GoogleCloudPlatform/compute-image-packages — pull request #84 by jkaplowitz (2014-06-19 08:21:56+00:00)
Title: Bugfix: Remove users keys when gone from metadata

Previously, the manage accounts daemon relied solely on the metadata
server to know which accounts to examine. It ignored all other accounts.
This means that, when the last reference to an account was removed from
the metadata server, the final SSH key would linger untouched.

Now, enumerate all accounts on the system (as revealed by the system's
passwd database). If an account has a ~/.ssh/authorized_keys file but
was not reflected in the metadata server, run our key update routine
with an empty list of SSH keys to remove any added-by-Google keys that
may be present.

I successfully tested this on a backports Debian image, by killing the
running daemon, copying over the files, starting the daemon, ensuring it
could create a new user as before, and ensuring it deletes that user's
only key after the user is removed from the metadata server.