Conversation
Adds an opt-in, per-device way to turn on SSH for the pi account, so a freshly flashed feeder can be reached without shipping a shared default login. The feeder config file on the boot partition gains two keys: SSH_PASSWORD sets the pi account password (minimum 12 characters) and enables password login scoped to pi only, and SSH_PUBKEY installs a single managed public key. The password is redacted from the config file on the SD card the moment it is applied, so no cleartext lingers. By default the image continues to ship with password SSH disabled. Pairs with the web-UI side in airplanes-live/image-webconfig.
Stage the apl-ssh helper and ssh-validators.sh into the runtime overlay and add their managed_paths symlinks, so the webconfig per-device SSH controls have their privileged helper installed on the feeder image. The helper ships in the webconfig release; this wires it onto the image.
Stable image releases now publish a changelog instead of the minimal metadata block: the image repo's own PRs (via GitHub's native release notes) plus a per-component section for every overlay pin that changed since the previous stable tag. Repositories that merge via pull requests render a qualified PR list; upstream and rebase-tracking repos fall back to a compare link and commit count. Generation is best-effort — failures degrade per component and the release keeps the prior minimal notes.
adduser --disabled-login leaves pi with a nologin shell; the usermod that fixed it was gated on FIRST_USER_PASS, which the opt-in SSH work removed. pi is the account the SSH enable paths target, so it now gets a bash login shell unconditionally (it stays disabled-login until enabled).
The Rotate-secret feature added a privileged wrapper at /usr/local/lib/airplanes-webconfig/claim-rotate.sh plus a sudoers grant for it. The sudoers file and the webconfig binary are already covered by managed_paths, but the wrapper itself had no entry — so a freshly flashed image carries it (the rootfs ships it) while a feeder updated via the runtime overlay would get the grant pointing at a script that isn't linked into place, breaking rotation. Add the missing symlink entry, mirroring the identity-export/identity-import wrappers.
Add a release gate (sudoers-managed-check.sh, wired into verify-gates.sh) that fails the build when a staged sudoers NOPASSWD command path is not provided by a managed_paths entry and is not a base-OS binary under /usr/bin, /bin, /usr/sbin, or /sbin. This is the cross-repo invariant that was missing: a privileged helper granted in image-webconfig but unmanaged here flashes fine yet breaks on an in-place overlay update. The gate would have caught the claim-rotate.sh omission this PR also fixes.
Move the stable channel onto the v0.3.0 webconfig release (device backup/restore, claim-secret rotation, opt-in SSH) and advance the feed overlay pin so the rotation flow has the apl-feed claim rotate --json it invokes.
Pin stable channel to webconfig v0.3.0 and newer feed overlay
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes the current dev branch to main for the next stable feeder image.
This release adds opt-in per-device SSH for the built-in account and moves the stable channel onto the v0.3.0 on-device webconfig — device backup/restore, claim-secret rotation, and detection of FlightAware/Flightradar24 feeders installed outside webconfig — along with the matching feed scripts. The webconfig commit SHA is pinned next to the release tag so the overlay build verifies the downloaded release against its manifest.