I'm trying to create an image without package-management that includes the shadow and password utilities. However the code at meta/lib/oe/rootfs.py around line 243 always remove those utils if package-management is disabled. This should be either configurable, or not happening. I think it's a valid case that I want password management without package management.
It seems the original idea was to remove such utilities with a read-only rootfs. Since this functionality was embedded in image.bbclas it only checks for the package manager and not for a read-only rootfs. Old commits make reference that these packages must be removed for the read-only filesystem, for example: http://lists.openembedded.org/pipermail/openembedded-core/2014-February/089116.html
The packages listed in there are not installed with every image, for example, core-image-minimal doesn't install shadow; it must be listed in IMAGE_INSTALL in order to be installed.
The logic to uninstall the packages should be changed from checking for a package manager to check for a read-only filesystem.
Agreed, the logic should check for read-only fs
Patch sent to the mailing list: http://lists.openembedded.org/pipermail/openembedded-core/2015-November/113425.html
Waiting for integration in master, moving to 2.1 M2
This bug has been solved in commit: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=9c0186fd57fe6b8ed7b4de7645fdadfc2e5db149