From c97836e4f2f39b2f238d71b30d15b1ac55120ea5 Mon Sep 17 00:00:00 2001 From: Emir Beganovic Date: Fri, 9 Oct 2026 19:45:40 +0200 Subject: [PATCH] VM image: check the factory snapshot holds no SSH login key The install test's key sits in the user's home, which is its own subvolume and not part of the factory snapshot, and the seal removes it there. The check says so of every image, instead of leaving it to the layout staying as it is. --- test/vm-image/vm-verify | 1 + 1 file changed, 1 insertion(+) diff --git a/test/vm-image/vm-verify b/test/vm-image/vm-verify index dba443f..bc10e41 100755 --- a/test/vm-image/vm-verify +++ b/test/vm-image/vm-verify @@ -41,6 +41,7 @@ check "no shell history" sh -c '! [ -e ~/.bash_history ]' check "the package cache is empty" [ -z "$(ls /var/cache/pacman/pkg)" ] root mkdir -p /run/top && root mount -o subvolid=5,ro "$(findmnt -no SOURCE / | sed 's/\[.*//')" /run/top check "the factory snapshot has no machine ID" sh -c "! printf '%s\n' '$PW' | sudo -S -p '' test -s /run/top/@factory/etc/machine-id" +check "the factory snapshot holds no SSH login key" sh -c "! printf '%s\n' '$PW' | sudo -S -p '' sh -c 'ls /run/top/@factory/root/.ssh/authorized_keys /run/top/@factory/home/*/.ssh/authorized_keys' 2>/dev/null | grep -q ." check "the factory snapshot has no SSH host keys" sh -c "[ -z \"\$(printf '%s\n' '$PW' | sudo -S -p '' sh -c 'ls /run/top/@factory/etc/ssh/ssh_host_* 2>/dev/null')\" ]" check "no snapshots besides the current system" [ -z "$(root ls /.snapshots)" ] echo "omarchy $(pacman -Q omarchy 2>/dev/null | cut -d' ' -f2), kernel $(uname -r), $(systemd-analyze | head -1)"