-cat /tmp/key
-EOF
-chmod +x $f
-
-
-if ifclass tp; then
- d=$target/q/root/shadow
- mkdir -p $d
- # ls -la /var/lib/fai/config/distro-install-common
- cp /var/lib/fai/config/distro-install-common/traci{,-simple} $d
- chmod -R o-rwx $d
- d=$target/q/root/luks
- mkdir -p $d
- cp /var/lib/fai/config/distro-install-common/luks/host-{tp,demohost} $d
- chmod -R o-rwx $d
+if [[ ${files[0]} ]]; then
+ d=$target/q/root/luks
+ mkdir -p $d
+ chmod 700 $d
+ cp -p ${files[@]} $d
+fi
+
+
+#### This bit is duplicated in rootsshsync, except we skip
+#### update-initramfs and add $target
+####
+# We generally shouldn't need this, because we don't ssh in on the 1st
+# reboot since we initially embed the luks key, and with distro-begin,
+# we run rootsshsync around the same time as we remove it. However, it
+# could be helpful in case of problems.
+
+auth_dir=$target/etc/dropbear/initramfs/
+candidate=$(apt-cache policy dropbear-initramfs | awk '$1 == "Candidate:" { print $2 }' | head -n1 ||:)
+if [[ $candidate ]] && dpkg --compare-versions "$candidate" lt 2020.81-4; then
+ auth_dir=$target/etc/dropbear-initramfs
+fi
+auth_file=$auth_dir/authorized_keys
+mkdir -p $auth_dir
+if [[ ! -e $auth_file ]] || ! diff -q /root/.ssh/authorized_keys $auth_file; then
+ cp -p /root/.ssh/authorized_keys $auth_file