Comment by crunchatized

Shouldn't the title of this post be *sshole? An asterisk isn't disallowed in post titles, is it?

He mentions that circa 2019, Debian's libcrypt stopped returning NULL and began returning the 2-character string '*0' - he doesn't elaborate, but this was part of a larger migration by many distros. glibc deprecated its own libcrypt so a more agile project that 'could move faster' would take its place [0]. This migration happened in Fedora 28 [1], Arch [2], and Debian bullseye [3].

Unless you specifically compile it with --disable-failure-tokens, on an error libxcrypt will return that 2-character failure token string. [4] [5] This behavior is very old [6], and hasn't been POSIX-compliant since at least POSIX.1-2001, which is based on SUSv2, which is from 1997.

So they've knowingly kept this non-standard backwards compatibility cludge for almost 30 years, and continue to claim it "isn't well standardized" in their man page despite POSIX and glibc existing, but at least it didn't bite them in the asterisk like it did musl. (Yet.) There's a new issue about removing this behavior now. [7]

[0] https://sourceware.org/legacy-ml/libc-alpha/2017-08/msg01257...

[1] https://fedoraproject.org/wiki/Changes/Replace_glibc_libcryp...

[2] https://bugs.archlinux.org/task/67312

[3] https://bugs.debian.org/941853

[4] https://manpages.debian.org/stretch/manpages-dev/crypt.3.en....

[5] https://manpages.debian.org/bullseye/libcrypt-dev/crypt.3.en...

[6] https://github.com/besser82/libxcrypt/commit/a1a3cba626843f3...

[7] https://github.com/besser82/libxcrypt/issues/226