From e0898e8a38c5b9a5a9bc848bdd5cb1d6e51b600b Mon Sep 17 00:00:00 2001
From: Paul Whalen <pwhalen@fedoraproject.org>
Date: Feb 24 2026 20:36:39 +0000
Subject: fix: restore SSH key management for Ignition


Configures OpenSSH to read keys from ~/.ssh/authorized_keys.d/* in
addition to authorized_keys, restoring functionality lost when
ssh-key-dir was removed.

Follows the same approach as CoreOS:
https://github.com/coreos/fedora-coreos-config/pull/3885

Signed-off-by: Paul Whalen <pwhalen@fedoraproject.org>

---

diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml
index d159307..329fac2 100644
--- a/fedora-iot-base.yaml
+++ b/fedora-iot-base.yaml
@@ -1,9 +1,11 @@
-include: 
+include:
   - bootupd.yaml
   # Enable composefs
   - composefs.yaml
   # Read only sysroot
   - sysroot-ro.yaml
+  # SSH authorized keys configuration for Ignition
+  - sshd-authorized-keys.yaml
 ref: fedora/rawhide/${basearch}/iot
 repos: []
 selinux: true
diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml
new file mode 100644
index 0000000..07657bc
--- /dev/null
+++ b/sshd-authorized-keys.yaml
@@ -0,0 +1,21 @@
+# Configuration to have OpenSSH read authorized keys from files in
+# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys
+# This enables Ignition to write keys to authorized_keys.d/ignition
+#
+# Replaces the deprecated ssh-key-dir package
+# See: https://github.com/coreos/ssh-key-dir/issues/188
+# See: https://github.com/coreos/fedora-coreos-config/pull/3885
+
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+
+    # Create sshd config directory if it doesn't exist
+    install -dm 0755 -o 0 -g 0 /etc/ssh/sshd_config.d
+
+    # Configure sshd to read keys from authorized_keys.d directory
+    cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF'
+    # Also accept keys configured by Ignition and Afterburn
+    AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/*
+    EOF