Function inject_root_ssh_authorized_keys 

pub(crate) fn inject_root_ssh_authorized_keys(
    root: &Dir,
    dest: &Dir,
    sepolicy: Option<&SePolicy>,
    contents: &str,
) -> Result<()>

Resolve /root in root and write the tmpfiles.d drop-in under dest. With ostree dest is the deployment root itself; a composefs deployment keeps its /etc apart from the image.