Confirmed. The postinst file only reset 'root_password' in debconf, but not 'root_password_again', so the root password is stored in cleartext, though the file is only readable by root.
Confirmed. The postinst file only reset 'root_password' in debconf, but not 'root_password_ again', so the root password is stored in cleartext, though the file is only readable by root.