3 Commits

Author	SHA1	Message	Date
Pierre Warnier	24347e9913	usermod: add -p/--password flag for pre-hashed passwords (#114) ... Ansible's user module calls `usermod -p <hash>` to set passwords. This was the most significant gap for Ansible interop. Implementation: - Add PASSWORD option constant and clap argument (-p/--password) - Write hash directly to shadow entry, update last_change to today - Follows the same lock → read → mutate → atomic_write pattern Tests: - test_set_password: basic -p flag with hash verification - test_set_password_long_flag: --password long form - test_set_password_preserves_other_fields: all 9 shadow fields intact Also updated e2e Ansible playbook to use native `user: password:` parameter instead of the chpasswd -e workaround. Fixes #114	2026-04-03 13:48:11 +02:00
Pierre Warnier	36a623d0dd	review: address all 8 Copilot review comments ... - Redact full command args in assert_ok failure output (password leak) - Wrap all bare useradd/chpasswd calls in assert_ok (5 test sections) - Strict symlink checks: require -L + verify target resolves to shadow-rs - Add no_log: true to Ansible password task - Redirect nscd -d stdout to /dev/null Assertion count: 97 → 117	2026-04-03 13:34:08 +02:00
Pierre Warnier	e29b06c461	e2e: add end-to-end deployment tests (#102) ... Add automated deployment testing in Docker that simulates a real system-wide installation: build from source, install replacing GNU shadow-utils, then run 97 assertions covering: - Symlink dispatch and multicall dispatch (all 14 tools) - Setuid bits and non-root privilege enforcement - Full user lifecycle (useradd → chpasswd → usermod → pwck → userdel) - Full group lifecycle (groupadd → groupmod → groupdel → grpck) - Individual tool tests (chage, chfn, chsh, passwd -l/-u) - PAM authentication (su with known password via expect) - nscd cache invalidation - Landlock sandboxing (when kernel supports it) - Ansible integration (user/group modules as real-world consumer) New files: - docker/Dockerfile.e2e — multi-stage build + debian:trixie runtime - tests/e2e/deploy-test.sh — bash test harness with 97 assertions - tests/e2e/ansible-test.yml — Ansible playbook integration test - .dockerignore — prevent sending target/ and .git/ to Docker Modified: - docker-compose.yml — add e2e service (no changes to existing services) - Cargo.toml — add pam feature forwarding to root package - shadow-core/pam.rs — add #[link(name = "pam")] for linker Closes #109, closes #110, closes #111, closes #112, closes #113 Refs #102	2026-04-03 13:22:55 +02:00