tree: import changes from testing-devel at 13a1fd7d83

manifests/coreos-bootc-delta.yaml

@@ -5,7 +5,6 @@ postprocess:
 # This is the historical default and what FCOS currently ships. fedora-bootc
 # uses the new `root` value, but migrating FCOS is not that simple...
 # https://coreos.github.io/rpm-ostree/treefile/#experimental-options
-# We can nuke `opt-usrlocal: var` above once this is the only path we support.
   - |
     #!/usr/bin/env bash
     set -xeuo pipefail
@@ -22,8 +21,6 @@ postprocess:
   # the future... For more details, see
   # https://github.com/CentOS/centos-bootc/issues/167
   # https://coreos.github.io/rpm-ostree/treefile/#experimental-options
-  # We can nuke `machineid-compat: false` above once we only support the
-  # container-native path.
   - |
     #!/usr/bin/env bash
     set -xeuo pipefail

manifests/fedora-coreos-base.yaml

@@ -17,7 +17,7 @@ include:
   - networking-tools.yaml
   - user-experience.yaml
   - shared-el.yaml
-  - coreos-bootc-minimal-plus.yaml
+  - coreos-bootc-delta.yaml
 
 ostree-layers:
   - overlay/05core

manifests/fedora-coreos.yaml

@@ -43,6 +43,7 @@ conditional-include:
 ostree-layers:
   - overlay/15fcos
   - overlay/17fcos-container-signing
+  - overlay/18sshd-authorized-keys-file
 
 packages:
   - fedora-release-coreos

manifests/system-configuration.yaml

@@ -33,8 +33,6 @@ packages:
   # Boost starving threads
   # https://github.com/coreos/fedora-coreos-tracker/issues/753
   - stalld
-  # Ignition aware SSH key management
-  - ssh-key-dir
 
 postprocess:
   # Mask systemd-repart. Ignition is responsible for partition setup on first

overlay.d/18sshd-authorized-keys-file/etc/ssh/sshd_config.d/40-authorized-keys-file.conf

@@ -0,0 +1,2 @@
+# Also accept keys configured by Ignition and Afterburn
+AuthorizedKeysFile=.ssh/authorized_keys .ssh/authorized_keys.d/*

overlay.d/README.md

@@ -46,6 +46,14 @@ here in a separate overlay to make it easy to include on specific
 streams for the time being. Eventually can probably put this in
 15fcos.
 
+18sshd-authorized-keys-file
+---------------------------
+
+Configuration to have OpenSSH read authorized keys from files in
+`~/.ssh/authorized_keys.d/*` in addition to `~/.ssh/authorized_keys` (default).
+We can drop this overlay once we have moved this configuration file to be
+installed alongside the Afterburn and Ignition packages.
+
 20platform-chrony
 -----------------