Cat ssh pubkey instead of cp

baker/bin/baker

@@ -31,7 +31,7 @@ die()
 {
 	ec="$1"; shift
 	echo "!! ${FUNCNAME[1]}: $*" >&2
-	return "$ec"
+	exit "$ec"
 }
 
 log() { printf '%s...' "$*" >&2; }
@@ -76,8 +76,9 @@ bakeradd()
 	log "Setting up ~/.ssh for $user"
 	{ 
 		sudo --user="$user" mkdir "/home/$user/.ssh"
-		sudo --user="$user" \
-			cp "$keyfile" "/home/$user/.ssh/authorized_keys2";
+		cat "$keyfile" >> "/home/$user/.ssh/authorized_keys2"
+		chmod 700 "/home/$user/.ssh"
+		chmod 644 "/home/$user/.ssh/authorized_keys2"
 	} && ok
 
 	echo "$user added."
@@ -134,6 +135,7 @@ bakerdemote()
 
 main()
 { # entry point
+	(( $(id -u) == 0 )) || die "Script must be run as root"
 	(( $# == 0 )) && usage 1
 	cmd="$1"; shift || die "Not enough arguments for \"$cmd\""
 	case "$cmd" in