diff --git a/libexec/nuageinit/nuageinit b/libexec/nuageinit/nuageinit
index dda3ae482859..f2f15f0d36f0 100755
--- a/libexec/nuageinit/nuageinit
+++ b/libexec/nuageinit/nuageinit
@@ -1,404 +1,409 @@
 #!/usr/libexec/flua
 ---
 -- SPDX-License-Identifier: BSD-2-Clause-FreeBSD
 --
 -- Copyright(c) 2022-2025 Baptiste Daroussin <bapt@FreeBSD.org>
 
 local nuage = require("nuage")
 local ucl = require("ucl")
 local yaml = require("yaml")
 local sys_stat = require("posix.sys.stat")
 
 if #arg ~= 2 then
 	nuage.err("Usage: " .. arg[0] .. " <cloud-init-directory> (<config-2> | <nocloud>)", false)
 end
 local path = arg[1]
 local citype = arg[2]
 
 local default_user = {
 	name = "freebsd",
 	homedir = "/home/freebsd",
 	groups = "wheel",
 	gecos = "FreeBSD User",
 	shell = "/bin/sh",
 	plain_text_passwd = "freebsd"
 }
 
 local root = os.getenv("NUAGE_FAKE_ROOTDIR")
 if not root then
 	root = ""
 end
 
 local function openat(dir, name)
 	local path_dir = root .. dir
 	local path_name = path_dir .. "/" .. name
 	nuage.mkdir_p(path_dir)
 	local f, err = io.open(path_name, "w")
 	if not f then
 		nuage.err("unable to open " .. path_name .. ": " .. err)
 	end
 	return f, path_name
 end
 local function open_ssh_key(name)
 	return openat("/etc/ssh", name)
 end
 
 local function open_config(name)
 	return openat("/etc/rc.conf.d", name)
 end
 
 local function get_ifaces()
 	local parser = ucl.parser()
 	-- grab ifaces
 	local ns = io.popen("netstat -i --libxo json")
 	local netres = ns:read("*a")
 	ns:close()
 	local res, err = parser:parse_string(netres)
 	if not res then
 		nuage.warn("Error parsing netstat -i --libxo json outout: " .. err)
 		return nil
 	end
 	local ifaces = parser:get_object()
 	local myifaces = {}
 	for _, iface in pairs(ifaces["statistics"]["interface"]) do
 		if iface["network"]:match("<Link#%d>") then
 			local s = iface["address"]
 			myifaces[s:lower()] = iface["name"]
 		end
 	end
 	return myifaces
 end
 
 local function install_packages(packages)
 	if not nuage.pkg_bootstrap() then
 		nuage.warn("Failed to bootstrap pkg, skip installing packages")
 		return
 	end
 	for n, p in pairs(packages) do
 		if type(p) == "string" then
 			if not nuage.install_package(p) then
 				nuage.warn("Failed to install : " .. p)
 			end
 		else
 			nuage.warn("Invalid type : " .. type(p) .. " for packages entry number " .. n)
 		end
 	end
 end
 
 local function config2_network(p)
 	local parser = ucl.parser()
 	local f = io.open(p .. "/network_data.json")
 	if not f then
 		-- silently return no network configuration is provided
 		return
 	end
 	f:close()
 	local res, err = parser:parse_file(p .. "/network_data.json")
 	if not res then
 		nuage.warn("error parsing network_data.json: " .. err)
 		return
 	end
 	local obj = parser:get_object()
 
 	local ifaces = get_ifaces()
 	if not ifaces then
 		nuage.warn("no network interfaces found")
 		return
 	end
 	local mylinks = {}
 	for _, v in pairs(obj["links"]) do
 		local s = v["ethernet_mac_address"]:lower()
 		mylinks[v["id"]] = ifaces[s]
 	end
 
 	local network = open_config("network")
 	local routing = open_config("routing")
 	local ipv6 = {}
 	local ipv6_routes = {}
 	local ipv4 = {}
 	for _, v in pairs(obj["networks"]) do
 		local interface = mylinks[v["link"]]
 		if v["type"] == "ipv4_dhcp" then
 			network:write("ifconfig_" .. interface .. '="DHCP"\n')
 		end
 		if v["type"] == "ipv4" then
 			network:write(
 				"ifconfig_" .. interface .. '="inet ' .. v["ip_address"] .. " netmask " .. v["netmask"] .. '"\n'
 			)
 			if v["gateway"] then
 				routing:write('defaultrouter="' .. v["gateway"] .. '"\n')
 			end
 			if v["routes"] then
 				for i, r in ipairs(v["routes"]) do
 					local rname = "cloudinit" .. i .. "_" .. interface
 					if v["gateway"] and v["gateway"] == r["gateway"] then
 						goto next
 					end
 					if r["network"] == "0.0.0.0" then
 						routing:write('defaultrouter="' .. r["gateway"] .. '"\n')
 						goto next
 					end
 					routing:write("route_" .. rname .. '="-net ' .. r["network"] .. " ")
 					routing:write(r["gateway"] .. " " .. r["netmask"] .. '"\n')
 					ipv4[#ipv4 + 1] = rname
 					::next::
 				end
 			end
 		end
 		if v["type"] == "ipv6" then
 			ipv6[#ipv6 + 1] = interface
 			ipv6_routes[#ipv6_routes + 1] = interface
 			network:write("ifconfig_" .. interface .. '_ipv6="inet6 ' .. v["ip_address"] .. '"\n')
 			if v["gateway"] then
 				routing:write('ipv6_defaultrouter="' .. v["gateway"] .. '"\n')
 				routing:write("ipv6_route_" .. interface .. '="' .. v["gateway"])
 				routing:write(" -prefixlen 128 -interface " .. interface .. '"\n')
 			end
 			-- TODO compute the prefixlen for the routes
 			--if v["routes"] then
 			--	for i, r in ipairs(v["routes"]) do
 			--	local rname = "cloudinit" .. i .. "_" .. mylinks[v["link"]]
 			--		-- skip all the routes which are already covered by the default gateway, some provider
 			--		-- still list plenty of them.
 			--		if v["gateway"] == r["gateway"] then
 			--			goto next
 			--		end
 			--		routing:write("ipv6_route_" .. rname .. '"\n')
 			--		ipv6_routes[#ipv6_routes + 1] = rname
 			--		::next::
 			--	end
 			--end
 		end
 	end
 	if #ipv4 > 0 then
 		routing:write('static_routes="')
 		routing:write(table.concat(ipv4, " ") .. '"\n')
 	end
 	if #ipv6 > 0 then
 		network:write('ipv6_network_interfaces="')
 		network:write(table.concat(ipv6, " ") .. '"\n')
 		network:write('ipv6_default_interface="' .. ipv6[1] .. '"\n')
 	end
 	if #ipv6_routes > 0 then
 		routing:write('ipv6_static_routes="')
 		routing:write(table.concat(ipv6, " ") .. '"\n')
 	end
 	network:close()
 	routing:close()
 end
 
 if citype == "config-2" then
 	local parser = ucl.parser()
 	local res, err = parser:parse_file(path .. "/meta_data.json")
 
 	if not res then
 		nuage.err("error parsing config-2 meta_data.json: " .. err)
 	end
 	local obj = parser:get_object()
 	if obj.public_keys then
 		local homedir = nuage.adduser(default_user)
 		for _,v in pairs(obj.public_keys) do
 			nuage.addsshkey(homedir, v)
 		end
 	end
 	nuage.sethostname(obj["hostname"])
 
