nixos/users-groups: Enforce ASCII usernames and fix repeated doubling of activation script runtime

[infinisil]

I unsuccessfully tried to specify a non-ascii username, all kinds of things broke, so I undid that. Only a bit later I'm running into a very weird problem: The NixOS activation script is taking ~twice as long to finish every time its run, now up to ~10 minutes!

After debugging, I figured out that it's taking so long to decode the /var/lib/nixos/auto-subuid-map, which has grown to 24MB! Turns out, the users-groups script has been doubly-encoding that file as UTF-8, while only singly-decoding it. While this works fine if it's just ASCII, this leads to an exponential explosion for anything else. Here's a demo of this:

#!/usr/bin/env perl

use utf8;
use File::Slurp;
use JSON;

my $file = "/tmp/perl-encoding-test";
my $content = "猫\n";

sub run {
    print $content;
    # Both write_file and encode_json take care of encoding to UTF-8,
    # so this doubly-encodes as UTF-8!
    # Should be without the binmode, or to_json alternatively
    write_file($file, { binmode => ':utf8' }, encode_json($content));
    $content = decode_json(read_file($file));
}

run();
run();
run();
run();

$ nix-shell -p 'perl.withPackages (p: [ p.FileSlurp p.JSON ])' --run 'perl -CS ./test.pl'
猫
�
�
�§���«

In addition to avoiding this double encoding, this PR also adds an assertion to ensure that users.users.*.name only matches what shadow considers valid, to save the trouble of users running into other issues with weird usernames.

Note that Ubuntu by default limits usernames to the more strict [a-z][-a-z0-9_]*, but that would break some configs.¹

Ping @adisbladis who originally introduced the code and @Mic92 who did some other UTF-8 fixes in the script.

Things done

• Ran the patched activation script on my system and checked that non-ascii characters in /var/lib/nixos/auto-subuid-map don't get elongated anymore.
• Set users.users."猫" and ensured that an assertion is thrown:

  Failed assertions:
  - The username "猫" is not valid, it does not match the regex "[a-zA-Z0-9_.][a-zA-Z0-9_.-]*".
  

---

This work is funded by Antithesis and Tweag ✨

Add a 👍 reaction to pull requests you find important.

Footnotes

1. 1 2 3 ↩

[SuperSandro2000]

The rabbit hole calls 😂 Good that you dug that up!

[keysmashes]

"Enforce non-ASCII usernames" in the PR title seems like the opposite of the goal :p

[infinisil]

Would anybody like to merge this? I'd rather avoid self-merges if possible :)