From 2da2e7fd5e010bec8e1165e3e9821112f6a12d65 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Fri, 24 Nov 2023 19:46:41 +0100
Subject: [PATCH] confd: Fix failure-config generation when password is missing

Setting admin's password to "!" is not accepted by the model, which
means we end up in RMA mode, even in cases when a valid startup
exists.

Not supplying a password will cause confd to generate a locked
account, which is what we want.
---
 src/confd/bin/gen-admin-auth | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/confd/bin/gen-admin-auth b/src/confd/bin/gen-admin-auth
index 030fc92a..825f8c71 100755
--- a/src/confd/bin/gen-admin-auth
+++ b/src/confd/bin/gen-admin-auth
@@ -7,9 +7,10 @@ pwhash=$(jq -r '."factory-password-hash"' /run/system.json)
 if [ -z "$pwhash" ] || [ "$pwhash" = "null" ]; then
     # Do not fail, lock account instead.  This way developers can enable
     # root account login at build-time to diagnose the system.
-    pwhash="!"
+    password=""
     rc=1
 else
+    password="\"password\": \"$pwhash\","
     rc=0
 fi
 
@@ -20,7 +21,7 @@ cat <<EOF
       "user": [
        {
           "name": "admin",
-          "password": "$pwhash",
+	  ${password}
 	  "infix-system:shell": "$shell"
        }
       ]