net-ssh: Use two-pass method to install an authorized key for root

features.in/net-ssh/generate.mk

@@ -3,11 +3,11 @@ ifneq (,$(BUILDDIR))
 include $(BUILDDIR)/distcfg.mk
 
 # prepare the provided public SSH key to be carried over into the image
-all: SSH_DIR = $(BUILDDIR)/files/root/.ssh
+all: TMPDIR = $(BUILDDIR)/files/tmp
 all:
 	@if [ -s "$(SSH_KEY)" ]; then \
-		mkdir -pm0700 "$(SSH_DIR)"; \
-		install -pm0600 "$(SSH_KEY)" "$(SSH_DIR)/authorized_keys"; \
+		mkdir -p "$(TMPDIR)"; \
+		cp -v "$(SSH_KEY)" "$(TMPDIR)/root_ssh_key.pub"; \
 	fi
 
 endif

features.in/net-ssh/rootfs/image-scripts.d/51-root-ssh-key

+#!/bin/sh -efu
+
+TMPDIR=/tmp
+SSH_DIR=/root/.ssh
+
+if [ -e "$TMPDIR/root_ssh_key.pub" ]; then
+    mkdir -pm0700 "$SSH_DIR"
+    install -v -pm0600 "$TMPDIR/root_ssh_key.pub" "$SSH_DIR/authorized_keys"
+    rm -fv "$TMPDIR/root_ssh_key.pub"
+fi