From 474d56779a508cbea2ea1c5aac8601444712b4f3 Mon Sep 17 00:00:00 2001
From: "atomicbackspace-agent[bot]"
 <330986079+atomicbackspace-agent[bot]@users.noreply.github.com>
Date: Thu, 12 Nov 2026 17:27:45 +0100
Subject: [PATCH] fix: give uid 1000 a passwd entry, so ssh-keygen runs as the
 runner user

With openssh-keygen in the image (#17, 12.11.1-ci11), zegit's SSHSIG
oracle test still failed on this runner: `ssh-keygen -Y verify` answered
"No user exists for uid 1000" (exit 255). The pod runs as uid 1000, which
has no /etc/passwd entry here, and ssh-keygen looks the current user up
(zegit#575, Gitea run 25467 job 56050).

The image adds a `runner` user and group for uid/gid 1000 (when the base
has none) with a home directory, and a build step running as uid 1000
signs and verifies an SSHSIG, so a missing entry fails the build.

Checked on the operator workstation: zegit's test fails in ci11 run as
--user 1000 ("No user exists for uid 1000") and passes in this build.

Refs: zegit-zoo/zegit#575
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Dockerfile | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index cf71086..e685589 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -143,5 +143,23 @@ RUN set -eux; \
 # The patched binary replaces the stock one (see the runner-build stage).
 COPY --from=runner-build /out/forgejo-runner /bin/forgejo-runner
 
+# A passwd entry for uid 1000, the runner pod's runAsUser. Tools that look up
+# the current user (getpwuid) refuse without one: ssh-keygen -Y verify answered
+# "No user exists for uid 1000" (exit 255) once openssh-keygen was in the image,
+# so zegit's SSHSIG oracle test still failed on this runner (zegit#575).
+RUN grep -q ':x:1000:' /etc/passwd || echo 'runner:x:1000:1000:runner:/home/runner:/bin/sh' >> /etc/passwd; \
+    grep -q ':x:1000:' /etc/group || echo 'runner:x:1000:' >> /etc/group; \
+    mkdir -p /home/runner && chown 1000:1000 /home/runner
+
 # Match the runner pod's runAsUser (1000); keep the image non-root by default.
 USER 1000
+
+# As that user, ssh-keygen signs and verifies an SSHSIG, so a missing passwd
+# entry fails the build here, not in CI.
+RUN set -eu; d=$(mktemp -d); \
+    ssh-keygen -q -t ed25519 -N '' -f "$d/k"; \
+    echo smoke > "$d/f"; \
+    ssh-keygen -q -Y sign -n file -f "$d/k" "$d/f"; \
+    printf 'smoke %s\n' "$(cat "$d/k.pub")" > "$d/allowed"; \
+    ssh-keygen -Y verify -f "$d/allowed" -I smoke -n file -s "$d/f.sig" < "$d/f"; \
+    rm -rf "$d"
-- 
2.54.0