 	-- network
 	config2_network(path)
 elseif citype == "nocloud" then
 	local f, err = io.open(path .. "/meta-data")
 	if err then
 		nuage.err("error parsing nocloud meta-data: " .. err)
 	end
 	local obj = yaml.eval(f:read("*a"))
 	f:close()
 	if not obj then
 		nuage.err("error parsing nocloud meta-data")
 	end
 	local hostname = obj["local-hostname"]
 	if not hostname then
 		hostname = obj["hostname"]
 	end
 	if hostname then
 		nuage.sethostname(hostname)
 	end
 else
 	nuage.err("Unknown cloud init type: " .. citype)
 end
 
 -- deal with user-data
 local ud = nil
 local f = nil
 userdatas = {"user-data", "user_data"}
 for _, v in pairs(userdatas) do
 	f = io.open(path .. "/" .. v, "r")
 	if f then
 		ud = v
 		break
 	end
 end
 if not f then
 	os.exit(0)
 end
 local line = f:read("*l")
 f:close()
 if line == "#cloud-config" then
 	f = io.open(path .. "/" .. ud)
 	local obj = yaml.eval(f:read("*a"))
 	f:close()
 	if not obj then
 		nuage.err("error parsing cloud-config file: " .. ud)
 	end
 	if obj.groups then
 		for n, g in pairs(obj.groups) do
 			if (type(g) == "string") then
 				local r = nuage.addgroup({name = g})
 				if not r then
 					nuage.warn("failed to add group: " .. g)
 				end
 			elseif type(g) == "table" then
 				for k, v in pairs(g) do
 					nuage.addgroup({name = k, members = v})
 				end
 			else
 				nuage.warn("invalid type: " .. type(g) .. " for users entry number " .. n)
 			end
 		end
 	end
 	if obj.users then
 		for n, u in pairs(obj.users) do
 			if type(u) == "string" then
 				if u == "default" then
 					nuage.adduser(default_user)
 				else
 					nuage.adduser({name = u})
 				end
 			elseif type(u) == "table" then
 				-- ignore users without a username
 				if u.name == nil then
 					goto unext
 				end
 				local homedir = nuage.adduser(u)
 				if u.ssh_authorized_keys then
 					for _, v in ipairs(u.ssh_authorized_keys) do
 						nuage.addsshkey(homedir, v)
 					end
 				end
 			else
 				nuage.warn("invalid type : " .. type(u) .. " for users entry number " .. n)
 			end
 			::unext::
 		end
 	else
 	-- default user if none are defined
 		nuage.adduser(default_user)
 	end
 	if obj.ssh_keys and type(obj.ssh_keys) == "table" then
 		for key, val in pairs(obj.ssh_keys) do
 			for keyname, keytype in key:gmatch("(%w+)_(%w+)") do
 				local sshkn = nil
 				if keytype == "public" then
 					sshkn =  "ssh_host_" .. keyname .. "_key.pub"
 				elseif keytype == "private" then
 					sshkn = "ssh_host_" .. keyname .. "_key"
 				end
 				if sshkn then
 					local sshkey, path = open_ssh_key(sshkn)
 					if sshkey then
 						sshkey:write(val .. "\n")
 						sshkey:close()
 					end
 					if keytype == "private" then
 						sys_stat.chmod(path, 384)
 					end
 				end
 			end
 		end
 	end
 	if obj.ssh_authorized_keys then
 		local homedir = nuage.adduser(default_user)
 		for _, k in ipairs(obj.ssh_authorized_keys) do
 			nuage.addsshkey(homedir, k)
 		end
 	end
 	if obj.network then
 		local ifaces = get_ifaces()
 		local network = open_config("network")
 		local routing = open_config("routing")
 		local ipv6 = {}
 		for _, v in pairs(obj.network.ethernets) do
 			if not v.match then
 				goto next
 			end
 			if not v.match.macaddress then
 				goto next
 			end
 			if not ifaces[v.match.macaddress] then
 				nuage.warn("not interface matching: " .. v.match.macaddress)
 				goto next
 			end
 			local interface = ifaces[v.match.macaddress]
 			if v.dhcp4 then
 				network:write("ifconfig_" .. interface .. '="DHCP"\n')
 			elseif v.addresses then
 				for _, a in pairs(v.addresses) do
 					if a:match("^(%d+)%.(%d+)%.(%d+)%.(%d+)") then
 						network:write("ifconfig_" .. interface .. '="inet ' .. a .. '"\n')
 					else
 						network:write("ifconfig_" .. interface .. '_ipv6="inet6 ' .. a .. '"\n')
 						ipv6[#ipv6 + 1] = interface
 					end
 				end
 			end
 			if v.gateway4 then
 				routing:write('defaultrouter="' .. v.gateway4 .. '"\n')
 			end
 			if v.gateway6 then
 				routing:write('ipv6_defaultrouter="' .. v.gateway6 .. '"\n')
 				routing:write("ipv6_route_" .. interface .. '="' .. v.gateway6)
 				routing:write(" -prefixlen 128 -interface " .. interface .. '"\n')
 			end
 			::next::
 		end
 		if #ipv6 > 0 then
 			network:write('ipv6_network_interfaces="')
 			network:write(table.concat(ipv6, " ") .. '"\n')
 			network:write('ipv6_default_interface="' .. ipv6[1] .. '"\n')
 		end
 		network:close()
 		routing:close()
 	end
 	if obj.ssh_pwauth ~= nil then
 		local value = "no"
 		if obj.ssh_pwauth then
 			value = "yes"
 		end
 		nuage.update_sshd_config("PasswordAuthentication", value)
 	end
 	if obj.chpasswd ~= nil then
 		nuage.chpasswd(obj.chpasswd)
 	end
 	if obj.runcmd then
 		for _, c in ipairs(obj.runcmd) do
 			if not os.execute(c) then
 				nuage.warn("Failed to execute '" .. c .. "'")
 				-- execute the next command anyway --
 			end
 		end
 	end
 	if obj.packages then
 		install_packages(obj.packages)
 	end
 
 	if obj.package_update then
 		nuage.update_packages()
 	end
 	if obj.package_upgrade then
 		nuage.upgrade_packages()
 	end
-else
-	local res, err = os.execute(path .. "/" .. ud)
-	if not res then
-		nuage.err("error executing user-data script: " .. err)
-	end
+elseif line:sub(1, 2) == "#!" then
+	-- delay for execution at rc.local time --
+	f = io.open(path .. "/" .. ud)
+	local content = f:read("*a")
+	f:close()
+	nuage.mkdir_p(root .. "/var/cache/nuageinit")
+	f = assert(io.open(root .. "/var/cache/nuageinit/user_data", "w"))
+	f:write(content)
+	f:close()
+	sys_stat.chmod(root .. "/var/cache/nuageinit/user_data", 493)
 end
diff --git a/libexec/nuageinit/tests/nuageinit.sh b/libexec/nuageinit/tests/nuageinit.sh
index 5fc811f1dcb5..be8b186d933b 100644
--- a/libexec/nuageinit/tests/nuageinit.sh
+++ b/libexec/nuageinit/tests/nuageinit.sh
@@ -1,836 +1,862 @@
 #-
 # Copyright (c) 2022 Baptiste Daroussin <bapt@FreeBSD.org>
 #
 # SPDX-License-Identifier: BSD-2-Clause
 #
 
 export NUAGE_FAKE_ROOTDIR="$PWD"
 
