nixos/users-groups: drop the weak-hash activation warning

The libxcrypt transition was in 23.05, so I think we've given
people sufficient time to fix hashes of mutable users.

Part of #475305.
This commit is contained in:
r-vdp
2026-06-07 18:10:38 +03:00
parent ca14f513f3
commit 5692c926f2
+2 -26
View File
@@ -950,32 +950,8 @@ in
};
};
# Warn about user accounts with deprecated password hashing schemes
# This does not work when the users and groups are created by
# systemd-sysusers because the users are created too late then.
system.activationScripts.hashes =
if !config.systemd.sysusers.enable && !config.services.userborn.enable then
{
deps = [ "users" ];
text = ''
users=()
while IFS=: read -r user hash _; do
if [[ "$hash" = "$"* && ! "$hash" =~ ^\''$${cryptSchemeIdPatternGroup}\$ ]]; then
users+=("$user")
fi
done </etc/shadow
if (( "''${#users[@]}" )); then
echo "
WARNING: The following user accounts rely on password hashing algorithms
that have been removed. They need to be renewed as soon as possible, as
they do prevent their users from logging in."
printf ' - %s\n' "''${users[@]}"
fi
'';
}
else
""; # keep around for backwards compatibility
# for backwards compatibility
system.activationScripts.hashes = stringAfter [ "users" ] "";
# for backwards compatibility
system.activationScripts.groups = stringAfter [ "users" ] "";