Gabriel Brown
6d1f3f3763
The comment above the prompt says the password never reaches a command line; --generate-hash="$first" put it on one, world-readable in /proc/<pid>/cmdline while mokutil ran. It now arrives on stdin, and the hash is taken from the last output line because mokutil prints its prompts to stdout too.