Skip to content

Commit 62947c5

Browse files
ericvhericvh
committed
Fix ssh key usage in initramfs and switch naming
1 parent 337b54c commit 62947c5

File tree

3 files changed

+48
-45
lines changed

3 files changed

+48
-45
lines changed

‎.github/workflows/build.yml‎

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -71,11 +71,11 @@ jobs:
7171
run: |
7272
mkdir -p build/binaries
7373
echo "Generating default SSH keys for CPU..."
74-
ssh-keygen -t rsa -b 4096 -f build/binaries/cpu_rsa -N "" -C "cpu-default-key"
74+
ssh-keygen -t rsa -b 4096 -f build/binaries/identity -N "" -C "cpu-default-key"
7575
echo "SSH keys generated:"
76-
echo " Private key: build/binaries/cpu_rsa"
77-
echo " Public key: build/binaries/cpu_rsa.pub"
78-
ls -la build/binaries/cpu_rsa*
76+
echo " Private key: build/binaries/identity"
77+
echo " Public key: build/binaries/identity.pub"
78+
ls -la build/binaries/identity*
7979
8080
- name: Build cpu binary for aarch64
8181
run: |
@@ -103,7 +103,7 @@ jobs:
103103
# Build the initramfs with cpud bundled in as init and include SSH public key
104104
echo "Building initramfs with u-root..."
105105
GOOS=linux GOARCH=arm64 ../../u-root-bin -format=cpio -o ../../initramfs/cpud-initramfs.cpio \
106-
-files "../../binaries/cpu_rsa.pub:etc/cpu_rsa.pub" \
106+
-files "../../binaries/identity.pub:etc/identity.pub" \
107107
-initcmd="cpud" \
108108
./cmds/cpud \
109109
../u-root/cmds/core/ls \
@@ -147,8 +147,8 @@ jobs:
147147
echo "Files in this archive:" >> BUILD_INFO.txt
148148
echo "- cpu: CPU client binary" >> BUILD_INFO.txt
149149
echo "- cpud: CPU daemon binary" >> BUILD_INFO.txt
150-
echo "- cpu_rsa: Default SSH private key" >> BUILD_INFO.txt
151-
echo "- cpu_rsa.pub: Default SSH public key" >> BUILD_INFO.txt
150+
echo "- identity: Default SSH private key" >> BUILD_INFO.txt
151+
echo "- identity.pub: Default SSH public key" >> BUILD_INFO.txt
152152
echo "- cpud-initramfs.cpio.gz: U-root initramfs with cpud as init" >> BUILD_INFO.txt
153153
echo "" >> BUILD_INFO.txt
154154
echo "Usage:" >> BUILD_INFO.txt
@@ -157,14 +157,14 @@ jobs:
157157
echo "" >> BUILD_INFO.txt
158158
echo "SSH Keys:" >> BUILD_INFO.txt
159159
echo " Default SSH keys are provided for convenience" >> BUILD_INFO.txt
160-
echo " Private key: cpu_rsa" >> BUILD_INFO.txt
161-
echo " Public key: cpu_rsa.pub (also embedded in initramfs)" >> BUILD_INFO.txt
160+
echo " Private key: identity" >> BUILD_INFO.txt
161+
echo " Public key: identity.pub (also embedded in initramfs)" >> BUILD_INFO.txt
162162
echo " WARNING: These are default keys - generate your own for production!" >> BUILD_INFO.txt
163163
echo "" >> BUILD_INFO.txt
164164
echo "Initramfs usage:" >> BUILD_INFO.txt
165165
echo " Use cpud-initramfs.cpio.gz as initrd with Linux kernel" >> BUILD_INFO.txt
166166
echo " Boot parameters: init=/init" >> BUILD_INFO.txt
167-
echo " SSH public key is embedded at /etc/cpu_rsa.pub" >> BUILD_INFO.txt
167+
echo " SSH public key is embedded at /etc/identity.pub" >> BUILD_INFO.txt
168168
cat BUILD_INFO.txt
169169
170170
- name: Create checksums
@@ -173,8 +173,8 @@ jobs:
173173
echo "Creating checksums..."
174174
sha256sum cpu > cpu.sha256
175175
sha256sum cpud > cpud.sha256
176-
sha256sum cpu_rsa > cpu_rsa.sha256
177-
sha256sum cpu_rsa.pub > cpu_rsa.pub.sha256
176+
sha256sum identity > identity.sha256
