From b9375419326dcd6b52be43de11d6c020ad7ff3bf Mon Sep 17 00:00:00 2001
From: Victor Moene <victor.moene@northern.tech>
Date: Mon, 12 Jan 2026 15:21:48 +0100
Subject: [PATCH] Fixed cf-remote install hub does not set password

Ticket: ENT-13655
Signed-off-by: Victor Moene <victor.moene@northern.tech>
---
 MANIFEST.in        |  1 +
 cf_remote/demo.py  | 34 +++++++---------------------------
 cf_remote/demo.sql | 27 +++++++++++++++++++++++++++
 3 files changed, 35 insertions(+), 27 deletions(-)
 create mode 100644 cf_remote/demo.sql

diff --git a/MANIFEST.in b/MANIFEST.in
index e9bd8fd..522d0f8 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -1,3 +1,4 @@
 include cf_remote/nt-discovery.sh
 include cf_remote/Vagrantfile
 include cf_remote/default_provision.sh
+include cf_remote/demo.sql
diff --git a/cf_remote/demo.py b/cf_remote/demo.py
index 70af68b..cdfc7c1 100644
--- a/cf_remote/demo.py
+++ b/cf_remote/demo.py
@@ -1,37 +1,12 @@
 import os
 import json
+from posixpath import dirname, join
 
 from cf_remote import log
 from cf_remote.paths import cf_remote_dir
 from cf_remote.utils import save_file
 from cf_remote.ssh import scp, ssh_sudo, ssh_cmd, auto_connect
 
-SET_ADMIN_PASSWORD_QUERY = """UPDATE
-       \"system\"
-SET
-       \"value\" = 'true'
-WHERE
-       \"key\" = 'is_setup_complete';
-INSERT
-INTO
-       \"users\"
-       (\"username\", \"password\", \"salt\", \"name\", \"email\", \"external\", \"active\", \"roles\", \"changetimestamp\") SELECT
-       'admin',
-       'SHA=7f062dc2ef82d2b87f012fc17d70c372aa4e2883d9b6c5c1cc7382a5c868b724',
-       'eWAbKQmxNP',
-       'admin',
-       'admin@organisation.com',
-       false,
-       '1',
-       '{admin,cf_remoteagent}',
-       now()
-              ON CONFLICT (username,
-              external) DO UPDATE
-
-       SET
-              password = 'SHA=7f062dc2ef82d2b87f012fc17d70c372aa4e2883d9b6c5c1cc7382a5c868b724',
-              salt = 'eWAbKQmxNP';"""
-
 
 @auto_connect
 def agent_run(data, *, connection=None):
@@ -50,9 +25,14 @@ def agent_run(data, *, connection=None):
 @auto_connect
 def disable_password_dialog(host, *, connection=None):
     print("Disabling password change on hub: '{}'".format(host))
+
+    query_path = join(dirname(__file__), "demo.sql")
+    scp(query_path, host, connection=connection)
+
+    query = os.path.basename(query_path)
     ssh_sudo(
         connection,
-        '/var/cfengine/bin/psql cfsettings -c "{}"'.format(SET_ADMIN_PASSWORD_QUERY),
+        '/var/cfengine/bin/psql cfsettings -f "{}"'.format(query),
     )
 
 
diff --git a/cf_remote/demo.sql b/cf_remote/demo.sql
new file mode 100644
index 0000000..ed6a087
--- /dev/null
+++ b/cf_remote/demo.sql
@@ -0,0 +1,27 @@
+UPDATE "system"
+SET "value" = 'true'
+WHERE "key" = 'is_setup_complete';
+
+
+INSERT INTO "users" ("username",
+                     "password",
+                     "salt",
+                     "name",
+                     "email",
+                     "external",
+                     "active",
+                     "roles",
+                     "changetimestamp")
+SELECT 'admin',
+       'SHA=7f062dc2ef82d2b87f012fc17d70c372aa4e2883d9b6c5c1cc7382a5c868b724',
+       'eWAbKQmxNP',
+       'admin',
+       'admin@organisation.com',
+       FALSE,
+       '1',
+       '{admin,cf_remoteagent}',
+       now() ON CONFLICT (username,
+                          EXTERNAL) DO
+UPDATE
+SET password = 'SHA=7f062dc2ef82d2b87f012fc17d70c372aa4e2883d9b6c5c1cc7382a5c868b724',
+    salt = 'eWAbKQmxNP';