 atf_test_case args
 atf_test_case nocloud
 atf_test_case nocloud_userdata_script
 atf_test_case nocloud_user_data_script
 atf_test_case nocloud_userdata_cloudconfig_users
 atf_test_case nocloud_network
 atf_test_case config2
 atf_test_case config2_pubkeys
 atf_test_case config2_pubkeys_user_data
 atf_test_case config2_pubkeys_meta_data
 atf_test_case config2_network
 atf_test_case config2_network_static_v4
 atf_test_case config2_ssh_keys
 atf_test_case nocloud_userdata_cloudconfig_ssh_pwauth
 atf_test_case nocloud_userdata_cloudconfig_chpasswd
 atf_test_case nocloud_userdata_cloudconfig_chpasswd_list_string
 atf_test_case nocloud_userdata_cloudconfig_chpasswd_list_list
 atf_test_case config2_userdata_runcmd
 atf_test_case config2_userdata_packages
 atf_test_case config2_userdata_update_packages
 atf_test_case config2_userdata_upgrade_packages
+atf_test_case config2_userdata_shebang
 
 setup_test_adduser()
 {
 	here=$(pwd)
 	export NUAGE_FAKE_ROOTDIR=$(pwd)
 	mkdir -p etc/ssh
 	cat > etc/master.passwd << EOF
 root:*:0:0::0:0:Charlie &:/root:/bin/csh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/csh
 EOF
 	pwd_mkdb -d etc ${here}/etc/master.passwd
 	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
 }
 
 args_body()
 {
 	atf_check -s exit:1 -e inline:"Usage: /usr/libexec/nuageinit <cloud-init-directory> (<config-2> | <nocloud>)\n" /usr/libexec/nuageinit
 	atf_check -s exit:1 -e inline:"Usage: /usr/libexec/nuageinit <cloud-init-directory> (<config-2> | <nocloud>)\n" /usr/libexec/nuageinit bla
 	atf_check -s exit:1 -e inline:"Usage: /usr/libexec/nuageinit <cloud-init-directory> (<config-2> | <nocloud>)\n" /usr/libexec/nuageinit bla meh plop
 	atf_check -s exit:1 -e inline:"nuageinit: Unknown cloud init type: meh\n" /usr/libexec/nuageinit bla meh
 }
 
 nocloud_body()
 {
 	mkdir -p media/nuageinit
 	atf_check -s exit:1 -e match:"nuageinit: error parsing nocloud.*" /usr/libexec/nuageinit "${PWD}"/media/nuageinit/ nocloud
 	printf "instance-id: iid-local01\nlocal-hostname: cloudimg\n" > "${PWD}"/media/nuageinit/meta-data
 	atf_check -s exit:0 /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o inline:"hostname=\"cloudimg\"\n" cat etc/rc.conf.d/hostname
 	cat > media/nuageinit/meta-data << EOF
 instance-id: iid-local01
 hostname: myhost
 EOF
 	atf_check -s exit:0 /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o inline:"hostname=\"myhost\"\n" cat etc/rc.conf.d/hostname
 }
 
 nocloud_userdata_script_body()
 {
 	mkdir -p media/nuageinit
 	printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data
 	printf "#!/bin/sh\necho yeah\n" > "${PWD}"/media/nuageinit/user-data
 	chmod 755 "${PWD}"/media/nuageinit/user-data
-	atf_check -s exit:0 -o inline:"yeah\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
+	atf_check -s exit:0 /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
+	atf_check -o inline:"#!/bin/sh\necho yeah\n" cat var/cache/nuageinit/user_data
 }
 
 nocloud_user_data_script_body()
 {
 	mkdir -p media/nuageinit
 	printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data
 	printf "#!/bin/sh\necho yeah\n" > "${PWD}"/media/nuageinit/user_data
 	chmod 755 "${PWD}"/media/nuageinit/user_data
-	atf_check -s exit:0 -o inline:"yeah\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
+	atf_check -s exit:0 /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
+	atf_check -o inline:"#!/bin/sh\necho yeah\n" cat var/cache/nuageinit/user_data
 }
 
 nocloud_userdata_cloudconfig_users_head()
 {
 	atf_set "require.user" root
 }
 nocloud_userdata_cloudconfig_users_body()
 {
 	mkdir -p media/nuageinit
 	printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data
 	mkdir -p etc
 	cat > etc/master.passwd << EOF
 root:*:0:0::0:0:Charlie &:/root:/bin/sh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 EOF
 	pwd_mkdb -d etc "${PWD}"/etc/master.passwd
 	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
 	cat > media/nuageinit/user-data << 'EOF'
 #cloud-config
 groups:
   - admingroup: [root,sys]
   - cloud-users
 users:
   - default
   - name: foobar
     gecos: Foo B. Bar
     primary_group: foobar
     groups: users
     passwd: $6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/
 EOF
 	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	cat > expectedgroup << EOF
 wheel:*:0:root,freebsd
 users:*:1:foobar
 admingroup:*:1001:root,sys
 cloud-users:*:1002:
 freebsd:*:1003:
 foobar:*:1004:
 EOF
 	cat > expectedpasswd << 'EOF'
 root:*:0:0::0:0:Charlie &:/root:/bin/sh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 freebsd:freebsd:1001:1003::0:0:FreeBSD User:/home/freebsd:/bin/sh
 foobar:$6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/:1002:1004::0:0:Foo B. Bar:/home/foobar:/bin/sh
 EOF
 	sed -i "" "s/freebsd:.*:1001/freebsd:freebsd:1001/" "${PWD}"/etc/master.passwd
 	atf_check -o file:expectedpasswd cat "${PWD}"/etc/master.passwd
 	atf_check -o file:expectedgroup cat "${PWD}"/etc/group
 }
 
 nocloud_network_head()
 {
 	atf_set "require.user" root
 }
 nocloud_network_body()
 {
 	mkdir -p media/nuageinit
 	mkdir -p etc
 	cat > etc/master.passwd << EOF
 root:*:0:0::0:0:Charlie &:/root:/bin/sh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 EOF
 	pwd_mkdb -d etc "${PWD}"/etc/master.passwd
 	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
 	mynetworks=$(ifconfig -l ether)
 	if [ -z "$mynetworks" ]; then
 		atf_skip "a network interface is needed"
 	fi
 	set -- $mynetworks
 	myiface=$1
 	myaddr=$(ifconfig $myiface ether | awk '/ether/ { print $2 }')
 	printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data
 	cat > media/nuageinit/user-data << EOF
 #cloud-config
 network:
   version: 2
   ethernets:
     # opaque ID for physical interfaces, only referred to by other stanzas
     id0:
       match:
         macaddress: "$myaddr"
       addresses:
         - 192.0.2.2/24
         - 2001:db8::2/64
       gateway4: 192.0.2.1
       gateway6: 2001:db8::1
 EOF
 	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	cat > network << EOF
 ifconfig_${myiface}="inet 192.0.2.2/24"
 ifconfig_${myiface}_ipv6="inet6 2001:db8::2/64"
 ipv6_network_interfaces="${myiface}"
 ipv6_default_interface="${myiface}"
 EOF
 	cat > routing << EOF
 defaultrouter="192.0.2.1"
 ipv6_defaultrouter="2001:db8::1"
 ipv6_route_${myiface}="2001:db8::1 -prefixlen 128 -interface ${myiface}"
 EOF
 	atf_check -o file:network cat "${PWD}"/etc/rc.conf.d/network
 	atf_check -o file:routing cat "${PWD}"/etc/rc.conf.d/routing
 }
 
