Minimum password length is 6 #46

New issue

Closed

opened 2026-09-26 07:29:08 +08:00 by Breadway · 4 comments

Breadway commented

2026-09-26 07:29:08 +08:00

Owner

Problem

iso/airootfs/etc/calamares/modules/users.conf: minLength: 6, libpwquality: minlen=6. With root locked, this password is the only thing protecting sudo (wheel).

Fix

Raise to 8 (NIST SP 800-63B minimum) or more, and show a warning (not a hard block) under 12 when disk encryption is on.

Source: BOS v0.6.2 source review (tag dated 2026-09-19). Read AGENTS.md first. One issue per branch/PR. Add a CHANGELOG [Unreleased] entry.

## Problem `iso/airootfs/etc/calamares/modules/users.conf`: `minLength: 6`, `libpwquality: minlen=6`. With root locked, this password is the only thing protecting sudo (`wheel`). ## Fix Raise to 8 (NIST SP 800-63B minimum) or more, and show a warning (not a hard block) under 12 when disk encryption is on. --- Source: BOS v0.6.2 source review (tag dated 2026-09-19). Read AGENTS.md first. One issue per branch/PR. Add a CHANGELOG `[Unreleased]` entry.

Breadway added the

installer

security

labels

2026-09-26 07:29:08 +08:00

Breadway referenced this issue from a pull request that will close it,

2026-09-30 03:51:26 +08:00

Minimum password length is 6 #63

Breadway commented

2026-09-30 03:51:34 +08:00

Author

Owner

Partial implementation is in PR #63. Calamares and libpwquality now both require 8 characters; the changelog recommends 12+ for encrypted installs and records that Calamares 3.4.2 has no BOS-local hook for a conditional, non-blocking warning. Implementing that warning needs a custom Calamares UI/module change, so this issue remains TODO for that follow-up.

Partial implementation is in PR https://git.breadway.dev/Breadway/bos/pulls/63. Calamares and libpwquality now both require 8 characters; the changelog recommends 12+ for encrypted installs and records that Calamares 3.4.2 has no BOS-local hook for a conditional, non-blocking warning. Implementing that warning needs a custom Calamares UI/module change, so this issue remains TODO for that follow-up.

Breadway commented

2026-09-30 04:14:20 +08:00

Author

Owner

Updated the existing PR #63 with a Calamares 3.4.2 users-module patch. With disk encryption selected, passwords under 12 characters now show an advisory through the existing warning status while the configured minimum remains 8 and does not block installation. The package workflow also builds on feature pushes and PRs while publishing only from main. Patch application, package metadata/checksum, workflow parsing and guard cases, and whitespace checks pass. The Calamares CMake test build needs Qt6LinguistTools, which is unavailable in this environment.

Updated the existing PR https://git.breadway.dev/Breadway/bos/pulls/63 with a Calamares 3.4.2 users-module patch. With disk encryption selected, passwords under 12 characters now show an advisory through the existing warning status while the configured minimum remains 8 and does not block installation. The package workflow also builds on feature pushes and PRs while publishing only from main. Patch application, package metadata/checksum, workflow parsing and guard cases, and whitespace checks pass. The Calamares CMake test build needs Qt6LinguistTools, which is unavailable in this environment.

Breadway commented

2026-09-30 04:19:43 +08:00

Author

Owner

Independent review of PR #63: the diff maps to the requested 8-character Calamares and libpwquality minimums, encrypted under-12 advisory, non-blocking readiness, and changelog. The checksum, patch application, and workflow guard were inspected; publication is limited to main push/dispatch and excluded from pull requests. PR #63 is mergeable. Validation is pending on head 857964448b7b1d637f61abc4ef39632320c644b2: package build runs #159 (push) and #160 (pull_request) both report started. The local Calamares CMake test build could not configure without Qt6LinguistTools, and no VM/UI acceptance evidence is recorded. Keeping the issue in REVIEW until CI finishes; this is BOS, so merge remains for the user.

Independent review of PR #63: the diff maps to the requested 8-character Calamares and libpwquality minimums, encrypted under-12 advisory, non-blocking readiness, and changelog. The checksum, patch application, and workflow guard were inspected; publication is limited to main push/dispatch and excluded from pull requests. PR #63 is mergeable. Validation is pending on head `857964448b7b1d637f61abc4ef39632320c644b2`: package build runs #159 (push) and #160 (pull_request) both report started. The local Calamares CMake test build could not configure without Qt6LinguistTools, and no VM/UI acceptance evidence is recorded. Keeping the issue in REVIEW until CI finishes; this is BOS, so merge remains for the user.

Breadway commented

2026-09-30 04:23:16 +08:00

Author

Owner

Final review at 857964448b7b1d637f61abc4ef39632320c644b2: PASS. Both package workflow runs are green: push run #159 and pull_request run #160. The PR is mergeable. The issue's explicit acceptance is met by the configured 8-character minimum, the encrypted-install under-12 advisory, and the nonblocking readiness behavior, with a Calamares users-module test added for the warning state. The package successfully builds with the pinned 3.4.2 patch. A live VM/UI run is not stated as an acceptance criterion; I recommend that as extra confidence only. BOS is release-sensitive, so I am leaving the merge to the project owner.

Final review at `857964448b7b1d637f61abc4ef39632320c644b2`: PASS. Both package workflow runs are green: push run #159 and pull_request run #160. The PR is mergeable. The issue's explicit acceptance is met by the configured 8-character minimum, the encrypted-install under-12 advisory, and the nonblocking readiness behavior, with a Calamares users-module test added for the warning state. The package successfully builds with the pinned 3.4.2 patch. A live VM/UI run is not stated as an acceptance criterion; I recommend that as extra confidence only. BOS is release-sensitive, so I am leaving the merge to the project owner.

Breadway closed this issue

2026-09-30 04:24:20 +08:00