Inject the SSH public key into the Fedora and AlmaLinux seed ISOs

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

seediso/almalinux10/README.md

@@ -3,6 +3,10 @@
 This directory contains the cloud-init NoCloud configuration used by
 `run-almalinux10.py`.
 
+`build-seed.sh` injects your SSH public key into `user-data` (the `@SSH_PUBKEY@`
+placeholder): `$SSH_PUBKEY_FILE`, else the first `~/.ssh/id_*.pub`, else the first
+key offered by `ssh-agent`.
+
 After changing `user-data`, `meta-data`, or `network-config`, remove the old
 `seed.iso` and rebuild it:
 

seediso/almalinux10/build-seed.sh

@@ -5,6 +5,33 @@ script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 output="${1:-${script_dir}/seed.iso}"
 files=(user-data meta-data)
 
+# Public key injected into user-data: $SSH_PUBKEY_FILE, else the first
+# ~/.ssh/id_*.pub, else the first key offered by ssh-agent.
+pubkey=""
+if [[ -n "${SSH_PUBKEY_FILE:-}" ]]; then
+  pubkey="$(head -n1 -- "${SSH_PUBKEY_FILE}")"
+else
+  for f in "${HOME}"/.ssh/id_ed25519.pub "${HOME}"/.ssh/id_*.pub; do
+    if [[ -f "$f" ]]; then pubkey="$(head -n1 -- "$f")"; break; fi
+  done
+  if [[ -z "$pubkey" ]] && command -v ssh-add >/dev/null 2>&1; then
+    pubkey="$(ssh-add -L 2>/dev/null | head -n1 || true)"
+  fi
+fi
+if [[ "$pubkey" != ssh-* && "$pubkey" != ecdsa-* && "$pubkey" != sk-* ]]; then
+  printf 'Error: no SSH public key found; set SSH_PUBKEY_FILE.\n' >&2
+  exit 1
+fi
+
+work="$(mktemp -d)"
+trap 'rm -rf -- "${work}"' EXIT
+template="$(<"${script_dir}/user-data")"
+printf '%s\n' "${template//@SSH_PUBKEY@/${pubkey}}" > "${work}/user-data"
+cp -- "${script_dir}/meta-data" "${work}/meta-data"
+if [[ -f "${script_dir}/network-config" ]]; then
+  cp -- "${script_dir}/network-config" "${work}/network-config"
+fi
+
 mkdir -p "$(dirname -- "$output")"
 
 if [[ -f "${script_dir}/network-config" ]]; then
@@ -14,22 +41,22 @@ fi
 if command -v cloud-localds >/dev/null 2>&1; then
   args=()
   if [[ -f "${script_dir}/network-config" ]]; then
-    args+=(--network-config="${script_dir}/network-config")
+    args+=(--network-config="${work}/network-config")
   fi
-  cloud-localds "${args[@]}" "$output" \
+  cloud-localds "${args[@]}" "${output}" \
-    "${script_dir}/user-data" "${script_dir}/meta-data"
+    "${work}/user-data" "${work}/meta-data"
 elif command -v xorriso >/dev/null 2>&1; then
   xorriso -as mkisofs -quiet -volid cidata -joliet -rock \
-    -output "$output" "${files[@]/#/${script_dir}/}"
+    -output "${output}" "${files[@]/#/${work}/}"
 elif command -v genisoimage >/dev/null 2>&1; then
-  genisoimage -quiet -output "$output" -volid cidata -joliet -rock \
+  genisoimage -quiet -output "${output}" -volid cidata -joliet -rock \
-    "${files[@]/#/${script_dir}/}"
+    "${files[@]/#/${work}/}"
 elif command -v mkisofs >/dev/null 2>&1; then
-  mkisofs -quiet -output "$output" -volid cidata -joliet -rock \
+  mkisofs -quiet -output "${output}" -volid cidata -joliet -rock \
-    "${files[@]/#/${script_dir}/}"
+    "${files[@]/#/${work}/}"
 else
   printf 'Error: install cloud-image-utils, xorriso, genisoimage, or mkisofs.\n' >&2
   exit 1
 fi
 
-printf 'Created %s\n' "$output"
+printf 'Created %s\n' "${output}"

seediso/almalinux10/user-data

@@ -10,6 +10,8 @@ users:
     shell: /bin/bash
     sudo: "ALL=(ALL) NOPASSWD: ALL"
     lock_passwd: false
+    ssh_authorized_keys:
+      - @SSH_PUBKEY@
     hashed_passwd: $6$0NtCERV3eO12t9oJ$nlFE2sSc66nFfuD5X0xMnOla1cuzOnHfeGNRY5X7dCDHg.WzWVmuRe7M17Puj44.eCWLnJAWt4WNjd9vP9X0D0
 
 chpasswd:

seediso/fedora44/README.md

@@ -4,6 +4,10 @@ This directory contains the cloud-init NoCloud configuration used by
 `run-fedora44.py`. On first boot, cloud-init's package module installs Fedora's
 GNOME package group and reboots the guest.
 
