Offline provisioning with `systemd-firstboot` leads to non-functioning system

[supakeen]

When using the documented approach for offline provisioning of the root user and timezone:

$ sudo systemd-firstboot \
  --image teamsbc-44-standard-rpi4.raw \
  --prompt-root-password \
  --prompt-timezone

The image ends up booting but services fail and it's not possible to login.

[supakeen]

Specifically this has to do with setting the root password. Only setting the timezone doesn't break the system.

[supakeen]

Most likely SELinux again:

artifacts € ls -Zlarth mnt-firstboot/etc/shadow
----------. 1 root root system_u:object_r:init_var_run_t:s0 579 Jun 18 10:36 mnt-firstboot/etc/shadow
artifacts € ls -Zlarth mnt-clean/etc/shadow    
----------. 1 root root system_u:object_r:shadow_t:s0 520 Jun 18 09:00 mnt-clean/etc/shadow

It feels like when ran from inside the image the file keeps the appropriate labeling but when ran from outside the image (with --image) it does not.

[supakeen]

Filed: systemd/systemd#42643

[supakeen]

Documented a workaround for users that encounter this issue, if any offline provisioning is performed with systemd tooling then they need to touch the .autorelabel file at the root of the filesystem.

See: https://handbook.teamsbc.org/getting-started/provisioning.html#offline-provisioning