fix: images ship root locked, or the build fails; stamp the build date #31

Merged

marcos-mendez merged 1 commit from fix/image-ships-root-locked into 19.x

2026-10-02 12:18:48 -03:00

marcos-mendez commented

2026-10-02 11:43:53 -03:00

(Migrated from github.com)

Layer (a) of the review finding on Keel-Linux/inithooks#35: Keep must never be offered for a password the image itself shipped.

mk/turnkey/seal-root, run last in root.patched/post of mk/turnkey.mk: fails the build unless root's shadow field is exactly *, ! or !* (what passwd --lock makes of *). The field is compared, never printed. Then it writes the build date, UTC, to /etc/keel/build-date, the stamp inithooks compares the password's last change against.
conf/turnkey.d/rootpass and conf/samba-rootpass ignore a build time ROOT_PASS (a line says so, without the value): it gave every copy the same password. The first boot preseed ROOT_PASS (inithooks) is untouched. turnkey-desktop.mk is left as it is.
Five older WordPress images shipped U6aMy0wojraho (the crypt of the empty string). seal-root refuses it, and so does inithooks#35.

Tests (written first)

tests/seal-root.bats (new, 100 percent of seal-root's lines under kcov): accepts *, !, !* and stamps the date; refuses a hash (not printed), the empty-password hash, an empty field, a locked hash, a missing root entry, a missing shadow file; checks that turnkey.mk calls it last. The ROOT_PASS tests in rootpass.bats, samba-rootpass.bats and before-firstboot.bats now expect it ignored.

Test plan

CI green
Next image build: /etc/keel/build-date present, root * in the tar.zst

Layer (a) of the review finding on Keel-Linux/inithooks#35: Keep must never be offered for a password the image itself shipped. - `mk/turnkey/seal-root`, run last in `root.patched/post` of `mk/turnkey.mk`: fails the build unless root's shadow field is exactly `*`, `!` or `!*` (what `passwd --lock` makes of `*`). The field is compared, never printed. Then it writes the build date, UTC, to `/etc/keel/build-date`, the stamp inithooks compares the password's last change against. - `conf/turnkey.d/rootpass` and `conf/samba-rootpass` ignore a build time `ROOT_PASS` (a line says so, without the value): it gave every copy the same password. The first boot preseed `ROOT_PASS` (inithooks) is untouched. `turnkey-desktop.mk` is left as it is. - Five older WordPress images shipped `U6aMy0wojraho` (the crypt of the empty string). seal-root refuses it, and so does inithooks#35. ## Tests (written first) `tests/seal-root.bats` (new, 100 percent of seal-root's lines under kcov): accepts `*`, `!`, `!*` and stamps the date; refuses a hash (not printed), the empty-password hash, an empty field, a locked hash, a missing root entry, a missing shadow file; checks that turnkey.mk calls it last. The ROOT_PASS tests in `rootpass.bats`, `samba-rootpass.bats` and `before-firstboot.bats` now expect it ignored. ## Test plan - [ ] CI green - [ ] Next image build: `/etc/keel/build-date` present, root `*` in the tar.zst