From 31a040682e577028fe3f203f7759320044a5864a Mon Sep 17 00:00:00 2001
From: Simone <simone@emulab.it>
Date: Tue, 12 May 2026 22:23:33 +0200
Subject: [PATCH] fix(linux): purge stale known_hosts entry before first SSH on
 each clone

Each Linux BuildVM clone gets a new SSH host key for the same
NAT IP, causing 'host key has changed' errors with accept-new mode.

After IP detection, ssh-keygen -R removes the old entry from the
CI-local known_hosts file (F:\CI\State\known_hosts by default)
before Phase 4/5 make any SSH connection. The file is created if
it does not exist yet. Windows jobs are unaffected.
---
 scripts/Invoke-CIJob.ps1 | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/scripts/Invoke-CIJob.ps1 b/scripts/Invoke-CIJob.ps1
index a2c1b07..c8f3925 100644
--- a/scripts/Invoke-CIJob.ps1
+++ b/scripts/Invoke-CIJob.ps1
@@ -438,6 +438,20 @@ try {
             Write-Host "[Invoke-CIJob] Could not detect GuestOS from VMX — defaulting to Windows"
         }
     }
+    # ── Purge stale known_hosts entry for this IP (Linux only) ───────────
+    # Each clone gets a new SSH host key. Remove any previous entry for this
+    # IP from the CI-local known_hosts file before the first SSH connection,
+    # so ssh.exe uses accept-new instead of refusing a changed key.
+    if ($GuestOS -eq 'Linux' -and $SshKnownHostsFile -ne '') {
+        $khDir = Split-Path $SshKnownHostsFile -Parent
+        if (-not (Test-Path $khDir)) {
+            New-Item -ItemType Directory -Path $khDir -Force | Out-Null
+        }
+        if (Test-Path $SshKnownHostsFile) {
+            & ssh-keygen -R $VMIPAddress -f $SshKnownHostsFile 2>$null | Out-Null
+            Write-Host "[Invoke-CIJob] Purged known_hosts entry for $VMIPAddress (fresh clone)."
+        }
+    }
     # ── Phase 4: Wait for readiness ───────────────────────────────────────
     Write-Host "`n[Phase 4/6] Waiting for VM readiness..."
     Write-JobEvent -Phase 'phase4.wait-ready' -Status 'start' -Data @{ ip = $VMIPAddress }