Share accounts: per-site Samba passwords from the webapp

Tools > Share accounts sets the pxe-upload, blancco and clonezilla Samba
passwords. Saving one runs smbpasswd and writes it everywhere it is used:
startnet.cmd in boot.wim (pxe-upload), the served Blancco preferences and
the live config.img (blancco), the iPXE menu's Clonezilla entries
(clonezilla). Refused while a PC is imaging unless forced. Stored 0600 in
UPDATES_DIR/shares/accounts.json, never shown back.

- The stored values are the authority: the playbook only creates the
  Samba accounts, seeds the store from site-vars (pxe_upload_password,
  blancco_smb_password, clonezilla_smb_password) for accounts it does not
  hold, and runs "share_accounts apply" at the end of every run.
- Every startnet save re-pins SHAREPASS, so a restored snapshot cannot
  bring an old password back; new menu blocks use %SHAREUSER%/%SHAREPASS%.
- Shop floor unattend Order 4 reads the login from fetch-source.txt;
  Invoke-PostPpkg deletes that file once the PPKG is applied.
- Upload-Image.ps1 asks for the password unless -Pass is given.
- pxe_admin_password: the Linux pxe login. Required while the box still
  has the shipped "pxe"; set with chpasswd when it differs.
- Blancco site settings now also reach the live config.img (BIOS path).

tests/vm/README.md

@@ -70,7 +70,8 @@ Watch the server with `virt-viewer -c qemu:///system pxetest-server` (VNC on
 127.0.0.1) or screenshots. On the installed system, first-boot output goes
 to `/var/log/first-boot.log`. Once the GE NIC takes a DHCP lease on the NAT
 network, `status.sh` shows its address and `ssh pxe@<address>` works from
-the host.
+the host (password `pxetest-admin`, or `PXETEST_ADMIN_PASSWORD` given to
+build-image.sh).
 
 The offline package set must be built against the SAME ISO the image is
 built from (download-packages.sh resolves against that ISO's base). For a

tests/vm/build-image.sh

@@ -11,6 +11,9 @@
 #   server with its GE NIC unplugged: virsh domif-setlink pxetest-server
 #   52:54:00:9e:10:01 down --config).
 # Env:   PXETEST_PAYLOAD_ROOT (where offline-packages/, boot-files/... live)
+#        PXETEST_ADMIN_PASSWORD (the server's pxe login, default pxetest-admin)
+#        PXETEST_UPLOAD_PASSWORD / _BLANCCO_PASSWORD / _CLONEZILLA_PASSWORD
+#        (optional share password seeds)
 source "$(dirname "$0")/common.sh"
 
 SIZE=auto
@@ -69,6 +72,16 @@ corp_nic_mac: "$SERVER_GE_MAC"   # libvirt default NAT ("GE/corp")
 YML
     log "site vars: pxe_nic_mac=$SERVER_IMAGING_MAC corp_nic_mac=$SERVER_GE_MAC"
 fi
+# The server's Linux login (required while it has the shipped "pxe") and,
+# when set, seeds for the share accounts (Tools > Share accounts).
+{
+    echo "pxe_admin_password: \"${PXETEST_ADMIN_PASSWORD:-pxetest-admin}\""
+    [ -n "${PXETEST_UPLOAD_PASSWORD:-}" ] && echo "pxe_upload_password: \"$PXETEST_UPLOAD_PASSWORD\""
+    [ -n "${PXETEST_BLANCCO_PASSWORD:-}" ] && echo "blancco_smb_password: \"$PXETEST_BLANCCO_PASSWORD\""
+    [ -n "${PXETEST_CLONEZILLA_PASSWORD:-}" ] && echo "clonezilla_smb_password: \"$PXETEST_CLONEZILLA_PASSWORD\""
+    true
+} >>"$SITE_VARS"
+log "site vars: pxe_admin_password set (PXETEST_ADMIN_PASSWORD, default pxetest-admin)"
 
 "$REPO_ROOT/scripts/build-usb.sh" --yes --payload-root "$PXETEST_PAYLOAD_ROOT" \
     --site-vars "$SITE_VARS" \