harden build scripts and fix correctness issues from audit

Security & correctness fixes following the audit in REPORT.md.

  - setup-hypervisor.sh: fix broken error handling — use curl -fsSL,
    check failures properly, return valid exit codes, and fetch
    /releases/latest (arch-aware) instead of the possibly-draft .[0]
  - entrypoint.sh: quote "$@" and build --net conditionally so empty
    NET_INTERFACE/NET_MAC don't yield "tap=,mac="
  - image-updater: replace tight 3s retry loop with capped exponential
    backoff + periodic pull instead of hammering the registry
  - sshd: set PermitRootLogin prohibit-password explicitly (key-only root)
  - vm.Dockerfile: copy only host private keys at mode 600 instead of
    the whole secret/* glob (drops .gitkeep/.pub from /etc/ssh)
  - Makefile: stop generating redundant _pub key files
  - build-image.sh: detect failure via alpine-make-vm-image's real exit
    status rather than grepping stdout for "ERROR"
  - remove orphaned etc/alloy/config.alloy (service not installed)
  - README: correct data.raw path
  - add REPORT.md audit notes (H1/H2 accepted as out-of-scope)

scripts/entrypoint.sh

@@ -1,8 +1,18 @@
 #!/bin/sh
-set -euo pipefail
+set -eu
 
 API_SOCKET="/hy.socks"
 
+# Build the --net argument, omitting empty fields so cloud-hypervisor can pick
+# sensible defaults (auto-created tap / generated MAC) instead of getting
+# "tap=,mac=".
+NET_INTERFACE="${NET_INTERFACE:-}"
+NET_MAC="${NET_MAC:-}"
+NET_ARG="tap=${NET_INTERFACE}"
+if [ -n "$NET_MAC" ]; then
+  NET_ARG="${NET_ARG},mac=${NET_MAC}"
+fi
+
 /usr/bin/cloud-hypervisor \
   --kernel /boot/vmlinuz-virt --initramfs /boot/initramfs-virt \
   --disk path=/image/vm.raw,image_type=raw \
@@ -11,8 +21,8 @@ API_SOCKET="/hy.socks"
   --cmdline "root=/dev/vda rootfstype=ext4 modules=ext4a rw console=hvc0" \
   --cpus boot=${CPU_COUNT:-4} \
   --memory size=${MEMORY:-4G},shared=on \
-  --net "tap=$NET_INTERFACE,mac=$NET_MAC" \
-  $@ &
+  --net "$NET_ARG" \
+  "$@" &
 
 CH_PID=$!
 
@@ -24,4 +34,4 @@ _stop() {
 
 trap _stop TERM INT
 
-wait $CH_PID
+wait $CH_PID

scripts/setup-hypervisor.sh

@@ -1,22 +1,64 @@
 #!/bin/sh
+# Download and install the latest cloud-hypervisor + ch-remote static binaries.
+set -eu
 
-set -u
+API="https://api.github.com/repos/cloud-hypervisor/cloud-hypervisor/releases/latest"
 
-echo "fetching latest version of cloud-hypervisor"
-RESPONSE=$(curl https://api.github.com/repos/cloud-hypervisor/cloud-hypervisor/releases)
-HYPERVISOR_URL=$(echo $RESPONSE | jq -r '.[0].assets.[] | select( .name == "cloud-hypervisor-static") | .browser_download_url')
-CH_REMOTE_URL=$(echo $RESPONSE | jq -r '.[0].assets.[] | select( .name == "ch-remote-static") | .browser_download_url' )
+# Pick the asset matching this architecture.
+case "$(uname -m)" in
+    x86_64|amd64)
+        ch_asset="cloud-hypervisor-static"
+        chremote_asset="ch-remote-static"
+        ;;
+    aarch64|arm64)
+        ch_asset="cloud-hypervisor-static-aarch64"
+        chremote_asset="ch-remote-static-aarch64"
+        ;;
+    *)
+        echo "unsupported architecture: $(uname -m)" >&2
+        exit 1
+        ;;
+esac
 
-if [ $? -ne 0 ]; then
-    echo "FAILED TO FETCH DOWNLOAD LINK OF CLOUD-HYPERVISOR-STATIC"
-    exit -1
+echo "fetching latest cloud-hypervisor release metadata"
+if ! RESPONSE=$(curl -fsSL "$API"); then
+    echo "FAILED TO QUERY CLOUD-HYPERVISOR RELEASES API" >&2
+    exit 1
 fi
 
-curl -sLo /usr/bin/cloud-hypervisor "$HYPERVISOR_URL" && chmod +x /usr/bin/cloud-hypervisor && cloud-hypervisor --help >/dev/null 2>&1 
+HYPERVISOR_URL=$(printf '%s' "$RESPONSE" | jq -r --arg n "$ch_asset" \
+    '.assets[] | select(.name == $n) | .browser_download_url')
+CH_REMOTE_URL=$(printf '%s' "$RESPONSE" | jq -r --arg n "$chremote_asset" \
+    '.assets[] | select(.name == $n) | .browser_download_url')
 
-curl -sLo /usr/bin/ch-remote "$CH_REMOTE_URL" && chmod +x /usr/bin/ch-remote && ch-remote --help >/dev/null 2>&1
+if [ -z "$HYPERVISOR_URL" ] || [ "$HYPERVISOR_URL" = "null" ] \
+    || [ -z "$CH_REMOTE_URL" ] || [ "$CH_REMOTE_URL" = "null" ]; then
+    echo "FAILED TO RESOLVE DOWNLOAD URLS (asset missing for $(uname -m)?)" >&2
+    exit 1
+fi
 
-if [ $? -ne 0 ]; then
-    echo "FAILED TO DOWNLOAD CLOUD-HYPERVISOR or CLOUD-HYPERVISOR IS NOT EXECUTABLE. (wrong arch?)"
-    exit -1
-fi
+# install_bin <url> <dest>
+install_bin() {
+    _url="$1"; _dest="$2"
+    echo "downloading $_url"
+    if ! curl -fsSL -o "$_dest" "$_url"; then
+        echo "FAILED TO DOWNLOAD $_url" >&2
+        exit 1
+    fi
+    chmod +x "$_dest"
+}
+
+install_bin "$HYPERVISOR_URL" /usr/bin/cloud-hypervisor
+install_bin "$CH_REMOTE_URL" /usr/bin/ch-remote
+
+# Sanity-check the binaries actually run on this platform.
+if ! /usr/bin/cloud-hypervisor --version >/dev/null 2>&1; then
+    echo "cloud-hypervisor is not executable (wrong arch?)" >&2
+    exit 1
+fi
+if ! /usr/bin/ch-remote --version >/dev/null 2>&1; then
+    echo "ch-remote is not executable (wrong arch?)" >&2
+    exit 1
+fi
+
+echo "cloud-hypervisor installed"