[1.4] core: services: commander: Keep .ssh keys on settings reset (backport #3677 + fix)

[joaoantoniocardoso]

Fixes #3440

Backport of #3677 plus the .ssh fix on top.

Problem

Reset Settings deletes everything under /root/.config. On 1.4 it only rescues bootstrap/startup.json afterwards, so everything else goes, including:

• /root/.config/.ssh — the keypair commander uses to run commands on the host. Once it is gone, run_command() falls back to sshpass with the default password (SSH_USER/SSH_PASSWORD), so every commander-backed feature breaks on any vehicle where the default password was changed, and a reboot does not recover it.
• ardupilot-manager, bag-of-holding and kraken — which is why a reset followed by a reboot leaves a vehicle with installed extensions in a broken state (see the discussion in The Restart Settings is removing the default ssh keys #3440).

Master already fixed the second half in #3677, which was never backported.

Changes

• Cherry-pick 3bdec9b: delete_everything(path, ignore=[...]), so callers can protect paths that must survive a wipe. Conflict resolution keeps 1.4's .gz handling.
• Cherry-pick ee1f27f: commander ignores ardupilot-manager, bag-of-holding, bootstrap and kraken instead of copying startup.json through /tmp.
• Cherry-pick eb85a93: coverage for commonwealth.utils.general, which is where the ignore behaviour is tested. 1.4 has no test_general.py, so the file is created at 1.4's path. Three tests are dropped because they target helpers that only exist on master (_file_is_open_logic_lsof, _file_is_open_command, file_is_open_async), and test_delete_everything_stream no longer holds the .gz file open, because on 1.4 the .gz special case lives in delete_everything rather than in delete_everything_stream. The test_get_cpu_type block is not included: it comes from 1a9bde2, which also changes Compute Module detection and is unrelated to this PR.
• Add /root/.config/.ssh to the ignore list.

After this, 1.4's reset_settings is identical to master's apart from the .ssh entry, which is the same change proposed in #4122 — so the two branches converge instead of diverging.

Preserving is used instead of regenerating so the key is never absent, and the private key never has to be copied through /tmp. The public half in /home/pi/.ssh/authorized_keys was never removed by reset anyway, so deleting the private key only ever broke auth while leaving a stale entry behind.

Complements #3898, which adds the recovery path (setup_ssh() on startup) — this PR stops the key from being destroyed in the first place.

Test plan

Verified on a Raspberry Pi running 1.4.4-beta.15, by running this code in the container:

• Before the fix: POST /commander/v1.0/settings/reset leaves /root/.config/.ssh empty, and the next host command logs Failed to run command with SSH key ... trying with sshpass
• After the fix: the keypair survives with the same fingerprint, and host commands run with ssh -i /root/.config/.ssh/id_rsa (no fallback)
• Marker files under ardupilot-manager, bag-of-holding, bootstrap and kraken all survive the reset, and bootstrap/startup.json is still present
• Reset still resets: a marker file under /root/.config/beacon is deleted
• pytest core/libs/commonwealth/commonwealth/utils/tests/ passes (21 tests)
• ./.hooks/pre-push reports the exact same 44 pre-existing failures as a pristine 1.4-dev checkout — no new ones

[github-actions]

Automated PR Review

0. Summary

• Verdict: LGTM

Backports #3677 to 1.4-dev, adding an ignore parameter to delete_everything() and switching commander's /settings/reset to use it instead of the shuffle-through-/tmp dance. Adds /root/.config/.ssh to the ignore list so the host-command keypair survives a settings reset, and preserves 1.4's .gz carve-out when reconciling the conflict. Tests cover the new containment behaviour.

No further comments, nice job 👍

Generated by PR Review Bot. This is advisory, a human reviewer must still approve.