nuageinit: fix shell injection in power_state_change delay and add test

nuageinit: fix shell command injection in multiple rc.conf.d writes

nuageinit: use single-quote shell escaping for hostname in rc.conf.d

The hostname value was written inside double quotes in
/etc/rc.conf.d/hostname. POSIX shell performs command substitution
inside

nuageinit: use single-quote shell escaping for hostname in rc.conf.d

The hostname value was written inside double quotes in
/etc/rc.conf.d/hostname. POSIX shell performs command substitution
inside double quotes, so a hostname containing $() or backticks would
be executed when the file is sourced (e.g., by rc(8)).

Switch to using the existing shell_escape() helper, which wraps values
in single quotes. In POSIX shell, single-quoted strings are completely
literal — no expansion or substitution of any kind is performed.

While the hostname is already validated to contain only
[a-zA-Z0-9.-], this change provides defense-in-depth so the output
format is safe regardless of future validation changes.

Reported by: Yazdan Soltani <yazdan.soltani@gmail.com>

show more ...

nuageinit: install certs in /usr/share/certs/trusted

Suggested by: kevans

nuageinit: implement phone_home support

Posts instance data (hostname, instance_id, public keys) to a URL
using fetch(1). Supports:
- url: target URL
- post: list of data items to send, or 'all'
- t

nuageinit: implement phone_home support

Posts instance data (hostname, instance_id, public keys) to a URL
using fetch(1). Supports:
- url: target URL
- post: list of data items to send, or 'all'
- tries: number of retry attempts (default 1)

show more ...

nuageinit: implement final_message support

nuage.lua: add encode_base64 helper

nuageinit: implement power_state_change and locale support

nuageinit: implement MIME multipart user-data support

Add support for MIME multipart/mixed user-data, allowing a single
user-data blob to contain multiple parts with different content types.

nuageinit: implement ca_certs support

Add support for the 'ca_certs' cloud-config key which manages
CA certificates by writing them to /etc/ssl/certs/ and running
certctl rehash.

nuageinit: implement ntp support

Add support for the 'ntp' cloud-config key which configures NTP
by writing /etc/ntp.conf with server and pool entries.

nuageinit: implement ssh_authkey_fingerprints support

Add support for the 'ssh_authkey_fingerprints' cloud-config key
which logs SSH host key fingerprints to the console via ssh-keygen.

nuageinit: implement keyboard support

nuageinit: implement resolv_conf support

Add support for the 'resolv_conf' cloud-config key which writes
directly to /etc/resolv.conf.

nuageinit: implement mounts support

Add support for the 'mounts' cloud-config key which configures
mount points by appending entries to /etc/fstab and creating
the corresponding directories.

nuageinit: add tests for bootcmd, ssh_deletekeys, disable_root, manage_etc_hosts

nuageinit: fix update_sshd_config crash when file does not exist

Previously update_sshd_config() would assert-fail if sshd_config did
not exist. Now it creates a new file with the given key/value.

nuageinit: fix update_sshd_config crash when file does not exist

Previously update_sshd_config() would assert-fail if sshd_config did
not exist. Now it creates a new file with the given key/value.

Also replace the fragile simultaneous r+ + temp file approach with
a cleaner read-then-write pattern: read all lines into memory, modify
as needed, then write to a temp file and rename. All assert() calls
replaced with proper error handling via warnmsg().

Add test case for missing file creation.

show more ...

nuageinit: add hostname validation (RFC 952/1123) to sethostname()

Validate hostnames before writing them:
- Reject empty hostnames
- Reject hostnames longer than 253 characters
- Reject hostnames w

nuageinit: add hostname validation (RFC 952/1123) to sethostname()

Validate hostnames before writing them:
- Reject empty hostnames
- Reject hostnames longer than 253 characters
- Reject hostnames with invalid characters
- Reject hostnames starting or ending with dot/hyphen
- Reject labels longer than 63 characters
- Reject labels starting or ending with hyphen

Expand the sethostname test to cover all rejection cases.
Update nuage.sh sethostname_body to ignore stderr (warnings).

show more ...

nuageinit: add config2_network DNS services test

nuageinit: add dirname edge case tests

nuageinit: fix command injection and related issues

- Add shell_escape() helper to safely escape shell arguments
- Apply shell_escape to all user-controlled values in shell commands:
adduser (user

nuageinit: fix command injection and related issues

- Add shell_escape() helper to safely escape shell arguments
- Apply shell_escape to all user-controlled values in shell commands:
adduser (usershow, useradd, lock, primary_group, groups)
addgroup (groupshow, groupadd, members)
exec_change_password (usermod)
settimezone (tzsetup root and timezone)
install_package (pkg package names)
- Escape double quotes in hostname when writing rc.conf.d/hostname
- Add missing 'local' declaration for resolvconf_command in nameservers()
- Escape interface name in resolvconf -a command
- Change open_resolvconf_conf() from 'w' to 'a' mode to prevent
data loss when nameservers() is called multiple times
- Clean up stale resolvconf.conf at the start of each boot
(skip on postnet to preserve config written by first call)

MFC After: 1 day

show more ...

nuageinit: add update_sshd_config tests

nuageinit: add adddoas tests

nuageinit: add addsudo tests

nuageinit: add decode_base64 tests