| Message ID | 20260723070614.161221-1-gouravsingh@siemens.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | image: clean ISAR apt auth file from final image by default | expand |
On Thu, 2026-07-23 at 12:36 +0530, 'Gourav Singh' via isar-users wrote: > Add ISAR_APT_CLEAN_AUTH_FILES (default: "1") in image.bbclass. > When ISAR_APT_CREDS is configured and cleanup is enabled, append > /etc/apt/auth.conf.d/isar.conf to ROOTFS_CLEAN_FILES so apt auth > credentials are removed from the final image rootfs. > > Also document the new variable and opt-out behavior in > RECIPE-API-CHANGELOG.md. > > Signed-off-by: Gourav Singh <gouravsingh@siemens.com> > --- > RECIPE-API-CHANGELOG.md | 11 +++++++++++ > meta/classes-recipe/image.bbclass | 11 +++++++++++ > 2 files changed, 22 insertions(+) > > diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md > index f5b84c84..348d296a 100644 > --- a/RECIPE-API-CHANGELOG.md > +++ b/RECIPE-API-CHANGELOG.md > @@ -1137,3 +1137,14 @@ targeting Microsoft Hyper-V virtual machines on amd64. > The machine produces a `.vhdx` disk image using the WIC image type > and GRUB as the bootloader. It supports Debian bullseye, bookworm > and trixie. > + > +### Automatic cleanup of APT authentication credentials > + > +`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`. > +When `ISAR_APT_CREDS` is configured and > +`ISAR_APT_CLEAN_AUTH_FILES` is enabled, > +`/etc/apt/auth.conf.d/isar.conf` is appended to > +`ROOTFS_CLEAN_FILES` so APT authentication credentials are > +removed from the final image rootfs. > +To keep the auth file in the image (not recommended), set > +`ISAR_APT_CLEAN_AUTH_FILES = "0"`. > diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass > index edd4f888..4e4c987b 100644 > --- a/meta/classes-recipe/image.bbclass > +++ b/meta/classes-recipe/image.bbclass > @@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}" > ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}" > ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}" > > +# If ISAR_APT_CREDS is configured, apt auth credentials are written to > +# /etc/apt/auth.conf.d/isar.conf during the build. Clean that file from > +# image rootfs by default to avoid shipping repository credentials. > +# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out. > +ISAR_APT_CLEAN_AUTH_FILES ?= "1" Hi, I would rather model this as a rootfs feature instead of adding yet another parameter. I'm currently re-modelling the rootfs features to get reproducible sstate artifacts (currently we are creating way more sstate artifacts than needed, simply because the output of bootstrapping and do_rootfs_install is not reproducible). I will send out that cleanup once the "Rework SBOM generation" is merged. Anyways, you can already model this as a feature and enable it in the image recipe (and SDK! recipe). > + > +ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \ > + if d.getVar('ISAR_APT_CREDS') \ > + and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \ if ${@bb.utils.contains('ROOTFS_FEATURES', 'clean-apt-credentials', ...) Felix > + else ''}" > + > CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}" > python () { > if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')): > -- > 2.39.5 > > -- > You received this message because you are subscribed to the Google Groups "isar-users" group. > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. > To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260723070614.161221-1-gouravsingh%40siemens.com.
