anchor.diff:          home = "/root";
           shell = mkDefault cfg.defaultUserShell;
           group = "root";
  +        initialHashedPassword = mkDefault "!";
         };
         nobody = {
           uid = ids.uids.nobody;
  
positive.code:         # there is at least one "privileged" account that has a
          # password or an SSH authorized key. Privileged accounts are
          # root and users in the wheel group.
          assertion = !cfg.mutableUsers ->
            any id ((mapAttrsToList (_: cfg:
              (cfg.name == "root"
               || cfg.group == "wheel"
               || elem "wheel" cfg.extraGroups)
              &&
  
negative.code:              || cfg.openssh.authorizedKeys.keyFiles != [])
            ) cfg.users) ++ [
              config.security.googleOsLogin.enable
            ];
          message = ''
            Neither the root account nor any wheel user has a password or SSH authorized key.
            You must set one to prevent being locked out of your system.
            If you really want to be locked out of your system, set users.allowNoPasswordLogin = true;
            However you are most probably better off by setting users.mutableUsers = true; and
            manually running passwd root to set the root password.
            '';
        }
      ] ++ flatten (flip mapAttrsToList cfg.users (name: user:
        [
  