 config2_body()
 {
 	mkdir -p media/nuageinit
 	atf_check -s exit:1 -e match:"nuageinit: error parsing config-2 meta_data.json:.*" /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	printf "{}" > media/nuageinit/meta_data.json
 	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	cat > media/nuageinit/meta_data.json << EOF
 {
     "hostname": "cloudimg"
 }
 EOF
 	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	atf_check -o inline:"hostname=\"cloudimg\"\n" cat etc/rc.conf.d/hostname
 }
 
 config2_pubkeys_head()
 {
 	atf_set "require.user" root
 }
 config2_pubkeys_body()
 {
 	mkdir -p media/nuageinit
 	touch media/nuageinit/meta_data.json
 	cat > media/nuageinit/user-data << EOF
 #cloud-config
 ssh_authorized_keys:
   - "ssh-rsa AAAAB3NzaC1y...== Generated by Nova"
 EOF
 	mkdir -p etc
 	cat > etc/master.passwd << EOF
 root:*:0:0::0:0:Charlie &:/root:/bin/sh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 EOF
 	pwd_mkdb -d etc "${PWD}"/etc/master.passwd
 	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
 	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	atf_check -o inline:"ssh-rsa AAAAB3NzaC1y...== Generated by Nova\n" cat home/freebsd/.ssh/authorized_keys
 }
 
 config2_pubkeys_user_data_head()
 {
 	atf_set "require.user" root
 }
 config2_pubkeys_user_data_body()
 {
 	mkdir -p media/nuageinit
 	touch media/nuageinit/meta_data.json
 	cat > media/nuageinit/user_data << EOF
 #cloud-config
 ssh_authorized_keys:
   - "ssh-rsa AAAAB3NzaC1y...== Generated by Nova"
 EOF
 	mkdir -p etc
 	cat > etc/master.passwd << EOF
 root:*:0:0::0:0:Charlie &:/root:/bin/sh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 EOF
 	pwd_mkdb -d etc "${PWD}"/etc/master.passwd
 	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
 	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	atf_check -o inline:"ssh-rsa AAAAB3NzaC1y...== Generated by Nova\n" cat home/freebsd/.ssh/authorized_keys
 }
 
 config2_pubkeys_meta_data_body()
 {
 	here=$(pwd)
 	export NUAGE_FAKE_ROOTDIR=$(pwd)
 	if [ $(id -u) -ne 0 ]; then
 		atf_skip "root required"
 	fi
 	mkdir -p media/nuageinit
 	cat > media/nuageinit/meta_data.json << EOF
 {
     "uuid": "uuid_for_this_instance",
     "admin_pass": "a_generated_password",
     "public_keys": {
         "tdb": "ssh-ed25519 my_key_id tdb@host"
     },
     "keys": [
         {
             "name": "tdb",
             "type": "ssh",
             "data": "ssh-ed25519 my_key_id tdb@host"
         }
     ],
     "hostname": "freebsd-14-test.novalocal",
     "name": "freebsd-14-test",
     "launch_index": 0,
     "availability_zone": "nova",
     "random_seed": "long_random_seed",
     "project_id": "my_project_id",
     "devices": [],
     "dedicated_cpus": []
 }
 EOF
 	mkdir -p etc
 	cat > etc/master.passwd << EOF
 root:*:0:0::0:0:Charlie &:/root:/bin/csh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/csh
 EOF
 	pwd_mkdb -d etc ${here}/etc/master.passwd
 	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
 	atf_check /usr/libexec/nuageinit ${here}/media/nuageinit config-2
 	atf_check -o inline:"ssh-ed25519 my_key_id tdb@host\n" cat home/freebsd/.ssh/authorized_keys
 }
 
 config2_network_body()
 {
 	mkdir -p media/nuageinit
 	printf "{}" > media/nuageinit/meta_data.json
 	mynetworks=$(ifconfig -l ether)
 	if [ -z "$mynetworks" ]; then
 		atf_skip "a network interface is needed"
 	fi
 	set -- $mynetworks
 	myiface=$1
 	myaddr=$(ifconfig $myiface ether | awk '/ether/ { print $2 }')
 cat > media/nuageinit/network_data.json << EOF
 {
     "links": [
         {
             "ethernet_mac_address": "$myaddr",
             "id": "iface0",
             "mtu": null
         }
     ],
     "networks": [
         {
             "id": "network0",
             "link": "iface0",
             "type": "ipv4_dhcp"
         },
         { // IPv6
             "id": "private-ipv4",
             "type": "ipv6",
             "link": "iface0",
             // supports condensed IPv6 with CIDR netmask
             "ip_address": "2001:db8::3257:9652/64",
             "gateway": "fd00::1",
             "routes": [
                 {
                     "network": "::",
                     "netmask": "::",
                     "gateway": "fd00::1"
                 },
                 {
                     "network": "::",
                     "netmask": "ffff:ffff:ffff::",
                     "gateway": "fd00::1:1"
                 }
             ],
             "network_id": "da5bb487-5193-4a65-a3df-4a0055a8c0d8"
         }
     ]
 }
 EOF
 	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	cat > network << EOF
 ifconfig_${myiface}="DHCP"
 ifconfig_${myiface}_ipv6="inet6 2001:db8::3257:9652/64"
 ipv6_network_interfaces="${myiface}"
 ipv6_default_interface="${myiface}"
 EOF
 	cat > routing << EOF
 ipv6_defaultrouter="fd00::1"
 ipv6_route_${myiface}="fd00::1 -prefixlen 128 -interface ${myiface}"
 ipv6_static_routes="${myiface}"
 EOF
 	atf_check -o file:network cat "${PWD}"/etc/rc.conf.d/network
 	atf_check -o file:routing cat "${PWD}"/etc/rc.conf.d/routing
 }
 
 config2_network_static_v4_body()
 {
 	mkdir -p media/nuageinit
 	printf "{}" > media/nuageinit/meta_data.json
 	mynetworks=$(ifconfig -l ether)
 	if [ -z "$mynetworks" ]; then
 		atf_skip "a network interface is needed"
 	fi
 	set -- $mynetworks
 	myiface=$1
 	myaddr=$(ifconfig $myiface ether | awk '/ether/ { print $2 }')
 cat > media/nuageinit/network_data.json << EOF
 {
     "links": [
         {
             "ethernet_mac_address": "$myaddr",
             "id": "iface0",
             "mtu": null
         }
     ],
     "networks": [
         {
             "id": "network0",
             "link": "iface0",
             "type": "ipv4",
             "ip_address": "10.184.0.244",
             "netmask": "255.255.240.0",
             "routes": [
                 {
                     "network": "10.0.0.0",
                     "netmask": "255.0.0.0",
                     "gateway": "11.0.0.1"
                 },
                 {
                     "network": "0.0.0.0",
                     "netmask": "0.0.0.0",
                     "gateway": "23.253.157.1"
                 }
             ]
         }
     ]
 }
 EOF
 	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	cat > network << EOF
 ifconfig_${myiface}="inet 10.184.0.244 netmask 255.255.240.0"
 EOF
 	cat > routing << EOF
 route_cloudinit1_${myiface}="-net 10.0.0.0 11.0.0.1 255.0.0.0"
 defaultrouter="23.253.157.1"
 static_routes="cloudinit1_${myiface}"
 EOF
 	atf_check -o file:network cat "${PWD}"/etc/rc.conf.d/network
 	atf_check -o file:routing cat "${PWD}"/etc/rc.conf.d/routing
 }
 
