From fa3135aaf70a4874b730527fa06d2ee03d4c9b09 Mon Sep 17 00:00:00 2001
From: Craig Jennings <c@cjennings.net>
Date: Mon, 20 Jul 2026 15:32:50 -0500
Subject: fix(installer): guard the user-password chpasswd

set -e is off, so a chpasswd failure silently left the primary user with no password and no log entry, leaving an unloggable account on a fresh install. I extracted set_user_password, which aborts via error_fatal on a chpasswd failure. A fake-chpasswd test pins that the guard fires.
---
 tests/installer-steps/test_set_user_password.py | 56 +++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 tests/installer-steps/test_set_user_password.py

(limited to 'tests')

diff --git a/tests/installer-steps/test_set_user_password.py b/tests/installer-steps/test_set_user_password.py
new file mode 100644
index 0000000..9f21b3a
--- /dev/null
+++ b/tests/installer-steps/test_set_user_password.py
@@ -0,0 +1,56 @@
+"""Test that the primary user's password is set under a guard.
+
+archsetup runs with `set -e` OFF (line 21), so an unguarded `chpasswd` that
+fails silently leaves the primary user with no password and no log entry -- an
+unloggable account on a fresh install. set_user_password guards the chpasswd
+with error_fatal so a failure aborts loudly instead of passing unnoticed.
+
+Method: sed-extract set_user_password from the real `archsetup`, run it with a
+fake chpasswd (controlled exit) and a fake error_fatal recorder. Assert the
+guard fires on failure and stays quiet on success.
+
+Run from repo root:
+    python3 -m unittest tests.installer-steps.test_set_user_password
+"""
+
+import os
+import subprocess
+import textwrap
+import unittest
+
+REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", ".."))
+ARCHSETUP = os.path.join(REPO_ROOT, "archsetup")
+
+
+def run_set_password(chpasswd_rc):
+    """Run set_user_password with a fake chpasswd exiting chpasswd_rc."""
+    script = textwrap.dedent(f"""\
+        password="hunter2"
+        logfile=/dev/null
+        display() {{ :; }}
+        chpasswd() {{ cat >/dev/null; return {chpasswd_rc}; }}
+        error_fatal() {{ echo "FATAL: $1"; exit 9; }}
+        source <(sed -n '/^set_user_password() {{/,/^}}/p' "{ARCHSETUP}")
+        set_user_password "alice"
+        echo "REACHED-END"
+    """)
+    return subprocess.run(
+        ["bash", "-c", script], capture_output=True, text=True, timeout=10,
+    )
+
+
+class SetUserPassword(unittest.TestCase):
+    def test_success_does_not_abort(self):
+        r = run_set_password(0)
+        self.assertIn("REACHED-END", r.stdout)
+        self.assertNotIn("FATAL", r.stdout)
+
+    def test_failure_aborts_with_error_fatal(self):
+        r = run_set_password(1)
+        self.assertIn("FATAL: setting password for alice", r.stdout,
+                      "a chpasswd failure must abort via error_fatal")
+        self.assertNotIn("REACHED-END", r.stdout)
+
+
+if __name__ == "__main__":
+    unittest.main()
-- 
cgit v1.2.3