From a8344dc2b57f9f115a921be57e27239272a9568b Mon Sep 17 00:00:00 2001
From: Lars Wirzenius <liw@liw.fi>
Date: Sun, 7 Mar 2021 13:24:03 +0200
Subject: fix: install private part of generated host key, not public

---
 src/cloudinit.rs | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/cloudinit.rs b/src/cloudinit.rs
index 842baa7..ccf98eb 100644
--- a/src/cloudinit.rs
+++ b/src/cloudinit.rs
@@ -215,6 +215,7 @@ impl Hostkeys {
         let ed25519_cert = spec.ed25519_host_cert.clone();
 
         if rsa.is_some() || dsa.is_some() || ecdsa.is_some() || ed25519.is_some() {
+            debug!("At least one host key specified");
             Ok(Some(Self {
                 rsa_private: rsa,
                 rsa_certificate: rsa_cert,
@@ -227,15 +228,17 @@ impl Hostkeys {
             }))
         } else if spec.generate_host_certificate {
             if spec.ca_key.is_none() {
+                debug!("No CA key specified");
                 return Err(CloudInitError::NoCAKey);
             }
             if let Some(filename) = &spec.ca_key {
+                debug!("Generating host key and certificate");
                 let ca = CaKey::from_file(&filename)?;
                 let pair = KeyPair::generate(KeyKind::Ed25519)?;
                 let cert = ca.certify_host(&pair, &spec.name)?;
                 debug!("generated Ed25519 host certificate {:?}", cert);
                 Ok(Some(Self {
-                    ed25519_private: Some(pair.public().to_string()),
+                    ed25519_private: Some(pair.private().to_string()),
                     ed25519_certificate: Some(cert.to_string()),
                     ..Self::default()
                 }))
@@ -243,6 +246,7 @@ impl Hostkeys {
                 Ok(None)
             }
         } else {
+            debug!("No host keys specified, no host certificate wanted");
             Ok(None)
         }
     }
-- 
cgit v1.2.1


From 50560ee9bc2f6c7fa7c601c320bd328c77d03d99 Mon Sep 17 00:00:00 2001
From: Lars Wirzenius <liw@liw.fi>
Date: Sun, 7 Mar 2021 13:24:29 +0200
Subject: fix: make host cert generation field optional in config

---
 src/config.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/config.rs b/src/config.rs
index 132f1f6..9f99655 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -10,7 +10,7 @@ pub struct Configuration {
     pub default_image_gib: Option<u64>,
     pub default_memory_mib: Option<u64>,
     pub default_cpus: Option<u64>,
-    pub default_generate_host_certificate: bool,
+    pub default_generate_host_certificate: Option<bool>,
     pub image_directory: Option<PathBuf>,
     pub authorized_keys: Option<Vec<PathBuf>>,
     pub ca_key: Option<PathBuf>,
-- 
cgit v1.2.1


From 26eb4ad6076fbd6a0f3ebef6c4f227dafd177d40 Mon Sep 17 00:00:00 2001
From: Lars Wirzenius <liw@liw.fi>
Date: Sun, 7 Mar 2021 13:24:54 +0200
Subject: fix: how effective host key cert setting is computed

---
 src/spec.rs | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/spec.rs b/src/spec.rs
index 928628e..2c13af7 100644
--- a/src/spec.rs
+++ b/src/spec.rs
@@ -202,6 +202,13 @@ impl Specification {
         } else {
             config.ca_key.clone()
         };
+        let gen_cert = if let Some(v) = &input.generate_host_certificate {
+            *v
+        } else if let Some(v) = &config.default_generate_host_certificate {
+            *v
+        } else {
+            false
+        };
 
         let spec = Specification {
             name: name.to_string(),
@@ -219,7 +226,7 @@ impl Specification {
             image_size_gib: input.image_size_gib(config, name)?,
             memory_mib: input.memory_mib(config, name)?,
             cpus: input.cpus(config, name)?,
-            generate_host_certificate: input.generate_host_certificate.or(Some(false)).unwrap(),
+            generate_host_certificate: gen_cert,
             ca_key: ca_key,
         };
 
-- 
cgit v1.2.1