 config2_ssh_keys_head()
 {
 	atf_set "require.user" root
 }
 config2_ssh_keys_body()
 {
 	here=$(pwd)
 	export NUAGE_FAKE_ROOTDIR=$(pwd)
 	mkdir -p media/nuageinit
 	touch media/nuageinit/meta_data.json
 	cat > media/nuageinit/user-data << EOF
 #cloud-config
 ssh_keys:
   rsa_private: |
     -----BEGIN RSA PRIVATE KEY-----
     MIIBxwIBAAJhAKD0YSHy73nUgysO13XsJmd4fHiFyQ+00R7VVu2iV9Qco
     ...
     -----END RSA PRIVATE KEY-----
   rsa_public: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAGEAoPRhIfLvedSDKw7Xd ...
   ed25519_private: |
     -----BEGIN OPENSSH PRIVATE KEY-----
     blabla
     ...
     -----END OPENSSH PRIVATE KEY-----
   ed25519_public: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+MH4E8KO32N5CXRvXVqvyZVl0+6ue4DobdhU0FqFd+
 EOF
 	mkdir -p etc/ssh
 	cat > etc/master.passwd << EOF
 root:*:0:0::0:0:Charlie &:/root:/bin/csh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/csh
 EOF
 	pwd_mkdb -d etc ${here}/etc/master.passwd
 	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
 	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	_expected="-----BEGIN RSA PRIVATE KEY-----
 MIIBxwIBAAJhAKD0YSHy73nUgysO13XsJmd4fHiFyQ+00R7VVu2iV9Qco
 ...
 -----END RSA PRIVATE KEY-----
 "
 	atf_check -o inline:"${_expected}" cat ${PWD}/etc/ssh/ssh_host_rsa_key
 	_expected="ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAGEAoPRhIfLvedSDKw7Xd ...\n"
 	atf_check -o inline:"${_expected}" cat ${PWD}/etc/ssh/ssh_host_rsa_key.pub
 	_expected="-----BEGIN OPENSSH PRIVATE KEY-----
 blabla
 ...
 -----END OPENSSH PRIVATE KEY-----\n"
 	atf_check -o inline:"${_expected}" cat ${PWD}/etc/ssh/ssh_host_ed25519_key
 	_expected="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+MH4E8KO32N5CXRvXVqvyZVl0+6ue4DobdhU0FqFd+\n"
 	atf_check -o inline:"${_expected}" cat ${PWD}/etc/ssh/ssh_host_ed25519_key.pub
 }
 
 
 nocloud_userdata_cloudconfig_ssh_pwauth_head()
 {
 	atf_set "require.user" root
 }
 nocloud_userdata_cloudconfig_ssh_pwauth_body()
 {
 	mkdir -p etc
 	cat > etc/master.passwd << EOF
 root:*:0:0::0:0:Charlie &:/root:/bin/sh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 EOF
 	pwd_mkdb -d etc "${PWD}"/etc/master.passwd
 	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
 	mkdir -p media/nuageinit
 	printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data
 	cat > media/nuageinit/user-data << 'EOF'
 #cloud-config
 ssh_pwauth: true
 EOF
 	mkdir -p etc/ssh/
 	touch etc/ssh/sshd_config
 
 	atf_check -o empty -e empty /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o inline:"PasswordAuthentication yes\n" cat etc/ssh/sshd_config
 
 	# Same value we don't touch anything
 	printf "   PasswordAuthentication yes # I want password\n" > etc/ssh/sshd_config
 	atf_check -o empty -e empty /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o inline:"   PasswordAuthentication yes # I want password\n" cat etc/ssh/sshd_config
 
 	printf "   PasswordAuthentication no # Should change\n" > etc/ssh/sshd_config
 	atf_check -o empty -e empty /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o inline:"PasswordAuthentication yes\n" cat etc/ssh/sshd_config
 
 	cat > media/nuageinit/user-data << 'EOF'
 #cloud-config
 ssh_pwauth: false
 EOF
 
 	printf "   PasswordAuthentication no # no passwords\n" > etc/ssh/sshd_config
 	atf_check -o empty -e empty /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o inline:"   PasswordAuthentication no # no passwords\n" cat etc/ssh/sshd_config
 
 	printf "   PasswordAuthentication yes # Should change\n" > etc/ssh/sshd_config
 	atf_check -o empty -e empty /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o inline:"PasswordAuthentication no\n" cat etc/ssh/sshd_config
 }
 
 nocloud_userdata_cloudconfig_chpasswd_head()
 {
 	atf_set "require.user" root
 }
 nocloud_userdata_cloudconfig_chpasswd_body()
 {
 	mkdir -p etc
 	cat > etc/master.passwd << EOF
 root:*:0:0::0:0:Charlie &:/root:/bin/sh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 user:*:1:0::0:0:Sys:/home/sys:/bin/sh
 EOF
 	pwd_mkdb -d etc "${PWD}"/etc/master.passwd
 	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
 	mkdir -p media/nuageinit
 	printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data
 	cat > media/nuageinit/user-data << 'EOF'
 #cloud-config
 chpasswd:
   expire: true
   users:
   - { user: "sys", password: RANDOM }
 EOF
 
 	atf_check -o empty -e inline:"nuageinit: Invalid entry for chpasswd.users: missing 'name'\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	# nothing modified
 	atf_check -o inline:"sys:*:1:0::0:0:Sys:/home/sys:/bin/sh\n" pw -R $(pwd) usershow sys
 
 	cat > media/nuageinit/user-data << 'EOF'
 #cloud-config
 chpasswd:
   expire: true
   users:
   - { name: "sys", pwd: RANDOM }
 EOF
 	atf_check -o empty -e inline:"nuageinit: Invalid entry for chpasswd.users: missing 'password'\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	# nothing modified
 	atf_check -o inline:"sys:*:1:0::0:0:Sys:/home/sys:/bin/sh\n" pw -R $(pwd) usershow sys
 
 	cat > media/nuageinit/user-data << 'EOF'
 #cloud-config
 chpasswd:
   expire: false
   users:
   - { name: "sys", password: RANDOM }
 EOF
 	# not empty because the password is printed to stdout
 	atf_check -o empty -e empty /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o match:'sys:\$.*:1:0::0:0:Sys:/home/sys:/bin/sh$' pw -R $(pwd) usershow sys
 
 	cat > media/nuageinit/user-data << 'EOF'
 #cloud-config
 chpasswd:
   expire: true
   users:
   - { name: "sys", password: RANDOM }
 EOF
 	# not empty because the password is printed to stdout
 	atf_check -o empty -e empty /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o match:'sys:\$.*:1:0::1:0:Sys:/home/sys:/bin/sh$' pw -R $(pwd) usershow sys
 
 	cat > media/nuageinit/user-data << 'EOF'
 #cloud-config
 chpasswd:
   expire: true
   users:
   - { name: "user", password: "$6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/" }
 EOF
 	# not empty because the password is printed to stdout
 	atf_check -o empty -e empty /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o inline:'user:$6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/:1:0::1:0:Sys:/home/sys:/bin/sh\n' pw -R $(pwd) usershow user
 }
 
