diff -u shadow-4.1.1/debian/rules shadow-4.1.1/debian/rules
--- shadow-4.1.1/debian/rules
+++ shadow-4.1.1/debian/rules
@@ -22,6 +22,9 @@
 DEB_AUTO_UPDATE_AUTOCONF = 1.9
 DEB_AUTO_UPDATE_AUTOMAKE = 1.9
 
+# Work-around for intrepid libtool
+DEB_AUTO_UPDATE_LIBTOOL = pre
+
 # Adds extra options when calling the configure script:
 DEB_CONFIGURE_EXTRA_FLAGS := --disable-shared --without-libcrack --without-audit --mandir=/usr/share/man --with-libpam --enable-shadowgrp --enable-man
 ifneq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE))
diff -u shadow-4.1.1/debian/changelog shadow-4.1.1/debian/changelog
--- shadow-4.1.1/debian/changelog
+++ shadow-4.1.1/debian/changelog
@@ -1,3 +1,12 @@
+shadow (1:4.1.1-1ubuntu1.1) intrepid-security; urgency=low
+
+  * disable the root password for virtual machines created with vm-builder
+    on Ubuntu 8.10. (LP: #296841)
+  * debian/rules: use 'DEB_AUTO_UPDATE_LIBTOOL = pre' to work-around new
+    libtool (thanks Colin Watson)
+
+ -- Jamie Strandboge <jamie@ubuntu.com>  Tue, 11 Nov 2008 15:56:09 -0600
+
 shadow (1:4.1.1-1ubuntu1) intrepid; urgency=low
 
   * Merge from debian unstable, remaining changes:
diff -u shadow-4.1.1/debian/passwd.postinst shadow-4.1.1/debian/passwd.postinst
--- shadow-4.1.1/debian/passwd.postinst
+++ shadow-4.1.1/debian/passwd.postinst
@@ -15,6 +15,16 @@
             done
     fi
 
+    # Fix root password of '!' for vm-builder installed instances. Unrelated
+    # to passwd, but seems best place. /var/log/installer won't exist in
+    # vm-builder created images
+    if dpkg --compare-versions "$2" lt "1:4.1.1-1ubuntu1.1" && \
+       test ! -d "/var/log/installer"; then
+        if printf '!\0' | unix_chkpwd root nullok ; then
+            echo 'root:!' | chpasswd -e
+        fi
+    fi
+
     rm -f /etc/pam.d/passwd.pre-upgrade 2>/dev/null
 	if ! getent group shadow | grep -q '^shadow:[^:]*:42'
 	then