Description:

shadow 4.7-3 installs several programs as setuid-root that can create or remove user and groups (useradd, userdel, groupadd, groupdel...). These programs did not have the setuid-root bit before. For example, shadow 4.7-2 (downloadable from https://archive.archlinux.org/packages/s/shadow/) installed these programs without the setuid bit.

According to the git history of package shadow, the only major change between 4.7-2 and 4.7-3 is https://git.archlinux.org/svntogit/packages.git/commit/trunk?h=packages/shadow&id=031c7149a15ab0f8a4b49835b9b10773176a40cc, which refers to a bug which seems unrelated to this package ( FS#64106  is about elasticsearch, https://bugs.archlinux.org/task/64106). This is very confusing. In my humble opinion, I expect a change such as adding setuid-root flags to existing programs to be documented at least in the commit message that introduces the change. Did I miss something in this regards?

Additional info:
* package version: shadow-4.7-3
* config: Arch Linux x86-64

Steps to reproduce:

* Run ls -l /usr/bin/{groupadd,groupdel,groupmod,useradd,userdel,usermod}
* Observe "-rwsr-xr-x 1 root root" at the beginning of every line