Authorities have responsibilities too

To clarify, no such arrangement exists. The only reason I tried to contact CNI is because I'd like to help end these bad security policies in my country. Seeing that they ignored me, I feel I've done my part, and it's now their problem (and also of anyone who has to comply; luckily, I don't). Whoever is affected/more interested will have to deal with them.

> It would probably be more convenient for CNI and others if they voluntarily complied, but that has to be weighed against the needs of the shadow-utils project. It seems that shadow-utils would like to avoid the outcome where CNI or someone else has to fork the software, so I imagine that there will be ongoing attempts to start a dialog. But six months, just to get an initial reply, seems a bit unreasonable to me.

Yup, I was hoping for a voluntary cooperation.

The way we've done it is interesting:

They don't need to fork (at least, not immediately), because the expiration functionality that they require is still there. However, they certainly must react immediately, as we've broken some scripts provided by them to the users of their policies.

I expect several possibilities in the short term:

They may not notice for some time. This depends on how much time one of their users takes until they run the lastest version and use the scripts to set up password expiration policies.

Once they notice:

A). They review the policy, and drop password expiration entirely (hopefully);

or B). They remove the commands that now fail, since they're not strictly required by the policy, and otherwise keep the policy.