From 4cc5e08f53c2ec732ba7ddd8658139dc71141281 Mon Sep 17 00:00:00 2001
From: Markus Rudy <mr@edgeless.systems>
Date: Wed, 30 Oct 2024 15:53:51 +0100
Subject: [PATCH] image: unset password reset date

---
 image/base/BUILD.bazel    | 1 +
 image/base/mkosi.finalize | 8 ++++++++
 2 files changed, 9 insertions(+)
 create mode 100755 image/base/mkosi.finalize

diff --git a/image/base/BUILD.bazel b/image/base/BUILD.bazel
index 9028b83761..2928787f16 100644
--- a/image/base/BUILD.bazel
+++ b/image/base/BUILD.bazel
@@ -30,6 +30,7 @@ copy_to_directory(
     mkosi_image(
         name = "base_" + kernel_variant,
         srcs = [
+            "mkosi.finalize",
             "mkosi.postinst",
             "mkosi.prepare",
         ] + glob([
diff --git a/image/base/mkosi.finalize b/image/base/mkosi.finalize
new file mode 100755
index 0000000000..f832f5d0ae
--- /dev/null
+++ b/image/base/mkosi.finalize
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+# Disable password age for Constellation sysusers.
+tmp=$(mktemp)
+cp -a "${BUILDROOT}/etc/shadow-" "${tmp}"
+mkosi-chroot chage -d "20014" etcd
+cp -a "${tmp}" "${BUILDROOT}/etc/shadow-"
\ No newline at end of file