Fix user ownership bug

scripts/extract-artifacts.sh

@@ -41,6 +41,16 @@ for bin in virt-copy-out virt-ls guestfish mkfs.erofs veritysetup jq getfattr; d
     command -v "$bin" >/dev/null || { echo "ERROR: $bin not found on build host" >&2; exit 1; }
 done
 
+# Must run as root: `tar -x` can only restore the build tree's real ownership
+# (root:ssh_keys host keys, tty/crontab setgid groups, service-user dirs, user
+# home dirs) with CAP_CHOWN. Non-root silently flattens ownership to the caller
+# -> a broken image (sshd refuses, setgid tools misbehave). We removed
+# mkfs.erofs --all-root, so correct ownership now depends on this.
+if [ "$(id -u)" -ne 0 ]; then
+    echo "ERROR: run extract-artifacts.sh as root so file ownership is preserved in the rootfs." >&2
+    exit 1
+fi
+
 mkdir -p "$OUT"
 export LIBGUESTFS_BACKEND=direct
 WORK=$(mktemp -d)
@@ -98,8 +108,12 @@ echo "==> Building reproducible erofs image"
 # a kernel you've confirmed has EROFS_FS_ZIP (grep CONFIG_EROFS /boot/config-*).
 # -T0 + fixed UUID keep output deterministic => stable dm-verity root hash for
 # identical input trees.
+# Do NOT use --all-root: it forces every inode to root:root, discarding group
+# ownership (ssh_keys on host keys -> sshd "permissions too open"; tty/crontab
+# setgid binaries) and user ownership (home dirs). Real ownership is preserved
+# from the tree, which is why this script must run as root (see the euid check).
 FIXED_UUID="6c10a7f0-1d2e-4f5a-9b3c-000000000001"
-mkfs.erofs -T 0 -U "$FIXED_UUID" --all-root \
+mkfs.erofs -T 0 -U "$FIXED_UUID" \
     "$WORK/rootfs.erofs" "$WORK/root"
 
 echo "==> Generating dm-verity hash tree as a SEPARATE file (two-namespace layout)"