From patchwork Fri Jul 24 09:54:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Singh, Gourav" X-Patchwork-Id: 5280 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Fri, 24 Jul 2026 11:55:33 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-lf1-f62.google.com (mail-lf1-f62.google.com [209.85.167.62]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 66O9tWcF015173 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 24 Jul 2026 11:55:33 +0200 Received: by mail-lf1-f62.google.com with SMTP id 2adb3069b0e04-5b2ad665573sf43006e87.0 for ; Fri, 24 Jul 2026 02:55:33 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1784886927; cv=pass; d=google.com; s=arc-20260327; b=Y6Qy5V6rP9M3vlnyECdrQHKjdw/mcuK6I7MQPN3r0XkDcO1OK7WAlf9FAkZTL17Pfk bmGPF3Q3ST/nt7cmNSJj8Ox1peXPt71EfN/Yu9Tfvttx7qDhzsBg3F0TqZrcU+Tabdyr EqPjpS3636OV8s1osVZ/VkUadbW/Ivczl7tQssA2Enm5wr2i6s33+Spulvkq8DZvEcKx dN/b8Wy8r3Y1r9eJEFuNPHwUm8bGNdhxksYIi9V6qIFu41IS128Fm8JdYyzDZmSs26dc 8CXFqSuV5t5oRCE6WqMc3nwMRAK7UnqdtBViPC4BKg9oR5xhIQJro4UR+ZM829Stc3BX A/HA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:feedback-id:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=ZDrQX2E/8Gm+h9jr3Sp24vN+zs78htdqvnRGFuVo548=; fh=ngIuLxCpLpcXZqv2bX6HauW6w8f1aBuNm7P8CgAbpT8=; b=FhQqkKl+JIva3czDZVMlQ/8xMgdGTTyiDMFYVUlggPcUlZvhSHnSf2kugPP8x6xRK0 qQ73gOqrsgzajsEApikUUAyRjZzlA9UG8eqITYBvRnJQa9vpnrbUPR1CzsuNXIYlF9M5 IaHodr3iL/gL5frMKYcaaXll/0nLpXLRXfn67alchzKwZeqgo1S3m9Z5gDaWw5HnJdrd c9t7dWYZpdkAAZL+NPFDDRr3MDsIxJJn/IuO3+pm/HdRE926VwVk3r+jyc2FrJz8JCVL Zc6cU+zlc7q8zH2a4iP9H/uZFddeXngsSWjJcqp+nuugSAF3nvZFwV4U6/SUjjpgO6q4 3Dyw==; darn=isar-build.org ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm1 header.b=LFftE7Sa; spf=pass (google.com: domain of fm-1333022-2026072409552323f9c17cfe000207b2-4asgnq@rts-flowmailer.siemens.com designates 185.136.65.225 as permitted sender) smtp.mailfrom=fm-1333022-2026072409552323f9c17cfe000207b2-4ASgnq@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1784886927; x=1785491727; darn=isar-build.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:content-type:reply-to :x-original-authentication-results:x-original-sender:feedback-id :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=ZDrQX2E/8Gm+h9jr3Sp24vN+zs78htdqvnRGFuVo548=; b=fJELoOHCJDQBjpHPuMymz+Qe4KYb5t+d0CIS+RxewpEuBGroqmfoXlubIHtQgKqgoK EpTz1FKCvUW6mhRjGTXouKcZhLEszbzEh/wOtVcTPyNSOa2PLq/iLg1nkl371Vs9eYzR TtGyrw0eTXzl+nBK4PU80NHC6magkgYmOMmG2Rb4plARM/S/xmwTKKQ/fZP7fgngtdvl VlxfxEAzT6xt+utgXc/KU4MO0NpD4lrqFedodL1PGYfRgixJhgjSQsEhPRkhBJqzB7cV OCCagto2bYD4CpFYl+QOBGMbIwxmrjtn+hz363sX9boaxgeO+kWS0DQ75ccxDaFLMe5O /nHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784886927; x=1785491727; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :content-type:reply-to:x-original-authentication-results :x-original-sender:feedback-id:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-beenthere:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to:content-type; bh=ZDrQX2E/8Gm+h9jr3Sp24vN+zs78htdqvnRGFuVo548=; b=GkRZxFB3GqZX0wF2L0ZLMuE55MYCA1mpfS0hj3i/aYw67Hvj7spdLCh2jVqNXYqevR Mx5DOMXvCXbwWY7Aq+2OPDZhUNBdU7Bn6WwBIG4zFhfeKxzRSMGW/ino/AaU253qHTIC zTZ5jd6CsUMamsl+GR0WbAom6JnzHZuxmVeR7JIlnnKgfVvBLIysMGv26xFKOD///fFF TKql7Wlg6eWEEfd7/mfuQn6emaHG87rf84zgDRh87xxf1jv9xZ5mFWrwxE+7qJMQdhYY bFmZKiuQtSD0RtGz7wwmh41WIABQfQLlbEA6HyBy3PL8jbDVycBOAXlQwNTQTBcr/OOA ckAg== X-Forwarded-Encrypted: i=2; AHgh+Rp6V6ROrAxD5kPXB/b7YkKNeVseFbw5faLe8F30wpHdM0ty1LjX+4hvY6QQyVFEllprHcN8hKo=@isar-build.org X-Gm-Message-State: AOJu0YwyE2ZUC2jta8nOU7sSS1T5gqKritI6NoxhCe8ekNP0JwqaUqVw VhijfGV0/Lq3E4wRJO69BTUKwvqh6riEIka0nqbreeHXISvUsXdoNlL5 X-Received: by 2002:a05:6512:3091:b0:5b0:312:21ca with SMTP id 2adb3069b0e04-5b2b2e54590mr796236e87.2.1784886927490; Fri, 24 Jul 2026 02:55:27 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="Aa7YSPSekF8tzkh0vrxarZ6xosNPtj/4YXsoCeBSBu3xecPAZg==" Received: by 2002:a05:6512:6411:b0:5b1:5cad:e908 with SMTP id 2adb3069b0e04-5b2b02656cels700032e87.0.-pod-prod-01-eu; Fri, 24 Jul 2026 02:55:25 -0700 (PDT) X-Received: by 2002:ac2:4a99:0:b0:5b0:113d:8ae5 with SMTP id 2adb3069b0e04-5b2b2e515f1mr938189e87.10.1784886925127; Fri, 24 Jul 2026 02:55:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1784886925; cv=none; d=google.com; s=arc-20260327; b=hIbTveMHlhxnukgXvpVXT/bcEn0Z9hIfCPiJjLUehOy8bB2j+qARAAJhTvoV2c8e8H tHNYw8i5CKZ+Pb2GqfuDPFQNOv//5gw096iLrfjSTTZlaRz8gpbH7k5aykMgMa9g+BiD JxoDjfTqLt50v28doKWXOBX+QuCTPme15ZJFJRyU0jy57xwE7a7fN/K2daMVTiCJC9D0 5m9ADXxrDYtrSIT6MM8xyiXpo54/ava1VxDHyQObcPK3PLV9gi5V7GPWJ2vXk0+MH5I7 nixGvPcgR2/jXpNWXjBOHESW28GbkwBMLD3b0ECuUWCY6cPyw3JD/DCijNNWLMSwo3ef Hjyw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=feedback-id:content-transfer-encoding:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature; bh=lXBZYC8Zgkmpzy1SgwziPOqAtwhJQOyTMxh0Z9Pa3OI=; fh=3YXhkv3MzUC5KRD01rKI4QMc8ThjW9m3G66agugPing=; b=I6d7ILUxJhq/u6+9nkCV5fwQtHytfeFqRSly2xm7l2x9z37V10QXjszK6vzuuwSTDi EfV8rz9csqSBDPztM4ID4shEkYC7vCBqSb30LtXSptlyeHXxKx3Mc2bRGxldi32MFSoF Hm6BQo2YJW+tbV+i2DANmZwIRextZ0nVxsufhldjYhSRNkK94HrypnAVZi4Fx8CqdWkO IuLxuXuVqmrHm01FKOIA//xvgpW29Wfzc38DILrY1xwYq0v8qIwDvINalylU1S7JomvS EMG2/RG5rh1Mer8U0qLyh6rqlnz9w4D8ZwuOEesuleqvHsgrAPCKL+mSjw7t9j4BXO8g QICg==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm1 header.b=LFftE7Sa; spf=pass (google.com: domain of fm-1333022-2026072409552323f9c17cfe000207b2-4asgnq@rts-flowmailer.siemens.com designates 185.136.65.225 as permitted sender) smtp.mailfrom=fm-1333022-2026072409552323f9c17cfe000207b2-4ASgnq@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net. [185.136.65.225]) by gmr-mx.google.com with ESMTPS id 2adb3069b0e04-5b2a9b154c6si186133e87.0.2026.07.24.02.55.24 