* [PATCH v2 1/1] rootfs: clean apt auth credentials from final rootfs by default
2026-07-24 9:54 [PATCH v2 0/1] rootfs: clean apt auth credentials from final rootfs by default 'Gourav Singh' via isar-users
@ 2026-07-24 9:54 ` 'Gourav Singh' via isar-users
2026-07-31 8:26 ` [PATCH v2 0/1] " Zhihang Wei
1 sibling, 0 replies; 3+ messages in thread
From: 'Gourav Singh' via isar-users @ 2026-07-24 9:54 UTC (permalink / raw)
To: isar-users; +Cc: felix.moessbauer, Gourav Singh
When ISAR_APT_CREDS is configured, apt writes authentication
credentials to /etc/apt/auth.conf.d/isar.conf in the rootfs
during the build. Add a `clean-apt-credentials` rootfs feature to
rootfs.bbclass that removes this file during do_rootfs_postprocess
to prevent credentials from being shipped in the final image or
SDK sysroot.
Enable the feature by default in image.bbclass and sdk.bbclass.
Document the feature and opt-out in RECIPE-API-CHANGELOG.md.
Signed-off-by: Gourav Singh <gouravsingh@siemens.com>
---
RECIPE-API-CHANGELOG.md | 18 ++++++++++++++++++
meta/classes-recipe/image.bbclass | 1 +
meta/classes-recipe/rootfs.bbclass | 6 ++++++
meta/classes-recipe/sdk.bbclass | 2 +-
4 files changed, 26 insertions(+), 1 deletion(-)
diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md
index f5b84c84..19eada4a 100644
--- a/RECIPE-API-CHANGELOG.md
+++ b/RECIPE-API-CHANGELOG.md
@@ -1137,3 +1137,21 @@ targeting Microsoft Hyper-V virtual machines on amd64.
The machine produces a `.vhdx` disk image using the WIC image type
and GRUB as the bootloader. It supports Debian bullseye, bookworm
and trixie.
+
+### Automatic cleanup of APT authentication credentials
+
+A new rootfs feature `clean-apt-credentials` has been added to
+`rootfs.bbclass`. When enabled, it removes
+`/etc/apt/auth.conf.d/isar.conf` from the rootfs during
+`do_rootfs_postprocess`, ensuring that APT authentication
+credentials set via `ISAR_APT_CREDS` are not shipped in the
+final image or SDK sysroot.
+
+The feature is enabled by default in `image.bbclass` and
+`sdk.bbclass` via `ROOTFS_FEATURES`.
+
+To opt out, remove the feature explicitly:
+
+```
+ROOTFS_FEATURES:remove = "clean-apt-credentials"
+```
diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass
index edd4f888..d02f99da 100644
--- a/meta/classes-recipe/image.bbclass
+++ b/meta/classes-recipe/image.bbclass
@@ -102,6 +102,7 @@ ROOTFS_FEATURES += "\
clean-debconf-cache \
populate-systemd-preset \
generate-sbom \
+ clean-apt-credentials \
"
ROOTFS_PACKAGES += "${IMAGE_PREINSTALL} ${@isar_multiarch_packages('IMAGE_INSTALL', d)}"
ROOTFS_VARDEPS += "IMAGE_INSTALL"
diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index e17f711f..0845320e 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -35,6 +35,7 @@ ROOTFS_BASE_DISTRO ?= "${BASE_DISTRO}"
# 'export-dpkg-status' - exports /var/lib/dpkg/status file to ${ROOTFS_DPKGSTATUS_DEPLOY_DIR}
# 'clean-log-files' - delete log files that are not owned by packages
# 'populate-systemd-preset' - enable systemd units according to systemd presets
+# 'clean-apt-credentials' - remove apt auth credentials written by ISAR_APT_CREDS
# only supported from bookworm / jammy on
ROOTFS_FEATURES:remove:buster = "generate-sbom"
@@ -531,6 +532,11 @@ rootfs_postprocess_clean_debconf_cache() {
run_privileged rm -rf "${ROOTFSDIR}/var/cache/debconf/"*
}
+ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'clean-apt-credentials', 'rootfs_postprocess_clean_apt_credentials', '', d)}"
+rootfs_postprocess_clean_apt_credentials() {
+ run_privileged rm -f "${ROOTFSDIR}/etc/apt/auth.conf.d/isar.conf"
+}
+
ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'clean-pycache', 'rootfs_postprocess_clean_pycache', '', d)}"
rootfs_postprocess_clean_pycache() {
run_privileged find ${ROOTFSDIR}/usr -type f -name '*.pyc' -delete -print
diff --git a/meta/classes-recipe/sdk.bbclass b/meta/classes-recipe/sdk.bbclass
index 7a8d5ff4..d79de2bf 100644
--- a/meta/classes-recipe/sdk.bbclass
+++ b/meta/classes-recipe/sdk.bbclass
@@ -49,7 +49,7 @@ ROOTFS_ARCH:class-sdk = "${HOST_ARCH}"
ROOTFS_DISTRO:class-sdk = "${@get_rootfs_distro(d)}"
ROOTFS_PACKAGES:class-sdk = "sdk-files ${SDK_TOOLCHAIN} ${SDK_PREINSTALL} ${@isar_multiarch_packages('SDK_INSTALL', d)}"
ROOTFS_VARDEPS:class-sdk = "SDK_INSTALL SDK_INCLUDE_ISAR_APT"
-ROOTFS_FEATURES:append:class-sdk = " clean-package-cache generate-manifest export-dpkg-status generate-sbom"
+ROOTFS_FEATURES:append:class-sdk = " clean-package-cache generate-manifest export-dpkg-status generate-sbom clean-apt-credentials"
ROOTFS_MANIFEST_DEPLOY_DIR:class-sdk = "${DEPLOY_DIR_SDKCHROOT}"
ROOTFS_DPKGSTATUS_DEPLOY_DIR:class-sdk = "${DEPLOY_DIR_SDKCHROOT}"
--
2.39.5
--
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260724095428.192250-2-gouravsingh%40siemens.com.
^ permalink raw reply [flat|nested] 3+ messages in thread