the recipe slapos.cookbook:generate.password will install the password only after the [request-xx] was called for the first time. Then the second run of buildout the password can change as it was not stored yet. We use publish-early to make it persistent on master and avoid inconsistency between published password and stored one.