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 24 Jul 2026 02:55:24 -0700 (PDT) Received-SPF: pass (google.com: domain of fm-1333022-2026072409552323f9c17cfe000207b2-4asgnq@rts-flowmailer.siemens.com designates 185.136.65.225 as permitted sender) client-ip=185.136.65.225; Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 2026072409552323f9c17cfe000207b2 for ; Fri, 24 Jul 2026 11:55:23 +0200 X-Patchwork-Original-From: "'Gourav Singh' via isar-users" From: "Singh, Gourav" To: isar-users@googlegroups.com Cc: felix.moessbauer@siemens.com, Gourav Singh Subject: [PATCH v2 1/1] rootfs: clean apt auth credentials from final rootfs by default Date: Fri, 24 Jul 2026 15:24:28 +0530 Message-Id: <20260724095428.192250-2-gouravsingh@siemens.com> In-Reply-To: <20260724095428.192250-1-gouravsingh@siemens.com> References: <20260724095428.192250-1-gouravsingh@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-1333022:519-21489:flowmailer X-Original-Sender: gouravsingh@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm1 header.b=LFftE7Sa; spf=pass (google.com: domain of fm-1333022-2026072409552323f9c17cfe000207b2-4asgnq@rts-flowmailer.siemens.com designates 185.136.65.225 as permitted sender) smtp.mailfrom=fm-1333022-2026072409552323f9c17cfe000207b2-4ASgnq@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Gourav Singh Reply-To: Gourav Singh Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,RCVD_IN_RP_CERTIFIED, RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= When ISAR_APT_CREDS is configured, apt writes authentication credentials to /etc/apt/auth.conf.d/isar.conf in the rootfs during the build. Add a `clean-apt-credentials` rootfs feature to rootfs.bbclass that removes this file during do_rootfs_postprocess to prevent credentials from being shipped in the final image or SDK sysroot. Enable the feature by default in image.bbclass and sdk.bbclass. Document the feature and opt-out in RECIPE-API-CHANGELOG.md. Signed-off-by: Gourav Singh --- RECIPE-API-CHANGELOG.md | 18 ++++++++++++++++++ meta/classes-recipe/image.bbclass | 1 + meta/classes-recipe/rootfs.bbclass | 6 ++++++ meta/classes-recipe/sdk.bbclass | 2 +- 4 files changed, 26 insertions(+), 1 deletion(-) -- 2.39.5 diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md index f5b84c84..19eada4a 100644 --- a/RECIPE-API-CHANGELOG.md +++ b/RECIPE-API-CHANGELOG.md @@ -1137,3 +1137,21 @@ targeting Microsoft Hyper-V virtual machines on amd64. The machine produces a `.vhdx` disk image using the WIC image type and GRUB as the bootloader. It supports Debian bullseye, bookworm and trixie. + +### Automatic cleanup of APT authentication credentials + +A new rootfs feature `clean-apt-credentials` has been added to +`rootfs.bbclass`. When enabled, it removes +`/etc/apt/auth.conf.d/isar.conf` from the rootfs during +`do_rootfs_postprocess`, ensuring