 
 nocloud_userdata_cloudconfig_chpasswd_list_string_head()
 {
 	atf_set "require.user" root
 }
 nocloud_userdata_cloudconfig_chpasswd_list_string_body()
 {
 	mkdir -p etc
 	cat > etc/master.passwd << EOF
 root:*:0:0::0:0:Charlie &:/root:/bin/sh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 user:*:1:0::0:0:Sys:/home/sys:/bin/sh
 EOF
 	pwd_mkdb -d etc "${PWD}"/etc/master.passwd
 	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
 	mkdir -p media/nuageinit
 	printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data
 	cat > media/nuageinit/user-data << 'EOF'
 #cloud-config
 chpasswd:
   expire: true
   list: |
      sys:RANDOM
 EOF
 
 	atf_check -o empty -e inline:"nuageinit: chpasswd.list is deprecated consider using chpasswd.users\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o match:'sys:\$.*:1:0::1:0:Sys:/home/sys:/bin/sh$' pw -R $(pwd) usershow sys
 
 	cat > media/nuageinit/user-data << 'EOF'
 #cloud-config
 chpasswd:
   expire: false
   list: |
      sys:plop
      user:$6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/
      root:R
 EOF
 
 	atf_check -o empty -e ignore /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o match:'sys:\$.*:1:0::0:0:Sys:/home/sys:/bin/sh$' pw -R $(pwd) usershow sys
 	atf_check -o inline:'user:$6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/:1:0::0:0:Sys:/home/sys:/bin/sh\n' pw -R $(pwd) usershow user
 	atf_check -o match:'root:\$.*:0:0::0:0:Charlie &:/root:/bin/sh$' pw -R $(pwd) usershow root
 }
 
 nocloud_userdata_cloudconfig_chpasswd_list_list_head()
 {
 	atf_set "require.user" root
 }
 nocloud_userdata_cloudconfig_chpasswd_list_list_body()
 {
 	mkdir -p etc
 	cat > etc/master.passwd << EOF
 root:*:0:0::0:0:Charlie &:/root:/bin/sh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 user:*:1:0::0:0:Sys:/home/sys:/bin/sh
 EOF
 	pwd_mkdb -d etc "${PWD}"/etc/master.passwd
 	cat > etc/group << EOF
 wheel:*:0:root
 users:*:1:
 EOF
 	mkdir -p media/nuageinit
 	printf "instance-id: iid-local01\n" > "${PWD}"/media/nuageinit/meta-data
 	cat > media/nuageinit/user-data << 'EOF'
 #cloud-config
 chpasswd:
   expire: true
   list:
   - sys:RANDOM
 EOF
 
 	atf_check -o empty -e inline:"nuageinit: chpasswd.list is deprecated consider using chpasswd.users\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o match:'sys:\$.*:1:0::1:0:Sys:/home/sys:/bin/sh$' pw -R $(pwd) usershow sys
 
 	cat > media/nuageinit/user-data << 'EOF'
 #cloud-config
 chpasswd:
   expire: false
   list:
   - sys:plop
   - user:$6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/
   - root:R
 EOF
 
 	atf_check -o empty -e ignore /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check -o match:'sys:\$.*:1:0::0:0:Sys:/home/sys:/bin/sh$' pw -R $(pwd) usershow sys
 	atf_check -o inline:'user:$6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/:1:0::0:0:Sys:/home/sys:/bin/sh\n' pw -R $(pwd) usershow user
 	atf_check -o match:'root:\$.*:0:0::0:0:Charlie &:/root:/bin/sh$' pw -R $(pwd) usershow root
 }
 
 config2_userdata_runcmd_head()
 {
 	atf_set "require.user" root
 }
 config2_userdata_runcmd_body()
 {
 	mkdir -p media/nuageinit
 	setup_test_adduser
 	printf "{}" > media/nuageinit/meta_data.json
 	cat > media/nuageinit/user_data << 'EOF'
 #cloud-config
 runcmd:
 EOF
 	chmod 755 "${PWD}"/media/nuageinit/user_data
 	atf_check -s exit:1 -e match:"attempt to index a nil value" /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	cat > media/nuageinit/user_data << 'EOF'
 #cloud-config
 runcmd:
   - plop
 EOF
 	chmod 755 "${PWD}"/media/nuageinit/user_data
 	atf_check -s exit:0 -e inline:"sh: plop: not found\nnuageinit: Failed to execute 'plop'\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 
 	cat > media/nuageinit/user_data << 'EOF'
 #cloud-config
 runcmd:
   - echo "yeah!" > "${PWD}"/media/nuageinit/runcmd_echo
   - uname -s > "${PWD}"/media/nuageinit/runcmd_uname
 EOF
 	chmod 755 "${PWD}"/media/nuageinit/user_data
 	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	atf_check -s exit:0 -o inline:"yeah!\n" cat "${PWD}"/media/nuageinit/runcmd_echo
 	atf_check -s exit:0 -o inline:"FreeBSD\n" cat "${PWD}"/media/nuageinit/runcmd_uname
 }
 
 config2_userdata_packages_head()
 {
 	atf_set "require.user" root
 }
 
 config2_userdata_packages_body()
 {
 	mkdir -p media/nuageinit
 	setup_test_adduser
 	export NUAGE_RUN_TESTS=1
 	printf "{}" > media/nuageinit/meta_data.json
 	cat > media/nuageinit/user_data << 'EOF'
 #cloud-config
 packages:
 EOF
 	chmod 755 "${PWD}"/media/nuageinit/user_data
 	atf_check -s exit:1 -e match:"attempt to index a nil value" /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 	cat > media/nuageinit/user_data << 'EOF'
 #cloud-config
 packages:
   - yeah/plop
 EOF
 	chmod 755 "${PWD}"/media/nuageinit/user_data
 	atf_check -s exit:0 -o inline:"pkg install -y yeah/plop\npkg info -q yeah/plop\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 
 	cat > media/nuageinit/user_data << 'EOF'
 #cloud-config
 packages:
   - curl
 EOF
 	chmod 755 "${PWD}"/media/nuageinit/user_data
 	atf_check -o inline:"pkg install -y curl\npkg info -q curl\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 
 	cat > media/nuageinit/user_data << 'EOF'
 #cloud-config
 packages:
   - curl
   - meh: bla
 EOF
 	chmod 755 "${PWD}"/media/nuageinit/user_data
 	atf_check -o inline:"pkg install -y curl\npkg info -q curl\n" -e inline:"nuageinit: Invalid type : table for packages entry number 2\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 }
 
 config2_userdata_update_packages_body()
 {
 	mkdir -p media/nuageinit
 	setup_test_adduser
 	export NUAGE_RUN_TESTS=1
 	printf "{}" > media/nuageinit/meta_data.json
 	cat > media/nuageinit/user_data << 'EOF'
 #cloud-config
 package_update: true
 EOF
 	chmod 755 "${PWD}"/media/nuageinit/user_data
 	atf_check -o inline:"pkg update -y\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 }
 
 config2_userdata_upgrade_packages_body()
 {
 	mkdir -p media/nuageinit
 	setup_test_adduser
 	export NUAGE_RUN_TESTS=1
 	printf "{}" > media/nuageinit/meta_data.json
 	cat > media/nuageinit/user_data << 'EOF'
 #cloud-config
 package_upgrade: true
 EOF
 	chmod 755 "${PWD}"/media/nuageinit/user_data
 	atf_check -o inline:"pkg upgrade -y\n" /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
 }
 
