Fix weak password crash in Live installer

Restore the Cockpit force-password behavior embedded in Fedora 43's
Anaconda WebUI bundle. Apply strict password policy through conf.d so
weak passwords remain a form validation error instead of aborting the
installer.

4 files changed, 68 insertions, 0 deletions

diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 391afd8..a93e9cd 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -39,6 +39,17 @@ jobs:
           done
           bash -n system_files/usr/libexec/aerocore-instruments-setup
 
+      - name: Validate Anaconda WebUI patch
+        run: |
+          fixture="$(mktemp)"
+          trap 'rm -f "${fixture}"' EXIT
+          printf '%s' 'n===0?r(new Error(X2("Password is too weak"))):o(' |
+            gzip -n > "${fixture}"
+          installer/patch-anaconda-webui.sh "${fixture}"
+          gzip -dc "${fixture}" |
+            grep -Fq 'n===0&&!e?r(new Error(X2("Password is too weak"))):o('
+          installer/patch-anaconda-webui.sh "${fixture}"
+
       - name: Validate installer polkit rules
         run: |
           for rule in installer/system_files/overrides/etc/polkit-1/rules.d/*.rules; do
diff --git a/installer/build.sh b/installer/build.sh
index 3093dcc..4535113 100755
--- a/installer/build.sh
+++ b/installer/build.sh
@@ -31,6 +31,11 @@ dnf --setopt=excludepkgs= reinstall -y \
   grub2-efi-x64 \
   grub2-efi-x64-cdboot
 
+# Fedora 43's anaconda-webui bundle embeds a Cockpit password helper from
+# before cockpit-project/cockpit@900c13f. Restore that upstream fix so a weak
+# pwscore result is returned as score 0 instead of rejecting the WebUI promise.
+"${SCRIPT_DIR}/patch-anaconda-webui.sh"
+
 # Apply the same AeroCore overlay to the live session where possible.
 if [[ -d /src/system_files ]]; then
   cp -a /src/system_files/. /
diff --git a/installer/patch-anaconda-webui.sh b/installer/patch-anaconda-webui.sh
new file mode 100755
index 0000000..2f61516
--- /dev/null
+++ b/installer/patch-anaconda-webui.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+bundle="${1:-/usr/share/cockpit/anaconda-webui/index.js.gz}"
+broken='n===0?r(new Error(X2("Password is too weak"))):o('
+fixed='n===0&&!e?r(new Error(X2("Password is too weak"))):o('
+fixed_sed='n===0\&\&!e?r(new Error(X2("Password is too weak"))):o('
+
+if [[ ! -f "${bundle}" ]]; then
+  echo "Anaconda WebUI bundle not found: ${bundle}" >&2
+  exit 1
+fi
+
+webui_js="$(mktemp)"
+patched_js="$(mktemp)"
+patched_bundle="$(mktemp)"
+trap 'rm -f "${webui_js}" "${patched_js}" "${patched_bundle}"' EXIT
+
+gzip -dc "${bundle}" > "${webui_js}"
+
+fixed_count="$( (grep -oF "${fixed}" "${webui_js}" || true) | wc -l | tr -d ' ')"
+if [[ "${fixed_count}" == "1" ]]; then
+  echo "Anaconda WebUI weak-password handling is already fixed"
+  exit 0
+fi
+
+broken_count="$( (grep -oF "${broken}" "${webui_js}" || true) | wc -l | tr -d ' ')"
+if [[ "${broken_count}" != "1" ]]; then
+  echo "Unexpected Anaconda WebUI password helper; refusing an unsafe patch" >&2
+  echo "Expected one weak-password rejection, found ${broken_count}" >&2
+  exit 1
+fi
+
+sed "s|${broken}|${fixed_sed}|" "${webui_js}" > "${patched_js}"
+
+fixed_count="$( (grep -oF "${fixed}" "${patched_js}" || true) | wc -l | tr -d ' ')"
+if [[ "${fixed_count}" != "1" ]] || grep -Fq "${broken}" "${patched_js}"; then
+  echo "Failed to patch Anaconda WebUI weak-password handling" >&2
+  exit 1
+fi
+
+gzip -n -9 -c "${patched_js}" > "${patched_bundle}"
+chmod 0644 "${patched_bundle}"
+mv -f "${patched_bundle}" "${bundle}"
+
+echo "Patched Anaconda WebUI weak-password handling"
diff --git a/installer/system_files/overrides/etc/anaconda/conf.d/99-aerocore-password.conf b/installer/system_files/overrides/etc/anaconda/conf.d/99-aerocore-password.conf
new file mode 100644
index 0000000..3105934
--- /dev/null
+++ b/installer/system_files/overrides/etc/anaconda/conf.d/99-aerocore-password.conf
@@ -0,0 +1,5 @@
+[User Interface]
+password_policies =
+    root (quality 1, length 6, strict)
+    user (quality 1, length 6, empty, strict)
+    luks (quality 1, length 6)