fix: fourth audit — nix build log, signing key validation, idempotent publish, hw-config cleanup

[mdheller]

Fourth audit findings

H1 — Step 10: nix build 2>/dev/null hides all build errors

When nix build fails, the die message told the operator to re-run with --show-trace — but they had no idea what failed because stderr was suppressed. Replaced 2>/dev/null with 2>"${BUILD_LOG}", where BUILD_LOG is a timestamped path in /tmp. The die message now includes the log path so the operator can read the error immediately without re-running.

H2 — Step 8: Empty/corrupt minisign public key not caught before writing enroll.nix

SIGNING_PUBKEY=$(grep -v '^untrusted comment' "${MINISIGN_PUB}" | head -1) returns an empty string if the pub file exists but is malformed (e.g. interrupted write from a previous run). Without validation, write_enroll_nix "" silently writes signingPublicKey = "" to enroll.nix. Pass-2 nixos-rebuild then fails with a Nix type error that has no obvious connection to the signing key. Added [[ -n "${SIGNING_PUBKEY}" ]] guard with a clear remediation instruction.

H3 — katello-sourceos-setup.sh: content-view publish not idempotent

Every call to katello-sourceos-setup.sh (invoked unconditionally by enroll.sh step 5) published a new content view version regardless of whether any version already existed. Publishing is a slow operation (1–2 min Katello sync) and creates spurious versions (v1.0, v2.0, v3.0...) that clutter the CV history. The CV_VERSION selection at the end (sorted by ID, take last) still worked correctly, but the extra round-trip on every re-run is wasteful and incorrect.

Fix: check content-view version list count before publishing; skip if any version already exists.

M1 — Step 1: Stale hardware-configuration.nix.tmp from previous interrupted runs

The atomic write pattern (> .tmp → mv .tmp final) leaves a .tmp on disk if step 1 is interrupted after nixos-generate-config but before mv. On re-run, the .tmp is silently overwritten anyway (the idempotent check looks for HW_CONFIG, not .tmp), but the stale file is confusing. Added rm -f "${HW_CONFIG}.tmp" at the top of step 1.