Re: [PATCHv2 1/2] meta/classes/image: Introduce sshd host key assertion

["Maxim Yu. Osipov" <mosipov@isar-build.org>]

On 6/3/19 1:12 PM, Henning Schild wrote:
> Change to v1:
>    - use find instead of "ls *" to detect if there are any keys
>    - reduce to just one if statement
> 
> Henning

Rebased and applied to the 'next'.

Regards,
Maxim.

> Am Mon, 3 Jun 2019 13:10:59 +0200
> schrieb Henning Schild <henning.schild@siemens.com>:
> 
>> From: Henning Schild <henning.schild@siemens.com>
>>
>> Images containing ssh host keys without some way of dealing with the
>> fact that those have to be generate at run-time not install-time are
>> invalid!
>>
>> Introduce a check that our own package "sshd-regen-keys" is installed
>> when such keys are present (when an ssh daemon is installed).
>>
>> Suggest to install that package or find some other way of dealing with
>> the problem. But fail by default, since such an image is most likely
>> broken.
>>
>> Signed-off-by: Henning Schild <henning.schild@siemens.com>
>> ---
>>   meta/classes/image-postproc-extension.bbclass | 13 +++++++++++++
>>   1 file changed, 13 insertions(+)
>>
>> diff --git a/meta/classes/image-postproc-extension.bbclass
>> b/meta/classes/image-postproc-extension.bbclass index
>> 625ba7d..f6ed793 100644 ---
>> a/meta/classes/image-postproc-extension.bbclass +++
>> b/meta/classes/image-postproc-extension.bbclass @@ -44,3 +44,16 @@
>> image_postprocess_mark() { update_etc_os_release \
>>           --build-id "${BUILD_ID}" --variant "${DESCRIPTION}"
>>   }
>> +
>> +ROOTFS_POSTPROCESS_COMMAND =+ "image_postprocess_sshd_key_regen"
>> +
>> +image_postprocess_sshd_key_regen() {
>> +    nhkeys=$( find ${IMAGE_ROOTFS}/etc/ssh/ -iname "ssh_host_*key*"
>> -printf '.' | wc -c )
>> +    if [ $nhkeys -ne 0 -a ! -d
>> ${IMAGE_ROOTFS}/usr/share/doc/sshd-regen-keys ]; then
>> +       bbwarn "Looks like you have ssh host keys in the image but
>> did "\
>> +              "not install \"sshd-regen-keys\". This image should
>> not be "\
>> +              "deployed more than once."
>> +       bberror "Install the package or forcefully remove this check!"
>> +       exit 1
>> +    fi
>> +}
>