@@ -1137,3 +1137,21 @@ targeting Microsoft Hyper-V virtual machines on amd64.
The machine produces a `.vhdx` disk image using the WIC image type
and GRUB as the bootloader. It supports Debian bullseye, bookworm
and trixie.
+
+### Automatic cleanup of APT authentication credentials
+
+A new rootfs feature `clean-apt-credentials` has been added to
+`rootfs.bbclass`. When enabled, it removes
+`/etc/apt/auth.conf.d/isar.conf` from the rootfs during
+`do_rootfs_postprocess`, ensuring that APT authentication
+credentials set via `ISAR_APT_CREDS` are not shipped in the
+final image or SDK sysroot.
+
+The feature is enabled by default in `image.bbclass` and
+`sdk.bbclass` via `ROOTFS_FEATURES`.
+
+To opt out, remove the feature explicitly:
+
+```
+ROOTFS_FEATURES:remove = "clean-apt-credentials"
+```
@@ -102,6 +102,7 @@ ROOTFS_FEATURES += "\
clean-debconf-cache \
populate-systemd-preset \
generate-sbom \
+ clean-apt-credentials \
"
ROOTFS_PACKAGES += "${IMAGE_PREINSTALL} ${@isar_multiarch_packages('IMAGE_INSTALL', d)}"
ROOTFS_VARDEPS += "IMAGE_INSTALL"
@@ -35,6 +35,7 @@ ROOTFS_BASE_DISTRO ?= "${BASE_DISTRO}"
# 'export-dpkg-status' - exports /var/lib/dpkg/status file to ${ROOTFS_DPKGSTATUS_DEPLOY_DIR}
# 'clean-log-files' - delete log files that are not owned by packages
# 'populate-systemd-preset' - enable systemd units according to systemd presets
+# 'clean-apt-credentials' - remove apt auth credentials written by ISAR_APT_CREDS
# only supported from bookworm / jammy on
ROOTFS_FEATURES:remove:buster = "generate-sbom"
@@ -531,6 +532,11 @@ rootfs_postprocess_clean_debconf_cache() {
run_privileged rm -rf "${ROOTFSDIR}/var/cache/debconf/"*
}
+ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'clean-apt-credentials', 'rootfs_postprocess_clean_apt_credentials', '', d)}"
+rootfs_postprocess_clean_apt_credentials() {
+ run_privileged rm -f "${ROOTFSDIR}/etc/apt/auth.conf.d/isar.conf"
+}
+
ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'clean-pycache', 'rootfs_postprocess_clean_pycache', '', d)}"
rootfs_postprocess_clean_pycache() {
run_privileged find ${ROOTFSDIR}/usr -type f -name '*.pyc' -delete -print
@@ -49,7 +49,7 @@ ROOTFS_ARCH:class-sdk = "${HOST_ARCH}"
ROOTFS_DISTRO:class-sdk = "${@get_rootfs_distro(d)}"
ROOTFS_PACKAGES:class-sdk = "sdk-files ${SDK_TOOLCHAIN} ${SDK_PREINSTALL} ${@isar_multiarch_packages('SDK_INSTALL', d)}"
ROOTFS_VARDEPS:class-sdk = "SDK_INSTALL SDK_INCLUDE_ISAR_APT"
-ROOTFS_FEATURES:append:class-sdk = " clean-package-cache generate-manifest export-dpkg-status generate-sbom"
+ROOTFS_FEATURES:append:class-sdk = " clean-package-cache generate-manifest export-dpkg-status generate-sbom clean-apt-credentials"
ROOTFS_MANIFEST_DEPLOY_DIR:class-sdk = "${DEPLOY_DIR_SDKCHROOT}"
ROOTFS_DPKGSTATUS_DEPLOY_DIR:class-sdk = "${DEPLOY_DIR_SDKCHROOT}"
When ISAR_APT_CREDS is configured, apt writes authentication credentials to /etc/apt/auth.conf.d/isar.conf in the rootfs during the build. Add a `clean-apt-credentials` rootfs feature to rootfs.bbclass that removes this file during do_rootfs_postprocess to prevent credentials from being shipped in the final image or SDK sysroot. Enable the feature by default in image.bbclass and sdk.bbclass. Document the feature and opt-out in RECIPE-API-CHANGELOG.md. Signed-off-by: Gourav Singh <gouravsingh@siemens.com> --- RECIPE-API-CHANGELOG.md | 18 ++++++++++++++++++ meta/classes-recipe/image.bbclass | 1 + meta/classes-recipe/rootfs.bbclass | 6 ++++++ meta/classes-recipe/sdk.bbclass | 2 +- 4 files changed, 26 insertions(+), 1 deletion(-) -- 2.39.5