unos-repository

commit 3ad1b3cc4754dced4b828dc2036dd1cd3ad3c76e
parent 3cf5df4bd950279e1a7708885215e059c36c63ce
Author: finwo <finwo@pm.me>
Date:   Mon, 14 Sep 2026 11:10:08 +0200

Add tinyssh package

Diffstat:
M
mk/build.sh
 | 
5
++++-
M
mk/rootfs.sh
 | 
2
+-
A
packages/tinyssh/files/tinyssh-check
 | 
3
+++
A
packages/tinyssh/files/tinyssh-log-run
 | 
4
++++
A
packages/tinyssh/files/tinyssh-run
 | 
12
++++++++++++
A
packages/tinyssh/template
 | 
45
+++++++++++++++++++++++++++++++++++++++++++++

6 files changed, 69 insertions(+), 2 deletions(-)
diff --git a/mk/build.sh b/mk/build.sh
@@ -60,7 +60,10 @@ PKGVER="${version}-r${revision}"
 ARCH="x86_64"
 OUTDIR="${ROOT}/build/repo/${ARCH}"
 
-mkdir -p "${SRCDEST}" "${WORK}" "${DESTDIR}" "${OUTDIR}"
+mkdir -p "${SRCDEST}" "${WORK}" "${OUTDIR}"
+# fresh staging every build: templates must be idempotent AND ghost-free
+rm -rf "${DESTDIR}"
+mkdir -p "${DESTDIR}"
 
 # --- fetch + verify ---
 if [ -n "${distfiles}" ]; then
diff --git a/mk/rootfs.sh b/mk/rootfs.sh
@@ -31,6 +31,6 @@ echo "==> trust seed: unos-keys via explicit --allow-untrusted"
 echo "==> UNOS system (fully trusted from here on)"
 "${APK}" --root "${ROOTFS}" --usermode \
   --cache-dir "${CACHE}" --repository "${REPO}" \
-  add base-files glibc busybox unos-firstboot
+  add base-files glibc busybox unos-firstboot tinyssh
 
 echo "==> done: ${ROOTFS}"
diff --git a/packages/tinyssh/files/tinyssh-check b/packages/tinyssh/files/tinyssh-check
@@ -0,0 +1,3 @@
+#!/bin/sh
+# tinyssh check: something answers TCP on 22 (tcpsvd accepted, daemon live).
+exec /usr/bin/nc -z -w2 127.0.0.1 22
diff --git a/packages/tinyssh/files/tinyssh-log-run b/packages/tinyssh/files/tinyssh-log-run
@@ -0,0 +1,4 @@
+#!/bin/sh
+# svlogd companion: runit captures stdout/stderr, so no log files in the
+# daemon itself.
+exec svlogd -tt /var/log/tinyssh
diff --git a/packages/tinyssh/files/tinyssh-run b/packages/tinyssh/files/tinyssh-run
@@ -0,0 +1,12 @@
+#!/bin/sh
+# tinyssh run: provision host keys once, then serve ssh via tcpsvd.
+# tinysshd-makekey is NOT idempotent (mkdir fails when the keydir exists,
+# and rerunning would rotate keys), so the ed25519.pk guard below is
+# load-bearing - never exec makekey unconditionally.
+exec 2>&1
+KEYDIR=/etc/tinyssh/sshkeydir
+mkdir -p /etc/tinyssh
+if [ ! -e "${KEYDIR}/ed25519.pk" ]; then
+  /usr/sbin/tinysshd-makekey -q "${KEYDIR}" || exit 1
+fi
+exec /usr/bin/tcpsvd -vE 0 22 /usr/sbin/tinysshd -v "${KEYDIR}"
diff --git a/packages/tinyssh/template b/packages/tinyssh/template
@@ -0,0 +1,45 @@
+# Template file for 'tinyssh'
+pkgname=tinyssh
+version=20260906
+revision=2
+short_desc="UNOS ssh daemon - tinysshd behind busybox tcpsvd"
+maintainer="finwo <finwo@pm.me>"
+license="CC0-1.0"
+homepage="https://tinyssh.org"
+distfiles="https://github.com/janmojzis/tinyssh/archive/refs/tags/20260906.tar.gz"
+checksum=54c143281e3a7430e9db80847c3242bbd6bf859ceafb5a18562bc4ecbbb2806d
+depends="busybox"
+
+# Notes:
+# - Daemon-only package: upstream ships no client. tinysshd is a multicall
+#   binary (makekey/printkey/noneauthd are argv[0] modes); the template
+#   installs real symlinks rather than the copies `make install` would lay.
+# - Host keys are provisioned by the service run script itself
+#   (idempotent tinysshd-makekey guarded on ed25519.pk), never packaged.
+#   Auth is stock ~/.ssh/authorized_keys, ssh-ed25519 only.
+# - No `make install`: full control over destinations via vinstall.
+
+do_build() {
+  cd "${WRKSRC}"
+  make -j"$(nproc)"
+  [ -x ./tinysshd ] || die "tinyssh: tinysshd binary missing after build"
+}
+
+do_install() {
+  cd "${WRKSRC}"
+  vinstall tinysshd 755 usr/sbin tinysshd
+  # -f: DESTDIR persists across rebuilds, links may already exist
+  ( cd "${DESTDIR}/usr/sbin" && ln -sfn tinysshd tinysshd-makekey ) || die "link makekey"
+  ( cd "${DESTDIR}/usr/sbin" && ln -sfn tinysshd tinysshd-printkey ) || die "link printkey"
+  ( cd "${DESTDIR}/usr/sbin" && ln -sfn tinysshd tinysshnoneauthd ) || die "link noneauthd"
+  vinstall man/tinysshd.8 644 usr/share/man/man8 tinysshd.8
+  vinstall man/tinysshd-makekey.8 644 usr/share/man/man8 tinysshd-makekey.8
+  vinstall man/tinysshd-printkey.8 644 usr/share/man/man8 tinysshd-printkey.8
+  vinstall man/tinysshnoneauthd.8 644 usr/share/man/man8 tinysshnoneauthd.8
+  vinstall ${FILESDIR}/tinyssh-run 755 etc/sv/tinyssh run
+  vinstall ${FILESDIR}/tinyssh-check 755 etc/sv/tinyssh check
+  vinstall ${FILESDIR}/tinyssh-log-run 755 etc/sv/tinyssh/log run
+  # owned (empty) so the keydir parent always exists; the run script also
+  # mkdir -p's defensively for wiped-state recovery
+  install -d "${DESTDIR}/etc/tinyssh"
+}