From 750f7890701ff94f5c0942cbd2fe243aaddda2cb Mon Sep 17 00:00:00 2001
From: Paul Whalen <pwhalen@fedoraproject.org>
Date: Feb 24 2026 21:43:34 +0000
Subject: fix: restore SSH key management for Ignition


Configures OpenSSH to read keys from ~/.ssh/authorized_keys.d/* in
addition to authorized_keys, restoring functionality lost when
ssh-key-dir was removed.

Uses 90- prefix to ensure crypto policies and security configs are
applied before user keys are sourced.

Follows the same approach as CoreOS:
https://github.com/coreos/fedora-coreos-config/pull/3885

Signed-off-by: Paul Whalen <pwhalen@fedoraproject.org>

---

diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml
index defc385..857b4de 100644
--- a/fedora-iot-base.yaml
+++ b/fedora-iot-base.yaml
@@ -1,9 +1,11 @@
-include: 
+include:
   - bootupd.yaml
   # Enable composefs
   - composefs.yaml
   # Read only sysroot
   - sysroot-ro.yaml
+  # SSH authorized keys configuration for Ignition
+  - sshd-authorized-keys.yaml
 ref: fedora/devel/${basearch}/iot
 repos: []
 selinux: true
diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml
new file mode 100644
index 0000000..4080a64
--- /dev/null
+++ b/sshd-authorized-keys.yaml
@@ -0,0 +1,18 @@
+# Configuration to have OpenSSH read authorized keys from files in
+# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys
+# This enables Ignition to write keys to authorized_keys.d/ignition
+#
+# Replaces the deprecated ssh-key-dir package
+# See: https://github.com/coreos/ssh-key-dir/issues/188
+# See: https://github.com/coreos/fedora-coreos-config/pull/3885
+
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+
+    # Configure sshd to read keys from authorized_keys.d directory
+    cat > /etc/ssh/sshd_config.d/90-authorized-keys-file.conf << 'EOF'
+    # Also accept keys configured by Ignition and Afterburn
+    AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/*
+    EOF