Dear Maintainer,

pam-auth-update parses a specific profile[1] incorrectly and produces
invalid output into /etc/pam.d/common-account. The problematic input
line is the line 11[2].

Instead of producing a valid line like this:

account [success=5 default=ignore]      pam_succeed_if.so uid eq 0 service in chfn:chpasswd:chsh:cron:login quiet

It appends an extra " =" at the end like so:

account [success=5 default=ignore]      pam_succeed_if.so uid eq 0 service in chfn:chpasswd:chsh:cron:login quiet =

The problem is reproducable and can be also seen in my GH project
Actions in the "authentication" part. Even though that particular test
runs Ubuntu, but it behaves exactly the same as in Debian. The Action
also archives the /etc/pam.d/common-account file and should be visible
there too.

To reproduce the issue the following steps can be taken:

* Copy uid_ge_1000.new[1] into /usr/share/pam-configs/uid_ge_1000
* Run: sed -i 's/quiet =$/quiet/' /etc/pam.d/common-account; pam-auth-update-fix --package --enable uid_ge_1000
* Observe invalid " =" appendix in /etc/pam.d/common-account

I'm not an expert in Perl, but I tried debugging this with Copilot and
it suggested the following fix into the merge_one_line function at the
end before returing:

# Filter %{$adds} to exclude invalid keys and standalone tokens
foreach my $key (keys %{$adds}) {
        if ($key eq '=' || $key eq '' || grep { $_ eq $key } @opts) {
                print STDERR "Removing invalid or duplicate key from Adds: $key\n";
                delete $adds->{$key};
        }
}

The full function that Copilot produced is included as an attachment.

That seemed to work, but I'm sure there's a more proper and elegant
solution for this.

[1] https://github.com/pyllyukko/harden.yml/blob/master/files/pam-configs/uid_ge_1000.new
[2] https://github.com/pyllyukko/harden.yml/blob/11cf63ed7d82d8e6bf7f9c85449cb2ff6de20716/files/pam-configs/uid_ge_1000.new#L11
[3] https://github.com/pyllyukko/harden.yml/actions/workflows/ansible-playbook.yml