177+
sha256sum identity.pub > identity.pub.sha256
178178
sha256sum BUILD_INFO.txt > BUILD_INFO.txt.sha256
179179
cd ../initramfs
180180
sha256sum cpud-initramfs.cpio.gz > cpud-initramfs.cpio.gz.sha256
@@ -243,13 +243,13 @@ jobs:
243243
files: |
244244
build/binaries/cpu
245245
build/binaries/cpud
246-
build/binaries/cpu_rsa
247-
build/binaries/cpu_rsa.pub
246+
build/binaries/identity
247+
build/binaries/identity.pub
248248
build/binaries/BUILD_INFO.txt
249249
build/binaries/cpu.sha256
250250
build/binaries/cpud.sha256
251-
build/binaries/cpu_rsa.sha256
252-
build/binaries/cpu_rsa.pub.sha256
251+
build/binaries/identity.sha256
252+
build/binaries/identity.pub.sha256
253253
build/binaries/BUILD_INFO.txt.sha256
254254
build/binaries/cpud-initramfs.cpio.gz
255255
build/binaries/cpud-initramfs.cpio.gz.sha256
@@ -269,18 +269,18 @@ jobs:
269269
- `*.sha256` - SHA256 checksums for verification
270270
271271
### SSH Keys
272-
- `cpu_rsa` - Default SSH private key
273-
- `cpu_rsa.pub` - Default SSH public key (also embedded in initramfs)
274-
- `cpu_rsa.sha256` - Private key checksum
275-
- `cpu_rsa.pub.sha256` - Public key checksum
272+
- `identity` - Default SSH private key
273+
- `identity.pub` - Default SSH public key (also embedded in initramfs)
274+
- `identity.sha256` - Private key checksum
275+
- `identity.pub.sha256` - Public key checksum
276276
277277
**⚠️ WARNING**: These are default keys for convenience. Generate your own keys for production use!
278278
279279
### Initramfs
280280
- `cpud-initramfs.cpio.gz` - U-root initramfs with cpud as init
281281
- `cpud-initramfs.cpio.gz.sha256` - Initramfs checksum
282282
283-
The initramfs includes the SSH public key at `/etc/cpu_rsa.pub` for automatic authentication.
283+
The initramfs includes the SSH public key at `/etc/identity.pub` for automatic authentication.
284284
285285
### Archive
286286
- `cpu-binaries-aarch64-${{ env.CPU_VERSION }}.tar.gz` - Complete archive with all binaries
@@ -293,23 +293,23 @@ jobs:
293293
# Download binaries and keys
294294
wget https://github.com/${{ github.repository }}/releases/download/${{ github.event.inputs.release_tag || github.ref_name }}/cpu
295295
wget https://github.com/${{ github.repository }}/releases/download/${{ github.event.inputs.release_tag || github.ref_name }}/cpud
296-
wget https://github.com/${{ github.repository }}/releases/download/${{ github.event.inputs.release_tag || github.ref_name }}/cpu_rsa
297-
wget https://github.com/${{ github.repository }}/releases/download/${{ github.event.inputs.release_tag || github.ref_name }}/cpu_rsa.pub
296+
wget https://github.com/${{ github.repository }}/releases/download/${{ github.event.inputs.release_tag || github.ref_name }}/identity
297+
wget https://github.com/${{ github.repository }}/releases/download/${{ github.event.inputs.release_tag || github.ref_name }}/identity.pub
298298
299299
# Make executable
300300
chmod +x cpu cpud
301-
chmod 600 cpu_rsa
302-
chmod 644 cpu_rsa.pub
301+
chmod 600 identity
302+
chmod 644 identity.pub
303303
304304
# Verify (optional)
305305
wget https://github.com/${{ github.repository }}/releases/download/${{ github.event.inputs.release_tag || github.ref_name }}/cpu.sha256
306306
wget https://github.com/${{ github.repository }}/releases/download/${{ github.event.inputs.release_tag || github.ref_name }}/cpud.sha256
