git: af0ca8cd7534 - stable/15 - nuageinit: accept lock_passwd for users

The branch stable/15 has been updated by bapt:

URL: https://cgit.FreeBSD.org/src/commit/?id=af0ca8cd7534d86e12186081a9b882fb9e7e71a9

commit af0ca8cd7534d86e12186081a9b882fb9e7e71a9
Author:     Baptiste Daroussin <bapt@FreeBSD.org>
AuthorDate: 2026-08-11 09:46:52 +0000
Commit:     Baptiste Daroussin <bapt@FreeBSD.org>
CommitDate: 2026-09-07 04:19:01 +0000

    nuageinit: accept lock_passwd for users
    
    Alias cloud-init lock_passwd key alongside locked.
    
    (cherry picked from commit cd06bf52053d463f4a3f6c0b9cb5c9f1d578e439)
---
 libexec/nuageinit/nuage.lua          |  2 +-
 libexec/nuageinit/nuageinit.7        |  5 ++++-
 libexec/nuageinit/tests/nuageinit.sh | 30 ++++++++++++++++++++++++++++++
 3 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/libexec/nuageinit/nuage.lua b/libexec/nuageinit/nuage.lua
index 8f609feb0980..80ba54680039 100644
--- a/libexec/nuageinit/nuage.lua
+++ b/libexec/nuageinit/nuage.lua
@@ -388,7 +388,7 @@ local function adduser(pwd)
 		warnmsg(cmd)
 		return nil
 	end
-	if pwd.locked then
+	if pwd.lock_passwd or pwd.locked then
 		cmd = "pw "
 		if root then
 			cmd = cmd .. "-R " .. root .. " "
diff --git a/libexec/nuageinit/nuageinit.7 b/libexec/nuageinit/nuageinit.7
index a9552cace85f..4f1a492473af 100644
--- a/libexec/nuageinit/nuageinit.7
+++ b/libexec/nuageinit/nuageinit.7
@@ -555,8 +555,11 @@ The encrypted password for the user.
 .It Ic plain_text_passwd
 The password in plain text for the user.
 Ignored if an encrypted password is already provided.
-.It Ic locked
+.It Ic lock_passwd
 Boolean to determine if the user account should be locked.
+The legacy
+.Ic locked
+key is also accepted.
 .It Ic sudo
 A string or an array of strings which should be appended to
 .Pa ${LOCALBASE}/etc/sudoers.d/90-nuageinit-users
diff --git a/libexec/nuageinit/tests/nuageinit.sh b/libexec/nuageinit/tests/nuageinit.sh
index a4b0def48a86..4803ddf941ab 100644
--- a/libexec/nuageinit/tests/nuageinit.sh
+++ b/libexec/nuageinit/tests/nuageinit.sh
@@ -181,6 +181,35 @@ EOF
 	atf_check -o inline:"permit persist foobar as root\ndeny bla as foobar\npermit persist bla as root cmd whoami\n" cat "${PWD}/${localbase}/etc/doas.conf"
 }
 
+nocloud_userdata_cloudconfig_users_lock_passwd_head()
+{
+	atf_set "require.user" root
+}
+nocloud_userdata_cloudconfig_users_lock_passwd_body()
+{
+	mkdir -p media/nuageinit
+	printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data
+	mkdir -p etc
+	cat > etc/master.passwd << EOF
+root:*:0:0::0:0:Charlie &:/root:/bin/sh
+sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
+EOF
+	pwd_mkdb -d etc "${PWD}"/etc/master.passwd
+	cat > etc/group << EOF
+wheel:*:0:root
+users:*:1:
+EOF
+	cat > media/nuageinit/user-data << 'EOF'
+#cloud-config
+users:
+  - name: lockeduser
+    lock_passwd: true
+EOF
+	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
+	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit postnet
+	atf_check -o match:'lockeduser:\*LOCKED\*:' cat "${PWD}"/etc/master.passwd
+}
+
 nocloud_network_head()
 {
 	atf_set "require.user" root
@@ -1474,6 +1503,7 @@ atf_init_test_cases()
 	atf_add_test_case nocloud_userdata_script
 	atf_add_test_case nocloud_user_data_script
 	atf_add_test_case nocloud_userdata_cloudconfig_users
+	atf_add_test_case nocloud_userdata_cloudconfig_users_lock_passwd
 	atf_add_test_case nocloud_network
 	atf_add_test_case config2
 	atf_add_test_case config2_pubkeys