image: clean ISAR apt auth file from final image by default

Message ID 20260723070614.161221-1-gouravsingh@siemens.com
State Superseded
Headers show
Series image: clean ISAR apt auth file from final image by default | expand

Commit Message

Singh, Gourav July 23, 2026, 7:06 a.m. UTC
Add ISAR_APT_CLEAN_AUTH_FILES (default: "1") in image.bbclass.
When ISAR_APT_CREDS is configured and cleanup is enabled, append
/etc/apt/auth.conf.d/isar.conf to ROOTFS_CLEAN_FILES so apt auth
credentials are removed from the final image rootfs.

Also document the new variable and opt-out behavior in
RECIPE-API-CHANGELOG.md.

Signed-off-by: Gourav Singh <gouravsingh@siemens.com>
---
 RECIPE-API-CHANGELOG.md           | 11 +++++++++++
 meta/classes-recipe/image.bbclass | 11 +++++++++++
 2 files changed, 22 insertions(+)

Comments

Felix Moessbauer July 23, 2026, 7:24 a.m. UTC | #1
On Thu, 2026-07-23 at 12:36 +0530, 'Gourav Singh' via isar-users wrote:
> Add ISAR_APT_CLEAN_AUTH_FILES (default: "1") in image.bbclass.
> When ISAR_APT_CREDS is configured and cleanup is enabled, append
> /etc/apt/auth.conf.d/isar.conf to ROOTFS_CLEAN_FILES so apt auth
> credentials are removed from the final image rootfs.
> 
> Also document the new variable and opt-out behavior in
> RECIPE-API-CHANGELOG.md.
> 
> Signed-off-by: Gourav Singh <gouravsingh@siemens.com>
> ---
>  RECIPE-API-CHANGELOG.md           | 11 +++++++++++
>  meta/classes-recipe/image.bbclass | 11 +++++++++++
>  2 files changed, 22 insertions(+)
> 
> diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md
> index f5b84c84..348d296a 100644
> --- a/RECIPE-API-CHANGELOG.md
> +++ b/RECIPE-API-CHANGELOG.md
> @@ -1137,3 +1137,14 @@ targeting Microsoft Hyper-V virtual machines on amd64.
>  The machine produces a `.vhdx` disk image using the WIC image type
>  and GRUB as the bootloader. It supports Debian bullseye, bookworm
>  and trixie.
> +
> +### Automatic cleanup of APT authentication credentials
> +
> +`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`.
> +When `ISAR_APT_CREDS` is configured and
> +`ISAR_APT_CLEAN_AUTH_FILES` is enabled,
> +`/etc/apt/auth.conf.d/isar.conf` is appended to
> +`ROOTFS_CLEAN_FILES` so APT authentication credentials are
> +removed from the final image rootfs.
> +To keep the auth file in the image (not recommended), set
> +`ISAR_APT_CLEAN_AUTH_FILES = "0"`.
> diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass
> index edd4f888..4e4c987b 100644
> --- a/meta/classes-recipe/image.bbclass
> +++ b/meta/classes-recipe/image.bbclass
> @@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
>  ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
>  ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}"
>  
> +# If ISAR_APT_CREDS is configured, apt auth credentials are written to
> +# /etc/apt/auth.conf.d/isar.conf during the build. Clean that file from
> +# image rootfs by default to avoid shipping repository credentials.
> +# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out.
> +ISAR_APT_CLEAN_AUTH_FILES ?= "1"

Hi,

I would rather model this as a rootfs feature instead of adding yet
another parameter. I'm currently re-modelling the rootfs features to
get reproducible sstate artifacts (currently we are creating way more
sstate artifacts than needed, simply because the output of
bootstrapping and do_rootfs_install is not reproducible).

I will send out that cleanup once the "Rework SBOM generation" is
merged.

Anyways, you can already model this as a feature and enable it in the
image recipe (and SDK! recipe).

> +
> +ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \
> +    if d.getVar('ISAR_APT_CREDS') \
> +    and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \

if ${@bb.utils.contains('ROOTFS_FEATURES', 'clean-apt-credentials',
...)

Felix

> +    else ''}"
> +
>  CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}"
>  python () {
>      if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')):
> -- 
> 2.39.5
> 
> -- 
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260723070614.161221-1-gouravsingh%40siemens.com.
Singh, Gourav July 24, 2026, 9:56 a.m. UTC | #2
Hi Felix,

Thanks for the suggestion. Updated in v2 to model this as a
`clean-apt-credentials` rootfs feature instead of a standalone
variable, enabled by default in image.bbclass and sdk.bbclass.

