spwd uses -1 rather than '' for empty attributes. This is different from the behaviour in the pwd module, and makes it more difficult to generate a new, valid shadow entry.

In my opinion, simply doing a ':'.join(str(val) for val in rec) should result in a valid entry. With pwd this is currently possible. Not so with spwd.

pwd:
import pwd
rec = pwd.getpwnam('alex')
print ':'.join(str(val) for val in rec)

spwd:
import spwd
rec = spwd.getspnam('alex')
shdw = ''
for idx, val in enumerate(recs_shdw):
    if idx != 0:
        shdw += ':'

    if val != -1:
        shdw += str(val)

print shdw

The docs for pwd and spwd modules specify that some items are strings and others are ints. Null strings should be '' and 'null' ints must be negative since 0 can be a valid item. It happens that all but 2 pwd items are strings and all but 2 spwd items are ints. The 2 pwd int items are uid and gid, which I believe are never missing, so you never encounter -1 for them. Similarly, the 2 spwd str items are nam and pwd, which I believe are not missing either, so you never encounter '' for them. Otherwise, your val != -1 test would not work.

I believe the following expression will work for spwd (and even pwd) (I cannot test on Windows ;-).

':'.join((str(val) if val != -1 else '') for val in rec)