Editfiles convergence bug

[David J. Bianco]

I've got a simple stanza like:

  BeginGroupIfNoLineMatching "^root:<somepasswordhash>:0:0"
    ReplaceAll "^root:[^:]*:0:0" With "root:<somepasswordhash>:0:0"
  EndGroup

In English, if the root password hash isn't correct, I want to change
the hash without mucking around with anything else in the line.  I
think this should work, but when it runs, I get:

cfengine:bebop: WARNING: Non-convergent edit operation ReplaceAll
[root:<somepasswordhash>:0:0] With [^root:[^:]*:0:0]
cfengine:bebop: Line begins
[root:<originalpasswordhash>:0:0:root:/root:/bin/b]
cfengine:bebop: Replacement matches search string and will thus replace
every time - edit was not done

I know this is intended to make sure the edit is convergent (ie. 
cfengine won't have to edit the same line every time it runs) but I
think the check is a little too simple.  By itself, the ReplaceAll
line *isn't* convergent, but nested inside a BeginGroupIfNoLineMatching
block, it is.  At least, it is unless I've made an error somewhere.

So my question is, is this by design, or is there a limitation in the
cfengine parser?  Also, is there a workaround for what  want to do?
Replacing the entire line us ugly, since different machines have 
different data in the rest of the fields.  

        Thanks,
          David

-- 
David J. Bianco <address@hidden>
Thomas Jefferson National Accelerator Facility