Best Regards,
Gourav

-----Original Message-----
From: Moessbauer, Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>
Sent: 23 July 2026 12:55
To: Singh, Gourav (FT FDS CES LX PBU 2) <gouravsingh@siemens.com>; isar-users@googlegroups.com
Subject: Re: [PATCH] image: clean ISAR apt auth file from final image by default

On Thu, 2026-07-23 at 12:36 +0530, 'Gourav Singh' via isar-users wrote:
> Add ISAR_APT_CLEAN_AUTH_FILES (default: "1") in image.bbclass.
> When ISAR_APT_CREDS is configured and cleanup is enabled, append
> /etc/apt/auth.conf.d/isar.conf to ROOTFS_CLEAN_FILES so apt auth
> credentials are removed from the final image rootfs.
>
> Also document the new variable and opt-out behavior in
> RECIPE-API-CHANGELOG.md.
>
> Signed-off-by: Gourav Singh <gouravsingh@siemens.com>
> ---
>  RECIPE-API-CHANGELOG.md           | 11 +++++++++++
>  meta/classes-recipe/image.bbclass | 11 +++++++++++
>  2 files changed, 22 insertions(+)
>
> diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md index
> f5b84c84..348d296a 100644
> --- a/RECIPE-API-CHANGELOG.md
> +++ b/RECIPE-API-CHANGELOG.md
> @@ -1137,3 +1137,14 @@ targeting Microsoft Hyper-V virtual machines on amd64.
>  The machine produces a `.vhdx` disk image using the WIC image type
> and GRUB as the bootloader. It supports Debian bullseye, bookworm  and
> trixie.
> +
> +### Automatic cleanup of APT authentication credentials
> +
> +`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`.
> +When `ISAR_APT_CREDS` is configured and `ISAR_APT_CLEAN_AUTH_FILES`
> +is enabled, `/etc/apt/auth.conf.d/isar.conf` is appended to
> +`ROOTFS_CLEAN_FILES` so APT authentication credentials are removed
> +from the final image rootfs.
> +To keep the auth file in the image (not recommended), set
> +`ISAR_APT_CLEAN_AUTH_FILES = "0"`.
> diff --git a/meta/classes-recipe/image.bbclass
> b/meta/classes-recipe/image.bbclass
> index edd4f888..4e4c987b 100644
> --- a/meta/classes-recipe/image.bbclass
> +++ b/meta/classes-recipe/image.bbclass
> @@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
>  ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
>  ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}"
>
> +# If ISAR_APT_CREDS is configured, apt auth credentials are written
> +to # /etc/apt/auth.conf.d/isar.conf during the build. Clean that file
> +from # image rootfs by default to avoid shipping repository credentials.
> +# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out.
> +ISAR_APT_CLEAN_AUTH_FILES ?= "1"

Hi,

I would rather model this as a rootfs feature instead of adding yet another parameter. I'm currently re-modelling the rootfs features to get reproducible sstate artifacts (currently we are creating way more sstate artifacts than needed, simply because the output of bootstrapping and do_rootfs_install is not reproducible).

I will send out that cleanup once the "Rework SBOM generation" is merged.

Anyways, you can already model this as a feature and enable it in the image recipe (and SDK! recipe).

> +
> +ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \
> +    if d.getVar('ISAR_APT_CREDS') \
> +    and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \

if ${@bb.utils.contains('ROOTFS_FEATURES', 'clean-apt-credentials',
...)

Felix

> +    else ''}"
> +
>  CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}"
>  python () {
>      if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')):
> --
> 2.39.5
>
> --
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260723070614.161221-1-gouravsingh%40siemens.com.
Singh, Gourav July 24, 2026, 10:43 a.m. UTC | #3
This patch has been superseded by v2 with an updated approach.
Please refer to the v2 thread:
https://groups.google.com/g/isar-users/c/IHlBfEK5OVU

-----Original Message-----
From: Singh, Gourav (FT FDS CES LX PBU 2)
Sent: 24 July 2026 15:26
To: Moessbauer, Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; isar-users@googlegroups.com
Subject: RE: [PATCH] image: clean ISAR apt auth file from final image by default

Hi Felix,

Thanks for the suggestion. Updated in v2 to model this as a `clean-apt-credentials` rootfs feature instead of a standalone variable, enabled by default in image.bbclass and sdk.bbclass.

