particle-os/debian-forge-composer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

manifest: lock the root password for OSTreeDeployment

Browse source
This commit is contained in:
Achilleas Koutsou 2022-08-23 19:22:07 +02:00 • committed by Tom Gundersen
parent fbe8c1cb39
commit a505defad3
7 changed files with 149 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
internal/manifest/commit_deployment.go
View file

@ -156,6 +156,17 @@ func (p *OSTreeDeployment) serialize() osbuild.Pipeline {
fstabStage.MountOSTree(p.osName, p.osTreeRef, 0)
pipeline.AddStage(fstabStage)
userOptions := &osbuild.UsersStageOptions{
Users: map[string]osbuild.UsersStageOptionsUser{
"root": {
Password: common.StringToPtr("!locked"), // this is treated as crypted and locks/disables the password
},
},
}
userStage := osbuild.NewUsersStage(userOptions)
userStage.MountOSTree(p.osName, p.osTreeRef, 0)
pipeline.AddStage(userStage)
if p.Keyboard != "" {
options := &osbuild.KeymapStageOptions{
Keymap: p.Keyboard,

23
test/data/manifests/fedora_35-aarch64-fedora_iot_raw_image-boot.json
View file

@ -1904,6 +1904,29 @@
}
]
},
{
"type": "org.osbuild.users",
"options": {
"users": {
"root": {
"password": "!locked"
}
}
},
"mounts": [
{
"name": "ostree-test/fedora/iot",
"type": "org.osbuild.ostree.deployment",
"options": {
"deployment": {
"osname": "fedora-iot",
"ref": "test/fedora/iot",
"serial": 0
}
}
}
]
},
{
"type": "org.osbuild.keymap",
"options": {

23
test/data/manifests/fedora_35-x86_64-fedora_iot_raw_image-boot.json
View file

@ -1928,6 +1928,29 @@
}
]
},
{
"type": "org.osbuild.users",
"options": {
"users": {
"root": {
"password": "!locked"
}
}
},
"mounts": [
{
"name": "ostree-test/fedora/iot",
"type": "org.osbuild.ostree.deployment",
"options": {
"deployment": {
"osname": "fedora-iot",
"ref": "test/fedora/iot",
"serial": 0
}
}
}
]
},
{
"type": "org.osbuild.keymap",
"options": {

23
test/data/manifests/fedora_36-aarch64-fedora_iot_raw_image-boot.json
View file

@ -2152,6 +2152,29 @@
}
]
},
{
"type": "org.osbuild.users",
"options": {
"users": {
"root": {
"password": "!locked"
}
}
},
"mounts": [
{
"name": "ostree-test/fedora/iot",
"type": "org.osbuild.ostree.deployment",
"options": {
"deployment": {
"osname": "fedora-iot",
"ref": "test/fedora/iot",
"serial": 0
}
}
}
]
},
{
"type": "org.osbuild.keymap",
"options": {

23
test/data/manifests/fedora_36-x86_64-fedora_iot_raw_image-boot.json
View file

@ -2176,6 +2176,29 @@
}
]
},
{
"type": "org.osbuild.users",
"options": {
"users": {
"root": {
"password": "!locked"
}
}
},
"mounts": [
{
"name": "ostree-test/fedora/iot",
"type": "org.osbuild.ostree.deployment",
"options": {
"deployment": {
"osname": "fedora-iot",
"ref": "test/fedora/iot",
"serial": 0
}
}
}
]
},
{
"type": "org.osbuild.keymap",
"options": {

23
test/data/manifests/fedora_37-aarch64-fedora_iot_raw_image-boot.json
View file

@ -2160,6 +2160,29 @@
}
]
},
{
"type": "org.osbuild.users",
"options": {
"users": {
"root": {
"password": "!locked"
}
}
},
"mounts": [
{
"name": "ostree-test/fedora/iot",
"type": "org.osbuild.ostree.deployment",
"options": {
"deployment": {
"osname": "fedora-iot",
"ref": "test/fedora/iot",
"serial": 0
}
}
}
]
},
{
"type": "org.osbuild.keymap",
"options": {

23
test/data/manifests/fedora_37-x86_64-fedora_iot_raw_image-boot.json
View file

@ -2184,6 +2184,29 @@
}
]
},
{
"type": "org.osbuild.users",
"options": {
"users": {
"root": {
"password": "!locked"
}
}
},
"mounts": [
{
"name": "ostree-test/fedora/iot",
"type": "org.osbuild.ostree.deployment",
"options": {
"deployment": {
"osname": "fedora-iot",
"ref": "test/fedora/iot",
"serial": 0
}
}
}
]
},
{
"type": "org.osbuild.keymap",
"options": {