Re: [PATCH] image: clean ISAR apt auth file from final image by default

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Thu, 2026-07-23 at 12:36 +0530, 'Gourav Singh' via isar-users wrote:
> Add ISAR_APT_CLEAN_AUTH_FILES (default: "1") in image.bbclass.
> When ISAR_APT_CREDS is configured and cleanup is enabled, append
> /etc/apt/auth.conf.d/isar.conf to ROOTFS_CLEAN_FILES so apt auth
> credentials are removed from the final image rootfs.
> 
> Also document the new variable and opt-out behavior in
> RECIPE-API-CHANGELOG.md.
> 
> Signed-off-by: Gourav Singh <gouravsingh@siemens.com>
> ---
>  RECIPE-API-CHANGELOG.md           | 11 +++++++++++
>  meta/classes-recipe/image.bbclass | 11 +++++++++++
>  2 files changed, 22 insertions(+)
> 
> diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md
> index f5b84c84..348d296a 100644
> --- a/RECIPE-API-CHANGELOG.md
> +++ b/RECIPE-API-CHANGELOG.md
> @@ -1137,3 +1137,14 @@ targeting Microsoft Hyper-V virtual machines on amd64.
>  The machine produces a `.vhdx` disk image using the WIC image type
>  and GRUB as the bootloader. It supports Debian bullseye, bookworm
>  and trixie.
> +
> +### Automatic cleanup of APT authentication credentials
> +
> +`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`.
> +When `ISAR_APT_CREDS` is configured and
> +`ISAR_APT_CLEAN_AUTH_FILES` is enabled,
> +`/etc/apt/auth.conf.d/isar.conf` is appended to
> +`ROOTFS_CLEAN_FILES` so APT authentication credentials are
> +removed from the final image rootfs.
> +To keep the auth file in the image (not recommended), set
> +`ISAR_APT_CLEAN_AUTH_FILES = "0"`.
> diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass
> index edd4f888..4e4c987b 100644
> --- a/meta/classes-recipe/image.bbclass
> +++ b/meta/classes-recipe/image.bbclass
> @@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
>  ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
>  ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}"
>  
> +# If ISAR_APT_CREDS is configured, apt auth credentials are written to
> +# /etc/apt/auth.conf.d/isar.conf during the build. Clean that file from
> +# image rootfs by default to avoid shipping repository credentials.
> +# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out.
> +ISAR_APT_CLEAN_AUTH_FILES ?= "1"

Hi,

I would rather model this as a rootfs feature instead of adding yet
another parameter. I'm currently re-modelling the rootfs features to
get reproducible sstate artifacts (currently we are creating way more
sstate artifacts than needed, simply because the output of
bootstrapping and do_rootfs_install is not reproducible).

I will send out that cleanup once the "Rework SBOM generation" is
merged.

Anyways, you can already model this as a feature and enable it in the
image recipe (and SDK! recipe).

> +
> +ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \
> +    if d.getVar('ISAR_APT_CREDS') \
> +    and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \

if ${@bb.utils.contains('ROOTFS_FEATURES', 'clean-apt-credentials',
...)

Felix

> +    else ''}"
> +
>  CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}"
>  python () {
>      if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')):
> -- 
> 2.39.5
> 
> -- 
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260723070614.161221-1-gouravsingh%40siemens.com.

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/005b0508c59bb794485eba66ecfc6c8358ca9959.camel%40siemens.com.