[BUG] Password with copy-paste includes trailing newline → yescrypt hash incompatible with PAM (sudo fails) #1627

Describe the bug

When setting a user password in Raspberry Pi Imager v2.0.7 on Windows 11 using copy-paste, the resulting yescrypt hash stored in /boot/firmware/user-data is computed from the password string plus a trailing \n character. Since PAM always strips the newline terminator when reading passwords, the hash never matches — making sudo permanently unusable without a reflash.

Steps to reproduce

1. Open Raspberry Pi Imager v2.0.7 on Windows 11
2. Select device, OS (Raspberry Pi OS Lite 32-bit Bookworm), storage
3. Go to Personalisation → User and paste a password using copy-paste (e.g. from a password generator)
4. Complete the flash
5. Boot the Pi, connect via SSH
6. Try sudo with the same password → Sorry, try again.

Expected behavior

sudo works with the password entered in Imager.

Actual behavior

sudo always fails. The hash in /boot/firmware/user-data does not correspond to the typed password.

Root cause (verified)

The hash stored in the Windows registry (HKCU\Software\Raspberry Pi\Raspberry Pi Imager\imagecustomization\sshUserPassword) and in /boot/firmware/user-data is the yescrypt hash of <password>\n (password + newline), not <password>.

Verified on the Pi using Perl's crypt() (which calls the system libxcrypt):

perl -e '
my $salt = "$y$jB5$<salt_from_user_data>";
my $target = "<full_hash_from_user_data>";
for my $p ("<password>", "<password>\n") {
    my $h = crypt($p, $salt);
    print ($h eq $target ? "MATCH" : "no") . ": [$p]\n";
}
'

Output:

no: [<password>]
MATCH: [<password>\n]

Since PAM reads passwords using getpass() (or equivalent), which always strips the newline terminator, the stored hash can never be matched at runtime — regardless of how the password is entered.

Workaround

Reflash the SD card. Before doing so, clear Imager's cached settings to prevent it from reusing the corrupted password hash:

⚠️ Warning — destructive operation: the commands below permanently delete all settings previously saved by Raspberry Pi Imager on this machine (hostname, username, SSH keys, Wi-Fi credentials, etc.). You will need to re-enter them from scratch in the Imager UI. Only proceed if you are aware of what was configured.

# PowerShell (Windows) — run only after reading the warning above
reg delete "HKCU\Software\Raspberry Pi" /f
Remove-Item -Recurse -Force "$env:LOCALAPPDATA\Raspberry Pi" -ErrorAction SilentlyContinue

Then type the password manually with the keyboard in the Imager UI — do not use copy-paste.

Environment

Additional context

Related issues: #1285, #878, #754 (all report password failures post-flash but do not identify the trailing \n as root cause).