Rewrite sshd promise type to use the keyword as the promiser

Instead of passing sshd directives as named attributes on a single
promise, each directive is now its own promise where the promiser is
the sshd keyword and "value" is the sole attribute. This simplifies
validation and aligns with a one-promise-per-directive model.

Ticket: ENT-13797
Signed-off-by: Lars Erik Wik <lars.erik.wik@northern.tech>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: larsewi

cfbs.json

@@ -307,7 +307,7 @@
       "subdirectory": "promise-types/sshd",
       "dependencies": ["library-for-promise-types-in-python"],
       "steps": [
-        "copy sshd.py modules/promises/",
+        "copy sshd_promise_type.py modules/promises/",
         "append enable.cf services/init.cf"
       ]
     },

promise-types/sshd/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Northern.tech
+Copyright (c) 2026 Northern.tech
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

promise-types/sshd/README.md

@@ -3,21 +3,18 @@
 Configures sshd and restarts the service when configuration changes.
 
 ## Promiser
-An arbitrary human-readable label that appears in log messages and reports.
-Since there is only one global sshd configuration, the promiser is not used to identify a resource.
-Example: `"global sshd config"`.
+The sshd configuration keyword to manage (e.g. `PermitRootLogin`, `AllowUsers`).
+Each promise manages a single directive in the drop-in config file.
 
 ## Attributes
-- Named using sshd's native directive names (e.g. `PermitRootLogin`, not `permit_root_login`)
-- Values can be strings or slists
-- Validated against `sshd -t` during promise evaluation
+- `value` (required) — the value for the directive, either a string or an slist
 
 ## What the module manages internally
 1. **Include directive** — ensures the base `sshd_config` includes the drop-in directory (`sshd_config.d/`) as its first non-comment directive
 2. **Drop-in directory** — creates the drop-in directory if it doesn't exist
 3. **Drop-in file** — writes directives to `sshd_config.d/00-cfengine.conf`
 4. **Service restart** — restarts sshd if configuration was changed and the service is already running
-5. **Verification** — verifies the desired attributes appear in the effective sshd config (`sshd -T`)
+5. **Verification** — verifies the desired directive appears in the effective sshd config (`sshd -T`)
 
 ## What the module does NOT do
 - Install sshd — that is a `packages:` promise
@@ -29,22 +26,19 @@ Example: `"global sshd config"`.
 bundle agent sshd_config
 {
   packages:
-      "openssh-server"
-          policy => "present";
+    "openssh-server" policy => "present";
 
   services:
-      "sshd"
-          service_policy => "start";
+    "sshd" service_policy => "start";
 
   vars:
-      "allowed_users" slist => { "alice", "bob" };
+    "allowed_users" slist => { "alice", "bob" };
 
   sshd:
-      "global"
-          PermitRootLogin        => "no",
-          PasswordAuthentication => "no",
-          Port                   => "22",
-          AllowUsers             => @(allowed_users);
+    "PermitRootLogin" value => "no";
+    "PasswordAuthentication" value => "no";
+    "Port" value => "22";
+    "AllowUsers" value => @(allowed_users);
 }
 ```
 

promise-types/sshd/enable.cf

@@ -1,6 +1,6 @@
 promise agent sshd
 # @brief Define sshd promise type
 {
-  path => "$(sys.workdir)/modules/promises/sshd.py";
+  path => "$(sys.workdir)/modules/promises/sshd_promise_type.py";
   interpreter => "/usr/bin/python3";
 }

promise-types/sshd/example.cf

@@ -1,7 +1,7 @@
 promise agent sshd
 # @brief Define sshd promise type
 {
-  path => "$(sys.workdir)/modules/promises/sshd.py";
+  path => "$(sys.workdir)/modules/promises/sshd_promise_type.py";
   interpreter => "/usr/bin/python3";
 }
 
@@ -19,11 +19,10 @@ bundle agent example
     "allowed_users" slist => { "alice", "bob" };
 
   sshd:
-    "global"
-        PermitRootLogin        => "no",
-        PasswordAuthentication => "no",
-        Port                   => "22",
-        AllowUsers             => @(allowed_users);
+    "PermitRootLogin" value => "no";
+    "PasswordAuthentication" value => "no";
+    "Port" value => "22";
+    "AllowUsers" value => @(allowed_users);
 }
 
 bundle agent __main__