Add ability to create passwordless root account (#2093)

To create a passwordless root account one may specify `hashed:` without passing
an actual hash.

diff --git a/mkosi/__init__.py b/mkosi/__init__.py
index f3ae51652d112bda3c7917a97f835838b22fa926..4da7144437008d90a14ff0561ee529afd6156050 100644 (file)
--- a/mkosi/__init__.py
+++ b/mkosi/__init__.py
@@ -1132,8 +1132,8 @@ def build_initrd(state: MkosiState) -> Path:
     # Default values are assigned via the parser so we go via the argument parser to construct
     # the config for the initrd.
 
-    password, hashed = state.config.root_password or (None, False)
-    if password:
+    if state.config.root_password:
+        password, hashed = state.config.root_password
         rootpwopt = f"hashed:{password}" if hashed else password
     else:
         rootpwopt = None
@@ -1860,7 +1860,8 @@ def run_firstboot(state: MkosiState) -> None:
     creds = []
 
     for option, cred, value in settings:
-        if not value:
+        # Check for None as password might be the empty string
+        if value is None:
             continue
 
         options += [option, value]

diff --git a/mkosi/resources/mkosi.md b/mkosi/resources/mkosi.md
index fcb043ae0d9ddcbe0bd6bbf0f64a03288b49f385..d039d2026b1528bfeeee8826c9e758c436ef95f9 100644 (file)
--- a/mkosi/resources/mkosi.md
+++ b/mkosi/resources/mkosi.md
@@ -1073,7 +1073,8 @@ boolean argument: either `1`, `yes`, or `true` to enable, or `0`, `no`,
 : Set the system root password. If this option is not used, but a `mkosi.rootpw` file is found in the local
   directory, the password is automatically read from it. If the password starts with `hashed:`, it is treated
   as an already hashed root password. The root password is also stored in `/usr/lib/credstore` under the
-  appropriate systemd credential so that it applies even if only `/usr` is shipped in the image.
+  appropriate systemd credential so that it applies even if only `/usr` is shipped in the image. To create
+  an unlocked account without any password use `hashed:` without a hash.
 
 `Autologin=`, `--autologin`