M1: vendored sha2/md5 (OpenBSD 8.0) + endian/swap compat; module builds green

scripts/lab-lib.sh

@@ -38,7 +38,9 @@ deb()     { ssh "${SSH_OPTS[@]}" "$DEB_USER@$DEB" "$@"; }
 deb_cmd() { deb "bash -s" <<<"$1"; }
 
 # Run a shell script inside a lab VM (nested ssh from deb with the lab key).
-vm_cmd()  { local ip=$1; deb "ssh -i $LAB_KEY_DEB ${SSH_OPTS[*]} root@$ip 'bash -s'" <<<"$2"; }
+# Guest host keys change every lab rebuild -> pin-noise disabled for this hop.
+VMSSH_OPTS="-o BatchMode=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=5 -o LogLevel=ERROR"
+vm_cmd()  { local ip=$1; deb "ssh -i $LAB_KEY_DEB $VMSSH_OPTS root@$ip 'bash -s'" <<<"$2"; }
 
 # --- template rendering: replace @KEY@ tokens from environment + extra K=V ---
 RENDER_KEYS=(
@@ -148,7 +150,7 @@ ensure_guest_kernel() {
 default_kernelblock() { # prints kernelblock xml for extracted direct boot
   local uuid
   uuid=$(deb "cat $BOOT_DIR/guest-root.uuid")
-  printf '    <kernel>%s/guest-vmlinuz</kernel>\n    <initrd>%s/guest-initramfs</initrd>\n    <cmdline>root=UUID=%s ro console=ttyS0,115200n8</cmdline>' \
+  printf '    <kernel>%s/guest-vmlinuz</kernel>\n    <initrd>%s/guest-initramfs</initrd>\n    <cmdline>root=UUID=%s ro console=ttyS0,115200n8 modules=sd-mod,usb-storage,ext4,ena,gve</cmdline>' \
     "$BOOT_DIR" "$BOOT_DIR" "$uuid"
 }
 
@@ -219,17 +221,19 @@ packages_fixup() { # safety net if cloud-init ran before pf0 had transit up
   local a ip
   for a in $VMS; do
     ip=$(vm_ip "$a")
-    vm_cmd "$ip" 'command -v iperf3 >/dev/null 2>&1 || {
+    vm_cmd "$ip" 'command -v iperf3 >/dev/null 2>&1 && command -v iptables >/dev/null 2>&1 || {
       . /etc/os-release
       grep -qE "^[^#]*/community" /etc/apk/repositories || echo "${HOME}/v${VERSION_ID}/community" >> /etc/apk/repositories
       apk update -q >/dev/null 2>&1
-      apk add -q iperf3 tcpdump python3 py3-scapy bash >/dev/null 2>&1 || warn "apk add failed on '"$a"'"
+      apk add -q iperf3 tcpdump python3 scapy bash iptables >/dev/null 2>&1 || warn "apk add failed on '"$a"'"
     }' || warn "no ssh to $a for package fixup"
   done
 }
 
 # --- ssh access plumbing: aliases pf0|cli|srv|gw2 from deb and from laptop ---
 laptop_ssh_config() {
+  # fresh pin file per lab rebuild: guest host keys change with recreated disks
+  rm -f "$HOME/.ssh/known_hosts_pflab"
   mkdir -p "$(dirname "$LAPTOP_SSH_FRAG")"; chmod 700 "$(dirname "$LAPTOP_SSH_FRAG")" 2>/dev/null || true
   cat > "$LAPTOP_SSH_FRAG" <<EOF
 # >>> generated by pf_port/scripts/vm-create.sh (topology: lab/ips.env) >>>
@@ -267,7 +271,8 @@ deb_ssh_config() {
 Host pf0 cli srv gw2
   User root
   IdentityFile '"$LAB_KEY_DEB"'
-  StrictHostKeyChecking accept-new
+  StrictHostKeyChecking no
+  UserKnownHostsFile /dev/null
   LogLevel ERROR
   ConnectTimeout 8
 Host pf0