Remove the subuid and subgid backups during the factory scrub

userdel rewrites /etc/subuid and /etc/subgid, and like every shadow-utils database write it leaves the previous contents behind in a dash-suffixed backup. The scrub removed four of the six backups those tools produce, so the retained @factory baseline still named the previous owner in /etc/subuid- and /etc/subgid- along with their subordinate ID range.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bin/omarchy-system-factory-reset

@@ -310,7 +310,7 @@ scrub_factory_accounts() {
   # passwd --lock preserves the hash. Replace it, then remove the backups
   # that userdel and usermod leave behind.
   usermod --root "$root" --password '!' root >>"$LOG_FILE" 2>&1 || return 1
-  rm -f "$root/etc/"{shadow-,gshadow-,passwd-,group-}
+  rm -f "$root/etc/"{shadow-,gshadow-,passwd-,group-,subuid-,subgid-}
 }
 
 # Remove the seller's account material and machine identity from the retained

test/shell.d/factory-reset-accounts-test.sh

@@ -90,8 +90,10 @@ EOF
   printf 'root:x:0:\ndaemon:x:1:\nseller:x:1000:\nwheel:x:998:seller\n' >"$factory/etc/group"
   printf 'root:!::\ndaemon:!::\nseller:!::\nwheel:!::seller\n' >"$factory/etc/gshadow"
   printf 'USERGROUPS_ENAB yes\n' >"$factory/etc/login.defs"
+  printf 'seller:100000:65536\n' >"$factory/etc/subuid"
+  printf 'seller:100000:65536\n' >"$factory/etc/subgid"
   chmod 600 "$factory/etc/"{shadow,gshadow}
-  for file in passwd shadow group gshadow; do
+  for file in passwd shadow group gshadow subuid subgid; do
     cp "$factory/etc/$file" "$factory/etc/$file-"
   done
 }
@@ -105,7 +107,7 @@ assert_scrubbed() {
   [[ ! -e $root/home/seller ]] || fail "reset removes the seller's baseline home"
   grep -q '^daemon:\*:' "$root/etc/shadow" || fail "reset preserves service accounts"
   [[ $(stat -c '%a' "$root/etc/shadow") == "600" ]] || fail "shadow stays private"
-  for file in passwd shadow group gshadow; do
+  for file in passwd shadow group gshadow subuid subgid; do
     [[ ! -e $root/etc/$file- ]] || fail "reset removes the $file backup"
   done
 }