From 84104fc1cadcb1ab61bfa40fc176522aead08349 Mon Sep 17 00:00:00 2001
From: Timothée Ravier <tim@siosm.fr>
Date: Mar 06 2026 03:34:49 +0000
Subject: Kinoite: Workaround missing (g)shadow entries for plasmalogin


The `/etc/shadow` and `/etc/gshadow` files are currently not properly
updated on rpm-ostree/bootc systems when new system users are added
using systemd-sysusers configs in the image.

Workaround that issue for the `plasmalogin` user specifically.

See: https://forge.fedoraproject.org/kde/tickets/issues/684

For more details why this happens and the likely proper fix, see:
- https://github.com/bootc-dev/bootc/issues/1179
- https://github.com/coreos/fedora-coreos-tracker/issues/1599
- https://github.com/coreos/rpm-ostree/issues/49

---

diff --git a/kinoite-shared.yaml b/kinoite-shared.yaml
index 5e5edd7..692d167 100644
--- a/kinoite-shared.yaml
+++ b/kinoite-shared.yaml
@@ -51,3 +51,66 @@ postprocess:
     UseUnattendedUpdates=true
     RequiredNotificationInterval=604800
     EOF
+
+  # Workaroud for missing shadow & gshadow entries for plasmalogin. See:
+  # https://forge.fedoraproject.org/kde/tickets/issues/684
+  # For more details why this happens and a potential proper fix, see:
+  # - https://github.com/bootc-dev/bootc/issues/1179
+  # - https://github.com/coreos/fedora-coreos-tracker/issues/1599
+  # - https://github.com/coreos/rpm-ostree/issues/49
+  - |
+    #!/bin/bash
+    set -xeuo pipefail
+
+    cat > /usr/lib/systemd/system/fedora-kinoite-plasmalogin-workaround.service << 'EOF'
+    [Unit]
+    Description=Workaround for missing plasmalogin entries in /etc/shadow & /etc/gshadow on Kinoite
+    Documentation=https://forge.fedoraproject.org/kde/SIG/issues/684
+    ConditionPathIsReadWrite=/etc
+    ConditionPathExists=/run/ostree-booted
+    ConditionPathExists=!/etc/.fedora-kinoite-plasmalogin-workaround
+    Before=plasmalogin.service
+
+    [Service]
+    Type=oneshot
+    RemainAfterExit=yes
+    ExecStart=/usr/libexec/fedora-kinoite-plasmalogin-workaround
+
+    [Install]
+    WantedBy=multi-user.target
+    EOF
+
+    cat > /usr/libexec/fedora-kinoite-plasmalogin-workaround << 'EOF'
+    #!/bin/bash
+    # See: https://forge.fedoraproject.org/kde/tickets/issues/684
+
+    set -euo pipefail
+
+    echo "Checking plasmalogin entries in /etc/shadow & /etc/gshadow"
+
+    if [[ $(grep -c "plasmalogin" "/etc/shadow") -eq 0 ]]; then
+        echo "plasmalogin:!*:::::::" >> "/etc/shadow"
+        echo "Added missing plasmalogin entry to /etc/shadow"
+    else
+        echo "Nothing to do for /etc/shadow"
+    fi
+
+    if [[ $(grep -c "plasmalogin" "/etc/gshadow") -eq 0 ]]; then
+        echo "plasmalogin:!*::" >> "/etc/gshadow"
+        echo "Added missing plasmalogin entry to /etc/gshadow"
+    else
+        echo "Nothing to do for /etc/gshadow"
+    fi
+
+    echo "Writing stamp file: /etc/.fedora-kinoite-plasmalogin-workaround"
+    touch /etc/.fedora-kinoite-plasmalogin-workaround
+    EOF
+
+    chmod a+x /usr/libexec/fedora-kinoite-plasmalogin-workaround
+
+    cat > /usr/lib/systemd/system-preset/82-kinoite.preset << 'EOF'
+    # See: https://forge.fedoraproject.org/kde/tickets/issues/684
+    enable fedora-kinoite-plasmalogin-workaround.service
+    EOF
+
+    systemctl preset fedora-kinoite-plasmalogin-workaround.service