[PATCH] image: clean ISAR apt auth file from final image by default

["'Gourav Singh' via isar-users" <isar-users@googlegroups.com>]

Add ISAR_APT_CLEAN_AUTH_FILES (default: "1") in image.bbclass.
When ISAR_APT_CREDS is configured and cleanup is enabled, append
/etc/apt/auth.conf.d/isar.conf to ROOTFS_CLEAN_FILES so apt auth
credentials are removed from the final image rootfs.

Also document the new variable and opt-out behavior in
RECIPE-API-CHANGELOG.md.

Signed-off-by: Gourav Singh <gouravsingh@siemens.com>
---
 RECIPE-API-CHANGELOG.md           | 11 +++++++++++
 meta/classes-recipe/image.bbclass | 11 +++++++++++
 2 files changed, 22 insertions(+)

diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md
index f5b84c84..348d296a 100644
--- a/RECIPE-API-CHANGELOG.md
+++ b/RECIPE-API-CHANGELOG.md
@@ -1137,3 +1137,14 @@ targeting Microsoft Hyper-V virtual machines on amd64.
 The machine produces a `.vhdx` disk image using the WIC image type
 and GRUB as the bootloader. It supports Debian bullseye, bookworm
 and trixie.
+
+### Automatic cleanup of APT authentication credentials
+
+`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`.
+When `ISAR_APT_CREDS` is configured and
+`ISAR_APT_CLEAN_AUTH_FILES` is enabled,
+`/etc/apt/auth.conf.d/isar.conf` is appended to
+`ROOTFS_CLEAN_FILES` so APT authentication credentials are
+removed from the final image rootfs.
+To keep the auth file in the image (not recommended), set
+`ISAR_APT_CLEAN_AUTH_FILES = "0"`.
diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass
index edd4f888..4e4c987b 100644
--- a/meta/classes-recipe/image.bbclass
+++ b/meta/classes-recipe/image.bbclass
@@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
 ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
 ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}"
 
+# If ISAR_APT_CREDS is configured, apt auth credentials are written to
+# /etc/apt/auth.conf.d/isar.conf during the build. Clean that file from
+# image rootfs by default to avoid shipping repository credentials.
+# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out.
+ISAR_APT_CLEAN_AUTH_FILES ?= "1"
+
+ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \
+    if d.getVar('ISAR_APT_CREDS') \
+    and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \
+    else ''}"
+
 CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}"
 python () {
     if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')):
-- 
2.39.5

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260723070614.161221-1-gouravsingh%40siemens.com.