nixos/users-groups: drop the weak-hash activation warning (#529154)

This commit is contained in:
Florian Klink
2026-06-08 21:19:54 +00:00
committed by GitHub
+2 -26
View File
@@ -950,32 +950,8 @@ in
};
};
# Warn about user accounts with deprecated password hashing schemes
# This does not work when the users and groups are created by
# systemd-sysusers because the users are created too late then.
system.activationScripts.hashes =
if !config.systemd.sysusers.enable && !config.services.userborn.enable then
{
deps = [ "users" ];
text = ''
users=()
while IFS=: read -r user hash _; do
if [[ "$hash" = "$"* && ! "$hash" =~ ^\''$${cryptSchemeIdPatternGroup}\$ ]]; then
users+=("$user")
fi
done </etc/shadow
if (( "''${#users[@]}" )); then
echo "
WARNING: The following user accounts rely on password hashing algorithms
that have been removed. They need to be renewed as soon as possible, as
they do prevent their users from logging in."
printf ' - %s\n' "''${users[@]}"
fi
'';
}
else
""; # keep around for backwards compatibility
# for backwards compatibility
system.activationScripts.hashes = stringAfter [ "users" ] "";
# for backwards compatibility
system.activationScripts.groups = stringAfter [ "users" ] "";