fix: show a generated password once, and record the updates answer #33

Merged

marcos-mendez merged 2 commits from fix/password-once-and-updates-record into master

2026-10-02 07:15:39 -03:00

marcos-mendez commented

2026-10-02 06:15:18 -03:00

(Migrated from github.com)

From the maintainer's screenshots of the Core image (2026-10-02). inithooks 2.3.6+keel16 (master took keel15; master is merged in).

002/003, generated password (the flow of #27). Root cause: the screen showing the password says "It is not shown again", and the "Did you save this password?" question after it showed the password again. The safer fix is to keep that promise, so the question no longer shows the password: "Did you save the password?" with Saved and New as before. New generates another password, which is also shown only once.
034/058, security updates. Root cause: nothing on the machine recorded the first boot's answer, so keel inspect fell back on the cron-apt install action that every image ships and reported force after Skip. 95secupdates now writes skip or force to /var/lib/inithooks/sec-updates, for both a preseeded and an interactive answer. keel 0.15.1 (Keel-Linux/keel#64) reads that file. If the file cannot be written, the hook logs it and the boot continues. The hook now takes INITHOOKS_DEFAULT, SEC_UPDATES_RECORD and SEC_UPDATES_LOG from the environment, for its first tests.

Tests written first:

Python: 373 tests pass. dialog_wrapper.py stays at 98 percent (the same lines are missed). New tests check that the password appears on one screen only.
Shell: the new tests/test-secupdates.bats covers 49 of 50 lines of 95secupdates. The shell total is 99.58, against a threshold of 98.

Real test: an LXC container from the step 7b Core image, with this package installed before the first boot. Generate showed the password once; the question did not show it. Choosing Skip left skip in /var/lib/inithooks/sec-updates, and keel inspect reported skip. The container was destroyed afterwards.

CI green
Review

From the maintainer's screenshots of the Core image (2026-10-02). inithooks 2.3.6+keel16 (master took keel15; master is merged in). - **002/003, generated password (the flow of #27).** Root cause: the screen showing the password says "It is not shown again", and the "Did you save this password?" question after it showed the password again. The safer fix is to keep that promise, so the question no longer shows the password: "Did you save the password?" with Saved and New as before. New generates another password, which is also shown only once. - **034/058, security updates.** Root cause: nothing on the machine recorded the first boot's answer, so keel inspect fell back on the cron-apt install action that every image ships and reported `force` after Skip. `95secupdates` now writes `skip` or `force` to `/var/lib/inithooks/sec-updates`, for both a preseeded and an interactive answer. keel 0.15.1 (Keel-Linux/keel#64) reads that file. If the file cannot be written, the hook logs it and the boot continues. The hook now takes `INITHOOKS_DEFAULT`, `SEC_UPDATES_RECORD` and `SEC_UPDATES_LOG` from the environment, for its first tests. Tests written first: - Python: 373 tests pass. `dialog_wrapper.py` stays at 98 percent (the same lines are missed). New tests check that the password appears on one screen only. - Shell: the new `tests/test-secupdates.bats` covers 49 of 50 lines of `95secupdates`. The shell total is 99.58, against a threshold of 98. Real test: an LXC container from the step 7b Core image, with this package installed before the first boot. Generate showed the password once; the question did not show it. Choosing Skip left `skip` in `/var/lib/inithooks/sec-updates`, and keel inspect reported `skip`. The container was destroyed afterwards. - [ ] CI green - [ ] Review