packages+frontends: dtail packaging follow-ups (vs0 review items)

- dtail-freebsd.json.tpl: move HostKeyFile from volatile
  /var/run/dserver/cache to persistent /var/db/dserver/ssh_host_key —
  FreeBSD's cleanvar purges /var/run at boot, so the host key was
  regenerated on every reboot (mirrors the NetBSD/OpenBSD templates)
- dserver-freebsd.tpl rc.d: start_precmd now creates /var/db/dserver
  (0700, dserver-owned) and re-runs dserver-update-key-cache.sh on
  every start, so the volatile key cache repopulates right after a
  reboot or restart instead of waiting for the daily periodic job
- packages/Makefile: .SHELLFLAGS gains -o pipefail — the
  "git archive | ssh ... tar" pipeline could mask a git archive
  failure as long as tar succeeded on the truncated stream (the only
  recipe-level pipeline; $(shell ...) calls are unaffected)
- packages/Makefile: OS-suffixed /tmp staging names for the OpenBSD
  and NetBSD dtail tgz (dtail-openbsd-*/dtail-netbsd-*) — a dash-less
  version would have made both targets stage to the same
  /tmp/dtail-<version>.tgz locally and on f0; the final repo copy
  keeps the canonical dtail-<version>.tgz name
- dserver-update-key-cache.sh.tpl (OpenBSD): port the NetBSD
  hardening — quote all variable expansions, derive the user via
  basename suffix stripping instead of cut -d. -f1 (dotted usernames
  broke), fix the obsolete-cachefile echo that used single quotes and
  never interpolated $cachefile, add a header comment documenting the
  rc_pre and /etc/daily.local call sites
- dserver.tpl (OpenBSD rc.d): replace 'rc_cmd $1 &' with rc_bg=YES and
  a plain rc_cmd "$1" — the daemon needs backgrounding because it does
  not daemonize, but backgrounding the whole rc framework made rc_pre
  failures and the start result invisible to rcctl; rc_bg is rc.subr's
  supported way to background only the daemon
- dserver-update-key-cache-freebsd.sh.tpl: header now documents the
  new rc.d start_precmd call site

Deployed: FreeBSD pkg republished, f0/f1/f2 upgraded with host key
migrated to /var/db/dserver first (sha256 verified identical); f3
unreachable, still on the old package. OpenBSD pkg republished,
fishfinger reinstalled + restarted, host key unchanged, dcat verified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

5 files changed, 34 insertions, 18 deletions

diff --git a/frontends/etc/dserver/dtail-freebsd.json.tpl b/frontends/etc/dserver/dtail-freebsd.json.tpl
index cd99560..634fcca 100644
--- a/frontends/etc/dserver/dtail-freebsd.json.tpl
+++ b/frontends/etc/dserver/dtail-freebsd.json.tpl
@@ -90,7 +90,7 @@
   },
   "Server": {
     "SSHBindAddress": "0.0.0.0",
-    "HostKeyFile": "/var/run/dserver/cache/ssh_host_key",
+    "HostKeyFile": "/var/db/dserver/ssh_host_key",
     "HostKeyBits": 2048,
     "MapreduceLogFormat": "default",
     "MaxConcurrentCats": 2,
diff --git a/frontends/etc/rc.d/dserver-freebsd.tpl b/frontends/etc/rc.d/dserver-freebsd.tpl
index 6110c0c..04380cb 100644
--- a/frontends/etc/rc.d/dserver-freebsd.tpl
+++ b/frontends/etc/rc.d/dserver-freebsd.tpl
@@ -21,9 +21,18 @@ start_precmd="dserver_precmd"
 
 dserver_precmd()
 {
+    # /var/run is volatile on FreeBSD (cleanvar purges it at boot) — recreate
+    # the runtime dirs and repopulate the SSH key cache on every service
+    # start (a daily periodic job keeps it fresh afterwards). The SSH host
+    # key lives in persistent /var/db/dserver so it survives reboots (a
+    # regenerated host key would break clients' known_hosts).
     install -d -o dserver -m 0755 /var/log/dserver
     install -d -o dserver -m 0755 /var/run/dserver
     install -d -o dserver -m 0755 /var/run/dserver/cache
+    install -d -o dserver -m 0700 /var/db/dserver
+    if [ -x /usr/local/bin/dserver-update-key-cache.sh ]; then
+        /usr/local/bin/dserver-update-key-cache.sh
+    fi
 }
 