that APT authentication +credentials set via `ISAR_APT_CREDS` are not shipped in the +final image or SDK sysroot. + +The feature is enabled by default in `image.bbclass` and +`sdk.bbclass` via `ROOTFS_FEATURES`. + +To opt out, remove the feature explicitly: + +``` +ROOTFS_FEATURES:remove = "clean-apt-credentials" +``` diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass index edd4f888..d02f99da 100644 --- a/meta/classes-recipe/image.bbclass +++ b/meta/classes-recipe/image.bbclass @@ -102,6 +102,7 @@ ROOTFS_FEATURES += "\ clean-debconf-cache \ populate-systemd-preset \ generate-sbom \ + clean-apt-credentials \ " ROOTFS_PACKAGES += "${IMAGE_PREINSTALL} ${@isar_multiarch_packages('IMAGE_INSTALL', d)}" ROOTFS_VARDEPS += "IMAGE_INSTALL" diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass index e17f711f..0845320e 100644 --- a/meta/classes-recipe/rootfs.bbclass +++ b/meta/classes-recipe/rootfs.bbclass @@ -35,6 +35,7 @@ ROOTFS_BASE_DISTRO ?= "${BASE_DISTRO}" # 'export-dpkg-status' - exports /var/lib/dpkg/status file to ${ROOTFS_DPKGSTATUS_DEPLOY_DIR} # 'clean-log-files' - delete log files that are not owned by packages # 'populate-systemd-preset' - enable systemd units according to systemd presets +# 'clean-apt-credentials' - remove apt auth credentials written by ISAR_APT_CREDS # only supported from bookworm / jammy on ROOTFS_FEATURES:remove:buster = "generate-sbom" @@ -531,6 +532,11 @@ rootfs_postprocess_clean_debconf_cache() { run_privileged rm -rf "${ROOTFSDIR}/var/cache/debconf/"* } +ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'clean-apt-credentials', 'rootfs_postprocess_clean_apt_credentials', '', d)}" +rootfs_postprocess_clean_apt_credentials() { + run_privileged rm -f "${ROOTFSDIR}/etc/apt/auth.conf.d/isar.conf" +} + ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'clean-pycache', 'rootfs_postprocess_clean_pycache', '', d)}" rootfs_postprocess_clean_pycache() { run_privileged find ${ROOTFSDIR}/usr -type f -name '*.pyc' -delete -print diff --git a/meta/classes-recipe/sdk.bbclass b/meta/classes-recipe/sdk.bbclass index 7a8d5ff4..d79de2bf 100644 --- a/meta/classes-recipe/sdk.bbclass +++ b/meta/classes-recipe/sdk.bbclass @@ -49,7 +49,7 @@ ROOTFS_ARCH:class-sdk = "${HOST_ARCH}" ROOTFS_DISTRO:class-sdk = "${@get_rootfs_distro(d)}" ROOTFS_PACKAGES:class-sdk = "sdk-files ${SDK_TOOLCHAIN} ${SDK_PREINSTALL} ${@isar_multiarch_packages('SDK_INSTALL', d)}" ROOTFS_VARDEPS:class-sdk = "SDK_INSTALL SDK_INCLUDE_ISAR_APT" -ROOTFS_FEATURES:append:class-sdk = " clean-package-cache generate-manifest export-dpkg-status generate-sbom" +ROOTFS_FEATURES:append:class-sdk = " clean-package-cache generate-manifest export-dpkg-status generate-sbom clean-apt-credentials" ROOTFS_MANIFEST_DEPLOY_DIR:class-sdk = "${DEPLOY_DIR_SDKCHROOT}" ROOTFS_DPKGSTATUS_DEPLOY_DIR:class-sdk = "${DEPLOY_DIR_SDKCHROOT}"