feat: update UVM installation and usage documentation; enhance image handling tests

tests/test_images.py

@@ -143,6 +143,31 @@ class ImageStoreTests(unittest.TestCase):
         self.assertLess(updated.index("Match User codemate-user"), updated.index("Match Group restricted"))
         self.assertIn("Match Group restricted\n    X11Forwarding no", updated)
 
+    @unittest.skipUnless(
+        shutil.which("sshd") and shutil.which("ssh-keygen") and Path("/run/sshd").is_dir(),
+        "OpenSSH server tools and the privilege-separation directory are required",
+    )
+    def test_openssh_accepts_the_full_config_and_limits_password_auth_to_the_guest_user(self) -> None:
+        runner = CommandRunner(emit=None)
+        with tempfile.TemporaryDirectory() as temporary:
+            key = Path(temporary) / "host_key"
+            runner.run(("ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-f", key), capture=True)
+            contents = _enable_ssh_password_authentication(
+                "UsePAM yes\nSubsystem sftp internal-sftp\nPermitRootLogin no\n",
+                "codemate-user",
+            )
+            for key_type in ("rsa", "ecdsa", "ed25519"):
+                contents = contents.replace(f"/etc/ssh/ssh_host_{key_type}_key", str(key))
+            config = Path(temporary) / "sshd_config"
+            config.write_text(contents, encoding="utf-8")
+            for username, expected in (("codemate-user", "yes"), ("root", "no")):
+                with self.subTest(username=username):
+                    result = runner.run((
+                        shutil.which("sshd"), "-T", "-f", config,
+                        "-C", f"user={username},host=localhost,addr=127.0.0.1",
+                    ), capture=True)
+                    self.assertIn(f"passwordauthentication {expected}\n", result.stdout)
+
     def test_removes_only_the_public_firecracker_demo_key(self) -> None:
         own_key = "ssh-ed25519 AAAA-own-key developer@example"
 
@@ -325,6 +350,11 @@ class OfflineGuestCredentialsTests(unittest.TestCase):
         self.assertIn("Defaults:codemate-user !rootpw, !runaspw, !targetpw\n", self.contents("/etc/sudoers"))
         self.assert_metadata("/etc/sudoers", 0o440, 0, 0)
         self.assert_metadata("/usr/bin/sudo", 0o4755, 0, 0)
+        if shutil.which("visudo"):
+            sudoers = self.base / "sudoers"
+            sudoers.write_text(self.contents("/etc/sudoers"), encoding="utf-8")
+            sudoers.chmod(0o440)
+            self.runner.run(("visudo", "-c", "-f", sudoers), capture=True)
         for guest_path in ("/etc/passwd", "/etc/group"):
             self.assert_metadata(guest_path, 0o644, 0, 0)
         for guest_path in ("/etc/shadow", "/etc/gshadow"):