Re: [PATCH 05/11] generate deterministic clear-text password hash

[Henning Schild <henning.schild@siemens.com>]

Am Wed, 11 Jan 2023 04:11:34 +0000
schrieb Felix Moessbauer <felix.moessbauer@siemens.com>:

> This patch changes how we derive the hashed password of a user that is
> created using the clear-text-password flag. Previously, the clear-text
> password was directly input into chpasswd. However, chpasswd
> internally creates a 16-character random salt. This breaks the
> reproducability.
> 
> Instead of letting chpasswd create the hashed password string, we now
> create it manually by deriving the salt from the SOURCE_DATE_EPOCH
> variable. This is technically done using the host openssl tool. As
> openssl is a transitive dependency of sbuild, we do not need to add
> it explicitly to the host-tools.
> 
> In case SOURCE_DATE_EPOCH is not set, chpasswd is used
> directly to create the salt.
> 
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>  meta/classes/image-account-extension.bbclass | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/meta/classes/image-account-extension.bbclass
> b/meta/classes/image-account-extension.bbclass index 70950a7..bcaa9c3
> 100644 --- a/meta/classes/image-account-extension.bbclass
> +++ b/meta/classes/image-account-extension.bbclass
> @@ -253,7 +253,15 @@ image_postprocess_accounts() {
>          if [ -n "$password" -o "${flags}" !=
> "${flags%*,allow-empty-password,*}" ]; then chpasswd_args="-e"
>              if [ "${flags}" != "${flags%*,clear-text-password,*}" ];
> then
> -                chpasswd_args=""
> +                # chpasswd adds a random salt when running against a
> clean-text password.

clear-text

> +                # For reproducible images, we manually generate the
> password and use the
> +                # SOURCE_DATE_EPOCH to generate the salt in a
> deterministic way.
> +                if [ -z "${SOURCE_DATE_EPOCH}"]; then
> +                    chpasswd_args=""
> +                else
> +                    salt="$(echo "${SOURCE_DATE_EPOCH}" | sha256sum
> -z | cut -c 1-15)"
> +                    password="$(openssl passwd -6 -salt $salt
> "$password")"
> +                fi
>              fi
>              printf '%s:%s' "$name" "$password" | sudo chroot
> '${ROOTFSDIR}' \ /usr/sbin/chpasswd $chpasswd_args