A few comments on this one:

Perhaps the tests should be patched instead of the grp module?  Because
it may be useful for someone to know that old-style NIS maps are being
referenced.

I presume if the change is made in grp that it should also be made in pwd?

Shouldn't the patch do a "continue" instead of a break?  I believe the
"+" entry means "include the contents of the NIS map here (I don't
believe it can be used for LDAP), and as far as I know does not HAVE to
be included at the end of the file.

We probably don't care, but just to be canonical it seems that there are
also "+name" and "-name" entries in /etc/group and /etc/passwd.  "+name"
in an entry is the same as a "name" entry, but the additional fields are
read from NIS.  "-name" means that "name" is not a valid user (in other
words, don't let "name" login, even if they exist in NIS).  I can't
imagine we want to implement those though, because...

Note that the "+" syntax is the old syntax from before nsswitch was
introduced.  As far as I know, + syntax was deprecated back in 1995 when
nsswitch.conf was added.

In conclusion, I think the tests that the tests that annoy Anthony
should be fixed, but I'm not convinced the behavior of grp should be
changed.  Particularly without a corresponding change in pwd.

Thoughts?

See the following URL for more information about the +/- syntax: 
http://bama.ua.edu/cgi-bin/man-cgi?nsswitch.conf+4