+`build-seed.sh` injects your SSH public key into `user-data` (the `@SSH_PUBKEY@`
+placeholder): `$SSH_PUBKEY_FILE`, else the first `~/.ssh/id_*.pub`, else the first
+key offered by `ssh-agent`.
+
 After changing `user-data`, `meta-data`, or `network-config`, remove the old
 `seed.iso` and rebuild it:
 

seediso/fedora44/build-seed.sh

@@ -5,24 +5,58 @@ script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 output="${1:-${script_dir}/seed.iso}"
 files=(user-data meta-data)
 
+# Public key injected into user-data: $SSH_PUBKEY_FILE, else the first
+# ~/.ssh/id_*.pub, else the first key offered by ssh-agent.
+pubkey=""
+if [[ -n "${SSH_PUBKEY_FILE:-}" ]]; then
+  pubkey="$(head -n1 -- "${SSH_PUBKEY_FILE}")"
+else
+  for f in "${HOME}"/.ssh/id_ed25519.pub "${HOME}"/.ssh/id_*.pub; do
+    if [[ -f "$f" ]]; then pubkey="$(head -n1 -- "$f")"; break; fi
+  done
+  if [[ -z "$pubkey" ]] && command -v ssh-add >/dev/null 2>&1; then
+    pubkey="$(ssh-add -L 2>/dev/null | head -n1 || true)"
+  fi
+fi
+if [[ "$pubkey" != ssh-* && "$pubkey" != ecdsa-* && "$pubkey" != sk-* ]]; then
+  printf 'Error: no SSH public key found; set SSH_PUBKEY_FILE.\n' >&2
+  exit 1
+fi
+
+work="$(mktemp -d)"
+trap 'rm -rf -- "${work}"' EXIT
+template="$(<"${script_dir}/user-data")"
+printf '%s\n' "${template//@SSH_PUBKEY@/${pubkey}}" > "${work}/user-data"
+cp -- "${script_dir}/meta-data" "${work}/meta-data"
+if [[ -f "${script_dir}/network-config" ]]; then
+  cp -- "${script_dir}/network-config" "${work}/network-config"
+fi
+
 mkdir -p "$(dirname -- "$output")"
+
 if [[ -f "${script_dir}/network-config" ]]; then
   files+=(network-config)
 fi
 
 if command -v cloud-localds >/dev/null 2>&1; then
   args=()
-  [[ -f "${script_dir}/network-config" ]] && args+=(--network-config="${script_dir}/network-config")
+  if [[ -f "${script_dir}/network-config" ]]; then
-  cloud-localds "${args[@]}" "$output" "${script_dir}/user-data" "${script_dir}/meta-data"
+    args+=(--network-config="${work}/network-config")
+  fi
+  cloud-localds "${args[@]}" "${output}" \
+    "${work}/user-data" "${work}/meta-data"
 elif command -v xorriso >/dev/null 2>&1; then
-  xorriso -as mkisofs -quiet -volid cidata -joliet -rock -output "$output" "${files[@]/#/${script_dir}/}"
+  xorriso -as mkisofs -quiet -volid cidata -joliet -rock \
+    -output "${output}" "${files[@]/#/${work}/}"
 elif command -v genisoimage >/dev/null 2>&1; then
-  genisoimage -quiet -output "$output" -volid cidata -joliet -rock "${files[@]/#/${script_dir}/}"
+  genisoimage -quiet -output "${output}" -volid cidata -joliet -rock \
+    "${files[@]/#/${work}/}"
 elif command -v mkisofs >/dev/null 2>&1; then
-  mkisofs -quiet -output "$output" -volid cidata -joliet -rock "${files[@]/#/${script_dir}/}"
+  mkisofs -quiet -output "${output}" -volid cidata -joliet -rock \
+    "${files[@]/#/${work}/}"
 else
   printf 'Error: install cloud-image-utils, xorriso, genisoimage, or mkisofs.\n' >&2
   exit 1
 fi
 
-printf 'Created %s\n' "$output"
+printf 'Created %s\n' "${output}"

seediso/fedora44/user-data

@@ -10,6 +10,8 @@ users:
     shell: /bin/bash
     sudo: "ALL=(ALL) NOPASSWD: ALL"
     lock_passwd: false
+    ssh_authorized_keys:
+      - @SSH_PUBKEY@
     hashed_passwd: $6$0NtCERV3eO12t9oJ$nlFE2sSc66nFfuD5X0xMnOla1cuzOnHfeGNRY5X7dCDHg.WzWVmuRe7M17Puj44.eCWLnJAWt4WNjd9vP9X0D0
 
 chpasswd: