From f53f985dbc6fd278a5aafaea268352649f7f92fb Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Thu, 23 Nov 2023 14:37:08 +0100
Subject: [PATCH] confd: do not fail if pwhash is missing in VPD, instead lock
 account

If pwhash is missing from system.json, lock account.  This allows for
more extensive diagnosis on developer builds with a root login.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 src/confd/bin/gen-admin-auth | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/confd/bin/gen-admin-auth b/src/confd/bin/gen-admin-auth
index ac19718d..66c2781f 100755
--- a/src/confd/bin/gen-admin-auth
+++ b/src/confd/bin/gen-admin-auth
@@ -5,7 +5,12 @@ shell="$1"
 pwhash="$(jq .pwhash /run/system.json)"
 
 if [ -z "$pwhash" ] || [ "$pwhash" = "null" ]; then
-    exit 1
+    # Do not fail, lock account instead.  This way developers can enable
+    # root account login at build-tiem to diagnose the system.
+    pwhash="!"
+    rc=1
+else
+    rc=0
 fi
 
 cat <<EOF
@@ -23,3 +28,5 @@ cat <<EOF
   }
 }
 EOF
+
+exit $rc