From 85e14f2cb8490a00a89dabcff17e3b0fcd3e4c5f Mon Sep 17 00:00:00 2001
From: wangbo <wangbolhr@163.com>
Date: Tue, 28 Jul 2026 04:40:26 +0800
Subject: [PATCH] =?UTF-8?q?fix(deploy):=20=E8=BF=87=E6=BB=A4=20WireGuard?=
 =?UTF-8?q?=20=E5=AE=89=E8=A3=85=E9=98=B6=E6=AE=B5=E6=A0=87=E5=87=86?=
 =?UTF-8?q?=E8=BE=93=E5=87=BA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

节点首次安装 wireguard-tools 时 apt 输出会混入公钥命令替换，导致格式门禁误判并安全停止。仅取远端输出最后一行作为公钥，同时保留原有长度和字符校验。

验证：bash -n、ShellCheck、远端公钥长度与权限只读检查。
---
 scripts/cluster/bootstrap-wireguard.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/cluster/bootstrap-wireguard.sh b/scripts/cluster/bootstrap-wireguard.sh
index e03c7d2..9827784 100755
--- a/scripts/cluster/bootstrap-wireguard.sh
+++ b/scripts/cluster/bootstrap-wireguard.sh
@@ -15,7 +15,7 @@ public_keys=()
 
 for host in "${hosts[@]}"; do
   echo "[wireguard] preparing $host"
-  public_key=$(cluster_ssh "$host" 'bash -s' <<'REMOTE'
+  public_key=$(cluster_ssh "$host" 'bash -s' <<'REMOTE' | tail -n 1
 set -euo pipefail
 export DEBIAN_FRONTEND=noninteractive
 if ! command -v wg >/dev/null 2>&1; then