From ce19dae6a2d6ab3665374ead04c270fd45d563fb Mon Sep 17 00:00:00 2001
From: Stefan Fercot <pgstef@fercot.be>
Date: Thu, 17 Sep 2026 09:59:27 +0200
Subject: [PATCH] Allow test user names that adduser on Debian rejects.

The test container is built with the same user name and id as the user on the host so files created inside it are owned by that user. Debian's adduser only accepts a name that matches NAME_REGEX, which excludes a dot, so vm-build failed on the Debian-based images for a host user named e.g. first.last.

Pass the flag that skips the check, since the name comes from the account running the build rather than from outside. The flag was renamed from --force-badname to --allow-bad-names and Ubuntu 22.04 ships a version that only knows the old spelling, so the spelling is taken from adduser --help when the container is built rather than hardcoded.
---
 doc/xml/release/2020s/2026/2.60.0.xml         | 12 ++++++++++++
 test/lib/command/vm/build.py                  |  9 +++++++++
 test/src/module/test/command/vm/build_test.py |  3 ++-
 3 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/doc/xml/release/2020s/2026/2.60.0.xml b/doc/xml/release/2020s/2026/2.60.0.xml
index 41c13ec08..59e338d36 100644
--- a/doc/xml/release/2020s/2026/2.60.0.xml
+++ b/doc/xml/release/2020s/2026/2.60.0.xml
@@ -241,6 +241,18 @@
 
                 <p>Replace deprecated OpenSSL APIs.</p>
             </release-item>
+
+            <release-item>
+                <github-issue id="2858"/>
+                <github-pull-request id="2859"/>
+
+                <release-item-contributor-list>
+                    <release-item-contributor id="stefan.fercot"/>
+                    <release-item-reviewer id="david.steele"/>
+                </release-item-contributor-list>
+
+                <p>Allow test user names that adduser on Debian rejects.</p>
+            </release-item>
         </release-development-list>
     </release-core-list>
 
diff --git a/test/lib/command/vm/build.py b/test/lib/command/vm/build.py
index 506707eee..738f6e1af 100644
--- a/test/lib/command/vm/build.py
+++ b/test/lib/command/vm/build.py
@@ -158,6 +158,15 @@ def _user_create(os_base, name, id, group):
     if os_base == VM_OS_BASE_RHEL:
         return "adduser -g%s -u%u -N %s" % (group, id, name)
 
+    # Debian's adduser rejects usernames that do not match NAME_REGEX (e.g. containing a dot). The name mirrors the trusted host
+    # user rather than external input, so it is safe to bypass this check. Ubuntu 22.04's adduser only understands the older
+    # --force-badname spelling; 24.04 accepts both, so detect which one this image's adduser advertises.
+    if os_base == VM_OS_BASE_DEBIAN:
+        return (
+            "badname=$(adduser --help 2>&1 | grep -q -- --allow-bad-names && echo --allow-bad-names || "
+            'echo --force-badname) && adduser --uid=%u --ingroup=%s --disabled-password --gecos "" $badname %s'
+        ) % (id, group, name)
+
     return 'adduser --uid=%u --ingroup=%s --disabled-password --gecos "" %s' % (id, group, name)
 
 
diff --git a/test/src/module/test/command/vm/build_test.py b/test/src/module/test/command/vm/build_test.py
index ecdfd3f27..517f534f6 100644
--- a/test/src/module/test/command/vm/build_test.py
+++ b/test/src/module/test/command/vm/build_test.py
@@ -96,7 +96,8 @@ SCRIPT_TEST_U24 = """ && \\
 
 # Create test user
     groupadd -f -g[GROUP_ID] [GROUP] && \\
-    adduser --uid=[USER_ID] --ingroup=[GROUP] --disabled-password --gecos "" [USER] && \\
+    badname=$(adduser --help 2>&1 | grep -q -- --allow-bad-names && echo --allow-bad-names || echo --force-badname) && \
+adduser --uid=[USER_ID] --ingroup=[GROUP] --disabled-password --gecos "" $badname [USER] && \\
     mkdir -m 750 /home/[USER]/test && \\
     chown [USER]:[GROUP] /home/[USER]/test && \\