 load_rc_config $name
diff --git a/frontends/etc/rc.d/dserver.tpl b/frontends/etc/rc.d/dserver.tpl
index 305b0ce..76e79a5 100755
--- a/frontends/etc/rc.d/dserver.tpl
+++ b/frontends/etc/rc.d/dserver.tpl
@@ -7,6 +7,10 @@ daemon_user="_dserver"
 . /etc/rc.d/rc.subr
 
 rc_reload=NO
+# dserver does not daemonize itself — let rc.subr start it in the background
+# (rc_bg) instead of backgrounding the whole rc_cmd invocation, which would
+# hide rc_pre failures and the start result from rcctl.
+rc_bg=YES
 
 rc_pre() {
     # /var/run is wiped by /etc/rc at boot — recreate the runtime dirs and
@@ -26,4 +30,4 @@ rc_pre() {
     fi
 }
 
-rc_cmd $1 &
+rc_cmd "$1"
diff --git a/frontends/scripts/dserver-update-key-cache-freebsd.sh.tpl b/frontends/scripts/dserver-update-key-cache-freebsd.sh.tpl
index 22173d7..5b11acf 100644
--- a/frontends/scripts/dserver-update-key-cache-freebsd.sh.tpl
+++ b/frontends/scripts/dserver-update-key-cache-freebsd.sh.tpl
@@ -1,6 +1,8 @@
 #!/bin/sh
 # Refresh the dserver SSH key cache from user authorized_keys files.
-# Called by /usr/local/etc/periodic/daily/200.dserver-update-key-cache.
+# FreeBSD variant: called from the dserver rc.d start_precmd (because
+# /var/run is volatile across reboots — cleanvar purges it) and by
+# /usr/local/etc/periodic/daily/200.dserver-update-key-cache.
 
 CACHEDIR=/var/run/dserver/cache
 DSERVER_USER=dserver
diff --git a/frontends/scripts/dserver-update-key-cache.sh.tpl b/frontends/scripts/dserver-update-key-cache.sh.tpl
index 86b5ecf..fc6bf9e 100644
--- a/frontends/scripts/dserver-update-key-cache.sh.tpl
+++ b/frontends/scripts/dserver-update-key-cache.sh.tpl
@@ -1,4 +1,8 @@
 #!/bin/ksh
+# Refresh the dserver SSH key cache from user authorized_keys files.
+# OpenBSD variant: called from the dserver rc.d rc_pre (because /var/run is
+# wiped by /etc/rc at boot) and from a daily /etc/daily.local entry added by
+# the Rex 'dtail' task — see the pkgrepo skill's dtail-package.md.
 
 CACHEDIR=/var/run/dserver/cache
 DSERVER_USER=_dserver
@@ -7,27 +11,24 @@ DSERVER_GROUP=_dserver
 echo 'Updating SSH key cache'
 
 ls /home/ | while read remoteuser; do
-    keysfile=/home/$remoteuser/.ssh/authorized_keys
+    keysfile="/home/$remoteuser/.ssh/authorized_keys"
 
-    if [ -f $keysfile ]; then
-        cachefile=$CACHEDIR/$remoteuser.authorized_keys
+    if [ -f "$keysfile" ]; then
+        cachefile="$CACHEDIR/$remoteuser.authorized_keys"
         echo "Caching $keysfile -> $cachefile"
 
-        cp $keysfile $cachefile
-        chown $DSERVER_USER:$DSERVER_GROUP $cachefile
-        chmod 600 $cachefile
+        cp "$keysfile" "$cachefile"
+        chown "$DSERVER_USER:$DSERVER_GROUP" "$cachefile"
+        chmod 600 "$cachefile"
     fi
 done
 
-# Cleanup obsolete public SSH keys
-find $CACHEDIR -name \*.authorized_keys -type f |
-while read cachefile; do
-    remoteuser=$(basename $cachefile | cut -d. -f1)
-    keysfile=/home/$remoteuser/.ssh/authorized_keys
-
-    if [ ! -f $keysfile ]; then
-        echo 'Deleting obsolete cache file $cachefile'
-        rm $cachefile
+# Remove stale cache entries for users whose authorized_keys no longer exist
+find "$CACHEDIR" -name '*.authorized_keys' -type f | while read cachefile; do
+    remoteuser=$(basename "$cachefile" .authorized_keys)
+    if [ ! -f "/home/$remoteuser/.ssh/authorized_keys" ]; then
+        echo "Deleting obsolete cache file $cachefile"
+        rm "$cachefile"
     fi
 done