packages+frontends: dtail packaging follow-ups (vs0 review items)

- dtail-freebsd.json.tpl: move HostKeyFile from volatile
  /var/run/dserver/cache to persistent /var/db/dserver/ssh_host_key —
  FreeBSD's cleanvar purges /var/run at boot, so the host key was
  regenerated on every reboot (mirrors the NetBSD/OpenBSD templates)
- dserver-freebsd.tpl rc.d: start_precmd now creates /var/db/dserver
  (0700, dserver-owned) and re-runs dserver-update-key-cache.sh on
  every start, so the volatile key cache repopulates right after a
  reboot or restart instead of waiting for the daily periodic job
- packages/Makefile: .SHELLFLAGS gains -o pipefail — the
  "git archive | ssh ... tar" pipeline could mask a git archive
  failure as long as tar succeeded on the truncated stream (the only
  recipe-level pipeline; $(shell ...) calls are unaffected)
- packages/Makefile: OS-suffixed /tmp staging names for the OpenBSD
  and NetBSD dtail tgz (dtail-openbsd-*/dtail-netbsd-*) — a dash-less
  version would have made both targets stage to the same
  /tmp/dtail-<version>.tgz locally and on f0; the final repo copy
  keeps the canonical dtail-<version>.tgz name
- dserver-update-key-cache.sh.tpl (OpenBSD): port the NetBSD
  hardening — quote all variable expansions, derive the user via
  basename suffix stripping instead of cut -d. -f1 (dotted usernames
  broke), fix the obsolete-cachefile echo that used single quotes and
  never interpolated $cachefile, add a header comment documenting the
  rc_pre and /etc/daily.local call sites
- dserver.tpl (OpenBSD rc.d): replace 'rc_cmd $1 &' with rc_bg=YES and
  a plain rc_cmd "$1" — the daemon needs backgrounding because it does
  not daemonize, but backgrounding the whole rc framework made rc_pre
  failures and the start result invisible to rcctl; rc_bg is rc.subr's
  supported way to background only the daemon
- dserver-update-key-cache-freebsd.sh.tpl: header now documents the
  new rc.d start_precmd call site

Deployed: FreeBSD pkg republished, f0/f1/f2 upgraded with host key
migrated to /var/db/dserver first (sha256 verified identical); f3
unreachable, still on the old package. OpenBSD pkg republished,
fishfinger reinstalled + restarted, host key unchanged, dcat verified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions