force git shell user password not to expire

[epcim]

At:
https://github.com/atomic-penguin/cookbook-gitlab/blob/ae4ee230be9b05228e64959d6788b31b468a48be/recipes/default.rb#L53

execute "#{username}: disable password expiration" do
  #command "chage -M -1 '#{username}'"
  command "chage --lastday 0 --expiredate -1 --inactive -1 --mindays 0 --maxdays 99999 --warndays 7 #{username}"
  only_if do
    require 'shadow'
    Shadow::Passwd.getspnam(username).sp_max != -1 }
  end
end

[epcim]

any comments on this approach?
any better way to control user shadow attributes in chef (as found user resource do not support them)

[chewi]

I wrote an LWRP for this ages ago. I could publish it but why is this needed? I don't think you should set a password on that account to start with.