RE: [PATCH] image: clean ISAR apt auth file from final image by default

["'Singh, Gourav' via isar-users" <isar-users@googlegroups.com>]

This patch has been superseded by v2 with an updated approach.
Please refer to the v2 thread:
https://groups.google.com/g/isar-users/c/IHlBfEK5OVU

-----Original Message-----
From: Singh, Gourav (FT FDS CES LX PBU 2)
Sent: 24 July 2026 15:26
To: Moessbauer, Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; isar-users@googlegroups.com
Subject: RE: [PATCH] image: clean ISAR apt auth file from final image by default

Hi Felix,

Thanks for the suggestion. Updated in v2 to model this as a `clean-apt-credentials` rootfs feature instead of a standalone variable, enabled by default in image.bbclass and sdk.bbclass.

Best Regards,
Gourav

-----Original Message-----
From: Moessbauer, Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>
Sent: 23 July 2026 12:55
To: Singh, Gourav (FT FDS CES LX PBU 2) <gouravsingh@siemens.com>; isar-users@googlegroups.com
Subject: Re: [PATCH] image: clean ISAR apt auth file from final image by default

On Thu, 2026-07-23 at 12:36 +0530, 'Gourav Singh' via isar-users wrote:
> Add ISAR_APT_CLEAN_AUTH_FILES (default: "1") in image.bbclass.
> When ISAR_APT_CREDS is configured and cleanup is enabled, append
> /etc/apt/auth.conf.d/isar.conf to ROOTFS_CLEAN_FILES so apt auth
> credentials are removed from the final image rootfs.
>
> Also document the new variable and opt-out behavior in
> RECIPE-API-CHANGELOG.md.
>
> Signed-off-by: Gourav Singh <gouravsingh@siemens.com>
> ---
>  RECIPE-API-CHANGELOG.md           | 11 +++++++++++
>  meta/classes-recipe/image.bbclass | 11 +++++++++++
>  2 files changed, 22 insertions(+)
>
> diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md index
> f5b84c84..348d296a 100644
> --- a/RECIPE-API-CHANGELOG.md
> +++ b/RECIPE-API-CHANGELOG.md
> @@ -1137,3 +1137,14 @@ targeting Microsoft Hyper-V virtual machines on amd64.
>  The machine produces a `.vhdx` disk image using the WIC image type
> and GRUB as the bootloader. It supports Debian bullseye, bookworm  and
> trixie.
> +
> +### Automatic cleanup of APT authentication credentials
> +
> +`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`.
> +When `ISAR_APT_CREDS` is configured and `ISAR_APT_CLEAN_AUTH_FILES`
> +is enabled, `/etc/apt/auth.conf.d/isar.conf` is appended to
> +`ROOTFS_CLEAN_FILES` so APT authentication credentials are removed
> +from the final image rootfs.
> +To keep the auth file in the image (not recommended), set
> +`ISAR_APT_CLEAN_AUTH_FILES = "0"`.
> diff --git a/meta/classes-recipe/image.bbclass
> b/meta/classes-recipe/image.bbclass
> index edd4f888..4e4c987b 100644
> --- a/meta/classes-recipe/image.bbclass
> +++ b/meta/classes-recipe/image.bbclass
> @@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
>  ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
>  ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}"
>
> +# If ISAR_APT_CREDS is configured, apt auth credentials are written
> +to # /etc/apt/auth.conf.d/isar.conf during the build. Clean that file
> +from # image rootfs by default to avoid shipping repository credentials.
> +# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out.
> +ISAR_APT_CLEAN_AUTH_FILES ?= "1"

Hi,

I would rather model this as a rootfs feature instead of adding yet another parameter. I'm currently re-modelling the rootfs features to get reproducible sstate artifacts (currently we are creating way more sstate artifacts than needed, simply because the output of bootstrapping and do_rootfs_install is not reproducible).

I will send out that cleanup once the "Rework SBOM generation" is merged.

Anyways, you can already model this as a feature and enable it in the image recipe (and SDK! recipe).

> +
> +ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \
> +    if d.getVar('ISAR_APT_CREDS') \
> +    and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \

if ${@bb.utils.contains('ROOTFS_FEATURES', 'clean-apt-credentials',
...)

Felix

> +    else ''}"
> +
>  CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}"
>  python () {
>      if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')):
> --
> 2.39.5
>
> --
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260723070614.161221-1-gouravsingh%40siemens.com.

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/KL1PR0601MB4697BA61ABFF09BDCED00598BCCF2%40KL1PR0601MB4697.apcprd06.prod.outlook.com.