From 4ea08a0353f85b5b0cc1ddd70da5fa23e7d588a4 Mon Sep 17 00:00:00 2001
From: Darren Tucker <dtucker@dtucker.net>
Date: Mon, 4 May 2026 23:33:57 +1000
Subject: [PATCH] Improve NetBSD PAM tests.

 - Set random password and use for password auth test.
 - When testing PAM builds, test with and without UsePAM.
---
 .github/workflows/vm.yml | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/vm.yml b/.github/workflows/vm.yml
index f6fb05a91..7d5161b5b 100644
--- a/.github/workflows/vm.yml
+++ b/.github/workflows/vm.yml
@@ -168,7 +168,9 @@ jobs:
         usesh: true
         prepare: |
           /usr/sbin/pkg_add sudo
-          /usr/sbin/useradd -m builder
+          openssl rand -base64 9 >$GITHUB_WORKSPACE/regress/password
+          pw=$(tr -d '\n' <$GITHUB_WORKSPACE/regress/password | pwhash)
+          /usr/sbin/useradd -m -p "${pw}" builder
           echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/pkg/etc/sudoers
           mkdir -p /var/empty /usr/local/etc
           cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
@@ -200,11 +202,17 @@ jobs:
     - name: "PAM: make"
       shell: netbsd {0}
       run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
-    - name: "PAM: make t-exec"
+    - name: "PAM: make t-exec UsePAM=no"
       shell: netbsd {0}
       run: |
         cd $GITHUB_WORKSPACE
-        sudo -u builder env SUDO=sudo SSHD_CONFOPTS="UsePam yes" make t-exec
+        sudo -u builder env SUDO=sudo make t-exec
+    - name: "PAM: make t-exec UsePAM=yes"
+      shell: netbsd {0}
+      run: |
+        cd $GITHUB_WORKSPACE
+        cp regress/password regress/kbdintpw
+        sudo -u builder env SUDO=sudo TEST_SSH_SSHD_CONFOPTS="UsePam yes" make t-exec
 
 
   omnios: