The question

How can a fuzzy search in /etc/subuid make setup silently skip the user it was supposed to configure?

Working model

Subordinate-ID files are colon-delimited records; account identity is field 1. An unanchored regex can match a different account containing the requested name, and punctuation in the name can become regex syntax.

Extract field 1 and compare it as a fixed, whole string. Distinguish an absent file, an empty file, a delimiter-free malformed line, and an exact record. Apply the same semantics to subuid and subgid, and verify an immediate rerun does not append duplicates.

This check answers only whether an account has a record. Range overlap and allocation policy are separate contracts.

Provenance

Synthesized from Linux Fieldwork's mmdebstrap package-test investigation at revision c79d34b65fb2cd8c54234f361f073248c53b513a.

Find the false positive

Requested account: debci.

Explain why old-debci-helper:200000:65536 must not count. Then unpack what each flag protects in:

cut -s -d: -f1 /etc/subuid | grep -Fxq -- "$user"

Add one test for a regex-significant username and one for a malformed delimiter-free line.