I don't think it is intended to be an in-memory upgrade but rather move the hash on disk into shadow with a new hash method. The only way to change the hash me

I don't think it is intended to be an in-memory upgrade but rather move the hash on disk into shadow with a new hash method. The only way to change the hash method is to create a new hash from the provided password after verifying that it matches the previous hash. The if statement seems designed to make sure that the password matches the currently stored password before doing anything, so the question is why does it not do that. Either the function returns that it does match for some reason or the return value is tested incorrectly. Currently the article doesn't say but maybe at some point the author will track that down :). Then the question is why it happened, which would be easier to speculate on knowing what precisely is wrong.