+config2_userdata_shebang_body()
+{
+	mkdir -p media/nuageinit
+	setup_test_adduser
+	printf "{}" > media/nuageinit/meta_data.json
+	cat > media/nuageinit/user_data <<EOF
+#!/we/dont/care
+anything
+EOF
+	atf_check -o empty /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
+	test -f var/cache/nuageinit/user_data || atf_fail "File not created"
+	test -x var/cache/nuageinit/user_data || atf_fail "Missing execution permission"
+	atf_check -o inline:"#!/we/dont/care\nanything\n" cat var/cache/nuageinit/user_data
+	cat > media/nuageinit/user_data <<EOF
+/we/dont/care
+EOF
+	rm var/cache/nuageinit/user_data
+	if [ -f var/cache/nuageinit/user_data ]; then
+		atf_fail "File should not have been created"
+	fi
+}
+
 atf_init_test_cases()
 {
 	atf_add_test_case args
 	atf_add_test_case nocloud
 	atf_add_test_case nocloud_userdata_script
 	atf_add_test_case nocloud_user_data_script
 	atf_add_test_case nocloud_userdata_cloudconfig_users
 	atf_add_test_case nocloud_network
 	atf_add_test_case config2
 	atf_add_test_case config2_pubkeys
 	atf_add_test_case config2_pubkeys_user_data
 	atf_add_test_case config2_pubkeys_meta_data
 	atf_add_test_case config2_network
 	atf_add_test_case config2_network_static_v4
 	atf_add_test_case config2_ssh_keys
 	atf_add_test_case nocloud_userdata_cloudconfig_ssh_pwauth
 	atf_add_test_case nocloud_userdata_cloudconfig_chpasswd
 	atf_add_test_case nocloud_userdata_cloudconfig_chpasswd_list_string
 	atf_add_test_case nocloud_userdata_cloudconfig_chpasswd_list_list
 	atf_add_test_case config2_userdata_runcmd
 	atf_add_test_case config2_userdata_packages
 	atf_add_test_case config2_userdata_update_packages
 	atf_add_test_case config2_userdata_upgrade_packages
+	atf_add_test_case config2_userdata_shebang
 }
diff --git a/libexec/rc/rc.d/Makefile b/libexec/rc/rc.d/Makefile
index 4696ef223378..b505d33c68f3 100644
--- a/libexec/rc/rc.d/Makefile
+++ b/libexec/rc/rc.d/Makefile
@@ -1,413 +1,414 @@
 .include <src.opts.mk>
 
 CONFDIR=	/etc/rc.d
 CONFGROUPS=	CONFS
 CONFSPACKAGE=	rc
 
 CONFS=	DAEMON \
 	FILESYSTEMS \
 	LOGIN \
 	NETWORKING \
 	SERVERS \
 	adjkerntz \
 	bgfsck \
 	bridge \
 	cfumass \
 	cleanvar \
 	cleartmp \
 	ddb \
 	defaultroute \
 	devfs \
 	dmesg \
 	dumpon \
 	fsck \
 	growfs \
 	growfs_fstab \
 	hostid \
 	hostid_save \
 	hostname \
 	iovctl \
 	ip6addrctl \
 	ipsec \
 	${_kadmind} \
 	${_kdc} \
 	${_kfd} \
 	kld \
 	kldxref \
 	${_kpasswdd} \
 	ldconfig \
 	linux \
 	local \
 	localpkg \
 	mixer \
 	motd \
 	mountcritlocal \
 	mountcritremote \
 	mountlate \
 	mdconfig \
 	mdconfig2 \
 	msgs \
 	netif \
 	netoptions \
 	netwait \
 	noshutdown \
 	${_nscd} \
 	${_opensm} \
 	os-release \
 	powerd \
 	pppoed \
 	pwcheck \
 	quota \
 	random \
 	rarpd \
 	rctl \
 	root \
 	route6d \
 	routing \
 	rpcbind \
 	rtadvd \
 	rtsold \
 	savecore \
 	securelevel \
 	serial \
 	static_arp \
 	static_ndp \
 	stf \
 	swap \
 	swaplate \
 	sysctl \
 	sysctl_lastload \
 	sysvipc \
 	tmp \
 	ugidfw \
 	var \
 	var_run \
 	watchdogd
 
 CONFGROUPS+=		DEVD
 DEVD=			devd
 DEVDPACKAGE=		devd
 
 CONFGROUPS+=		DEVMATCH
 DEVMATCH=		devmatch
 DEVMATCHPACKAGE=	devmatch
 
 CONFGROUPS+=		DHCLIENT
 DHCLIENT=		dhclient
 DHCLIENTPACKAGE=	dhclient
 
 CONFGROUPS+=		GEOM
 GEOM=			geli \
 			geli2 \
 			gptboot
 GEOMPACKAGE=		geom
 
 CONFGROUPS+=		GGATED
 GGATED=			ggated
 GGATEDPACKAGE=		ggate
 
 CONFGROUPS+=		RESOLVCONF
 RESOLVCONF=		resolv
 RESOLVCONFPACKAGE=	resolvconf
 
 CONFGROUPS+=		CRON
 CRON+=			cron
 CRONPACKAGE=		cron
 
 CONFGROUPS+=		CTL
 CTL=			ctld
 CTLPACKAGE=		ctl
 
 CONFGROUPS+=		NFS
 NFS=			lockd \
 			mountd \
 			nfscbd \
 			nfsclient \
 			nfsd \
 			nfsuserd \
 			statd
 NFSPACKAGE=		nfs
 
 CONFGROUPS+=		NEWSYSLOG
 NEWSYSLOG=		newsyslog
 NEWSYSLOGPACKAGE=	newsyslog
 
 CONFGROUPS+=		SYSLOGD
 SYSLOGD=		syslogd
 SYSLOGDPACKAGE=		syslogd
 
 CONFGROUPS+=		RCMDS
 RCMDS=			rwho
 RCMDSPACKAGE=		rcmds
 
 .if ${MK_ACCT} != "no" || ${MK_UTMPX} != "no"
 CONFGROUPS+=	ACCT
 ACCTPACKAGE=	acct
 .if ${MK_ACCT} != "no"
 ACCT+=		accounting
 .endif
 .if ${MK_UTMPX} != "no"
 ACCT+=		utx
 .endif
 .endif
 
 .if ${MK_ACPI} != "no"
 CONFGROUPS+=	ACPI
 ACPI=		power_profile
 ACPIPACKAGE=	acpi
 .endif
 
 .if ${MK_APM} != "no"
 CONFGROUPS+=	APM
 APM+=		apm
 .if ${MACHINE} == "i386"
 APM+=		apmd
 .endif
 APMPACKAGE=	apm
 .endif
 
 .if ${MK_AUDIT} != "no"
 CONFGROUPS+=	AUDIT
 AUDIT+=		auditd
 AUDIT+=		auditdistd
 AUDITPACKAGE=	audit
 .endif
 
 .if ${MK_AUTOFS} != "no"
 CONFGROUPS+=	AUTOFS
 AUTOFS=		automount \
 		automountd \
 		autounmountd
 AUTOFSPACKAGE=	autofs
 .endif
 
 .if ${MK_BLACKLIST} != "no"
 CONFGROUPS+=	BLOCKLIST
 BLOCKLIST=	blacklistd
 BLOCKLISTPACKAGE=blocklist
 .endif
 
 .if ${MK_BLUETOOTH} != "no"
 CONFGROUPS+=	BLUETOOTH
 BLUETOOTH+=	bluetooth \
 		bthidd \
 		hcsecd \
 		rfcomm_pppd_server \
 		sdpd \
 		ubthidhci
 BLUETOOTHPACKAGE=	bluetooth
 .endif
 
