 
--AC_DEFINE_UNQUOTED(SHELL, ["$SHELL"], [The default shell.])
-+AC_DEFINE_UNQUOTED(SHELL, ["$RUNTIME_SHELL"], [The runtime shell.])
- 
- AM_GNU_GETTEXT_VERSION(0.16)
- AM_GNU_GETTEXT([external], [need-ngettext])