git: d7984912385c - main - nuageinit: implement ssh_authkey_fingerprints support

The branch main has been updated by bapt:

URL: https://cgit.FreeBSD.org/src/commit/?id=d7984912385cc5a191547dc6c2d73acba25e2239

commit d7984912385cc5a191547dc6c2d73acba25e2239
Author:     Baptiste Daroussin <bapt@FreeBSD.org>
AuthorDate: 2026-06-05 10:38:06 +0000
Commit:     Baptiste Daroussin <bapt@FreeBSD.org>
CommitDate: 2026-06-05 11:17:55 +0000

    nuageinit: implement ssh_authkey_fingerprints support
    
    Add support for the 'ssh_authkey_fingerprints' cloud-config key
    which logs SSH host key fingerprints to the console via ssh-keygen.
---
 libexec/nuageinit/nuageinit          | 24 ++++++++++++++++++++++++
 libexec/nuageinit/nuageinit.7        |  5 +++++
 libexec/nuageinit/tests/nuageinit.sh | 21 +++++++++++++++++++++
 3 files changed, 50 insertions(+)

diff --git a/libexec/nuageinit/nuageinit b/libexec/nuageinit/nuageinit
index 033aa7861f6b..8e2658f2cd13 100755
--- a/libexec/nuageinit/nuageinit
+++ b/libexec/nuageinit/nuageinit
@@ -509,6 +509,29 @@ local function ssh_pwauth(obj)
 	nuage.update_sshd_config("PasswordAuthentication", value)
 end
 
+local function ssh_authkey_fingerprints(obj)
+	if obj.ssh_authkey_fingerprints ~= true then return end
+	local ssh_dir = root .. "/etc/ssh"
+	local attrs = lfs.attributes(ssh_dir)
+	if not attrs or attrs.mode ~= "directory" then
+		return
+	end
+	for entry in lfs.dir(ssh_dir) do
+		if entry:match("^ssh_host_.*_key$") then
+			local keypath = ssh_dir .. "/" .. entry
+			local f = io.popen("ssh-keygen -l -f " ..
+			    nuage.shell_escape(keypath), "r")
+			if f then
+				local fingerprint = f:read("*a")
+				f:close()
+				if fingerprint and fingerprint ~= "" then
+					io.stderr:write(fingerprint)
+				end
+			end
+		end
+	end
+end
+
 local function ssh_deletekeys(obj)
 	if obj.ssh_deletekeys == nil then return end
 	if obj.ssh_deletekeys then
@@ -897,6 +920,7 @@ elseif line == "#cloud-config" then
 		create_default_user,
 		ssh_deletekeys,
 		ssh_keys,
+		ssh_authkey_fingerprints,
 		network_config,
 		resolv_conf,
 		keyboard,
diff --git a/libexec/nuageinit/nuageinit.7 b/libexec/nuageinit/nuageinit.7
index 9a20df0787ba..200eb2524fe6 100644
--- a/libexec/nuageinit/nuageinit.7
+++ b/libexec/nuageinit/nuageinit.7
@@ -232,6 +232,11 @@ The keyboard variant (e.g.,
 .Qq acc ,
 .Qq nodeadkeys ) .
 .El
+.It Ic ssh_authkey_fingerprints
+Boolean which determines whether fingerprints of SSH host keys
+should be logged to the console.
+Defaults to
+.Ar false .
 .It Ic timezone
 Sets the system timezone based on the value provided.
 .Pp
diff --git a/libexec/nuageinit/tests/nuageinit.sh b/libexec/nuageinit/tests/nuageinit.sh
index 22b002ae2440..44c681e18046 100644
--- a/libexec/nuageinit/tests/nuageinit.sh
+++ b/libexec/nuageinit/tests/nuageinit.sh
@@ -37,6 +37,7 @@ atf_test_case config2_userdata_manage_etc_hosts
 atf_test_case config2_userdata_mounts
 atf_test_case config2_userdata_resolv_conf
 atf_test_case config2_userdata_keyboard
+atf_test_case config2_userdata_ssh_authkey_fingerprints
 atf_test_case config2_userdata_fqdn_and_hostname
 atf_test_case config2_userdata_write_files
 
@@ -1198,6 +1199,25 @@ EOF
 	true
 }
 
+config2_userdata_ssh_authkey_fingerprints_head()
+{
+	atf_set "require.user" root
+}
+config2_userdata_ssh_authkey_fingerprints_body()
+{
+	mkdir -p media/nuageinit
+	setup_test_adduser
+	printf "{}" > media/nuageinit/meta_data.json
+	mkdir -p etc/ssh
+	ssh-keygen -t ed25519 -f etc/ssh/ssh_host_ed25519_key -N "" -q 2>/dev/null
+	cat > media/nuageinit/user_data <<EOF
+#cloud-config
+ssh_authkey_fingerprints: true
+EOF
+	atf_check -s exit:0 -e match:"SHA256:" /usr/libexec/nuageinit "${PWD}"/media/nuageinit config-2
+	true
+}
+
 config2_userdata_fqdn_and_hostname_body()
 {
 	mkdir -p media/nuageinit
@@ -1250,6 +1270,7 @@ atf_init_test_cases()
 	atf_add_test_case config2_userdata_mounts
 	atf_add_test_case config2_userdata_resolv_conf
 	atf_add_test_case config2_userdata_keyboard
+	atf_add_test_case config2_userdata_ssh_authkey_fingerprints
 	atf_add_test_case config2_userdata_fqdn_and_hostname
 	atf_add_test_case config2_userdata_write_files
 }