307-
wget https://github.com/${{ github.repository }}/releases/download/${{ github.event.inputs.release_tag || github.ref_name }}/cpu_rsa.sha256
308-
wget https://github.com/${{ github.repository }}/releases/download/${{ github.event.inputs.release_tag || github.ref_name }}/cpu_rsa.pub.sha256
307+
wget https://github.com/${{ github.repository }}/releases/download/${{ github.event.inputs.release_tag || github.ref_name }}/identity.sha256
308+
wget https://github.com/${{ github.repository }}/releases/download/${{ github.event.inputs.release_tag || github.ref_name }}/identity.pub.sha256
309309
sha256sum -c cpu.sha256
310310
sha256sum -c cpud.sha256
311-
sha256sum -c cpu_rsa.sha256
312-
sha256sum -c cpu_rsa.pub.sha256
311+
sha256sum -c identity.sha256
312+
sha256sum -c identity.pub.sha256
313313
```
314314
315315
### Download complete archive:

‎.github/workflows/package.yml‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -58,10 +58,11 @@ jobs:
5858
5959
- name: Generate SSH keys
6060
run: |
61+
mkdir -p binaries
6162
echo "Generating default SSH keys for CPU..."
62-
ssh-keygen -t rsa -b 4096 -f binaries/cpu_rsa -N "" -C "cpu-default-key"
63+
ssh-keygen -t rsa -b 4096 -f binaries/identity -N "" -C "cpu-default-key"
6364
echo "SSH keys generated:"
64-
ls -la binaries/cpu_rsa*
65+
ls -la binaries/identity*
6566
6667
- name: Build binaries
6768
run: |
@@ -77,8 +78,8 @@ jobs:
7778
FROM scratch
7879
COPY binaries/cpu /usr/local/bin/cpu
7980
COPY binaries/cpud /usr/local/bin/cpud
80-
COPY binaries/cpu_rsa /etc/cpu_rsa
81-
COPY binaries/cpu_rsa.pub /etc/cpu_rsa.pub
81+
COPY binaries/identity /etc/identity
82+
COPY binaries/identity.pub /etc/identity.pub
8283
COPY BUILD_INFO.txt /BUILD_INFO.txt
8384
LABEL org.opencontainers.image.title="CPU Binaries"
8485
LABEL org.opencontainers.image.description="Prebuilt CPU binaries for aarch64 with SSH keys"
@@ -100,8 +101,8 @@ jobs:
100101
Files in this package:
101102
- /usr/local/bin/cpu: CPU client binary
102103
- /usr/local/bin/cpud: CPU daemon binary
103-
- /etc/cpu_rsa: Default SSH private key
104-
- /etc/cpu_rsa.pub: Default SSH public key
104+
- /etc/identity: Default SSH private key
105+
- /etc/identity.pub: Default SSH public key
105106
106107
WARNING: These are default keys for convenience - generate your own for production!
107108
@@ -110,8 +111,8 @@ jobs:
110111
docker run --rm ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest /usr/local/bin/cpud -h
111112
112113
Extract SSH keys from container:
113-
docker run --rm ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest cat /etc/cpu_rsa > cpu_rsa
114-
docker run --rm ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest cat /etc/cpu_rsa.pub > cpu_rsa.pub
114+
docker run --rm ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest cat /etc/identity > identity
115+
docker run --rm ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest cat /etc/identity.pub > identity.pub
115116
EOF
116117
117118
- name: Build and push Docker image

‎Makefile‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@ CPU_BINARY := $(BINARIES_DIR)/cpu
2626
CPUD_BINARY := $(BINARIES_DIR)/cpud
2727
INITRAMFS_FILE := $(INITRAMFS_DIR)/cpud-initramfs.cpio.gz
2828
BUILD_INFO := $(BINARIES_DIR)/BUILD_INFO.txt
29-
SSH_PRIVATE_KEY := $(BINARIES_DIR)/cpu_rsa
