I've recently noticed some changes to the
/etc/gshadow files on my Arch Linux system, which were presumably caused by a system upgrade:
+kvm:x:992: # group +kvm:!!:: # gshadow
How can I determine which package created that group?
With that specific group, the package is
libvirt. But as you can see from the PKGBUILD it is not the package that creates the group, but the application. pacman would have told you this when you installed it.
pacman has its own concept of groups, but they refer to groups of packages, not user groups. So there is no guaranteed or simple way to immediately determine which package altered
/etc/shadow. Your best bet would be to query the database to determine which package owns the binary referred to in those files, and then investigate from there:
pacman -Ss kvm community/libvirt 3.5.0-1 API for controlling virtualization engines (openvz,kvm,qemu,virtualbox,xen,etc)