Hi Felix, Thanks for the suggestion. Updated in v2 to model this as a `clean-apt-credentials` rootfs feature instead of a standalone variable, enabled by default in image.bbclass and sdk.bbclass. Best Regards, Gourav -----Original Message----- From: Moessbauer, Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com> Sent: 23 July 2026 12:55 To: Singh, Gourav (FT FDS CES LX PBU 2) <gouravsingh@siemens.com>; isar-users@googlegroups.com Subject: Re: [PATCH] image: clean ISAR apt auth file from final image by default On Thu, 2026-07-23 at 12:36 +0530, 'Gourav Singh' via isar-users wrote: > Add ISAR_APT_CLEAN_AUTH_FILES (default: "1") in image.bbclass. > When ISAR_APT_CREDS is configured and cleanup is enabled, append > /etc/apt/auth.conf.d/isar.conf to ROOTFS_CLEAN_FILES so apt auth > credentials are removed from the final image rootfs. > > Also document the new variable and opt-out behavior in > RECIPE-API-CHANGELOG.md. > > Signed-off-by: Gourav Singh <gouravsingh@siemens.com> > --- > RECIPE-API-CHANGELOG.md | 11 +++++++++++ > meta/classes-recipe/image.bbclass | 11 +++++++++++ > 2 files changed, 22 insertions(+) > > diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md index > f5b84c84..348d296a 100644 > --- a/RECIPE-API-CHANGELOG.md > +++ b/RECIPE-API-CHANGELOG.md > @@ -1137,3 +1137,14 @@ targeting Microsoft Hyper-V virtual machines on amd64. > The machine produces a `.vhdx` disk image using the WIC image type > and GRUB as the bootloader. It supports Debian bullseye, bookworm and > trixie. > + > +### Automatic cleanup of APT authentication credentials > + > +`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`. > +When `ISAR_APT_CREDS` is configured and `ISAR_APT_CLEAN_AUTH_FILES` > +is enabled, `/etc/apt/auth.conf.d/isar.conf` is appended to > +`ROOTFS_CLEAN_FILES` so APT authentication credentials are removed > +from the final image rootfs. > +To keep the auth file in the image (not recommended), set > +`ISAR_APT_CLEAN_AUTH_FILES = "0"`. > diff --git a/meta/classes-recipe/image.bbclass > b/meta/classes-recipe/image.bbclass > index edd4f888..4e4c987b 100644 > --- a/meta/classes-recipe/image.bbclass > +++ b/meta/classes-recipe/image.bbclass > @@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}" > ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}" > ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}" > > +# If ISAR_APT_CREDS is configured, apt auth credentials are written > +to # /etc/apt/auth.conf.d/isar.conf during the build. Clean that file > +from # image rootfs by default to avoid shipping repository credentials. > +# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out. > +ISAR_APT_CLEAN_AUTH_FILES ?= "1" Hi, I would rather model this as a rootfs feature instead of adding yet another parameter. I'm currently re-modelling the rootfs features to get reproducible sstate artifacts (currently we are creating way more sstate artifacts than needed, simply because the output of bootstrapping and do_rootfs_install is not reproducible). I will send out that cleanup once the "Rework SBOM generation" is merged. Anyways, you can already model this as a feature and enable it in the image recipe (and SDK! recipe). > + > +ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \ > + if d.getVar('ISAR_APT_CREDS') \ > + and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \ if ${@bb.utils.contains('ROOTFS_FEATURES', 'clean-apt-credentials', ...) Felix > + else ''}" > + > CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}" > python () { > if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')): > -- > 2.39.5 > > -- > You received this message because you are subscribed to the Google Groups "isar-users" group. > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. > To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260723070614.161221-1-gouravsingh%40siemens.com.
This patch has been superseded by v2 with an updated approach. Please refer to the v2 thread: https://groups.google.com/g/isar-users/c/IHlBfEK5OVU -----Original Message----- From: Singh, Gourav (FT FDS CES LX PBU 2) Sent: 24 July 2026 15:26 To: Moessbauer, Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; isar-users@googlegroups.com Subject: RE: [PATCH] image: clean ISAR apt auth file from final image by default Hi Felix, Thanks for the suggestion. Updated in v2 to model this as a `clean-apt-credentials` rootfs feature instead of a standalone variable, enabled by default in image.bbclass and sdk.bbclass. Best Regards, Gourav -----Original Message----- From: Moessbauer, Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com> Sent: 23 July 2026 12:55 To: Singh, Gourav (FT FDS CES LX PBU 2) <gouravsingh@siemens.com>; isar-users@googlegroups.com Subject: Re: [PATCH] image: clean ISAR apt auth file from final image by default On Thu, 2026-07-23 at 12:36 +0530, 'Gourav Singh' via isar-users wrote: > Add ISAR_APT_CLEAN_AUTH_FILES (default: "1") in image.bbclass. > When ISAR_APT_CREDS is configured and cleanup is enabled, append > /etc/apt/auth.conf.d/isar.conf to ROOTFS_CLEAN_FILES so apt auth > credentials are removed from the final image rootfs. > > Also document the new variable and opt-out behavior in > RECIPE-API-CHANGELOG.md. > > Signed-off-by: Gourav Singh <gouravsingh@siemens.com> > --- > RECIPE-API-CHANGELOG.md | 11 +++++++++++ > meta/classes-recipe/image.bbclass | 11 +++++++++++ > 2 files changed, 22 insertions(+) > > diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md index > f5b84c84..348d296a 100644 > --- a/RECIPE-API-CHANGELOG.md > +++ b/RECIPE-API-CHANGELOG.md > @@ -1137,3 +1137,14 @@ targeting Microsoft Hyper-V virtual machines on amd64. > The machine produces a `.vhdx` disk image using the WIC image type > and GRUB as the bootloader. It supports Debian bullseye, bookworm and > trixie. > + > +### Automatic cleanup of APT authentication credentials > + > +`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`. > +When `ISAR_APT_CREDS` is configured and `ISAR_APT_CLEAN_AUTH_FILES` > +is enabled, `/etc/apt/auth.conf.d/isar.conf` is appended to > +`ROOTFS_CLEAN_FILES` so APT authentication credentials are removed > +from the final image rootfs. > +To keep the auth file in the image (not recommended), set > +`ISAR_APT_CLEAN_AUTH_FILES = "0"`. > diff --git a/meta/classes-recipe/image.bbclass > b/meta/classes-recipe/image.bbclass > index edd4f888..4e4c987b 100644 > --- a/meta/classes-recipe/image.bbclass > +++ b/meta/classes-recipe/image.bbclass > @@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}" > ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}" > ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}" > > +# If ISAR_APT_CREDS is configured, apt auth credentials are written > +to # /etc/apt/auth.conf.d/isar.conf during the build. Clean that file > +from # image rootfs by default to avoid shipping repository credentials. > +# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out. > +ISAR_APT_CLEAN_AUTH_FILES ?= "1" Hi, I would rather model this as a rootfs feature instead of adding yet another parameter. I'm currently re-modelling the rootfs features to get reproducible sstate artifacts (currently we are creating way more sstate artifacts than needed, simply because the output of bootstrapping and do_rootfs_install is not reproducible). I will send out that cleanup once the "Rework SBOM generation" is merged. Anyways, you can already model this as a feature and enable it in the image recipe (and SDK! recipe). > + > +ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \ > + if d.getVar('ISAR_APT_CREDS') \ > + and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \ if ${@bb.utils.contains('ROOTFS_FEATURES', 'clean-apt-credentials', ...) Felix > + else ''}" > + > CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}" > python () { > if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')): > -- > 2.39.5 > > -- > You received this message because you are subscribed to the Google Groups "isar-users" group. > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. > To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260723070614.161221-1-gouravsingh%40siemens.com.
diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md index f5b84c84..348d296a 100644 --- a/RECIPE-API-CHANGELOG.md +++ b/RECIPE-API-CHANGELOG.md @@ -1137,3 +1137,14 @@ targeting Microsoft Hyper-V virtual machines on amd64. The machine produces a `.vhdx` disk image using the WIC image type and GRUB as the bootloader. It supports Debian bullseye, bookworm and trixie. + +### Automatic cleanup of APT authentication credentials + +`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`. +When `ISAR_APT_CREDS` is configured and +`ISAR_APT_CLEAN_AUTH_FILES` is enabled, +`/etc/apt/auth.conf.d/isar.conf` is appended to +`ROOTFS_CLEAN_FILES` so APT authentication credentials are +removed from the final image rootfs. +To keep the auth file in the image (not recommended), set +`ISAR_APT_CLEAN_AUTH_FILES = "0"`. diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass index edd4f888..4e4c987b 100644 --- a/meta/classes-recipe/image.bbclass +++ b/meta/classes-recipe/image.bbclass @@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}" ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}" ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}" +# If ISAR_APT_CREDS is configured, apt auth credentials are written to +# /etc/apt/auth.conf.d/isar.conf during the build. Clean that file from +# image rootfs by default to avoid shipping repository credentials. +# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out. +ISAR_APT_CLEAN_AUTH_FILES ?= "1" + +ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \ + if d.getVar('ISAR_APT_CREDS') \ + and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \ + else ''}" + CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}" python () { if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')):
Add ISAR_APT_CLEAN_AUTH_FILES (default: "1") in image.bbclass. When ISAR_APT_CREDS is configured and cleanup is enabled, append /etc/apt/auth.conf.d/isar.conf to ROOTFS_CLEAN_FILES so apt auth credentials are removed from the final image rootfs. Also document the new variable and opt-out behavior in RECIPE-API-CHANGELOG.md. Signed-off-by: Gourav Singh <gouravsingh@siemens.com> --- RECIPE-API-CHANGELOG.md | 11 +++++++++++ meta/classes-recipe/image.bbclass | 11 +++++++++++ 2 files changed, 22 insertions(+)