30-
SSH_PUBLIC_KEY := $(BINARIES_DIR)/cpu_rsa.pub
29+
SSH_PRIVATE_KEY := $(BINARIES_DIR)/identity
30+
SSH_PUBLIC_KEY := $(BINARIES_DIR)/identity.pub
3131

3232
# Version detection
3333
CPU_VERSION := $(shell cd $(CPU_REPO) 2>/dev/null && git describe --tags --always 2>/dev/null || echo "unknown")
@@ -115,8 +115,8 @@ $(BUILD_INFO): $(CPU_BINARY) $(CPUD_BINARY) $(SSH_PRIVATE_KEY)
115115
echo "Files in this archive:" >> ../../binaries/BUILD_INFO.txt && \
116116
echo "- cpu: CPU client binary" >> ../../binaries/BUILD_INFO.txt && \
117117
echo "- cpud: CPU daemon binary" >> ../../binaries/BUILD_INFO.txt && \
118-
echo "- cpu_rsa: Default SSH private key" >> ../../binaries/BUILD_INFO.txt && \
119-
echo "- cpu_rsa.pub: Default SSH public key" >> ../../binaries/BUILD_INFO.txt && \
118+
echo "- identity: Default SSH private key" >> ../../binaries/BUILD_INFO.txt && \
119+
echo "- identity.pub: Default SSH public key" >> ../../binaries/BUILD_INFO.txt && \
120120
echo "- cpud-initramfs.cpio.gz: U-root initramfs with cpud as init" >> ../../binaries/BUILD_INFO.txt && \
121121
echo "" >> ../../binaries/BUILD_INFO.txt && \
122122
echo "Usage:" >> ../../binaries/BUILD_INFO.txt && \
@@ -125,14 +125,15 @@ $(BUILD_INFO): $(CPU_BINARY) $(CPUD_BINARY) $(SSH_PRIVATE_KEY)
125125
echo "" >> ../../binaries/BUILD_INFO.txt && \
126126
echo "SSH Keys:" >> ../../binaries/BUILD_INFO.txt && \
127127
echo " Default SSH keys are provided for convenience" >> ../../binaries/BUILD_INFO.txt && \
128-
echo " Private key: cpu_rsa" >> ../../binaries/BUILD_INFO.txt && \
129-
echo " Public key: cpu_rsa.pub (also embedded in initramfs)" >> ../../binaries/BUILD_INFO.txt && \
128+
echo " Private key: identity" >> ../../binaries/BUILD_INFO.txt && \
129+
echo " Public key: identity.pub (also embedded in initramfs)" >> ../../binaries/BUILD_INFO.txt && \
130130
echo " WARNING: These are default keys - generate your own for production!" >> ../../binaries/BUILD_INFO.txt && \
131131
echo "" >> ../../binaries/BUILD_INFO.txt && \
132132
echo "Initramfs usage:" >> ../../binaries/BUILD_INFO.txt && \
133133
echo " Use cpud-initramfs.cpio.gz as initrd with Linux kernel" >> ../../binaries/BUILD_INFO.txt && \
134134
echo " Boot parameters: init=/init" >> ../../binaries/BUILD_INFO.txt && \
135-
echo " SSH public key is embedded at /etc/cpu_rsa.pub" >> ../../binaries/BUILD_INFO.txt && \
135+
echo " SSH public key is embedded at /etc/identity.pub" >> ../../binaries/BUILD_INFO.txt && \
136+
echo " cpud automatically uses the embedded SSH key for authentication" >> ../../binaries/BUILD_INFO.txt && \
136137
echo "" >> ../../binaries/BUILD_INFO.txt && \
137138
echo "Build system: Makefile" >> ../../binaries/BUILD_INFO.txt
138139

@@ -157,8 +158,9 @@ $(INITRAMFS_FILE): $(CPUD_BINARY) $(UROOT_BIN) $(SSH_PUBLIC_KEY)
157158
@rm -f $(INITRAMFS_DIR)/*
158159
@echo "Building initramfs with u-root..."
159160
@cd $(CPU_REPO) && GOOS=$(GOOS) GOARCH=$(GOARCH) ../../u-root-bin -format=cpio -o ../../initramfs/cpud-initramfs.cpio \
160-
-files "../../binaries/cpu_rsa.pub:etc/cpu_rsa.pub" \
161+
-files "../../binaries/identity.pub:etc/identity.pub" \
161162
-initcmd="cpud" \
163+
-uinitcmd="cpud -pk /etc/identity.pub" \
162164
./cmds/cpud \
163165
../u-root/cmds/core/ls \
164166
../u-root/cmds/core/ip \

0 commit comments

Comments
 (0)