@mslacken and @middelkoopt, let me know what you think.

Basically I approve this idea, but handling this with templates is a good idea.
Still there can be a lot of side effects and testing this properly could delay the 4.6.0 release.
Can we push that to 4.6.1?

but handling this with templates is a good idea.

I don't understand. What can be done with templates already is being done with templates. Some of it, like the chown and chmod of all the files in the image, must be done in the image, and the updates to /etc/passwd and /etc/group need to match.

None of that is new; syncuser has been doing this since before I joined the project. But it's been built assuming you're always going to use it. But you've never had to, so this change is mostly about disabling all the warnings.

The only other change is in filtering duplicate entries.

Still there can be a lot of side effects

What new side-effects? Like I said: syncuser is not new. This is just about making it easier to disable, not assuming that people will use it, and (in the most different case) filtering duplicates from the file, which is one of the more common complaints we get about Warewulf.

testing this properly could delay the 4.6.0 release.

That situation is being tested now. If you want more, I'll add more. In fact, syncuser wasn't being tested at all before, because the dependence on the host's /etc directory meant that we couldn't test it. Moving it to sysconfdir means that testenv can direct where it reads host files from, which lets me enable the tests.

Can we push that to 4.6.1?

My first inclination is that this is a significant enough change that, if it doesn't make v4.6.0, it'd need to go to v4.7.0. But I'd strongly prefer getting this in v4.6.0.

Just tell me what you want to see tested that isn't. But, again, this isn't a new feature; it's modifications to an existing feature that was completely untested before, and is tested now (in this PR).