Best Regards,
Gourav

-----Original Message-----
From: Moessbauer, Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>
Sent: 23 July 2026 12:55
To: Singh, Gourav (FT FDS CES LX PBU 2) <gouravsingh@siemens.com>; isar-users@googlegroups.com
Subject: Re: [PATCH] image: clean ISAR apt auth file from final image by default

On Thu, 2026-07-23 at 12:36 +0530, 'Gourav Singh' via isar-users wrote:
> Add ISAR_APT_CLEAN_AUTH_FILES (default: "1") in image.bbclass.
> When ISAR_APT_CREDS is configured and cleanup is enabled, append
> /etc/apt/auth.conf.d/isar.conf to ROOTFS_CLEAN_FILES so apt auth
> credentials are removed from the final image rootfs.
>
> Also document the new variable and opt-out behavior in
> RECIPE-API-CHANGELOG.md.
>
> Signed-off-by: Gourav Singh <gouravsingh@siemens.com>
> ---
>  RECIPE-API-CHANGELOG.md           | 11 +++++++++++
>  meta/classes-recipe/image.bbclass | 11 +++++++++++
>  2 files changed, 22 insertions(+)
>
> diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md index
> f5b84c84..348d296a 100644
> --- a/RECIPE-API-CHANGELOG.md
> +++ b/RECIPE-API-CHANGELOG.md
> @@ -1137,3 +1137,14 @@ targeting Microsoft Hyper-V virtual machines on amd64.
>  The machine produces a `.vhdx` disk image using the WIC image type
> and GRUB as the bootloader. It supports Debian bullseye, bookworm  and
> trixie.
> +
> +### Automatic cleanup of APT authentication credentials
> +
> +`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`.
> +When `ISAR_APT_CREDS` is configured and `ISAR_APT_CLEAN_AUTH_FILES`
> +is enabled, `/etc/apt/auth.conf.d/isar.conf` is appended to
> +`ROOTFS_CLEAN_FILES` so APT authentication credentials are removed
> +from the final image rootfs.
> +To keep the auth file in the image (not recommended), set
> +`ISAR_APT_CLEAN_AUTH_FILES = "0"`.
> diff --git a/meta/classes-recipe/image.bbclass
> b/meta/classes-recipe/image.bbclass
> index edd4f888..4e4c987b 100644
> --- a/meta/classes-recipe/image.bbclass
> +++ b/meta/classes-recipe/image.bbclass
> @@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
>  ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
>  ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}"
>
> +# If ISAR_APT_CREDS is configured, apt auth credentials are written
> +to # /etc/apt/auth.conf.d/isar.conf during the build. Clean that file
> +from # image rootfs by default to avoid shipping repository credentials.
> +# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out.
> +ISAR_APT_CLEAN_AUTH_FILES ?= "1"

Hi,

I would rather model this as a rootfs feature instead of adding yet another parameter. I'm currently re-modelling the rootfs features to get reproducible sstate artifacts (currently we are creating way more sstate artifacts than needed, simply because the output of bootstrapping and do_rootfs_install is not reproducible).

I will send out that cleanup once the "Rework SBOM generation" is merged.

Anyways, you can already model this as a feature and enable it in the image recipe (and SDK! recipe).

> +
> +ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \
> +    if d.getVar('ISAR_APT_CREDS') \
> +    and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \

if ${@bb.utils.contains('ROOTFS_FEATURES', 'clean-apt-credentials',
...)

Felix

> +    else ''}"
> +
>  CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}"
>  python () {
>      if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')):
> --
> 2.39.5
>
> --
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260723070614.161221-1-gouravsingh%40siemens.com.

Patch

diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md
index f5b84c84..348d296a 100644
--- a/RECIPE-API-CHANGELOG.md
+++ b/RECIPE-API-CHANGELOG.md
@@ -1137,3 +1137,14 @@  targeting Microsoft Hyper-V virtual machines on amd64.
 The machine produces a `.vhdx` disk image using the WIC image type
 and GRUB as the bootloader. It supports Debian bullseye, bookworm
 and trixie.
+
+### Automatic cleanup of APT authentication credentials
+
+`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`.
+When `ISAR_APT_CREDS` is configured and
+`ISAR_APT_CLEAN_AUTH_FILES` is enabled,
+`/etc/apt/auth.conf.d/isar.conf` is appended to
+`ROOTFS_CLEAN_FILES` so APT authentication credentials are
+removed from the final image rootfs.
+To keep the auth file in the image (not recommended), set
+`ISAR_APT_CLEAN_AUTH_FILES = "0"`.
diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass
index edd4f888..4e4c987b 100644
--- a/meta/classes-recipe/image.bbclass
+++ b/meta/classes-recipe/image.bbclass
@@ -109,6 +109,17 @@  ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
 ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
 ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}"
 
+# If ISAR_APT_CREDS is configured, apt auth credentials are written to
+# /etc/apt/auth.conf.d/isar.conf during the build. Clean that file from
+# image rootfs by default to avoid shipping repository credentials.
+# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out.
+ISAR_APT_CLEAN_AUTH_FILES ?= "1"
+
+ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \
+    if d.getVar('ISAR_APT_CREDS') \
+    and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \
+    else ''}"
+
 CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}"
 python () {
     if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')):