 .if ${MK_BOOTPARAMD} != "no"
 CONFS+=		bootparams
 .endif
 
 .if ${MK_BSNMP} != "no"
 CONFGROUPS+=	BSNMP
 BSNMP+=		bsnmpd
 BSNMPPACKAGE=	bsnmp
 .endif
 
 .if ${MK_CCD} != "no"
 CONFGROUPS+=	CCD
 CCD=		ccd
 CCDPACKAGE=	ccdconfig
 .endif
 
 .if ${MK_FTP} != "no"
 CONFGROUPS+=	FTPD
 FTPD=		ftpd
 FTPDPACKAGE=	ftpd
 .endif
 
 .if ${MK_GSSAPI} != "no"
 CONFGROUPS+=	GSSD
 GSSD=		gssd
 GSSDPACKAGE=	kerberos
 .endif
 
 .if ${MK_HAST} != "no"
 CONFGROUPS+=	HAST
 HAST=		hastd
 HASTPACKAGE=	hast
 .endif
 
 .if ${MK_INETD} != "no"
 CONFGROUPS+=	INETD
 INETD=		inetd
 INETDPACKAGE=	inetd
 .endif
 
 .if ${MK_IPFILTER} != "no"
 CONFGROUPS+=	IPF
 IPF=		ipfilter \
 		ipfs \
 		ipmon \
 		ipnat \
 		ippool
 IPFPACKAGE=	ipf
 .endif
 
 .if ${MK_IPFW} != "no"
 CONFGROUPS+=	IPFW
 IPFW=		ipfw dnctl
 .if ${MK_NETGRAPH} != "no"
 IPFW+=		ipfw_netflow
 .endif
 IPFWPACKAGE=	ipfw
 
 # natd is only built when ipfw is built
 CONFGROUPS+=	NATD
 NATD+=		natd
 NATDPACKAGE=	natd
 .endif
 
 .if ${MK_ISCSI} != "no"
 CONFGROUPS+=	ISCSI
 ISCSI=		iscsictl \
 		iscsid
 ISCSIPACKAGE=	iscsi
 .endif
 
 .if ${MK_JAIL} != "no"
 CONFGROUPS+=	JAIL
 JAIL+=		jail
 JAILPACKAGE=	jail
 .endif
 
 .if ${MK_LEGACY_CONSOLE} != "no"
 CONFGROUPS+=	CONSOLE
 CONSOLE+=	moused
 CONSOLE+=	syscons
 CONSOLEPACKAGE=	console-tools
 .endif
 
 .if ${MK_LPR} != "no"
 CONFGROUPS+=	LP
 LP+=		lpd
 LPPACKAGE=	lp
 .endif
 
 .if ${MK_KERBEROS} != "no"
 CONFS+=		ipropd_master
 CONFS+=		ipropd_slave
 _kadmind=	kadmind
 _kdc=		kdc
 _kfd=		kfd
 _kpasswdd=	kpasswdd
 
 DIRS+=	VAR_HEMIDAL
 VAR_HEMIDAL=	/var/heimdal
 VAR_HEMIDAL_MODE=	700
 .endif
 
 .if ${MK_NIS} != "no"
 CONFGROUPS+=	YP
 YP=		ypbind \
 		ypldap \
 		yppasswdd \
 		ypserv \
 		ypset \
 		ypupdated \
 		ypxfrd \
 		nisdomain
 YPPACKAGE=	yp
 .endif
 
 .if ${MK_NS_CACHING} != "no"
 _nscd=		nscd
 .endif
 
 .if ${MK_NTP} != "no"
 CONFGROUPS+=	NTP
 NTP+=		ntpd \
 		ntpdate
 NTPPACKAGE=	ntp
 .endif
 
 .if ${MK_OFED_EXTRA} != "no"
 _opensm=	opensm
 .endif
 
 .if ${MK_OPENSSL} != "no" && ${MK_OPENSSL_KTLS} != "no"
 CONFS+=		tlsclntd \
 		tlsservd
 .endif
 
 .if ${MK_OPENSSH} != "no"
 CONFGROUPS+=	SSH
 SSH=		sshd
 SSHPACKAGE=	ssh
 .endif
 
 .if ${MK_PF} != "no"
 CONFGROUPS+=	PF
 PF=		pf \
 		pflog \
 		pfsync \
 		ftp-proxy
 PFPACKAGE=	pf
 .endif
 
 .if ${MK_PPP} != "no"
 CONFGROUPS+=	PPP
 PPP=		ppp
 PPPPACKAGE=	ppp
 .endif
 
 .if ${MK_ROUTED} != "no"
 CONFS+=		routed
 .endif
 
 .if ${MK_SENDMAIL} != "no"
 CONFGROUPS+=	SMRCD
 SMRCD=		sendmail
 SMRCDPACKAGE=	sendmail
 .endif
 
 .if ${MK_NUAGEINIT} != "no"
 CONFGROUPS+=	NIUAGEINIT
-NIUAGEINIT=		nuageinit
+NIUAGEINIT=		nuageinit \
+			nuageinit_user_data_script
 NIUAGEINITPACKAGE=	nuageinit
 .endif
 
 .if ${MK_UNBOUND} != "no"
 CONFGROUPS+=	UNBOUND
 UNBOUND+=	local_unbound
 UNBOUNDPACKAGE=	unbound
 .endif
 
 .if ${MK_VI} != "no"
 CONFGROUPS+=	VI
 VI+=		virecover
 VIPACKAGE=	vi
 .endif
 
 .if ${MK_WIRELESS} != "no"
 CONFGROUPS+=	HOSTAPD
 HOSTAPD=	hostapd
 HOSTAPDPACKAGE=	hostapd
 
 CONFGROUPS+=	WPA
 WPA=		wpa_supplicant
 WPAPACKAGE=	wpa
 .endif
 
 .if ${MK_ZFS} != "no"
 CONFGROUPS+=	ZFS
 ZFS+=		zfs
 ZFS+=		zfsbe
 ZFS+=		zfsd
 ZFS+=		zfskeys
 ZFS+=		zpool
 ZFS+=		zpoolreguid
 ZFS+=		zpoolupgrade
 ZFS+=		zvol
 ZFSPACKAGE=	zfs
 .endif
 
 .for fg in ${CONFGROUPS}
 ${fg}MODE?=	${BINMODE}
 .endfor
 
 .include <bsd.prog.mk>
diff --git a/libexec/rc/rc.d/nuageinit_user_data_script b/libexec/rc/rc.d/nuageinit_user_data_script
new file mode 100755
index 000000000000..94d5d008a7fc
--- /dev/null
+++ b/libexec/rc/rc.d/nuageinit_user_data_script
@@ -0,0 +1,25 @@
+#!/bin/sh
+#
+
+# PROVIDE: nuageinit_user_data_script
+# REQUIRE: local
+# KEYWORD: firstboot
+
+. /etc/rc.subr
+
+name="nuageinit_user_data_script"
+desc="Execute user data script provided by cloudinit"
+start_cmd="execute_user_data_script"
+stop_cmd=":"
+rcvar="nuageinit_enable"
+
+execute_user_data_script()
+{
+	test -x /var/cache/nuageinit/user_data || return
+	echo "Executing user_data script" | tee -a /var/log/nuageinnit.log
+	/var/cache/nuageinit/user_data 2>&1 | tee -a /var/log/nuageinit.log
+}
+
+# Share the same config as nuageinit
+load_rc_config nuageinit
+run_rc_command "$1"